commit 05f7e89ab9731565d8a62e3b5d1ec206485eeb0b Author: Linus Torvalds Date: Sun Feb 8 13:03:27 2026 -0800 Linux 6.19 commit e98f34af61167aee238e666bfbc97d1620afd88a Merge: e7aa5724770073 b126097b032743 Author: Linus Torvalds Date: Sun Feb 8 09:17:46 2026 -0800 Merge tag 'i2c-for-6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: - imx: preserve error state during SMBus block read length handling * tag 'i2c-for-6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: imx: preserve error state in block data length handler commit e7aa57247700733e52a8e2e4dee6a52c2a76de02 Merge: 142fdd7bb7095c a0a75b40c919b9 Author: Linus Torvalds Date: Sat Feb 7 09:37:34 2026 -0800 Merge tag 'spi-fix-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "One final batch of fixes for the Tegra SPI drivers, the main one is a batch of fixes for races with the interrupts in the Tegra210 QSPI driver that Breno has been working on for a while" * tag 'spi-fix-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: tegra114: Preserve SPI mode bits in def_command1_reg spi: tegra: Fix a memory leak in tegra_slink_probe() spi: tegra210-quad: Protect curr_xfer check in IRQ handler spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one spi: tegra210-quad: Move curr_xfer read inside spinlock spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer commit 142fdd7bb7095c114d027b1ee36878a67b869228 Merge: b0e7d3f88e563b 41399c5d476156 Author: Linus Torvalds Date: Sat Feb 7 09:34:49 2026 -0800 Merge tag 'regulator-fix-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One last fix for v6.19: the voltages for the SpaceMIT P1 were not described correctly" * tag 'regulator-fix-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: spacemit-p1: Fix n_voltages for BUCK and LDO regulators commit b0e7d3f88e563b5ca793fca23c7d7fa1352c1079 Merge: dda5df9823630a ec4ddc90d201d0 Author: Linus Torvalds Date: Sat Feb 7 09:27:57 2026 -0800 Merge tag 'char-misc-6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull binder fixes from Greg KH: "Here are some small, last-minute binder C and Rust driver fixes for reported issues. They include a number of fixes for reported crashes and other problems. All of these have been in linux-next this week, and longer" * tag 'char-misc-6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: binderfs: fix ida_alloc_max() upper bound rust_binderfs: fix ida_alloc_max() upper bound binder: fix BR_FROZEN_REPLY error log rust_binder: add additional alignment checks binder: fix UAF in binder_netlink_report() rust_binder: correctly handle FDA objects of length zero commit dda5df9823630a26ed24ca9150b33a7f56ba4546 Merge: 7e0b172c80ad79 4463c7aa11a6e6 Author: Linus Torvalds Date: Sat Feb 7 09:10:42 2026 -0800 Merge tag 'sched-urgent-2026-02-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Miscellaneous MMCID fixes to address bugs and performance regressions in the recent rewrite of the SCHED_MM_CID management code: - Fix livelock triggered by BPF CI testing - Fix hard lockup on weakly ordered systems - Simplify the dropping of CIDs in the exit path by removing an unintended transition phase - Fix performance/scalability regression on a thread-pool benchmark by optimizing transitional CIDs when scheduling out" * tag 'sched-urgent-2026-02-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/mmcid: Optimize transitional CIDs when scheduling out sched/mmcid: Drop per CPU CID immediately when switching to per task mode sched/mmcid: Protect transition on weakly ordered systems sched/mmcid: Prevent live lock on task to CPU mode transition commit 7e0b172c80ad797061dfa32e18bf908c81ceab0e Merge: 2687c848e57820 f495054bd12e2a Author: Linus Torvalds Date: Sat Feb 7 08:21:21 2026 -0800 Merge tag 'objtool-urgent-2026-02-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar:: - Bump up the Clang minimum version requirements for livepatch builds, due to Clang assembler section handling bugs causing silent miscompilations - Strip livepatching symbol artifacts from non-livepatch modules - Fix livepatch build warnings when certain Clang LTO options are enabled - Fix livepatch build error when CONFIG_MEM_ALLOC_PROFILING_DEBUG=y * tag 'objtool-urgent-2026-02-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool/klp: Fix unexported static call key access for manually built livepatch modules objtool/klp: Fix symbol correlation for orphaned local symbols livepatch: Free klp_{object,func}_ext data after initialization livepatch: Fix having __klp_objects relics in non-livepatch modules livepatch/klp-build: Require Clang assembler >= 20 commit 2687c848e57820651b9f69d30c4710f4219f7dbf Author: Josh Poimboeuf Date: Fri Feb 6 14:24:55 2026 -0800 x86/vmware: Fix hypercall clobbers Fedora QA reported the following panic: BUG: unable to handle page fault for address: 0000000040003e54 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20251119-3.fc43 11/19/2025 RIP: 0010:vmware_hypercall4.constprop.0+0x52/0x90 .. Call Trace: vmmouse_report_events+0x13e/0x1b0 psmouse_handle_byte+0x15/0x60 ps2_interrupt+0x8a/0xd0 ... because the QEMU VMware mouse emulation is buggy, and clears the top 32 bits of %rdi that the kernel kept a pointer in. The QEMU vmmouse driver saves and restores the register state in a "uint32_t data[6];" and as a result restores the state with the high bits all cleared. RDI originally contained the value of a valid kernel stack address (0xff5eeb3240003e54). After the vmware hypercall it now contains 0x40003e54, and we get a page fault as a result when it is dereferenced. The proper fix would be in QEMU, but this works around the issue in the kernel to keep old setups working, when old kernels had not happened to keep any state in %rdi over the hypercall. In theory this same issue exists for all the hypercalls in the vmmouse driver; in practice it has only been seen with vmware_hypercall3() and vmware_hypercall4(). For now, just mark RDI/RSI as clobbered for those two calls. This should have a minimal effect on code generation overall as it should be rare for the compiler to want to make RDI/RSI live across hypercalls. Reported-by: Justin Forbes Link: https://lore.kernel.org/all/99a9c69a-fc1a-43b7-8d1e-c42d6493b41f@broadcom.com/ Signed-off-by: Josh Poimboeuf Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 3dc58c9ce1c5802fec680cb8e95962f1430d5771 Merge: bab849a908496a ae9fd76c111bb4 Author: Linus Torvalds Date: Fri Feb 6 13:07:47 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-02-06-12-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "A couple of late-breaking MM fixes. One against a new-in-this-cycle patch and the other addresses a locking issue which has been there for over a year" * tag 'mm-hotfixes-stable-2026-02-06-12-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/memory-failure: reject unsupported non-folio compound page procfs: avoid fetching build ID while holding VMA lock commit bab849a908496a593af61a9832eea26f1ec3e279 Merge: 240b8d82274683 033c55fe2e326b Author: Linus Torvalds Date: Fri Feb 6 12:37:28 2026 -0800 Merge tag 'trace-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: - Fix event format field alignments for 32 bit architectures The fields in the event format files are used to parse the raw binary buffer data by applications. If they are incorrect, then the application produces garbage. On 32 bit architectures, the function graph 64bit calltime and rettime were off by 4bytes. That's because the actual fields are in a packed structure but the macros used by the ftrace events did not mark them as packed, and instead, gave them their natural alignment which made their offsets off by 4 bytes. There are macros to have a packed field within an embedded structure of an event, but there's no macro for normal fields within a packed structure of the event. The macro __field_packed() was used for the packed embedded structure field. Rename that to __field_desc_packed() (to match the non-packed embedded field macro __field_desc()), and make __field_packed() for fields that are in a packed event structure (which matches the unpacked __field() macro). Switch the calltime and rettime fields of the function graph event to use the new __field_packed() and this makes the offsets correct. * tag 'trace-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix ftrace event field alignments commit 240b8d8227468344e814c6bc7eb8ae532e3b8a09 Merge: 23b0d2f7c28640 7987cce375ac8c Author: Linus Torvalds Date: Fri Feb 6 10:34:17 2026 -0800 Merge tag 'ceph-for-6.19-rc9' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "One RBD and two CephFS fixes which address potential oopses. The RBD thing is more of a rare edge case that pops up in our CI, while the two CephFS scenarios are regressions that were reported by users and can be triggered trivially in normal operation. All marked for stable" * tag 'ceph-for-6.19-rc9' of https://github.com/ceph/ceph-client: ceph: fix NULL pointer dereference in ceph_mds_auth_match() ceph: fix oops due to invalid pointer for kfree() in parse_longname() rbd: check for EOD after exclusive lock is ensured to be held commit 23b0d2f7c2864099fba140672017e3e69ddf88a0 Merge: fe70b3260e39ce c33efdfcfa6f80 Author: Linus Torvalds Date: Fri Feb 6 10:27:42 2026 -0800 Merge tag 'dma-mapping-6.19-2026-02-06' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two minor fixes for the DMA-mapping subsystem: - check for the rare case of the allocation failure of the global CMA pool (Shanker Donthineni) - avoid perf buffer overflow when tracing large scatter-gather lists (Deepanshu Kartikey)" * tag 'dma-mapping-6.19-2026-02-06' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma: contiguous: Check return value of dma_contiguous_reserve_area() tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow commit fe70b3260e39ce4915a01cf3556a3ffe5b7f8817 Merge: 0dbc3577107008 02f9d76a76adb5 Author: Linus Torvalds Date: Fri Feb 6 10:19:54 2026 -0800 Merge tag 'iommu-fix-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fix from Joerg Roedel: - Fix wrong definition of PASID_FLAG_PWSNP bit. This caused DMAR errors on Arrow Lake platforms. * tag 'iommu-fix-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/vt-d: Treat PAGE_SNOOP and PWSNP separately commit 0dbc3577107008883a9d4275e4b67cd3b4dfacf5 Merge: 8aa3041808b5dc e2c4c5b2bbd4f6 Author: Linus Torvalds Date: Fri Feb 6 10:10:39 2026 -0800 Merge tag 'pmdomain-v6.19-rc3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: - Fix system wakeup support for imx8mp power domains - Fix potential out-of-range access for imx8m power domains - Fix the imx8mm gpu hang - qcom: Fix off-by-one error for highest state in rpmpd * tag 'pmdomain-v6.19-rc3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state commit 8aa3041808b5dcf43f4964a5b58cd44652d772a8 Merge: 8770bd8f91749d e34f77b09080c8 Author: Linus Torvalds Date: Fri Feb 6 10:05:35 2026 -0800 Merge tag 'gpio-fixes-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix incorrect retval check in gpio-loongson-64bit - fix GPIO counting with ACPI * tag 'gpio-fixes-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() gpiolib: acpi: Fix gpio count with string references commit 8770bd8f91749dfd05714447dfbd511147cb9576 Merge: 5ca98c22b5c450 51db05283f7c9c Author: Linus Torvalds Date: Fri Feb 6 09:59:40 2026 -0800 Merge tag 'sound-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. It became a bit larger than wished, but all of them are device-specific small fixes, and it should be still fairly safe to take at the last minute. Included are a few quirks and fixes for Intel, AMD, HD-audio, and USB-audio, as well as a race fix in aloop driver and corrections of Cirrus firmware kunit test" * tag 'sound-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() ASoC: dt-bindings: ti,tlv320aic3x: Add compatible string ti,tlv320aic23 ASoC: amd: fix memory leak in acp3x pdm dma ops ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() ALSA: aloop: Fix racy access at PCM trigger ASoC: rt1320: fix intermittent no-sound issue ASoC: SOF: Intel: use hdev->info.link_mask directly firmware: cs_dsp: rate-limit log messages in KUnit builds ASoC: amd: yc: Add quirk for HP 200 G2a 16 ASoC: cs42l43: Correct handling of 3-pole jack load detection ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with cs42l43 commit 5ca98c22b5c4507fad4513a504d7c5ec46cd0386 Merge: f896d1c03e8dba e6c53ead2d8fa7 Author: Linus Torvalds Date: Fri Feb 6 09:56:03 2026 -0800 Merge tag 'slab-for-6.19-rc8-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: "A stable fix for memory allocation profiling tag not being cleared when aborting an allocation due to memcg charge failure (Hao Ge)" * tag 'slab-for-6.19-rc8-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single commit f896d1c03e8dba2178c14d717d188ea43db016e6 Merge: b7ff7151e653aa 23ea2a4c72323f Author: Linus Torvalds Date: Fri Feb 6 09:21:38 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM fix from Russell King: "Just one fix for memset64() on big endian 32-bit ARM systems" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9468/1: fix memset64() on big-endian commit 02f9d76a76adb5ea16b4e3b403496c42033f8fd1 Author: Viktor Kleen Date: Thu Feb 5 16:49:41 2026 +0800 iommu/vt-d: Treat PAGE_SNOOP and PWSNP separately The PASID_FLAG_PAGE_SNOOP and PASID_FLAG_PWSNP constants are identical. This will cause the pasid code to always set both or neither of the PGSNP and PWSNP bits in PASID table entries. However, PWSNP is a reserved bit if SMPWC is not set in the IOMMU's extended capability register, even if SC is supported. This has resulted in DMAR errors when testing the iommufd code on an Arrow Lake platform. With this patch, those errors disappear and the PASID table entries look correct. Fixes: 101a2854110fa ("iommu/vt-d: Follow PT_FEAT_DMA_INCOHERENT into the PASID entry") Cc: stable@vger.kernel.org Signed-off-by: Viktor Kleen Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20260202192109.1665799-1-viktor@kleen.org Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit e6c53ead2d8fa73206e0a63e9cd9aea6bc929837 Author: Hao Ge Date: Wed Feb 4 18:14:01 2026 +0800 mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single When CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the following warning may be noticed: [ 3959.023862] ------------[ cut here ]------------ [ 3959.023891] alloc_tag was not cleared (got tag for lib/xarray.c:378) [ 3959.023947] WARNING: ./include/linux/alloc_tag.h:155 at alloc_tag_add+0x128/0x178, CPU#6: mkfs.ntfs/113998 [ 3959.023978] Modules linked in: dns_resolver tun brd overlay exfat btrfs blake2b libblake2b xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink sr_mod virtio_gpu cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper ghash_ce drm sm4 backlight virtio_net net_failover virtio_scsi failover virtio_console virtio_blk virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod i2c_dev aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject] [ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary) [ 3959.024182] Tainted: [W]=WARN [ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 3959.024199] pc : alloc_tag_add+0x128/0x178 [ 3959.024207] lr : alloc_tag_add+0x128/0x178 [ 3959.024214] sp : ffff80008b696d60 [ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240 [ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860 [ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0 [ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000 [ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293 [ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000 [ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001 [ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838 [ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640 [ 3959.024340] Call trace: [ 3959.024346] alloc_tag_add+0x128/0x178 (P) [ 3959.024355] __alloc_tagging_slab_alloc_hook+0x11c/0x1a8 [ 3959.024362] kmem_cache_alloc_lru_noprof+0x1b8/0x5e8 [ 3959.024369] xas_alloc+0x304/0x4f0 [ 3959.024381] xas_create+0x1e0/0x4a0 [ 3959.024388] xas_store+0x68/0xda8 [ 3959.024395] __filemap_add_folio+0x5b0/0xbd8 [ 3959.024409] filemap_add_folio+0x16c/0x7e0 [ 3959.024416] __filemap_get_folio_mpol+0x2dc/0x9e8 [ 3959.024424] iomap_get_folio+0xfc/0x180 [ 3959.024435] __iomap_get_folio+0x2f8/0x4b8 [ 3959.024441] iomap_write_begin+0x198/0xc18 [ 3959.024448] iomap_write_iter+0x2ec/0x8f8 [ 3959.024454] iomap_file_buffered_write+0x19c/0x290 [ 3959.024461] blkdev_write_iter+0x38c/0x978 [ 3959.024470] vfs_write+0x4d4/0x928 [ 3959.024482] ksys_write+0xfc/0x1f8 [ 3959.024489] __arm64_sys_write+0x74/0xb0 [ 3959.024496] invoke_syscall+0xd4/0x258 [ 3959.024507] el0_svc_common.constprop.0+0xb4/0x240 [ 3959.024514] do_el0_svc+0x48/0x68 [ 3959.024520] el0_svc+0x40/0xf8 [ 3959.024526] el0t_64_sync_handler+0xa0/0xe8 [ 3959.024533] el0t_64_sync+0x1ac/0x1b0 [ 3959.024540] ---[ end trace 0000000000000000 ]--- When __memcg_slab_post_alloc_hook() fails, there are two different free paths depending on whether size == 1 or size != 1. In the kmem_cache_free_bulk() path, we do call alloc_tagging_slab_free_hook(). However, in memcg_alloc_abort_single() we don't, the above warning will be triggered on the next allocation. Therefore, add alloc_tagging_slab_free_hook() to the memcg_alloc_abort_single() path. Fixes: 9f9796b413d3 ("mm, slab: move memcg charging to post-alloc hook") Cc: stable@vger.kernel.org Suggested-by: Hao Li Signed-off-by: Hao Ge Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20260204101401.202762-1-hao.ge@linux.dev Signed-off-by: Vlastimil Babka commit b7ff7151e653aa296ab6c5495b2c1ab7c21eb250 Merge: 8185461e531c39 831a2b27914cc8 Author: Linus Torvalds Date: Thu Feb 5 21:33:22 2026 -0800 Merge tag 'hwmon-for-v6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - occ: Mark occ_init_attribute() as __printf to avoid build failure due to '-Werror=suggest-attribute=format' - gpio-fan: Allow to stop fans when CONFIG_PM is disabled, and fix set_rpm() return value - acpi_power_meter: Fix deadlocks related to acpi_power_meter_notify() - dell-smm: Add Dell G15 5510 to fan control whitelist * tag 'hwmon-for-v6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (occ) Mark occ_init_attribute() as __printf hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled hwmon: (gpio-fan) Fix set_rpm() return value hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelist commit 8185461e531c39d67aa4705d7f94873feb87adfd Merge: 06bc4e26310f9f 7ef92d2ecef748 Author: Linus Torvalds Date: Thu Feb 5 19:56:47 2026 -0800 Merge tag 'drm-fixes-2026-02-06' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "The usual xe/amdgpu selection, and a couple of misc changes for gma500, mgag200 and bridge. There is a nouveau revert, and also a set of changes that fix a regression since we moved to 570 firmware. Suspend/resume was broken on a bunch of GPUs. The fix looks big, but it's mostly just refactoring to pass an extra bit down the nouveau abstractions to the firmware command. amdgpu: - MES 11 old firmware compatibility fix - ASPM fix - DC LUT fixes amdkfd: - Fix possible double deletion of validate list xe: - Fix topology query pointer advance - A couple of kerneldoc fixes - Disable D3Cold for BMG only on specific platforms - Fix CFI violation in debugfs access nouveau: - Revert adding atomic commit functions as it regresses pre-nv50 - Fix suspend/resume bugs exposed by enabling 570 firmware gma500: - Revert a regression caused by vblank changes mgag200: - Replace a busy loop with a polling loop to fix that blocking 1 cpu for 300 ms roughly every 20 minutes bridge: - imx8mp-hdmi-pa: Use runtime pm to fix a bug in channel ordering" * tag 'drm-fixes-2026-02-06' of https://gitlab.freedesktop.org/drm/kernel: drm/xe/guc: Fix CFI violation in debugfs access. drm/bridge: imx8mp-hdmi-pai: enable PM runtime drm/xe/pm: Disable D3Cold for BMG only on specific platforms drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early drm/xe: Fix kerneldoc for xe_migrate_exec_queue drm/xe/query: Fix topology query pointer advance drm/mgag200: fix mgag200_bmc_stop_scanout() nouveau/gsp: fix suspend/resume regression on r570 firmware nouveau: add a third state to the fini handler. nouveau/gsp: use rpc sequence numbers properly. drm/amdgpu: Fix double deletion of validate_list drm/amd/display: remove assert around dpp_base replacement drm/amd/display: extend delta clamping logic to CM3 LUT helper drm/amd/display: fix wrong color value mapping on MCM shaper LUT Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52 Revert "drm/gma500: use drm_crtc_vblank_crtc()" Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" commit 7ef92d2ecef7486d46eda0f911dc53b873fdf567 Merge: cb8455cbf34379 6b61a54e684006 Author: Dave Airlie Date: Fri Feb 6 12:44:46 2026 +1000 Merge tag 'amd-drm-fixes-6.19-2026-02-05' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-02-05: amdgpu: - MES 11 old firmware compatibility fix - ASPM fix - DC LUT fixes amdkfd: - Fix possible double deletion of validate list Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260205182017.2409773-1-alexander.deucher@amd.com commit cb8455cbf343791eea3c9fa142807a99c186b323 Merge: 4e3b2f0db48ebc 4cb1b327135ddd Author: Dave Airlie Date: Fri Feb 6 12:41:35 2026 +1000 Merge tag 'drm-xe-fixes-2026-02-05' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix topology query pointer advance (Shuicheng) - A couple of kerneldoc fixes (Shuicheng) - Disable D3Cold for BMG only on specific platforms (Karthik) - Fix CFI violation in debugfs access (Daniele) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aYS2v12R8ELQoTiZ@fedora commit 4e3b2f0db48ebc277855dace4b4b746f166fecb3 Merge: 18f7fcd5e69a04 40b24d9cdd4141 Author: Dave Airlie Date: Fri Feb 6 12:24:38 2026 +1000 Merge tag 'drm-misc-fixes-2026-02-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19 final: nouveau ------- Revert adding atomic commit functions as it regresses pre-nv50. Fix bugs exposed by enabling 570 firmware. gma500 ------ Revert a regression caused by vblank changes. mgag200 ------- Replace a busy loop with a polling loop to fix that blocking 1 cpu for 300 ms roughly every 20 minutes. bridge ------ imx8mp-hdmi-pa: Use runtime pm to fix a bug in channel ordering. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/c0077ea5-faeb-4b0c-bd4a-ea2384d6dc0c@linux.intel.com commit 06bc4e26310f9f2c0dd2fbf4885483306c5235cb Merge: 92f778a0b17a3d a6abd64e145ca3 Author: Linus Torvalds Date: Thu Feb 5 15:00:53 2026 -0800 Merge tag 'block-6.19-20260205' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Revert of a change for loop, which caused regressions for some users (Actually revert of two commits, where one is just an existing fix for the offending commit) - NVMe pull via Keith: - Fix NULL pointer access setting up dma mappings - Fix invalid memory access from malformed TCP PDU * tag 'block-6.19-20260205' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: loop: revert exclusive opener loop status change nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvme-pci: handle changing device dma map requirements commit 92f778a0b17a3d4d0b0200a5fb164c5107063044 Merge: 49233c41cf8546 38cfdd9dd27947 Author: Linus Torvalds Date: Thu Feb 5 14:40:06 2026 -0800 Merge tag 'io_uring-6.19-20260205' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Two small fixes for zcrx - Two small fixes for fdinfo - one is just killing a superflous newline * tag 'io_uring-6.19-20260205' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/fdinfo: be a bit nicer when looping a lot of SQEs/CQEs io_uring/fdinfo: kill unnecessary newline feed in CQE32 printing io_uring/zcrx: fix rq flush locking io_uring/zcrx: fix page array leak commit ae9fd76c111bb4a5293c2831a1ad373605251dd6 Author: Miaohe Lin Date: Thu Feb 5 15:53:28 2026 +0800 mm/memory-failure: reject unsupported non-folio compound page When !CONFIG_TRANSPARENT_HUGEPAGE, a non-folio compound page can appear in a userspace mapping via either vm_insert_*() functions or vm_operatios_struct->fault(). They are not folios, thus should not be considered for folio operations like split. To reject these pages, make sure get_hwpoison_page() is always called as HWPoisonHandlable() will do the right work. [Some commit log borrowed from Zi Yan. Thanks.] Link: https://lkml.kernel.org/r/20260205075328.523211-1-linmiaohe@huawei.com Fixes: 689b8986776c ("mm/memory-failure: improve large block size folio handling") Signed-off-by: Miaohe Lin Reported-by: 是参差 Closes: https://lore.kernel.org/all/PS1PPF7E1D7501F1E4F4441E7ECD056DEADAB98A@PS1PPF7E1D7501F.apcprd02.prod.outlook.com/ Reviewed-by: Zi Yan Tested-by: Zi Yan Cc: David Hildenbrand Cc: Jane Chu Cc: Miaohe Lin Cc: Naoya Horiguchi Signed-off-by: Andrew Morton commit b5cbacd7f86f4f62b8813688c8e73be94e8e1951 Author: Andrii Nakryiko Date: Thu Jan 29 13:53:40 2026 -0800 procfs: avoid fetching build ID while holding VMA lock Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, whichever was used to lock VMA under question, to avoid deadlock reported by syzbot: -> #1 (&mm->mmap_lock){++++}-{4:4}: __might_fault+0xed/0x170 _copy_to_iter+0x118/0x1720 copy_page_to_iter+0x12d/0x1e0 filemap_read+0x720/0x10a0 blkdev_read_iter+0x2b5/0x4e0 vfs_read+0x7f4/0xae0 ksys_read+0x12a/0x250 do_syscall_64+0xcb/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&sb->s_type->i_mutex_key#8){++++}-{4:4}: __lock_acquire+0x1509/0x26d0 lock_acquire+0x185/0x340 down_read+0x98/0x490 blkdev_read_iter+0x2a7/0x4e0 __kernel_read+0x39a/0xa90 freader_fetch+0x1d5/0xa80 __build_id_parse.isra.0+0xea/0x6a0 do_procmap_query+0xd75/0x1050 procfs_procmap_ioctl+0x7a/0xb0 __x64_sys_ioctl+0x18e/0x210 do_syscall_64+0xcb/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(&mm->mmap_lock); lock(&sb->s_type->i_mutex_key#8); lock(&mm->mmap_lock); rlock(&sb->s_type->i_mutex_key#8); *** DEADLOCK *** This seems to be exacerbated (as we haven't seen these syzbot reports before that) by the recent: 777a8560fd29 ("lib/buildid: use __kernel_read() for sleepable context") To make this safe, we need to grab file refcount while VMA is still locked, but other than that everything is pretty straightforward. Internal build_id_parse() API assumes VMA is passed, but it only needs the underlying file reference, so just add another variant build_id_parse_file() that expects file passed directly. [akpm@linux-foundation.org: fix up kerneldoc] Link: https://lkml.kernel.org/r/20260129215340.3742283-1-andrii@kernel.org Fixes: ed5d583a88a9 ("fs/procfs: implement efficient VMA querying API for /proc//maps") Signed-off-by: Andrii Nakryiko Reported-by: Reviewed-by: Suren Baghdasaryan Tested-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Eduard Zingerman Cc: Hao Luo Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Song Liu Cc: Stanislav Fomichev Cc: Yonghong Song Cc: Signed-off-by: Andrew Morton commit a0a75b40c919b9f6d3a0b6c978e6ccf344c1be5a Author: Vishwaroop A Date: Wed Feb 4 14:12:12 2026 +0000 spi: tegra114: Preserve SPI mode bits in def_command1_reg The COMMAND1 register bits [29:28] set the SPI mode, which controls the clock idle level. When a transfer ends, tegra_spi_transfer_end() writes def_command1_reg back to restore the default state, but this register value currently lacks the mode bits. This results in the clock always being configured as idle low, breaking devices that need it high. Fix this by storing the mode bits in def_command1_reg during setup, to prevent this field from always being cleared. Fixes: f333a331adfa ("spi/tegra114: add spi driver") Signed-off-by: Vishwaroop A Link: https://patch.msgid.link/20260204141212.1540382-1-va@nvidia.com Signed-off-by: Mark Brown commit 49233c41cf8546b94d213a5dd877ef07e61b1f3f Merge: 8fdb05de0e2db8 2005aabe94eaab Author: Linus Torvalds Date: Thu Feb 5 11:19:26 2026 -0800 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull dcache fixes from Al Viro: "A couple of regression fixes for the tree-in-dcache series this cycle" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions rust_binderfs: fix a dentry leak commit 2005aabe94eaab8608879d98afb901bc99bc3a31 Author: Al Viro Date: Sat Jan 31 18:24:41 2026 -0500 functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions When all files are closed, functionfs needs ffs_data_reset() to be done before any further opens are allowed. During that time we have ffs->state set to FFS_CLOSING; that makes ->open() fail with -EBUSY. Once ffs_data_reset() is done, it switches state (to FFS_READ_DESCRIPTORS) indicating that opening that thing is allowed again. There's a couple of additional twists: * mounting with -o no_disconnect delays ffs_data_reset() from doing that at the final ->release() to the first subsequent open(). That's indicated by ffs->state set to FFS_DEACTIVATED; if open() sees that, it immediately switches to FFS_CLOSING and proceeds with doing ffs_data_reset() before returning to userland. * a couple of usb callbacks need to force the delayed transition; unfortunately, they are done in locking environment that does not allow blocking and ffs_data_reset() can block. As the result, if these callbacks see FFS_DEACTIVATED, they change state to FFS_CLOSING and use schedule_work() to get ffs_data_reset() executed asynchronously. Unfortunately, the locking is rather insufficient. A fix attempted in e5bf5ee26663 ("functionfs: fix the open/removal races") had closed a bunch of UAF, but it didn't do anything to the callbacks, lacked barriers in transition from FFS_CLOSING to FFS_READ_DESCRIPTORS _and_ it had been too heavy-handed in open()/open() serialization - I've used ffs->mutex for that, and it's being held over actual IO on ep0, complete with copy_from_user(), etc. Even more unfortunately, the userland side is apparently racy enough to have the resulting timing changes (no failures, just a delayed return of open(2)) disrupt the things quite badly. Userland bugs or not, it's a clear regression that needs to be dealt with. Solution is to use a spinlock for serializing these state checks and transitions - unlike ffs->mutex it can be taken in these callbacks and it doesn't disrupt the timings in open(). We could introduce a new spinlock, but it's easier to use the one that is already there (ffs->eps_lock) instead - the locking environment is safe for it in all affected places. Since now it is held over all places that alter or check the open count (ffs->opened), there's no need to keep that atomic_t - int would serve just fine and it's simpler that way. Fixes: e5bf5ee26663 ("functionfs: fix the open/removal races") Fixes: 18d6b32fca38 ("usb: gadget: f_fs: add "no_disconnect" mode") # v4.0 Tested-by: Samuel Wu Signed-off-by: Al Viro commit 351ea48ae880b1673abcf232947c577183fdf712 Author: Al Viro Date: Mon Jan 26 01:05:57 2026 -0500 rust_binderfs: fix a dentry leak Parallel to binderfs patches - 02da8d2c0965 "binderfs_binder_ctl_create(): kill a bogus check" and the bit of b89aa544821d "convert binderfs" that got lost when making 4433d8e25d73 "convert rust_binderfs"; the former is a cleanup, the latter is about marking /binder-control persistent, so that it would be taken out on umount. Fixes: 4433d8e25d73 ("convert rust_binderfs") Acked-by: Alice Ryhl Acked-by: Christian Brauner Signed-off-by: Al Viro commit 8fdb05de0e2db89d8f56144c60ab784812e8c3b7 Merge: b20624608f350c bbf4a17ad9ffc4 Author: Linus Torvalds Date: Thu Feb 5 09:39:26 2026 -0800 Merge tag 'net-6.19-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless and Netfilter. Previous releases - regressions: - eth: stmmac: fix stm32 (and potentially others) resume regression - nf_tables: fix inverted genmask check in nft_map_catchall_activate() - usb: r8152: fix resume reset deadlock - fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for RSS contexts Previous releases - always broken: - sched: cls_u32: use skb_header_pointer_careful() to avoid OOB reads with malicious u32 rules - eth: ice: timestamping related fixes" * tag 'net-6.19-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits) ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() net: cpsw: Execute ndo_set_rx_mode callback in a work queue net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue gve: Correct ethtool rx_dropped calculation gve: Fix stats report corruption on queue count change selftest: net: add a test-case for encap segmentation after GRO net: gro: fix outer network offset net: add proper RCU protection to /proc/net/ptype net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() wifi: iwlwifi: mvm: pause TCM on fast resume wifi: iwlwifi: mld: cancel mlo_scan_start_wk net: spacemit: k1-emac: fix jumbo frame support net: enetc: Convert 16-bit register reads to 32-bit for ENETC v4 net: enetc: Convert 16-bit register writes to 32-bit for ENETC v4 net: enetc: Remove CBDR cacheability AXI settings for ENETC v4 net: enetc: Remove SI/BDR cacheability AXI settings for ENETC v4 tipc: use kfree_sensitive() for session key material net: stmmac: fix stm32 (and potentially others) resume regression net: rss: fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for contexts ... commit e34f77b09080c86c929153e2a72da26b4f8947ff Author: Chen Ni Date: Thu Feb 5 15:26:49 2026 +0800 gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() Fix incorrect NULL check in loongson_gpio_init_irqchip(). The function checks chip->parent instead of chip->irq.parents. Fixes: 03c146cb6cd1 ("gpio: loongson-64bit: Add support for Loongson-2K0300 SoC") Signed-off-by: Chen Ni Link: https://patch.msgid.link/20260205072649.3271158-1-nichen@iscas.ac.cn Signed-off-by: Bartosz Golaszewski commit bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25 Author: Shigeru Yoshida Date: Wed Feb 4 18:58:37 2026 +0900 ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF syzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6 route. [0] Commit f72514b3c569 ("ipv6: clear RA flags when adding a static route") introduced logic to clear RTF_ADDRCONF from existing routes when a static route with the same nexthop is added. However, this causes a problem when the existing route has a gateway. When RTF_ADDRCONF is cleared from a route that has a gateway, that route becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns true. The issue is that this route was never added to the fib6_siblings list. This leads to a mismatch between the following counts: - The sibling count computed by iterating fib6_next chain, which includes the newly ECMP-eligible route - The actual siblings in fib6_siblings list, which does not include that route When a subsequent ECMP route is added, fib6_add_rt2node() hits BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings) because the counts don't match. Fix this by only clearing RTF_ADDRCONF when the existing route does not have a gateway. Routes without a gateway cannot qualify for ECMP anyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing RTF_ADDRCONF on them is safe and matches the original intent of the commit. [0]: kernel BUG at net/ipv6/ip6_fib.c:1217! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217 [...] Call Trace: fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946 ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571 inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577 sock_do_ioctl+0xdc/0x300 net/socket.c:1245 sock_ioctl+0x576/0x790 net/socket.c:1366 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: f72514b3c569 ("ipv6: clear RA flags when adding a static route") Reported-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cb809def1baaac68ab92 Tested-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260204095837.1285552-1-syoshida@redhat.com Signed-off-by: Jakub Kicinski commit d9eb317812288700f15965fa20d7db22c54c5e9d Merge: 7d6ba706ae5ef7 f41c5d151078c5 Author: Jakub Kicinski Date: Thu Feb 5 08:38:02 2026 -0800 Merge tag 'nf-26-02-05' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: update for net This is one last-minute crash fix for nf_tables, from Andrew Fasano: Logical check is inverted, this makes kernel fail to correctly undo the transaction, leading to a use-after-free. * tag 'nf-26-02-05' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() ==================== Link: https://patch.msgid.link/20260205074450.3187-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit a6abd64e145ca3084b6a567e06517a7c2dbfd38d Author: Jens Axboe Date: Thu Feb 5 09:26:53 2026 -0700 loop: revert exclusive opener loop status change This commit effectively reverts the following two commits: 2704024d83fa ("loop: add missing bd_abort_claiming in loop_set_status") 08e136ebd193 ("loop: don't change loop device under exclusive opener in loop_set_status") as there are reports of them causing issues with unmounting. As we're close to the 6.19 kernel release and the original author hasn't taken a closer look at this yet, revert them for release. Reported-by: nokangaroo Link: https://lore.kernel.org/all/62de4453-17e8-47f6-a10b-39bf5a49fdee@leemhuis.info/ Signed-off-by: Jens Axboe commit f495054bd12e2abe5068e243bdf344b704c303c6 Author: Josh Poimboeuf Date: Mon Feb 2 11:00:17 2026 -0800 objtool/klp: Fix unexported static call key access for manually built livepatch modules Enabling CONFIG_MEM_ALLOC_PROFILING_DEBUG with CONFIG_SAMPLE_LIVEPATCH results in the following error: samples/livepatch/livepatch-shadow-fix1.o: error: objtool: static_call: can't find static_call_key symbol: __SCK__WARN_trap This is caused an extra file->klp sanity check which was added by commit 164c9201e1da ("objtool: Add base objtool support for livepatch modules"). That check was intended to ensure that livepatch modules built with klp-build always have full access to their static call keys. However, it failed to account for the fact that manually built livepatch modules (i.e., not built with klp-build) might need access to unexported static call keys, for which read-only access is typically allowed for modules. While the livepatch-shadow-fix1 module doesn't explicitly use any static calls, it does have a memory allocation, which can cause CONFIG_MEM_ALLOC_PROFILING_DEBUG to insert a WARN() call. And WARN() is now an unexported static call as of commit 860238af7a33 ("x86_64/bug: Inline the UD1"). Fix it by removing the overzealous file->klp check, restoring the original behavior for manually built livepatch modules. Fixes: 164c9201e1da ("objtool: Add base objtool support for livepatch modules") Reported-by: Arnd Bergmann Acked-by: Song Liu Tested-by: Arnd Bergmann Link: https://patch.msgid.link/0bd3ae9a53c3d743417fe842b740a7720e2bcd1c.1770058775.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit 18328546dd59b6adc111cf84a0ee4cdd3a867611 Author: Josh Poimboeuf Date: Mon Feb 2 10:01:08 2026 -0800 objtool/klp: Fix symbol correlation for orphaned local symbols When compiling with CONFIG_LTO_CLANG_THIN, vmlinux.o has __irf_[start|end] before the first FILE entry: $ readelf -sW vmlinux.o Symbol table '.symtab' contains 597706 entries: Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000000000 0 NOTYPE LOCAL DEFAULT 18 __irf_start 2: 0000000000000200 0 NOTYPE LOCAL DEFAULT 18 __irf_end 3: 0000000000000000 0 SECTION LOCAL DEFAULT 17 .text 4: 0000000000000000 0 SECTION LOCAL DEFAULT 18 .init.ramfs This causes klp-build warnings like: vmlinux.o: warning: objtool: no correlation: __irf_start vmlinux.o: warning: objtool: no correlation: __irf_end The problem is that Clang LTO is stripping the initramfs_data.o FILE symbol, causing those two symbols to be orphaned and not noticed by klp-diff's correlation logic. Add a loop to correlate any symbols found before the first FILE symbol. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Reported-by: Song Liu Acked-by: Song Liu Link: https://patch.msgid.link/e21ec1141fc749b5f538d7329b531c1ab63a6d1a.1770055235.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit b525fcaf0a76507f152d58c6f9e5ef67b3ff552c Author: Petr Pavlu Date: Fri Jan 23 11:26:57 2026 +0100 livepatch: Free klp_{object,func}_ext data after initialization The klp_object_ext and klp_func_ext data, which are stored in the __klp_objects and __klp_funcs sections, respectively, are not needed after they are used to create the actual klp_object and klp_func instances. This operation is implemented by the init function in scripts/livepatch/init.c. Prefix the two sections with ".init" so they are freed after the module is initializated. Signed-off-by: Petr Pavlu Acked-by: Joe Lawrence Acked-by: Miroslav Benes Reviewed-by: Aaron Tomlin Link: https://patch.msgid.link/20260123102825.3521961-3-petr.pavlu@suse.com Signed-off-by: Josh Poimboeuf commit ab10815472fcbc2c772dc21a979460b7f74f0145 Author: Petr Pavlu Date: Fri Jan 23 11:26:56 2026 +0100 livepatch: Fix having __klp_objects relics in non-livepatch modules The linker script scripts/module.lds.S specifies that all input __klp_objects sections should be consolidated into an output section of the same name, and start/stop symbols should be created to enable scripts/livepatch/init.c to locate this data. This start/stop pattern is not ideal for modules because the symbols are created even if no __klp_objects input sections are present. Consequently, a dummy __klp_objects section also appears in the resulting module. This unnecessarily pollutes non-livepatch modules. Instead, since modules are relocatable files, the usual method for locating consolidated data in a module is to read its section table. This approach avoids the aforementioned problem. The klp_modinfo already stores a copy of the entire section table with the final addresses. Introduce a helper function that scripts/livepatch/init.c can call to obtain the location of the __klp_objects section from this data. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Signed-off-by: Petr Pavlu Acked-by: Joe Lawrence Acked-by: Miroslav Benes Reviewed-by: Aaron Tomlin Link: https://patch.msgid.link/20260123102825.3521961-2-petr.pavlu@suse.com Signed-off-by: Josh Poimboeuf commit 7e210d5e934c8af0f74a1e1b4852a8996a6cb5a5 Merge: 4da7c5c3ec34d8 52a0a98549344c Author: Jens Axboe Date: Thu Feb 5 08:44:31 2026 -0700 Merge tag 'nvme-6.19-2026-02-05' of git://git.infradead.org/nvme into block-6.19 Pull NVMe fixes from Keith: "- Fix NULL pointer access setting up dma mappings (Keith) - Fix invalid memory access from malformed TCP PDU (YunJe)" * tag 'nvme-6.19-2026-02-05' of git://git.infradead.org/nvme: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvme-pci: handle changing device dma map requirements commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c Author: YunJe Shin Date: Wed Jan 28 09:41:07 2026 +0900 nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: YunJe Shin Reviewed-by: Sagi Grimberg Reviewed-by: Joonkyo Jung Signed-off-by: Keith Busch commit 071be3b0b6575d45be9df9c5b612f5882bfc5e88 Author: Keith Busch Date: Wed Feb 4 06:29:11 2026 -0800 nvme-pci: handle changing device dma map requirements The initial state of dma_needs_unmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the result. The nvme driver needs to save the mapped dma vectors to be unmapped later, so allocate as needed during iteration rather than assume it was always allocated at the beginning. This fixes a NULL dereference from accessing an uninitialized dma_vecs when the device dma unmapping requirements change mid-iteration. Fixes: b8b7570a7ec8 ("nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping") Link: https://lore.kernel.org/linux-nvme/20260202125738.1194899-1-pradeep.pragallapati@oss.qualcomm.com/ Reported-by: Pradeep P V K Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 033c55fe2e326bea022c3cc5178ecf3e0e459b82 Author: Steven Rostedt Date: Wed Feb 4 11:36:28 2026 -0500 tracing: Fix ftrace event field alignments The fields of ftrace specific events (events used to save ftrace internal events like function traces and trace_printk) are generated similarly to how normal trace event fields are generated. That is, the fields are added to a trace_events_fields array that saves the name, offset, size, alignment and signness of the field. It is used to produce the output in the format file in tracefs so that tooling knows how to parse the binary data of the trace events. The issue is that some of the ftrace event structures are packed. The function graph exit event structures are one of them. The 64 bit calltime and rettime fields end up 4 byte aligned, but the algorithm to show to userspace shows them as 8 byte aligned. The macros that create the ftrace events has one for embedded structure fields. There's two macros for theses fields: __field_desc() and __field_packed() The difference of the latter macro is that it treats the field as packed. Rename that field to __field_desc_packed() and create replace the __field_packed() to be a normal field that is packed and have the calltime and rettime use those. This showed up on 32bit architectures for function graph time fields. It had: ~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format [..] field:unsigned long func; offset:8; size:4; signed:0; field:unsigned int depth; offset:12; size:4; signed:0; field:unsigned int overrun; offset:16; size:4; signed:0; field:unsigned long long calltime; offset:24; size:8; signed:0; field:unsigned long long rettime; offset:32; size:8; signed:0; Notice that overrun is at offset 16 with size 4, where in the structure calltime is at offset 20 (16 + 4), but it shows the offset at 24. That's because it used the alignment of unsigned long long when used as a declaration and not as a member of a structure where it would be aligned by word size (in this case 4). By using the proper structure alignment, the format has it at the correct offset: ~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format [..] field:unsigned long func; offset:8; size:4; signed:0; field:unsigned int depth; offset:12; size:4; signed:0; field:unsigned int overrun; offset:16; size:4; signed:0; field:unsigned long long calltime; offset:20; size:8; signed:0; field:unsigned long long rettime; offset:28; size:8; signed:0; Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: Mark Rutland Acked-by: Masami Hiramatsu (Google) Reported-by: "jempty.liang" Link: https://patch.msgid.link/20260204113628.53faec78@gandalf.local.home Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()") Closes: https://lore.kernel.org/all/20260130015740.212343-1-imntjempty@163.com/ Closes: https://lore.kernel.org/all/20260202123342.2544795-1-imntjempty@163.com/ Signed-off-by: Steven Rostedt (Google) commit e2c4c5b2bbd4f688a0f9f6da26cdf6d723c53478 Author: Xu Yang Date: Wed Feb 4 19:11:42 2026 +0800 pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup USB system wakeup need its PHY on, so add the GENPD_FLAG_ACTIVE_WAKEUP flags to USB PHY genpd configuration. Signed-off-by: Xu Yang Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit e9ab2b83893dd03cf04d98faded81190e635233f Author: Xu Yang Date: Wed Feb 4 19:11:41 2026 +0800 pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup Current design will power off all dependent GPC power domains in imx8mp_blk_ctrl_suspend(), even though the user device has enabled wakeup capability. The result is that wakeup function never works for such device. An example will be USB wakeup on i.MX8MP. PHY device '382f0040.usb-phy' is attached to power domain 'hsioblk-usb-phy2' which is spawned by hsio block control. A virtual power domain device 'genpd:3:32f10000.blk-ctrl' is created to build connection with 'hsioblk-usb-phy2' and it depends on GPC power domain 'usb-otg2'. If device '382f0040.usb-phy' enable wakeup, only power domain 'hsioblk-usb-phy2' keeps on during system suspend, power domain 'usb-otg2' is off all the time. So the wakeup event can't happen. In order to further establish a connection between the power domains related to GPC and block control during system suspend, register a genpd power on/off notifier for the power_dev. This allows us to prevent the GPC power domain from being powered off, in case the block control power domain is kept on to serve system wakeup. Suggested-by: Ulf Hansson Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Signed-off-by: Ulf Hansson commit 4cb1b327135dddf3d0ec2544ea36ed05ba2252bc Author: Daniele Ceraolo Spurio Date: Thu Jan 29 10:25:48 2026 -0800 drm/xe/guc: Fix CFI violation in debugfs access. xe_guc_print_info is void-returning, but the function pointer it is assigned to expects an int-returning function, leading to the following CFI error: [ 206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe] (target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a) Fix this by updating xe_guc_print_info to return an integer. Fixes: e15826bb3c2c ("drm/xe/guc: Refactor GuC debugfs initialization") Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Cc: George D Sworo Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com (cherry picked from commit dd8ea2f2ab71b98887fdc426b0651dbb1d1ea760) Signed-off-by: Thomas Hellström commit 40b24d9cdd4141ef43eeaa7e57c3efc07a567473 Author: Shengjiu Wang Date: Fri Jan 30 16:09:10 2026 +0800 drm/bridge: imx8mp-hdmi-pai: enable PM runtime There is an audio channel shift issue with multi channel case - the channel order is correct for the first run, but the channel order is shifted for the second run. The fix method is to reset the PAI interface at the end of playback. The reset can be handled by PM runtime, so enable PM runtime. Fixes: 0205fae6327a ("drm/bridge: imx: add driver for HDMI TX Parallel Audio Interface") Signed-off-by: Shengjiu Wang Reviewed-by: Liu Ying Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20260130080910.3532724-1-shengjiu.wang@nxp.com commit 51db05283f7c9c95a3e6853a3044cd04226551bf Author: Breno Baptista Date: Wed Feb 4 23:43:41 2026 -0300 ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 Add quirk to support microphone input through headphone jack on Acer Nitro 5 AN515-57 (ALC295). Signed-off-by: Breno Baptista Link: https://patch.msgid.link/20260205024341.26694-1-brenomb07@gmail.com Signed-off-by: Takashi Iwai commit f41c5d151078c5348271ffaf8e7410d96f2d82f8 Author: Andrew Fasano Date: Wed Feb 4 17:46:58 2026 +0100 netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) continue; /* skip inactive, process active */ The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never called for the catchall element. For NFT_GOTO verdict elements, this means nft_data_hold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and CONFIG_NF_TABLES. Fix by removing the negation so the check matches nft_mapelem_activate(): skip active elements, process inactive ones. Fixes: 628bd3e49cba ("netfilter: nf_tables: drop map element references from preparation phase") Signed-off-by: Andrew Fasano Signed-off-by: Florian Westphal commit 7d6ba706ae5ef7d3d00b67140d2873ae1da6d41f Merge: 7576bd9017e353 45a66b75bf10c8 Author: Jakub Kicinski Date: Wed Feb 4 20:29:53 2026 -0800 Merge tag 'wireless-2026-02-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Two last-minute iwlwifi fixes: - cancel mlo_scan_work on disassoc to avoid use-after-free/init-after-queue issues - pause TCM work on suspend to avoid crashing the FW (and sometimes the host) on resume with traffic * tag 'wireless-2026-02-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: mvm: pause TCM on fast resume wifi: iwlwifi: mld: cancel mlo_scan_start_wk ==================== Link: https://patch.msgid.link/20260204113547.159742-4-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit b20624608f350c5dadd74577629e90715d351e2c Merge: f14faaf3a1fb3b 1a47837bfafed7 Author: Linus Torvalds Date: Wed Feb 4 16:04:00 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-02-04-15-55' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Five hotfixes. Two are cc:stable, two are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-02-04-15-55' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: Documentation: document liveupdate cmdline parameter mm, shmem: prevent infinite loop on truncate race mailmap: update Alexander Mikhalitsyn's emails liveupdate: luo_file: do not clear serialized_data on unfreeze x86/kfence: fix booting on 32bit non-PAE systems commit f14faaf3a1fb3b9e4cf2e56269711fb85fba9458 Merge: 3c7b4d1994f63d c2012263047689 Author: Linus Torvalds Date: Wed Feb 4 15:15:54 2026 -0800 Merge tag 'tsm-fixes-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull TSM (TEE security Manager) fixes from Dan Williams: "The largest change is reverting part of an ABI that never shipped in a released kernel (Documentation/ABI/testing/sysfs-class-tsm). The fix / replacement for that is too large to squeeze in at this late date. The rest is a collection of small fixups: - Fix multiple streams per host bridge for SEV-TIO - Drop the TSM ABI for reporting IDE streams (to be replaced) - Fix virtual function enumeration - Fix reserved stream ID initialization - Fix unused variable compiler warning" * tag 'tsm-fixes-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: crypto/ccp: Allow multiple streams on the same root bridge crypto/ccp: Use PCI bridge defaults for IDE coco/tsm: Remove unused variable tsm_rwsem PCI/IDE: Fix reading a wrong reg for unused sel stream initialization PCI/IDE: Fix off by one error calculating VF RID range Revert "PCI/TSM: Report active IDE streams" commit 3c7b4d1994f63d6fa3984d7d5ad06dbaad96f167 Merge: 27db1ae6ecdf23 0eca95cba2b7bf Author: Linus Torvalds Date: Wed Feb 4 15:11:24 2026 -0800 Merge tag 'sched_ext-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fix from Tejun Heo: - Fix race where sched_class operations (sched_setscheduler() and friends) could be invoked on dead tasks after sched_ext_dead() already ran, causing invalid SCX task state transitions and NULL pointer dereferences. This was a regression from the cgroup exit ordering fix which moved sched_ext_free() to finish_task_switch(). * tag 'sched_ext-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Short-circuit sched_class operations on dead tasks commit 831a2b27914cc880130ffe8fb8d1e65a5324d07f Author: Arnd Bergmann Date: Tue Feb 3 17:34:36 2026 +0100 hwmon: (occ) Mark occ_init_attribute() as __printf This is a printf-style function, which gcc -Werror=suggest-attribute=format correctly points out: drivers/hwmon/occ/common.c: In function 'occ_init_attribute': drivers/hwmon/occ/common.c:761:9: error: function 'occ_init_attribute' might be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format] Add the attribute to avoid this warning and ensure any incorrect format strings are detected here. Fixes: 744c2fe950e9 ("hwmon: (occ) Rework attribute registration for stack usage") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20260203163440.2674340-1-arnd@kernel.org Signed-off-by: Guenter Roeck commit 0eca95cba2b7bf7b7b4f2fa90734a85fcaa72782 Author: Tejun Heo Date: Wed Feb 4 10:07:55 2026 -1000 sched_ext: Short-circuit sched_class operations on dead tasks 7900aa699c34 ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()") moved sched_ext_free() to finish_task_switch() and renamed it to sched_ext_dead() to fix cgroup exit ordering issues. However, this created a race window where certain sched_class ops may be invoked on dead tasks leading to failures - e.g. sched_setscheduler() may try to switch a task which finished sched_ext_dead() back into SCX triggering invalid SCX task state transitions. Add task_dead_and_done() which tests whether a task is TASK_DEAD and has completed its final context switch, and use it to short-circuit sched_class operations which may be called on dead tasks. Fixes: 7900aa699c34 ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()") Reported-by: Andrea Righi Link: http://lkml.kernel.org/r/20260202151341.796959-1-arighi@nvidia.com Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 7987cce375ac8ce98e170a77aa2399f2cf6eb99f Author: Viacheslav Dubeyko Date: Tue Feb 3 14:54:46 2026 -0800 ceph: fix NULL pointer dereference in ceph_mds_auth_match() The CephFS kernel client has regression starting from 6.18-rc1. We have issue in ceph_mds_auth_match() if fs_name == NULL: const char fs_name = mdsc->fsc->mount_options->mds_namespace; ... if (auth->match.fs_name && strcmp(auth->match.fs_name, fs_name)) { / fsname mismatch, try next one */ return 0; } Patrick Donnelly suggested that: In summary, we should definitely start decoding `fs_name` from the MDSMap and do strict authorizations checks against it. Note that the `-o mds_namespace=foo` should only be used for selecting the file system to mount and nothing else. It's possible no mds_namespace is specified but the kernel will mount the only file system that exists which may have name "foo". This patch reworks ceph_mdsmap_decode() and namespace_equals() with the goal of supporting the suggested concept. Now struct ceph_mdsmap contains m_fs_name field that receives copy of extracted FS name by ceph_extract_encoded_string(). For the case of "old" CephFS file systems, it is used "cephfs" name. [ idryomov: replace redundant %*pE with %s in ceph_mdsmap_decode(), get rid of a series of strlen() calls in ceph_namespace_match(), drop changes to namespace_equals() body to avoid treating empty mds_namespace as equal, drop changes to ceph_mdsc_handle_fsmap() as namespace_equals() isn't an equivalent substitution there ] Cc: stable@vger.kernel.org Fixes: 22c73d52a6d0 ("ceph: fix multifs mds auth caps issue") Link: https://tracker.ceph.com/issues/73886 Signed-off-by: Viacheslav Dubeyko Reviewed-by: Patrick Donnelly Tested-by: Patrick Donnelly Signed-off-by: Ilya Dryomov commit 27db1ae6ecdf23f4176276da6037eaafbd23bf94 Merge: a14980444f418d 0de4a0eec25b91 Author: Linus Torvalds Date: Wed Feb 4 10:38:56 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: - Fix a bug where AVIC is incorrectly inhibited when running with x2AVIC disabled via module param (or on a system without x2AVIC) - Fix a dangling device posted IRQs bug by explicitly checking if the irqfd is still active (on the list) when handling an eventfd signal, instead of zeroing the irqfd's routing information when the irqfd is deassigned. Zeroing the irqfd's routing info causes arm64 and x86's to not disable posting for the IRQ (kvm_arch_irq_bypass_del_producer() looks for an MSI), incorrectly leaving the IRQ in posted mode (and leading to use-after-free and memory leaks on AMD in particular). This is both the most pressing and scariest, but it's been in -next for a while. - Disable FORTIFY_SOURCE for KVM selftests to prevent the compiler from generating calls to the checked versions of memset() and friends, which leads to unexpected page faults in guest code due e.g. __memset_chk@plt not being resolved. - Explicitly configure the supported XSS capabilities from within {svm,vmx}_set_cpu_caps() to fix a bug where VMX will compute the reference VMCS configuration with SHSTK and IBT enabled, but then compute each CPUs local config with SHSTK and IBT disabled if not all CET xfeatures are enabled, e.g. if the kernel is built with X86_KERNEL_IBT=n. The mismatch in features results in differing nVMX setting, and ultimately causes kvm-intel.ko to refuse to load with nested=1. * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps() KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures KVM: x86: Assert that non-MSI doesn't have bypass vCPU when deleting producer KVM: Don't clobber irqfd routing type when deassigning irqfd KVM: SVM: Check vCPU ID against max x2AVIC ID if and only if x2AVIC is enabled commit 0de4a0eec25b9171f2a2abb1a820e125e6797770 Merge: e89f0e9a0a007e f8ade833b733ae Author: Paolo Bonzini Date: Wed Feb 4 18:30:32 2026 +0100 Merge tag 'kvm-x86-fixes-6.19-rc8' of https://github.com/kvm-x86/linux into HEAD Final KVM fixes for 6.19: - Fix a bug where AVIC is incorrectly inhibited when running with x2AVIC disabled via module param (or on a system without x2AVIC). - Fix a dangling device posted IRQs bug by explicitly checking if the irqfd is still active (on the list) when handling an eventfd signal, instead of zeroing the irqfd's routing information when the irqfd is deassigned. Zeroing the irqfd's routing info causes arm64 and x86's to not disable posting for the IRQ (kvm_arch_irq_bypass_del_producer() looks for an MSI), incorrectly leaving the IRQ in posted mode (and leading to use-after-free and memory leaks on AMD in particular). This is both the most pressing and scariest, but it's been in -next for a while. - Disable FORTIFY_SOURCE for KVM selftests to prevent the compiler from generating calls to the checked versions of memset() and friends, which leads to unexpected page faults in guest code due e.g. __memset_chk@plt not being resolved. - Explicitly configure the support XSS from within {svm,vmx}_set_cpu_caps() to fix a bug where VMX will compute the reference VMCS configuration with SHSTK and IBT enabled, but then compute each CPUs local config with SHSTK and IBT disabled if not all CET xfeatures are enabled, e.g. if the kernel is built with X86_KERNEL_IBT=n. The mismatch in features results in differing nVMX setting, and ultimately causes kvm-intel.ko to refuse to load with nested=1. commit a14980444f418de53a7cc315eb4fbd8a89c72991 Merge: 5fd0a1df5d05ad c3cb2722e28969 Author: Linus Torvalds Date: Wed Feb 4 08:26:22 2026 -0800 Merge tag 'soc-fixes-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "Shawn Guo is moving on from maintaining the NXP i.MX platform and hands over to Frank Li. Shawn has maintained the platform for 15 years after initially upstreaming support for i.MX6 and i.MX23/28, and his work has helped make this the most important industrial embedded Linux platform. Roughly one out of five devicetree files in mainline kernels are for the wider i.MX platform. Many thanks to Shawn for the taking care of the platform all these years! There are also two additional updates for the MAINTAINERS file, and a fix for error handling in the qualcomm smem driver" * tag 'soc-fixes-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: MAINTAINERS: Change Sudeep Holla's email address MAINTAINERS: Add myself as maintainer of hisi_soc_hha soc: qcom: smem: fix qcom_smem_is_available and check if __smem is valid MAINTAINERS: Replace Shawn with Frank as i.MX platform maintainer commit 523abd481ccf335727a6ca3840d0fd692328e335 Merge: 124bdc6eccc8c5 f514248727606b Author: Takashi Iwai Date: Wed Feb 4 17:03:08 2026 +0100 Merge tag 'asoc-fix-v6.19-rc8' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A bunch more small fixes here, plus some more of the constant stream of quirks. The most notable change here is Richard's change to the cs_dsp code for the KUnit tests which is relatively large, mostly due to boilerplate. The tests were triggering large numbers of error messages as part of verifying that problems with input data are appropriately detected which in turn caused runtime issues for the framework due to the performance impact of pushing the logging out, while the logging is valuable in normal operation it's basically useless while doing tests designed to trigger it so rate limiting is an appropriate fix. commit bb36170d959fad7f663f91eb9c32a84dd86bef2b Author: Karthik Poosa Date: Fri Jan 23 23:02:38 2026 +0530 drm/xe/pm: Disable D3Cold for BMG only on specific platforms Restrict D3Cold disablement for BMG to unsupported NUC platforms, instead of disabling it on all platforms. Signed-off-by: Karthik Poosa Fixes: 3e331a6715ee ("drm/xe/pm: Temporarily disable D3Cold on BMG") Link: https://patch.msgid.link/20260123173238.1642383-1-karthik.poosa@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit 39125eaf8863ab09d70c4b493f58639b08d5a897) Signed-off-by: Thomas Hellström commit 16264a3b594282a7f25028745158bc59a9cf7f96 Author: Shuicheng Lin Date: Thu Jan 29 23:38:38 2026 +0000 drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval_job.c:210 expecting prototype for xe_tlb_inval_alloc_dep(). Prototype was for xe_tlb_inval_job_alloc_dep() instead" Fixes: 15366239e2130 ("drm/xe: Decouple TLB invalidations from GT") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-8-shuicheng.lin@intel.com (cherry picked from commit 9f9c117ac566cb567dd56cc5b7564c45653f7a2a) Signed-off-by: Thomas Hellström commit 51db5eef2ce39311cee2919623cda2ac0fc13c02 Author: Shuicheng Lin Date: Thu Jan 29 23:38:37 2026 +0000 drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval.c:136 expecting prototype for xe_gt_tlb_inval_init(). Prototype was for xe_gt_tlb_inval_init_early() instead" v2: add () for the function. (Michal) Fixes: db16f9d90c1d9 ("drm/xe: Split TLB invalidation code in frontend and backend") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-7-shuicheng.lin@intel.com (cherry picked from commit 0651dbb9d6a72e99569576fbec4681fd8160d161) Signed-off-by: Thomas Hellström commit e022c16965b8345af3c384c9136c7ca541a25f72 Author: Shuicheng Lin Date: Thu Jan 29 23:38:36 2026 +0000 drm/xe: Fix kerneldoc for xe_migrate_exec_queue Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_migrate.c:1262 expecting prototype for xe_get_migrate_exec_queue(). Prototype was for xe_migrate_exec_queue() instead" Fixes: 916ee4704a865 ("drm/xe/vf: Register CCS read/write contexts with Guc") Reviewed-by: Michal Wajdeczko Signed-off-by: Shuicheng Lin Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20260129233834.419977-6-shuicheng.lin@intel.com (cherry picked from commit 9fd8da717934f05125b9ba6782622c459a368dc0) Signed-off-by: Thomas Hellström commit 7ee9b3e091c63da71e15c72003f1f07e467f5158 Author: Shuicheng Lin Date: Fri Jan 30 04:39:08 2026 +0000 drm/xe/query: Fix topology query pointer advance The topology query helper advanced the user pointer by the size of the pointer, not the size of the structure. This can misalign the output blob and corrupt the following mask. Fix the increment to use sizeof(*topo). There is no issue currently, as sizeof(*topo) happens to be equal to sizeof(topo) on 64-bit systems (both evaluate to 8 bytes). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Shuicheng Lin Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260130043907.465128-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit c2a6859138e7f73ad904be17dd7d1da6cc7f06b3) Signed-off-by: Thomas Hellström commit 45a66b75bf10c84060c9948e3be664e03454515d Merge: 1cac38910ecb88 fb7f54aa2a99b0 Author: Johannes Berg Date: Wed Feb 4 12:31:42 2026 +0100 Merge tag 'iwlwifi-fixes-2026-02-03' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fixes - Cancel mlo_scan_work on disassoc - Pause TCM work on suspend ==================== Signed-off-by: Johannes Berg commit f514248727606b9087bc38a284ff686e0093abf1 Author: Ziyi Guo Date: Mon Feb 2 17:41:12 2026 +0000 ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() fsl_xcvr_activate_ctl() has lockdep_assert_held(&card->snd_card->controls_rwsem), but fsl_xcvr_mode_put() calls it without acquiring this lock. Other callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and fsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read(). Add the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl() in fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential race conditions when multiple userspace threads access the control. Signed-off-by: Ziyi Guo Link: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu Signed-off-by: Mark Brown commit 85352e59de4ce09de8322b2591a26f515fbde9c0 Author: Frank Li Date: Mon Feb 2 15:57:57 2026 -0500 ASoC: dt-bindings: ti,tlv320aic3x: Add compatible string ti,tlv320aic23 Add compatible string ti,tlv320aic23 to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/imx/imx35-eukrea-mbimxsd35-baseboard.dtb: /soc/bus@43f00000/i2c@43f80000/codec@1a: failed to match any schema with compatible: ['ti,tlv320aic23'] Signed-off-by: Frank Li Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260202205758.3044617-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit 7f67ba5413f98d93116a756e7f17cd2c1d6c2bd6 Author: Chris Bainbridge Date: Mon Feb 2 20:50:33 2026 +0000 ASoC: amd: fix memory leak in acp3x pdm dma ops Fixes: 4a767b1d039a8 ("ASoC: amd: add acp3x pdm driver dma ops") Signed-off-by: Chris Bainbridge Link: https://patch.msgid.link/20260202205034.7697-1-chris.bainbridge@gmail.com Signed-off-by: Mark Brown commit 4463c7aa11a6e67169ae48c6804968960c4bffea Author: Thomas Gleixner Date: Mon Feb 2 10:39:55 2026 +0100 sched/mmcid: Optimize transitional CIDs when scheduling out During the investigation of the various transition mode issues instrumentation revealed that the amount of bitmap operations can be significantly reduced when a task with a transitional CID schedules out after the fixup function completed and disabled the transition mode. At that point the mode is stable and therefore it is not required to drop the transitional CID back into the pool. As the fixup is complete the potential exhaustion of the CID pool is not longer possible, so the CID can be transferred to the scheduling out task or to the CPU depending on the current ownership mode. The racy snapshot of mm_cid::mode which contains both the ownership state and the transition bit is valid because runqueue lock is held and the fixup function of a concurrent mode switch is serialized. Assigning the ownership right there not only spares the bitmap access for dropping the CID it also avoids it when the task is scheduled back in as it directly hits the fast path in both modes when the CID is within the optimal range. If it's outside the range the next schedule in will need to converge so dropping it right away is sensible. In the good case this also allows to go into the fast path on the next schedule in operation. With a thread pool benchmark which is configured to cross the mode switch boundaries frequently this reduces the number of bitmap operations by about 30% and increases the fastpath utilization in the low single digit percentage range. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20260201192835.100194627@kernel.org commit 007d84287c7466ca68a5809b616338214dc5b77b Author: Thomas Gleixner Date: Mon Feb 2 10:39:50 2026 +0100 sched/mmcid: Drop per CPU CID immediately when switching to per task mode When a exiting task initiates the switch from per CPU back to per task mode, it has already dropped its CID and marked itself inactive. But a leftover from an earlier iteration of the rework then reassigns the per CPU CID to the exiting task with the transition bit set. That's wrong as the task is already marked CID inactive, which means it is inconsistent state. It's harmless because the CID is marked in transit and therefore dropped back into the pool when the exiting task schedules out either through preemption or the final schedule(). Simply drop the per CPU CID when the exiting task triggered the transition. Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions") Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20260201192835.032221009@kernel.org commit 47ee94efccf6732e4ef1a815c451aacaf1464757 Author: Thomas Gleixner Date: Mon Feb 2 10:39:45 2026 +0100 sched/mmcid: Protect transition on weakly ordered systems Shrikanth reported a hard lockup which he observed once. The stack trace shows the following CID related participants: watchdog: CPU 23 self-detected hard LOCKUP @ mm_get_cid+0xe8/0x188 NIP: mm_get_cid+0xe8/0x188 LR: mm_get_cid+0x108/0x188 mm_cid_switch_to+0x3c4/0x52c __schedule+0x47c/0x700 schedule_idle+0x3c/0x64 do_idle+0x160/0x1b0 cpu_startup_entry+0x48/0x50 start_secondary+0x284/0x288 start_secondary_prolog+0x10/0x14 watchdog: CPU 11 self-detected hard LOCKUP @ plpar_hcall_norets_notrace+0x18/0x2c NIP: plpar_hcall_norets_notrace+0x18/0x2c LR: queued_spin_lock_slowpath+0xd88/0x15d0 _raw_spin_lock+0x80/0xa0 raw_spin_rq_lock_nested+0x3c/0xf8 mm_cid_fixup_cpus_to_tasks+0xc8/0x28c sched_mm_cid_exit+0x108/0x22c do_exit+0xf4/0x5d0 make_task_dead+0x0/0x178 system_call_exception+0x128/0x390 system_call_vectored_common+0x15c/0x2ec The task on CPU11 is running the CID ownership mode change fixup function and is stuck on a runqueue lock. The task on CPU23 is trying to get a CID from the pool with the same runqueue lock held, but the pool is empty. After decoding a similar issue in the opposite direction switching from per task to per CPU mode the tool which models the possible scenarios failed to come up with a similar loop hole. This showed up only once, was not reproducible and according to tooling not related to a overlooked scheduling scenario permutation. But the fact that it was observed on a PowerPC system gave the right hint: PowerPC is a weakly ordered architecture. The transition mechanism does: WRITE_ONCE(mm->mm_cid.transit, MM_CID_TRANSIT); WRITE_ONCE(mm->mm_cid.percpu, new_mode); fixup() WRITE_ONCE(mm->mm_cid.transit, 0); mm_cid_schedin() does: if (!READ_ONCE(mm->mm_cid.percpu)) ... cid |= READ_ONCE(mm->mm_cid.transit); so weakly ordered systems can observe percpu == false and transit == 0 even if the fixup function has not yet completed. As a consequence the task will not drop the CID when scheduling out before the fixup is completed, which means the CID space can be exhausted and the next task scheduling in will loop in mm_get_cid() and the fixup thread can livelock on the held runqueue lock as above. This could obviously be solved by using: smp_store_release(&mm->mm_cid.percpu, true); and smp_load_acquire(&mm->mm_cid.percpu); but that brings a memory barrier back into the scheduler hotpath, which was just designed out by the CID rewrite. That can be completely avoided by combining the per CPU mode and the transit storage into a single mm_cid::mode member and ordering the stores against the fixup functions to prevent the CPU from reordering them. That makes the update of both states atomic and a concurrent read observes always consistent state. The price is an additional AND operation in mm_cid_schedin() to evaluate the per CPU or the per task path, but that's in the noise even on strongly ordered architectures as the actual load can be significantly more expensive and the conditional branch evaluation is there anyway. Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions") Closes: https://lore.kernel.org/bdfea828-4585-40e8-8835-247c6a8a76b0@linux.ibm.com Reported-by: Shrikanth Hegde Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20260201192834.965217106@kernel.org commit 4327fb13fa47770183c4850c35382c30ba5f939d Author: Thomas Gleixner Date: Mon Feb 2 10:39:40 2026 +0100 sched/mmcid: Prevent live lock on task to CPU mode transition Ihor reported a BPF CI failure which turned out to be a live lock in the MM_CID management. The scenario is: A test program creates the 5th thread, which means the MM_CID users become more than the number of CPUs (four in this example), so it switches to per CPU ownership mode. At this point each live task of the program has a CID associated. Assume thread creation order assignment for simplicity. T0 CID0 runs fork() and creates T4 T1 CID1 T2 CID2 T3 CID3 T4 --- not visible yet T0 sets mm_cid::percpu = true and transfers its own CID to CPU0 where it runs on and then starts the fixup which walks through the threads to transfer the per task CIDs either to the CPU the task is running on or drop it back into the pool if the task is not on a CPU. During that T1 - T3 are free to schedule in and out before the fixup caught up with them. Going through all possible permutations with a python script revealed a few problematic cases. The most trivial one is: T1 schedules in on CPU1 and observes percpu == true, so it transfers its CID to CPU1 T1 is migrated to CPU2 and schedule in observes percpu == true, but CPU2 does not have a CID associated and T1 transferred its own to CPU1 So it has to allocate one with CPU2 runqueue lock held, but the pool is empty, so it keeps looping in mm_get_cid(). Now T0 reaches T1 in the thread walk and tries to lock the corresponding runqueue lock, which is held causing a full live lock. There is a similar scenario in the reverse direction of switching from per CPU to task mode which is way more obvious and got therefore addressed by an intermediate mode. In this mode the CIDs are marked with MM_CID_TRANSIT, which means that they are neither owned by the CPU nor by the task. When a task schedules out with a transit CID it drops the CID back into the pool making it available for others to use temporarily. Once the task which initiated the mode switch finished the fixup it clears the transit mode and the process goes back into per task ownership mode. Unfortunately this insight was not mapped back to the task to CPU mode switch as the above described scenario was not considered in the analysis. Apply the same transit mechanism to the task to CPU mode switch to handle these problematic cases correctly. As with the CPU to task transition this results in a potential temporary contention on the CID bitmap, but that's only for the time it takes to complete the transition. After that it stays in steady mode which does not touch the bitmap at all. Fixes: fbd0e71dc370 ("sched/mmcid: Provide CID ownership mode fixup functions") Closes: https://lore.kernel.org/2b7463d7-0f58-4e34-9775-6e2115cfb971@linux.dev Reported-by: Ihor Solodrai Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20260201192834.897115238@kernel.org commit c62e0658d458d8f100445445c3ddb106f3824a45 Author: Alban Bedel Date: Thu Jan 29 15:59:44 2026 +0100 gpiolib: acpi: Fix gpio count with string references Since commit 9880702d123f2 ("ACPI: property: Support using strings in reference properties") it is possible to use strings instead of local references. This work fine with single GPIO but not with arrays as acpi_gpio_package_count() didn't handle this case. Update it to handle strings like local references to cover this case as well. Signed-off-by: Alban Bedel Reviewed-by: Mika Westerberg Link: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de Signed-off-by: Bartosz Golaszewski commit 0e0c8f4d16de92520623aa1ea485cadbf64e6929 Author: Jacob Keller Date: Mon Feb 2 16:16:39 2026 -0800 drm/mgag200: fix mgag200_bmc_stop_scanout() The mgag200_bmc_stop_scanout() function is called by the .atomic_disable() handler for the MGA G200 VGA BMC encoder. This function performs a few register writes to inform the BMC of an upcoming mode change, and then polls to wait until the BMC actually stops. The polling is implemented using a busy loop with udelay() and an iteration timeout of 300, resulting in the function blocking for 300 milliseconds. The function gets called ultimately by the output_poll_execute work thread for the DRM output change polling thread of the mgag200 driver: kworker/0:0-mm_ 3528 [000] 4555.315364: ffffffffaa0e25b3 delay_halt.part.0+0x33 ffffffffc03f6188 mgag200_bmc_stop_scanout+0x178 ffffffffc087ae7a disable_outputs+0x12a ffffffffc087c12a drm_atomic_helper_commit_tail+0x1a ffffffffc03fa7b6 mgag200_mode_config_helper_atomic_commit_tail+0x26 ffffffffc087c9c1 commit_tail+0x91 ffffffffc087d51b drm_atomic_helper_commit+0x11b ffffffffc0509694 drm_atomic_commit+0xa4 ffffffffc05105e8 drm_client_modeset_commit_atomic+0x1e8 ffffffffc0510ce6 drm_client_modeset_commit_locked+0x56 ffffffffc0510e24 drm_client_modeset_commit+0x24 ffffffffc088a743 __drm_fb_helper_restore_fbdev_mode_unlocked+0x93 ffffffffc088a683 drm_fb_helper_hotplug_event+0xe3 ffffffffc050f8aa drm_client_dev_hotplug+0x9a ffffffffc088555a output_poll_execute+0x29a ffffffffa9b35924 process_one_work+0x194 ffffffffa9b364ee worker_thread+0x2fe ffffffffa9b3ecad kthread+0xdd ffffffffa9a08549 ret_from_fork+0x29 On a server running ptp4l with the mgag200 driver loaded, we found that ptp4l would sometimes get blocked from execution because of this busy waiting loop. Every so often, approximately once every 20 minutes -- though with large variance -- the output_poll_execute() thread would detect some sort of change that required performing a hotplug event which results in attempting to stop the BMC scanout, resulting in a 300msec delay on one CPU. On this system, ptp4l was pinned to a single CPU. When the output_poll_execute() thread ran on that CPU, it blocked ptp4l from executing for its 300 millisecond duration. This resulted in PTP service disruptions such as failure to send a SYNC message on time, failure to handle ANNOUNCE messages on time, and clock check warnings from the application. All of this despite the application being configured with FIFO_RT and a higher priority than the background workqueue tasks. (However, note that the kernel did not use CONFIG_PREEMPT...) It is unclear if the event is due to a faulty VGA connection, another bug, or actual events causing a change in the connection. At least on the system under test it is not a one-time event and consistently causes disruption to the time sensitive applications. The function has some helpful comments explaining what steps it is attempting to take. In particular, step 3a and 3b are explained as such: 3a - The third step is to verify if there is an active scan. We are waiting on a 0 on remhsyncsts (. 3b - This step occurs only if the remove is actually scanning. We are waiting for the end of the frame which is a 1 on remvsyncsts (). The actual steps 3a and 3b are implemented as while loops with a non-sleeping udelay(). The first step iterates while the tmp value at position 0 is *not* set. That is, it keeps iterating as long as the bit is zero. If the bit is already 0 (because there is no active scan), it will iterate the entire 300 attempts which wastes 300 milliseconds in total. This is opposite of what the description claims. The step 3b logic only executes if we do not iterate over the entire 300 attempts in the first loop. If it does trigger, it is trying to check and wait for a 1 on the remvsyncsts. However, again the condition is actually inverted and it will loop as long as the bit is 1, stopping once it hits zero (rather than the explained attempt to wait until we see a 1). Worse, both loops are implemented using non-sleeping waits which spin instead of allowing the scheduler to run other processes. If the kernel is not configured to allow arbitrary preemption, it will waste valuable CPU time doing nothing. There does not appear to be any documentation for the BMC register interface, beyond what is in the comments here. It seems more probable that the comment here is correct and the implementation accidentally got inverted from the intended logic. Reading through other DRM driver implementations, it does not appear that the .atomic_enable or .atomic_disable handlers need to delay instead of sleep. For example, the ast_astdp_encoder_helper_atomic_disable() function calls ast_dp_set_phy_sleep() which uses msleep(). The "atomic" in the name is referring to the atomic modesetting support, which is the support to enable atomic configuration from userspace, and not to the "atomic context" of the kernel. There is no reason to use udelay() here if a sleep would be sufficient. Replace the while loops with a read_poll_timeout() based implementation that will sleep between iterations, and which stops polling once the condition is met (instead of looping as long as the condition is met). This aligns with the commented behavior and avoids blocking on the CPU while doing nothing. Note the RREG_DAC is implemented using a statement expression to allow working properly with the read_poll_timeout family of functions. The other RREG_ macros ought to be cleaned up to have better semantics, and several places in the mgag200 driver could make use of RREG_DAC or similar RREG_* macros should likely be cleaned up for better semantics as well, but that task has been left as a future cleanup for a non-bugfix. Fixes: 414c45310625 ("mgag200: initial g200se driver (v2)") Suggested-by: Thomas Zimmermann Signed-off-by: Jacob Keller Reviewed-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260202-jk-mgag200-fix-bad-udelay-v2-1-ce1e9665987d@intel.com commit 7576bd9017e35379db1ab1ef6b0e1d570eb28429 Merge: 279fe484dde428 0b8c878d117319 Author: Jakub Kicinski Date: Tue Feb 3 19:45:53 2026 -0800 Merge branch 'net-cpsw-execute-ndo_set_rx_mode-callback-in-a-work-queue' Kevin Hao says: ==================== net: cpsw: Execute ndo_set_rx_mode callback in a work queue These two patches resolve an RTNL assertion call trace issue in both the legacy and new cpsw drivers. ==================== Link: https://patch.msgid.link/20260203-bbb-v5-0-ea0ea217a85c@gmail.com Signed-off-by: Jakub Kicinski commit 0b8c878d117319f2be34c8391a77e0f4d5c94d79 Author: Kevin Hao Date: Tue Feb 3 10:18:31 2026 +0800 net: cpsw: Execute ndo_set_rx_mode callback in a work queue Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board: WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0x98 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x54 This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution. To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver. Please note: To reproduce this issue, I manually reverted the changes to am335x-bone-common.dtsi from commit c477358e66a3 ("ARM: dts: am335x-bone: switch to new cpsw switch drv") in order to revert to the legacy cpsw driver. Fixes: 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260203-bbb-v5-2-ea0ea217a85c@gmail.com Signed-off-by: Jakub Kicinski commit c0b5dc73a38f954e780f93a549b8fe225235c07a Author: Kevin Hao Date: Tue Feb 3 10:18:30 2026 +0800 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this change triggered the following call trace on my BeagleBone Black board: WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496 RTNL: assertion failed at net/8021q/vlan_core.c (236) Modules linked in: CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x28/0x2c show_stack from dump_stack_lvl+0x30/0x38 dump_stack_lvl from __warn+0xb8/0x11c __warn from warn_slowpath_fmt+0x130/0x194 warn_slowpath_fmt from vlan_for_each+0x120/0x124 vlan_for_each from cpsw_add_mc_addr+0x54/0xd8 cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88 __dev_mc_add from igmp6_group_added+0x84/0xec igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0 __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4 __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168 do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8 ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c do_sock_setsockopt from __sys_setsockopt+0x84/0xac __sys_setsockopt from ret_fast_syscall+0x0/0x5 This trace occurs because vlan_for_each() is called within cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held. Since modifying vlan_for_each() to operate without the RTNL lock is not straightforward, and because ndo_set_rx_mode() is invoked both with and without the RTNL lock across different code paths, simply adding rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution. To resolve this issue, we opt to execute the actual processing within a work queue, following the approach used by the icssg-prueth driver. Fixes: 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") Signed-off-by: Kevin Hao Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260203-bbb-v5-1-ea0ea217a85c@gmail.com Signed-off-by: Jakub Kicinski commit 279fe484dde428d305eeb8e3acdaa7ddfaa62a42 Merge: 6788d44b936c7e c7db85d579a1dc Author: Jakub Kicinski Date: Tue Feb 3 19:28:07 2026 -0800 Merge branch 'gve-stats-reporting-fixes' Max Yuan says: ==================== gve: Stats reporting fixes This series addresses two issues related to statistics in the gve driver. The first patch fixes a memory corruption issue that occurs when resizing the stats region during queue count changes. By allocating the maximum possible size upfront and aligning offset calculations with the NIC, we ensure stability and accuracy across reconfigurations. The second patch fixes the 'rx_dropped' counter by removing allocation failures and incorporating XDP transmit and redirect errors to provide a more accurate representation of dropped packets. ==================== Link: https://patch.msgid.link/20260202193925.3106272-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit c7db85d579a1dccb624235534508c75fbf2dfe46 Author: Max Yuan Date: Mon Feb 2 19:39:25 2026 +0000 gve: Correct ethtool rx_dropped calculation The gve driver's "rx_dropped" statistic, exposed via `ethtool -S`, incorrectly includes `rx_buf_alloc_fail` counts. These failures represent an inability to allocate receive buffers, not true packet drops where a received packet is discarded. This misrepresentation can lead to inaccurate diagnostics. This patch rectifies the ethtool "rx_dropped" calculation. It removes `rx_buf_alloc_fail` from the total and adds `xdp_tx_errors` and `xdp_redirect_errors`, which represent legitimate packet drops within the XDP path. Cc: stable@vger.kernel.org Fixes: 433e274b8f7b ("gve: Add stats for gve.") Signed-off-by: Max Yuan Reviewed-by: Jordan Rhee Reviewed-by: Joshua Washington Reviewed-by: Matt Olson Signed-off-by: Harshitha Ramamurthy Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260202193925.3106272-3-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 7b9ebcce0296e104a0d82a6b09d68564806158ff Author: Debarghya Kundu Date: Mon Feb 2 19:39:24 2026 +0000 gve: Fix stats report corruption on queue count change The driver and the NIC share a region in memory for stats reporting. The NIC calculates its offset into this region based on the total size of the stats region and the size of the NIC's stats. When the number of queues is changed, the driver's stats region is resized. If the queue count is increased, the NIC can write past the end of the allocated stats region, causing memory corruption. If the queue count is decreased, there is a gap between the driver and NIC stats, leading to incorrect stats reporting. This change fixes the issue by allocating stats region with maximum size, and the offset calculation for NIC stats is changed to match with the calculation of the NIC. Cc: stable@vger.kernel.org Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.") Signed-off-by: Debarghya Kundu Reviewed-by: Joshua Washington Signed-off-by: Harshitha Ramamurthy Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260202193925.3106272-2-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 6788d44b936c7e494b0d179c8843a72188287473 Merge: f613e8b4afea0c bee60ce21b7512 Author: Jakub Kicinski Date: Tue Feb 3 19:23:46 2026 -0800 Merge branch 'net-gro-fix-outer-network-offset' Paolo Abeni says: ==================== net: gro: fix outer network offset The GRO stage has still problems in some edge scenarios when dealing with encapsulated traffic: the first patch address an issue there leading to bad checksums. The second patch introduces a test case covering the relevant scenario: S/W segmentation after GRO for encapsulated traffic. ==================== Link: https://patch.msgid.link/cover.1770032084.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit bee60ce21b751275b3a7766f614373ef02dde512 Author: Paolo Abeni Date: Mon Feb 2 12:43:15 2026 +0100 selftest: net: add a test-case for encap segmentation after GRO We had a few patches in this area and no explicit coverage so far. The test case covers the scenario addressed by the previous fix; reusing the existing udpgro_fwd.sh script to leverage part of the of the virtual network setup, even if such script is possibly not a perfect fit. Note that the mentioned script already contains several shellcheck violation; this patch does not fix the existing code, just avoids adding more issues in the new one. Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/768ca132af81e83856e34d3105b86c37e566a7ad.1770032084.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 5c2c3c38be396257a6a2e55bd601a12bb9781507 Author: Paolo Abeni Date: Mon Feb 2 12:43:14 2026 +0100 net: gro: fix outer network offset The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup. Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing. Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete(). Fixes: 5ef31ea5d053 ("net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb") Reviewed-by: Willem de Bruijn Signed-off-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/562638dbebb3b15424220e26a180274b387e2a88.1770032084.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit f613e8b4afea0cd17c7168e8b00e25bc8d33175d Author: Eric Dumazet Date: Mon Feb 2 20:52:17 2026 +0000 net: add proper RCU protection to /proc/net/ptype Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules. ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier. At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period. Define ptype_iter_state to carry a dev pointer along seq_net_private: struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch }; We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes. We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values) Many thanks to Dong Chenchen for providing a repro. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1d10f8a1f40b ("net-procfs: show net devices bound packet types") Fixes: c353e8983e0d ("net: introduce per netns packet chains") Reported-by: Yin Fengwei Reported-by: Dong Chenchen Closes: https://lore.kernel.org/netdev/CANn89iKRRKPnWjJmb-_3a=sq+9h6DvTQM4DBZHT5ZRGPMzQaiA@mail.gmail.com/T/#m7b80b9fc9b9267f90e0b7aad557595f686f9c50d Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Tested-by: Yin Fengwei Link: https://patch.msgid.link/20260202205217.2881198-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 78211543d2e44f84093049b4ef5f5bfa535f4645 Author: Chen Ni Date: Mon Feb 2 12:02:28 2026 +0800 net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() The devm_gpiod_get_optional() function may return an ERR_PTR in case of genuine GPIO acquisition errors, not just NULL which indicates the legitimate absence of an optional GPIO. Add an IS_ERR() check after the call in adin1110_check_spi(). On error, return the error code to ensure proper failure handling rather than proceeding with invalid pointers. Fixes: 36934cac7aaf ("net: ethernet: adi: adin1110: add reset GPIO") Signed-off-by: Chen Ni Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20260202040228.4129097-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 8302d0afeaec0bc57d951dd085e0cffe997d4d18 Author: Dave Airlie Date: Tue Feb 3 15:21:13 2026 +1000 nouveau/gsp: fix suspend/resume regression on r570 firmware The r570 firmware with certain GPUs (at least RTX6000) needs this flag to reflect the suspend vs runtime PM state of the driver. This uses that info to set the correct flags to the firmware. This fixes a regression on RTX6000 and other GPUs since r570 firmware was enabled. Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144") Cc: Reviewed-by: Lyude Paul Tested-by: Lyude Paul Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260203052431.2219998-4-airlied@gmail.com commit 8f8a4dce64013737701d13565cf6107f42b725ea Author: Dave Airlie Date: Tue Feb 3 15:21:12 2026 +1000 nouveau: add a third state to the fini handler. This is just refactoring to allow the lower layers to distinguish between suspend and runtime suspend. GSP 570 needs to set a flag with the GPU is going into GCOFF, this flag taken from the opengpu driver is set whenever runtime suspend is enterning GCOFF but not for normal suspend paths. This just refactors the code, a subsequent patch use the information. Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144") Cc: Reviewed-by: Lyude Paul Tested-by: Lyude Paul Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260203052431.2219998-3-airlied@gmail.com commit 90caca3b7264cc3e92e347b2004fff4e386fc26e Author: Dave Airlie Date: Tue Feb 3 15:21:11 2026 +1000 nouveau/gsp: use rpc sequence numbers properly. There are two layers of sequence numbers, one at the msg level and one at the rpc level. 570 firmware started asserting on the sequence numbers being in the right order, and we would see nocat records with asserts in them. Add the rpc level sequence number support. Fixes: 53dac0623853 ("drm/nouveau/gsp: add support for 570.144") Cc: Signed-off-by: Dave Airlie Reviewed-by: Lyude Paul Tested-by: Lyude Paul Link: https://patch.msgid.link/20260203052431.2219998-2-airlied@gmail.com commit 5fd0a1df5d05ad066e5618ccdd3d0fa6cb686c27 Merge: de0674d9bc6969 67b3da8d3051fb Author: Linus Torvalds Date: Tue Feb 3 16:20:59 2026 -0800 Merge tag 'v6.19rc8-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Two small client memory leak fixes" * tag 'v6.19rc8-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb/client: fix memory leak in SendReceive() smb/client: fix memory leak in smb2_open_file() commit 6b61a54e684006ca0d92d684a1d3c3a00f077d8f Author: Harish Kasiviswanathan Date: Fri Jan 9 15:26:36 2026 -0500 drm/amdgpu: Fix double deletion of validate_list If amdgpu_amdkfd_gpuvm_free_memory_of_gpu() fails after kgd_mem is removed from validate_list, the mem handle still lingers in the KFD idr. This means when process is terminated, kfd_process_free_outstanding_kfd_bos() will call amdgpu_amdkfd_gpuvm_free_memory_of_gpu() again resulting in double deletion. To avoid this - (a) Check if list is empty before deleting it (b) Rearragne amdgpu_amdkfd_gpuvm_free_memory_of_gpu() such that it can be safely called again if it returns failure the first time. Signed-off-by: Harish Kasiviswanathan Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 6ba60345f45eaf7cb4f89105d26083a4b9fd1cba) commit 84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0 Author: Melissa Wen Date: Fri Jan 16 12:50:49 2026 -0300 drm/amd/display: remove assert around dpp_base replacement There is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS. Remove the assert placed for a TODO to avoid misinterpretations. Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 1714dcc4c2c53e41190896eba263ed6328bcf415) commit d25b32aa829a3ed5570138e541a71fb7805faec3 Author: Melissa Wen Date: Mon Dec 8 22:44:15 2025 -0100 drm/amd/display: extend delta clamping logic to CM3 LUT helper Commit 27fc10d1095f ("drm/amd/display: Fix the delta clamping for shaper LUT") fixed banding when using plane shaper LUT in DCN10 CM helper. The problem is also present in DCN30 CM helper, fix banding by extending the same bug delta clamping fix to CM3. Signed-off-by: Melissa Wen Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit 0274a54897f356f9c78767c4a2a5863f7dde90c6) commit 8f959d37c1f2efec6dac55915ee82302e98101fb Author: Melissa Wen Date: Thu Jan 22 12:20:29 2026 -0300 drm/amd/display: fix wrong color value mapping on MCM shaper LUT Some shimmer/colorful points appears when using the steamOS color pipeline for HDR on gaming with DCN32. These points look like black values being wrongly mapped to red/blue/green values. It was caused because the number of hw points in regular LUTs and in a shaper LUT was treated as the same. DCN3+ regular LUTs have 257 bases and implicit deltas (i.e. HW calculates them), but shaper LUT is a special case: it has 256 bases and 256 deltas, as in DCN1-2 regular LUTs, and outputs 14-bit values. Fix that by setting by decreasing in 1 the number of HW points computed in the LUT segmentation so that shaper LUT (i.e. fixpoint == true) keeps the same DCN10 CM logic and regular LUTs go with `hw_points + 1`. CC: Krunoslav Kovac Fixes: 4d5fd3d08ea9 ("drm/amd/display: PQ tail accuracy") Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 5006505b19a2119e71c008044d59f6d753c858b9) commit 243b467dea1735fed904c2e54d248a46fa417a2d Author: Bert Karwatzki Date: Sun Feb 1 01:24:45 2026 +0100 Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" This reverts commit 7294863a6f01248d72b61d38478978d638641bee. This commit was erroneously applied again after commit 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") removed it, leading to very hard to debug crashes, when used with a system with two AMD GPUs of which only one supports ASPM. Link: https://lore.kernel.org/linux-acpi/20251006120944.7880-1-spasswolf@web.de/ Link: https://github.com/acpica/acpica/issues/1060 Fixes: 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") Signed-off-by: Bert Karwatzki Reviewed-by: Christian König Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 97a9689300eb2b393ba5efc17c8e5db835917080) Cc: stable@vger.kernel.org commit 1478a34470bf4755465d29b348b24a610bccc180 Author: Mario Limonciello Date: Thu Jan 29 13:47:22 2026 -0600 drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52 commit f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") caused a dependency on new enough MES firmware to use amdgpu. This was fixed on most gfx11 and gfx12 hardware with commit 0180e0a5dd5c ("drm/amdgpu/mes: add compatibility checks for set_hw_resource_1"), but this left out that GC 11.0.4 had breakage at MES 0x51. Bump the requirement to 0x52 instead. Reported-by: danijel@nausys.com Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4576 Fixes: f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit c2d2ccc85faf8cc6934d50c18e43097eb453ade2) Cc: stable@vger.kernel.org commit b126097b0327437048bd045a0e4d273dea2910dd Author: LI Qingwu Date: Fri Jan 16 11:19:05 2026 +0000 i2c: imx: preserve error state in block data length handler When a block read returns an invalid length, zero or >I2C_SMBUS_BLOCK_MAX, the length handler sets the state to IMX_I2C_STATE_FAILED. However, i2c_imx_master_isr() unconditionally overwrites this with IMX_I2C_STATE_READ_CONTINUE, causing an endless read loop that overruns buffers and crashes the system. Guard the state transition to preserve error states set by the length handler. Fixes: 5f5c2d4579ca ("i2c: imx: prevent rescheduling in non dma mode") Signed-off-by: LI Qingwu Cc: # v6.13+ Reviewed-by: Stefan Eichenberger Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260116111906.3413346-2-Qing-wu.Li@leica-geosystems.com.cn Signed-off-by: Wolfram Sang commit bc8dedae022ce3058659c3addef3ec4b41d15e00 Author: Daniel Vogelbacher Date: Sun Feb 1 09:34:01 2026 +0100 ceph: fix oops due to invalid pointer for kfree() in parse_longname() This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running `ls /mnt/my_ceph/.snap`. The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer. Steps to reproduce: 1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase) 2. Add cephfs mount to fstab $ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab 3. Reboot the system $ systemctl reboot 4. Check if it's really mounted $ mount | grep stuff 5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap Now ls hangs forever and the kernel log shows the oops. Cc: stable@vger.kernel.org Fixes: 101841c38346 ("[ceph] parse_longname(): strrchr() expects NUL-terminated string") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220807 Suggested-by: Helge Deller Signed-off-by: Daniel Vogelbacher Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit bd3884a204c3b507e6baa9a4091aa927f9af5404 Author: Ilya Dryomov Date: Wed Jan 7 22:37:55 2026 +0100 rbd: check for EOD after exclusive lock is ensured to be held Similar to commit 870611e4877e ("rbd: get snapshot context after exclusive lock is ensured to be held"), move the "beyond EOD" check into the image request state machine so that it's performed after exclusive lock is ensured to be held. This avoids various race conditions which can arise when the image is shrunk under I/O (in practice, mostly readahead). In one such scenario rbd_assert(objno < rbd_dev->object_map_size); can be triggered if a close-to-EOD read gets queued right before the shrink is initiated and the EOD check is performed against an outdated mapping_size. After the resize is done on the server side and exclusive lock is (re)acquired bringing along the new (now shrunk) object map, the read starts going through the state machine and rbd_obj_may_exist() gets invoked on an object that is out of bounds of rbd_dev->object_map array. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit de0674d9bc69699c497477d45172493393ae9007 Merge: d0452e3ea094e1 29fb415a6a72c9 Author: Linus Torvalds Date: Tue Feb 3 10:19:58 2026 -0800 Merge tag 'for-6.19-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "A regression fix for a memory leak when raid56 is used" * tag 'for-6.19-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: raid56: fix memory leak of btrfs_raid_bio::stripe_uptodate_bitmap commit d0452e3ea094e1fd4959fb3fd67f8827a4c04743 Merge: 6bd9ed02871f22 008bec8ffe6e77 Author: Linus Torvalds Date: Tue Feb 3 10:06:43 2026 -0800 Merge tag 'platform-drivers-x86-v6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - classmate-laptop: Add missing NULL pointer checks - hp-bioscfg: Skip empty attribute names - intel_telemetry: - Fix PSS event register mask - Fix swapped arrays in PSS output - intel/tpmi/plr: Make the file domain/status writeable - intel/vsec: Add Nova Lake PUNIT support - lg-laptop: Recognize 2022-2025 models - panasonic-laptop: Fix sysfs group leak in error path - toshiba_haps: Fix memory leaks in add/remove routines * tag 'platform-drivers-x86-v6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel/tpmi/plr: Make the file domain/status writeable platform/x86: hp-bioscfg: Skip empty attribute names platform/x86: classmate-laptop: Add missing NULL pointer checks platform/x86: lg-laptop: Recognize 2022-2025 models platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro platform/x86: intel_telemetry: Fix PSS event register mask platform/x86: intel_telemetry: Fix swapped arrays in PSS output platform/x86/intel/vsec: Add Nova Lake PUNIT support platform/x86: toshiba_haps: Fix memory leaks in add/remove routines platform/x86: panasonic-laptop: Fix sysfs group leak in error path commit 38cfdd9dd279473a73814df9fd7e6e716951d361 Author: Jens Axboe Date: Tue Feb 3 09:56:55 2026 -0700 io_uring/fdinfo: be a bit nicer when looping a lot of SQEs/CQEs Add cond_resched() in those dump loops, just in case a lot of entries are being dumped. And detect invalid CQ ring head/tail entries, to avoid iterating more than what is necessary. Generally not an issue, but can be if things like KASAN or other debugging metrics are enabled. Reported-by: 是参差 Link: https://lore.kernel.org/all/PS1PPF7E1D7501FE5631002D242DD89403FAB9BA@PS1PPF7E1D7501F.apcprd02.prod.outlook.com/ Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit 124bdc6eccc8c5cba68fee00e01c084c116c4360 Author: Sergey Shtylyov Date: Tue Feb 3 19:15:57 2026 +0300 ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() When the support for the Sound Blaster X-Fi Surround 5.1 Pro was added, the existing logic for the X-Fi Surround 5.1 in snd_audigy2nx_led_put() was broken due to missing *else* before the added *if*: snd_usb_ctl_msg() became incorrectly called twice and an error from first snd_usb_ctl_msg() call ignored. As the added snd_usb_ctl_msg() call was totally identical to the existing one for the "plain" X-Fi Surround 5.1, just merge those two *if* statements while fixing the broken logic... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Fixes: 7cdd8d73139e ("ALSA: usb-audio - Add support for USB X-Fi S51 Pro") Signed-off-by: Sergey Shtylyov Link: https://patch.msgid.link/20260203161558.18680-1-s.shtylyov@auroraos.dev Signed-off-by: Takashi Iwai commit b1dfe4e0fcef0cc01233a70ec8fd95b900024a5a Author: Jens Axboe Date: Tue Feb 3 09:55:47 2026 -0700 io_uring/fdinfo: kill unnecessary newline feed in CQE32 printing There's an unconditional newline feed anyway after dumping both normal and big CQE contents, remove the \n from the CQE32 extra1/extra2 printing. Signed-off-by: Jens Axboe commit 826af7fa62e347464b1b4e0ba2fe19a92438084f Author: Takashi Iwai Date: Tue Feb 3 15:09:59 2026 +0100 ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF. Reported-by: syzbot+5f8f3acdee1ec7a7ef7b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/69783ba1.050a0220.c9109.0011.GAE@google.com Cc: Link: https://patch.msgid.link/20260203141003.116584-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 6e1e735181e0c18e1f4ecb0118be4b1e2ee439d1 Author: Shuming Fan Date: Tue Feb 3 16:48:26 2026 +0800 ASoC: rt1320: fix intermittent no-sound issue This patch adds a setting to resolve the intermittent no-sound issue. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20260203084827.768238-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 284e70ace9ecdeb8644fbe65c5da12c90b377545 Author: Bard Liao Date: Tue Feb 3 15:24:05 2026 +0800 ASoC: SOF: Intel: use hdev->info.link_mask directly The link_mask variable is not changed after setting to hdev->info.link_mask until it is used for another purpose to get the used SoundWire links and set to mach->mach_params.links. Besides, the link_mask variable should be reset before any link id is added to the link_mask. To fix the issue above and avoid confusing, use the hdev->info.link_mask variable directly to check if the SoundWire link is enabled. Fixes: 5226d19d4cae ("ASoC: SOF: Intel: use sof_sdw as default SDW machine driver") Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260203072405.3716307-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit fb7f54aa2a99b07945911152c5d3d4a6eb39f797 Author: Miri Korenblit Date: Thu Jan 29 21:27:10 2026 +0200 wifi: iwlwifi: mvm: pause TCM on fast resume Not pausing it means that we can have the TCM work queued into a non-freezable workqueue, which, in resume, is re-activated before the driver's resume is called. The TCM work might send commands to the FW before we resumed the device, leading to an assert. Closes: https://lore.kernel.org/linux-wireless/aTDoDiD55qlUZ0pn@debian.local/ Tested-by: Chris Bainbridge Fixes: e8bb19c1d590 ("wifi: iwlwifi: support fast resume") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260129212650.05621f3faedb.I44df9cf9183b5143df8078131e0d87c0fd7e1763@changeid commit 5ff641011ab7fb63ea101251087745d9826e8ef5 Author: Miri Korenblit Date: Thu Jan 29 21:27:09 2026 +0200 wifi: iwlwifi: mld: cancel mlo_scan_start_wk mlo_scan_start_wk is not canceled on disconnection. In fact, it is not canceled anywhere except in the restart cleanup, where we don't really have to. This can cause an init-after-queue issue: if, for example, the work was queued and then drv_change_interface got executed. This can also cause use-after-free: if the work is executed after the vif is freed. Fixes: 9748ad82a9d9 ("wifi: iwlwifi: defer MLO scan after link activation") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260129212650.a36482a60719.I5bf64a108ca39dacb5ca0dcd8b7258a3ce8db74c@changeid commit ec4ddc90d201d09ef4e4bef8a2c6d9624525ad68 Author: Carlos Llamas Date: Tue Jan 27 23:55:11 2026 +0000 binderfs: fix ida_alloc_max() upper bound The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'. Cc: stable@vger.kernel.org Fixes: 3ad20fe393b3 ("binder: implement binderfs") Signed-off-by: Carlos Llamas Link: https://patch.msgid.link/20260127235545.2307876-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit d6ba734814266bbf7ee01f9030436597116805f3 Author: Carlos Llamas Date: Tue Jan 27 23:55:10 2026 +0000 rust_binderfs: fix ida_alloc_max() upper bound The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202512181203.IOv6IChH-lkp@intel.com/ Signed-off-by: Carlos Llamas Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260127235545.2307876-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 29fb415a6a72c9207d118dd0a7a37184a14a3680 Author: Filipe Manana Date: Fri Jan 30 17:06:45 2026 +0000 btrfs: raid56: fix memory leak of btrfs_raid_bio::stripe_uptodate_bitmap We allocate the bitmap but we never free it in free_raid_bio_pointers(). Fix this by adding a bitmap_free() call against the stripe_uptodate_bitmap of a raid bio. Fixes: 1810350b04ef ("btrfs: raid56: move sector_ptr::uptodate into a dedicated bitmap") Reported-by: Christoph Hellwig Link: https://lore.kernel.org/linux-btrfs/20260126045315.GA31641@lst.de/ Reviewed-by: Qu Wenruo Tested-by: Christoph Hellwig Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3125fc17016945b11e9725c6aff30ff3326fd58f Author: Tomas Hlavacek Date: Fri Jan 30 11:23:01 2026 +0100 net: spacemit: k1-emac: fix jumbo frame support The driver never programs the MAC frame size and jabber registers, causing the hardware to reject frames larger than the default 1518 bytes even when larger DMA buffers are allocated. Program MAC_MAXIMUM_FRAME_SIZE, MAC_TRANSMIT_JABBER_SIZE, and MAC_RECEIVE_JABBER_SIZE based on the configured MTU. Also fix the maximum buffer size from 4096 to 4095, since the descriptor buffer size field is only 12 bits. Account for double VLAN tags in frame size calculations. Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Cc: stable@vger.kernel.org Signed-off-by: Tomas Hlavacek Link: https://patch.msgid.link/20260130102301.477514-1-tmshlvck@gmail.com Signed-off-by: Jakub Kicinski commit 1a47837bfafed7e9ef93f5dfdea6d70869b0c3ab Author: Li Chen Date: Fri Jan 30 19:20:33 2026 +0800 Documentation: document liveupdate cmdline parameter liveupdate is used to enable Live Update Orchestrator (LUO) early during boot. Add it to kernel-parameters.txt so users can discover and use it. Link: https://lkml.kernel.org/r/20260130112036.359806-1-me@linux.beauty Signed-off-by: Li Chen Acked-by: Mike Rapoport (Microsoft) Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Frank van der Linden Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Kees Cook Cc: Li RongQing Cc: Pawan Gupta Cc: Randy Dunlap Cc: Pratyush Yadav Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 2030dddf95451b4e7a389f052091e7c4b7b274c6 Author: Kairui Song Date: Thu Jan 29 00:19:23 2026 +0800 mm, shmem: prevent infinite loop on truncate race When truncating a large swap entry, shmem_free_swap() returns 0 when the entry's index doesn't match the given index due to lookup alignment. The failure fallback path checks if the entry crosses the end border and aborts when it happens, so truncate won't erase an unexpected entry or range. But one scenario was ignored. When `index` points to the middle of a large swap entry, and the large swap entry doesn't go across the end border, find_get_entries() will return that large swap entry as the first item in the batch with `indices[0]` equal to `index`. The entry's base index will be smaller than `indices[0]`, so shmem_free_swap() will fail and return 0 due to the "base < index" check. The code will then call shmem_confirm_swap(), get the order, check if it crosses the END boundary (which it doesn't), and retry with the same index. The next iteration will find the same entry again at the same index with same indices, leading to an infinite loop. Fix this by retrying with a round-down index, and abort if the index is smaller than the truncate range. Link: https://lkml.kernel.org/r/aXo6ltB5iqAKJzY8@KASONG-MC4 Fixes: 809bc86517cc ("mm: shmem: support large folio swap out") Fixes: 8a1968bd997f ("mm/shmem, swap: fix race of truncate and swap entry split") Signed-off-by: Kairui Song Reported-by: Chris Mason Closes: https://lore.kernel.org/linux-mm/20260128130336.727049-1-clm@meta.com/ Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Hugh Dickins Cc: Kemeng Shi Cc: Nhat Pham Cc: Signed-off-by: Andrew Morton commit f1675db3c7f1838dbbec4f1768d680e0acbc6721 Author: Alexander Mikhalitsyn Date: Wed Jan 28 18:39:15 2026 +0100 mailmap: update Alexander Mikhalitsyn's emails Link: https://lkml.kernel.org/r/20260128173915.162309-1-alexander@mihalicyn.com Signed-off-by: Alexander Mikhalitsyn Signed-off-by: Andrew Morton commit 011d4e52a76cf4131ae612869b9874c09eef7657 Author: Pratyush Yadav (Google) Date: Tue Jan 27 00:02:52 2026 +0100 liveupdate: luo_file: do not clear serialized_data on unfreeze Patch series "liveupdate: fixes in error handling". This series contains some fixes in LUO's error handling paths. The first patch deals with failed freeze() attempts. The cleanup path calls unfreeze, and that clears some data needed by later unpreserve calls. The second patch is a bit more involved. It deals with failed retrieve() attempts. To do so properly, it reworks some of the error handling logic in luo_file core. Both these fixes are "theoretical" -- in the sense that I have not been able to reproduce either of them in normal operation. The only supported file type right now is memfd, and there is nothing userspace can do right now to make it fail its retrieve or freeze. I need to make the retrieve or freeze fail by artificially injecting errors. The injected errors trigger a use-after-free and a double-free. That said, once more complex file handlers are added or memfd preservation is used in ways not currently expected or covered by the tests, we will be able to see them on real systems. This patch (of 2): The unfreeze operation is supposed to undo the effects of the freeze operation. serialized_data is not set by freeze, but by preserve. Consequently, the unpreserve operation needs to access serialized_data to undo the effects of the preserve operation. This includes freeing the serialized data structures for example. If a freeze callback fails, unfreeze is called for all frozen files. This would clear serialized_data for them. Since live update has failed, it can be expected that userspace aborts, releasing all sessions. When the sessions are released, unpreserve will be called for all files. The unfrozen files will see 0 in their serialized_data. This is not expected by file handlers, and they might either fail, leaking data and state, or might even crash or cause invalid memory access. Do not clear serialized_data on unfreeze so it gets passed on to unpreserve. There is no need to clear it on unpreserve since luo_file will be freed immediately after. Link: https://lkml.kernel.org/r/20260126230302.2936817-1-pratyush@kernel.org Link: https://lkml.kernel.org/r/20260126230302.2936817-2-pratyush@kernel.org Fixes: 7c722a7f44e0 ("liveupdate: luo_file: implement file systems callbacks") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 16459fe7e0ca6520a6e8f603de4ccd52b90fd765 Author: Andrew Cooper Date: Mon Jan 26 21:10:46 2026 +0000 x86/kfence: fix booting on 32bit non-PAE systems The original patch inverted the PTE unconditionally to avoid L1TF-vulnerable PTEs, but Linux doesn't make this adjustment in 2-level paging. Adjust the logic to use the flip_protnone_guard() helper, which is a nop on 2-level paging but inverts the address bits in all other paging modes. This doesn't matter for the Xen aspect of the original change. Linux no longer supports running 32bit PV under Xen, and Xen doesn't support running any 32bit PV guests without using PAE paging. Link: https://lkml.kernel.org/r/20260126211046.2096622-1-andrew.cooper3@citrix.com Fixes: b505f1944535 ("x86/kfence: avoid writing L1TF-vulnerable PTEs") Reported-by: Ryusuke Konishi Closes: https://lore.kernel.org/lkml/CAKFNMokwjw68ubYQM9WkzOuH51wLznHpEOMSqtMoV1Rn9JV_gw@mail.gmail.com/ Signed-off-by: Andrew Cooper Tested-by: Ryusuke Konishi Tested-by: Borislav Petkov (AMD) Cc: Alexander Potapenko Cc: Marco Elver Cc: Dmitry Vyukov Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Jann Horn Cc: Signed-off-by: Andrew Morton commit 79987ce1bce9f6a756c2cf3c78f8a759a507a0e1 Merge: d9f5824d5d9a7b 40857194956dca Author: Jakub Kicinski Date: Mon Feb 2 18:22:35 2026 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-30 (ice, i40e) This series contains updates to ice and i40e drivers. Grzegorz and Jake resolve issues around timing for E825 that can cause Tx timestamps to be missed/interrupts not generated on ice. Aaron Ma defers restart of PTP work until after after VSIs are rebuilt to prevent NULL pointer dereference for ice. Mohammad Heib removes calls to udp_tunnel_get_rx_info() in ice and i40e which violates locking expectations and is unneeded. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: drop udp_tunnel_get_rx_info() call from i40e_open() ice: drop udp_tunnel_get_rx_info() call from ndo_open() ice: Fix PTP NULL pointer dereference during VSI rebuild ice: PTP: fix missing timestamps on E825 hardware ice: fix missing TX timestamps interrupts on E825 devices ==================== Link: https://patch.msgid.link/20260130185401.1091523-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d9f5824d5d9a7b8c717c03d8d54dc2c2df991037 Merge: 74d9391e8849e7 c28d765ec5da16 Author: Jakub Kicinski Date: Mon Feb 2 18:11:53 2026 -0800 Merge branch 'enetc-v4-hardware-integration-fixes' Claudiu Manoil says: ==================== ENETC v4 hardware integration fixes ENETC v4 targeted fixes addressing SoC level integration issues regarding AXI settings and register access width. ==================== Link: https://patch.msgid.link/20260130141035.272471-1-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski commit c28d765ec5da160d3a48d0928528084cef97bf19 Author: Claudiu Manoil Date: Fri Jan 30 16:10:35 2026 +0200 net: enetc: Convert 16-bit register reads to 32-bit for ENETC v4 It is not recommended to access the 32‑bit registers of this hardware IP using lower‑width accessors (i.e. 16‑bit), and the only exception to this rule was introduced in the initial ENETC v1 driver for the PMAR1 register, which holds the lower 16 bits of the primary MAC address of an SI. Meanwhile, this exception has been replicated in the v4 driver code as well. Since LS1028 (the only SoC with ENETC v1) is not affected by this issue, the current patch converts the 16‑bit reads from PMAR1 starting with ENETC v4. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260130141035.272471-5-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski commit 21d0fc95b5920ae8e69a2c0394bef82b8392bcc9 Author: Claudiu Manoil Date: Fri Jan 30 16:10:34 2026 +0200 net: enetc: Convert 16-bit register writes to 32-bit for ENETC v4 For ENETC v4, which is integrated into more complex SoCs (compared to v1), 16‑bit register writes are blocked in the SoC interconnect on some chips. To be fair, it is not recommended to access 32‑bit registers of this IP using lower‑width accessors (i.e. 16‑bit), and the only exception to this rule was introduced by me in the initial ENETC v1 driver for the PMAR1 register, which holds the lower 16 bits of the primary MAC address of an SI. Meanwhile, this exception has been replicated for v4 as well. Since LS1028 (the only SoC with ENETC v1) is not affected by this issue, the current patch fixes the 16‑bit writes to PMAR1 starting with ENETC v4. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260130141035.272471-4-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski commit 9ae13b2e64fcd2ca00a76b7d60fc4641a6b9209d Author: Claudiu Manoil Date: Fri Jan 30 16:10:33 2026 +0200 net: enetc: Remove CBDR cacheability AXI settings for ENETC v4 For ENETC v4 these settings are controlled by the global ENETC command cache attribute registers (EnCAR), from the IERB register block. The hardcoded CDBR cacheability settings were inherited from LS1028A, and should be removed from the ENETC v4 driver as they conflict with the global IERB settings. Fixes: e3f4a0a8ddb4 ("net: enetc: add command BD ring support for i.MX95 ENETC") Signed-off-by: Claudiu Manoil Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260130141035.272471-3-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski commit a69c17230cab07bd156f894fdc82bd78b43ea72f Author: Claudiu Manoil Date: Fri Jan 30 16:10:32 2026 +0200 net: enetc: Remove SI/BDR cacheability AXI settings for ENETC v4 For ENETC v4 these settings are controlled by the global ENETC message and buffer cache attribute registers (EnBCAR and EnMCAR), from the IERB register block. The hardcoded cacheability settings were inherited from LS1028A, and should be removed from the ENETC v4 driver as they conflict with the global IERB settings. Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF") Signed-off-by: Claudiu Manoil Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260130141035.272471-2-claudiu.manoil@nxp.com Signed-off-by: Jakub Kicinski commit 74d9391e8849e70ded5309222d09b0ed0edbd039 Author: Daniel Hodges Date: Sat Jan 31 10:01:14 2026 -0800 tipc: use kfree_sensitive() for session key material The rx->skey field contains a struct tipc_aead_key with GCM-AES encryption keys used for TIPC cluster communication. Using plain kfree() leaves this sensitive key material in freed memory pages where it could potentially be recovered. Switch to kfree_sensitive() to ensure the key material is zeroed before the memory is freed. Fixes: 1ef6f7c9390f ("tipc: add automatic session key exchange") Signed-off-by: Daniel Hodges Link: https://patch.msgid.link/20260131180114.2121438-1-hodgesd@meta.com Signed-off-by: Jakub Kicinski commit dbbec8c5a79f4c7aa8d07da8c0b5a34d76c50699 Author: Russell King (Oracle) Date: Fri Jan 30 20:04:57 2026 +0000 net: stmmac: fix stm32 (and potentially others) resume regression Marek reported that suspending stm32 causes the following errors when the interface is administratively down: $ echo devices > /sys/power/pm_test $ echo mem > /sys/power/state ... ck_ker_eth2stp already disabled ... ck_ker_eth2stp already unprepared ... On suspend, stm32 starts the eth2stp clock in its suspend method, and stops it in the resume method. This is because the blamed commit omits the call to the platform glue ->suspend() method, but does make the call to the platform glue ->resume() method. This problem affects all other converted drivers as well - e.g. looking at the PCIe drivers, pci_save_state() will not be called, but pci_restore_state() will be. Similar issues affect all other drivers. Fix this by always calling the ->suspend() method, even when the network interface is down. This fixes all the conversions to the platform glue ->suspend() and ->resume() methods. Link: https://lore.kernel.org/r/20260114081809.12758-1-marex@nabladev.com Fixes: 07bbbfe7addf ("net: stmmac: add suspend()/resume() platform ops") Reported-by: Marek Vasut Tested-by: Marek Vasut Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vlujh-00000007Hkw-2p6r@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1c172febdf065375359b2b95156e476bfee30b60 Author: Jakub Kicinski Date: Fri Jan 30 11:03:11 2026 -0800 net: rss: fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for contexts Initializing input_xfrm to RXH_XFRM_NO_CHANGE in RSS contexts is problematic. I think I did this to make it clear that the context does not have its own settings applied. But unlike ETH_RSS_HASH_NO_CHANGE which is zero, RXH_XFRM_NO_CHANGE is 0xff. We need to be careful when reading the value back, and remember to treat 0xff as 0. Remove the initialization and switch to storing 0. This lets us also remove the workaround in ethnl_rss_set(). Get side does not need any adjustments and context get no longer reports: RSS input transformation: symmetric-xor: on symmetric-or-xor: on Unknown bits in RSS input transformation: 0xfc for NICs which don't support input_xfrm. Remove the init of hfunc to ETH_RSS_HASH_NO_CHANGE while at it. As already mentioned this is a noop since ETH_RSS_HASH_NO_CHANGE is 0 and struct is zalloc'd. But as this fix exemplifies storing NO_CHANGE as state is fragile. This issue is implicitly caught by running our selftests because YNL in selftests errors out on unknown bits. Fixes: d3e2c7bab124 ("ethtool: rss: support setting input-xfrm via Netlink") Link: https://patch.msgid.link/20260130190311.811129-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 83b67cc9be9223183caf91826d9c194d7fb128fa Author: Jiayuan Chen Date: Sun Feb 1 21:59:10 2026 +0800 linkwatch: use __dev_put() in callers to prevent UAF After linkwatch_do_dev() calls __dev_put() to release the linkwatch reference, the device refcount may drop to 1. At this point, netdev_run_todo() can proceed (since linkwatch_sync_dev() sees an empty list and returns without blocking), wait for the refcount to become 1 via netdev_wait_allrefs_any(), and then free the device via kobject_put(). This creates a use-after-free when __linkwatch_run_queue() tries to call netdev_unlock_ops() on the already-freed device. Note that adding netdev_lock_ops()/netdev_unlock_ops() pair in netdev_run_todo() before kobject_put() would not work, because netdev_lock_ops() is conditional - it only locks when netdev_need_ops_lock() returns true. If the device doesn't require ops_lock, linkwatch won't hold any lock, and netdev_run_todo() acquiring the lock won't provide synchronization. Fix this by moving __dev_put() from linkwatch_do_dev() to its callers. The device reference logically pairs with de-listing the device, so it's reasonable for the caller that did the de-listing to release it. This allows placing __dev_put() after all device accesses are complete, preventing UAF. The bug can be reproduced by adding mdelay(2000) after linkwatch_do_dev() in __linkwatch_run_queue(), then running: ip tuntap add mode tun name tun_test ip link set tun_test up ip link set tun_test carrier off ip link set tun_test carrier on sleep 0.5 ip tuntap del mode tun name tun_test KASAN report: ================================================================== BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline] BUG: KASAN: use-after-free in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245 Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123 CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events_unbound linkwatch_event Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x156/0x4c9 mm/kasan/report.c:482 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595 netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] netdev_unlock_ops include/net/netdev_lock.h:47 [inline] __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 ================================================================== Fixes: 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE") Reported-by: syzbot+1ec2f6a450f0b54af8c8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6824d064.a70a0220.3e9d8.001a.GAE@google.com/T/ Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260201135915.393451-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski commit 6bd9ed02871f22beb0e50690b0c3caf457104f7c Merge: dee65f79364c18 99a2ef50090613 Author: Linus Torvalds Date: Mon Feb 2 15:14:45 2026 -0800 Merge tag 'cgroup-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "Three dmem fixes from Chen Ridong addressing use-after-free, RCU warning, and NULL pointer dereference issues introduced with the dmem controller. All changes are confined to kernel/cgroup/dmem.c and can only affect dmem controller users" * tag 'cgroup-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/dmem: avoid pool UAF cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: fix NULL pointer dereference when setting max commit dee65f79364c18033cabdf0728c7e7025405cf40 Merge: 18f7fcd5e69a04 bdde21d3e77da5 Author: Linus Torvalds Date: Mon Feb 2 09:48:23 2026 -0800 Merge tag 'lsm-pr-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm fix from Paul Moore: "A small patch to address a regression found in the v6.19-rcX releases where the /proc/sys/vm/mmap_min_addr tunable disappeared when CONFIG_SECURITY was not selected. Long term we plan to work with the MM folks to get the core parts of this moved over to the MM subsystem, but in the meantime we need to fix this regression prior to the v6.19 release" * tag 'lsm-pr-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY commit 52fb36a5f9c15285b7d67c0ff87dc17b3206b5df Author: Gabor Juhos Date: Mon Feb 2 16:58:57 2026 +0100 hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled When CONFIG_PM is disabled, the GPIO controlled FANs can't be stopped by using the sysfs attributes since commit 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support"). Using either the 'pwm1' or the 'fan1_target' attribute fails the same way: $ echo 0 > /sys/class/hwmon/hwmon1/pwm1 ash: write error: Function not implemented $ echo 0 > /sys/class/hwmon/hwmon1/fan1_target ash: write error: Function not implemented Both commands were working flawlessly before the mentioned commit. The issue happens because pm_runtime_put_sync() returns with -ENOSYS when CONFIG_PM is disabled, and the set_fan_speed() function handles this as an error. In order to restore the previous behaviour, change the error check in the set_fan_speed() function to ignore the -ENOSYS error code. Cc: stable@vger.kernel.org Fixes: 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support") Signed-off-by: Gabor Juhos Link: https://lore.kernel.org/r/20260202-gpio-fan-stop-fix-v1-1-c7853183d93d@gmail.com Signed-off-by: Guenter Roeck commit f5c092787c48296633c2dd7240752f88fa9710fc Author: Gabor Juhos Date: Sun Feb 1 21:35:06 2026 +0100 hwmon: (gpio-fan) Fix set_rpm() return value The set_rpm function is used as a 'store' callback of a device attribute, and as such it should return with the number of bytes consumed. However since commit 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support"), the function returns with zero on success. Due to this, the function gets called again and again whenever the user tries to change the FAN speed by writing the desired RPM value into the 'fan1_target' sysfs attribute. The broken behaviour can be reproduced easily. For example, the following command never returns unless it gets terminated: $ echo 500 > /sys/class/hwmon/hwmon1/fan1_target ^C $ Change the code to return with the same value as the 'count' parameter on success to indicate that all bytes from the input buffer are consumed. The function behaved the same way prior to the offending change. Cc: stable@vger.kernel.org Fixes: 0d01110e6356 ("hwmon: (gpio-fan) Add regulator support") Signed-off-by: Gabor Juhos Link: https://lore.kernel.org/r/20260201-gpio-fan-set_rpm-retval-fix-v1-1-dc39bc7693ca@gmail.com Signed-off-by: Guenter Roeck commit 67b3da8d3051fba7e1523b3afce4f71c658f15f8 Author: ChenXiaoSong Date: Mon Feb 2 09:49:06 2026 +0000 smb/client: fix memory leak in SendReceive() Reproducer: 1. server: supports SMB1, directories are exported read-only 2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs The error message is as follows: ============================================================================= BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Object 0x00000000d34491e6 @offset=896 Object 0x00000000bde9fab3 @offset=4480 Object 0x00000000104a1f70 @offset=6272 Object 0x0000000092a51bb5 @offset=7616 Object 0x000000006714a7db @offset=13440 ... WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712 ... Call Trace: kmem_cache_destroy+0x69/0x160 cifs_destroy_request_bufs+0x39/0x40 [cifs] cleanup_module+0x43/0xfc0 [cifs] __se_sys_delete_module+0x1d5/0x300 __x64_sys_delete_module+0x1a/0x30 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x6e/0x270 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712 Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6 Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()") Reported-by: Paulo Alcantara Reviewed-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit e3a43633023e3cacaca60d4b8972d084a2b06236 Author: ChenXiaoSong Date: Mon Feb 2 08:24:07 2026 +0000 smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs The error message is as follows: ============================================================================= BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Object 0x00000000d47521be @offset=14336 ... WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577 ... Call Trace: kmem_cache_destroy+0x94/0x190 cifs_destroy_request_bufs+0x3e/0x50 [cifs] cleanup_module+0x4e/0x540 [cifs] __se_sys_delete_module+0x278/0x400 __x64_sys_delete_module+0x5f/0x70 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x89/0x350 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577 Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6 Fixes: e255612b5ed9 ("cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES") Reported-by: Paulo Alcantara Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: ChenXiaoSong Reviewed-by: Pali Rohár Signed-off-by: Steve French commit 99a2ef500906138ba58093b9893972a5c303c734 Author: Chen Ridong Date: Mon Feb 2 12:27:18 2026 +0000 cgroup/dmem: avoid pool UAF An UAF issue was observed: BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150 Write of size 8 at addr ffff888106715440 by task insmod/527 CPU: 4 UID: 0 PID: 527 Comm: insmod 6.19.0-rc7-next-20260129+ #11 Tainted: [O]=OOT_MODULE Call Trace: dump_stack_lvl+0x82/0xd0 kasan_report+0xca/0x100 kasan_check_range+0x39/0x1c0 page_counter_uncharge+0x65/0x150 dmem_cgroup_uncharge+0x1f/0x260 Allocated by task 527: Freed by task 0: The buggy address belongs to the object at ffff888106715400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 64 bytes inside of freed 512-byte region [ffff888106715400, ffff888106715600) The buggy address belongs to the physical page: Memory state around the buggy address: ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb The issue occurs because a pool can still be held by a caller after its associated memory region is unregistered. The current implementation frees the pool even if users still hold references to it (e.g., before uncharge operations complete). This patch adds a reference counter to each pool, ensuring that a pool is only freed when its reference count drops to zero. Fixes: b168ed458dde ("kernel/cgroup: Add "dmem" memory accounting cgroup") Cc: stable@vger.kernel.org # v6.14+ Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 592a68212c5664bcaa88f24ed80bf791282790fe Author: Chen Ridong Date: Mon Feb 2 12:27:17 2026 +0000 cgroup/dmem: avoid rcu warning when unregister region A warnning was detected: WARNING: suspicious RCU usage 6.19.0-rc7-next-20260129+ #1101 Tainted: G O kernel/cgroup/dmem.c:456 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by insmod/532: #0: ffffffff85e78b38 (dmemcg_lock){+.+.}-dmem_cgroup_unregister_region+ stack backtrace: CPU: 2 UID: 0 PID: 532 Comm: insmod Tainted: 6.19.0-rc7-next- Tainted: [O]=OOT_MODULE Call Trace: dump_stack_lvl+0xb0/0xd0 lockdep_rcu_suspicious+0x151/0x1c0 dmem_cgroup_unregister_region+0x1e2/0x380 ? __pfx_dmem_test_init+0x10/0x10 [dmem_uaf] dmem_test_init+0x65/0xff0 [dmem_uaf] do_one_initcall+0xbb/0x3a0 The macro list_for_each_rcu() must be used within an RCU read-side critical section (between rcu_read_lock() and rcu_read_unlock()). Using it outside that context, as seen in dmem_cgroup_unregister_region(), triggers the lockdep warning because the RCU protection is not guaranteed. Replace list_for_each_rcu() with list_for_each_entry_safe(), which is appropriate for traversal under spinlock protection where nodes may be deleted. Fixes: b168ed458dde ("kernel/cgroup: Add "dmem" memory accounting cgroup") Cc: stable@vger.kernel.org # v6.14+ Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 43151f812886be1855d2cba059f9c93e4729460b Author: Chen Ridong Date: Mon Feb 2 12:27:16 2026 +0000 cgroup/dmem: fix NULL pointer dereference when setting max An issue was triggered: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 15 UID: 0 PID: 658 Comm: bash Tainted: 6.19.0-rc6-next-2026012 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), RIP: 0010:strcmp+0x10/0x30 RSP: 0018:ffffc900017f7dc0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888107cd4358 RDX: 0000000019f73907 RSI: ffffffff82cc381a RDI: 0000000000000000 RBP: ffff8881016bef0d R08: 000000006c0e7145 R09: 0000000056c0e714 R10: 0000000000000001 R11: ffff888107cd4358 R12: 0007ffffffffffff R13: ffff888101399200 R14: ffff888100fcb360 R15: 0007ffffffffffff CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000105c79000 CR4: 00000000000006f0 Call Trace: dmemcg_limit_write.constprop.0+0x16d/0x390 ? __pfx_set_resource_max+0x10/0x10 kernfs_fop_write_iter+0x14e/0x200 vfs_write+0x367/0x510 ksys_write+0x66/0xe0 do_syscall_64+0x6b/0x390 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f42697e1887 It was trriggered setting max without limitation, the command is like: "echo test/region0 > dmem.max". To fix this issue, add check whether options is valid after parsing the region_name. Fixes: b168ed458dde ("kernel/cgroup: Add "dmem" memory accounting cgroup") Cc: stable@vger.kernel.org # v6.14+ Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 41d9a6795b95d6ea28439ac1e9ce8c95bbca20fc Author: Felix Gu Date: Mon Feb 2 23:15:09 2026 +0800 spi: tegra: Fix a memory leak in tegra_slink_probe() In tegra_slink_probe(), when platform_get_irq() fails, it directly returns from the function with an error code, which causes a memory leak. Replace it with a goto label to ensure proper cleanup. Fixes: eb9913b511f1 ("spi: tegra: Fix missing IRQ check in tegra_slink_probe()") Signed-off-by: Felix Gu Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260202-slink-v1-1-eac50433a6f9@gmail.com Signed-off-by: Mark Brown commit af07330e28ad65352126270b0b3af226df46e307 Author: Pavel Begunkov Date: Sun Feb 1 21:19:56 2026 +0000 io_uring/zcrx: fix rq flush locking zcrx needs to keep the rq lock for uref manipulations, for now move all zcrx_return_buffers() under the lock. Fixes: 475eb39b00478 ("io_uring/zcrx: add sync refill queue flushing") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0ae91d8ab70922fb74c22c20bedcb69459579b1c Author: Pavel Begunkov Date: Sun Feb 1 21:18:53 2026 +0000 io_uring/zcrx: fix page array leak d9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg init fail") fixed a page leakage but didn't free the page array, release it as well. Fixes: b84621d96ee02 ("io_uring/zcrx: allocate sgtable for umem areas") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 10db9f6899dd3a2dfd26efd40afd308891dc44a8 Author: Richard Fitzgerald Date: Fri Jan 30 17:12:56 2026 +0000 firmware: cs_dsp: rate-limit log messages in KUnit builds Use the dev_*_ratelimit() macros if the cs_dsp KUnit tests are enabled in the build, and allow the KUnit tests to disable message output. Some of the KUnit tests cause a very large number of log messages from cs_dsp, because the tests perform many different test cases. This could cause some lines to be dropped from the kernel log. Dropped lines can prevent the KUnit wrappers from parsing the ktap output in the dmesg log. The KUnit builds of cs_dsp export three bools that the KUnit tests can use to entirely disable log output of err, warn and info messages. Some tests have been updated to use this, replacing the previous fudge of a usleep() in the exit handler of each test. We don't necessarily want to disable all log messages if they aren't expected to be excessive, so the rate-limiting allows leaving some logging enabled. The rate-limited macros are not used in normal builds because it is not appropriate to rate-limit every message. That could cause important messages to be dropped, and there wouldn't be such a high rate of messages in normal operation. Signed-off-by: Richard Fitzgerald Reported-by: Mark Brown Closes: https://lore.kernel.org/linux-sound/af393f08-facb-4c44-a054-1f61254803ec@opensource.cirrus.com/T/#t Fixes: cd8c058499b6 ("firmware: cs_dsp: Add KUnit testing of bin error cases") Link: https://patch.msgid.link/20260130171256.863152-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 611c7d2262d5645118e0b3a9a88475d35a8366f2 Author: Dirk Su Date: Thu Jan 29 14:50:19 2026 +0800 ASoC: amd: yc: Add quirk for HP 200 G2a 16 Fix the missing mic on HP 200 G2a 16 by adding quirk with the board ID 8EE4 Signed-off-by: Dirk Su Link: https://patch.msgid.link/20260129065038.39349-1-dirk.su@canonical.com Signed-off-by: Mark Brown commit e77a4081d7e324dfa876a9560b2a78969446ba82 Author: Charles Keepax Date: Fri Jan 30 15:09:27 2026 +0000 ASoC: cs42l43: Correct handling of 3-pole jack load detection The load detection process for 3-pole jacks requires slightly updated reference values to ensure an accurate result. Update the code to apply different tunings for the 3-pole and 4-pole cases. This also updates the thresholds overall so update the relevant comments to match. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260130150927.2964664-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 6b641122d31f9d33e7d60047ee0586d1659f3f54 Author: Tagir Garaev Date: Sun Feb 1 15:17:28 2026 +0300 ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 Add DMI entry for Huawei Matebook D (BOD-WXX9) with HEADPHONE_GPIO and DMIC quirks. This device has ES8336 codec with: - GPIO 16 (headphone-enable) for headphone amplifier control - GPIO 17 (speakers-enable) for speaker amplifier control - GPIO 269 for jack detection IRQ - 2-channel DMIC Hardware investigation shows that both GPIO 16 and 17 are required for proper audio routing, as headphones and speakers share the same physical output (HPOL/HPOR) and are separated only via amplifier enable signals. RFC: Seeking advice on GPIO control issue: GPIO values change in driver (gpiod_get_value() shows logical value changes) but not physically (debugfs gpio shows no change). The same gpiod_set_value_cansleep() calls work correctly in probe context with msleep(), but fail when called from DAPM event callbacks. Context information from diagnostics: - in_atomic=0, in_interrupt=0, irqs_disabled=0 - Process context: pipewire - GPIO 17 (speakers): changes in driver, no physical change - GPIO 16 (headphone): changes in driver, no physical change In Windows, audio switching works without visible GPIO changes, suggesting possible ACPI/firmware involvement. Any suggestions on how to properly control these GPIOs from DAPM events would be appreciated. Signed-off-by: Tagir Garaev Link: https://patch.msgid.link/20260201121728.16597-1-tgaraev653@gmail.com Signed-off-by: Mark Brown commit 1425900231372acf870dd89e8d3bb4935f7f0c81 Author: Maciej Strozek Date: Wed Jan 28 09:24:05 2026 +0000 ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with cs42l43 Add a quirk for a Lenovo laptop (SSID: 0x17aa3821) to allow using sidecar CS35L57 amps with CS42L43 codec. Signed-off-by: Maciej Strozek Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260128092410.1540583-1-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit 78f1421dc3ac2588fb59b55e2b4c2c55a442913e Author: Jani Nikula Date: Fri Jan 30 17:13:19 2026 +0200 Revert "drm/gma500: use drm_crtc_vblank_crtc()" This reverts commit d930ffa5d6e8867a290db9c6aad1c62731aeb2c3. According to Thomas, commit d930ffa5d6e8 ("drm/gma500: use drm_crtc_vblank_crtc()") breaks the driver with a NULL-ptr oops on startup. This is because the IRQ initialization in gma_irq_install() now uses CRTCs that are only allocated later in psb_modeset_init(). Stack trace is below. Revert. Go back to the drawing board. [ 65.831766] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] SMP KASAN NOPTI [ 65.832114] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] [ 65.832232] CPU: 1 UID: 0 PID: 296 Comm: (udev-worker) Tainted: G E 6.19.0-rc6-1-default+ #4622 PREEMPT(voluntary) [ 65.832376] Tainted: [E]=UNSIGNED_MODULE [ 65.832448] Hardware name: /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012 [ 65.832543] RIP: 0010:drm_crtc_vblank_crtc+0x24/0xd0 [ 65.832652] Code: 90 90 90 90 90 90 0f 1f 44 00 00 48 89 f8 48 81 c7 18 01 00 00 48 83 ec 10 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <0f> b6 14 11 84 d2 74 05 80 fa 03 7e 58 48 89 c6 8b 90 18 01 00 00 [ 65.832820] RSP: 0018:ffff88800c8f7688 EFLAGS: 00010006 [ 65.832919] RAX: fffffffffffffff0 RBX: ffff88800fff4928 RCX: 0000000000000021 [ 65.833011] RDX: dffffc0000000000 RSI: ffffc90000978130 RDI: 0000000000000108 [ 65.833107] RBP: ffffed1001ffea03 R08: 0000000000000000 R09: ffffed100191eec7 [ 65.833199] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880014480c8 [ 65.833289] R13: dffffc0000000000 R14: fffffffffffffff0 R15: ffff88800fff4000 [ 65.833380] FS: 00007fe53d4d5d80(0000) GS:ffff888148dd8000(0000) knlGS:0000000000000000 [ 65.833488] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.833575] CR2: 00007fac707420b8 CR3: 000000000ebd1000 CR4: 00000000000006f0 [ 65.833668] Call Trace: [ 65.833735] [ 65.833808] gma_irq_preinstall+0x190/0x3e0 [gma500_gfx] [ 65.834054] gma_irq_install+0xb2/0x240 [gma500_gfx] [ 65.834282] psb_driver_load+0x7b2/0x1090 [gma500_gfx] [ 65.834516] ? __pfx_psb_driver_load+0x10/0x10 [gma500_gfx] [ 65.834726] ? ksize+0x1d/0x40 [ 65.834817] ? drmm_add_final_kfree+0x3b/0xb0 [ 65.834935] ? __pfx_psb_pci_probe+0x10/0x10 [gma500_gfx] [ 65.835164] psb_pci_probe+0xc8/0x150 [gma500_gfx] [ 65.835384] local_pci_probe+0xd5/0x190 [ 65.835492] pci_call_probe+0x167/0x4b0 [ 65.835594] ? __pfx_pci_call_probe+0x10/0x10 [ 65.835693] ? local_clock+0x11/0x30 [ 65.835808] ? __pfx___driver_attach+0x10/0x10 [ 65.835915] ? do_raw_spin_unlock+0x55/0x230 [ 65.836014] ? pci_match_device+0x303/0x790 [ 65.836124] ? pci_match_device+0x386/0x790 [ 65.836226] ? __pfx_pci_assign_irq+0x10/0x10 [ 65.836320] ? kernfs_create_link+0x16a/0x230 [ 65.836418] ? do_raw_spin_unlock+0x55/0x230 [ 65.836526] ? __pfx___driver_attach+0x10/0x10 [ 65.836626] pci_device_probe+0x175/0x2c0 [ 65.836735] call_driver_probe+0x64/0x1e0 [ 65.836842] really_probe+0x194/0x740 [ 65.836951] ? __pfx___driver_attach+0x10/0x10 [ 65.837053] __driver_probe_device+0x18c/0x3a0 [ 65.837163] ? __pfx___driver_attach+0x10/0x10 [ 65.837262] driver_probe_device+0x4a/0x120 [ 65.837369] __driver_attach+0x19c/0x550 [ 65.837474] ? __pfx___driver_attach+0x10/0x10 [ 65.837575] bus_for_each_dev+0xe6/0x150 [ 65.837669] ? local_clock+0x11/0x30 [ 65.837770] ? __pfx_bus_for_each_dev+0x10/0x10 [ 65.837891] bus_add_driver+0x2af/0x4f0 [ 65.838000] ? __pfx_psb_init+0x10/0x10 [gma500_gfx] [ 65.838236] driver_register+0x19f/0x3a0 [ 65.838342] ? rcu_is_watching+0x11/0xb0 [ 65.838446] do_one_initcall+0xb5/0x3a0 [ 65.838546] ? __pfx_do_one_initcall+0x10/0x10 [ 65.838644] ? __kasan_slab_alloc+0x2c/0x70 [ 65.838741] ? rcu_is_watching+0x11/0xb0 [ 65.838837] ? __kmalloc_cache_noprof+0x3e8/0x6e0 [ 65.838937] ? klp_module_coming+0x1a0/0x2e0 [ 65.839033] ? do_init_module+0x85/0x7f0 [ 65.839126] ? kasan_unpoison+0x40/0x70 [ 65.839230] do_init_module+0x26e/0x7f0 [ 65.839341] ? __pfx_do_init_module+0x10/0x10 [ 65.839450] init_module_from_file+0x13f/0x160 [ 65.839549] ? __pfx_init_module_from_file+0x10/0x10 [ 65.839651] ? __lock_acquire+0x578/0xae0 [ 65.839791] ? do_raw_spin_unlock+0x55/0x230 [ 65.839886] ? idempotent_init_module+0x585/0x720 [ 65.839993] idempotent_init_module+0x1ff/0x720 [ 65.840097] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 65.840211] ? __pfx_idempotent_init_module+0x10/0x10 Reported-by: Thomas Zimmermann Closes: https://lore.kernel.org/r/5aec1964-072c-4335-8f37-35e6efb4910e@suse.de Fixes: d930ffa5d6e8 ("drm/gma500: use drm_crtc_vblank_crtc()") Cc: Patrik Jakobsson Signed-off-by: Jani Nikula Reviewed-by: Thomas Zimmermann Tested-by: Thomas Zimmermann Signed-off-by: Patrik Jakobsson Link: https://patch.msgid.link/20260130151319.31264-1-jani.nikula@intel.com commit c33efdfcfa6f80e05ce1ee33694c1bad4994cd78 Author: Shanker Donthineni Date: Thu Jan 29 12:13:17 2026 -0600 dma: contiguous: Check return value of dma_contiguous_reserve_area() Commit 8f1fc1bf1a3d ("dma: contiguous: Reserve default CMA heap") introduced a bug where dma_heap_cma_register_heap() is called with a NULL pointer when dma_contiguous_reserve_area() fails to reserve the CMA area. When dma_contiguous_reserve_area() fails, dma_contiguous_default_area remains NULL (initialized as a global variable), but the code doesn't check the return value and proceeds to call dma_heap_cma_register_heap() with this NULL pointer. Later during boot, add_cma_heaps() iterates through the dma_areas[] array and attempts to register heaps. When it encounters the NULL pointer stored by the earlier call, it crashes in __add_cma_heap() -> dma_heap_add() when trying to dereference the NULL CMA pointer. The crash manifests as: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 ... Call trace: dma_heap_add+0x40/0x2b0 __add_cma_heap+0x80/0xe0 add_cma_heaps+0x64/0xb0 do_one_initcall+0x60/0x318 kernel_init_freeable+0x260/0x2f0 kernel_init+0x2c/0x168 ret_from_fork+0x10/0x20 Fix this by checking the return value of dma_contiguous_reserve_area() and only calling dma_heap_cma_register_heap() when the reservation succeeds. Fixes: 8f1fc1bf1a3d ("dma: contiguous: Reserve default CMA heap") Signed-off-by: Shanker Donthineni Reviewed-by: T.J. Mercier Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260129181317.2429196-1-sdonthineni@nvidia.com commit daafcc0ef0b358d9d622b6e3b7c43767aa3814ee Author: Deepanshu Kartikey Date: Fri Jan 30 21:22:15 2026 +0530 tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow The dma_map_sg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices like virtio-gpu creating large DRM buffers, nents can exceed 1000 entries, resulting in: phys_addrs: 1000 * 8 bytes = 8,000 bytes dma_addrs: 1000 * 8 bytes = 8,000 bytes lengths: 1000 * 4 bytes = 4,000 bytes Total: ~20,000 bytes This exceeds PERF_MAX_TRACE_SIZE (8192 bytes), causing: WARNING: CPU: 0 PID: 5497 at kernel/trace/trace_event_perf.c:405 perf buffer not large enough, wanted 24620, have 8192 Cap all three dynamic arrays at 128 entries using min() in the array size calculation. This ensures arrays are only as large as needed (up to the cap), avoiding unnecessary memory allocation for small operations while preventing overflow for large ones. The tracepoint now records the full nents/ents counts and a truncated flag so users can see when data has been capped. Changes in v2: - Use min(nents, DMA_TRACE_MAX_ENTRIES) for dynamic array sizing instead of fixed DMA_TRACE_MAX_ENTRIES allocation (feedback from Steven Rostedt) - This allocates only what's needed up to the cap, avoiding waste for small operations Reported-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=28cea38c382fd15e751a Tested-by: syzbot+28cea38c382fd15e751a@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Reviwed-by: Sean Anderson Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260130155215.69737-1-kartikey406@gmail.com commit 18f7fcd5e69a04df57b563360b88be72471d6b62 Author: Linus Torvalds Date: Sun Feb 1 14:01:13 2026 -0800 Linux 6.19-rc8 commit 6c65db809796717f0a96cf22f80405dbc1a31a4b Author: John Ogness Date: Fri Jan 30 12:38:08 2026 +0106 Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" This reverts commit 604826acb3f53c6648a7ee99a3914ead680ab7fb. Apparently there is more to supporting atomic modesetting than providing atomic_(check|commit) callbacks. Before this revert: WARNING: [] drivers/gpu/drm/drm_plane.c:389 at .__drm_universal_plane_init+0x13c/0x794 [drm], CPU#1: modprobe/1790 BUG: Kernel NULL pointer dereference on read at 0x00000000 .drm_atomic_get_plane_state+0xd4/0x210 [drm] (unreliable) .drm_client_modeset_commit_atomic+0xf8/0x338 [drm] .drm_client_modeset_commit_locked+0x80/0x260 [drm] .drm_client_modeset_commit+0x40/0x7c [drm] .__drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0xfc/0x108 [drm_kms_helper] .drm_fb_helper_set_par+0x8c/0xb8 [drm_kms_helper] .fbcon_init+0x31c/0x618 [...] .__drm_fb_helper_initial_config_and_unlock+0x474/0x7f4 [drm_kms_helper] .drm_fbdev_client_hotplug+0xb0/0x120 [drm_client_lib] .drm_client_register+0x88/0xe4 [drm] .drm_fbdev_client_setup+0x12c/0x19b4 [drm_client_lib] .drm_client_setup+0x15c/0x18c [drm_client_lib] .nouveau_drm_probe+0x19c/0x268 [nouveau] Fixes: 604826acb3f5 ("drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)") Reported-by: John Ogness Closes: https://lore.kernel.org/lkml/87ldhf1prw.fsf@jogness.linutronix.de Signed-off-by: John Ogness Tested-by: Daniel Palmer Link: https://patch.msgid.link/20260130113230.2311221-1-john.ogness@linutronix.de Signed-off-by: Danilo Krummrich commit 9f2693489ef8558240d9e80bfad103650daed0af Merge: c00a8791646a22 0444568edbf87c Author: Linus Torvalds Date: Sun Feb 1 11:24:53 2026 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Small changes in drivers only, no core changes. The firewire one fixes a user controlled overflow (but I still can't see how it could be exploited)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: amd-versal2: Fix PHY initialization in HCE enable notify scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() scsi: qla2xxx: edif: Fix dma_free_coherent() size commit c00a8791646a226b77d24980ffad0c5e8e268b07 Merge: e53ada651abea1 76ed27608f7dd2 Author: Linus Torvalds Date: Sun Feb 1 10:47:21 2026 -0800 Merge tag 'perf-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fix from Ingo Molnar: "Fix a race in the user-callchains code" * tag 'perf-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: sched: Fix perf crash with new is_user_task() helper commit e53ada651abea14481336091fbe2428ff05a8eee Merge: 969b5726acb96f 115135422562e2 Author: Linus Torvalds Date: Sun Feb 1 10:39:52 2026 -0800 Merge tag 'sched-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a regression in the deferrable dl_server code that can cause the dl_server to be stuck" * tag 'sched-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Fix 'stuck' dl_server commit 969b5726acb96fa37f2d8869f4c70678ebde8481 Merge: 5db2a252e10035 78c268f3781e4b Author: Linus Torvalds Date: Sun Feb 1 10:27:43 2026 -0800 Merge tag 'objtool-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: - Fix a build error on ia32-x86_64 cross builds - Replace locally open coded ALIGN_UP(), ALIGN_UP_POW2() and MAX(), which, beyond being duplicates, the ALIGN_UP_POW2() is also buggy - Fix objtool klp-diff regression caused by a recent change to the bug table format - Fix klp-build vs CONFIG_MODULE_SRCVERSION_ALL build failure * tag 'objtool-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: livepatch/klp-build: Fix klp-build vs CONFIG_MODULE_SRCVERSION_ALL objtool/klp: Fix bug table handling for __WARN_printf() objtool: Replace custom macros in elf.c with shared ones objtool: Print bfd_vma as unsigned long long on ia32-x86_64 cross build commit 5db2a252e100354bfba4da2c6628d52349a35db2 Merge: 162b42445b585c ba5c657141ea29 Author: Linus Torvalds Date: Sun Feb 1 10:24:01 2026 -0800 Merge tag 'irq-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "Misc irqchip fixes: - Fix a regression in the ls-extirq irqchip driver - Fix an irqchip platform enumeration regression in the simple-pm-bus driver" * tag 'irq-urgent-2026-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: bus: simple-pm-bus: Probe the Layerscape SCFG node irqchip/ls-extirq: Convert to a platform driver to make it work again commit fdf3f6800be36377e045e2448087f12132b88d2f Author: Jakub Kicinski Date: Thu Jan 29 19:38:27 2026 -0800 net: don't touch dev->stats in BPF redirect paths Gal reports that BPF redirect increments dev->stats.tx_errors on failure. This is not correct, most modern drivers completely ignore dev->stats so these drops will be invisible to the user. Core code should use the dedicated core stats which are folded into device stats in dev_get_stats(). Note that we're switching from tx_errors to tx_dropped. Core only has tx_dropped, hence presumably users already expect that counter to increment for "stack" Tx issues. Reported-by: Gal Pressman Link: https://lore.kernel.org/c5df3b60-246a-4030-9c9a-0a35cd1ca924@nvidia.com Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") Acked-by: Martin KaFai Lau Acked-by: Daniel Borkmann Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260130033827.698841-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 162b42445b585cd89f45475848845db353539605 Merge: d097a0783102a9 80f1a2c2332fee Author: Linus Torvalds Date: Sat Jan 31 09:40:13 2026 -0800 Merge tag 'iommu-fixes-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Fix a performance regression cause by the new Generic IO-Page-Table code detected in Intel VT-d driver - Command queue flushing fix for NVidia version of the ARM-SMMU-v3 * tag 'iommu-fixes-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/tegra241-cmdqv: Reset VCMDQ in tegra241_vcmdq_hw_init_user() iommupt: Only cache flush memory changed by unmap commit d097a0783102a9e966ed0a70f54def4a1d091b6a Merge: 9827b1fb558a58 4b22ec1685ce1f Author: Linus Torvalds Date: Sat Jan 31 08:57:16 2026 -0800 Merge tag 'efi-fixes-for-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: - Fix regression in efivarfs error propagation * tag 'efi-fixes-for-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: fix error propagation in efivar_entry_get() commit 9827b1fb558a58b40e5c6f0689acb8597c2dea00 Merge: 44f4119c7c6aac 00f32dfceda29f Author: Linus Torvalds Date: Sat Jan 31 08:52:41 2026 -0800 Merge tag 'sound-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a few device-specific fixes; all small and mostly trivial, should be pretty safe to take at the late stage" * tag 'sound-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with cs42l43 ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO ASoC: soc-acpi-intel-ptl-match: fix name_prefix of rt1320-2 ALSA: hda/realtek: Add quirk for Inspur S14-G1 ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. ALSA: hda/realtek - fixed speaker no sound ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list ASoC: fsl: imx-card: Do not force slot width to sample width ASoC: dt-bindings: fsl,sai: Add support for i.MX952 platform ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel commit 44f4119c7c6aac5f6d476b51a0bc62dcbfcaad12 Merge: ad9a728a3388dc 8e249948723612 Author: Linus Torvalds Date: Sat Jan 31 08:21:32 2026 -0800 Merge tag 'kbuild-fixes-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nicolas Schier: - Generate rpm-pkg debuginfo package manually, allowing signed kernel modules in rpm package, again - Fix permissions of modules.builtin.modinfo - Do not run kernel-doc when building external modules * tag 'kbuild-fixes-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Do not run kernel-doc when building external modules kbuild: Fix permissions of modules.builtin.modinfo kbuild: rpm-pkg: Generate debuginfo package manually commit 615901b57b7ef8eb655f71358f7e956e42bcd16b Author: Rafael J. Wysocki Date: Sat Jan 31 07:23:28 2026 -0800 hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() The acpi_power_meter driver's .notify() callback function, acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock that is also acquired by callbacks in sysfs attributes of the device being unregistered which is prone to deadlocks between sysfs access and device removal. Address this by moving the hwmon device removal in acpi_power_meter_notify() outside the lock in question, but notice that doing it alone is not sufficient because two concurrent METER_NOTIFY_CONFIG notifications may be attempting to remove the same device at the same time. To prevent that from happening, add a new lock serializing the execution of the switch () statement in acpi_power_meter_notify(). For simplicity, it is a static mutex which should not be a problem from the performance perspective. The new lock also allows the hwmon_device_register_with_info() in acpi_power_meter_notify() to be called outside the inner lock because it prevents the other notifications handled by that function from manipulating the "resource" object while the hwmon device based on it is being registered. The sending of ACPI netlink messages from acpi_power_meter_notify() is serialized by the new lock too which generally helps to ensure that the order of handling firmware notifications is the same as the order of sending netlink messages related to them. In addition, notice that hwmon_device_register_with_info() may fail in which case resource->hwmon_dev will become an error pointer, so add checks to avoid attempting to unregister the hwmon device pointer to by it in that case to acpi_power_meter_notify() and acpi_power_meter_remove(). Fixes: 16746ce8adfe ("hwmon: (acpi_power_meter) Replace the deprecated hwmon_device_register") Closes: https://lore.kernel.org/linux-hwmon/CAK8fFZ58fidGUCHi5WFX0uoTPzveUUDzT=k=AAm4yWo3bAuCFg@mail.gmail.com/ Reported-by: Jaroslav Pulchart Signed-off-by: Rafael J. Wysocki Signed-off-by: Guenter Roeck commit 8e24994872361212531a952c93adb01c485148f1 Author: Nathan Chancellor Date: Fri Jan 30 14:37:47 2026 -0700 kbuild: Do not run kernel-doc when building external modules After commit 778b8ebe5192 ("docs: Move the python libraries to tools/lib/python"), building an external module with any value of W= against the output of install-extmod-build fails with: $ make -C /usr/lib/modules/6.19.0-rc7-00108-g4d310797262f/build M=$PWD W=1 make: Entering directory '/usr/lib/modules/6.19.0-rc7-00108-g4d310797262f/build' make[1]: Entering directory '...' CC [M] ... Traceback (most recent call last): File "/usr/lib/modules/6.19.0-rc7-00108-g4d310797262f/build/scripts/kernel-doc.py", line 339, in main() ~~~~^^ File "/usr/lib/modules/6.19.0-rc7-00108-g4d310797262f/build/scripts/kernel-doc.py", line 295, in main from kdoc.kdoc_files import KernelFiles # pylint: disable=C0415 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ModuleNotFoundError: No module named 'kdoc' scripts/lib was included in the build directory from find_in_scripts but after the move to tools/lib/python, it is no longer included, breaking kernel-doc.py. Commit eba6ffd126cd ("docs: kdoc: move kernel-doc to tools/docs") breaks this even further by moving kernel-doc outside of scripts as well, so it cannot be found when called by cmd_checkdoc. $ make -C /usr/lib/modules/6.19.0-rc7-next-20260130/build M=$PWD W=1 make: Entering directory '/usr/lib/modules/6.19.0-rc7-next-20260130/build' make[1]: Entering directory '...' CC [M] ... python3: can't open file '/usr/lib/modules/6.19.0-rc7-next-20260130/build/tools/docs/kernel-doc': [Errno 2] No such file or directory While kernel-doc could be useful for external modules, it is more useful for in-tree documentation that will be build and included in htmldocs. Rather than including it in install-extmod-build, just skip running kernel-doc for the external module build. Cc: stable@vger.kernel.org Fixes: 778b8ebe5192 ("docs: Move the python libraries to tools/lib/python") Reported-by: Rong Zhang Closes: https://lore.kernel.org/20260129175321.415295-1-i@rong.moe/ Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Nathan Chancellor Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20260130-kbuild-skip-kernel-doc-extmod-v1-1-58443d60131a@kernel.org Reviewed-by: Nicolas Schier Signed-off-by: Nicolas Schier commit 23ea2a4c72323feb6e3e025e8a6f18336513d5ad Author: Thomas Weissschuh Date: Wed Jan 7 11:01:49 2026 +0100 ARM: 9468/1: fix memset64() on big-endian On big-endian systems the 32-bit low and high halves need to be swapped for the underlying assembly implementation to work correctly. Fixes: fd1d362600e2 ("ARM: implement memset32 & memset64") Cc: stable@vger.kernel.org Signed-off-by: Thomas Weißschuh Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit 80f1a2c2332fee0edccd006fe87fc8a6db94bab3 Author: Nicolin Chen Date: Thu Jan 29 14:43:41 2026 -0800 iommu/tegra241-cmdqv: Reset VCMDQ in tegra241_vcmdq_hw_init_user() The Enable bits in CMDQV/VINTF/VCMDQ_CONFIG registers do not actually reset the HW registers. So, the driver explicitly clears all the registers when a VINTF or VCMDQ is being initialized calling its hw_deinit() function. However, a userspace VCMDQ is not properly reset, unlike an in-kernel VCMDQ getting reset in tegra241_vcmdq_hw_init(). Meanwhile, tegra241_vintf_hw_init() calling tegra241_vintf_hw_deinit() will not deinit any VCMDQ, since there is no userspace VCMDQ mapped to the VINTF at that stage. Then, this may result in dirty VCMDQ registers, which can fail the VM. Like tegra241_vcmdq_hw_init(), reset a VCMDQ in tegra241_vcmdq_hw_init() to fix this bug. This is required by a host kernel. Fixes: 6717f26ab1e7 ("iommu/tegra241-cmdqv: Add user-space use support") Cc: stable@vger.kernel.org Reported-by: Bao Nguyen Signed-off-by: Nicolin Chen Signed-off-by: Joerg Roedel commit 6d06bc83a5ae8777a5f7a81c32dd75b8d9b2fe04 Author: Sergey Senozhatsky Date: Thu Jan 29 12:10:30 2026 +0900 net: usb: r8152: fix resume reset deadlock rtl8152 can trigger device reset during reset which potentially can result in a deadlock: **** DPM device timeout after 10 seconds; 15 seconds until panic **** Call Trace: schedule+0x483/0x1370 schedule_preempt_disabled+0x15/0x30 __mutex_lock_common+0x1fd/0x470 __rtl8152_set_mac_address+0x80/0x1f0 dev_set_mac_address+0x7f/0x150 rtl8152_post_reset+0x72/0x150 usb_reset_device+0x1d0/0x220 rtl8152_resume+0x99/0xc0 usb_resume_interface+0x3e/0xc0 usb_resume_both+0x104/0x150 usb_resume+0x22/0x110 The problem is that rtl8152 resume calls reset under tp->control mutex while reset basically re-enters rtl8152 and attempts to acquire the same tp->control lock once again. Reset INACCESSIBLE device outside of tp->control mutex scope to avoid recursive mutex_lock() deadlock. Fixes: 4933b066fefb ("r8152: If inaccessible at resume time, issue a reset") Reviewed-by: Douglas Anderson Signed-off-by: Sergey Senozhatsky Link: https://patch.msgid.link/20260129031106.3805887-1-senozhatsky@chromium.org Signed-off-by: Jakub Kicinski commit f8db6475a83649689c087a8f52486fcc53e627e9 Author: Eric Dumazet Date: Thu Jan 29 20:43:59 2026 +0000 macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link p2 type macvlan mode source ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20 ping -c1 -I p1 1.2.3.4 He also gave a very detailed analysis: The issue is triggered when a new macvlan link is created with MACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or MACVLAN_MACADDR_SET) parameter, lower device already has a macvlan port and register_netdevice() called from macvlan_common_newlink() fails (e.g. because of the invalid link name). In this case macvlan_hash_add_source is called from macvlan_change_sources() / macvlan_common_newlink(): This adds a reference to vlan to the port's vlan_source_hash using macvlan_source_entry. vlan is a pointer to the priv data of the link that is being created. When register_netdevice() fails, the error is returned from macvlan_newlink() to rtnl_newlink_create(): if (ops->newlink) err = ops->newlink(dev, ¶ms, extack); else err = register_netdevice(dev); if (err < 0) { free_netdev(dev); goto out; } and free_netdev() is called, causing a kvfree() on the struct net_device that is still referenced in the source entry attached to the lower device's macvlan port. Now all packets sent on the macvlan port with a matching source mac address will trigger a use-after-free in macvlan_forward_source(). With all that, my fix is to make sure we call macvlan_flush_sources() regardless of @create value whenever "goto destroy_macvlan_port;" path is taken. Many thanks to valis for following up on this issue. Fixes: aa5fd0fb7748 ("driver: macvlan: Destroy new macvlan port if macvlan_common_newlink failed.") Signed-off-by: Eric Dumazet Reported-by: valis Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com Closes: https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u Cc: Boudewijn van der Heide Link: https://patch.msgid.link/20260129204359.632556-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit adcbadfd8e05d3558c9cfaa783f17c645181165f Author: Marek Behún Date: Thu Jan 29 09:22:27 2026 +0100 net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module Commit fd580c9830316eda ("net: sfp: augment SFP parsing with phy_interface_t bitmap") did not add augumentation for the interface bitmap in the quirk for Ubiquiti U-Fiber Instant. The subsequent commit f81fa96d8a6c7a77 ("net: phylink: use phy_interface_t bitmaps for optical modules") then changed phylink code for selection of SFP interface: instead of using link mode bitmap, the interface bitmap is used, and the fastest interface mode supported by both SFP module and MAC is chosen. Since the interface bitmap contains also modes faster than 1000base-x, this caused a regression wherein this module stopped working out-of-the-box. Fix this. Fixes: fd580c9830316eda ("net: sfp: augment SFP parsing with phy_interface_t bitmap") Signed-off-by: Marek Behún Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20260129082227.17443-1-kabel@kernel.org Signed-off-by: Jakub Kicinski commit ad9a728a3388dc5f66eab6b7135e0154249e9403 Merge: 2912d799e5342d 2724138b2f7f62 Author: Linus Torvalds Date: Fri Jan 30 17:17:30 2026 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fix from Jason Gunthorpe: "One fix for a harmless KMSAN splat" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Initialize batch->kind in batch_clear() commit 2912d799e5342de7c06821668b930fd94639bd78 Merge: 283073725700d4 20e01bba2ae489 Author: Linus Torvalds Date: Fri Jan 30 17:07:45 2026 -0800 Merge tag 'firewire-fixes-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a race condition introduced in v6.18. Andreas Persson discovered this issue while working with Focusrite Saffire Pro 40 (TCD33070). The fw_card instance maintains a linked list of pending transactions, which must be protected against concurrent access. However, a commit b5725cfa4120 ("firewire: core: use spin lock specific to timer for split transaction") unintentionally allowed concurrent accesses to this list. Fix this by adjusting the relevant critical sections to properly serialize access" * tag 'firewire-fixes-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix race condition against transaction list commit 283073725700d494d0d8f0085f76bb4e3ff063ce Merge: 367b81ef010ad3 0ea05c4f7527a9 Author: Linus Torvalds Date: Fri Jan 30 16:57:36 2026 -0800 Merge tag 'riscv-for-linus-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Correct the RISC-V compat.h COMPAT_UTS_MACHINE architecture name - Avoid printing a false warning message on kernels with the SiFive and MIPS errata compiled in - Address a few warnings generated by sparse in the signal handling code - Fix a comment typo * tag 'riscv-for-linus-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: compat: fix COMPAT_UTS_MACHINE definition errata/sifive: remove unreliable warn_miss_errata riscv: fix minor typo in syscall.h comment riscv: signal: fix some warnings reported by sparse commit 367b81ef010ad3d0986af32f594c3a2e5807b40a Merge: 03610bd6b53cc5 5016cae970d7d5 Author: Linus Torvalds Date: Fri Jan 30 16:15:59 2026 -0800 Merge tag 'rust-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust fixes from Miguel Ojeda: "Toolchain and infrastructure: - Trigger rebuilds of the newly added 'proc-macro2' crate (and its dependencies) when the Rust compiler version changes - Fix error in '.rsi' targets (macro expanding single targets) under 'O=' pointing to an external (not subdir) folder - Fix off-by-one line number in 'rustdoc' KUnit tests - Add '-fdiagnostics-show-context' to GCC flags skipped by 'bindgen' - Clean objtool warning by adding one more 'noreturn' function - Clean 'libpin_init_internal.{so,dylib}' in 'mrproper' 'kernel' crate: - Fix build error when using expressions in formatting arguments - Mark 'num::Bounded::__new()' as unsafe and clean documentation accordingly - Always inline functions using 'build_assert' with arguments - Fix 'rusttest' build error providing the right 'isize_atomic_repr' type for the host 'macros' crate: - Fix 'rusttest' build error by ignoring example rust-analyzer: - Remove assertion that was not true for distributions like NixOS - Add missing dependency edges and fix editions for 'quote' and sysroot crates to provide correct IDE support DRM Tyr: - Fix build error by adding missing dependency on 'CONFIG_COMMON_CLK' Plus clean a few typos in docs and comments" * tag 'rust-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (28 commits) rust: num: bounded: clean __new documentation and comments scripts: generate_rust_analyzer: fix resolution of #[pin_data] macros drm/tyr: depend on `COMMON_CLK` to fix build error rust: sync: atomic: Provide stub for `rusttest` 32-bit hosts kbuild: rust: clean libpin_init_internal in mrproper rust: proc-macro2: rebuild if the version text changes rust: num: bounded: add missing comment for always inlined function rust: sync: refcount: always inline functions using build_assert with arguments rust: bits: always inline functions using build_assert with arguments scripts: generate_rust_analyzer: compile sysroot with correct edition scripts: generate_rust_analyzer: compile quote with correct edition scripts: generate_rust_analyzer: quote: treat `core` and `std` as dependencies scripts: generate_rust_analyzer: syn: treat `std` as a dependency scripts: generate_rust_analyzer: remove sysroot assertion rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target scripts: generate_rust_analyzer: Add pin_init_internal deps scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins dep scripts: generate_rust_analyzer: Add compiler_builtins -> core dep rust: macros: ignore example with module parameters rust: num: bounded: mark __new as unsafe ... commit c2012263047689e495e81c96d7d5b0586299578d Author: Alexey Kardashevskiy Date: Fri Jan 23 16:30:57 2026 +1100 crypto/ccp: Allow multiple streams on the same root bridge With SEV-TIO the low-level TSM driver is responsible for allocating a Stream ID. The Stream ID needs to be unique within each IDE partner port. Fix the Stream ID selection to reuse the host bridge stream resource id which is a pool of 256 ids per host bridge on AMD platforms. Otherwise, only one device per-host bridge can establish Selective Stream IDE. Fixes: 4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)") Signed-off-by: Alexey Kardashevskiy Acked-by: Tom Lendacky Link: https://patch.msgid.link/20260123053057.1350569-3-aik@amd.com [djbw: clarify end user impact in changelog] Signed-off-by: Dan Williams commit 403dd7da22461b0c7fd18d5cd4373b9a1ec8b5f7 Author: Alexey Kardashevskiy Date: Fri Jan 23 16:30:56 2026 +1100 crypto/ccp: Use PCI bridge defaults for IDE The current number of streams in AMD TSM is 1 which is too little, the core uses 255. Also, even if the module parameter is increased, calling pci_ide_set_nr_streams() second time triggers WARN_ON. Simplify the code by sticking to the PCI core defaults. Fixes: 4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)") Signed-off-by: Alexey Kardashevskiy Acked-by: Tom Lendacky Link: https://patch.msgid.link/20260123053057.1350569-2-aik@amd.com Signed-off-by: Dan Williams commit 76ed27608f7dd235b727ebbb12163438c2fbb617 Author: Steven Rostedt Date: Thu Jan 29 10:28:21 2026 -0500 perf: sched: Fix perf crash with new is_user_task() helper In order to do a user space stacktrace the current task needs to be a user task that has executed in user space. It use to be possible to test if a task is a user task or not by simply checking the task_struct mm field. If it was non NULL, it was a user task and if not it was a kernel task. But things have changed over time, and some kernel tasks now have their own mm field. An idea was made to instead test PF_KTHREAD and two functions were used to wrap this check in case it became more complex to test if a task was a user task or not[1]. But this was rejected and the C code simply checked the PF_KTHREAD directly. It was later found that not all kernel threads set PF_KTHREAD. The io-uring helpers instead set PF_USER_WORKER and this needed to be added as well. But checking the flags is still not enough. There's a very small window when a task exits that it frees its mm field and it is set back to NULL. If perf were to trigger at this moment, the flags test would say its a user space task but when perf would read the mm field it would crash with at NULL pointer dereference. Now there are flags that can be used to test if a task is exiting, but they are set in areas that perf may still want to profile the user space task (to see where it exited). The only real test is to check both the flags and the mm field. Instead of making this modification in every location, create a new is_user_task() helper function that does all the tests needed to know if it is safe to read the user space memory or not. [1] https://lore.kernel.org/all/20250425204120.639530125@goodmis.org/ Fixes: 90942f9fac05 ("perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL") Closes: https://lore.kernel.org/all/0d877e6f-41a7-4724-875d-0b0a27b8a545@roeck-us.net/ Reported-by: Guenter Roeck Signed-off-by: Steven Rostedt (Google) Signed-off-by: Peter Zijlstra (Intel) Tested-by: Guenter Roeck Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260129102821.46484722@gandalf.local.home commit 115135422562e2f791e98a6f55ec57b2da3b3a95 Author: Peter Zijlstra Date: Fri Jan 30 13:41:00 2026 +0100 sched/deadline: Fix 'stuck' dl_server Andrea reported the dl_server getting stuck for him. He tracked it down to a state where dl_server_start() saw dl_defer_running==1, but the dl_server's job is no longer valid at the time of dl_server_start(). In the state diagram this corresponds to [4] D->A (or dl_server_stop() due to no more runnable tasks) followed by [1], which in case of a lapsed deadline must then be A->B. Now our A has dl_defer_running==1, while B demands dl_defer_running==0, therefore it must get cleared when the CBS wakeup rules demand a replenish. Fixes: a110a81c52a9 ("sched/deadline: Deferrable dl server") Reported-by: Andrea Righi arighi@nvidia.com Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Tested-by: Andrea Righi arighi@nvidia.com Link: https://lkml.kernel.org/r/20260123161645.2181752-1-arighi@nvidia.com Link: https://patch.msgid.link/20260130124100.GC1079264@noisy.programming.kicks-ass.net commit f8ade833b733ae0b72e87ac6d2202a1afbe3eb4a Author: Sean Christopherson Date: Tue Jan 27 17:43:08 2026 -0800 KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps() Explicitly configure KVM's supported XSS as part of each vendor's setup flow to fix a bug where clearing SHSTK and IBT in kvm_cpu_caps, e.g. due to lack of CET XFEATURE support, makes kvm-intel.ko unloadable when nested VMX is enabled, i.e. when nested=1. The late clearing results in nested_vmx_setup_{entry,exit}_ctls() clearing VM_{ENTRY,EXIT}_LOAD_CET_STATE when nested_vmx_setup_ctls_msrs() runs during the CPU compatibility checks, ultimately leading to a mismatched VMCS config due to the reference config having the CET bits set, but every CPU's "local" config having the bits cleared. Note, kvm_caps.supported_{xcr0,xss} are unconditionally initialized by kvm_x86_vendor_init(), before calling into vendor code, and not referenced between ops->hardware_setup() and their current/old location. Fixes: 69cc3e886582 ("KVM: x86: Add XSS support for CET_KERNEL and CET_USER") Cc: stable@vger.kernel.org Cc: Mathias Krause Cc: John Allen Cc: Rick Edgecombe Cc: Chao Gao Cc: Binbin Wu Cc: Xiaoyao Li Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Link: https://patch.msgid.link/20260128014310.3255561-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 03610bd6b53cc5e42ce767faddd489220f0011ef Merge: 2b54ac9e0cf898 4da7c5c3ec34d8 Author: Linus Torvalds Date: Fri Jan 30 13:18:32 2026 -0800 Merge tag 'block-6.19-20260130' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix for an accounting leak in bcache that's been there forever, and a related dead code removal - Revert of a fix for rnbd that went into this series, but depends on other changes that are staged for 7.0 - NVMe pull request via Keith: - TCP target completion race condition fix (Ming) - DMA descriptor cleanup fix (Roger) * tag 'block-6.19-20260130' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: bcache: fix I/O accounting leak in detached_dev_do_request bcache: remove dead code in detached_dev_do_request nvme-pci: DMA unmap the correct regions in nvme_free_sgls Revert "rnbd-clt: fix refcount underflow in device unmap path" nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference commit 2b54ac9e0cf8986e138736840f20d537db22ce79 Merge: d941a3f6560511 56c430c7f06d83 Author: Linus Torvalds Date: Fri Jan 30 13:15:04 2026 -0800 Merge tag 'dma-mapping-6.19-2026-01-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: - important fix for ARM 32-bit based systems using cma= kernel parameter (Oreoluwa Babatunde) - a fix for the corner case of the DMA atomic pool based allocations (Sai Sree Kartheek Adivi) * tag 'dma-mapping-6.19-2026-01-30' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma/pool: distinguish between missing and exhausted atomic pools of: reserved_mem: Allow reserved_mem framework detect "cma=" kernel param commit d941a3f65605113db18d1485d65f0e175238beea Merge: 4327db89f5e024 e64d1cb21a1c6e Author: Linus Torvalds Date: Fri Jan 30 11:58:27 2026 -0800 Merge tag 'gpio-fixes-for-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Over the last week I received quite an unexpected (for rc7) number of fixes but they are all pretty small and mostly limited to drivers: - don't call into pinctrl when setting direction in gpio-rockchip as it's not needed and may trigger locking context errors - change spinlock to raw_spinlock in gpio-sprd - fix a use-after-free bug in gpio-virtuser - don't register a driver from another driver's probe() in gpio-omap - fix int width problems in GPIO ACPI code - fix interrupt-to-pin mapping in gpio-brcmstb - mask interrupts in irq shutdown in gpio-pca953x" * tag 'gpio-fixes-for-v6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: acpi: Fix potential out-of-boundary left shift gpio: brcmstb: correct hwirq to bank map gpio: omap: do not register driver in probe() gpio: pca953x: mask interrupts in irq shutdown gpio: virtuser: fix UAF in configfs release path gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler gpio: sprd: Change sprd_gpio lock to raw_spin_lock gpio: rockchip: Stop calling pinctrl for set_direction commit 40857194956dcaf3d2b66d6bd113d844c93bef54 Author: Mohammad Heib Date: Sun Dec 28 21:40:20 2025 +0200 i40e: drop udp_tunnel_get_rx_info() call from i40e_open() The i40e driver calls udp_tunnel_get_rx_info() during i40e_open(). This is redundant because UDP tunnel RX offload state is preserved across device down/up cycles. The udp_tunnel core handles synchronization automatically when required. Furthermore, recent changes in the udp_tunnel infrastructure require querying RX info while holding the udp_tunnel lock. Calling it directly from the ndo_open path violates this requirement, triggering the following lockdep warning: Call Trace: ? __udp_tunnel_nic_assert_locked+0x39/0x40 [udp_tunnel] i40e_open+0x135/0x14f [i40e] __dev_open+0x121/0x2e0 __dev_change_flags+0x227/0x270 dev_change_flags+0x3d/0xb0 devinet_ioctl+0x56f/0x860 sock_do_ioctl+0x7b/0x130 __x64_sys_ioctl+0x91/0xd0 do_syscall_64+0x90/0x170 ... Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from i40e_open() resolve the locking violation. Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") Signed-off-by: Mohammad Heib Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 234e615bfece9e3e91c50fe49ab9e68ee37c791a Author: Mohammad Heib Date: Sun Dec 28 21:40:21 2025 +0200 ice: drop udp_tunnel_get_rx_info() call from ndo_open() The ice driver calls udp_tunnel_get_rx_info() during ice_open_internal(). This is redundant because UDP tunnel RX offload state is preserved across device down/up cycles. The udp_tunnel core handles synchronization automatically when required. Furthermore, recent changes in the udp_tunnel infrastructure require querying RX info while holding the udp_tunnel lock. Calling it directly from the ndo_open path violates this requirement, triggering the following lockdep warning: Call Trace: ice_open_internal+0x253/0x350 [ice] __udp_tunnel_nic_assert_locked+0x86/0xb0 [udp_tunnel] __dev_open+0x2f5/0x880 __dev_change_flags+0x44c/0x660 netif_change_flags+0x80/0x160 devinet_ioctl+0xd21/0x15f0 inet_ioctl+0x311/0x350 sock_ioctl+0x114/0x220 __x64_sys_ioctl+0x131/0x1a0 ... Remove the redundant and unsafe call to udp_tunnel_get_rx_info() from ice_open_internal() to resolve the locking violation Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") Signed-off-by: Mohammad Heib Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fc6f36eaaedcf4b81af6fe1a568f018ffd530660 Author: Aaron Ma Date: Wed Jan 21 15:51:06 2026 +0800 ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] Fixes: 803bef817807d ("ice: factor out ice_ptp_rebuild_owner()") Signed-off-by: Aaron Ma Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 88b68f35eb43ad5ac77ac1107059040b04e6f477 Author: Jacob Keller Date: Wed Jan 21 10:44:19 2026 -0800 ice: PTP: fix missing timestamps on E825 hardware The E825 hardware currently has each PF handle the PFINT_TSYN_TX cause of the miscellaneous OICR interrupt vector. The actual interrupt cause underlying this is shared by all ports on the same quad: ┌─────────────────────────────────┐ │ │ │ ┌────┐ ┌────┐ ┌────┐ ┌────┐ │ │ │PF 0│ │PF 1│ │PF 2│ │PF 3│ │ │ └────┘ └────┘ └────┘ └────┘ │ │ │ └────────────────▲────────────────┘ │ │ ┌────────────────┼────────────────┐ │ PHY QUAD │ └───▲────────▲────────▲────────▲──┘ │ │ │ │ ┌───┼──┐ ┌───┴──┐ ┌───┼──┐ ┌───┼──┐ │Port 0│ │Port 1│ │Port 2│ │Port 3│ └──────┘ └──────┘ └──────┘ └──────┘ If multiple PFs issue Tx timestamp requests near simultaneously, it is possible that the correct PF will not be interrupted and will miss its timestamp. Understanding why is somewhat complex. Consider the following sequence of events: CPU 0: Send Tx packet on PF 0 ... PF 0 enqueues packet with Tx request CPU 1, PF1: ... Send Tx packet on PF1 ... PF 1 enqueues packet with Tx request HW: PHY Port 0 sends packet PHY raises Tx timestamp event interrupt MAC raises each PF interrupt CPU 0, PF0: CPU 1, PF1: ice_misc_intr() checks for Tx timestamps ice_misc_intr() checks for Tx timestamp Sees packet ready bit set Sees nothing available ... Exits ... ... HW: PHY port 1 sends packet PHY interrupt ignored because not all packet timestamps read yet. ... Read timestamp, report to stack Because the interrupt event is shared for all ports on the same quad, the PHY will not raise a new interrupt for any PF until all timestamps are read. In the example above, the second timestamp comes in for port 1 before the timestamp from port 0 is read. At this point, there is no longer an interrupt thread running that will read the timestamps, because each PF has checked and found that there was no work to do. Applications such as ptp4l will timeout after waiting a few milliseconds. Eventually, the watchdog service task will re-check for all quads and notice that there are outstanding timestamps, and issue a software interrupt to recover. However, by this point it is far too late, and applications have already failed. All of this occurs because of the underlying hardware behavior. The PHY cannot raise a new interrupt signal until all outstanding timestamps have been read. As a first step to fix this, switch the E825C hardware to the ICE_PTP_TX_INTERRUPT_ALL mode. In this mode, only the clock owner PF will respond to the PFINT_TSYN_TX cause. Other PFs disable this cause and will not wake. In this mode, the clock owner will iterate over all ports and handle timestamps for each connected port. This matches the E822 behavior, and is a necessary but insufficient step to resolve the missing timestamps. Even with use of the ICE_PTP_TX_INTERRUPT_ALL mode, we still sometimes miss a timestamp event. The ice_ptp_tx_tstamp_owner() does re-check the ready bitmap, but does so before re-enabling the OICR interrupt vector. It also only checks the ready bitmap, but not the software Tx timestamp tracker. To avoid risk of losing a timestamp, refactor the logic to check both the software Tx timestamp tracker bitmap *and* the hardware ready bitmap. Additionally, do this outside of ice_ptp_process_ts() after we have already re-enabled the OICR interrupt. Remove the checks from the ice_ptp_tx_tstamp(), ice_ptp_tx_tstamp_owner(), and the ice_ptp_process_ts() functions. This results in ice_ptp_tx_tstamp() being nothing more than a wrapper around ice_ptp_process_tx_tstamp() so we can remove it. Add the ice_ptp_tx_tstamps_pending() function which returns a boolean indicating if there are any pending Tx timestamps. First, check the software timestamp tracker bitmap. In ICE_PTP_TX_INTERRUPT_ALL mode, check *all* ports software trackers. If a tracker has outstanding timestamp requests, return true. Additionally, check the PHY ready bitmap to confirm if the PHY indicates any outstanding timestamps. In the ice_misc_thread_fn(), call ice_ptp_tx_tstamps_pending() just before returning from the IRQ thread handler. If it returns true, write to PFINT_OICR to trigger a PFINT_OICR_TSYN_TX_M software interrupt. This will force the handler to interrupt again and complete the work even if the PHY hardware did not interrupt for any reason. This results in the following new flow for handling Tx timestamps: 1) send Tx packet 2) PHY captures timestamp 3) PHY triggers MAC interrupt 4) clock owner executes ice_misc_intr() with PFINT_OICR_TSYN_TX flag set 5) ice_ptp_ts_irq() returns IRQ_WAKE_THREAD 7) The interrupt thread wakes up and kernel calls ice_misc_intr_thread_fn() 8) ice_ptp_process_ts() is called to handle any outstanding timestamps 9) ice_irq_dynamic_ena() is called to re-enable the OICR hardware interrupt cause 10) ice_ptp_tx_tstamps_pending() is called to check if we missed any more outstanding timestamps, checking both software and hardware indicators. With this change, it should no longer be possible for new timestamps to come in such a way that we lose an interrupt. If a timestamp comes in before the ice_ptp_tx_tstamps_pending() call, it will be noticed by at least one of the software bitmap check or the hardware bitmap check. If the timestamp comes in *after* this check, it should cause a timestamp interrupt as we have already read all timestamps from the PHY and the OICR vector has been re-enabled. Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Signed-off-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemyslaw Korba Tested-by: Vitaly Grinberg Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 99854c167cfc113ad863832b1601c4ca1a639cfe Author: Grzegorz Nitka Date: Thu Nov 27 10:25:58 2025 +0100 ice: fix missing TX timestamps interrupts on E825 devices Modify PTP (Precision Time Protocol) configuration on link down flow. Previously, PHY_REG_TX_OFFSET_READY register was cleared in such case. This register is used to determine if the timestamp is valid or not on the hardware side. However, there is a possibility that there is still the packet in the HW queue which originally was supposed to be timestamped but the link is already down and given register is cleared. This potentially might lead to the situation in which that 'delayed' packet's timestamp is treated as invalid one when the link is up again. This in turn leads to the situation in which the driver is not able to effectively clean timestamp memory and interrupt configuration. From the hardware perspective, that 'old' interrupt was not handled properly and even if new timestamp packets are processed, no new interrupts is generated. As a result, providing timestamps to the user applications (like ptp4l) is not possible. The solution for this problem is implemented at the driver level rather than the firmware, and maintains the tx_ready bit high, even during link down events. This avoids entering a potential inconsistent state between the driver and the timestamp hardware. Testing hints: - run PTP traffic at higher rate (like 16 PTP messages per second) - observe ptp4l behaviour at the client side in the following conditions: a) trigger link toggle events. It needs to be physiscal link down/up events b) link speed change In all above cases, PTP processing at ptp4l application should resume always. In failure case, the following permanent error message in ptp4l log was observed: controller-0 ptp4l: err [6175.116] ptp4l-legacy timed out while polling for tx timestamp Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") Reviewed-by: Aleksandr Loktionov Signed-off-by: Grzegorz Nitka Tested-by: Sunitha Mekala (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit edf9088b6e1d6d88982db7eb5e736a0e4fbcc09e Author: Breno Leitao Date: Mon Jan 26 09:50:31 2026 -0800 spi: tegra210-quad: Protect curr_xfer check in IRQ handler Now that all other accesses to curr_xfer are done under the lock, protect the curr_xfer NULL check in tegra_qspi_isr_thread() with the spinlock. Without this protection, the following race can occur: CPU0 (ISR thread) CPU1 (timeout path) ---------------- ------------------- if (!tqspi->curr_xfer) // sees non-NULL spin_lock() tqspi->curr_xfer = NULL spin_unlock() handle_*_xfer() spin_lock() t = tqspi->curr_xfer // NULL! ... t->len ... // NULL dereference! With this patch, all curr_xfer accesses are now properly synchronized. Although all accesses to curr_xfer are done under the lock, in tegra_qspi_isr_thread() it checks for NULL, releases the lock and reacquires it later in handle_cpu_based_xfer()/handle_dma_based_xfer(). There is a potential for an update in between, which could cause a NULL pointer dereference. To handle this, add a NULL check inside the handlers after acquiring the lock. This ensures that if the timeout path has already cleared curr_xfer, the handler will safely return without dereferencing the NULL pointer. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao Tested-by: Jon Hunter Acked-by: Jon Hunter Acked-by: Thierry Reding Link: https://patch.msgid.link/20260126-tegra_xfer-v2-6-6d2115e4f387@debian.org Signed-off-by: Mark Brown commit 6d7723e8161f3c3f14125557e19dd080e9d882be Author: Breno Leitao Date: Mon Jan 26 09:50:30 2026 -0800 spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer Protect the curr_xfer clearing in tegra_qspi_non_combined_seq_xfer() with the spinlock to prevent a race with the interrupt handler that reads this field to check if a transfer is in progress. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao Tested-by: Jon Hunter Acked-by: Jon Hunter Acked-by: Thierry Reding Link: https://patch.msgid.link/20260126-tegra_xfer-v2-5-6d2115e4f387@debian.org Signed-off-by: Mark Brown commit bf4528ab28e2bf112c3a2cdef44fd13f007781cd Author: Breno Leitao Date: Mon Jan 26 09:50:29 2026 -0800 spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer The curr_xfer field is read by the IRQ handler without holding the lock to check if a transfer is in progress. When clearing curr_xfer in the combined sequence transfer loop, protect it with the spinlock to prevent a race with the interrupt handler. Protect the curr_xfer clearing at the exit path of tegra_qspi_combined_seq_xfer() with the spinlock to prevent a race with the interrupt handler that reads this field. Without this protection, the IRQ handler could read a partially updated curr_xfer value, leading to NULL pointer dereference or use-after-free. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao Tested-by: Jon Hunter Acked-by: Jon Hunter Acked-by: Thierry Reding Link: https://patch.msgid.link/20260126-tegra_xfer-v2-4-6d2115e4f387@debian.org Signed-off-by: Mark Brown commit f5a4d7f5e32ba163cff893493ec1cbb0fd2fb0d5 Author: Breno Leitao Date: Mon Jan 26 09:50:28 2026 -0800 spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one When the timeout handler processes a completed transfer and signals completion, the transfer thread can immediately set up the next transfer and assign curr_xfer to point to it. If a delayed ISR from the previous transfer then runs, it checks if (!tqspi->curr_xfer) (currently without the lock also -- to be fixed soon) to detect stale interrupts, but this check passes because curr_xfer now points to the new transfer. The ISR then incorrectly processes the new transfer's context. Protect the curr_xfer assignment with the spinlock to ensure the ISR either sees NULL (and bails out) or sees the new value only after the assignment is complete. Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller") Signed-off-by: Breno Leitao Tested-by: Jon Hunter Acked-by: Jon Hunter Acked-by: Thierry Reding Link: https://patch.msgid.link/20260126-tegra_xfer-v2-3-6d2115e4f387@debian.org Signed-off-by: Mark Brown commit ef13ba357656451d6371940d8414e3e271df97e3 Author: Breno Leitao Date: Mon Jan 26 09:50:27 2026 -0800 spi: tegra210-quad: Move curr_xfer read inside spinlock Move the assignment of the transfer pointer from curr_xfer inside the spinlock critical section in both handle_cpu_based_xfer() and handle_dma_based_xfer(). Previously, curr_xfer was read before acquiring the lock, creating a window where the timeout path could clear curr_xfer between reading it and using it. By moving the read inside the lock, the handlers are guaranteed to see a consistent value that cannot be modified by the timeout path. Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller") Signed-off-by: Breno Leitao Acked-by: Thierry Reding Tested-by: Jon Hunter Acked-by: Jon Hunter Link: https://patch.msgid.link/20260126-tegra_xfer-v2-2-6d2115e4f387@debian.org Signed-off-by: Mark Brown commit aabd8ea0aa253d40cf5f20a609fc3d6f61e38299 Author: Breno Leitao Date: Mon Jan 26 09:50:26 2026 -0800 spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer When the ISR thread wakes up late and finds that the timeout handler has already processed the transfer (curr_xfer is NULL), return IRQ_HANDLED instead of IRQ_NONE. Use a similar approach to tegra_qspi_handle_timeout() by reading QSPI_TRANS_STATUS and checking the QSPI_RDY bit to determine if the hardware actually completed the transfer. If QSPI_RDY is set, the interrupt was legitimate and triggered by real hardware activity. The fact that the timeout path handled it first doesn't make it spurious. Returning IRQ_NONE incorrectly suggests the interrupt wasn't for this device, which can cause issues with shared interrupt lines and interrupt accounting. Fixes: b4e002d8a7ce ("spi: tegra210-quad: Fix timeout handling") Signed-off-by: Breno Leitao Signed-off-by: Usama Arif Tested-by: Jon Hunter Acked-by: Jon Hunter Acked-by: Thierry Reding Link: https://patch.msgid.link/20260126-tegra_xfer-v2-1-6d2115e4f387@debian.org Signed-off-by: Mark Brown commit 6bd8b4a92a901fae1a422e6f914801063c345e8d Author: Xu Yang Date: Fri Jan 30 13:11:07 2026 +0800 pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains Fix out-of-range access of bc->domains in imx8m_blk_ctrl_remove(). Fixes: 2684ac05a8c4 ("soc: imx: add i.MX8M blk-ctrl driver") Cc: stable@kernel.org Signed-off-by: Xu Yang Reviewed-by: Daniel Baluta Signed-off-by: Ulf Hansson commit 4327db89f5e02458001b9c296a961265b8613395 Merge: 4d310797262f0d 3a390a21ff0bc5 Author: Linus Torvalds Date: Thu Jan 29 23:20:51 2026 -0800 Merge tag 'drm-fixes-2026-01-30' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Seems to be a bit quieter this week, mostly xe and amdgpu, with msm and imx fixes and one WARN_ON from user blocked. Nothing of note outstanding either. uapi: - Fix a WARN_ON() when passing an invalid handle to drm_gem_change_handle_ioctl() msm: - GPU: - Fix bogus hwcg register update for a690 xe: - Skip address copy for sync-only execs - Fix a WA - Derive mem_copy cap from graphics version - Fix is_bound() pci_dev lifetime - xe nvm cleanup fixes amdgpu: - SMU 13 fixes - SMU 14 fixes - GPUVM fault filter fix - Powergating fix - HDMI debounce fix - Xclk fix for soc21 APUs - Fix COND_EXEC handling for GC 11 - GC 10-12 KGQ init fixes - GC 11-12 KGQ reset fixes imx/tve: - drop ddc device reference when unloading" * tag 'drm-fixes-2026-01-30' of https://gitlab.freedesktop.org/drm/kernel: (21 commits) drm/xe/nvm: Fix double-free on aux add failure drm/xe/nvm: Manage nvm aux cleanup with devres drm/amdgpu/gfx12: adjust KGQ reset sequence drm/amdgpu/gfx11: adjust KGQ reset sequence drm/amdgpu/gfx12: fix wptr reset in KGQ init drm/amdgpu/gfx11: fix wptr reset in KGQ init drm/amdgpu/gfx10: fix wptr reset in KGQ init drm/xe/configfs: Fix is_bound() pci_dev lifetime drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() drm/amdgpu/soc21: fix xclk for APUs drm/amd/display: Clear HDMI HPD pending work only if it is enabled drm/imx/tve: fix probe device leak drm/amd/pm: fix race in power state check before mutex lock drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove drm/amd/pm: fix smu v14 soft clock frequency setting issue drm/amd/pm: fix smu v13 soft clock frequency setting issue drm/xe: derive mem copy capability from graphics version drm/xe/xelp: Fix Wa_18022495364 drm/xe: Skip address copy for sync-only execs drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() ... commit 31a7a0bbeb006bac2d9c81a2874825025214b6d8 Author: Junrui Luo Date: Thu Jan 29 00:55:13 2026 +0800 dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx(). Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 24ab724f8a46 ("dpaa2-switch: use the port index in the IRQ handler") Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB7881D420AB43FF1A227B84AFAF91A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski commit 82deb2816ebbdc79083e2d76e0ef141a48aec69c Merge: ed48a84a72fefb 6cbba46934aefd Author: Jakub Kicinski Date: Thu Jan 29 19:27:37 2026 -0800 Merge branch 'net-liquidio-fix-memory-leaks-in-setup_nic_devices' Zilin Guan says: ==================== net: liquidio: Fix memory leaks in setup_nic_devices() This series fixes memory leaks in the initialization paths of the NIC devices. Patch 1 moves the initialization of oct->props[i].netdev before queue setup calls. This ensures that if queue setup fails, the cleanup function can find and free the allocated netdev. It also initializes lio->oct_dev early to prevent a crash in the cleanup path. Patch 2 fixes an off-by-one error in the PF cleanup loop. It ensures the current device index is cleaned up and correctly handles the post-loop devlink_alloc failure case. Patch 3 fixes the same off-by-one error in the VF cleanup loop. ==================== Link: https://patch.msgid.link/20260128154440.278369-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 6cbba46934aefdfb5d171e0a95aec06c24f7ca30 Author: Zilin Guan Date: Wed Jan 28 15:44:40 2026 +0000 net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Compile tested only. Issue found using code review. Fixes: 846b46873eeb ("liquidio CN23XX: VF offload features") Suggested-by: Simon Horman Signed-off-by: Zilin Guan Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260128154440.278369-4-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 8558aef4e8a1a83049ab906d21d391093cfa7e7f Author: Zilin Guan Date: Wed Jan 28 15:44:39 2026 +0000 net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index. Compile tested only. Issue found using code review. Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters") Suggested-by: Simon Horman Signed-off-by: Zilin Guan Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260128154440.278369-3-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 926ede0c85e1e57c97d64d9612455267d597bb2c Author: Zilin Guan Date: Wed Jan 28 15:44:38 2026 +0000 net: liquidio: Initialize netdev pointer before queue setup In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues(). If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak. Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: c33c997346c3 ("liquidio: enhanced ethtool --set-channels feature") Signed-off-by: Zilin Guan Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20260128154440.278369-2-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit ed48a84a72fefb20a82dd90a7caa7807e90c6f66 Author: Junrui Luo Date: Wed Jan 28 16:07:34 2026 +0800 dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface") Signed-off-by: Junrui Luo Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/SYBPR01MB7881BEABA8DA896947962470AF91A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski commit de5720f91b0b64c603f14da3c6298cba4febeb01 Merge: 37d312bf957b95 cabd1a97637578 Author: Jakub Kicinski Date: Thu Jan 29 18:25:24 2026 -0800 Merge branch 'net-fix-potential-crash-in-net-sched-cls_u32-c' Eric Dumazet says: ==================== net: fix potential crash in net/sched/cls_u32.c GangMin Kim provided a report and a repro fooling u32_classify(). Add skb_header_pointer_careful() variant of skb_header_pointer() and use it in net/sched/cls_u32.c. Later we can also use it in net/sched/act_pedit.c ==================== Link: https://patch.msgid.link/20260128141539.3404400-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit cabd1a976375780dabab888784e356f574bbaed8 Author: Eric Dumazet Date: Wed Jan 28 14:15:39 2026 +0000 net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221 Fixes: fbc2e7d9cf49 ("cls_u32: use skb_header_pointer() to dereference data safely") Reported-by: GangMin Kim Closes: https://lore.kernel.org/netdev/CANn89iJkyUZ=mAzLzC4GdcAgLuPnUoivdLaOs6B9rq5_erj76w@mail.gmail.com/T/ Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260128141539.3404400-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 13e00fdc9236bd4d0bff4109d2983171fbcb74c4 Author: Eric Dumazet Date: Wed Jan 28 14:15:38 2026 +0000 net: add skb_header_pointer_careful() helper This variant of skb_header_pointer() should be used in contexts where @offset argument is user-controlled and could be negative. Negative offsets are supported, as long as the zone starts between skb->head and skb->data. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3a390a21ff0bc53800433441045c00b51de9d439 Merge: 016bf66866d1af e535c23513c63f Author: Dave Airlie Date: Fri Jan 30 11:47:01 2026 +1000 Merge tag 'drm-misc-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc8: - Fix a WARN_ON() when passing an invalid handle to drm_gem_change_handle_ioctl() - drop ddc device reference when unloading in imx/tve. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/a34d967e-b111-4b29-8c97-af3e77b5d33e@linux.intel.com commit 37d312bf957b95346fae2b3f82ce043474ea66c9 Author: Jakub Kicinski Date: Wed Jan 28 13:04:35 2026 -0800 MAINTAINERS: add an entry for PSP We are missing a MAINTAINERS entry for PSP, create one. Acked-by: Willem de Bruijn Link: https://patch.msgid.link/20260128210435.161061-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 016bf66866d1aff89be273520de9179148a772b1 Merge: 190eaa45bb39ce dfd64f6e8cd7b5 Author: Dave Airlie Date: Fri Jan 30 10:43:35 2026 +1000 Merge tag 'amd-drm-fixes-6.19-2026-01-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-29: amdgpu: - SMU 13 fixes - SMU 14 fixes - GPUVM fault filter fix - Powergating fix - HDMI debounce fix - Xclk fix for soc21 APUs - Fix COND_EXEC handling for GC 11 - GC 10-12 KGQ init fixes - GC 11-12 KGQ reset fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260129212518.22274-1-alexander.deucher@amd.com commit 190eaa45bb39ce4c427f5702ce03359ffdefe545 Merge: 2243afcd8c49f3 8a44241b0b83a6 Author: Dave Airlie Date: Fri Jan 30 09:35:13 2026 +1000 Merge tag 'drm-xe-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Skip address copy for sync-only execs (Lin) - Fix a WA (Tvrtko) - Derive mem_copy cap from graphics version (Nitin) - Fix is_bound() pci_dev lifetime (Lin) - xe nvm cleanup fixes (Lin) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aXu_JzBFb9YVFYW1@fedora commit 4d310797262f0ddf129e76c2aad2b950adaf1fda Merge: e9f6ac972ec013 1730daa3b425ea Author: Linus Torvalds Date: Thu Jan 29 15:20:22 2026 -0800 Merge tag 'pm-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "This adds a terminating NULL entry to an of_device_id table in the qcom-nvmem cpufreq driver to avoid out-of-bounds access (Pei Xiao)" * tag 'pm-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: qcom-nvmem: add sentinel to qcom_cpufreq_ipq806x_match_list commit e9f6ac972ec0139a7988fe713740a957aea5d999 Merge: bcb6058a4b4596 2f6d2c8d9ac05a Author: Linus Torvalds Date: Thu Jan 29 14:08:36 2026 -0800 Merge tag 'mtd/fixes-for-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fix from Miquel Raynal: "A single late MTD fix, which reverts a fix that turned out to be incorrect. The observations of the committer was that the number of IDs to be used to probe a chip was incorrect. It happened to be a limitation of his controller, not a chip issue. Restore the chip description, a solution must be found somewhere else" * tag 'mtd/fixes-for-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: Revert "mtd: spinand: esmt: fix id code for F50D1G41LB" commit 8a44241b0b83a6047c5448da1fff03fcc29496b5 Author: Shuicheng Lin Date: Tue Jan 20 18:32:42 2026 +0000 drm/xe/nvm: Fix double-free on aux add failure After a successful auxiliary_device_init(), aux_dev->dev.release (xe_nvm_release_dev()) is responsible for the kfree(nvm). When there is failure with auxiliary_device_add(), driver will call auxiliary_device_uninit(), which call put_device(). So that the .release callback will be triggered to free the memory associated with the auxiliary_device. Move the kfree(nvm) into the auxiliary_device_init() failure path and remove the err goto path to fix below error. " [ 13.232905] ================================================================== [ 13.232911] BUG: KASAN: double-free in xe_nvm_init+0x751/0xf10 [xe] [ 13.233112] Free of addr ffff888120635000 by task systemd-udevd/273 [ 13.233120] CPU: 8 UID: 0 PID: 273 Comm: systemd-udevd Not tainted 6.19.0-rc2-lgci-xe-kernel+ #225 PREEMPT(voluntary) ... [ 13.233125] Call Trace: [ 13.233126] [ 13.233127] dump_stack_lvl+0x7f/0xc0 [ 13.233132] print_report+0xce/0x610 [ 13.233136] ? kasan_complete_mode_report_info+0x5d/0x1e0 [ 13.233139] ? xe_nvm_init+0x751/0xf10 [xe] ... " v2: drop err goto path. (Alexander) Fixes: 7926ba2143d8 ("drm/xe: defer free of NVM auxiliary container to device release callback") Reviewed-by: Nitin Gote Reviewed-by: Brian Nguyen Cc: Alexander Usyskin Cc: Rodrigo Vivi Suggested-by: Brian Nguyen Signed-off-by: Shuicheng Lin Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260120183239.2966782-7-shuicheng.lin@intel.com (cherry picked from commit a3187c0c2bbd947ffff97f90d077ac88f9c2a215) Signed-off-by: Thomas Hellström commit 2da8fbb8f1c17129a08c1e0e42c71eabdca76062 Author: Shuicheng Lin Date: Tue Jan 20 18:32:41 2026 +0000 drm/xe/nvm: Manage nvm aux cleanup with devres Move nvm teardown to a devm-managed action registered from xe_nvm_init(). This ensures the auxiliary NVM device is deleted on probe failure and device detach without requiring explicit calls from remove paths. As part of this, drop xe_nvm_fini() from xe_device_remove() and from the survivability sysfs teardown, and remove the public xe_nvm_fini() API from the header. This is to fix below warn message when there is probe failure after xe_nvm_init(), then xe_device_probe() is called again: " [ 207.318152] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/xe.nvm.768' [ 207.318157] CPU: 5 UID: 0 PID: 10261 Comm: modprobe Tainted: G B W 6.19.0-rc2-lgci-xe-kernel+ #223 PREEMPT(voluntary) [ 207.318160] Tainted: [B]=BAD_PAGE, [W]=WARN [ 207.318161] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023 [ 207.318163] Call Trace: [ 207.318163] [ 207.318165] dump_stack_lvl+0xa0/0xc0 [ 207.318170] dump_stack+0x10/0x20 [ 207.318171] sysfs_warn_dup+0xd5/0x110 [ 207.318175] sysfs_create_dir_ns+0x1f6/0x280 [ 207.318177] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 207.318179] ? lock_acquire+0x1a4/0x2e0 [ 207.318182] ? __kasan_check_read+0x11/0x20 [ 207.318185] ? do_raw_spin_unlock+0x5c/0x240 [ 207.318187] kobject_add_internal+0x28d/0x8e0 [ 207.318189] kobject_add+0x11f/0x1f0 [ 207.318191] ? __pfx_kobject_add+0x10/0x10 [ 207.318193] ? lockdep_init_map_type+0x4b/0x230 [ 207.318195] ? get_device_parent.isra.0+0x43/0x4c0 [ 207.318197] ? kobject_get+0x55/0xf0 [ 207.318199] device_add+0x2d7/0x1500 [ 207.318201] ? __pfx_device_add+0x10/0x10 [ 207.318203] ? lockdep_init_map_type+0x4b/0x230 [ 207.318205] __auxiliary_device_add+0x99/0x140 [ 207.318208] xe_nvm_init+0x7a2/0xef0 [xe] [ 207.318333] ? xe_devcoredump_init+0x80/0x110 [xe] [ 207.318452] ? __devm_add_action+0x82/0xc0 [ 207.318454] ? fs_reclaim_release+0xc0/0x110 [ 207.318457] xe_device_probe+0x17dd/0x2c40 [xe] [ 207.318574] ? __pfx___drm_dev_dbg+0x10/0x10 [ 207.318576] ? add_dr+0x180/0x220 [ 207.318579] ? __pfx___drmm_mutex_release+0x10/0x10 [ 207.318582] ? __pfx_xe_device_probe+0x10/0x10 [xe] [ 207.318697] ? xe_pm_init_early+0x33a/0x410 [xe] [ 207.318850] xe_pci_probe+0x936/0x1250 [xe] [ 207.318999] ? lock_acquire+0x1a4/0x2e0 [ 207.319003] ? __pfx_xe_pci_probe+0x10/0x10 [xe] [ 207.319151] local_pci_probe+0xe6/0x1a0 [ 207.319154] pci_device_probe+0x523/0x840 [ 207.319157] ? __pfx_pci_device_probe+0x10/0x10 [ 207.319159] ? sysfs_do_create_link_sd.isra.0+0x8c/0x110 [ 207.319162] ? sysfs_create_link+0x48/0xc0 ... " Fixes: c28bfb107dac ("drm/xe/nvm: add on-die non-volatile memory device") Reviewed-by: Alexander Usyskin Reviewed-by: Brian Nguyen Cc: Rodrigo Vivi Cc: Riana Tauro Signed-off-by: Shuicheng Lin Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260120183239.2966782-6-shuicheng.lin@intel.com (cherry picked from commit 11035eab1b7d88daa7904440046e64d3810b1ca1) Signed-off-by: Thomas Hellström commit bcb6058a4b4596f12065276faeb9363dc4887ea9 Merge: 1cac38910ecb88 bd58782995a2e6 Author: Linus Torvalds Date: Thu Jan 29 11:09:13 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-01-29-09-41' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "16 hotfixes. 9 are cc:stable, 12 are for MM. There's a patch series from Pratyush Yadav which fixes a few things in the new-in-6.19 LUO memfd code. Plus the usual shower of singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-01-29-09-41' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: vmcoreinfo: make hwerr_data visible for debugging mm/zone_device: reinitialize large zone device private folios mm/mm_init: don't cond_resched() in deferred_init_memmap_chunk() if called from deferred_grow_zone() mm/kfence: randomize the freelist on initialization kho: kho_preserve_vmalloc(): don't return 0 when ENOMEM kho: init alloc tags when restoring pages from reserved memory mm: memfd_luo: restore and free memfd_luo_ser on failure mm: memfd_luo: use memfd_alloc_file() instead of shmem_file_setup() memfd: export alloc_file() flex_proportions: make fprop_new_period() hardirq safe mailmap: add entry for Viacheslav Bocharov mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn mm/memory-failure: fix missing ->mf_stats count in hugetlb poison mm, swap: restore swap_space attr aviod kernel panic mm/kasan: fix KASAN poisoning in vrealloc() mm/shmem, swap: fix race of truncate and swap entry split commit bdde21d3e77da55121885fd2ef42bc6a15ac2f0c Author: Paul Moore Date: Thu Jan 29 13:31:56 2026 -0500 lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY While reworking the LSM initialization code the /proc/sys/vm/mmap_min_addr handler was inadvertently caught up in the change and the procfs entry wasn't setup when CONFIG_SECURITY was not selected at kernel build time. This patch restores the previous behavior and ensures that the procfs entry is setup regardless of the CONFIG_SECURITY state. Future work will improve upon this, likely by moving the procfs handler into the mm subsystem, but this patch should resolve the immediate regression. Fixes: 4ab5efcc2829 ("lsm: consolidate all of the LSM framework initcalls") Reported-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Reviewed-by: Kees Cook Signed-off-by: Paul Moore commit 1cac38910ecb881b09f61f57545a771bbe57ba68 Merge: e829083bc46d3d 426ca15c7f6cb6 Author: Linus Torvalds Date: Thu Jan 29 10:21:52 2026 -0800 Merge tag 'net-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth, CAN and wireless. There are no known regressions currently under investigation. Current release - fix to a fix: - can: gs_usb_receive_bulk_callback(): fix error message Current release - regressions: - eth: gve: fix probe failure if clock read fails Previous releases - regressions: - ipv6: use the right ifindex when replying to icmpv6 from localhost - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - bluetooth: fix null-ptr-deref in hci_uart_write_work - eth: - sfc: fix deadlock in RSS config read - ice: ifix NULL pointer dereference in ice_vsi_set_napi_queues - mlx5: fix memory leak in esw_acl_ingress_lgcy_setup() Previous releases - always broken: - core: fix segmentation of forwarding fraglist GRO - wifi: mac80211: correctly decode TTLM with default link map - mptcp: avoid dup SUB_CLOSED events after disconnect - nfc: fix memleak in nfc_llcp_send_ui_frame(). - eth: - bonding: fix use-after-free due to enslave fail - mlx5e: - TC, delete flows only for existing peers - fix inverted cap check in tx flow table root disconnect" * tag 'net-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (43 commits) net: fix segmentation of forwarding fraglist GRO wifi: mac80211: correctly decode TTLM with default link map selftests: mptcp: join: fix local endp not being tracked selftests: mptcp: check subflow errors in close events mptcp: only reset subflow errors when propagated selftests: mptcp: check no dup close events after error mptcp: avoid dup SUB_CLOSED events after disconnect net/mlx5e: Skip ESN replay window setup for IPsec crypto offload net/mlx5: Fix vhca_id access call trace use before alloc net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect net: phy: micrel: fix clk warning when removing the driver net/mlx5e: don't assume psp tx skbs are ipv6 csum handling net: bridge: fix static key check nfc: nci: Fix race between rfkill and nci_unregister_device(). gve: fix probe failure if clock read fails net/mlx5e: Account for netdev stats in ndo_get_stats64 net/mlx5e: TC, delete flows only for existing peers net/mlx5: Fix Unbinding uplink-netdev in switchdev mode ice: stop counting UDP csum mismatch as rx_errors ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues ... commit a8ff29f0ca1d63a215ef445102662850a912d127 Author: Josh Poimboeuf Date: Tue Jan 27 17:12:05 2026 -0800 livepatch/klp-build: Require Clang assembler >= 20 Some special sections specify their ELF section entsize, for example: .pushsection section, "M", @progbits, 8 The entsize (8 in this example) is needed by objtool klp-diff for extracting individual entries. Clang assembler versions older than 20 silently ignore the above construct and set entsize to 0, resulting in the following error: .discard.annotate_data: missing special section entsize or annotations Add a klp-build check to prevent the use of Clang assembler versions prior to 20. Fixes: 24ebfcd65a87 ("livepatch/klp-build: Introduce klp-build script for generating livepatch modules") Reported-by: Song Liu Acked-by: Song Liu Link: https://patch.msgid.link/957fd52e375d0e2cfa3ac729160da995084a7f5e.1769562556.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit dfd64f6e8cd7b59238cdaf8af7a55711f13a89db Author: Alex Deucher Date: Wed Jan 28 23:05:50 2026 -0500 drm/amdgpu/gfx12: adjust KGQ reset sequence Kernel gfx queues do not need to be reinitialized or remapped after a reset. Align with gfx11. v2: preserve init and remap for MMIO case. Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 0a6d6ed694d72b66b0ed7a483d5effa01acd3951) Cc: stable@vger.kernel.org commit 3eb46fbb601f9a0b4df8eba79252a0a85e983044 Author: Alex Deucher Date: Wed Jan 28 22:55:46 2026 -0500 drm/amdgpu/gfx11: adjust KGQ reset sequence Kernel gfx queues do not need to be reinitialized or remapped after a reset. This fixes queue reset failures on APUs. v2: preserve init and remap for MMIO case. Fixes: b3e9bfd86658 ("drm/amdgpu/gfx11: add ring reset callbacks") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789 Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit b340ff216fdabfe71ba0cdd47e9835a141d08e10) Cc: stable@vger.kernel.org commit 9077d32a4b570fa20500aa26e149981c366c965d Author: Alex Deucher Date: Wed Jan 28 18:13:16 2026 -0500 drm/amdgpu/gfx12: fix wptr reset in KGQ init wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs. Reviewed-by: Timur Kristóf Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit a2918f958d3f677ea93c0ac257cb6ba69b7abb7c) Cc: stable@vger.kernel.org commit b1f810471c6a6bd349f7f9f2f2fed96082056d46 Author: Alex Deucher Date: Wed Jan 28 18:09:03 2026 -0500 drm/amdgpu/gfx11: fix wptr reset in KGQ init wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs. Reviewed-by: Timur Kristóf Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 1f16866bdb1daed7a80ca79ae2837a9832a74fbc) Cc: stable@vger.kernel.org commit cc4f433b14e05eaa4a98fd677b836e9229422387 Author: Alex Deucher Date: Wed Jan 28 20:51:08 2026 -0500 drm/amdgpu/gfx10: fix wptr reset in KGQ init wptr is a 64 bit value and we need to update the full value, not just 32 bits. Align with what we already do for KCQs. Reviewed-by: Timur Kristóf Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit e80b1d1aa1073230b6c25a1a72e88f37e425ccda) Cc: stable@vger.kernel.org commit c1ed856c09d0d730c2f63bbb757cb6011db148f9 Author: Shuicheng Lin Date: Wed Jan 21 17:37:51 2026 +0000 drm/xe/configfs: Fix is_bound() pci_dev lifetime Move pci_dev_put() after pci_dbg() to avoid using pdev after dropping its reference. Fixes: 2674f1ef29f46 ("drm/xe/configfs: Block runtime attribute changes") Signed-off-by: Shuicheng Lin Reviewed-by: Ashutosh Dixit Signed-off-by: Ashutosh Dixit Link: https://patch.msgid.link/20260121173750.3090907-2-shuicheng.lin@intel.com (cherry picked from commit 63b33604365bdca43dee41bab809da2230491036) Signed-off-by: Thomas Hellström commit e829083bc46d3d79b9aade758c350ec12342c9bd Merge: 8dfce8991b95d8 0d0f1314e8f86f Author: Linus Torvalds Date: Thu Jan 29 09:07:17 2026 -0800 Merge tag 'for-6.19-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix leaked folio refcount on s390x when using hw zlib compression acceleration - remove own threshold from ->writepages() which could collide with cgroup limits and lead to a deadlock when metadadata are not written because the amount is under the internal limit * tag 'for-6.19-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zlib: fix the folio leak on S390 hardware acceleration btrfs: do not strictly require dirty metadata threshold for metadata writepages commit 426ca15c7f6cb6562a081341ca88893a50c59fa2 Author: Jibin Zhang Date: Mon Jan 26 23:21:11 2026 +0800 net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT. Signed-off-by: Jibin Zhang Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260126152114.1211-1-jibin.zhang@mediatek.com Signed-off-by: Paolo Abeni commit 00f32dfceda29f8dc6c34b159123f3bf78ad3b4c Merge: 9e18920e783d0b 94e5baff3ee3cd Author: Takashi Iwai Date: Thu Jan 29 13:58:06 2026 +0100 Merge tag 'asoc-fix-v6.19-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A couple of small fixes and a couple of quirks, nothing major commit 008bec8ffe6e7746588d1e12c5b3865fa478fc91 Author: Ricardo Neri Date: Tue Jan 27 15:45:40 2026 -0800 platform/x86/intel/tpmi/plr: Make the file domain/status writeable The file sys/kernel/debug/tpmi-/plr/domain/status has store and show callbacks. Make it writeable. Fixes: 811f67c51636d ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits") Signed-off-by: Ricardo Neri Link: https://patch.msgid.link/20260127-plr-debugfs-write-v1-1-1fffbc370b1e@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6222883af286e2feb3c9ff2bf9fd8fdf4220c55a Author: Mario Limonciello Date: Wed Jan 28 13:04:45 2026 -0600 platform/x86: hp-bioscfg: Skip empty attribute names Avoid registering kobjects with empty names when a BIOS attribute name decodes to an empty string. Fixes: a34fc329b1895 ("platform/x86: hp-bioscfg: bioscfg") Reported-by: Alain Cousinie Closes: https://lore.kernel.org/platform-driver-x86/22ed5f78-c8bf-4ab4-8c38-420cc0201e7e@laposte.net/ Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260128190501.2170068-1-mario.limonciello@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0858206732250d24bb43b0e95beb50dffcbae665 Merge: df8b9be3d41281 1eab33aa63c993 Author: Paolo Abeni Date: Thu Jan 29 13:21:35 2026 +0100 Merge tag 'wireless-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just one fix, for a parsing error in mac80211 that might result in a one byte out-of-bounds read. * tag 'wireless-2026-01-29' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: correctly decode TTLM with default link map ==================== Link: https://patch.msgid.link/20260129110403.178036-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit 94e5baff3ee3cd1a5246c85b0744092eab1c5d42 Author: Maciej Strozek Date: Wed Jan 28 09:24:05 2026 +0000 ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with cs42l43 Add a quirk for a Lenovo laptop (SSID: 0x17aa3821) to allow using sidecar CS35L57 amps with CS42L43 codec. Signed-off-by: Maciej Strozek Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20260128092410.1540583-1-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit 1eab33aa63c993685dd341e03bd5b267dd7403fa Author: Benjamin Berg Date: Thu Jan 29 11:33:50 2026 +0100 wifi: mac80211: correctly decode TTLM with default link map TID-To-Link Mapping (TTLM) elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped. Note that access points should not explicitly report an advertised TTLM with a default mapping as that is the implied mapping if the element is not included, this is even the case when switching back to the default mapping. However, mac80211 would incorrectly parse the frame and would also read one byte beyond the end of the element. Reported-by: Ruikai Peng Closes: https://lore.kernel.org/linux-wireless/CAFD3drMqc9YWvTCSHLyP89AOpBZsHdZ+pak6zVftYoZcUyF7gw@mail.gmail.com Fixes: 702e80470a33 ("wifi: mac80211: support handling of advertised TID-to-link mapping") Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20260129113349.d6b96f12c732.I69212a50f0f70db185edd3abefb6f04d3cb3e5ff@changeid Signed-off-by: Johannes Berg commit 56c430c7f06d838fe3b2077dbbc4cc0bf992312b Author: Sai Sree Kartheek Adivi Date: Wed Jan 28 19:05:54 2026 +0530 dma/pool: distinguish between missing and exhausted atomic pools Currently, dma_alloc_from_pool() unconditionally warns and dumps a stack trace when an allocation fails, with the message "Failed to get suitable pool". This conflates two distinct failure modes: 1. Configuration error: No atomic pool is available for the requested DMA mask (a fundamental system setup issue) 2. Resource Exhaustion: A suitable pool exists but is currently full (a recoverable runtime state) This lack of distinction prevents drivers from using __GFP_NOWARN to suppress error messages during temporary pressure spikes, such as when awaiting synchronous reclaim of descriptors. Refactor the error handling to distinguish these cases: - If no suitable pool is found, keep the unconditional WARN regarding the missing pool. - If a pool was found but is exhausted, respect __GFP_NOWARN and update the warning message to explicitly state "DMA pool exhausted". Fixes: 9420139f516d ("dma-pool: fix coherent pool allocations for IOMMU mappings") Signed-off-by: Sai Sree Kartheek Adivi Reviewed-by: Robin Murphy Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260128133554.3056582-1-s-adivi@ti.com commit c3cb2722e28969650c58d6defb09d57339a2a223 Merge: 59e82a4237cf39 f2090ebdb59d05 Author: Arnd Bergmann Date: Thu Jan 29 10:02:10 2026 +0100 Merge tag 'qcom-drivers-fixes-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fix for v6.19 The changes to the logic in the Qualcomm SMEM driver for separating "failed to probe" from "not yet probed", did not change the qcom_smem_is_available() function, with the result that clients sees SMEM as always available. Clients might then proceed to interact with SMEM in codepaths that aren't suited to cope with -EPROBE_DEFER. * tag 'qcom-drivers-fixes-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: smem: fix qcom_smem_is_available and check if __smem is valid Signed-off-by: Arnd Bergmann commit 59e82a4237cf39be697f25f2da26f4bee3007826 Author: Sudeep Holla Date: Sun Jan 25 20:15:45 2026 +0000 MAINTAINERS: Change Sudeep Holla's email address Switch to my kernel.org email address going forward. Signed-off-by: Sudeep Holla Link: https://lore.kernel.org/r/20260125201545.3461463-1-sudeep.holla@kernel.org Signed-off-by: Arnd Bergmann commit c7e45aa0a91f27a63fc9adc44385cfbcdb48eec1 Author: Yushan Wang Date: Wed Jan 28 19:56:31 2026 +0000 MAINTAINERS: Add myself as maintainer of hisi_soc_hha Add myself as maintainer of HiSilicon SoC HHA driver as I will be responsible for this driver. Signed-off-by: Yushan Wang Acked-by: Jonathan Cameron Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20260128-audition-professed-31d1b66d5b4e@spud Signed-off-by: Arnd Bergmann commit 9d24a733376768ed09d764870d23aee05b5b77b1 Merge: 63804fed149a67 473dd9ecb3fd13 Author: Arnd Bergmann Date: Thu Jan 29 10:00:44 2026 +0100 Merge tag 'imx-maintainers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX MAINTAINERS changes for 6.20: - Shawn Guo steps down and Frank Li steps up as i.MX platform maintainer * tag 'imx-maintainers-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: MAINTAINERS: Replace Shawn with Frank as i.MX platform maintainer Signed-off-by: Arnd Bergmann commit 0ea05c4f7527a98f5946f96c829733788934311d Author: Han Gao Date: Wed Jan 28 03:07:11 2026 +0800 riscv: compat: fix COMPAT_UTS_MACHINE definition The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv". Change it to "riscv32" to reflect the correct 32-bit compat name. Fixes: 06d0e3723647 ("riscv: compat: Add basic compat data type implementation") Cc: stable@vger.kernel.org Signed-off-by: Han Gao Reviewed-by: Guo Ren (Alibaba Damo Academy) Link: https://patch.msgid.link/20260127190711.2264664-1-gaohan@iscas.ac.cn Signed-off-by: Paul Walmsley commit df8b9be3d41281e7bf5f14cd078be2c5c5cc7698 Merge: 95f82b2b39ef5d c5d5ecf21fdd9c Author: Jakub Kicinski Date: Wed Jan 28 20:59:09 2026 -0800 Merge branch 'mptcp-avoid-dup-nl-events-and-propagate-error' Matthieu Baerts says: ==================== mptcp: avoid dup NL events and propagate error Here are two fixes affecting the MPTCP Netlink events with their tests: - Patches 1 & 2: a subflow closed NL event was visible multiple times in some specific conditions. A fix for v5.12. - Patches 3 & 4: subflow closed NL events never contained the error code, even when expected. A fix for v5.11. Plus an extra fix: - Patch 5: fix a false positive with the "signal addresses race test" subtest when validating the MPTCP Join selftest on a v5.15.y stable kernel. ==================== Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-0-7f71e1bc4feb@kernel.org Signed-off-by: Jakub Kicinski commit c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc Author: Matthieu Baerts (NGI0) Date: Tue Jan 27 20:27:27 2026 +0100 selftests: mptcp: join: fix local endp not being tracked When running this mptcp_join.sh selftest on older kernel versions not supporting local endpoints tracking, this test fails because 3 MP_JOIN ACKs have been received, while only 2 were expected. It is not clear why only 2 MP_JOIN ACKs were expected on old kernel versions, while 3 MP_JOIN SYN and SYN+ACK were expected. When testing on the v5.15.197 kernel, 3 MP_JOIN ACKs are seen, which is also what is expected in the selftests included in this kernel version, see commit f4480eaad489 ("selftests: mptcp: add missing join check"). Switch the expected MP_JOIN ACKs to 3. While at it, move this chk_join_nr helper out of the special condition for older kernel versions as it is now the same as with more recent ones. Also, invert the condition to be more logical: what's expected on newer kernel versions having such helper first. Fixes: d4c81bbb8600 ("selftests: mptcp: join: support local endpoint being tracked or not") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-5-7f71e1bc4feb@kernel.org Signed-off-by: Jakub Kicinski commit 2ef9e3a3845d0a20b62b01f5b731debd0364688d Author: Matthieu Baerts (NGI0) Date: Tue Jan 27 20:27:26 2026 +0100 selftests: mptcp: check subflow errors in close events This validates the previous commit: subflow closed events should contain an error field when a subflow got closed with an error, e.g. reset or timeout. For this test, the chk_evt_nr helper has been extended to check attributes in the matched events. In this test, the 2 subflow closed events should have an error. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-4-7f71e1bc4feb@kernel.org Signed-off-by: Jakub Kicinski commit dccf46179ddd6c04c14be8ed584dc54665f53f0e Author: Matthieu Baerts (NGI0) Date: Tue Jan 27 20:27:25 2026 +0100 mptcp: only reset subflow errors when propagated Some subflow socket errors need to be reported to the MPTCP socket: the initial subflow connect (MP_CAPABLE), and the ones from the fallback sockets. The others are not propagated. The issue is that sock_error() was used to retrieve the error, which was also resetting the sk_err field. Because of that, when notifying the userspace about subflow close events later on from the MPTCP worker, the ssk->sk_err field was always 0. Now, the error (sk_err) is only reset when propagating it to the msk. Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org Signed-off-by: Jakub Kicinski commit 8467458dfa61b37e259e3485a5d3e415d08193c1 Author: Matthieu Baerts (NGI0) Date: Tue Jan 27 20:27:24 2026 +0100 selftests: mptcp: check no dup close events after error This validates the previous commit: subflow closed events are re-sent with less info when the initial subflow is disconnected after an error and each time a subflow is closed after that. In this new test, the userspace PM is involved because that's how it was discovered, but it is not specific to it. The initial subflow is terminated with a RESET, and that will cause the subflow disconnect. Then, a new subflow is initiated, but also got rejected, which cause a second subflow closed event, but not a third one. While at it, in case of failure to get the expected amount of events, the events are printed. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-2-7f71e1bc4feb@kernel.org Signed-off-by: Jakub Kicinski commit 280d654324e33f8e6e3641f76764694c7b64c5db Author: Matthieu Baerts (NGI0) Date: Tue Jan 27 20:27:23 2026 +0100 mptcp: avoid dup SUB_CLOSED events after disconnect In case of subflow disconnect(), which can also happen with the first subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset will reset most fields from the mptcp_subflow_context structure, including close_event_done. Then, when another subflow is closed, yet another SUB_CLOSED event for the disconnected initial subflow is sent. Because of the previous reset, there are no source address and destination port. A solution is then to also check the subflow's local id: it shouldn't be negative anyway. Another solution would be not to reset subflow->close_event_done at disconnect time, but when reused. But then, probably the whole reset could be done when being reused. Let's not change this logic, similar to TCP with tcp_disconnect(). Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events") Cc: stable@vger.kernel.org Reported-by: Marco Angaroni Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/603 Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-1-7f71e1bc4feb@kernel.org Signed-off-by: Jakub Kicinski commit 95f82b2b39ef5d9cedf0d87a6a1a4c51146672d6 Merge: 2aa1545ba8d480 011be342dd24b5 Author: Jakub Kicinski Date: Wed Jan 28 20:36:10 2026 -0800 Merge branch 'mlx5-misc-fixes-2026-01-27' Tariq Toukan says: ==================== mlx5 misc fixes 2026-01-27 [part] This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1769503961-124173-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 011be342dd24b5168a5dcf408b14c3babe503341 Author: Jianbo Liu Date: Tue Jan 27 10:52:41 2026 +0200 net/mlx5e: Skip ESN replay window setup for IPsec crypto offload Commit a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay window size") introduced logic to setup the ESN replay window size. This logic is only valid for packet offload. However, the check to skip this block only covered outbound offloads. It was not skipped for crypto offload, causing it to fall through to the new switch statement and trigger its WARN_ON default case (for instance, if a window larger than 256 bits was configured). Fix this by amending the condition to also skip the replay window setup if the offload type is not XFRM_DEV_OFFLOAD_PACKET. Fixes: a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay window size") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1769503961-124173-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a8f930b7be7be3f18f14446df461e17137400407 Author: Parav Pandit Date: Tue Jan 27 10:52:40 2026 +0200 net/mlx5: Fix vhca_id access call trace use before alloc HCA CAP structure is allocated in mlx5_hca_caps_alloc(). mlx5_mdev_init() mlx5_hca_caps_alloc() And HCA CAP is read from the device in mlx5_init_one(). The vhca_id's debugfs file is published even before above two operations are done. Due to this when user reads the vhca id before the initialization, following call trace is observed. Fix this by deferring debugfs publication until the HCA CAP is allocated and read from the device. BUG: kernel NULL pointer dereference, address: 0000000000000004 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 23 UID: 0 PID: 6605 Comm: cat Kdump: loaded Not tainted 6.18.0-rc7-sf+ #110 PREEMPT(full) Hardware name: Supermicro SYS-6028U-TR4+/X10DRU-i+, BIOS 2.0b 08/09/2016 RIP: 0010:vhca_id_show+0x17/0x30 [mlx5_core] Code: cb 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 8b 47 70 48 c7 c6 45 f0 12 c1 48 8b 80 70 03 00 00 <8b> 50 04 0f ca 0f b7 d2 e8 8c 82 47 cb 31 c0 c3 cc cc cc cc 0f 1f RSP: 0018:ffffd37f4f337d40 EFLAGS: 00010203 RAX: 0000000000000000 RBX: ffff8f18445c9b40 RCX: 0000000000000001 RDX: ffff8f1109825180 RSI: ffffffffc112f045 RDI: ffff8f18445c9b40 RBP: 0000000000000000 R08: 0000645eac0d2928 R09: 0000000000000006 R10: ffffd37f4f337d48 R11: 0000000000000000 R12: ffffd37f4f337dd8 R13: ffffd37f4f337db0 R14: ffff8f18445c9b68 R15: 0000000000000001 FS: 00007f3eea099580(0000) GS:ffff8f2090f1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000004 CR3: 00000008b64e4006 CR4: 00000000003726f0 Call Trace: seq_read_iter+0x11f/0x4f0 ? _raw_spin_unlock+0x15/0x30 ? do_anonymous_page+0x104/0x810 seq_read+0xf6/0x120 ? srso_alias_untrain_ret+0x1/0x10 full_proxy_read+0x5c/0x90 vfs_read+0xad/0x320 ? handle_mm_fault+0x1ab/0x290 ksys_read+0x52/0xd0 do_syscall_64+0x61/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: dd3dd7263cde ("net/mlx5: Expose vhca_id to debugfs") Signed-off-by: Parav Pandit Reviewed-by: Shay Drori Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1769503961-124173-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2610a3d65691a1301ab10c92ff6ebab0bedf9199 Author: Shay Drory Date: Tue Jan 27 10:52:38 2026 +0200 net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect The capability check for reset_root_to_default was inverted, causing the function to return -EOPNOTSUPP when the capability IS supported, rather than when it is NOT supported. Fix the capability check condition. Fixes: 3c9c34c32bc6 ("net/mlx5: fs, Command to control TX flow table root") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Reviewed-by: Simon Horman Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1769503961-124173-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2aa1545ba8d4801fba5be83a404e28014b80196a Author: Wei Fang Date: Mon Jan 26 16:15:44 2026 +0800 net: phy: micrel: fix clk warning when removing the driver Since the commit 25c6a5ab151f ("net: phy: micrel: Dynamically control external clock of KSZ PHY"), the clock of Micrel PHY has been enabled by phy_driver::resume() and disabled by phy_driver::suspend(). However, devm_clk_get_optional_enabled() is used in kszphy_probe(), so the clock will automatically be disabled when the device is unbound from the bus. Therefore, this could cause the clock to be disabled twice, resulting in clk driver warnings. For example, this issue can be reproduced on i.MX6ULL platform, and we can see the following logs when removing the FEC MAC drivers. $ echo 2188000.ethernet > /sys/bus/platform/drivers/fec/unbind $ echo 20b4000.ethernet > /sys/bus/platform/drivers/fec/unbind [ 109.758207] ------------[ cut here ]------------ [ 109.758240] WARNING: drivers/clk/clk.c:1188 at clk_core_disable+0xb4/0xd0, CPU#0: sh/639 [ 109.771011] enet2_ref already disabled [ 109.793359] Call trace: [ 109.822006] clk_core_disable from clk_disable+0x28/0x34 [ 109.827340] clk_disable from clk_disable_unprepare+0xc/0x18 [ 109.833029] clk_disable_unprepare from devm_clk_release+0x1c/0x28 [ 109.839241] devm_clk_release from devres_release_all+0x98/0x100 [ 109.845278] devres_release_all from device_unbind_cleanup+0xc/0x70 [ 109.851571] device_unbind_cleanup from device_release_driver_internal+0x1a4/0x1f4 [ 109.859170] device_release_driver_internal from bus_remove_device+0xbc/0xe4 [ 109.866243] bus_remove_device from device_del+0x140/0x458 [ 109.871757] device_del from phy_mdio_device_remove+0xc/0x24 [ 109.877452] phy_mdio_device_remove from mdiobus_unregister+0x40/0xac [ 109.883918] mdiobus_unregister from fec_enet_mii_remove+0x40/0x78 [ 109.890125] fec_enet_mii_remove from fec_drv_remove+0x4c/0x158 [ 109.896076] fec_drv_remove from device_release_driver_internal+0x17c/0x1f4 [ 109.962748] WARNING: drivers/clk/clk.c:1047 at clk_core_unprepare+0xfc/0x13c, CPU#0: sh/639 [ 109.975805] enet2_ref already unprepared [ 110.002866] Call trace: [ 110.031758] clk_core_unprepare from clk_unprepare+0x24/0x2c [ 110.037440] clk_unprepare from devm_clk_release+0x1c/0x28 [ 110.042957] devm_clk_release from devres_release_all+0x98/0x100 [ 110.048989] devres_release_all from device_unbind_cleanup+0xc/0x70 [ 110.055280] device_unbind_cleanup from device_release_driver_internal+0x1a4/0x1f4 [ 110.062877] device_release_driver_internal from bus_remove_device+0xbc/0xe4 [ 110.069950] bus_remove_device from device_del+0x140/0x458 [ 110.075469] device_del from phy_mdio_device_remove+0xc/0x24 [ 110.081165] phy_mdio_device_remove from mdiobus_unregister+0x40/0xac [ 110.087632] mdiobus_unregister from fec_enet_mii_remove+0x40/0x78 [ 110.093836] fec_enet_mii_remove from fec_drv_remove+0x4c/0x158 [ 110.099782] fec_drv_remove from device_release_driver_internal+0x17c/0x1f4 After analyzing the process of removing the FEC driver, as shown below, it can be seen that the clock was disabled twice by the PHY driver. fec_drv_remove() --> fec_enet_close() --> phy_stop() --> phy_suspend() --> kszphy_suspend() #1 The clock is disabled --> fec_enet_mii_remove() --> mdiobus_unregister() --> phy_mdio_device_remove() --> device_del() --> devm_clk_release() #2 The clock is disabled again Therefore, devm_clk_get_optional() is used to fix the above issue. And to avoid the issue mentioned by the commit 985329462723 ("net: phy: micrel: use devm_clk_get_optional_enabled for the rmii-ref clock"), the clock is enabled by clk_prepare_enable() to get the correct clock rate. Fixes: 25c6a5ab151f ("net: phy: micrel: Dynamically control external clock of KSZ PHY") Signed-off-by: Wei Fang Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260126081544.983517-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit a62f7d62d2b115e67c7224e36ace4ef12a9650b4 Author: Daniel Zahka Date: Mon Jan 26 11:38:17 2026 -0800 net/mlx5e: don't assume psp tx skbs are ipv6 csum handling mlx5e_psp_handle_tx_skb() assumes skbs are ipv6 when doing a partial TCP checksum with tso. Make correctly mlx5e_psp_handle_tx_skb() handle ipv4 packets. Fixes: e5a1861a298e ("net/mlx5e: Implement PSP Tx data path") Signed-off-by: Daniel Zahka Reviewed-by: Eric Dumazet Reviewed-by: Cosmin Ratiu Link: https://patch.msgid.link/20260126-dzahka-fix-tx-csum-partial-v2-1-0a905590ea5f@gmail.com Signed-off-by: Jakub Kicinski commit 2b73e754389d32063c36b5a6a990161063653ef6 Merge: cc0cf10fdaeadf 05faf2c0a76581 Author: Jakub Kicinski Date: Wed Jan 28 19:40:54 2026 -0800 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-27 (ixgbe, ice) For ixgbe: Kohei Enju adjusts the cleanup path on firmware error to resolve some memory leaks and removes an instance of double init, free on ACI mutex. For ice: Aaron Ma adds NULL checks for q_vectors to avoid NULL pointer dereference. Jesse Brandeburg removes UDP checksum mismatch from being counted in Rx errors. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: stop counting UDP csum mismatch as rx_errors ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues ixgbe: don't initialize aci lock in ixgbe_recovery_probe() ixgbe: fix memory leaks in the ixgbe_recovery_probe() path ==================== Link: https://patch.msgid.link/20260127223047.3979404-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit cc0cf10fdaeadf5542d64a55b5b4120d3df90b7d Author: Martin Kaiser Date: Tue Jan 27 11:19:23 2026 +0100 net: bridge: fix static key check Fix the check if netfilter's static keys are available. netfilter defines and exports static keys if CONFIG_JUMP_LABEL is enabled. (HAVE_JUMP_LABEL is never defined.) Fixes: 971502d77faa ("bridge: netfilter: unroll NF_HOOK helper in bridge input path") Signed-off-by: Martin Kaiser Reviewed-by: Florian Westphal Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260127101925.1754425-1-martin@kaiser.cx Signed-off-by: Jakub Kicinski commit d2492688bb9fed6ab6e313682c387ae71a66ebae Author: Kuniyuki Iwashima Date: Tue Jan 27 04:03:59 2026 +0000 nfc: nci: Fix race between rfkill and nci_unregister_device(). syzbot reported the splat below [0] without a repro. It indicates that struct nci_dev.cmd_wq had been destroyed before nci_close_device() was called via rfkill. nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which (I think) was called from virtual_ncidev_close() when syzbot close()d an fd of virtual_ncidev. The problem is that nci_unregister_device() destroys nci_dev.cmd_wq first and then calls nfc_unregister_device(), which removes the device from rfkill by rfkill_unregister(). So, the device is still visible via rfkill even after nci_dev.cmd_wq is destroyed. Let's unregister the device from rfkill first in nci_unregister_device(). Note that we cannot call nfc_unregister_device() before nci_close_device() because 1) nfc_unregister_device() calls device_del() which frees all memory allocated by devm_kzalloc() and linked to ndev->conn_info_list 2) nci_rx_work() could try to queue nci_conn_info to ndev->conn_info_list which could be leaked Thus, nfc_unregister_device() is split into two functions so we can remove rfkill interfaces only before nci_close_device(). [0]: DEBUG_LOCKS_WARN_ON(1) WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349 WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x39d/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: syz.0.8675/6349 Modules linked in: CPU: 0 UID: 0 PID: 6349 Comm: syz.0.8675 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline] RIP: 0010:__lock_acquire+0x3a4/0x2cf0 kernel/locking/lockdep.c:5187 Code: 18 00 4c 8b 74 24 08 75 27 90 e8 17 f2 fc 02 85 c0 74 1c 83 3d 50 e0 4e 0e 00 75 13 48 8d 3d 43 f7 51 0e 48 c7 c6 8b 3a de 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f RSP: 0018:ffffc9000c767680 EFLAGS: 00010046 RAX: 0000000000000001 RBX: 0000000000040000 RCX: 0000000000080000 RDX: ffffc90013080000 RSI: ffffffff8dde3a8b RDI: ffffffff8ff24ca0 RBP: 0000000000000003 R08: ffffffff8fef35a3 R09: 1ffffffff1fde6b4 R10: dffffc0000000000 R11: fffffbfff1fde6b5 R12: 00000000000012a2 R13: ffff888030338ba8 R14: ffff888030338000 R15: ffff888030338b30 FS: 00007fa5995f66c0(0000) GS:ffff8881256f8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e72f842d0 CR3: 00000000485a0000 CR4: 00000000003526f0 Call Trace: lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868 touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3940 __flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:3982 nci_close_device+0x302/0x630 net/nfc/nci/core.c:567 nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:639 nfc_dev_down+0x152/0x290 net/nfc/core.c:161 nfc_rfkill_set_block+0x2d/0x100 net/nfc/core.c:179 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_fop_write+0x461/0x5a0 net/rfkill/core.c:1301 vfs_write+0x29a/0xb90 fs/read_write.c:684 ksys_write+0x150/0x270 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa59b39acb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa5995f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fa59b615fa0 RCX: 00007fa59b39acb9 RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000007 RBP: 00007fa59b408bf7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa59b616038 R14: 00007fa59b615fa0 R15: 00007ffc82218788 Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-by: syzbot+f9c5fd1a0874f9069dce@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/695e7f56.050a0220.1c677c.036c.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260127040411.494931-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f Author: Shida Zhang Date: Tue Jan 27 16:21:12 2026 +0800 bcache: fix I/O accounting leak in detached_dev_do_request When a bcache device is detached, discard requests are completed immediately. However, the I/O accounting started in cached_dev_make_request() is not ended, leading to 100% disk utilization reports in iostat. Add the missing bio_end_io_acct() call. Fixes: cafe56359144 ("bcache: A block layer cache") Signed-off-by: Shida Zhang Acked-by: Coly Li Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 6ea84d7a92cb0b30aaf7d2066a69e28e27932332 Author: Shida Zhang Date: Tue Jan 27 16:21:11 2026 +0800 bcache: remove dead code in detached_dev_do_request bio_alloc_clone() with GFP_NOIO and a mempool will not return NULL. Remove the unnecessary NULL check. Suggested-by: Christoph Hellwig Signed-off-by: Shida Zhang Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 0fd17e5983337231dc655e9ca0095d2ca3f47405 Author: Oreoluwa Babatunde Date: Mon Jan 26 18:13:27 2026 +0100 of: reserved_mem: Allow reserved_mem framework detect "cma=" kernel param When initializing the default cma region, the "cma=" kernel parameter takes priority over a DT defined linux,cma-default region. Hence, give the reserved_mem framework the ability to detect this so that the DT defined cma region can skip initialization accordingly. Signed-off-by: Oreoluwa Babatunde Tested-by: Joy Zou Acked-by: Rob Herring (Arm) Fixes: 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed") Fixes: 2c223f7239f3 ("of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()") Link: https://lore.kernel.org/r/20251210002027.1171519-1-oreoluwa.babatunde@oss.qualcomm.com [mszyprow: rebased onto v6.19-rc1, added fixes tags, added a stub for cma_skip_dt_default_reserved_mem() if no CONFIG_DMA_CMA is set] Signed-off-by: Marek Szyprowski commit 20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 Author: Takashi Sakamoto Date: Wed Jan 28 07:34:13 2026 +0900 firewire: core: fix race condition against transaction list The list of transaction is enumerated without acquiring card lock when processing AR response event. This causes a race condition bug when processing AT request completion event concurrently. This commit fixes the bug by put timer start for split transaction expiration into the scope of lock. The value of jiffies in card structure is referred before acquiring the lock. Cc: stable@vger.kernel.org # v6.18 Fixes: b5725cfa4120 ("firewire: core: use spin lock specific to timer for split transaction") Reported-by: Andreas Persson Closes: https://github.com/alsa-project/snd-firewire-ctl-services/issues/209 Tested-by: Andreas Persson Link: https://lore.kernel.org/r/20260127223413.22265-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit b1defcdc4457649db236415ee618a7151e28788c Author: Alex Deucher Date: Mon Jan 26 23:44:45 2026 -0500 drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() The EXEC_COUNT field must be > 0. In the gfx shadow handling we always emit a cond_exec packet after the gfx_shadow packet, but the EXEC_COUNT never gets patched. This leads to a hang when we try and reset queues on gfx11 APUs. Fixes: c68cbbfd54c6 ("drm/amdgpu: cleanup conditional execution") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4789 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit ba205ac3d6e83f56c4f824f23f1b4522cb844ff3) Cc: stable@vger.kernel.org commit e7fbff9e7622a00c2b53cb14df481916f0019742 Author: Alex Deucher Date: Fri Jan 16 17:33:05 2026 -0500 drm/amdgpu/soc21: fix xclk for APUs The reference clock is supposed to be 100Mhz, but it appears to actually be slightly lower (99.81Mhz). Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14451 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 637fee3954d4bd509ea9d95ad1780fc174489860) Cc: stable@vger.kernel.org commit acecfee88564d8d6c11bc23c9b7fff89cd010314 Author: Ivan Lipski Date: Fri Jan 16 10:03:54 2026 -0500 drm/amd/display: Clear HDMI HPD pending work only if it is enabled [Why&How] On amdgpu_dm_connector_destroy(), the driver attempts to cancel pending HDMI HPD work without checking if the HDMI HPD is enabled. Added a check that it is enabled before clearing it. Fixes: 6a681cd90345 ("drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module") Signed-off-by: Ivan Lipski Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 17b2c526fd8026d8e0f4c0e7f94fc517e3901589) commit 45614d8cd1e813c6ccfae80582c9a0073209ef3e Merge: c87f15efeb2efc a54afbc8a2138f Author: Jens Axboe Date: Wed Jan 28 11:59:09 2026 -0700 Merge tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme into block-6.19 Pull NVMe fixes from Keith: "- TCP target completion race condition fix (Ming) - DMA descriptor cleanup fix (Roger)" * tag 'nvme-6.19-2026-01-28' of git://git.infradead.org/nvme: nvme-pci: DMA unmap the correct regions in nvme_free_sgls nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference commit 2724138b2f7f6299812b3404e23b124304834759 Author: Deepanshu Kartikey Date: Sat Jan 24 18:52:14 2026 +0530 iommufd: Initialize batch->kind in batch_clear() KMSAN reported an uninitialized value when batch_add_pfn_num() reads batch->kind. This occurs because batch_clear() does not initialize the kind field. When batch_add_pfn_num() checks "if (batch->kind != kind)", it reads this uninitialized value, triggering KMSAN warnings. However the algorithm is fine with any value in kind at this point as the batch is always empty and it always corrects kind if wrong. Initialize batch->kind to zero in batch_clear() to silence the KMSAN warning. Link: https://patch.msgid.link/r/20260124132214.624041-1-kartikey406@gmail.com Reported-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=df28076a30d726933015 Fixes: f394576eb11db ("iommufd: PFN handling for iopt_pages") Tested-by: syzbot+df28076a30d726933015@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Reviewed-by: Kevin Tian Tested-by: syzbot+a0c841e02f328005bbcc@syzkaller.appspotmail.com Reported-by: syzbot+a0c841e02f328005bbcc@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe commit 8dfce8991b95d8625d0a1d2896e42f93b9d7f68d Merge: 1f97d9dcf53649 f58442788fdac5 Author: Linus Torvalds Date: Wed Jan 28 08:03:11 2026 -0800 Merge tag 'pinctrl-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Mark the Meson GPIO controller as sleeping to avoid a context splat - Fix up the I2S2 and SWR TX group settings in the Qualcomm SM8350 LPASS pin controller, and implement the proper .get_direction() callback - Fix a pin typo in the TG1520 pin controller - Fix a group name in the Marvell armada 3710 XB pin controller that got mangled in a DT schema rewrite * tag 'pinctrl-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: fix 'usb32_drvvbus0' group name pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver pinctrl: th1520: Fix typo pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins pinctrl: meson: mark the GPIO controller as sleeping commit f2090ebdb59d0546cbd7b55d9dd63a77133efc03 Author: Christian Marangi Date: Sat Nov 22 19:49:56 2025 +0100 soc: qcom: smem: fix qcom_smem_is_available and check if __smem is valid Commit 7a94d5f31b54 ("soc: qcom: smem: better track SMEM uninitialized state") changed the usage of __smem and init now as an error pointer instead of NULL. qcom_smem_is_available() wasn't updated to reflect this change and also .qcom_smem_remove doesn't reset it on module exit. Update both entry to reflect new handling of __smem. Fixes: 7a94d5f31b54 ("soc: qcom: smem: better track SMEM uninitialized state") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aSAnR3ECa04CoPqp@stanley.mountain/ Signed-off-by: Christian Marangi Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251122185002.26524-1-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit a54afbc8a2138f8c2490510cf26cde188d480c43 Author: Roger Pau Monne Date: Tue Jan 27 20:59:06 2026 +0100 nvme-pci: DMA unmap the correct regions in nvme_free_sgls The call to nvme_free_sgls() in nvme_unmap_data() has the sg_list and sge parameters swapped. This wasn't noticed by the compiler because both share the same type. On a Xen PV hardware domain, and possibly any other architectures that takes that path, this leads to corruption of the NVMe contents. Fixes: f0887e2a52d4 ("nvme-pci: create common sgl unmapping helper") Reviewed-by: Christoph Hellwig Signed-off-by: Roger Pau Monné Signed-off-by: Keith Busch commit e64d1cb21a1c6ecd51bc1c94c83f6fc656f7c94d Author: Andy Shevchenko Date: Wed Jan 28 10:58:54 2026 +0100 gpiolib: acpi: Fix potential out-of-boundary left shift GPIO Address Space handler gets a pointer to the in or out value. This value is supposed to be at least 64-bit, but it's not limited to be exactly 64-bit. When ACPI tables are being parsed, for the bigger Connection():s ACPICA creates a Buffer instead of regular Integer object. The Buffer exists as long as Namespace holds the certain Connection(). Hence we can access the necessary bits without worrying. On the other hand, the left shift, used in the code, is limited by 31 (on 32-bit platforms) and otherwise considered to be Undefined Behaviour. Also the code uses only the first 64-bit word for the value, and anything bigger than 63 will be also subject to UB. Fix all this by modifying the code to correctly set or clear the respective bit in the bitmap constructed of 64-bit words. Fixes: 59084c564c41 ("gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler") Fixes: 2c4d00cb8fc5 ("gpiolib: acpi: Use BIT() macro to increase readability") Cc: stable@vger.kernel.org Reviewed-by: Mika Westerberg Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260128095918.4157491-1-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 5815d9303c67cef5f47cd01e73b671e6b9c40ef3 Author: Jason Gunthorpe Date: Sat Jan 24 17:00:21 2026 -0400 iommupt: Only cache flush memory changed by unmap The cache flush was happening on every level across the whole range of iteration, even if no leafs or tables were cleared. Instead flush only the sub range that was actually written. Overflushing isn't a correctness problem but it does impact the performance of unmap. After this series the performance compared to the original VT-d implementation with cache flushing turned on is: map_pages pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 253,266 , 213,227 , 6.06 2^21, 246,244 , 221,219 , 0.00 2^30, 231,240 , 209,217 , 3.03 256*2^12, 2604,2668 , 2415,2540 , 4.04 256*2^21, 2495,2824 , 2390,2734 , 12.12 256*2^30, 2542,2845 , 2380,2718 , 12.12 unmap_pages pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 259,292 , 222,251 , 11.11 2^21, 255,259 , 227,236 , 3.03 2^30, 238,254 , 217,230 , 5.05 256*2^12, 2751,2620 , 2417,2437 , 0.00 256*2^21, 2461,2526 , 2377,2423 , 1.01 256*2^30, 2498,2543 , 2370,2404 , 1.01 Fixes: efa03dab7ce4 ("iommupt: Flush the CPU cache after any writes to the page table") Reported-by: Francois Dugast Closes: https://lore.kernel.org/all/20260121130233.257428-1-francois.dugast@intel.com/ Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Tested-by: Francois Dugast Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit fe747d7112283f47169e9c16e751179a9b38611e Author: Rafael J. Wysocki Date: Mon Jan 26 21:02:40 2026 +0100 platform/x86: classmate-laptop: Add missing NULL pointer checks In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6d60354ea2f90352b22039ed8371c4f4321df90e Author: Ethan Zuo Date: Wed Jan 28 14:37:51 2026 +0800 kbuild: Fix permissions of modules.builtin.modinfo Currently, modules.builtin.modinfo is created with executable permissions (0755). This is because after commit 39cfd5b12160 ("kbuild: extract modules.builtin.modinfo from vmlinux.unstripped"), modules.builtin.modinfo is extracted from vmlinux.unstripped using objcopy. When extracting sections, objcopy inherits attributes from the source ELF file. Since modules.builtin.modinfo is a data file and not an executable, it should have regular file permissions (0644). The executable bit can trigger warnings in Debian's Lintian tool. Explicitly remove the executable bit after generation. Fixes: 39cfd5b12160 ("kbuild: extract modules.builtin.modinfo from vmlinux.unstripped") Signed-off-by: Ethan Zuo Link: https://patch.msgid.link/SY0P300MB0609F6916B24ADF65502940B9C91A@SY0P300MB0609.AUSP300.PROD.OUTLOOK.COM Signed-off-by: Nicolas Schier commit 62089b804895e845f82e132ea9d46a1fc53ed5a7 Author: Nathan Chancellor Date: Wed Jan 21 15:29:15 2026 -0700 kbuild: rpm-pkg: Generate debuginfo package manually Commit a7c699d090a1 ("kbuild: rpm-pkg: build a debuginfo RPM") adjusted the __spec_install_post macro to include __os_install_post, which runs brp-strip. This ends up stripping module signatures, breaking loading modules with lockdown enabled. Undo most of the changes of the aforementioned debuginfo patch and mirror commit 16c36f8864e3 ("kbuild: deb-pkg: use build ID instead of debug link for dbg package") in kernel.spec to generate a functionally equivalent debuginfo package while avoiding touching the modules after they have already been signed during modules_install. Fixes: a7c699d090a1 ("kbuild: rpm-pkg: build a debuginfo RPM") Reported-by: Holger Kiehl Closes: https://lore.kernel.org/68c375f6-e07e-fec-434d-6a45a4f1390@praktifix.dwd.de/ Tested-by: Holger Kiehl Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260121-fix-module-signing-binrpm-pkg-v1-1-8fc5832b6cbc@kernel.org Signed-off-by: Nicolas Schier commit e535c23513c63f02f67e3e09e0787907029efeaf Author: Johan Hovold Date: Thu Oct 30 17:34:56 2025 +0100 drm/imx/tve: fix probe device leak Make sure to drop the reference taken to the DDC device during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: fcbc51e54d2a ("staging: drm/imx: Add support for Television Encoder (TVEv2)") Cc: stable@vger.kernel.org # 3.10 Cc: Philipp Zabel Reviewed-by: Frank Li Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251030163456.15807-1-johan@kernel.org Signed-off-by: Maxime Ripard commit b2cf569ed81e7574d4287eaf3b2c38690a934d34 Author: Doug Berger Date: Tue Jan 27 13:46:54 2026 -0800 gpio: brcmstb: correct hwirq to bank map The brcmstb_gpio_hwirq_to_bank() function was designed to accommodate the downward numbering of dynamic GPIOs by traversing the bank list in the reverse order. However, the dynamic numbering has changed to increment upward which can produce an incorrect mapping. The function is modified to no longer assume an ordering of the list to accommodate either option. Fixes: 7b61212f2a07 ("gpiolib: Get rid of ARCH_NR_GPIOS") Signed-off-by: Doug Berger Signed-off-by: Florian Fainelli Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260127214656.447333-2-florian.fainelli@broadcom.com Signed-off-by: Bartosz Golaszewski commit 730e5ebff40c852e3ea57b71bf02a4b89c69435f Author: Danilo Krummrich Date: Tue Jan 27 21:17:12 2026 +0100 gpio: omap: do not register driver in probe() Commit 11a78b794496 ("ARM: OMAP: MPUIO wake updates") registers the omap_mpuio_driver from omap_mpuio_init(), which is called from omap_gpio_probe(). However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held. The latter was revealed by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") leading to a potential deadlock condition described in [1]. Additionally, the omap_mpuio_driver is never unregistered from the driver core, even if the module is unloaded. Hence, register the omap_mpuio_driver from the module initcall and unregister it in module_exit(). Link: https://lore.kernel.org/lkml/DFU7CEPUSG9A.1KKGVW4HIPMSH@kernel.org/ [1] Fixes: dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") Fixes: 11a78b794496 ("ARM: OMAP: MPUIO wake updates") Reviewed-by: Greg Kroah-Hartman Signed-off-by: Danilo Krummrich Reviewed-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260127201725.35883-1-dakr@kernel.org Signed-off-by: Bartosz Golaszewski commit 2243afcd8c49f357316165151c8fe7059c41b9e8 Merge: 63804fed149a67 dedb897f11c5d7 Author: Dave Airlie Date: Wed Jan 28 14:25:15 2026 +1000 Merge tag 'drm-msm-fixes-2026-01-23' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Late fix for v6.19: GPU: - Fix bogus hwcg register update for a690 Signed-off-by: Dave Airlie From: Rob Clark Link: https://patch.msgid.link/CACSVV03A-GE5mNG1OLF3s9UCenQk4x3jO71Hmvr9j+vCF2hc7g@mail.gmail.com commit c87f15efeb2efc8049a4f021e7328f3a4737f749 Author: Jens Axboe Date: Tue Jan 27 21:13:54 2026 -0700 Revert "rnbd-clt: fix refcount underflow in device unmap path" This reverts commit ec19ed2b3e2af8ec5380400cdee9cb6560144506. This commit relies on changes queued for 7.0, and isn't safe in its current form for the 6.19 release. Revert it for now for 6.19. Link: https://lore.kernel.org/linux-block/aXhLQmRudk7cSAnT@shinmob/ Signed-off-by: Jens Axboe commit a040afa3bca415019d96a586b96b5f17b1f55a90 Author: Jordan Rhee Date: Tue Jan 27 01:02:10 2026 +0000 gve: fix probe failure if clock read fails If timestamping is supported, GVE reads the clock during probe, which can fail for various reasons. Previously, this failure would abort the driver probe, rendering the device unusable. This behavior has been observed on production GCP VMs, causing driver initialization to fail completely. This patch allows the driver to degrade gracefully. If gve_init_clock() fails, it logs a warning and continues loading the driver without PTP support. Cc: stable@vger.kernel.org Fixes: a479a27f4da4 ("gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call") Signed-off-by: Jordan Rhee Reviewed-by: Shachar Raindel Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260127010210.969823-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit d32ba904a450633429eff08046a7a8e258b85add Merge: e9acda52fd2ee0 476681f10cc1e0 Author: Jakub Kicinski Date: Tue Jan 27 18:03:44 2026 -0800 Merge branch 'mlx5-misc-fixes-2026-01-26' Tariq Toukan says: ==================== mlx5 misc fixes 2026-01-26 misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1769411695-18820-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 476681f10cc1e0e56e26856684e75d4678b072b2 Author: Gal Pressman Date: Mon Jan 26 09:14:55 2026 +0200 net/mlx5e: Account for netdev stats in ndo_get_stats64 The driver's ndo_get_stats64 callback is only reporting mlx5 counters, without accounting for the netdev stats, causing errors from the network stack to be invisible in statistics. Add netdev_stats_to_stats64() call to first populate the counters, then add mlx5 counters on top, ensuring both are accounted for (where appropriate). Fixes: f62b8bb8f2d3 ("net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality") Signed-off-by: Gal Pressman Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1769411695-18820-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f67666938ae626cbda63fbf5176b3583c07e7124 Author: Mark Bloch Date: Mon Jan 26 09:14:54 2026 +0200 net/mlx5e: TC, delete flows only for existing peers When deleting TC steering flows, iterate only over actual devcom peers instead of assuming all possible ports exist. This avoids touching non-existent peers and ensures cleanup is limited to devices the driver is currently connected to. BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 133c8a067 P4D 0 Oops: Oops: 0002 [#1] SMP CPU: 19 UID: 0 PID: 2169 Comm: tc Not tainted 6.18.0+ #156 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core] Code: 00 00 a8 08 74 a8 49 8b 46 18 f6 c4 02 74 9f 4c 8d bf a0 12 00 00 4c 89 ff e8 0e e7 96 e1 49 8b 44 24 08 49 8b 0c 24 4c 89 ff <48> 89 41 08 48 89 08 49 89 2c 24 49 89 5c 24 08 e8 7d ce 96 e1 49 RSP: 0018:ff11000143867528 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dead000000000122 RCX: 0000000000000000 RDX: ff11000143691580 RSI: ff110001026e5000 RDI: ff11000106f3d2a0 RBP: dead000000000100 R08: 00000000000003fd R09: 0000000000000002 R10: ff11000101c75690 R11: ff1100085faea178 R12: ff11000115f0ae78 R13: 0000000000000000 R14: ff11000115f0a800 R15: ff11000106f3d2a0 FS: 00007f35236bf740(0000) GS:ff110008dc809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000157a01001 CR4: 0000000000373eb0 Call Trace: mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] mlx5e_flow_put+0x25/0x50 [mlx5_core] mlx5e_delete_flower+0x2a6/0x3e0 [mlx5_core] tc_setup_cb_reoffload+0x20/0x80 fl_reoffload+0x26f/0x2f0 [cls_flower] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] tcf_block_playback_offloads+0x9e/0x1c0 tcf_block_unbind+0x7b/0xd0 tcf_block_setup+0x186/0x1d0 tcf_block_offload_cmd.isra.0+0xef/0x130 tcf_block_offload_unbind+0x43/0x70 __tcf_block_put+0x85/0x160 ingress_destroy+0x32/0x110 [sch_ingress] __qdisc_destroy+0x44/0x100 qdisc_graft+0x22b/0x610 tc_get_qdisc+0x183/0x4d0 rtnetlink_rcv_msg+0x2d7/0x3d0 ? rtnl_calcit.isra.0+0x100/0x100 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x249/0x320 ? __alloc_skb+0x102/0x1f0 netlink_sendmsg+0x1e3/0x420 __sock_sendmsg+0x38/0x60 ____sys_sendmsg+0x1ef/0x230 ? copy_msghdr_from_user+0x6c/0xa0 ___sys_sendmsg+0x7f/0xc0 ? ___sys_recvmsg+0x8a/0xc0 ? __sys_sendto+0x119/0x180 __sys_sendmsg+0x61/0xb0 do_syscall_64+0x55/0x640 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f35238bb764 Code: 15 b9 86 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d e5 08 0d 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 RSP: 002b:00007ffed4c35638 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000055a2efcc75e0 RCX: 00007f35238bb764 RDX: 0000000000000000 RSI: 00007ffed4c356a0 RDI: 0000000000000003 RBP: 00007ffed4c35710 R08: 0000000000000010 R09: 00007f3523984b20 R10: 0000000000000004 R11: 0000000000000202 R12: 00007ffed4c35790 R13: 000000006947df8f R14: 000055a2efcc75e0 R15: 00007ffed4c35780 Fixes: 9be6c21fdcf8 ("net/mlx5e: Handle offloads flows per peer") Signed-off-by: Mark Bloch Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1769411695-18820-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2ae8c7edea87f54609bda30963a099cd3c64b0bb Author: Shay Drory Date: Mon Jan 26 09:14:53 2026 +0200 net/mlx5: Fix Unbinding uplink-netdev in switchdev mode It is possible to unbind the uplink ETH driver while the E-Switch is in switchdev mode. This leads to netdevice reference counting issues[1], as the driver removal path was not designed to clean up from this state. During uplink ETH driver removal (_mlx5e_remove), the code now waits for any concurrent E-Switch mode transition to finish. It then removes the REPs auxiliary device, if exists. This ensures a graceful cleanup. [1] unregister_netdevice: waiting for eth2 to become free. Usage count = 2 ref_tracker: netdev@00000000c912e04b has 1/1 users at ib_device_set_netdev+0x130/0x270 [ib_core] mlx5_ib_vport_rep_load+0xf4/0x3e0 [mlx5_ib] mlx5_esw_offloads_rep_load+0xc7/0xe0 [mlx5_core] esw_offloads_enable+0x583/0x900 [mlx5_core] mlx5_eswitch_enable_locked+0x1b2/0x290 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x107/0x3e0 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xd0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x183/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 __x64_sys_sendto+0x20/0x30 Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") Signed-off-by: Shay Drory Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1769411695-18820-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ee8d07cd5730038e33bf5e551448190bbd480eb8 Author: Yang Wang Date: Tue Jan 27 11:07:07 2026 +0800 drm/amd/pm: fix race in power state check before mutex lock The power state check in amdgpu_dpm_set_powergating_by_smu() is done before acquiring the pm mutex, leading to a race condition where: 1. Thread A checks state and thinks no change is needed 2. Thread B acquires mutex and modifies the state 3. Thread A returns without updating state, causing inconsistency Fix this by moving the mutex lock before the power state check, ensuring atomicity of the state check and modification. Fixes: 6ee27ee27ba8 ("drm/amd/pm: avoid duplicate powergate/ungate setting") Signed-off-by: Yang Wang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher (cherry picked from commit 7a3fbdfd19ec5992c0fc2d0bd83888644f5f2f38) commit 8b1ecc9377bc641533cd9e76dfa3aee3cd04a007 Author: Jon Doron Date: Sat Dec 20 15:04:40 2025 +0200 drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and ih2 interrupt ring buffers are not initialized. This is by design, as these secondary IH rings are only available on discrete GPUs. See vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when AMD_IS_APU is set. However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to get the timestamp of the last interrupt entry. When retry faults are enabled on APUs (noretry=0), this function is called from the SVM page fault recovery path, resulting in a NULL pointer dereference when amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[]. The crash manifests as: BUG: kernel NULL pointer dereference, address: 0000000000000004 RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu] Call Trace: amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu] svm_range_restore_pages+0xae5/0x11c0 [amdgpu] amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu] gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu] amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu] amdgpu_ih_process+0x84/0x100 [amdgpu] This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1") which changed the default for Renoir APU from noretry=1 to noretry=0, enabling retry fault handling and thus exercising the buggy code path. Fix this by adding a check for ih1.ring_size before attempting to use it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu: Rework retry fault removal"). This is needed if the hardware doesn't support secondary HW IH rings. v2: additional updates (Alex) Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3814 Fixes: dd299441654f ("drm/amdgpu: Rework retry fault removal") Reviewed-by: Timur Kristóf Reviewed-by: Philip Yang Signed-off-by: Jon Doron Signed-off-by: Alex Deucher (cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526) Cc: stable@vger.kernel.org commit 239d0ccf567c3b09aed58eb88cd3376af37aaf14 Author: Yang Wang Date: Wed Jan 21 11:06:29 2026 +0800 drm/amd/pm: fix smu v14 soft clock frequency setting issue v1: resolve the issue where some freq frequencies cannot be set correctly due to insufficient floating-point precision. v2: patch this convert on 'max' value only. Signed-off-by: Yang Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 53868dd8774344051999c880115740da92f97feb) Cc: stable@vger.kernel.org commit c764b7af15289051718b4859a67f9a3bc69d3fb2 Author: Yang Wang Date: Wed Jan 21 11:04:06 2026 +0800 drm/amd/pm: fix smu v13 soft clock frequency setting issue v1: resolve the issue where some freq frequencies cannot be set correctly due to insufficient floating-point precision. v2: patch this convert on 'max' value only. Signed-off-by: Yang Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 6194f60c707e3878e120adeb36997075664d8429) Cc: stable@vger.kernel.org commit 05faf2c0a76581d0a7fdbb8ec46477ba183df95b Author: Jesse Brandeburg Date: Mon Dec 1 15:38:52 2025 -0800 ice: stop counting UDP csum mismatch as rx_errors Since the beginning, the Intel ice driver has counted receive checksum offload mismatches into the rx_errors member of the rtnl_link_stats64 struct. In ethtool -S these show up as rx_csum_bad.nic. I believe counting these in rx_errors is fundamentally wrong, as it's pretty clear from the comments in if_link.h and from every other statistic the driver is summing into rx_errors, that all of them would cause a "hardware drop" except for the UDP checksum mismatch, as well as the fact that all the other causes for rx_errors are L2 reasons, and this L4 UDP "mismatch" is an outlier. A last nail in the coffin is that rx_errors is monitored in production and can indicate a bad NIC/cable/Switch port, but instead some random series of UDP packets with bad checksums will now trigger this alert. This false positive makes the alert useless and affects us as well as other companies. This packet with presumably a bad UDP checksum is *already* passed to the stack, just not marked as offloaded by the hardware/driver. If it is dropped by the stack it will show up as UDP_MIB_CSUMERRORS. And one more thing, none of the other Intel drivers, and at least bnxt_en and mlx5 both don't appear to count UDP offload mismatches as rx_errors. Here is a related customer complaint: https://community.intel.com/t5/Ethernet-Products/ice-rx-errros-is-too-sensitive-to-IP-TCP-attack-packets-Intel/td-p/1662125 Fixes: 4f1fe43c920b ("ice: Add more Rx errors to netdev's rx_error counter") Cc: Tony Nguyen Cc: Jake Keller Cc: IWL Signed-off-by: Jesse Brandeburg Acked-by: Jacob Keller Signed-off-by: Tony Nguyen commit 9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85 Author: Aaron Ma Date: Thu Dec 25 14:21:21 2025 +0800 ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes during resume from suspend when rings[q_idx]->q_vector is NULL. Tested adaptor: 60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02) Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003] SR-IOV state: both disabled and enabled can reproduce this issue. kernel version: v6.18 Reproduce steps: Boot up and execute suspend like systemctl suspend or rtcwake. Log: <1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 <1>[ 231.444052] #PF: supervisor read access in kernel mode <1>[ 231.444484] #PF: error_code(0x0000) - not-present page <6>[ 231.444913] PGD 0 P4D 0 <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89 <4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202 <4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010 <4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000 <4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000 <4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 <4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000 <4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000 <4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0 <4>[ 231.451629] PKRU: 55555554 <4>[ 231.452076] Call Trace: <4>[ 231.452549] <4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice] <4>[ 231.453482] ice_resume+0xfd/0x220 [ice] <4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.454425] pci_pm_resume+0x8c/0x140 <4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.455347] dpm_run_callback+0x5f/0x160 <4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170 <4>[ 231.456244] device_resume+0x177/0x270 <4>[ 231.456708] dpm_resume+0x209/0x2f0 <4>[ 231.457151] dpm_resume_end+0x15/0x30 <4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0 <4>[ 231.458054] enter_state+0x10e/0x570 Add defensive checks for both the ring pointer and its q_vector before dereferencing, allowing the system to resume successfully even when q_vectors are unmapped. Fixes: 2a5dc090b92cf ("ice: move netif_queue_set_napi to rtnl-protected sections") Reviewed-by: Aleksandr Loktionov Signed-off-by: Aaron Ma Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit 100cf7b4ca6ed770ec4287f3789b1da2e340a05a Author: Kohei Enju Date: Thu Dec 11 18:15:32 2025 +0900 ixgbe: don't initialize aci lock in ixgbe_recovery_probe() hw->aci.lock is already initialized in ixgbe_sw_init(), so ixgbe_recovery_probe() doesn't need to initialize the lock. This function is also not responsible for destroying the lock on failures. Additionally, change the name of label in accordance with this change. Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode") Reported-by: Simon Horman Closes: https://lore.kernel.org/intel-wired-lan/aTcFhoH-z2btEKT-@horms.kernel.org/ Signed-off-by: Kohei Enju Signed-off-by: Tony Nguyen commit 638344712aefeba97b6e0d90f560815fd88abd0f Author: Kohei Enju Date: Thu Dec 11 18:15:31 2025 +0900 ixgbe: fix memory leaks in the ixgbe_recovery_probe() path When ixgbe_recovery_probe() is invoked and this function fails, allocated resources in advance are not completely freed, because ixgbe_probe() returns ixgbe_recovery_probe() directly and ixgbe_recovery_probe() only frees partial resources, resulting in memory leaks including: - adapter->io_addr - adapter->jump_tables[0] - adapter->mac_table - adapter->rss_key - adapter->af_xdp_zc_qps The leaked MMIO region can be observed in /proc/vmallocinfo, and the remaining leaks are reported by kmemleak. Don't return ixgbe_recovery_probe() directly, and instead let ixgbe_probe() to clean up resources on failures. Fixes: 29cb3b8d95c7 ("ixgbe: add E610 implementation of FW recovery mode") Signed-off-by: Kohei Enju Signed-off-by: Tony Nguyen commit d02f20a4de0c498fbba2b0e3c1496e72c630a91e Author: Martin Larsson Date: Wed Jan 21 12:57:22 2026 +0000 gpio: pca953x: mask interrupts in irq shutdown In the existing implementation irq_shutdown does not mask the interrupts in hardware. This can cause spurious interrupts from the IO expander. Add masking to irq_shutdown to prevent spurious interrupts. Cc: stable@vger.kernel.org Signed-off-by: Martin Larsson Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20260121125631.2758346-1-martin.larsson@actia.se Signed-off-by: Bartosz Golaszewski commit 53ad4a948a4586359b841d607c08fb16c5503230 Author: Yuhao Huang Date: Mon Jan 26 12:03:48 2026 +0800 gpio: virtuser: fix UAF in configfs release path The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory. Specifically, gpio_virtuser_device_config_group_release() destroys the mutex and frees the device while still inside the guard(mutex) scope. When the function returns, the guard cleanup invokes mutex_unlock(&dev->lock), resulting in a slab use-after-free. Limit the mutex lifetime by using a scoped_guard() only around the activation check, so that the lock is released before mutex_destroy() and kfree() are called. Fixes: 91581c4b3f29 ("gpio: virtuser: new virtual testing driver for the GPIO API") Signed-off-by: Yuhao Huang Link: https://lore.kernel.org/r/20260126040348.11167-1-yuhaohuang@YuhaodeMacBook-Pro.local Signed-off-by: Bartosz Golaszewski commit c0ae43d303e45764918fa8c1dc13d6a5db59c479 Author: Denis Sergeev Date: Mon Jan 26 06:59:14 2026 +0300 gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler The BIT() macro uses unsigned long, which is 32 bits on 32-bit architectures. When iterating over GPIO pins with index >= 32, the expression (*value & BIT(i)) causes undefined behavior due to shifting by a value >= type width. Since 'value' is a pointer to u64, use BIT_ULL() to ensure correct 64-bit mask on all architectures. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 2c4d00cb8fc5 ("gpiolib: acpi: Use BIT() macro to increase readability") Signed-off-by: Denis Sergeev Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/r/20260126035914.16586-1-denserg.edu@gmail.com Signed-off-by: Bartosz Golaszewski commit 96313fcc1f062ba239f4832c9eff685da6c51c99 Author: Xuewen Yan Date: Mon Jan 26 17:42:09 2026 +0800 gpio: sprd: Change sprd_gpio lock to raw_spin_lock There was a lockdep warning in sprd_gpio: [ 6.258269][T329@C6] [ BUG: Invalid wait context ] [ 6.258270][T329@C6] 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 Tainted: G W OE [ 6.258272][T329@C6] ----------------------------- [ 6.258273][T329@C6] modprobe/329 is trying to lock: [ 6.258275][T329@C6] ffffff8081c91690 (&sprd_gpio->lock){....}-{3:3}, at: sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd] [ 6.258282][T329@C6] other info that might help us debug this: [ 6.258283][T329@C6] context-{5:5} [ 6.258285][T329@C6] 3 locks held by modprobe/329: [ 6.258286][T329@C6] #0: ffffff808baca108 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xc4/0x204 [ 6.258295][T329@C6] #1: ffffff80965e7240 (request_class#4){+.+.}-{4:4}, at: __setup_irq+0x1cc/0x82c [ 6.258304][T329@C6] #2: ffffff80965e70c8 (lock_class#4){....}-{2:2}, at: __setup_irq+0x21c/0x82c [ 6.258313][T329@C6] stack backtrace: [ 6.258314][T329@C6] CPU: 6 UID: 0 PID: 329 Comm: modprobe Tainted: G W OE 6.18.0-android17-0-g30527ad7aaae-ab00009-4k #1 PREEMPT 3ad5b0f45741a16e5838da790706e16ceb6717df [ 6.258316][T329@C6] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 6.258317][T329@C6] Hardware name: Unisoc UMS9632-base Board (DT) [ 6.258318][T329@C6] Call trace: [ 6.258318][T329@C6] show_stack+0x20/0x30 (C) [ 6.258321][T329@C6] __dump_stack+0x28/0x3c [ 6.258324][T329@C6] dump_stack_lvl+0xac/0xf0 [ 6.258326][T329@C6] dump_stack+0x18/0x3c [ 6.258329][T329@C6] __lock_acquire+0x824/0x2c28 [ 6.258331][T329@C6] lock_acquire+0x148/0x2cc [ 6.258333][T329@C6] _raw_spin_lock_irqsave+0x6c/0xb4 [ 6.258334][T329@C6] sprd_gpio_irq_unmask+0x4c/0xa4 [gpio_sprd 814535e93c6d8e0853c45c02eab0fa88a9da6487] [ 6.258337][T329@C6] irq_startup+0x238/0x350 [ 6.258340][T329@C6] __setup_irq+0x504/0x82c [ 6.258342][T329@C6] request_threaded_irq+0x118/0x184 [ 6.258344][T329@C6] devm_request_threaded_irq+0x94/0x120 [ 6.258347][T329@C6] sc8546_init_irq+0x114/0x170 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] [ 6.258352][T329@C6] sc8546_charger_probe+0x53c/0x5a0 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] [ 6.258358][T329@C6] i2c_device_probe+0x2c8/0x350 [ 6.258361][T329@C6] really_probe+0x1a8/0x46c [ 6.258363][T329@C6] __driver_probe_device+0xa4/0x10c [ 6.258366][T329@C6] driver_probe_device+0x44/0x1b4 [ 6.258369][T329@C6] __driver_attach+0xd0/0x204 [ 6.258371][T329@C6] bus_for_each_dev+0x10c/0x168 [ 6.258373][T329@C6] driver_attach+0x2c/0x3c [ 6.258376][T329@C6] bus_add_driver+0x154/0x29c [ 6.258378][T329@C6] driver_register+0x70/0x10c [ 6.258381][T329@C6] i2c_register_driver+0x48/0xc8 [ 6.258384][T329@C6] init_module+0x28/0xfd8 [sc8546_charger 223586ccafc27439f7db4f95b0c8e6e882349a99] [ 6.258389][T329@C6] do_one_initcall+0x128/0x42c [ 6.258392][T329@C6] do_init_module+0x60/0x254 [ 6.258395][T329@C6] load_module+0x1054/0x1220 [ 6.258397][T329@C6] __arm64_sys_finit_module+0x240/0x35c [ 6.258400][T329@C6] invoke_syscall+0x60/0xec [ 6.258402][T329@C6] el0_svc_common+0xb0/0xe4 [ 6.258405][T329@C6] do_el0_svc+0x24/0x30 [ 6.258407][T329@C6] el0_svc+0x54/0x1c4 [ 6.258409][T329@C6] el0t_64_sync_handler+0x68/0xdc [ 6.258411][T329@C6] el0t_64_sync+0x1c4/0x1c8 This is because the spin_lock would change to rt_mutex in PREEMPT_RT, however the sprd_gpio->lock would use in hard-irq, this is unsafe. So change the spin_lock_t to raw_spin_lock_t to use the spinlock in hard-irq. Signed-off-by: Xuewen Yan Reviewed-by: Baolin Wang Reviewed-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20260126094209.9855-1-xuewen.yan@unisoc.com [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit 1f97d9dcf53649c41c33227b345a36902cbb08ad Merge: fcb70a56f4d814 61ceaf236115f2 Author: Linus Torvalds Date: Tue Jan 27 10:39:17 2026 -0800 Merge tag 'vfio-v6.19-rc8' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Fix a gap in the initial VFIO DMABUF implementation where it's required to explicitly implement a failing pin callback to prevent pinned importers that cannot properly support move_notify. (Leon Romanovsky) * tag 'vfio-v6.19-rc8' of https://github.com/awilliam/linux-vfio: vfio: Prevent from pinned DMABUF importers to attach to VFIO DMABUF commit 78c268f3781e4b9706103def0cc011505e0c4332 Author: Josh Poimboeuf Date: Mon Jan 26 15:56:44 2026 -0800 livepatch/klp-build: Fix klp-build vs CONFIG_MODULE_SRCVERSION_ALL When building a patch to a single-file kernel module with CONFIG_MODULE_SRCVERSION_ALL enabled, the klp-build module link fails in modpost: Diffing objects drivers/md/raid0.o: changed function: raid0_run Building patch module: livepatch-0001-patch-raid0_run.ko drivers/md/raid0.c: No such file or directory ... The problem here is that klp-build copied drivers/md/.raid0.o.cmd to the module build directory, but it didn't also copy over the input source file listed in the .cmd file: source_drivers/md/raid0.o := drivers/md/raid0.c So modpost dies due to the missing .c file which is needed for calculating checksums for CONFIG_MODULE_SRCVERSION_ALL. Instead of copying the original .cmd file, just create an empty one. Modpost only requires that it exists. The original object's build dependencies are irrelevant for the frankenobjects used by klp-build. Fixes: 24ebfcd65a87 ("livepatch/klp-build: Introduce klp-build script for generating livepatch modules") Reported-by: Song Liu Tested-by: Song Liu Link: https://patch.msgid.link/c41b6629e02775e4c1015259aa36065b3fe2f0f3.1769471792.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit f2dba60339a6299e181671e95293efe312237e2d Author: Josh Poimboeuf Date: Sun Jan 25 21:56:39 2026 -0800 objtool/klp: Fix bug table handling for __WARN_printf() Running objtool klp-diff on a changed function which uses WARN() can fail with: vmlinux.o: error: objtool: md_run+0x866: failed to convert reloc sym '__bug_table' to its proper format The problem is that since commit 5b472b6e5bd9 ("x86_64/bug: Implement __WARN_printf()"), each __WARN_printf() call site now directly references its bug table entry. klp-diff errors out when it can't convert such section-based references to object symbols (because bug table entries don't have symbols). Luckily, klp-diff already has code to create symbols for bug table entries. Move that code earlier, before function diffing. Fixes: dd590d4d57eb ("objtool/klp: Introduce klp diff subcommand for diffing object files") Fixes: 5b472b6e5bd9 ("x86_64/bug: Implement __WARN_printf()") Reported-by: Song Liu Tested-by: Song Liu Link: https://patch.msgid.link/a8e0a714b9da962858842b9aecd63b4900927c88.1769406850.git.jpoimboe@kernel.org Signed-off-by: Josh Poimboeuf commit d107b3265aa5e61a1e326b2815a767526ddb12ac Author: Petr Pavlu Date: Mon Jan 26 16:13:48 2026 +0100 objtool: Replace custom macros in elf.c with shared ones The source file tools/objtool/elf.c defines the macros ALIGN_UP(), ALIGN_UP_POW2() and MAX(). These macros unnecessarily duplicate functionality already available under tools/include/, specifically ALIGN(), roundup_pow_of_two() and max(). More importantly, the definition of ALIGN_UP_POW2() is incorrect when the input is 1, as it results in a call to __builtin_clz(0), which produces an undefined result. This issue impacts the function elf_alloc_reloc(). When adding the first relocation to a section, the function allocates an undefined number of relocations. Replace the custom macros with the shared functionality to resolve these issues. Fixes: 2c05ca026218 ("objtool: Add elf_create_reloc() and elf_init_reloc()") Signed-off-by: Petr Pavlu Link: https://patch.msgid.link/20260126151356.3924887-1-petr.pavlu@suse.com Signed-off-by: Josh Poimboeuf commit fd4eeb30b9e30ca1118a618be0755287bcbb2da9 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Mon Jan 26 04:57:35 2026 +0000 objtool: Print bfd_vma as unsigned long long on ia32-x86_64 cross build When objtool is cross-compiled in ia32 container for x86_64 target it fails with the following errors: > disas.c: In function 'disas_print_addr_sym': > disas.c:173:38: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'bfd_vma' {aka 'long long unsigned int'} [-Werror=format=] > 173 | DINFO_FPRINTF(dinfo, "0x%lx <%s>", addr, symstr); > | ^~~~~~~~~~~~ ~~~~ > | | > | bfd_vma {aka long long unsigned int} Provide a correct printf-fmt depending on sizeof(bfd_vma). Fixes: 5d859dff266f ("objtool: Print symbol during disassembly") Signed-off-by: Dmitry Safonov Reviewed-by: Alexandre Chartre Link: https://patch.msgid.link/20260126-objtool-ia32-v1-1-bb6feaf17566@arista.com Signed-off-by: Josh Poimboeuf commit ba5c657141ea29261e893c46faff29a101f4496a Author: Ioana Ciornei Date: Thu Jan 22 15:40:34 2026 +0200 bus: simple-pm-bus: Probe the Layerscape SCFG node Make the simple-pm-bus driver probe the Layerscape SCFG dt nodes and populate platform_device structures from its child dt nodes. This is now needed because its child interrupt-controller - ls-extirq - is being handled as a platform_device instead of being initialized through the IRQCHIP_DECLARE infrastructure which impeded its parent IRQ retrieval through the blamed commit. Note that this does not set ONLY_BUS because that enables the of_platform_populate() call. The extra power management operations which are enabled by that are not required but harmless. Fixes: 1b1f04d8271e ("of/irq: Ignore interrupt parent for nodes without interrupts") Signed-off-by: Ioana Ciornei Signed-off-by: Thomas Gleixner Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260122134034.3274053-3-ioana.ciornei@nxp.com commit 05cd654829dd2717e86a5a3f9ff301447fc28c93 Author: Ioana Ciornei Date: Thu Jan 22 15:40:33 2026 +0200 irqchip/ls-extirq: Convert to a platform driver to make it work again Starting with the blamed commit, the ls-extirq driver stopped working. This is because ls-extirq, being one of the interrupt-map property abusers, does not pass the DT checks added by the referenced commit, making it unable to determine its interrupt parent: irq-ls-extirq: Cannot find parent domain OF: of_irq_init: Failed to init /soc/syscon@1f70000/interrupt-controller@14 ((____ptrval____)), parent 0000000000000000 Instead of reverting the referenced commit, convert the ls-extirq to a platform driver to avoid the irqchip_init() -> of_irq_init() code path completely. As part of the conversion, use the managed resources APIs and dev_err_probe() so that there is no need for a .remove() callback or for complicated error handling. Fixes: 1b1f04d8271e ("of/irq: Ignore interrupt parent for nodes without interrupts") Co-developed-by: Alexander Stein Signed-off-by: Alexander Stein Signed-off-by: Ioana Ciornei Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260122134034.3274053-2-ioana.ciornei@nxp.com commit ae0a24c5a8dcea20bf8e344eadf6593e6d1959c3 Author: Jacky Bai Date: Fri Jan 23 10:51:26 2026 +0800 pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset On i.MX8MM, the GPUMIX, GPU2D, and GPU3D blocks share a common reset domain. Due to this hardware limitation, powering off/on GPU2D or GPU3D also triggers a reset of the GPUMIX domain, including its ADB400 port. However, the ADB400 interface must always be placed into power‑down mode before being reset. Currently the GPUMIX and GPU2D/3D power domains rely on runtime PM to handle dependency ordering. In some corner cases, the GPUMIX power off sequence is skipped, leaving the ADB400 port active when GPU2D/3D reset. This causes the GPUMIX ADB400 port to be reset while still active, leading to unpredictable bus behavior and GPU hangs. To avoid this, refine the power‑domain control logic so that the GPUMIX ADB400 port is explicitly powered down and powered up as part of the GPU power domain on/off sequence. This ensures proper ordering and prevents incorrect ADB400 reset. Suggested-by: Lucas Stach Signed-off-by: Jacky Bai Reviewed-by: Lucas Stach Tested-by: Philipp Zabel Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit e9acda52fd2ee0cdca332f996da7a95c5fd25294 Author: Nikolay Aleksandrov Date: Fri Jan 23 14:06:59 2026 +0200 bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding] Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") Signed-off-by: Nikolay Aleksandrov Reported-by: Chen Zhen Closes: https://lore.kernel.org/netdev/fae17c21-4940-5605-85b2-1d5e17342358@huawei.com/ CC: Jussi Maki CC: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20260123120659.571187-1-razor@blackwall.org Signed-off-by: Paolo Abeni commit 8aa6f7697f5981d336cac7af6ddd182a03c6da01 Author: Gabor Juhos Date: Thu Jan 22 18:20:12 2026 +0100 pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state As it is indicated by the comment, the rpmpd_aggregate_corner() function tries to clamp the state to the highest corner/level supported by the given power domain, however the calculation of the highest state contains an off-by-one error. The 'max_state' member of the 'rpmpd' structure indicates the highest corner/level, and as such it does not needs to be decremented. Change the code to use the 'max_state' value directly to avoid the error. Fixes: 98c8b3efacae ("soc: qcom: rpmpd: Add sync_state") Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 1730daa3b425ea8c88ae599af6e1a4957bd2d81a Merge: 63804fed149a67 7e3debb4c72fe8 Author: Rafael J. Wysocki Date: Tue Jan 27 14:40:29 2026 +0100 Merge tag 'cpufreq-arm-fixes-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull a CPUFreq driver fix for 6.19 from Viresh Kumar: - Add sentinel to qcom_cpufreq_ipq806x_match_list (Pei Xiao). * tag 'cpufreq-arm-fixes-6.19-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: qcom-nvmem: add sentinel to qcom_cpufreq_ipq806x_match_list commit 213c4e51267fd825cd21a08a055450cac7e0b7fb Author: Tagir Garaev Date: Wed Jan 21 18:24:35 2026 +0300 ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion The headphone GPIO should be set to the inverse of speaker_en. When speakers are enabled, headphones should be disabled and vice versa. Currently both GPIOs are set to the same value (speaker_en), causing audio to play through both speakers and headphones simultaneously when headphones are plugged in. Tested on Huawei Matebook (BOD-WXX9) with ES8336 codec. Fixes: 6e1ff1459e00 ("ASoC: Intel: sof_es8336: support a separate gpio to control headphone") Signed-off-by: Tagir Garaev Link: https://patch.msgid.link/20260121152435.101698-1-tgaraev653@gmail.com Signed-off-by: Mark Brown commit f58442788fdac580c49e0c42379fd32438cff6d7 Author: Gabor Juhos Date: Mon Jan 26 16:13:11 2026 +0100 dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: fix 'usb32_drvvbus0' group name The trailing '0' character of the 'usb32_drvvbus0' pin group got removed during converting the bindings to DT schema. $ git grep -n usb32_drvvbus v6.18 v6.18:Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt:106:group usb32_drvvbus0 v6.18:drivers/pinctrl/mvebu/pinctrl-armada-37xx.c:195: PIN_GRP_GPIO("usb32_drvvbus0", 0, 1, BIT(0), "drvbus"), $ git grep -n usb32_drvvbus v6.19-rc1 v6.19-rc1:Documentation/devicetree/bindings/pinctrl/marvell,armada3710-xb-pinctrl.yaml:91: usb2_drvvbus1, usb32_drvvbus ] v6.19-rc1:drivers/pinctrl/mvebu/pinctrl-armada-37xx.c:195: PIN_GRP_GPIO("usb32_drvvbus0", 0, 1, BIT(0), "drvbus"), Add it back to match the group name with the one the driver expects. Fixes: c1c9641a04e8 ("dt-bindings: pinctrl: Convert marvell,armada-3710-(sb|nb)-pinctrl to DT schema") Signed-off-by: Gabor Juhos Acked-by: Conor Dooley Reviewed-by: Miquel Raynal Signed-off-by: Linus Walleij commit 4f0d22ec60cee420125f4055af76caa0f373a3fe Author: Bartosz Golaszewski Date: Mon Jan 26 14:56:27 2026 +0100 pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver GPIO controller driver should typically implement the .get_direction() callback as GPIOLIB internals may try to use it to determine the state of a pin. Add it for the LPASS LPI driver. Reported-by: Abel Vesa Cc: stable@vger.kernel.org Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") Signed-off-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Tested-by: Konrad Dybcio # X1E CRD Tested-by: Abel Vesa Signed-off-by: Linus Walleij commit 7ca497be00163610afb663867db24ac408752f13 Author: Robin Murphy Date: Mon Jan 26 12:12:26 2026 +0000 gpio: rockchip: Stop calling pinctrl for set_direction Marking the whole controller as sleeping due to the pinctrl calls in the .direction_{input,output} callbacks has the unfortunate side effect that legitimate invocations of .get and .set, which cannot themselves sleep, in atomic context now spew WARN()s from gpiolib. However, as Heiko points out, the driver doing this is a bit silly to begin with, as the pinctrl .gpio_set_direction hook doesn't even care about the direction, the hook is only used to claim the mux. And sure enough, the .gpio_request_enable hook exists to serve this very purpose, so switch to that and remove the problematic business entirely. Cc: stable@vger.kernel.org Fixes: 20cf2aed89ac ("gpio: rockchip: mark the GPIO controller as sleeping") Suggested-by: Heiko Stuebner Signed-off-by: Robin Murphy Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/bddc0469f25843ca5ae0cf578ab3671435ae98a7.1769429546.git.robin.murphy@arm.com Signed-off-by: Bartosz Golaszewski commit 7e3debb4c72fe840d60014192cf93950871fb3be Author: Pei Xiao Date: Thu Jan 22 09:44:48 2026 +0800 cpufreq: qcom-nvmem: add sentinel to qcom_cpufreq_ipq806x_match_list The of_device_id table is expected to be NULL-terminated. Without the sentinel, the traversal of the array can lead to out-of-bound access, causing undefined behavior. This adds the missing sentinel to the qcom_cpufreq_ipq806x_match_list array. Fixes: 58f5d39d5ed8 ("cpufreq: qcom-nvmem: add compatible fallback for ipq806x for no SMEM") Signed-off-by: Pei Xiao Reviewed-by: Konrad Dybcio Signed-off-by: Viresh Kumar commit 165c34fb6068ff153e3fc99a932a80a9d5755709 Author: Kuniyuki Iwashima Date: Sun Jan 25 00:59:28 2026 +0000 nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). syzbot reported various memory leaks related to NFC, struct nfc_llcp_sock, sk_buff, nfc_dev, etc. [0] The leading log hinted that nfc_llcp_send_ui_frame() failed to allocate skb due to sock_error(sk) being -ENXIO. ENXIO is set by nfc_llcp_socket_release() when struct nfc_llcp_local is destroyed by local_cleanup(). The problem is that there is no synchronisation between nfc_llcp_send_ui_frame() and local_cleanup(), and skb could be put into local->tx_queue after it was purged in local_cleanup(): CPU1 CPU2 ---- ---- nfc_llcp_send_ui_frame() local_cleanup() |- do { ' |- pdu = nfc_alloc_send_skb(..., &err) | . | |- nfc_llcp_socket_release(local, false, ENXIO); | |- skb_queue_purge(&local->tx_queue); | | ' | |- skb_queue_tail(&local->tx_queue, pdu); | ... | |- pdu = nfc_alloc_send_skb(..., &err) | ^._________________________________.' local_cleanup() is called for struct nfc_llcp_local only after nfc_llcp_remove_local() unlinks it from llcp_devices. If we hold local->tx_queue.lock then, we can synchronise the thread and nfc_llcp_send_ui_frame(). Let's do that and check list_empty(&local->list) before queuing skb to local->tx_queue in nfc_llcp_send_ui_frame(). [0]: [ 56.074943][ T6096] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6) [ 64.318868][ T5813] kmemleak: 6 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff8881272f6800 (size 1024): comm "syz.0.17", pid 6096, jiffies 4294942766 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc da58d84d): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4979 [inline] slab_alloc_node mm/slub.c:5284 [inline] __do_kmalloc_node mm/slub.c:5645 [inline] __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658 kmalloc_noprof include/linux/slab.h:961 [inline] sk_prot_alloc+0x11a/0x1b0 net/core/sock.c:2239 sk_alloc+0x36/0x360 net/core/sock.c:2295 nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979 llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044 nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31 __sock_create+0x1a9/0x340 net/socket.c:1605 sock_create net/socket.c:1663 [inline] __sys_socket_create net/socket.c:1700 [inline] __sys_socket+0xb9/0x1a0 net/socket.c:1747 __do_sys_socket net/socket.c:1761 [inline] __se_sys_socket net/socket.c:1759 [inline] __x64_sys_socket+0x1b/0x30 net/socket.c:1759 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88810fbd9800 (size 240): comm "syz.0.17", pid 6096, jiffies 4294942850 hex dump (first 32 bytes): 68 f0 ff 08 81 88 ff ff 68 f0 ff 08 81 88 ff ff h.......h....... 00 00 00 00 00 00 00 00 00 68 2f 27 81 88 ff ff .........h/'.... backtrace (crc 6cc652b1): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4979 [inline] slab_alloc_node mm/slub.c:5284 [inline] kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5336 __alloc_skb+0x203/0x240 net/core/skbuff.c:660 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671 sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965 sock_alloc_send_skb include/net/sock.h:1859 [inline] nfc_alloc_send_skb+0x45/0x80 net/nfc/core.c:724 nfc_llcp_send_ui_frame+0x162/0x360 net/nfc/llcp_commands.c:766 llcp_sock_sendmsg+0x14c/0x1d0 net/nfc/llcp_sock.c:814 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x2d8/0x2f0 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0x28/0x30 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 94f418a20664 ("NFC: UI frame sending routine implementation") Reported-by: syzbot+f2d245f1d76bbfa50e4c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/697569c7.a00a0220.33ccc7.0014.GAE@google.com/T/#u Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260125010214.1572439-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 2c84959167d6493dbdac88965c7389b8ab88bf4e Author: Vivian Wang Date: Fri Jan 23 11:52:23 2026 +0800 net: spacemit: Check for netif_carrier_ok() in emac_stats_update() Some PHYs stop the refclk for power saving, usually while link down. This causes reading stats to time out. Therefore, in emac_stats_update(), also don't update and reschedule if !netif_carrier_ok(). But that means we could be missing later updates if the link comes back up, so also reschedule when link up is detected in emac_adjust_link(). While we're at it, improve the comments and error message prints around this to reflect the better understanding of how this could happen. Hopefully if this happens again on new hardware, these comments will direct towards a solution. Closes: https://lore.kernel.org/r/20260119141620.1318102-1-amadeus@jmu.edu.cn/ Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC") Co-developed-by: Chukun Pan Signed-off-by: Chukun Pan Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20260123-k1-ethernet-clarify-stat-timeout-v3-1-93b9df627e87@iscas.ac.cn Signed-off-by: Jakub Kicinski commit e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d Author: Eric Dumazet Date: Sat Jan 24 11:59:18 2026 +0100 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches. Fixes: 141694df6573 ("mptcp: remove address when netlink flushes addrs") Signed-off-by: Eric Dumazet Reported-by: syzbot+5498a510ff9de39d37da@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6970a46d.a00a0220.3ad28e.5cf0.GAE@google.com/T/ Reported-by: Eulgyu Kim Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/611 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260124-net-mptcp-race_nl_flush_addrs-v3-1-b2dc1b613e9d@kernel.org Signed-off-by: Jakub Kicinski commit 8d7ba71e46216b8657a82ca2ec118bc93812a4d0 Author: Kery Qi Date: Sat Jan 24 05:10:31 2026 +0800 rocker: fix memory leak in rocker_world_port_post_fini() In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with kzalloc(wops->port_priv_size, GFP_KERNEL). However, in rocker_world_port_post_fini(), the memory is only freed when wops->port_post_fini callback is set: if (!wops->port_post_fini) return; wops->port_post_fini(rocker_port); kfree(rocker_port->wpriv); Since rocker_ofdpa_ops does not implement port_post_fini callback (it is NULL), the wpriv memory allocated for each port is never freed when ports are removed. This leads to a memory leak of sizeof(struct ofdpa_port) bytes per port on every device removal. Fix this by always calling kfree(rocker_port->wpriv) regardless of whether the port_post_fini callback exists. Fixes: e420114eef4a ("rocker: introduce worlds infrastructure") Signed-off-by: Kery Qi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260123211030.2109-2-qikeyu2017@gmail.com Signed-off-by: Jakub Kicinski commit bd58782995a2e6a07fd07255f3cc319f40b131c9 Author: Breno Leitao Date: Thu Jan 22 02:39:36 2026 -0800 vmcoreinfo: make hwerr_data visible for debugging If the kernel is compiled with LTO, hwerr_data symbol might be lost, and vmcoreinfo doesn't have it dumped. This is currently seen in some production kernels with LTO enabled. Remove the static qualifier from hwerr_data so that the information is still preserved when the kernel is built with LTO. Making hwerr_data a global symbol ensures its debug info survives the LTO link process and appears in kallsyms. Also document it, so it doesn't get removed in the future as suggested by akpm. Link: https://lkml.kernel.org/r/20260122-fix_vmcoreinfo-v2-1-2d6311f9e36c@debian.org Fixes: 3fa805c37dd4 ("vmcoreinfo: track and log recoverable hardware errors") Signed-off-by: Breno Leitao Acked-by: Baoquan He Cc: Dave Young Cc: "Luck, Tony" Cc: Omar Sandoval Cc: Shuai Xue Cc: Vivek Goyal Cc: Zhiquan Li Signed-off-by: Andrew Morton commit 12b2285bf3d14372238d36215b73af02ac3bdfc1 Author: Matthew Brost Date: Fri Jan 16 12:10:16 2026 +0100 mm/zone_device: reinitialize large zone device private folios Reinitialize metadata for large zone device private folios in zone_device_page_init prior to creating a higher-order zone device private folio. This step is necessary when the folio's order changes dynamically between zone_device_page_init calls to avoid building a corrupt folio. As part of the metadata reinitialization, the dev_pagemap must be passed in from the caller because the pgmap stored in the folio page may have been overwritten with a compound head. Without this fix, individual pages could have invalid pgmap fields and flags (with PG_locked being notably problematic) due to prior different order allocations, which can, and will, result in kernel crashes. Link: https://lkml.kernel.org/r/20260116111325.1736137-2-francois.dugast@intel.com Fixes: d245f9b4ab80 ("mm/zone_device: support large zone device private folios") Signed-off-by: Matthew Brost Signed-off-by: Francois Dugast Acked-by: Felix Kuehling Reviewed-by: Balbir Singh Acked-by: Vlastimil Babka Cc: Zi Yan Cc: Alistair Popple Cc: Madhavan Srinivasan Cc: Nicholas Piggin Cc: Michael Ellerman Cc: "Christophe Leroy (CS GROUP)" Cc: Alex Deucher Cc: "Christian König" Cc: David Airlie Cc: Simona Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Hildenbrand Cc: Oscar Salvador Cc: Andrew Morton Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Signed-off-by: Andrew Morton commit cbbbf7795fc35a740e1d09f3a55aba543b72a8d3 Author: Waiman Long Date: Thu Jan 22 13:43:43 2026 -0500 mm/mm_init: don't cond_resched() in deferred_init_memmap_chunk() if called from deferred_grow_zone() Commit 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone()") made deferred_grow_zone() call deferred_init_memmap_chunk() within a pgdat_resize_lock() critical section with irqs disabled. It did check for irqs_disabled() in deferred_init_memmap_chunk() to avoid calling cond_resched(). For a PREEMPT_RT kernel build, however, spin_lock_irqsave() does not disable interrupt but rcu_read_lock() is called. This leads to the following bug report. BUG: sleeping function called from invalid context at mm/mm_init.c:2091 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 3 locks held by swapper/0/1: #0: ffff80008471b7a0 (sched_domains_mutex){+.+.}-{4:4}, at: sched_domains_mutex_lock+0x28/0x40 #1: ffff003bdfffef48 (&pgdat->node_size_lock){+.+.}-{3:3}, at: deferred_grow_zone+0x140/0x278 #2: ffff800084acf600 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1b4/0x408 CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.19.0-rc6-test #1 PREEMPT_{RT,(full) } Tainted: [W]=WARN Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0xdc/0xf8 dump_stack+0x1c/0x28 __might_resched+0x384/0x530 deferred_init_memmap_chunk+0x560/0x688 deferred_grow_zone+0x190/0x278 _deferred_grow_zone+0x18/0x30 get_page_from_freelist+0x780/0xf78 __alloc_frozen_pages_noprof+0x1dc/0x348 alloc_slab_page+0x30/0x110 allocate_slab+0x98/0x2a0 new_slab+0x4c/0x80 ___slab_alloc+0x5a4/0x770 __slab_alloc.constprop.0+0x88/0x1e0 __kmalloc_node_noprof+0x2c0/0x598 __sdt_alloc+0x3b8/0x728 build_sched_domains+0xe0/0x1260 sched_init_domains+0x14c/0x1c8 sched_init_smp+0x9c/0x1d0 kernel_init_freeable+0x218/0x358 kernel_init+0x28/0x208 ret_from_fork+0x10/0x20 Fix it adding a new argument to deferred_init_memmap_chunk() to explicitly tell it if cond_resched() is allowed or not instead of relying on some current state information which may vary depending on the exact kernel configuration options that are enabled. Link: https://lkml.kernel.org/r/20260122184343.546627-1-longman@redhat.com Fixes: 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone()") Signed-off-by: Waiman Long Suggested-by: Sebastian Andrzej Siewior Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: "Paul E . McKenney" Cc: Steven Rostedt Cc: Wei Yang Cc: Signed-off-by: Andrew Morton commit 870ff19251bf3910dda7a7245da826924045fedd Author: Pimyn Girgis Date: Tue Jan 20 17:15:10 2026 +0100 mm/kfence: randomize the freelist on initialization Randomize the KFENCE freelist during pool initialization to make allocation patterns less predictable. This is achieved by shuffling the order in which metadata objects are added to the freelist using get_random_u32_below(). Additionally, ensure the error path correctly calculates the address range to be reset if initialization fails, as the address increment logic has been moved to a separate loop. Link: https://lkml.kernel.org/r/20260120161510.3289089-1-pimyn@google.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Pimyn Girgis Reviewed-by: Alexander Potapenko Cc: Dmitry Vyukov Cc: Marco Elver Cc: Ernesto Martnez Garca Cc: Greg KH Cc: Kees Cook Cc: Signed-off-by: Andrew Morton commit 412a32f0e53f4a50062f6f4bc18f8910aa551734 Author: Andrew Morton Date: Wed Jan 21 12:36:17 2026 -0800 kho: kho_preserve_vmalloc(): don't return 0 when ENOMEM kho_preserve_vmalloc() should return -ENOMEM when new_vmalloc_chunk() fails. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601211636.IRaejjdw-lkp@intel.com/ Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Jason Gunthorpe Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit e86436ad0ad2a9aaf88802d69b68f02cbd1f04a9 Author: Ran Xiaokai Date: Thu Jan 22 13:27:40 2026 +0000 kho: init alloc tags when restoring pages from reserved memory Memblock pages (including reserved memory) should have their allocation tags initialized to CODETAG_EMPTY via clear_page_tag_ref() before being released to the page allocator. When kho restores pages through kho_restore_page(), missing this call causes mismatched allocation/deallocation tracking and below warning message: alloc_tag was not set WARNING: include/linux/alloc_tag.h:164 at ___free_pages+0xb8/0x260, CPU#1: swapper/0/1 RIP: 0010:___free_pages+0xb8/0x260 kho_restore_vmalloc+0x187/0x2e0 kho_test_init+0x3c4/0xa30 do_one_initcall+0x62/0x2b0 kernel_init_freeable+0x25b/0x480 kernel_init+0x1a/0x1c0 ret_from_fork+0x2d1/0x360 Add missing clear_page_tag_ref() annotation in kho_restore_page() to fix this. Link: https://lkml.kernel.org/r/20260122132740.176468-1-ranxiaokai627@163.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Ran Xiaokai Reviewed-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Kent Overstreet Cc: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit c657c5dc1360fa1ed1b090aedb5883d9cf9f0a0f Author: Pratyush Yadav (Google) Date: Thu Jan 22 16:18:41 2026 +0100 mm: memfd_luo: restore and free memfd_luo_ser on failure memfd_luo_ser has the serialization metadata. It is of no use once restoration fails. Free it on failure. Link: https://lkml.kernel.org/r/20260122151842.4069702-4-pratyush@kernel.org Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 02e117b8ca58928f193e5b4df48d6763232f5e91 Author: Pratyush Yadav (Google) Date: Thu Jan 22 16:18:40 2026 +0100 mm: memfd_luo: use memfd_alloc_file() instead of shmem_file_setup() When restoring a memfd, the file is created using shmem_file_setup(). While memfd creation also calls this function to get the file, it also does other things: 1. The O_LARGEFILE flag is set on the file. If this is not done, writes on the memfd exceeding 2 GiB fail. 2. FMODE_LSEEK, FMODE_PREAD, and FMODE_PWRITE are set on the file. This makes sure the file is seekable and can be used with pread() and pwrite(). 3. Initializes the security field for the inode and makes sure that inode creation is permitted by the security module. Currently, none of those things are done. This means writes above 2 GiB fail, pread(), and pwrite() fail, and so on. lseek() happens to work because file_init_path() sets it because shmem defines fop->llseek. Fix this by using memfd_alloc_file() to get the file to make sure the initialization sequence for normal and preserved memfd is the same. Link: https://lkml.kernel.org/r/20260122151842.4069702-3-pratyush@kernel.org Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 71e2b5eadbad43d33f0e2cf6d767395273ba5eaa Author: Pratyush Yadav (Google) Date: Thu Jan 22 16:18:39 2026 +0100 memfd: export alloc_file() Patch series "mm: memfd_luo hotfixes". This series contains a couple of fixes for memfd preservation using LUO. This patch (of 3): The Live Update Orchestrator's (LUO) memfd preservation works by preserving all the folios of a memfd, re-creating an empty memfd on the next boot, and then inserting back the preserved folios. Currently it creates the file by directly calling shmem_file_setup(). This leaves out other work done by alloc_file() like setting up the file mode, flags, or calling the security hooks. Export alloc_file() to let memfd_luo use it. Rename it to memfd_alloc_file() since it is no longer private and thus needs a subsystem prefix. Link: https://lkml.kernel.org/r/20260122151842.4069702-1-pratyush@kernel.org Link: https://lkml.kernel.org/r/20260122151842.4069702-2-pratyush@kernel.org Signed-off-by: Pratyush Yadav (Google) Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc Author: Jan Kara Date: Wed Jan 21 12:27:30 2026 +0100 flex_proportions: make fprop_new_period() hardirq safe Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race: run_timer_softirq - we are in softirq context call_timer_fn writeout_period fprop_new_period write_seqcount_begin(&p->sequence); ... blk_mq_end_request() blk_update_request() ext4_end_bio() folio_end_writeback() __wb_writeout_add() __fprop_add_percpu_max() if (unlikely(max_frac < FPROP_FRAC_BASE)) { fprop_fraction_percpu() seq = read_seqcount_begin(&p->sequence); - sees odd sequence so loops indefinitely Note that a deadlock like this is only possible if the bdi has configured maximum fraction of writeout throughput which is very rare in general but frequent for example for FUSE bdis. To fix this problem we have to make sure write section of the sequence counter is irqsafe. Link: https://lkml.kernel.org/r/20260121112729.24463-2-jack@suse.cz Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()") Signed-off-by: Jan Kara Reported-by: Bernd Schubert Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/ Reviewed-by: Matthew Wilcox (Oracle) Cc: Joanne Koong Cc: Miklos Szeredi Cc: Signed-off-by: Andrew Morton commit d54887e8e144514768df056878d27346f5b71093 Author: Viacheslav Bocharov Date: Tue Jan 20 11:21:59 2026 +0300 mailmap: add entry for Viacheslav Bocharov Map my address to new personal address Old domain lexina.in will no longer be accessible due to registration expiration. Link: https://lkml.kernel.org/r/20260120082212.364268-1-adeep@lexina.in Signed-off-by: Viacheslav Bocharov Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton commit 057a6f2632c956483e2b2628477f0fcd1cd8a844 Author: Jane Chu Date: Tue Jan 20 16:22:34 2026 -0700 mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn When a hugetlb folio is being poisoned again, try_memory_failure_hugetlb() passed head pfn to kill_accessing_process(), that is not right. The precise pfn of the poisoned page should be used in order to determine the precise vaddr as the SIGBUS payload. This issue has already been taken care of in the normal path, that is, hwpoison_user_mappings(), see [1][2]. Further more, for [3] to work correctly in the hugetlb repoisoning case, it's essential to inform VM the precise poisoned page, not the head page. [1] https://lkml.kernel.org/r/20231218135837.3310403-1-willy@infradead.org [2] https://lkml.kernel.org/r/20250224211445.2663312-1-jane.chu@oracle.com [3] https://lore.kernel.org/lkml/20251116013223.1557158-1-jiaqiyan@google.com/ Link: https://lkml.kernel.org/r/20260120232234.3462258-2-jane.chu@oracle.com Signed-off-by: Jane Chu Reviewed-by: Liam R. Howlett Acked-by: Miaohe Lin Cc: Chris Mason Cc: David Hildenbrand Cc: David Rientjes Cc: Jiaqi Yan Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: William Roche Cc: Signed-off-by: Andrew Morton commit a148a2040191b12b45b82cb29c281cb3036baf90 Author: Jane Chu Date: Tue Jan 20 16:22:33 2026 -0700 mm/memory-failure: fix missing ->mf_stats count in hugetlb poison When a newly poisoned subpage ends up in an already poisoned hugetlb folio, 'num_poisoned_pages' is incremented, but the per node ->mf_stats is not. Fix the inconsistency by designating action_result() to update them both. While at it, define __get_huge_page_for_hwpoison() return values in terms of symbol names for better readibility. Also rename folio_set_hugetlb_hwpoison() to hugetlb_update_hwpoison() since the function does more than the conventional bit setting and the fact three possible return values are expected. Link: https://lkml.kernel.org/r/20260120232234.3462258-1-jane.chu@oracle.com Fixes: 18f41fa616ee ("mm: memory-failure: bump memory failure stats to pglist_data") Signed-off-by: Jane Chu Acked-by: Miaohe Lin Cc: Chris Mason Cc: David Hildenbrand Cc: David Rientjes Cc: Jiaqi Yan Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: William Roche Cc: Signed-off-by: Andrew Morton commit a0f3c0845a4ff68d403c568266d17e9cc553e561 Author: robin.kuo Date: Fri Jan 16 14:25:00 2026 +0800 mm, swap: restore swap_space attr aviod kernel panic commit 8b47299a411a ("mm, swap: mark swap address space ro and add context debug check") made the swap address space read-only. It may lead to kernel panic if arch_prepare_to_swap returns a failure under heavy memory pressure as follows, el1_abort+0x40/0x64 el1h_64_sync_handler+0x48/0xcc el1h_64_sync+0x84/0x88 errseq_set+0x4c/0xb8 (P) __filemap_set_wb_err+0x20/0xd0 shrink_folio_list+0xc20/0x11cc evict_folios+0x1520/0x1be4 try_to_shrink_lruvec+0x27c/0x3dc shrink_one+0x9c/0x228 shrink_node+0xb3c/0xeac do_try_to_free_pages+0x170/0x4f0 try_to_free_pages+0x334/0x534 __alloc_pages_direct_reclaim+0x90/0x158 __alloc_pages_slowpath+0x334/0x588 __alloc_frozen_pages_noprof+0x224/0x2fc __folio_alloc_noprof+0x14/0x64 vma_alloc_zeroed_movable_folio+0x34/0x44 do_pte_missing+0xad4/0x1040 handle_mm_fault+0x4a4/0x790 do_page_fault+0x288/0x5f8 do_translation_fault+0x38/0x54 do_mem_abort+0x54/0xa8 Restore swap address space as not ro to avoid the panic. Link: https://lkml.kernel.org/r/20260116062535.306453-2-robin.kuo@mediatek.com Fixes: 8b47299a411a ("mm, swap: mark swap address space ro and add context debug check") Signed-off-by: robin.kuo Reviewed-by: Andrew Morton Cc: andrew.yang Cc: AngeloGiaocchino Del Regno Cc: Baoquan He Cc: Barry Song Cc: Chinwen Chang Cc: Chris Li Cc: Kairui Song Cc: Kairui Song Cc: Kemeng Shi Cc: Mathias Brugger Cc: Nhat Pham Cc: Qun-wei Lin Cc: Signed-off-by: Andrew Morton commit 9b47d4eea3f7c1f620e95bda1d6221660bde7d7b Author: Andrey Ryabinin Date: Tue Jan 13 20:15:15 2026 +0100 mm/kasan: fix KASAN poisoning in vrealloc() A KASAN warning can be triggered when vrealloc() changes the requested size to a value that is not aligned to KASAN_GRANULE_SIZE. ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1 at mm/kasan/shadow.c:174 kasan_unpoison+0x40/0x48 ... pc : kasan_unpoison+0x40/0x48 lr : __kasan_unpoison_vmalloc+0x40/0x68 Call trace: kasan_unpoison+0x40/0x48 (P) vrealloc_node_align_noprof+0x200/0x320 bpf_patch_insn_data+0x90/0x2f0 convert_ctx_accesses+0x8c0/0x1158 bpf_check+0x1488/0x1900 bpf_prog_load+0xd20/0x1258 __sys_bpf+0x96c/0xdf0 __arm64_sys_bpf+0x50/0xa0 invoke_syscall+0x90/0x160 Introduce a dedicated kasan_vrealloc() helper that centralizes KASAN handling for vmalloc reallocations. The helper accounts for KASAN granule alignment when growing or shrinking an allocation and ensures that partial granules are handled correctly. Use this helper from vrealloc_node_align_noprof() to fix poisoning logic. [ryabinin.a.a@gmail.com: move kasan_enabled() check, fix build] Link: https://lkml.kernel.org/r/20260119144509.32767-1-ryabinin.a.a@gmail.com Link: https://lkml.kernel.org/r/20260113191516.31015-1-ryabinin.a.a@gmail.com Fixes: d699440f58ce ("mm: fix vrealloc()'s KASAN poisoning logic") Signed-off-by: Andrey Ryabinin Reported-by: Maciej Żenczykowski Reported-by: Closes: https://lkml.kernel.org/r/CANP3RGeuRW53vukDy7WDO3FiVgu34-xVJYkfpm08oLO3odYFrA@mail.gmail.com Reviewed-by: Andrey Konovalov Tested-by: Maciej Wieczor-Retman Cc: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Dmitry Vyukov Cc: Uladzislau Rezki Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit 8a1968bd997f45a9b11aefeabdd1232e1b6c7184 Author: Kairui Song Date: Tue Jan 20 00:11:21 2026 +0800 mm/shmem, swap: fix race of truncate and swap entry split The helper for shmem swap freeing is not handling the order of swap entries correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it gets the entry order before that using xa_get_order without lock protection, and it may get an outdated order value if the entry is split or changed in other ways after the xa_get_order and before the xa_cmpxchg_irq. And besides, the order could grow and be larger than expected, and cause truncation to erase data beyond the end border. For example, if the target entry and following entries are swapped in or freed, then a large folio was added in place and swapped out, using the same entry, the xa_cmpxchg_irq will still succeed, it's very unlikely to happen though. To fix that, open code the Xarray cmpxchg and put the order retrieval and value checking in the same critical section. Also, ensure the order won't exceed the end border, skip it if the entry goes across the border. Skipping large swap entries crosses the end border is safe here. Shmem truncate iterates the range twice, in the first iteration, find_lock_entries already filtered such entries, and shmem will swapin the entries that cross the end border and partially truncate the folio (split the folio or at least zero part of it). So in the second loop here, if we see a swap entry that crosses the end order, it must at least have its content erased already. I observed random swapoff hangs and kernel panics when stress testing ZSWAP with shmem. After applying this patch, all problems are gone. Link: https://lkml.kernel.org/r/20260120-shmem-swap-fix-v3-1-3d33ebfbc057@tencent.com Fixes: 809bc86517cc ("mm: shmem: support large folio swap out") Signed-off-by: Kairui Song Reviewed-by: Nhat Pham Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Hugh Dickins Cc: Kemeng Shi Cc: Signed-off-by: Andrew Morton commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d Author: Zhang Heng Date: Mon Jan 26 09:49:52 2026 +0800 ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the issue where the internal microphone was not detected. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220983 Cc: stable@vger.kernel.org Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260126014952.3674450-1-zhangheng@kylinos.cn Signed-off-by: Mark Brown commit fcb70a56f4d81450114034b2c61f48ce7444a0e2 Merge: 63804fed149a67 6358461178ca29 Author: Linus Torvalds Date: Mon Jan 26 09:30:48 2026 -0800 Merge tag 'vfs-6.19-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix the the buggy conversion of fuse_reverse_inval_entry() introduced during the creation rework - Disallow nfs delegation requests for directories by setting simple_nosetlease() - Require an opt-in for getting readdir flag bits outside of S_DT_MASK set in d_type - Fix scheduling delayed writeback work by only scheduling when the dirty time expiry interval is non-zero and cancel the delayed work if the interval is set to zero - Use rounded_jiffies_interval for dirty time work - Check the return value of sb_set_blocksize() for romfs - Wait for batched folios to be stable in __iomap_get_folio() - Use private naming for fuse hash size - Fix the stale dentry cleanup to prevent a race that causes a UAF * tag 'vfs-6.19-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: vfs: document d_dispose_if_unused() fuse: shrink once after all buckets have been scanned fuse: clean up fuse_dentry_tree_work() fuse: add need_resched() before unlocking bucket fuse: make sure dentry is evicted if stale fuse: fix race when disposing stale dentries fuse: use private naming for fuse hash size writeback: use round_jiffies_relative for dirtytime_work iomap: wait for batched folios to be stable in __iomap_get_folio romfs: check sb_set_blocksize() return value docs: clarify that dirtytime_expire_seconds=0 disables writeback writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 readdir: require opt-in for d_type flags vboxsf: don't allow delegations to be set on directories ceph: don't allow delegations to be set on directories gfs2: don't allow delegations to be set on directories 9p: don't allow delegations to be set on directories smb/client: properly disallow delegations on directories nfs: properly disallow delegation requests on directories fuse: fix conversion of fuse_reverse_inval_entry() to start_removing() commit 1769f90e5ba2a6d24bb46b85da33fe861c68f005 Author: Carlos Llamas Date: Fri Jan 23 17:57:02 2026 +0000 binder: fix BR_FROZEN_REPLY error log The error logging for failed transactions is misleading as it always reports "dead process or thread" even when the target is actually frozen. Additionally, the pid and tid are reversed which can further confuse debugging efforts. Fix both issues. Cc: stable@kernel.org Cc: Steven Moreland Fixes: a15dac8b2286 ("binder: additional transaction error logs") Signed-off-by: Carlos Llamas Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260123175702.2154348-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit d047248190d86a52164656d47bec9bfba61dc71e Author: Alice Ryhl Date: Fri Jan 23 16:23:56 2026 +0000 rust_binder: add additional alignment checks This adds some alignment checks to match C Binder more closely. This causes the driver to reject more transactions. I don't think any of the transactions in question are harmful, but it's still a bug because it's the wrong uapi to accept them. The cases where usize is changed for u64, it will affect only 32-bit kernels. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20260123-binder-alignment-more-checks-v1-1-7e1cea77411d@google.com Signed-off-by: Greg Kroah-Hartman commit 5e8a3d01544282e50d887d76f30d1496a0a53562 Author: Carlos Llamas Date: Thu Jan 22 18:02:02 2026 +0000 binder: fix UAF in binder_netlink_report() Oneway transactions sent to frozen targets via binder_proc_transaction() return a BR_TRANSACTION_PENDING_FROZEN error but they are still treated as successful since the target is expected to thaw at some point. It is then not safe to access 't' after BR_TRANSACTION_PENDING_FROZEN errors as the transaction could have been consumed by the now thawed target. This is the case for binder_netlink_report() which derreferences 't' after a pending frozen error, as pointed out by the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_netlink_report.isra.0+0x694/0x6c8 Read of size 8 at addr ffff00000f98ba38 by task binder-util/522 CPU: 4 UID: 0 PID: 522 Comm: binder-util Not tainted 6.19.0-rc6-00015-gc03e9c42ae8f #1 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: binder_netlink_report.isra.0+0x694/0x6c8 binder_transaction+0x66e4/0x79b8 binder_thread_write+0xab4/0x4440 binder_ioctl+0x1fd4/0x2940 [...] Allocated by task 522: __kmalloc_cache_noprof+0x17c/0x50c binder_transaction+0x584/0x79b8 binder_thread_write+0xab4/0x4440 binder_ioctl+0x1fd4/0x2940 [...] Freed by task 488: kfree+0x1d0/0x420 binder_free_transaction+0x150/0x234 binder_thread_read+0x2d08/0x3ce4 binder_ioctl+0x488/0x2940 [...] ================================================================== Instead, make a transaction copy so the data can be safely accessed by binder_netlink_report() after a pending frozen error. While here, add a comment about not using t->buffer in binder_netlink_report(). Cc: stable@vger.kernel.org Fixes: 63740349eba7 ("binder: introduce transaction reports via netlink") Signed-off-by: Carlos Llamas Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260122180203.1502637-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 8f589c9c3be539d6c2b393c82940c3783831082f Author: Alice Ryhl Date: Mon Dec 29 15:38:14 2025 +0000 rust_binder: correctly handle FDA objects of length zero Fix a bug where an empty FDA (fd array) object with 0 fds would cause an out-of-bounds error. The previous implementation used `skip == 0` to mean "this is a pointer fixup", but 0 is also the correct skip length for an empty FDA. If the FDA is at the end of the buffer, then this results in an attempt to write 8-bytes out of bounds. This is caught and results in an EINVAL error being returned to userspace. The pattern of using `skip == 0` as a special value originates from the C-implementation of Binder. As part of fixing this bug, this pattern is replaced with a Rust enum. I considered the alternate option of not pushing a fixup when the length is zero, but I think it's cleaner to just get rid of the zero-is-special stuff. The root cause of this bug was diagnosed by Gemini CLI on first try. I used the following prompt: > There appears to be a bug in @drivers/android/binder/thread.rs where > the Fixups oob bug is triggered with 316 304 316 324. This implies > that we somehow ended up with a fixup where buffer A has a pointer to > buffer B, but the pointer is located at an index in buffer A that is > out of bounds. Please investigate the code to find the bug. You may > compare with @drivers/android/binder.c that implements this correctly. Cc: stable@vger.kernel.org Reported-by: DeepChirp Closes: https://github.com/waydroid/waydroid/issues/2157 Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Tested-by: DeepChirp Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20251229-fda-zero-v1-1-58a41cb0e7ec@google.com Signed-off-by: Greg Kroah-Hartman commit 662c9cb86fc322038647d8808e751f5c6c0cc13f Author: Jonas Ringeis Date: Fri Jan 23 23:54:23 2026 +0100 platform/x86: lg-laptop: Recognize 2022-2025 models The lg-laptop driver uses the DMI to identify the product year. Currently, the driver recognizes all models released after 2022 incorrectly as 2022. Update logic to handle model identifiers for years 2022-2025. Link: https://en.wikipedia.org/w/index.php?title=LG_Gram&oldid=1327931565#Comparison_of_Gram_models Signed-off-by: Jonas Ringeis Link: https://patch.msgid.link/20260123225503.493467-1-private@glitchdev.me Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2b4e00d8e70ca8736fda82447be6a4e323c6d1f5 Author: gongqi <550230171hxy@gmail.com> Date: Thu Jan 22 23:55:00 2026 +0800 platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to the AMD PMC. Add it to the quirk list to use the spurious_8042 fix. Signed-off-by: gongqi <550230171hxy@gmail.com> Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com Signed-off-by: Ilpo Järvinen commit 39e9c376ac42705af4ed4ae39eec028e8bced9b4 Author: Kaushlendra Kumar Date: Wed Dec 24 11:41:44 2025 +0530 platform/x86: intel_telemetry: Fix PSS event register mask The PSS telemetry info parsing incorrectly applies TELEM_INFO_SRAMEVTS_MASK when extracting event register count from firmware response. This reads bits 15-8 instead of the correct bits 7-0, causing misdetection of hardware capabilities. The IOSS path correctly uses TELEM_INFO_NENABLES_MASK for register count. Apply the same mask to PSS parsing for consistency. Fixes: 9d16b482b059 ("platform:x86: Add Intel telemetry platform driver") Signed-off-by: Kaushlendra Kumar Link: https://patch.msgid.link/20251224061144.3925519-1-kaushlendra.kumar@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 25e9e322d2ab5c03602eff4fbf4f7c40019d8de2 Author: Kaushlendra Kumar Date: Wed Dec 24 08:50:53 2025 +0530 platform/x86: intel_telemetry: Fix swapped arrays in PSS output The LTR blocking statistics and wakeup event counters are incorrectly cross-referenced during debugfs output rendering. The code populates pss_ltr_blkd[] with LTR blocking data and pss_s0ix_wakeup[] with wakeup data, but the display loops reference the wrong arrays. This causes the "LTR Blocking Status" section to print wakeup events and the "Wakes Status" section to print LTR blockers, misleading power management analysis and S0ix residency debugging. Fix by aligning array usage with the intended output section labels. Fixes: 87bee290998d ("platform:x86: Add Intel Telemetry Debugfs interfaces") Cc: stable@vger.kernel.org Signed-off-by: Kaushlendra Kumar Link: https://patch.msgid.link/20251224032053.3915900-1-kaushlendra.kumar@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 98bdc485b281da7e20e67b13a8cc834956d68e9c Author: David E. Box Date: Wed Jan 21 18:21:08 2026 -0800 platform/x86/intel/vsec: Add Nova Lake PUNIT support Add PCI ID for Nova Lake, supporting PUNIT telemetry. Signed-off-by: David E. Box Link: https://patch.msgid.link/20260122022110.3231344-1-david.e.box@linux.intel.com Signed-off-by: Ilpo Järvinen commit 128497456756e1b952bd5a912cd073836465109d Author: Rafael J. Wysocki Date: Mon Jan 26 16:38:45 2026 +0200 platform/x86: toshiba_haps: Fix memory leaks in add/remove routines toshiba_haps_add() leaks the haps object allocated by it if it returns an error after allocating that object successfully. toshiba_haps_remove() does not free the object pointed to by toshiba_haps before clearing that pointer, so it becomes unreachable allocated memory. Address these memory leaks by using devm_kzalloc() for allocating the memory in question. Fixes: 23d0ba0c908a ("platform/x86: Toshiba HDD Active Protection Sensor") Signed-off-by: Rafael J. Wysocki commit 43b0b7eff4b3fb684f257d5a24376782e9663465 Author: Rafael J. Wysocki Date: Tue Jan 20 16:43:44 2026 +0100 platform/x86: panasonic-laptop: Fix sysfs group leak in error path The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group if platform_device_register_simple() fails for the "panasonic" platform device. Address this by making it call sysfs_remove_group() in that case for the group in question. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ca8dcfedac480e424b8860e3d1394afdcdc550fe Author: Nitin Gote Date: Tue Jan 20 11:17:25 2026 +0530 drm/xe: derive mem copy capability from graphics version Drop .has_mem_copy_instr from the platform descriptors and set it in xe_info_init() after handle_gmdid() populates graphics_verx100. Centralizing the GRAPHICS_VER(xe) >= 20 check keeps MEM_COPY enabled on Xe2+ and removes redundant per-platform plumbing. Bspec: 57561 Fixes: 1e12dbae9d72 ("drm/xe/migrate: support MEM_COPY instruction") Cc: Matt Roper Reviewed-by: Matthew Auld Suggested-by: Matthew Auld Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20260120054724.1982608-2-nitin.r.gote@intel.com Signed-off-by: Tejas Upadhyay (cherry picked from commit 6ef02656c3222b1e12032a40d644ed56806b14fc) Signed-off-by: Thomas Hellström commit 051be49133971076717846e2a04c746ab3476282 Author: Tvrtko Ursulin Date: Fri Jan 16 09:50:40 2026 +0000 drm/xe/xelp: Fix Wa_18022495364 It looks I mistyped CS_DEBUG_MODE2 as CS_DEBUG_MODE1 when adding the workaround. Fix it. Signed-off-by: Tvrtko Ursulin Fixes: ca33cd271ef9 ("drm/xe/xelp: Add Wa_18022495364") Cc: Matt Roper Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: # v6.18+ Reviewed-by: Matt Roper Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20260116095040.49335-1-tvrtko.ursulin@igalia.com (cherry picked from commit 7fe6cae2f7fad2b5166b0fc096618629f9e2ebcb) Signed-off-by: Thomas Hellström commit c73a8917b31e8ddbd53cc248e17410cec27f8f58 Author: Shuicheng Lin Date: Thu Jan 22 21:40:54 2026 +0000 drm/xe: Skip address copy for sync-only execs For parallel exec queues, xe_exec_ioctl() copied the batch buffer address array from userspace without checking num_batch_buffer. If user creates a sync-only exec that doesn't use the address field, the exec will fail with -EFAULT. Add num_batch_buffer check to skip the copy, and the exec could be executed successfully. Here is the sync-only exec: struct drm_xe_exec exec = { .extensions = 0, .exec_queue_id = qid, .num_syncs = 1, .syncs = (uintptr_t)&sync, .address = 0, /* ignored for sync-only */ .num_batch_buffer = 0, /* sync-only */ }; Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260122214053.3189366-2-shuicheng.lin@intel.com (cherry picked from commit 4761791c1e736273d612ff564f318bfbbb04fa4e) Signed-off-by: Thomas Hellström commit 12f15d52d38ac53f7c70ea3d4b3d76afed04e064 Author: Tvrtko Ursulin Date: Fri Jan 23 14:15:40 2026 +0000 drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning: idr_alloc(): ... if (WARN_ON_ONCE(start < 0)) return -EINVAL; ... Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain. Signed-off-by: Tvrtko Ursulin Reported-by: Zhi Wang Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle") Cc: David Francis Cc: Felix Kuehling Cc: Christian König Cc: # v6.18+ Tested-by: Harshit Mogalapalli Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260123141540.76540-1-tvrtko.ursulin@igalia.com commit 41399c5d476156635c9a58de870d39318e22fa09 Author: Guodong Xu Date: Thu Jan 22 17:43:42 2026 +0800 regulator: spacemit-p1: Fix n_voltages for BUCK and LDO regulators Higher voltage settings were unusable due to incorrect n_voltages values causing registration failures. For example, setting aldo4 to 3.3V failed with -EINVAL because the required selector (123) exceeded the allowed range (n_voltages=117). Fix by aligning n_voltages with the hardware register widths per the P1 datasheet [1]: - BUCK: 255 (was 254), allows selectors 0-254, selector 255 is reserved - LDO: 128 (was 117), allows selectors 0-127, selectors 0-10 are for suspend mode, valid operational range is 11-127 This enables the full voltage range supported by the hardware. Fixes: 8b84d712ad84 ("regulator: spacemit: support SpacemiT P1 regulators") Link: https://developer.spacemit.com/documentation [1] Signed-off-by: Guodong Xu Link: https://patch.msgid.link/20260122-spacemit-p1-v1-1-309be27fbff9@riscstar.com Signed-off-by: Mark Brown commit 403a0591be681eebc0c4825f8b42afe7fd13ee7f Author: Bard Liao Date: Fri Jan 23 19:38:09 2026 +0800 ASoC: soc-acpi-intel-ptl-match: fix name_prefix of rt1320-2 rt1320_2_group2_adr works with rt1320_1_group2_adr and the name_prefix should be rt1320-2. Fixes: ffe450cb6bce ("ASoC: Intel: soc-acpi-intel-ptl-match: add rt713_vb_l3_rt1320_l12 support") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20260123113809.2238766-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 9e18920e783d0bcd4c127a7adc66565243ab9655 Author: Zhang Heng Date: Mon Jan 26 15:35:08 2026 +0800 ALSA: hda/realtek: Add quirk for Inspur S14-G1 Inspur S14-G1 is equipped with ALC256. Enable "power saving mode" and Enable "headset jack mode". Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260126073508.3897461-2-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 891b77d459d0ce993c68365d899134bc9fd47ac0 Author: Zhang Heng Date: Mon Jan 26 15:35:07 2026 +0800 ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine The HP EliteBook 630 G11 (103c:8c8f) is using ALC236 codec which used 0x02 to control mute LED and 0x01 to control micmute LED. Therefore, add a quirk to make it works. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220828 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260126073508.3897461-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 28a12ef366ecb118db19b92120a07b0491c1958e Author: Andreas Schwab Date: Sun Jan 25 21:09:04 2026 -0700 errata/sifive: remove unreliable warn_miss_errata When both the SiFive and MIPS errata are enabled then sifive_errata_patch_func emits a wrong and misleading warning claiming that the SiFive errata haven't been applied. This happens because sifive_errata_patch_func is being called twice, once for the kernel image and once for the vdso image. The vdso image has alternative entries for the MIPS errata, but none for the SiFive errata. Signed-off-by: Andreas Schwab Link: https://patch.msgid.link/mvmv7i8q8gg.fsf@suse.de Signed-off-by: Paul Walmsley commit 494d4a051c3bfc79b847a46bdc52a2473d27b3b0 Author: Austin Kim Date: Sun Jan 25 21:08:59 2026 -0700 riscv: fix minor typo in syscall.h comment Some developers may be confused because RISC-V does not have a register named r0. Also, orig_r0 is not available in pt_regs structure, which is specific to riscv. So we had better fix this minor typo. Signed-off-by: Austin Kim Link: https://patch.msgid.link/aW3Z4zTBvGJpk7a7@adminpc-PowerEdge-R7525 Signed-off-by: Paul Walmsley commit ba89709a3610ba27a2eef2e127f3f4fc5b64d5f7 Author: Paul Walmsley Date: Sun Jan 25 21:08:53 2026 -0700 riscv: signal: fix some warnings reported by sparse Clean up a few warnings reported by sparse in arch/riscv/kernel/signal.c. These come from code that was added recently; they were missed when I initially reviewed the patch. Fixes: 818d78ba1b3f ("riscv: signal: abstract header saving for setup_sigcontext") Cc: Andy Chiu Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601171848.ydLTJYrz-lkp@intel.com/ [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley commit 5016cae970d7d59d62aa4f6f11455a9e9630dd1c Author: Shivam Kalra Date: Fri Jan 23 18:51:13 2026 +0530 rust: num: bounded: clean __new documentation and comments Following commit 3a1ec424dd9c ("rust: num: bounded: mark __new as unsafe"), remove the redundant paragraph in the documentation of __new now that the Safety section explicitly covers the requirement. Additionally, add an INVARIANT comment inside the function body where the Bounded instance is actually constructed to document that the type invariant is upheld. Suggested-by: Miguel Ojeda Link: https://lore.kernel.org/rust-for-linux/CANiq72mUCUh72BWP4eD1PTDpwdb1ML+Xgfom-Ys6thJooqQPwQ@mail.gmail.com/ Signed-off-by: Shivam Kalra Acked-by: Alexandre Courbot Link: https://patch.msgid.link/20260123132132.53854-1-shivamklr@cock.li [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 473dd9ecb3fd139ffebd6f7a9f73fb73d85fe2aa Author: Shawn Guo Date: Wed Jan 21 22:20:47 2026 +0800 MAINTAINERS: Replace Shawn with Frank as i.MX platform maintainer Shawn is no longer interested in maintaining i.MX platform, and would like to step down. On the other hand, Frank seems to be the best successor for this role. - He has been one of the most outstanding contributors to i.MX platform in the recent years. - He has been actively working as a co-maintainer reviewing i.MX patches and keep the platform support in good shape. - He works for NXP and could be the bridge and coordinator between NXP internal developers and community contributors. Acked-by: Peng Fan Acked-by: Daniel Baluta Reviewed-by: Fabio Estevam Acked-by: Dong Aisheng Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit e440bc5c190cd0e5f148b2892aeb1f4bbbf54507 Author: SeungJong Ha Date: Fri Jan 23 13:18:44 2026 +0000 scripts: generate_rust_analyzer: fix resolution of #[pin_data] macros Currently, rust-analyzer fails to properly resolve structs annotated with `#[pin_data]`. This prevents IDE features like "Go to Definition" from working correctly for those structs. Add the missing configuration to `generate_rust_analyzer.py` to ensure the `pin-init` crate macros are handled correctly. Signed-off-by: SeungJong Ha Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure") Cc: stable@vger.kernel.org Tested-by: Tamir Duberstein Acked-by: Tamir Duberstein Acked-by: Gary Guo Reviewed-by: Jesung Yang Link: https://patch.msgid.link/20260123-fix-pin-init-crate-dependecies-v2-1-bb1c2500e54c@gmail.com Signed-off-by: Miguel Ojeda commit b0581f6ab952ffd135ca4402d2ee3da641538d6b Author: Miguel Ojeda Date: Sat Jan 24 17:09:48 2026 +0100 drm/tyr: depend on `COMMON_CLK` to fix build error Tyr needs `CONFIG_COMMON_CLK` to build: error[E0432]: unresolved import `kernel::clk::Clk` --> drivers/gpu/drm/tyr/driver.rs:3:5 | 3 | use kernel::clk::Clk; | ^^^^^^^^^^^^^^^^ no `Clk` in `clk` error[E0432]: unresolved import `kernel::clk::OptionalClk` --> drivers/gpu/drm/tyr/driver.rs:4:5 | 4 | use kernel::clk::OptionalClk; | ^^^^^^^^^^^^^^^^^^^^^^^^ no `OptionalClk` in `clk` Thus add the dependency to fix it. Fixes: cf4fd52e3236 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs") Cc: stable@vger.kernel.org Acked-by: Alice Ryhl Link: https://patch.msgid.link/20260124160948.67508-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit bd36f6e2abf7f85644f7ea8deb1de4040b03bbc1 Author: Miguel Ojeda Date: Sat Jan 24 00:34:32 2026 +0100 rust: sync: atomic: Provide stub for `rusttest` 32-bit hosts For arm32, on a x86_64 builder, running the `rusttest` target yields: error[E0080]: evaluation of constant value failed --> rust/kernel/static_assert.rs:37:23 | 37 | const _: () = ::core::assert!($condition $(,$arg)?); | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the evaluated program panicked at 'assertion failed: size_of::() == size_of::()', rust/kernel/sync/atomic/predefine.rs:68:1 | ::: rust/kernel/sync/atomic/predefine.rs:68:1 | 68 | static_assert!(size_of::() == size_of::()); | -------------------------------------------------------------------- in this macro invocation | = note: this error originates in the macro `::core::assert` which comes from the expansion of the macro `static_assert` (in Nightly builds, run with -Z macro-backtrace for more info) The reason is that `rusttest` runs on the host, so for e.g. a x86_64 builder `isize` is 64 bits but it is not a `CONFIG_64BIT` build. Fix it by providing a stub for `rusttest` as usual. Fixes: 84c6d36bcaf9 ("rust: sync: atomic: Add Atomic<{usize,isize}>") Cc: stable@vger.kernel.org Reviewed-by: Onur Özkan Acked-by: Boqun Feng Link: https://patch.msgid.link/20260123233432.22703-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 709bbb015538dfd5c97308b77c950d41a4d95cd3 Author: David Yang Date: Fri Jan 23 01:05:09 2026 +0800 net: dsa: yt921x: Fix MIB overflow wraparound routine Reported by the following Smatch static checker warning: drivers/net/dsa/yt921x.c:702 yt921x_read_mib() warn: was expecting a 64 bit value instead of '(~0)' Fixes: 186623f4aa72 ("net: dsa: yt921x: Add support for Motorcomm YT921x") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/netdev/aPsjYKQMzpY0nSXm@stanley.mountain/ Suggested-by: David Laight Signed-off-by: David Yang Link: https://patch.msgid.link/20260122170512.2713738-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit ca12c4a155ebf84e9ef29b05ce979bc89364290f Author: Zeng Chi Date: Fri Jan 23 16:57:49 2026 +0800 net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() The function mlx5_esw_vport_vhca_id() is declared to return bool, but returns -EOPNOTSUPP (-45), which is an int error code. This causes a signedness bug as reported by smatch. This patch fixes this smatch report: drivers/net/ethernet/mellanox/mlx5/core/eswitch.h:981 mlx5_esw_vport_vhca_id() warn: signedness bug returning '(-45)' Fixes: 1baf30426553 ("net/mlx5: E-Switch, Set/Query hca cap via vhca id") Reviewed-by: Parav Pandit Signed-off-by: Zeng Chi Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260123085749.1401969-1-zeng_chi911@163.com Signed-off-by: Jakub Kicinski commit f0813bcd2d9d97fdbdf2efb9532ab03ae92e99e6 Author: Kery Qi Date: Fri Jan 23 01:04:01 2026 +0800 net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without checking if the number of fragments has exceeded MAX_SKB_FRAGS. This could lead to a buffer overflow in skb_shinfo(skb)->frags[] array, corrupting adjacent memory and potentially causing kernel crashes or other undefined behavior. This issue was identified through static code analysis by comparing with a similar vulnerability fixed in the mt76 driver commit b102f0c522cf ("mt76: fix array overflow on receiving too many fragments for a packet"). The vulnerability could be triggered if the modem firmware sends packets with excessive fragments. While under normal protocol conditions (MTU 3080 bytes, BAT buffer 3584 bytes), a single packet should not require additional fragments, the kernel should not blindly trust firmware behavior. Malicious, buggy, or compromised firmware could potentially craft packets with more fragments than the kernel expects. Fix this by adding a bounds check before calling skb_add_rx_frag() to ensure nr_frags does not exceed MAX_SKB_FRAGS. The check must be performed before unmapping to avoid a page leak and double DMA unmap during device teardown. Fixes: d642b012df70a ("net: wwan: t7xx: Add data path interface") Signed-off-by: Kery Qi Link: https://patch.msgid.link/20260122170401.1986-2-qikeyu2017@gmail.com Signed-off-by: Jakub Kicinski commit 63804fed149a6750ffd28610c5c1c98cce6bd377 Author: Linus Torvalds Date: Sun Jan 25 14:11:24 2026 -0800 Linux 6.19-rc7 commit 1742272bd3fae6362301d0f11eb9db9030348afc Author: Fernando Fernandez Mancera Date: Wed Jan 21 20:44:09 2026 +0100 selftests: net: add ipv6 ping to local address from localhost Test ipv6 pinging to local configured address and linklocal address from localhost with -I ::1. Signed-off-by: Fernando Fernandez Mancera Reviewed-by: David Ahern Link: https://patch.msgid.link/20260121194409.6749-2-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 03cbcdf93866e61beb0063392e6dbb701f03aea2 Author: Fernando Fernandez Mancera Date: Wed Jan 21 20:44:08 2026 +0100 ipv6: use the right ifindex when replying to icmpv6 from localhost When replying to a ICMPv6 echo request that comes from localhost address the right output ifindex is 1 (lo) and not rt6i_idev dev index. Use the skb device ifindex instead. This fixes pinging to a local address from localhost source address. $ ping6 -I ::1 2001:1:1::2 -c 3 PING 2001:1:1::2 (2001:1:1::2) from ::1 : 56 data bytes 64 bytes from 2001:1:1::2: icmp_seq=1 ttl=64 time=0.037 ms 64 bytes from 2001:1:1::2: icmp_seq=2 ttl=64 time=0.069 ms 64 bytes from 2001:1:1::2: icmp_seq=3 ttl=64 time=0.122 ms 2001:1:1::2 ping statistics 3 packets transmitted, 3 received, 0% packet loss, time 2032ms rtt min/avg/max/mdev = 0.037/0.076/0.122/0.035 ms Fixes: 1b70d792cf67 ("ipv6: Use rt6i_idev index for echo replies to a local address") Signed-off-by: Fernando Fernandez Mancera Reviewed-by: David Ahern Link: https://patch.msgid.link/20260121194409.6749-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit 09f979d1f312627b31d2ee1e46f9692e442610cd Author: Zilin Guan Date: Fri Jan 23 06:57:16 2026 +0000 net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() In mvpp2_ethtool_cls_rule_ins(), the ethtool_rule is allocated by ethtool_rx_flow_rule_create(). If the subsequent conversion to flow type fails, the function jumps to the clean_rule label. However, the clean_rule label only frees efs, skipping the cleanup of ethtool_rule, which leads to a memory leak. Fix this by jumping to the clean_eth_rule label, which properly calls ethtool_rx_flow_rule_destroy() before freeing efs. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: f4f1ba18195d ("net: mvpp2: cls: Report an error for unsupported flow types") Signed-off-by: Zilin Guan Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20260123065716.2248324-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 944c614b0a7afa5b87612c3fb557b95a50ad654c Author: Edward Cree Date: Fri Jan 23 16:16:34 2026 +0000 sfc: fix deadlock in RSS config read Since cited commit, core locks the net_device's rss_lock when handling ethtool -x command, so driver's implementation should not lock it again. Remove the latter. Fixes: 040cef30b5e6 ("net: ethtool: move get_rxfh callback under the rss_lock") Reported-by: Damir Mansurov Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126015 Suggested-by: Ben Hutchings Signed-off-by: Edward Cree Link: https://patch.msgid.link/20260123161634.1215006-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit f66f5c212e7407fda7b7ce864f94420c46b086cb Merge: f6c3665b6dc53c 494fc029f662c3 Author: Jakub Kicinski Date: Sun Jan 25 13:01:15 2026 -0800 Merge tag 'linux-can-fixes-for-6.19-20260123' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-01-23 The first patch is by Zilin Guan and fixes a memory leak in the error path of the at91_can driver's probe function. The last patch is by me and fixes yet another error in the gs_usb's gs_usb_receive_bulk_callback() function. * tag 'linux-can-fixes-for-6.19-20260123' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: gs_usb: gs_usb_receive_bulk_callback(): fix error message can: at91_can: Fix memory leak in at91_can_probe() ==================== Link: https://patch.msgid.link/20260123173241.1026226-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 0237777974728cc5a6f45347b7eca473ab6ef90a Merge: f9e6e6d210669f 19bc5f2a6962df Author: Linus Torvalds Date: Sun Jan 25 12:06:15 2026 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Only one core change, the rest are drivers. The core change reorders some state operations in the error handler to try to prevent missed wake ups of the error handler (which can halt error processing and effectively freeze the entire system)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qla2xxx: Sanitize payload size to prevent member overflow scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() scsi: core: Wake up the error handler when final completions race against each other scsi: storvsc: Process unsupported MODE_SENSE_10 scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() commit f9e6e6d210669f24697e615b68b5abbae9d7a32e Merge: 0a6dce0a5c66ab 6342969dafbc63 Author: Linus Torvalds Date: Sun Jan 25 10:06:23 2026 -0800 Merge tag 'keys-trusted-next-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull keys fix from Jarkko Sakkinen. * tag 'keys-trusted-next-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal commit 0a6dce0a5c66ab2cb3e9f01902e5b188ada8a89d Merge: 11de40c03cf0f8 88da5f4b46f557 Author: Linus Torvalds Date: Sun Jan 25 09:57:31 2026 -0800 Merge tag 'char-misc-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/iio driver fixes from Greg KH: "Here are some small char/misc/iio and some other minor driver subsystem fixes for 6.19-rc7. Nothing huge here, just some fixes for reported issues including: - lots of little iio driver fixes - comedi driver fixes - mux driver fix - w1 driver fixes - uio driver fix - slimbus driver fixes - hwtracing bugfix - other tiny bugfixes All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits) comedi: dmm32at: serialize use of paged registers mei: trace: treat reg parameter as string uio: pci_sva: correct '-ENODEV' check logic uacce: ensure safe queue release with state management uacce: implement mremap in uacce_vm_ops to return -EPERM uacce: fix isolate sysfs check condition uacce: fix cdev handling in the cleanup path slimbus: core: clean up of_slim_get_device() slimbus: core: fix of_slim_get_device() kernel doc slimbus: core: amend slim_get_device() kernel doc slimbus: core: fix device reference leak on report present slimbus: core: fix runtime PM imbalance on report present slimbus: core: fix OF node leak on registration failure intel_th: rename error label intel_th: fix device leak on output open() comedi: Fix getting range information for subdevices 16 to 255 mux: mmio: Fix IS_ERR() vs NULL check in probe() interconnect: debugfs: initialize src_node and dst_node to empty strings iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source iio: accel: iis328dq: fix gain values ... commit 11de40c03cf0f84466f517cc4d58f02ff1ba30be Merge: 913fb068e25907 32f37e57583f86 Author: Linus Torvalds Date: Sun Jan 25 09:53:28 2026 -0800 Merge tag 'tty-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are three small serial driver fixes for 6.19-rc7 that resolve some reported issues. They include: - tty->port race condition fix for a reported problem - qcom_geni serial driver fix - 8250_pci serial driver fix All of these have been in linux-next with no reported issues" * tag 'tty-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: Fix not set tty->port race condition serial: 8250_pci: Fix broken RS485 for F81504/508/512 serial: qcom_geni: Fix BT failure regression on RB2 platform commit 913fb068e259079bf9564c9e84ff9e65c37dcac7 Merge: c1a5135e60f1a0 e6e09d34118477 Author: Linus Torvalds Date: Sun Jan 25 09:47:30 2026 -0800 Merge tag 'i2c-for-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: - k1: drop wrong IRQF_ONESHOT from IRQ request to fix genirq warning * tag 'i2c-for-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: spacemit: drop IRQF_ONESHOT flag from IRQ request commit c1a5135e60f1a026f135c6b0964cc8f4e1c4a8bb Merge: d91a46d6805af4 19a5d9ba6208e9 Author: Linus Torvalds Date: Sun Jan 25 09:42:25 2026 -0800 Merge tag 'input-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a couple of quirks to i8042 to enable keyboard on a Asus and MECHREVO laptops * tag 'input-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: i8042 - add quirks for MECHREVO Wujie 15X Pro Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA commit 6342969dafbc63597cfc221aa13c3b123c2800c5 Author: Srish Srinivasan Date: Fri Jan 23 22:25:03 2026 +0530 keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal TPM2_Unseal[1] expects the handle of a loaded data object, and not the handle of the parent key. But the tpm2_unseal_cmd provides the parent keyhandle instead of blob_handle for the session HMAC calculation. This causes unseal to fail. Fix this by passing blob_handle to tpm_buf_append_name(). References: [1] trustedcomputinggroup.org/wp-content/uploads/ Trusted-Platform-Module-2.0-Library-Part-3-Version-184_pub.pdf Fixes: 6e9722e9a7bf ("tpm2-sessions: Fix out of range indexing in name_size") Signed-off-by: Srish Srinivasan Reviewed-by: Stefan Berger Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 19a5d9ba6208e9006a2a9d5962aea4d6e427d8ab Author: gongqi <550230171hxy@gmail.com> Date: Thu Jan 22 23:54:59 2026 +0800 Input: i8042 - add quirks for MECHREVO Wujie 15X Pro The MECHREVO Wujie 15X Pro requires several i8042 quirks to function correctly. Specifically, NOMUX, RESET_ALWAYS, NOLOOP, and NOPNP are needed to ensure the keyboard and touchpad work reliably. Signed-off-by: gongqi <550230171hxy@gmail.com> Link: https://patch.msgid.link/20260122155501.376199-3-550230171hxy@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 2934325f56150ad8dab8ab92cbe2997242831396 Author: feng Date: Sat Jan 24 21:44:12 2026 -0800 Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA The ASUS Zenbook UX425QA_UM425QA fails to initialize the keyboard after a cold boot. A quirk already exists for "ZenBook UX425", but some Zenbooks report "Zenbook" with a lowercase 'b'. Since DMI matching is case-sensitive, the existing quirk is not applied to these "extra special" Zenbooks. Testing confirms that this model needs the same quirks as the ZenBook UX425 variants. Signed-off-by: feng Link: https://patch.msgid.link/20260122013957.11184-1-alec.jiang@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit d91a46d6805af41e7f2286e0fc22d498f45a682b Merge: d04ed417d20a79 841e47d56cef9b Author: Linus Torvalds Date: Sat Jan 24 18:55:48 2026 -0800 Merge tag 'riscv-for-linus-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "The notable changes here are the three RISC-V timer compare register update sequence patches. These only apply to RV32 systems and are related to the 64-bit timer compare value being split across two separate 32-bit registers. We weren't using the appropriate three-write sequence, documented in the RISC-V ISA specifications, to avoid spurious timer interrupts during the update sequence; so, these patches now use the recommended sequence. This doesn't affect 64-bit RISC-V systems, since the timer compare value fits inside a single register and can be updated with a single write. - Fix the RISC-V timer compare register update sequence on RV32 systems to use the recommended sequence in the RISC-V ISA manual This avoids spurious interrupts during updates - Add a dependence on the new CONFIG_CACHEMAINT_FOR_DMA Kconfig symbol for Renesas and StarFive RISC-V SoCs - Add a temporary workaround for a Clang compiler bug caused by using asm_goto_output for get_user() - Clarify our documentation to specifically state a particular ISA specification version for a chapter number reference" * tag 'riscv-for-linus-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Add intermediate cast to 'unsigned long' in __get_user_asm riscv: Use 64-bit variable for output in __get_user_asm soc: renesas: Fix missing dependency on new CONFIG_CACHEMAINT_FOR_DMA riscv: ERRATA_STARFIVE_JH7100: Fix missing dependency on new CONFIG_CACHEMAINT_FOR_DMA riscv: suspend: Fix stimecmp update hazard on RV32 riscv: kvm: Fix vstimecmp update hazard on RV32 riscv: clocksource: Fix stimecmp update hazard on RV32 Documentation: riscv: uabi: Clarify ISA spec version for canonical order commit d04ed417d20a79c111a7d8fef005ae9fe1e73b38 Merge: b83a8ff87a0c10 2ccb5e8dbcd2de Author: Linus Torvalds Date: Sat Jan 24 18:43:52 2026 -0800 Merge tag 'ntb-6.19-bugfixes' of https://github.com/jonmason/ntb Pull NTB fix from Jon Mason: "Bug fix for uninitialized mutex in ntb transport" * tag 'ntb-6.19-bugfixes' of https://github.com/jonmason/ntb: ntb: transport: Fix uninitialized mutex commit b83a8ff87a0c10c1d86eb7f96e14009d91fae024 Merge: 102606402f4f59 361eb853c65528 Author: Linus Torvalds Date: Sat Jan 24 17:18:57 2026 -0800 Merge tag 'trace-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix a crash with passing a stacktrace between synthetic events A synthetic event is an event that combines two events into a single event that can display fields from both events as well as the time delta that took place between the events. It can also pass a stacktrace from the first event so that it can be displayed by the synthetic event (this is useful to get a stacktrace of a task scheduling out when blocked and recording the time it was blocked for). A synthetic event can also connect an existing synthetic event to another event. An issue was found that if the first synthetic event had a stacktrace as one of its fields, and that stacktrace field was passed to the new synthetic event to be displayed, it would crash the kernel. This was due to the stacktrace not being saved as a stacktrace but was still marked as one. When the stacktrace was read, it would try to read an array but instead read the integer metadata of the stacktrace and dereferenced a bad value. Fix this by saving the stacktrace field as a stacktrace. - Fix possible overflow in cmp_mod_entry() compare function A binary search is used to find a module address and if the addresses are greater than 2GB apart it could lead to truncation and cause a bad search result. Use normal compares instead of a subtraction between addresses to calculate the compare value. - Fix output of entry arguments in function graph tracer Depending on the configurations enabled, the entry can be two different types that hold the argument array. The macro FGRAPH_ENTRY_ARGS() is used to find the correct arguments from the given type. One location was missed and still referenced the arguments directly via entry->args and could produce the wrong value depending on how the kernel was configured. - Fix memory leak in scripts/tracepoint-update build tool If the array fails to allocate, the memory for the values needs to be freed and was not. Free the allocated values if the array failed to allocate. * tag 'trace-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: scripts/tracepoint-update: Fix memory leak in add_string() on failure function_graph: Fix args pointer mismatch in print_graph_retval() tracing: Avoid possible signed 64-bit truncation tracing: Fix crash on synthetic stacktrace field usage commit 102606402f4f5943266160e263c450fdfe4dd981 Author: Dan Williams Date: Fri Jan 23 17:22:56 2026 -0800 Documentation: Project continuity Document project continuity procedures. This is a plan for a plan for navigating events that affect the forward progress of the canonical Linux repository, torvalds/linux.git. It is a follow-up from Maintainer Summit [1]. Co-developed-by: Jonathan Corbet Signed-off-by: Jonathan Corbet Reviewed-by: Greg Kroah-Hartman Reviewed-by: Miguel Ojeda Reviewed-by: Kees Cook Reviewed-by: Jiri Kosina Reviewed-by: Steven Rostedt Link: https://lwn.net/Articles/1050179/ [1] Signed-off-by: Dan Williams Signed-off-by: Linus Torvalds commit 5dbeeb268b63ea2d9795b3e5e8ffb48c236f5bb0 Merge: 12a0094839d095 a995fe1a3aa78b Author: Linus Torvalds Date: Sat Jan 24 10:13:22 2026 -0800 Merge tag 'driver-core-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Always inline I/O and IRQ methods using build_assert!() to avoid false positive build errors - Do not free the driver's device private data in I2C shutdown() avoiding race conditions that can lead to UAF bugs - Drop the driver's device private data after the driver has been fully unbound from its device to avoid UAF bugs from &Device scopes, such as IRQ callbacks * tag 'driver-core-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: driver: drop device private data post unbind rust: driver: add DriverData type to the DriverLayout trait rust: driver: add DEVICE_DRIVER_OFFSET to the DriverLayout trait rust: driver: introduce a DriverLayout trait rust: auxiliary: add Driver::unbind() callback rust: i2c: do not drop device private data on shutdown() rust: irq: always inline functions using build_assert with arguments rust: io: always inline functions using build_assert with arguments commit 12a0094839d095e6cfd23dc5f5336d260a363331 Merge: af5a3fae860df6 c06343be0b4e03 Author: Linus Torvalds Date: Sat Jan 24 09:36:03 2026 -0800 Merge tag 'timers-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Ingo Molnar: - Fix auxiliary timekeeper update & locking bug - Reduce the sensitivity of the clocksource watchdog, to fix false positive measurements that marked the TSC clocksource unstable * tag 'timers-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Reduce watchdog readout delay limit to prevent false positives timekeeping: Adjust the leap state for the correct auxiliary timekeeper commit af5a3fae860df6d065d796810a3e3a03fbb6f895 Merge: ceaeaf66a21f87 15257cc2f905db Author: Linus Torvalds Date: Sat Jan 24 09:29:41 2026 -0800 Merge tag 'sched-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix PELT clock synchronization bug when entering idle - Disable the NEXT_BUDDY feature, as during extensive testing Mel found that the negatives outweigh the positives - Make wakeup preemption less aggressive, which resulted in an unreasonable increase in preemption frequency * tag 'sched-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Revert force wakeup preemption sched/fair: Disable scheduler feature NEXT_BUDDY sched/fair: Fix pelt clock sync when entering idle commit ceaeaf66a21f87febed73ec2051f9384390efe2f Merge: dc67a355058087 91dcfae0ff2b9b Author: Linus Torvalds Date: Sat Jan 24 09:24:17 2026 -0800 Merge tag 'perf-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fixes from Ingo Molnar: - Fix mmap_count warning & bug when creating a group member event with the PERF_FLAG_FD_OUTPUT flag - Disable the sample period == 1 branch events BTS optimization on guests, because BTS is not virtualized * tag 'perf-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Do not enable BTS for guests perf: Fix refcount warning on event->mmap_count increment commit dc67a355058087792abd4e7fd9af22ef4a86cefe Merge: 4fc8d3fcb98881 3f2de814c0597c Author: Linus Torvalds Date: Sat Jan 24 09:22:09 2026 -0800 Merge tag 'objtool-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Ingo Molnar: "Fix objtool build error in non-standard static library build environments" * tag 'objtool-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Fix libopcodes linking with static libraries commit 4fc8d3fcb9888166456ffd6f68f4b77c6a3a52d4 Merge: 4a51fe919b06cb 8d76a7d89c12d0 Author: Linus Torvalds Date: Sat Jan 24 09:15:25 2026 -0800 Merge tag 'irq-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: - Fix spurious interrupts during resume in the renesas-rzv2h driver - Fix a 32+ bit physical memory truncation bug in the gic-v3-its driver * tag 'irq-urgent-2026-01-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Avoid truncating memory addresses irqchip/renesas-rzv2h: Prevent TINT spurious interrupt during resume commit 4a51fe919b06cb33ab5834600b501058e944f42b Merge: 62085877ae6592 e89f0e9a0a007e Author: Linus Torvalds Date: Sat Jan 24 09:02:56 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull arm64 kvm fixes from Paolo Bonzini: - Ensure early return semantics are preserved for pKVM fault handlers - Fix case where the kernel runs with the guest's PAN value when CONFIG_ARM64_PAN is not set - Make stage-1 walks to set the access flag respect the access permission of the underlying stage-2, when enabled - Propagate computed FGT values to the pKVM view of the vCPU at vcpu_load() - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page tables - Check that the VM is actually using VGICv3 before accessing the GICv3 CPU interface - Delete some unused code * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: arm64: Invert KVM_PGTABLE_WALK_HANDLE_FAULT to fix pKVM walkers KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps() KVM: arm64: Remove unused parameter in synchronize_vcpu_pstate() KVM: arm64: Remove extra argument for __pvkm_host_{share,unshare}_hyp() KVM: arm64: Inject UNDEF for a register trap without accessor KVM: arm64: Copy FGT traps to unprotected pKVM VCPU on VCPU load KVM: arm64: Fix EL2 S1 XN handling for hVHE setups KVM: arm64: gic: Check for vGICv3 when clearing TWI commit e6e09d34118477fa3cb4dcea330ba2f6c5bdaf4d Merge: 24d479d26b25bc e351836a54e3b0 Author: Wolfram Sang Date: Sat Jan 24 12:56:53 2026 +0100 Merge tag 'i2c-host-fixes-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.19-rc7 k1: drop IRQF_ONESHOT from IRQ request to fix genirq warning. commit 1aaedafb21f38cb872d44f7608b4828a1e14e795 Author: Werner Sembach Date: Fri Jan 23 23:12:24 2026 +0100 ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. Add a PCI quirk to enable microphone detection on the headphone jack of TongFang X6AR55xU devices. The former quirk entry did not acomplish this and is removed. Fixes: b48fe9af1e60 ("ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU") Signed-off-by: Tim Guttzeit Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260123221233.28273-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit e89f0e9a0a007e8c3afb8ecd739c0b3255422b00 Merge: 24d479d26b25bc 19cffd16ed6489 Author: Paolo Bonzini Date: Sat Jan 24 08:42:14 2026 +0100 Merge tag 'kvmarm-fixes-6.19-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.19 - Ensure early return semantics are preserved for pKVM fault handlers - Fix case where the kernel runs with the guest's PAN value when CONFIG_ARM64_PAN is not set - Make stage-1 walks to set the access flag respect the access permission of the underlying stage-2, when enabled - Propagate computed FGT values to the pKVM view of the vCPU at vcpu_load() - Correctly program PXN and UXN privilege bits for hVHE's stage-1 page tables - Check that the VM is actually using VGICv3 before accessing the GICv3 CPU interface - Delete some unused code commit 0444568edbf87c1da76b61c798ce0f1c1e478467 Author: Ajay Neeli Date: Wed Dec 24 11:09:50 2025 +0530 scsi: ufs: amd-versal2: Fix PHY initialization in HCE enable notify Move the PHY initialization from PRE_CHANGE to POST_CHANGE in the ufs_versal2_hce_enable_notify() callback. This ensures that the PHY is initialized after the host controller enable sequence is complete, rather than before it starts. The PHY initialization requires the UFS host controller to be in a stable enabled state to properly configure the MPHY registers. Moving this to POST_CHANGE aligns with the expected initialization order and prevents potential timing issues during controller startup. Fixes: 769b8b2ffded ("scsi: ufs: amd-versal2: Add UFS support for AMD Versal Gen 2 SoC") Signed-off-by: Ajay Neeli Link: https://patch.msgid.link/20251224053950.54213-1-ajay.neeli@amd.com Signed-off-by: Martin K. Petersen commit b2d6b1d443009ed4da2d69f5423ab38e5780505a Author: Kery Qi Date: Wed Jan 21 19:45:15 2026 +0800 scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of "tpg->tport_tpgt" is u16. This causes a type truncation issue. When a user creates a TPG via configfs mkdir, for example: mkdir /sys/kernel/config/target/sbp//tpgt_70000 The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt, the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the value the user specified to differ from what is actually stored, leading to confusion and potential unexpected behavior. Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which will properly reject values outside the u16 range. Fixes: a511ce339780 ("sbp-target: Initial merge of firewire/ieee-1394 target mode support") Signed-off-by: Kery Qi Link: https://patch.msgid.link/20260121114515.1829-2-qikeyu2017@gmail.com Signed-off-by: Martin K. Petersen commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f Author: Haoxiang Li Date: Sat Dec 13 16:36:43 2025 +0800 scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() If nonemb_cmd->va fails to be allocated, free the allocation previously made by alloc_mcc_wrb(). Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Martin K. Petersen commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 Author: Thomas Fourier Date: Mon Jan 12 14:43:24 2026 +0100 scsi: qla2xxx: edif: Fix dma_free_coherent() size Earlier in the function, the ha->flt buffer is allocated with size sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error path with size SFP_DEV_SIZE. Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit dedb897f11c5d7e32c0e0a0eff7cec23a8047167 Author: Johan Hovold Date: Sun Dec 21 17:45:52 2025 +0100 drm/msm/a6xx: fix bogus hwcg register updates The hw clock gating register sequence consists of register value pairs that are written to the GPU during initialisation. The a690 hwcg sequence has two GMU registers in it that used to amount to random writes in the GPU mapping, but since commit 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets") they trigger a fault as the updated offsets now lie outside the mapping. This in turn breaks boot of machines like the Lenovo ThinkPad X13s. Note that the updates of these GMU registers is already taken care of properly since commit 40c297eb245b ("drm/msm/a6xx: Set GMU CGC properties on a6xx too"), but for some reason these two entries were left in the table. Fixes: 5e7665b5e484 ("drm/msm/adreno: Add Adreno A690 support") Cc: stable@vger.kernel.org # 6.5 Cc: Bjorn Andersson Cc: Konrad Dybcio Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Reviewed-by: Akhil P Oommen Fixes: 188db3d7fe66 ("drm/msm/a6xx: Rebase GMU register offsets") Patchwork: https://patchwork.freedesktop.org/patch/695778/ Message-ID: <20251221164552.19990-1-johan@kernel.org> Signed-off-by: Rob Clark (cherry picked from commit dcbd2f8280eea2c965453ed8c3c69d6f121e950b) commit 62085877ae6592be830c2267e35dc469cb706308 Merge: 3a622041d78bb0 baaecfcac559bc Author: Linus Torvalds Date: Fri Jan 23 14:58:51 2026 -0800 Merge tag 'kbuild-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull kbuild fixes from Nicolas Schier: - Reduce possible complications when cross-compiling by increasing use of ${NM} in check-function-names.sh - Fix static linking of nconf * tag 'kbuild-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kconfig: fix static linking of nconf kbuild: prefer ${NM} in check-function-names.sh commit a44bfed9df8a514962e2cb076d9c0b594caeff36 Author: Chen Miao Date: Fri Oct 31 02:32:39 2025 +0000 kbuild: rust: clean libpin_init_internal in mrproper When I enabled Rust compilation, I wanted to clean up its output, so I used make mrproper. However, I was still able to find that libpin_init_internal.so in the rust directory was not deleted, while all other corresponding outputs were cleared. Thus add it to the `MRPROPER_FILES` list. Reviewed-by: Dongliang Mu Signed-off-by: Chen Miao Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure") Cc: stable@vger.kernel.org Acked-by: Nicolas Schier Acked-by: Benno Lossin Link: https://patch.msgid.link/71ff222b8731e63e06059c5d8566434e508baf2b.1761876365.git.chenmiao@openatom.club [ Fixed tags and Git author as discussed. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 3a622041d78bb0737cc9dd507ead099b66abdda2 Merge: e85d3e9d581eb6 ddc6cbef3ef103 Author: Linus Torvalds Date: Fri Jan 23 14:00:58 2026 -0800 Merge tag 's390-6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Add $(DISABLE_KSTACK_ERASE) to vdso compile flags to fix compile errors with old gcc versions - Fix path to s390 chacha implementation in vdso selftests, after vdso64 has been renamed to vdso - Fix off-by-one bug in APQN limit calculation - Discard .modinfo section from decompressor image to fix SecureBoot * tag 's390-6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/boot/vmlinux.lds.S: Ensure bzImage ends with SecureBoot trailer s390/ap: Fix wrong APQN fill calculation selftests: vDSO: getrandom: Fix path to s390 chacha implementation s390/vdso: Disable kstack erase commit e85d3e9d581eb6047a2a79f088b1934e30d81a9b Merge: 6d064432376627 e2f8216ca2d8e6 Author: Linus Torvalds Date: Fri Jan 23 13:56:04 2026 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - A set of fixes for FPSIMD/SVE/SME state management (around signal handling and ptrace) where a task can be placed in an invalid state - __nocfi added to swsusp_arch_resume() to avoid a data abort on resuming from hibernate * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Set __nocfi on swsusp_arch_resume() arm64/fpsimd: signal: Fix restoration of SVE context arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA arm64/fpsimd: ptrace: Fix SVE writes on !SME systems commit f6c3665b6dc53c3ab7d31b585446a953a74340ef Author: Eric Dumazet Date: Thu Jan 22 16:29:14 2026 +0000 bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 ... write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ... value changed: 0x0000000100005365 -> 0x0000000100005366 Fixes: f5b2b966f032 ("[PATCH] bonding: Validate probe replies in ARP monitor") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://patch.msgid.link/20260122162914.2299312-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6d064432376627ff76f86e16b3fbc13c38e860c2 Merge: 5bde837031a3e0 5914d98ff0f7f9 Author: Linus Torvalds Date: Fri Jan 23 13:40:55 2026 -0800 Merge tag 'v6.19-rc6-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Use the original nents value for ib_dma_unmap_sg(), preventing potential memory corruption in the RDMA transport layer - Fix a naming discrepancy in the kernel-doc for ksmbd_vfs_kern_path_start_removing() as identified by sparse static analysis - Reset smb_direct_port to its default value during initialization to ensure the correct port is used when switching between different RDMA device types without module reload * tag 'v6.19-rc6-server-fixes' of git://git.samba.org/ksmbd: smb: server: reset smb_direct_port = SMB_DIRECT_PORT_INFINIBAND on init smb: server: fix comment for ksmbd_vfs_kern_path_start_removing() ksmbd: smbd: fix dma_unmap_sg() nents commit 5bde837031a3e0465b8c8413d45e45d7927b958a Merge: 2a4d91142e538f 5528fd38f230c9 Author: Linus Torvalds Date: Fri Jan 23 13:20:24 2026 -0800 Merge tag 'pci-v6.19-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Fix the pci_do_resource_release_and_resize() failure path, which clobbered the intended failure return value (Ilpo Järvinen) - Restore resizable BAR size before value because the size determines which bits are writable; this fixes i915 and xe regressions (Ilpo Järvinen) * tag 'pci-v6.19-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Fix Resizable BAR restore order PCI: Fix BAR resize rollback path overwriting ret commit 2a4d91142e538ff5580c6bf48b5e668d8131fd9a Merge: 9731fa48beb346 4b11f2336e23d5 Author: Linus Torvalds Date: Fri Jan 23 13:16:26 2026 -0800 Merge tag 'platform-drivers-x86-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - acer-wmi: - Extend support for Acer Nitro AN515-58 - Fix missing capability check - amd/wbrf: Fix memory leak in wbrf_record() - asus-armoury: - Fix GA403U* matching - Fix FA608UM TDP data - Add many models - asus-wmi: Move OOBE presence check outside deprecation ifdef - hp-bioscfg: - Fix kernel panic in GET_INSTANCE_ID macro - Fix kobject warnings for empty attribute names - Correct GUID to uppercase (lowercase letter prevented autoloading the module) - mellanox: Fix SN5640/SN5610 LED platform data - docs: - alienware-wmi: Typo fix - amd_hsmp: Fix document link * tag 'platform-drivers-x86-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (21 commits) platform/x86: acer-wmi: Fix missing capability check platform/x86: acer-wmi: Extend support for Acer Nitro AN515-58 platform/x86: asus-armoury: add support for GA403WW platform/x86: asus-armoury: keep the list ordered alphabetically platform/x86: asus-armoury: add support for G835L platform/x86: asus-armoury: fix ppt data for FA608UM platform/x86: hp-bioscfg: Fix automatic module loading platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names platform/x86: asus-wmi: fix sending OOBE at probe platform/x86: asus-armoury: add support for FA617XT platform/x86: asus-armoury: add support for FA401UV platform/x86: asus-armoury: add support for GV302XV platform/x86: asus-armoury: Add power limits for Asus G513QY platform/x86/amd: Fix memory leak in wbrf_record() platform/mellanox: Fix SN5640/SN5610 LED platform data docs: fix PPR for AMD EPYC broken link docs: alienware-wmi: fix typo platform/x86: asus-armoury: add support for GA403UV asus-armoury: fix ppt data for GA403U* renaming to GA403UI ... commit 9731fa48beb346bb9804cb81e34b3260ce65e561 Merge: d4be90cce60e60 861d21c43c9847 Author: Linus Torvalds Date: Fri Jan 23 13:12:49 2026 -0800 Merge tag 'pmdomain-v6.19-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Remove incorrect reset/clock mask for 8mq vpu - rockchip: Fix initial state of PM domain * tag 'pmdomain-v6.19-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain:rockchip: Fix init genpd as GENPD_STATE_ON before regulator ready pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu commit 894148a25aebeaeb7ec397fdf1a1f1958d55496d Author: Thomas Weißschuh Date: Fri Jan 23 13:09:00 2026 -0800 coco/tsm: Remove unused variable tsm_rwsem This variable is and was never used, remove it. Fixes: 603c646f0010 ("coco/tsm: Introduce a core device for TEE Security Managers") Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260120-coco-tsm_rwsem-v1-1-125059fe2f69@linutronix.de Signed-off-by: Dan Williams commit d4be90cce60e60cf99c419b74105d217eec194c1 Merge: 00d20db21e0dde 5cfc828502cbd0 Author: Linus Torvalds Date: Fri Jan 23 13:01:28 2026 -0800 Merge tag 'mmc-v6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - rtsx_pci_sdmmc: Fix signal voltage switch - sdhci-of-dwcmshc: - A couple of fixes for Eswin EIC7700 - Fix support for HS200/HS400 mode * tag 'mmc-v6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-of-dwcmshc: Fix DMA 128MB boundary for Eswin EIC7700 mmc: sdhci-of-dwcmshc: Fix init for AXI clock for Eswin EIC7700 mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode commit 00d20db21e0ddefa0578a6b510f331ca34880f74 Merge: 7907f673d0ea56 3ef825dfd4e487 Author: Linus Torvalds Date: Fri Jan 23 12:53:56 2026 -0800 Merge tag 'block-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - A set of selftest fixes for ublk - Fix for a pid mismatch in ublk, comparing PIDs in different namespaces if run inside a namespace - Fix for a regression added in this release with polling, where the nvme tcp connect code would spin forever - Zoned device error path fix - Tweak the blkzoned uapi additions from this kernel release, making them more easily discoverable - Fix for a regression in bcache with bio endio handling added in this release * tag 'block-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: bcache: use bio cloning for detached device requests blk-mq: use BLK_POLL_ONESHOT for synchronous poll completion selftests/ublk: fix garbage output in foreground mode selftests/ublk: fix error handling for starting device selftests/ublk: fix IO thread idle check block: make the new blkzoned UAPI constants discoverable ublk: fix ublksrv pid handling for pid namespaces block: Fix an error path in disk_update_zone_resources() commit 7907f673d0ea569b23274ce2fc75f479b905e547 Merge: b33d7062597712 145e0074392587 Author: Linus Torvalds Date: Fri Jan 23 12:51:00 2026 -0800 Merge tag 'io_uring-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix for a potential leak of an iovec, if a specific cleanup path is used and the rw_cache is full at the time of the call - Fix for a regression added in this cycle, where waitid should be using prober release/acquire semantics for updating the wait queue head - Check for the cancelation bit being set for every work item processed by io-wq, not just at the start of the loop. Has no real practical implications other than to shut up syzbot doing crazy things that grossly overload a system, hence slowing down ring exit - A few selftest additions, updating the mini_liburing that selftests use * tag 'io_uring-6.19-20260122' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: selftests/io_uring: support NO_SQARRAY in miniliburing selftests/io_uring: add io_uring_queue_init_params io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop io_uring/waitid: fix KCSAN warning on io_waitid->head io_uring/rw: free potentially allocated iovec on cache put failure commit b33d70625977126d59f59dfd8c0bf9a75b4591c0 Merge: c133687c2eae4f 374e7af67d9d9d Author: Linus Torvalds Date: Fri Jan 23 12:46:12 2026 -0800 Merge tag 'iommu-fixes-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - AMD IOMMU: Fix potential NULL-ptr dereference in error path of amd_iommu_probe_device() - Generic IOMMUPT: Fix another compiler issue seen with older compiler versions - Fix signedness issue in ARM IO-PageTable code * tag 'iommu-fixes-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/io-pgtable-arm: fix size_t signedness bug in unmap path iommupt: Make it clearer to the compiler that pts.level == 0 for single page iommu/amd: Fix error path in amd_iommu_probe_device() commit 8016dc5ee19a77678c264f8ba368b1e873fa705b Author: Zilin Guan Date: Wed Jan 21 13:05:51 2026 +0000 octeon_ep: Fix memory leak in octep_device_setup() In octep_device_setup(), if octep_ctrl_net_init() fails, the function returns directly without unmapping the mapped resources and freeing the allocated configuration memory. Fix this by jumping to the unsupported_dev label, which performs the necessary cleanup. This aligns with the error handling logic of other paths in this function. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 577f0d1b1c5f ("octeon_ep: add separate mailbox command and response queues") Signed-off-by: Zilin Guan Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260121130551.3717090-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 6de4436bf369e1444606445e4cd5df5bcfc74b48 Author: Justin Chen Date: Thu Jan 22 11:40:01 2026 -0800 net: bcmasp: fix early exit leak with fixed phy We are not deregistering the fixed phy link when hitting the early exit condition. Add the correct early exit sequence. Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260122194001.1098859-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit d48c896cb2c122a24545c4300f7d50812f68eeb9 Merge: deb5c201aa4e39 1b9c17fd0a7fdc Author: Jakub Kicinski Date: Fri Jan 23 10:47:02 2026 -0800 Merge tag 'for-net-2026-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_uart: fix null-ptr-deref in hci_uart_write_work - MGMT: Fix memory leak in set_ssp_complete * tag 'for-net-2026-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Fix memory leak in set_ssp_complete Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work ==================== Link: https://patch.msgid.link/20260122200751.2950279-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit deb5c201aa4e39858a2297530b70f70cc4d536e5 Author: Ajit Khaparde Date: Thu Jan 22 12:50:20 2026 -0800 MAINTAINERS: Update be2net maintainers Remove Somnath Kotur from maintainers for be2net driver. Signed-off-by: Ajit Khaparde Link: https://patch.msgid.link/20260122205020.26743-1-ajit.khaparde@broadcom.com Signed-off-by: Jakub Kicinski commit 361eb853c655288f3b5c8020f6cd95d69ffe6479 Author: Weigang He Date: Mon Jan 19 11:45:42 2026 +0000 scripts/tracepoint-update: Fix memory leak in add_string() on failure When realloc() fails in add_string(), the function returns -1 but leaves *vals pointing to the previously allocated memory. This can cause memory leaks in callers like make_trace_array() that return on error without freeing the partially built array. Fix this by freeing *vals and setting it to NULL when realloc() fails. This makes the error handling self-contained in add_string() so callers don't need to handle cleanup on failure. This bug is found by my static analysis tool and my code review. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Fixes: e30f8e61e2518 ("tracing: Add a tracepoint verification check at build time") Link: https://patch.msgid.link/20260119114542.1714405-1-geoffreyhe2@gmail.com Signed-off-by: Weigang He Signed-off-by: Steven Rostedt (Google) commit c9703d17d2c86eda38fe4917ca70c27ec9dbe162 Author: Donglin Peng Date: Mon Jan 12 10:16:01 2026 +0800 function_graph: Fix args pointer mismatch in print_graph_retval() When funcgraph-args and funcgraph-retaddr are both enabled, many kernel functions display invalid parameters in trace logs. The issue occurs because print_graph_retval() passes a mismatched args pointer to print_function_args(). Fix this by retrieving the correct args pointer using the FGRAPH_ENTRY_ARGS() macro. Link: https://patch.msgid.link/20260112021601.1300479-1-dolinux.peng@gmail.com Fixes: f83ac7544fbf ("function_graph: Enable funcgraph-args and funcgraph-retaddr to work simultaneously") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit 00f13e28a9c3acd40f0551cde7e9d2d1a41585bf Author: Ian Rogers Date: Wed Jan 7 16:26:25 2026 -0800 tracing: Avoid possible signed 64-bit truncation 64-bit truncation to 32-bit can result in the sign of the truncated value changing. The cmp_mod_entry is used in bsearch and so the truncation could result in an invalid search order. This would only happen were the addresses more than 2GB apart and so unlikely, but let's fix the potentially broken compare anyway. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260108002625.333331-1-irogers@google.com Signed-off-by: Ian Rogers Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 90f9f5d64cae4e72defd96a2a22760173cb3c9ec Author: Steven Rostedt Date: Thu Jan 22 19:48:24 2026 -0500 tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred: ~# cd /sys/kernel/tracing ~# echo 's:stack unsigned long stack[];' > dynamic_events ~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger ~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger The above creates a synthetic event that takes a stacktrace when a task schedules out in a non-running state and passes that stacktrace to the sched_switch event when that task schedules back in. It triggers the "stack" synthetic event that has a stacktrace as its field (called "stack"). ~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events ~# echo 'hist:keys=common_pid:s2=stack' >> events/synthetic/stack/trigger ~# echo 'hist:keys=common_pid:s3=$s2,i0=id:onmatch(synthetic.stack).trace(syscall_stack,$i0,$s3)' >> events/raw_syscalls/sys_exit/trigger The above makes another synthetic event called "syscall_stack" that attaches the first synthetic event (stack) to the sys_exit trace event and records the stacktrace from the stack event with the id of the system call that is exiting. When enabling this event (or using it in a historgram): ~# echo 1 > events/synthetic/syscall_stack/enable Produces a kernel crash! BUG: unable to handle page fault for address: 0000000000400010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 6 UID: 0 PID: 1257 Comm: bash Not tainted 6.16.3+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.3-1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:trace_event_raw_event_synth+0x90/0x380 Code: c5 00 00 00 00 85 d2 0f 84 e1 00 00 00 31 db eb 34 0f 1f 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 <49> 8b 04 24 48 83 c3 01 8d 0c c5 08 00 00 00 01 cd 41 3b 5d 40 0f RSP: 0018:ffffd2670388f958 EFLAGS: 00010202 RAX: ffff8ba1065cc100 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: fffff266ffda7b90 RDI: ffffd2670388f9b0 RBP: 0000000000000010 R08: ffff8ba104e76000 R09: ffffd2670388fa50 R10: ffff8ba102dd42e0 R11: ffffffff9a908970 R12: 0000000000400010 R13: ffff8ba10a246400 R14: ffff8ba10a710220 R15: fffff266ffda7b90 FS: 00007fa3bc63f740(0000) GS:ffff8ba2e0f48000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400010 CR3: 0000000107f9e003 CR4: 0000000000172ef0 Call Trace: ? __tracing_map_insert+0x208/0x3a0 action_trace+0x67/0x70 event_hist_trigger+0x633/0x6d0 event_triggers_call+0x82/0x130 trace_event_buffer_commit+0x19d/0x250 trace_event_raw_event_sys_exit+0x62/0xb0 syscall_exit_work+0x9d/0x140 do_syscall_64+0x20a/0x2f0 ? trace_event_raw_event_sched_switch+0x12b/0x170 ? save_fpregs_to_fpstate+0x3e/0x90 ? _raw_spin_unlock+0xe/0x30 ? finish_task_switch.isra.0+0x97/0x2c0 ? __rseq_handle_notify_resume+0xad/0x4c0 ? __schedule+0x4b8/0xd00 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x1ef/0x2f0 ? do_fault+0x2e9/0x540 ? __handle_mm_fault+0x7d1/0xf70 ? count_memcg_events+0x167/0x1d0 ? handle_mm_fault+0x1d7/0x2e0 ? do_user_addr_fault+0x2c3/0x7f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reason is that the stacktrace field is not labeled as such, and is treated as a normal field and not as a dynamic event that it is. In trace_event_raw_event_synth() the event is field is still treated as a dynamic array, but the retrieval of the data is considered a normal field, and the reference is just the meta data: // Meta data is retrieved instead of a dynamic array str_val = (char *)(long)var_ref_vals[val_idx]; // Then when it tries to process it: len = *((unsigned long *)str_val) + 1; It triggers a kernel page fault. To fix this, first when defining the fields of the first synthetic event, set the filter type to FILTER_STACKTRACE. This is used later by the second synthetic event to know that this field is a stacktrace. When creating the field of the new synthetic event, have it use this FILTER_STACKTRACE to know to create a stacktrace field to copy the stacktrace into. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tom Zanussi Link: https://patch.msgid.link/20260122194824.6905a38e@gandalf.local.home Fixes: 00cf3d672a9d ("tracing: Allow synthetic events to pass around stacktraces") Signed-off-by: Steven Rostedt (Google) commit c133687c2eae4f38d4481430793b04f2e7267e7c Merge: 346c558355dae1 caa329649259d0 Author: Linus Torvalds Date: Fri Jan 23 10:20:28 2026 -0800 Merge tag 'spi-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "One new device ID, plus a few fixes. The most substantial of the fixes is for the Cadence driver which in at least some instantiations requires transmit data to drive data through the IP" * tag 'spi-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: intel-pci: Add support for Nova Lake SPI serial flash spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization spi: spi-sprd-adi: Fix double free in probe error path commit 346c558355dae13f11f4ecb6fcc04be92d0a3497 Merge: afb923b8198aa7 e3b76494d675e4 Author: Linus Torvalds Date: Fri Jan 23 10:19:18 2026 -0800 Merge tag 'regulator-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A trivial fix adding a missing memory allocation check" * tag 'regulator-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fp9931: Add missing memory allocation check commit afb923b8198aa71e5b8e65268e598026faf43f12 Merge: 1f664bbd5f2fc1 4b58aac989c1e3 Author: Linus Torvalds Date: Fri Jan 23 10:17:06 2026 -0800 Merge tag 'regmap-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "A couple of small fixes, one error handling one and another for misuse of the hwspinlock API" * tag 'regmap-fix-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Fix race condition in hwspinlock irqsave routine regmap: maple: free entry on mas_store_gfp() failure commit 1f664bbd5f2fc16c6bef29912d610ca67e12a2c1 Merge: 6e49f9e05c5280 4918cc05137cb3 Author: Linus Torvalds Date: Fri Jan 23 10:14:52 2026 -0800 Merge tag 'gpio-fixes-for-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Some fixes to resource leaks in the character device handling and another small fix for shared GPIO management: - fix resource leaks in error paths in GPIO character device code - return -ENOMEM and not -ENODEV on memory allocation failure - fix an audio issue on Qualcomm platforms due to configuration not being propagated to pinctrl from shared GPIO proxy" * tag 'gpio-fixes-for-v6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: shared: propagate configuration to pinctrl gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register() gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() gpio: cdev: Correct return code on memory allocation failure commit e2f8216ca2d8e61a23cb6ec355616339667e0ba6 Author: Zhaoyang Huang Date: Thu Jan 22 19:49:25 2026 +0800 arm64: Set __nocfi on swsusp_arch_resume() A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*() and does not have a CFI hash, but swsusp_arch_resume() will attempt to verify the CFI hash when calling a copy of swsusp_arch_suspend_exit(). Given that there's an existing requirement that the entrypoint to swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text section, we cannot fix this by marking swsusp_arch_suspend_exit() with SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in swsusp_arch_resume(). Mark swsusp_arch_resume() as __nocfi to disable the CFI check. [1] [ 22.991934][ T1] Unable to handle kernel paging request at virtual address 0000000109170ffc [ 22.991934][ T1] Mem abort info: [ 22.991934][ T1] ESR = 0x0000000096000007 [ 22.991934][ T1] EC = 0x25: DABT (current EL), IL = 32 bits [ 22.991934][ T1] SET = 0, FnV = 0 [ 22.991934][ T1] EA = 0, S1PTW = 0 [ 22.991934][ T1] FSC = 0x07: level 3 translation fault [ 22.991934][ T1] Data abort info: [ 22.991934][ T1] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 22.991934][ T1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 22.991934][ T1] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 22.991934][ T1] [0000000109170ffc] user address but active_mm is swapper [ 22.991934][ T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP [ 22.991934][ T1] Dumping ftrace buffer: [ 22.991934][ T1] (ftrace buffer empty) [ 22.991934][ T1] Modules linked in: [ 22.991934][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419 [ 22.991934][ T1] Hardware name: Unisoc UMS9360-base Board (DT) [ 22.991934][ T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.991934][ T1] pc : swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] lr : swsusp_arch_resume+0x294/0x344 [ 22.991934][ T1] sp : ffffffc08006b960 [ 22.991934][ T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000 [ 22.991934][ T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820 [ 22.991934][ T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000 [ 22.991934][ T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058 [ 22.991934][ T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004 [ 22.991934][ T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000 [ 22.991934][ T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000 [ 22.991934][ T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b [ 22.991934][ T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530 [ 22.991934][ T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000 [ 22.991934][ T1] Call trace: [ 22.991934][ T1] swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] hibernation_restore+0x158/0x18c [ 22.991934][ T1] load_image_and_restore+0xb0/0xec [ 22.991934][ T1] software_resume+0xf4/0x19c [ 22.991934][ T1] software_resume_initcall+0x34/0x78 [ 22.991934][ T1] do_one_initcall+0xe8/0x370 [ 22.991934][ T1] do_initcall_level+0xc8/0x19c [ 22.991934][ T1] do_initcalls+0x70/0xc0 [ 22.991934][ T1] do_basic_setup+0x1c/0x28 [ 22.991934][ T1] kernel_init_freeable+0xe0/0x148 [ 22.991934][ T1] kernel_init+0x20/0x1a8 [ 22.991934][ T1] ret_from_fork+0x10/0x20 [ 22.991934][ T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110) Co-developed-by: Jeson Gao Signed-off-by: Jeson Gao Signed-off-by: Zhaoyang Huang Acked-by: Will Deacon Acked-by: Mark Rutland Cc: [catalin.marinas@arm.com: commit log updated by Mark Rutland] Signed-off-by: Catalin Marinas commit 6e49f9e05c528055c005bb42018a6b5a615b45b9 Merge: d6112dddbf354d 64e0924ed3b446 Author: Linus Torvalds Date: Fri Jan 23 09:37:35 2026 -0800 Merge tag 'sound-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of a few more small fixes for HD- and USB-audio, including a regression fix for the OOB fix that was included in the previous pull request" * tag 'sound-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone ALSA: usb-audio: Use the right limit for PCM OOB check ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU ALSA: ctxfi: Fix potential OOB access in audio mixer handling selftests: ALSA: Remove unused variable in utimer-test ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti ALSA: scarlett2: Fix buffer overflow in config retrieval ALSA: usb: Increase volume range that triggers a warning commit 494fc029f662c331e06b7c2031deff3c64200eed Author: Marc Kleine-Budde Date: Tue Jan 20 10:40:22 2026 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error") a failing resubmit URB will print an info message. In the case of a short read where netdev has not yet been assigned, initialize as NULL to avoid dereferencing an undefined value. Also report the error value of the failed resubmit. Fixes: 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/all/20260119181904.1209979-1-kuba@kernel.org/ Link: https://patch.msgid.link/20260120-gs_usb-fix-error-message-v1-1-6be04de572bc@pengutronix.de Signed-off-by: Marc Kleine-Budde commit d6112dddbf354d21ff2fcd49338df68782492c73 Merge: c072629f05d7bc b91adbe8309362 Author: Linus Torvalds Date: Fri Jan 23 09:01:26 2026 -0800 Merge tag 'drm-fixes-2026-01-23' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Probably a good thing you decided to do an rc8 in this round. Nothing stands out, but xe/amdgpu and mediatek all have a bunch of fixes, and then there are a few other single patches. Hopefully next week is calmer for release. xe: - Disallow bind-queue sharing across multiple VMs - Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE - Fix a missed page count update - Fix a confused argument to alloc_workqueue() - Kernel-doc fixes - Disable a workaround on VFs - Fix a job lock assert - Update wedged.mode only after successful reset policy change - Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected amdgpu: - fix color pipeline string leak - GC 12 fix - Misc error path fixes - DC analog fix - SMU 6 fixes - TLB flush fix - DC idle optimization fix amdkfd: - GC 11 cooperative launch fix imagination: - sync wait for logtype update completion to ensure FW trace is available bridge/synopsis: - Fix error paths in dw_dp_bind nouveau: - Add and implement missing DSB connector types, and improve unknown connector handling - Set missing atomic function ops intel: - place 3D lut at correct place in pipeline - fix color pipeline string leak vkms: - fix color pipeline string leak mediatek: - Fix platform_get_irq() error checking - HDMI DDC v2 driver fixes - dpi: Find next bridge during probe - mtk_gem: Partial refactor and use drm_gem_dma_object - dt-bindings: Fix typo 'hardwares' to 'hardware'" * tag 'drm-fixes-2026-01-23' of https://gitlab.freedesktop.org/drm/kernel: (38 commits) Revert "drm/amd/display: pause the workload setting in dm" drm/xe: Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected drm, drm/xe: Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE drm/i915/display: Fix color pipeline enum name leak drm/vkms: Fix color pipeline enum name leak drm/amd/display: Fix color pipeline enum name leak drm/i915/color: Place 3D LUT after CSC in plane color pipeline drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors drm/nouveau: add missing DCB connector types drm/amdgpu: fix type for wptr in ring backup drm/amdgpu: Fix validating flush_gpu_tlb_pasid() drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) drm/amd/pm: Don't clear SI SMC table when setting power limit drm/amd/pm: Fix si_dpm mmCG_THERMAL_INT setting drm/xe: Update wedged.mode only after successful reset policy change drm/xe/migrate: fix job lock assert drm/xe/uapi: disallow bind queue sharing drm/amd/display: Only poll analog connectors drm/amdgpu: fix error handling in ib_schedule() ... commit e396a74222654486d6ab45dca5d0c54c408b8b91 Author: Zhiquan Li Date: Thu Jan 22 13:35:50 2026 +0800 KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures Some distributions (such as Ubuntu) configure GCC so that _FORTIFY_SOURCE is automatically enabled at -O1 or above. This results in some fortified version of definitions of standard library functions are included. While linker resolves the symbols, the fortified versions might override the definitions in lib/string_override.c and reference to those PLT entries in GLIBC. This is not a problem for the code in host, but it is a disaster for the guest code. E.g., if build and run x86/nested_emulation_test on Ubuntu 24.04 will encounter a L1 #PF due to memset() reference to __memset_chk@plt. The option -fno-builtin-memset is not helpful here, because those fortified versions are not built-in but some definitions which are included by header, they are for different intentions. In order to eliminate the unpredictable behaviors may vary depending on the linker and platform, add the "-U_FORTIFY_SOURCE" into CFLAGS to prevent from introducing the fortified definitions. Signed-off-by: Zhiquan Li Link: https://patch.msgid.link/20260122053551.548229-1-zhiquan_li@163.com Fixes: 6b6f71484bf4 ("KVM: selftests: Implement memcmp(), memcpy(), and memset() for guest use") Cc: stable@vger.kernel.org [sean: tag for stable] Signed-off-by: Sean Christopherson commit 32f37e57583f869140cff445feedeea8a5fea986 Author: Krzysztof Kozlowski Date: Fri Jan 23 08:21:40 2026 +0100 serial: Fix not set tty->port race condition Revert commit bfc467db60b7 ("serial: remove redundant tty_port_link_device()") because the tty_port_link_device() is not redundant: the tty->port has to be confured before we call uart_configure_port(), otherwise user-space can open console without TTY linked to the driver. This tty_port_link_device() was added explicitly to avoid this exact issue in commit fb2b90014d78 ("tty: link tty and port before configuring it as console"), so offending commit basically reverted the fix saying it is redundant without addressing the actual race condition presented there. Reproducible always as tty->port warning on Qualcomm SoC with most of devices disabled, so with very fast boot, and one serial device being the console: printk: legacy console [ttyMSM0] enabled printk: legacy console [ttyMSM0] enabled printk: legacy bootconsole [qcom_geni0] disabled printk: legacy bootconsole [qcom_geni0] disabled ------------[ cut here ]------------ tty_init_dev: ttyMSM driver does not set tty->port. This would crash the kernel. Fix the driver! WARNING: drivers/tty/tty_io.c:1414 at tty_init_dev.part.0+0x228/0x25c, CPU#2: systemd/1 Modules linked in: socinfo tcsrcc_eliza gcc_eliza sm3_ce fuse ipv6 CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G S 6.19.0-rc4-next-20260108-00024-g2202f4d30aa8 #73 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Qualcomm Technologies, Inc. Eliza (DT) ... tty_init_dev.part.0 (drivers/tty/tty_io.c:1414 (discriminator 11)) (P) tty_open (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 3) drivers/tty/tty_io.c:2073 (discriminator 3) drivers/tty/tty_io.c:2120 (discriminator 3)) chrdev_open (fs/char_dev.c:411) do_dentry_open (fs/open.c:962) vfs_open (fs/open.c:1094) do_open (fs/namei.c:4634) path_openat (fs/namei.c:4793) do_filp_open (fs/namei.c:4820) do_sys_openat2 (fs/open.c:1391 (discriminator 3)) ... Starting Network Name Resolution... Apparently the flow with this small Yocto-based ramdisk user-space is: driver (qcom_geni_serial.c): user-space: ============================ =========== qcom_geni_serial_probe() uart_add_one_port() serial_core_register_port() serial_core_add_one_port() uart_configure_port() register_console() | | open console | ... | tty_init_dev() | driver->ports[idx] is NULL | tty_port_register_device_attr_serdev() tty_port_link_device() <- set driver->ports[idx] Fixes: bfc467db60b7 ("serial: remove redundant tty_port_link_device()") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Jiri Slaby Link: https://patch.msgid.link/20260123072139.53293-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 61ceaf236115f20f4fdd7cf60f883ada1063349a Author: Leon Romanovsky Date: Wed Jan 21 17:45:02 2026 +0200 vfio: Prevent from pinned DMABUF importers to attach to VFIO DMABUF Some pinned importers, such as non-ODP RDMA ones, cannot invalidate their mappings and therefore must be prevented from attaching to this exporter. Fixes: 5d74781ebc86 ("vfio/pci: Add dma-buf export support for MMIO regions") Signed-off-by: Leon Romanovsky Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20260121-vfio-add-pin-v1-1-4e04916b17f1@nvidia.com Signed-off-by: Alex Williamson commit 2733634a5f7b7faa95e81565d3c9178dc1b6e563 Merge: 630fbc6e870eb0 018b211b1d321a Author: Takashi Iwai Date: Fri Jan 23 16:29:24 2026 +0100 Merge tag 'asoc-fix-v6.19-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A couple of device IDs and a couple of small fixes, nothing hugely remarkable. commit 630fbc6e870eb06c5126cc97a3abecbe012272c8 Author: Kailang Yang Date: Fri Jan 23 15:21:36 2026 +0800 ALSA: hda/realtek - fixed speaker no sound If it play a 5s above silence media stream, it will cause silence detection trigger. Speaker will make no sound when you use another app to play a stream. Add this patch will solve this issue. GPIO2: Mute Hotkey GPIO3: Mic Mute LED Enable this will turn on hotkey and LED support. Signed-off-by: Kailang Yang Link: https://lore.kernel.org/f4929e137a7949238cc043d861a4d9f8@realtek.com Signed-off-by: Takashi Iwai commit 15257cc2f905dbf5813c0bfdd3c15885f28093c4 Author: Vincent Guittot Date: Fri Jan 23 11:28:58 2026 +0100 sched/fair: Revert force wakeup preemption This agressively bypasses run_to_parity and slice protection with the assumpiton that this is what waker wants but there is no garantee that the wakee will be the next to run. It is a better choice to use yield_to_task or WF_SYNC in such case. This increases the number of resched and preemption because a task becomes quickly "ineligible" when it runs; We update the task vruntime periodically and before the task exhausted its slice or at least quantum. Example: 2 tasks A and B wake up simultaneously with lag = 0. Both are eligible. Task A runs 1st and wakes up task C. Scheduler updates task A's vruntime which becomes greater than average runtime as all others have a lag == 0 and didn't run yet. Now task A is ineligible because it received more runtime than the other task but it has not yet exhausted its slice nor a min quantum. We force preemption, disable protection but Task B will run 1st not task C. Sidenote, DELAY_ZERO increases this effect by clearing positive lag at wake up. Fixes: e837456fdca8 ("sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals") Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260123102858.52428-1-vincent.guittot@linaro.org commit 4f70f106bca1a56bd66d00830ac91680bd754974 Author: Mel Gorman Date: Tue Jan 20 11:33:35 2026 +0000 sched/fair: Disable scheduler feature NEXT_BUDDY NEXT_BUDDY was disabled with the introduction of EEVDF and enabled again after NEXT_BUDDY was rewritten for EEVDF by commit e837456fdca8 ("sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals"). It was not expected that this would be a universal win without a crystal ball instruction but the reported regressions are a concern [1][2] even if gains were also reported. Specifically; o mysql with client/server running on different servers regresses o specjbb reports lower peak metrics o daytrader regresses The mysql is realistic and a concern. It needs to be confirmed if specjbb is simply shifting the point where peak performance is measured but still a concern. daytrader is considered to be representative of a real workload. Access to test machines is currently problematic for verifying any fix to this problem. Disable NEXT_BUDDY for now by default until the root causes are addressed. Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Tested-by: Madadi Vineeth Reddy Link: https://lore.kernel.org/lkml/4b96909a-f1ac-49eb-b814-97b8adda6229@arm.com [1] Link: https://lore.kernel.org/lkml/ec3ea66f-3a0d-4b5a-ab36-ce778f159b5b@linux.ibm.com [2] Link: https://patch.msgid.link/fyqsk63pkoxpeaclyqsm5nwtz3dyejplr7rg6p74xwemfzdzuu@7m7xhs5aqpqw commit 4c4e62321a41747390bc167f9c581408f6e0d322 Author: Miguel Ojeda Date: Thu Jan 22 06:41:35 2026 +0100 rust: proc-macro2: rebuild if the version text changes The Rust compiler cannot use dependencies built by other versions, e.g.: error[E0514]: found crate `proc_macro2` compiled by an incompatible version of rustc --> rust/quote/ext.rs:5:5 | 5 | use proc_macro2::{TokenStream, TokenTree}; | ^^^^^^^^^^^ | = note: the following crate versions were found: crate `proc_macro2` compiled by rustc 1.92.0 (ded5c06cf 2025-12-08): ./rust/libproc_macro2.rlib = help: please recompile that crate using this compiler (rustc 1.93.0 (254b59607 2026-01-19)) (consider running `cargo clean` first) Thus trigger a rebuild if the version text changes like we do in other top-level cases (e.g. see commit aeb0e24abbeb ("kbuild: rust: replace proc macros dependency on `core.o` with the version text")). The build errors for now are hard to trigger, since we do not yet use the new crates we just introduced (the use cases are coming in the next merge window), but they can still be seen if e.g. one manually removes one of the targets, so fix it already. Fixes: 158a3b72118a ("rust: proc-macro2: enable support in kbuild") Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260122054135.138445-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 108948f723b13874b7ebf6b3f1cc598a7de38622 Author: Zilin Guan Date: Tue Jan 20 13:46:40 2026 +0000 net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() In esw_acl_ingress_lgcy_setup(), if esw_acl_table_create() fails, the function returns directly without releasing the previously created counter, leading to a memory leak. Fix this by jumping to the out label instead of returning directly, which aligns with the error handling logic of other paths in this function. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes") Signed-off-by: Zilin Guan Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260120134640.2717808-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit c072629f05d7bca1148ab17690d7922a31423984 Merge: 614da1d3d4cdbd 2397e9264676be Author: Linus Torvalds Date: Thu Jan 22 19:39:25 2026 -0800 Merge tag 'v6.19-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Add assoclen check in authencesn * tag 'v6.19-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec commit 841e47d56cef9b96fd2314220e3d0f1d92c719f4 Author: Nathan Chancellor Date: Wed Jan 21 14:36:00 2026 -0700 riscv: Add intermediate cast to 'unsigned long' in __get_user_asm After commit bdce162f2e57 ("riscv: Use 64-bit variable for output in __get_user_asm"), there is a warning when building for 32-bit RISC-V: In file included from include/linux/uaccess.h:13, from include/linux/sched/task.h:13, from include/linux/sched/signal.h:9, from include/linux/rcuwait.h:6, from include/linux/mm.h:36, from include/linux/migrate.h:5, from mm/migrate.c:16: mm/migrate.c: In function 'do_pages_move': arch/riscv/include/asm/uaccess.h:115:15: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 115 | (x) = (__typeof__(x))__tmp; \ | ^ arch/riscv/include/asm/uaccess.h:198:17: note: in expansion of macro '__get_user_asm' 198 | __get_user_asm("lb", (x), __gu_ptr, label); \ | ^~~~~~~~~~~~~~ arch/riscv/include/asm/uaccess.h:218:9: note: in expansion of macro '__get_user_nocheck' 218 | __get_user_nocheck(x, ptr, __gu_failed); \ | ^~~~~~~~~~~~~~~~~~ arch/riscv/include/asm/uaccess.h:255:9: note: in expansion of macro '__get_user_error' 255 | __get_user_error(__gu_val, __gu_ptr, __gu_err); \ | ^~~~~~~~~~~~~~~~ arch/riscv/include/asm/uaccess.h:285:17: note: in expansion of macro '__get_user' 285 | __get_user((x), __p) : \ | ^~~~~~~~~~ mm/migrate.c:2358:29: note: in expansion of macro 'get_user' 2358 | if (get_user(p, pages + i)) | ^~~~~~~~ Add an intermediate cast to 'unsigned long', which is guaranteed to be the same width as a pointer, before the cast to the type of the output variable to clear up the warning. Fixes: bdce162f2e57 ("riscv: Use 64-bit variable for output in __get_user_asm") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601210526.OT45dlOZ-lkp@intel.com/ Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260121-riscv-fix-int-to-pointer-cast-v1-1-b83eebe57c76@kernel.org Signed-off-by: Paul Walmsley commit 0b50f116af5e29724b756a5ee6ae268deaae2d29 Author: Li Ming Date: Sun Jan 11 15:38:23 2026 +0800 PCI/IDE: Fix reading a wrong reg for unused sel stream initialization During pci_ide_init(), it will write PCI_ID_RESERVED_STREAM_ID into all unused selective IDE stream blocks. In a selective IDE stream block, IDE stream ID field is in selective IDE stream control register instead of selective IDE stream capability register. Fixes: 079115370d00 ("PCI/IDE: Initialize an ID for all IDE streams") Signed-off-by: Li Ming Acked-by: Bjorn Helgaas Reviewed-by: Xu Yilun Link: https://patch.msgid.link/20260111073823.486665-1-ming.li@zohomail.com Signed-off-by: Dan Williams commit 8370af2019dee9ca004ca7c5e36b1f629ecb1e39 Author: Li Ming Date: Wed Jan 14 19:14:55 2026 +0800 PCI/IDE: Fix off by one error calculating VF RID range The VF ID range of an SR-IOV device is [0, num_VFs - 1]. pci_ide_stream_alloc() mistakenly uses num_VFs to represent the last ID. Fix that off by one error to stay in bounds of the range. Fixes: 1e4d2ff3ae45 ("PCI/IDE: Add IDE establishment helpers") Signed-off-by: Li Ming Reviewed-by: Xu Yilun Link: https://patch.msgid.link/20260114111455.550984-1-ming.li@zohomail.com Signed-off-by: Dan Williams commit 731bb3118f859d2a68444a9ae580681522d32bc0 Author: Dan Williams Date: Thu Jan 22 16:35:56 2026 -0800 Revert "PCI/TSM: Report active IDE streams" The proposed ABI failed to account for multiple host bridges with the same stream name. The fix needs to namespace streams or otherwise link back to the host bridge, but a change like that is too big for a fix. Given this ABI never saw a released kernel, delete it for now and bring it back later with this issue addressed. Reported-by: Xu Yilun Reported-by: Yi Lai Closes: http://lore.kernel.org/20251223085601.2607455-1-yilun.xu@linux.intel.com Link: http://patch.msgid.link/6972c872acbb9_1d3310035@dwillia2-mobl4.notmuch Signed-off-by: Dan Williams commit 614da1d3d4cdbd6e41aea06bc97ec15aacff6daf Author: Cedric Xing Date: Thu Jan 22 18:39:15 2026 -0600 x86: make page fault handling disable interrupts properly There's a big comment in the x86 do_page_fault() about our interrupt disabling code: * User address page fault handling might have reenabled * interrupts. Fixing up all potential exit points of * do_user_addr_fault() and its leaf functions is just not * doable w/o creating an unholy mess or turning the code * upside down. but it turns out that comment is subtly wrong, and the code as a result is also wrong. Because it's certainly true that we may have re-enabled interrupts when handling user page faults. And it's most certainly true that we don't want to bother fixing up all the cases. But what isn't true is that it's limited to user address page faults. The confusion stems from the fact that we have logic here that depends on the address range of the access, but other code then depends on the _context_ the access was done in. The two are not related, even though both of them are about user-vs-kernel. In other words, both user and kernel addresses can cause interrupts to have been enabled (eg when __bad_area_nosemaphore() gets called for user accesses to kernel addresses). As a result we should make sure to disable interrupts again regardless of the address range before returning to the low-level fault handling code. The __bad_area_nosemaphore() code actually did disable interrupts again after enabling them, just not consistently. Ironically, as noted in the original comment, fixing up all the cases is just not worth it, when the simple solution is to just do it unconditionally in one single place. So remove the incomplete case that unsuccessfully tried to do what the comment said was "not doable" in commit ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code"), and just make it do the simple and straightforward thing. Signed-off-by: Cedric Xing Reviewed-by: Dave Hansen Fixes: ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code") Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Linus Torvalds commit 5914d98ff0f7f9ec0e3963dbe2773401b02888ac Author: Stefan Metzmacher Date: Mon Dec 8 16:49:19 2025 +0100 smb: server: reset smb_direct_port = SMB_DIRECT_PORT_INFINIBAND on init This allows testing with different devices (iwrap vs. non-iwarp) without 'rmmod ksmbd && modprobe ksmbd', but instead 'ksmbd.control -s && ksmbd.mountd' is enough. In the long run we want to listen on iwarp and non-iwarp at the same time, but requires more changes, most likely also in the rdma layer. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 8e50cd059ca8fd0376c53f703fca721fbcb5372e Author: Stefan Metzmacher Date: Mon Jan 19 18:43:10 2026 +0100 smb: server: fix comment for ksmbd_vfs_kern_path_start_removing() This was found by sparse... Fixes: 1ead2213dd7d ("smb/server: use end_removing_noperm for for target of smb2_create_link()") Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: NeilBrown Cc: Christian Brauner Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 98e3e2b561bc88f4dd218d1c05890672874692f6 Author: Thomas Fourier Date: Fri Jan 9 11:38:39 2026 +0100 ksmbd: smbd: fix dma_unmap_sg() nents The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Cc: Signed-off-by: Thomas Fourier Acked-by: Namjae Jeon Signed-off-by: Steve French commit b91adbe83093629a675c77d39ac638610630b1e8 Merge: 2312e0ab59759b b9639c5e313e14 Author: Dave Airlie Date: Fri Jan 23 10:12:44 2026 +1000 Merge tag 'mediatek-drm-fixes-20260119' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20260119 1. Fix platform_get_irq() error checking 2. HDMI DDC v2 driver fixes 3. dpi: Find next bridge during probe 4. mtk_gem: Partial refactor and use drm_gem_dma_object 5. dt-bindings: Fix typo 'hardwares' to 'hardware' Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20260119154717.4735-1-chunkuang.hu@kernel.org commit 2312e0ab59759b2df23117bf6ce37120303d4b42 Merge: e63b9229c3d2bf f377ea0561c957 Author: Dave Airlie Date: Fri Jan 23 08:11:56 2026 +1000 Merge tag 'amd-drm-fixes-6.19-2026-01-22' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-22: amdgpu: - GC 12 fix - Misc error path fixes - DC analog fix - SMU 6 fixes - TLB flush fix - DC idle optimization fix amdkfd: - GC 11 cooperative launch fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260122204308.946339-1-alexander.deucher@amd.com commit e63b9229c3d2bf6684b1c154e8365e2d1822f039 Merge: 353f91bc25e228 e27ada4f19e7ff Author: Dave Airlie Date: Fri Jan 23 08:03:43 2026 +1000 Merge tag 'drm-xe-fixes-2026-01-22' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: - Disallow bind-queue sharing across multiple VMs (Matt Auld) Core Changes: - Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE (Thomas) Driver Changes: - Fix a missed page count update (Matt Brost) - Fix a confused argument to alloc_workqueue() (Marco Crivellari) - Kernel-doc fixes (Jani) - Disable a workaround on VFs (Matt Brost) - Fix a job lock assert (Matt Auld) - Update wedged.mode only after successful reset policy change (Lukasz) - Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected (Thomas) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aXIdiXaY-RxoaviV@fedora commit 353f91bc25e228c7e089b6c2791c04f8dd2517b6 Merge: 24d479d26b25bc 0a095b64fa5b4b Author: Dave Airlie Date: Fri Jan 23 07:51:30 2026 +1000 Merge tag 'drm-misc-fixes-2026-01-22' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-msic-fixes for v6.19: imagination: - sync wait for logtype update completion to ensure FW trace is available bridge/synopsis: - Fix error paths in dw_dp_bind nouveau: - Add and implement missing DSB connector types, and improve unknown connector handling. - Set missing atomic function ops. intel/display, amd, vkms: - (intel) Place 3D lut at correct place in colorops pipeline. - (all) Fix a leak during device init where strings were leaked. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/4c2f66df-c990-448a-b466-99a66981272b@linux.intel.com commit 1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2 Author: Jianpeng Chang Date: Wed Jan 21 13:29:26 2026 +0800 Bluetooth: MGMT: Fix memory leak in set_ssp_complete Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list. Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit. This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes. Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete(). Fixes: 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") Signed-off-by: Jianpeng Chang Signed-off-by: Luiz Augusto von Dentz commit 0c3cd7a0b862c37acbee6d9502107146cc944398 Author: Jia-Hong Su Date: Sun Jan 18 20:08:59 2026 +0800 Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv. The race condition is: CPU0 CPU1 ---- ---- hci_uart_set_proto() set_bit(HCI_UART_PROTO_INIT) hci_uart_register_dev() tty write wakeup hci_uart_tty_wakeup() hci_uart_tx_wakeup() schedule_work(&hu->write_work) proto->open(hu) // initializes hu->priv hci_uart_write_work() hci_uart_dequeue() proto->dequeue(hu) // accesses hu->priv (NULL!) Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled. Fixes: 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") Link: https://lore.kernel.org/linux-bluetooth/6969764f.170a0220.2b9fc4.35a7@mx.google.com/ Signed-off-by: Jia-Hong Su Signed-off-by: Luiz Augusto von Dentz commit 0a80e38d0fe1fe7b59c1e93ad908c4148a15926a Merge: 0309fc3cc0f508 4a3dba48188208 Author: Linus Torvalds Date: Thu Jan 22 09:32:11 2026 -0800 Merge tag 'net-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from CAN and wireless. Pretty big, but hard to make up any cohesive story that would explain it, a random collection of fixes. The two reverts of bad patches from this release here feel like stuff that'd normally show up by rc5 or rc6. Perhaps obvious thing to say, given the holiday timing. That said, no active investigations / regressions. Let's see what the next week brings. Current release - fix to a fix: - can: alloc_candev_mqs(): add missing default CAN capabilities Current release - regressions: - usbnet: fix crash due to missing BQL accounting after resume - Revert "net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not ... Previous releases - regressions: - Revert "nfc/nci: Add the inconsistency check between the input ... Previous releases - always broken: - number of driver fixes for incorrect use of seqlocks on stats - rxrpc: fix recvmsg() unconditional requeue, don't corrupt rcv queue when MSG_PEEK was set - ipvlan: make the addrs_lock be per port avoid races in the port hash table - sched: enforce that teql can only be used as root qdisc - virtio: coalesce only linear skb - wifi: ath12k: fix dead lock while flushing management frames - eth: igc: reduce TSN TX packet buffer from 7KB to 5KB per queue" * tag 'net-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits) Octeontx2-af: Add proper checks for fwdata dpll: Prevent duplicate registrations net/sched: act_ife: avoid possible NULL deref hinic3: Fix netif_queue_set_napi queue_index input parameter error vsock/test: add stream TX credit bounds test vsock/virtio: cap TX credit to local buffer size vsock/test: fix seqpacket message bounds test vsock/virtio: fix potential underflow in virtio_transport_get_credit() net: fec: account for VLAN header in frame length calculations net: openvswitch: fix data race in ovs_vport_get_upcall_stats octeontx2-af: Fix error handling net: pcs: pcs-mtk-lynxi: report in-band capability for 2500Base-X rxrpc: Fix data-race warning and potential load/store tearing net: dsa: fix off-by-one in maximum bridge ID determination net: bcmasp: Fix network filter wake for asp-3.0 bonding: provide a net pointer to __skb_flow_dissect() selftests: net: amt: wait longer for connection before sending packets be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list Revert "net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not-at-end warning" netrom: fix double-free in nr_route_frame() ... commit 0309fc3cc0f508895a224a1eb5c56af97025f9fb Merge: a66191c590b3b5 d1883cefd31752 Author: Linus Torvalds Date: Thu Jan 22 09:24:00 2026 -0800 Merge tag 'leds-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED fix from Lee Jones: - Fix race condition leading to null pointer dereference on ThinkPad * tag 'leds-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: leds: led-class: Only Add LED to leds_list when it is fully ready commit f377ea0561c9576cdb7e3890bcf6b8168d455464 Author: Alex Deucher Date: Wed Jan 21 18:10:04 2026 -0500 Revert "drm/amd/display: pause the workload setting in dm" This reverts commit bc6d54ac7e7436721a19443265f971f890c13cc5. The workload profile needs to be in the default state when the dc idle optimizaion state is entered. However, when jobs come in for video or GFX or compute, the profile may be set to a non-default profile resulting in the dc idle optimizations not taking affect and resulting in higher power usage. As such we need to pause the workload profile changes during this transition. When this patch was originally committed, it caused a regression with a Dell U3224KB display, but no other problems were reported at the time. When it was reapplied (this patch) to address increased power usage, it seems to have caused additional regressions. This change seems to have a number of side affects (audio issues, stuttering, etc.). I suspect the pause should only happen when all displays are off or in static screen mode, but I think this call site gets called more often than that which results in idle state entry more often than intended. For now revert. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4894 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4717 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4725 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4517 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4806 Cc: Yang Wang Cc: Kenneth Feng Cc: Roman Li Reviewed-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit 1412482b714358ffa30d38fd3dd0b05795163648) commit 5528fd38f230c906fcebb202cc94fbb8ed8f122a Author: Ilpo Järvinen Date: Wed Jan 21 15:14:17 2026 +0200 PCI: Fix Resizable BAR restore order The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") changed BAR resize to layer rebar code and resource setup/restore code cleanly. Unfortunately, it did not consider how the value of the BAR Size field impacts the read-only bits in the Base Address Register (PCIe7 spec, sec. 7.8.6.3). That is, it very much matters in which order the BAR Size and Base Address Register are restored. Post-337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") during BAR resize rollback, pci_do_resource_release_and_resize() attempts to restore the old address to the BAR that was resized, but it can fail to setup the address correctly if the address has low bits set that collide with the bits that are still read-only. As a result, kernel's resource and BAR will be out-of-sync. Fix this by restoring BAR Size before rolling back the resource changes and restoring the BAR. Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") Reported-by: Ville Syrjälä Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Ville Syrjälä Reviewed-by: Ville Syrjälä Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260121131417.9582-3-ilpo.jarvinen@linux.intel.com commit 08d9eae76b85263173f8c833800e3cc409ee1be4 Author: Ilpo Järvinen Date: Wed Jan 21 15:14:16 2026 +0200 PCI: Fix BAR resize rollback path overwriting ret The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") added BAR rollback to pci_do_resource_release_and_resize() in case of resize failure. On the rollback, pci_claim_resource() is called, which can fail and the code is prepared for that possibility. pci_claim_resource()'s return value, however, overwrites the original value of ret so pci_do_resource_release_and_resize() will return an incorrect value in the end (as pci_claim_resource() normally succeeds, in practice ret will be 0). Fix the issue by directly calling pci_claim_resource() inside the if (). Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") Reported-by: Ville Syrjälä Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Ville Syrjälä Reviewed-by: Ville Syrjälä Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260121131417.9582-2-ilpo.jarvinen@linux.intel.com commit 4a3dba48188208e4f66822800e042686784d29d1 Author: Hariprasad Kelam Date: Wed Jan 21 15:18:19 2026 +0530 Octeontx2-af: Add proper checks for fwdata firmware populates MAC address, link modes (supported, advertised) and EEPROM data in shared firmware structure which kernel access via MAC block(CGX/RPM). Accessing fwdata, on boards booted with out MAC block leading to kernel panics. Internal error: Oops: 0000000096000005 [#1] SMP [ 10.460721] Modules linked in: [ 10.463779] CPU: 0 UID: 0 PID: 174 Comm: kworker/0:3 Not tainted 6.19.0-rc5-00154-g76ec646abdf7-dirty #3 PREEMPT [ 10.474045] Hardware name: Marvell OcteonTX CN98XX board (DT) [ 10.479793] Workqueue: events work_for_cpu_fn [ 10.484159] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 10.491124] pc : rvu_sdp_init+0x18/0x114 [ 10.495051] lr : rvu_probe+0xe58/0x1d18 Fixes: 997814491cee ("Octeontx2-af: Fetch MAC channel info from firmware") Fixes: 5f21226b79fd ("Octeontx2-pf: ethtool: support multi advertise mode") Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20260121094819.2566786-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit f3ddbaaaaf4d0633b40482f471753f9c71294a4a Author: Ivan Vecera Date: Wed Jan 21 14:00:11 2026 +0100 dpll: Prevent duplicate registrations Modify the internal registration helpers dpll_xa_ref_{dpll,pin}_add() to reject duplicate registration attempts. Previously, if a caller attempted to register the same pin multiple times (with the same ops, priv, and cookie) on the same device, the core silently increments the reference count and return success. This behavior is incorrect because if the caller makes these duplicate registrations then for the first one dpll_pin_registration is allocated and for others the associated dpll_pin_ref.refcount is incremented. During the first unregistration the associated dpll_pin_registration is freed and for others WARN is fired. Fix this by updating the logic to return `-EEXIST` if a matching registration is found to enforce a strict "register once" policy. Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions") Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260121130012.112606-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 27880b0b0d35ad1c98863d09788254e36f874968 Author: Eric Dumazet Date: Wed Jan 21 13:37:24 2026 +0000 net/sched: act_ife: avoid possible NULL deref tcf_ife_encode() must make sure ife_encode() does not return NULL. syzbot reported: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166 CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full) Call Trace: ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101 tcf_ife_encode net/sched/act_ife.c:841 [inline] tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877 tc_act include/net/tc_wrapper.h:130 [inline] tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152 tcf_exts_exec include/net/pkt_cls.h:349 [inline] mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860 multiq_classify net/sched/sch_multiq.c:39 [inline] multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66 dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798 Fixes: 295a6e06d21e ("net/sched: act_ife: Change to use ife module") Reported-by: syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6970d61d.050a0220.706b.0010.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Yotam Gigi Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260121133724.3400020-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fb2bb2a1ebf7b9514c32b03bb5c3be5d518d437b Author: Fan Gong Date: Thu Jan 22 17:41:55 2026 +0800 hinic3: Fix netif_queue_set_napi queue_index input parameter error Incorrectly transmitted interrupt number instead of queue number when using netif_queue_set_napi. Besides, move this to appropriate code location to set napi. Remove redundant netif_stop_subqueue beacuase it is not part of the hinic3_send_one_skb process. Fixes: 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic") Co-developed-by: Zhu Yikai Signed-off-by: Zhu Yikai Signed-off-by: Fan Gong Link: https://patch.msgid.link/7b8e4eb5c53cbd873ee9aaefeb3d9dbbaff52deb.1769070766.git.zhuyikai1@h-partners.com Signed-off-by: Jakub Kicinski commit 0baa4d3170d72a2a8dc93bf729d6d04ad113dc72 Author: Zilin Guan Date: Thu Jan 22 11:41:28 2026 +0000 can: at91_can: Fix memory leak in at91_can_probe() In at91_can_probe(), the dev structure is allocated via alloc_candev(). However, if the subsequent call to devm_phy_optional_get() fails, the code jumps directly to exit_iounmap, missing the call to free_candev(). This results in a memory leak of the allocated net_device structure. Fix this by jumping to the exit_free label instead, which ensures that free_candev() is called to properly release the memory. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 3ecc09856afb ("can: at91_can: add CAN transceiver support") Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20260122114128.643752-1-zilin@seu.edu.cn Signed-off-by: Marc Kleine-Budde commit 9146fe2829907a73464210db1a117103941d94f1 Merge: 5778d65d4b85d4 50b359896fe55d Author: Jakub Kicinski Date: Thu Jan 22 07:54:30 2026 -0800 Merge tag 'wireless-2026-11-22' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Another set of updates: - various small fixes for ath10k/ath12k/mwifiex/rsi - cfg80211 fix for HE bitrate overflow - mac80211 fixes - S1G beacon handling in scan - skb tailroom handling for HW encryption - CSA fix for multi-link - handling of disabled links during association * tag 'wireless-2026-11-22' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: ignore link disabled flag from userspace wifi: mac80211: apply advertised TTLM from association response wifi: mac80211: parse all TTLM entries wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice wifi: mac80211: don't perform DA check on S1G beacon wifi: ath12k: Fix wrong P2P device link id issue wifi: ath12k: fix dead lock while flushing management frames wifi: ath12k: Fix scan state stuck in ABORTING after cancel_remain_on_channel wifi: ath12k: cancel scan only on active scan vdev wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() wifi: mac80211: correctly check if CSA is active wifi: cfg80211: Fix bitrate calculation overflow for HE rates wifi: rsi: Fix memory corruption due to not set vif driver data size wifi: ath12k: don't force radio frequency check in freq_to_idx() wifi: ath12k: fix dma_free_coherent() pointer wifi: ath10k: fix dma_free_coherent() pointer ==================== Link: https://patch.msgid.link/20260122110248.15450-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 5778d65d4b85d4929d30998863e08e20af4b6113 Merge: ca1bb3fedf26a0 2a689f76edd04a Author: Paolo Abeni Date: Thu Jan 22 15:41:35 2026 +0100 Merge branch 'vsock-virtio-fix-tx-credit-handling' Stefano Garzarella says: ==================== vsock/virtio: fix TX credit handling The original series was posted by Melbin K Mathew till v4. Since it's a real issue and the original author seems busy, I'm sending the new version fixing my comments but keeping the authorship (and restoring mine on patch 2 as reported on v4). v5: https://lore.kernel.org/netdev/20260116201517.273302-1-sgarzare@redhat.com/ v4: https://lore.kernel.org/netdev/20251217181206.3681159-1-mlbnkm1@gmail.com/ From Melbin K Mathew : This series fixes TX credit handling in virtio-vsock: Patch 1: Fix potential underflow in get_credit() using s64 arithmetic Patch 2: Fix vsock_test seqpacket bounds test Patch 3: Cap TX credit to local buffer size (security hardening) Patch 4: Add stream TX credit bounds regression test The core issue is that a malicious guest can advertise a huge buffer size via SO_VM_SOCKETS_BUFFER_SIZE, causing the host to allocate excessive sk_buff memory when sending data to that guest. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. With this series applied, the same PoC shows only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. ==================== Link: https://patch.msgid.link/20260121093628.9941-1-sgarzare@redhat.com Signed-off-by: Paolo Abeni commit 2a689f76edd04a53137bd01d4618343f4cdd7e23 Author: Melbin K Mathew Date: Wed Jan 21 10:36:28 2026 +0100 vsock/test: add stream TX credit bounds test Add a regression test for the TX credit bounds fix. The test verifies that a sender with a small local buffer size cannot queue excessive data even when the peer advertises a large receive buffer. The client: - Sets a small buffer size (64 KiB) - Connects to server (which advertises 2 MiB buffer) - Sends in non-blocking mode until EAGAIN - Verifies total queued data is bounded This guards against the original vulnerability where a remote peer could cause unbounded kernel memory allocation by advertising a large buffer and reading slowly. Suggested-by: Stefano Garzarella Signed-off-by: Melbin K Mathew [Stefano: use sock_buf_size to check the bytes sent + small fixes] Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20260121093628.9941-5-sgarzare@redhat.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 8ee784fdf006cbe8739cfa093f54d326cbf54037 Author: Melbin K Mathew Date: Wed Jan 21 10:36:27 2026 +0100 vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value. On the host side this means that the amount of data we are willing to queue for a connection is scaled by a guest-chosen buffer size, rather than the host's own vsock configuration. A malicious guest can advertise a large buffer and read slowly, causing the host to allocate a correspondingly large amount of sk_buff memory. The same thing would happen in the guest with a malicious host, since virtio transports share the same code base. Introduce a small helper, virtio_transport_tx_buf_size(), that returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume peer_buf_alloc. This ensures the effective TX window is bounded by both the peer's advertised buffer and our own buf_alloc (already clamped to buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer cannot force the other to queue more data than allowed by its own vsock settings. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. That said, if QEMU memory is limited with cgroups, the maximum memory used will be limited. With this patch applied: Before: MemFree: ~61.6 GiB Slab: ~142 MiB SUnreclaim: ~117 MiB After 32 high-credit connections: MemFree: ~61.5 GiB Slab: ~178 MiB SUnreclaim: ~152 MiB Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. Compatibility with non-virtio transports: - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per socket based on the local vsk->buffer_* values; the remote side cannot enlarge those queues beyond what the local endpoint configured. - Hyper-V's vsock transport uses fixed-size VMBus ring buffers and an MTU bound; there is no peer-controlled credit field comparable to peer_buf_alloc, and the remote endpoint cannot drive in-flight kernel memory above those ring sizes. - The loopback path reuses virtio_transport_common.c, so it naturally follows the same semantics as the virtio transport. This change is limited to virtio_transport_common.c and thus affects virtio-vsock, vhost-vsock, and loopback, bringing them in line with the "remote window intersected with local policy" behaviour that VMCI and Hyper-V already effectively have. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Suggested-by: Stefano Garzarella Signed-off-by: Melbin K Mathew [Stefano: small adjustments after changing the previous patch] [Stefano: tweak the commit message] Signed-off-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20260121093628.9941-4-sgarzare@redhat.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 0a98de80136968bab7db37b16282b37f044694d3 Author: Stefano Garzarella Date: Wed Jan 21 10:36:26 2026 +0100 vsock/test: fix seqpacket message bounds test The test requires the sender (client) to send all messages before waking up the receiver (server). Since virtio-vsock had a bug and did not respect the size of the TX buffer, this test worked, but now that we are going to fix the bug, the test hangs because the sender would fill the TX buffer before waking up the receiver. Set the buffer size in the sender (client) as well, as we already do for the receiver (server). Fixes: 5c338112e48a ("test/vsock: rework message bounds test") Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20260121093628.9941-3-sgarzare@redhat.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 3ef3d52a1a9860d094395c7a3e593f3aa26ff012 Author: Melbin K Mathew Date: Wed Jan 21 10:36:25 2026 +0100 vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes are in flight, the subtraction can underflow and produce a large positive value, potentially allowing more data to be queued than the peer can handle. Reuse virtio_transport_has_space() which already handles this case and add a comment to make it clear why we are doing that. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Suggested-by: Stefano Garzarella Signed-off-by: Melbin K Mathew [Stefano: use virtio_transport_has_space() instead of duplicating the code] [Stefano: tweak the commit message] Signed-off-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20260121093628.9941-2-sgarzare@redhat.com Acked-by: Michael S. Tsirkin Signed-off-by: Paolo Abeni commit 3ef825dfd4e487d6f92b23ee2df2455814583ef4 Author: Shida Zhang Date: Thu Jan 22 14:13:21 2026 +0800 bcache: use bio cloning for detached device requests Previously, bcache hijacked the bi_end_io and bi_private fields of the incoming bio when the backing device was in a detached state. This is fragile and breaks if the bio is needed to be processed by other layers. This patch transitions to using a cloned bio embedded within a private structure. This ensures the original bio's metadata remains untouched. Fixes: 53280e398471 ("bcache: fix improper use of bi_end_io") Co-developed-by: Christoph Hellwig Signed-off-by: Christoph Hellwig Signed-off-by: Shida Zhang Acked-by: Coly Li Signed-off-by: Jens Axboe commit 046be7e5967ef80547f7fd8a399e932f5338d5d4 Author: Ming Lei Date: Thu Jan 22 12:28:58 2026 +0800 blk-mq: use BLK_POLL_ONESHOT for synchronous poll completion blk_execute_rq() with polling is used in kernel code paths such as NVMe controller connect. The aggressive spinning in blk_hctx_poll() can prevent the completion task from getting a chance to run, causing a lockup. The spinning with cpu_relax() doesn't yield CPU, so need_resched() only becomes true on timer tick. This causes unnecessary spinning while the completion task is already waiting to run. Before commit f22ecf9c14c1, the loop would exit early because task_is_running() was always true. After that commit removed the check, the loop now spins until need_resched(). Fix this by using BLK_POLL_ONESHOT in blk_rq_poll_completion(). This causes blk_hctx_poll() to poll once and return immediately, letting the outer loop's cond_resched() yield CPU so the completion task can run. Fixes: f22ecf9c14c1 ("blk-mq: delete task running check in blk_hctx_poll()") Cc: Diangang Li Cc: Fengnan Chang Reported-by: Yi Zhang Signed-off-by: Ming Lei Tested-by: Yi Zhang Signed-off-by: Jens Axboe commit ddc6cbef3ef10359b5640b4ee810a520edc73586 Author: Alexander Egorenkov Date: Wed Jan 21 14:59:50 2026 +0100 s390/boot/vmlinux.lds.S: Ensure bzImage ends with SecureBoot trailer Since commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") the .modinfo section which has SHF_ALLOC ends up in bzImage after the SecureBoot trailer. This breaks SecureBoot because the bootloader can no longer find the SecureBoot trailer with kernel's signature at the expected location in bzImage. To fix the bug, move discarded sections before the ELF_DETAILS macro and discard the .modinfo section which is not needed by the decompressor. Fixes: 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") Cc: stable@vger.kernel.org Suggested-by: Vasily Gorbik Reviewed-by: Vasily Gorbik Tested-by: Vasily Gorbik Signed-off-by: Alexander Egorenkov Signed-off-by: Heiko Carstens commit e351836a54e3b0b4483f896abcd6a0dc71097693 Author: Yixun Lan Date: Thu Jan 22 07:52:00 2026 +0800 i2c: spacemit: drop IRQF_ONESHOT flag from IRQ request In commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler")[1], it will check IRQF_ONESHOT flag in IRQ request, and gives a warning if there is no threaded handler. Drop this flag to fix this warning. Link: https://lore.kernel.org/r/20260112134013.eQWyReHR@linutronix.de/ [1] Fixes: 5ea558473fa3 ("i2c: spacemit: add support for SpacemiT K1 SoC") Signed-off-by: Yixun Lan Cc: # v6.15+ Reviewed-by: Javier Martinez Canillas Reviewed-by: Troy Mitchell Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260122-05-k1-i2c-irq-v1-1-9b8d94bbcd22@kernel.org commit 64e0924ed3b446fdd758dfab582e0e961863a116 Author: Martin Hamilton Date: Thu Jan 22 02:51:18 2026 +0000 ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio The amp/speakers on the Lenovo Yoga Book 9i 13IRU8 laptop aren't fully powered up, resulting in horrible tinny sound by default. The kernel has an existing quirk for PCI SSID 0x17aa3843 which matches this machine and several others. The quirk applies the ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP fixup, however the fixup does not work on this machine. This patch modifies the existing quirk by adding a check for the subsystem ID 0x17aa3881. If present, ALC287_FIXUP_TAS2781_I2C will be applied instead of ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP. With this change the TAS2781 amp is powered up, firmware is downloaded and recognised by HDA/SOF - i.e. all is good, and we can boogie. Code is re-used from alc298_fixup_lenovo_c940_duet7(), which fixes a similar problem with two other Lenovo laptops. Cross checked against ALSA cardinfo database for potential clashes. Tested against 6.18.5 kernel built with Arch Linux default options. Tested in HDA mode and SOF mode. Note: Possible further work required to address quality of life issues caused by the firmware's agressive power saving, and to improve ALSA control mappings. Signed-off-by: Martin Hamilton Link: https://patch.msgid.link/20260122-alc269-yogabook9i-fixup-v1-1-a6883429400f@martinh.net Signed-off-by: Takashi Iwai commit c45385ed624eecc5305ff165e1ac5dfa7548bcd5 Author: Zhang Heng Date: Thu Jan 22 16:52:40 2026 +0800 ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone After applying this quirk for the ALC256 audio codec, the headphone audio path functions normally; otherwise, headphones produce no sound. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220574 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260122085240.3163975-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 5cfc828502cbd0c827113bdb5694c2658af2c37c Author: Huan He Date: Wed Jan 14 20:22:56 2026 +0800 mmc: sdhci-of-dwcmshc: Fix DMA 128MB boundary for Eswin EIC7700 This DWC MSHC has a 128MB limitation where the data buffer size and start address must not exceed the 128MB boundary. Registering the missing 'adma_write_desc' callback function. Signed-off-by: Huan He Acked-by: Adrian Hunter Fixes: 32b2633219d3 ("mmc: sdhci-of-dwcmshc: Add support for Eswin EIC7700") Signed-off-by: Ulf Hansson commit fd9809ec6704db0c162b4510b11f877ec7b72065 Author: Huan He Date: Wed Jan 14 20:21:41 2026 +0800 mmc: sdhci-of-dwcmshc: Fix init for AXI clock for Eswin EIC7700 Accessing the High-Speed registers requires the AXI clock to be enabled. Signed-off-by: Huan He Acked-by: Adrian Hunter Fixes: 32b2633219d3 ("mmc: sdhci-of-dwcmshc: Add support for Eswin EIC7700") Signed-off-by: Ulf Hansson commit ca1bb3fedf26a08ed31974131bc0064d4fe33649 Author: Clemens Gruber Date: Wed Jan 21 09:37:51 2026 +0100 net: fec: account for VLAN header in frame length calculations The MAX_FL (maximum frame length) and related calculations used ETH_HLEN, which does not account for the 4-byte VLAN tag in tagged frames. This caused the hardware to reject valid VLAN frames as oversized, resulting in RX errors and dropped packets. Use VLAN_ETH_HLEN instead of ETH_HLEN in the MAX_FL register setup, cut-through mode threshold, buffer allocation, and max_mtu calculation. Cc: stable@kernel.org # v6.18+ Fixes: 62b5bb7be7bc ("net: fec: update MAX_FL based on the current MTU") Fixes: d466c16026e9 ("net: fec: enable the Jumbo frame support for i.MX8QM") Fixes: 59e9bf037d75 ("net: fec: add change_mtu to support dynamic buffer allocation") Fixes: ec2a1681ed4f ("net: fec: use a member variable for maximum buffer size") Signed-off-by: Clemens Gruber Reviewed-by: Wei Fang Link: https://patch.msgid.link/20260121083751.66997-1-mail@clemensgruber.at Signed-off-by: Paolo Abeni commit cc4816bdb08639e5cd9acb295a02d6f0f09736b4 Author: David Yang Date: Wed Jan 21 15:29:26 2026 +0800 net: openvswitch: fix data race in ovs_vport_get_upcall_stats In ovs_vport_get_upcall_stats(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics are already accumulated by u64_stats_inc(). Fix this by reading them into temporary variables first. Fixes: 1933ea365aa7 ("net: openvswitch: Add support to count upcall packets") Signed-off-by: David Yang Acked-by: Ilya Maximets Reviewed-by: Eric Dumazet Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20260121072932.2360971-1-mmyangfl@gmail.com Signed-off-by: Paolo Abeni commit e27ada4f19e7ffda4c05ce8633daf6daed667eea Author: Thomas Hellström Date: Wed Jan 21 10:10:48 2026 +0100 drm/xe: Select CONFIG_DEVICE_PRIVATE when DRM_XE_GPUSVM is selected CONFIG_DEVICE_PRIVATE is a prerequisite for DRM_XE_GPUSVM. Explicitly select it so that DRM_XE_GPUSVM is not unintentionally left out from distro configs not explicitly enabling CONFIG_DEVICE_PRIVATE. v2: - Select also CONFIG_ZONE_DEVICE since it's needed by CONFIG_DEVICE_PRIVATE. v3: - Depend on CONFIG_ZONE_DEVICE rather than selecting it. Cc: Matthew Auld Cc: Matthew Brost Cc: Rodrigo Vivi Cc: Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20260121091048.41371-3-thomas.hellstrom@linux.intel.com (cherry picked from commit 9386f49316074d2d76fd78d6bd359996de42fb7f) Signed-off-by: Thomas Hellström commit d2907cbe9ea0a54cbe078076f9d089240ee1e2d9 Author: Mark Rutland Date: Tue Jan 20 14:51:07 2026 +0000 arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds memory (and may potentially take a fatal fault) and/or may kill the task with a SIGKILL. (1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into an invalid state where SVCR.SM is set (and sve_state is non-NULL) but TIF_SME is clear, consequently resuting in out-of-bounds memory reads and/or killing the task with SIGKILL. This can only occur in unusual (but legitimate) cases where the SVE signal context has either been modified by userspace or was saved in the context of another task (e.g. as with CRIU), as otherwise the presence of an SVE signal context with SVE_SIG_FLAG_SM implies that TIF_SME is already set. While in this state, task_fpsimd_load() will NOT configure SMCR_ELx (leaving some arbitrary value configured in hardware) before restoring SVCR and attempting to restore the streaming mode SVE registers from memory via sve_load_state(). As the value of SMCR_ELx.LEN may be larger than the task's streaming SVE vector length, this may read memory outside of the task's allocated sve_state, reading unrelated data and/or triggering a fault. While this can result in secrets being loaded into streaming SVE registers, these values are never exposed. As TIF_SME is clear, fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0 accesses to streaming mode SVE registers, so these cannot be accessed directly at EL0. As fpsimd_save_user_state() verifies the live vector length before saving (S)SVE state to memory, no secret values can be saved back to memory (and hence cannot be observed via ptrace, signals, etc). When the live vector length doesn't match the expected vector length for the task, fpsimd_save_user_state() will send a fatal SIGKILL signal to the task. Hence the task may be killed after executing userspace for some period of time. (2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the task's SVCR.SM. If SVCR.SM was set prior to restoring the context, then the task will be left in streaming mode unexpectedly, and some register state will be combined inconsistently, though the task will be left in legitimate state from the kernel's PoV. This can only occur in unusual (but legitimate) cases where ptrace has been used to set SVCR.SM after entry to the sigreturn syscall, as syscall entry clears SVCR.SM. In these cases, the the provided SVE register data will be loaded into the task's sve_state using the non-streaming SVE vector length and the FPSIMD registers will be merged into this using the streaming SVE vector length. Fix (1) by setting TIF_SME when setting SVCR.SM. This also requires ensuring that the task's sme_state has been allocated, but as this could contain live ZA state, it should not be zeroed. Fix (2) by clearing SVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear. For consistency, I've pulled the manipulation of SVCR, TIF_SVE, TIF_SME, and fp_type earlier, immediately after the allocation of sve_state/sme_state, before the restore of the actual register state. This makes it easier to ensure that these are always modified consistently, even if a fault is taken while reading the register data from the signal context. I do not expect any software to depend on the exact state restored when a fault is taken while reading the context. Fixes: 85ed24dad290 ("arm64/sme: Implement streaming SVE signal handling") Signed-off-by: Mark Rutland Cc: Cc: Mark Brown Cc: Will Deacon Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4 Author: Mark Rutland Date: Tue Jan 20 14:51:06 2026 +0000 arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring a ZA context can place a task into an invalid state where TIF_SME is set but the task's sve_state is NULL. In legitimate but uncommon cases where the ZA signal context was NOT created by the kernel in the context of the same task (e.g. if the task is saved/restored with something like CRIU), we have no guarantee that sve_state had been allocated previously. In these cases, userspace can enter streaming mode without trapping while sve_state is NULL, causing a later NULL pointer dereference when the kernel attempts to store the register state: | # ./sigreturn-za | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000046 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x06: level 2 translation fault | Data abort info: | ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00 | [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000 | Internal error: Oops: 0000000096000046 [#1] SMP | Modules linked in: | CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT | Hardware name: linux,dummy-virt (DT) | pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : sve_save_state+0x4/0xf0 | lr : fpsimd_save_user_state+0xb0/0x1c0 | sp : ffff80008070bcc0 | x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658 | x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40 | x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000 | x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c | x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020 | x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0 | x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48 | x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000 | x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440 | Call trace: | sve_save_state+0x4/0xf0 (P) | fpsimd_thread_switch+0x48/0x198 | __switch_to+0x20/0x1c0 | __schedule+0x36c/0xce0 | schedule+0x34/0x11c | exit_to_user_mode_loop+0x124/0x188 | el0_interrupt+0xc8/0xd8 | __el0_irq_handler_common+0x18/0x24 | el0t_64_irq_handler+0x10/0x1c | el0t_64_irq+0x198/0x19c | Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800) | ---[ end trace 0000000000000000 ]--- Fix this by having restore_za_context() ensure that the task's sve_state is allocated, matching what we do when taking an SME trap. Any live SVE/SSVE state (which is restored earlier from a separate signal context) must be preserved, and hence this is not zeroed. Fixes: 39782210eb7e ("arm64/sme: Implement ZA signal handling") Signed-off-by: Mark Rutland Cc: Cc: Mark Brown Cc: Will Deacon Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit 128a7494a9f15aad60cc6b7e3546bf481ac54a13 Author: Mark Rutland Date: Tue Jan 20 14:51:05 2026 +0000 arm64/fpsimd: ptrace: Fix SVE writes on !SME systems When SVE is supported but SME is not supported, a ptrace write to the NT_ARM_SVE regset can place the tracee into an invalid state where (non-streaming) SVE register data is stored in FP_STATE_SVE format but TIF_SVE is clear. This can result in a later warning from fpsimd_restore_current_state(), e.g. WARNING: CPU: 0 PID: 7214 at arch/arm64/kernel/fpsimd.c:383 fpsimd_restore_current_state+0x50c/0x748 When this happens, fpsimd_restore_current_state() will set TIF_SVE, placing the task into the correct state. This occurs before any other check of TIF_SVE can possibly occur, as other checks of TIF_SVE only happen while the FPSIMD/SVE/SME state is live. Thus, aside from the warning, there is no functional issue. This bug was introduced during rework to error handling in commit: 9f8bf718f2923 ("arm64/fpsimd: ptrace: Gracefully handle errors") ... where the setting of TIF_SVE was moved into a block which is only executed when system_supports_sme() is true. Fix this by removing the system_supports_sme() check. This ensures that TIF_SVE is set for (SVE-formatted) writes to NT_ARM_SVE, at the cost of unconditionally manipulating the tracee's saved svcr value. The manipulation of svcr is benign and inexpensive, and we already do similar elsewhere (e.g. during signal handling), so I don't think it's worth guarding this with system_supports_sme() checks. Aside from the above, there is no functional change. The 'type' argument to sve_set_common() is only set to ARM64_VEC_SME (in ssve_set())) when system_supports_sme(), so the ARM64_VEC_SME case in the switch statement is still unreachable when !system_supports_sme(). When CONFIG_ARM64_SME=n, the only caller of sve_set_common() is sve_set(), and the compiler can constant-fold for the case where type is ARM64_VEC_SVE, removing the logic for other cases. Reported-by: syzbot+d4ab35af21e99d07ce67@syzkaller.appspotmail.com Fixes: 9f8bf718f292 ("arm64/fpsimd: ptrace: Gracefully handle errors") Signed-off-by: Mark Rutland Cc: Cc: Mark Brown Cc: Will Deacon Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit bdcdf968be314b6fc8835b99fb4519e7619671e6 Author: Thomas Hellström Date: Wed Jan 21 10:10:47 2026 +0100 drm, drm/xe: Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE CONFIG_DEVICE_PRIVATE is not selected by default by some distros, for example Fedora, and that leads to a regression in the xe driver since userptr support gets compiled out. It turns out that DRM_GPUSVM, which is needed for xe userptr support compiles also without CONFIG_DEVICE_PRIVATE, but doesn't compile without CONFIG_ZONE_DEVICE. Exclude the drm_pagemap files from compilation with !CONFIG_ZONE_DEVICE, and remove the CONFIG_DEVICE_PRIVATE dependency from CONFIG_DRM_GPUSVM and the xe driver's selection of it, re-enabling xe userptr for those configs. v2: - Don't compile the drm_pagemap files unless CONFIG_ZONE_DEVICE is set. - Adjust the drm_pagemap.h header accordingly. Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Cc: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Cc: Matthew Brost Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: dri-devel@lists.freedesktop.org Cc: # v6.18+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Acked-by: Maarten Lankhorst Link: https://patch.msgid.link/20260121091048.41371-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 1e372b246199ca7a35f930177fea91b557dac16e) Signed-off-by: Thomas Hellström commit 0a095b64fa5b4b1edfeb2e9b1751e044230c5d73 Author: Chaitanya Kumar Borah Date: Tue Jan 13 15:52:54 2026 +0530 drm/i915/display: Fix color pipeline enum name leak intel_color_pipeline_plane_init() allocates enum names for color pipelines, which are copied by drm_property_create_enum(). The temporary strings were not freed, resulting in a memory leak. Allocate enum names only after successful pipeline construction and free them on all exit paths. Fixes: ef105316819d ("drm/i915/color: Create a transfer function color pipeline") Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Signed-off-by: Maarten Lankhorst Acked-by: Jani Nikula Link: https://patch.msgid.link/20260113102303.724205-5-chaitanya.kumar.borah@intel.com commit cce30b8311e8a342f97cee60a72c2d921605adbd Author: Chaitanya Kumar Borah Date: Tue Jan 13 15:52:53 2026 +0530 drm/vkms: Fix color pipeline enum name leak vkms_initialize_colorops() allocates enum names for color pipelines, which are copied by drm_property_create_enum(). The temporary strings were not freed, resulting in a memory leak. Allocate enum names only after successful pipeline construction and free them on all exit paths Fixes: c1e578bd08da ("drm/vkms: Add enumerated 1D curve colorop") Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Reviewed-by: Louis Chauvet Signed-off-by: Maarten Lankhorst Link: https://patch.msgid.link/20260113102303.724205-4-chaitanya.kumar.borah@intel.com commit 7d8257fe2590fea9fef8071507f3b8a052c5e3d1 Author: Chaitanya Kumar Borah Date: Tue Jan 13 15:52:52 2026 +0530 drm/amd/display: Fix color pipeline enum name leak dm_plane_init_colorops() allocates enum names for color pipelines. These are eventually passed to drm_property_create_enum() which create its own copies of the string. Free the strings after initialization is done. Also, allocate color pipeline enum names only after successfully creating color pipeline. Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Reviewed-by: Alex Hung Signed-off-by: Maarten Lankhorst Acked-by: Alex Deucher #irc Link: https://patch.msgid.link/20260113102303.724205-3-chaitanya.kumar.borah@intel.com commit 7261305d22a729fb7f8a3187414c145a492787d4 Author: Chaitanya Kumar Borah Date: Tue Jan 13 15:52:51 2026 +0530 drm/i915/color: Place 3D LUT after CSC in plane color pipeline Move the 3D LUT block to its correct position in the plane color pipeline: [Pre-CSC] -> [CSC] -> [3DLUT] -> [Post-CSC] Fixes: 65db7a1f9cf7 ("drm/i915/color: Add 3D LUT to color pipeline") Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Suraj Kandpal Reviewed-by: Uma Shankar Signed-off-by: Maarten Lankhorst Acked-by: Jani Nikula Link: https://patch.msgid.link/20260113102303.724205-2-chaitanya.kumar.borah@intel.com commit a66191c590b3b58eaff05d2277971f854772bd5b Merge: 79f255b2e9a2f7 12ffd561d2de28 Author: Linus Torvalds Date: Wed Jan 21 21:53:26 2026 -0800 Merge tag 'hyperv-fixes-signed-20260121' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix ARM64 port of the MSHV driver (Anirudh Rayabharam) - Fix huge page handling in the MSHV driver (Stanislav Kinsburskii) - Minor fixes to driver code (Julia Lawall, Michael Kelley) * tag 'hyperv-fixes-signed-20260121' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: handle gpa intercepts for arm64 mshv: add definitions for arm64 gpa intercepts mshv: Add __user attribute to argument passed to access_ok() mshv: Store the result of vfs_poll in a variable of type __poll_t mshv: Align huge page stride with guest mapping Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() Drivers: hv: vmbus: fix typo in function name reference commit 79f255b2e9a2f714efcd91777ccb9e4827e20006 Merge: cf38b2340c0e60 1eb217ab2e7376 Author: Linus Torvalds Date: Wed Jan 21 21:50:44 2026 -0800 Merge tag 'perf-tools-fixes-for-v6.19-2026-01-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf-tools fix from Namhyung Kim: "A minor fix for error handling in the event parser" * tag 'perf-tools-fixes-for-v6.19-2026-01-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf parse-events: Fix evsel allocation failure commit 19e4175e997a5b85eab97d522f00cc99abd1873c Author: Ratheesh Kannoth Date: Wed Jan 21 09:09:34 2026 +0530 octeontx2-af: Fix error handling This commit adds error handling and rollback logic to rvu_mbox_handler_attach_resources() to properly clean up partially attached resources when rvu_attach_block() fails. Fixes: 746ea74241fa0 ("octeontx2-af: Add RVU block LF provisioning support") Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260121033934.1900761-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit e8ca461f7d19464b47c64fe4cf2f83162421bcc0 Author: Daniel Golle Date: Wed Jan 21 02:23:17 2026 +0000 net: pcs: pcs-mtk-lynxi: report in-band capability for 2500Base-X It turns out that 2500Base-X actually works fine with in-band status on MediaTek's LynxI PCS -- I wrongly concluded it didn't because it is broken in all the copper SFP modules and GPON sticks I used for testing. Hence report LINK_INBAND_ENABLE also for 2500Base-X mode. This reverts most of commit a003c38d9bbb ("net: pcs: pcs-mtk-lynxi: correctly report in-band status capabilities"). The removal of the QSGMII interface mode was correct and is left untouched. Link: https://github.com/openwrt/openwrt/issues/21436 Fixes: a003c38d9bbb ("net: pcs: pcs-mtk-lynxi: correctly report in-band status capabilities") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/b1cf26157b63fee838be09ae810497fb22fd8104.1768961746.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 5d5fe8bcd331f1e34e0943ec7c18432edfcf0e8b Author: David Howells Date: Tue Jan 20 10:13:05 2026 +0000 rxrpc: Fix data-race warning and potential load/store tearing Fix the following: BUG: KCSAN: data-race in rxrpc_peer_keepalive_worker / rxrpc_send_data_packet which is reporting an issue with the reads and writes to ->last_tx_at in: conn->peer->last_tx_at = ktime_get_seconds(); and: keepalive_at = peer->last_tx_at + RXRPC_KEEPALIVE_TIME; The lockless accesses to these to values aren't actually a problem as the read only needs an approximate time of last transmission for the purposes of deciding whether or not the transmission of a keepalive packet is warranted yet. Also, as ->last_tx_at is a 64-bit value, tearing can occur on a 32-bit arch. Fix both of these by switching to an unsigned int for ->last_tx_at and only storing the LSW of the time64_t. It can then be reconstructed at need provided no more than 68 years has elapsed since the last transmission. Fixes: ace45bec6d77 ("rxrpc: Fix firewall route keepalive") Reported-by: syzbot+6182afad5045e6703b3d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/695e7cfb.050a0220.1c677c.036b.GAE@google.com/ Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/1107124.1768903985@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 869f3f7f1f622f7894decef7078bb963148be0ef Merge: dfca045cd4d0ea bdfc7b55adcd04 Author: Jakub Kicinski Date: Wed Jan 21 19:54:21 2026 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-20 (ice, idpf) For ice: Cody Haas breaks dependency of needing both RSS key and LUT for ice_get_rxfh() as ethtool ioctls do not always supply both. Paul fixes issues related to devlink reload; adding missing deinit HW call and moving hwmon exit function to the proper call chain. For idpf: Mina Almasry moves a register read call into the time sandwich to ensure the register is properly flushed. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: read lower clock bits inside the time sandwich ice: fix devlink reload call trace ice: add missing ice_deinit_hw() in devlink reinit path ice: Fix persistent failure in ice_get_rxfh ==================== Link: https://patch.msgid.link/20260120224430.410377-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit dfca045cd4d0ea07ff4198ba392be3e718acaddc Author: Vladimir Oltean Date: Tue Jan 20 23:10:39 2026 +0200 net: dsa: fix off-by-one in maximum bridge ID determination Prior to the blamed commit, the bridge_num range was from 0 to ds->max_num_bridges - 1. After the commit, it is from 1 to ds->max_num_bridges. So this check: if (bridge_num >= max) return 0; must be updated to: if (bridge_num > max) return 0; in order to allow the last bridge_num value (==max) to be used. This is easiest visible when a driver sets ds->max_num_bridges=1. The observed behaviour is that even the first created bridge triggers the netlink extack "Range of offloadable bridges exceeded" warning, and is handled in software rather than being offloaded. Fixes: 3f9bb0301d50 ("net: dsa: make dp->bridge_num one-based") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260120211039.3228999-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit bbb11b8d758d17a4ce34b8ed0b49de150568265b Author: Justin Chen Date: Tue Jan 20 11:23:39 2026 -0800 net: bcmasp: Fix network filter wake for asp-3.0 We need to apply the tx_chan_offset to the netfilter cfg channel or the output channel will be incorrect for asp-3.0 and newer. Fixes: e9f31435ee7d ("net: bcmasp: Add support for asp-v3.0") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20260120192339.2031648-1-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 5f9b329096596b7e53e07d041d7fca4cbe1be752 Author: Eric Dumazet Date: Tue Jan 20 16:17:44 2026 +0000 bonding: provide a net pointer to __skb_flow_dissect() After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), either via skb->dev, skb->sk, or a user provided pointer. In the following case, syzbot was able to cook a bare skb. WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053 Call Trace: bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline] __bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157 bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline] bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline] bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515 xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388 bpf_prog_run_xdp include/net/xdp.h:700 [inline] bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421 bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390 bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703 __sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 Fixes: 58deb77cc52d ("bonding: balance ICMP echoes in layer3+4 mode") Reported-by: syzbot+c46409299c70a221415e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/696faa23.050a0220.4cb9c.001f.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Matteo Croce Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260120161744.1893263-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 04708606fd7bdc34b69089a4ff848ff36d7088f9 Author: Taehee Yoo Date: Tue Jan 20 13:39:30 2026 +0000 selftests: net: amt: wait longer for connection before sending packets Both send_mcast4() and send_mcast6() use sleep 2 to wait for the tunnel connection between the gateway and the relay, and for the listener socket to be created in the LISTENER namespace. However, tests sometimes fail because packets are sent before the connection is fully established. Increase the waiting time to make the tests more reliable, and use wait_local_port_listen() to explicitly wait for the listener socket. Fixes: c08e8baea78e ("selftests: add amt interface selftest script") Signed-off-by: Taehee Yoo Link: https://patch.msgid.link/20260120133930.863845-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit 8215794403d264739cc676668087512950b2ff31 Author: Andrey Vatoropin Date: Tue Jan 20 11:37:47 2026 +0000 be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is set to false, the driver may request the PMAC_ID from the firmware of the network card, and this function will store that PMAC_ID at the provided address pmac_id. This is the contract of this function. However, there is a location within the driver where both pmac_id_valid == false and pmac_id == NULL are being passed. This could result in dereferencing a NULL pointer. To resolve this issue, it is necessary to pass the address of a stub variable to the function. Fixes: 95046b927a54 ("be2net: refactor MAC-addr setup code") Signed-off-by: Andrey Vatoropin Link: https://patch.msgid.link/20260120113734.20193-1-a.vatoropin@crpt.ru Signed-off-by: Jakub Kicinski commit 2030c4358bd8451583f2e010108607de5cdac5dc Author: Slark Xiao Date: Tue Jan 20 15:20:18 2026 +0800 Revert "net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not-at-end warning" This reverts commit eeecf5d3a3a484cedfa3f2f87e6d51a7390ed960. This change lead to MHI WWAN device can't connect to internet. I found a netwrok issue with kernel 6.19-rc4, but network works well with kernel 6.18-rc1. After checking, this commit is the root cause. Before appliing this serial changes on MHI WWAN network, we shall revert this change in case of v6.19 being impacted. Fixes: eeecf5d3a3a4 ("net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not-at-end warning") Signed-off-by: Slark Xiao Link: https://patch.msgid.link/20260120072018.29375-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 604826acb3f53c6648a7ee99a3914ead680ab7fb Author: Lyude Paul Date: Wed Jan 21 14:13:10 2026 -0500 drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) Apparently we never actually filled these in, despite the fact that we do in fact technically support atomic modesetting. Since not having these filled in causes us to potentially forget to disable fbdev and friends during suspend/resume, let's fix it. Signed-off-by: Lyude Paul Cc: stable@vger.kernel.org Reviewed-by: Dave Airlie Link: https://patch.msgid.link/20260121191320.210342-1-lyude@redhat.com commit d0bd10792d6cc3725ddee43f03fd6ee234f24844 Author: Alex Ramírez Date: Fri Dec 12 19:53:27 2025 -0500 drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors * Implement missing DCB connectors in uconn.c previously defined in conn.h. * Replace kernel WARN_ON macro with printk message to more gracefully signify an unknown connector was encountered. With this patch, unknown connectors are explicitly marked with value 0 (DCB_CONNECTOR_VGA) to match the tested current behavior. Although 0xff (DCB_CONNECTOR_NONE) may be more suitable, I don't want to introduce a breaking change. Fixes: 8b7d92cad953 ("drm/nouveau/kms/nv50-: create connectors based on nvkm info") Link: https://download.nvidia.com/open-gpu-doc/DCB/1/DCB-4.0-Specification.html#_connector_table_entry Signed-off-by: Alex Ramírez Reviewed-by: Lyude Paul [Lyude: Remove unneeded parenthesis around nvkm_warn()] Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251213005327.9495-3-lxrmrz732@gmail.com commit 3036b4ce4b209af690fa776e4616925892caba4c Author: Alex Ramírez Date: Fri Dec 12 19:53:26 2025 -0500 drm/nouveau: add missing DCB connector types * Add missing DCB connectors in conn.h as per the NVIDIA DCB specification. A lot of connector logic was rewritten for Linux v6.5; some display connector types went unaccounted-for which caused kernel warnings on devices with the now-unsupported DCB connectors. This patch adds all of the DCB connectors as defined by NVIDIA to the dcb_connector_type enum to bring back support for these connectors to the new logic. Fixes: 8b7d92cad953 ("drm/nouveau/kms/nv50-: create connectors based on nvkm info") Link: https://download.nvidia.com/open-gpu-doc/DCB/1/DCB-4.0-Specification.html#_connector_table_entry Signed-off-by: Alex Ramírez Reviewed-by: Lyude Paul [Lyude: Clarify DCB_CONNECTOR_HDMI_0 weirdness in comments] Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251213005327.9495-2-lxrmrz732@gmail.com commit 095ca815174e51fc0049771712d5455cabd7231e Author: Alex Deucher Date: Thu Jan 15 21:45:43 2026 -0500 drm/amdgpu: fix type for wptr in ring backup Needs to be a u64. Fixes: 77cc0da39c7c ("drm/amdgpu: track ring state associated with a fence") Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 56fff1941abd3ca3b6f394979614ca7972552f7f) commit fd2ac113a5dcb0ff14a66f8b798a88b8da26fe7e Author: Timur Kristóf Date: Sun Jan 18 13:57:46 2026 +0100 drm/amdgpu: Fix validating flush_gpu_tlb_pasid() When a function holds a lock and we return without unlocking it, it deadlocks the kernel. We should always unlock before returning. This commit fixes suspend/resume on SI. Tested on two Tahiti GPUs: FirePro W9000 and R9 280X. Fixes: f4db9913e4d3 ("drm/amdgpu: validate the flush_gpu_tlb_pasid()") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601190121.z9C0uml5-lkp@intel.com/ Signed-off-by: Timur Kristóf Signed-off-by: Prike Liang Reviewed-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit e3a6eff92bbd960b471966d9afccb4d584546d17) commit 764a90eb02268a23b1bb98be5f4a13671346804a Author: Timur Kristóf Date: Mon Jan 19 21:36:24 2026 +0100 drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) Radeon 430 and 520 are OEM GPUs from 2016~2017 They have the same device id: 0x6611 and revision: 0x87 On the Radeon 430, powertune is buggy and throttles the GPU, never allowing it to reach its maximum SCLK. Work around this bug by raising the TDP limits we program to the SMC from 24W (specified by the VBIOS on Radeon 430) to 32W. Disabling powertune entirely is not a viable workaround, because it causes the Radeon 520 to heat up above 100 C, which I prefer to avoid. Additionally, revise the maximum SCLK limit. Considering the above issue, these GPUs never reached a high SCLK on Linux, and the workarounds were added before the GPUs were released, so the workaround likely didn't target these specifically. Use 780 MHz (the maximum SCLK according to the VBIOS on the Radeon 430). Note that the Radeon 520 VBIOS has a higher maximum SCLK: 905 MHz, but in practice it doesn't seem to perform better with the higher clock, only heats up more. v2: Move the workaround to si_populate_smc_tdp_limits. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 966d70f1e160bdfdecaf7ff2b3f22ad088516e9f) commit d5077426e1a76d269e518e048bde2e9fc49b32ad Author: Timur Kristóf Date: Mon Jan 19 21:36:23 2026 +0100 drm/amd/pm: Don't clear SI SMC table when setting power limit There is no reason to clear the SMC table. We also don't need to recalculate the power limit then. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit e214d626253f5b180db10dedab161b7caa41f5e9) commit 4ca284c6d15dda481f714e3687a1d5fb70b3bf5c Author: Timur Kristóf Date: Mon Jan 19 21:36:22 2026 +0100 drm/amd/pm: Fix si_dpm mmCG_THERMAL_INT setting Use WREG32 to write mmCG_THERMAL_INT. This is a direct access register. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 2555f4e4a741d31e0496572a8ab4f55941b4e30e) commit 3f2de814c0597c97d5abe09a1635d8c4e2fddaf2 Author: Sasha Levin Date: Wed Jan 21 11:25:32 2026 -0500 objtool: Fix libopcodes linking with static libraries Commit 436326bc525d ("objtool: fix build failure due to missing libopcodes check") tests for libopcodes using an empty main(), which passes even when static libraries lack their dependencies. This causes undefined reference errors (xmalloc, bfd_get_bits, etc.) when linking against static libopcodes without its required libbfd and libiberty. Fix by testing with an actual libopcodes symbol and trying increasingly complete library combinations until one succeeds. Fixes: 436326bc525d ("objtool: fix build failure due to missing libopcodes check") Reported-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Signed-off-by: Peter Zijlstra (Intel) Tested-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260121162532.1596238-1-sashal@kernel.org commit 0d0f1314e8f86f5205f71f9e31e272a1d008e40b Author: Qu Wenruo Date: Mon Jan 19 16:24:04 2026 +1030 btrfs: zlib: fix the folio leak on S390 hardware acceleration [BUG] After commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), we no longer release the folio of the page cache of folio returned by btrfs_compress_filemap_get_folio() for S390 hardware acceleration path. [CAUSE] Before that commit, we call kumap_local() and folio_put() after handling each folio. Although the timing is not ideal (it release previous folio at the beginning of the loop, and rely on some extra cleanup out of the loop), it at least handles the folio release correctly. Meanwhile the refactored code is easier to read, it lacks the call to release the filemap folio. [FIX] Add the missing folio_put() for copy_data_into_buffer(). CC: linux-s390@vger.kernel.org # 6.18+ Fixes: aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation") Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4e159150a9a56d66d247f4b5510bed46fe58aa1c Author: Qu Wenruo Date: Mon Jan 19 17:31:19 2026 +1030 btrfs: do not strictly require dirty metadata threshold for metadata writepages [BUG] There is an internal report that over 1000 processes are waiting at the io_schedule_timeout() of balance_dirty_pages(), causing a system hang and trigger a kernel coredump. The kernel is v6.4 kernel based, but the root problem still applies to any upstream kernel before v6.18. [CAUSE] From Jan Kara for his wisdom on the dirty page balance behavior first. This cgroup dirty limit was what was actually playing the role here because the cgroup had only a small amount of memory and so the dirty limit for it was something like 16MB. Dirty throttling is responsible for enforcing that nobody can dirty (significantly) more dirty memory than there's dirty limit. Thus when a task is dirtying pages it periodically enters into balance_dirty_pages() and we let it sleep there to slow down the dirtying. When the system is over dirty limit already (either globally or within a cgroup of the running task), we will not let the task exit from balance_dirty_pages() until the number of dirty pages drops below the limit. So in this particular case, as I already mentioned, there was a cgroup with relatively small amount of memory and as a result with dirty limit set at 16MB. A task from that cgroup has dirtied about 28MB worth of pages in btrfs btree inode and these were practically the only dirty pages in that cgroup. So that means the only way to reduce the dirty pages of that cgroup is to writeback the dirty pages of btrfs btree inode, and only after that those processes can exit balance_dirty_pages(). Now back to the btrfs part, btree_writepages() is responsible for writing back dirty btree inode pages. The problem here is, there is a btrfs internal threshold that if the btree inode's dirty bytes are below the 32M threshold, it will not do any writeback. This behavior is to batch as much metadata as possible so we won't write back those tree blocks and then later re-COW them again for another modification. This internal 32MiB is higher than the existing dirty page size (28MiB), meaning no writeback will happen, causing a deadlock between btrfs and cgroup: - Btrfs doesn't want to write back btree inode until more dirty pages - Cgroup/MM doesn't want more dirty pages for btrfs btree inode Thus any process touching that btree inode is put into sleep until the number of dirty pages is reduced. Thanks Jan Kara a lot for the analysis of the root cause. [ENHANCEMENT] Since kernel commit b55102826d7d ("btrfs: set AS_KERNEL_FILE on the btree_inode"), btrfs btree inode pages will only be charged to the root cgroup which should have a much larger limit than btrfs' 32MiB threshold. So it should not affect newer kernels. But for all current LTS kernels, they are all affected by this problem, and backporting the whole AS_KERNEL_FILE may not be a good idea. Even for newer kernels I still think it's a good idea to get rid of the internal threshold at btree_writepages(), since for most cases cgroup/MM has a better view of full system memory usage than btrfs' fixed threshold. For internal callers using btrfs_btree_balance_dirty() since that function is already doing internal threshold check, we don't need to bother them. But for external callers of btree_writepages(), just respect their requests and write back whatever they want, ignoring the internal btrfs threshold to avoid such deadlock on btree inode dirty page balancing. CC: stable@vger.kernel.org CC: Jan Kara Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit cf38b2340c0e60ef695b7137440a4d187ed49c88 Merge: 119d1cbc6ee3c7 0638dc292e54ba Author: Linus Torvalds Date: Wed Jan 21 09:34:45 2026 -0800 Merge tag 'soc-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The main changes are devicetree updates for qualcomm and rockchips arm64 platforms, fixing minor mistakes in SoC and board specific settings: - GPIO settings for Pinephone Pro buttons - Register ranges for rk3576 GPU - Power domains on sc8280xp - Clocks on qcom talos - dtc warnings for extraneous properties, nonstandard node names and undocument identifiers The Tegra210 platform gets a single revert for a devicetree change that caused a 6.19 regression. On 32-bit Arm, we have trivial fixes for Microchip SAMA7 devicetree files and NPCM Kconfig, as well as Andrew Jeffery being officially listed as MAINTAINER for NPCM. A single driver fix is for Qualcomm RPMHD power domains, bringing the driver up to date with a devicetree change that added additional power domains to be enabled" * tag 'soc-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (27 commits) MAINTAINERS: Add Andrew as M: to ARM/NUVOTON NPCM ARCHITECTURE MAINTAINERS: update email address for Yixun Lan Revert "arm64: tegra: Add interconnect properties for Tegra210" arm64: dts: rockchip: Drop unsupported properties arm64: dts: rockchip: Fix gpio pinctrl node names arm64: dts: rockchip: Fix pinctrl property typo on rk3326-odroid-go3 arm64: dts: rockchip: Drop "sitronix,st7789v" fallback compatible from rk3568-wolfvision ARM: dts: microchip: sama7d65: fix size-cells property for i2c3 ARM: dts: microchip: sama7d65: fix the ranges property for flx9 arm: npcm: drop unused Kconfig ERRATA symbol arm64: dts: rockchip: Fix wrong register range of rk3576 gpu arm64: dts: rockchip: Configure MCLK for analog sound on NanoPi M5 arm64: dts: rockchip: Fix headphones widget name on NanoPi M5 ARM: dts: microchip: lan966x: Fix the access to the PHYs for pcb8290 arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s arm64: dts: rockchip: remove dangerous max-link-speed from helios64 arm64: dts: rockchip: fix unit-address for RK3588 NPU's core1 and core2's IOMMU arm64: dts: rockchip: Fix wifi interrupts flag on Sakura Pi RK3308B arm64: dts: qcom: sm8650: Fix compile warnings in USB controller node arm64: dts: qcom: sm8550: Fix compile warnings in USB controller node ... commit 119d1cbc6ee3c72620b1ab24dc3c89de31981d82 Merge: 07eebd934c9cb9 99a3e3a1cfc93b Author: Linus Torvalds Date: Wed Jan 21 09:19:15 2026 -0800 Merge tag 'slab-for-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - A stable fix for kmalloc_nolock() in non-preemptible contexts on PREEMPT_RT (Swaraj Gaikwad) * tag 'slab-for-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: slab: fix kmalloc_nolock() context check for PREEMPT_RT commit 98c88dc8a1ace642d9021b103b28cba7b51e3abc Author: Vincent Guittot Date: Wed Jan 21 17:33:17 2026 +0100 sched/fair: Fix pelt clock sync when entering idle Samuel and Alex reported regressions of the util_avg of RT rq with commit 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection"). It happens that fair is updating and syncing the pelt clock with task one when pick_next_task_fair() fails to pick a task but before the prev scheduling class got a chance to update its pelt signals. Move update_idle_rq_clock_pelt() in set_next_task_idle() which is called after prev class has been called. Fixes: 17e3e88ed0b6 ("sched/fair: Fix pelt lost idle time detection") Closes: https://lore.kernel.org/all/CAG2KctpO6VKS6GN4QWDji0t92_gNBJ7HjjXrE+6H+RwRXt=iLg@mail.gmail.com/ Closes: https://lore.kernel.org/all/8cf19bf0e0054dcfed70e9935029201694f1bb5a.camel@mediatek.com/ Reported-by: Samuel Wu Reported-by: Alex Hoh Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Tested-by: Samuel Wu Tested-by: Alex Hoh Link: https://patch.msgid.link/20260121163317.505635-1-vincent.guittot@linaro.org commit 07eebd934c9cb9f12f589ea5b826fa7ca056cb4d Merge: 6c790212c588fd 34308187395ff0 Author: Linus Torvalds Date: Wed Jan 21 08:42:34 2026 -0800 Merge tag 'for-6.19-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - protect reading super block vs setting block size externally (found by syzbot) - make sure no transaction is started in read-only mode even with some rescue mount option combinations - fix checksum calculation of backup super blocks when block-group-tree is enabled - more extensive mount-time checks of device items that could be left after device replace and attempting degraded mount - fix build warning with -Wmaybe-uninitialized on loongarch64-gcc 12 * tag 'for-6.19-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: add extra device item checks at mount btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE btrfs: reject new transactions if the fs is fully read-only btrfs: sync read disk super and set block size btrfs: fix Wmaybe-uninitialized warning in replay_one_buffer() commit 91dcfae0ff2b9b9ab03c1ec95babaceefbffb9f4 Author: Fernand Sieber Date: Thu Dec 11 20:36:04 2025 +0200 perf/x86/intel: Do not enable BTS for guests By default when users program perf to sample branch instructions (PERF_COUNT_HW_BRANCH_INSTRUCTIONS) with a sample period of 1, perf interprets this as a special case and enables BTS (Branch Trace Store) as an optimization to avoid taking an interrupt on every branch. Since BTS doesn't virtualize, this optimization doesn't make sense when the request originates from a guest. Add an additional check that prevents this optimization for virtualized events (exclude_host). Reported-by: Jan H. Schönherr Suggested-by: Peter Zijlstra Signed-off-by: Fernand Sieber Signed-off-by: Peter Zijlstra (Intel) Cc: Link: https://patch.msgid.link/20251211183604.868641-1-sieberf@amazon.com commit d06bf78e55d5159c1b00072e606ab924ffbbad35 Author: Will Rosenberg Date: Mon Jan 19 11:49:56 2026 -0700 perf: Fix refcount warning on event->mmap_count increment When calling refcount_inc(&event->mmap_count) inside perf_mmap_rb(), the following warning is triggered: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 PoC: struct perf_event_attr attr = {0}; int fd = syscall(__NR_perf_event_open, &attr, 0, -1, -1, 0); mmap(NULL, 0x3000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); int victim = syscall(__NR_perf_event_open, &attr, 0, -1, fd, PERF_FLAG_FD_OUTPUT); mmap(NULL, 0x3000, PROT_READ | PROT_WRITE, MAP_SHARED, victim, 0); This occurs when creating a group member event with the flag PERF_FLAG_FD_OUTPUT. The group leader should be mmap-ed and then mmap-ing the event triggers the warning. Since the event has copied the output_event in perf_event_set_output(), event->rb is set. As a result, perf_mmap_rb() calls refcount_inc(&event->mmap_count) when event->mmap_count = 0. Disallow the case when event->mmap_count = 0. This also prevents two events from updating the same user_page. Fixes: 448f97fba901 ("perf: Convert mmap() refcounts to refcount_t") Suggested-by: Peter Zijlstra Signed-off-by: Will Rosenberg Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260119184956.801238-1-whrosenb@asu.edu commit 0fcee2cfc4b2e16e62ff8e0cc2cd8dd24efad65e Author: Ming Lei Date: Wed Jan 21 17:38:54 2026 +0800 nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start(): 1. nvmet_bio_done() is called when a bio completes 2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req) 3. The queue_response callback can re-queue and re-submit the same request 4. The re-submission reuses the same inline_bio from nvmet_req 5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete) invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL 6. The re-submitted bio enters submit_bio_noacct_nocheck() 7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode RIP: 0010:blk_cgroup_bio_start+0x10/0xd0 Call Trace: submit_bio_noacct_nocheck+0x44/0x250 nvmet_bdev_execute_rw+0x254/0x370 [nvmet] process_one_work+0x193/0x3c0 worker_thread+0x281/0x3a0 Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition. Fixes: 190f4c2c863a ("nvmet: fix memory leak of bio integrity") Cc: Dmitry Bogdanov Cc: stable@vger.kernel.org Cc: Guangwu Zhang Link: http://www.mail-archive.com/debian-kernel@lists.debian.org/msg146238.html Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Keith Busch commit 145e0074392587606aa5df353d0e761f0b8357d5 Author: Pavel Begunkov Date: Tue Jan 20 21:11:45 2026 +0000 selftests/io_uring: support NO_SQARRAY in miniliburing Add support for IORING_SETUP_NO_SQARRAY in miniliburing. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 73061dbeca783aaf311e1af9610f8cba1c1176cd Author: Pavel Begunkov Date: Tue Jan 20 21:11:44 2026 +0000 selftests/io_uring: add io_uring_queue_init_params Add a ring init variant taking struct io_uring_params, which mimicks liburing API. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e7e1cc18f120a415646be12470169a978a1adcd9 Author: Ming Lei Date: Tue Jan 13 16:58:02 2026 +0800 selftests/ublk: fix garbage output in foreground mode Initialize _evtfd to -1 in struct dev_ctx to prevent garbage output when running kublk in foreground mode. Without this, _evtfd is zero-initialized to 0 (stdin), and ublk_send_dev_event() writes binary data to stdin which appears as garbage on the terminal. Also fix debug message format string. Fixes: 6aecda00b7d1 ("selftests: ublk: add kernel selftests for ublk") Signed-off-by: Ming Lei Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 23e62cf75518825aac12e9a22bdc40f062428898 Author: Ming Lei Date: Tue Jan 13 16:58:01 2026 +0800 selftests/ublk: fix error handling for starting device Fix error handling in ublk_start_daemon() when start_dev fails: 1. Call ublk_ctrl_stop_dev() to cancel inflight uring_cmd before cleanup. Without this, the device deletion may hang waiting for I/O completion that will never happen. 2. Add fail_start label so that pthread_join() is called on the error path. This ensures proper thread cleanup when startup fails. Fixes: 6aecda00b7d1 ("selftests: ublk: add kernel selftests for ublk") Signed-off-by: Ming Lei Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 75aad5ffe099a1b1a342257236dc260493917ed2 Author: Ming Lei Date: Tue Jan 13 16:58:00 2026 +0800 selftests/ublk: fix IO thread idle check Include cmd_inflight in ublk_thread_is_done() check. Without this, the thread may exit before all FETCH commands are completed, which may cause device deletion to hang. Fixes: 6aecda00b7d1 ("selftests: ublk: add kernel selftests for ublk") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit f5f2bad67a45cd1ef6f5b727da104694a81b3666 Author: Christoph Hellwig Date: Wed Jan 21 08:31:49 2026 +0100 block: make the new blkzoned UAPI constants discoverable The Linux 6.19 merge window added the new BLKREPORTZONESV2 ioctl, and with it the new BLK_ZONE_REP_CACHED and BLK_ZONE_COND_ACTIVE constants. The two constants are defined as part of enums, which makes it very painful for userspace to discover if they are present in the installed system headers. Use the #define to the same name trick to make them trivially discoverable using CPP directives. Fixes: 0bf0e2e46668 ("block: track zone conditions") Fixes: b30ffcdc0c15 ("block: introduce BLKREPORTZONESV2 ioctl") Reported-by: Andrey Albershteyn Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 47bdf1d29caec7207b7f112230055db36602dfc0 Author: Seamus Connor Date: Wed Jan 14 18:59:52 2026 -0800 ublk: fix ublksrv pid handling for pid namespaces When ublksrv runs inside a pid namespace, START/END_RECOVERY compared the stored init-ns tgid against the userspace pid (getpid vnr), so the check failed and control ops could not proceed. Compare against the caller’s init-ns tgid and store that value, then translate it back to the caller’s pid namespace when reporting GET_DEV_INFO so ublk list shows a sensible pid. Testing: start/recover in a pid namespace; `ublk list` shows reasonable pid values in init, child, and sibling namespaces. Fixes: c2c8089f325e ("ublk: validate ublk server pid") Signed-off-by: Seamus Connor Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit f262015b9797effdec15e8a81c81b2158ede9578 Author: Lukasz Laguna Date: Wed Jan 21 15:33:04 2026 +0100 drm/xe: Update wedged.mode only after successful reset policy change Previously, the driver's internal wedged.mode state was updated without verifying whether the corresponding engine reset policy update in GuC succeeded. This could leave the driver reporting a wedged.mode state that doesn't match the actual reset behavior programmed in GuC. With this change, the reset policy is updated first, and the driver's wedged.mode state is modified only if the policy update succeeds on all available GTs. This patch also introduces two functional improvements: - The policy is sent to GuC only when a change is required. An update is needed only when entering or leaving XE_WEDGED_MODE_UPON_ANY_HANG, because only in that case the reset policy changes. For example, switching between XE_WEDGED_MODE_UPON_CRITICAL_ERROR and XE_WEDGED_MODE_NEVER doesn't affect the reset policy, so there is no need to send the same value to GuC. - An inconsistent_reset flag is added to track cases where reset policy update succeeds only on a subset of GTs. If such inconsistency is detected, future wedged mode configuration will force a retry of the reset policy update to restore a consistent state across all GTs. Fixes: 6b8ef44cc0a9 ("drm/xe: Introduce the wedged_mode debugfs") Signed-off-by: Lukasz Laguna Link: https://patch.msgid.link/20260107174741.29163-3-lukasz.laguna@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi (cherry picked from commit 0f13dead4e0385859f5c9c3625a19df116b389d3) Signed-off-by: Thomas Hellström commit 772157f626d0e1a7c6d49dffb0bbe4b2343a1d44 Author: Matthew Auld Date: Tue Jan 20 11:06:11 2026 +0000 drm/xe/migrate: fix job lock assert We are meant to be checking the user vm for the bind queue, but actually we are checking the migrate vm. For various reasons this is not currently firing but this will likely change in the future. Now that we have the user_vm attached to the bind queue, we can fix this by directly checking that here. Fixes: dba89840a920 ("drm/xe: Add GT TLB invalidation jobs") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Matthew Brost Reviewed-by: Arvind Yadav Link: https://patch.msgid.link/20260120110609.77958-4-matthew.auld@intel.com (cherry picked from commit 9dd1048bca4fe2aa67c7a286bafb3947537adedb) Signed-off-by: Thomas Hellström commit 6f4b7aed61817624250e590ba0ef304146d34614 Author: Matthew Auld Date: Tue Jan 20 11:06:10 2026 +0000 drm/xe/uapi: disallow bind queue sharing Currently this is very broken if someone attempts to create a bind queue and share it across multiple VMs. For example currently we assume it is safe to acquire the user VM lock to protect some of the bind queue state, but if allow sharing the bind queue with multiple VMs then this quickly breaks down. To fix this reject using a bind queue with any VM that is not the same VM that was originally passed when creating the bind queue. This a uAPI change, however this was more of an oversight on kernel side that we didn't reject this, and expectation is that userspace shouldn't be using bind queues in this way, so in theory this change should go unnoticed. Based on a patch from Matt Brost. v2 (Matt B): - Hold the vm lock over queue create, to ensure it can't be closed as we attach the user_vm to the queue. - Make sure we actually check for NULL user_vm in destruction path. v3: - Fix error path handling. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Thomas Hellström Signed-off-by: Matthew Auld Cc: José Roberto de Souza Cc: Matthew Brost Cc: Michal Mrozek Cc: Carl Zhang Cc: # v6.8+ Acked-by: José Roberto de Souza Reviewed-by: Matthew Brost Reviewed-by: Arvind Yadav Acked-by: Michal Mrozek Link: https://patch.msgid.link/20260120110609.77958-3-matthew.auld@intel.com (cherry picked from commit 9dd08fdecc0c98d6516c2d2d1fa189c1332f8dab) Signed-off-by: Thomas Hellström commit 4918cc05137cb347686462923ab3fd249ef7899d Author: Bartosz Golaszewski Date: Tue Jan 20 16:49:13 2026 +0100 gpio: shared: propagate configuration to pinctrl Just toggling the descriptor's "requested" flag is not enough. We need to properly request it in order to potentially propagate any configuration to pinctrl via the .request() callback. We must not take the reference to the device at this point (the device is not ready but we're also requesting the device's own descriptor) so make the _commit() variants of request and free functions available to GPIO core in order to use them instead of their regular counterparts. This fixes an audio issue reported on one of the Qualcomm platforms. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reviewed-by: Linus Walleij Tested-by: Ravi Hothi Link: https://lore.kernel.org/r/20260120154913.61991-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 99a3e3a1cfc93b8fe318c0a3a5cfb01f1d4ad53c Author: Swaraj Gaikwad Date: Tue Jan 13 20:36:39 2026 +0530 slab: fix kmalloc_nolock() context check for PREEMPT_RT On PREEMPT_RT kernels, local_lock becomes a sleeping lock. The current check in kmalloc_nolock() only verifies we're not in NMI or hard IRQ context, but misses the case where preemption is disabled. When a BPF program runs from a tracepoint with preemption disabled (preempt_count > 0), kmalloc_nolock() proceeds to call local_lock_irqsave() which attempts to acquire a sleeping lock, triggering: BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6128 preempt_count: 2, expected: 0 Fix this by checking !preemptible() on PREEMPT_RT, which directly expresses the constraint that we cannot take a sleeping lock when preemption is disabled. This encompasses the previous checks for NMI and hard IRQ contexts while also catching cases where preemption is disabled. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Reported-by: syzbot+b1546ad4a95331b2101e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b1546ad4a95331b2101e Signed-off-by: Swaraj Gaikwad Acked-by: Sebastian Andrzej Siewior Acked-by: Alexei Starovoitov Acked-by: Harry Yoo Link: https://patch.msgid.link/20260113150639.48407-1-swarajgaikwad1925@gmail.co Cc: Signed-off-by: Vlastimil Babka commit c06343be0b4e03fe319910dd7a5d5b9929e1c0cb Author: Thomas Gleixner Date: Wed Dec 17 18:21:05 2025 +0100 clocksource: Reduce watchdog readout delay limit to prevent false positives The "valid" readout delay between the two reads of the watchdog is larger than the valid delta between the resulting watchdog and clocksource intervals, which results in false positive watchdog results. Assume TSC is the clocksource and HPET is the watchdog and both have a uncertainty margin of 250us (default). The watchdog readout does: 1) wdnow = read(HPET); 2) csnow = read(TSC); 3) wdend = read(HPET); The valid window for the delta between #1 and #3 is calculated by the uncertainty margins of the watchdog and the clocksource: m = 2 * watchdog.uncertainty_margin + cs.uncertainty margin; which results in 750us for the TSC/HPET case. The actual interval comparison uses a smaller margin: m = watchdog.uncertainty_margin + cs.uncertainty margin; which results in 500us for the TSC/HPET case. That means the following scenario will trigger the watchdog: Watchdog cycle N: 1) wdnow[N] = read(HPET); 2) csnow[N] = read(TSC); 3) wdend[N] = read(HPET); Assume the delay between #1 and #2 is 100us and the delay between #1 and Watchdog cycle N + 1: 4) wdnow[N + 1] = read(HPET); 5) csnow[N + 1] = read(TSC); 6) wdend[N + 1] = read(HPET); If the delay between #4 and #6 is within the 750us margin then any delay between #4 and #5 which is larger than 600us will fail the interval check and mark the TSC unstable because the intervals are calculated against the previous value: wd_int = wdnow[N + 1] - wdnow[N]; cs_int = csnow[N + 1] - csnow[N]; Putting the above delays in place this results in: cs_int = (wdnow[N + 1] + 610us) - (wdnow[N] + 100us); -> cs_int = wd_int + 510us; which is obviously larger than the allowed 500us margin and results in marking TSC unstable. Fix this by using the same margin as the interval comparison. If the delay between two watchdog reads is larger than that, then the readout was either disturbed by interconnect congestion, NMIs or SMIs. Fixes: 4ac1dd3245b9 ("clocksource: Set cs_watchdog_read() checks based on .uncertainty_margin") Reported-by: Daniel J Blueman Signed-off-by: Thomas Gleixner Reviewed-by: Paul E. McKenney Tested-by: Paul E. McKenney Link: https://lore.kernel.org/lkml/20250602223251.496591-1-daniel@quora.org/ Link: https://patch.msgid.link/87bjjxc9dq.ffs@tglx commit 0638dc292e54ba0cbcb1ff81af3ca52d3bbfaf54 Merge: 0240c897745599 1f6ca557088eb9 Author: Arnd Bergmann Date: Wed Jan 21 09:28:30 2026 +0100 Merge tag 'qcom-arm64-fixes-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 DeviceTree fixes for v6.19 Add missing power-domains to the SC8280XP RPM power-domain and ensure these are voted for from the remoteproc instances while powering them up. Clear a couple of DeviceTree validation warnings in SM8550 and SM8650 USB controller nodes. Specify the correct display panel on the OnePlus 6. Correct the UFS clock mapping on Talos, to ensure UFS is properly clocked. Add Abel's old emails address to .mailmap. * tag 'qcom-arm64-fixes-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sm8650: Fix compile warnings in USB controller node arm64: dts: qcom: sm8550: Fix compile warnings in USB controller node arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links pmdomain: qcom: rpmhpd: Add MXC to SC8280XP dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO arm64: dts qcom: sdm845-oneplus-enchilada: Specify panel name within the compatible mailmap: Update email address for Abel Vesa arm64: dts: qcom: talos: Correct UFS clocks ordering Signed-off-by: Arnd Bergmann commit 70b4db7d258118a7464f039112a74ddb49a95b06 Author: Takashi Iwai Date: Wed Jan 21 09:20:20 2026 +0100 ALSA: usb-audio: Use the right limit for PCM OOB check The recent fix commit for addressing the OOB access of PCM URB data buffer caused a regression on Behringer UMC2020HD device, resulting in choppy sound. The fix used ep->max_urb_frames for the upper limit check, and this is no right value to be referred. Use the actual buffer size (ctx->buffer_size) as the upper limit instead, which also avoids the regression on the device above. Fixes: ef5749ef8b30 ("ALSA: usb-audio: Prevent excessive number of frames") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220997 Link: https://patch.msgid.link/20260121082025.718748-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit ba1096c315283ee3292765f6aea4cca15816c4f7 Author: Jeongjun Park Date: Mon Jan 19 15:33:59 2026 +0900 netrom: fix double-free in nr_route_frame() In nr_route_frame(), old_skb is immediately freed without checking if nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL, the caller function will free old_skb again, causing a double-free bug. Therefore, to prevent this, we need to modify it to check whether nr_neigh->ax25 is NULL before freeing old_skb. Cc: Reported-by: syzbot+999115c3bf275797dc27@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0029.GAE@google.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jeongjun Park Link: https://patch.msgid.link/20260119063359.10604-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski commit cdf8de9c6bfe94508d251cb290ee66e34e6f3368 Author: Hariprasad Kelam Date: Mon Jan 19 15:32:22 2026 +0530 Octeontx2-pf: Update xdp features In recent testing, verification of XDP_REDIRECT and zero-copy features failed because the driver is not setting the corresponding feature flags. Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support") Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20260119100222.2267925-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit c7159e960f1472a5493ac99aff0086ab1d683594 Author: Laurent Vivier Date: Mon Jan 19 08:55:18 2026 +0100 usbnet: limit max_mtu based on device's hard_mtu The usbnet driver initializes net->max_mtu to ETH_MAX_MTU before calling the device's bind() callback. When the bind() callback sets dev->hard_mtu based the device's actual capability (from CDC Ethernet's wMaxSegmentSize descriptor), max_mtu is never updated to reflect this hardware limitation). This allows userspace (DHCP or IPv6 RA) to configure MTU larger than the device can handle, leading to silent packet drops when the backend sends packet exceeding the device's buffer size. Fix this by limiting net->max_mtu to the device's hard_mtu after the bind callback returns. See https://gitlab.com/qemu-project/qemu/-/issues/3268 and https://bugs.passt.top/attachment.cgi?bugid=189 Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers") Signed-off-by: Laurent Vivier Link: https://bugs.passt.top/show_bug.cgi?id=189 Reviewed-by: Stefano Brivio Link: https://patch.msgid.link/20260119075518.2774373-1-lvivier@redhat.com Signed-off-by: Jakub Kicinski commit f6cc7f1c11a776fd2ebc2016be42e7581063dc6e Author: Timur Kristóf Date: Sun Jan 18 14:03:45 2026 +0100 drm/amd/display: Only poll analog connectors Analog connectors may be hot-plugged unlike other connector types that don't support HPD. Stop DRM from polling other connector types that don't support HPD, such as eDP, LVDS, etc. These were wrongly polled when analog connector support was added, causing issues with the seamless boot process. Fixes: c4f3f114e73c ("drm/amd/display: Poll analog connectors (v3)") Signed-off-by: Timur Kristóf Reported-by: Matthew Schwartz Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit e924c7004b08e4e173782bad60b27841d889e371) commit 82a401ceffba9120fae937e0a504dbe7e5d63003 Author: Alex Deucher Date: Mon Dec 29 15:24:10 2025 -0500 drm/amdgpu: fix error handling in ib_schedule() If fence emit fails, free the fence if necessary. Fixes: db36632ea51e ("drm/amdgpu: clean up and unify hw fence handling") Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 5eb680a06007f2f6ea333d11a4e29039da90614b) commit b6aff8bb0c40dfcd42e82a8b030123cebd4df8f5 Author: Jonathan Kim Date: Wed Dec 17 11:03:12 2025 -0500 drm/amdkfd: fix gfx11 restrictions on debugging cooperative launch Restrictions on debugging cooperative launch for GFX11 devices should align to CWSR work around requirements. i.e. devices without the need for the work around should not be subject to such restrictions. Signed-off-by: Jonathan Kim Reviewed-by: James Zhu Signed-off-by: Alex Deucher (cherry picked from commit 230ef3977d6ffdd498ffa9baa6f5a061786189bf) commit 8e96b36d9bfd841e14ee8f9e1b77145e52fff3a3 Author: Jiqian Chen Date: Wed Jan 14 18:06:10 2026 +0800 drm/amdgpu: free hw_vm_fence when fail in amdgpu_job_alloc If drm_sched_job_init fails, hw_vm_fence is not freed currently, then cause memory leak. Fixes: db36632ea51e ("drm/amdgpu: clean up and unify hw fence handling") Link: https://lore.kernel.org/amd-gfx/a5a828cb-0e4a-41f0-94c3-df31e5ddad52@amd.com/T/#t Signed-off-by: Jiqian Chen Reviewed-by: Amos Kong Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 5d42ee457ccd1fb5da4c7f817825b2806ec36956) commit 10343253328e0dbdb465bff709a2619a08fe01ad Author: Likun Gao Date: Mon Dec 15 11:33:58 2025 +0800 drm/amdgpu: remove frame cntl for gfx v12 Remove emit_frame_cntl function for gfx v12, which is not support. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 5aaa5058dec5bfdcb24c42fe17ad91565a3037ca) Cc: stable@vger.kernel.org commit 9a063f96d87efc3a6cc667f8de096a3d38d74bb5 Author: Eric Dumazet Date: Sun Jan 18 15:29:41 2026 +0000 ipv6: annotate data-race in ndisc_router_discovery() syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_MTU is best effort. Add READ_ONCE()/WRITE_ONCE() to document the race. Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch. [1] BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1: ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0: ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... value changed: 0x00000000 -> 0xe5400659 Fixes: 49b99da2c9ce ("ipv6: add IFLA_INET6_RA_MTU to expose mtu value") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Rocco Yue Link: https://patch.msgid.link/20260118152941.2563857-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8175dbf174d487afab81e936a862a8d9b8a1ccb6 Author: Eric Dumazet Date: Sun Jan 18 13:25:28 2026 +0000 mISDN: annotate data-race around dev->work dev->work can re read locklessly in mISDN_read() and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations. BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1: misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline] mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583 x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0: mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112 do_loop_readv_writev fs/read_write.c:847 [inline] vfs_readv+0x3fb/0x690 fs/read_write.c:1020 do_readv+0xe7/0x210 fs/read_write.c:1080 __do_sys_readv fs/read_write.c:1165 [inline] __se_sys_readv fs/read_write.c:1162 [inline] __x64_sys_readv+0x45/0x50 fs/read_write.c:1162 x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000 -> 0x00000001 Fixes: 1b2b03f8e514 ("Add mISDN core files") Reported-by: syzbot Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260118132528.2349573-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3d778e65b4f44c6af4901d83020bb8a0a010f39e Author: Jiawen Wu Date: Mon Jan 19 14:59:35 2026 +0800 net: txgbe: remove the redundant data return in SW-FW mailbox For these two firmware mailbox commands, in txgbe_test_hostif() and txgbe_set_phy_link_hostif(), there is no need to read data from the buffer. Under the current setting, OEM firmware will cause the driver to fail to probe. Because OEM firmware returns more link information, with a larger OEM structure txgbe_hic_ephy_getlink. However, the current driver does not support the OEM function. So just fix it in the way that does not involve reading the returned data. Fixes: d84a3ff9aae8 ("net: txgbe: Restrict the use of mismatched FW versions") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/2914AB0BC6158DDA+20260119065935.6015-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 9d11e974f59680a20bd5c3aab8e20db238da2eb8 Merge: 5228e9faaed4e5 f87e034d16e43a Author: Jakub Kicinski Date: Tue Jan 20 18:31:41 2026 -0800 Merge branch 'fix-some-bugs-in-the-flow-director-of-hns3-driver' Jijie Shao says: ==================== fix some bugs in the flow director of HNS3 driver This patchset fixes two bugs in the flow director: 1. Incorrect definition of HCLGE_FD_AD_COUNTER_NUM_M 2. Incorrect assignment of HCLGE_FD_AD_NXT_KEY ==================== Link: https://patch.msgid.link/20260119132840.410513-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit f87e034d16e43af984380a95c32c25201b7759a7 Author: Jijie Shao Date: Mon Jan 19 21:28:40 2026 +0800 net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue Use next_input_key instead of counter_id to set HCLGE_FD_AD_NXT_KEY. Fixes: 117328680288 ("net: hns3: Add input key and action config support for flow director") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20260119132840.410513-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit d57c67c956a1bad15115eba6e59d77a6dfeba01d Author: Jijie Shao Date: Mon Jan 19 21:28:39 2026 +0800 net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M HCLGE_FD_AD_COUNTER_NUM_M should be at GENMASK(19, 13), rather than at GENMASK(20, 13), because bit 20 is HCLGE_FD_AD_NXT_STEP_B. This patch corrects the wrong definition. Fixes: 117328680288 ("net: hns3: Add input key and action config support for flow director") Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20260119132840.410513-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 5228e9faaed4e55f6291e1bd138bffea90252fbd Author: Russell King (Oracle) Date: Mon Jan 19 14:21:36 2026 +0000 net: stmmac: fix resume: calculate tso last_segment Tao Wang reports that sometimes, after resume, stmmac can watchdog: NETDEV WATCHDOG: CPU: x: transmit queue x timed out xx ms When this occurs, the DMA transmit descriptors contain: eth0: 221 [0x0000000876d10dd0]: 0x73660cbe 0x8 0x42 0xb04416a0 eth0: 222 [0x0000000876d10de0]: 0x77731d40 0x8 0x16a0 0x90000000 where descriptor 221 is the TSO header and 222 is the TSO payload. tdes3 for descriptor 221 (0xb04416a0) has both bit 29 (first descriptor) and bit 28 (last descriptor) set, which is incorrect. The following packet also has bit 28 set, but isn't marked as a first descriptor, and this causes the transmit DMA to stall. This occurs because stmmac_tso_allocator() populates the first descriptor, but does not set .last_segment correctly. There are two places where this matters: one is later in stmmac_tso_xmit() where we use it to update the TSO header descriptor. The other is in the ring/chain mode clean_desc3() which is a performance optimisation. Rather than using tx_q->tx_skbuff_dma[].last_segment to determine whether the first descriptor entry is the only segment, calculate the number of descriptor entries used. If there is only one descriptor, then the first is also the last, so mark it as such. Further work will be necessary to either eliminate .last_segment entirely or set it correctly. Code analysis also indicates that a similar issue exists with .is_jumbo. These will be the subject of a future patch. Reported-by: Tao Wang Fixes: c2837423cb54 ("net: stmmac: Rework TX Coalesce logic") Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vhq8O-00000005N5s-0Ke5@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 302e5b481caa7b3d11ec0e058434c1fc95195e50 Author: David Yang Date: Mon Jan 19 23:34:36 2026 +0800 be2net: fix data race in be_get_new_eqd In be_get_new_eqd(), statistics of pkts, protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. Before the commit in question, these statistics were retrieved one by one directly from queues. Fix this by reading them into temporary variables first. Fixes: 209477704187 ("be2net: set interrupt moderation for Skyhawk-R using EQ-DB") Signed-off-by: David Yang Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260119153440.1440578-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 5fbe395cd1fdbc883584e7f38369e4ba5ca778d2 Author: David Yang Date: Tue Jan 20 00:27:16 2026 +0800 idpf: Fix data race in idpf_net_dim In idpf_net_dim(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. The correct way to copy statistics is already illustrated by idpf_add_queue_stats(). Fix this by reading them into temporary variables first. Fixes: c2d548cad150 ("idpf: add TX splitq napi poll support") Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support") Signed-off-by: David Yang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260119162720.1463859-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 748a81c8ceda1fdbdcd0af595947422e810442aa Author: David Yang Date: Tue Jan 20 00:07:37 2026 +0800 net: hns3: fix data race in hns3_fetch_stats In hns3_fetch_stats(), ring statistics, protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics are already accumulated by hns3_ring_stats_update(). Fix this by reading them into a temporary buffer first. Fixes: b20d7fe51e0d ("net: hns3: add some statitics info to tx process") Signed-off-by: David Yang Link: https://patch.msgid.link/20260119160759.1455950-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit a917cd0a23fae160a85b0e8a0dd1d548c5d5242e Author: Michel Lind Date: Fri Jan 16 21:21:58 2026 +0000 tools/net/ynl: Makefile's install target now installs ynltool This tool is built by default, but was not being installed by default when running `make install`. Fix this by calling ynltool's install target. Signed-off-by: Michel Lind Link: https://patch.msgid.link/aWqr9gUT4hWZwwcI@mbp-m3-fedora.vm Signed-off-by: Jakub Kicinski commit a9f470594c50ab1ddf25b21a00ca4d3166057f3b Author: Krzysztof Kozlowski Date: Sun Jan 18 10:48:23 2026 +0100 nfc: MAINTAINERS: Orphan the NFC and look for new maintainers NFC stack in Linux is in poor shape, with several bugs being discovered last years via fuzzing, not much new development happening and limited review and testing. It requires some more effort than drive-by reviews I have been offering last one or two years. I don't have much time nor business interests to keep looking at NFC, so let's drop me from the maintainers to clearly indicate that more hands are needed. Acked-by: Mark Greer Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260118094822.10126-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 79912b256e14054e6ba177d7e7e631485ce23dbe Author: Daniel Golle Date: Mon Jan 19 00:41:54 2026 +0000 net: phy: intel-xway: fix OF node refcount leakage Automated review spotted am OF node reference count leakage when checking if the 'leds' child node exists. Call of_put_node() to correctly maintain the refcount. Link: https://netdev-ai.bots.linux.dev/ai-review.html?id=20f173ba-0c64-422b-a663-fea4b4ad01d0 Fixes: 1758af47b98c1 ("net: phy: intel-xway: add support for PHY LEDs") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/e3275e1c1cdca7e6426bb9c11f33bd84b8d900c8.1768783208.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 6c790212c588fddeb0d852f2790840753bb604b1 Merge: c25f2fb1f469de 81122fba08fa3c Author: Linus Torvalds Date: Tue Jan 20 15:01:15 2026 -0800 Merge tag 'devicetree-fixes-for-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix a refcount leak in of_alias_scan() - Support descending into child nodes when populating nodes in /firmware * tag 'devicetree-fixes-for-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: fix reference count leak in of_alias_scan() of: platform: Use default match table for /firmware commit c25f2fb1f469deaed2df8db524d91f3321a0f816 Merge: c03e9c42ae8f9b 16aca2c98a6fdf Author: Linus Torvalds Date: Tue Jan 20 13:32:16 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-01-20-13-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: - A patch series from David Hildenbrand which fixes a few things related to hugetlb PMD sharing - The remainder are singletons, please see their changelogs for details * tag 'mm-hotfixes-stable-2026-01-20-13-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: restore per-memcg proactive reclaim with !CONFIG_NUMA mm/kfence: fix potential deadlock in reboot notifier Docs/mm/allocation-profiling: describe sysctrl limitations in debug mode mm: do not copy page tables unnecessarily for VM_UFFD_WP mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather mm/rmap: fix two comments related to huge_pmd_unshare() mm/hugetlb: fix two comments related to huge_pmd_unshare() mm/hugetlb: fix hugetlb_pmd_shared() mm: remove unnecessary and incorrect mmap lock assert x86/kfence: avoid writing L1TF-vulnerable PTEs mm/vma: do not leak memory when .mmap_prepare swaps the file migrate: correct lock ordering for hugetlb file folios panic: only warn about deprecated panic_print on write access fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes() mm: take into account mm_cid size for mm_struct static definitions mm: rename cpu_bitmap field to flexible_array mm: add missing static initializer for init_mm::mm_cid.lock commit bdfc7b55adcd04834ccc1b6b13e55e3fd7eaa789 Author: Mina Almasry Date: Thu Dec 11 10:19:29 2025 +0000 idpf: read lower clock bits inside the time sandwich PCIe reads need to be done inside the time sandwich because PCIe writes may get buffered in the PCIe fabric and posted to the device after the _postts completes. Doing the PCIe read inside the time sandwich guarantees that the write gets flushed before the _postts timestamp is taken. Cc: lrizzo@google.com Cc: namangulati@google.com Cc: willemb@google.com Cc: intel-wired-lan@lists.osuosl.org Cc: milena.olech@intel.com Cc: jacob.e.keller@intel.com Fixes: 5cb8805d2366 ("idpf: negotiate PTP capabilities and get PTP clock") Suggested-by: Shachar Raindel Signed-off-by: Mina Almasry Reviewed-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit d3f867e7a04678640ebcbfb81893c59f4af48586 Author: Paul Greenwalt Date: Mon Dec 29 03:52:34 2025 -0500 ice: fix devlink reload call trace Commit 4da71a77fc3b ("ice: read internal temperature sensor") introduced internal temperature sensor reading via HWMON. ice_hwmon_init() was added to ice_init_feature() and ice_hwmon_exit() was added to ice_remove(). As a result if devlink reload is used to reinit the device and then the driver is removed, a call trace can occur. BUG: unable to handle page fault for address: ffffffffc0fd4b5d Call Trace: string+0x48/0xe0 vsnprintf+0x1f9/0x650 sprintf+0x62/0x80 name_show+0x1f/0x30 dev_attr_show+0x19/0x60 The call trace repeats approximately every 10 minutes when system monitoring tools (e.g., sadc) attempt to read the orphaned hwmon sysfs attributes that reference freed module memory. The sequence is: 1. Driver load, ice_hwmon_init() gets called from ice_init_feature() 2. Devlink reload down, flow does not call ice_remove() 3. Devlink reload up, ice_hwmon_init() gets called from ice_init_feature() resulting in a second instance 4. Driver unload, ice_hwmon_exit() called from ice_remove() leaving the first hwmon instance orphaned with dangling pointer Fix this by moving ice_hwmon_exit() from ice_remove() to ice_deinit_features() to ensure proper cleanup symmetry with ice_hwmon_init(). Fixes: 4da71a77fc3b ("ice: read internal temperature sensor") Reviewed-by: Aleksandr Loktionov Signed-off-by: Paul Greenwalt Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 42fb5f3deb582cb96440e4683745017dbabb83d6 Author: Paul Greenwalt Date: Thu Dec 18 08:36:53 2025 -0500 ice: add missing ice_deinit_hw() in devlink reinit path devlink-reload results in ice_init_hw failed error, and then removing the ice driver causes a NULL pointer dereference. [ +0.102213] ice 0000:ca:00.0: ice_init_hw failed: -16 ... [ +0.000001] Call Trace: [ +0.000003] [ +0.000006] ice_unload+0x8f/0x100 [ice] [ +0.000081] ice_remove+0xba/0x300 [ice] Commit 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths") removed ice_deinit_hw() from ice_deinit_dev(). As a result ice_devlink_reinit_down() no longer calls ice_deinit_hw(), but ice_devlink_reinit_up() still calls ice_init_hw(). Since the control queues are not uninitialized, ice_init_hw() fails with -EBUSY. Add ice_deinit_hw() to ice_devlink_reinit_down() to correspond with ice_init_hw() in ice_devlink_reinit_up(). Fixes: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths") Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Signed-off-by: Paul Greenwalt Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f406220eb8e227ca344eef1a6d30aff53706b196 Author: Cody Haas Date: Fri Dec 12 16:22:26 2025 -0800 ice: Fix persistent failure in ice_get_rxfh Several ioctl functions have the ability to call ice_get_rxfh, however all of these ioctl functions do not provide all of the expected information in ethtool_rxfh_param. For example, ethtool_get_rxfh_indir does not provide an rss_key. This previously caused ethtool_get_rxfh_indir to always fail with -EINVAL. This change draws inspiration from i40e_get_rss to handle this situation, by only calling the appropriate rss helpers when the necessary information has been provided via ethtool_rxfh_param. Fixes: b66a972abb6b ("ice: Refactor ice_set/get_rss into LUT and key specific functions") Signed-off-by: Cody Haas Closes: https://lore.kernel.org/intel-wired-lan/CAH7f-UKkJV8MLY7zCdgCrGE55whRhbGAXvgkDnwgiZ9gUZT7_w@mail.gmail.com/ Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit c03e9c42ae8f9be76a0cf55ef3f88663f0f6a63a Merge: 8f7537efbe5636 c6ccd098807483 Author: Linus Torvalds Date: Tue Jan 20 10:16:18 2026 -0800 Merge tag 'dma-mapping-6.19-2026-01-20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: - minor fixes for the corner cases of the SWIOTLB pool management (Robin Murphy) * tag 'dma-mapping-6.19-2026-01-20' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma/pool: Avoid allocating redundant pools mm_zone: Generalise has_managed_dma() dma/pool: Improve pool lookup commit 8f7537efbe5636a798cf885ea2fa0e4889995fa9 Merge: 73c9007d9b9406 0a155a8a24ddc6 Author: Linus Torvalds Date: Tue Jan 20 09:46:29 2026 -0800 Merge tag 'pwm/for-6.19-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fixes and a maintainer update from Uwe Kleine-König: - pwm: Ensure ioctl() returns a negative errno on error This affects two ioctls on /dev/pwmchipX where the return value of copy_to_user() was passed to userspace. This is fixed to return -EFAULT now instead. - pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops This fixes an oversight in the original commit that added support for the max7360 driver (d93a75d94b79: "pwm: max7360: Add MAX7360 PWM support"). There is no user-visible effect because the .sizeof_wfhw member is just a safe guard that the memory provided by the core is big enough. While it currently is big enough and there is no reason to assume that will change, doing that correctly is necessary. - MAINTAINERS: Add Michal Wilczynski as reviewer for PWM rust drivers Michal cares for the Rust parts of the pwm subsystem. Several of the patches sent recently for the (for now) only Rust pwm driver did not add Michal to Cc which resulted in the patches waiting for review as I thought Michal would care but he wasn't aware of them. * tag 'pwm/for-6.19-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: MAINTAINERS: Add myself as reviewer for PWM rust drivers pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops pwm: Ensure ioctl() returns a negative errno on error commit 16aca2c98a6fdf071e5a1a765a295995d7c7e346 Author: Yosry Ahmed Date: Fri Jan 16 20:52:47 2026 +0000 mm: restore per-memcg proactive reclaim with !CONFIG_NUMA Commit 2b7226af730c ("mm/memcg: make memory.reclaim interface generic") moved proactive reclaim logic from memory.reclaim handler to a generic user_proactive_reclaim() helper to be used for per-node proactive reclaim. However, user_proactive_reclaim() was only defined under CONFIG_NUMA, with a stub always returning 0 otherwise. This broke memory.reclaim on !CONFIG_NUMA configs, causing it to report success without actually attempting reclaim. Move the definition of user_proactive_reclaim() outside CONFIG_NUMA, and instead define a stub for __node_reclaim() in the !CONFIG_NUMA case. __node_reclaim() is only called from user_proactive_reclaim() when a write is made to sys/devices/system/node/nodeX/reclaim, which is only defined with CONFIG_NUMA. Link: https://lkml.kernel.org/r/20260116205247.928004-1-yosry.ahmed@linux.dev Fixes: 2b7226af730c ("mm/memcg: make memory.reclaim interface generic") Signed-off-by: Yosry Ahmed Acked-by: Shakeel Butt Acked-by: Michal Hocko Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Davidlohr Bueso Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Qi Zheng Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wei Xu Cc: Yuanchu Xie Cc: Signed-off-by: Andrew Morton commit 9bc9ccbf4c935852e4916081dbce4c25a585ec7d Author: Breno Leitao Date: Fri Jan 16 06:10:11 2026 -0800 mm/kfence: fix potential deadlock in reboot notifier The reboot notifier callback can deadlock when calling cancel_delayed_work_sync() if toggle_allocation_gate() is blocked in wait_event_idle() waiting for allocations, that might not happen on shutdown path. The issue is that cancel_delayed_work_sync() waits for the work to complete, but the work is waiting for kfence_allocation_gate > 0 which requires allocations to happen (each allocation is increased by 1) - allocations that may have stopped during shutdown. Fix this by: 1. Using cancel_delayed_work() (non-sync) to avoid blocking. Now the callback succeeds and return. 2. Adding wake_up() to unblock any waiting toggle_allocation_gate() 3. Adding !kfence_enabled to the wait condition so the wake succeeds The static_branch_disable() IPI will still execute after the wake, but at this early point in shutdown (reboot notifier runs with INT_MAX priority), the system is still functional and CPUs can respond to IPIs. Link: https://lkml.kernel.org/r/20260116-kfence_fix-v1-1-4165a055933f@debian.org Fixes: ce2bba89566b ("mm/kfence: add reboot notifier to disable KFENCE on shutdown") Signed-off-by: Breno Leitao Reported-by: Chris Mason Closes: https://lore.kernel.org/all/20260113140234.677117-1-clm@meta.com/ Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Breno Leitao Cc: Chris Mason Cc: Dmitriy Vyukov Signed-off-by: Andrew Morton commit cb7d761bf5d4b1600564efdd42653b821eb2ec8e Author: Suren Baghdasaryan Date: Fri Jan 16 10:44:23 2026 -0800 Docs/mm/allocation-profiling: describe sysctrl limitations in debug mode When CONFIG_MEM_ALLOC_PROFILING_DEBUG=y, /proc/sys/vm/mem_profiling is read-only to avoid debug warnings in a scenario when an allocation is made while profiling is disabled (allocation does not get an allocation tag), then profiling gets enabled and allocation gets freed (warning due to the allocation missing allocation tag). Link: https://lkml.kernel.org/r/20260116184423.2708363-1-surenb@google.com Fixes: ebdf9ad4ca98 ("memprofiling: documentation") Reported-by: Andrew Morton Signed-off-by: Suren Baghdasaryan Acked-by: SeongJae Park Cc: Jonathan Corbet Cc: Kent Overstreet Cc: Matthew Wilcox (Oracle) Cc: Ran Xiaokai Cc: SeongJae Park Signed-off-by: Andrew Morton commit 35e247032606f06c2f19d90a6562bc315206b7a7 Author: Lorenzo Stoakes Date: Wed Jan 14 11:00:06 2026 +0000 mm: do not copy page tables unnecessarily for VM_UFFD_WP Commit ab04b530e7e8 ("mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one") aggregates flags checks in vma_needs_copy(), including VM_UFFD_WP. However in doing so, it incorrectly performed this check against src_vma. This check was done on the assumption that all relevant flags are copied upon fork. However the userfaultfd logic is very innovative in that it implements custom logic on fork in dup_userfaultfd(), including a rather well hidden case where lacking UFFD_FEATURE_EVENT_FORK causes VM_UFFD_WP to not be propagated to the destination VMA. And indeed, vma_needs_copy(), prior to this patch, did check this property on dst_vma, not src_vma. Since all the other relevant flags are copied on fork, we can simply fix this by checking against dst_vma. While we're here, we fix a comment against VM_COPY_ON_FORK (noting that it did indeed already reference dst_vma) to make it abundantly clear that we must check against the destination VMA. Link: https://lkml.kernel.org/r/20260114110006.1047071-1-lorenzo.stoakes@oracle.com Fixes: ab04b530e7e8 ("mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one") Signed-off-by: Lorenzo Stoakes Reported-by: Chris Mason Closes: https://lore.kernel.org/all/20260113231257.3002271-1-clm@meta.com/ Acked-by: David Hildenbrand (Red Hat) Acked-by: Pedro Falcato Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8ce720d5bd91e9dc16db3604aa4b1bf76770a9a1 Author: David Hildenbrand (Red Hat) Date: Tue Dec 23 22:40:37 2025 +0100 mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather As reported, ever since commit 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") we can end up in some situations where we perform so many IPI broadcasts when unsharing hugetlb PMD page tables that it severely regresses some workloads. In particular, when we fork()+exit(), or when we munmap() a large area backed by many shared PMD tables, we perform one IPI broadcast per unshared PMD table. There are two optimizations to be had: (1) When we process (unshare) multiple such PMD tables, such as during exit(), it is sufficient to send a single IPI broadcast (as long as we respect locking rules) instead of one per PMD table. Locking prevents that any of these PMD tables could get reused before we drop the lock. (2) When we are not the last sharer (> 2 users including us), there is no need to send the IPI broadcast. The shared PMD tables cannot become exclusive (fully unshared) before an IPI will be broadcasted by the last sharer. Concurrent GUP-fast could walk into a PMD table just before we unshared it. It could then succeed in grabbing a page from the shared page table even after munmap() etc succeeded (and supressed an IPI). But there is not difference compared to GUP-fast just sleeping for a while after grabbing the page and re-enabling IRQs. Most importantly, GUP-fast will never walk into page tables that are no-longer shared, because the last sharer will issue an IPI broadcast. (if ever required, checking whether the PUD changed in GUP-fast after grabbing the page like we do in the PTE case could handle this) So let's rework PMD sharing TLB flushing + IPI sync to use the mmu_gather infrastructure so we can implement these optimizations and demystify the code at least a bit. Extend the mmu_gather infrastructure to be able to deal with our special hugetlb PMD table sharing implementation. To make initialization of the mmu_gather easier when working on a single VMA (in particular, when dealing with hugetlb), provide tlb_gather_mmu_vma(). We'll consolidate the handling for (full) unsharing of PMD tables in tlb_unshare_pmd_ptdesc() and tlb_flush_unshared_tables(), and track in "struct mmu_gather" whether we had (full) unsharing of PMD tables. Because locking is very special (concurrent unsharing+reuse must be prevented), we disallow deferring flushing to tlb_finish_mmu() and instead require an explicit earlier call to tlb_flush_unshared_tables(). From hugetlb code, we call huge_pmd_unshare_flush() where we make sure that the expected lock protecting us from concurrent unsharing+reuse is still held. Check with a VM_WARN_ON_ONCE() in tlb_finish_mmu() that tlb_flush_unshared_tables() was properly called earlier. Document it all properly. Notes about tlb_remove_table_sync_one() interaction with unsharing: There are two fairly tricky things: (1) tlb_remove_table_sync_one() is a NOP on architectures without CONFIG_MMU_GATHER_RCU_TABLE_FREE. Here, the assumption is that the previous TLB flush would send an IPI to all relevant CPUs. Careful: some architectures like x86 only send IPIs to all relevant CPUs when tlb->freed_tables is set. The relevant architectures should be selecting MMU_GATHER_RCU_TABLE_FREE, but x86 might not do that in stable kernels and it might have been problematic before this patch. Also, the arch flushing behavior (independent of IPIs) is different when tlb->freed_tables is set. Do we have to enlighten them to also take care of tlb->unshared_tables? So far we didn't care, so hopefully we are fine. Of course, we could be setting tlb->freed_tables as well, but that might then unnecessarily flush too much, because the semantics of tlb->freed_tables are a bit fuzzy. This patch changes nothing in this regard. (2) tlb_remove_table_sync_one() is not a NOP on architectures with CONFIG_MMU_GATHER_RCU_TABLE_FREE that actually don't need a sync. Take x86 as an example: in the common case (!pv, !X86_FEATURE_INVLPGB) we still issue IPIs during TLB flushes and don't actually need the second tlb_remove_table_sync_one(). This optimized can be implemented on top of this, by checking e.g., in tlb_remove_table_sync_one() whether we really need IPIs. But as described in (1), it really must honor tlb->freed_tables then to send IPIs to all relevant CPUs. Notes on TLB flushing changes: (1) Flushing for non-shared PMD tables We're converting from flush_hugetlb_tlb_range() to tlb_remove_huge_tlb_entry(). Given that we properly initialize the MMU gather in tlb_gather_mmu_vma() to be hugetlb aware, similar to __unmap_hugepage_range(), that should be fine. (2) Flushing for shared PMD tables We're converting from various things (flush_hugetlb_tlb_range(), tlb_flush_pmd_range(), flush_tlb_range()) to tlb_flush_pmd_range(). tlb_flush_pmd_range() achieves the same that tlb_remove_huge_tlb_entry() would achieve in these scenarios. Note that tlb_remove_huge_tlb_entry() also calls __tlb_remove_tlb_entry(), however that is only implemented on powerpc, which does not support PMD table sharing. Similar to (1), tlb_gather_mmu_vma() should make sure that TLB flushing keeps on working as expected. Further, note that the ptdesc_pmd_pts_dec() in huge_pmd_share() is not a concern, as we are holding the i_mmap_lock the whole time, preventing concurrent unsharing. That ptdesc_pmd_pts_dec() usage will be removed separately as a cleanup later. There are plenty more cleanups to be had, but they have to wait until this is fixed. [david@kernel.org: fix kerneldoc] Link: https://lkml.kernel.org/r/f223dd74-331c-412d-93fc-69e360a5006c@kernel.org Link: https://lkml.kernel.org/r/20251223214037.580860-5-david@kernel.org Fixes: 1013af4f585f ("mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race") Signed-off-by: David Hildenbrand (Red Hat) Reported-by: Uschakow, Stanislav" Closes: https://lore.kernel.org/all/4d3878531c76479d9f8ca9789dc6485d@amazon.de/ Tested-by: Laurence Oberman Acked-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Lance Yang Cc: Liu Shixin Cc: Oscar Salvador Cc: Rik van Riel Cc: Signed-off-by: Andrew Morton commit a8682d500f691b6dfaa16ae1502d990aeb86e8be Author: David Hildenbrand (Red Hat) Date: Tue Dec 23 22:40:36 2025 +0100 mm/rmap: fix two comments related to huge_pmd_unshare() PMD page table unsharing no longer touches the refcount of a PMD page table. Also, it is not about dropping the refcount of a "PMD page" but the "PMD page table". Let's just simplify by saying that the PMD page table was unmapped, consequently also unmapping the folio that was mapped into this page. This code should be deduplicated in the future. Link: https://lkml.kernel.org/r/20251223214037.580860-4-david@kernel.org Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count") Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Rik van Riel Tested-by: Laurence Oberman Reviewed-by: Lorenzo Stoakes Acked-by: Oscar Salvador Cc: Liu Shixin Cc: Harry Yoo Cc: Lance Yang Cc: "Uschakow, Stanislav" Cc: Signed-off-by: Andrew Morton commit 3937027caecb4f8251e82dd857ba1d749bb5a428 Author: David Hildenbrand (Red Hat) Date: Tue Dec 23 22:40:35 2025 +0100 mm/hugetlb: fix two comments related to huge_pmd_unshare() Ever since we stopped using the page count to detect shared PMD page tables, these comments are outdated. The only reason we have to flush the TLB early is because once we drop the i_mmap_rwsem, the previously shared page table could get freed (to then get reallocated and used for other purpose). So we really have to flush the TLB before that could happen. So let's simplify the comments a bit. The "If we unshared PMDs, the TLB flush was not recorded in mmu_gather." part introduced as in commit a4a118f2eead ("hugetlbfs: flush TLBs correctly after huge_pmd_unshare") was confusing: sure it is recorded in the mmu_gather, otherwise tlb_flush_mmu_tlbonly() wouldn't do anything. So let's drop that comment while at it as well. We'll centralize these comments in a single helper as we rework the code next. Link: https://lkml.kernel.org/r/20251223214037.580860-3-david@kernel.org Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count") Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Rik van Riel Tested-by: Laurence Oberman Reviewed-by: Lorenzo Stoakes Acked-by: Oscar Salvador Reviewed-by: Harry Yoo Cc: Liu Shixin Cc: Lance Yang Cc: "Uschakow, Stanislav" Cc: Signed-off-by: Andrew Morton commit ca1a47cd3f5f4c46ca188b1c9a27af87d1ab2216 Author: David Hildenbrand (Red Hat) Date: Tue Dec 23 22:40:34 2025 +0100 mm/hugetlb: fix hugetlb_pmd_shared() Patch series "mm/hugetlb: fixes for PMD table sharing (incl. using mmu_gather)", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I recently shared [1] for the performance fix, deferring most of the cleanups I had in the prototype to a later point. While doing that I identified the other things. The goal of this patch set is to be backported to stable trees "fairly" easily. At least patch #1 and #4. Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing Patch #2 + #3 are simple comment fixes that patch #4 interacts with. Patch #4 is a fix for the reported performance regression due to excessive IPI broadcasts during fork()+exit(). The last patch is all about TLB flushes, IPIs and mmu_gather. Read: complicated There are plenty of cleanups in the future to be had + one reasonable optimization on x86. But that's all out of scope for this series. Runtime tested, with a focus on fixing the performance regression using the original reproducer [2] on x86. This patch (of 4): We switched from (wrongly) using the page count to an independent shared count. Now, shared page tables have a refcount of 1 (excluding speculative references) and instead use ptdesc->pt_share_count to identify sharing. We didn't convert hugetlb_pmd_shared(), so right now, we would never detect a shared PMD table as such, because sharing/unsharing no longer touches the refcount of a PMD table. Page migration, like mbind() or migrate_pages() would allow for migrating folios mapped into such shared PMD tables, even though the folios are not exclusive. In smaps we would account them as "private" although they are "shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the pagemap interface. Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared(). Link: https://lkml.kernel.org/r/20251223214037.580860-1-david@kernel.org Link: https://lkml.kernel.org/r/20251223214037.580860-2-david@kernel.org Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [1] Link: https://lore.kernel.org/all/8cab934d-4a56-44aa-b641-bfd7e23bd673@kernel.org/ [2] Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count") Signed-off-by: David Hildenbrand (Red Hat) Reviewed-by: Rik van Riel Reviewed-by: Lance Yang Tested-by: Lance Yang Reviewed-by: Harry Yoo Tested-by: Laurence Oberman Reviewed-by: Lorenzo Stoakes Acked-by: Oscar Salvador Cc: Liu Shixin Cc: Uschakow, Stanislav" Cc: Signed-off-by: Andrew Morton commit 90888b4ae103e65e5dfd438adb8d7d7ece91afd2 Author: Lorenzo Stoakes Date: Wed Jan 14 11:56:19 2026 +0000 mm: remove unnecessary and incorrect mmap lock assert This check was introduced by commit 42fc541404f2 ("mmap locking API: add mmap_assert_locked() and mmap_assert_write_locked()") which replaced a VM_BUG_ON_VMA() over rwsem_is_locked from commit a00cc7d9dd93 ("mm, x86: add support for PUD-sized transparent hugepages"), i.e. the commit that introduced PUD THPs. These seem to be careful asserts introduced to ensure that locks are held in general, however for a zap we require that VMAs are kept stable, and this is a requirement that has held perfectly well for a long time. These were long before VMA locks and thus there appears to be no reason to think this is assert is there for anything other than 'stabilised VMA'. Asserting that the VMA under examination is stable only in the case of a THP PUD is strange and unnecessary. If we wish to be careful and assert such things, we should do so at the zap level. However in any case the current situation is already simply incorrect - a VMA lock suffices here. Remove the assert for now as it is unnecessarily, incorrect and unhelpful, subsequent work can introduce an assert in general for zapping if required. Link: https://lkml.kernel.org/r/20260114115619.1087466-1-lorenzo.stoakes@oracle.com Fixes: 2ab7f1bbafc9 ("mm/madvise: allow guard page install/remove under VMA lock") Signed-off-by: Lorenzo Stoakes Reported-by: Chris Mason Closes: https://lore.kernel.org/all/20260113220856.2358195-1-clm@meta.com/ Acked-by: David Hildenbrand (Red Hat) Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8 Author: Chaitanya Kulkarni Date: Fri Dec 19 15:28:58 2025 -0800 iommu/io-pgtable-arm: fix size_t signedness bug in unmap path __arm_lpae_unmap() returns size_t but was returning -ENOENT (negative error code) when encountering an unmapped PTE. Since size_t is unsigned, -ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE on 64-bit systems). This corrupted value propagates through the call chain: __arm_lpae_unmap() returns -ENOENT as size_t -> arm_lpae_unmap_pages() returns it -> __iommu_unmap() adds it to iova address -> iommu_pgsize() triggers BUG_ON due to corrupted iova This can cause IOVA address overflow in __iommu_unmap() loop and trigger BUG_ON in iommu_pgsize() from invalid address alignment. Fix by returning 0 instead of -ENOENT. The WARN_ON already signals the error condition, and returning 0 (meaning "nothing unmapped") is the correct semantic for size_t return type. This matches the behavior of other io-pgtable implementations (io-pgtable-arm-v7s, io-pgtable-dart) which return 0 on error conditions. Fixes: 3318f7b5cefb ("iommu/io-pgtable-arm: Add quirk to quiet WARN_ON()") Cc: stable@vger.kernel.org Signed-off-by: Chaitanya Kulkarni Acked-by: Will Deacon Reviewed-by: Jason Gunthorpe Reviewed-by: Rob Clark Signed-off-by: Joerg Roedel commit b97d5eedf4976cc94321243be83b39efe81a0e15 Author: Yun Lu Date: Fri Jan 16 17:53:08 2026 +0800 netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_create_prog() performs list_add_tail, it is possible that nsim_bpf_destroy_prog() is simultaneously performs list_del. Concurrent operations on the list may lead to list corruption and trigger a kernel crash as follows: [ 417.290971] kernel BUG at lib/list_debug.c:62! [ 417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1 [ 417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 417.291007] Workqueue: events bpf_prog_free_deferred [ 417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0 [ 417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff <0f> 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8 [ 417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246 [ 417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000 [ 417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180 [ 417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003 [ 417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20 [ 417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000 [ 417.291074] FS: 0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000 [ 417.291079] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0 [ 417.291088] PKRU: 55555554 [ 417.291091] Call Trace: [ 417.291096] [ 417.291103] nsim_bpf_destroy_prog+0x31/0x80 [netdevsim] [ 417.291154] __bpf_prog_offload_destroy+0x2a/0x80 [ 417.291163] bpf_prog_dev_bound_destroy+0x6f/0xb0 [ 417.291171] bpf_prog_free_deferred+0x18e/0x1a0 [ 417.291178] process_one_work+0x18a/0x3a0 [ 417.291188] worker_thread+0x27b/0x3a0 [ 417.291197] ? __pfx_worker_thread+0x10/0x10 [ 417.291207] kthread+0xe5/0x120 [ 417.291214] ? __pfx_kthread+0x10/0x10 [ 417.291221] ret_from_fork+0x31/0x50 [ 417.291230] ? __pfx_kthread+0x10/0x10 [ 417.291236] ret_from_fork_asm+0x1a/0x30 [ 417.291246] Add a mutex lock, to prevent simultaneous addition and deletion operations on the list. Fixes: 31d3ad832948 ("netdevsim: add bpf offload support") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Signed-off-by: Yun Lu Link: https://patch.msgid.link/20260116095308.11441-1-luyun_611@163.com Signed-off-by: Paolo Abeni commit 34308187395ff01f2d54007eb8b222f843bdf445 Author: Qu Wenruo Date: Mon Jan 12 08:32:09 2026 +1030 btrfs: add extra device item checks at mount [BUG] There is a bug report where after a dev-replace, the replace source device with devid 4 is properly erased (dump tree shows it's the old devid 4), but the target device is still using devid 0. When the user tries to mount the fs degraded, the mount failed with the following errors: BTRFS: device fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 devid 5 transid 1394395 /dev/sda (8:0) scanned by btrfs (261) BTRFS: device fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 devid 6 transid 1394395 /dev/sde (8:64) scanned by btrfs (261) BTRFS: device fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 devid 0 transid 1394395 /dev/sdd (8:48) scanned by btrfs (261) BTRFS: device fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 devid 3 transid 1394395 /dev/sdf (8:80) scanned by btrfs (261) BTRFS info (device sdd): first mount of filesystem 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 BTRFS info (device sdd): using crc32c (crc32c-intel) checksum algorithm BTRFS warning (device sdd): devid 4 uuid 01e2081c-9c2a-4071-b9f4-e1b27e571ff5 is missing BTRFS info (device sdd): bdev errs: wr 84994544, rd 15567, flush 65872, corrupt 0, gen 0 BTRFS info (device sdd): bdev /dev/sdd errs: wr 71489901, rd 0, flush 30001, corrupt 0, gen 0 BTRFS error (device sdd): replace without active item, run 'device scan --forget' on the target device BTRFS error (device sdd): failed to init dev_replace: -117 BTRFS error (device sdd): open_ctree failed: -117 [CAUSE] The devid 0 didn't get its devid updated is its own problem, here I'm only focusing on the mount failure itself. The mount is not caused by the missing device, as the fs has RAID1C3 for metadata and RAID10 for data, thus is completely able to tolerate one missing device. The device tree shows the dev-replace has properly finished: item 7 key (0 DEV_REPLACE 0) itemoff 15931 itemsize 72 src devid -1 cursor left 11091821199360 cursor right 11091821199360 mode ALWAYS state FINISHED write errors 0 uncorrectable read errors 0 ^^^^^^^^ And the chunk tree shows there is no devid 0: leaf 37980736602112 items 23 free space 12548 generation 1394388 owner CHUNK_TREE leaf 37980736602112 flags 0x1(WRITTEN) backref revision 1 fs uuid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 chunk uuid d074c661-6311-4570-b59f-a5c83fd37f8e item 0 key (DEV_ITEMS DEV_ITEM 3) itemoff 16185 itemsize 98 devid 3 total_bytes 20000588955648 bytes_used 8282877984768 io_align 4096 io_width 4096 sector_size 4096 type 0 generation 0 start_offset 0 dev_group 0 seek_speed 0 bandwidth 0 uuid 0d596b69-fb0d-4031-b4af-a301d0868b8b fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 ... Which shows the first device is devid 3. But there is indeed /dev/sdd with devid 0: superblock: bytenr=65536, device=/dev/sdd --------------------------------------------------------- csum_type 0 (crc32c) csum_size 4 csum 0xd4bed87e [match] bytenr 65536 flags 0x1 ( WRITTEN ) magic _BHRfS_M [match] fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 ... uuid_tree_generation 1394388 dev_item.uuid ee6532ad-5442-45f7-87fb-7703e29ed934 dev_item.fsid 84a1ed4a-365c-45c3-a9ee-a7df525dc3c9 [match] dev_item.type 0 dev_item.total_bytes 20000588955648 dev_item.bytes_used 8292541661184 dev_item.io_align 0 dev_item.io_width 0 dev_item.sector_size 0 dev_item.devid 0 <<< So this means device scan will register sdd as devid 0 into the fs, then during btrfs_init_dev_replace(), we located the replace progress item, found the previous replace is finished, but we still need to check if the dev-replace target device (devid 0) exists. If that device exists, we error out showing that error message. But to be honest the end user may not really remember which device is the replace target device, thus not sure what to do in the next step. [ENHANCEMENT] To make the error more obvious, and tell the end user which devices should be unregistered: - Introduce BTRFS_DEV_STATE_ITEM_FOUND flag During device item read from the chunk tree, set the flag for each found device item. - Verify there is no device without the above flag during mount Even missing device should have that flag set. If we found a device without that flag set, it means it's an unexpected one and should be rejected. - More detailed error message on what to do next This will show all unexpected devices and tell the end user to use 'btrfs dev scan --forget' to forget them or remove them before mount. There is an example dmesg where a device of a valid filesystem is modified to have devid 0, then try degraded mount: BTRFS info (device dm-6): first mount of filesystem 7c873869-844c-4b39-bd75-a96148bf4656 BTRFS info (device dm-6): using crc32c checksum algorithm BTRFS warning (device dm-6): devid 3 uuid b4a9f35b-db42-4ac4-b55a-cbf81d3b9683 is missing BTRFS error (device dm-6): devid 0 path /dev/mapper/test-scratch3 is registered but not found in chunk tree BTRFS error (device dm-6): please remove above devices or use 'btrfs device scan --forget ' to unregister them before mount BTRFS error (device dm-6): open_ctree failed: -117 Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1d8f69f453c2e8a2d99b158e58e02ed65031fa6d Author: Mark Harmstone Date: Tue Jan 13 18:37:56 2026 +0000 btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE When the BLOCK_GROUP_TREE compat_ro flag is set, the extent root and csum root fields are getting missed. This is because EXTENT_TREE_V2 treated these differently, and when they were split off this special-casing was mistakenly assigned to BGT rather than the rump EXTENT_TREE_V2. There's no reason why the existence of the block group tree should mean that we don't record the details of the last commit's extent root and csum root. Fix the code in backup_super_roots() so that the correct check gets made. Fixes: 1c56ab991903 ("btrfs: separate BLOCK_GROUP_TREE compat RO flag from EXTENT_TREE_V2") Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1972f44c189c8aacde308fa9284e474c1a5cbd9f Author: Qu Wenruo Date: Wed Jan 14 07:28:28 2026 +1030 btrfs: reject new transactions if the fs is fully read-only [BUG] There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnings during unmount: BTRFS: Transaction aborted (error -22) Modules linked in: CPU: 0 UID: 0 PID: 9758 Comm: repro.out Not tainted 6.19.0-rc5-00002-gb71e635feefc #7 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:find_free_extent_update_loop fs/btrfs/extent-tree.c:4208 [inline] RIP: 0010:find_free_extent+0x52f0/0x5d20 fs/btrfs/extent-tree.c:4611 Call Trace: btrfs_reserve_extent+0x2cd/0x790 fs/btrfs/extent-tree.c:4705 btrfs_alloc_tree_block+0x1e1/0x10e0 fs/btrfs/extent-tree.c:5157 btrfs_force_cow_block+0x578/0x2410 fs/btrfs/ctree.c:517 btrfs_cow_block+0x3c4/0xa80 fs/btrfs/ctree.c:708 btrfs_search_slot+0xcad/0x2b50 fs/btrfs/ctree.c:2130 btrfs_truncate_inode_items+0x45d/0x2350 fs/btrfs/inode-item.c:499 btrfs_evict_inode+0x923/0xe70 fs/btrfs/inode.c:5628 evict+0x5f4/0xae0 fs/inode.c:837 __dentry_kill+0x209/0x660 fs/dcache.c:670 finish_dput+0xc9/0x480 fs/dcache.c:879 shrink_dcache_for_umount+0xa0/0x170 fs/dcache.c:1661 generic_shutdown_super+0x67/0x2c0 fs/super.c:621 kill_anon_super+0x3b/0x70 fs/super.c:1289 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2127 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318 task_work_run+0x1d4/0x260 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x694/0x22f0 kernel/exit.c:971 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112 __do_sys_exit_group kernel/exit.c:1123 [inline] __se_sys_exit_group kernel/exit.c:1121 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1121 x64_sys_call+0x2210/0x2210 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x44f639 Code: Unable to access opcode bytes at 0x44f60f. RSP: 002b:00007ffc15c4e088 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00000000004c32f0 RCX: 000000000044f639 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004c32f0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 Since rescue mount options will mark the full fs read-only, there should be no new transaction triggered. But during unmount we will evict all inodes, which can trigger a new transaction, and triggers warnings on a heavily corrupted fs. [CAUSE] Btrfs allows new transaction even on a read-only fs, this is to allow log replay happen even on read-only mounts, just like what ext4/xfs do. However with rescue mount options, the fs is fully read-only and cannot be remounted read-write, thus in that case we should also reject any new transactions. [FIX] If we find the fs has rescue mount options, we should treat the fs as error, so that no new transaction can be started. Reported-by: Jiaming Zhang Link: https://lore.kernel.org/linux-btrfs/CANypQFYw8Nt8stgbhoycFojOoUmt+BoZ-z8WJOZVxcogDdwm=Q@mail.gmail.com/ Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3f29d661e5686f3aa14e6f11537ff5c49846f2e2 Author: Edward Adam Davis Date: Fri Jan 9 21:02:02 2026 +0800 btrfs: sync read disk super and set block size When the user performs a btrfs mount, the block device is not set correctly. The user sets the block size of the block device to 0x4000 by executing the BLKBSZSET command. Since the block size change also changes the mapping->flags value, this further affects the result of the mapping_min_folio_order() calculation. Let's analyze the following two scenarios: Scenario 1: Without executing the BLKBSZSET command, the block size is 0x1000, and mapping_min_folio_order() returns 0; Scenario 2: After executing the BLKBSZSET command, the block size is 0x4000, and mapping_min_folio_order() returns 2. do_read_cache_folio() allocates a folio before the BLKBSZSET command is executed. This results in the allocated folio having an order value of 0. Later, after BLKBSZSET is executed, the block size increases to 0x4000, and the mapping_min_folio_order() calculation result becomes 2. This leads to two undesirable consequences: 1. filemap_add_folio() triggers a VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) assertion. 2. The syzbot report [1] shows a null pointer dereference in create_empty_buffers() due to a buffer head allocation failure. Synchronization should be established based on the inode between the BLKBSZSET command and read cache page to prevent inconsistencies in block size or mapping flags before and after folio allocation. [1] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694 Call Trace: folio_create_buffers+0x109/0x150 fs/buffer.c:1802 block_read_full_folio+0x14c/0x850 fs/buffer.c:2403 filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496 do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096 do_read_cache_page mm/filemap.c:4162 [inline] read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195 btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367 Reported-by: syzbot+b4a2af3000eaa84d95d5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b4a2af3000eaa84d95d5 Signed-off-by: Edward Adam Davis Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit d1883cefd31752f0504b94c3bcfa1f6d511d6e87 Author: Hans de Goede Date: Thu Dec 11 17:37:27 2025 +0100 leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized. This leaves a window where led_trigger_register() of a LED's default trigger will call led_trigger_set() which calls led_set_brightness() which in turn will end up queueing the *uninitialized* led_classdev.set_brightness_work. This race gets hit by the lenovo-thinkpad-t14s EC driver which registers 2 LEDs with a default trigger provided by snd_ctl_led.ko in quick succession. The first led_classdev_register() causes an async modprobe of snd_ctl_led to run and that async modprobe manages to exactly hit the window where the second LED is on the leds_list without led_init_core() being called for it, resulting in: ------------[ cut here ]------------ WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025 ... Call trace: __flush_work+0x344/0x390 (P) flush_work+0x2c/0x50 led_trigger_set+0x1c8/0x340 led_trigger_register+0x17c/0x1c0 led_trigger_register_simple+0x84/0xe8 snd_ctl_led_init+0x40/0xf88 [snd_ctl_led] do_one_initcall+0x5c/0x318 do_init_module+0x9c/0x2b8 load_module+0x7e0/0x998 Close the race window by moving the adding of the LED to leds_list to after the led_init_core() call. Cc: stable@vger.kernel.org Fixes: d23a22a74fde ("leds: delay led_set_brightness if stopping soft-blink") Signed-off-by: Hans de Goede Reviewed-by: Sebastian Reichel Link: https://patch.msgid.link/20251211163727.366441-1-johannes.goede@oss.qualcomm.com Signed-off-by: Lee Jones commit 5d54aa40c7b7e9dee5746cca99e9ddbcca13e895 Author: Michal Luczaj Date: Fri Jan 16 09:52:36 2026 +0100 vsock/test: Do not filter kallsyms by symbol type Blamed commit implemented logic to discover available vsock transports by grepping /proc/kallsyms for known symbols. It incorrectly filtered entries by type 'd'. For some kernel configs having CONFIG_VIRTIO_VSOCKETS=m CONFIG_VSOCKETS_LOOPBACK=y kallsyms reports 0000000000000000 d virtio_transport [vmw_vsock_virtio_transport] 0000000000000000 t loopback_transport Overzealous filtering might have affected vsock test suit, resulting in insufficient/misleading testing. Do not filter symbols by type. It never helped much. Fixes: 3070c05b7afd ("vsock/test: Introduce get_transports()") Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260116-vsock_test-kallsyms-grep-v1-1-3320bc3346f2@rbox.co Signed-off-by: Paolo Abeni commit 4b11f2336e23d5c55b76591bd8ac39b059f68ad0 Author: Armin Wolf Date: Thu Jan 8 17:45:27 2026 +0100 platform/x86: acer-wmi: Fix missing capability check During the rework of the fan behavior control code in commit d8e8362b09d3 ("platform/x86: acer-wmi: Fix setting of fan behavior"), acer_toggle_turbo() was changed to use WMID_gaming_set_fan_behavior() instead of WMID_gaming_set_u64() when switching the fans to turbo mode. The new function however does not check if the necessary capability (ACER_CAP_TURBO_FAN) is actually enabled on a given machine, causing the driver to potentially access unsupported features. Fix this by manually checking if ACER_CAP_TURBO_FAN is enabled on a given machine before changing the fan mode. Cc: stable@vger.kernel.org Fixes: d8e8362b09d3 ("platform/x86: acer-wmi: Fix setting of fan behavior") Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260108164716.14376-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 40901719bd28a129471f80f98edca42548273458 Author: Armin Wolf Date: Thu Jan 8 17:45:26 2026 +0100 platform/x86: acer-wmi: Extend support for Acer Nitro AN515-58 The Acer Nitro AN515-58 additionally supports fan control. Modify the quirk list to enable said feature on this machine. Reported-by: Pranay Pawar Closes: https://lore.kernel.org/platform-driver-x86/CACy5qBaFv_L5y_nGJU_3pd3CXbFZrUAE18y5Fc-hnAmrd8bSLA@mail.gmail.com/ Tested-by: Pranay Pawar Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260108164716.14376-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0240c89774559986103d150ef2323de6c7a2ece8 Merge: 400928d01fb97f 70b8c45d8621c4 Author: Arnd Bergmann Date: Tue Jan 20 16:08:41 2026 +0100 Merge tag 'nuvoton-arm-6.19-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes Nuvoton NPCM Arm fixes for v6.19 Just the one change from Randy dropping an unused Kconfig symbol. * tag 'nuvoton-arm-6.19-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: arm: npcm: drop unused Kconfig ERRATA symbol Signed-off-by: Arnd Bergmann commit 400928d01fb97fa86b4d82a6b65bfa82d7c19f6d Author: Andrew Jeffery Date: Fri Jan 16 11:29:56 2026 +1030 MAINTAINERS: Add Andrew as M: to ARM/NUVOTON NPCM ARCHITECTURE Nuvoton's NPCM SoCs are part of their iBMC product line[1]. NPCM arch patches have historically gone through Joel's tree along with ASPEED changes due to their relevance to OpenBMC. Commit df5e674c7a99 ("MAINTAINERS: Switch ASPEED tree to shared BMC repository") does what it says on the tin - we now have bmc/linux.git on git.kernel.org, and I've picked up the maintainer role for it. Document that I'm continuing to apply NPCM arch patches from the openbmc@ list to the BMC tree for PRs to the SoC tree. Cc: Alexandre Belloni Cc: Arnd Bergmann Cc: Avi Fishman Cc: Drew Fustini Cc: Joel Stanley Cc: Krzysztof Kozlowski Cc: Linus Walleij Cc: Rob Herring Cc: Tali Perry Cc: Tomer Maimon Link: https://www.nuvoton.com/products/cloud-computing/ibmc/ [1] Signed-off-by: Andrew Jeffery Signed-off-by: Arnd Bergmann commit b3914291d985124e15ddc91b84fbb9dc356883e7 Author: Denis Benato Date: Fri Jan 16 19:06:37 2026 +0100 platform/x86: asus-armoury: add support for GA403WW Add TDP data for laptop model GA403WW. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260116180637.859803-5-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 01f31c2fffae7550ec3bd392256b2566f9233834 Author: Denis Benato Date: Fri Jan 16 19:06:36 2026 +0100 platform/x86: asus-armoury: keep the list ordered alphabetically Model GA403WM appears after GA403WR breaking the alphabetical order: swap theirs position. Fixes: f5fc40734b0f ("platform/x86: asus-armoury: add support for GA403WM") Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260116180637.859803-4-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d40d7f8e402bdf24d285f0ea5d6cbdae396e6810 Author: Denis Benato Date: Fri Jan 16 19:06:35 2026 +0100 platform/x86: asus-armoury: add support for G835L Add TDP data for laptop model G835L. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260116180637.859803-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 43098a53939e98e6c8191db4bac3c7ef9eed503c Author: Denis Benato Date: Fri Jan 16 19:06:34 2026 +0100 platform/x86: asus-armoury: fix ppt data for FA608UM ppt_pl3_fppt_def and ppt_pl3_fppt_max are wrong: correct it. Fixes: a22d893f490d ("platform/x86: asus-armoury: add support for FA608UM") Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260116180637.859803-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 467d4afc6caa64b84a6db1634f8091e931f4a7cb Author: Mario Limonciello Date: Thu Jan 15 14:31:12 2026 -0600 platform/x86: hp-bioscfg: Fix automatic module loading hp-bioscfg has a MODULE_DEVICE_TABLE with a GUID in it that looks plausible, but the module doesn't automatically load on applicable systems. This is because the GUID has some lower case characters and so it doesn't match the modalias during boot. Update the GUIDs to be all uppercase. Cc: stable@vger.kernel.org Fixes: 5f94f181ca25 ("platform/x86: hp-bioscfg: bioscfg-h") Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260115203725.828434-4-mario.limonciello@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 10dc959398175736e495f71c771f8641e1ca1907 Author: Jens Axboe Date: Tue Jan 20 07:42:50 2026 -0700 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Currently this is checked before running the pending work. Normally this is quite fine, as work items either end up blocking (which will create a new worker for other items), or they complete fairly quickly. But syzbot reports an issue where io-wq takes seemingly forever to exit, and with a bit of debugging, this turns out to be because it queues a bunch of big (2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't support ->read_iter(), loop_rw_iter() ends up handling them. Each read returns 16MB of data read, which takes 20 (!!) seconds. With a bunch of these pending, processing the whole chain can take a long time. Easily longer than the syzbot uninterruptible sleep timeout of 140 seconds. This then triggers a complaint off the io-wq exit path: INFO: task syz.4.135:6326 blocked for more than 143 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.135 state:D stack:26824 pid:6326 tgid:6324 ppid:5957 task_flags:0x400548 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5256 [inline] __schedule+0x1139/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121 io_wq_exit_workers io_uring/io-wq.c:1328 [inline] io_wq_put_and_exit+0x271/0x8a0 io_uring/io-wq.c:1356 io_uring_clean_tctx+0x10d/0x190 io_uring/tctx.c:203 io_uring_cancel_generic+0x69c/0x9a0 io_uring/cancel.c:651 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x2ce/0x2bd0 kernel/exit.c:911 do_group_exit+0xd3/0x2a0 kernel/exit.c:1112 get_signal+0x2671/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline] exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa02738f749 RSP: 002b:00007fa0281ae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fa0275e6098 RCX: 00007fa02738f749 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0275e6098 RBP: 00007fa0275e6090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa0275e6128 R14: 00007fff14e4fcb0 R15: 00007fff14e4fd98 There's really nothing wrong here, outside of processing these reads will take a LONG time. However, we can speed up the exit by checking the IO_WQ_BIT_EXIT inside the io_worker_handle_work() loop, as syzbot will exit the ring after queueing up all of these reads. Then once the first item is processed, io-wq will simply cancel the rest. That should avoid syzbot running into this complaint again. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/68a2decc.050a0220.e29e5.0099.GAE@google.com/ Reported-by: syzbot+4eb282331cab6d5b6588@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 25150715e0b049b99df664daf05dab12f41c3e13 Author: Mario Limonciello Date: Thu Jan 15 14:31:11 2026 -0600 platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro The GET_INSTANCE_ID macro that caused a kernel panic when accessing sysfs attributes: 1. Off-by-one error: The loop condition used '<=' instead of '<', causing access beyond array bounds. Since array indices are 0-based and go from 0 to instances_count-1, the loop should use '<'. 2. Missing NULL check: The code dereferenced attr_name_kobj->name without checking if attr_name_kobj was NULL, causing a null pointer dereference in min_length_show() and other attribute show functions. The panic occurred when fwupd tried to read BIOS configuration attributes: Oops: general protection fault [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:min_length_show+0xcf/0x1d0 [hp_bioscfg] Add a NULL check for attr_name_kobj before dereferencing and corrects the loop boundary to match the pattern used elsewhere in the driver. Cc: stable@vger.kernel.org Fixes: 5f94f181ca25 ("platform/x86: hp-bioscfg: bioscfg-h") Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260115203725.828434-3-mario.limonciello@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1a0f69e3c28477b97d3609569b7e8feb4b6162e8 Author: Osama Abdelkader Date: Fri Jan 2 16:55:52 2026 +0100 drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind Fix several issues in dw_dp_bind() error handling: 1. Missing return after drm_bridge_attach() failure - the function continued execution instead of returning an error. 2. Resource leak: drm_dp_aux_register() is not a devm function, so drm_dp_aux_unregister() must be called on all error paths after aux registration succeeds. This affects errors from: - drm_bridge_attach() - phy_init() - devm_add_action_or_reset() - platform_get_irq() - devm_request_threaded_irq() 3. Bug fix: platform_get_irq() returns the IRQ number or a negative error code, but the error path was returning ERR_PTR(ret) instead of ERR_PTR(dp->irq). Use a goto label for cleanup to ensure consistent error handling. Fixes: 86eecc3a9c2e ("drm/bridge: synopsys: Add DW DPTX Controller support library") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader Reviewed-by: Louis Chauvet Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260102155553.13243-1-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli commit 3317785a8803db629efc759d811d0f589d3a0b2d Author: Harald Freudenberger Date: Mon Jan 19 10:37:28 2026 +0100 s390/ap: Fix wrong APQN fill calculation The upper limit of the firmware queue fill state for each APQN is reported by the hwinfo.qd field. This field shows the numbers 0-7 for 1-8 queue spaces available. But the exploiting code assumed the real boundary is stored there and thus stoppes queuing in messages one tick too early. Correct the limit calculation and thus offer a boost of 12.5% performance for high traffic on one APQN. Fixes: d4c53ae8e4948 ("s390/ap: store TAPQ hwinfo in struct ap_card") Cc: stable@vger.kernel.org Reported-by: Ingo Franzki Reviewed-by: Ingo Franzki Signed-off-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit 018b211b1d321a52ed8d8de74ce83ce52a2e1224 Author: Anatolii Shirykalov Date: Mon Jan 19 15:56:18 2026 +0100 ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list Add ASUS ExpertBook PM1503CDA to the DMI quirks table to enable internal DMIC support via the ACP6x machine driver. Signed-off-by: Anatolii Shirykalov Link: https://patch.msgid.link/20260119145618.3171435-1-pipocavsobake@gmail.com Signed-off-by: Mark Brown commit 9210f5ff6318163835d9e42ee68006be4da0f531 Author: Fabio Estevam Date: Sun Jan 18 17:50:30 2026 -0300 ASoC: fsl: imx-card: Do not force slot width to sample width imx-card currently sets the slot width to the physical sample width for I2S links. This breaks controllers that use fixed-width slots (e.g. 32-bit FIFO words), causing the unused bits in the slot to contain undefined data when playing 16-bit streams. Do not override the slot width in the machine driver and let the CPU DAI select an appropriate default instead. This matches the behavior of simple-audio-card and avoids embedding controller-specific policy in the machine driver. On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots, playing 16-bit audio resulted in spurious frequencies and an incorrect SAI data waveform, as the slot width was forced to 16 bits. After this change, audio artifacts are eliminated and the 16-bit samples correctly occupy the first half of the 32-bit slot, with the remaining bits padded with zeroes. Cc: stable@vger.kernel.org Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver") Signed-off-by: Fabio Estevam Acked-by: Shengjiu Wang Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com Signed-off-by: Mark Brown commit 930e69757b74c3ae083b0c3c7419bfe7f0edc7b2 Author: Berk Cem Goksel Date: Tue Jan 20 13:28:55 2026 +0300 ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed memory. Later when snd_card_register() runs, the OSS mixer layer calls their callbacks and hits a use-after-free read. Call trace: get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411 get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241 mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381 snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887 ... snd_card_register+0x4ed/0x6d0 sound/core/init.c:923 usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025 Fix by calling snd_ctl_remove() for all mixer controls before freeing id_elems. We save the next pointer first because snd_ctl_remove() frees the current element. Fixes: 6639b6c2367f ("[ALSA] usb-audio - add mixer control notifications") Cc: stable@vger.kernel.org Cc: Andrey Konovalov Signed-off-by: Berk Cem Goksel Link: https://patch.msgid.link/20260120102855.7300-1-berkcgoksel@gmail.com Signed-off-by: Takashi Iwai commit 122610220134b32c742cc056eaf64f7017ac8cd9 Author: Matthew Schwartz Date: Mon Dec 29 12:45:26 2025 -0800 mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function rtsx_pci_sdmmc does not have an sdmmc_card_busy function, so any voltage switches cause a kernel warning, "mmc0: cannot verify signal voltage switch." Copy the sdmmc_card_busy function from rtsx_pci_usb to rtsx_pci_sdmmc to fix this. Fixes: ff984e57d36e ("mmc: Add realtek pcie sdmmc host driver") Signed-off-by: Matthew Schwartz Tested-by: Ricky WU Reviewed-by: Ricky WU Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 8a8c942cad4cd12f739a8bb60cac77fd173c4e07 Author: Tzung-Bi Shih Date: Tue Jan 20 09:26:50 2026 +0000 gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register() On error handling paths, gpiolib_cdev_register() doesn't free the allocated resources which results leaks. Fix it. Cc: stable@vger.kernel.org Fixes: 7b9b77a8bba9 ("gpiolib: add a per-gpio_device line state notification workqueue") Fixes: d83cee3d2bb1 ("gpio: protect the pointer to gpio_chip in gpio_device with SRCU") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260120092650.2305319-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit 88da5f4b46f55717202fb1d81052e91d4f88b296 Merge: e03b29b55f2b7c cc8f92e41eb76f Author: Greg Kroah-Hartman Date: Tue Jan 20 10:31:56 2026 +0100 Merge tag 'w1-drv-6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1 into char-misc-linus 1-Wire bus drivers fixes Non critical (old issues) fixes: 1. Fix possible buffer overflow in W1 thermal driver sysfs interfasce, 2. Drop duplicated device put when attaching a slave device failed, which could lead to memory corruption. * tag 'w1-drv-6.20' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1: w1: fix redundant counter decrement in w1_attach_slave_device() w1: therm: Fix off-by-one buffer overflow in alarms_store commit e806f7dde8ba28bc72a7a0898589cac79f6362ac Author: Thomas Weißschuh Date: Tue Jan 20 07:55:55 2026 +0100 timekeeping: Adjust the leap state for the correct auxiliary timekeeper When __do_ajdtimex() was introduced to handle adjtimex for any timekeeper, this reference to tk_core was not updated. When called on an auxiliary timekeeper, the core timekeeper would be updated incorrectly. This gets caught by the lock debugging diagnostics because the timekeepers sequence lock gets written to without holding its associated spinlock: WARNING: include/linux/seqlock.h:226 at __do_adjtimex+0x394/0x3b0, CPU#2: test/125 aux_clock_adj (kernel/time/timekeeping.c:2979) __do_sys_clock_adjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) Update the correct auxiliary timekeeper. Fixes: 775f71ebedd3 ("timekeeping: Make do_adjtimex() reusable") Fixes: ecf3e7030491 ("timekeeping: Provide adjtimex() for auxiliary clocks") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260120-timekeeper-auxclock-leapstate-v1-1-5b358c6b3cfd@linutronix.de commit 98d5110f90ae0dbc5f2f13f033e06f6d57009e0d Author: Jason Gunthorpe Date: Mon Jan 19 20:19:49 2026 -0400 iommupt: Make it clearer to the compiler that pts.level == 0 for single page Older versions of gcc and clang sometimes get tripped up by the build time assertion in FIELD_PREP because they can see that the argument to FIELD_PREP is constant but can't see that the if condition protecting it is also a constant false. In file included from : In function 'amdv1pt_install_leaf_entry', inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:651:3, inlined from '__map_single_page0' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1, inlined from 'pt_descend' at drivers/iommu/generic_pt/fmt/../pt_iter.h:391:9, inlined from '__do_map_single_page' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:658:10, inlined from '__map_single_page1.constprop' at drivers/iommu/generic_pt/fmt/../iommu_pt.h:662:1: ././include/linux/compiler_types.h:631:45: error: call to '__compiletime_assert_251' declared with attribute error: FIELD_PREP: value too large for the field 631 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^ ././include/linux/compiler_types.h:612:25: note: in definition of macro '__compiletime_assert' 612 | prefix ## suffix(); \ | ^~~~~~ ././include/linux/compiler_types.h:631:9: note: in expansion of macro '_compiletime_assert' 631 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | ^~~~~~~~~~~~~~~~~~~ ./include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' 39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) | ^~~~~~~~~~~~~~~~~~ ./include/linux/bitfield.h:69:17: note: in expansion of macro 'BUILD_BUG_ON_MSG' 69 | BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ? \ | ^~~~~~~~~~~~~~~~ ./include/linux/bitfield.h:90:17: note: in expansion of macro '__BF_FIELD_CHECK_MASK' 90 | __BF_FIELD_CHECK_MASK(mask, val, pfx); \ | ^~~~~~~~~~~~~~~~~~~~~ ./include/linux/bitfield.h:137:17: note: in expansion of macro '__FIELD_PREP' 137 | __FIELD_PREP(_mask, _val, "FIELD_PREP: "); \ | ^~~~~~~~~~~~ drivers/iommu/generic_pt/fmt/amdv1.h:220:26: note: in expansion of macro 'FIELD_PREP' 220 | FIELD_PREP(AMDV1PT_FMT_OA, | ^~~~~~~~~~ Changing the caller to check pts.level == 0 avoids demanding a bit of complex reasoning from the compiler that pts.level == level == 0. Instead the compiler sees that pt_install_leaf_entry() is called with a constant pts.level == 0 which makes it more reliable to see the constant false in the if. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Reported-by: Chunyu Hu Closes: https://lore.kernel.org/all/aUn9uGPCooqB-RIF@gmail.com/ Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 Author: Arnd Bergmann Date: Mon Jan 19 21:15:12 2026 +0100 irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org commit 50b359896fe55d0443ed550e1fabba71d242031a Author: Benjamin Berg Date: Sun Jan 18 09:51:15 2026 +0200 wifi: cfg80211: ignore link disabled flag from userspace When the AP has an advertised TID to Link Mapping (TTLM) it shall include the element in the association response. As such, when this element is present it needs to be used for the currently dormant links. See Draft P802.11REVmf_D1.0 section 35.3.7.2.3 ("Negotiation of TTLM") for the details. The flag is also not usable in case userspace wants to specify a negotiated TTLM during association. Note that for the link reconfiguration case, mac80211 did not use the information. Draft P802.11REVmf_D1.0 states in section 35.3.6.4 ("Link reconfiguration to the setup links) that we "shall operate with all the TIDs mapped to the newly added links ..." All this means that the flag is not needed. The implementation should parse the information from the association response. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260118093904.754e057896a5.Ifd06f5ef839a93bfd54d0593dc932870f95f3242@changeid Signed-off-by: Johannes Berg commit aebc29dec67aa998a9ea6d34aacba7b5c6a74d33 Author: Benjamin Berg Date: Sun Jan 18 09:51:14 2026 +0200 wifi: mac80211: apply advertised TTLM from association response When the AP has a disabled link that the station can include in the association, the fact that the link is dormant needs to be advertised in the TID to Link Mapping (TTLM). Section 35.3.7.2.3 ("Negotiation of TTLM") of Draft P802.11REVmf_D1.0 also states that the mapping needs to be included in the association response frame. As such, we can simply rely on the TTLM from the association response. Before this change mac80211 would not properly track that an advertised TTLM was effectively active, resulting in it not enabling the link once it became available again. For the link reconfiguration case, the data was not used at all. This behaviour is actually correct because Draft P802.11REVmf_D1.0 states in section 35.3.6.4 that we "shall operate with all the TIDs mapped to the newly added links ..." Fixes: 6d543b34dbcf ("wifi: mac80211: Support disabled links during association") Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260118093904.43c861424543.I067f702ac46b84ac3f8b4ea16fb0db9cbbfae7e2@changeid Signed-off-by: Johannes Berg commit 3fa2886d11d4545dc0dcfd0759ffbd03f88b5410 Author: Benjamin Berg Date: Sun Jan 18 09:51:13 2026 +0200 wifi: mac80211: parse all TTLM entries For the follow up patch, we need to properly parse TTLM entries that do not have a switch time. Change the logic so that ieee80211_parse_adv_t2l returns usable values in all non-error cases. Before the values filled in were technically incorrect but enough for ieee80211_process_adv_ttlm. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260118093904.ccd324e2dd59.I69f0bee0a22e9b11bb95beef313e305dab17c051@changeid Signed-off-by: Johannes Berg commit 3f3d8ff31496874a69b131866f62474eb24ed20a Author: Miri Korenblit Date: Sun Jan 18 09:28:29 2026 +0200 wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice In reconfig, in case the driver asks to disconnect during the reconfig, all the keys of the interface are marked as tainted. Then ieee80211_reenable_keys will loop over all the interface keys, and for each one it will a) increment crypto_tx_tailroom_needed_cnt b) call ieee80211_key_enable_hw_accel, which in turn will detect that this key is tainted, so it will mark it as "not in hardware", which is paired with crypto_tx_tailroom_needed_cnt incrementation, so we get two incrementations for each tainted key. Then we get a warning in ieee80211_free_keys. To fix it, don't increment the count in ieee80211_reenable_keys for tainted keys Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260118092821.4ca111fddcda.Id6e554f4b1c83760aa02d5a9e4e3080edb197aa2@changeid Signed-off-by: Johannes Berg commit 5dc6975566f5d142ec53eb7e97af688c45dd314d Author: Lachlan Hodges Date: Tue Jan 20 14:11:21 2026 +1100 wifi: mac80211: don't perform DA check on S1G beacon S1G beacons don't contain the DA field as per IEEE80211-2024 9.3.4.3, so the DA broadcast check reads the SA address of the S1G beacon which will subsequently lead to the beacon being dropped. As a result, passive scanning is not possible. Fix this by only performing the check on non-S1G beacons to allow S1G long beacons to be processed during a passive scan. Fixes: ddf82e752f8a ("wifi: mac80211: Allow beacons to update BSS table regardless of scan") Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260120031122.309942-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 304c3ebcaff36560d76e3030ba0839e629635f47 Author: Thomas Gerner Date: Tue Jan 20 09:59:26 2026 +0100 pinctrl: th1520: Fix typo This fixes a simple typo in the TH1520 SPI0 for group3 pins: QSPI0 is misspelled QSPI1. Signed-off-by: Thomas Gerner Signed-off-by: Linus Walleij commit 0a155a8a24ddc647aaf28ce7cdb14af7270c158f Author: Michal Wilczynski Date: Mon Jan 19 21:54:58 2026 +0100 MAINTAINERS: Add myself as reviewer for PWM rust drivers I would like to help with reviewing the Rust part of the PWM drivers. While I maintain the Rust bindings, adding this separate entry ensures I am automatically CC-ed on the driver implementations (drivers/pwm/*.rs) Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20260119-maintain_rust_drivers-v1-1-88711afc559e@samsung.com Signed-off-by: Uwe Kleine-König commit 70b3c280533167749a8f740acaa8ef720f78f984 Author: Tzung-Bi Shih Date: Tue Jan 20 03:08:56 2026 +0000 gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() On error handling paths, lineinfo_changed_notify() doesn't free the allocated resources which results leaks. Fix it. Cc: stable@vger.kernel.org Fixes: d4cd0902c156 ("gpio: cdev: make sure the cdev fd is still active before emitting events") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260120030857.2144847-1-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit faff6846474e99295a139997f93ef6db222b5cee Author: Tzung-Bi Shih Date: Fri Jan 16 08:10:18 2026 +0000 gpio: cdev: Correct return code on memory allocation failure -ENOMEM is a more appropriate return code for memory allocation failures. Correct it. Cc: stable@vger.kernel.org Fixes: 20bddcb40b2b ("gpiolib: cdev: replace locking wrappers for gpio_device with guards") Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20260116081036.352286-6-tzungbi@kernel.org Signed-off-by: Bartosz Golaszewski commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 Author: Taeyang Lee <0wn@theori.io> Date: Fri Jan 16 16:03:58 2026 +0900 crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than the minimum expected length, crypto_authenc_esn_decrypt() can advance past the end of the destination scatterlist and trigger a NULL pointer dereference in scatterwalk_map_and_copy(), leading to a kernel panic (DoS). Add a minimum AAD length check to fail fast on invalid inputs. Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface") Reported-By: Taeyang Lee <0wn@theori.io> Signed-off-by: Taeyang Lee <0wn@theori.io> Signed-off-by: Herbert Xu commit b994ace83a2bc7699420f6a4c6b860c8da133159 Author: Jens Axboe Date: Mon Jan 19 19:46:26 2026 -0700 io_uring/waitid: fix KCSAN warning on io_waitid->head Storing of the iw->head entry inside the wait_queue callback, or when removing a waitid item, really should use proper load/store acquire/release semantics, and KCSAN correctly warns of that. Ensure that they do so. Reported-by: syzbot+eb441775f4f948a0902f@syzkaller.appspotmail.com Fixes: a48c0cbf28c0 ("io_uring/waitid: have io_waitid_complete() remove wait queue entry") Signed-off-by: Jens Axboe commit 9c7e71c97c8cd086b148d0d3d1cd84a1deab023c Author: Qiang Ma Date: Thu Dec 18 16:16:18 2025 +0800 btrfs: fix Wmaybe-uninitialized warning in replay_one_buffer() Warning was found when compiling using loongarch64-gcc 12.3.1: $ make CFLAGS_tree-log.o=-Wmaybe-uninitialized In file included from fs/btrfs/ctree.h:21, from fs/btrfs/tree-log.c:12: fs/btrfs/accessors.h: In function 'replay_one_buffer': fs/btrfs/accessors.h:66:16: warning: 'inode_item' may be used uninitialized [-Wmaybe-uninitialized] 66 | return btrfs_get_##bits(eb, s, offsetof(type, member)); \ | ^~~~~~~~~~ fs/btrfs/tree-log.c:2803:42: note: 'inode_item' declared here 2803 | struct btrfs_inode_item *inode_item; | ^~~~~~~~~~ Initialize the inode_item to NULL, the compiler does not seem to see the relation between the first 'wc->log_key.type == BTRFS_INODE_ITEM_KEY' check and the other one that also checks the replay phase. Signed-off-by: Qiang Ma Reviewed-by: David Sterba Signed-off-by: David Sterba commit b505f1944535f83d369ae68813e7634d11b990d3 Author: Andrew Cooper Date: Tue Jan 6 18:04:26 2026 +0000 x86/kfence: avoid writing L1TF-vulnerable PTEs For native, the choice of PTE is fine. There's real memory backing the non-present PTE. However, for XenPV, Xen complains: (XEN) d1 L1TF-vulnerable L1e 8010000018200066 - Shadowing To explain, some background on XenPV pagetables: Xen PV guests are control their own pagetables; they choose the new PTE value, and use hypercalls to make changes so Xen can audit for safety. In addition to a regular reference count, Xen also maintains a type reference count. e.g. SegDesc (referenced by vGDT/vLDT), Writable (referenced with _PAGE_RW) or L{1..4} (referenced by vCR3 or a lower pagetable level). This is in order to prevent e.g. a page being inserted into the pagetables for which the guest has a writable mapping. For non-present mappings, all other bits become software accessible, and typically contain metadata rather a real frame address. There is nothing that a reference count could sensibly be tied to. As such, even if Xen could recognise the address as currently safe, nothing would prevent that frame from changing owner to another VM in the future. When Xen detects a PV guest writing a L1TF-PTE, it responds by activating shadow paging. This is normally only used for the live phase of migration, and comes with a reasonable overhead. KFENCE only cares about getting #PF to catch wild accesses; it doesn't care about the value for non-present mappings. Use a fully inverted PTE, to avoid hitting the slow path when running under Xen. While adjusting the logic, take the opportunity to skip all actions if the PTE is already in the right state, half the number PVOps callouts, and skip TLB maintenance on a !P -> P transition which benefits non-Xen cases too. Link: https://lkml.kernel.org/r/20260106180426.710013-1-andrew.cooper3@citrix.com Fixes: 1dc0da6e9ec0 ("x86, kfence: enable KFENCE for x86") Signed-off-by: Andrew Cooper Tested-by: Marco Elver Cc: Alexander Potapenko Cc: Marco Elver Cc: Dmitry Vyukov Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Jann Horn Cc: Signed-off-by: Andrew Morton commit 605f6586ecf78395f0185ab24c368fb46a06e434 Author: Lorenzo Stoakes Date: Mon Jan 12 15:51:43 2026 +0000 mm/vma: do not leak memory when .mmap_prepare swaps the file The current implementation of mmap() is set up such that a struct file object is obtained for the input fd in ksys_mmap_pgoff() via fget(), and its reference count decremented at the end of the function via. fput(). If a merge can be achieved, we are fine to simply decrement the refcount on the file. Otherwise, in __mmap_new_file_vma(), we increment the reference count on the file via get_file() such that the fput() in ksys_mmap_pgoff() does not free the now-referenced file object. The introduction of the f_op->mmap_prepare hook changes things, as it becomes possible for a driver to replace the file object right at the beginning of the mmap operation. The current implementation is buggy if this happens because it unconditionally calls get_file() on the mapping's file whether or not it was replaced (and thus whether or not its reference count will be decremented at the end of ksys_mmap_pgoff()). This results in a memory leak, and was exposed in commit ab04945f91bc ("mm: update mem char driver to use mmap_prepare"). This patch solves the problem by explicitly tracking whether we actually need to call get_file() on the file or not, and only doing so if required. Link: https://lkml.kernel.org/r/20260112155143.661284-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Fixes: ab04945f91bc ("mm: update mem char driver to use mmap_prepare") Reported-by: syzbot+bf5de69ebb4bdf86f59f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6964a92b.050a0220.eaf7.008a.GAE@google.com/ Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Liam Howlett Cc: Pedro Falcato Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit b7880cb166ab62c2409046b2347261abf701530e Author: Matthew Wilcox (Oracle) Date: Fri Jan 9 04:13:42 2026 +0000 migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock. migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() <- Takes folio_lock! -> remove_migration_ptes() -> __rmap_walk_file() -> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)! hugetlbfs_fallocate() -> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)! -> hugetlbfs_zero_partial_page() -> filemap_lock_hugetlb_folio() -> filemap_lock_folio() -> __filemap_get_folio <- Waits for folio_lock! The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too. This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages. Link: https://lkml.kernel.org/r/20260109041345.3863089-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Fixes: 336bf30eb765 ("hugetlbfs: fix anon huge page migration race") Reported-by: syzbot+2d9c96466c978346b55f@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/68e9715a.050a0220.1186a4.000d.GAE@google.com Debugged-by: Lance Yang Acked-by: David Hildenbrand (Red Hat) Acked-by: Zi Yan Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: Jann Horn Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Brost Cc: Rakie Kim Cc: Rik van Riel Cc: Vlastimil Babka Cc: Ying Huang Cc: Signed-off-by: Andrew Morton commit 90f3c123247e9564f2ecf861946ec41ceaf5e198 Author: Gal Pressman Date: Tue Jan 6 18:33:21 2026 +0200 panic: only warn about deprecated panic_print on write access The panic_print_deprecated() warning is being triggered on both read and write operations to the panic_print parameter. This causes spurious warnings when users run 'sysctl -a' to list all sysctl values, since that command reads /proc/sys/kernel/panic_print and triggers the deprecation notice. Modify the handlers to only emit the deprecation warning when the parameter is actually being set: - sysctl_panic_print_handler(): check 'write' flag before warning. - panic_print_get(): remove the deprecation call entirely. This way, users are only warned when they actively try to use the deprecated parameter, not when passively querying system state. Link: https://lkml.kernel.org/r/20260106163321.83586-1-gal@nvidia.com Fixes: ee13240cd78b ("panic: add note that panic_print sysctl interface is deprecated") Fixes: 2683df6539cb ("panic: add note that 'panic_print' parameter is deprecated") Signed-off-by: Gal Pressman Reviewed-by: Mark Bloch Reviewed-by: Nimrod Oren Cc: Feng Tang Cc: Joel Granados Cc: Petr Mladek Cc: Signed-off-by: Andrew Morton commit f9a49aa302a05e91ca01f69031cb79a0ea33031f Author: Joanne Koong Date: Mon Jan 5 13:17:27 2026 -0800 fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes() Above the while() loop in wait_sb_inodes(), we document that we must wait for all pages under writeback for data integrity. Consequently, if a mapping, like fuse, traditionally does not have data integrity semantics, there is no need to wait at all; we can simply skip these inodes. This restores fuse back to prior behavior where syncs are no-ops. This fixes a user regression where if a system is running a faulty fuse server that does not reply to issued write requests, this causes wait_sb_inodes() to wait forever. Link: https://lkml.kernel.org/r/20260105211737.4105620-2-joannelkoong@gmail.com Fixes: 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree") Signed-off-by: Joanne Koong Reported-by: Athul Krishna Reported-by: J. Neuschäfer Reviewed-by: Bernd Schubert Tested-by: J. Neuschäfer Cc: Alexander Viro Cc: Bernd Schubert Cc: Bonaccorso Salvatore Cc: Christian Brauner Cc: David Hildenbrand Cc: Jan Kara Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: "Matthew Wilcox (Oracle)" Cc: Michal Hocko Cc: Mike Rapoport Cc: Miklos Szeredi Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit be31340a4cc259340044b7fc4f7e97f58c74ee8e Author: Mathieu Desnoyers Date: Wed Dec 24 12:33:58 2025 -0500 mm: take into account mm_cid size for mm_struct static definitions Both init_mm and efi_mm static definitions need to make room for the 2 mm_cid cpumasks. This fixes possible out-of-bounds accesses to init_mm and efi_mm. Add a space between # and define for the mm_alloc_cid() definition to make it consistent with the coding style used in the rest of this header file. Link: https://lkml.kernel.org/r/20251224173358.647691-4-mathieu.desnoyers@efficios.com Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Signed-off-by: Mathieu Desnoyers Reviewed-by: Thomas Gleixner Cc: Mark Brown Cc: Aboorva Devarajan Cc: Al Viro Cc: Baolin Wang Cc: Christan König Cc: Christian Brauner Cc: Christoph Lameter Cc: David Hildenbrand Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: "Liam R . Howlett" Cc: Lorenzo Stoakes Cc: Martin Liu Cc: Masami Hiramatsu Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: "Paul E. McKenney" Cc: Roman Gushchin Cc: SeongJae Park Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sweet Tea Dorminy Cc: Tejun Heo Cc: Vlastimil Babka Cc: Wei Yang Cc: Yu Zhao Cc: Peter Zijlstra (Intel) Cc: Signed-off-by: Andrew Morton commit 6ac433f8b2590b09ca00863d218665729ac985f7 Author: Mathieu Desnoyers Date: Wed Dec 24 12:33:57 2025 -0500 mm: rename cpu_bitmap field to flexible_array The cpu_bitmap flexible array now contains more than just the cpu_bitmap. In preparation for changing the static mm_struct definitions to cover for the additional space required, change the cpu_bitmap type from "unsigned long" to "char", require an unsigned long alignment of the flexible array, and rename the field from "cpu_bitmap" to "flexible_array". Introduce the MM_STRUCT_FLEXIBLE_ARRAY_INIT macro to statically initialize the flexible array. This covers the init_mm and efi_mm static definitions. This is a preparation step for fixing the missing mm_cid size for static mm_struct definitions. Link: https://lkml.kernel.org/r/20251224173358.647691-3-mathieu.desnoyers@efficios.com Fixes: af7f588d8f73 ("sched: Introduce per-memory-map concurrency ID") Signed-off-by: Mathieu Desnoyers Reviewed-by: Thomas Gleixner Cc: Mark Brown Cc: Aboorva Devarajan Cc: Al Viro Cc: Baolin Wang Cc: Christan König Cc: Christian Brauner Cc: Christoph Lameter Cc: David Hildenbrand Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: "Liam R . Howlett" Cc: Lorenzo Stoakes Cc: Martin Liu Cc: Masami Hiramatsu Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: "Paul E. McKenney" Cc: Roman Gushchin Cc: SeongJae Park Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sweet Tea Dorminy Cc: Tejun Heo Cc: Vlastimil Babka Cc: Wei Yang Cc: Yu Zhao Cc: Peter Zijlstra (Intel) Cc: Signed-off-by: Andrew Morton commit 12a6ddfc76bb8a6d4508171d806c8632cf50a74a Author: Mathieu Desnoyers Date: Wed Dec 24 12:33:56 2025 -0500 mm: add missing static initializer for init_mm::mm_cid.lock Initialize the mm_cid.lock struct member of init_mm. Link: https://lkml.kernel.org/r/20251224173358.647691-2-mathieu.desnoyers@efficios.com Fixes: 8cea569ca785 ("sched/mmcid: Use proper data structures") Signed-off-by: Mathieu Desnoyers Reviewed-by: Thomas Gleixner Cc: Aboorva Devarajan Cc: Al Viro Cc: Baolin Wang Cc: Christan König Cc: Christian Brauner Cc: Christoph Lameter Cc: David Hildenbrand Cc: David Rientjes Cc: Dennis Zhou Cc: Johannes Weiner Cc: "Liam R . Howlett" Cc: Lorenzo Stoakes Cc: Mark Brown Cc: Martin Liu Cc: Masami Hiramatsu Cc: Mateusz Guzik Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: "Paul E. McKenney" Cc: Roman Gushchin Cc: SeongJae Park Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sweet Tea Dorminy Cc: Tejun Heo Cc: Vlastimil Babka Cc: Wei Yang Cc: Yu Zhao Cc: Peter Zijlstra (Intel) Cc: Signed-off-by: Andrew Morton commit 73c9007d9b94065cbb60f318ff0d3637d1c8283e Merge: 24d479d26b25bc c8c6fb886f57d5 Author: Linus Torvalds Date: Mon Jan 19 12:24:45 2026 -0800 Merge tag 'ata-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - A set of fixes for link power management as the recent changes/fixes introduced regressions with ATAPI devices and with adapters that have DUMMY ports, preventing an adapter to fully reach a low power state and thus preventing the system CPU from reaching low power C-states (from Niklas) * tag 'ata-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata: Print features also for ATAPI devices ata: libata: Add DIPM and HIPM to ata_dev_print_features() early return ata: libata: Add cpr_log to ata_dev_print_features() early return ata: libata-sata: Improve link_power_management_supported sysfs attribute ata: libata: Call ata_dev_config_lpm() for ATAPI devices ata: ahci: Do not read the per port area for unimplemented ports commit 58bae918d73e3b6cd57d1e39fcf7c75c7dd1a8fe Merge: 3ddf44626a1bea 2460f31e6e444a Author: Jakub Kicinski Date: Mon Jan 19 12:06:44 2026 -0800 Merge branch 'net-sched-teql-enforce-hierarchy-placement' Jamal Hadi Salim says: ==================== net/sched: teql: Enforce hierarchy placement GangMin Kim managed to create a UAF on qfq by inserting teql as a child qdisc and exploiting a qlen sync issue. teql is not intended to be used as a child qdisc. Lets enforce that rule in patch #1. Although patch #1 fixes the issue, we prevent another potential qlen exploit in qfq in patch #2 by enforcing the child's active status is not determined by inspecting the qlen. In patch #3 we add a tdc test case. ==================== Link: https://patch.msgid.link/20260114160243.913069-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 2460f31e6e444a52a4e718e4fe64cff29ffaab05 Author: Victor Nogueira Date: Wed Jan 14 11:02:43 2026 -0500 selftests/tc-testing: Try to add teql as a child qdisc Add a selftest that attempts to add a teql qdisc as a qfq child. Since teql _must_ be added as a root qdisc, the kernel should reject this. Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260114160243.913069-4-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit d837fbee92453fbb829f950c8e7cf76207d73f33 Author: Jamal Hadi Salim Date: Wed Jan 14 11:02:42 2026 -0500 net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation. Fixes: 462dbc9101acd ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260114160243.913069-3-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b Author: Jamal Hadi Salim Date: Wed Jan 14 11:02:41 2026 -0500 net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will describe the scenario that unearthed this issue for the curious. GangMin Kim managed to concot a scenario as follows: ROOT qdisc 1:0 (QFQ) ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1, lmax=1514) teql GangMin sends a packet which is enqueued to 1:1 (netem). Any invocation of dequeue by QFQ from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: GangMin Kim Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260114160243.913069-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 3ddf44626a1beab25d249b88c18ca4eb9558bec9 Merge: ab9b218a152113 70458a363d7cf1 Author: Jakub Kicinski Date: Mon Jan 19 10:19:32 2026 -0800 Merge tag 'linux-can-fixes-for-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-01-16 The first patch is by me and sets the missing CAN device default capabilities in the CAN device layer. The next patch is by me, target the gs_usb driver and adds the missing unanchor URB on usb_submit_urb() error. The last 5 patches are also from me and fix the same USB-URB leak (as in the gs_usb driver) in the affected CAN-USB driver: ems_usb, esd_usb, kvaser_usb, mcba_usb and usb_8dev. * tag 'linux-can-fixes-for-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error can: dev: alloc_candev_mqs(): add missing default CAN capabilities ==================== Link: https://patch.msgid.link/20260116200323.366877-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit ab9b218a1521133a4410722907fa7189566be9bc Author: Alok Tiwari Date: Fri Jan 16 08:47:12 2026 -0800 octeontx2: cn10k: fix RX flowid TCAM mask handling The RX flowid programming initializes the TCAM mask to all ones, but then overwrites it when clearing the MAC DA mask bits. This results in losing the intended initialization and may affect other match fields. Update the code to clear the MAC DA bits using an AND operation, making the handling of mask[0] consistent with mask[1], where the field-specific bits are cleared after initializing the mask to ~0ULL. Fixes: 57d00d4364f3 ("octeontx2-pf: mcs: Match macsec ethertype along with DMAC") Signed-off-by: Alok Tiwari Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/20260116164724.2733511-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 2c28769a51deb6022d7fbd499987e237a01dd63a Author: David Howells Date: Wed Jan 14 22:03:23 2026 +0000 rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it. The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns. Fix this by only requeuing the call if it isn't already on the queue - and moving it to the front if it is already queued. If we don't queue it, we have to put the ref we obtained by dequeuing it. Also, MSG_PEEK doesn't dequeue the call so shouldn't call rxrpc_notify_socket() for the call if we didn't use up all the data on the queue, so fix that also. Fixes: 540b1c48c37a ("rxrpc: Fix deadlock between call creation and sendmsg/recvmsg") Reported-by: Faith Reported-by: Pumpkin Chang Signed-off-by: David Howells Acked-by: Marc Dionne cc: Nir Ohfeld cc: Willy Tarreau cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/95163.1768428203@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 07a1bc5c14c9ef6401b21c1873c6c087075ff292 Author: Bart Van Assche Date: Wed Jan 14 11:28:02 2026 -0800 block: Fix an error path in disk_update_zone_resources() Any queue_limits_start_update() call must be followed either by a queue_limits_commit_update() call or by a queue_limits_cancel_update() call. Make sure that the error path near the start of disk_update_zone_resources() follows this requirement. Remove the "goto unfreeze" statement from that error path to make the code easier to verify. This was detected by annotating the queue_limits_*() calls with Clang thread-safety attributes and by building the kernel with thread-safety checking enabled. Without this patch and with thread-safety checking enabled, the following error is reported: block/blk-zoned.c:2020:1: error: mutex 'disk->queue->limits_lock' is not held on every path through here [-Werror,-Wthread-safety-analysis] 2020 | } | ^ block/blk-zoned.c:1959:8: note: mutex acquired here 1959 | lim = queue_limits_start_update(q); | ^ Cc: Damien Le Moal Cc: Christoph Hellwig Fixes: bba4322e3f30 ("block: freeze queue when updating zone resources") Signed-off-by: Bart Van Assche Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20260114192803.4171847-3-bvanassche@acm.org Signed-off-by: Jens Axboe commit 7b8e1a807cb653d745baa4ad29f68a44c7bef00c Merge: 7a29f6bf60f259 8becfe16e4a122 Author: Jakub Kicinski Date: Mon Jan 19 10:03:33 2026 -0800 Merge branch 'ipvlan-addrs_lock-made-per-port' Dmitry Skorodumov says: ==================== ipvlan: addrs_lock made per port First patch fixes a rather minor issues that sometimes ipvlan-addrs are modified without lock (because for IPv6 addr can be sometimes added without RTNL) ==================== Link: https://patch.msgid.link/20260112142417.4039566-1-skorodumov.dmitry@huawei.com Signed-off-by: Jakub Kicinski commit 8becfe16e4a12218c703a98f5bfc15b6f0fbd99c Author: Dmitry Skorodumov Date: Mon Jan 12 17:24:07 2026 +0300 selftests: net: simple selftest for ipvtap This is a simple ipvtap test to test handling IP-address add/remove on ipvlan interface. It creates a veth-interface and then creates several network-namespace with ipvlan0 interface in it linked to veth. Then it starts to add/remove addresses on ipvlan0 interfaces in several threads. At finish, it checks that there is no duplicated addresses. Signed-off-by: Dmitry Skorodumov Link: https://patch.msgid.link/20260112142417.4039566-3-skorodumov.dmitry@huawei.com Signed-off-by: Jakub Kicinski commit d3ba32162488283c0a4c5bedd8817aec91748802 Author: Dmitry Skorodumov Date: Mon Jan 12 17:24:06 2026 +0300 ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So 1) Introduce per-port addrs_lock. 2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close) This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause: 1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock. 2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths. Fixes: 8230819494b3 ("ipvlan: use per device spinlock to protect addrs list updates") Signed-off-by: Dmitry Skorodumov Reviewed-by: Paolo Abeni Link: https://patch.msgid.link/20260112142417.4039566-2-skorodumov.dmitry@huawei.com Signed-off-by: Jakub Kicinski commit 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf Author: Eric Dumazet Date: Thu Jan 15 09:21:39 2026 +0000 l2tp: avoid one data-race in l2tp_tunnel_del_work() We should read sk->sk_socket only when dealing with kernel sockets. syzbot reported the following data-race: BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0: sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1: l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0xffff88811b818000 -> 0x0000000000000000 Fixes: d00fa9adc528 ("l2tp: fix races with tunnel socket close") Reported-by: syzbot+7312e82745f7fa2526db@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6968b029.050a0220.58bed.0016.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: James Chapman Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20260115092139.3066180-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8d50870695aaf5535c9c0a70a3fee71d954f5e9b Merge: 812062e74a3945 9dd1f5f3eb8cb1 Author: Maarten Lankhorst Date: Mon Jan 19 18:44:39 2026 +0100 Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes Upstream is on rc5, we're still on rc1. No luck in hoping for a fast-forward, time to backmerge! Signed-off-by: Maarten Lankhorst commit 63faf32666e03a78cc985bcbae196418cf7d7938 Author: Richard Genoud Date: Tue Jan 13 17:39:07 2026 +0100 pwm: max7360: Populate missing .sizeof_wfhw in max7360_pwm_ops The sizeof_wfhw field wasn't populated in max7360_pwm_ops so it was set to 0 by default. While this is ok for now because: sizeof(struct max7360_pwm_waveform) < PWM_WFHWSIZE in the future, if struct max7360_pwm_waveform grows, it could lead to stack corruption. Fixes: d93a75d94b79 ("pwm: max7360: Add MAX7360 PWM support") Signed-off-by: Richard Genoud Link: https://patch.msgid.link/20260113163907.368919-1-richard.genoud@bootlin.com Signed-off-by: Uwe Kleine-König commit c198b7773ca5bc3bdfb15b85e414fb9a99a5e5ba Author: Uwe Kleine-König Date: Mon Jan 19 16:13:26 2026 +0100 pwm: Ensure ioctl() returns a negative errno on error copy_to_user() returns the number of bytes not copied, thus if there is a problem a positive number. However the ioctl callback is supposed to return a negative error code on error. This error is a unfortunate as strictly speaking it became ABI with the introduction of pwm character devices. However I never saw the issue in real life -- I found this by code inspection -- and it only affects an error case where readonly memory is passed to the ioctls or the address mapping changes while the ioctl is active. Also there are already error cases returning negative values, so the calling code must be prepared to see such values already. Fixes: 9c06f26ba5f5 ("pwm: Add support for pwmchip devices for faster and easier userspace access") Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20260119151325.571857-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit b48fe9af1e60360baf09ca6b7a3cd6541f16e611 Author: Tim Guttzeit Date: Mon Jan 19 16:15:55 2026 +0100 ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU Add a PCI quirk to enable microphone detection on the headphone jack of TongFang X6AR55xU devices. Signed-off-by: Tim Guttzeit Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20260119151626.35481-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit b9639c5e313e14ff1feaf175f2a93b4640732a8e Author: Nauman Sabir Date: Mon Jan 12 17:07:59 2026 +0100 dt-bindings: display: mediatek: Fix typo 'hardwares' to 'hardware' Fix incorrect plural form of the uncountable noun 'hardware' in the MediaTek DP binding description. Signed-off-by: Nauman Sabir Acked-by: Rob Herring (Arm) Link: https://patchwork.kernel.org/project/dri-devel/patch/20260112160759.19027-1-officialnaumansabir@gmail.com/ Signed-off-by: Chun-Kuang Hu commit e3b76494d675e49fa032ec47f58487875a1de70a Author: Felix Gu Date: Sun Jan 18 17:26:23 2026 +0800 regulator: fp9931: Add missing memory allocation check Add a check for devm_kzalloc failure in fp9931_probe to prevent a null pointer dereference. Fixes: 12d821bd13d4 ("regulator: Add FP9931/JD9930 driver") Signed-off-by: Felix Gu Link: https://patch.msgid.link/tencent_5FCF2108621C51007E5526A7C60A5CC1F306@qq.com Signed-off-by: Mark Brown commit 2e48020fd7ced9e9953c55b57a5cb608e64deee0 Author: Shengjiu Wang Date: Thu Jan 15 14:14:18 2026 +0800 ASoC: dt-bindings: fsl,sai: Add support for i.MX952 platform Add a new compatible string 'fsl,imx952-sai' for i.MX952 platform, which is fallback compatible with 'fsl,imx95-sai'. Signed-off-by: Shengjiu Wang Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260115061418.4131432-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 6dd0fdc908c02318c28ec2c0979661846ee0a9f7 Author: Ricardo Rivera-Matos Date: Thu Jan 15 19:25:10 2026 +0000 ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel ASP_TX5 was incorrectly mapped to a channel value of 3 corrects, the channel value of 4. Reviewed-by: Charles Keepax Signed-off-by: Ricardo Rivera-Matos Link: https://patch.msgid.link/20260115192523.1335742-2-rriveram@opensource.cirrus.com Signed-off-by: Mark Brown commit 4b9748055457ac3a0710bf210c229d01ea1b01b9 Author: Jens Axboe Date: Sun Jan 18 19:48:01 2026 -0700 io_uring/rw: free potentially allocated iovec on cache put failure If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not. Reviewed-by: Nitesh Shetty Signed-off-by: Jens Axboe commit 61006c540cbdedea83b05577dc7fb7fa18fe1276 Author: Takashi Iwai Date: Mon Jan 19 14:32:07 2026 +0100 ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices. Reported-by: Salvatore Bonaccorso Tested-by: Karsten Hohmeier Closes: https://bugs.debian.org/1121535 Cc: Link: https://lore.kernel.org/all/aSk8KJI35H7gFru6@eldamar.lan/ Link: https://patch.msgid.link/20260119133212.189129-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 812062e74a3945b575dce89d330b67cb50054a77 Author: Brajesh Gupta Date: Thu Jan 8 04:09:36 2026 +0000 drm/imagination: Wait for FW trace update command completion Possibility of no FW trace available after update in the fw_trace_mask due to asynchronous mode of command consumption in the FW. To ensure FW trace is available after update, wait for FW trace log update command completion from the FW. Fixes: cc1aeedb98ad ("drm/imagination: Implement firmware infrastructure and META FW support") Signed-off-by: Brajesh Gupta Reviewed-by: Matt Coster Link: https://patch.msgid.link/20260108040936.129769-1-brajesh.gupta@imgtec.com Signed-off-by: Matt Coster commit 1deecf7805f16cbcb3541cc57d8478b8b992a2ab Author: LeeYongjun Date: Sun Jan 18 15:55:10 2026 +0900 selftests: ALSA: Remove unused variable in utimer-test The variable 'i' in wrong_timers_test() is declared but never used. This was detected by Cppcheck static analysis. tools/testing/selftests/alsa/utimer-test.c:144:9: style: Unused variable: i [unusedVariable] Remove it to clean up the code and silence the warning. Signed-off-by: LeeYongjun Link: https://patch.msgid.link/20260118065510.29644-1-jun85566@gmail.com Signed-off-by: Takashi Iwai commit 49985bc466b51af88d534485631c8cd8c9c65f43 Author: Lianqin Hu Date: Fri Jan 16 06:33:03 2026 +0000 ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti Audio control requests that sets sampling frequency sometimes fail on this card. Adding delay between control messages eliminates that problem. usb 1-1: New USB device found, idVendor=2fc6, idProduct=f06b usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: MOONDROP Moonriver2 Ti usb 1-1: Manufacturer: MOONDROP usb 1-1: SerialNumber: MOONDROP Moonriver2 Ti Signed-off-by: Lianqin Hu Reviewed-by: Cryolitia PukNgae Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/TYUPR06MB6217911EFC7E9224935FA507D28DA@TYUPR06MB6217.apcprd06.prod.outlook.com commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 Author: Kohei Enju Date: Sat Jan 17 16:00:45 2026 +0000 efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path. Fix it by returning the error from __efivar_entry_get(). Fixes: 2d82e6227ea1 ("efi: vars: Move efivar caching layer into efivarfs") Cc: # v6.1+ Signed-off-by: Kohei Enju Signed-off-by: Ard Biesheuvel commit 1fbe3abb449c5ef2178e1c3e3e8b9a43a7a410ac Author: Krzysztof Kozlowski Date: Thu Jan 8 11:07:22 2026 +0100 pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins Qualcomm SC7280 and SM8350 SoCs have slightly different LPASS audio blocks (v9.4.5 and v9.2), however the LPASS LPI pin controllers are exactly the same. The driver for SM8350 has two issues, which can be fixed by simply moving over to SC7280 driver which has them correct: 1. "i2s2_data_groups" listed twice GPIO12, but should have both GPIO12 and GPIO13, 2. "swr_tx_data_groups" contained GPIO5 for "swr_tx_data2" function, but that function is also available on GPIO14, thus listing it twice is not necessary. OTOH, GPIO5 has also "swr_rx_data1", so selecting swr_rx_data function should not block the TX one. Fixes: be9f6d56381d ("pinctrl: qcom: sm8350-lpass-lpi: add SM8350 LPASS TLMM") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Signed-off-by: Linus Walleij commit 28f24068387169722b508bba6b5257cb68b86e74 Author: Bartosz Golaszewski Date: Mon Jan 5 16:05:08 2026 +0100 pinctrl: meson: mark the GPIO controller as sleeping The GPIO controller is configured as non-sleeping but it uses generic pinctrl helpers which use a mutex for synchronization. This can cause the following lockdep splat with shared GPIOs enabled on boards which have multiple devices using the same GPIO: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name: kworker/u25:3 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 46379 hardirqs last enabled at (46379): [] _raw_spin_unlock_irqrestore+0x74/0x78 hardirqs last disabled at (46378): [] _raw_spin_lock_irqsave+0x84/0x88 softirqs last enabled at (46330): [] handle_softirqs+0x4c4/0x4dc softirqs last disabled at (46295): [] __do_softirq+0x14/0x20 CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C 6.19.0-rc4-next-20260105+ #11963 PREEMPT Tainted: [C]=CRAP Hardware name: Khadas VIM3 (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x24 __might_resched+0x144/0x248 __might_sleep+0x48/0x98 __mutex_lock+0x5c/0x894 mutex_lock_nested+0x24/0x30 pinctrl_get_device_gpio_range+0x44/0x128 pinctrl_gpio_set_config+0x40/0xdc gpiochip_generic_config+0x28/0x3c gpio_do_set_config+0xa8/0x194 gpiod_set_config+0x34/0xfc gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy] gpio_do_set_config+0xa8/0x194 gpiod_set_transitory+0x4c/0xf0 gpiod_configure_flags+0xa4/0x480 gpiod_find_and_request+0x1a0/0x574 gpiod_get_index+0x58/0x84 devm_gpiod_get_index+0x20/0xb4 devm_gpiod_get+0x18/0x24 mmc_pwrseq_emmc_probe+0x40/0xb8 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0xdc/0x164 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x80/0xdc __device_attach+0xa8/0x1b0 Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") Cc: stable@vger.kernel.org Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/ Signed-off-by: Bartosz Golaszewski Reviewed-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Linus Walleij commit 9b54a32c7c6aa4687db4d278c0174d5a318efeaa Author: AngeloGioacchino Del Regno Date: Tue Nov 11 09:51:14 2025 +0100 drm/mediatek: mtk_gem: Partial refactor and use drm_gem_dma_object Partially refactor mtk_gem to stop using (and remove) the unneeded custom mtk_gem_obj structure and migrate drivers to use the API defined drm_gem_dma_object structure instead, and to align all of the functions to be similar to the logic from drm_gem_dma_helper. Unfortunately, for this driver it wasn't possible to directly use the drm_gem_dma_helper callbacks (apart from .print_info), as the DMA mapping here is done on specific dma devices instead of the main DRM device. Also, since the mtk_gem_obj structure is no more, also migrate the mtk_plane.c code to grab the DMA address from a drm_gem_dma_object and replace the inclusion of the custom mtk_gem.h header (as it is now unneeded) with the DRM API provided drm_gem_dma_helper. While at it, also set DRM_GEM_DMA_HELPER as an unconditional dependency (remove the `if DRM_FBDEV_EMULATION` from the select DRM_GEM_DMA_HELPER statement in Kconfig). This resolves an issue pointed by UBSAN, as when using drm_fbdev_dma the drm_gem_object is supposed to be child of a drm_gem_dma_object instead of a custom mtk_gem_obj (or the mtk_gem_obj should have been reordered to have the same fields as drm_gem_dma_object, but that would have been too fragile and generally a bad idea anyway). Fixes: 0992284b4fe4 ("drm/mediatek: Use fbdev-dma") Signed-off-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20251111085114.9752-1-angelogioacchino.delregno@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7 Author: Linus Torvalds Date: Sun Jan 18 15:42:45 2026 -0800 Linux 6.19-rc6 commit 21465e73400dc69a5f732ae7bcc2a58bad673cd1 Author: Chen-Yu Tsai Date: Wed Jan 14 17:22:42 2026 +0800 drm/mediatek: dpi: Find next bridge during probe Trying to find the next bridge and deferring probe in the bridge attach callback is much too late. At this point the driver has already finished probing and is now running the component bind code path. What's even worse is that in the specific case of the DSI host being the last component to be added as part of the dsi_host_attach callback, the code path that this is in: -> devm_drm_of_get_bridge() mtk_dpi_bridge_attach() drm_bridge_attach() mtk_dpi_bind() ... component_add() mtk_dsi_host_attach() anx7625_attach_dsi() anx7625_link_bridge() - done_probing callback for of_dp_aux_populate_bus() of_dp_aux_populate_bus() anx7625_i2c_probe() _cannot_ return probe defer: anx7625 4-0058: [drm:anx7625_bridge_attach] drm attach mediatek-drm mediatek-drm.15.auto: bound 14014000.dsi (ops mtk_dsi_component_ops) mediatek-drm mediatek-drm.15.auto: error -EPROBE_DEFER: failed to attach bridge /soc/dpi@14015000 to encoder TMDS-37 [drm:mtk_dsi_host_attach] *ERROR* failed to add dsi_host component: -517 anx7625 4-0058: [drm:anx7625_link_bridge] *ERROR* fail to attach dsi to host. panel-simple-dp-aux aux-4-0058: DP AUX done_probing() can't defer panel-simple-dp-aux aux-4-0058: probe with driver panel-simple-dp-aux failed with error -22 anx7625 4-0058: [drm:anx7625_i2c_probe] probe done This results in the whole display driver failing to probe. Perhaps this was an attempt to mirror the structure in the DSI driver; but in the DSI driver the next bridge is retrieved in the DSI attach callback, not the bridge attach callback. Move the code finding the next bridge back to the probe function so that deferred probing works correctly. Also rework the fallback to the old OF graph endpoint numbering scheme so that deferred probing logs in both cases. This issue was found on an MT8183 Jacuzzi device with an extra patch enabling the DPI-based external display pipeline. Also tested on an MT8192 Hayato device with both DSI and DPI display pipelines enabled. Fixes: 4c932840db1d ("drm/mediatek: Implement OF graphs support for display paths") Signed-off-by: Chen-Yu Tsai Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20260114092243.3914836-1-wenst@chromium.org/ Signed-off-by: Chun-Kuang Hu commit 90a855e75a99f2932b19f4d04bac1edef158d95e Merge: 6f32aa91612ae7 6abbb8703aeeb6 Author: Linus Torvalds Date: Sun Jan 18 15:15:47 2026 -0800 Merge tag 'landlock-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock fixes from Mickaël Salaün: "This fixes TCP handling, tests, documentation, non-audit elided code, and minor cosmetic changes" * tag 'landlock-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Clarify documentation for the IOCTL access right selftests/landlock: Properly close a file descriptor landlock: Improve the comment for domain_is_scoped selftests/landlock: Use scoped_base_variants.h for ptrace_test selftests/landlock: Fix missing semicolon selftests/landlock: Fix typo in fs_test landlock: Optimize stack usage when !CONFIG_AUDIT landlock: Fix spelling landlock: Clean up hook_ptrace_access_check() landlock: Improve erratum documentation landlock: Remove useless include landlock: Fix wrong type usage selftests/landlock: NULL-terminate unix pathname addresses selftests/landlock: Remove invalid unix socket bind() selftests/landlock: Add missing connect(minimal AF_UNSPEC) test selftests/landlock: Fix TCP bind(AF_UNSPEC) test case landlock: Fix TCP handling of short AF_UNSPEC addresses landlock: Fix formatting commit 6f32aa91612ae7e6a59f7ed228ce6274231a9332 Merge: f8907398a6d941 84697bf5532923 Author: Linus Torvalds Date: Sun Jan 18 14:30:27 2026 -0800 Merge tag 'cgroup-for-6.19-rc5-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Add Chen Ridong as cpuset reviewer - Add SPDX license identifiers to cgroup files that were missing them * tag 'cgroup-for-6.19-rc5-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: kernel: cgroup: Add LGPL-2.1 SPDX license ID to legacy_freezer.c kernel: cgroup: Add SPDX-License-Identifier lines MAINTAINERS: Add Chen Ridong as cpuset reviewer commit f8907398a6d941b204b90b6a40eecfdfd7d00c44 Merge: e90b81e8ff298b d250bdf531d9cd Author: Linus Torvalds Date: Sun Jan 18 14:01:20 2026 -0800 Merge tag 'ext4_for_linus-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: - Fix an inconsistency in structure size on 32-bit platforms caused by padding differences for the new EXT4_IOC_[GS]ET_TUNE_SB_PARAM ioctls - Fix a buffer leak on the error path when dropping the refcount an xattr value stored in an inode - Fix missing locking on the error path for the file defragmentation ioctl leading to a BUG * tag 'ext4_for_linus-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref ext4: add missing down_write_data_sem in mext_move_extent(). ext4: fix ext4_tune_sb_params padding commit e90b81e8ff298b4341d2ee340fe785a6c321bcdd Merge: 3271b25e3d127b 76cba1e60b69c9 Author: Linus Torvalds Date: Sun Jan 18 13:38:31 2026 -0800 Merge tag 'dmaengine-fix-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "A bunch of driver fixes for: - dma mask fix for mmp pdma driver - Xilinx regmap max register, uninitialized addr_width fix - device leak fix for bunch of drivers in the subsystem - stm32 dmamux, TI crossbar driver fixes for device & of node leak and route allocation cleanup - Tegra use afer free fix - Memory leak fix in Qualcomm gpi and omap-dma driver - compatible fix for apple driver" * tag 'dmaengine-fix-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (25 commits) dmaengine: apple-admac: Add "apple,t8103-admac" compatible dmaengine: omap-dma: fix dma_pool resource leak in error paths dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing dmaengine: tegra-adma: Fix use-after-free dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() dmaengine: ti: k3-udma: fix device leak on udma lookup dmaengine: ti: dma-crossbar: clean up dra7x route allocation error paths dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation dmaengine: stm32: dmamux: clean up route allocation error labels dmaengine: stm32: dmamux: fix OF node leak on route allocation failure dmaengine: stm32: dmamux: fix device leak on route allocation dmaengine: sh: rz-dmac: fix device leak on probe failure dmaengine: lpc32xx-dmamux: fix device leak on route allocation dmaengine: lpc18xx-dmamux: fix device leak on route allocation dmaengine: idxd: fix device leaks on compat bind and unbind dmaengine: dw: dmamux: fix OF node leak on route allocation failure ... commit 3271b25e3d127bb9f45bce1e71c0f8987486a070 Merge: 56bc8a18aa94f1 f2ec4723defbc6 Author: Linus Torvalds Date: Sun Jan 18 13:18:40 2026 -0800 Merge tag 'phy-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: "A bunch of driver fixes: - Freescale typec orientation switch fix, clearing register fix, assertion of phy reset during power on - Qualcomm pcs register clear before using - stm one off fix - TI runtimepm error handling, regmap leak fixes - Rockchip gadget mode disconnection and disruption fixes - Tegra register level fix - Broadcom pointer cast warning fix" * tag 'phy-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: freescale: imx8m-pcie: assert phy reset during power on phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 phy: rockchip: inno-usb2: fix communication disruption in gadget mode phy: rockchip: inno-usb2: fix disconnection in gadget mode phy: ti: gmii-sel: fix regmap leak on probe failure phy: sparx5-serdes: make it selectable for ARCH_LAN969X phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors phy: stm32-usphyc: Fix off by one in probe() phy: qcom-qusb2: Fix NULL pointer dereference on early suspend phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings for qcs8300 phy: fsl-imx8mq-usb: fix typec orientation switch when built as module commit 56bc8a18aa94f1ff2cf18e843b1947edb169dda2 Merge: 27983960f0fb73 12d4fd9a657174 Author: Linus Torvalds Date: Sun Jan 18 12:29:12 2026 -0800 Merge tag 'soundwire-6.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire fix from Vinod Koul: - Single off-by-one fix for allocating slave id * tag 'soundwire-6.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: bus: fix off-by-one when allocating slave IDs commit 27983960f0fb7331d3635c1f0270b794cc6b930c Merge: 5d1765a96c6636 dd83dc1249737b Author: Linus Torvalds Date: Sun Jan 18 12:09:13 2026 -0800 Merge tag 'usb-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device ids for 6.19-rc6 Included in here are: - new usb-serial device ids - dwc3-apple driver fixes to get things working properly on that hardware platform - ohci/uhci platfrom driver module soft-deps with ehci to remove a runtime warning that sometimes shows up on some platforms. - quirk for broken devices that can not handle reading the BOS descriptor from them without going crazy. - usb-serial driver fixes - xhci driver fixes - usb gadget driver fixes All of these except for the last xhci fix has been in linux-next for a while. The xhci fix has been reported by others to solve the issue for them, so should be ok" * tag 'usb-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: xhci: sideband: don't dereference freed ring when removing sideband endpoint usb: gadget: uvc: retry vb2_reqbufs() with vb_vmalloc_memops if use_sg fail usb: gadget: uvc: return error from uvcg_queue_init() usb: gadget: uvc: fix interval_duration calculation usb: gadget: uvc: fix req_payload_size calculation usb: dwc3: apple: Ignore USB role switches to the active role usb: host: xhci-tegra: Use platform_get_irq_optional() for wake IRQs USB: OHCI/UHCI: Add soft dependencies on ehci_platform usb: dwc3: apple: Set USB2 PHY mode before dwc3 init USB: serial: f81232: fix incomplete serial port generation USB: serial: ftdi_sio: add support for PICAXE AXE027 cable USB: serial: option: add Telit LE910 MBIM composition usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor dt-bindings: usb: qcom,dwc3: Correct MSM8994 interrupts dt-bindings: usb: qcom,dwc3: Correct IPQ5018 interrupts tcpm: allow looking for role_sw device in the main node usb: dwc3: Check for USB4 IP_NAME commit 5d1765a96c66360bbbec5377ce7344d286715a8a Merge: 93fc4e044a0bd3 f2a3f51365bf67 Author: Linus Torvalds Date: Sun Jan 18 12:00:35 2026 -0800 Merge tag 'i2c-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - riic, imx-lpi2c: suspend/resume fixes - qcom-geni: DMA handling fix - iproc: correct DT binding description * tag 'i2c-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: imx-lpi2c: change to PIO mode in system-wide suspend/resume progress i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA i2c: riic: Move suspend handling to NOIRQ phase dt-bindings: i2c: brcm,iproc-i2c: Allow 2 reg entries for brcm,iproc-nic-i2c commit 2af6ad09fc7dfe9b3610100983cccf16998bf34d Author: Alexandre Courbot Date: Mon Dec 8 11:47:05 2025 +0900 rust: num: bounded: add missing comment for always inlined function This code is always inlined to avoid a build error if the error path of `build_assert` cannot be optimized out. Add a comment justifying the `#[inline(always)]` property to avoid it being taken away by mistake. Reviewed-by: Daniel Almeida Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251208-io-build-assert-v3-7-98aded02c1ea@nvidia.com Signed-off-by: Miguel Ojeda commit d6ff6e870077ae0f01a6f860ca1e4a5a825dc032 Author: Alexandre Courbot Date: Mon Dec 8 11:47:03 2025 +0900 rust: sync: refcount: always inline functions using build_assert with arguments `build_assert` relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of `build_assert` might not be optimized out, triggering a build error. Cc: stable@vger.kernel.org Fixes: bb38f35b35f9 ("rust: implement `kernel::sync::Refcount`") Reviewed-by: Daniel Almeida Signed-off-by: Alexandre Courbot Acked-by: Boqun Feng Link: https://patch.msgid.link/20251208-io-build-assert-v3-5-98aded02c1ea@nvidia.com Signed-off-by: Miguel Ojeda commit 09c3c9112d71c44146419c87c55c710e68335741 Author: Alexandre Courbot Date: Mon Dec 8 11:47:02 2025 +0900 rust: bits: always inline functions using build_assert with arguments `build_assert` relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of `build_assert` might not be optimized out, triggering a build error. Cc: stable@vger.kernel.org Fixes: cc84ef3b88f4 ("rust: bits: add support for bits/genmask macros") Reviewed-by: Daniel Almeida Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251208-io-build-assert-v3-4-98aded02c1ea@nvidia.com Signed-off-by: Miguel Ojeda commit 93fc4e044a0bd3840f781009f9e51b32e8e5faf9 Merge: e503f539dc113c 0ff7c44106b471 Author: Linus Torvalds Date: Sun Jan 18 11:39:56 2026 -0800 Merge tag 'edac_urgent_for_v6.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fixes from Borislav Petkov: "Make sure the memory-mapped memory controller registers BAR gets unmapped when the driver memory allocation fails Fix that in both x38 and i3200 EDAC drivers as former has copied the bug from the latter, it looks like" * tag 'edac_urgent_for_v6.19_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/x38: Fix a resource leak in x38_probe1() EDAC/i3200: Fix a resource leak in i3200_probe1() commit e503f539dc113ce74347d9b1ce1f7b83f68f5fe0 Merge: b671c1dad244a2 d9b40d7262a227 Author: Linus Torvalds Date: Sun Jan 18 11:34:11 2026 -0800 Merge tag 'x86-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 fixes from Ingo Molnar: - Fix resctrl initialization on Hygon CPUs - Fix resctrl memory bandwidth counters on Hygon CPUs - Fix x86 self-tests build bug * tag 'x86-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/x86: Add selftests include path for kselftest.h after centralization x86/resctrl: Fix memory bandwidth counter width for Hygon x86/resctrl: Add missing resctrl initialization for Hygon commit ac3c50b9a24e9ebeb585679078d6c47922034bb6 Author: Tamir Duberstein Date: Fri Jan 16 15:46:04 2026 -0500 scripts: generate_rust_analyzer: compile sysroot with correct edition Use `core_edition` for all sysroot crates rather than just core as all were updated to edition 2024 in Rust 1.87. Fixes: f4daa80d6be7 ("rust: compile libcore with edition 2024 for 1.87+") Signed-off-by: Tamir Duberstein Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-rust-analyzer-sysroot-v2-1-094aedc33208@kernel.org [ Added `>`s to make the quote a single block. - Miguel ] Signed-off-by: Miguel Ojeda commit bc83834c157676e7cca62b876b5e3da1bee06285 Author: Tamir Duberstein Date: Thu Jan 15 11:45:59 2026 -0500 scripts: generate_rust_analyzer: compile quote with correct edition Our copy of the quote crate uses edition 2018, thus generate the correct rust-analyzer configuration for it. Fixes: 88de91cc1ce7 ("rust: quote: enable support in kbuild") Signed-off-by: Tamir Duberstein Reviewed-by: Jesung Yang Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260115-rust-analyzer-quote-edition-v1-1-d492f880dde4@gmail.com Signed-off-by: Miguel Ojeda commit 3a50257e560043bf8968f807af65f32c98d7dbf9 Author: Jesung Yang Date: Tue Nov 25 09:33:00 2025 +0000 scripts: generate_rust_analyzer: quote: treat `core` and `std` as dependencies Fix the `generate_rust_analyzer.py` script to ensure that the `rust-project.json` it produces includes `core` and `std` in the `deps` field for the `quote` crate. `quote` directly references items from both `core` and `std`, so rust-analyzer should treat them as dependencies to provide correct IDE support. For example, the `::quote::ToTokens` trait is implemented for `std::ffi::CString`. With `std` listed in the `deps` field, rust-analyzer can show the expected autocomplete for the `::quote::ToTokens` methods on `std::ffi::CString`. Verified the explicit uses of `core` and `std` using: grep -rnE 'core::|std::' rust/quote/ Fixes: 88de91cc1ce7 ("rust: quote: enable support in kbuild") Signed-off-by: Jesung Yang Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/cef76fc1105481d219953c8552eb5eb07dac707a.1764062688.git.y.j3ms.n@gmail.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 87417cc95b0f1096cc27011ec750d9f988a63e83 Author: Jesung Yang Date: Tue Nov 25 09:32:59 2025 +0000 scripts: generate_rust_analyzer: syn: treat `std` as a dependency Fix the `generate_rust_analyzer.py` script to ensure that the `rust-project.json` it produces includes `std` in the `deps` field for the `syn` crate. `syn` directly references items from `std`, so rust-analyzer should treat it as a dependency to provide correct IDE support. For example, `syn::Punctuated` contains fields of type `Vec<..>` and `Option<..>`, both of which come from the standard library prelude. With `std` listed in the `deps` field, rust-analyzer can infer the types of these fields instead of showing `{unknown}`. Verified the explicit uses of `std` using: grep -rn 'std::' rust/syn/ Fixes: 737401751ace ("rust: syn: enable support in kbuild") Signed-off-by: Jesung Yang Reviewed-by: Tamir Duberstein Tested-by: Tamir Duberstein Link: https://patch.msgid.link/6dbdf6e1c1639ae381ca9ab7041f84728ffa2267.1764062688.git.y.j3ms.n@gmail.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 1b83ef9f7ad4635c913b80ef5e718f95f48e85af Author: Onur Özkan Date: Wed Dec 24 16:53:43 2025 +0300 scripts: generate_rust_analyzer: remove sysroot assertion With nixpkgs's rustc, rust-src component is not bundled with the compiler by default and is instead provided from a separate store path, so this assumption does not hold. The assertion assumes these paths are in the same location which causes `make LLVM=1 rust-analyzer` to fail on NixOS. Link: https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/565284250 Signed-off-by: Onur Özkan Reviewed-by: Gary Guo Fixes: fe992163575b ("rust: Support latest version of `rust-analyzer`") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251224135343.32476-1-work@onurozkan.dev [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit af20ae33e7dd949f2e770198e74ac8f058cb299d Author: Miguel Ojeda Date: Thu Jan 15 19:38:32 2026 +0100 rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target `rustfmt` is configured via the `.rustfmt.toml` file in the source tree, and we apply `rustfmt` to the macro expanded sources generated by the `.rsi` target. However, under an `O=` pointing to an external folder (i.e. not just a subdir), `rustfmt` will not find the file when checking the parent folders. Since the edition is configured in this file, this can lead to errors when it encounters newer syntax, e.g. error: expected one of `!`, `.`, `::`, `;`, `?`, `where`, `{`, or an operator, found `"rust_minimal"` --> samples/rust/rust_minimal.rsi:29:49 | 28 | impl ::kernel::ModuleMetadata for RustMinimal { | - while parsing this item list starting here 29 | const NAME: &'static ::kernel::str::CStr = c"rust_minimal"; | ^^^^^^^^^^^^^^ expected one of 8 possible tokens 30 | } | - the item list ends here | = note: you may be trying to write a c-string literal = note: c-string literals require Rust 2021 or later = help: pass `--edition 2024` to `rustc` = note: for more on editions, read https://doc.rust-lang.org/edition-guide A workaround is to use `RUSTFMT=n`, which is documented in the `Makefile` help for cases where macro expanded source may happen to break `rustfmt` for other reasons, but this is not one of those cases. One solution would be to pass `--edition`, but we want `rustfmt` to use the entire configuration, even if currently we essentially use the default configuration. Thus explicitly give the path to the config file to `rustfmt` instead. Reported-by: Alice Ryhl Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") Cc: stable@vger.kernel.org Reviewed-by: Nathan Chancellor Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260115183832.46595-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit b671c1dad244a21ce71de3f7b1dbca83d25fffd4 Merge: 837c8180e34f30 05dc4a9fc8b36d Author: Linus Torvalds Date: Sun Jan 18 10:56:32 2026 -0800 Merge tag 'timers-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix the update_needs_ipi() check in the hrtimer code that may result in incorrect skipping of hrtimer IPIs" * tag 'timers-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hrtimer: Fix softirq base check in update_needs_ipi() commit 837c8180e34f30ddf99a473efe9105ccb62e66e4 Merge: cee47579650037 627cc25f84466d Author: Linus Torvalds Date: Sun Jan 18 10:17:40 2026 -0800 Merge tag 'sched-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Misc deadline scheduler fixes, mainly for a new category of bugs that were discovered and fixed recently: - Fix a race condition in the DL server - Fix a DL server bug which can result in incorrectly going idle when there's work available - Fix DL server bug which triggers a WARN() due to broken get_prio_dl() logic and subsequent misbehavior - Fix double update_rq_clock() calls - Fix setscheduler() assumption about static priorities - Make sure balancing callbacks are always called - Plus a handful of preparatory commits for the fixes" * tag 'sched-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Use ENQUEUE_MOVE to allow priority change sched: Deadline has dynamic priority sched: Audit MOVE vs balance_callbacks sched: Fold rq-pin swizzle into __balance_callbacks() sched/deadline: Avoid double update_rq_clock() sched/deadline: Ensure get_prio_dl() is up-to-date sched/deadline: Fix server stopping with runnable tasks sched: Provide idle_rq() helper sched/deadline: Fix potential race in dl_add_task_root_domain() sched/deadline: Remove unnecessary comment in dl_add_task_root_domain() commit cee4757965003738533dbd408d61968d374409e2 Merge: 8562711ac09a6c 436326bc525d46 Author: Linus Torvalds Date: Sun Jan 18 09:09:32 2026 -0800 Merge tag 'objtool-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: "Fix two objtool build failures that trigger in uncommon build environments" * tag 'objtool-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: fix build failure due to missing libopcodes check objtool: fix compilation failure with the x32 toolchain commit 8562711ac09a6c0d8dd8868611c46f6145fa4d49 Merge: e84d960149e71e f2edf797dab185 Author: Linus Torvalds Date: Sun Jan 18 09:08:27 2026 -0800 Merge tag 'irq-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix a riscv-imsic irqchip driver regression" * tag 'irq-urgent-2026-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/riscv-imsic: Revert "Remove redundant irq_data lookups" commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 Author: Yang Erkun Date: Sat Dec 13 13:57:06 2025 +0800 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code. Fixes: 57295e835408 ("ext4: guard against EA inode refcount underflow in xattr update") Signed-off-by: Yang Erkun Reviewed-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 0ef7ef422730b8585214a2825735838d664ce1be Author: Julian Sun Date: Mon Dec 8 20:37:13 2025 +0800 ext4: add missing down_write_data_sem in mext_move_extent(). Commit 962e8a01eab9 ("ext4: introduce mext_move_extent()") attempts to call ext4_swap_extents() on the failure path to recover the swapped extents, but fails to acquire locks for the two inode->i_data_sem, triggering the BUG_ON statement in ext4_swap_extents(). This issue can be fixed by calling ext4_double_down_write_data_sem() before ext4_swap_extents(). Signed-off-by: Julian Sun Reported-by: syzbot+4ea6bd8737669b423aae@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69368649.a70a0220.38f243.0093.GAE@google.com/ Fixes: 962e8a01eab9 ("ext4: introduce mext_move_extent()") Reviewed-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Signed-off-by: Theodore Ts'o Link: https://patch.msgid.link/20251208123713.1971068-1-sunjunchao@bytedance.com Signed-off-by: Theodore Ts'o commit cd16edba1c6a24af138e1a5ded2711231fffa99f Author: Arnd Bergmann Date: Thu Dec 4 11:19:10 2025 +0100 ext4: fix ext4_tune_sb_params padding The padding at the end of struct ext4_tune_sb_params is architecture specific and in particular is different between x86-32 and x86-64, since the __u64 member only enforces struct alignment on the latter. This shows up as a new warning when test-building the headers with -Wpadded: include/linux/ext4.h:144:1: error: padding struct size to alignment boundary with 4 bytes [-Werror=padded] All members inside the structure are naturally aligned, so the only difference here is the amount of padding at the end. Make the padding explicit, to have a consistent sizeof(struct ext4_tune_sb_params) of 232 on all architectures and avoid adding compat ioctl handling for EXT4_IOC_GET_TUNE_SB_PARAM/EXT4_IOC_SET_TUNE_SB_PARAM. This is an ABI break on x86-32 but hopefully this can go into 6.18.y early enough as a fixup so no actual users will be affected. Alternatively, the kernel could handle the ioctl commands for both sizes (232 and 228 bytes) on all architectures. Fixes: 04a91570ac67 ("ext4: implemet new ioctls to set and get superblock parameters") Signed-off-by: Arnd Bergmann Reviewed-by: Jan Kara Link: https://patch.msgid.link/20251204101914.1037148-1-arnd@kernel.org Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit b886aa65eafe3098bbd691f0ca4a9abce03f9d03 Author: Matthew Brost Date: Fri Jan 9 17:27:38 2026 -0800 drm/xe: Disable timestamp WA on VFs The timestamp WA does not work on a VF because it requires reading MMIO registers, which are inaccessible on a VF. This timestamp WA confuses LRC sampling on a VF during TDR, as the LRC timestamp would always read as 1 for any active context. Disable the timestamp WA on VFs to avoid this confusion. Signed-off-by: Matthew Brost Reviewed-by: Umesh Nerlige Ramappa Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization") Link: https://patch.msgid.link/20260110012739.2888434-7-matthew.brost@intel.com (cherry picked from commit efffd56e4bd894e0935eea00e437f233b6cebc0d) Signed-off-by: Thomas Hellström commit 47bf28e22a121b807a9a9680c4209846a78a98a6 Author: Jani Nikula Date: Wed Jan 7 17:54:00 2026 +0200 drm/xe/vm: fix xe_vm_validation_exec() kernel-doc Fix kernel-doc warnings on xe_vm_validation_exec(): Warning: ../drivers/gpu/drm/xe/xe_vm.h:392 expecting prototype for xe_vm_set_validation_exec(). Prototype was for xe_vm_validation_exec() instead Fixes: 0131514f9789 ("drm/xe: Pass down drm_exec context to validation") Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260107155401.2379127-4-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit b3a7767989e6519127ac5e0cde682c50ad587f3b) Signed-off-by: Thomas Hellström commit dc1d0ffee09740088eb190af84a2c470d279bad9 Author: Jani Nikula Date: Wed Jan 7 17:53:59 2026 +0200 drm/xe/xe_late_bind_fw: fix enum xe_late_bind_fw_id kernel-doc Fix kernel-doc warnings on enum xe_late_bind_fw_id: Warning: ../drivers/gpu/drm/xe/xe_late_bind_fw_types.h:19 cannot understand function prototype: 'enum xe_late_bind_fw_id' Fixes: 45832bf9c10f ("drm/xe/xe_late_bind_fw: Initialize late binding firmware") Cc: Badal Nilawar Cc: Daniele Ceraolo Spurio Cc: Rodrigo Vivi Reviewed-by: Badal Nilawar Link: https://patch.msgid.link/20260107155401.2379127-3-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit a857e6102970c7bd8f2db967fe02d76741179d14) Signed-off-by: Thomas Hellström commit a009bbb9586119047a071971a48b093fcc65f33d Author: Jani Nikula Date: Wed Jan 7 17:53:58 2026 +0200 drm/xe/vf: fix struct xe_gt_sriov_vf_migration kernel-doc Fix kernel-doc warnings on struct xe_gt_sriov_vf_migration: Warning: ../drivers/gpu/drm/xe/xe_gt_sriov_vf_types.h:47 cannot understand function prototype: 'struct xe_gt_sriov_vf_migration' Fixes: e1d2e2d878bf ("drm/xe/vf: Add xe_gt_recovery_pending helper") Cc: Matthew Brost Cc: Michal Wajdeczko Cc: Tomasz Lis Reviewed-by: Matt Roper Link: https://patch.msgid.link/20260107155401.2379127-2-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 44393331c79f5df14c1ff25f4a355f439a2dc8a2) Signed-off-by: Thomas Hellström commit 6f287b1c8d0e255e94e54116ebbe126515f5c911 Author: Marco Crivellari Date: Thu Jan 8 19:01:48 2026 +0100 drm/xe: fix WQ_MEM_RECLAIM passed as max_active to alloc_workqueue() Workqueue xe-ggtt-wq has been allocated using WQ_MEM_RECLAIM, but the flag has been passed as 3rd parameter (max_active) instead of 2nd (flags) creating the workqueue as per-cpu with max_active = 8 (the WQ_MEM_RECLAIM value). So change this by set WQ_MEM_RECLAIM as the 2nd parameter with a default max_active. Fixes: 60df57e496e4 ("drm/xe: Mark GGTT work queue with WQ_MEM_RECLAIM") Cc: stable@vger.kernel.org Signed-off-by: Marco Crivellari Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260108180148.423062-1-marco.crivellari@suse.com (cherry picked from commit aa39abc08e77d66ebb0c8c9ec4cc8d38ded34dc9) Signed-off-by: Thomas Hellström commit ca9e5115e870b9a531deb02752055a8a587904e3 Author: Matthew Brost Date: Wed Jan 7 12:57:32 2026 -0800 drm/xe: Adjust page count tracepoints in shrinker Page accounting can change via the shrinker without calling xe_ttm_tt_unpopulate(), which normally updates page count tracepoints through update_global_total_pages. Add a call to update_global_total_pages when the shrinker successfully shrinks a BO. v2: - Don't adjust global accounting when pinning (Stuart) Cc: stable@vger.kernel.org Fixes: ce3d39fae3d3 ("drm/xe/bo: add GPU memory trace points") Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20260107205732.2267541-1-matthew.brost@intel.com (cherry picked from commit cc54eabdfbf0c5b6638edc50002cfafac1f1e18b) Signed-off-by: Thomas Hellström commit 3222b6de5145272c43a90cb8667377d676635ea0 Author: Vasant Hegde Date: Fri Jan 16 05:53:32 2026 +0000 iommu/amd: Fix error path in amd_iommu_probe_device() Currently, the error path of amd_iommu_probe_device() unconditionally references dev_data, which may not be initialized if an early failure occurs (like iommu_init_device() fails). Move the out_err label to ensure the function exits immediately on failure without accessing potentially uninitialized dev_data. Fixes: 19e5cc156cb ("iommu/amd: Enable support for up to 2K interrupts per function") Cc: Rakuram Eswaran Cc: Jörg Rödel Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512191724.meqJENXe-lkp@intel.com/ Signed-off-by: Vasant Hegde Signed-off-by: Joerg Roedel commit cd4a3ced4d1cdb14ffe905657b98a91e9d239dfb Author: Biju Das Date: Tue Jan 13 12:53:11 2026 +0000 irqchip/renesas-rzv2h: Prevent TINT spurious interrupt during resume A glitch in the edge detection circuit can cause a spurious interrupt. The hardware manual recommends clearing the status flag after setting the ICU_TSSRk register as a countermeasure. Currently, a spurious interrupt is generated on the resume path of s2idle for the PMIC RTC TINT interrupt due to a glitch related to unnecessary enabling/disabling of the TINT enable bit. Fix this issue by not setting TSSR(TINT Source) and TITSR(TINT Detection Method Selection) registers if the values are the same as those set in these registers. Fixes: 0d7605e75ac2 ("irqchip: Add RZ/V2H(P) Interrupt Control Unit (ICU) driver") Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260113125315.359967-2-biju.das.jz@bp.renesas.com commit e84d960149e71e8d5e4db69775ce31305898ed0c Merge: 47622aa8b66c8f 437cc6057e01d9 Author: Linus Torvalds Date: Sat Jan 17 19:29:32 2026 -0800 Merge tag 'for-6.19-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - with large folios in use, fix partial incorrect update of a reflinked range - fix potential deadlock in iget when lookup fails and eviction is needed - in send, validate inline extent type while detecting file holes - fix memory leak after an error when creating a space info - remove zone statistics from sysfs again, the output size limitations make it unusable, we'll do it in another way in another release - test fixes: - return proper error codes from block remapping tests - fix tree root leaks in qgroup tests after errors * tag 'for-6.19-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: remove zoned statistics from sysfs btrfs: fix memory leaks in create_space_info() error paths btrfs: invalidate pages instead of truncate after reflinking btrfs: update the Kconfig string for CONFIG_BTRFS_EXPERIMENTAL btrfs: send: check for inline extents in range_is_hole_in_parent() btrfs: tests: fix return 0 on rmap test failure btrfs: tests: fix root tree leak in btrfs_test_qgroups() btrfs: release path before iget_failed() in btrfs_read_locked_inode() commit 47622aa8b66c8fb2af4aff584c3c7c17ca0686ea Merge: d12453c7e281d2 1cf342a7c3adc5 Author: Linus Torvalds Date: Sat Jan 17 19:24:48 2026 -0800 Merge tag 'loongarch-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Remove redundant code in head.S, fix PMU counter allocation for mixed- type event groups, fix a lot of dts build warnings, and fix kvm_device memory leaks" * tag 'loongarch-fixes-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells LoongArch: dts: Describe PCI sideband IRQ through interrupt-extended LoongArch: Fix PMU counter allocation for mixed-type event groups LoongArch: Remove redundant code in head.S commit f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf Author: Thadeu Lima de Souza Cascardo Date: Tue Jan 13 17:24:58 2026 -0300 Revert "nfc/nci: Add the inconsistency check between the input data length and count" This reverts commit 068648aab72c9ba7b0597354ef4d81ffaac7b979. NFC packets may have NUL-bytes. Checking for string length is not a correct assumption here. As long as there is a check for the length copied from copy_from_user, all should be fine. The fix only prevented the syzbot reproducer from triggering the bug because the packet is not enqueued anymore and the code that triggers the bug is not exercised. The fix even broke testing/selftests/nci/nci_dev, making all tests there fail. After the revert, 6 out of 8 tests pass. Fixes: 068648aab72c ("nfc/nci: Add the inconsistency check between the input data length and count") Cc: stable@vger.kernel.org Signed-off-by: Thadeu Lima de Souza Cascardo Link: https://patch.msgid.link/20260113202458.449455-1-cascardo@igalia.com Signed-off-by: Jakub Kicinski commit a92a6c50e35b75a8021265507f3c2a9084df0b94 Author: Hamza Mahfooz Date: Tue Jan 13 18:29:57 2026 -0500 net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick This is another one of those XGSPON ONU sticks that's using the X-ONU-SFPP internally, thus it also requires the potron quirk to avoid tx faults. So, add an entry for it in sfp_quirks[]. Cc: stable@vger.kernel.org Signed-off-by: Hamza Mahfooz Link: https://patch.msgid.link/20260113232957.609642-1-someguy@effective-light.com Signed-off-by: Jakub Kicinski commit b47adaab8b3d443868096bac08fdbb3d403194ba Author: David Yang Date: Wed Jan 14 20:24:45 2026 +0800 veth: fix data race in veth_get_ethtool_stats In veth_get_ethtool_stats(), some statistics protected by u64_stats_sync, are read and accumulated in ignorance of possible u64_stats_fetch_retry() events. These statistics, peer_tq_xdp_xmit and peer_tq_xdp_xmit_err, are already accumulated by veth_xdp_xmit(). Fix this by reading them into a temporary buffer first. Fixes: 5fe6e56776ba ("veth: rely on peer veth_rq for ndo_xdp_xmit accounting") Signed-off-by: David Yang Link: https://patch.msgid.link/20260114122450.227982-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 6a5e5a3da3557ab1ccc3716b2cdb67aab658dc45 Merge: ff7737946812eb 7a9bc9e3f42391 Author: Jakub Kicinski Date: Sat Jan 17 16:00:27 2026 -0800 Merge branch 'fou-gue-fix-skb-memleak-with-inner-protocol-0' Kuniyuki Iwashima says: ==================== fou/gue: Fix skb memleak with inner protocol 0. syzbot reported memleak for a GUE packet with its inner protocol number 0. Patch 1 fixes the issue, and patch 3 fixes the same issue in FOU. ==================== Link: https://patch.msgid.link/20260115172533.693652-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5 Author: Kuniyuki Iwashima Date: Thu Jan 15 17:24:48 2026 +0000 fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu(). Let's forbid 0 for FOU_ATTR_IPPROTO. Fixes: 23461551c0062 ("fou: Support for foo-over-udp RX path") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260115172533.693652-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 68578370f9b3a2aba5964b273312d51c581b6aad Author: Kuniyuki Iwashima Date: Thu Jan 15 17:24:47 2026 +0000 tools: ynl: Specify --no-line-number in ynl-regen.sh. If grep.lineNumber is enabled in .gitconfig, [grep] lineNumber = true ynl-regen.sh fails with the following error: $ ./tools/net/ynl/ynl-regen.sh -f ... ynl_gen_c.py: error: argument --mode: invalid choice: '4:' (choose from user, kernel, uapi) GEN 4: net/ipv4/fou_nl.c Let's specify --no-line-number explicitly. Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") Suggested-by: Jakub Kicinski Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260115172533.693652-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9a56796ad258786d3624eef5aefba394fc9bdded Author: Kuniyuki Iwashima Date: Thu Jan 15 17:24:46 2026 +0000 gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. [0] The repro generated a GUE packet with its inner protocol 0. gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in ip_protocol_deliver_rcu(), but this only works with non-zero protocol number. Let's drop such packets. Note that 0 is a valid number (IPv6 Hop-by-Hop Option). I think it is not practical to encap HOPOPT in GUE, so once someone starts to complain, we could pass down a resubmit flag pointer to distinguish two zeros from the upper layer: * no error * resubmit HOPOPT [0] BUG: memory leak unreferenced object 0xffff888109695a00 (size 240): comm "syz.0.17", pid 6088, jiffies 4294943096 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace (crc a84b336f): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270 __build_skb+0x23/0x60 net/core/skbuff.c:474 build_skb+0x20/0x190 net/core/skbuff.c:490 __tun_build_skb drivers/net/tun.c:1541 [inline] tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636 tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770 tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x45d/0x710 fs/read_write.c:686 ksys_write+0xa7/0x170 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 37dd0247797b1 ("gue: Receive side for Generic UDP Encapsulation") Reported-by: syzbot+4d8c7d16b0e95c0d0f0d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965534b.050a0220.38aacd.0001.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260115172533.693652-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ff7737946812eb59faad70d497b803c4f59200b9 Author: Simon Horman Date: Thu Jan 15 13:54:00 2026 +0000 docs: netdev: refine 15-patch limit The 15 patch limit is intended by the maintainers to cover all outstanding patches on the mailing list on a per-tree basis. Not just those in a single patchset. Document this practice accordingly. Signed-off-by: Simon Horman Link: https://patch.msgid.link/20260115-15-minutes-of-fame-v2-1-70cbf0883aff@kernel.org Signed-off-by: Jakub Kicinski commit c158f985cf6c2c36c99c4f67af2ff3f5ebe09f8f Author: Raju Rangoju Date: Wed Jan 14 22:00:37 2026 +0530 amd-xgbe: avoid misleading per-packet error log On the receive path, packet can be damaged because of buffer overflow in Rx FIFO. Avoid misleading per-packet error log when packet->errors is set, this can flood the log. Instead, rely on the standard rtnl_link_stats64 stats. Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20260114163037.2062606-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit d998b0e5afffa90d0f03770bad31083767079858 Author: Thomas Fourier Date: Wed Jan 14 13:31:06 2026 +0100 octeontx2: Fix otx2_dma_map_page() error return code 0 is a valid DMA address [1] so using it as the error value can lead to errors. The error value of dma_map_XXX() functions is DMA_MAPPING_ERROR which is ~0. The callers of otx2_dma_map_page() use dma_mapping_error() to test the return value of otx2_dma_map_page(). This means that they would not detect an error in otx2_dma_map_page(). Make otx2_dma_map_page() return the raw value of dma_map_page_attrs(). [1] https://lore.kernel.org/all/f977f68b-cec5-4ab7-b4bd-2cf6aca46267@intel.com Fixes: caa2da34fd25 ("octeontx2-pf: Initialize and config queues") Cc: Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260114123107.42387-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit a80c9d945aef55b23b54838334345f20251dad83 Author: Xin Long Date: Tue Jan 13 12:10:26 2026 -0500 sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2 RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline] RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401 Call Trace: sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189 sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111 sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217 sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787 sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline] sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169 sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052 sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88 sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243 sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127 The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently: - SCTP_CMD_PEER_INIT - SCTP_CMD_TIMER_STOP (T1_INIT) - SCTP_CMD_TIMER_START (T1_COOKIE) - SCTP_CMD_NEW_STATE (COOKIE_ECHOED) - SCTP_CMD_ASSOC_SHKEY - SCTP_CMD_GEN_COOKIE_ECHO If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user(). Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue. Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup. Fixes: 730fc3d05cd4 ("[SCTP]: Implete SCTP-AUTH parameter processing") Reported-by: Zhen Chen Tested-by: Zhen Chen Signed-off-by: Xin Long Link: https://patch.msgid.link/44881224b375aa8853f5e19b4055a1a56d895813.1768324226.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 830e0bef79aaaea8b1ef426b8032e70c63a58653 Author: leobannocloutier@gmail.com Date: Fri Jan 16 20:53:15 2026 -0500 hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelist On the Dell G15 5510, fans spin at maximum speed when AC power is connected. This behavior has been observed as a regression in recent kernels (v6.18+). Add the Dell G15 5510 to the fan control whitelist to enable manual fan control and resolve the issue. This model requires the same fan control configuration as the Dell G15 5511. Fixes: 1c1658058c99 ("hwmon: (dell-smm) Add support for automatic fan mode") Signed-off-by: Leo Banno-Cloutier Link: https://lore.kernel.org/r/20260117015315.214569-2-leobannocloutier@gmail.com [groeck: Updated patch description to follow guidance] Signed-off-by: Guenter Roeck commit 2ccb5e8dbcd2dedf13e0270165ac48bd79b7f673 Author: Dave Jiang Date: Thu Jan 8 14:09:33 2026 -0700 ntb: transport: Fix uninitialized mutex When the mutex 'link_event_lock' was introduced, it was never initialized and it triggers kernel warnings when used with locking debug turned on. Add initialization for the mutex. Fixes: 3db835dd8f9a ("ntb: Add mutex to make link_event_callback executed linearly.") Cc: fuyuanli Signed-off-by: Dave Jiang Signed-off-by: Jon Mason commit d12453c7e281d236f77b5c7d7cccbf9e5dfadfe5 Merge: d3eeb99bbc99cc b9f5c38e4af1a0 Author: Linus Torvalds Date: Sat Jan 17 08:52:45 2026 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "An arm64/mpam fix to use non-atomic bitops on struct mmap_props member (atomicity not required). For kunit testing, the structure is packed to avoid memcmp() errors but this affects atomic bitops as they have strict alignment requirements. Also remove a duplicate include in the mpam driver" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm_mpam: Use non-atomic bitops when modifying feature bitmap arm_mpam: Remove duplicate linux/srcu.h header commit 81122fba08fa3ccafab6ed272a5c6f2203923a7e Author: Weigang He Date: Sat Jan 17 09:12:38 2026 +0000 of: fix reference count leak in of_alias_scan() of_find_node_by_path() returns a device_node with its refcount incremented. When kstrtoint() fails or dt_alloc() fails, the function continues to the next iteration without calling of_node_put(), causing a reference count leak. Add of_node_put(np) before continue on both error paths to properly release the device_node reference. Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id") Cc: stable@vger.kernel.org Signed-off-by: Weigang He Link: https://patch.msgid.link/20260117091238.481243-1-geoffreyhe2@gmail.com Signed-off-by: Rob Herring (Arm) commit d045e166d3c51b7aec069669bb243e057d80d04f Author: Thomas Weißschuh Date: Thu Jan 15 14:56:52 2026 +0100 selftests: vDSO: getrandom: Fix path to s390 chacha implementation The s390 vDSO source directory was recently moved, but this reference was not updated. Fixes: c0087d807ae8 ("s390/vdso: Rename vdso64 to vdso") Signed-off-by: Thomas Weißschuh Acked-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 576b1b7b1148517364303f0a52d27034b01796be Author: Heiko Carstens Date: Fri Jan 9 10:33:14 2026 +0100 s390/vdso: Disable kstack erase For some reason gcc 8, 9, 10, and 11 generate a dynamic relocation in vdso.so.dbg if CONFIG_KSTACK_ERASE is enabled: >> arch/s390/kernel/vdso/vdso.so.dbg: dynamic relocations are not supported make[3]: *** [arch/s390/kernel/vdso/Makefile:54: arch/s390/kernel/vdso/vdso.so.dbg] Error 1 $ readelf -rW arch/s390/kernel/vdso/vdso.so.dbg Relocation section '.rela.dyn' at offset 0x15c0 contains 1 entry: Offset Info Type Symbol's Value Symbol's Name + Addend 00000000000015f0 000000010000000b R_390_JMP_SLOT 0000000000000000 __sanitizer_cov_stack_depth + 0 Add $(DISABLE_KSTACK_ERASE) to vdso compile flags to fix this. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202601070505.xQcLr5KV-lkp@intel.com/ Signed-off-by: Heiko Carstens commit d9b40d7262a227442bf402ea0708dc94f438bb52 Author: Bala-Vignesh-Reddy Date: Wed Oct 22 11:59:48 2025 +0530 selftests/x86: Add selftests include path for kselftest.h after centralization The previous change centralizing kselftest.h include path in lib.mk caused x86 selftests to fail, as x86 Makefile overwrites CFLAGS using ":=", dropping the include path added in lib.mk. Therefore, helpers.h could not find kselftest.h during compilation. Fix this by adding the tools/testing/sefltest to CFLAGS in x86 Makefile. [ bp: Correct commit ID in Fixes: ] Fixes: e6fbd1759c9e ("selftests: complete kselftest include centralization") Closes: https://lore.kernel.org/lkml/CA+G9fYvKjQcCBMfXA-z2YuL2L+3Qd-pJjEUDX8PDdz2-EEQd=Q@mail.gmail.com/T/#m83fd330231287fc9d6c921155bee16c591db7360 Reported-by: Linux Kernel Functional Testing Signed-off-by: Bala-Vignesh-Reddy Signed-off-by: Borislav Petkov (AMD) Tested-by: Anders Roxell Tested-by: Brendan Jackman Link: https://patch.msgid.link/20251022062948.162852-1-reddybalavignesh9979@gmail.com commit 6f5c69f72e50d51be3a8c028ae7eda42c82902cb Author: Samasth Norway Ananda Date: Fri Jan 16 17:27:06 2026 -0800 ALSA: scarlett2: Fix buffer overflow in config retrieval The scarlett2_usb_get_config() function has a logic error in the endianness conversion code that can cause buffer overflows when count > 1. The code checks `if (size == 2)` where `size` is the total buffer size in bytes, then loops `count` times treating each element as u16 (2 bytes). This causes the loop to access `count * 2` bytes when the buffer only has `size` bytes allocated. Fix by checking the element size (config_item->size) instead of the total buffer size. This ensures the endianness conversion matches the actual element type. Fixes: ac34df733d2d ("ALSA: usb-audio: scarlett2: Update get_config to do endian conversion") Cc: stable@vger.kernel.org Signed-off-by: Samasth Norway Ananda Link: https://patch.msgid.link/20260117012706.1715574-1-samasth.norway.ananda@oracle.com Signed-off-by: Takashi Iwai commit 6b971191fcfc9e3c2c0143eea22534f1f48dbb62 Author: Arun Raghavan Date: Fri Jan 16 14:58:04 2026 -0800 ALSA: usb: Increase volume range that triggers a warning On at least the HyperX Cloud III, the range is 18944 (-18944 -> 0 in steps of 1), so the original check for 255 steps is definitely obsolete. Let's give ourselves a little more headroom before we emit a warning. Fixes: 80acefff3bc7 ("ALSA: usb-audio - Add volume range check and warn if it too big") Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: linux-sound@vger.kernel.org Signed-off-by: Arun Raghavan Link: https://patch.msgid.link/20260116225804.3845935-1-arunr@valvesoftware.com Signed-off-by: Takashi Iwai commit d3eeb99bbc99cc5eb94a4a75ed4415a0272254ef Merge: 216c7a0326c6c5 ec19ed2b3e2af8 Author: Linus Torvalds Date: Fri Jan 16 20:59:46 2026 -0800 Merge tag 'block-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Device quirk to disable faulty temperature (Ilikara) - TCP target null pointer fix from bad host protocol usage (Shivam) - Add apple,t8103-nvme-ans2 as a compatible apple controller (Janne) - FC tagset leak fix (Chaitanya) - TCP socket deadlock fix (Hannes) - Target name buffer overrun fix (Shin'ichiro) - Fix for an underflow for rnbd during device unmap - Zero the non-PI part of the auto integrity buffer - Fix for a configfs memory leak in the null block driver * tag 'block-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: rnbd-clt: fix refcount underflow in device unmap path nvme: fix PCIe subsystem reset controller state transition nvmet: do not copy beyond sybsysnqn string length nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() null_blk: fix kmemleak by releasing references to fault configfs items block: zero non-PI portion of auto integrity buffer nvme-fc: release admin tagset if init fails nvme-apple: add "apple,t8103-nvme-ans2" as compatible nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec nvme-pci: disable secondary temp for Wodposit WPBSNM8 commit 216c7a0326c6c598c7c3d4450200af33982e35e2 Merge: 39d3389331abd7 da579f05ef0faa Author: Linus Torvalds Date: Fri Jan 16 20:56:56 2026 -0800 Merge tag 'io_uring-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix moving local task_work inside the cancelation loop, rather than only before cancelations. If any cancelations generate task_work, we do need to re-run it" * tag 'io_uring-6.19-20260116' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: move local task_work in exit cancel loop commit 19bc5f2a6962dfaa0e32d0e0bc2271993d85d414 Author: Jiasheng Jiang Date: Tue Jan 6 20:53:44 2026 +0000 scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purex_item. If the reported frame_size exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIG_FORTIFY_SOURCE. Fix this by capping total_bytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Signed-off-by: Jiasheng Jiang Reviewed-by: Himanshu Madhani Link: https://patch.msgid.link/20260106205344.18031-1-jiashengjiangcool@gmail.com Signed-off-by: Martin K. Petersen commit 84dc6037390b8607c5551047d3970336cb51ba9a Author: Maurizio Lombardi Date: Mon Jan 12 17:53:52 2026 +0100 scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the session release path) may wake up and free the iscsit_session structure immediately. This creates a race condition where the current thread may attempt to execute spin_unlock_bh() on a session structure that has already been deallocated, resulting in a KASAN slab-use-after-free. To resolve this, release the session_usage_lock before calling complete() to ensure all dereferences of the sess pointer are finished before the waiter is allowed to proceed with deallocation. Signed-off-by: Maurizio Lombardi Reported-by: Zhaojuan Guo Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260112165352.138606-3-mlombard@redhat.com Signed-off-by: Martin K. Petersen commit 9411a89e9e7135cc459178fa77a3f1d6191ae903 Author: Maurizio Lombardi Date: Mon Jan 12 17:53:51 2026 +0100 scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete(). Signed-off-by: Maurizio Lombardi Reported-by: Zhaojuan Guo Reviewed-by: Mike Christie Link: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com Signed-off-by: Martin K. Petersen commit fe2f8ad6f0999db3b318359a01ee0108c703a8c3 Author: David Jeffery Date: Tue Jan 13 11:08:13 2026 -0500 scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes or times out has race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance. First, there is an memory ordering issue within scsi_dec_host_busy(). The write which clears SCMD_STATE_INFLIGHT may be reordered with reads counting in scsi_host_busy(). While the local CPU will see its own write, reordering can allow other CPUs in scsi_dec_host_busy() or scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to see a host busy equal to the host_failed count. This race condition can be prevented with a memory barrier on the error path to force the write to be visible before counting host busy commands. Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By counting busy commands before incrementing host_failed, it can race with a final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does not see host_failed incremented but scsi_eh_inc_host_failed() counts busy commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(), resulting in neither waking the error handler task. This needs the call to scsi_host_busy() to be moved after host_failed is incremented to close the race condition. Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq") Signed-off-by: David Jeffery Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260113161036.6730-1-djeffery@redhat.com Signed-off-by: Martin K. Petersen commit 9eacec5d18f98f89be520eeeef4b377acee3e4b8 Author: Long Li Date: Fri Jan 16 17:03:02 2026 -0800 scsi: storvsc: Process unsupported MODE_SENSE_10 The Hyper-V host does not support MODE_SENSE_10 and MODE_SENSE. The driver handles MODE_SENSE as unsupported command, but not for MODE_SENSE_10. Add MODE_SENSE_10 to the same handling logic and return correct code to SCSI layer. Fixes: 89ae7d709357 ("Staging: hv: storvsc: Move the storage driver out of the staging area") Cc: stable@kernel.org Signed-off-by: Long Li Reviewed-by: Michael Kelley Link: https://patch.msgid.link/20260117010302.294068-1-longli@linux.microsoft.com Signed-off-by: Martin K. Petersen commit 1cf342a7c3adc5877837b53bbceb5cc9eff60bbf Author: Qiang Ma Date: Sat Jan 17 10:57:03 2026 +0800 LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_pch_pic_destroy() is not currently doing this, that would lead to a memory leak. So, fix it. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit 7d8553fc75aefa7ec936af0cf8443ff90b51732e Author: Qiang Ma Date: Sat Jan 17 10:57:02 2026 +0800 LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_eiointc_destroy() is not currently doing this, that would lead to a memory leak. So, fix it. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit 0bf58cb7288a4d3de6d8ecbb3a65928a9362bf21 Author: Qiang Ma Date: Sat Jan 17 10:57:02 2026 +0800 LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() In kvm_ioctl_create_device(), kvm_device has allocated memory, kvm_device->destroy() seems to be supposed to free its kvm_device struct, but kvm_ipi_destroy() is not currently doing this, that would lead to a memory leak. So, fix it. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit 14ea5a3625881d79f75418c66e3a7d98db8518e1 Author: Binbin Zhou Date: Sat Jan 17 10:56:53 2026 +0800 LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names The binding wants the node to be named "i2c-number", but those are named "i2c-gpio-number" instead. Thus rename those to i2c-0, i2c-1 to adhere to the binding and suppress dtbs_check warnings. Cc: stable@vger.kernel.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit e65df3f77ecd59d3a8647d19df82b22a6ce210a9 Author: Binbin Zhou Date: Sat Jan 17 10:56:53 2026 +0800 LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells Add missing address-cells 0 to the Local I/O, Extend I/O and PCH-PIC Interrupt Controller node to silence W=1 warning: loongson-2k2000.dtsi:364.5-49: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map: Missing property '#address-cells' in node /bus@10000000/interrupt-controller@10000000, using 0 as fallback Value '0' is correct because: 1. The LIO/EIO/PCH interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Cc: stable@vger.kernel.org Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 81e8cb7e504a5adbcc48f7f954bf3c2aa9b417f8 Author: Binbin Zhou Date: Sat Jan 17 10:56:53 2026 +0800 LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells Add missing address-cells 0 to the Local I/O interrupt controller node to silence W=1 warning: loongson-2k1000.dtsi:498.5-55: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@9,0:interrupt-map: Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe01440, using 0 as fallback Value '0' is correct because: 1. The Local I/O interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Cc: stable@vger.kernel.org Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit c4461754e6fe7e12a3ff198cce4707e3e20e43d4 Author: Binbin Zhou Date: Sat Jan 17 10:56:52 2026 +0800 LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells Add missing address-cells 0 to the Local I/O and Extend I/O interrupt controller node to silence W=1 warning: loongson-2k0500.dtsi:513.5-51: Warning (interrupt_map): /bus@10000000/pcie@1a000000/pcie@0,0:interrupt-map: Missing property '#address-cells' in node /bus@10000000/interrupt-controller@1fe11600, using 0 as fallback Value '0' is correct because: 1. The Local I/O & Extend I/O interrupt controller do not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Cc: stable@vger.kernel.org Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 762cf75bec2ad9d17899087899a34336b1757238 Author: Yao Zi Date: Sat Jan 17 10:56:52 2026 +0800 LoongArch: dts: Describe PCI sideband IRQ through interrupt-extended SoC integrated peripherals on LS2K1000 and LS2K2000 could be discovered as PCI devices, but require sideband interrupts to function, which are previously described by interrupts and interrupt-parent properties. However, pci/pci-device.yaml allows interrupts property to only specify PCI INTx interrupts, not sideband ones. Convert these devices to use interrupt-extended property, which describes sideband interrupts used by PCI devices since dt-schema commit e6ea659d2baa ("schemas: pci-device: Allow interrupts-extended for sideband interrupts"), eliminating dtbs_check warnings. Cc: stable@vger.kernel.org Fixes: 30a5532a3206 ("LoongArch: dts: DeviceTree for Loongson-2K1000") Signed-off-by: Yao Zi Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit a91f86e27087f250a5d9c89bb4a427b9c30fd815 Author: Lisa Robinson Date: Sat Jan 17 10:56:43 2026 +0800 LoongArch: Fix PMU counter allocation for mixed-type event groups When validating a perf event group, validate_group() unconditionally attempts to allocate hardware PMU counters for the leader, sibling events and the new event being added. This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event is part of the group, the current code still tries to allocate a hardware PMU counter for it, which can wrongly consume hardware PMU resources and cause spurious allocation failures. Fix this by only allocating PMU counters for hardware events during group validation, and skipping software events. A trimmed down reproducer is as simple as this: #include #include #include #include #include #include int main (int argc, char *argv[]) { struct perf_event_attr attr = { 0 }; int fds[5]; attr.disabled = 1; attr.exclude_kernel = 1; attr.exclude_hv = 1; attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED | PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP; attr.size = sizeof (attr); attr.type = PERF_TYPE_SOFTWARE; attr.config = PERF_COUNT_SW_DUMMY; fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0); assert (fds[0] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_CPU_CYCLES; fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[1] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_INSTRUCTIONS; fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[2] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_BRANCH_MISSES; fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[3] >= 0); attr.type = PERF_TYPE_HARDWARE; attr.config = PERF_COUNT_HW_CACHE_REFERENCES; fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0); assert (fds[4] >= 0); printf ("PASSED\n"); return 0; } Cc: stable@vger.kernel.org Fixes: b37042b2bb7c ("LoongArch: Add perf events support") Signed-off-by: Lisa Robinson Signed-off-by: Huacai Chen commit 48e6a9c4a20870e09f85ff1a3628275d6bce31c0 Author: Rob Herring (Arm) Date: Tue Jan 13 19:51:58 2026 -0600 of: platform: Use default match table for /firmware Calling of_platform_populate() without a match table will only populate the immediate child nodes under /firmware. This is usually fine, but in the case of something like a "simple-mfd" node such as "raspberrypi,bcm2835-firmware", those child nodes will not be populated. And subsequent calls won't work either because the /firmware node is marked as processed already. Switch the call to of_platform_default_populate() to solve this problem. It should be a nop for existing cases. Fixes: 3aa0582fdb82 ("of: platform: populate /firmware/ node from of_platform_default_populate_init()") Cc: stable@vger.kernel.org Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/20260114015158.692170-2-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit bdce162f2e57a969803e5e9375999a3e0546905f Author: Nathan Chancellor Date: Fri Jan 16 15:44:34 2026 -0700 riscv: Use 64-bit variable for output in __get_user_asm After commit f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()"), which was the first commit that started using asm goto with outputs on RISC-V, builds of clang built with assertions enabled start crashing in certain files that use get_user() with: clang: llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:12743: Register FollowCopyChain(MachineRegisterInfo &, Register): Assertion `MI->getOpcode() == TargetOpcode::COPY && "start of copy chain MUST be COPY"' failed. Internally, LLVM generates an addiw instruction when the output of the inline asm (which may be any scalar type) needs to be sign extended for ABI reasons, such as a later function call, so that basic block does not have to do it. Use a temporary 64-bit variable as the output of the inline assembly in __get_user_asm() and explicitly cast it to truncate it if necessary, avoiding the addiw that triggers the assertion. Link: https://github.com/ClangBuiltLinux/linux/issues/2092 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20260116-riscv-wa-llvm-asm-goto-outputs-assertion-failure-v3-1-55b5775f989b@kernel.org Signed-off-by: Paul Walmsley commit 39d3389331abd712461f50249722f7ed9d815068 Merge: 6782a30d20775b 9dd1f5f3eb8cb1 Author: Linus Torvalds Date: Fri Jan 16 13:48:18 2026 -0800 Merge tag 'drm-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Simona Vetter: "We've had nothing aside of a compiler noise fix until today, when the amd and drm-misc fixes showed up after Dave already went into weekend mode. So it's on me to push these out, since there's a bunch of important fixes in here I think that shouldn't be delayed for a week. Core Changes: - take gem lock when preallocating in gpuvm - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations Driver Changes: - i915: compiler noise fix - amdgpu/amdkfd: pile of fixes all over - vmwgfx: - v10 cursor regression fix - other fixes - rockchip: - waiting for cfgdone regression fix - other fixes - gud: fix oops on disconnect - simple-panel: - regression fix when connector is not set - fix for DataImage SCF0700C48GGU18 - nouveau: cursor handling locking fix" * tag 'drm-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/kernel: (33 commits) drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 drm/amdkfd: No need to suspend whole MES to evict process Revert "drm/amdgpu: don't attach the tlb fence for SI" drm/amdgpu: validate the flush_gpu_tlb_pasid() drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 drm/amd/display: Initialise backlight level values from hw drm/amd/display: Bump the HDMI clock to 340MHz drm/amd/display: Show link name in PSR status message drm/amdkfd: fix a memory leak in device_queue_manager_init() drm/amdgpu: make sure userqs are enabled in userq IOCTLs drm/amdgpu: Use correct address to setup gart page table for vram access Revert duplicate "drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces" drm/amd: Clean up kfd node on surprise disconnect drm/amdgpu: fix drm panic null pointer when driver not support atomic drm/amdgpu: Fix gfx9 update PTE mtype flag drm/sysfb: Remove duplicate declarations drm/nouveau/kms/nv50-: Assert we hold nv50_disp->lock in nv50_head_flush_* drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare drm/gud: fix NULL fb and crtc dereferences on USB disconnect ... commit 6782a30d20775bc03d516b0f56befc73f3893be8 Merge: d81585830017a8 8441c7d3bd6c5a Author: Linus Torvalds Date: Fri Jan 16 13:09:28 2026 -0800 Merge tag 'cxl-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) fixes from Dave Jiang: - Recognize all ZONE_DEVICE users as physaddr consumers - Fix format string for extended_linear_cache_size_show() - Fix target list setup for multiple decoders sharing the same downstream port - Restore HBIW check before derefernce platform data - Fix potential infinite loop in __cxl_dpa_reserve() - Check for invalid addresses returned from translation functions on error * tag 'cxl-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl: Check for invalid addresses returned from translation functions on errors cxl/hdm: Fix potential infinite loop in __cxl_dpa_reserve() cxl/acpi: Restore HBIW check before dereferencing platform_data cxl/port: Fix target list setup for multiple decoders sharing the same dport cxl/region: fix format string for resource_size_t x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers commit d81585830017a896a1d6cfc1c626d7faaf9dfa55 Merge: b62ce2547fe8a8 05f66cf5e7a5fc Author: Linus Torvalds Date: Fri Jan 16 12:24:22 2026 -0800 Merge tag 'pci-v6.19-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Add a pci_free_irq_vectors() stub to fix a build issue when CONFIG_PCI is not set (Boqun Feng) * tag 'pci-v6.19-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Provide pci_free_irq_vectors() stub commit b62ce2547fe8a8ba15857bb974bcad250c5420d6 Merge: e547d4f733f04a d51e68b7007b9c Author: Linus Torvalds Date: Fri Jan 16 12:08:19 2026 -0800 Merge tag 'pm-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an error path memory leak in the energy model management code, fix a kerneldoc comment in it, and fix and revamp the energy model YNL specification added recently along with the new energy model management netlink interface (that received feedback after being added): - Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout) - Fix stale description of the cost field in struct em_perf_state to reflect the current code (Yaxiong Tian) - Fix and revamp the energy model YNL specification added recently along with the energy model netlink interface (Changwoo Min)" * tag 'pm-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: EM: Add dump to get-perf-domains in the EM YNL spec PM: EM: Change cpus' type from string to u64 array in the EM YNL spec PM: EM: Rename em.yaml to dev-energymodel.yaml PM: EM: Fix yamllint warnings in the EM YNL spec PM: EM: Fix memory leak in em_create_pd() error path PM: EM: Fix incorrect description of the cost field in struct em_perf_state commit 70458a363d7cf1a6b019685d44ad5932264f8a29 Merge: 79a6d1bfe1148b f7a980b3b8f80f Author: Marc Kleine-Budde Date: Fri Jan 16 20:41:17 2026 +0100 Merge patch series "can: usb: fix URB memory leaks" Marc Kleine-Budde says: An URB memory leak [1][2] was recently fixed in the gs_usb driver. The driver did not take into account that completed URBs are no longer anchored, causing them to be lost during ifdown. The memory leak was fixed by re-anchoring the URBs in the URB completion callback. Several USB CAN drivers are affected by the same error. Fix them accordingly. [1] https://lore.kernel.org/all/20260109135311.576033-3-mkl@pengutronix.de/ [2] https://lore.kernel.org/all/20260116-can_usb-fix-reanchor-v1-1-9d74e7289225@pengutronix.de/ Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-0-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde commit f7a980b3b8f80fe367f679da376cf76e800f9480 Author: Marc Kleine-Budde Date: Sat Jan 10 12:52:27 2026 +0100 can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback usb_8dev_read_bulk_callback(), the URBs are processed and resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor. Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-5-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 710a7529fb13c5a470258ff5508ed3c498d54729 Author: Marc Kleine-Budde Date: Sat Jan 10 12:52:27 2026 +0100 can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are allocated, added to the priv->rx_submitted anchor and submitted. In the complete callback mcba_usb_read_bulk_callback(), the URBs are processed and resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by calling usb_kill_anchored_urbs(&priv->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor. Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-4-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 248e8e1a125fa875158df521b30f2cc7e27eeeaa Author: Marc Kleine-Budde Date: Sat Jan 10 12:52:27 2026 +0100 can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In kvaser_usb_remove_interfaces() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in usb_kill_anchored_urbs(). Fix the memory leak by anchoring the URB in the kvaser_usb_read_bulk_callback() to the dev->rx_submitted anchor. Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-3-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 5a4391bdc6c8357242f62f22069c865b792406b3 Author: Marc Kleine-Budde Date: Sat Jan 10 12:52:27 2026 +0100 can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In esd_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In esd_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in esd_usb_close(). Fix the memory leak by anchoring the URB in the esd_usb_read_bulk_callback() to the dev->rx_submitted anchor. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-2-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 0ce73a0eb5a27070957b67fd74059b6da89cc516 Author: Marc Kleine-Budde Date: Sat Jan 10 12:52:27 2026 +0100 can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In ems_usb_open(), the URBs for USB-in transfers are allocated, added to the dev->rx_submitted anchor and submitted. In the complete callback ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In ems_usb_close() the URBs are freed by calling usb_kill_anchored_urbs(&dev->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in ems_usb_close(). Fix the memory leak by anchoring the URB in the ems_usb_read_bulk_callback() to the dev->rx_submitted anchor. Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-1-4b8cb2915571@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 9dd1f5f3eb8cb175e2f7fd2a685bdb6b1bd2a726 Merge: 52456a62174f5e b91a565ed14fcf Author: Simona Vetter Date: Fri Jan 16 20:27:20 2026 +0100 Merge tag 'drm-misc-fixes-2026-01-16' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc6: vmwgfx: - Fix hw regression from refactoring cursor handling on v10 'hardware' - Fix warnings in destructor by merging the 2 release functions - kernel doc fix - error handling in vmw_compat_shader_add() rockchip: - fix vop2 polling - fix regression waiting for cfgdone without config change - fix warning when enabling encoder core: - take gem lock when preallocating in gpuvm. - add single byte read fallback to dp for broken usb-c adapters - remove duplicate drm_sysfb declarations gud: - Fix oops on usb disconnect Simple panel: - Re-add fallback when connector is not set to fix regressions - Set correct type in DataImage SCF0700C48GGU18 nouveau: - locking fixes for cursor handling. Signed-off-by: Simona Vetter From: Maarten Lankhorst Link: https://patch.msgid.link/ce0acfe2-9c1a-42b7-8782-f1e7f34b8544@linux.intel.com commit e547d4f733f04ac540099b09358e6dc8c8977113 Merge: 711673f8dd19cf 7edf6f7ef5345e Author: Linus Torvalds Date: Fri Jan 16 11:03:17 2026 -0800 Merge tag 'acpi-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Add checks missed by a previous recent update to the ACPI suspend-to-idle code and add a debug module parameter to it to work around a platform firmware issue exposed by that update (Rafael Wysocki)" * tag 'acpi-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PM: s2idle: Add module parameter for LPS0 constraints checking ACPI: PM: s2idle: Add missing checks to acpi_s2idle_begin_lps0() commit 711673f8dd19cfb907913cb762d4c6c1b9d2a332 Merge: c2a44a02d785b5 46b8d0888f01f2 Author: Linus Torvalds Date: Fri Jan 16 10:48:17 2026 -0800 Merge tag 'sound-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became a bit larger than wished for, often seen as a bump at the middle, but almost all changes are small device-specific fixes, so the risk must be pretty low. - SoundWire fix for missing symbol export - Fixes for device-tree bindings - A fix for OOB access in USB-audio, spotted by fuzzer - Quirks for HD-audio, SoundWire, AMD ACP - A series of ASoC tlv320 and wsa codec fixes - Other misc fixes in PCM OSS error-handling, Cirrus scodec test, ASoC ops endianess, davinci, simple-card, and tegra" * tag 'sound-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (33 commits) ALSA: hda/tas2781: Add newly-released HP laptop ASoC: rt5640: Fix duplicate clock properties in DT binding ALSA: hda/realtek: Add quirk for HP Pavilion x360 to enable mute LED ASoC: tlv320adcx140: fix word length ASoC: tlv320adcx140: Propagate error codes during probe ASoC: tlv320adcx140: fix null pointer ASoC: tlv320adcx140: invert DRE_ENABLE ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type ASoC: sdw_utils: Call init callbacks on the correct codec DAI soundwire: Add missing EXPORT for sdw_slave_type ALSA: usb-audio: Prevent excessive number of frames ALSA: hda/cirrus_scodec_test: Fix test suite name ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip ALSA: hda/realtek: Add quirk for Asus Zephyrus G14 2025 using CS35L56, fix speakers ASoC: amd: yc: Fix microphone on ASUS M6500RE ASoC: tegra: Revert fix for uninitialized flat cache warning in tegra210_ahub ASoC: dt-bindings: rockchip-spdif: Allow "port" node ASoC: dt-bindings: realtek,rt5640: Allow 7 for realtek,jack-detect-source ASoC: dt-bindings: realtek,rt5640: Add missing properties/node ASoC: dt-bindings: realtek,rt5640: Document port node ... commit 52456a62174f5e917060486fd84cac877c3e25e5 Merge: 85807edac851c9 d04f73668bebbc Author: Simona Vetter Date: Fri Jan 16 19:37:22 2026 +0100 Merge tag 'amd-drm-fixes-6.19-2026-01-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-15: amdgpu: - GC 9 PTE mtype fix - Non-DC display kernel panic helper fix - Merge fix - GART vram access fix - Userq fixes - PSR debugging fix - HDMI fixes - Backlight fix - SMU 14 fix - TLB flush fixes amdkfd: - KFD node cleanup for eGPU disconnect - Memory leak fix - MES evict process fix Signed-off-by: Simona Vetter From: Alex Deucher Link: https://patch.msgid.link/20260115205405.1890089-1-alexander.deucher@amd.com commit 6358461178ca29a87c66495f1ce854388b0107c3 Merge: 4973d95679fb4f 79d11311f64d3e Author: Christian Brauner Date: Fri Jan 16 19:15:20 2026 +0100 Merge patch series "fuse: fixes and cleanups for expired dentry eviction" Miklos Szeredi says: This mini series fixes issues with the stale dentry cleanup patches added in this cycle. In particular commit ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") allowed a race resulting in UAF. * patches from https://patch.msgid.link/20260114145344.468856-1-mszeredi@redhat.com: vfs: document d_dispose_if_unused() fuse: shrink once after all buckets have been scanned fuse: clean up fuse_dentry_tree_work() fuse: add need_resched() before unlocking bucket fuse: make sure dentry is evicted if stale fuse: fix race when disposing stale dentries Link: https://patch.msgid.link/20260114145344.468856-1-mszeredi@redhat.com Signed-off-by: Christian Brauner commit 79d11311f64d3e9fbc20ac95b7df6f917221329f Author: Miklos Szeredi Date: Wed Jan 14 15:53:43 2026 +0100 vfs: document d_dispose_if_unused() Add a warning about the danger of using this function without proper locking preventing eviction. Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260114145344.468856-7-mszeredi@redhat.com Signed-off-by: Christian Brauner commit fa79401a9c35fe2ba590599d7617789761f574a9 Author: Miklos Szeredi Date: Wed Jan 14 15:53:42 2026 +0100 fuse: shrink once after all buckets have been scanned In fuse_dentry_tree_work() move the shrink_dentry_list() out from the loop. Suggested-by: Al Viro Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260114145344.468856-6-mszeredi@redhat.com Signed-off-by: Christian Brauner commit 3926746b553455faaff2387b9a617c98d936980d Author: Miklos Szeredi Date: Wed Jan 14 15:53:41 2026 +0100 fuse: clean up fuse_dentry_tree_work() - Change time_after64() time_before64(), since the latter is exclusively used in this file to compare dentry/inode timeout with current time. - Move the break statement from the else branch to the if branch, reducing indentation. Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260114145344.468856-5-mszeredi@redhat.com Signed-off-by: Christian Brauner commit 09f7a43ae501541030f42670351032f3c8bfa06e Author: Miklos Szeredi Date: Wed Jan 14 15:53:40 2026 +0100 fuse: add need_resched() before unlocking bucket In fuse_dentry_tree_work() no need to unlock/lock dentry_hash[i].lock on each iteration. Suggested-by: Al Viro Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260114145344.468856-4-mszeredi@redhat.com Signed-off-by: Christian Brauner commit 1e2c1af1beb395841743e240a59ab37edc9a7d33 Author: Miklos Szeredi Date: Wed Jan 14 15:53:39 2026 +0100 fuse: make sure dentry is evicted if stale d_dispose_if_unused() may find the dentry with a positive refcount, in which case it won't be put on the dispose list even though it has already timed out. "Reinstall" the d_delete() callback, which was optimized out in fuse_dentry_settime(). This will result in the dentry being evicted as soon as the refcount hits zero. Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260114145344.468856-3-mszeredi@redhat.com Signed-off-by: Christian Brauner commit cb8d2bdcb8241b66ca4ac4868f20e12cd6881ebc Author: Miklos Szeredi Date: Wed Jan 14 15:53:38 2026 +0100 fuse: fix race when disposing stale dentries In fuse_dentry_tree_work() just before d_dispose_if_unused() the dentry could get evicted, resulting in UAF. Move unlocking dentry_hash[i].lock to after the dispose. To do this, fuse_dentry_tree_del_node() needs to be moved from fuse_dentry_prune() to fuse_dentry_release() to prevent an ABBA deadlock. The lock ordering becomes: -> dentry_bucket.lock -> dentry.d_lock Reported-by: Al Viro Closes: https://lore.kernel.org/all/20251206014242.GO1712166@ZenIV/ Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260114145344.468856-2-mszeredi@redhat.com Signed-off-by: Christian Brauner commit c2a44a02d785b5dc06d68060079e2daf67a67e5a Merge: 7a2c1b27cd6b85 471e998c0e3120 Author: Linus Torvalds Date: Fri Jan 16 09:55:09 2026 -0800 Merge tag 'gpio-fixes-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Two more GPIO fixes addressing an issue uncovered by the shared GPIO management changes in v6.19: - implement the missing .get_direction() callback for gpio-davinci - remove redundant check in GPIO core which can also propagate an invalid errno to user-space" * tag 'gpio-fixes-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: remove redundant callback check gpio: davinci: implement .get_direction() commit 7a2c1b27cd6b853e924bb0bbcb01eb64fbb97875 Merge: 353c6f43ab690b 9bd18e1262c0fe Author: Linus Torvalds Date: Fri Jan 16 09:46:59 2026 -0800 Merge tag 'printk-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Prevent softlockup by restoring IRQs in atomic flush after each record * tag 'printk-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/nbcon: Restore IRQ in atomic flush after each emitted record commit 353c6f43ab690b5746289c057c1701a389b12f98 Merge: 983d014aafb14e c360004c0160db Author: Linus Torvalds Date: Fri Jan 16 09:09:41 2026 -0800 Merge tag 'xfs-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "Just a few obvious fixes and some 'cosmetic' changes" * tag 'xfs-fixes-6.19-rc6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: set max_agbno to allow sparse alloc of last full inode chunk xfs: Fix xfs_grow_last_rtg() xfs: improve the assert at the top of xfs_log_cover xfs: fix an overly long line in xfs_rtgroup_calc_geometry xfs: mark __xfs_rtgroup_extents static xfs: Fix the return value of xfs_rtcopy_summary() xfs: fix memory leak in xfs_growfs_check_rtgeom() commit 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7 Author: Marc Kleine-Budde Date: Fri Jan 16 14:10:10 2026 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"), the URB was re-anchored before usb_submit_urb() in gs_usb_receive_bulk_callback() to prevent a leak of this URB during cleanup. However, this patch did not take into account that usb_submit_urb() could fail. The URB remains anchored and usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops infinitely since the anchor list never becomes empty. To fix the bug, unanchor the URB when an usb_submit_urb() error occurs, also print an info message. Fixes: 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/all/20260110223836.3890248-1-kuba@kernel.org/ Link: https://patch.msgid.link/20260116-can_usb-fix-reanchor-v1-1-9d74e7289225@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 375629c92fd842bc2a229bb34c4453f62e097169 Author: Marc Kleine-Budde Date: Fri Jan 16 13:13:45 2026 +0100 can: dev: alloc_candev_mqs(): add missing default CAN capabilities The idea behind series 6c1f5146b214 ("Merge patch series "can: raw: better approach to instantly reject unsupported CAN frames"") is to set the capabilities of a CAN device (CAN-CC, CAN-FD, CAN-XL, and listen only) [1] and, based on these capabilities, reject unsupported CAN frames in the CAN-RAW protocol [2]. This works perfectly for CAN devices configured in CAN-FD or CAN-XL mode. CAN devices with static CAN control modes define their capabilities via can_set_static_ctrlmode() -> can_set_cap_info(). CAN devices configured by the user space for CAN-FD or CAN-XL set their capabilities via can_changelink() -> can_ctrlmode_changelink() -> can_set_cap_info(). However, in commit 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv"), the capabilities of CAN devices are not initialized. This results in CAN-RAW rejecting all CAN frames on devices directly after ifup if the user space has not changed the CAN control mode. Fix this problem by setting the default capabilities to CAN-CC in alloc_candev_mqs() as soon as the CAN specific ml_priv is allocated. [1] commit 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv") [2] commit faba5860fcf9 ("can: raw: instantly reject disabled CAN frames") Fixes: 166e87329ce6 ("can: propagate CAN device capabilities via ml_priv") Acked-by: Oliver Hartkopp Tested-by: Oliver Hartkopp Link: https://patch.msgid.link/20260116-can_add_missing_set_caps-v1-1-7525126d8b20@pengutronix.de [mkl: fix typo in subject] Signed-off-by: Marc Kleine-Budde commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 Author: Ian Abbott Date: Mon Jan 12 16:28:35 2026 +0000 comedi: dmm32at: serialize use of paged registers Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15: 00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved 11 => Calibration registers are accessible The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the `dm32at_8255_io()` function (used for Comedi instruction handling on the digital I/O subdevice). Make use of the generic Comedi device spin-lock `dev->spinlock` (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers. Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver") Cc: stable@vger.kernel.org Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 06d5a7afe1d0b47102936d8fba568572c2b4b941 Author: Alexander Usyskin Date: Sun Jan 11 16:51:25 2026 +0200 mei: trace: treat reg parameter as string The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") forbids to emit event with a plain char* without a wrapper. The reg parameter always passed as static string and wrapper is not strictly required, contrary to dev parameter. Use the string wrapper anyway to check sanity of the reg parameters, store it value independently and prevent internal kernel data leaks. Since some code refactoring has taken place, explicit backporting may be needed for kernels older than 6.10. Cc: stable@vger.kernel.org # v6.11+ Fixes: a0a927d06d79 ("mei: me: add io register tracing") Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20260111145125.1754912-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 054e1c0e6114aaf08672c5ad25d796362bc7e76b Author: Haiyue Wang Date: Sat Jan 10 01:54:25 2026 +0800 uio: pci_sva: correct '-ENODEV' check logic The current '-ENODEV' check uses '&&', which can lead to a NULL pointer dereference when udev is NULL. Fix the condition to return -ENODEV if either udev or its pdev is NULL. Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c") Signed-off-by: Haiyue Wang Link: https://patch.msgid.link/20260109175448.34309-1-haiyuewa@163.com Signed-off-by: Greg Kroah-Hartman commit 26c08dabe5475d99a13f353d8dd70e518de45663 Author: Chenghai Huang Date: Tue Dec 2 14:12:56 2025 +0800 uacce: ensure safe queue release with state management Directly calling `put_queue` carries risks since it cannot guarantee that resources of `uacce_queue` have been fully released beforehand. So adding a `stop_queue` operation for the UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to the final resource release ensures safety. Queue states are defined as follows: - UACCE_Q_ZOMBIE: Initial state - UACCE_Q_INIT: After opening `uacce` - UACCE_Q_STARTED: After `start` is issued via `ioctl` When executing `poweroff -f` in virt while accelerator are still working, `uacce_fops_release` and `uacce_remove` may execute concurrently. This can cause `uacce_put_queue` within `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add state checks to prevent accessing freed pointers. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang Signed-off-by: Yang Shen Acked-by: Zhangfei Gao Link: https://patch.msgid.link/20251202061256.4158641-5-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman commit 02695347be532b628f22488300d40c4eba48b9b7 Author: Yang Shen Date: Tue Dec 2 14:12:55 2025 +0800 uacce: implement mremap in uacce_vm_ops to return -EPERM The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario: An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok). Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Yang Shen Signed-off-by: Chenghai Huang Acked-by: Zhangfei Gao Link: https://patch.msgid.link/20251202061256.4158641-4-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman commit 98eec349259b1fd876f350b1c600403bcef8f85d Author: Chenghai Huang Date: Tue Dec 2 14:12:54 2025 +0800 uacce: fix isolate sysfs check condition uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will create sysfs files now. Users can read and configure the isolation policy through sysfs. Currently, sysfs files are created as long as either isolate_err_threshold_read or isolate_err_threshold_write callback functions are present. However, accessing a non-existent callback function may cause the system to crash. Therefore, intercept the creation of sysfs if neither read nor write exists; create sysfs if either is supported, but intercept unsupported operations at the call site. Fixes: e3e289fbc0b5 ("uacce: supports device isolation feature") Cc: stable@vger.kernel.org Signed-off-by: Chenghai Huang Acked-by: Zhangfei Gao Link: https://patch.msgid.link/20251202061256.4158641-3-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman commit a3bece3678f6c88db1f44c602b2a63e84b4040ac Author: Wenkai Lin Date: Tue Dec 2 14:12:53 2025 +0800 uacce: fix cdev handling in the cleanup path When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable@vger.kernel.org Signed-off-by: Wenkai Lin Signed-off-by: Chenghai Huang Acked-by: Zhangfei Gao Link: https://patch.msgid.link/20251202061256.4158641-2-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman commit bba7fd1258cd72f9a9d9e7d86c155851fff23ae2 Author: Johan Hovold Date: Wed Nov 26 15:53:29 2025 +0100 slimbus: core: clean up of_slim_get_device() Clean up of_find_slim_device() by folding in the of_find_slim_device() helper. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251126145329.5022-7-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7831f710553dcda6a67b3fe3f7a9d2f9a7233c3f Author: Johan Hovold Date: Wed Nov 26 15:53:28 2025 +0100 slimbus: core: fix of_slim_get_device() kernel doc Unlike slim_get_device() the of_slim_get_device() helper does not allocate and register any slimbus devices in case lookup fails. Update the of_slim_get_device() kernel doc to reflect this and add a comment about the helper taking a reference to the returned device. Fixes: e0772de8a48b ("slimbus: core: add of_slim_device_get() helper") Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251126145329.5022-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 4c6da2fdc811391c4a5e594c6e976803b54198b7 Author: Johan Hovold Date: Wed Nov 26 15:53:27 2025 +0100 slimbus: core: amend slim_get_device() kernel doc Add a comment to clarify that slim_get_device() takes a reference to the embedded struct device of the returned slimbus device. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251126145329.5022-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9391380eb91ea5ac792aae9273535c8da5b9aa01 Author: Johan Hovold Date: Wed Nov 26 15:53:26 2025 +0100 slimbus: core: fix device reference leak on report present Slimbus devices can be allocated dynamically upon reception of report-present messages. Make sure to drop the reference taken when looking up already registered devices. Note that this requires taking an extra reference in case the device has not yet been registered and has to be allocated. Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") Cc: stable@vger.kernel.org # 4.16 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251126145329.5022-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0eb4ff6596114aabba1070a66afa2c2f5593739f Author: Johan Hovold Date: Wed Nov 26 15:53:25 2025 +0100 slimbus: core: fix runtime PM imbalance on report present Make sure to balance the runtime PM usage count in case slimbus device or address allocation fails on report present, which would otherwise prevent the controller from suspending. Fixes: 4b14e62ad3c9 ("slimbus: Add support for 'clock-pause' feature") Cc: stable@vger.kernel.org # 4.16 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251126145329.5022-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0b52edaeb5c2ae9d9d25476554671014d2a1057b Author: Johan Hovold Date: Wed Nov 26 15:53:24 2025 +0100 slimbus: core: fix OF node leak on registration failure Make sure to drop the OF node reference taken when initialising and registering the slimbus device also on registration failure by releasing it in the destructor as expected. Fixes: 7588a511bdb4 ("slimbus: core: add support to device tree helper") Fixes: 01360857486c ("slimbus: core: Fix mismatch in of_node_get/put") Cc: Saravana Kannan Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251126145329.5022-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit aa3f64a98b23c524ce768661779d7f640f59c4da Author: Johan Hovold Date: Mon Dec 8 16:35:24 2025 +0100 intel_th: rename error label Use a more a descriptive name for the error label that is used to put the reference to dev. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251208153524.68637-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 Author: Johan Hovold Date: Mon Dec 8 16:35:23 2025 +0100 intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open(). Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices") Fixes: 6d5925b667e4 ("intel_th: Fix error handling in intel_th_output_open") Cc: stable@vger.kernel.org # 4.4: 6d5925b667e4 Cc: Alexander Shishkin Cc: Ma Ke Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251208153524.68637-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 10d28cffb3f6ec7ad67f0a4cd32c2afa92909452 Author: Ian Abbott Date: Wed Dec 3 16:24:38 2025 +0000 comedi: Fix getting range information for subdevices 16 to 255 The `COMEDI_RANGEINFO` ioctl does not work properly for subdevice indices above 15. Currently, the only in-tree COMEDI drivers that support more than 16 subdevices are the "8255" driver and the "comedi_bond" driver. Making the ioctl work for subdevice indices up to 255 is achievable. It needs minor changes to the handling of the `COMEDI_RANGEINFO` and `COMEDI_CHANINFO` ioctls that should be mostly harmless to user-space, apart from making them less broken. Details follow... The `COMEDI_RANGEINFO` ioctl command gets the list of supported ranges (usually with units of volts or milliamps) for a COMEDI subdevice or channel. (Only some subdevices have per-channel range tables, indicated by the `SDF_RANGETYPE` flag in the subdevice information.) It uses a `range_type` value and a user-space pointer, both supplied by user-space, but the `range_type` value should match what was obtained using the `COMEDI_CHANINFO` ioctl (if the subdevice has per-channel range tables) or `COMEDI_SUBDINFO` ioctl (if the subdevice uses a single range table for all channels). Bits 15 to 0 of the `range_type` value contain the length of the range table, which is the only part that user-space should care about (so it can use a suitably sized buffer to fetch the range table). Bits 23 to 16 store the channel index, which is assumed to be no more than 255 if the subdevice has per-channel range tables, and is set to 0 if the subdevice has a single range table. For `range_type` values produced by the `COMEDI_SUBDINFO` ioctl, bits 31 to 24 contain the subdevice index, which is assumed to be no more than 255. But for `range_type` values produced by the `COMEDI_CHANINFO` ioctl, bits 27 to 24 contain the subdevice index, which is assumed to be no more than 15, and bits 31 to 28 contain the COMEDI device's minor device number for some unknown reason lost in the mists of time. The `COMEDI_RANGEINFO` ioctl extract the length from bits 15 to 0 of the user-supplied `range_type` value, extracts the channel index from bits 23 to 16 (only used if the subdevice has per-channel range tables), extracts the subdevice index from bits 27 to 24, and ignores bits 31 to 28. So for subdevice indices 16 to 255, the `COMEDI_SUBDINFO` or `COMEDI_CHANINFO` ioctl will report a `range_type` value that doesn't work with the `COMEDI_RANGEINFO` ioctl. It will either get the range table for the subdevice index modulo 16, or will fail with `-EINVAL`. To fix this, always use bits 31 to 24 of the `range_type` value to hold the subdevice index (assumed to be no more than 255). This affects the `COMEDI_CHANINFO` and `COMEDI_RANGEINFO` ioctls. There should not be anything in user-space that depends on the old, broken usage, although it may now see different values in bits 31 to 28 of the `range_type` values reported by the `COMEDI_CHANINFO` ioctl for subdevices that have per-channel subdevices. User-space should not be trying to decode bits 31 to 16 of the `range_type` values anyway. Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable@vger.kernel.org #5.17+ Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251203162438.176841-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 9aeacd2ff31e1520bd302e40f7d2500cb98a2401 Author: Dan Carpenter Date: Sat Nov 29 17:50:39 2025 +0300 mux: mmio: Fix IS_ERR() vs NULL check in probe() The devm_kmalloc() function never returns error pointers, it returns NULL on error. Fix the error checking. Fixes: 4863cb2b0f50 ("mux: mmio: Add suspend and resume support") Signed-off-by: Dan Carpenter Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/aSsIP7oKrhKfCUv3@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit d51e68b7007b9c1c3456c4f93657a153ae3816ec Merge: 0f61b1860cc3f5 380ff27af25e49 Author: Rafael J. Wysocki Date: Fri Jan 16 16:16:24 2026 +0100 Merge branch 'pm-em' Merge fixes related to the energy model management for 6.19-rc6: - Fix a memory leak in em_create_pd() error path (Malaya Kumar Rout) - Fix stale description of the cost field in struct em_perf_state to reflect the current code (Yaxiong Tian) - Fix and revamp the energy model YNL specification added recently along with the energy model netlink interface (Changwoo Min) * pm-em: PM: EM: Add dump to get-perf-domains in the EM YNL spec PM: EM: Change cpus' type from string to u64 array in the EM YNL spec PM: EM: Rename em.yaml to dev-energymodel.yaml PM: EM: Fix yamllint warnings in the EM YNL spec PM: EM: Fix memory leak in em_create_pd() error path PM: EM: Fix incorrect description of the cost field in struct em_perf_state commit 27aff0a56b3c77ea1a73641c9b3c4172a8f7238f Author: Marnix Rijnart Date: Mon Jan 12 01:08:23 2026 +0100 serial: 8250_pci: Fix broken RS485 for F81504/508/512 Fintek F81504/508/512 can support both RTS_ON_SEND and RTS_AFTER_SEND, but pci_fintek_rs485_supported only announces the former. This makes it impossible to unset SER_RS485_RTS_ON_SEND from userspace because of uart_sanitize_serial_rs485(). Some devices with these chips need RTS low on TX, so they are effectively broken. Fix this by announcing the support for SER_RS485_RTS_AFTER_SEND, similar to commit 068d35a7be65 ("serial: sc16is7xx: announce support for SER_RS485_RTS_ON_SEND"). Fixes: 4afeced55baa ("serial: core: fix sanitizing check for RTS settings") Cc: stable Signed-off-by: Marnix Rijnart Link: https://patch.msgid.link/20260112000931.61703-1-marnix.rijnart@iwell.eu Signed-off-by: Greg Kroah-Hartman commit fb47423dc7bf43301048d77289ce0114959de4de Author: Praveen Talari Date: Thu Jan 8 09:40:06 2026 +0530 serial: qcom_geni: Fix BT failure regression on RB2 platform Commit 10904d725f6e ("serial: qcom-geni: Enable PM runtime for serial driver") caused BT init to fail during bootup on the RB2 platform, preventing proper BT initialization. However, BT works correctly after bootup completes. The issue occurs when runtime PM is enabled and uart_add_one_port() is called before wakeup IRQ setup. The uart_add_one_port() call activates the device through runtime PM, which configures GPIOs to the "qup_x" pinmux function during runtime resume. When wakeup IRQ registration happens afterward using dev_pm_set_dedicated_wake_irq(), these GPIOs are reset back to the "gpio" pinmux function, which impacts the RX GPIO and leads to Bluetooth failures. Fix this by ensuring wakeup IRQ setup is completed before calling uart_add_one_port() to prevent the pinmux function conflict. Fixes: 10904d725f6e ("serial: qcom-geni: Enable PM runtime for serial driver") Reported-by: Dmitry Baryshkov Closes: https://lore.kernel.org/all/20251110101043.2108414-4-praveen.talari@oss.qualcomm.com/ Tested-by: Dmitry Baryshkov Reviewed-by: Dmitry Baryshkov Signed-off-by: Praveen Talari Link: https://patch.msgid.link/20260108041006.1874757-1-praveen.talari@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit fdee1b09721605f532352628d0a24623e7062efb Author: Mario Limonciello Date: Thu Jan 15 14:31:10 2026 -0600 platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names The hp-bioscfg driver attempts to register kobjects with empty names when the HP BIOS returns attributes with empty name strings. This causes multiple kernel warnings: kobject: (00000000135fb5e6): attempted to be registered with empty name! WARNING: CPU: 14 PID: 3336 at lib/kobject.c:219 kobject_add_internal+0x2eb/0x310 Add validation in hp_init_bios_buffer_attribute() to check if the attribute name is empty after parsing it from the WMI buffer. If empty, log a debug message and skip registration of that attribute, allowing the module to continue processing other valid attributes. Cc: stable@vger.kernel.org Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260115203725.828434-2-mario.limonciello@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 0ea4cc93d5ec6dcc388291e261b0833bee05b348 Merge: 36a70608a31487 8cc27f5c6dd17d Author: Greg Kroah-Hartman Date: Fri Jan 16 13:53:44 2026 +0100 Merge tag 'icc-6.19-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus interconnect fixes for v6.19-rc This contains a few small fixes for the current cycle. - dt-bindings: interconnect: qcom,sa8775p-rpmh: Fix incorrectly added reg and clocks - MAINTAINERS: Add interconnect-clk.h to interconnect API entry - interconnect: debugfs: initialize src_node and dst_node to empty strings Signed-off-by: Georgi Djakov * tag 'icc-6.19-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: debugfs: initialize src_node and dst_node to empty strings MAINTAINERS: Add interconnect-clk.h to interconnect API entry dt-bindings: interconnect: qcom,sa8775p-rpmh: Fix incorrectly added reg and clocks commit b9f5c38e4af1a094384650d2fc79fb992d6d5e64 Author: Ben Horgan Date: Mon Jan 12 16:58:29 2026 +0000 arm_mpam: Use non-atomic bitops when modifying feature bitmap In the test__props_mismatch() kunit test we rely on the struct mpam_props being packed to ensure memcmp doesn't consider packing. Making it packed reduces the alignment of the features bitmap and so breaks a requirement for the use of atomics. As we don't rely on the set/clear of these bits being atomic, just make them non-atomic. Reviewed-by: Jonathan Cameron Signed-off-by: Ben Horgan Fixes: 8c90dc68a5de ("arm_mpam: Probe the hardware features resctrl supports") Reviewed-by: Gavin Shan Tested-by: Shaopeng Tan Tested-by: Peter Newman Signed-off-by: Catalin Marinas commit b5a69c4869211a6ab61a95f5cc987b25f383dbc3 Author: Jiapeng Chong Date: Mon Jan 12 16:58:28 2026 +0000 arm_mpam: Remove duplicate linux/srcu.h header ./drivers/resctrl/mpam_internal.h: linux/srcu.h is included more than once. Reviewed-by: Jonathan Cameron Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=27328 Signed-off-by: Jiapeng Chong Acked-by: James Morse [BH: Keep alphabetical order] Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Signed-off-by: Catalin Marinas commit dd83dc1249737b837ac5d57c81f2b0977c613d9f Author: Mathias Nyman Date: Fri Jan 16 01:37:58 2026 +0200 xhci: sideband: don't dereference freed ring when removing sideband endpoint xhci_sideband_remove_endpoint() incorrecly assumes that the endpoint is running and has a valid transfer ring. Lianqin reported a crash during suspend/wake-up stress testing, and found the cause to be dereferencing a non-existing transfer ring 'ep->ring' during xhci_sideband_remove_endpoint(). The endpoint and its ring may be in unknown state if this function is called after xHCI was reinitialized in resume (lost power), or if device is being re-enumerated, disconnected or endpoint already dropped. Fix this by both removing unnecessary ring access, and by checking ep->ring exists before dereferencing it. Also make sure endpoint is running before attempting to stop it. Remove the xhci_initialize_ring_info() call during sideband endpoint removal as is it only initializes ring structure enqueue, dequeue and cycle state values to their starting values without changing actual hardware enqueue, dequeue and cycle state. Leaving them out of sync is worse than leaving it as it is. The endpoint will get freed in after this in most usecases. If the (audio) class driver want's to reuse the endpoint after offload then it is up to the class driver to ensure endpoint is properly set up. Reported-by: 胡连勤 Closes: https://lore.kernel.org/linux-usb/TYUPR06MB6217B105B059A7730C4F6EC8D2B9A@TYUPR06MB6217.apcprd06.prod.outlook.com/ Tested-by: 胡连勤 Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity") Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20260115233758.364097-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9fa015bdd8913f55cb528724db83adf99c381802 Merge: 9bcb4c4c330ca3 cd644b805da8a2 Author: Greg Kroah-Hartman Date: Fri Jan 16 11:57:55 2026 +0100 Merge tag 'usb-serial-6.19-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial fix for 6.19-rc6 Here's a fix for an f81232 enumeration issue that could prevent some ports from being enabled (e.g. during driver rebind). Included are also some new device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.19-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: f81232: fix incomplete serial port generation USB: serial: ftdi_sio: add support for PICAXE AXE027 cable USB: serial: option: add Telit LE910 MBIM composition commit 4973d95679fb4f8bb4413dcb3bce435ef848285d Author: Jens Axboe Date: Thu Jan 15 05:25:28 2026 -0700 fuse: use private naming for fuse hash size With a mix of include dependencies, the compiler warns that: fs/fuse/dir.c:35:9: warning: ?HASH_BITS? redefined 35 | #define HASH_BITS 5 | ^~~~~~~~~ In file included from ./include/linux/io_uring_types.h:5, from ./include/linux/bpf.h:34, from ./include/linux/security.h:35, from ./include/linux/fs_context.h:14, from fs/fuse/dir.c:13: ./include/linux/hashtable.h:28:9: note: this is the location of the previous definition 28 | #define HASH_BITS(name) ilog2(HASH_SIZE(name)) | ^~~~~~~~~ fs/fuse/dir.c:36:9: warning: ?HASH_SIZE? redefined 36 | #define HASH_SIZE (1 << HASH_BITS) | ^~~~~~~~~ ./include/linux/hashtable.h:27:9: note: this is the location of the previous definition 27 | #define HASH_SIZE(name) (ARRAY_SIZE(name)) | ^~~~~~~~~ Hence rename the HASH_SIZE/HASH_BITS in fuse, by prefixing them with FUSE_ instead. Signed-off-by: Jens Axboe Link: https://patch.msgid.link/195c9525-281c-4302-9549-f3d9259416c6@kernel.dk Acked-by: Miklos Szeredi Signed-off-by: Christian Brauner commit 84697bf5532923f70ac99ea9784fab325c560df0 Author: Tim Bird Date: Wed Jan 14 16:22:08 2026 -0700 kernel: cgroup: Add LGPL-2.1 SPDX license ID to legacy_freezer.c Add an appropriate SPDX-License-Identifier line to the file, and remove the GNU boilerplate text. Signed-off-by: Tim Bird Signed-off-by: Tejun Heo commit a1b3421a023e920b006d9a55eac334b14d115687 Author: Tim Bird Date: Wed Jan 14 13:30:27 2026 -0700 kernel: cgroup: Add SPDX-License-Identifier lines Add GPL-2.0 SPDX license id lines to a few old files, replacing the reference to the COPYING file. The COPYING file at the time of creation of these files (2007 and 2005) was GPL-v2.0, with an additional clause indicating that only v2 applied. Signed-off-by: Tim Bird Signed-off-by: Tejun Heo commit 09444bef413fcafabe965c1ff14e3bc9c2c0f4f9 Author: Waiman Long Date: Tue Jan 13 23:54:35 2026 -0500 MAINTAINERS: Add Chen Ridong as cpuset reviewer Add Chen Ridong as a reviewer for the cpuset cgroup subsystem. Signed-off-by: Waiman Long Acked-by: Chen Ridong Signed-off-by: Tejun Heo commit 85807edac851c9766d86cd8bded315e130379efa Merge: 0f61b1860cc3f5 81d0223832f99c Author: Dave Airlie Date: Fri Jan 16 15:45:40 2026 +1000 Merge tag 'drm-intel-fixes-2026-01-15' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes drm/i915 fixes for v6.19-rc6: - make 'guc_hw_reg_state' static Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/65bb05f7c8cbd3faf2350f979d4d47a395e5d372@intel.com commit a74c7a58ca2ca1cbb93f4c01421cf24b8642b962 Author: Maxime Chevallier Date: Wed Jan 14 09:02:46 2026 +0100 net: freescale: ucc_geth: Return early when TBI PHY can't be found In ucc_geth's .mac_config(), we configure the TBI Serdes block represented by a struct phy_device that we get from firmware. While porting to phylink, a check was missed to make sure we don't try to access the TBI PHY if we can't get it. Let's add it and return early in case of error Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202601130843.rFGNXA5a-lkp@intel.com/ Fixes: 53036aa8d031 ("net: freescale: ucc_geth: phylink conversion") Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20260114080247.366252-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 2c68d5eacc1e0f25b083bf3c3c425b0f1b45c18c Merge: 4f5f148dd7c045 8ad1b6c1e63d25 Author: Jakub Kicinski Date: Thu Jan 15 19:59:40 2026 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-13 (ice, igc) For ice: Jake adds missing initialization calls to u64_stats_init(). Dave stops deletion of VLAN 0 from prune list when device is primary LAG interface. Ding Hui adds a missed unit conversion function for proper timeout value. For igc: Kurt Kanzenbach adds a call to re-set default Qbv schedule when number of channels changes. Chwee-Lin Choong reworks Tx timestamp detection logic to resolve a race condition and reverts changes to TSN packet buffer size causing Tx hangs under heavy load. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue igc: fix race condition in TX timestamp read for register 0 igc: Restore default Qbv schedule when changing channels ice: Fix incorrect timeout ice_release_res() ice: Avoid detrimental cleanup for bond during interface stop ice: initialize ring_stats->syncp ==================== Link: https://patch.msgid.link/20260113220220.1034638-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4f5f148dd7c0459229d2ab9a769b2e820f9ee6a2 Author: Ricardo B. Marlière Date: Tue Jan 13 12:37:44 2026 -0300 selftests: net: fib-onlink-tests: Convert to use namespaces by default Currently, the test breaks if the SUT already has a default route configured for IPv6. Fix by avoiding the use of the default namespace. Fixes: 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route") Suggested-by: Fernando Fernandez Mancera Signed-off-by: Ricardo B. Marlière Reviewed-by: Ido Schimmel Reviewed-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20260113-selftests-net-fib-onlink-v2-1-89de2b931389@suse.com Signed-off-by: Jakub Kicinski commit 4d10edfd1475b69dbd4c47f34b61a3772ece83ca Author: Kuniyuki Iwashima Date: Tue Jan 13 18:54:44 2026 +0000 l2tp: Fix memleak in l2tp_udp_encap_recv(). syzbot reported memleak of struct l2tp_session, l2tp_tunnel, sock, etc. [0] The cited commit moved down the validation of the protocol version in l2tp_udp_encap_recv(). The new place requires an extra error handling to avoid the memleak. Let's call l2tp_session_put() there. [0]: BUG: memory leak unreferenced object 0xffff88810a290200 (size 512): comm "syz.0.17", pid 6086, jiffies 4294944299 hex dump (first 32 bytes): 7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00 }............... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc babb6a4f): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] __do_kmalloc_node mm/slub.c:5656 [inline] __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] l2tp_session_create+0x3a/0x3b0 net/l2tp/l2tp_core.c:1778 pppol2tp_connect+0x48b/0x920 net/l2tp/l2tp_ppp.c:755 __sys_connect_file+0x7a/0xb0 net/socket.c:2089 __sys_connect+0xde/0x110 net/socket.c:2108 __do_sys_connect net/socket.c:2114 [inline] __se_sys_connect net/socket.c:2111 [inline] __x64_sys_connect+0x1c/0x30 net/socket.c:2111 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 364798056f518 ("l2tp: Support different protocol versions with same IP/port quadruple") Reported-by: syzbot+2c42ea4485b29beb0643@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/696693f2.a70a0220.245e30.0001.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20260113185446.2533333-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6 Author: Eric Dumazet Date: Tue Jan 13 19:12:01 2026 +0000 bonding: limit BOND_MODE_8023AD to Ethernet devices BOND_MODE_8023AD makes sense for ARPHRD_ETHER only. syzbot reported: BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline] BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497 CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 __hw_addr_create net/core/dev_addr_lists.c:63 [inline] __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118 __dev_mc_add net/core/dev_addr_lists.c:868 [inline] dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886 bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963 do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165 rtnl_changelink net/core/rtnetlink.c:3776 [inline] __rtnl_newlink net/core/rtnetlink.c:3935 [inline] rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 ____sys_sendmsg+0x505/0x820 net/socket.c:2592 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646 __sys_sendmsg+0x164/0x220 net/socket.c:2678 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332 entry_SYSENTER_compat_after_hwframe+0x84/0x8e The buggy address belongs to the variable: lacpdu_mcast_addr+0x0/0x40 Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER") Reported-by: syzbot+9c081b17773615f24672@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6966946b.a70a0220.245e30.0002.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Andrew Lunn Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20260113191201.3970737-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 220d89df1da6ed95ac74883a72a5fb43abf2a586 Author: Eric Dumazet Date: Mon Jan 12 17:26:21 2026 +0000 net: add skb->data_len and (skb>end - skb->tail) to skb_dump() While working on a syzbot report, I found that skb_dump() is lacking two important parts : - skb->data_len. - (skb>end - skb->tail) tailroom is zero if skb is not linear. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260112172621.4188700-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7d7dbafefbe74f5a25efc4807af093b857a7612e Author: Ethan Nelson-Moore Date: Mon Jan 12 22:39:24 2026 -0800 net: usb: dm9601: remove broken SR9700 support The SR9700 chip sends more than one packet in a USB transaction, like the DM962x chips can optionally do, but the dm9601 driver does not support this mode, and the hardware does not have the DM962x MODE_CTL register to disable it, so this driver drops packets on SR9700 devices. The sr9700 driver correctly handles receiving more than one packet per transaction. While the dm9601 driver could be improved to handle this, the easiest way to fix this issue in the short term is to remove the SR9700 device ID from the dm9601 driver so the sr9700 driver is always used. This device ID should not have been in more than one driver to begin with. The "Fixes" commit was chosen so that the patch is automatically included in all kernels that have the sr9700 driver, even though the issue affects dm9601. Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") Signed-off-by: Ethan Nelson-Moore Acked-by: Peter Korsgaard Link: https://patch.msgid.link/20260113063924.74464-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski commit 9ad693018c8466819356771cb98f2fbe860640ca Merge: c4efd7a770c549 a63e5fe0959200 Author: Jakub Kicinski Date: Thu Jan 15 19:44:45 2026 -0800 Merge branch 'vsock-virtio-fix-data-loss-disclosure-due-to-joining-of-non-linear-skb' Michal Luczaj says: ==================== vsock/virtio: Fix data loss/disclosure due to joining of non-linear skb Loopback transport coalesces some skbs too eagerly. Handling a zerocopy (non-linear) skb as a linear one leads to skb data loss and kernel memory disclosure. Plug the loss/leak by allowing only linear skb join. Provide a test. ==================== Link: https://patch.msgid.link/20260113-vsock-recv-coalescence-v2-0-552b17837cf4@rbox.co Signed-off-by: Jakub Kicinski commit a63e5fe0959200afcfefa7640db44c491f102c4c Author: Michal Luczaj Date: Tue Jan 13 16:08:19 2026 +0100 vsock/test: Add test for a linear and non-linear skb getting coalesced Loopback transport can mangle data in rx queue when a linear skb is followed by a small MSG_ZEROCOPY packet. To exercise the logic, send out two packets: a weirdly sized one (to ensure some spare tail room in the skb) and a zerocopy one that's small enough to fit in the spare room of its predecessor. Then, wait for both to land in the rx queue, and check the data received. Faulty packets merger manifests itself by corrupting payload of the later packet. Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260113-vsock-recv-coalescence-v2-2-552b17837cf4@rbox.co Signed-off-by: Jakub Kicinski commit 0386bd321d0f95d041a7b3d7b07643411b044a96 Author: Michal Luczaj Date: Tue Jan 13 16:08:18 2026 +0100 vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them. Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory. Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb(). Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear. Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support") Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20260113-vsock-recv-coalescence-v2-1-552b17837cf4@rbox.co Signed-off-by: Jakub Kicinski commit c4efd7a770c54964bf2d8c98b2f4fd10be13dc54 Author: Simon Schippers Date: Tue Jan 13 08:51:38 2026 +0100 usbnet: fix crash due to missing BQL accounting after resume In commit 7ff14c52049e ("usbnet: Add support for Byte Queue Limits (BQL)"), it was missed that usbnet_resume() may enqueue SKBs using __skb_queue_tail() without reporting them to BQL. As a result, the next call to netdev_completed_queue() triggers a BUG_ON() in dql_completed(), since the SKBs queued during resume were never accounted for. This patch fixes the issue by adding a corresponding netdev_sent_queue() call in usbnet_resume() when SKBs are queued after suspend. Because dev->txq.lock is held at this point, no concurrent calls to netdev_sent_queue() from usbnet_start_xmit() can occur. The crash can be reproduced by generating network traffic (e.g. iperf3 -c ... -t 0), suspending the system, and then waking it up (e.g. rtcwake -m mem -s 5). When testing USB2 Android tethering (cdc_ncm), the system crashed within three suspend/resume cycles without this patch. With the patch applied, no crashes were observed after 90 cycles. Testing with an AX88179 USB Ethernet adapter also showed no crashes. Fixes: 7ff14c52049e ("usbnet: Add support for Byte Queue Limits (BQL)") Reported-by: Bard Liao Tested-by: Bard Liao Tested-by: Simon Schippers Signed-off-by: Simon Schippers Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260113075139.6735-1-simon.schippers@tu-dortmund.de Signed-off-by: Jakub Kicinski commit 8fdc61faa730e1213e925b8b2ea488d03e3510ac Author: Jonathan Cameron Date: Wed Dec 10 16:00:47 2025 +0000 soc: renesas: Fix missing dependency on new CONFIG_CACHEMAINT_FOR_DMA The Kconfig menu entry was converted to a menuconfig to allow it to be hidden for !CONFIG_RISCV. The drivers under this new option were selected by some other Kconfig symbols and so an extra select CACHEMAINT_FOR_DMA is needed. Fixes: 4d1608d0ab33 ("cache: Make top level Kconfig menu a boolean dependent on RISCV") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512100411.WxJU2No9-lkp@intel.com/ Signed-off-by: Jonathan Cameron Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251210160047.201379-3-Jonathan.Cameron@huawei.com Signed-off-by: Paul Walmsley commit 521cadb4b69e7b19cba3d926f3b3dbf0015bd8f5 Author: Jonathan Cameron Date: Wed Dec 10 16:00:46 2025 +0000 riscv: ERRATA_STARFIVE_JH7100: Fix missing dependency on new CONFIG_CACHEMAINT_FOR_DMA The Kconfig menu entry was converted to a menuconfig to allow it to be hidden for !CONFIG_RISCV. The drivers under this new option were selected by some other Kconfig symbols and so an extra select CACHEMAINT_FOR_DMA is needed. Fixes: 4d1608d0ab33 ("cache: Make top level Kconfig menu a boolean dependent on RISCV") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512100509.g6llkMMr-lkp@intel.com/ Signed-off-by: Jonathan Cameron Link: https://patch.msgid.link/20251210160047.201379-2-Jonathan.Cameron@huawei.com Signed-off-by: Paul Walmsley commit 983d014aafb14ee5e4915465bf8948e8f3a723b5 Author: Tim Bird Date: Thu Jan 15 17:04:31 2026 -0700 kernel: modules: Add SPDX license identifier to kmod.c Add a GPL-2.0 license identifier line for this file. kmod.c was originally introduced in the kernel in February of 1998 by Linus Torvalds - who was familiar with kernel licensing at the time this was introduced. Signed-off-by: Tim Bird Signed-off-by: Linus Torvalds commit a995fe1a3aa78b7d06cc1cc7b6b8436c5e93b07f Author: Danilo Krummrich Date: Wed Jan 7 11:35:05 2026 +0100 rust: driver: drop device private data post unbind Currently, the driver's device private data is allocated and initialized from driver core code called from bus abstractions after the driver's probe() callback returned the corresponding initializer. Similarly, the driver's device private data is dropped within the remove() callback of bus abstractions after calling the remove() callback of the corresponding driver. However, commit 6f61a2637abe ("rust: device: introduce Device::drvdata()") introduced an accessor for the driver's device private data for a Device, i.e. a device that is currently bound to a driver. Obviously, this is in conflict with dropping the driver's device private data in remove(), since a device can not be considered to be fully unbound after remove() has finished: We also have to consider registrations guarded by devres - such as IRQ or class device registrations - which are torn down after remove() in devres_release_all(). Thus, it can happen that, for instance, a class device or IRQ callback still calls Device::drvdata(), which then runs concurrently to remove() (which sets dev->driver_data to NULL and drops the driver's device private data), before devres_release_all() started to tear down the corresponding registration. This is because devres guarded registrations can, as expected, access the corresponding Device that defines their scope. In C it simply is the driver's responsibility to ensure that its device private data is freed after e.g. an IRQ registration is unregistered. Typically, C drivers achieve this by allocating their device private data with e.g. devm_kzalloc() before doing anything else, i.e. before e.g. registering an IRQ with devm_request_threaded_irq(), relying on the reverse order cleanup of devres. Technically, we could do something similar in Rust. However, the resulting code would be pretty messy: In Rust we have to differentiate between allocated but uninitialized memory and initialized memory in the type system. Thus, we would need to somehow keep track of whether the driver's device private data object has been initialized (i.e. probe() was successful and returned a valid initializer for this memory) and conditionally call the destructor of the corresponding object when it is freed. This is because we'd need to allocate and register the memory of the driver's device private data *before* it is initialized by the initializer returned by the driver's probe() callback, because the driver could already register devres guarded registrations within probe() outside of the driver's device private data initializer. Luckily there is a much simpler solution: Instead of dropping the driver's device private data at the end of remove(), we just drop it after the device has been fully unbound, i.e. after all devres callbacks have been processed. For this, we introduce a new post_unbind() callback private to the driver-core, i.e. the callback is neither exposed to drivers, nor to bus abstractions. This way, the driver-core code can simply continue to conditionally allocate the memory for the driver's device private data when the driver's initializer is returned from probe() - no change needed - and drop it when the driver-core code receives the post_unbind() callback. Closes: https://lore.kernel.org/all/DEZMS6Y4A7XE.XE7EUBT5SJFJ@kernel.org/ Fixes: 6f61a2637abe ("rust: device: introduce Device::drvdata()") Acked-by: Alice Ryhl Acked-by: Greg Kroah-Hartman Acked-by: Igor Korotin Link: https://patch.msgid.link/20260107103511.570525-7-dakr@kernel.org [ Remove #ifdef CONFIG_RUST, rename post_unbind() to post_unbind_rust(). - Danilo] Signed-off-by: Danilo Krummrich commit 2ad0f490c224283eb5b38f81e247000ce3c714d3 Author: Danilo Krummrich Date: Wed Jan 7 11:35:04 2026 +0100 rust: driver: add DriverData type to the DriverLayout trait Add an associated type DriverData to the DriverLayout trait indicating the type of the driver's device private data. Acked-by: Alice Ryhl Acked-by: Igor Korotin Link: https://patch.msgid.link/20260107103511.570525-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c1d4519e1c36ffa01973e23af4502e69dcd84f39 Author: Danilo Krummrich Date: Wed Jan 7 11:35:03 2026 +0100 rust: driver: add DEVICE_DRIVER_OFFSET to the DriverLayout trait Add an associated const DEVICE_DRIVER_OFFSET to the DriverLayout trait indicating the offset of the embedded struct device_driver within Self::DriverType, i.e. the specific driver structs, such as struct pci_driver or struct platform_driver. Acked-by: Alice Ryhl Acked-by: Igor Korotin Link: https://patch.msgid.link/20260107103511.570525-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 0af1a9e4629a85964a7eebe58ebd2ca37c8c21fc Author: Danilo Krummrich Date: Wed Jan 7 11:35:02 2026 +0100 rust: driver: introduce a DriverLayout trait The DriverLayout trait describes the layout of a specific driver structure, such as `struct pci_driver` or `struct platform_driver`. In a first step, this replaces the associated type RegType of the RegistrationOps with the DriverLayout::DriverType associated type. Acked-by: Alice Ryhl Acked-by: Igor Korotin Link: https://patch.msgid.link/20260107103511.570525-4-dakr@kernel.org [ Rename driver::Driver to driver::DriverLayout, as it represents the layout of a driver structure rather than the driver structure itself. - Danilo ] Signed-off-by: Danilo Krummrich commit 88e490913f079f0c0f9535e844077f9d31c369aa Merge: 603c05a1639f60 be55257fab181b Author: Linus Torvalds Date: Thu Jan 15 15:13:05 2026 -0800 Merge tag 'ftrace-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace fix from Steven Rostedt: - Fix allocation accounting on boot up The ftrace records for each function that ftrace can attach to is done in a group of pages. At boot up, the number of pages are calculated and allocated. After that, the pages are filled with data. It may allocate more than needed due to some functions not being recorded (because they are unused weak functions), this too is recorded. After the data is filled in, a check is made to make sure the right number of pages were allocated. But this was off due to the assumption that the same number of entries fit per every page. Because the size of an entry does not evenly divide into PAGE_SIZE, there is a rounding error when a large number of pages is allocated to hold the events. This causes the check to fail and triggers a warning. Fix the accounting by finding out how many pages are actually allocated from the functions that allocate them and use that to see if all the pages allocated were used and the ones not used are properly freed. * tag 'ftrace-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Do not over-allocate ftrace memory commit 627cc25f84466d557d86e5dc67b43a4eea604c80 Author: Peter Zijlstra Date: Thu Jan 15 09:27:22 2026 +0100 sched/deadline: Use ENQUEUE_MOVE to allow priority change Pierre reported hitting balance callback warnings for deadline tasks after commit 6455ad5346c9 ("sched: Move sched_class::prio_changed() into the change pattern"). It turns out that DEQUEUE_SAVE+ENQUEUE_RESTORE does not preserve DL priority and subsequently trips a balance pass -- where one was not expected. From discussion with Juri and Luca, the purpose of this clause was to deal with tasks new to DL and all those sites will have MOVE set (as well as CLASS, but MOVE is move conservative at this point). Per the previous patches MOVE is audited to always run the balance callbacks, so switch enqueue_dl_entity() to use MOVE for this case. Fixes: 6455ad5346c9 ("sched: Move sched_class::prio_changed() into the change pattern") Reported-by: Pierre Gondois Signed-off-by: Peter Zijlstra (Intel) Tested-by: Pierre Gondois Tested-by: Juri Lelli Link: https://patch.msgid.link/20260114130528.GB831285@noisy.programming.kicks-ass.net commit e008ec6c7904ed99d3b2cb634b6545b008a99288 Author: Peter Zijlstra Date: Thu Jan 15 09:25:37 2026 +0100 sched: Deadline has dynamic priority While FIFO/RR have static priority, DEADLINE is a dynamic priority scheme. Notably it has static priority -1. Do not assume the priority doesn't change for deadline tasks just because the static priority doesn't change. This ensures DL always sees {DE,EN}QUEUE_MOVE where appropriate. Fixes: ff77e4685359 ("sched/rt: Fix PI handling vs. sched_setscheduler()") Signed-off-by: Peter Zijlstra (Intel) Tested-by: Pierre Gondois Tested-by: Juri Lelli Link: https://patch.msgid.link/20260114130528.GB831285@noisy.programming.kicks-ass.net commit 53439363c0a111f11625982b69c88ee2ce8608ec Author: Peter Zijlstra Date: Thu Jan 15 09:17:49 2026 +0100 sched: Audit MOVE vs balance_callbacks The {DE,EN}QUEUE_MOVE flag indicates a task is allowed to change priority, which means there could be balance callbacks queued. Therefore audit all MOVE users and make sure they do run balance callbacks before dropping rq-lock. Fixes: 6455ad5346c9 ("sched: Move sched_class::prio_changed() into the change pattern") Signed-off-by: Peter Zijlstra (Intel) Tested-by: Pierre Gondois Tested-by: Juri Lelli Link: https://patch.msgid.link/20260114130528.GB831285@noisy.programming.kicks-ass.net commit 49041e87f9cd3e6be8926b80b3fee71e89323e1c Author: Peter Zijlstra Date: Thu Jan 15 09:16:44 2026 +0100 sched: Fold rq-pin swizzle into __balance_callbacks() Prepare for more users needing the rq-pin swizzle. Signed-off-by: Peter Zijlstra (Intel) Tested-by: Pierre Gondois Tested-by: Juri Lelli Link: https://patch.msgid.link/20260114130528.GB831285@noisy.programming.kicks-ass.net commit 4de9ff76067b40c3660df73efaea57389e62ea7a Author: Peter Zijlstra Date: Tue Jan 13 12:57:14 2026 +0100 sched/deadline: Avoid double update_rq_clock() When setup_new_dl_entity() is called from enqueue_task_dl() -> enqueue_dl_entity(), the rq-clock should already be updated, and calling update_rq_clock() again is not right. Move the update_rq_clock() to the one other caller of setup_new_dl_entity(): sched_init_dl_server(). Fixes: 9f239df55546 ("sched/deadline: Initialize dl_servers after SMP") Reported-by: Pierre Gondois Signed-off-by: Peter Zijlstra (Intel) Tested-by: Pierre Gondois Link: https://patch.msgid.link/20260113115622.GA831285@noisy.programming.kicks-ass.net commit 375410bb9a403009a44af3cc7f087090da076e09 Author: Peter Zijlstra Date: Tue Jan 6 11:41:13 2026 +0100 sched/deadline: Ensure get_prio_dl() is up-to-date Pratheek tripped a WARN and noted the following issue: > Inspecting the set of events that led to the warning being triggered > showed the following: > > systemd-1 [008] dN.31 ...: do_set_cpus_allowed: set_cpus_allowed begin! > > systemd-1 [008] dN.31 ...: sched_change_begin: Begin! > systemd-1 [008] dN.31 ...: sched_change_begin: Before dequeue_task()! > systemd-1 [008] dN.31 ...: update_curr_dl_se: update_curr_dl_se: ENQUEUE_REPLENISH > systemd-1 [008] dN.31 ...: enqueue_dl_entity: enqueue_dl_entity: ENQUEUE_REPLENISH > systemd-1 [008] dN.31 ...: replenish_dl_entity: Replenish before: 14815760217 > systemd-1 [008] dN.31 ...: replenish_dl_entity: Replenish after: 14816960047 > systemd-1 [008] dN.31 ...: sched_change_begin: Before put_prev_task()! > > systemd-1 [008] dN.31 ...: sched_change_end: Before enqueue_task()! > systemd-1 [008] dN.31 ...: sched_change_end: Before put_prev_task()! > systemd-1 [008] dN.31 ...: prio_changed_dl: Queuing pull task on prio change: 14815760217 -> 14816960047 > systemd-1 [008] dN.31 ...: prio_changed_dl: Queuing balance callback! > systemd-1 [008] dN.31 ...: sched_change_end: End! > > systemd-1 [008] dN.31 ...: do_set_cpus_allowed: set_cpus_allowed end! > systemd-1 [008] dN.21 ...: __schedule: Woops! Balance callback found! > > 1. sched_change_begin() from guard(sched_change) in > do_set_cpus_allowed() stashes the priority, which for the deadline > task, is "p->dl.deadline". > 2. The dequeue of the deadline task replenishes the deadline. > 3. The task is enqueued back after guard's scope ends and since there is > no *_CLASS flags set, sched_change_end() calls > dl_sched_class->prio_changed() which compares the deadline. > 4. Since deadline was moved on dequeue, prio_changed_dl() sees the value > differ from the stashed value and queues a balance pull callback. > 5. do_set_cpus_allowed() finishes and drops the rq_lock without doing a > do_balance_callbacks(). > 6. Grabbing the rq_lock() at subsequent __schedule() triggers the > warning since the balance pull callback was never executed before > dropping the lock. Meaning get_prio_dl() ought to update current and return an up-to-date value. Fixes: 6455ad5346c9 ("sched: Move sched_class::prio_changed() into the change pattern") Reported-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Link: https://patch.msgid.link/20260106104113.GX3707891@noisy.programming.kicks-ass.net commit 603c05a1639f60e0c52c5fdd25cf5e0b44b9bd8e Merge: bc08b6588037e8 d5811e6297f3fd Author: Linus Torvalds Date: Thu Jan 15 11:59:49 2026 -0800 Merge tag 'nfs-for-6.19-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fixes from Trond Myklebust: - Fix another deadlock involving nfs_release_folio() - localio: - Stop I/O upon hitting a fatal error - Deal with page offsets that are > PAGE_SIZE - Fix size read races in truncate, fallocate and copy offload - Several bugfixes for the NFSv4.x directory delegation client code - pNFS: - Fix a deadlock when returning delegations during open - Fix memory leaks in various error paths * tag 'nfs-for-6.19-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: Fix size read races in truncate, fallocate and copy offload NFS: Don't immediately return directory delegations when disabled NFS/localio: Deal with page bases that are > PAGE_SIZE NFS/localio: Stop further I/O upon hitting an error NFSv4.x: Directory delegations don't require any state recovery NFSv4: Don't free slots prematurely if requesting a directory delegation NFSv4: Fix nfs_clear_verifier_delegated() for delegated directories NFS: Fix directory delegation verifier checks pnfs/blocklayout: Fix memory leak in bl_parse_scsi() pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() NFS: Fix a deadlock involving nfs_release_folio() pNFS: Fix a deadlock when returning a delegation during open() commit d5811e6297f3fd9020ac31f51fc317dfdb260cb0 Author: Trond Myklebust Date: Sat Jan 10 18:53:34 2026 -0500 NFS: Fix size read races in truncate, fallocate and copy offload If the pre-operation file size is read before locking the inode and quiescing O_DIRECT writes, then nfs_truncate_last_folio() might end up overwriting valid file data. Fixes: b1817b18ff20 ("NFS: Protect against 'eof page pollution'") Signed-off-by: Trond Myklebust commit bc08b6588037e8894bcdb940c3adbc4308387353 Merge: 13b2d15d991b3f d7f1b4bdc7108b Author: Linus Torvalds Date: Thu Jan 15 11:23:24 2026 -0800 Merge tag 'efi-fixes-for-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Wipe the INITRD config table upon consumption so it doesn't confuse kexec - Let APEI/GHES maintainers take responsibility for CPER processing logic - Fix wrong return value in CPER string helper routine * tag 'efi-fixes-for-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/cper: Fix cper_bits_to_str buffer handling and return value MAINTAINERS: add cper to APEI files efi: Wipe INITRD config table from memory after consumption commit 13b2d15d991b3f0f4ebfffbed081dbff27ac1c9d Merge: 9e995c573b6345 3e8e590fd65d05 Author: Linus Torvalds Date: Thu Jan 15 10:47:14 2026 -0800 Merge tag 'mm-hotfixes-stable-2026-01-15-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: - kerneldoc fixes from Bagas Sanjaya - DAMON fixes from SeongJae - mremap VMA-related fixes from Lorenzo - various singletons - please see the changelogs for details * tag 'mm-hotfixes-stable-2026-01-15-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (30 commits) drivers/dax: add some missing kerneldoc comment fields for struct dev_dax mm: numa,memblock: include for 'numa_nodes_parsed' mailmap: add entry for Daniel Thompson tools/testing/selftests: fix gup_longterm for unknown fs mm/page_alloc: prevent pcp corruption with SMP=n iommu/sva: include mmu_notifier.h header mm: kmsan: fix poisoning of high-order non-compound pages tools/testing/selftests: add forked (un)/faulted VMA merge tests mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too tools/testing/selftests: add tests for !tgt, src mremap() merges mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure mm/damon/sysfs: cleanup intervals subdirs on attrs dir setup failure mm/damon/core: remove call_control in inactive contexts powerpc/watchdog: add support for hardlockup_sys_info sysctl mips: fix HIGHMEM initialization mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported ... commit 9e995c573b63453a904f3157813dc8cde4a6aba4 Merge: 944aacb68baf76 851822aec1a335 Author: Linus Torvalds Date: Thu Jan 15 10:11:11 2026 -0800 Merge tag 'net-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth, can and IPsec. Current release - regressions: - net: add net.core.qdisc_max_burst - can: propagate CAN device capabilities via ml_priv Previous releases - regressions: - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - ipv6: fix use-after-free in inet6_addr_del(). - xfrm: fix inner mode lookup in tunnel mode GSO segmentation - ip_tunnel: spread netdev_lockdep_set_classes() - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - bluetooth: hci_sync: enable PA sync lost event - eth: virtio-net: - fix the deadlock when disabling rx NAPI - fix misalignment bug in struct virtnet_info Previous releases - always broken: - ipv4: ip_gre: make ipgre_header() robust - can: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - eth: - mlx5e: profile change fix - octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback - macvlan: fix possible UAF in macvlan_forward_source()" * tag 'net-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (37 commits) virtio_net: Fix misalignment bug in struct virtnet_info net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts can: raw: instantly reject disabled CAN frames can: propagate CAN device capabilities via ml_priv Revert "can: raw: instantly reject unsupported CAN frames" net/sched: sch_qfq: do not free existing class in qfq_change_class() selftests: drv-net: fix RPS mask handling for high CPU numbers selftests: drv-net: fix RPS mask handling in toeplitz test ipv6: Fix use-after-free in inet6_addr_del(). dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() net: hv_netvsc: reject RSS hash key programming without RX indirection table tools: ynl: render event op docs correctly net: add net.core.qdisc_max_burst net: airoha: Fix typo in airoha_ppe_setup_tc_block_cb definition net: phy: motorcomm: fix duplex setting error for phy leds net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback net/mlx5e: Restore destroying state bit after profile cleanup net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv net/mlx5e: Fix crash on profile change rollback failure ... commit 4ead53ba5071334e9c97e0fc358136016531cbd1 Merge: 1902e2eae5ce25 56e7cc8dadf91c Author: Arnd Bergmann Date: Thu Jan 15 17:59:16 2026 +0100 Merge tag 'v6.19-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes In terms of bigger fixes, RK3576 GPU register range was overflowing into the next peripheral, Nano Pi M5 sound was not working correctly, the adc-keys voltage levels for 2 buttons on the Pinephone Pro were wrong and a really wrong PCIe linkspeed was removed from helios64. Apart from that there are a number of dt-cleanlieness fixes. * tag 'v6.19-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Drop unsupported properties arm64: dts: rockchip: Fix gpio pinctrl node names arm64: dts: rockchip: Fix pinctrl property typo on rk3326-odroid-go3 arm64: dts: rockchip: Drop "sitronix,st7789v" fallback compatible from rk3568-wolfvision arm64: dts: rockchip: Fix wrong register range of rk3576 gpu arm64: dts: rockchip: Configure MCLK for analog sound on NanoPi M5 arm64: dts: rockchip: Fix headphones widget name on NanoPi M5 arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s arm64: dts: rockchip: remove dangerous max-link-speed from helios64 arm64: dts: rockchip: fix unit-address for RK3588 NPU's core1 and core2's IOMMU arm64: dts: rockchip: Fix wifi interrupts flag on Sakura Pi RK3308B arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro Signed-off-by: Arnd Bergmann commit 1902e2eae5ce25b3211aaaa9a18de613c8999ec5 Merge: 8bb9fd440aec08 94ad504e67cd3b Author: Arnd Bergmann Date: Thu Jan 15 17:45:07 2026 +0100 Merge tag 'at91-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v6.19 This update includes: - fix access to the PHYs on the Microchip LAN966X PCB8290 board - fix the ranges DT property for flexcom9 on the Microchip SAMA7D65 SoC - fix the #size-cells DT property for i2c3 on the Microchip SAMA7D65 SoC * tag 'at91-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sama7d65: fix size-cells property for i2c3 ARM: dts: microchip: sama7d65: fix the ranges property for flx9 ARM: dts: microchip: lan966x: Fix the access to the PHYs for pcb8290 Signed-off-by: Arnd Bergmann commit 8bb9fd440aec080f69d54697d069c295940aa995 Author: Yixun Lan Date: Thu Jan 15 10:03:35 2026 +0800 MAINTAINERS: update email address for Yixun Lan Switch my email address to kernel.org account for more convenience. Also add entries to the mailmap. Signed-off-by: Yixun Lan Link: https://lore.kernel.org/r/20260115-11-maintainer-dlan-v1-1-64bb698da846@kernel.org Signed-off-by: Arnd Bergmann commit 2150467fc61ddb473145ace99afdcde88b54af8e Author: Jon Hunter Date: Wed Dec 17 10:47:44 2025 +0000 Revert "arm64: tegra: Add interconnect properties for Tegra210" Commit 59a42707a094 ("arm64: tegra: Add interconnect properties for Tegra210") populated interconnect properties for Tegra210 and this is preventing the Tegra DRM driver from probing successfully. The following error is observed on boot ... drm drm: failed to initialize 54240000.dc: -517 For now revert this change, until a fix is available. Fixes: 59a42707a094 ("arm64: tegra: Add interconnect properties for Tegra210") Signed-off-by: Jon Hunter Acked-by: Thierry Reding Signed-off-by: Arnd Bergmann commit be55257fab181b93af38f8c4b1b3cb453a78d742 Author: Guenter Roeck Date: Tue Jan 13 07:22:42 2026 -0800 ftrace: Do not over-allocate ftrace memory The pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group. However, ENTRIES_PER_PAGE is PAGE_SIZE / ENTRY_SIZE (integer division). When PAGE_SIZE is not a multiple of ENTRY_SIZE (e.g. 4096 / 24 = 170 with remainder 16), high-order allocations (like 256 pages) have significantly more capacity than 256 * 170. This leads to pg_remaining being underestimated, which in turn makes skip (derived from skipped - pg_remaining) larger than expected, causing the WARN(skip != remaining) to trigger. Extra allocated pages for ftrace: 2 with 654 skipped WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7295 ftrace_process_locs+0x5bf/0x5e0 A similar problem in ftrace_allocate_records() can result in allocating too many pages. This can trigger the second warning in ftrace_process_locs(). Extra allocated pages for ftrace WARNING: CPU: 0 PID: 0 at kernel/trace/ftrace.c:7276 ftrace_process_locs+0x548/0x580 Use the actual capacity of a page group to determine the number of pages to allocate. Have ftrace_allocate_pages() return the number of allocated pages to avoid having to calculate it. Use the actual page group capacity when validating the number of unused pages due to skipped entries. Drop the definition of ENTRIES_PER_PAGE since it is no longer used. Cc: stable@vger.kernel.org Fixes: 4a3efc6baff93 ("ftrace: Update the mcount_loc check of skipped entries") Link: https://patch.msgid.link/20260113152243.3557219-1-linux@roeck-us.net Signed-off-by: Guenter Roeck Signed-off-by: Steven Rostedt (Google) commit ec19ed2b3e2af8ec5380400cdee9cb6560144506 Author: Chaitanya Kulkarni Date: Mon Jan 12 15:19:28 2026 -0800 rnbd-clt: fix refcount underflow in device unmap path During device unmapping (triggered by module unload or explicit unmap), a refcount underflow occurs causing a use-after-free warning: [14747.574913] ------------[ cut here ]------------ [14747.574916] refcount_t: underflow; use-after-free. [14747.574917] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x55/0x90, CPU#9: kworker/9:1/378 [14747.574924] Modules linked in: rnbd_client(-) rtrs_client rnbd_server rtrs_server rtrs_core ... [14747.574998] CPU: 9 UID: 0 PID: 378 Comm: kworker/9:1 Tainted: G O N 6.19.0-rc3lblk-fnext+ #42 PREEMPT(voluntary) [14747.575005] Workqueue: rnbd_clt_wq unmap_device_work [rnbd_client] [14747.575010] RIP: 0010:refcount_warn_saturate+0x55/0x90 [14747.575037] Call Trace: [14747.575038] [14747.575038] rnbd_clt_unmap_device+0x170/0x1d0 [rnbd_client] [14747.575044] process_one_work+0x211/0x600 [14747.575052] worker_thread+0x184/0x330 [14747.575055] ? __pfx_worker_thread+0x10/0x10 [14747.575058] kthread+0x10d/0x250 [14747.575062] ? __pfx_kthread+0x10/0x10 [14747.575066] ret_from_fork+0x319/0x390 [14747.575069] ? __pfx_kthread+0x10/0x10 [14747.575072] ret_from_fork_asm+0x1a/0x30 [14747.575083] [14747.575096] ---[ end trace 0000000000000000 ]--- Befor this patch :- The bug is a double kobject_put() on dev->kobj during device cleanup. Kobject Lifecycle: kobject_init_and_add() sets kobj.kref = 1 (initialization) kobject_put() sets kobj.kref = 0 (should be called once) * Before this patch: rnbd_clt_unmap_device() rnbd_destroy_sysfs() kobject_del(&dev->kobj) [remove from sysfs] kobject_put(&dev->kobj) PUT #1 (WRONG!) kref: 1 to 0 rnbd_dev_release() kfree(dev) [DEVICE FREED!] rnbd_destroy_gen_disk() [use-after-free!] rnbd_clt_put_dev() refcount_dec_and_test(&dev->refcount) kobject_put(&dev->kobj) PUT #2 (UNDERFLOW!) kref: 0 to -1 [WARNING!] The first kobject_put() in rnbd_destroy_sysfs() prematurely frees the device via rnbd_dev_release(), then the second kobject_put() in rnbd_clt_put_dev() causes refcount underflow. * After this patch :- Remove kobject_put() from rnbd_destroy_sysfs(). This function should only remove sysfs visibility (kobject_del), not manage object lifetime. Call Graph (FIXED): rnbd_clt_unmap_device() rnbd_destroy_sysfs() kobject_del(&dev->kobj) [remove from sysfs only] [kref unchanged: 1] rnbd_destroy_gen_disk() [device still valid] rnbd_clt_put_dev() refcount_dec_and_test(&dev->refcount) kobject_put(&dev->kobj) ONLY PUT (CORRECT!) kref: 1 to 0 [BALANCED] rnbd_dev_release() kfree(dev) [CLEAN DESTRUCTION] This follows the kernel pattern where sysfs removal (kobject_del) is separate from object destruction (kobject_put). Fixes: 581cf833cac4 ("block: rnbd: add .release to rnbd_dev_ktype") Signed-off-by: Chaitanya Kulkarni Acked-by: Jack Wang Reviewed-by: Jack Wang Signed-off-by: Jens Axboe commit caa329649259d0f90c0056c9860ca659d4ba3211 Author: Alan Borzeszkowski Date: Thu Jan 15 13:03:05 2026 +0100 spi: intel-pci: Add support for Nova Lake SPI serial flash Add Intel Nova Lake PCH-S SPI serial flash PCI ID to the list of supported devices. This is the same controller found in previous generations. Signed-off-by: Alan Borzeszkowski Acked-by: Mika Westerberg Link: https://patch.msgid.link/20260115120305.10080-1-alan.borzeszkowski@linux.intel.com Signed-off-by: Mark Brown commit f6b625639e39bc384a7bddbf134a698d40258b3b Author: Jun Guo Date: Thu Jan 15 17:19:24 2026 +0800 spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX During an SPI read operation, even if the xspi->txbuf passed to the cdns_spi_writerinterface is empty, it is still necessary to call cdns_spi_write(xspi, CDNS_SPI_TXD, txw); otherwise, the read operation will fail to obtain data correctly due to a lack of clocks. Fixes: 4e00135b2dd1 ("spi: spi-cadence: supports transmission with bits_per_word of 16 and 32") Reported-by: Rodrigo Alencar <455.rodrigo.alencar@gmail.com> Closes: https://lore.kernel.org/all/lbijvnnwsnddonmm5pveqzap6iibxhl4maneq43x4j6w64dev6@u75qhm5cwiob/ Signed-off-by: Jun Guo Link: https://patch.msgid.link/20260115091924.844179-1-jun.guo@cixtech.com Signed-off-by: Mark Brown commit 46b8d0888f01f250fbd24d00ff80b755c3c42cd4 Author: Shenghao Ding Date: Thu Jan 15 20:49:06 2026 +0800 ALSA: hda/tas2781: Add newly-released HP laptop HP released the new laptop with the subid 0x103C. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20260115124907.629-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit f2161d5f1aae21a42b0a64d87e10cb31db423f42 Merge: ab2be3af8c4ea5 be5a39e7994ec9 Author: Takashi Iwai Date: Thu Jan 15 15:01:32 2026 +0100 Merge tag 'asoc-fix-v6.19-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A moderately large collection of fixes since I missed a week, plus a few new device IDs and quirks. It's all fairly minor, including a bunch of work on the device tree bindings fixes which have no runtime effect. There's one SoundWire change here exporting a symbol which was required for a fix to the ASoC SoundWire code. commit f7fffd2e3f92ff526bf3a620e5bdd58bbbb96ccd Author: Denis Benato Date: Sat Jan 3 00:43:43 2026 +0100 platform/x86: asus-wmi: fix sending OOBE at probe Disabling OOBE is an important step to be able to fully control the hardware in TUF laptops that requires this command, but the command has been incorrectly tied to deprecated attributes: restore sending the OOBE exit command. Fixes: c683651b6791 ("platform/x86: asus-wmi: deprecate bios features") Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260102234344.366227-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8ba4e0598d127f46f9ac74b8c54456a470ce685e Author: Denis Benato Date: Mon Jan 12 22:50:38 2026 +0100 platform/x86: asus-armoury: add support for FA617XT Add TDP data for laptop model FA617XT. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260112215038.575883-4-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a06bb57b2e71d57c11054ba90b956c39210fcd67 Author: Denis Benato Date: Mon Jan 12 22:50:37 2026 +0100 platform/x86: asus-armoury: add support for FA401UV Add TDP data for laptop model FA401UV. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260112215038.575883-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e11e3e801193d149d0e322e0764778477337d731 Author: Denis Benato Date: Mon Jan 12 22:50:36 2026 +0100 platform/x86: asus-armoury: add support for GV302XV Add TDP data for laptop model GV302XV. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260112215038.575883-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2e91919a67953609d34786807697410a6ffb760e Author: Shresth Sarthak Awasthi Date: Fri Jan 9 18:35:57 2026 +0530 platform/x86: asus-armoury: Add power limits for Asus G513QY Add the DMI entry and power limits for the Asus ROG Strix G15 Advantage Edition (G513QY). This laptop requires manual fan curves and specific APU/Platform PPT limits. Signed-off-by: Shresth Sarthak Awasthi Link: https://patch.msgid.link/20260109130557.78720-1-bengdeeba@gmail.com Signed-off-by: Ilpo Järvinen commit 2bf1877b7094c684e1d652cac6912cfbc507ad3e Author: Zilin Guan Date: Tue Jan 6 09:13:17 2026 +0000 platform/x86/amd: Fix memory leak in wbrf_record() The tmp buffer is allocated using kcalloc() but is not freed if acpi_evaluate_dsm() fails. This causes a memory leak in the error path. Fix this by explicitly freeing the tmp buffer in the error handling path of acpi_evaluate_dsm(). Fixes: 58e82a62669d ("platform/x86/amd: Add support for AMD ACPI based Wifi band RFI mitigation feature") Suggested-by: Ilpo Järvinen Co-developed-by: Jianhao Xu Signed-off-by: Jianhao Xu Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20260106091318.747019-1-zilin@seu.edu.cn Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3113bcf4ccf06c938f0bc0c34cf6efe03278badc Author: Oleksandr Shamray Date: Wed Jan 7 16:25:48 2026 +0200 platform/mellanox: Fix SN5640/SN5610 LED platform data In SN5640/SN5610 platforms should be used XDR style LED data with predefined slot index per led_fan. Fixes: 317bbe169c46 ("platform: mellanox: mlx-platform: Add support for new Nvidia system") Signed-off-by: Oleksandr Shamray Reviewed-by: Vadim Pasternak Link: https://patch.msgid.link/20260107142548.916556-1-oleksandrs@nvidia.com Signed-off-by: Ilpo Järvinen commit 861d21c43c98478eef70e68e31d4ff86400c6ef7 Author: Frank Zhang Date: Tue Dec 16 13:52:47 2025 +0800 pmdomain:rockchip: Fix init genpd as GENPD_STATE_ON before regulator ready RK3588_PD_NPU initialize as GENPD_STATE_ON before regulator ready. rknn_iommu initlized success and suspend RK3588_PD_NPU. When rocket driver register, it will resume rknn_iommu. If regulator is still not ready at this point, rknn_iommu resume fail, pm runtime status will be error: -EPROBE_DEFER. This patch set pmdomain to off if it need regulator during probe, consumer device can power on pmdomain after regulator ready. Signed-off-by: Frank Zhang Tested-by: Chaoyi Chen Tested-by: Quentin Schulz Reviewed-by: Sebastian Reichel Fixes: db6df2e3fc16 ("pmdomain: rockchip: add regulator support") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 851822aec1a3359ecb7a4767d7f4a32336043c2f Merge: 5ce234a8fe0579 1809c82aa073a1 Author: Paolo Abeni Date: Thu Jan 15 13:13:01 2026 +0100 Merge tag 'linux-can-fixes-for-6.19-20260115' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-01-15 this is a pull request of 4 patches for net/main, it super-seeds the "can 2026-01-14" pull request. The dev refcount leak in patch #3 is fixed. The first 3 patches are by Oliver Hartkopp and revert the approach to instantly reject unsupported CAN frames introduced in net-next-for-v6.19 and replace it by placing the needed data into the CAN specific ml_priv. The last patch is by Tetsuo Handa and fixes a J1939 refcount leak for j1939_session in session deactivation upon receiving the second RTS. linux-can-fixes-for-6.19-20260115 * tag 'linux-can-fixes-for-6.19-20260115' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts can: raw: instantly reject disabled CAN frames can: propagate CAN device capabilities via ml_priv Revert "can: raw: instantly reject unsupported CAN frames" ==================== Link: https://patch.msgid.link/20260115090603.1124860-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit 5ce234a8fe05798b5e6c1dff674776dab933b43b Merge: 4156c3745f06bc c196def07bbc6e Author: Paolo Abeni Date: Thu Jan 15 12:46:12 2026 +0100 Merge tag 'ipsec-2026-01-14' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2026-01-14 1) Fix inner mode lookup in tunnel mode GSO segmentation. The protocol was taken from the wrong field. 2) Set ipv4 no_pmtu_disc flag only on output SAs. The insertation of input SAs can fail if no_pmtu_disc is set. Please pull or let me know if there are problems. ipsec-2026-01-14 * tag 'ipsec-2026-01-14' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set xfrm: Fix inner mode lookup in tunnel mode GSO segmentation ==================== Link: https://patch.msgid.link/20260114121817.1106134-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit be5a39e7994ec9f003c8569b670c794a4e5d1551 Author: Mark Brown Date: Wed Jan 14 22:08:35 2026 +0000 ASoC: rt5640: Fix duplicate clock properties in DT binding Not quite overlapping changes to the rt5640 binding resulted in duplicate definitions of the clocks and clock-names properties. Delete one of them, preferring the simpler one. Reported-by: Jon Hunter Closes: https://lore.kernel.org/r/0e68c5f4-f68d-4544-bc7a-40694829db75@nvidia.com Signed-off-by: Mark Brown Link: https://patch.msgid.link/20260114-asoc-fix-rt5640-dt-clocks-v1-1-421d438673c2@kernel.org Signed-off-by: Mark Brown commit 0d26ca8ec461c01f682402f73a89643f4fefbbb3 Author: Huacai Chen Date: Thu Jan 15 18:50:48 2026 +0800 LoongArch: Remove redundant code in head.S SETUP_MODES already setup the initial values of CSR.CRMD, CSR.PRMD and CSR.EUEN, so the redundant open code can be removed. Fixes: 7b2afeafaf9c2d5 ("LoongArch: Adjust boot & setup for 32BIT/64BIT") Signed-off-by: Huacai Chen commit ab2be3af8c4ea57f779474cd2a2fe8dd4ad537a6 Author: Zhang Heng Date: Thu Jan 15 09:58:44 2026 +0800 ALSA: hda/realtek: Add quirk for HP Pavilion x360 to enable mute LED This quirk enables mute LED on HP Pavilion x360 2-in-1 Laptop 14-ek0xxx, which use ALC245 codec. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220220 Cc: Signed-off-by: Zhang Heng Link: https://patch.msgid.link/20260115015844.3129890-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai commit 4156c3745f06bc197094b9ee97a9584e69ed00bf Author: Gustavo A. R. Silva Date: Sat Jan 10 17:07:17 2026 +0900 virtio_net: Fix misalignment bug in struct virtnet_info Use the new TRAILING_OVERLAP() helper to fix a misalignment bug along with the following warning: drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it (in this case `u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];`). This overlays the trailing members (rss_hash_key_data) onto the FAM (hash_key_data) while keeping the FAM and the start of MEMBERS aligned. The static_assert() ensures this alignment remains. Notice that due to tail padding in flexible `struct virtio_net_rss_config_trailer`, `rss_trailer.hash_key_data` (at offset 83 in struct virtnet_info) and `rss_hash_key_data` (at offset 84 in struct virtnet_info) are misaligned by one byte. See below: struct virtio_net_rss_config_trailer { __le16 max_tx_vq; /* 0 2 */ __u8 hash_key_length; /* 2 1 */ __u8 hash_key_data[]; /* 3 0 */ /* size: 4, cachelines: 1, members: 3 */ /* padding: 1 */ /* last cacheline: 4 bytes */ }; struct virtnet_info { ... struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */ /* XXX last struct has 1 byte of padding */ u8 rss_hash_key_data[40]; /* 84 40 */ ... /* size: 832, cachelines: 13, members: 48 */ /* sum members: 801, holes: 8, sum holes: 31 */ /* paddings: 2, sum paddings: 5 */ }; After changes, those members are correctly aligned at offset 795: struct virtnet_info { ... union { struct virtio_net_rss_config_trailer rss_trailer; /* 792 4 */ struct { unsigned char __offset_to_hash_key_data[3]; /* 792 3 */ u8 rss_hash_key_data[40]; /* 795 40 */ }; /* 792 43 */ }; /* 792 44 */ ... /* size: 840, cachelines: 14, members: 47 */ /* sum members: 801, holes: 8, sum holes: 35 */ /* padding: 4 */ /* paddings: 1, sum paddings: 4 */ /* last cacheline: 8 bytes */ }; As a result, the RSS key passed to the device is shifted by 1 byte: the last byte is cut off, and instead a (possibly uninitialized) byte is added at the beginning. As a last note `struct virtio_net_rss_config_hdr *rss_hdr;` is also moved to the end, since it seems those three members should stick around together. :) Cc: stable@vger.kernel.org Fixes: ed3100e90d0d ("virtio_net: Use new RSS config structs") Signed-off-by: Gustavo A. R. Silva Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/aWIItWq5dV9XTTCJ@kspp Signed-off-by: Paolo Abeni commit 1809c82aa073a11b7d335ae932d81ce51a588a4a Author: Tetsuo Handa Date: Wed Jan 14 00:28:47 2026 +0900 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when the timer is enabled, we need to call j1939_session_deactivate_activate_next() if we cancelled the timer. Otherwise, refcount for j1939_session leaks, which will later appear as | unregister_netdevice: waiting for vcan0 to become free. Usage count = 2. problem. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Signed-off-by: Tetsuo Handa Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Link: https://patch.msgid.link/b1212653-8fa1-44e1-be9d-12f950fb3a07@I-love.SAKURA.ne.jp Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 6c1f5146b214f281a04ceeff7608845f1818c4f2 Merge: 3879cffd9d07aa faba5860fcf9a0 Author: Marc Kleine-Budde Date: Thu Jan 15 09:52:34 2026 +0100 Merge patch series "can: raw: better approach to instantly reject unsupported CAN frames" Oliver Hartkopp says: This series reverts commit 1a620a723853 ("can: raw: instantly reject unsupported CAN frames"). and its follow-up fixes for the introduced dependency issues. commit 1a620a723853 ("can: raw: instantly reject unsupported CAN frames") commit cb2dc6d2869a ("can: Kconfig: select CAN driver infrastructure by default") commit 6abd4577bccc ("can: fix build dependency") commit 5a5aff6338c0 ("can: fix build dependency") The reverted patch was accessing CAN device internal data structures from the network layer because it needs to know about the CAN protocol capabilities of the CAN devices. This data access caused build problems between the CAN network and the CAN driver layer which introduced unwanted Kconfig dependencies and fixes. The patches 2 & 3 implement a better approach which makes use of the CAN specific ml_priv data which is accessible from both sides. With this change the CAN network layer can check the required features and the decoupling of the driver layer and network layer is restored. Link: https://patch.msgid.link/20260109144135.8495-1-socketcan@hartkopp.net [mkl: give series a more descriptive name] [mkl: properly format reverted patch commitish] Signed-off-by: Marc Kleine-Budde commit faba5860fcf9a0ae49d2e484397bce44293367ff Author: Oliver Hartkopp Date: Fri Jan 9 15:41:35 2026 +0100 can: raw: instantly reject disabled CAN frames For real CAN interfaces the CAN_CTRLMODE_FD and CAN_CTRLMODE_XL control modes indicate whether an interface can handle those CAN FD/XL frames. In the case a CAN XL interface is configured in CANXL-only mode with disabled error-signalling neither CAN CC nor CAN FD frames can be sent. The checks are now performed on CAN_RAW sockets to give an instant feedback to the user when writing unsupported CAN frames to the interface or when the CAN interface is in read-only mode. Fixes: 1a620a723853 ("can: raw: instantly reject unsupported CAN frames") Cc: Marc Kleine-Budde Cc: Arnd Bergmann Cc: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260109144135.8495-4-socketcan@hartkopp.net [mkl: fix dev reference leak] Link: https://lore.kernel.org/all/0636c732-2e71-4633-8005-dfa85e1da445@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 166e87329ce6f1eaa3475ba2d14ed30e54727c0d Author: Oliver Hartkopp Date: Fri Jan 9 15:41:34 2026 +0100 can: propagate CAN device capabilities via ml_priv Commit 1a620a723853 ("can: raw: instantly reject unsupported CAN frames") caused a sequence of dependency and linker fixes. Instead of accessing CAN device internal data structures which caused the dependency problems this patch introduces capability information into the CAN specific ml_priv data which is accessible from both sides. With this change the CAN network layer can check the required features and the decoupling of the driver layer and network layer is restored. Fixes: 1a620a723853 ("can: raw: instantly reject unsupported CAN frames") Cc: Marc Kleine-Budde Cc: Arnd Bergmann Cc: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260109144135.8495-3-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 4650ff58a1b9ee68b2d3a207047998dd42e939b2 Author: Oliver Hartkopp Date: Fri Jan 9 15:41:33 2026 +0100 Revert "can: raw: instantly reject unsupported CAN frames" This reverts commit 1a620a723853a0f49703c317d52dc6b9602cbaa8 and its follow-up fixes for the introduced dependency issues. commit 1a620a723853 ("can: raw: instantly reject unsupported CAN frames") commit cb2dc6d2869a ("can: Kconfig: select CAN driver infrastructure by default") commit 6abd4577bccc ("can: fix build dependency") commit 5a5aff6338c0 ("can: fix build dependency") The entire problem was caused by the requirement that a new network layer feature needed to know about the protocol capabilities of the CAN devices. Instead of accessing CAN device internal data structures which caused the dependency problems a better approach has been developed which makes use of CAN specific ml_priv data which is accessible from both sides. Cc: Marc Kleine-Budde Cc: Arnd Bergmann Cc: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260109144135.8495-2-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 12ffd561d2de28825f39e15e8d22346d26b09688 Author: Anirudh Rayabharam (Microsoft) Date: Mon Jan 5 12:28:37 2026 +0000 mshv: handle gpa intercepts for arm64 The mshv driver now uses movable pages for guests. For arm64 guests to be functional, handle gpa intercepts for arm64 too (the current code implements handling only for x86). Move some arch-agnostic functions out of #ifdefs so that they can be re-used. Fixes: b9a66cd5ccbb ("mshv: Add support for movable memory regions") Signed-off-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit 69c88a6a49cfe1fd6bd5c1166d02a7dd29de9569 Author: Anirudh Rayabharam (Microsoft) Date: Mon Jan 5 12:28:36 2026 +0000 mshv: add definitions for arm64 gpa intercepts Add definitions required for handling GPA intercepts on arm64. Signed-off-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit d2999c0fbcb2a84b0994ad3ec0d30c190ccd5e67 Author: Michael Kelley Date: Wed Jan 14 10:15:08 2026 -0800 mshv: Add __user attribute to argument passed to access_ok() access_ok() expects its first argument to have the __user attribute since it is checking access to user space. Current code passes an argument that lacks that attribute, resulting in 'sparse' flagging the incorrect usage. However, the compiler doesn't generate code based on the attribute, so there's no actual bug. In the interest of general correctness and to avoid noise from sparse, add the __user attribute. No functional change. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512141339.791TCKnB-lkp@intel.com/ Signed-off-by: Michael Kelley Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit e020f604abaa6da9b7d579d9d73ffaf37072f520 Author: Michael Kelley Date: Wed Jan 14 09:01:12 2026 -0800 mshv: Store the result of vfs_poll in a variable of type __poll_t vfs_poll() returns a result of type __poll_t, but current code is using an "unsigned int" local variable. The difference is that __poll_t carries the "bitwise" attribute. This attribute is not interpreted by the C compiler; it is only used by 'sparse' to flag incorrect usage of the return value. The return value is used correctly here, so there's no bug, but sparse complains about the type mismatch. In the interest of general correctness and to avoid noise from sparse, change the local variable to type __poll_t. No functional change. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512141339.791TCKnB-lkp@intel.com/ Signed-off-by: Michael Kelley Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 259add0d982cbe83170f0c2a9f160834f0f83dd4 Author: Stanislav Kinsburskii Date: Wed Jan 7 18:45:43 2026 +0000 mshv: Align huge page stride with guest mapping Ensure that a stride larger than 1 (huge page) is only used when page points to a head of a huge page and both the guest frame number (gfn) and the operation size (page_count) are aligned to the huge page size (PTRS_PER_PMD). This matches the hypervisor requirement that map/unmap operations for huge pages must be guest-aligned and cover a full huge page. Add mshv_chunk_stride() to encapsulate this alignment and page-order validation, and plumb a huge_page flag into the region chunk handlers. This prevents issuing large-page map/unmap/share operations that the hypervisor would reject due to misaligned guest mappings. Fixes: abceb4297bf8 ("mshv: Fix huge page handling in memory region traversal") Signed-off-by: Stanislav Kinsburskii Reviewed-by: Nuno Das Neves Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 49f49d47af67f8a7b221db1d758fc634242dc91a Author: Michael Kelley Date: Wed Dec 31 12:14:47 2025 -0800 Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() hv_kmsg_dump() currently skips the panic notification entirely if it doesn't get any message bytes to pass to Hyper-V due to an error from kmsg_dump_get_buffer(). Skipping the notification is undesirable because it leaves the Hyper-V host uncertain about the state of a panic'ed guest. Fix this by always doing the panic notification, even if bytes_written is zero. Also ensure that bytes_written is initialized, which fixes a kernel test robot warning. The warning is actually bogus because kmsg_dump_get_buffer() happens to set bytes_written even if it fails, and in the kernel test robot's CONFIG_PRINTK not set case, hv_kmsg_dump() is never called. But do the initialization for robustness and to quiet the static checker. Fixes: 9c318a1d9b50 ("Drivers: hv: move panic report code from vmbus to hv early init code") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/202512172103.OcUspn1Z-lkp@intel.com/ Signed-off-by: Michael Kelley Reviewed-by: Roman Kisel Signed-off-by: Wei Liu commit fc558188f251f5df6dd11ac409d668733d9baac7 Author: Julia Lawall Date: Tue Dec 30 15:14:14 2025 +0100 Drivers: hv: vmbus: fix typo in function name reference Replace cmxchg by cmpxchg. Signed-off-by: Julia Lawall Reviewed-by: Roman Kisel Signed-off-by: Wei Liu commit 3e8e590fd65d0572584ab7bba89a35e6d19931f1 Author: John Groves Date: Sat Jan 10 13:18:04 2026 -0600 drivers/dax: add some missing kerneldoc comment fields for struct dev_dax Add the missing @align and @memmap_on_memory fields to kerneldoc comment header for struct dev_dax. Also, some other fields were followed by '-' and others by ':'. Fix all to be ':' for actual kerneldoc compliance. Link: https://lkml.kernel.org/r/20260110191804.5739-1-john@groves.net Fixes: 33cf94d71766 ("device-dax: make align a per-device property") Fixes: 4eca0ef49af9 ("dax/kmem: allow kmem to add memory with memmap_on_memory") Signed-off-by: John Groves Cc: Dan Williams Cc: Joao Martins Cc: Vishal Verma Signed-off-by: Andrew Morton commit f46c26f1bcd9164d7f3377f15ca75488a3e44362 Author: Ben Dooks Date: Thu Jan 8 10:15:39 2026 +0000 mm: numa,memblock: include for 'numa_nodes_parsed' The 'numa_nodes_parsed' is defined in but this file is not included in mm/numa_memblks.c (build x86_64) so add this to the incldues to fix the following sparse warning: mm/numa_memblks.c:13:12: warning: symbol 'numa_nodes_parsed' was not declared. Should it be static? Link: https://lkml.kernel.org/r/20260108101539.229192-1-ben.dooks@codethink.co.uk Fixes: 87482708210f ("mm: introduce numa_memblks") Signed-off-by: Ben Dooks Reviewed-by: Mike Rapoport (Microsoft) Cc: Ben Dooks Cc: Signed-off-by: Andrew Morton commit 18e87bceae6cdeceb9d31803bf81e2968073c191 Author: Daniel Thompson Date: Thu Jan 8 11:09:54 2026 +0000 mailmap: add entry for Daniel Thompson My linaro address stopped working a long time ago but I didn't update my mailmap entry. Fix that. Link: https://lkml.kernel.org/r/20260108-mailmap-daniel_thompson_linaro-org-v1-1-83f610876377@kernel.org Signed-off-by: Daniel Thompson Signed-off-by: Andrew Morton commit 21c68ad1d9771d331198cc73cbf6e908d7915f35 Author: Lorenzo Stoakes Date: Tue Jan 6 15:45:47 2026 +0000 tools/testing/selftests: fix gup_longterm for unknown fs Commit 66bce7afbaca ("selftests/mm: fix test result reporting in gup_longterm") introduced a small bug causing unknown filesystems to always result in a test failure. This is because do_test() was updated to use a common reporting path, but this case appears to have been missed. This is problematic for e.g. virtme-ng which uses an overlayfs file system, causing gup_longterm to appear to fail each time due to a test count mismatch: # Planned tests != run tests (50 != 46) # Totals: pass:24 fail:0 xfail:0 xpass:0 skip:22 error:0 The fix is to simply change the return into a break. Link: https://lkml.kernel.org/r/20260106154547.214907-1-lorenzo.stoakes@oracle.com Fixes: 66bce7afbaca ("selftests/mm: fix test result reporting in gup_longterm") Signed-off-by: Lorenzo Stoakes Reviewed-by: David Hildenbrand (Red Hat) Cc: Jason Gunthorpe Cc: John Hubbard Cc: Liam Howlett Cc: "Liam R. Howlett" Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Xu Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 038a102535eb49e10e93eafac54352fcc5d78847 Author: Vlastimil Babka Date: Mon Jan 5 16:08:56 2026 +0100 mm/page_alloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0 CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470 Call Trace: __dump_stack (lib/dump_stack.c:95) dump_stack_lvl (lib/dump_stack.c:123) dump_stack (lib/dump_stack.c:130) spin_dump (kernel/locking/spinlock_debug.c:71) do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138) __free_frozen_pages (mm/page_alloc.c:2973) ___free_pages (mm/page_alloc.c:5295) __free_pages (mm/page_alloc.c:5334) tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290) ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289) ? rcu_core (kernel/rcu/tree.c:?) rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861) rcu_core_si (kernel/rcu/tree.c:2879) handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623) __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725) irq_exit_rcu (kernel/softirq.c:741) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052) RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) free_pcppages_bulk (mm/page_alloc.c:1494) drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632) __drain_all_pages (mm/page_alloc.c:2731) drain_all_pages (mm/page_alloc.c:2747) kcompactd (mm/compaction.c:3115) kthread (kernel/kthread.c:465) ? __cfi_kcompactd (mm/compaction.c:3166) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork (arch/x86/kernel/process.c:164) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Matthew has analyzed the report and identified that in drain_page_zone() we are in a section protected by spin_lock(&pcp->lock) and then get an interrupt that attempts spin_trylock() on the same lock. The code is designed to work this way without disabling IRQs and occasionally fail the trylock with a fallback. However, the SMP=n spinlock implementation assumes spin_trylock() will always succeed, and thus it's normally a no-op. Here the enabled lock debugging catches the problem, but otherwise it could cause a corruption of the pcp structure. The problem has been introduced by commit 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations"). The pcp locking scheme recognizes the need for disabling IRQs to prevent nesting spin_trylock() sections on SMP=n, but the need to prevent the nesting in spin_lock() has not been recognized. Fix it by introducing local wrappers that change the spin_lock() to spin_lock_iqsave() with SMP=n and use them in all places that do spin_lock(&pcp->lock). [vbabka@suse.cz: add pcp_ prefix to the spin_lock_irqsave wrappers, per Steven] Link: https://lkml.kernel.org/r/20260105-fix-pcp-up-v1-1-5579662d2071@suse.cz Fixes: 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations") Signed-off-by: Vlastimil Babka Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202512101320.e2f2dd6f-lkp@intel.com Analyzed-by: Matthew Wilcox Link: https://lore.kernel.org/all/aUW05pyc9nZkvY-1@casper.infradead.org/ Acked-by: Mel Gorman Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 4b5c493ff762bb0433529ca6870b284f0a2a5ca8 Author: Carlos Llamas Date: Mon Jan 5 19:07:46 2026 +0000 iommu/sva: include mmu_notifier.h header A call to mmu_notifier_arch_invalidate_secondary_tlbs() was introduced in commit e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space") but without explicitly adding its corresponding header file . This was evidenced while trying to enable compile testing support for IOMMU_SVA: config IOMMU_SVA select IOMMU_MM_DATA - bool + bool "Shared Virtual Addressing" if COMPILE_TEST The thing is for certain architectures this header file is indirectly included via . However, for others such as 32-bit arm the header is missing and it results in a build failure: $ make ARCH=arm allmodconfig [...] drivers/iommu/iommu-sva.c:340:3: error: call to undeclared function 'mmu_notifier_arch_invalidate_secondary_tlbs' [...] 340 | mmu_notifier_arch_invalidate_secondary_tlbs(iommu_mm->mm, start, end); | ^ Fix this by including the appropriate header file. Link: https://lkml.kernel.org/r/20260105190747.625082-1-cmllamas@google.com Fixes: e37d5a2d60a3 ("iommu/sva: invalidate stale IOTLB entries for kernel address space") Signed-off-by: Carlos Llamas Cc: Baolu Lu Cc: Jason Gunthorpe Cc: Joerg Roedel Cc: Kevin Tian Cc: Robin Murphy Cc: Vasant Hegde Cc: Will Deacon Signed-off-by: Andrew Morton commit 4795d205d78690a46b60164f44b8bb7b3e800865 Author: Ryan Roberts Date: Sun Jan 4 13:43:47 2026 +0000 mm: kmsan: fix poisoning of high-order non-compound pages kmsan_free_page() is called by the page allocator's free_pages_prepare() during page freeing. Its job is to poison all the memory covered by the page. It can be called with an order-0 page, a compound high-order page or a non-compound high-order page. But page_size() only works for order-0 and compound pages. For a non-compound high-order page it will incorrectly return PAGE_SIZE. The implication is that the tail pages of a high-order non-compound page do not get poisoned at free, so any invalid access while they are free could go unnoticed. It looks like the pages will be poisoned again at allocation time, so that would bookend the window. Fix this by using the order parameter to calculate the size. Link: https://lkml.kernel.org/r/20260104134348.3544298-1-ryan.roberts@arm.com Fixes: b073d7f8aee4 ("mm: kmsan: maintain KMSAN metadata for page operations") Signed-off-by: Ryan Roberts Reviewed-by: Alexander Potapenko Tested-by: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Dmitry Vyukov Cc: Marco Elver Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit fb39444732f02c32a8312c168d97e33d872c14d3 Author: Lorenzo Stoakes Date: Mon Jan 5 20:11:50 2026 +0000 tools/testing/selftests: add forked (un)/faulted VMA merge tests Now we correctly handle forked faulted/unfaulted merge on mremap(), exhaustively assert that we handle this correctly. Do this in the less duplicative way by adding a new merge_with_fork fixture and forked/unforked variants, and abstract the forking logic as necessary to avoid code duplication with this also. Link: https://lkml.kernel.org/r/1daf76d89fdb9d96f38a6a0152d8f3c2e9e30ac7.1767638272.git.lorenzo.stoakes@oracle.com Fixes: 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") Signed-off-by: Lorenzo Stoakes Cc: David Hildenbrand (Red Hat) Cc: Jann Horn Cc: Jeongjun Park Cc: Liam Howlett Cc: Pedro Falcato Cc: Rik van Riel Cc: Vlastimil Babka Cc: Yeoreum Yun Cc: Harry Yoo Cc: Signed-off-by: Andrew Morton commit 3b617fd3d317bf9dd7e2c233e56eafef05734c9d Author: Lorenzo Stoakes Date: Mon Jan 5 20:11:49 2026 +0000 mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too The is_mergeable_anon_vma() function uses vmg->middle as the source VMA. However when merging a new VMA, this field is NULL. In all cases except mremap(), the new VMA will either be newly established and thus lack an anon_vma, or will be an expansion of an existing VMA thus we do not care about whether VMA is CoW'd or not. In the case of an mremap(), we can end up in a situation where we can accidentally allow an unfaulted/faulted merge with a VMA that has been forked, violating the general rule that we do not permit this for reasons of anon_vma lock scalability. Now we have the ability to be aware of the fact we are copying a VMA and also know which VMA that is, we can explicitly check for this, so do so. This is pertinent since commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges"), as this patch permits unfaulted/faulted merges that were previously disallowed running afoul of this issue. While we are here, vma_had_uncowed_parents() is a confusing name, so make it simple and rename it to vma_is_fork_child(). Link: https://lkml.kernel.org/r/6e2b9b3024ae1220961c8b81d74296d4720eaf2b.1767638272.git.lorenzo.stoakes@oracle.com Fixes: 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") Signed-off-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Reviewed-by: Jeongjun Park Acked-by: Vlastimil Babka Cc: David Hildenbrand (Red Hat) Cc: Jann Horn Cc: Liam Howlett Cc: Pedro Falcato Cc: Rik van Riel Cc: Yeoreum Yun Cc: Signed-off-by: Andrew Morton commit 0ace8f2db6b3b4b0677e559d1a7ab7fd625d61ec Author: Lorenzo Stoakes Date: Mon Jan 5 20:11:48 2026 +0000 tools/testing/selftests: add tests for !tgt, src mremap() merges Test that mremap()'ing a VMA into a position such that the target VMA on merge is unfaulted and the source faulted is correctly performed. We cover 4 cases: 1. Previous VMA unfaulted: copied -----| v |-----------|.............| | unfaulted |(faulted VMA)| |-----------|.............| prev target = prev, expand prev to cover. 2. Next VMA unfaulted: copied -----| v |.............|-----------| |(faulted VMA)| unfaulted | |.............|-----------| next target = next, expand next to cover. 3. Both adjacent VMAs unfaulted: copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| unfaulted | |-----------|.............|-----------| prev next target = prev, expand prev to cover. 4. prev unfaulted, next faulted: copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| faulted | |-----------|.............|-----------| prev next target = prev, expand prev to cover. Essentially equivalent to 3, but with additional requirement that next's anon_vma is the same as the copied VMA's. Each of these are performed with MREMAP_DONTUNMAP set, which will cause a KASAN assert for UAF or an assert on zero refcount anon_vma if a bug exists with correctly propagating anon_vma state in each scenario. Link: https://lkml.kernel.org/r/f903af2930c7c2c6e0948c886b58d0f42d8e8ba3.1767638272.git.lorenzo.stoakes@oracle.com Fixes: 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") Signed-off-by: Lorenzo Stoakes Cc: David Hildenbrand (Red Hat) Cc: Jann Horn Cc: Jeongjun Park Cc: Liam Howlett Cc: Pedro Falcato Cc: Rik van Riel Cc: Vlastimil Babka Cc: Yeoreum Yun Cc: Harry Yoo Cc: Signed-off-by: Andrew Morton commit 61f67c230a5e7c741c352349ea80147fbe65bfae Author: Lorenzo Stoakes Date: Mon Jan 5 20:11:47 2026 +0000 mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge Patch series "mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge", v2. Commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") introduced the ability to merge previously unavailable VMA merge scenarios. However, it is handling merges incorrectly when it comes to mremap() of a faulted VMA adjacent to an unfaulted VMA. The issues arise in three cases: 1. Previous VMA unfaulted: copied -----| v |-----------|.............| | unfaulted |(faulted VMA)| |-----------|.............| prev 2. Next VMA unfaulted: copied -----| v |.............|-----------| |(faulted VMA)| unfaulted | |.............|-----------| next 3. Both adjacent VMAs unfaulted: copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| unfaulted | |-----------|.............|-----------| prev next This series fixes each of these cases, and introduces self tests to assert that the issues are corrected. I also test a further case which was already handled, to assert that my changes continues to correctly handle it: 4. prev unfaulted, next faulted: copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| faulted | |-----------|.............|-----------| prev next This bug was discovered via a syzbot report, linked to in the first patch in the series, I confirmed that this series fixes the bug. I also discovered that we are failing to check that the faulted VMA was not forked when merging a copied VMA in cases 1-3 above, an issue this series also addresses. I also added self tests to assert that this is resolved (and confirmed that the tests failed prior to this). I also cleaned up vma_expand() as part of this work, renamed vma_had_uncowed_parents() to vma_is_fork_child() as the previous name was unduly confusing, and simplified the comments around this function. This patch (of 4): Commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") introduced the ability to merge previously unavailable VMA merge scenarios. The key piece of logic introduced was the ability to merge a faulted VMA immediately next to an unfaulted VMA, which relies upon dup_anon_vma() to correctly handle anon_vma state. In the case of the merge of an existing VMA (that is changing properties of a VMA and then merging if those properties are shared by adjacent VMAs), dup_anon_vma() is invoked correctly. However in the case of the merge of a new VMA, a corner case peculiar to mremap() was missed. The issue is that vma_expand() only performs dup_anon_vma() if the target (the VMA that will ultimately become the merged VMA): is not the next VMA, i.e. the one that appears after the range in which the new VMA is to be established. A key insight here is that in all other cases other than mremap(), a new VMA merge either expands an existing VMA, meaning that the target VMA will be that VMA, or would have anon_vma be NULL. Specifically: * __mmap_region() - no anon_vma in place, initial mapping. * do_brk_flags() - expanding an existing VMA. * vma_merge_extend() - expanding an existing VMA. * relocate_vma_down() - no anon_vma in place, initial mapping. In addition, we are in the unique situation of needing to duplicate anon_vma state from a VMA that is neither the previous or next VMA being merged with. dup_anon_vma() deals exclusively with the target=unfaulted, src=faulted case. This leaves four possibilities, in each case where the copied VMA is faulted: 1. Previous VMA unfaulted: copied -----| v |-----------|.............| | unfaulted |(faulted VMA)| |-----------|.............| prev target = prev, expand prev to cover. 2. Next VMA unfaulted: copied -----| v |.............|-----------| |(faulted VMA)| unfaulted | |.............|-----------| next target = next, expand next to cover. 3. Both adjacent VMAs unfaulted: copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| unfaulted | |-----------|.............|-----------| prev next target = prev, expand prev to cover. 4. prev unfaulted, next faulted: copied -----| v |-----------|.............|-----------| | unfaulted |(faulted VMA)| faulted | |-----------|.............|-----------| prev next target = prev, expand prev to cover. Essentially equivalent to 3, but with additional requirement that next's anon_vma is the same as the copied VMA's. This is covered by the existing logic. To account for this very explicitly, we introduce vma_merge_copied_range(), which sets a newly introduced vmg->copied_from field, then invokes vma_merge_new_range() which handles the rest of the logic. We then update the key vma_expand() function to clean up the logic and make what's going on clearer, making the 'remove next' case less special, before invoking dup_anon_vma() unconditionally should we be copying from a VMA. Note that in case 3, the if (remove_next) ... branch will be a no-op, as next=src in this instance and src is unfaulted. In case 4, it won't be, but since in this instance next=src and it is faulted, this will have required tgt=faulted, src=faulted to be compatible, meaning that next->anon_vma == vmg->copied_from->anon_vma, and thus a single dup_anon_vma() of next suffices to copy anon_vma state for the copied-from VMA also. If we are copying from a VMA in a successful merge we must _always_ propagate anon_vma state. This issue can be observed most directly by invoked mremap() to move around a VMA and cause this kind of merge with the MREMAP_DONTUNMAP flag specified. This will result in unlink_anon_vmas() being called after failing to duplicate anon_vma state to the target VMA, which results in the anon_vma itself being freed with folios still possessing dangling pointers to the anon_vma and thus a use-after-free bug. This bug was discovered via a syzbot report, which this patch resolves. We further make a change to update the mergeable anon_vma check to assert the copied-from anon_vma did not have CoW parents, as otherwise dup_anon_vma() might incorrectly propagate CoW ancestors from the next VMA in case 4 despite the anon_vma's being identical for both VMAs. Link: https://lkml.kernel.org/r/cover.1767638272.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/b7930ad2b1503a657e29fe928eb33061d7eadf5b.1767638272.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Fixes: 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") Reported-by: syzbot+b165fc2e11771c66d8ba@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/694a2745.050a0220.19928e.0017.GAE@google.com/ Reported-by: syzbot+5272541ccbbb14e2ec30@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/694e3dc6.050a0220.35954c.0066.GAE@google.com/ Reviewed-by: Harry Yoo Reviewed-by: Jeongjun Park Acked-by: Vlastimil Babka Cc: David Hildenbrand (Red Hat) Cc: Jann Horn Cc: Yeoreum Yun Cc: Liam Howlett Cc: "Liam R. Howlett" Cc: Pedro Falcato Cc: Rik van Riel Cc: Signed-off-by: Andrew Morton commit 590b13669b813d55844fecd9142c56abd567914d Author: Pavel Butsykin Date: Wed Dec 31 11:46:38 2025 +0400 mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() crypto_alloc_acomp_node() may return ERR_PTR(), but the fail path checks only for NULL and can pass an error pointer to crypto_free_acomp(). Use IS_ERR_OR_NULL() to only free valid acomp instances. Link: https://lkml.kernel.org/r/20251231074638.2564302-1-pbutsykin@cloudlinux.com Fixes: 779b9955f643 ("mm: zswap: move allocations during CPU init outside the lock") Signed-off-by: Pavel Butsykin Reviewed-by: SeongJae Park Acked-by: Yosry Ahmed Acked-by: Nhat Pham Cc: Johannes Weiner Cc: Chengming Zhou Cc: Signed-off-by: Andrew Morton commit 392b3d9d595f34877dd745b470c711e8ebcd225c Author: SeongJae Park Date: Wed Dec 24 18:30:37 2025 -0800 mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure When a DAMOS-scheme DAMON sysfs directory setup fails after setup of access_pattern/ directory, subdirectories of access_pattern/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked. Cleanup the directories under such failures. Link: https://lkml.kernel.org/r/20251225023043.18579-5-sj@kernel.org Fixes: 9bbb820a5bd5 ("mm/damon/sysfs: support DAMOS quotas") Signed-off-by: SeongJae Park Cc: chongjiapeng Cc: # 5.18.x Signed-off-by: Andrew Morton commit dc7e1d75fd8c505096d0cddeca9e2efb2b55aaf9 Author: SeongJae Park Date: Wed Dec 24 18:30:36 2025 -0800 mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure When a DAMOS-scheme DAMON sysfs directory setup fails after setup of quotas/ directory, subdirectories of quotas/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked. Cleanup the directories under such failures. Link: https://lkml.kernel.org/r/20251225023043.18579-4-sj@kernel.org Fixes: 1b32234ab087 ("mm/damon/sysfs: support DAMOS watermarks") Signed-off-by: SeongJae Park Cc: chongjiapeng Cc: # 5.18.x Signed-off-by: Andrew Morton commit 9814cc832b88bd040fc2a1817c2b5469d0f7e862 Author: SeongJae Park Date: Wed Dec 24 18:30:35 2025 -0800 mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked. Cleanup the directories under such failures. Link: https://lkml.kernel.org/r/20251225023043.18579-3-sj@kernel.org Fixes: c951cd3b8901 ("mm/damon: implement a minimal stub for sysfs-based DAMON interface") Signed-off-by: SeongJae Park Cc: chongjiapeng Cc: # 5.18.x Signed-off-by: Andrew Morton commit a24ca8ebb0cd5ea07a1462b77be0f0823c40f319 Author: SeongJae Park Date: Wed Dec 24 18:30:34 2025 -0800 mm/damon/sysfs: cleanup intervals subdirs on attrs dir setup failure Patch series "mm/damon/sysfs: free setup failures generated zombie sub-sub dirs". Some DAMON sysfs directory setup functions generates its sub and sub-sub directories. For example, 'monitoring_attrs/' directory setup creates 'intervals/' and 'intervals/intervals_goal/' directories under 'monitoring_attrs/' directory. When such sub-sub directories are successfully made but followup setup is failed, the setup function should recursively clean up the subdirectories. However, such setup functions are only dereferencing sub directory reference counters. As a result, under certain setup failures, the sub-sub directories keep having non-zero reference counters. It means the directories cannot be removed like zombies, and the memory for the directories cannot be freed. The user impact of this issue is limited due to the following reasons. When the issue happens, the zombie directories are still taking the path. Hence attempts to generate the directories again will fail, without additional memory leak. This means the upper bound memory leak is limited. Nonetheless this also implies controlling DAMON with a feature that requires the setup-failed sysfs files will be impossible until the system reboots. Also, the setup operations are quite simple. The certain failures would hence only rarely happen, and are difficult to artificially trigger. This patch (of 4): When attrs/ DAMON sysfs directory setup is failed after setup of intervals/ directory, intervals/intervals_goal/ directory is not cleaned up. As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked. Cleanup the directory under such failures. Link: https://lkml.kernel.org/r/20251225023043.18579-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251225023043.18579-2-sj@kernel.org Fixes: 8fbbcbeaafeb ("mm/damon/sysfs: implement intervals tuning goal directory") Signed-off-by: SeongJae Park Cc: chongjiapeng Cc: # 6.15.x Signed-off-by: Andrew Morton commit f9132fbc2e83baf2c45a77043672a63a675c9394 Author: SeongJae Park Date: Tue Dec 30 17:23:13 2025 -0800 mm/damon/core: remove call_control in inactive contexts If damon_call() is executed against a DAMON context that is not running, the function returns error while keeping the damon_call_control object linked to the context's call_controls list. Let's suppose the object is deallocated after the damon_call(), and yet another damon_call() is executed against the same context. The function tries to add the new damon_call_control object to the call_controls list, which still has the pointer to the previous damon_call_control object, which is deallocated. As a result, use-after-free happens. This can actually be triggered using the DAMON sysfs interface. It is not easily exploitable since it requires the sysfs write permission and making a definitely weird file writes, though. Please refer to the report for more details about the issue reproduction steps. Fix the issue by making two changes. Firstly, move the final kdamond_call() for cancelling all existing damon_call() requests from terminating DAMON context to be done before the ctx->kdamond reset. This makes any code that sees NULL ctx->kdamond can safely assume the context may not access damon_call() requests anymore. Secondly, let damon_call() to cleanup the damon_call_control objects that were added to the already-terminated DAMON context, before returning the error. Link: https://lkml.kernel.org/r/20251231012315.75835-1-sj@kernel.org Fixes: 004ded6bee11 ("mm/damon: accept parallel damon_call() requests") Signed-off-by: SeongJae Park Reported-by: JaeJoon Jung Closes: https://lore.kernel.org/20251224094401.20384-1-rgbi3307@gmail.com Cc: # 6.17.x Signed-off-by: Andrew Morton commit e561383a39ed6e5c85a0b2369720743b694327ae Author: Feng Tang Date: Wed Dec 31 16:03:09 2025 +0800 powerpc/watchdog: add support for hardlockup_sys_info sysctl Commit a9af76a78760 ("watchdog: add sys_info sysctls to dump sys info on system lockup") adds 'hardlock_sys_info' systcl knob for general kernel watchdog to control what kinds of system debug info to be dumped on hardlockup. Add similar support in powerpc watchdog code to make the sysctl knob more general, which also fixes a compiling warning in general watchdog code reported by 0day bot. Link: https://lkml.kernel.org/r/20251231080309.39642-1-feng.tang@linux.alibaba.com Fixes: a9af76a78760 ("watchdog: add sys_info sysctls to dump sys info on system lockup") Signed-off-by: Feng Tang Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512030920.NFKtekA7-lkp@intel.com/ Suggested-by: Petr Mladek Reviewed-by: Petr Mladek Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Signed-off-by: Andrew Morton commit f171b55f1441294344b86edfeaa575ea9673fd23 Author: Mike Rapoport (Microsoft) Date: Wed Dec 31 12:57:01 2025 +0200 mips: fix HIGHMEM initialization Commit 6faea3422e3b ("arch, mm: streamline HIGHMEM freeing") overzealously removed mem_init_free_highmem() function that beside freeing high memory pages checked for CPU support for high memory as a prerequisite. Partially restore mem_init_free_highmem() with a new highmem_init() name and make it discard high memory in case there is no CPU support for it. Link: https://lkml.kernel.org/r/20251231105701.519711-1-rppt@kernel.org Fixes: 6faea3422e3b ("arch, mm: streamline HIGHMEM freeing") Signed-off-by: Mike Rapoport (Microsoft) Reported-by: Markus Stockhausen Cc: Chris Packham Cc: Hauke Mehrtens Cc: Jonas Jelonek Cc: Thomas Bogendoerfer Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit b02019169284df8f4ce972a60da31d28bd5b5979 Author: Sourabh Jain Date: Wed Dec 24 17:25:24 2025 +0530 mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported Skip processing hugepage kernel arguments (hugepagesz, hugepages, and default_hugepagesz) when hugepages are not supported by the architecture. Some architectures may need to disable hugepages based on conditions discovered during kernel boot. The hugepages_supported() helper allows architecture code to advertise whether hugepages are supported. Currently, normal hugepage allocation is guarded by hugepages_supported(), but gigantic hugepages are allocated regardless of this check. This causes problems on powerpc for fadump (firmware- assisted dump). In the fadump (firmware-assisted dump) scenario, a production kernel crash causes the system to boot into a special kernel whose sole purpose is to collect the memory dump and reboot. Features such as hugepages are not required in this environment and should be disabled. For example, when the fadump kernel boots with the following kernel arguments: default_hugepagesz=1GB hugepagesz=1GB hugepages=200 Before this patch, the kernel prints the following logs: HugeTLB: allocating 200 of page size 1.00 GiB failed. Only allocated 58 hugepages. HugeTLB support is disabled! HugeTLB: huge pages not supported, ignoring associated command-line parameters hugetlbfs: disabling because there are no supported hugepage sizes Even though the logs state that HugeTLB support is disabled, gigantic hugepages are still allocated. This causes the fadump kernel to run out of memory during boot. After this patch is applied, the kernel prints the following logs for the same command line: HugeTLB: hugepages unsupported, ignoring default_hugepagesz=1GB cmdline HugeTLB: hugepages unsupported, ignoring hugepagesz=1GB cmdline HugeTLB: hugepages unsupported, ignoring hugepages=200 cmdline HugeTLB support is disabled! hugetlbfs: disabling because there are no supported hugepage sizes To fix the issue, gigantic hugepage allocation should be guarded by hugepages_supported(). Previously, two approaches were proposed to bring gigantic hugepage allocation under hugepages_supported(): [1] Check hugepages_supported() in the generic code before allocating gigantic hugepages [2] Make arch_hugetlb_valid_size() return false for all hugetlb sizes Approach [2] has two minor issues: 1. It prints misleading logs about invalid hugepage sizes 2. The kernel still processes hugepage kernel arguments unnecessarily To control gigantic hugepage allocation, skip processing hugepage kernel arguments (default_hugepagesz, hugepagesz and hugepages) when hugepages_supported() returns false. Note for backporting: This fix is a partial reversion of the commit mentioned in the Fixes tag and is only valid once the change referenced by the Depends-on tag is present. When backporting this patch, the commit mentioned in the Depends-on tag must be included first. Link: https://lore.kernel.org/all/20250121150419.1342794-1-sourabhjain@linux.ibm.com/ [1] Link: https://lore.kernel.org/all/20250128043358.163372-1-sourabhjain@linux.ibm.com/ [2] Link: https://lkml.kernel.org/r/20251224115524.1272010-1-sourabhjain@linux.ibm.com Fixes: c2833a5bf75b ("hugetlbfs: fix changes to command line processing") Signed-off-by: Sourabh Jain Depends-on: 2354ad252b66 ("powerpc/mm: Update default hugetlb size early") Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Ritesh Harjani (IBM) Cc: Borislav Petkov Cc: Christophe Leroy Cc: Heiko Carstens Cc: Ingo Molnar Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Muchun Song Cc: Oscar Salvador Cc: Thomas Gleixner Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit b9efe36b5e3eb2e91aa3d706066428648af034fc Author: Aboorva Devarajan Date: Mon Dec 1 11:30:09 2025 +0530 mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free When page isolation loops indefinitely during memory offline, reading /proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock, causing hung task warnings. Make procfs reads lock-free since percpu_pagelist_high_fraction is a simple integer with naturally atomic reads, writers still serialize via the mutex. This prevents hung task warnings when reading the procfs file during long-running memory offline operations. [akpm@linux-foundation.org: add comment, per Michal] Link: https://lkml.kernel.org/r/aS_y9AuJQFydLEXo@tiehlicka Link: https://lkml.kernel.org/r/20251201060009.1420792-1-aboorvad@linux.ibm.com Signed-off-by: Aboorva Devarajan Acked-by: Michal Hocko Cc: Brendan Jackman Cc: Johannes Weiner Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit a38be546269073bf8edc3c49eaf18cdfce905777 Author: Shakeel Butt Date: Wed Dec 24 16:29:04 2025 -0800 mm/damon/core: get memcg reference before access The commit b74a120bcf507 ("mm/damon/core: implement DAMOS_QUOTA_NODE_MEMCG_USED_BP") added accesses to memcg structure without getting reference to it. This is unsafe. Let's get the reference before accessing the memcg. Link: https://lkml.kernel.org/r/20251225002904.139543-1-shakeel.butt@linux.dev Fixes: b74a120bcf507 ("mm/damon/core: implement DAMOS_QUOTA_NODE_MEMCG_USED_BP") Signed-off-by: Shakeel Butt Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 582f0f3864110e1c6e4af3af768e1c2453ba2306 Author: Pasha Tatashin Date: Tue Dec 23 09:01:40 2025 -0500 kho: validate preserved memory map during population If the previous kernel enabled KHO but did not call kho_finalize() (e.g., CONFIG_LIVEUPDATE=n or userspace skipped the finalization step), the 'preserved-memory-map' property in the FDT remains empty/zero. Previously, kho_populate() would succeed regardless of the memory map's state, reserving the incoming scratch regions in memblock. However, kho_memory_init() would later fail to deserialize the empty map. By that time, the scratch regions were already registered, leading to partial initialization and subsequent list corruption (freeing scratch area twice) during kho_init(). Move the validation of the preserved memory map earlier into kho_populate(). If the memory map is empty/NULL: 1. Abort kho_populate() immediately with -ENOENT. 2. Do not register or reserve the incoming scratch memory, allowing the new kernel to reclaim those pages as standard free memory. 3. Leave the global 'kho_in' state uninitialized. Consequently, kho_memory_init() sees no active KHO context (kho_in.mem_chunks_phys is 0) and falls back to kho_reserve_scratch(), allocating fresh scratch memory as if it were a standard cold boot. Link: https://lkml.kernel.org/r/20251223140140.2090337-1-pasha.tatashin@soleen.com Fixes: de51999e687c ("kho: allow memory preservation state updates after finalization") Signed-off-by: Pasha Tatashin Reported-by: Ricardo Neri Closes: https://lore.kernel.org/all/20251218215613.GA17304@ranerica-svr.sc.intel.com Reviewed-by: Mike Rapoport (Microsoft) Tested-by: Ricardo Neri Reviewed-by: Pratyush Yadav Cc: Alexander Graf Signed-off-by: Andrew Morton commit 777a8560fd29738350c5094d4166fe5499452409 Author: Shakeel Butt Date: Mon Dec 22 12:58:59 2025 -0800 lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to use __kernel_read() instead of direct page cache access via read_cache_folio(). This simplifies the faultable code path by using the standard kernel file reading interface which handles all the complexity of reading file data. At the moment we are not changing the code for non-sleepable context which uses filemap_get_folio() and only succeeds if the target folios are already in memory and up-to-date. The reason is to keep the patch simple and easier to backport to stable kernels. Syzbot repro does not crash the kernel anymore and the selftests run successfully. In the follow up we will make __kernel_read() with IOCB_NOWAIT work for non-sleepable contexts. In addition, I would like to replace the secretmem check with a more generic approach and will add fstest for the buildid code. Link: https://lkml.kernel.org/r/20251222205859.3968077-1-shakeel.butt@linux.dev Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API") Reported-by: syzbot+09b7d050e4806540153d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=09b7d050e4806540153d Signed-off-by: Shakeel Butt Reviewed-by: Christoph Hellwig Tested-by: Jinchao Wang Link: https://lkml.kernel.org/r/aUteBPWPYzVWIZFH@ndev Reviewed-by: Christian Brauner Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkman Cc: "Darrick J. Wong" Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit 6ac166a0c8b8aca2a2d796aec1e3c110f4e3300d Author: Marco Elver Date: Mon Dec 22 16:00:06 2025 +0100 docs: kernel-parameters: add kfence parameters Add a brief summary for KFENCE's kernel command-line parameters in admin-guide/kernel-parameters. Link: https://lkml.kernel.org/r/20251222150018.1349672-1-elver@google.com Signed-off-by: Marco Elver Cc: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit aba744a2e4b23c2040e335db35c141b95915efbd Author: Szymon Wilczek Date: Sun Dec 21 16:17:10 2025 +0100 mailmap: update email address for Szymon Wilczek Map my old address to my new address . The old account is no longer accessible due to provider blocking access. Link: https://lkml.kernel.org/r/20251221151710.13747-1-swilczek.lx@gmail.com Signed-off-by: Szymon Wilczek Signed-off-by: Andrew Morton commit 6cfab50e1440fde19af7c614aacd85e11aa4dcea Author: Bagas Sanjaya Date: Fri Dec 19 08:40:07 2025 +0700 mm, kfence: describe @slab parameter in __kfence_obj_info() Sphinx reports kernel-doc warning: WARNING: ./include/linux/kfence.h:220 function parameter 'slab' not described in '__kfence_obj_info' Fix it by describing @slab parameter. Link: https://lkml.kernel.org/r/20251219014006.16328-6-bagasdotme@gmail.com Fixes: 2dfe63e61cc3 ("mm, kfence: support kmem_dump_obj() for KFENCE objects") Signed-off-by: Bagas Sanjaya Acked-by: Marco Elver Acked-by: David Hildenbrand (Red Hat) Acked-by: Harry Yoo Signed-off-by: Andrew Morton commit eb3f781ab73e7ed970070a0b9a7d951f980e717a Author: Bagas Sanjaya Date: Fri Dec 19 08:40:06 2025 +0700 mm: vmalloc: fix up vrealloc_node_align() kernel-doc macro name Sphinx reports kernel-doc warning: WARNING: ./mm/vmalloc.c:4284 expecting prototype for vrealloc_node_align_noprof(). Prototype was for vrealloc_node_align() instead Fix the macro name in vrealloc_node_align_noprof() kernel-doc comment. Link: https://lkml.kernel.org/r/20251219014006.16328-5-bagasdotme@gmail.com Fixes: 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") Signed-off-by: Bagas Sanjaya Reviewed-by: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit f26528478bb102c28e7ac0cbfc8ec8185afdafc7 Author: Bagas Sanjaya Date: Fri Dec 19 08:40:05 2025 +0700 textsearch: describe @list member in ts_ops search Sphinx reports kernel-doc warning: WARNING: ./include/linux/textsearch.h:49 struct member 'list' not described in 'ts_ops' Describe @list member to fix it. Link: https://lkml.kernel.org/r/20251219014006.16328-4-bagasdotme@gmail.com Fixes: 2de4ff7bd658 ("[LIB]: Textsearch infrastructure.") Signed-off-by: Bagas Sanjaya Cc: Thomas Graf Cc: "David S. Miller" Signed-off-by: Andrew Morton commit e2fb7836b01747815f8bb94981c35f2688afb120 Author: Bagas Sanjaya Date: Fri Dec 19 08:40:04 2025 +0700 mm: describe @flags parameter in memalloc_flags_save() Patch series "mm kernel-doc fixes". Here are kernel-doc fixes for mm subsystem. I'm also including textsearch fix since there's currently no maintainer for include/linux/textsearch.h (get_maintainer.pl only shows LKML). This patch (of 4): Sphinx reports kernel-doc warning: WARNING: ./include/linux/sched/mm.h:332 function parameter 'flags' not described in 'memalloc_flags_save' Describe @flags to fix it. Link: https://lkml.kernel.org/r/20251219014006.16328-2-bagasdotme@gmail.com Link: https://lkml.kernel.org/r/20251219014006.16328-3-bagasdotme@gmail.com Signed-off-by: Bagas Sanjaya Fixes: 3f6d5e6a468d ("mm: introduce memalloc_flags_{save,restore}") Acked-by: David Hildenbrand (Red Hat) Acked-by: Harry Yoo Signed-off-by: Andrew Morton commit 344c5281f43851b22c7cc223fd0250c143fcbc79 Author: Naohiko Shimizu Date: Sun Jan 4 22:59:38 2026 +0900 riscv: suspend: Fix stimecmp update hazard on RV32 On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two separate 32-bit writes. A race condition exists if the timer triggers during these two writes. The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp) recommends a specific 3-step sequence to avoid spurious interrupts when updating 64-bit comparison registers on 32-bit systems: 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX). 2. Set the high-order bits (stimecmph) to the desired value. 3. Set the low-order bits (stimecmp) to the desired value. Current implementation writes the LSB first without ensuring a future value, which may lead to a transient state where the 64-bit comparison is incorrectly evaluated as "expired" by the hardware. This results in spurious timer interrupts. This patch adopts the spec-recommended 3-step sequence to ensure the intermediate 64-bit state is never smaller than the current time. Fixes: ffef54ad4110 ("riscv: Add stimecmp save and restore") Signed-off-by: Naohiko Shimizu Reviewed-by: Anup Patel Link: https://patch.msgid.link/20260104135938.524-4-naohiko.shimizu@gmail.com Signed-off-by: Paul Walmsley commit 75870639bf5d1c447ddba4d738ff72771a69f2a1 Author: Naohiko Shimizu Date: Sun Jan 4 22:59:37 2026 +0900 riscv: kvm: Fix vstimecmp update hazard on RV32 On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two separate 32-bit writes. A race condition exists if the timer triggers during these two writes. The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp) recommends a specific 3-step sequence to avoid spurious interrupts when updating 64-bit comparison registers on 32-bit systems: 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX). 2. Set the high-order bits (stimecmph) to the desired value. 3. Set the low-order bits (stimecmp) to the desired value. Current implementation writes the LSB first without ensuring a future value, which may lead to a transient state where the 64-bit comparison is incorrectly evaluated as "expired" by the hardware. This results in spurious timer interrupts. This patch adopts the spec-recommended 3-step sequence to ensure the intermediate 64-bit state is never smaller than the current time. Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") Signed-off-by: Naohiko Shimizu Reviewed-by: Anup Patel Link: https://patch.msgid.link/20260104135938.524-3-naohiko.shimizu@gmail.com Signed-off-by: Paul Walmsley commit eaa9bb1d39d59e7c17b06cec12622b7c586ab629 Author: Naohiko Shimizu Date: Sun Jan 4 22:59:36 2026 +0900 riscv: clocksource: Fix stimecmp update hazard on RV32 On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two separate 32-bit writes. A race condition exists if the timer triggers during these two writes. The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp) recommends a specific 3-step sequence to avoid spurious interrupts when updating 64-bit comparison registers on 32-bit systems: 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX). 2. Set the high-order bits (stimecmph) to the desired value. 3. Set the low-order bits (stimecmp) to the desired value. Current implementation writes the LSB first without ensuring a future value, which may lead to a transient state where the 64-bit comparison is incorrectly evaluated as "expired" by the hardware. This results in spurious timer interrupts. This patch adopts the spec-recommended 3-step sequence to ensure the intermediate 64-bit state is never smaller than the current time. Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available") Signed-off-by: Naohiko Shimizu Reviewed-by: Anup Patel Link: https://patch.msgid.link/20260104135938.524-2-naohiko.shimizu@gmail.com Signed-off-by: Paul Walmsley commit 5f4476e98387618ce22bb93fb5c11142827458ec Author: Danilo Krummrich Date: Wed Jan 7 11:35:01 2026 +0100 rust: auxiliary: add Driver::unbind() callback Add missing unbind() callback to auxiliary::Driver, since it will be needed by drivers eventually (e.g. the Nova DRM driver). Acked-by: Alice Ryhl Link: https://patch.msgid.link/20260107103511.570525-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4181aceb4af414bd6d2ce5eb9a22637bbb4f5f8c Author: Danilo Krummrich Date: Wed Jan 7 11:35:00 2026 +0100 rust: i2c: do not drop device private data on shutdown() We must not drop the device private data on shutdown(); none of the registrations attached to devres that might access the device private data are released before shutdown() is called. Hence, freeing the device private data on shutdown() can cause UAF bugs. Fixes: 57c5bd9aee94 ("rust: i2c: add basic I2C device and driver abstractions") Acked-by: Alice Ryhl Acked-by: Igor Korotin Link: https://patch.msgid.link/20260107103511.570525-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 69132c2d4c11858fa43edeb19a911eab625567f9 Author: Guodong Xu Date: Thu Jan 15 07:18:57 2026 +0800 Documentation: riscv: uabi: Clarify ISA spec version for canonical order Specify that chapter 27 refers to version 20191213 of the RISC-V ISA Unprivileged Architecture. The chapter numbering differs across specification versions - for example, in version 20250508, the ISA Extension Naming Conventions is chapter 36, not chapter 27. Historical versions of the RISC-V specification can be found via Link [1]. Acked-by: Paul Walmsley Link: https://riscv.org/specifications/ratified/ [1] Fixes: f07b2b3f9d47 ("Documentation: riscv: add a section about ISA string ordering in /proc/cpuinfo") Signed-off-by: Guodong Xu Link: https://patch.msgid.link/20260115-adding-b-dtsi-v2-1-254dd61cf947@riscstar.com commit a57d5cc053e9e6491c54e5bcc8d116cc0d7e98b2 Merge: 1a75f24a7f8c2c 46378ab9fcb796 Author: Mark Brown Date: Wed Jan 14 22:16:56 2026 +0000 ASoC: tlv320adcx140: Merge fixes from Pengutronix Merge patches that Pengutronix have been carrying in their tree for a while and were upstreamed by Sascha Hauer together with some new features that are going into the next release. commit ef3719e33e6649164382c629d58704b828f56079 Author: Sean Christopherson Date: Tue Jan 13 09:46:06 2026 -0800 KVM: x86: Assert that non-MSI doesn't have bypass vCPU when deleting producer When disconnecting a non-MSI irqfd from an IRQ bypass producer, WARN if the irqfd is configured for IRQ bypass and set its IRTE back to remapped mode to harden against kernel/KVM bugs (keeping the irqfd in bypass mode is often fatal to the host). Deactivating an irqfd (removing it from the list of irqfds), updating irqfd routes, and the code in question are all mutually exclusive (all run under irqfds.lock). If an irqfd is configured for bypass, and the irqfd is deassigned at the same time IRQ routing is updated (to change the routing to non-MSI), then either kvm_arch_update_irqfd_routing() should process the irqfd routing change and put the IRTE into remapped mode (routing update "wins"), or kvm_arch_irq_bypass_del_producer() should see the MSI routing info (deactivation "wins"). Link: https://patch.msgid.link/20260113174606.104978-3-seanjc@google.com Signed-off-by: Sean Christopherson commit b4d37cdb77a0015f51fee083598fa227cc07aaf1 Author: Sean Christopherson Date: Tue Jan 13 09:46:05 2026 -0800 KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86 and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to handle a concurrent routing update, verify that the irqfd is still active before consuming the routing information. As evidenced by the x86 and arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below), clobbering the entry type without notifying arch code is surprising and error prone. As a bonus, checking that the irqfd is active provides a convenient location for documenting _why_ KVM must not consume the routing entry for an irqfd that is in the process of being deassigned: once the irqfd is deleted from the list (which happens *before* the eventfd is detached), it will no longer receive updates via kvm_irq_routing_update(), and so KVM could deliver an event using stale routing information (relative to KVM_SET_GSI_ROUTING returning to userspace). As an even better bonus, explicitly checking for the irqfd being active fixes a similar bug to the one the clobbering is trying to prevent: if an irqfd is deactivated, and then its routing is changed, kvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing() (because the irqfd isn't in the list). And so if the irqfd is in bypass mode, IRQs will continue to be posted using the old routing information. As for kvm_arch_irq_bypass_del_producer(), clobbering the routing type results in KVM incorrectly keeping the IRQ in bypass mode, which is especially problematic on AMD as KVM tracks IRQs that are being posted to a vCPU in a list whose lifetime is tied to the irqfd. Without the help of KASAN to detect use-after-free, the most common sympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to the memory for irqfd structure being re-allocated and zeroed, resulting in irqfd->irq_bypass_data being NULL when read by avic_update_iommu_vcpu_affinity(): BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test Tainted: G U W O 6.19.0-smp--5dddc257e6b2-irqfd #31 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025 RIP: 0010:amd_iommu_update_ga+0x19/0xe0 Call Trace: avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd] __avic_vcpu_load+0xf4/0x130 [kvm_amd] kvm_arch_vcpu_load+0x89/0x210 [kvm] vcpu_load+0x30/0x40 [kvm] kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm] kvm_vcpu_ioctl+0x571/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x6f/0x9d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46893b ---[ end trace 0000000000000000 ]--- If AVIC is inhibited when the irfd is deassigned, the bug will manifest as list corruption, e.g. on the next irqfd assignment. list_add corruption. next->prev should be prev (ffff8d474d5cd588), but was 0000000000000000. (next=ffff8d8658f86530). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! Oops: invalid opcode: 0000 [#1] SMP CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test Tainted: G U W O 6.19.0-smp--f19dc4d680ba-irqfd #28 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025 RIP: 0010:__list_add_valid_or_report+0x97/0xc0 Call Trace: avic_pi_update_irte+0x28e/0x2b0 [kvm_amd] kvm_pi_update_irte+0xbf/0x190 [kvm] kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm] irq_bypass_register_consumer+0xcd/0x170 [irqbypass] kvm_irqfd+0x4c6/0x540 [kvm] kvm_vm_ioctl+0x118/0x5d0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x6f/0x9d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]--- On Intel and arm64, the bug is less noisy, as the end result is that the device keeps posting IRQs to the vCPU even after it's been deassigned. Note, the worst of the breakage can be traced back to commit cb210737675e ("KVM: Pass new routing entries and irqfd when updating IRTEs"), as before that commit KVM would pull the routing information from the per-VM routing table. But as above, similar bugs have existed since support for IRQ bypass was added. E.g. if a routing change finished before irq_shutdown() invoked kvm_arch_irq_bypass_del_producer(), VMX and SVM would see stale routing information and potentially leave the irqfd in bypass mode. Alternatively, x86 could be fixed by explicitly checking irq_bypass_vcpu instead of irq_entry.type in kvm_arch_irq_bypass_del_producer(), and arm64 could be modified to utilize irq_bypass_vcpu in a similar manner. But (a) that wouldn't fix the routing updates bug, and (b) fixing core code doesn't preclude x86 (or arm64) from adding such code as a sanity check (spoiler alert). Fixes: f70c20aaf141 ("KVM: Add an arch specific hooks in 'struct kvm_kernel_irqfd'") Fixes: cb210737675e ("KVM: Pass new routing entries and irqfd when updating IRTEs") Fixes: a0d7e2fc61ab ("KVM: arm64: vgic-v4: Only attempt vLPI mapping for actual MSIs") Cc: stable@vger.kernel.org Cc: Marc Zyngier Cc: Oliver Upton Link: https://patch.msgid.link/20260113174606.104978-2-seanjc@google.com Signed-off-by: Sean Christopherson commit cfbe371194d1f342bdd88f87a9b36407d1ec0f52 Author: Sean Christopherson Date: Mon Jan 12 15:28:05 2026 -0800 KVM: SVM: Check vCPU ID against max x2AVIC ID if and only if x2AVIC is enabled When allocating the AVIC backing page, only check one of the max AVIC vs. x2AVIC ID based on whether or not x2AVIC is enabled. Doing so fixes a bug where KVM incorrectly inhibits AVIC if x2AVIC is _disabled_ and any vCPU with a non-zero APIC ID is created, as x2avic_max_physical_id is left '0' when x2AVIC is disabled. Fixes: 940fc47cfb0d ("KVM: SVM: Add AVIC support for 4k vCPUs in x2AVIC mode") Cc: stable@vger.kernel.org Cc: Naveen N Rao (AMD) Cc: Suravee Suthikulpanit Reviewed-by: Naveen N Rao (AMD) Link: https://patch.msgid.link/20260112232805.1512361-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 437cc6057e01d98ee124496f045ede36224af326 Author: Johannes Thumshirn Date: Wed Dec 17 14:41:36 2025 +0100 btrfs: remove zoned statistics from sysfs Remove the newly introduced zoned statistics from sysfs, as sysfs can only show a single page this will truncate the output on a busy filesystem. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit d04f73668bebbc5a44a2771ea92b6ec253148050 Author: Ivan Lipski Date: Tue Jan 13 17:29:59 2026 -0500 drm/amd/display: Add an hdmi_hpd_debounce_delay_ms module [Why&How] Right now, the HDMI HPD filter is enabled by default at 1500ms. We want to disable it by default, as most modern displays with HDMI do not require it for DPMS mode. The HPD can instead be enabled as a driver parameter with a custom delay value in ms (up to 5000ms). Fixes: c918e75e1ed9 ("drm/amd/display: Add an HPD filter for HDMI") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4859 Signed-off-by: Ivan Lipski Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 6a681cd9034587fe3550868bacfbd639d1c6891f) commit b2426a211dba6432e32a2e70e9183c6e134475c6 Author: Srinivasan Shanmugam Date: Wed Jan 14 16:14:53 2026 +0530 drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 The user mode queue keeps a pointer to the most recent fence in userq->last_fence. This pointer holds an extra dma_fence reference. When the queue is destroyed, we free the fence driver and its xarray, but we forgot to drop the last_fence reference. Because of the missing dma_fence_put(), the last fence object can stay alive when the driver unloads. This leaves an allocated object in the amdgpu_userq_fence slab cache and triggers This is visible during driver unload as: BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown() kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects Call Trace: kmem_cache_destroy amdgpu_userq_fence_slab_fini amdgpu_exit __do_sys_delete_module Fix this by putting userq->last_fence and clearing the pointer during amdgpu_userq_fence_driver_free(). This makes sure the fence reference is released and the slab cache is empty when the module exits. v2: Update to only release userq->last_fence with dma_fence_put() (Christian) Fixes: edc762a51c71 ("drm/amdgpu/userq: move some code around") Cc: Alex Deucher Cc: Christian König Signed-off-by: Srinivasan Shanmugam Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb) commit 18dbcfb46f692e665c3fe3eee804e56c4eae53d6 Author: Harish Kasiviswanathan Date: Sun Jan 11 16:53:18 2026 -0500 drm/amdkfd: No need to suspend whole MES to evict process Each queue of the process is individually removed and there is not need to suspend whole mes. Suspending mes stops kernel mode queues also causing unnecessary timeouts when running mixed work loads Fixes: 079ae5118e1f ("drm/amdkfd: fix suspend/resume all calls in mes based eviction path") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4765 Signed-off-by: Harish Kasiviswanathan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 3fd20580b96a6e9da65b94ac3b58ee288239b731) commit 808c2052f046d730a588f7b92b04a12f64970853 Author: Prike Liang Date: Fri Jan 9 16:15:11 2026 +0800 Revert "drm/amdgpu: don't attach the tlb fence for SI" This reverts commit 820b3d376e8a102c6aeab737ec6edebbbb710e04. It’s better to validate VM TLB flushes in the flush‑TLB backend rather than in the generic VM layer. Reverting this patch depends on commit fa7c231fc2b0 ("drm/amdgpu: validate the flush_gpu_tlb_pasid()") being present in the tree. Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 9163fe4d790fb4e16d6b0e23f55b43cddd3d4a65) commit 0bea77b13b7649710108e6b67937ab4c7f8a9363 Author: Prike Liang Date: Tue Jan 6 17:00:57 2026 +0800 drm/amdgpu: validate the flush_gpu_tlb_pasid() Validate flush_gpu_tlb_pasid() availability before flushing tlb. Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit f4db9913e4d3dabe9ff3ea6178f2c1bc286012b8) commit 90dbc0bc2aa60021615969841fed06790c992bde Author: Yang Wang Date: Tue Jan 6 14:42:40 2026 +0800 drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 resolving the issue of incorrect type definitions potentially causing calculation errors. Fixes: 54f7f3ca982a ("drm/amdgpu/swm14: Update power limit logic") Signed-off-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit e3a03d0ae16d6b56e893cce8e52b44140e1ed985) commit 52d3d115e9cc975b90b1fc49abf6d36ad5e8847a Author: Vivek Das Mohapatra Date: Mon Jan 12 15:28:56 2026 +0000 drm/amd/display: Initialise backlight level values from hw Internal backlight levels are initialised from ACPI but the values are sometimes out of sync with the levels in effect until there has been a read from hardware (eg triggered by reading from sysfs). This means that the first drm_commit can cause the levels to be set to a different value than the actual starting one, which results in a sudden change in brightness. This path shows the problem (when the values are out of sync): amdgpu_dm_atomic_commit_tail() -> amdgpu_dm_commit_streams() -> amdgpu_dm_backlight_set_level(..., dm->brightness[n]) This patch calls the backlight ops get_brightness explicitly at the end of backlight registration to make sure dm->brightness[n] is in sync with the actual hardware levels. Fixes: 2fe87f54abdc ("drm/amd/display: Set default brightness according to ACPI") Signed-off-by: Vivek Das Mohapatra Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 318b1c36d82a0cd2b06a4bb43272fa6f1bc8adc1) Cc: stable@vger.kernel.org commit fee50077656d8a58011f13bca48f743d1b6d6015 Author: Mario Limonciello Date: Mon Dec 15 14:08:30 2025 -0600 drm/amd/display: Bump the HDMI clock to 340MHz [Why] DP-HDMI dongles can execeed bandwidth requirements on high resolution monitors. This can lead to pruning the high resolution modes. HDMI 1.3 bumped the clock to 340MHz, but display code never matched it. [How] Set default to (DVI) 165MHz. Once HDMI display is identified update to 340MHz. Reported-by: Dianne Skoll Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4780 Reviewed-by: Chris Park Signed-off-by: Mario Limonciello Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit ac1e65d8ade46c09fb184579b81acadf36dcb91e) Cc: stable@vger.kernel.org commit 0a1253ba5096f531eaaef40caa4c069da6ad48ae Author: Mario Limonciello (AMD) Date: Sun Dec 14 08:59:16 2025 -0600 drm/amd/display: Show link name in PSR status message [Why] The PSR message was moved in commit 4321742c394e ("drm/amd/display: Move PSR support message into amdgpu_dm"). This message however shows for every single link without showing which link is which. This can send a confusing message to the user. [How] Add link name into the message. Fixes: 4321742c394e ("drm/amd/display: Move PSR support message into amdgpu_dm") Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Matthew Stewart Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 99f77f6229c0766b980ae05affcf9f742d97de6a) commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 Author: Haoxiang Li Date: Thu Jan 8 15:18:22 2026 +0800 drm/amdkfd: fix a memory leak in device_queue_manager_init() If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd() to release the memory allocated by allocate_hiq_sdma_mqd(). Move deallocate_hiq_sdma_mqd() up to ensure proper function visibility at the point of use. Fixes: 11614c36bc8f ("drm/amdkfd: Allocate MQD trunk for HIQ and SDMA") Signed-off-by: Haoxiang Li Signed-off-by: Felix Kuehling Reviewed-by: Oak Zeng Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher (cherry picked from commit b7cccc8286bb9919a0952c812872da1dcfe9d390) Cc: stable@vger.kernel.org commit b6dff005fcf32dd072f6f2d08ca461394a21bd4f Author: Alex Deucher Date: Fri Jan 9 08:54:55 2026 -0500 drm/amdgpu: make sure userqs are enabled in userq IOCTLs These IOCTLs shouldn't be called when userqs are not enabled. Make sure they are enabled before executing the IOCTLs. Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit d967509651601cddce7ff2a9f09479f3636f684d) Cc: stable@vger.kernel.org commit 122b15cdbcc2eaccd7c1e630bb79ff4c268dd3f4 Author: Xiaogang Chen Date: Thu Jan 8 09:50:36 2026 -0600 drm/amdgpu: Use correct address to setup gart page table for vram access Use dst input parameter to setup gart page table entries instead of using fixed location. Fixes: 237d623ae659 ("drm/amdgpu/gart: Add helper to bind VRAM pages (v2)") Signed-off-by: Xiaogang Chen Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit ca5d4db8db843be7ed35fc9334737490c2b58d32) commit 9c8120015270d8a31c335c7137977749e5e8cd30 Author: Peter Colberg Date: Mon Dec 22 12:42:48 2025 -0500 Revert duplicate "drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces" This reverts commit 22a36e660d014925114feb09a2680bb3c2d1e279 once, which was merged twice due to an incorrect backmerge resolution. Fixes: ce0478b02ed2 ("Merge tag 'v6.18-rc6' into drm-next") Signed-off-by: Peter Colberg Signed-off-by: Alex Deucher (cherry picked from commit 38a0f4cf8c6147fd10baa206ab349f8ff724e391) commit 28695ca09d326461f8078332aa01db516983e8a2 Author: Mario Limonciello (AMD) Date: Wed Jan 7 15:37:28 2026 -0600 drm/amd: Clean up kfd node on surprise disconnect When an eGPU is unplugged the KFD topology should also be destroyed for that GPU. This never happens because the fini_sw callbacks never get to run. Run them manually before calling amdgpu_device_ip_fini_early() when a device has already been disconnected. This location is intentionally chosen to make sure that the kfd locking refcount doesn't get incremented unintentionally. Cc: kent.russell@amd.com Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33 Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Kent Russell Signed-off-by: Alex Deucher (cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab) Cc: stable@vger.kernel.org commit 9cb6278b44c38899961b36d303d7b18b38be2a6e Author: Lu Yao Date: Tue Jan 6 10:37:12 2026 +0800 drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane->fb rather than plane->state->fb. Fixes: fe151ed7af54 ("drm/amdgpu: add generic display panic helper code") Signed-off-by: Lu Yao Signed-off-by: Alex Deucher (cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef) commit 292e5757b2229c0c6f1d059123a85f8a28f4464d Author: Philip Yang Date: Thu Dec 4 12:13:05 2025 -0500 drm/amdgpu: Fix gfx9 update PTE mtype flag Fix copy&paste error, that should have been an assignment instead of an or, otherwise MTYPE_UC 0x3 can not be updated to MTYPE_RW 0x1. Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit fc1366016abe4103c0f0fac882811aea961ef213) Cc: stable@vger.kernel.org commit 1a75f24a7f8c2cac9c34126d7221ff59c5265316 Merge: 390caeed0897fc 5b027c74f3ee89 Author: Mark Brown Date: Wed Jan 14 19:38:52 2026 +0000 ASoC: Fix sdw_utils calling wrong codec init callbacks Merge series from Richard Fitzgerald : This series fixes a problem with soc_sdw_utils.c calling the wrong codec init callbacks, because it assumed that the DAI name could be used to uniquely identify the codec. This isn't the case, especially on SDCA which is a generic driver for many parts. The first patch is needed to add a missing export to SoundWire core. commit 015c2246edabc1f26500eb7735184d5f0355f81b Merge: 40b94ec7edbbb8 0edb475ac0a7d1 Author: Jens Axboe Date: Wed Jan 14 12:35:00 2026 -0700 Merge tag 'nvme-6.19-2026-01-14' of git://git.infradead.org/nvme into block-6.19 Pull NVMe fixes from Keith: "- Device quirk to disable faulty temperature (Ilikara) - TCP target null pointer fix from bad host protocol usage (Shivam) - Add compatible apple controller (Janne) - FC tagset leak fix (Chaitanya) - TCP socket deadlock fix (Hannes) - Target name buffer overrun fix (Shin'ichiro)" * tag 'nvme-6.19-2026-01-14' of git://git.infradead.org/nvme: nvme: fix PCIe subsystem reset controller state transition nvmet: do not copy beyond sybsysnqn string length nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() nvme-fc: release admin tagset if init fails nvme-apple: add "apple,t8103-nvme-ans2" as compatible nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec nvme-pci: disable secondary temp for Wodposit WPBSNM8 commit 5d9c4c272ba06055d19e05c2a02e16e58acc8943 Author: Alexandre Courbot Date: Mon Dec 8 11:47:04 2025 +0900 rust: irq: always inline functions using build_assert with arguments `build_assert` relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of `build_assert` might not be optimized out, triggering a build error. Cc: stable@vger.kernel.org Fixes: 746680ec6696 ("rust: irq: add flags module") Reviewed-by: Daniel Almeida Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251208-io-build-assert-v3-6-98aded02c1ea@nvidia.com Signed-off-by: Danilo Krummrich commit 33d19f621641de1b6ec6fe1bb2ac68a7d2c61f6a Author: Alexandre Courbot Date: Mon Dec 8 11:47:00 2025 +0900 rust: io: always inline functions using build_assert with arguments `build_assert` relies on the compiler to optimize out its error path. Functions using it with its arguments must thus always be inlined, otherwise the error path of `build_assert` might not be optimized out, triggering a build error. Cc: stable@vger.kernel.org Fixes: ce30d94e6855 ("rust: add `io::{Io, IoRaw}` base types") Reviewed-by: Daniel Almeida Signed-off-by: Alexandre Courbot Tested-by: Timur Tabi Link: https://patch.msgid.link/20251208-io-build-assert-v3-2-98aded02c1ea@nvidia.com Signed-off-by: Danilo Krummrich commit 944aacb68baf7624ab8d277d0ebf07f025ca137c Merge: e0d4140e804380 309a29b5965a0b Author: Linus Torvalds Date: Wed Jan 14 11:24:38 2026 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Only one core change (and one in doc only) the rest are drivers. The one core fix is for some inline encrypting drives that can't handle encryption requests on non-data commands (like error handling ones); it saves the request level encryption parameters in the eh_save structure so they can be cleared for error handling and restored after it is completed" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: host: mediatek: Make read-only array scale_us static const scsi: bfa: Update outdated comment scsi: mpt3sas: Update maintainer list scsi: ufs: core: Configure MCQ after link startup scsi: core: Fix error handler encryption support scsi: core: Correct documentation for scsi_test_unit_ready() scsi: ufs: dt-bindings: Fix several grammar errors commit 74e15ac34b098934895fd27655d098971d2b43d9 Author: Tamir Duberstein Date: Wed Jul 23 11:39:42 2025 -0400 scripts: generate_rust_analyzer: Add pin_init_internal deps Commit d7659acca7a3 ("rust: add pin-init crate build infrastructure") did not add dependencies to `pin_init_internal`, resulting in broken navigation. Thus add them now. [ Tamir elaborates: "before this series, go-to-symbol from pin_init_internal to e.g. proc_macro::TokenStream doesn't work." - Miguel ] Signed-off-by: Tamir Duberstein Reviewed-by: Jesung Yang Acked-by: Benno Lossin Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-3-3c6956173c78@kernel.org Signed-off-by: Miguel Ojeda commit 98dcca855343512a99432224447f07c5988753ad Author: Tamir Duberstein Date: Wed Jul 23 11:39:41 2025 -0400 scripts: generate_rust_analyzer: Add pin_init -> compiler_builtins dep Add a dependency edge from `pin_init` to `compiler_builtins` to `scripts/generate_rust_analyzer.py` to match `rust/Makefile`. This has been incorrect since commit d7659acca7a3 ("rust: add pin-init crate build infrastructure"). Signed-off-by: Tamir Duberstein Reviewed-by: Jesung Yang Acked-by: Benno Lossin Fixes: d7659acca7a3 ("rust: add pin-init crate build infrastructure") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-2-3c6956173c78@kernel.org Signed-off-by: Miguel Ojeda commit 5157c328edb35bac05ce77da473c3209d20e0bbb Author: Tamir Duberstein Date: Wed Jul 23 11:39:40 2025 -0400 scripts: generate_rust_analyzer: Add compiler_builtins -> core dep Add a dependency edge from `compiler_builtins` to `core` to `scripts/generate_rust_analyzer.py` to match `rust/Makefile`. This has been incorrect since commit 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`") Signed-off-by: Tamir Duberstein Reviewed-by: Jesung Yang Acked-by: Benno Lossin Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-1-3c6956173c78@kernel.org Signed-off-by: Miguel Ojeda commit 81a304f5b39c9a0a26c1b42997e60a5c9be05ec8 Author: FUJITA Tomonori Date: Wed Jan 14 18:16:38 2026 +0000 rust: macros: ignore example with module parameters `ModuleParamAccess` uses `SetOnce`, which depends on the helper functions so the `macros` crate example under `rusttest` fails to build: ---- rust/macros/lib.rs - module (line 62) stdout ---- error: linking with `cc` failed: exit status: 1 | = note: "cc" "-m64" ... = note: some arguments are omitted. use `--verbose` to show all linker arguments = note: rust-lld: error: undefined symbol: rust_helper_atomic_try_cmpxchg_relaxed >>> referenced by kernel.ecd446ce39a5fcbb-cgu.3 >>> kernel.kernel.ecd446ce39a5fcbb-cgu.3.rcgu.o:(kernel::sync::set_once::SetOnce$LT$T$GT$::populate::h8b02644e30bd70bc) in archive ./rust/test/libkernel.rlib rust-lld: error: undefined symbol: rust_helper_atomic_set_release >>> referenced by kernel.ecd446ce39a5fcbb-cgu.3 >>> kernel.kernel.ecd446ce39a5fcbb-cgu.3.rcgu.o:(kernel::sync::set_once::SetOnce$LT$T$GT$::populate::h8b02644e30bd70bc) in archive ./rust/test/libkernel.rlib collect2: error: ld returned 1 exit status Thus ignore that example to fix the error. [ Only the first one is needed (the other example does not use parameters), so we can keep it enabled. Thus I removed that second deletion (and reworded a bit). We may want to do something better here later on; on the other hand, we should get KUnit tests for `macros` too eventually, so we may end up removing or repurposing that target anyway, so it is not a big deal. - Miguel ] Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/rust-for-linux/CANiq72mEYacdZmHKvpbahJzO_X_qqYyiSiSTYaWEQZAfp6sbxg@mail.gmail.com/ Signed-off-by: FUJITA Tomonori Fixes: 0b24f9740f26 ("rust: module: update the module macro with module parameter support") Link: https://patch.msgid.link/20251210.082603.290476643413141778.fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda commit da579f05ef0faada3559e7faddf761c75cdf85e1 Author: Ming Lei Date: Wed Jan 14 16:54:05 2026 +0800 io_uring: move local task_work in exit cancel loop With IORING_SETUP_DEFER_TASKRUN, task work is queued to ctx->work_llist (local work) rather than the fallback list. During io_ring_exit_work(), io_move_task_work_from_local() was called once before the cancel loop, moving work from work_llist to fallback_llist. However, task work can be added to work_llist during the cancel loop itself. There are two cases: 1) io_kill_timeouts() is called from io_uring_try_cancel_requests() to cancel pending timeouts, and it adds task work via io_req_queue_tw_complete() for each cancelled timeout: 2) URING_CMD requests like ublk can be completed via io_uring_cmd_complete_in_task() from ublk_queue_rq() during canceling, given ublk request queue is only quiesced when canceling the 1st uring_cmd. Since io_allowed_defer_tw_run() returns false in io_ring_exit_work() (kworker != submitter_task), io_run_local_work() is never invoked, and the work_llist entries are never processed. This causes io_uring_try_cancel_requests() to loop indefinitely, resulting in 100% CPU usage in kworker threads. Fix this by moving io_move_task_work_from_local() inside the cancel loop, ensuring any work on work_llist is moved to fallback before each cancel attempt. Cc: stable@vger.kernel.org Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e0d4140e804380ae898da1e4c58c21e6323415a4 Merge: d19954ee63b221 6a069876eb1402 Author: Linus Torvalds Date: Wed Jan 14 08:55:09 2026 -0800 Merge tag 'bitmap-for-6.19-rc5' of https://github.com/norov/linux Pull bitmap fix from Yury Norov: "Fix Rust build for architectures implementing their own find_bit() ops (arm and m68k)" * tag 'bitmap-for-6.19-rc5' of https://github.com/norov/linux: rust: bitops: fix missing _find_* functions on 32-bit ARM commit d19954ee63b2211fcc14175d6cb07cbc040980d5 Merge: c537e12daeecae 69d6c6fc79eb3a Author: Linus Torvalds Date: Wed Jan 14 08:18:01 2026 -0800 Merge tag 'media/v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - ov02c10: some fixes related to preserving bayer pattern and horizontal control - ipu-bridge: Add quirks for some Dell XPS laptops with inverted sensors - mali-c55: Fix version identifier logic - rzg2l-cru: csi-2: fix RZ/V2H input sizes on some variants * tag 'media/v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: ov02c10: Remove unnecessary hflip and vflip pointers media: ipu-bridge: Add DMI quirk for Dell XPS laptops with upside down sensors media: ov02c10: Fix the horizontal flip control media: ov02c10: Adjust x-win/y-win when changing flipping to preserve bayer-pattern media: ov02c10: Fix bayer-pattern change after default vflip change media: rzg2l-cru: csi-2: Support RZ/V2H input sizes media: uapi: mali-c55-config: Remove version identifier media: mali-c55: Remove duplicated version check media: Documentation: mali-c55: Use v4l2-isp version identifier commit f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 Author: Rafael Beims Date: Tue Dec 23 12:02:54 2025 -0300 phy: freescale: imx8m-pcie: assert phy reset during power on After U-Boot initializes PCIe with "pcie enum", Linux fails to detect an NVMe disk on some boot cycles with: phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110 Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to lock when re-initialized without a reset cycle [1]. The issue reproduces on 7% of tested hardware platforms, with a 30-40% failure rate per affected device across boot cycles. Insert a reset cycle in the power-on routine to ensure the PHY is initialized from a known state. [1] https://community.nxp.com/t5/i-MX-Processors/iMX8MP-PCIe-initialization-in-U-Boot/m-p/2248437#M242401 Signed-off-by: Rafael Beims Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251223150254.1075221-1-rafael@beims.me Signed-off-by: Vinod Koul commit e93b31d0816201f9fd8daeaf69d6db99463d3e05 Author: Zhao Mengmeng Date: Tue Jan 13 16:26:14 2026 +0800 writeback: use round_jiffies_relative for dirtytime_work The dirtytime_work is a background housekeeping task that flushes dirty inodes, using round_jiffies_relative() will allow kernel to batch this work with other aligned system tasks, reducing power consumption. Signed-off-by: Zhao Mengmeng Link: https://patch.msgid.link/20260113082614.231580-1-zhaomzhao@126.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 561940a7ee81319b9cba06d2b7ba6b45a5c41cbc Author: Christoph Hellwig Date: Tue Jan 13 16:39:17 2026 +0100 iomap: wait for batched folios to be stable in __iomap_get_folio __iomap_get_folio needs to wait for writeback to finish if the file requires folios to be stable for writes. For the regular path this is taken care of by __filemap_get_folio, but for the newly added batch lookup it has to be done manually. This fixes xfs/131 failures when running on PI-capable hardware. Fixes: 395ed1ef0012 ("iomap: optional zero range dirty folio processing") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260113153943.3323869-1-hch@lst.de Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 0edb475ac0a7d153318a24d4dca175a270a5cc4f Author: Nilay Shroff Date: Wed Jan 14 12:54:13 2026 +0530 nvme: fix PCIe subsystem reset controller state transition The commit d2fe192348f9 (“nvme: only allow entering LIVE from CONNECTING state”) disallows controller state transitions directly from RESETTING to LIVE. However, the NVMe PCIe subsystem reset path relies on this transition to recover the controller on PowerPC (PPC) systems. On PPC systems, issuing a subsystem reset causes a temporary loss of communication with the NVMe adapter. A subsequent PCIe MMIO read then triggers EEH recovery, which restores the PCIe link and brings the controller back online. For EEH recovery to proceed correctly, the controller must transition back to the LIVE state. Due to the changes introduced by commit d2fe192348f9 (“nvme: only allow entering LIVE from CONNECTING state”), the controller can no longer transition directly from RESETTING to LIVE. As a result, EEH recovery exits prematurely, leaving the controller stuck in the RESETTING state. Fix this by explicitly transitioning the controller state from RESETTING to CONNECTING and then to LIVE. This satisfies the updated state transition rules and allows the controller to be successfully recovered on PPC systems following a PCIe subsystem reset. Cc: stable@vger.kernel.org Fixes: d2fe192348f9 ("nvme: only allow entering LIVE from CONNECTING state") Reviewed-by: Daniel Wagner Signed-off-by: Nilay Shroff Signed-off-by: Keith Busch commit 9bcb4c4c330ca36ba7ab398c03d75c15b769d59d Author: Xu Yang Date: Tue Jan 13 17:53:10 2026 +0800 usb: gadget: uvc: retry vb2_reqbufs() with vb_vmalloc_memops if use_sg fail Based on the reality[1][2] that vb2_dma_sg_alloc() can't alloc buffer with device DMA limits, those device will always get below error: "swiotlb buffer is full (sz: 393216 bytes), total 65536 (slots), used 2358 (slots)" and the uvc gadget function can't work at all. The videobuf2-dma-sg.c driver doesn't has a formal improve about this issue till now. For UVC gadget, the videobuf2 subsystem doesn't do dma_map() on vmalloc returned big buffer when allocate the video buffers, however, it do it for dma_sg returned buffer. So the issue happens for vb2_dma_sg_alloc(). To workaround the issue, lets retry vb2_reqbufs() with vb_vmalloc_memops if it fails to allocate buffer with vb2_dma_sg_memops. If use vmalloced buffer, UVC gadget will allocate some small buffers for each usb_request to do dma transfer, then uvc driver will memcopy data from big buffer to small buffer. Link[1]: https://lore.kernel.org/linux-media/20230828075420.2009568-1-anle.pan@nxp.com/ Link[2]: https://lore.kernel.org/linux-media/20230914145812.12851-1-hui.fang@nxp.com/ Signed-off-by: Xu Yang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260113-uvc-gadget-fix-patch-v2-4-62950ef5bcb5@nxp.com Signed-off-by: Greg Kroah-Hartman commit 0bce8f19bba16277257a915e4fb94e1cfe99d760 Author: Xu Yang Date: Tue Jan 13 17:53:09 2026 +0800 usb: gadget: uvc: return error from uvcg_queue_init() uvcg_queue_init() may fail, but its return value is currently ignored. Propagate the error code from uvcg_queue_init() to correctly report initialization failures. Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260113-uvc-gadget-fix-patch-v2-3-62950ef5bcb5@nxp.com Signed-off-by: Greg Kroah-Hartman commit 010dc57cb5163e5f4a32430dd5091cc29efd0471 Author: Xu Yang Date: Tue Jan 13 17:53:08 2026 +0800 usb: gadget: uvc: fix interval_duration calculation According to USB specification: For full-/high-speed isochronous endpoints, the bInterval value is used as the exponent for a 2^(bInterval-1) value. To correctly convert bInterval as interval_duration: interval_duration = 2^(bInterval-1) * frame_interval Because the unit of video->interval is 100ns, add a comment info to make it clear. Fixes: 48dbe731171e ("usb: gadget: uvc: set req_size and n_requests based on the frame interval") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260113-uvc-gadget-fix-patch-v2-2-62950ef5bcb5@nxp.com Signed-off-by: Greg Kroah-Hartman commit 2edc1acb1a2512843425aa19d0c6060a0a924605 Author: Xu Yang Date: Tue Jan 13 17:53:07 2026 +0800 usb: gadget: uvc: fix req_payload_size calculation Current req_payload_size calculation has 2 issue: (1) When the first time calculate req_payload_size for all the buffers, reqs_per_frame = 0 will be the divisor of DIV_ROUND_UP(). So the result is undefined. This happens because VIDIOC_STREAMON is always executed after VIDIOC_QBUF. So video->reqs_per_frame will be 0 until VIDIOC_STREAMON is run. (2) The buf->req_payload_size may be bigger than max_req_size. Take YUYV pixel format as example: If bInterval = 1, video->interval = 666666, high-speed: video->reqs_per_frame = 666666 / 1250 = 534 720p: buf->req_payload_size = 1843200 / 534 = 3452 1080p: buf->req_payload_size = 4147200 / 534 = 7766 Based on such req_payload_size, the controller can't run normally. To fix above issue, assign max_req_size to buf->req_payload_size when video->reqs_per_frame = 0. And limit buf->req_payload_size to video->req_size if it's large than video->req_size. Since max_req_size is used at many place, add it to struct uvc_video and set the value once endpoint is enabled. Fixes: 98ad03291560 ("usb: gadget: uvc: set req_length based on payload by nreqs instead of req_size") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20260113-uvc-gadget-fix-patch-v2-1-62950ef5bcb5@nxp.com Signed-off-by: Greg Kroah-Hartman commit 42c85d89b8d677b51f6a75569c69299a46d9f03d Author: Janne Grunau Date: Fri Jan 9 11:13:48 2026 +0100 usb: dwc3: apple: Ignore USB role switches to the active role Ignore USB role switches if dwc3-apple is already in the desired state. The USB-C port controller on M2 and M1/M2 Pro/Max/Ultra devices issues additional interrupts which result in USB role switches to the already active role. Ignore these USB role switches to ensure the USB-C port controller and dwc3-apple are always in a consistent state. This matches the behaviour in __dwc3_set_mode() in core.c. Fixes detecting USB 2.0 and 3.x devices on the affected systems. The reset caused by the additional role switch appears to leave the USB devices in a state which prevents detection when the phy and dwc3 is brought back up again. Fixes: 0ec946d32ef7 ("usb: dwc3: Add Apple Silicon DWC3 glue layer driver") Cc: stable Signed-off-by: Janne Grunau Acked-by: Thinh Nguyen Reviewed-by: Sven Peter Tested-by: Sven Peter # M1 mac mini and macbook air Link: https://patch.msgid.link/20260109-apple-dwc3-role-switch-v1-1-11623b0f6222@jannau.net Signed-off-by: Greg Kroah-Hartman commit d13b6a128a12e528bb18f971f2969feb286f45c7 Author: Wayne Chang Date: Mon Jan 12 22:56:53 2026 +0800 usb: host: xhci-tegra: Use platform_get_irq_optional() for wake IRQs When some wake IRQs are disabled in the device tree, the corresponding interrupt entries are removed from DT. In such cases, the driver currently calls platform_get_irq(), which returns -ENXIO and logs an error like: tegra-xusb 3610000.usb: error -ENXIO: IRQ index 2 not found However, not all wake IRQs are mandatory. The hardware can operate normally even if some wake sources are not defined in DT. To avoid this false alarm and allow missing wake IRQs gracefully, use platform_get_irq_optional() instead of platform_get_irq(). Fixes: 5df186e2ef11 ("usb: xhci: tegra: Support USB wakeup function for Tegra234") Cc: stable Signed-off-by: Wayne Chang Signed-off-by: Wei-Cheng Chen Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20260112145653.95691-1-weichengc@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 Author: Huacai Chen Date: Mon Jan 12 16:48:02 2026 +0800 USB: OHCI/UHCI: Add soft dependencies on ehci_platform Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not loaded first") said that ehci-hcd should be loaded before ohci-hcd and uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci- pci, which is not enough and we may still see the warnings in boot log. To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f is bogus, we only need the soft dependencies in the PCI level rather than the HCD level. However, there is really another neccessary soft dependencies between ohci-platform/uhci-platform and ehci-platform, which is added by this patch. The boot logs are below. 1. ohci-platform loaded before ehci-platform: ohci-platform 1f058000.usb: Generic Platform OHCI controller ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1 ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000 hub 1-0:1.0: USB hub found hub 1-0:1.0: 4 ports detected Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after usb 1-4: new low-speed USB device number 2 using ohci-platform ehci-platform 1f050000.usb: EHCI Host Controller ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2 ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000 ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00 usb 1-4: device descriptor read/all, error -62 hub 2-0:1.0: USB hub found hub 2-0:1.0: 4 ports detected usb 1-4: new low-speed USB device number 3 using ohci-platform input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0 2. ehci-platform loaded before ohci-platform: ehci-platform 1f050000.usb: EHCI Host Controller ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1 ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000 ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 4 ports detected ohci-platform 1f058000.usb: Generic Platform OHCI controller ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2 ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 4 ports detected usb 2-4: new low-speed USB device number 2 using ohci-platform input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0 hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0 In the later case, there is no re-connection for USB-1.0/1.1 devices, which is expected. Cc: stable Reported-by: Shengwen Xiao Signed-off-by: Huacai Chen Reviewed-by: Alan Stern Link: https://patch.msgid.link/20260112084802.1995923-1-chenhuacai@loongson.cn Signed-off-by: Greg Kroah-Hartman commit c4380ee3ccbf591d855317249f31c820b7b73a46 Author: Sven Peter Date: Fri Jan 9 17:43:34 2026 +0100 usb: dwc3: apple: Set USB2 PHY mode before dwc3 init Now that the upstream code has been getting broader test coverage by our users we occasionally see issues with USB2 devices plugged in during boot. Before Linux is running, the USB2 PHY has usually been running in device mode and it turns out that sometimes host->device or device->host transitions don't work. The root cause: If the role inside the USB2 PHY is re-configured when it has already been powered on or when dwc3 has already enabled the ULPI interface the new configuration sometimes doesn't take affect until dwc3 is reset again. Fix this rare issue by configuring the role much earlier. Note that the USB3 PHY does not suffer from this issue and actually requires dwc3 to be up before the correct role can be configured there. Reported-by: James Calligeros Reported-by: Janne Grunau Fixes: 0ec946d32ef7 ("usb: dwc3: Add Apple Silicon DWC3 glue layer driver") Cc: stable Tested-by: Janne Grunau Reviewed-by: Janne Grunau Acked-by: Thinh Nguyen Signed-off-by: Sven Peter Link: https://patch.msgid.link/20260109-dwc3-apple-usb2phy-fix-v2-1-ab6b041e3b26@kernel.org Signed-off-by: Greg Kroah-Hartman commit e07dea3de508cd6950c937cec42de7603190e1ca Author: Wentao Liang Date: Fri Jan 9 15:46:26 2026 +0000 phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() The for_each_available_child_of_node() calls of_node_put() to release child_np in each success loop. After breaking from the loop with the child_np has been released, the code will jump to the put_child label and will call the of_node_put() again if the devm_request_threaded_irq() fails. These cause a double free bug. Fix by returning directly to avoid the duplicate of_node_put(). Fixes: ed2b5a8e6b98 ("phy: phy-rockchip-inno-usb2: support muxed interrupts") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260109154626.2452034-1-vulab@iscas.ac.cn Signed-off-by: Vinod Koul commit 46378ab9fcb796dca46b51e10646f636e2c661f9 Author: Emil Svendsen Date: Tue Jan 13 11:58:47 2026 +0100 ASoC: tlv320adcx140: fix word length The word length is the physical width of the channel slots. So the hw_params would misconfigure when format width and physical width doesn't match. Like S24_LE which has data width of 24 bits but physical width of 32 bits. So if using asymmetric formats you will get a lot of noise. Fixes: 689c7655b50c5 ("ASoC: tlv320adcx140: Add the tlv320adcx140 codec driver family") Signed-off-by: Emil Svendsen Signed-off-by: Sascha Hauer Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-4-8f7ecec525c8@pengutronix.de Signed-off-by: Mark Brown commit d89aad92cfd15edbd704746f44c98fe687f9366f Author: Dimitrios Katsaros Date: Tue Jan 13 11:58:46 2026 +0100 ASoC: tlv320adcx140: Propagate error codes during probe When scanning for the reset pin, we could get an -EPROBE_DEFER. The driver would assume that no reset pin had been defined, which would mean that the chip would never be powered. Now we both respect any error we get from devm_gpiod_get_optional. We also now properly report the missing GPIO definition when 'gpio_reset' is NULL. Signed-off-by: Dimitrios Katsaros Signed-off-by: Sascha Hauer Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-3-8f7ecec525c8@pengutronix.de Signed-off-by: Mark Brown commit be7664c81d3129fc313ef62ff275fd3d33cfecd4 Author: Emil Svendsen Date: Tue Jan 13 11:58:45 2026 +0100 ASoC: tlv320adcx140: fix null pointer The "snd_soc_component" in "adcx140_priv" was only used once but never set. It was only used for reaching "dev" which is already present in "adcx140_priv". Fixes: 4e82971f7b55 ("ASoC: tlv320adcx140: Add a new kcontrol") Signed-off-by: Emil Svendsen Signed-off-by: Sascha Hauer Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-2-8f7ecec525c8@pengutronix.de Signed-off-by: Mark Brown commit 4130dc47ce8f60d289d91e2bdd18c4d863ca3237 Author: Emil Svendsen Date: Tue Jan 13 11:58:44 2026 +0100 ASoC: tlv320adcx140: invert DRE_ENABLE Looking at section 8.6.1.1.69 in datasheets for both 5140 and 6140 (3140 doesn't support DRE). REG ADCX140_DSP_CFG1 BIT 3 field "DRE_AGC_SEL" it select either DRE or AGC. It states: * 0 = DRE * 1 = AGC The control is called "DRE_ENABLE" and for it to be true it has to be active low. This commit will invert the control so "DRE_ENABLE" is active low. Signed-off-by: Emil Svendsen Signed-off-by: Sascha Hauer Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-1-8f7ecec525c8@pengutronix.de Signed-off-by: Mark Brown commit 390caeed0897fcac75f3c414dbdd85d593183d9c Author: Cole Leavitt Date: Tue Jan 13 19:55:18 2026 -0700 ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type The CS42L43 codec's load detection can return different impedance values that map to either HEADPHONE or LINEOUT jack types. However, the soc_jack_pins array only maps SND_JACK_HEADPHONE to the "Headphone" DAPM pin, not SND_JACK_LINEOUT. When headphones are detected with an impedance that maps to LINEOUT (such as impedance value 0x2), the driver reports SND_JACK_LINEOUT. Since this doesn't match the jack pin mask, the "Headphone" DAPM pin is not activated, and no audio is routed to the headphone outputs. Fix by adding SND_JACK_LINEOUT to the Headphone pin mask, so that both headphone and line-out detection properly enable the headphone output path. This fixes no audio output on devices like the Lenovo ThinkPad P16 Gen 3 where headphones are detected with LINEOUT impedance. Fixes: d74bad3b7452 ("ASoC: intel: sof_sdw_cs42l43: Create separate jacks for hp and mic") Reviewed-by: Charles Keepax Signed-off-by: Cole Leavitt Link: https://patch.msgid.link/20260114025518.28519-1-cole@unwrap.rs Signed-off-by: Mark Brown commit 5b027c74f3ee8979193c50d31187edfa31acc0db Author: Richard Fitzgerald Date: Mon Jan 12 14:07:57 2026 +0000 ASoC: sdw_utils: Call init callbacks on the correct codec DAI asoc_sdw_rtd_init() needs to call the rtd_init() callbacks for each codec in a dailink. It was finding the codecs by looking for the matching DAI name in codec_info_list[] but this isn't correct, because the DAI name isn't guaranteed to be unique. Parts using the same codec driver (so the same DAI names) might require different machine driver setup. Instead, get the struct sdw_slave and extract the SoundWire part ID. Use this to lookup the entry in codec_info_list[]. This is the same identity info that was used to find the entry when the machine driver created the dailink. Signed-off-by: Richard Fitzgerald Fixes: e377c9477317 ("ASoC: intel/sdw_utils: move soundwire codec_info_list structure") Reviewed-by: Pierre-Louis Bossart Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260112140758.215799-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 1ddbcb910a06f53fc2b14e1743c6ad4ccfd7107f Author: Richard Fitzgerald Date: Mon Jan 12 14:07:56 2026 +0000 soundwire: Add missing EXPORT for sdw_slave_type include/sdw_type.h provides the function is_sdw_slave() which requires sdw_slave_type. But sdw_slave_type was not exported. Signed-off-by: Richard Fitzgerald Acked-by: Vinod Koul Reviewed-by: Pierre-Louis Bossart Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260112140758.215799-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit baaecfcac559bcac73206df447eb5c385fa22f2a Author: Arkadiusz Kozdra Date: Sat Jan 10 12:48:08 2026 +0100 kconfig: fix static linking of nconf When running make nconfig with a static linking host toolchain, the libraries are linked in an incorrect order, resulting in errors similar to the following: $ MAKEFLAGS='HOSTCC=cc\ -static' make nconfig /usr/bin/ld: /usr/lib64/gcc/x86_64-unknown-linux-gnu/14.2.1/../../../../lib64/libpanel.a(p_new.o): in function `new_panel': (.text+0x13): undefined reference to `_nc_panelhook_sp' /usr/bin/ld: (.text+0x6c): undefined reference to `_nc_panelhook_sp' Fixes: 1c5af5cf9308 ("kconfig: refactor ncurses package checks for building mconf and nconf") Signed-off-by: Arusekk Link: https://patch.msgid.link/20260110114808.22595-1-floss@arusekk.pl [nsc: Added comment about library order] Signed-off-by: Nicolas Schier commit 946d462346d2ded161cfd3dc62a61d7050d9f9ec Author: Carlos Llamas Date: Thu Dec 18 17:58:06 2025 +0000 kbuild: prefer ${NM} in check-function-names.sh The check-function-names.sh scripts invokes 'nm' directly and this can be problematic during cross-compilation when the toolchain is different from the system's default (e.g. LLVM=1). scripts/check-function-names.sh: nm: not found Let's prefer the ${NM} variable which is already set by kbuild. However, still fallback to plain 'nm' to ensure the script is still usable when called directly. Fixes: 93863f3f859a ("kbuild: Check for functions with ambiguous -ffunction-sections section names") Signed-off-by: Carlos Llamas Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251218175824.3122690-1-cmllamas@google.com Signed-off-by: Nicolas Schier commit f2a3f51365bf672dab4b58d1e8954926a9196b44 Author: Carlos Song Date: Fri Nov 21 11:00:30 2025 +0800 i2c: imx-lpi2c: change to PIO mode in system-wide suspend/resume progress EDMA resumes early and suspends late in the system power transition sequence, while LPI2C enters the NOIRQ stage for both suspend and resume. This means LPI2C resources become available before EDMA is fully resumed. Once IRQs are enabled, a slave device may immediately trigger an LPI2C transfer. If the transfer length meets DMA requirements, the driver will attempt to use EDMA even though EDMA may still be unavailable. This timing gap can lead to transfer failures. To prevent this, force LPI2C to use PIO mode during system-wide suspend and resume transitions. This reduces dependency on EDMA and avoids using an unready DMA resource. Fixes: a09c8b3f9047 ("i2c: imx-lpi2c: add eDMA mode support for LPI2C") Signed-off-by: Carlos Song Reviewed-by: Frank Li Signed-off-by: Wolfram Sang commit c0c50e3743e467ec4752c638e10e97f89c8644e2 Author: Neil Armstrong Date: Wed Oct 29 19:07:42 2025 +0100 i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA The I2C Hub controller is a simpler GENI I2C variant that doesn't support DMA at all, add a no_dma flag to make sure it nevers selects the SE DMA mode with mappable 32bytes long transfers. Fixes: cacd9643eca7 ("i2c: qcom-geni: add support for I2C Master Hub variant") Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Reviewed-by: Mukesh Kumar Savaliya > Signed-off-by: Wolfram Sang commit 36a70608a31487a2ecb8f501877813e94cf78b70 Merge: 0f61b1860cc3f5 978d28136c53df Author: Greg Kroah-Hartman Date: Wed Jan 14 12:22:39 2026 +0100 Merge tag 'iio-fixes-for-6.19a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: 1st set of fixes for the 6.19 cycle The usual mixed bag of fixes for ancient problems plus some more recent ones. adi,ad7280a - Check for errors from spi_setup(). adi,ad3552r - Fix potential buffer overflow when setting to use the internal ramp. adi,ax5695r - Fill in the data for this device in the chip info table. adi,ad7606 - Don't store a negative error in an unsigned int. adi,ad9467 - Fix incorrect register mask value. adi,adxl380 - Fix inverted condition for whether INT1 interrupt present in dt. atmel,at91-sama5d2 - Cancel work on remove to avoid a potential use-after-free invensense,icm45600 - Fix temperature scaling. samsung,eynos_adc - Use of_platform_depolulate() to correctly clear up such that child devices are created correctly if the driver is rebound. sensiron,scd4x - Fix incorrect endianness reported to user-space. st,accel - Fix gain reported for the iis329dq. st,lsm6dsx - Hide event related interfaces on parts that don't support events. ti,pac1934 - Ensure output of clamp() is used rather than unclamped value. * tag 'iio-fixes-for-6.19a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source iio: accel: iis328dq: fix gain values iio: core: add separate lockdep class for info_exist_lock iio: chemical: scd4x: fix reported channel endianness iio: imu: inv_icm45600: fix temperature offset reporting iio: adc: exynos_adc: fix OF populate on driver rebind iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl iio: accel: adxl380: fix handling of unavailable "INT1" interrupt iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot iio: adc: ad9467: fix ad9434 vref mask iio: adc: ad7606: Fix incorrect type for error return variable iio: adc: ad7280a: handle spi_setup() errors in probe() iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver commit d7f1b4bdc7108be1b178e1617b5f45c8918e88d7 Author: Morduan Zang Date: Wed Jan 14 13:30:33 2026 +0800 efi/cper: Fix cper_bits_to_str buffer handling and return value The return value calculation was incorrect: `return len - buf_size;` Initially `len = buf_size`, then `len` decreases with each operation. This results in a negative return value on success. Fix by returning `buf_size - len` which correctly calculates the actual number of bytes written. Fixes: a976d790f494 ("efi/cper: Add a new helper function to print bitmasks") Signed-off-by: Morduan Zang Signed-off-by: Ard Biesheuvel commit b91a565ed14fcf900b4d95e86882b4b763860986 Author: Thomas Zimmermann Date: Thu Jan 8 15:19:46 2026 +0100 drm/sysfb: Remove duplicate declarations Commit 6046b49bafff ("drm/sysfb: Share helpers for integer validation") and commit e8c086880b2b ("drm/sysfb: Share helpers for screen_info validation") added duplicate function declarations. Remove the latter ones. Signed-off-by: Thomas Zimmermann Fixes: e8c086880b2b ("drm/sysfb: Share helpers for screen_info validation") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: dri-devel@lists.freedesktop.org Cc: # v6.16+ Reviewed-by: Javier Martinez Canillas Link: https://patch.msgid.link/20260108145058.56943-7-tzimmermann@suse.de commit c6ccd098807483762ccd726e1498bac5a71d0005 Author: Robin Murphy Date: Mon Jan 12 15:46:38 2026 +0000 dma/pool: Avoid allocating redundant pools On smaller systems, e.g. embedded arm64, it is common for all memory to end up in ZONE_DMA32 or even ZONE_DMA. In such cases it is redundant to allocate a nominal pool for an empty higher zone that just ends up coming from a lower zone that should already have its own pool anyway. We already have logic to skip allocating a ZONE_DMA pool when that is empty, so generalise that to save memory in the case of other zones too. Signed-off-by: Robin Murphy Tested-by: Vladimir Kondratiev Reviewed-by: Baoquan He Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/8ab8d8a620dee0109f33f5cb63d6bfeed35aac37.1768230104.git.robin.murphy@arm.com commit 6626734dd2b151753e134730e27d17e64784c345 Author: Robin Murphy Date: Mon Jan 12 15:46:37 2026 +0000 mm_zone: Generalise has_managed_dma() It would be useful to be able to check for potential DMA pages beyond just ZONE_DMA - generalise the existing has_managed_dma() function to allow checking other zones too. Signed-off-by: Robin Murphy Acked-by: David Hildenbrand (Red Hat) Acked-by: Mike Rapoport (Microsoft) Tested-by: Vladimir Kondratiev Reviewed-by: Baoquan He Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/bd002d2351074e57be1ca08f03f333debac658fb.1768230104.git.robin.murphy@arm.com commit b31ac41b59b6b6f1f6d426e2088e5c391bf89bf3 Author: Robin Murphy Date: Mon Jan 12 15:46:36 2026 +0000 dma/pool: Improve pool lookup If CONFIG_ZONE_DMA32 is enabled, but we have not allocated the corresponding atomic_pool_dma32, dma_guess_pool() may return the NULL value of that and fail a GFP_DMA32 allocation without trying to fall back to other pools which may exist. Furthermore, if no GFP_DMA pool exists, it is preferable to try GFP_DMA32 rather than immediately fall back to GFP_KERNEL with even less chance of success. Improve matters by encoding an explicit order of pool preference for each flag. Signed-off-by: Robin Murphy Tested-by: Vladimir Kondratiev Reviewed-by: Baoquan He Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/c846b1a2f43295cac926c7af2ce907f62baec518.1768230104.git.robin.murphy@arm.com commit e7df8567878f9cbb9059287161e80f7c7da9b15c Merge: 2120f3a3738a65 31707572108da5 Author: Johannes Berg Date: Wed Jan 14 10:41:03 2026 +0100 Merge tag 'ath-current-20260113' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath into wireless Jeff Johnson says: ================== ath.git update for v6.19-rc6 A collection of small bug fixes in ath10k and ath12k. ================== Link: https://patch.msgid.link/98386125-c0bb-495e-b2ba-2765aaed19d8@oss.qualcomm.com Signed-off-by: Johannes Berg commit c537e12daeecaecdcd322c56a5f70659d2de7bde Merge: b54345928fa1db ec69daabe45256 Author: Linus Torvalds Date: Tue Jan 13 21:21:13 2026 -0800 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK in riscv JIT (Menglong Dong) - Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) - Fix metadata size check in bpf_test_run() (Toke Høiland-Jørgensen) - Check that BPF insn array is not allowed as a map for const strings (Deepanshu Kartikey) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix reference count leak in bpf_prog_test_run_xdp() bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() selftests/bpf: Update xdp_context_test_run test to check maximum metadata size bpf, test_run: Subtract size of xdp_frame from allowed metadata size riscv, bpf: Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 Author: Eric Dumazet Date: Mon Jan 12 17:56:56 2026 +0000 net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: syzbot+07f3f38f723c335f106d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260112175656.17605-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6a069876eb1402478900ee0eb7d7fe276bb1f4e3 Author: Alice Ryhl Date: Mon Jan 5 10:44:06 2026 +0000 rust: bitops: fix missing _find_* functions on 32-bit ARM On 32-bit ARM, you may encounter linker errors such as this one: ld.lld: error: undefined symbol: _find_next_zero_bit >>> referenced by rust_binder_main.43196037ba7bcee1-cgu.0 >>> drivers/android/binder/rust_binder_main.o:(::insert_or_update_handle) in archive vmlinux.a >>> referenced by rust_binder_main.43196037ba7bcee1-cgu.0 >>> drivers/android/binder/rust_binder_main.o:(::insert_or_update_handle) in archive vmlinux.a This error occurs because even though the functions are declared by include/linux/find.h, the definition is #ifdef'd out on 32-bit ARM. This is because arch/arm/include/asm/bitops.h contains: #define find_first_zero_bit(p,sz) _find_first_zero_bit_le(p,sz) #define find_next_zero_bit(p,sz,off) _find_next_zero_bit_le(p,sz,off) #define find_first_bit(p,sz) _find_first_bit_le(p,sz) #define find_next_bit(p,sz,off) _find_next_bit_le(p,sz,off) And the underscore-prefixed function is conditional on #ifndef of the non-underscore-prefixed name, but the declaration in find.h is *not* conditional on that #ifndef. To fix the linker error, we ensure that the symbols in question exist when compiling Rust code. We do this by defining them in rust/helpers/ whenever the normal definition is #ifndef'd out. Note that these helpers are somewhat unusual in that they do not have the rust_helper_ prefix that most helpers have. Adding the rust_helper_ prefix does not compile, as 'bindings::_find_next_zero_bit()' will result in a call to a symbol called _find_next_zero_bit as defined by include/linux/find.h rather than a symbol with the rust_helper_ prefix. This is because when a symbol is present in both include/ and rust/helpers/, the one from include/ wins under the assumption that the current configuration is one where that helper is unnecessary. This heuristic fails for _find_next_zero_bit() because the header file always declares it even if the symbol does not exist. The functions still use the __rust_helper annotation. This lets the wrapper function be inlined into Rust code even if full kernel LTO is not used once the patch series for that feature lands. Yury: arches are free to implement they own find_bit() functions. Most rely on generic implementation, but arm32 and m86k - not; so they require custom handling. Alice confirmed it fixes the build for both. Cc: stable@vger.kernel.org Fixes: 6cf93a9ed39e ("rust: add bindings for bitops.h") Reported-by: Andreas Hindborg Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/x/topic/x/near/561677301 Tested-by: Andreas Hindborg Reviewed-by: Dirk Behme Signed-off-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit dbe6b3138fb877a368917833f713bfbbb521045e Merge: ddf96c393a33ae cf055f8c000445 Author: Jakub Kicinski Date: Tue Jan 13 19:13:10 2026 -0800 Merge branch 'selftests-couple-of-fixes-in-toeplitz-rps-cases' Gal Pressman says: ==================== selftests: Couple of fixes in Toeplitz RPS cases Fix a couple of bugs in the RPS cases of the Toeplitz selftest. ==================== Link: https://patch.msgid.link/20260112173715.384843-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit cf055f8c000445aa688c53a706ef4f580818eedb Author: Gal Pressman Date: Mon Jan 12 19:37:15 2026 +0200 selftests: drv-net: fix RPS mask handling for high CPU numbers The RPS bitmask bounds check uses ~(RPS_MAX_CPUS - 1) which equals ~15 = 0xfff0, only allowing CPUs 0-3. Change the mask to ~((1UL << RPS_MAX_CPUS) - 1) = ~0xffff to allow CPUs 0-15. Fixes: 5ebfb4cc3048 ("selftests/net: toeplitz test") Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260112173715.384843-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 9d48c62f6b4ed70ebeea70f52ddb1c6d8613bed4 Author: Gal Pressman Date: Mon Jan 12 19:37:14 2026 +0200 selftests: drv-net: fix RPS mask handling in toeplitz test The toeplitz.py test passed the hex mask without "0x" prefix (e.g., "300" for CPUs 8,9). The toeplitz.c strtoul() call wrongly parsed this as decimal 300 (0x12c) instead of hex 0x300. Pass the prefixed mask to toeplitz.c, and the unprefixed one to sysfs. Fixes: 9cf9aa77a1f6 ("selftests: drv-net: hw: convert the Toeplitz test to Python") Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260112173715.384843-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit ddf96c393a33aef4887e2e406c76c2f8cda1419c Author: Kuniyuki Iwashima Date: Tue Jan 13 01:05:08 2026 +0000 ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->flags for temporary addresses in inet6_addr_del(). Let's move ipv6_del_addr() down to fix the UAF. [0]: BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593 CPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181 inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f164cf8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749 RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003 RBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288 Allocated by task 9593: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120 inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050 addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160 inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6099: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free_freelist_hook mm/slub.c:2569 [inline] slab_free_bulk mm/slub.c:6696 [inline] kmem_cache_free_bulk mm/slub.c:7383 [inline] kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362 kfree_bulk include/linux/slab.h:830 [inline] kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523 kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline] kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Fixes: 00b5b7aab9e42 ("net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged") Reported-by: syzbot+72e610f4f1a930ca9d8a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/696598e9.050a0220.3be5c5.0009.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Hangbin Liu Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260113010538.2019411-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 9a6f0c4d5796ab89b5a28a890ce542344d58bd69 Author: Eric Dumazet Date: Mon Jan 12 10:38:25 2026 +0000 dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_init()/INIT_LIST_HEAD() while writing list->prev, while the prior write on list->next went well. static inline void INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); // This went well WRITE_ONCE(list->prev, list); // Crash, @list has been freed. } Issue here is that rt6_uncached_list_del() did not attempt to lock ul->lock, as list_empty(&rt->dst.rt_uncached) returned true because the WRITE_ONCE(list->next, list) happened on the other CPU. We might use list_del_init_careful() and list_empty_careful(), or make sure rt6_uncached_list_del() always grabs the spinlock whenever rt->dst.rt_uncached_list has been set. A similar fix is neeed for IPv4. [1] BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD include/linux/list.h:46 [inline] BUG: KASAN: slab-use-after-free in list_del_init include/linux/list.h:296 [inline] BUG: KASAN: slab-use-after-free in rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline] BUG: KASAN: slab-use-after-free in rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020 Write of size 8 at addr ffff8880294cfa78 by task kworker/u8:14/3450 CPU: 0 UID: 0 PID: 3450 Comm: kworker/u8:14 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: netns cleanup_net Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 INIT_LIST_HEAD include/linux/list.h:46 [inline] list_del_init include/linux/list.h:296 [inline] rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline] rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020 addrconf_ifdown+0x143/0x18a0 net/ipv6/addrconf.c:3853 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282 [inline] netif_close_many+0x29c/0x410 net/core/dev.c:1785 unregister_netdevice_many_notify+0xb50/0x2330 net/core/dev.c:12353 ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:248 cleanup_net+0x4de/0x7b0 net/core/net_namespace.c:696 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Allocated by task 803: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270 dst_alloc+0x105/0x170 net/core/dst.c:89 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333 mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Freed by task 20: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6670 [inline] kmem_cache_free+0x18f/0x8d0 mm/slub.c:6781 dst_destroy+0x235/0x350 net/core/dst.c:121 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core kernel/rcu/tree.c:2857 [inline] rcu_cpu_kthread+0xba5/0x1af0 kernel/rcu/tree.c:2945 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Last potentially related work creation: kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556 __call_rcu_common kernel/rcu/tree.c:3119 [inline] call_rcu+0xee/0x890 kernel/rcu/tree.c:3239 refdst_drop include/net/dst.h:266 [inline] skb_dst_drop include/net/dst.h:278 [inline] skb_release_head_state+0x71/0x360 net/core/skbuff.c:1156 skb_release_all net/core/skbuff.c:1180 [inline] __kfree_skb net/core/skbuff.c:1196 [inline] sk_skb_reason_drop+0xe9/0x170 net/core/skbuff.c:1234 kfree_skb_reason include/linux/skbuff.h:1322 [inline] tcf_kfree_skb_list include/net/sch_generic.h:1127 [inline] __dev_xmit_skb net/core/dev.c:4260 [inline] __dev_queue_xmit+0x26aa/0x3210 net/core/dev.c:4785 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff8880294cfa00 which belongs to the cache ip6_dst_cache of size 232 The buggy address is located 120 bytes inside of freed 232-byte region [ffff8880294cfa00, ffff8880294cfae8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x294cf memcg:ffff88803536b781 flags: 0x80000000000000(node=0|zone=1) page_type: f5(slab) raw: 0080000000000000 ffff88802ff1c8c0 ffffea0000bf2bc0 dead000000000006 raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff88803536b781 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9, tgid 9 (kworker/0:0), ts 91119585830, free_ts 91088628818 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x234/0x290 mm/page_alloc.c:1857 prep_new_page mm/page_alloc.c:1865 [inline] get_page_from_freelist+0x28c0/0x2960 mm/page_alloc.c:3915 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5210 alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486 alloc_slab_page mm/slub.c:3075 [inline] allocate_slab+0x86/0x3b0 mm/slub.c:3248 new_slab mm/slub.c:3302 [inline] ___slab_alloc+0xb10/0x13e0 mm/slub.c:4656 __slab_alloc+0xc6/0x1f0 mm/slub.c:4779 __slab_alloc_node mm/slub.c:4855 [inline] slab_alloc_node mm/slub.c:5251 [inline] kmem_cache_alloc_noprof+0x101/0x6c0 mm/slub.c:5270 dst_alloc+0x105/0x170 net/core/dst.c:89 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333 mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 page last free pid 5859 tgid 5859 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xfe1/0x1170 mm/page_alloc.c:2943 discard_slab mm/slub.c:3346 [inline] __put_partials+0x149/0x170 mm/slub.c:3886 __slab_free+0x2af/0x330 mm/slub.c:5952 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270 getname_flags+0xb8/0x540 fs/namei.c:146 getname include/linux/fs.h:2498 [inline] do_sys_openat2+0xbc/0x200 fs/open.c:1426 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister") Fixes: 78df76a065ae ("ipv4: take rt_uncached_lock only if needed") Reported-by: syzbot+179fc225724092b8b2b2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6964cdf2.050a0220.eaf7.009d.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Martin KaFai Lau Reviewed-by: David Ahern Link: https://patch.msgid.link/20260112103825.3810713-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d23564955811da493f34412d7de60fa268c8cb50 Author: Aditya Garg Date: Mon Jan 12 02:01:33 2026 -0800 net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang. Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior. Fixes: 962f3fee83a4 ("netvsc: add ethtool ops to get/set RSS key") Signed-off-by: Aditya Garg Reviewed-by: Dipayaan Roy Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/1768212093-1594-1-git-send-email-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 456c4f5ff0c886fd49daaa4dec13160df872bbc3 Author: Lyude Paul Date: Fri Dec 19 16:52:03 2025 -0500 drm/nouveau/kms/nv50-: Assert we hold nv50_disp->lock in nv50_head_flush_* Now that we've had one bug that occurred in nouveau as the result of nv50_head_flush_* being called without the appropriate locks, let's add some lockdep asserts to make sure this doesn't happen in the future. Reviewed-by: Dave Airlie Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251219215344.170852-3-lyude@redhat.com commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e Author: Lyude Paul Date: Fri Dec 19 16:52:02 2025 -0500 drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare For a while, I've been seeing a strange issue where some (usually not all) of the display DMA channels will suddenly hang, particularly when there is a visible cursor on the screen that is being frequently updated, and especially when said cursor happens to go between two screens. While this brings back lovely memories of fixing Intel Skylake bugs, I would quite like to fix it :). It turns out the problem that's happening here is that we're managing to reach nv50_head_flush_set() in our atomic commit path without actually holding nv50_disp->mutex. This means that cursor updates happening in parallel (along with any other atomic updates that need to use the core channel) will race with eachother, which eventually causes us to corrupt the pushbuffer - leading to a plethora of various GSP errors, usually: nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001 nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001 The reason this is happening is because generally we check whether we need to set nv50_atom->lock_core at the end of nv50_head_atomic_check(). However, curs507a_prepare is called from the fb_prepare callback, which happens after the atomic check phase. As a result, this can lead to commits that both touch the core channel but also don't grab nv50_disp->mutex. So, fix this by making sure that we set nv50_atom->lock_core in cus507a_prepare(). Reviewed-by: Dave Airlie Signed-off-by: Lyude Paul Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") Cc: # v4.18+ Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com commit 7edf6f7ef5345e1b4202912ca98aaa7c73e1e82c Author: Rafael J. Wysocki Date: Tue Jan 13 14:36:54 2026 +0100 ACPI: PM: s2idle: Add module parameter for LPS0 constraints checking Commit 32ece31db4df ("ACPI: PM: s2idle: Only retrieve constraints when needed") attempted to avoid useless evaluation of LPS0 _DSM Function 1 in lps0_device_attach() because pm_debug_messages_on might never be set (and that is the case on production systems most of the time), but it turns out that LPS0 _DSM Function 1 is generally problematic on some platforms and causes suspend issues to occur when pm_debug_messages_on is set now. In Linux, LPS0 _DSM Function 1 is only useful for diagnostics and only in the cases when the system does not reach the deepest platform idle state during suspend-to-idle for some reason. If such diagnostics is not necessary, evaluating it is a loss of time, so using it along with the other pm_debug_messages_on diagnostics is questionable because the latter is expected to be suitable for collecting debug information even during production use of system suspend. For this reason, add a module parameter called check_lps0_constraints to control whether or not the list of LPS0 constraints will be checked in acpi_s2idle_prepare_late_lps0() and so whether or not to evaluate LPS0 _DSM Function 1 (once) in acpi_s2idle_begin_lps0(). Fixes: 32ece31db4df ("ACPI: PM: s2idle: Only retrieve constraints when needed") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/2827214.mvXUDI8C0e@rafael.j.wysocki commit 84164acba33158208c2b0e8e5607bdd43edc0dd4 Author: Shin'ichiro Kawasaki Date: Sun Dec 21 16:37:14 2025 +0900 nvmet: do not copy beyond sybsysnqn string length Commit edd17206e363 ("nvmet: remove redundant subsysnqn field from ctrl") replaced ctrl->subsysnqn with ctrl->subsys->subsysnqn. This change works as expected because both point to strings with the same data. However, their memory allocation lengths differ. ctrl->subsysnqn had the fixed size defined as NVMF_NQN_FILED_LEN, while ctrl->subsys->subsysnqn has variable length determined by kstrndup(). Due to this difference, KASAN slab-out-of-bounds occurs at memcpy() in nvmet_passthru_override_id_ctrl() after the commit. The failure can be recreated by running the blktests test case nvme/033. To prevent such failures, replace memcpy() with strscpy(), which copies only the string length and avoids overruns. Fixes: edd17206e363 ("nvmet: remove redundant subsysnqn field from ctrl") Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit fa5726692e4ca0d4e56d7cbd1b33126efd3f849e Author: Donald Hunter Date: Mon Jan 12 15:34:36 2026 +0000 tools: ynl: render event op docs correctly The docs for YNL event ops currently render raw python structs. For example in: https://docs.kernel.org/netlink/specs/ethtool.html#cable-test-ntf event: {‘attributes’: [‘header’, ‘status’, ‘nest’], ‘__lineno__’: 2385} Handle event ops correctly and render their op attributes: event: attributes: [header, status] Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20260112153436.75495-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 8ad1b6c1e63d25f5465b7a8aa403bdcee84b86f9 Author: Chwee-Lin Choong Date: Thu Dec 4 20:21:50 2025 +0800 igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW User Manual Section 7.5.4. The 8 KB "freed" by this change is currently unused. This reduction is not expected to impact throughput, as the i226 is PCIe-limited for small TSN packets rather than TX-buffer-limited. Fixes: 0d58cdc902da ("igc: optimize TX packet buffer utilization for TSN mode") Reported-by: Zdenek Bouska Closes: https://lore.kernel.org/netdev/AS1PR10MB5675DBFE7CE5F2A9336ABFA4EBEAA@AS1PR10MB5675.EURPRD10.PROD.OUTLOOK.COM/ Reviewed-by: Paul Menzel Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Signed-off-by: Chwee-Lin Choong Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit 6990dc392a9ab10e52af37e0bee8c7b753756dc4 Author: Chwee-Lin Choong Date: Fri Nov 28 18:53:04 2025 +0800 igc: fix race condition in TX timestamp read for register 0 The current HW bug workaround checks the TXTT_0 ready bit first, then reads TXSTMPL_0 twice (before and after reading TXSTMPH_0) to detect whether a new timestamp was captured by timestamp register 0 during the workaround. This sequence has a race: if a new timestamp is captured after checking the TXTT_0 bit but before the first TXSTMPL_0 read, the detection fails because both the "old" and "new" values come from the same timestamp. Fix by reading TXSTMPL_0 first to establish a baseline, then checking the TXTT_0 bit. This ensures any timestamp captured during the race window will be detected. Old sequence: 1. Check TXTT_0 ready bit 2. Read TXSTMPL_0 (baseline) 3. Read TXSTMPH_0 (interrupt workaround) 4. Read TXSTMPL_0 (detect changes vs baseline) New sequence: 1. Read TXSTMPL_0 (baseline) 2. Check TXTT_0 ready bit 3. Read TXSTMPH_0 (interrupt workaround) 4. Read TXSTMPL_0 (detect changes vs baseline) Fixes: c789ad7cbebc ("igc: Work around HW bug causing missing timestamps") Suggested-by: Avi Shalev Reviewed-by: Aleksandr Loktionov Co-developed-by: Song Yoong Siang Signed-off-by: Song Yoong Siang Signed-off-by: Chwee-Lin Choong Tested-by: Avigail Dahan Signed-off-by: Tony Nguyen commit 41a9a6826f20a524242a6c984845c4855f629841 Author: Kurt Kanzenbach Date: Thu Nov 20 09:18:29 2025 +0100 igc: Restore default Qbv schedule when changing channels The Multi-queue Priority (MQPRIO) and Earliest TxTime First (ETF) offloads utilize the Time Sensitive Networking (TSN) Tx mode. This mode is always coupled to IEEE 802.1Qbv time aware shaper (Qbv). Therefore, the driver sets a default Qbv schedule of all gates opened and a cycle time of 1s. This schedule is set during probe. However, the following sequence of events lead to Tx issues: - Boot a dual core system igc_probe(): igc_tsn_clear_schedule(): -> Default Schedule is set Note: At this point the driver has allocated two Tx/Rx queues, because there are only two CPUs. - ethtool -L enp3s0 combined 4 igc_ethtool_set_channels(): igc_reinit_queues() -> Default schedule is gone, per Tx ring start and end time are zero - tc qdisc replace dev enp3s0 handle 100 parent root mqprio \ num_tc 4 map 3 3 2 2 0 1 1 1 3 3 3 3 3 3 3 3 \ queues 1@0 1@1 1@2 1@3 hw 1 igc_tsn_offload_apply(): igc_tsn_enable_offload(): -> Writes zeros to IGC_STQT(i) and IGC_ENDQT(i), causing Tx to stall/fail Therefore, restore the default Qbv schedule after changing the number of channels. Furthermore, add a restriction to not allow queue reconfiguration when TSN/Qbv is enabled, because it may lead to inconsistent states. Fixes: c814a2d2d48f ("igc: Use default cycle 'start' and 'end' values for queues") Signed-off-by: Kurt Kanzenbach Reviewed-by: Aleksandr Loktionov Tested-by: Avigail Dahan Acked-by: Vinicius Costa Gomes Signed-off-by: Tony Nguyen commit 01139a2ce532d77379e1593230127caa261a8036 Author: Ding Hui Date: Sat Dec 6 21:46:09 2025 +0800 ice: Fix incorrect timeout ice_release_res() The commit 5f6df173f92e ("ice: implement and use rd32_poll_timeout for ice_sq_done timeout") converted ICE_CTL_Q_SQ_CMD_TIMEOUT from jiffies to microseconds. But the ice_release_res() function was missed, and its logic still treats ICE_CTL_Q_SQ_CMD_TIMEOUT as a jiffies value. So correct the issue by usecs_to_jiffies(). Found by inspection of the DDP downloading process. Compile and modprobe tested only. Fixes: 5f6df173f92e ("ice: implement and use rd32_poll_timeout for ice_sq_done timeout") Signed-off-by: Ding Hui Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Reviewed-by: Jacob Keller Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit a9d45c22ed120cdd15ff56d0a6e4700c46451901 Author: Dave Ertman Date: Thu Nov 20 09:58:26 2025 -0800 ice: Avoid detrimental cleanup for bond during interface stop When the user issues an administrative down to an interface that is the primary for an aggregate bond, the prune lists are being purged. This breaks communication to the secondary interface, which shares a prune list on the main switch block while bonded together. For the primary interface of an aggregate, avoid deleting these prune lists during stop, and since they are hardcoded to specific values for the default vlan and QinQ vlans, the attempt to re-add them during the up phase will quietly fail without any additional problem. Fixes: 1e0f9881ef79 ("ice: Flesh out implementation of support for SRIOV on bonded interface") Reviewed-by: Jacob Keller Reviewed-by: Marcin Szycik Signed-off-by: Dave Ertman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 8439016c3b8b5ab687c2420317b1691585106611 Author: Jacob Keller Date: Thu Nov 20 12:20:41 2025 -0800 ice: initialize ring_stats->syncp The u64_stats_sync structure is empty on 64-bit systems. However, on 32-bit systems it contains a seqcount_t which needs to be initialized. While the memory is zero-initialized, a lack of u64_stats_init means that lockdep won't get initialized properly. Fix this by adding u64_stats_init() calls to the rings just after allocation. Fixes: 2b245cb29421 ("ice: Implement transmit and NAPI support") Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b54345928fa1dbde534e32ecaa138678fd5d2135 Merge: 0bb933a9fcdee1 469d71512d1359 Author: Linus Torvalds Date: Tue Jan 13 10:04:34 2026 -0800 Merge tag 'gfs2-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 revert from Andreas Gruenbacher: "Revert bad commit "gfs2: Fix use of bio_chain" I was originally assuming that there must be a bug in gfs2 because gfs2 chains bios in the opposite direction of what bio_chain_and_submit() expects. It turns out that the bio chains are set up in "reverse direction" intentionally so that the first bio's bi_end_io callback is invoked rather than the last bio's callback. We want the first bio's callback invoked for the following reason: The initial bio starts page aligned and covers one or more pages. When it terminates at a non-page-aligned offset, subsequent bios are added to handle the remaining portion of the final page. Upon completion of the bio chain, all affected pages need to be be marked as read, and only the first bio references all of these pages" * tag 'gfs2-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: Revert "gfs2: Fix use of bio_chain" commit 0bb933a9fcdee14ef82970caeb8617ad59a11303 Merge: afd12f914c8f73 3611ca7c12b740 Author: Linus Torvalds Date: Tue Jan 13 09:50:07 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull x86 kvm fixes from Paolo Bonzini: - Avoid freeing stack-allocated node in kvm_async_pf_queue_task - Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 selftests: kvm: try getting XFD and XSAVE state out of sync selftests: kvm: replace numbered sync points with actions x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task commit afd12f914c8f733a9660c97bdbe539aee88e742b Merge: b71e635feefc85 173d6f64f9558f Author: Linus Torvalds Date: Tue Jan 13 09:37:49 2026 -0800 Merge tag 'hyperv-fixes-signed-20260112' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Minor fixes and cleanups for the MSHV driver * tag 'hyperv-fixes-signed-20260112' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: release mutex on region invalidation failure hyperv: Avoid -Wflex-array-member-not-at-end warning mshv: hide x86-specific functions on arm64 mshv: Initialize local variables early upon region invalidation mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions commit bc5a847a80d45b1f77c60c738e05521f0dee453c Merge: 8e29db1b08808f b540b4e157c4b2 Author: Mark Brown Date: Tue Jan 13 17:16:27 2026 +0000 ASoC: dt-bindings: realtek,rt5640: Various fixes Merge series from Jon Hunter : This series includes fixes for the realtek,rt5640 dt-binding to address a few warnings that are observed when running the CHECK_DTBS=y for some DTBs that use this codec. commit e383f0961422f983451ac4dd6aed1a3d3311f2be Author: Tommaso Merciai Date: Thu Dec 18 16:10:21 2025 +0100 i2c: riic: Move suspend handling to NOIRQ phase Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following WARNING is seen on entering suspend ... [ 134.275704] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 134.285536] ------------[ cut here ]------------ [ 134.290298] i2c i2c-2: Transfer while suspended [ 134.295174] WARNING: drivers/i2c/i2c-core.h:56 at __i2c_smbus_xfer+0x1e4/0x214, CPU#0: systemd-sleep/388 [ 134.365507] Tainted: [W]=WARN [ 134.368485] Hardware name: Renesas SMARC EVK version 2 based on r9a09g047e57 (DT) [ 134.375961] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 134.382935] pc : __i2c_smbus_xfer+0x1e4/0x214 [ 134.387329] lr : __i2c_smbus_xfer+0x1e4/0x214 [ 134.391717] sp : ffff800083f23860 [ 134.395040] x29: ffff800083f23860 x28: 0000000000000000 x27: ffff800082ed5d60 [ 134.402226] x26: 0000001f4395fd74 x25: 0000000000000007 x24: 0000000000000001 [ 134.409408] x23: 0000000000000000 x22: 000000000000006f x21: ffff800083f23936 [ 134.416589] x20: ffff0000c090e140 x19: ffff0000c090e0d0 x18: 0000000000000006 [ 134.423771] x17: 6f63657320313030 x16: 2e30206465737061 x15: ffff800083f23280 [ 134.430953] x14: 0000000000000000 x13: ffff800082b16ce8 x12: 0000000000000f09 [ 134.438134] x11: 0000000000000503 x10: ffff800082b6ece8 x9 : ffff800082b16ce8 [ 134.445315] x8 : 00000000ffffefff x7 : ffff800082b6ece8 x6 : 80000000fffff000 [ 134.452495] x5 : 0000000000000504 x4 : 0000000000000000 x3 : 0000000000000000 [ 134.459672] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c9ee9e80 [ 134.466851] Call trace: [ 134.469311] __i2c_smbus_xfer+0x1e4/0x214 (P) [ 134.473715] i2c_smbus_xfer+0xbc/0x120 [ 134.477507] i2c_smbus_read_byte_data+0x4c/0x84 [ 134.482077] isl1208_i2c_read_time+0x44/0x178 [rtc_isl1208] [ 134.487703] isl1208_rtc_read_time+0x14/0x20 [rtc_isl1208] [ 134.493226] __rtc_read_time+0x44/0x88 [ 134.497012] rtc_read_time+0x3c/0x68 [ 134.500622] rtc_suspend+0x9c/0x170 The warning is triggered because I2C transfers can still be attempted while the controller is already suspended, due to inappropriate ordering of the system sleep callbacks. If the controller is autosuspended, there is no way to wake it up once runtime PM disabled (in suspend_late()). During system resume, the I2C controller will be available only after runtime PM is re-enabled (in resume_early()). However, this may be too late for some devices. Wake up the controller in the suspend() callback while runtime PM is still enabled. The I2C controller will remain available until the suspend_noirq() callback (pm_runtime_force_suspend()) is called. During resume, the I2C controller can be restored by the resume_noirq() callback (pm_runtime_force_resume()). Finally, the resume() callback re-enables autosuspend. As a result, the I2C controller can remain available until the system enters suspend_noirq() and from resume_noirq(). Cc: stable@vger.kernel.org Fixes: 53326135d0e0 ("i2c: riic: Add suspend/resume support") Signed-off-by: Tommaso Merciai Reviewed-by: Biju Das Tested-by: Biju Das Signed-off-by: Wolfram Sang commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c Author: Xiaochen Shen Date: Tue Dec 9 14:26:50 2025 +0800 x86/resctrl: Fix memory bandwidth counter width for Hygon The memory bandwidth calculation relies on reading the hardware counter and measuring the delta between samples. To ensure accurate measurement, the software reads the counter frequently enough to prevent it from rolling over twice between reads. The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits. Hygon CPUs provide a 32-bit width counter, but they do not support the MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset (from 24 bits). Consequently, the kernel falls back to the 24-bit default counter width, which causes incorrect overflow handling on Hygon CPUs. Fix this by explicitly setting the counter width offset to 8 bits (resulting in a 32-bit total counter width) for Hygon CPUs. Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper") Signed-off-by: Xiaochen Shen Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tony Luck Reviewed-by: Reinette Chatre Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251209062650.1536952-3-shenxiaochen@open-hieco.net commit 8441c7d3bd6c5a52ab2ecf77e43a5bf262004f5c Author: Robert Richter Date: Wed Jan 7 13:05:43 2026 +0100 cxl: Check for invalid addresses returned from translation functions on errors Translation functions may return an invalid address in case of errors. If the address is not checked the further use of the invalid value will cause an address corruption. Consistently check for a valid address returned by translation functions. Use RESOURCE_SIZE_MAX to indicate an invalid address for type resource_size_t. Depending on the type either RESOURCE_SIZE_MAX or ULLONG_MAX is used to indicate an address error. Propagating an invalid address from a failed translation may cause userspace to think it has received a valid SPA, when in fact it is wrong. The CXL userspace API, using trace events, expects ULLONG_MAX to indicate a translation failure. If ULLONG_MAX is not returned immediately, subsequent calculations can transform that bad address into a different value (!ULLONG_MAX), and an invalid SPA may be returned to userspace. This can lead to incorrect diagnostics and erroneous corrective actions. [ dj: Added user impact statement from Alison. ] [ dj: Fixed checkpatch tab alignment issue. ] Reviewed-by: Dave Jiang Signed-off-by: Robert Richter Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset") Fixes: b78b9e7b7979 ("cxl/region: Refactor address translation funcs for testing") Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260107120544.410993-1-rrichter@amd.com Signed-off-by: Dave Jiang commit 747d2464e6e3c690184fabc7cc104c1a2064c9c3 Author: Rob Herring (Arm) Date: Mon Dec 15 15:28:05 2025 -0600 dt-bindings: i2c: brcm,iproc-i2c: Allow 2 reg entries for brcm,iproc-nic-i2c The brcm,iproc-nic-i2c variant has 2 reg entries. The second one is related to the brcm,ape-hsls-addr-mask property, but it's not clear what a proper description would be. Signed-off-by: Rob Herring (Arm) Reviewed-by: Florian Fainelli Signed-off-by: Wolfram Sang commit 2fa8961d3a6a1c2395d8d560ffed2c782681bade Author: Hannes Reinecke Date: Mon Aug 18 11:32:45 2025 +0200 nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() When the socket is closed while in TCP_LISTEN a callback is run to flush all outstanding packets, which in turns calls nvmet_tcp_listen_data_ready() with the sk_callback_lock held. So we need to check if we are in TCP_LISTEN before attempting to get the sk_callback_lock() to avoid a deadlock. Link: https://lore.kernel.org/linux-nvme/CAHj4cs-zu7eVB78yUpFjVe2UqMWFkLk8p+DaS3qj+uiGCXBAoA@mail.gmail.com/ Tested-by: Yi Zhang Reviewed-by: Sagi Grimberg Signed-off-by: Hannes Reinecke Signed-off-by: Keith Busch commit 31707572108da55a005e7fed32cc3869c16b7c16 Author: Yingying Tang Date: Tue Jan 13 13:46:36 2026 +0800 wifi: ath12k: Fix wrong P2P device link id issue Wrong P2P device link id value of 0 was introduced in ath12k_mac_op_tx() by [1]. During the P2P negotiation process, there is only one scan vdev with link ID 15. Currently, the device link ID is incorrectly set to 0 in ath12k_mac_op_tx() during the P2P negotiation process, which leads to TX failures. Set the correct P2P device link ID to 15 to fix the TX failure issue. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 648a121bafa3 ("wifi: ath12k: ath12k_mac_op_tx(): MLO support") # [1] Signed-off-by: Yingying Tang Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Cc: linux-next@vger.kernel.org Cc: netdev@vger.kernel.org Link: https://patch.msgid.link/20260113054636.2620035-1-yingying.tang@oss.qualcomm.com Signed-off-by: Jeff Johnson --- Note to linux-next and netdev maintainers: This patch going through the "current" tree conflicts with the following going through the "next" tree: commit 631ee338f04d ("Merge branch 'ath12k-ng' into ath-next") The conflict resolution is to leave the following file unmodified: drivers/net/wireless/ath/ath12k/mac. And to apply the following patch to ath12k_wifi7_mac_op_tx() in the file drivers/net/wireless/ath/ath12k/wifi7/hw.c -705,7 +705,10 return; } } else { - link_id = 0; + if (vif->type == NL80211_IFTYPE_P2P_DEVICE) + link_id = ATH12K_FIRST_SCAN_LINK; + else + link_id = 0; } arvif = rcu_dereference(ahvif->link[link_id]); commit f88e9fc30a261d63946ddc6cc6a33405e6aa27c3 Author: Baochen Qiang Date: Tue Jan 13 09:48:11 2026 +0800 wifi: ath12k: fix dead lock while flushing management frames Commit [1] converted the management transmission work item into a wiphy work. Since a wiphy work can only run under wiphy lock protection, a race condition happens in below scenario: 1. a management frame is queued for transmission. 2. ath12k_mac_op_flush() gets called to flush pending frames associated with the hardware (i.e, vif being NULL). Then in ath12k_mac_flush() the process waits for the transmission done. 3. Since wiphy lock has been taken by the flush process, the transmission work item has no chance to run, hence the dead lock. >From user view, this dead lock results in below issue: wlp8s0: authenticate with xxxxxx (local address=xxxxxx) wlp8s0: send auth to xxxxxx (try 1/3) wlp8s0: authenticate with xxxxxx (local address=xxxxxx) wlp8s0: send auth to xxxxxx (try 1/3) wlp8s0: authenticated wlp8s0: associate with xxxxxx (try 1/3) wlp8s0: aborting association with xxxxxx by local choice (Reason: 3=DEAUTH_LEAVING) ath12k_pci 0000:08:00.0: failed to flush mgmt transmit queue, mgmt pkts pending 1 The dead lock can be avoided by invoking wiphy_work_flush() to proactively run the queued work item. Note actually it is already present in ath12k_mac_op_flush(), however it does not protect the case where vif being NULL. Hence move it ahead to cover this case as well. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 56dcbf0b5207 ("wifi: ath12k: convert struct ath12k::wmi_mgmt_tx_work to struct wiphy_work") # [1] Reported-by: Stuart Hayhurst Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220959 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260113-ath12k-fix-dead-lock-while-flushing-v1-1-9713621f3a0f@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 8b8d6ee53dfdee61b0beff66afe3f712456e707a Author: Yingying Tang Date: Mon Jan 12 19:55:16 2026 +0800 wifi: ath12k: Fix scan state stuck in ABORTING after cancel_remain_on_channel Scan finish workqueue was introduced in __ath12k_mac_scan_finish() by [1]. During ath12k_mac_op_cancel_remain_on_channel(), scan state is set to ABORTING and should be reset to IDLE in the queued work. However, wiphy_work_cancel() is called before exiting ath12k_mac_op_cancel_remain_on_channel(), which prevents the work from running and leaves the state in ABORTING. This blocks all subsequent scan requests. Replace wiphy_work_cancel() with wiphy_work_flush() to ensure the queued work runs and scan state is reset to IDLE. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: 3863f014ad23 ("wifi: ath12k: symmetrize scan vdev creation and deletion during HW scan") # [1] Signed-off-by: Yingying Tang Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260112115516.2144219-1-yingying.tang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 39c90b1a1dbe6d7c49d19da6e5aec00980c55d8b Author: Manish Dharanenthiran Date: Wed Jan 7 11:32:35 2026 +0530 wifi: ath12k: cancel scan only on active scan vdev Cancel the scheduled scan request only on the vdev that has an active scan running. Currently, ahvif->links_map is used to obtain the links, but this includes links for which no scan is scheduled. In failure cases where the scan fails due to an invalid channel definition, other links which are not yet brought up (vdev not created) may also be accessed, leading to the following trace: Unable to handle kernel paging request at virtual address 0000000000004c8c pc : _raw_spin_lock_bh+0x1c/0x54 lr : ath12k_scan_abort+0x20/0xc8 [ath12k] Call trace: _raw_spin_lock_bh+0x1c/0x54 (P) ath12k_mac_op_cancel_hw_scan+0xac/0xc4 [ath12k] ieee80211_scan_cancel+0xcc/0x12c [mac80211] ieee80211_do_stop+0x6c4/0x7a8 [mac80211] ieee80211_stop+0x60/0xd8 [mac80211] Skip links that are not created or are not the current scan vdev. This ensures only the scan for the matching links is aborted and avoids aborting unrelated links during cancellation, thus aligning with how start/cleanup manage ar->scan.arvif. Also, remove the redundant arvif->is_started check from ath12k_mac_op_cancel_hw_scan() that was introduced in commit 3863f014ad23 ("wifi: ath12k: symmetrize scan vdev creation and deletion during HW scan") to avoid deleting the scan interface if the scan is triggered on the existing AP vdev as this use case is already handled in ath12k_scan_vdev_clean_work(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: feed05f1526e ("wifi: ath12k: Split scan request for split band device") Signed-off-by: Manish Dharanenthiran Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260107-scan_vdev-v1-1-b600aedc645a@qti.qualcomm.com Signed-off-by: Jeff Johnson commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b Author: Xiaochen Shen Date: Tue Dec 9 14:26:49 2025 +0800 x86/resctrl: Add missing resctrl initialization for Hygon Hygon CPUs supporting Platform QoS features currently undergo partial resctrl initialization through resctrl_cpu_detect() in the Hygon BSP init helper and AMD/Hygon common initialization code. However, several critical data structures remain uninitialized for Hygon CPUs in the following paths: - get_mem_config()-> __rdt_get_mem_config_amd(): rdt_resource::membw,alloc_capable hw_res::num_closid - rdt_init_res_defs()->rdt_init_res_defs_amd(): rdt_resource::cache hw_res::msr_base,msr_update Add the missing AMD/Hygon common initialization to ensure proper Platform QoS functionality on Hygon CPUs. Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper") Signed-off-by: Xiaochen Shen Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251209062650.1536952-2-shenxiaochen@open-hieco.net commit cd644b805da8a253198718741bf363c4c58862ff Author: Ji-Ze Hong (Peter Hong) Date: Fri Dec 12 15:08:31 2025 +0800 USB: serial: f81232: fix incomplete serial port generation The Fintek F81532A/534A/535/536 family relies on the F81534A_CTRL_CMD_ENABLE_PORT (116h) register during initialization to both determine serial port status and control port creation. If the driver experiences fast load/unload cycles, the device state may becomes unstable, resulting in the incomplete generation of serial ports. Performing a dummy read operation on the register prior to the initial write command resolves the issue. This clears the device's stale internal state. Subsequent write operations will correctly generate all serial ports. This patch also removes the retry loop in f81534a_ctrl_set_register() because the stale state has been fixed. Tested on: HygonDM1SLT(Hygon C86 3250 8-core Processor) Signed-off-by: Ji-Ze Hong (Peter Hong) Signed-off-by: Johan Hovold commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 Author: Nilay Shroff Date: Tue Jan 13 12:27:22 2026 +0530 null_blk: fix kmemleak by releasing references to fault configfs items When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeout_inject, requeue_inject, and init_hctx_fault_inject configfs items as children of the top-level nullbX configfs group. However, when the nullbX device is removed, the references taken to these fault-config configfs items are not released. As a result, kmemleak reports a memory leak, for example: unreferenced object 0xc00000021ff25c40 (size 32): comm "mkdir", pid 10665, jiffies 4322121578 hex dump (first 32 bytes): 69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_ 69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject.......... backtrace (crc 1a018c86): __kmalloc_node_track_caller_noprof+0x494/0xbd8 kvasprintf+0x74/0xf4 config_item_set_name+0xf0/0x104 config_group_init_type_name+0x48/0xfc fault_config_init+0x48/0xf0 0xc0080000180559e4 configfs_mkdir+0x304/0x814 vfs_mkdir+0x49c/0x604 do_mkdirat+0x314/0x3d0 sys_mkdir+0xa0/0xd8 system_call_exception+0x1b0/0x4f0 system_call_vectored_common+0x15c/0x2ec Fix this by explicitly releasing the references to the fault-config configfs items when dropping the reference to the top-level nullbX configfs group. Cc: stable@vger.kernel.org Reviewed-by: Chaitanya Kulkarni Fixes: bb4c19e030f4 ("block: null_blk: make fault-injection dynamically configurable per device") Signed-off-by: Nilay Shroff Signed-off-by: Jens Axboe commit ef5749ef8b307bf8717945701b1b79d036af0a15 Author: Edward Adam Davis Date: Tue Jan 13 16:29:23 2026 +0800 ALSA: usb-audio: Prevent excessive number of frames In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; When the user performs a write operation to send audio data into the ALSA PCM playback stream, the calculated number of frames is packsize[0] * packets = 264, which exceeds the allocated URB buffer size, triggering the out-of-bounds (OOB) issue reported by syzbot [1]. Added a check for the number of single data URB frames when calculating the number of frames to prevent [1]. [1] BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506 Call Trace: copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611 prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333 Reported-by: syzbot+6db0415d6d5c635f72cb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6db0415d6d5c635f72cb Tested-by: syzbot+6db0415d6d5c635f72cb@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://patch.msgid.link/tencent_9AECE6CD2C7A826D902D696C289724E8120A@qq.com Signed-off-by: Takashi Iwai commit dc2d5ddb193e363187bae2ad358245642d2721fb Author: Shenghao Yang Date: Wed Dec 31 13:50:26 2025 +0800 drm/gud: fix NULL fb and crtc dereferences on USB disconnect On disconnect drm_atomic_helper_disable_all() is called which sets both the fb and crtc for a plane to NULL before invoking a commit. This causes a kernel oops on every display disconnect. Add guards for those dereferences. Cc: # 6.18.x Fixes: 73cfd166e045 ("drm/gud: Replace simple display pipe with DRM atomic helpers") Signed-off-by: Shenghao Yang Reviewed-by: Ruben Wauters Signed-off-by: Ruben Wauters Link: https://patch.msgid.link/20251231055039.44266-1-me@shenghaoyang.info commit 6a0243c4020636482797acfd48d7d9b0ea2f2a20 Author: Richard Fitzgerald Date: Tue Jan 13 13:40:56 2026 +0000 ALSA: hda/cirrus_scodec_test: Fix test suite name Change the test suite name string to "snd-hda-cirrus-scodec-test". It was incorrectly named "snd-hda-scodec-cs35l56-test", a leftover from when the code under test was actually in the cs35l56 driver. Signed-off-by: Richard Fitzgerald Fixes: 2144833e7b414 ("ALSA: hda: cirrus_scodec: Add KUnit test") Link: https://patch.msgid.link/20260113134056.619051-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit c5e96e54eca3876d4ce8857e2e22adbe9f44f4a2 Author: Richard Fitzgerald Date: Tue Jan 13 13:09:54 2026 +0000 ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip Set gpiochip parent to the struct device of the dummy GPIO driver so that the software node will be associated with the GPIO chip. The recent commit e5d527be7e698 ("gpio: swnode: don't use the swnode's name as the key for GPIO lookup") broke cirrus_scodec_test, because the software node no longer gets associated with the GPIO driver by name. Instead, setting struct gpio_chip.parent to the owning struct device will find the node using a normal fwnode lookup. Signed-off-by: Richard Fitzgerald Fixes: 2144833e7b414 ("ALSA: hda: cirrus_scodec: Add KUnit test") Link: https://patch.msgid.link/20260113130954.574670-1-rf@opensource.cirrus.com Signed-off-by: Takashi Iwai commit c0afe95e62984ceea171c3ea319beaf84a21181c Author: Ethan Nelson-Moore Date: Wed Dec 10 18:01:17 2025 -0800 USB: serial: ftdi_sio: add support for PICAXE AXE027 cable The vendor provides instructions to write "0403 bd90" to /sys/bus/usb-serial/drivers/ftdi_sio/new_id; see: https://picaxe.com/docs/picaxe_linux_instructions.pdf Cc: stable@vger.kernel.org Signed-off-by: Ethan Nelson-Moore Signed-off-by: Johan Hovold commit c8c6fb886f57d5bf71fb6de6334a143608d35707 Author: Niklas Cassel Date: Mon Jan 12 13:20:51 2026 +0100 ata: libata: Print features also for ATAPI devices Commit d633b8a702ab ("libata: print feature list on device scan") added a print of the features supported by the device for ATA_DEV_ATA and ATA_DEV_ZAC devices, but not for ATA_DEV_ATAPI devices. Fix this by printing the features also for ATAPI devices. Before changes: ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133 After changes: ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133 ata1.00: Features: Dev-Attention HIPM DIPM Fixes: d633b8a702ab ("libata: print feature list on device scan") Signed-off-by: Niklas Cassel Tested-by: Wolf Signed-off-by: Damien Le Moal commit 89531b68fc293e91187bf0992147e8d22c65cff3 Author: Niklas Cassel Date: Mon Jan 12 13:20:50 2026 +0100 ata: libata: Add DIPM and HIPM to ata_dev_print_features() early return ata_dev_print_features() is supposed to return early and not print anything if there are no features supported. However, commit b1f5af54f1f5 ("ata: libata-core: Advertize device support for DIPM and HIPM features") added additional features to ata_dev_print_features() without updating the early return conditional. Add the missing features to the early return conditional. Fixes: b1f5af54f1f5 ("ata: libata-core: Advertize device support for DIPM and HIPM features") Signed-off-by: Niklas Cassel Tested-by: Wolf Signed-off-by: Damien Le Moal commit a6bee5e5243ad02cae575becc4c83df66fc29573 Author: Niklas Cassel Date: Mon Jan 12 13:20:49 2026 +0100 ata: libata: Add cpr_log to ata_dev_print_features() early return ata_dev_print_features() is supposed to return early and not print anything if there are no features supported. However, commit fe22e1c2f705 ("libata: support concurrent positioning ranges log") added another feature to ata_dev_print_features() without updating the early return conditional. Add the missing feature to the early return conditional. Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log") Signed-off-by: Niklas Cassel Tested-by: Wolf Signed-off-by: Damien Le Moal commit ce83767ea323baf8509a75eb0c783cd203e14789 Author: Niklas Cassel Date: Mon Jan 12 13:20:48 2026 +0100 ata: libata-sata: Improve link_power_management_supported sysfs attribute The link_power_management_supported sysfs attribute is currently set as true even for ata ports that lack a .set_lpm() callback, e.g. dummy ports. This is a bit silly, because while writing to the link_power_management_policy sysfs attribute will make ata_scsi_lpm_store() update ap->target_lpm_policy (thus sysfs will reflect the new value) and call ata_port_schedule_eh() for the port, it is essentially a no-op. This is because for a port without a .set_lpm() callback, once EH gets to run, the ata_eh_link_set_lpm() will simply return, since the port does not provide a .set_lpm() callback. Thus, make sure that the link_power_management_supported sysfs attribute is set to false for ports that lack a .set_lpm() callback. This way the link_power_management_policy sysfs attribute will no longer be writable, so we will no longer be misleading users to think that their sysfs write actually does something. Fixes: 0060beec0bfa ("ata: libata-sata: Add link_power_management_supported sysfs attribute") Signed-off-by: Niklas Cassel Tested-by: Wolf Signed-off-by: Damien Le Moal commit 8f3fb33f8f3f825c708ece800c921977c157f9b6 Author: Niklas Cassel Date: Mon Jan 12 13:20:47 2026 +0100 ata: libata: Call ata_dev_config_lpm() for ATAPI devices Commit d360121832d8 ("ata: libata-core: Introduce ata_dev_config_lpm()") introduced ata_dev_config_lpm(). However, it only called this function for ATA_DEV_ATA and ATA_DEV_ZAC devices, not for ATA_DEV_ATAPI devices. Additionally, commit d99a9142e782 ("ata: libata-core: Move device LPM quirk settings to ata_dev_config_lpm()") moved the LPM quirk application from ata_dev_configure() to ata_dev_config_lpm(), causing LPM quirks for ATAPI devices to no longer be applied. Call ata_dev_config_lpm() also for ATAPI devices, such that LPM quirks are applied for ATAPI devices with an entry in __ata_dev_quirks once again. Fixes: d360121832d8 ("ata: libata-core: Introduce ata_dev_config_lpm()") Fixes: d99a9142e782 ("ata: libata-core: Move device LPM quirk settings to ata_dev_config_lpm()") Signed-off-by: Niklas Cassel Tested-by: Wolf Signed-off-by: Damien Le Moal commit ea4d4ea6d10a561043922d285f1765c7e4bfd32a Author: Niklas Cassel Date: Mon Jan 12 13:20:46 2026 +0100 ata: ahci: Do not read the per port area for unimplemented ports An AHCI HBA specifies the number of ports it supports using CAP.NP. The HBA is free to only make a subset of the number of ports available using the PI (Ports Implemented) register. libata currently creates dummy ports for HBA ports that are provided by the HBA, but which are marked as "unavailable" using the PI register. Each port will have a per port area of registers in the HBA, regardless if the port is marked as "unavailable" or not. ahci_mark_external_port() currently reads this per port area of registers using readl() to see if the port is marked as external/hotplug-capable. However, AHCI 1.3.1, section "3.1.4 Offset 0Ch: PI – Ports Implemented" states: "Software must not read or write to registers within unavailable ports." Thus, make sure that we only call ahci_mark_external_port() and ahci_update_initial_lpm_policy() for ports that are implemented. From a libata perspective, this should not change anything related to LPM, as dummy ports do not provide any ap->ops (they do not have a .set_lpm() callback), so even if EH were to call .set_lpm() on a dummy port, it was already a no-op. Fixes: f7131935238d ("ata: ahci: move marking of external port earlier") Signed-off-by: Niklas Cassel Tested-by: Wolf Signed-off-by: Damien Le Moal commit cbd46cbc5470f9cb0bbeff70561a3dd3e0769fe1 Author: Aleksandrs Vinarskis Date: Mon Jan 12 01:06:37 2026 +0100 ALSA: hda/realtek: Add quirk for Asus Zephyrus G14 2025 using CS35L56, fix speakers Just like GA403U, this GA403W needs to remap woofers to DAC1. Similarly to other Asus devices, headphones/headset MIC is not working, however the pin config alone is not enough to fix it. From Windows dump of GA403W: 0x12, 0x90a60140 # Correctly set by codec out of the box 0x13, 0x90a60550 0x14, 0x90170510 0x17, 0x90170120 # Correctly set by codec out of the box 0x19, 0x03a11050 # Set by ALC285_FIXUP_ASUS_GA403U_HEADSET_MIC 0x1a, 0x411115F0 0x1b, 0x03a11c30 # Set by ALC285_FIXUP_ASUS_GA403U_HEADSET_MIC 0x1d, 0x40663A45 # Correctly set by codec out of the box 0x21, 0x03211430 Even with all the values set, MIC of the jack is not detected. Until a complete solution is found, set ALC285_FIXUP_ASUS_GA403U_HEADSET_MIC for GA403W which fixes audio volume control for woofers. No need to create new quirk with missing pin config just yet, since its not making the situation better. Signed-off-by: Aleksandrs Vinarskis Link: https://patch.msgid.link/20260112-asus-rog-audio-v1-1-513957b4704e@vinarskis.com Signed-off-by: Takashi Iwai commit 8e29db1b08808f709231e6fd4c79dcdee5b17a17 Author: Radhi Bajahaw Date: Mon Jan 12 21:38:14 2026 +0100 ASoC: amd: yc: Fix microphone on ASUS M6500RE Add DMI match for ASUSTeK COMPUTER INC. M6500RE to enable the internal microphone. Signed-off-by: Radhi Bajahaw Link: https://patch.msgid.link/20260112203814.155-1-bajahawradhi@gmail.com Signed-off-by: Mark Brown commit 12d4fd9a657174496677cff2841315090f1c11fc Author: Harshit Mogalapalli Date: Sat Jan 10 12:19:58 2026 -0800 soundwire: bus: fix off-by-one when allocating slave IDs ida_alloc_max() interprets its max argument as inclusive. Using SDW_FW_MAX_DEVICES(16) therefore allows an ID of 16 to be allocated, but the IRQ domain created for the bus is sized for IDs 0-15. If 16 is returned, irq_create_mapping() fails and the driver ends up with an invalid IRQ mapping. Limit the allocation to 0-15 by passing SDW_FW_MAX_DEVICES - 1. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512240450.hlDH3nCs-lkp@intel.com/ Fixes: aab12022b076 ("soundwire: bus: Add internal slave ID and use for IRQs") Signed-off-by: Harshit Mogalapalli Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20260110201959.2523024-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Vinod Koul commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 Author: Ulrich Mohr Date: Tue Dec 9 21:08:41 2025 +0100 USB: serial: option: add Telit LE910 MBIM composition Add support for Telit LE910 module when operating in MBIM composition with additional ttys. This USB product ID is used by the module when AT#USBCFG is set to 7. 0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1252 Rev=03.18 S: Manufacturer=Android S: Product=LE910C1-EU S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Signed-off-by: Ulrich Mohr Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit ca1e8eede4fc68ce85a9fdce1a6c13ad64933318 Author: Gabriele Monaco Date: Tue Jan 13 09:52:01 2026 +0100 sched/deadline: Fix server stopping with runnable tasks The deadline server can currently stop due to idle although fair tasks are runnable. This happens essentially when: * the server is set to idle, a task wakes up, the server stops * a task wakes up, the server sets itself to idle and stops right away Address both cases by clearing the server idle flag whenever a fair task wakes up and accounting also for pending tasks in the definition of idle. Fixes: f5a538c07df2 ("sched/deadline: Fix dl_server stop condition") Signed-off-by: Gabriele Monaco Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260113085159.114226-3-gmonaco@redhat.com commit 1e0a2ba7afb1b60f02599093d84b72ce62ad11c0 Author: Peter Zijlstra Date: Tue Jan 13 10:50:41 2026 +0100 sched: Provide idle_rq() helper A fix for the dl_server 'requires' idle_cpu() usage, which made me note that it and available_idle_cpu() are extern function calls. And while idle_cpu() is used outside of kernel/sched/, available_idle_cpu() is not. This makes it hard to make idle_cpu() an inline helper, so provide idle_rq() and implement idle_cpu() and available_idle_cpu() using that. Signed-off-by: Peter Zijlstra (Intel) commit 436326bc525d467e38db1da576139ec5f28268c5 Author: Sasha Levin Date: Tue Dec 23 07:03:57 2025 -0500 objtool: fix build failure due to missing libopcodes check Commit 59953303827e ("objtool: Disassemble code with libopcodes instead of running objdump") added support for using libopcodes for disassembly. However, the feature detection checks for libbfd availability but then unconditionally links against libopcodes: ifeq ($(feature-libbfd),1) OBJTOOL_LDFLAGS += -lopcodes endif This causes build failures in environments where libbfd is installed but libopcodes is not, since the test-libbfd.c feature test only links against -lbfd and -ldl, not -lopcodes: /usr/bin/ld: cannot find -lopcodes: No such file or directory collect2: error: ld returned 1 exit status make[4]: *** [Makefile:109: objtool] Error 1 Additionally, the shared feature framework uses $(CC) which is the cross-compiler in cross-compilation builds. Since objtool is a host tool that links with $(HOSTCC) against host libraries, the feature detection can falsely report libopcodes as available when the cross-compiler's sysroot has it but the host system doesn't. Fix this by replacing the feature framework check with a direct inline test that uses $(HOSTCC) to compile and link a test program against libopcodes, similar to how xxhash availability is detected. Fixes: 59953303827e ("objtool: Disassemble code with libopcodes instead of running objdump") Assisted-by: claude-opus-4-5-20251101 Signed-off-by: Sasha Levin Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251223120357.2492008-1-sashal@kernel.org commit 64e6fa76610ec970cfa8296ed057907a4b384ca5 Author: Pingfan Liu Date: Tue Nov 25 11:26:30 2025 +0800 sched/deadline: Fix potential race in dl_add_task_root_domain() The access rule for local_cpu_mask_dl requires it to be called on the local CPU with preemption disabled. However, dl_add_task_root_domain() currently violates this rule. Without preemption disabled, the following race can occur: 1. ThreadA calls dl_add_task_root_domain() on CPU 0 2. Gets pointer to CPU 0's local_cpu_mask_dl 3. ThreadA is preempted and migrated to CPU 1 4. ThreadA continues using CPU 0's local_cpu_mask_dl 5. Meanwhile, the scheduler on CPU 0 calls find_later_rq() which also uses local_cpu_mask_dl (with preemption properly disabled) 6. Both contexts now corrupt the same per-CPU buffer concurrently Fix this by moving the local_cpu_mask_dl access to the preemption disabled section. Closes: https://lore.kernel.org/lkml/aSBjm3mN_uIy64nz@jlelli-thinkpadt14gen4.remote.csb Fixes: 318e18ed22e8 ("sched/deadline: Walk up cpuset hierarchy to decide root domain when hot-unplug") Reported-by: Juri Lelli Signed-off-by: Pingfan Liu Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Acked-by: Waiman Long Link: https://patch.msgid.link/20251125032630.8746-3-piliu@redhat.com commit 479972efc2e7c9e0b3743ac538b042fcd4f315d7 Author: Pingfan Liu Date: Tue Nov 25 11:26:29 2025 +0800 sched/deadline: Remove unnecessary comment in dl_add_task_root_domain() The comments above dl_get_task_effective_cpus() and dl_add_task_root_domain() already explain how to fetch a valid root domain and protect against races. There's no need to repeat this inside dl_add_task_root_domain(). Remove the redundant comment to keep the code clean. No functional change. Signed-off-by: Pingfan Liu Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Acked-by: Waiman Long Link: https://patch.msgid.link/20251125032630.8746-2-piliu@redhat.com commit 26bea10450afe5ad4dd0e0bbb797c44e1df110fe Author: Mikulas Patocka Date: Tue Jan 6 12:13:15 2026 +0100 objtool: fix compilation failure with the x32 toolchain When using the x32 toolchain, compilation fails because the printf specifier "%lx" (long), doesn't match the type of the "checksum" variable (long long). Fix this by changing the printf specifier to "%llx" and casting "checksum" to unsigned long long. Fixes: a3493b33384a ("objtool/klp: Add --debug-checksum= to show per-instruction checksums") Signed-off-by: Mikulas Patocka Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/a1158c99-fe0e-a218-4b5b-ffac212489f6@redhat.com commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 Author: Thomas Weißschuh Date: Wed Jan 7 11:39:24 2026 +0100 hrtimer: Fix softirq base check in update_needs_ipi() The 'clockid' field is not the correct way to check for a softirq base. Fix the check to correctly compare the base type instead of the clockid. Fixes: 1e7f7fbcd40c ("hrtimer: Avoid more SMP function calls in clock_was_set()") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260107-hrtimer-clock-base-check-v1-1-afb5dbce94a1@linutronix.de commit c360004c0160dbe345870f59f24595519008926f Author: Brian Foster Date: Fri Jan 9 12:49:05 2026 -0500 xfs: set max_agbno to allow sparse alloc of last full inode chunk Sparse inode cluster allocation sets min/max agbno values to avoid allocating an inode cluster that might map to an invalid inode chunk. For example, we can't have an inode record mapped to agbno 0 or that extends past the end of a runt AG of misaligned size. The initial calculation of max_agbno is unnecessarily conservative, however. This has triggered a corner case allocation failure where a small runt AG (i.e. 2063 blocks) is mostly full save for an extent to the EOFS boundary: [2050,13]. max_agbno is set to 2048 in this case, which happens to be the offset of the last possible valid inode chunk in the AG. In practice, we should be able to allocate the 4-block cluster at agbno 2052 to map to the parent inode record at agbno 2048, but the max_agbno value precludes it. Note that this can result in filesystem shutdown via dirty trans cancel on stable kernels prior to commit 9eb775968b68 ("xfs: walk all AGs if TRYLOCK passed to xfs_alloc_vextent_iterate_ags") because the tail AG selection by the allocator sets t_highest_agno on the transaction. If the inode allocator spins around and finds an inode chunk with free inodes in an earlier AG, the subsequent dir name creation path may still fail to allocate due to the AG restriction and cancel. To avoid this problem, update the max_agbno calculation to the agbno prior to the last chunk aligned agbno in the AG. This is not necessarily the last valid allocation target for a sparse chunk, but since inode chunks (i.e. records) are chunk aligned and sparse allocs are cluster sized/aligned, this allows the sb_spino_align alignment restriction to take over and round down the max effective agbno to within the last valid inode chunk in the AG. Note that even though the allocator improvements in the aforementioned commit seem to avoid this particular dirty trans cancel situation, the max_agbno logic improvement still applies as we should be able to allocate from an AG that has been appropriately selected. The more important target for this patch however are older/stable kernels prior to this allocator rework/improvement. Cc: stable@vger.kernel.org # v4.2 Fixes: 56d1115c9bc7 ("xfs: allocate sparse inode chunks on full chunk allocation failure") Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a65fd81207669367504b6da7758e130ee23a7dfe Author: Nirjhar Roy (IBM) Date: Mon Jan 12 13:54:02 2026 +0530 xfs: Fix xfs_grow_last_rtg() The last rtg should be able to grow when the size of the last is less than (and not equal to) sb_rgextents. xfs_growfs with realtime groups fails without this patch. The reason is that, xfs_growfs_rtg() tries to grow the last rt group even when the last rt group is at its maximal size i.e, sb_rgextents. It fails with the following messages: XFS (loop0): Internal error block >= mp->m_rsumblocks at line 253 of file fs/xfs/libxfs/xfs_rtbitmap.c. Caller xfs_rtsummary_read_buf+0x20/0x80 XFS (loop0): Corruption detected. Unmount and run xfs_repair XFS (loop0): Internal error xfs_trans_cancel at line 976 of file fs/xfs/xfs_trans.c. Caller xfs_growfs_rt_bmblock+0x402/0x450 XFS (loop0): Corruption of in-memory data (0x8) detected at xfs_trans_cancel+0x10a/0x1f0 (fs/xfs/xfs_trans.c:977). Shutting down filesystem. XFS (loop0): Please unmount the filesystem and rectify the problem(s) Signed-off-by: Nirjhar Roy (IBM) Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit df7ec7226fbe14d8654193933da81b2470cc5814 Author: Christoph Hellwig Date: Fri Jan 9 16:18:21 2026 +0100 xfs: improve the assert at the top of xfs_log_cover Move each condition into a separate assert so that we can see which on triggered. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit baed03efe223b1649320e835d7e0c03b3dde0b0c Author: Christoph Hellwig Date: Fri Jan 9 16:18:54 2026 +0100 xfs: fix an overly long line in xfs_rtgroup_calc_geometry Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e0aea42a32984a6fd13410aed7afd3bd0caeb1c1 Author: Christoph Hellwig Date: Fri Jan 9 16:18:53 2026 +0100 xfs: mark __xfs_rtgroup_extents static __xfs_rtgroup_extents is not used outside of xfs_rtgroup.c, so mark it static. Move it and xfs_rtgroup_extents up in the file to avoid forward declarations. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 6b2d155366581705a848833a9b626bfea41d5a8d Author: Nirjhar Roy (IBM) Date: Mon Jan 12 15:35:23 2026 +0530 xfs: Fix the return value of xfs_rtcopy_summary() xfs_rtcopy_summary() should return the appropriate error code instead of always returning 0. The caller of this function which is xfs_growfs_rt_bmblock() is already handling the error. Fixes: e94b53ff699c ("xfs: cache last bitmap block in realtime allocator") Signed-off-by: Nirjhar Roy (IBM) Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Cc: stable@vger.kernel.org # v6.7 Signed-off-by: Carlos Maiolino commit ffe4ccd359d006eba559cb1a3c6113144b7fb38c Author: Eric Dumazet Date: Wed Jan 7 10:41:59 2026 +0000 net: add net.core.qdisc_max_burst In blamed commit, I added a check against the temporary queue built in __dev_xmit_skb(). Idea was to drop packets early, before any spinlock was acquired. if (unlikely(defer_count > READ_ONCE(q->limit))) { kfree_skb_reason(skb, SKB_DROP_REASON_QDISC_DROP); return NET_XMIT_DROP; } It turned out that HTB Qdisc has a zero q->limit. HTB limits packets on a per-class basis. Some of our tests became flaky. Add a new sysctl : net.core.qdisc_max_burst to control how many packets can be stored in the temporary lockless queue. Also add a new QDISC_BURST_DROP drop reason to better diagnose future issues. Thanks Neal ! Fixes: 100dfa74cad9 ("net: dev_queue_xmit() llist adoption") Reported-and-bisected-by: Neal Cardwell Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260107104159.3669285-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 9380dc33cd6ae4a6857818fcefce31cf716f3fae Author: Ludovic Desroches Date: Thu Dec 18 14:34:43 2025 +0100 drm/panel: simple: restore connector_type fallback The switch from devm_kzalloc() + drm_panel_init() to devm_drm_panel_alloc() introduced a regression. Several panel descriptors do not set connector_type. For those panels, panel_simple_probe() used to compute a connector type (currently DPI as a fallback) and pass that value to drm_panel_init(). After the conversion to devm_drm_panel_alloc(), the call unconditionally used desc->connector_type instead, ignoring the computed fallback and potentially passing DRM_MODE_CONNECTOR_Unknown, which drm_panel_bridge_add() does not allow. Move the connector_type validation / fallback logic before the devm_drm_panel_alloc() call and pass the computed connector_type to devm_drm_panel_alloc(), so panels without an explicit connector_type once again get the DPI default. Signed-off-by: Ludovic Desroches Fixes: de04bb0089a9 ("drm/panel/panel-simple: Use the new allocation in place of devm_kzalloc()") Cc: stable@vger.kernel.org Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/stable/20251126-lcd_panel_connector_type_fix-v2-1-c15835d1f7cb%40microchip.com Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251218-lcd_panel_connector_type_fix-v3-1-ddcea6d8d7ef@microchip.com commit 6ab3d4353bf75005eaa375677c9fed31148154d6 Author: Marek Vasut Date: Sat Jan 10 16:27:28 2026 +0100 drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set. This leads to a warning and a backtrace in the kernel log and panel does not work: " WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8 " The warning is triggered by a check for valid connector type in devm_drm_panel_bridge_add(). If there is no valid connector type set for a panel, the warning is printed and panel is not added. Fill in the missing connector type to fix the warning and make the panel operational once again. Cc: stable@vger.kernel.org Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18") Signed-off-by: Marek Vasut Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com commit ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 Author: Deepanshu Kartikey Date: Tue Jan 13 14:10:37 2026 +0530 romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh(): kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0. Reported-by: syzbot+9c4e33e12283d9437c25@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9c4e33e12283d9437c25 Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260113084037.1167887-1-kartikey406@gmail.com Signed-off-by: Christian Brauner commit f2edf797dab185cce439e5bc5185fe20dd536300 Author: Luo Haiyang Date: Tue Jan 13 11:19:30 2026 +0800 irqchip/riscv-imsic: Revert "Remove redundant irq_data lookups" Commit c475c0b71314("irqchip/riscv-imsic: Remove redundant irq_data lookups") leads to a NULL pointer deference in imsic_msi_update_msg(): virtio_blk virtio1: 8/0/0 default/read/poll queues Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Current kworker/u32:2 pgtable: 4K pagesize, 48-bit VAs, pgdp=0x0000000081c33000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 CPU: 5 UID: 0 PID: 75 Comm: kworker/u32:2 Not tainted 6.19.0-rc4-next-20260109 #1 NONE epc : 0x0 ra : imsic_irq_set_affinity+0x110/0x130 The irq_data argument of imsic_irq_set_affinity() is associated with the imsic domain and not with the top-level MSI domain. As a consequence the code dereferences the wrong interrupt chip, which has the irq_write_msi_msg() callback not populated. Signed-off-by: Luo Haiyang Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260113111930821RrC26avITHWSFCN0bYbgI@zte.com.cn commit dfdf774656205515b2d6ad94fce63c7ccbe92d91 Author: Lorenzo Bianconi Date: Fri Jan 9 10:29:06 2026 +0100 net: airoha: Fix typo in airoha_ppe_setup_tc_block_cb definition Fix Typo in airoha_ppe_dev_setup_tc_block_cb routine definition when CONFIG_NET_AIROHA is not enabled. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601090517.Fj6v501r-lkp@intel.com/ Fixes: f45fc18b6de04 ("net: airoha: Add airoha_ppe_dev struct definition") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260109-airoha_ppe_dev_setup_tc_block_cb-typo-v1-1-282e8834a9f9@kernel.org Signed-off-by: Jakub Kicinski commit e02f2a0f1f9b6d4f0c620de2ce037d4436b58f70 Author: Jijie Shao Date: Thu Jan 8 15:14:09 2026 +0800 net: phy: motorcomm: fix duplex setting error for phy leds fix duplex setting error for phy leds Fixes: 355b82c54c12 ("net: phy: motorcomm: Add support for PHY LEDs on YT8521") Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260108071409.2750607-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit ec69daabe45256f98ac86c651b8ad1b2574489a7 Author: Tetsuo Handa Date: Thu Jan 8 21:36:48 2026 +0900 bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b ("bpf: Support specifying ingress via xdp_md context in BPF_PROG_TEST_RUN"), the refcount obtained by xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the error handling path introduced by commit 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") forgot to call xdp_convert_buff_to_md(). Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Fixes: 1c1949982524 ("bpf: introduce frags support to bpf_prog_test_run_xdp()") Signed-off-by: Tetsuo Handa Reviewed-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/af090e53-9d9b-4412-8acb-957733b3975c@I-love.SAKURA.ne.jp Signed-off-by: Alexei Starovoitov commit f34b32745e2c9f85ee33b42e7a8cdaa1ee1c16a3 Author: sheetal Date: Wed Dec 17 18:55:24 2025 +0530 ASoC: tegra: Revert fix for uninitialized flat cache warning in tegra210_ahub Commit 4d4021b0bbd1 ("ASoC: tegra: Fix uninitialized flat cache warning in tegra210_ahub") attempted to fix the uninitialized flat cache warning that is observed for the Tegra210 AHUB driver. However, the change broke various audio tests because an -EBUSY error is returned when accessing registers from cache before they are read from hardware. Revert this change for now, until a proper fix is available. Fixes: 4d4021b0bbd1 ("ASoC: tegra: Fix uninitialized flat cache warning in tegra210_ahub") Signed-off-by: sheetal Acked-by: Jon Hunter Link: https://patch.msgid.link/20251217132524.2844499-1-sheetal@nvidia.com Signed-off-by: Mark Brown commit b71e635feefc852405b14620a7fc58c4c80c0f73 Merge: 0f61b1860cc3f5 ef56578274d2b9 Author: Linus Torvalds Date: Mon Jan 12 09:56:17 2026 -1000 Merge tag 'cgroup-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: - Fix -Wflex-array-member-not-at-end warnings in cgroup_root * tag 'cgroup-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Eliminate cgrp_ancestor_storage in cgroup_root commit 2120f3a3738a65730c81bf10447b1ff776078915 Author: Dan Carpenter Date: Thu Jan 8 23:00:24 2026 +0300 wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() The "i" iterator variable is used to count two different things but unfortunately we can't store two different numbers in the same variable. Use "i" for the outside loop and "j" for the inside loop. Cc: stable@vger.kernel.org Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size") Signed-off-by: Dan Carpenter Reviewed-by: Jeff Chen Link: https://patch.msgid.link/aWAM2MGUWRP0zWUd@stanley.mountain Signed-off-by: Johannes Berg commit db1d0b6ab11f612ea8a327663a578c8946efeee9 Author: Miri Korenblit Date: Sun Jan 11 19:19:30 2026 +0200 wifi: mac80211: correctly check if CSA is active We are not adding an interface if an existing one is doing CSA. But the check won't work for MLO station interfaces, since for those, vif->bss_conf is zeroed out. Fix this by checking if any link of the vif has an active CSA. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260111191912.7ceff62fc561.Ia38d27f42684d1cfd82d930d232bd5dea6ab9282@changeid Signed-off-by: Johannes Berg commit a3034bf0746d88a00cceda9541534a5721445a24 Author: Veerendranath Jakkam Date: Fri Jan 9 20:30:04 2026 +0530 wifi: cfg80211: Fix bitrate calculation overflow for HE rates An integer overflow occurs in cfg80211_calculate_bitrate_he() when calculating bitrates for high throughput HE configurations. For example, with 160 MHz bandwidth, HE-MCS 13, HE-NSS 4, and HE-GI 0, the multiplication (result * rate->nss) overflows the 32-bit 'result' variable before division by 8, leading to significantly underestimated bitrate values. The overflow occurs because the NSS multiplication operates on a 32-bit integer that cannot accommodate intermediate values exceeding 4,294,967,295. When overflow happens, the value wraps around, producing incorrect bitrates for high MCS and NSS combinations. Fix this by utilizing the 64-bit 'tmp' variable for the NSS multiplication and subsequent divisions via do_div(). This approach preserves full precision throughout the entire calculation, with the final value assigned to 'result' only after completing all operations. Signed-off-by: Veerendranath Jakkam Link: https://patch.msgid.link/20260109-he_bitrate_overflow-v1-1-95575e466b6e@oss.qualcomm.com Signed-off-by: Johannes Berg commit 4f431d88ea8093afc7ba55edf4652978c5a68f33 Author: Marek Vasut Date: Sat Jan 10 00:56:29 2026 +0100 wifi: rsi: Fix memory corruption due to not set vif driver data size The struct ieee80211_vif contains trailing space for vif driver data, when struct ieee80211_vif is allocated, the total memory size that is allocated is sizeof(struct ieee80211_vif) + size of vif driver data. The size of vif driver data is set by each WiFi driver as needed. The RSI911x driver does not set vif driver data size, no trailing space for vif driver data is therefore allocated past struct ieee80211_vif . The RSI911x driver does however use the vif driver data to store its vif driver data structure "struct vif_priv". An access to vif->drv_priv leads to access out of struct ieee80211_vif bounds and corruption of some memory. In case of the failure observed locally, rsi_mac80211_add_interface() would write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv; vif_info->vap_id = vap_idx. This write corrupts struct fq_tin member struct list_head new_flows . The flow = list_first_entry(head, struct fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus address, which when accessed causes a crash. The trigger is very simple, boot the machine with init=/bin/sh , mount devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1", "ip link set wlan0 down" and the crash occurs. Fix this by setting the correct size of vif driver data, which is the size of "struct vif_priv", so that memory is allocated and the driver can store its driver data in it, instead of corrupting memory around it. Cc: stable@vger.kernel.org Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260109235817.150330-1-marex@nabladev.com Signed-off-by: Johannes Berg commit 8f334e35220721f65180bc2e0fe9187436c2c475 Author: Rafael J. Wysocki Date: Wed Jan 7 16:14:55 2026 +0100 ACPI: PM: s2idle: Add missing checks to acpi_s2idle_begin_lps0() Commit 32ece31db4df ("ACPI: PM: s2idle: Only retrieve constraints when needed"), that attempted to avoid useless evaluation of LPS0 _DSM Function 1 in lps0_device_attach(), forgot to add checks for lps0_device_handle and sleep_no_lps0 to acpi_s2idle_begin_lps0() where they should be done before calling lpi_device_get_constraints() or lpi_device_get_constraints_amd(). Add the missing checks. Fixes: 32ece31db4df ("ACPI: PM: s2idle: Only retrieve constraints when needed") Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/2818730.mvXUDI8C0e@rafael.j.wysocki commit f93fc5d12d69012788f82151bee55fce937e1432 Author: Kery Qi Date: Fri Jan 9 00:42:57 2026 +0800 net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails part-way, the rollback loop calls free_irq() with dev_id set to 'oct', which does not match the original dev_id and may leave the irqaction registered. This can keep IRQ handlers alive while ioq_vector is later freed during unwind/teardown, leading to a use-after-free or crash when an interrupt fires. Fix the error path to free IRQs with the same ioq_vector dev_id used during request_irq(). Fixes: 1cd3b407977c ("octeon_ep_vf: add Tx/Rx processing and interrupt support") Signed-off-by: Kery Qi Link: https://patch.msgid.link/20260108164256.1749-2-qikeyu2017@gmail.com Signed-off-by: Jakub Kicinski commit 803e18641fd444a614415711a5af53dcde21104b Author: Anna Schumaker Date: Fri Jan 9 15:41:14 2026 -0500 NFS: Don't immediately return directory delegations when disabled The function nfs_inode_evict_delegation() immediately and synchronously returns a delegation when called. This means we can't call it from nfs4_have_delegation(), since that function could be called under a lock. Instead we should mark the delegation for return and let the state manager handle it for us. Fixes: b6d2a520f463 ("NFS: Add a module option to disable directory delegations") Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 05f66cf5e7a5fc7c7227541f8a4a476037999916 Author: Boqun Feng Date: Fri Dec 26 19:39:38 2025 +0800 PCI: Provide pci_free_irq_vectors() stub 473b9f331718 ("rust: pci: fix build failure when CONFIG_PCI_MSI is disabled") fixed a build error by providing Rust helpers when CONFIG_PCI_MSI is not set. However the Rust helpers rely on pci_free_irq_vectors(), which is only available when CONFIG_PCI=y. When CONFIG_PCI is not set, there is already a stub for pci_alloc_irq_vectors(). Add a similar stub for pci_free_irq_vectors(). Fixes: 473b9f331718 ("rust: pci: fix build failure when CONFIG_PCI_MSI is disabled") Reported-by: FUJITA Tomonori Closes: https://lore.kernel.org/rust-for-linux/20251209014312.575940-1-fujita.tomonori@gmail.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512220740.4Kexm4dW-lkp@intel.com/ Reported-by: Liang Jie Closes: https://lore.kernel.org/rust-for-linux/20251222034415.1384223-1-buaajxlj@163.com/ Signed-off-by: Boqun Feng Signed-off-by: Bjorn Helgaas Reviewed-by: Drew Fustini Reviewed-by: David Gow Reviewed-by: Joel Fernandes Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20251226113938.52145-1-boqun.feng@gmail.com commit 6abbb8703aeeb645a681ab6ad155e0b450413787 Author: Günther Noack Date: Sun Jan 11 18:52:04 2026 +0100 landlock: Clarify documentation for the IOCTL access right Move the description of the LANDLOCK_ACCESS_FS_IOCTL_DEV access right together with the file access rights. This group of access rights applies to files (in this case device files), and they can be added to file or directory inodes using landlock_add_rule(2). The check for that works the same for all file access rights, including LANDLOCK_ACCESS_FS_IOCTL_DEV. Invoking ioctl(2) on directory FDs can not currently be restricted with Landlock. Having it grouped separately in the documentation is a remnant from earlier revisions of the LANDLOCK_ACCESS_FS_IOCTL_DEV patch set. Link: https://lore.kernel.org/all/20260108.Thaex5ruach2@digikod.net/ Signed-off-by: Günther Noack Link: https://lore.kernel.org/r/20260111175203.6545-2-gnoack3000@gmail.com Signed-off-by: Mickaël Salaün commit d4026a44626490dc4eca4dd2c4d0816338fa179b Author: Li Ming Date: Mon Jan 12 20:05:26 2026 +0800 cxl/hdm: Fix potential infinite loop in __cxl_dpa_reserve() In __cxl_dpa_reserve(), it will check if the new resource range is included in one of paritions of the cxl memory device. cxlds->nr_paritions is used to represent how many partitions information the cxl memory device has. In the loop, if driver cannot find a partition including the new resource range, it will be an infinite loop. [ dj: Removed incorrect fixes tag ] Fixes: 991d98f17d31 ("cxl: Make cxl_dpa_alloc() DPA partition number agnostic") Signed-off-by: Li Ming Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260112120526.530232-1-ming.li@zohomail.com Signed-off-by: Dave Jiang commit a11224a016d6d1d46a4d9b6573244448a80d4d7f Author: Jiasheng Jiang Date: Sun Jan 11 19:20:37 2026 +0000 btrfs: fix memory leaks in create_space_info() error paths In create_space_info(), the 'space_info' object is allocated at the beginning of the function. However, there are two error paths where the function returns an error code without freeing the allocated memory: 1. When create_space_info_sub_group() fails in zoned mode. 2. When btrfs_sysfs_add_space_info_type() fails. In both cases, 'space_info' has not yet been added to the fs_info->space_info list, resulting in a memory leak. Fix this by adding an error handling label to kfree(space_info) before returning. Fixes: 2be12ef79fe9 ("btrfs: Separate space_info create/update") Reviewed-by: Qu Wenruo Signed-off-by: Jiasheng Jiang Signed-off-by: David Sterba commit 882680774933fd276023e01cf0261c2350d7201e Author: Filipe Manana Date: Thu Jan 8 16:16:38 2026 +0000 btrfs: invalidate pages instead of truncate after reflinking Qu reported that generic/164 often fails because the read operations get zeroes when it expects to either get all bytes with a value of 0x61 or 0x62. The issue stems from truncating the pages from the page cache instead of invalidating, as truncating can zero page contents. This zeroing is not just in case the range is not page sized (as it's commented in truncate_inode_pages_range()) but also in case we are using large folios, they need to be split and the splitting fails. Stealing Qu's comment in the thread linked below: "We can have the following case: 0 4K 8K 12K 16K | | | | | |<---- Extent A ----->|<----- Extent B ------>| The page size is still 4K, but the folio we got is 16K. Then if we remap the range for [8K, 16K), then truncate_inode_pages_range() will get the large folio 0 sized 16K, then call truncate_inode_partial_folio(). Which later calls folio_zero_range() for the [8K, 16K) range first, then tries to split the folio into smaller ones to properly drop them from the cache. But if splitting failed (e.g. racing with other operations holding the filemap lock), the partially zeroed large folio will be kept, resulting the range [8K, 16K) being zeroed meanwhile the folio is still a 16K sized large one." So instead of truncating, invalidate the page cache range with a call to filemap_invalidate_inode(), which besides not doing any zeroing also ensures that while it's invalidating folios, no new folios are added. This helps ensure that buffered reads that happen while a reflink operation is in progress always get either the whole old data (the one before the reflink) or the whole new data, which is what generic/164 expects. Link: https://lore.kernel.org/linux-btrfs/7fb9b44f-9680-4c22-a47f-6648cb109ddf@suse.com/ Reported-by: Qu Wenruo Reviewed-by: Qu Wenruo Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 64dd1caf88f96146edee24e82834cf2a11c3932b Author: Qu Wenruo Date: Fri Jan 9 14:01:14 2026 +1030 btrfs: update the Kconfig string for CONFIG_BTRFS_EXPERIMENTAL The following new features are missing: - Async checksum - Shutdown ioctl and auto-degradation - Larger block size support Which is dependent on larger folios. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 469d71512d135907bf5ea0972dfab8c420f57848 Author: Andreas Gruenbacher Date: Mon Jan 12 11:47:35 2026 +0100 Revert "gfs2: Fix use of bio_chain" This reverts commit 8a157e0a0aa5143b5d94201508c0ca1bb8cfb941. That commit incorrectly assumed that the bio_chain() arguments were swapped in gfs2. However, gfs2 intentionally constructs bio chains so that the first bio's bi_end_io callback is invoked when all bios in the chain have completed, unlike bio chains where the last bio's callback is invoked. Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain") Cc: stable@vger.kernel.org Signed-off-by: Andreas Gruenbacher commit 4b58aac989c1e3fafb1c68a733811859df388250 Author: Cheng-Yu Lee Date: Fri Jan 9 11:26:33 2026 +0800 regmap: Fix race condition in hwspinlock irqsave routine Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner. Fix this by using a local stack variable 'flags' to store the IRQ state temporarily. Fixes: 8698b9364710 ("regmap: Add hardware spinlock support") Signed-off-by: Cheng-Yu Lee Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Link: https://patch.msgid.link/20260109032633.8732-1-eleanor.lin@realtek.com Signed-off-by: Mark Brown commit b062a899c997df7b9ce29c62164888baa7a85833 Author: Devyn Liu Date: Thu Jan 8 15:53:23 2026 +0800 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization In hisi_spi_debugfs_init, spi controller pointer is calculated by container_of macro, and the member is hs->dev. But the host cannot be calculated offset directly by this. (hs->dev) points to (pdev->dev), and it is the (host->dev.parent) rather than (host->dev) points to the (pdev->dev), which is set in __spi_alloc_controller. In this patch, this issues is fixed by getting the spi_controller data from pdev->dev by dev_get_drvdata() directly. (dev->driver_data) points to the spi controller data in the probe stage. Signed-off-by: Devyn Liu Reviewed-by: Yang Shen Link: https://patch.msgid.link/20260108075323.3831574-1-liudingyuan@h-partners.com Signed-off-by: Mark Brown commit 383d4f5cffcc8df930d95b06518a9d25a6d74aac Author: Felix Gu Date: Fri Jan 9 20:49:53 2026 +0800 spi: spi-sprd-adi: Fix double free in probe error path The driver currently uses spi_alloc_host() to allocate the controller but registers it using devm_spi_register_controller(). If devm_register_restart_handler() fails, the code jumps to the put_ctlr label and calls spi_controller_put(). However, since the controller was registered via a devm function, the device core will automatically call spi_controller_put() again when the probe fails. This results in a double-free of the spi_controller structure. Fix this by switching to devm_spi_alloc_host() and removing the manual spi_controller_put() call. Fixes: ac17750 ("spi: sprd: Add the support of restarting the system") Signed-off-by: Felix Gu Reviewed-by: Baolin Wang Link: https://patch.msgid.link/tencent_AC7D389CE7E24318445E226F7CDCCC2F0D07@qq.com Signed-off-by: Mark Brown commit 70d95c5d2081faca7e849fa9c6665c9e0dae3923 Author: Rob Herring (Arm) Date: Thu Jan 8 16:49:36 2026 -0600 ASoC: dt-bindings: rockchip-spdif: Allow "port" node Add a "port" node entry for Rockchip S/PDIF binding. It's already in use and a common property for DAIs. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260108224938.1320809-1-robh@kernel.org Signed-off-by: Mark Brown commit f66e7da2a6b1ba055d47d7c97c9c855729f868ed Author: Rob Herring (Arm) Date: Thu Jan 8 15:53:06 2026 -0600 ASoC: dt-bindings: realtek,rt5640: Allow 7 for realtek,jack-detect-source The driver accepts and uses a value of 7 for realtek,jack-detect-source. What exactly it means isn't clear though. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260108215307.1138515-2-robh@kernel.org Signed-off-by: Mark Brown commit 101b982654ac0305ab286b54d46de79b5b982f3a Author: Rob Herring (Arm) Date: Thu Jan 8 15:53:05 2026 -0600 ASoC: dt-bindings: realtek,rt5640: Add missing properties/node The RT5640 has an MCLK pin and several users already define a clocks entry. A 'port' node is also in use and a common node for codecs. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260108215307.1138515-1-robh@kernel.org Signed-off-by: Mark Brown commit 81d0223832f99c0833e46be114a8310888015f8b Author: Ben Dooks Date: Thu Jan 8 15:12:03 2026 -0500 drm/i915/guc: make 'guc_hw_reg_state' static as it isn't exported The guc_hw_reg_state array is not exported, so make it static. Fixes the following sparse warning: drivers/gpu/drm/i915/i915_gpu_error.c:692:3: warning: symbol 'guc_hw_reg_state' was not declared. Should it be static? Fixes: ba391a102ec11 ("drm/i915/guc: Include the GuC registers in the error state") Signed-off-by: Ben Dooks Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20260108201202.59250-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 701c47493328a8173996e7590733be3493af572f) Signed-off-by: Jani Nikula commit e16688084df76e719b329a1a56b338ec491002e0 Merge: c644bce62b9c6b 30ef9a20f1fdf6 Author: Christian Brauner Date: Mon Jan 12 11:07:30 2026 +0100 Merge patch series "Fix vm.dirtytime_expire_seconds=0 causing 100% CPU" Laveesh Bansal says: Setting vm.dirtytime_expire_seconds to 0 causes wakeup_dirtytime_writeback() to reschedule itself with a delay of 0, creating an infinite busy loop that spins kworker at 100% CPU. This series: - Patch 1: Fixes the bug by handling interval=0 as "disable writeback" (consistent with dirty_writeback_centisecs behavior) - Patch 2: Documents that setting the value to 0 disables writeback Tested by booting kernels in QEMU with virtme-ng: - Buggy kernel: kworker CPU spikes to ~73% when interval set to 0 - Fixed kernel: CPU remains normal, writeback correctly disabled - Re-enabling (0 -> non-zero): writeback resumes correctly * patches from https://patch.msgid.link/20260106145059.543282-1-laveeshb@laveeshbansal.com: docs: clarify that dirtytime_expire_seconds=0 disables writeback writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 Link: https://patch.msgid.link/20260106145059.543282-1-laveeshb@laveeshbansal.com Signed-off-by: Christian Brauner commit 30ef9a20f1fdf6ab483d64fe3d54ba7d07b9b46f Author: Laveesh Bansal Date: Tue Jan 6 14:50:59 2026 +0000 docs: clarify that dirtytime_expire_seconds=0 disables writeback Document that setting vm.dirtytime_expire_seconds to zero disables periodic dirtytime writeback, matching the behavior of the related dirty_writeback_centisecs sysctl which already documents this. Signed-off-by: Laveesh Bansal Link: https://patch.msgid.link/20260106145059.543282-3-laveeshb@laveeshbansal.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 543467d6fe97e27e22a26e367fda972dbefebbff Author: Laveesh Bansal Date: Tue Jan 6 14:50:58 2026 +0000 writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 When vm.dirtytime_expire_seconds is set to 0, wakeup_dirtytime_writeback() schedules delayed work with a delay of 0, causing immediate execution. The function then reschedules itself with 0 delay again, creating an infinite busy loop that causes 100% kworker CPU usage. Fix by: - Only scheduling delayed work in wakeup_dirtytime_writeback() when dirtytime_expire_interval is non-zero - Cancelling the delayed work in dirtytime_interval_handler() when the interval is set to 0 - Adding a guard in start_dirtytime_writeback() for defensive coding Tested by booting kernel in QEMU with virtme-ng: - Before fix: kworker CPU spikes to ~73% - After fix: CPU remains at normal levels - Setting interval back to non-zero correctly resumes writeback Fixes: a2f4870697a5 ("fs: make sure the timestamps for lazytime inodes eventually get written") Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220227 Signed-off-by: Laveesh Bansal Link: https://patch.msgid.link/20260106145059.543282-2-laveeshb@laveeshbansal.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit c644bce62b9c6b441143a03c910f986109c47001 Author: Amir Goldstein Date: Thu Jan 8 08:45:22 2026 +0100 readdir: require opt-in for d_type flags Commit c31f91c6af96 ("fuse: don't allow signals to interrupt getdents copying") introduced the use of high bits in d_type as flags. However, overlayfs was not adapted to handle this change. In ovl_cache_entry_new(), the code checks if d_type == DT_CHR to determine if an entry might be a whiteout. When fuse is used as the lower layer and sets high bits in d_type, this comparison fails, causing whiteout files to not be recognized properly and resulting in incorrect overlayfs behavior. Fix this by requiring callers of iterate_dir() to opt-in for getting flag bits in d_type outside of S_DT_MASK. Fixes: c31f91c6af96 ("fuse: don't allow signals to interrupt getdents copying") Link: https://lore.kernel.org/all/20260107034551.439-1-luochunsheng@ustc.edu/ Link: https://github.com/containerd/stargz-snapshotter/issues/2214 Reported-by: Chunsheng Luo Reviewed-by: Chunsheng Luo Tested-by: Chunsheng Luo Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20260108074522.3400998-1-amir73il@gmail.com Signed-off-by: Christian Brauner commit 7d42f2b1cc3a60a71784967384ddcf29fe3f35ed Merge: cab01237512230 8a5511eeaa5c4e Author: Christian Brauner Date: Mon Jan 12 10:54:52 2026 +0100 Merge patch series "vfs: properly deny directory leases on filesystems with special lease handling" Jeff Layton says: Filesystems currently have to set the ->setlease() method explicitly in order to deny attempts to set a lease or delegation. With the advent of directory delegations, we now need to set ->setlease on the directory file_operations for several filesystems to simple_nosetlease() to ensure this. This patchset does that. There should be no noticeable change in behavior, other than fixing the support detection in xfstests, allowing lease/delegation tests to be properly skipped on these filesystems. It's probably simplest to merge these all at once via Christian's tree if he's amenable, but Acks would be welcome. Ideally these would go in for v6.19. Long term, I think it would be best to change leases/delegations to be an opt-in thing, such that leases are always denied by default if the method isn't set. That's a larger patchset though as we'd need to audit all of the file_operations that currently have ->setlease() as NULL. * patches from https://patch.msgid.link/20260107-setlease-6-19-v1-0-85f034abcc57@kernel.org: vboxsf: don't allow delegations to be set on directories ceph: don't allow delegations to be set on directories gfs2: don't allow delegations to be set on directories 9p: don't allow delegations to be set on directories smb/client: properly disallow delegations on directories nfs: properly disallow delegation requests on directories Link: https://patch.msgid.link/20260107-setlease-6-19-v1-0-85f034abcc57@kernel.org Signed-off-by: Christian Brauner commit 8a5511eeaa5c4e5c2be6209abe549302b70311b0 Author: Jeff Layton Date: Wed Jan 7 09:20:14 2026 -0500 vboxsf: don't allow delegations to be set on directories With the advent of directory leases, it's necessary to set the ->setlease() handler in directory file_operations to properly deny them. Fixes: e6d28ebc17eb ("filelock: push the S_ISREG check down to ->setlease handlers") Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260107-setlease-6-19-v1-6-85f034abcc57@kernel.org Signed-off-by: Christian Brauner commit ffb321045b0f1cd8bcea215269fbaa17c12da038 Author: Jeff Layton Date: Wed Jan 7 09:20:13 2026 -0500 ceph: don't allow delegations to be set on directories With the advent of directory leases, it's necessary to set the ->setlease() handler in directory file_operations to properly deny them. Fixes: e6d28ebc17eb ("filelock: push the S_ISREG check down to ->setlease handlers") Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260107-setlease-6-19-v1-5-85f034abcc57@kernel.org Reviewed-by: Viacheslav Dubeyko Signed-off-by: Christian Brauner commit ce946c4fb98c95519ee39ab7d4b117ff15f09efa Author: Jeff Layton Date: Wed Jan 7 09:20:12 2026 -0500 gfs2: don't allow delegations to be set on directories With the advent of directory leases, it's necessary to set the ->setlease() handler in directory file_operations to properly deny them. In the "nolock" case however, there is no need to deny them. Fixes: e6d28ebc17eb ("filelock: push the S_ISREG check down to ->setlease handlers") Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260107-setlease-6-19-v1-4-85f034abcc57@kernel.org Signed-off-by: Christian Brauner commit 5d65a70bd0437d2a7762164eb5015f6975937986 Author: Jeff Layton Date: Wed Jan 7 09:20:11 2026 -0500 9p: don't allow delegations to be set on directories With the advent of directory leases, it's necessary to set the ->setlease() handler in directory file_operations to properly deny them. Fixes: e6d28ebc17eb ("filelock: push the S_ISREG check down to ->setlease handlers") Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260107-setlease-6-19-v1-3-85f034abcc57@kernel.org Signed-off-by: Christian Brauner commit b9a9be4d3557b97303ac6c8b5e153b7ef569d886 Author: Jeff Layton Date: Wed Jan 7 09:20:10 2026 -0500 smb/client: properly disallow delegations on directories The check for S_ISREG() in cifs_setlease() is incorrect since that operation doesn't get called for directories. The correct way to prevent delegations on directories is to set the ->setlease() method in directory file_operations to simple_nosetlease(). Fixes: e6d28ebc17eb ("filelock: push the S_ISREG check down to ->setlease handlers") Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260107-setlease-6-19-v1-2-85f034abcc57@kernel.org Signed-off-by: Christian Brauner commit 10dcd5110678c6b241bbcf062f72ea14fb3597f3 Author: Jeff Layton Date: Wed Jan 7 09:20:09 2026 -0500 nfs: properly disallow delegation requests on directories Checking for S_ISREG() in nfs4_setlease() is incorrect, since that op is never called for directories. The right way to deny lease requests on directories is to set the ->setlease() operation to simple_nosetlease() in the directory file_operations. Fixes: e6d28ebc17eb ("filelock: push the S_ISREG check down to ->setlease handlers") Reported-by: Christoph Hellwig Closes: https://lore.kernel.org/linux-fsdevel/aV316LhsVSl0n9-E@infradead.org/ Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260107-setlease-6-19-v1-1-85f034abcc57@kernel.org Tested-by: Christoph Hellwig Signed-off-by: Christian Brauner commit cab012375122304a6343c1ed09404e5143b9dc01 Author: NeilBrown Date: Mon Dec 1 09:06:18 2025 +1100 fuse: fix conversion of fuse_reverse_inval_entry() to start_removing() The recent conversion of fuse_reverse_inval_entry() to use start_removing() was wrong. As Val Packett points out the original code did not call ->lookup while the new code does. This can lead to a deadlock. Rather than using full_name_hash() and d_lookup() as the old code did, we can use try_lookup_noperm() which combines these. Then the result can be given to start_removing_dentry() to get the required locks for removal. We then double check that the name hasn't changed. As 'dir' needs to be used several times now, we load the dput() until the end, and initialise to NULL so dput() is always safe. Reported-by: Val Packett Closes: https://lore.kernel.org/all/6713ea38-b583-4c86-b74a-bea55652851d@packett.cool Fixes: c9ba789dad15 ("VFS: introduce start_creating_noperm() and start_removing_noperm()") Signed-off-by: NeilBrown Link: https://patch.msgid.link/176454037897.634289.3566631742434963788@noble.neil.brown.name Signed-off-by: Christian Brauner commit 471e998c0e31206ff0eac7202b2659698cf9b46e Author: Bartosz Golaszewski Date: Fri Jan 9 11:55:56 2026 +0100 gpiolib: remove redundant callback check The presence of the .get_direction() callback is already checked in gpiochip_get_direction(). Remove the duplicated check which also returns the wrong error code to user-space. Fixes: e623c4303ed1 ("gpiolib: sanitize the return value of gpio_chip::get_direction()") Reported-by: Michael Walle Closes: https://lore.kernel.org/all/DFJAFK3DTBOZ.3G2P3A5IH34GF@kernel.org/ Link: https://lore.kernel.org/r/20260109105557.20024-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit c18790018799155e58d5a11c6697f9c398bf8b60 Author: Bartosz Golaszewski Date: Fri Jan 9 14:08:32 2026 +0100 gpio: davinci: implement .get_direction() It's strongly recommended for GPIO drivers to always implement the .get_direction() callback - even for fixed-direction controllers. GPIO core will even emit a warning if the callback is missing, when users try to read the direction of a pin. Implement .get_direction() for gpio-davinci. Reported-by: Michael Walle Closes: https://lore.kernel.org/all/DFJAFK3DTBOZ.3G2P3A5IH34GF@kernel.org/ Reviewed-by: Linus Walleij Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Tested-by: Michael Walle # on sa67 Link: https://lore.kernel.org/r/20260109130832.27326-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 0f61b1860cc3f52aef9036d7235ed1f017632193 Author: Linus Torvalds Date: Sun Jan 11 17:03:14 2026 -1000 Linux 6.19-rc5 commit 901a5f309daba412e2a30364d7ec1492fa11c32c Author: Abdun Nihaal Date: Tue Dec 23 12:00:11 2025 +0530 scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() Memory allocated for struct vscsiblk_info in scsiback_probe() is not freed in scsiback_remove() leading to potential memory leaks on remove, as well as in the scsiback_probe() error paths. Fix that by freeing it in scsiback_remove(). Cc: stable@vger.kernel.org Fixes: d9d660f6e562 ("xen-scsiback: Add Xen PV SCSI backend driver") Signed-off-by: Abdun Nihaal Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20251223063012.119035-1-nihaal@cse.iitm.ac.in Signed-off-by: Martin K. Petersen commit 7143203341dccbca809ba0a8e72239ea4652ace6 Merge: 9c7ef209cd0f7c 74d74bb78aeccc Author: Linus Torvalds Date: Sun Jan 11 15:07:56 2026 -1000 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - A couple more fixes for the lib/crypto KUnit tests - Fix missing MMU protection for the AES S-box * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: aes: Fix missing MMU protection for AES S-box MAINTAINERS: add test vector generation scripts to "CRYPTO LIBRARY" lib/crypto: tests: Fix syntax error for old python versions lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs commit 8cc27f5c6dd17dd090f3a696683f04336c162ff5 Author: Georgi Djakov Date: Fri Jan 9 14:25:23 2026 +0200 interconnect: debugfs: initialize src_node and dst_node to empty strings The debugfs_create_str() API assumes that the string pointer is either NULL or points to valid kmalloc() memory. Leaving the pointer uninitialized can cause problems. Initialize src_node and dst_node to empty strings before creating the debugfs entries to guarantee that reads and writes are safe. Fixes: 770c69f037c1 ("interconnect: Add debugfs test client") Signed-off-by: Georgi Djakov Reviewed-by: Kuan-Wei Chiu Tested-by: Kuan-Wei Chiu Link: https://lore.kernel.org/r/20260109122523.125843-1-djakov@kernel.org Signed-off-by: Georgi Djakov commit 9c7ef209cd0f7c1a92ed61eed3e835d6e4abc66c Merge: 316a94cb6398ea 361e0ff456a8da Author: Linus Torvalds Date: Sun Jan 11 07:27:44 2026 -1000 Merge tag 'char-misc-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for some reported issues. Included in here is: - much reported rust_binder fix - counter driver fixes - new device ids for the mei driver All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: rust_binder: remove spin_lock() in rust_shrink_free_page() mei: me: add nova lake point S DID counter: 104-quad-8: Fix incorrect return value in IRQ handler counter: interrupt-cnt: Drop IRQF_NO_THREAD flag commit 316a94cb6398ea073790462ddd337da06ad8e1de Merge: fac4bdbacab5a9 9efb74f84ba82a Author: Linus Torvalds Date: Sun Jan 11 07:19:43 2026 -1000 Merge tag 'x86-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Disable GCOV instrumentation in the SEV noinstr.c collection of SEV noinstr methods, to further robustify the code" * tag 'x86-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Disable GCOV on noinstr object commit fac4bdbacab5a9abe7e017069c640273c2a704e2 Merge: fe948326e95dcc 2bdf777410dc6e Author: Linus Torvalds Date: Sun Jan 11 07:11:53 2026 -1000 Merge tag 'sched-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a crash in sched_mm_cid_after_execve()" * tag 'sched-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve() commit fe948326e95dcc7b1efb6b76e92b5b919f56250c Merge: 88730166f3ee26 ff5860f5088e90 Author: Linus Torvalds Date: Sun Jan 11 06:55:27 2026 -1000 Merge tag 'perf-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Ingo Molnar: "Fix perf swevent hrtimer deinit regression" * tag 'perf-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Ensure swevent hrtimer is properly destroyed commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 Author: Janne Grunau Date: Wed Dec 31 13:34:59 2025 +0100 dmaengine: apple-admac: Add "apple,t8103-admac" compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,admac" anymore [1]. Use "apple,t8103-admac" as base compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") Cc: stable@vger.kernel.org Reviewed-by: Neal Gompa Signed-off-by: Janne Grunau Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net Signed-off-by: Vinod Koul commit 2e1136acf8a8887c29f52e35a77b537309af321f Author: Haotian Zhang Date: Mon Nov 3 15:30:18 2025 +0800 dmaengine: omap-dma: fix dma_pool resource leak in error paths The dma_pool created by dma_pool_create() is not destroyed when dma_async_device_register() or of_dma_controller_register() fails, causing a resource leak in the probe error paths. Add dma_pool_destroy() in both error paths to properly release the allocated dma_pool resource. Fixes: 7bedaa553760 ("dmaengine: add OMAP DMA engine driver") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251103073018.643-1-vulab@iscas.ac.cn Signed-off-by: Vinod Koul commit 3f747004bbd641131d9396d87b5d2d3d1e182728 Author: Miaoqian Lin Date: Wed Oct 29 20:34:19 2025 +0800 dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails. The issue occurs when: 1. gchan->config points to previously allocated memory 2. krealloc() fails and returns NULL 3. The function directly assigns NULL to gchan->config, losing the reference to the original memory 4. The original memory becomes unreachable and cannot be freed Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds. Found via static analysis and code review. Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com Signed-off-by: Vinod Koul commit 88730166f3ee261c43e5087ea665f3a47966865b Merge: 2e4b28c48f88ce a33d16dc874a95 Author: Linus Torvalds Date: Sun Jan 11 06:36:20 2026 -1000 Merge tag 'irq-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc irqchip fixes from Ingo Molnar: - Fix an endianness bug in the gic-v5 irqchip driver - Revert a broken commit from the riscv-imsic irqchip driver * tag 'irq-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "irqchip/riscv-imsic: Embed the vector array in lpriv" irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness commit 2e4b28c48f88ce9e263957b1d944cf5349952f88 Author: Thomas Gleixner Date: Sun Jan 11 16:53:48 2026 +0100 treewide: Update email address In a vain attempt to consolidate the email zoo switch everything to the kernel.org account. Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit db8061bbb9b23534ecd69bccdfbd70f5c9543189 Author: Cristian Ciocaltea Date: Sat Jan 10 23:12:11 2026 +0200 drm/rockchip: dw_hdmi_qp: Switch to gpiod_set_value_cansleep() Since commit 20cf2aed89ac ("gpio: rockchip: mark the GPIO controller as sleeping"), the Rockchip GPIO chip operations potentially sleep, hence the kernel complains when trying to make use of the non-sleeping API: [ 16.653343] WARNING: drivers/gpio/gpiolib.c:3902 at gpiod_set_value+0xd0/0x108, CPU#5: kworker/5:1/93 ... [ 16.678470] Hardware name: Radxa ROCK 5B (DT) [ 16.682374] Workqueue: events dw_hdmi_qp_rk3588_hpd_work [rockchipdrm] ... [ 16.729314] Call trace: [ 16.731846] gpiod_set_value+0xd0/0x108 (P) [ 16.734548] dw_hdmi_qp_rockchip_encoder_enable+0xbc/0x3a8 [rockchipdrm] [ 16.737487] drm_atomic_helper_commit_encoder_bridge_enable+0x314/0x380 [drm_kms_helper] [ 16.740555] drm_atomic_helper_commit_tail_rpm+0xa4/0x100 [drm_kms_helper] [ 16.743501] commit_tail+0x1e0/0x2c0 [drm_kms_helper] [ 16.746290] drm_atomic_helper_commit+0x274/0x2b8 [drm_kms_helper] [ 16.749178] drm_atomic_commit+0x1f0/0x248 [drm] [ 16.752000] drm_client_modeset_commit_atomic+0x490/0x5d0 [drm] [ 16.754954] drm_client_modeset_commit_locked+0xf4/0x400 [drm] [ 16.757911] drm_client_modeset_commit+0x50/0x80 [drm] [ 16.760791] __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0x170 [drm_kms_helper] [ 16.763843] drm_fb_helper_hotplug_event+0x340/0x368 [drm_kms_helper] [ 16.766780] drm_fbdev_client_hotplug+0x64/0x1d0 [drm_client_lib] [ 16.769634] drm_client_hotplug+0x178/0x240 [drm] [ 16.772455] drm_client_dev_hotplug+0x170/0x1c0 [drm] [ 16.775303] drm_connector_helper_hpd_irq_event+0xa4/0x178 [drm_kms_helper] [ 16.778248] dw_hdmi_qp_rk3588_hpd_work+0x44/0xb8 [rockchipdrm] [ 16.781080] process_one_work+0xc3c/0x1658 [ 16.783719] worker_thread+0xa24/0xc40 [ 16.786333] kthread+0x3b4/0x3d8 [ 16.788889] ret_from_fork+0x10/0x20 Since gpiod_get_value() is called from a context that can sleep, switch to its *_cansleep() variant and get rid of the issue. Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20260110-dw-hdmi-qp-cansleep-v1-1-1ce937c5b201@collabora.com commit 978d28136c53df38f8f0b747191930e2f95e9084 Author: Miaoqian Lin Date: Wed Jan 7 22:35:50 2026 +0800 iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source When simple_write_to_buffer() succeeds, it returns the number of bytes actually copied to the buffer. The code incorrectly uses 'count' as the index for null termination instead of the actual bytes copied. If count exceeds the buffer size, this leads to out-of-bounds write. Add a check for the count and use the return value as the index. The bug was validated using a demo module that mirrors the original code and was tested under QEMU. Pattern of the bug: - A fixed 64-byte stack buffer is filled using count. - If count > 64, the code still does buf[count] = '\0', causing an - out-of-bounds write on the stack. Steps for reproduce: - Opens the device node. - Writes 128 bytes of A to it. - This overflows the 64-byte stack buffer and KASAN reports the OOB. Found via static analysis. This is similar to the commit da9374819eb3 ("iio: backend: fix out-of-bound write") Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit b8f15d1df2e73322e2112de21a4a7f3553c7fb60 Author: Markus Koeniger Date: Wed Jan 7 16:32:18 2026 +0100 iio: accel: iis328dq: fix gain values The sensors IIS328DQ and H3LIS331DL share one configuration but H3LIS331DL has different gain parameters, configs therefore need to be split up. The gain parameters for the IIS328DQ are 0.98, 1.95 and 3.91, depending on the selected measurement range. See sensor manuals, chapter 2.1 "mechanical characteristics", parameter "Sensitivity". Datasheet: https://www.st.com/resource/en/datasheet/iis328dq.pdf Datasheet: https://www.st.com/resource/en/datasheet/h3lis331dl.pdf Fixes: 46e33707fe95 ("iio: accel: add support for IIS328DQ variant") Reviewed-by: Dimitri Fedrau Signed-off-by: Markus Koeniger Cc: Signed-off-by: Jonathan Cameron commit 755bc1335e3b116b702205b72eb57b7b8aef2bb2 Merge: 0fa27899e0147f b0d7f5f0c9f05f Author: Linus Torvalds Date: Sat Jan 10 15:54:41 2026 -1000 Merge tag 'riscv-for-linus-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Notable changes include a fix to close one common microarchitectural attack vector for out-of-order cores. Another patch exposed an omission in my boot test coverage, which is currently missing relocatable kernels. Otherwise, the fixes seem to be settling down for us. - Fix CONFIG_RELOCATABLE=y boots by building Image files from vmlinux, rather than vmlinux.unstripped, now that the .modinfo section is included in vmlinux.unstripped - Prevent branch predictor poisoning microarchitectural attacks that use the syscall index as a vector by using array_index_nospec() to clamp the index after the bounds check (as x86 and ARM64 already do) - Fix a crash in test_kprobes when building with Clang - Fix a deadlock possible when tracing is enabled for SBI ecalls - Fix the definition of the Zk standard RISC-V ISA extension bundle, which was missing the Zknh extension - A few other miscellaneous non-functional cleanups, removing unused macros, fixing an out-of-date path in code comments, resolving a compile-time warning for a type mismatch in a pr_crit(), and removing an unnecessary header file inclusion" * tag 'riscv-for-linus-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: trace: fix snapshot deadlock with sbi ecall riscv: remove irqflags.h inclusion in asm/bitops.h riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int riscv: configs: Clean up references to non-existing configs riscv: kexec_image: Fix dead link to boot-image-header.rst riscv: pgtable: Cleanup useless VA_USER_XXX definitions riscv: cpufeature: Fix Zk bundled extension missing Zknh riscv: fix KUnit test_kprobes crash when building with Clang riscv: Sanitize syscall table indexing under speculation riscv: boot: Always make Image from vmlinux, not vmlinux.unstripped commit 0fa27899e0147fe180b603bda30930e8c145dd47 Merge: b061fcffe336f1 8510ef5e3cfbd7 Author: Linus Torvalds Date: Sat Jan 10 15:04:04 2026 -1000 Merge tag 'driver-core-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix swapped example values for the `family` and `machine` attributes in the sysfs SoC bus ABI documentation - Fix Rust build and intra-doc issues when optional subsystems (CONFIG_PCI, CONFIG_AUXILIARY_BUS, CONFIG_PRINTK) are disabled - Fix typos and incorrect safety comments in Rust PCI, DMA, and device ID documentation * tag 'driver-core-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: device: Remove explicit import of CStrExt rust: pci: fix typos in Bar struct's comments rust: device: fix broken intra-doc links rust: dma: fix broken intra-doc links rust: driver: fix broken intra-doc links to example driver types rust: device_id: replace incorrect word in safety documentation rust: dma: remove incorrect safety documentation docs: ABI: sysfs-devices-soc: Fix swapped sample values commit b061fcffe336f1f1d1afe6a904f36962378c4026 Merge: 97313d6113ab43 6e39903c73df08 Author: Linus Torvalds Date: Sat Jan 10 14:57:55 2026 -1000 Merge tag 'linux_kselftest-fixes-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fix from Shuah Khan: "Fix tracing test_multiple_writes stalls when buffer_size_kb is less than 12KB" * tag 'linux_kselftest-fixes-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/tracing: Fix test_multiple_writes stall commit 16ce6e6fa946ca6fd1e4fce6926b52b6263d98a8 Merge: 79db36697bc023 5629f8859dca7e Author: Jakub Kicinski Date: Sat Jan 10 15:21:12 2026 -0800 Merge branch 'mlx5e-profile-change-fix' Saeed Mahameed says: ==================== mlx5e profile change fix This series fixes a crash in mlx5e due to profile change error flow. ==================== Link: https://patch.msgid.link/20260108212657.25090-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 5629f8859dca7ef74d7314b60de6a957f23166c0 Author: Saeed Mahameed Date: Thu Jan 8 13:26:57 2026 -0800 net/mlx5e: Restore destroying state bit after profile cleanup Profile rollback can fail in mlx5e_netdev_change_profile() and we will end up with invalid mlx5e_priv memset to 0, we must maintain the 'destroying' bit in order to gracefully shutdown even if the profile/priv are not valid. This patch maintains the previous state of the 'destroying' state of mlx5e_priv after priv cleanup, to allow the remove flow to cleanup common resources from mlx5_core to avoid FW fatal errors as seen below: $ devlink dev eswitch set pci/0000:00:03.0 mode switchdev Error: mlx5_core: Failed setting eswitch to offloads. dmesg: mlx5_core 0000:00:03.0 enp0s3np0: failed to rollback to orig profile, ... $ devlink dev reload pci/0000:00:03.0 mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:00:03.0: poll_health:803:(pid 519): Fatal error 3 detected mlx5_core 0000:00:03.0: firmware version: 28.41.1000 mlx5_core 0000:00:03.0: 0.000 Gb/s available PCIe bandwidth (Unknown x255 link) mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failed mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failed mlx5_core 0000:00:03.0: mlx5_health_try_recover:340:(pid 141): handling bad device here mlx5_core 0000:00:03.0: mlx5_handle_bad_state:285:(pid 141): Expected to see disabled NIC but it is full driver mlx5_core 0000:00:03.0: mlx5_error_sw_reset:236:(pid 141): start mlx5_core 0000:00:03.0: NIC IFC still 0 after 4000ms. Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") Signed-off-by: Saeed Mahameed Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260108212657.25090-5-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 4ef8512e1427111f7ba92b4a847d181ff0aeec42 Author: Saeed Mahameed Date: Thu Jan 8 13:26:56 2026 -0800 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails. Pass netdev to mlx5e_destroy_netdev() to guarantee it will work on a valid netdev. On mlx5e_remove: Check validity of priv->profile, before attempting to cleanup any resources that might be not there. This fixes a kernel oops in mlx5e_remove when switchdev mode fails due to change profile failure. $ devlink dev eswitch set pci/0000:00:03.0 mode switchdev Error: mlx5_core: Failed setting eswitch to offloads. dmesg: workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 $ devlink dev reload pci/0000:00:03.0 ==> oops BUG: kernel NULL pointer dereference, address: 0000000000000370 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100 RSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286 RAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0 RBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10 R10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0 R13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400 FS: 00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0 Call Trace: mlx5e_remove+0x57/0x110 device_release_driver_internal+0x19c/0x200 bus_remove_device+0xc6/0x130 device_del+0x160/0x3d0 ? devl_param_driverinit_value_get+0x2d/0x90 mlx5_detach_device+0x89/0xe0 mlx5_unload_one_devl_locked+0x3a/0x70 mlx5_devlink_reload_down+0xc8/0x220 devlink_reload+0x7d/0x260 devlink_nl_reload_doit+0x45b/0x5a0 genl_family_rcv_msg_doit+0xe8/0x140 Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") Signed-off-by: Saeed Mahameed Reviewed-by: Shay Drori Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260108212657.25090-4-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 123eda2e5b1638e298e3a66bb1e64a8da92de5e1 Author: Saeed Mahameed Date: Thu Jan 8 13:26:55 2026 -0800 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails, mlx5e_priv in mlx5e_dev devlink private is used to reference the netdev and mdev associated with that struct. Instead, store netdev directly into mlx5e_dev and get mdev from the containing mlx5_adev aux device structure. This fixes a kernel oops in mlx5e_remove when switchdev mode fails due to change profile failure. $ devlink dev eswitch set pci/0000:00:03.0 mode switchdev Error: mlx5_core: Failed setting eswitch to offloads. dmesg: workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 $ devlink dev reload pci/0000:00:03.0 ==> oops BUG: kernel NULL pointer dereference, address: 0000000000000520 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_remove+0x68/0x130 RSP: 0018:ffffc900034838f0 EFLAGS: 00010246 RAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10 R10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0 R13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400 FS: 00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0 Call Trace: device_release_driver_internal+0x19c/0x200 bus_remove_device+0xc6/0x130 device_del+0x160/0x3d0 ? devl_param_driverinit_value_get+0x2d/0x90 mlx5_detach_device+0x89/0xe0 mlx5_unload_one_devl_locked+0x3a/0x70 mlx5_devlink_reload_down+0xc8/0x220 devlink_reload+0x7d/0x260 devlink_nl_reload_doit+0x45b/0x5a0 genl_family_rcv_msg_doit+0xe8/0x140 Fixes: ee75f1fc44dd ("net/mlx5e: Create separate devlink instance for ethernet auxiliary device") Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") Signed-off-by: Saeed Mahameed Link: https://patch.msgid.link/20260108212657.25090-3-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 4dadc4077e3f77d6d31e199a925fc7a705e7adeb Author: Saeed Mahameed Date: Thu Jan 8 13:26:54 2026 -0800 net/mlx5e: Fix crash on profile change rollback failure mlx5e_netdev_change_profile can fail to attach a new profile and can fail to rollback to old profile, in such case, we could end up with a dangling netdev with a fully reset netdev_priv. A retry to change profile, e.g. another attempt to call mlx5e_netdev_change_profile via switchdev mode change, will crash trying to access the now NULL priv->mdev. This fix allows mlx5e_netdev_change_profile() to handle previous failures and an empty priv, by not assuming priv is valid. Pass netdev and mdev to all flows requiring mlx5e_netdev_change_profile() and avoid passing priv. In mlx5e_netdev_change_profile() check if current priv is valid, and if not, just attach the new profile without trying to access the old one. This fixes the following oops, when enabling switchdev mode for the 2nd time after first time failure: ## Enabling switchdev mode first time: mlx5_core 0012:03:00.1: E-Switch: Supported tc chains and prios offload workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 ^^^^^^^^ mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) ## retry: Enabling switchdev mode 2nd time: mlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload BUG: kernel NULL pointer dereference, address: 0000000000000038 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5e_detach_netdev+0x3c/0x90 Code: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 <48> 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07 RSP: 0018:ffffc90000673890 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000 RDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000 R10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000 FS: 00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0 Call Trace: mlx5e_netdev_change_profile+0x45/0xb0 mlx5e_vport_rep_load+0x27b/0x2d0 mlx5_esw_offloads_rep_load+0x72/0xf0 esw_offloads_enable+0x5d0/0x970 mlx5_eswitch_enable_locked+0x349/0x430 ? is_mp_supported+0x57/0xb0 mlx5_devlink_eswitch_mode_set+0x26b/0x430 devlink_nl_eswitch_set_doit+0x6f/0xf0 genl_family_rcv_msg_doit+0xe8/0x140 genl_rcv_msg+0x18b/0x290 ? __pfx_devlink_nl_pre_doit+0x10/0x10 ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10 ? __pfx_devlink_nl_post_doit+0x10/0x10 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x52/0x100 genl_rcv+0x28/0x40 netlink_unicast+0x282/0x3e0 ? __alloc_skb+0xd6/0x190 netlink_sendmsg+0x1f7/0x430 __sys_sendto+0x213/0x220 ? __sys_recvmsg+0x6a/0xd0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x50/0x1f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fdfb8495047 Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") Signed-off-by: Saeed Mahameed Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260108212657.25090-2-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 79db36697bc02371d1df6d0fbfc659c8e0e5144f Merge: c8a49a2f9117f4 e707c591a139d1 Author: Jakub Kicinski Date: Sat Jan 10 14:35:32 2026 -0800 Merge tag 'linux-can-fixes-for-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2026-01-09 The first patch is by Szymon Wilczek and fixes a potential memory leak in the etas_es58x driver. The 2nd patch is by me, targets the gs_usb driver and fixes an URB memory leak. Ondrej Ille's patch fixes the transceiver delay compensation in the ctucanfd driver, which is needed for bit rates higher than 1 Mbit/s. * tag 'linux-can-fixes-for-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak can: etas_es58x: allow partial RX URB allocation to succeed ==================== Link: https://patch.msgid.link/20260109135311.576033-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit c8a49a2f9117f4a7c574cbb709dc92a2b602ec00 Merge: c39a6a277e0e67 ab749bfe6a1fc2 Author: Jakub Kicinski Date: Sat Jan 10 14:32:01 2026 -0800 Merge tag 'for-net-2026-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: enable PA Sync Lost event * tag 'for-net-2026-01-09' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: enable PA Sync Lost event ==================== Link: https://patch.msgid.link/20260109211949.236218-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit c39a6a277e0e67ffff6a8efcbbf7e7e23ce9e38c Author: Stefano Garzarella Date: Thu Jan 8 12:44:19 2026 +0100 vsock/test: add a final full barrier after run all tests If the last test fails, the other side still completes correctly, which could lead to false positives. Let's add a final barrier that ensures that the last test has finished correctly on both sides, but also that the two sides agree on the number of tests to be performed. Fixes: 2f65b44e199c ("VSOCK: add full barrier between test cases") Reviewed-by: Luigi Leonardi Signed-off-by: Stefano Garzarella Link: https://patch.msgid.link/20260108114419.52747-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit e67c577d89894811ce4dcd1a9ed29d8b63476667 Author: Eric Dumazet Date: Thu Jan 8 19:02:14 2026 +0000 ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device. [1] skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0 kernel BUG at net/core/skbuff.c:213 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") Reported-by: syzbot+7c134e1c3aa3283790b9@syzkaller.appspotmail.com Closes: https://www.spinics.net/lists/netdev/msg1147302.html Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260108190214.1667040-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit cac2c363c41c12ec9ea1caefdf90f99607a531aa Merge: 7470a7a63dc162 a0c159647e6627 Author: Jakub Kicinski Date: Sat Jan 10 11:13:03 2026 -0800 Merge branch 'virtio-net-fix-the-deadlock-when-disabling-rx-napi' Bui Quang Minh says: ==================== virtio-net: fix the deadlock when disabling rx NAPI Calling napi_disable() on an already disabled napi can cause the deadlock. In commit 4bc12818b363 ("virtio-net: disable delayed refill when pausing rx"), to avoid the deadlock, when pausing the RX in virtnet_rx_pause[_all](), we disable and cancel the delayed refill work. However, in the virtnet_rx_resume_all(), we enable the delayed refill work too early before enabling all the receive queue napis. The deadlock can be reproduced by running selftests/drivers/net/hw/xsk_reconfig.py with multiqueue virtio-net device and inserting a cond_resched() inside the for loop in virtnet_rx_resume_all() to increase the success rate. Because the worker processing the delayed refilled work runs on the same CPU as virtnet_rx_resume_all(), a reschedule is needed to cause the deadlock. In real scenario, the contention on netdev_lock can cause the reschedule. Due to the complexity of delayed refill worker, in this series, we remove it. When we fail to refill the receive buffer, we will retry in the next NAPI poll instead. - Patch 1: removes delayed refill worker schedule and retry refill in next NAPI - Patch 2, 3: removes and clean up unused delayed refill worker code For testing, I've run the following tests with no issue so far - selftests/drivers/net/hw/xsk_reconfig.py which sets up the XDP zerocopy without providing any descriptors to the fill ring. As a result, try_fill_recv will always fail. - Send TCP packets from host to guest while guest is nearly OOM and some try_fill_recv calls fail. v2: https://lore.kernel.org/20260102152023.10773-1-minhquangbui99@gmail.com v1: https://lore.kernel.org/20251223152533.24364-1-minhquangbui99@gmail.com Link to the previous approach and discussion: https://lore.kernel.org/20251212152741.11656-1-minhquangbui99@gmail.com ==================== Link: https://patch.msgid.link/20260106150438.7425-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit a0c159647e6627496a85e57ca81f8cd6c685564b Author: Bui Quang Minh Date: Tue Jan 6 22:04:38 2026 +0700 virtio-net: clean up __virtnet_rx_pause/resume The delayed refill worker is removed which makes virtnet_rx_pause/resume quite the same as __virtnet_rx_pause/resume. So remove __virtnet_rx_pause/resume and move the code to virtnet_rx_pause/resume. Acked-by: Michael S. Tsirkin Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20260106150438.7425-4-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit 1e7b90aa7988d90518fa01c398b3487e1fdcb19b Author: Bui Quang Minh Date: Tue Jan 6 22:04:37 2026 +0700 virtio-net: remove unused delayed refill worker Since we switched to retry refilling receive buffer in NAPI poll instead of delayed worker, remove all now unused delayed refill worker code. Acked-by: Michael S. Tsirkin Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20260106150438.7425-3-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit fcdef3bcbb2c04e06ae89f8faff2cd6416b3a467 Author: Bui Quang Minh Date: Tue Jan 6 22:04:36 2026 +0700 virtio-net: don't schedule delayed refill worker When we fail to refill the receive buffers, we schedule a delayed worker to retry later. However, this worker creates some concurrency issues. For example, when the worker runs concurrently with virtnet_xdp_set, both need to temporarily disable queue's NAPI before enabling again. Without proper synchronization, a deadlock can happen when napi_disable() is called on an already disabled NAPI. That napi_disable() call will be stuck and so will the subsequent napi_enable() call. To simplify the logic and avoid further problems, we will instead retry refilling in the next NAPI poll. Fixes: 4bc12818b363 ("virtio-net: disable delayed refill when pausing rx") Reported-by: Paolo Abeni Closes: https://lore.kernel.org/526b5396-459d-4d02-8635-a222d07b46d7@redhat.com Cc: stable@vger.kernel.org Suggested-by: Xuan Zhuo Signed-off-by: Bui Quang Minh Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260106150438.7425-2-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit ca22c566b89164f6e670af56ecc45f47ef3df819 Author: Caleb Sander Mateos Date: Thu Jan 8 10:22:10 2026 -0700 block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise the uninitialized memory can be read back by userspace or anyone with physical access to the storage device. If protection information is generated, that portion of the integrity buffer is already initialized. The integrity data is also zeroed if PI generation is disabled via sysfs or the PI tuple size is 0. However, this misses the case where PI is generated and the PI tuple size is nonzero, but the metadata size is larger than the PI tuple. In this case, the remainder ("opaque") of the metadata is left uninitialized. Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the metadata is larger than just the PI tuple. Signed-off-by: Caleb Sander Mateos Fixes: c546d6f43833 ("block: only zero non-PI metadata tuples in bio_integrity_prep") Reviewed-by: Anuj Gupta Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 97313d6113ab4362ad15076f65560e65288fbcb8 Merge: 7893cc12251f6f 6a3d5fda2ce464 Author: Linus Torvalds Date: Sat Jan 10 07:14:40 2026 -1000 Merge tag 'iommu-fixes-v6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iomu fixes from Joerg Roedel: - several Kconfig-related build fixes - fix for when gcc 8.5 on PPC refuses to inline a function from a header file * tag 'iommu-fixes-v6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommupt: Make pt_feature() always_inline iommufd/selftest: Prevent module/builtin conflicts in kconfig iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER iommupt: Fix the kunit building commit 7893cc12251f6f19e7689a4cf3ba803bddbd8437 Author: Gao Xiang Date: Sat Jan 10 19:47:03 2026 +0800 erofs: fix file-backed mounts no longer working on EROFS partitions Sheng Yong reported [1] that Android APEX images didn't work with commit 072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for now") because "EROFS-formatted APEX file images can be stored within an EROFS-formatted Android system partition." In response, I sent a quick fat-fingered [PATCH v3] to address the report. Unfortunately, the updated condition was incorrect: if (erofs_is_fileio_mode(sbi)) { - sb->s_stack_depth = - file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1; - if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) { - erofs_err(sb, "maximum fs stacking depth exceeded"); + inode = file_inode(sbi->dif0.file); + if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) || + inode->i_sb->s_stack_depth) { The condition `!sb->s_bdev` is always true for all file-backed EROFS mounts, making the check effectively a no-op. The real fix tested and confirmed by Sheng Yong [2] at that time was [PATCH v3 RESEND], which correctly ensures the following EROFS^2 setup works: EROFS (on a block device) + EROFS (file-backed mount) But sadly I screwed it up again by upstreaming the outdated [PATCH v3]. This patch applies the same logic as the delta between the upstream [PATCH v3] and the real fix [PATCH v3 RESEND]. Reported-by: Sheng Yong Closes: https://lore.kernel.org/r/3acec686-4020-4609-aee4-5dae7b9b0093@gmail.com [1] Fixes: 072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for now") Link: https://lore.kernel.org/r/243f57b8-246f-47e7-9fb1-27a771e8e9e8@gmail.com [2] Signed-off-by: Gao Xiang Signed-off-by: Linus Torvalds commit 19cffd16ed6489770272ba383ff3aaec077e01ed Author: Will Deacon Date: Mon Jan 5 15:49:09 2026 +0000 KVM: arm64: Invert KVM_PGTABLE_WALK_HANDLE_FAULT to fix pKVM walkers Commit ddcadb297ce5 ("KVM: arm64: Ignore EAGAIN for walks outside of a fault") introduced a new walker flag ('KVM_PGTABLE_WALK_HANDLE_FAULT') to KVM's page-table code. When set, the walk logic maintains its previous behaviour of terminating a walk as soon as the visitor callback returns an error. However, when the flag is clear, the walk will continue if the visitor returns -EAGAIN and the error is then suppressed and returned as zero to the caller. Clearing the flag is beneficial when write-protecting a range of IPAs with kvm_pgtable_stage2_wrprotect() but is not useful in any other cases, either because we are operating on a single page (e.g. kvm_pgtable_stage2_mkyoung() or kvm_phys_addr_ioremap()) or because the early termination is desirable (e.g. when mapping pages from a fault in user_mem_abort()). Subsequently, commit e912efed485a ("KVM: arm64: Introduce the EL1 pKVM MMU") hooked up pKVM's hypercall interface to the MMU code at EL1 but failed to propagate any of the walker flags. As a result, page-table walks at EL2 fail to set KVM_PGTABLE_WALK_HANDLE_FAULT even when the early termination semantics are desirable on the fault handling path. Rather than complicate the pKVM hypercall interface, invert the flag so that the whole thing can be simplified and only pass the new flag ('KVM_PGTABLE_WALK_IGNORE_EAGAIN') from the wrprotect code. Cc: Fuad Tabba Cc: Quentin Perret Cc: Marc Zyngier Cc: Oliver Upton Reviewed-by: Marc Zyngier Fixes: fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") Signed-off-by: Will Deacon Reviewed-by: Quentin Perret Link: https://msgid.link/20260105154939.11041-2-will@kernel.org Signed-off-by: Oliver Upton commit 6a3d5fda2ce464a80a9af9e358dfbab6a989ab5d Author: Jason Gunthorpe Date: Fri Jan 9 10:29:52 2026 -0400 iommupt: Make pt_feature() always_inline gcc 8.5 on powerpc does not automatically inline these functions even though they evaluate to constants in key cases. Since the constant propagation is essential for some code elimination and built-time checks this causes a build failure: ERROR: modpost: "__pt_no_sw_bit" [drivers/iommu/generic_pt/fmt/iommu_amdv1.ko] undefined! Caused by this: if (pts_feature(&pts, PT_FEAT_DMA_INCOHERENT) && !pt_test_sw_bit_acquire(&pts, SW_BIT_CACHE_FLUSH_DONE)) flush_writes_item(&pts); Where pts_feature() evaluates to a constant false. Mark them as __always_inline to force it to evaluate to a constant and trigger the code elimination. Fixes: 7c5b184db714 ("genpt: Generic Page Table base API") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512230720.9y9DtWIo-lkp@intel.com/ Signed-off-by: Jason Gunthorpe commit 7adfd682745a41fdf0279e4457d11fffab145a8f Author: Jason Gunthorpe Date: Tue Jan 6 15:22:12 2026 -0400 iommufd/selftest: Prevent module/builtin conflicts in kconfig The selftest now depends on the AMDv1 page table, however the selftest kconfig itself is just an sub-option of the main IOMMUFD module kconfig. This means it cannot be modular and so kconfig allowed a modular IOMMU_PT_AMDV1 with a built in IOMMUFD. This causes link failures: ld: vmlinux.o: in function `mock_domain_alloc_pgtable.isra.0': selftest.c:(.text+0x12e8ad3): undefined reference to `pt_iommu_amdv1_init' ld: vmlinux.o: in function `BSWAP_SHUFB_CTL': sha1-avx2-asm.o:(.rodata+0xaa36a8): undefined reference to `pt_iommu_amdv1_read_and_clear_dirty' ld: sha1-avx2-asm.o:(.rodata+0xaa36f0): undefined reference to `pt_iommu_amdv1_map_pages' ld: sha1-avx2-asm.o:(.rodata+0xaa36f8): undefined reference to `pt_iommu_amdv1_unmap_pages' ld: sha1-avx2-asm.o:(.rodata+0xaa3720): undefined reference to `pt_iommu_amdv1_iova_to_phys' Adjust the kconfig to disable IOMMUFD_TEST if IOMMU_PT_AMDV1 is incompatible. Fixes: e93d5945ed5b ("iommufd: Change the selftest to use iommupt instead of xarray") Suggested-by: Arnd Bergmann Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512210135.freQWpxa-lkp@intel.com/ Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit faa37ff3bf18d5242fe3d54f5462b1c3254c2567 Author: Jason Gunthorpe Date: Tue Jan 6 15:22:11 2026 -0400 iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER The test doesn't build without it, dma-buf.h does not provide stub functions if it is not enabled. Compilation can fail with: ERROR:root:ld: vmlinux.o: in function `iommufd_test': (.text+0x3b1cdd): undefined reference to `dma_buf_get' ld: (.text+0x3b1d08): undefined reference to `dma_buf_put' ld: (.text+0x3b2105): undefined reference to `dma_buf_export' ld: (.text+0x3b211f): undefined reference to `dma_buf_fd' ld: (.text+0x3b2e47): undefined reference to `dma_buf_move_notify' Add the missing select. Fixes: d2041f1f11dd ("iommufd/selftest: Add some tests for the dmabuf flow") Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit cefd81e76a8c0dc4aa2bacd884acca44e7b61e5b Author: Jason Gunthorpe Date: Tue Jan 6 15:22:10 2026 -0400 iommupt: Fix the kunit building The kunit doesn't work since the below commit made GENERIC_PT unselectable: $ make ARCH=x86_64 O=build_kunit_x86_64 olddefconfig ERROR:root:Not all Kconfig options selected in kunitconfig were in the generated .config. This is probably due to unsatisfied dependencies. Missing: CONFIG_DEBUG_GENERIC_PT=y, CONFIG_IOMMUFD_TEST=y, CONFIG_IOMMU_PT_X86_64=y, CONFIG_GENERIC_PT=y, CONFIG_IOMMU_PT_AMDV1=y, CONFIG_IOMMU_PT_VTDSS=y, CONFIG_IOMMU_PT=y, CONFIG_IOMMU_PT_KUNIT_TEST=y Also remove the unneeded CONFIG_IOMMUFD_TEST reference as the iommupt kunit doesn't interact with iommufd, and it doesn't currently build for the kunit due problems with DMA_SHARED buffer either. Fixes: 01569c216dde ("genpt: Make GENERIC_PT invisible") Fixes: 1dd4187f53c3 ("iommupt: Add a kunit test for Generic Page Table") Signed-off-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Signed-off-by: Joerg Roedel commit 3611ca7c12b740e250d83f8bbe3554b740c503b0 Author: Sean Christopherson Date: Mon Dec 29 12:23:30 2025 -0800 selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 Rework the AMX test's #NM handling to use kvm_asm_safe() to verify an #NM actually occurs. As is, a completely missing #NM could go unnoticed. Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini commit 0383a8edef396cf0a6884b0be81d62bde60737b0 Author: Paolo Bonzini Date: Wed Dec 31 16:47:26 2025 +0100 selftests: kvm: try getting XFD and XSAVE state out of sync The host is allowed to set FPU state that includes a disabled xstate component. Check that this does not cause bad effects. Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit a1025dcd377ef92d9a09af03b70ce80be281ee22 Author: Paolo Bonzini Date: Wed Dec 24 00:44:49 2025 +0100 selftests: kvm: replace numbered sync points with actions Rework the guest=>host syncs in the AMX test to use named actions instead of arbitrary, incrementing numbers. The "stage" of the test has no real meaning, what matters is what action the test wants the host to perform. The incrementing numbers are somewhat helpful for triaging failures, but fully debugging failures almost always requires a much deeper dive into the test (and KVM). Using named actions not only makes it easier to extend the test without having to shift all sync point numbers, it makes the code easier to read. [Commit message by Sean Christopherson] Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit b45f721775947a84996deb5c661602254ce25ce6 Author: Sean Christopherson Date: Wed Dec 31 16:43:15 2025 +0100 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled features in the saved (or to be restored) XSTATE_BV to ensure KVM doesn't attempt to load state for features that are disabled via the guest's XFD. Because the kernel executes XRSTOR with the guest's XFD, saving XSTATE_BV[i]=1 with XFD[i]=1 will cause XRSTOR to #NM and panic the kernel. E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV: ------------[ cut here ]------------ WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848 Modules linked in: kvm_intel kvm irqbypass CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:exc_device_not_available+0x101/0x110 Call Trace: asm_exc_device_not_available+0x1a/0x20 RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90 switch_fpu_return+0x4a/0xb0 kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm] kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm] __x64_sys_ioctl+0x8f/0xd0 do_syscall_64+0x62/0x940 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]--- This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1, and a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler's call to fpu_update_guest_xfd(). and if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE: ------------[ cut here ]------------ WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867 Modules linked in: kvm_intel kvm irqbypass CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:exc_device_not_available+0x101/0x110 Call Trace: asm_exc_device_not_available+0x1a/0x20 RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90 fpu_swap_kvm_fpstate+0x6b/0x120 kvm_load_guest_fpu+0x30/0x80 [kvm] kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm] kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm] __x64_sys_ioctl+0x8f/0xd0 do_syscall_64+0x62/0x940 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ---[ end trace 0000000000000000 ]--- The new behavior is consistent with the AMX architecture. Per Intel's SDM, XSAVE saves XSTATE_BV as '0' for components that are disabled via XFD (and non-compacted XSAVE saves the initial configuration of the state component): If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i, the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1; instead, it operates as if XINUSE[i] = 0 (and the state component was in its initial state): it saves bit i of XSTATE_BV field of the XSAVE header as 0; in addition, XSAVE saves the initial configuration of the state component (the other instructions do not save state component i). Alternatively, KVM could always do XRSTOR with XFD=0, e.g. by using a constant XFD based on the set of enabled features when XSAVEing for a struct fpu_guest. However, having XSTATE_BV[i]=1 for XFD-disabled features can only happen in the above interrupt case, or in similar scenarios involving preemption on preemptible kernels, because fpu_swap_kvm_fpstate()'s call to save_fpregs_to_fpstate() saves the outgoing FPU state with the current XFD; and that is (on all but the first WRMSR to XFD) the guest XFD. Therefore, XFD can only go out of sync with XSTATE_BV in the above interrupt case, or in similar scenarios involving preemption on preemptible kernels, and it we can consider it (de facto) part of KVM ABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features. Reported-by: Paolo Bonzini Cc: stable@vger.kernel.org Fixes: 820a6ee944e7 ("kvm: x86: Add emulation for IA32_XFD", 2022-01-14) Signed-off-by: Sean Christopherson [Move clearing of XSTATE_BV from fpu_copy_uabi_to_guest_fpstate to kvm_vcpu_ioctl_x86_set_xsave. - Paolo] Reviewed-by: Binbin Wu Signed-off-by: Paolo Bonzini commit b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba Merge: cb2076b0910f3b 072a7c7cdbea4f Author: Linus Torvalds Date: Fri Jan 9 19:34:50 2026 -1000 Merge tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fix from Gao Xiang: - Don't increase s_stack_depth which caused regressions in some composefs mount setups (EROFS + ovl^2) Instead just allow one extra unaccounted fs stacking level for straightforward cases. * tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: don't bother with s_stack_depth increasing for now commit 072a7c7cdbea4f91df854ee2bb216256cd619f2a Author: Gao Xiang Date: Thu Jan 8 10:38:31 2026 +0800 erofs: don't bother with s_stack_depth increasing for now Previously, commit d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts") bumped `s_stack_depth` by one to avoid kernel stack overflow when stacking an unlimited number of EROFS on top of each other. This fix breaks composefs mounts, which need EROFS+ovl^2 sometimes (and such setups are already used in production for quite a long time). One way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH from 2 to 3, but proving that this is safe in general is a high bar. After a long discussion on GitHub issues [1] about possible solutions, one conclusion is that there is no need to support nesting file-backed EROFS mounts on stacked filesystems, because there is always the option to use loopback devices as a fallback. As a quick fix for the composefs regression for this cycle, instead of bumping `s_stack_depth` for file backed EROFS mounts, we disallow nesting file-backed EROFS over EROFS and over filesystems with `s_stack_depth` > 0. This works for all known file-backed mount use cases (composefs, containerd, and Android APEX for some Android vendors), and the fix is self-contained. Essentially, we are allowing one extra unaccounted fs stacking level of EROFS below stacking filesystems, but EROFS can only be used in the read path (i.e. overlayfs lower layers), which typically has much lower stack usage than the write path. We can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more stack usage analysis or using alternative approaches, such as splitting the `s_stack_depth` limitation according to different combinations of stacking. Fixes: d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts") Reported-and-tested-by: Dusty Mabe Reported-by: Timothée Ravier Closes: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1] Reported-by: "Alekséi Naidénov" Closes: https://lore.kernel.org/r/CAFHtUiYv4+=+JP_-JjARWjo6OwcvBj1wtYN=z0QXwCpec9sXtg@mail.gmail.com Acked-by: Amir Goldstein Acked-by: Alexander Larsson Reviewed-and-tested-by: Sheng Yong Reviewed-by: Zhiguo Niu Reviewed-by: Chao Yu Cc: Christian Brauner Cc: Miklos Szeredi Signed-off-by: Gao Xiang commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e Author: Eric Dumazet Date: Thu Jan 8 13:36:51 2026 +0000 macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). Fixes: 79cf79abce71 ("macvlan: add source mode") Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit eb74c19fe10872ee1f29a8f90ca5ce943921afe9 Author: Eric Dumazet Date: Thu Jan 8 09:32:44 2026 +0000 net: update netdev_lock_{type,name} Add missing entries in netdev_lock_type[] and netdev_lock_name[] : CAN, MCTP, RAWIP, CAIF, IP6GRE, 6LOWPAN, NETLINK, VSOCKMON, IEEE802154_MONITOR. Also add a WARN_ONCE() in netdev_lock_pos() to help future bug hunting next time a protocol is added without updating these arrays. Fixes: 1a33e10e4a95 ("net: partially revert dynamic lockdep key changes") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260108093244.830280-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 81c734dae203757fb3c9eee6f9896386940776bd Author: Eric Dumazet Date: Wed Jan 7 16:31:09 2026 +0000 ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Fixes: 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") Reported-by: syzbot+d4dda070f833dc5dc89a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695e88b2.050a0220.1c677c.036d.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260107163109.4188620-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit cb2076b0910f3b19036ec7d50530113fcb9736c8 Merge: 68ad2095ca0f42 f0d385f6689f37 Author: Linus Torvalds Date: Fri Jan 9 15:42:46 2026 -1000 Merge tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Kill unlikely checks for blk-rq-qos. These checks are really all-or-nothing, either the branch is taken all the time, or it's not. Depending on the configuration, either one of those cases may be true. Just remove the annotation - Fix for merging bios with different app tags set - Fix for a recently introduced slowdown due to RCU synchronization - Fix for a status change on loop while it's in use, and then a later fix for that fix - Fix for the async partition scanning in ublk * tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: ublk: fix use-after-free in ublk_partition_scan_work blk-mq: avoid stall during boot due to synchronize_rcu_expedited loop: add missing bd_abort_claiming in loop_set_status block: don't merge bios with different app_tags blk-rq-qos: Remove unlikely() hints from QoS checks loop: don't change loop device under exclusive opener in loop_set_status commit b25a0b4a2193407aa72a4cd1df66a7ed07dd4f1e Author: Eric Dumazet Date: Thu Jan 8 09:38:06 2026 +0000 net: bridge: annotate data-races around fdb->{updated,used} fdb->updated and fdb->used are read and written locklessly. Add READ_ONCE()/WRITE_ONCE() annotations. Fixes: 31cbc39b6344 ("net: bridge: add option to allow activity notifications for any fdb entries") Reported-by: syzbot+bfab43087ad57222ce96@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695e3d74.050a0220.1c677c.035f.GAE@google.com/ Signed-off-by: Eric Dumazet Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260108093806.834459-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 68ad2095ca0f42a92d16d8cd1df0fb4f4bff634a Merge: e28ddd0b7af218 e4fdbca2dc7743 Author: Linus Torvalds Date: Fri Jan 9 15:21:15 2026 -1000 Merge tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: "A single fix for a regression introduced in 6.15, where a failure to wake up idle io-wq workers at ring exit will wait for the timeout to expire. This isn't normally noticeable, as the exit is async. But if a parent task created a thread that sets up a ring and uses requests that cause io-wq threads to be created, and the parent task then waits for the thread to exit, then it can take 5 seconds for that pthread_join() to succeed as the child thread is waiting for its children to exit. On top of that, just a basic cleanup as well" * tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/io-wq: remove io_wq_for_each_worker() return value io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic commit e28ddd0b7af218e1a8863c524e15918895af9ac8 Merge: e55feea3a03aa1 bdf3f4176092df Author: Linus Torvalds Date: Fri Jan 9 15:17:48 2026 -1000 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Do not return false if !preemptible() in current_in_efi(). EFI runtime services can now run with preemption enabled - Fix uninitialised variable in the arm MPAM driver, reported by sparse - Fix partial kasan_reset_tag() use in change_memory_common() when calculating page indices or comparing ranges - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit is lost * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Fix cleared E0POE bit after cpu_suspend()/resume() arm64: mm: Fix incomplete tag reset in change_memory_common() arm_mpam: Stop using uninitialized variables in __ris_msmon_read() arm64/efi: Don't fail check current_in_efi() if preemptible commit e55feea3a03aa1eaf5abb22cc854208813865e04 Merge: 4621c338d33f2e bf104037ebd5c1 Author: Linus Torvalds Date: Fri Jan 9 15:11:45 2026 -1000 Merge tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The main code change is a revert of the Raspberry Pi RP1 overlay support that was decided to not be ready. The other fixes are all for devicetree sources: - ethernet configuration on ixp42x-actiontec-mi424wr is board revision specific - validation warning fixes for imx27/imx51/imx6, hikey960 and k3 - Minor corrections across imx8 boards, addressing all types of issues with interrups, dma, ethernet and clock settings, all simple one-line changes" * tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits) arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties Documentation/process: maintainer-soc: Mark 'make' as commands Documentation/process: maintainer-soc: Be more explicit about defconfig arm64: dts: mba8mx: Fix Ethernet PHY IRQ support arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells arm64: dts: freescale: moduline-display: fix compatible dt-bindings: arm: fsl: moduline-display: fix compatible ARM: dts: imx6q-ba16: fix RTC interrupt level arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt arm64: dts: add off-on-delay-us for usdhc2 regulator arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level ARM: dts: nxp: imx: Fix mc13xxx LED node names arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP MAINTAINERS: Fix a linusw mail address arm64: dts: broadcom: rp1: drop RP1 overlay arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology misc: rp1: drop overlay support ... commit 4621c338d33f2e49c55d317fa5b1fbc0ae1cccb7 Merge: 372800cb95a35a c0fe2994f9a9d0 Author: Linus Torvalds Date: Fri Jan 9 15:05:19 2026 -1000 Merge tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A bunch of libceph fixes split evenly between memory safety and implementation correctness issues (all marked for stable) and a change in maintainers for CephFS: Slava and Alex have formally taken over Xiubo's role" * tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client: libceph: make calc_target() set t->paused, not just clear it libceph: reset sparse-read state in osd_fault() libceph: return the handler error from mon_handle_auth_done() libceph: make free_choose_arg_map() resilient to partial allocation ceph: update co-maintainers list in MAINTAINERS libceph: replace overzealous BUG_ON in osdmap_apply_incremental() libceph: prevent potential out-of-bounds reads in handle_auth_done() commit 49d106347913201b6bc6d810c964b90781db8343 Author: Alison Schofield Date: Fri Jan 9 11:49:44 2026 -0800 cxl/acpi: Restore HBIW check before dereferencing platform_data Commit 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing") split xormap handling code to create a reusable helper function but inadvertently dropped the check of HBIW values before dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps are needed and platform_data may be NULL, leading to a potential NULL pointer dereference. Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3, when performing DPA->HPA address translation for CXL events. Those events would be any of poison ops, general media, or dram. Restore the early return check for HBIW values of 1 and 3 before dereferencing platform_data. Fixes: 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing") Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260109194946.431083-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit 86364832ba6f2777db98391060b2d7f69938ad9b Author: Marc Zyngier Date: Wed Jan 7 12:46:00 2026 +0000 KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit We set PSTATE.PAN to 1 on exiting from a guest if PAN support has been compiled in and that it exists on the HW. However, this is not necessarily correct. In a nVHE configuration, there is no notion of PAN at EL2, so setting PSTATE.PAN to anything is pointless. Furthermore, not setting PAN to 0 when CONFIG_ARM64_PAN isn't set means we run with the *guest's* PSTATE.PAN (which might be set to 1), and we will explode on the next userspace access. Yes, the architecture is delightful in that particular corner. Fix the whole thing by always setting PAN to something when running VHE (which implies PAN support), and only ignore it when running nVHE. Reported-by: Mark Rutland Signed-off-by: Marc Zyngier Link: https://msgid.link/20260107124600.2736328-1-maz@kernel.org Signed-off-by: Oliver Upton commit 9e27085c33cca7ad26bec0af2c17aab072dd802e Author: Oliver Upton Date: Thu Jan 8 12:42:30 2026 -0800 KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF Naturally, updating the Access Flag in a stage-1 descriptor requires write permission at stage-2, although this isn't actually enforced in KVM's software PTW. Generate a stage-2 permission fault if the stage-1 walk attempts to update the descriptor and its corresponding stage-2 translation lacks write permission. Fixes: bff8aa213dee ("KVM: arm64: Implement HW access flag management in stage-1 SW PTW") Reviewed-by: Marc Zyngier Link: https://msgid.link/20260108204230.677172-1-oupton@kernel.org Signed-off-by: Oliver Upton commit 9cb2c20f06c300f92a831e4c374e353b33c5582b Author: Dongxu Sun Date: Fri Jan 9 16:02:26 2026 +0800 KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps() Function vcpu_{clear,set}_wfx_traps() are unused since commit 0b5afe05377d7 ("KVM: arm64: Add early_param to control WFx trapping"). Remove it. Reviewed-by: Zenghui Yu Signed-off-by: Dongxu Sun Link: https://msgid.link/20260109080226.761107-1-sundongxu1024@163.com Signed-off-by: Oliver Upton commit 6e39903c73df08b256322d04c4dfe4a82ec63a45 Author: Fushuai Wang Date: Fri Jan 9 11:36:20 2026 +0800 selftests/tracing: Fix test_multiple_writes stall When /sys/kernel/tracing/buffer_size_kb is less than 12KB, the test_multiple_writes test will stall and wait for more input due to insufficient buffer space. Check current buffer_size_kb value before the test. If it is less than 12KB, it temporarily increase the buffer to 12KB, and restore the original value after the tests are completed. Link: https://lore.kernel.org/r/20260109033620.25727-1-fushuai.wang@linux.dev Fixes: 37f46601383a ("selftests/tracing: Add basic test for trace_marker_raw file") Suggested-by: Steven Rostedt Signed-off-by: Fushuai Wang Acked-by: Steven Rostedt (Google) Signed-off-by: Shuah Khan commit ab749bfe6a1fc233213f2d00facea5233139d509 Author: Yang Li Date: Fri Dec 19 10:43:09 2025 +0800 Bluetooth: hci_sync: enable PA Sync Lost event Enable the PA Sync Lost event mask to ensure PA sync loss is properly reported and handled. Fixes: 485e0626e587 ("Bluetooth: hci_event: Fix not handling PA Sync Lost event") Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 380ff27af25e49e2cb2ff8fd0ecd7c95be2976ee Author: Changwoo Min Date: Thu Jan 8 14:32:12 2026 +0900 PM: EM: Add dump to get-perf-domains in the EM YNL spec Add dump to get-perf-domains, so that a user can fetch either information about a specific performance domain with do or information about all performance domains with dump. Share the reply format of do and dump using perf-domain-attrs, so remove perf-domains. The YNL spec, autogenerated files, and the do implementation are updated, and the dump implementation is added. Suggested-by: Donald Hunter Reviewed-by: Lukasz Luba Reviewed-by: Donald Hunter Signed-off-by: Changwoo Min Link: https://patch.msgid.link/20260108053212.642478-5-changwoo@igalia.com Signed-off-by: Rafael J. Wysocki commit d29b900cf412c31f18bab67d04db619f64acb43d Author: Changwoo Min Date: Thu Jan 8 14:32:11 2026 +0900 PM: EM: Change cpus' type from string to u64 array in the EM YNL spec Previously, the cpus attribute was a string format which was a "%*pb" stringification of a bitmap. That is not very consumable for a UAPI, so let’s change it to an u64 array of CPU ids. Suggested-by: Donald Hunter Reviewed-by: Lukasz Luba Reviewed-by: Donald Hunter Signed-off-by: Changwoo Min Link: https://patch.msgid.link/20260108053212.642478-4-changwoo@igalia.com Signed-off-by: Rafael J. Wysocki commit caa07a815d6ee32586beb66f67e7e3c103a02efd Author: Changwoo Min Date: Thu Jan 8 14:32:10 2026 +0900 PM: EM: Rename em.yaml to dev-energymodel.yaml The EM YNL specification used many acronyms, including ‘em’, ‘pd’, ‘ps’, etc. While the acronyms are short and convenient, they could be confusing. So, let’s spell them out to be more specific. The following changes were made in the spec. Note that the protocol name cannot exceed GENL_NAMSIZ (16). em -> dev-energymodel pds -> perf-domains pd -> perf-domain pd-id -> perf-domain-id pd-table -> perf-table ps -> perf-state get-pds -> get-perf-domains get-pd-table -> get-perf-table pd-created -> perf-domain-created pd-updated -> perf-domain-updated pd-deleted -> perf-domain-deleted In addition. doc strings were added to the spec. based on the comments in energy_model.h. Two flag attributes (perf-state-flags and perf-domain-flags) were added for easily interpreting the bit flags. Finally, the autogenerated files and em_netlink.c were updated accordingly to reflect the name changes. Suggested-by: Donald Hunter Reviewed-by: Lukasz Luba Reviewed-by: Donald Hunter Signed-off-by: Changwoo Min Link: https://patch.msgid.link/20260108053212.642478-3-changwoo@igalia.com Signed-off-by: Rafael J. Wysocki commit ebabc32ddb84caf2c018ae6aeca2ca2989a8056b Author: Changwoo Min Date: Thu Jan 8 14:32:09 2026 +0900 PM: EM: Fix yamllint warnings in the EM YNL spec The energy model YNL spec has the following two warnings when checking with yamlint: 3:1 warning missing document start "---" (document-start) 107:13 error wrong indentation: expected 10 but found 12 (indentation) So let’s fix whose lint warnings. Fixes: bd26631ccdfd ("PM: EM: Add em.yaml and autogen files") Suggested-by: Donald Hunter Reviewed-by: Lukasz Luba Reviewed-by: Donald Hunter Signed-off-by: Changwoo Min Link: https://patch.msgid.link/20260108053212.642478-2-changwoo@igalia.com Signed-off-by: Rafael J. Wysocki commit 56e7cc8dadf91cd2164e5d6dac9258f448d50182 Author: Rob Herring (Arm) Date: Thu Jan 8 17:06:07 2026 -0600 arm64: dts: rockchip: Drop unsupported properties "pinctrl-names" is not valid without a pinctrl-N property. "max-freq" is not a defined property name. Maybe it was supposed to be "spi-max-frequency", but changing to that would be a change in behavior. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260108230607.1348879-1-robh@kernel.org Signed-off-by: Heiko Stuebner commit 5fc045974cdeafd16b25f2c360b0cf48502dd1c5 Author: Rob Herring (Arm) Date: Thu Jan 8 17:06:23 2026 -0600 arm64: dts: rockchip: Fix gpio pinctrl node names The pinctrl node names "gpios" or with "-gpio" suffix collide with GPIO property names creating false warnings. Add a "-pins?" suffix to avoid the issue. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260108230623.1349310-1-robh@kernel.org Signed-off-by: Heiko Stuebner commit f45385c511141683379a6e090fe74c6002337b5e Author: Rob Herring (Arm) Date: Thu Jan 8 17:06:13 2026 -0600 arm64: dts: rockchip: Fix pinctrl property typo on rk3326-odroid-go3 "pinctrl" is not a defined property name. The correct name is "pinctrl-0". Signed-off-by: Rob Herring (Arm) [added missing pinctrl-names property] Link: https://patch.msgid.link/20260108230613.1349060-1-robh@kernel.org Signed-off-by: Heiko Stuebner commit 3ea9fe578d1d2c1fb88410f53e378561d1531e45 Author: Rob Herring (Arm) Date: Thu Jan 8 17:05:59 2026 -0600 arm64: dts: rockchip: Drop "sitronix,st7789v" fallback compatible from rk3568-wolfvision "sitronix,st7789v" is not a defined fallback for "jasonic,jt240mhqs-hwt-ek-e3", so drop it. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260108230600.1348699-1-robh@kernel.org Signed-off-by: Heiko Stuebner commit a8f49a0043011c3dd12998a6c700bb59d5365c20 Author: Chia-Lin Kao (AceLan) Date: Thu Dec 4 10:46:47 2025 +0800 drm/dp: Add byte-by-byte fallback for broken USB-C adapters Some USB-C hubs and adapters have buggy firmware where multi-byte AUX reads consistently timeout, while single-byte reads from the same address work correctly. Known affected devices that exhibit this issue: - Lenovo USB-C to VGA adapter (VIA VL817 chipset) idVendor=17ef, idProduct=7217 - Dell DA310 USB-C mobile adapter hub idVendor=413c, idProduct=c010 Analysis of the failure pattern shows: - Single-byte probes to 0xf0000 (LTTPR) succeed - Single-byte probes to 0x00102 (TRAINING_AUX_RD_INTERVAL) succeed - Multi-byte reads from 0x00000 (DPCD capabilities) timeout with -ETIMEDOUT - Retrying does not help - the failure is consistent across all attempts The issue appears to be a firmware bug in the AUX transaction handling that specifically affects multi-byte reads. Add a fallback mechanism in drm_dp_dpcd_read_data() that attempts byte-by-byte reading when the normal multi-byte read fails. This workaround only activates for adapters that fail the standard read path, ensuring no impact on correctly functioning hardware. Tested with: - Lenovo USB-C to VGA adapter (VIA VL817) - now works with fallback - Dell DA310 USB-C hub - now works with fallback - Dell/Analogix Slimport adapter - continues to work with normal path Signed-off-by: Chia-Lin Kao (AceLan) Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251204024647.1462866-1-acelan.kao@canonical.com Signed-off-by: Mario Limonciello (AMD) commit 372800cb95a35a7c40a07e2e0f7de4ce6786d230 Merge: 4d6fe1dd12a77c 2bb83bc42be628 Author: Linus Torvalds Date: Fri Jan 9 07:02:38 2026 -1000 Merge tag 'for-6.19-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix potential NULL pointer dereference when replaying tree log after an error - release path before initializing extent tree to avoid potential deadlock when allocating new inode - on filesystems with block size > page size - fix potential read out of bounds during encoded read of an inline extent - only enforce free space tree if v1 cache is required - print correct tree id in error message * tag 'for-6.19-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: show correct warning if can't read data reloc tree btrfs: fix NULL pointer dereference in do_abort_log_replay() btrfs: force free space tree for bs > ps cases btrfs: only enforce free space tree if v1 cache is required for bs < ps cases btrfs: release path before initializing extent tree in btrfs_read_locked_inode() btrfs: avoid access-beyond-folio for bs > ps encoded writes commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 Author: Qu Wenruo Date: Tue Jan 6 20:26:40 2026 +1030 btrfs: send: check for inline extents in range_is_hole_in_parent() Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent. This is because for inline extents their data starts at the offset of the disk_bytenr field. So accessing the disk_bytenr means we are accessing inline data or in case the inline data is less than 8 bytes we can actually cause an invalid memory access if this inline extent item is the first item in the leaf or access metadata from other items. Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d5fac7ddb38cd627a8fc2b87e5b588b48a803956 Author: Naohiro Aota Date: Mon Jan 5 17:19:05 2026 +0900 btrfs: tests: fix return 0 on rmap test failure In test_rmap_blocks(), we have ret = 0 before checking the results. We need to set it to -EINVAL, so that a mismatching result will return -EINVAL not 0. Reviewed-by: Qu Wenruo Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit be1c2e8afe3ac4a4f15a13f6844619c2cf47b1d1 Author: Zilin Guan Date: Fri Dec 26 11:30:22 2025 +0000 btrfs: tests: fix root tree leak in btrfs_test_qgroups() If btrfs_insert_fs_root() fails, the tmp_root allocated by btrfs_alloc_dummy_root() is leaked because its initial reference count is not decremented. Fix this by calling btrfs_put_root() unconditionally after btrfs_insert_fs_root(). This ensures the local reference is always dropped. Also fix a copy-paste error in the error message where the subvolume root insertion failure was incorrectly logged as "fs root". Co-developed-by: Jianhao Xu Signed-off-by: Jianhao Xu Signed-off-by: Zilin Guan Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1e1f2055ad5a7a5d548789b334a4473a7665c418 Author: Filipe Manana Date: Fri Dec 19 11:26:02 2025 +0000 btrfs: release path before iget_failed() in btrfs_read_locked_inode() In btrfs_read_locked_inode() if we fail to lookup the inode, we jump to the 'out' label with a path that has a read locked leaf and then we call iget_failed(). This can result in a ABBA deadlock, since iget_failed() triggers inode eviction and that causes the release of the delayed inode, which must lock the delayed inode's mutex, and a task updating a delayed inode starts by taking the node's mutex and then modifying the inode's subvolume btree. Syzbot reported the following lockdep splat for this: ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Not tainted ------------------------------------------------------ btrfs-cleaner/8725 is trying to acquire lock: ffff0000d6826a48 (&delayed_node->mutex){+.+.}-{4:4}, at: __btrfs_release_delayed_node+0xa0/0x9b0 fs/btrfs/delayed-inode.c:290 but task is already holding lock: ffff0000dbeba878 (btrfs-tree-00){++++}-{4:4}, at: btrfs_tree_read_lock_nested+0x44/0x2ec fs/btrfs/locking.c:145 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (btrfs-tree-00){++++}-{4:4}: __lock_release kernel/locking/lockdep.c:5574 [inline] lock_release+0x198/0x39c kernel/locking/lockdep.c:5889 up_read+0x24/0x3c kernel/locking/rwsem.c:1632 btrfs_tree_read_unlock+0xdc/0x298 fs/btrfs/locking.c:169 btrfs_tree_unlock_rw fs/btrfs/locking.h:218 [inline] btrfs_search_slot+0xa6c/0x223c fs/btrfs/ctree.c:2133 btrfs_lookup_inode+0xd8/0x38c fs/btrfs/inode-item.c:395 __btrfs_update_delayed_inode+0x124/0xed0 fs/btrfs/delayed-inode.c:1032 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1118 [inline] __btrfs_commit_inode_delayed_items+0x15f8/0x1748 fs/btrfs/delayed-inode.c:1141 __btrfs_run_delayed_items+0x1ac/0x514 fs/btrfs/delayed-inode.c:1176 btrfs_run_delayed_items_nr+0x28/0x38 fs/btrfs/delayed-inode.c:1219 flush_space+0x26c/0xb68 fs/btrfs/space-info.c:828 do_async_reclaim_metadata_space+0x110/0x364 fs/btrfs/space-info.c:1158 btrfs_async_reclaim_metadata_space+0x90/0xd8 fs/btrfs/space-info.c:1226 process_one_work+0x7e8/0x155c kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x958/0xed8 kernel/workqueue.c:3427 kthread+0x5fc/0x75c kernel/kthread.c:463 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 -> #0 (&delayed_node->mutex){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868 __mutex_lock_common+0x1d0/0x2678 kernel/locking/mutex.c:598 __mutex_lock kernel/locking/mutex.c:760 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:812 __btrfs_release_delayed_node+0xa0/0x9b0 fs/btrfs/delayed-inode.c:290 btrfs_release_delayed_node fs/btrfs/delayed-inode.c:315 [inline] btrfs_remove_delayed_node+0x68/0x84 fs/btrfs/delayed-inode.c:1326 btrfs_evict_inode+0x578/0xe28 fs/btrfs/inode.c:5587 evict+0x414/0x928 fs/inode.c:810 iput_final fs/inode.c:1914 [inline] iput+0x95c/0xad4 fs/inode.c:1966 iget_failed+0xec/0x134 fs/bad_inode.c:248 btrfs_read_locked_inode+0xe1c/0x1234 fs/btrfs/inode.c:4101 btrfs_iget+0x1b0/0x264 fs/btrfs/inode.c:5837 btrfs_run_defrag_inode fs/btrfs/defrag.c:237 [inline] btrfs_run_defrag_inodes+0x520/0xdc4 fs/btrfs/defrag.c:309 cleaner_kthread+0x21c/0x418 fs/btrfs/disk-io.c:1516 kthread+0x5fc/0x75c kernel/kthread.c:463 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(btrfs-tree-00); lock(&delayed_node->mutex); lock(btrfs-tree-00); lock(&delayed_node->mutex); *** DEADLOCK *** 1 lock held by btrfs-cleaner/8725: #0: ffff0000dbeba878 (btrfs-tree-00){++++}-{4:4}, at: btrfs_tree_read_lock_nested+0x44/0x2ec fs/btrfs/locking.c:145 stack backtrace: CPU: 0 UID: 0 PID: 8725 Comm: btrfs-cleaner Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_circular_bug+0x324/0x32c kernel/locking/lockdep.c:2043 check_noncircular+0x154/0x174 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868 __mutex_lock_common+0x1d0/0x2678 kernel/locking/mutex.c:598 __mutex_lock kernel/locking/mutex.c:760 [inline] mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:812 __btrfs_release_delayed_node+0xa0/0x9b0 fs/btrfs/delayed-inode.c:290 btrfs_release_delayed_node fs/btrfs/delayed-inode.c:315 [inline] btrfs_remove_delayed_node+0x68/0x84 fs/btrfs/delayed-inode.c:1326 btrfs_evict_inode+0x578/0xe28 fs/btrfs/inode.c:5587 evict+0x414/0x928 fs/inode.c:810 iput_final fs/inode.c:1914 [inline] iput+0x95c/0xad4 fs/inode.c:1966 iget_failed+0xec/0x134 fs/bad_inode.c:248 btrfs_read_locked_inode+0xe1c/0x1234 fs/btrfs/inode.c:4101 btrfs_iget+0x1b0/0x264 fs/btrfs/inode.c:5837 btrfs_run_defrag_inode fs/btrfs/defrag.c:237 [inline] btrfs_run_defrag_inodes+0x520/0xdc4 fs/btrfs/defrag.c:309 cleaner_kthread+0x21c/0x418 fs/btrfs/disk-io.c:1516 kthread+0x5fc/0x75c kernel/kthread.c:463 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 Fix this by releasing the path before calling iget_failed(). Reported-by: syzbot+c1c6edb02bea1da754d8@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/694530c2.a70a0220.207337.010d.GAE@google.com/ Fixes: 69673992b1ae ("btrfs: push cleanup into btrfs_read_locked_inode()") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 4d6fe1dd12a77c7774a3210f8450bdad2f84d879 Merge: 553410fcb95e3a bdb32359eab940 Author: Linus Torvalds Date: Fri Jan 9 06:41:10 2026 -1000 Merge tag 'pci-v6.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Remove ASPM L0s support for MSM8996 SoC since we now enable L0s when advertised, and it caused random hangs on this device (Manivannan Sadhasivam) - Fix meson-pcie to report that the link is up while in ASPM L0s or L1, since those are active states from the software point of view, and treating the link as down caused config access failures (Bjorn Helgaas) - Fix up sparc DTS BAR descriptions that are above 4GB but not marked as prefetchable, which caused resource assignment and driver probe failures after we converted from the SPARC pcibios_enable_device() to the generic version (Ilpo Järvinen) * tag 'pci-v6.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: sparc/PCI: Correct 64-bit non-pref -> pref BAR resources PCI: meson: Report that link is up while in ASPM L0s and L1 states PCI: qcom: Remove ASPM L0s support for MSM8996 SoC commit 3e8aaacdad4f66641f87ab441fe644b45f8ebdff Author: Robert Richter Date: Thu Jan 8 11:13:23 2026 +0100 cxl/port: Fix target list setup for multiple decoders sharing the same dport If a switch port has more than one decoder that is using the same downstream port, the enumeration of the target lists may fail with: # dmesg | grep target.list update_decoder_targets: cxl decoder1.0: dport3 found in target list, index 3 update_decoder_targets: cxl decoder1.0: dport2 found in target list, index 2 update_decoder_targets: cxl decoder1.0: dport0 found in target list, index 0 update_decoder_targets: cxl decoder2.0: dport3 found in target list, index 1 update_decoder_targets: cxl decoder4.0: dport3 found in target list, index 1 cxl_mem mem6: failed to find endpoint12:0000:00:01.4 in target list of decoder2.1 cxl_mem mem8: failed to find endpoint13:0000:20:01.4 in target list of decoder4.1 The case, that the same downstream port can be used in multiple target lists, is allowed and possible. Fix the update of the target list. Enumerate all children of the switch port and do not stop the iteration after the first matching target was found. With the fix applied: # dmesg | grep target.list update_decoder_targets: cxl decoder1.0: dport2 found in target list, index 2 update_decoder_targets: cxl decoder1.0: dport0 found in target list, index 0 update_decoder_targets: cxl decoder1.0: dport3 found in target list, index 3 update_decoder_targets: cxl decoder2.0: dport3 found in target list, index 1 update_decoder_targets: cxl decoder2.1: dport3 found in target list, index 1 update_decoder_targets: cxl decoder4.0: dport3 found in target list, index 1 update_decoder_targets: cxl decoder4.1: dport3 found in target list, index 1 Analyzing the conditions when this happens: 1) A dport is shared by multiple decoders. 2) The decoders have interleaving configured (ways > 1). The configuration above has the following hierarchy details (fixed version): root0 |_ | | | decoder0.1 | ways: 2 | target_list: 0,1 |_______________________________________ | | | dport0 | dport1 | | port2 port4 | | |___________________ |_____________________ | | | | | | | decoder2.0 decoder2.1 | decoder4.0 decoder4.1 | ways: 2 ways: 2 | ways: 2 ways: 2 | target_list: 2,3 target_list: 2,3 | target_list: 2,3 target_list: 2,3 |___________________ |___________________ | | | | | dport2 | dport3 | dport2 | dport3 | | | | endpoint7 endpoint12 endpoint9 endpoint13 |_ |_ |_ |_ | | | | | | | | | decoder7.0 | decoder12.0 | decoder9.0 | decoder13.0 | decoder7.2 | decoder12.2 | decoder9.2 | decoder13.2 | | | | mem3 mem5 mem6 mem8 Note: Device numbers vary for every boot. Current kernel fails to enumerate endpoint12 and endpoint13 as the target list is not updated for the second decoder. Fixes: 4f06d81e7c6a ("cxl: Defer dport allocation for switch ports") Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Signed-off-by: Robert Richter Link: https://patch.msgid.link/20260108101324.509667-1-rrichter@amd.com Signed-off-by: Dave Jiang commit 553410fcb95e3acf1a4ac7c08c5b30407f5f30b6 Merge: 81c5ffec9ece10 1ca8677d9f3491 Author: Linus Torvalds Date: Fri Jan 9 06:20:15 2026 -1000 Merge tag 'acpi-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fix from Rafael Wysocki: "This fixes the ACPI/PCI legacy interrupts (INTx) parsing in the case when the ACPI Global System Interrupt (GSI) value is a 32-bit one with the MSB set. That was interpreted as a negative integer and caused acpi_pci_link_allocate_irq() to fail and acpi_irq_get_penalty() to trigger an out-of-bounds array dereference (Lorenzo Pieralisi)" * tag 'acpi-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PCI: IRQ: Fix INTx GSIs signedness commit 81c5ffec9ece10079b8c6d944a754fcddfcd37da Merge: a81668db9e2c46 7966cf0ebe32c9 Author: Linus Torvalds Date: Fri Jan 9 06:18:05 2026 -1000 Merge tag 'pm-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "This fixes a crash in the hibernation image saving code that can be triggered when the given compression algorithm is unavailable (Malaya Kumar Rout)" * tag 'pm-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: hibernate: Fix crash when freeing invalid crypto compressor commit a81668db9e2c46d7274fe00892f943ed68f86481 Merge: cbd4480cfac54d d578b31856cec3 Author: Linus Torvalds Date: Fri Jan 9 06:10:22 2026 -1000 Merge tag 'gpio-fixes-for-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "There are several ordinary driver fixes and a fix to a race between the registration of two chips that causes a crash in GPIO core. The bulk of the changed lines however, concerns the management of shared GPIOs that landed in v6.19-rc1. Enabling it for ARCH_QCOM enabled it in defconfig which effectively enabled it for all arm64 platforms and exposed the code to quite a lot of testing (which is good, right? :)). As a resukt, I received a number of bug reports, which I progressively fixed over the course of last weeks. This explains the number of lines higher than what I normally aim for at this stage. - balance superio enter/exit calls in error path in gpio-it87 - fix a race where we try to take the SRCU read lock of the GPIO device before it's been initialized causing a NULL-pointer dereference - fix handling of short-pulse interrupts in gpio-pca053x - fix a reference leak in error path in gpio-mpsse - mark the GPIO controller as sleeping (it calls sleeping functions) in gpio-rockchip - fix several issues in management of shared GPIOs" * tag 'gpio-fixes-for-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: shared: fix a false-positive sharing detection with reset-gpios gpiolib: fix lookup table matching gpio: shared: don't allocate the lookup table until we really need it gpio: shared: fix a race condition gpio: shared: assign the correct firmware node for reset-gpio use-case gpio: rockchip: mark the GPIO controller as sleeping gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths gpio: pca953x: handle short interrupt pulses on PCAL devices gpiolib: fix race condition for gdev->srcu gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib gpio: shared: verify con_id when adding proxy lookup gpiolib: allow multiple lookup tables per consumer gpio: it87: balance superio enter/exit calls in error path commit cbd4480cfac54dd4e9f7fb9ac2e0226ea38fecbb Merge: 2bfe3e0da6e619 f6eac56d6bf202 Author: Linus Torvalds Date: Fri Jan 9 06:04:05 2026 -1000 Merge tag 'drm-fixes-2026-01-09' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "I missed the drm-rust fixes tree for last week, so this catches up on that, along with amdgpu, and then some misc fixes across a few drivers. I hadn't got an xe pull by the time I sent this, I suspect one will arrive 10 mins after, but I don't think there is anything that can't wait for next week. Things seem to have picked up a little with people coming back from holidays, MAINTAINERS: - Fix Nova GPU driver git links - Fix typo in TYR driver entry preventing correct behavior of scripts/get_maintainer.pl - Exclude TYR driver from DRM MISC nova-core: - Correctly select RUST_FW_LOADER_ABSTRACTIONS to prevent build errors - Regenerate nova-core bindgen bindings with '--explicit-padding' to avoid uninitialized bytes - Fix length of received GSP messages, due to miscalculated message payload size - Regenerate bindings to derive MaybeZeroable - Use a bindings alias to derive the firmware version exynos: - hdmi: replace system_wq with system_percpu_wq pl111: - Fix error handling in probe mediatek/atomic/tidss: - Fix tidss in another way and revert reordering of pre-enable and post-disable operations, as it breaks other bridge drivers nouveau: - Fix regression from fwsec s/r fix pci/vga: - Fix multiple gpu's being reported a 'boot_display' fb-helper: - Fix vblank timeout during suspend/reset amdgpu: - Clang fixes - Navi1x PCIe DPM fixes - Ring reset fixes - ISP suspend fix - Analog DC fixes - VPE fixes - Mode1 reset fix radeon: - Variable sized array fix" * tag 'drm-fixes-2026-01-09' of https://gitlab.freedesktop.org/drm/kernel: (32 commits) Reapply "Revert "drm/amd: Skip power ungate during suspend for VPE"" drm/amd/display: Check NULL before calling dac_load_detection drm/amd/pm: Disable MMIO access during SMU Mode 1 reset drm/exynos: hdmi: replace use of system_wq with system_percpu_wq drm/fb-helper: Fix vblank timeout during suspend/reset PCI/VGA: Don't assume the only VGA device on a system is `boot_vga` drm/amdgpu: Fix query for VPE block_type and ip_count drm/amd/display: Add missing encoder setup to DACnEncoderControl drm/amd/display: Correct color depth for SelectCRTC_Source drm/amd/amdgpu: Fix SMU warning during isp suspend-resume drm/amdgpu: always backup and reemit fences drm/amdgpu: don't reemit ring contents more than once drm/amd/pm: force send pcie parmater on navi1x drm/amd/pm: fix wrong pcie parameter on navi1x drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] drm/amd/display: Reduce number of arguments of dcn30's CalculateWatermarksAndDRAMSpeedChangeSupport() drm/amd/display: Reduce number of arguments of dcn30's CalculatePrefetchSchedule() drm/amd/display: Apply e4479aecf658 to dml nouveau: don't attempt fwsec on sb on newer platforms drm/tidss: Fix enable/disable order ... commit 2bfe3e0da6e619dbf6157dfad896307ab6b9a58a Merge: 77d4c5da97ceb5 75ddaa4ddc86d3 Author: Linus Torvalds Date: Fri Jan 9 05:57:57 2026 -1000 Merge tag 'vfs-6.19-rc5.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Remove incorrect __user annotation from struct xattr_args::value - Documentation fix: Add missing kernel-doc description for the @isnew parameter in ilookup5_nowait() to silence Sphinx warnings - Documentation fix: Fix kernel-doc comment for __start_dirop() - the function name in the comment was wrong and the @state parameter was undocumented - Replace dynamic folio_batch allocation with stack allocation in iomap_zero_range(). The dynamic allocation was problematic for ext4-on-iomap work (didn't handle allocation failure properly) and triggered lockdep complaints. Uses a flag instead to control batch usage - Re-add #ifdef guards around PIDFD_GET__NAMESPACE ioctls. When a namespace type is disabled, ns->ops is NULL, causes crashes during inode eviction when closing the fd. The ifdefs were removed in a recent simplification but are still needed - Fixe a race where a folio could be unlocked before the trailing zeros (for EOF within the page) were written - Split out a dedicated lease_dispose_list() helper since lease code paths always know they're disposing of leases. Removes unnecessary runtime flag checks and prepares for upcoming lease_manager enhancements - Fix userland delegation requests succeeding despite conflicting opens. Previously, FL_LAYOUT and FL_DELEG leases bypassed conflict checks (a hack for nfsd). Adds new ->lm_open_conflict() lease_manager operation so userland delegations get proper conflict checking while nfsd can continue its own conflict handling - Fix LOOKUP_CACHED path lookups incorrectly falling through to the slow path. After legitimize_links() calls were conditionally elided, the routine would always fail with LOOKUP_CACHED regardless of whether there were any links. Now the flag is checked at the two callsites before calling legitimize_links() - Fix bug in media fd allocation in media_request_alloc() - Fix mismatched API calls in ecryptfs_mknod(): was calling end_removing() instead of end_creating() after ecryptfs_start_creating_dentry() - Fix dentry reference count leak in ecryptfs_mkdir(): a dget() of the lower parent dir was added but never dput()'d, causing BUG during lower filesystem unmount due to the still-in-use dentry * tag 'vfs-6.19-rc5.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: pidfs: protect PIDFD_GET_* ioctls() via ifdef ecryptfs: Release lower parent dentry after creating dir ecryptfs: Fix improper mknod pairing of start_creating()/end_removing() get rid of bogus __user in struct xattr_args::value VFS: fix __start_dirop() kernel-doc warnings fs: Describe @isnew parameter in ilookup5_nowait() fs: make sure to fail try_to_unlazy() and try_to_unlazy() for LOOKUP_CACHED netfs: Fix early read unlock of page with EOF in middle filelock: allow lease_managers to dictate what qualifies as a conflict filelock: add lease_dispose_list() helper iomap: replace folio_batch allocation with stack allocation media: mc: fix potential use-after-free in media_request_alloc() commit 77d4c5da97ceb5f9bf9993a36b5fb453616412e8 Merge: 623fb9912f6af6 961ac9d97be722 Author: Linus Torvalds Date: Fri Jan 9 05:55:34 2026 -1000 Merge tag 'v6.19-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix duplicate restart messages in qat * tag 'v6.19-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: qat - fix duplicate restarting msg during AER error commit 1fed08c5519d2f929457f354d3c06c6a8c33829c Author: Baochen Qiang Date: Thu Jan 8 11:21:46 2026 +0800 wifi: ath12k: don't force radio frequency check in freq_to_idx() freq_to_idx() is used to map a channel to a survey index. Commit acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") adds radio specific frequency range check in this helper to make sure an invalid index is returned if the channel falls outside that range. However, this check introduces a race, resulting in below warnings as reported in [1]. ath12k_pci 0000:08:00.0: chan info: invalid frequency 6455 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6535 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6615 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6695 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6775 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6855 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6935 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 7015 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 7095 (idx 101 out of bounds) ath12k_pci 0000:08:00.0: chan info: invalid frequency 6435 (idx 101 out of bounds) Race scenario: 1) A regdomain covering below frequency range is uploaded to host via WMI_REG_CHAN_LIST_CC_EXT_EVENTID event: Country 00, CFG Regdomain UNSET FW Regdomain 0, num_reg_rules 6 1. (2402 - 2472 @ 40) (0, 20) (0 ms) (FLAGS 360448) (0, 0) 2. (2457 - 2477 @ 20) (0, 20) (0 ms) (FLAGS 360576) (0, 0) 3. (5170 - 5330 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 4. (5490 - 5730 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 5. (5735 - 5895 @ 160) (0, 20) (0 ms) (FLAGS 264320) (0, 0) 6. (5925 - 7125 @ 320) (0, 24) (0 ms) (FLAGS 2056) (0, 255) As a result, radio frequency range is updated as [2402, 7125] ath12k_pci 0000:08:00.0: mac pdev 0 freq limit updated. New range 2402->7125 MHz If no scan in progress or after scan finished, command WMI_SCAN_CHAN_LIST_CMDID is sent to firmware notifying that firmware is allowed to do scan on all channels within that range. The running path is: /* redomain uploaded */ 1. WMI_REG_CHAN_LIST_CC_EXT_EVENTID 2. ath12k_reg_chan_list_event() 3. ath12k_reg_handle_chan_list() 4. queue_work(..., &ar->regd_update_work) 5. ath12k_regd_update_work() 6. ath12k_regd_update() /* update radio frequency range */ 7. ath12k_mac_update_freq_range() 8. regulatory_set_wiphy_regd() 9. ath12k_reg_notifier() 10. ath12k_reg_update_chan_list() 11. queue_work(..., &ar->regd_channel_update_work) 12. ath12k_regd_update_chan_list_work() /* wait scan finishes */ 13. wait_for_completion_timeout(&ar->scan.completed, ...) /* command notifying list of valid channels */ 14. ath12k_wmi_send_scan_chan_list_cmd() 2) Hardware scan is triggered on all allowed channels. 3) Before scan completed, 11D mechanism detects a new country code ath12k_pci 0000:08:00.0: wmi 11d new cc GB With this code sent to firmware, firmware uploads a new regdomain Country GB, CFG Regdomain ETSI FW Regdomain 2, num_reg_rules 9 1. (2402 - 2482 @ 40) (0, 20) (0 ms) (FLAGS 360448) (0, 0) 2. (5170 - 5250 @ 80) (0, 23) (0 ms) (FLAGS 264192) (0, 0) 3. (5250 - 5330 @ 80) (0, 23) (0 ms) (FLAGS 264216) (0, 0) 4. (5490 - 5590 @ 80) (0, 30) (0 ms) (FLAGS 264208) 5. (5590 - 5650 @ 40) (0, 30) (600000 ms) (FLAGS 264208) 6. (5650 - 5730 @ 80) (0, 30) (0 ms) (FLAGS 264208) 7. (5735 - 5875 @ 80) (0, 14) (0 ms) (FLAGS 264192) (0, 0) 8. (5855 - 5875 @ 20) (0, 14) (0 ms) (FLAGS 264192) (0, 0) 9. (5945 - 6425 @ 320) (0, 24) (0 ms) (FLAGS 2056) (0, 11) Then radio frequency range is updated as [2402, 6425] ath12k_pci 0000:08:00.0: mac pdev 0 freq limit updated. New range 2402->6425 MHz Please note this is a smaller range than the previous one. Later host runs the same path for the purpose of notifying the new channel list. However since scan not completed, host just waits there. Meanwhile, firmware is possibly scanning channels outside the new range. As a result, WMI_CHAN_INFO_EVENTID events for those channels fail freq_to_idx() check and triggers warnings above. Fix this issue by removing radio frequency check in freq_to_idx(). This is valid because channels being scanned do not synchronize with frequency range update. Besides, this won't cause any problem, since freq_to_idx() is only used for survey data. Even out-of-range channels filled in the survey, they won't get delivered to userspace due to the range check already there in ath12k_mac_op_get_survey(). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 Fixes: acc152f9be20 ("wifi: ath12k: combine channel list for split-phy devices in single-wiphy") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220871 # 1 Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20260108-ath12k-fix-freq-to-idx-v1-1-b2458cf7aa0d@oss.qualcomm.com Signed-off-by: Jeff Johnson commit bb97131fbf9b708dd9616ac2bdc793ad102b5c48 Author: Thomas Fourier Date: Tue Jan 6 09:49:04 2026 +0100 wifi: ath12k: fix dma_free_coherent() pointer dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260106084905.18622-2-fourier.thomas@gmail.com Signed-off-by: Jeff Johnson commit 9282a1e171ad8d2205067e8ec3bbe4e3cef4f29f Author: Thomas Fourier Date: Mon Jan 5 22:04:38 2026 +0100 wifi: ath10k: fix dma_free_coherent() pointer dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the aligned addresses. Fixes: 2a1e1ad3fd37 ("ath10k: Add support for 64 bit ce descriptor") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260105210439.20131-2-fourier.thomas@gmail.com Signed-off-by: Jeff Johnson commit a33d16dc874a9512c02b1f1a3e08c26a82b4be5e Author: Anup Patel Date: Tue Dec 23 20:05:44 2025 +0530 Revert "irqchip/riscv-imsic: Embed the vector array in lpriv" The __alloc_percpu() fails when the number of IDs are greater than 959 because size parameter of __alloc_percpu() must be less than 32768 (aka PCPU_MIN_UNIT_SIZE). This failure is observed with KVMTOOL when AIA is trap-n-emulated by in-kernel KVM because in this case KVM guest has 2047 interrupt IDs. To address this issue, don't embed vector array in struct imsic_local_priv until __alloc_percpu() support size parameter greater than 32768. This reverts commit 79eaabc61dfb ("irqchip/riscv-imsic: Embed the vector array in lpriv"). Signed-off-by: Anup Patel Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251223143544.1504217-1-anup.patel@oss.qualcomm.com commit 1690eeb0cb2bb77096cb6c826b6849ef05013e34 Author: Lorenzo Pieralisi Date: Mon Dec 22 11:22:50 2025 +0100 irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness Kbuild bot (through sparse) reported that the ITTE read to carry out a valid check in gicv5_its_map_event() lacks proper endianness handling. Add the missing endianess conversion. Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") Reported-by: kernel test robot Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://patch.msgid.link/20251222102250.435460-1-lpieralisi@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202512131849.30ZRTBeR-lkp@intel.com/ commit d1877cc7270302081a315a81a0ee8331f19f95c8 Author: Chaitanya Kulkarni Date: Fri Dec 19 16:18:42 2025 -0800 nvme-fc: release admin tagset if init fails nvme_fabrics creates an NVMe/FC controller in following path: nvmf_dev_write() -> nvmf_create_ctrl() -> nvme_fc_create_ctrl() -> nvme_fc_init_ctrl() nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc. Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts. Reported-by: Yi Zhang Reviewed-by: Justin Tee Signed-off-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit 7d3fa7e954934fbda0a017ac1c305b7b10ecceef Author: Janne Grunau Date: Wed Dec 31 11:10:57 2025 +0100 nvme-apple: add "apple,t8103-nvme-ans2" as compatible After discussion with the devicetree maintainers we agreed to not extend lists with the generic compatible "apple,nvme-ans2" anymore [1]. Add "apple,t8103-nvme-ans2" as fallback compatible as it is the SoC the driver and bindings were written for. [1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/ Cc: stable@vger.kernel.org # v6.18+ Fixes: 5bd2927aceba ("nvme-apple: Add initial Apple SoC NVMe driver") Reviewed-by: Neal Gompa Reviewed-by: Christoph Hellwig Signed-off-by: Janne Grunau Signed-off-by: Keith Busch commit 32b63acd78f577b332d976aa06b56e70d054cbba Author: Shivam Kumar Date: Sat Dec 13 13:57:48 2025 -0500 nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate whether the command's data structures (cmd->req.sg and cmd->iov) have been properly initialized before processing H2C_DATA PDUs. The nvmet_tcp_build_pdu_iovec() function dereferences these pointers without NULL checks. This can be triggered by sending H2C_DATA PDU immediately after the ICREQ/ICRESP handshake, before sending a CONNECT command or NVMe write command. Attack vectors that trigger NULL pointer dereferences: 1. H2C_DATA PDU sent before CONNECT → both pointers NULL 2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL 3. H2C_DATA PDU for uninitialized command slot → both pointers NULL The fix validates both cmd->req.sg and cmd->iov before calling nvmet_tcp_build_pdu_iovec(). Both checks are required because: - Uninitialized commands: both NULL - READ commands: cmd->req.sg allocated, cmd->iov NULL - WRITE commands: both allocated Fixes: efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") Reviewed-by: Sagi Grimberg Signed-off-by: Shivam Kumar Signed-off-by: Keith Busch commit f0d385f6689f37a2828c686fb279121df006b4cb Author: Ming Lei Date: Fri Jan 9 20:14:54 2026 +0800 ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk() 2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does: - del_gendisk(ub->ub_disk) - ublk_detach_disk() sets ub->ub_disk = NULL - put_disk() which may free the disk 3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk leading to UAF Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold a reference to the disk during the partition scan. The spinlock in ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker either gets a valid reference or sees NULL and exits early. Also change flush_work() to cancel_work_sync() to avoid running the partition scan work unnecessarily when the disk is already detached. Fixes: 7fc4da6a304b ("ublk: scan partition in async way") Reported-by: Ruikai Peng Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit e707c591a139d1bfa4ddc83036fc820ca006a140 Author: Ondrej Ille Date: Mon Jan 5 12:16:20 2026 +0100 can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. The Secondary Sample Point Source field has been set to an incorrect value by some mistake in the past 0b01 - SSP_SRC_NO_SSP - SSP is not used. for data bitrates above 1 MBit/s. The correct/default value already used for lower bitrates is 0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY (Measured Transmitter delay) + SSP_OFFSET. The related configuration register structure is described in section 3.1.46 SSP_CFG of the CTU CAN FD IP CORE Datasheet. The analysis leading to the proper configuration is described in section 2.8.3 Secondary sampling point of the datasheet. The change has been tested on AMD/Xilinx Zynq with the next CTU CN FD IP core versions: - 2.6 aka master in the "integration with Zynq-7000 system" test 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git driver (change already included in the driver repo) - older 2.5 snapshot with mainline kernels with this patch applied locally in the multiple CAN latency tester nightly runs 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT 6.19.0-rc3-dut The logs, the datasheet and sources are available at https://canbus.pages.fel.cvut.cz/ Signed-off-by: Ondrej Ille Signed-off-by: Pavel Pisa Link: https://patch.msgid.link/20260105111620.16580-1-pisa@fel.cvut.cz Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit b540b4e157c4b24d0501e5e50ffba598d066de42 Author: Jon Hunter Date: Thu Jan 8 14:31:58 2026 +0000 ASoC: dt-bindings: realtek,rt5640: Document port node Various boards that use the rt5640 audio codec define a 'port' child node under the codec node to describe the interface between it and the SoC that it is connected to. The binding document for the rt5640 codec does not define the 'port' child node and so this is generating warnings when running the DTB checks for these boards. Add the 'port' node to the binding document for the rt5640 codec to fix this. Signed-off-by: Jon Hunter Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260108143158.351223-4-jonathanh@nvidia.com Signed-off-by: Mark Brown commit 25b858474497b5f7e2198f6fc9381488d9bdb55d Author: Jon Hunter Date: Thu Jan 8 14:31:57 2026 +0000 ASoC: dt-bindings: realtek,rt5640: Update jack-detect The device-tree property 'realtek,jack-detect-source' currently only permits values from 0-6. However, commit 2b9c8d2b3c89 ("ASoC: rt5640: Add the HDA header support") updated the Realtek rt5640 to support setting the 'realtek,jack-detect-source' to 7 to support the HDA header. The Tegra234 platforms currently set 'realtek,jack-detect-source' to 7 for the HDA header and this is causing a warning when building device-tree. audio-codec@1c (realtek,rt5640): realtek,jack-detect-source: 7 is not one of [0, 1, 2, 3, 4, 5, 6] Given that the driver already supports this settings, update the binding document for the rt5640 device to add the HDA header as a valid configuration for the 'realtek,jack-detect-source' property. Fixes: 2b9c8d2b3c89 ("ASoC: rt5640: Add the HDA header support") Signed-off-by: Jon Hunter Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260108143158.351223-3-jonathanh@nvidia.com Signed-off-by: Mark Brown commit 66b47b9c069fa548db64bde6a32d3b33aa05f740 Author: Jon Hunter Date: Thu Jan 8 14:31:56 2026 +0000 ASoC: dt-bindings: realtek,rt5640: Document mclk Commit eba5a0bac211 ("ASoC: dt-bindings: realtek,rt5640: Convert to dtschema") converted the rt5640 dt-binding to yaml format but in the process dropped 'clock' and 'clock-names' properties that are used to specify the codec 'mclk'. This is causing DTB build warnings for boards that use this codec and define an 'mclk' in device-tree. Update the rt5640 binding document to add the optional mclk. Fixes: eba5a0bac211 ("ASoC: dt-bindings: realtek,rt5640: Convert to dtschema") Signed-off-by: Jon Hunter Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260108143158.351223-2-jonathanh@nvidia.com Signed-off-by: Mark Brown commit 2bdf777410dc6e022d1081885ff34673b5dfee99 Author: Cong Wang Date: Tue Dec 23 13:51:13 2025 -0800 sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve() sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path even when exec_binprm() fails. For the init task's first execve(), this causes a problem: 1. current->mm is NULL (kernel threads don't have an mm) 2. sched_mm_cid_before_execve() exits early because mm is NULL 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter) 4. sched_mm_cid_after_execve() is called with mm still NULL 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON This is easily reproduced by booting with an init that is a shell script (#!/bin/sh) where the interpreter doesn't exist in the initramfs. Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(), matching the behavior of sched_mm_cid_before_execve() which already handles this case via sched_mm_cid_exit()'s early return. Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value") Signed-off-by: Cong Wang Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Acked-by: Will Deacon Link: https://patch.msgid.link/20251223215113.639686-1-xiyou.wangcong@gmail.com commit 8dad31f85c7b91fd8bdbc6d0f27abc53bd8b1ffe Author: Dan Carpenter Date: Fri Dec 19 13:33:50 2025 +0300 xfs: fix memory leak in xfs_growfs_check_rtgeom() Free the "nmp" allocation before returning -EINVAL. Fixes: dc68c0f60169 ("xfs: fix the zoned RT growfs check for zone alignment") Signed-off-by: Dan Carpenter Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 15e8d739fda1084d81f7d3813e9600eba6e0f134 Author: Günther Noack Date: Thu Jan 1 14:40:58 2026 +0100 selftests/landlock: Properly close a file descriptor Add a missing close(srv_fd) call, and use EXPECT_EQ() to check the result. Signed-off-by: Günther Noack Fixes: f83d51a5bdfe ("selftests/landlock: Check IOCTL restrictions for named UNIX domain sockets") Link: https://lore.kernel.org/r/20260101134102.25938-2-gnoack3000@gmail.com [mic: Use EXPECT_EQ() and update commit message] Signed-off-by: Mickaël Salaün commit bdf3f4176092df5281877cacf42f843063b4784d Author: Yeoreum Yun Date: Wed Jan 7 16:21:15 2026 +0000 arm64: Fix cleared E0POE bit after cpu_suspend()/resume() TCR2_ELx.E0POE is set during smp_init(). However, this bit is not reprogrammed when the CPU enters suspension and later resumes via cpu_resume(), as __cpu_setup() does not re-enable E0POE and there is no save/restore logic for the TCR2_ELx system register. As a result, the E0POE feature no longer works after cpu_resume(). To address this, save and restore TCR2_EL1 in the cpu_suspend()/cpu_resume() path, rather than adding related logic to __cpu_setup(), taking into account possible future extensions of the TCR2_ELx feature. Fixes: bf83dae90fbc ("arm64: enable the Permission Overlay Extension for EL0") Cc: # 6.12.x Signed-off-by: Yeoreum Yun Reviewed-by: Anshuman Khandual Reviewed-by: Kevin Brodsky Signed-off-by: Catalin Marinas commit 7352e1d5932a0e777e39fa4b619801191f57e603 Author: Marc Kleine-Budde Date: Tue Dec 23 21:21:39 2025 +0100 can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close(). Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de Signed-off-by: Marc Kleine-Budde commit b1979778e98569c1e78c2c7f16bb24d76541ab00 Author: Szymon Wilczek Date: Tue Dec 23 02:17:32 2025 +0100 can: etas_es58x: allow partial RX URB allocation to succeed When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked. As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error. Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open(). Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e8cb6691a7cf68256cb8 Signed-off-by: Szymon Wilczek Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20251223011732.39361-1-swilczek.lx@gmail.com Signed-off-by: Marc Kleine-Budde commit d578b31856cec31315f27b3ba97b212e4c6989b3 Author: Bartosz Golaszewski Date: Thu Jan 8 14:39:19 2026 +0100 gpio: shared: fix a false-positive sharing detection with reset-gpios After scanning the devicetree, we remove all entries that have only one reference, while creating GPIO shared proxies for the remaining, shared entries. However: for the reset-gpio corner-case, we will have two references for a "reset-gpios" pin that's not really shared. In this case one will come from the actual consumer fwnode and the other from the potential auxiliary reset-gpio device. This causes the GPIO core to create unnecessary GPIO shared proxy devices for pins that are not really shared. Add a function that can detect this situation and remove entries that have exactly two references but one of them is a reset-gpio. Fixes: 7b78b26757e0 ("gpio: shared: handle the reset-gpios corner case") Link: https://lore.kernel.org/r/20260108-gpio-shared-false-positive-v1-1-5dbf8d1b2f7d@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 623fb9912f6af600cda3b6bd166ac738c1115ef4 Merge: 5572ad8fddecd4 ebc18e9854e5a2 Author: Linus Torvalds Date: Thu Jan 8 16:38:19 2026 -1000 Merge tag 'pinctrl-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Fix the mt8189 register base name order back from being fixed broken - Add REGMAP_MMIO to the pic64gx-gpio2 to avoid build breakages - Mark the Qualcomm lpass-lpi pin controller GPIO chip instance as sleeping to fix lock splats - Update .mailmap with my new kernel.org address for all old mails after maintainers ran into issues with this * tag 'pinctrl-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping pinctrl: pic64gx-gpio2: Add REGMAP_MMIO dependency Update .mailmap for Linus Walleij pinctrl: mediatek: mt8189: restore previous register base name array order commit 872ac785e7680dac9ec7f8c5ccd4f667f49d6997 Author: Eric Dumazet Date: Tue Jan 6 17:24:26 2026 +0000 ipv4: ip_tunnel: spread netdev_lockdep_set_classes() Inspired by yet another syzbot report. IPv6 tunnels call netdev_lockdep_set_classes() for each tunnel type, while IPv4 currently centralizes netdev_lockdep_set_classes() call from ip_tunnel_init(). Make ip_tunnel_init() a macro, so that we have different lockdep classes per tunnel type. Fixes: 0bef512012b1 ("net: add netdev_lockdep_set_classes() to virtual drivers") Reported-by: syzbot+1240b33467289f5ab50b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695d439f.050a0220.1c677c.0347.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260106172426.1760721-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d252c7898ebccef52665514be07b90987de7ffc7 Author: Alexandru Elisei Date: Tue Dec 16 10:30:53 2025 +0000 KVM: arm64: Remove unused parameter in synchronize_vcpu_pstate() synchronize_vcpu_pstate() doesn't make use of the reference to exit_code, remove the parameter. Reviewed-by: Fuad Tabba Signed-off-by: Alexandru Elisei Reviewed-by: Marc Zyngier Tested-by: Fuad Tabba Link: https://msgid.link/20251216103053.47224-5-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit 26cdea4893c2b26cad58926d8f29792386219332 Author: Alexandru Elisei Date: Tue Dec 16 10:30:52 2025 +0000 KVM: arm64: Remove extra argument for __pvkm_host_{share,unshare}_hyp() __pvkm_host_share_hyp() and __pkvm_host_unshare_hyp() both have one parameter, the pfn, not two. Even though correctness isn't impacted because the SMCCC handlers pass the first argument and ignore the second one, let's call the functions with the proper number of arguments. Reviewed-by: Fuad Tabba Signed-off-by: Alexandru Elisei Reviewed-by: Marc Zyngier Tested-by: Fuad Tabba Link: https://msgid.link/20251216103053.47224-4-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit aba963cb98c6d9d42490262a39c3d383cfebc6a9 Author: Alexandru Elisei Date: Tue Dec 16 10:30:51 2025 +0000 KVM: arm64: Inject UNDEF for a register trap without accessor Configuring a register trap without specifying an accessor function is abviously a bug. Instead of calling die() when that happens, let's be a bit more helpful and print the register encoding. Also inject an undefined instruction exception in the guest, similar to other unhandled register accesses. Signed-off-by: Alexandru Elisei Reviewed-by: Marc Zyngier Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Link: https://msgid.link/20251216103053.47224-3-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit 145cc42fe1217c66174c44c4034cc0fe3040bbb0 Author: Alexandru Elisei Date: Tue Dec 16 10:30:50 2025 +0000 KVM: arm64: Copy FGT traps to unprotected pKVM VCPU on VCPU load Commit fb10ddf35c1c ("KVM: arm64: Compute per-vCPU FGTs at vcpu_load()") introduced per-VCPU FGT traps. For an unprotected pKVM VCPU, the untrusted host FGT configuration is copied in pkvm_vcpu_init_traps(), which is called from __pkvm_init_vcpu(). __pkvm_init_vcpu() is called once per VCPU (when the VCPU is first run) which means that the uninitialized, zero, values for the FGT registers end up being used for the entire lifetime of the VCPU. This causes both unwanted traps (for the inverse polarity trap bits) and the guest being allowed to access registers it shouldn't. Fix it by copying the FGT traps for unprotected pKVM VCPUs when the untrusted host loads the VCPU. Fixes: fb10ddf35c1c ("KVM: arm64: Compute per-vCPU FGTs at vcpu_load()") Acked-by: Will Deacon Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Signed-off-by: Alexandru Elisei Reviewed-by: Marc Zyngier Link: https://msgid.link/20251216103053.47224-2-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit 8d8e882c2b4b73a3f894c3cad74718b633e3d166 Author: Marc Zyngier Date: Wed Dec 10 17:30:19 2025 +0000 KVM: arm64: Fix EL2 S1 XN handling for hVHE setups The current XN implementation is tied to the EL2 translation regime, and fall flat on its face with the EL2&0 one that is used for hVHE, as the permission bit for privileged execution is a different one. Fixes: 6537565fd9b7f ("KVM: arm64: Adjust EL2 stage-1 leaf AP bits when ARM64_KVM_HVHE is set") Signed-off-by: Marc Zyngier Reviewed-by: Fuad Tabba Link: https://msgid.link/20251210173024.561160-2-maz@kernel.org Signed-off-by: Oliver Upton commit 5e8b511c39f35dcbf2e548a75d49782778c2df48 Author: Sascha Bischoff Date: Tue Jan 6 16:52:10 2026 +0000 KVM: arm64: gic: Check for vGICv3 when clearing TWI Explicitly check for the vgic being v3 when disabling TWI. Failure to check this can result in using the wrong view of the vgic CPU IF union causing undesirable/unexpected behaviour. Signed-off-by: Sascha Bischoff Reviewed-by: Marc Zyngier Link: https://msgid.link/20260106165154.3321753-1-sascha.bischoff@arm.com Signed-off-by: Oliver Upton commit 56d0aea041f2e2be2d177005209596a4132485c9 Author: Jakub Kicinski Date: Tue Jan 6 12:07:06 2026 -0800 MAINTAINERS: add docs and selftest to the TLS file list The TLS MAINTAINERS entry does not seem to cover the selftest or docs. Add those. While at it remove the unnecessary wildcard from net/tls/, there are no subdirectories anyway so this change has no impact today. Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260106200706.1596250-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5fcd5513072b09f6533e22a779183fa2818bce81 Author: Jiayuan Chen Date: Sun Jan 4 20:35:27 2026 +0800 arm64: mm: Fix incomplete tag reset in change_memory_common() Running KASAN KUnit tests with {HW,SW}_TAGS mode triggers a fault in change_memory_common(): Call trace: change_memory_common+0x168/0x210 (P) set_memory_ro+0x20/0x48 vmalloc_helpers_tags+0xe8/0x338 kunit_try_run_case+0x74/0x188 kunit_generic_run_threadfn_adapter+0x30/0x70 kthread+0x11c/0x200 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- # vmalloc_helpers_tags: try faulted not ok 67 vmalloc_helpers_tags Commit a06494adb7ef ("arm64: mm: use untagged address to calculate page index") fixed a KASAN warning in the BPF subsystem by adding kasan_reset_tag() to the index calculation. In the execmem flow: bpf_prog_pack_alloc() -> bpf_jit_alloc_exec() -> execmem_alloc() The returned address from execmem_vmalloc/execmem_cache_alloc is passed through kasan_reset_tag(), so start has no tag while area->addr still retains the original tag. The fix correctly handled this case by resetting the tag on area->addr: (start - (unsigned long)kasan_reset_tag(area->addr)) >> PAGE_SHIFT However, in normal vmalloc paths, both start and area->addr have matching tags(or no tags). Resetting only area->addr causes a mismatch when subtracting a tagged address from an untagged one, resulting in an incorrect index. Fix this by resetting tags on both addresses in the index calculation. This ensures correct results regardless of the tag state of either address. Tested with KASAN KUnit tests under CONFIG_KASAN_GENERIC, CONFIG_KASAN_SW_TAGS, and CONFIG_KASAN_HW_TAGS - all pass. Also verified the original BPF KASAN warning from [1] is still fixed. [1] https://lore.kernel.org/all/20251118164115.GA3977565@ax162/ Fixes: a06494adb7ef ("arm64: mm: use untagged address to calculate page index") Signed-off-by: Jiayuan Chen Signed-off-by: Jiayuan Chen Signed-off-by: Catalin Marinas commit 74d74bb78aeccc9edc10db216d6be121cf7ec176 Author: Eric Biggers Date: Tue Jan 6 21:20:23 2026 -0800 lib/crypto: aes: Fix missing MMU protection for AES S-box __cacheline_aligned puts the data in the ".data..cacheline_aligned" section, which isn't marked read-only i.e. it doesn't receive MMU protection. Replace it with ____cacheline_aligned which does the right thing and just aligns the data while keeping it in ".rodata". Fixes: b5e0b032b6c3 ("crypto: aes - add generic time invariant AES cipher") Cc: stable@vger.kernel.org Reported-by: Qingfang Deng Closes: https://lore.kernel.org/r/20260105074712.498-1-dqfext@gmail.com/ Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260107052023.174620-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2eb57ca7cc373404aa1399a9d926dea8479eb728 Author: Eric Biggers Date: Tue Jan 6 19:39:48 2026 -0800 MAINTAINERS: add test vector generation scripts to "CRYPTO LIBRARY" The scripts in scripts/crypto/ are used to generate files in lib/crypto/, so they should be included in "CRYPTO LIBRARY". Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260107033948.29368-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0f42c2a52d8a7535088895c3104150ac9019afd8 Author: Jie Zhan Date: Wed Jan 7 09:58:29 2026 +0800 lib/crypto: tests: Fix syntax error for old python versions 'make binrpm-pkg' throws me this error, with Python 3.9: *** Error compiling '.../gen-hash-testvecs.py'... File ".../scripts/crypto/gen-hash-testvecs.py", line 121 return f'{alg.upper().replace('-', '_')}_DIGEST_SIZE' ^ SyntaxError: f-string: unmatched '(' Old python versions, presumably <= 3.11, can't resolve these quotes. Fix it with double quotes for compatibility. Fixes: 15c64c47e484 ("lib/crypto: tests: Add SHA3 kunit tests") Signed-off-by: Jie Zhan Link: https://lore.kernel.org/r/20260107015829.2000699-1-zhanjie9@hisilicon.com Signed-off-by: Eric Biggers commit fcff71fd888dce1533a3975e68fc80824ff69ef9 Author: Thomas Weißschuh Date: Fri Jan 2 08:32:03 2026 +0100 lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs On my development machine the generic, memcpy()-only implementation of polyval_preparekey() is too fast for the IRQ workers to actually fire. The test fails. Increase the iterations to make the test more robust. The test will run for a maximum of one second in any case. [EB: This failure was already fixed by commit c31f4aa8fed0 ("kunit: Enforce task execution in {soft,hard}irq contexts"). I'm still applying this patch too, since the iteration count in this test made its running time much shorter than the other similar ones.] Fixes: b3aed551b3fc ("lib/crypto: tests: Add KUnit tests for POLYVAL") Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20260102-kunit-polyval-fix-v1-1-5313b5a65f35@linutronix.de Signed-off-by: Eric Biggers commit c2803bd580db226008aabf2fb2f0c9a7d3b5d0de Author: Ben Horgan Date: Fri Dec 19 18:11:03 2025 +0000 arm_mpam: Stop using uninitialized variables in __ris_msmon_read() Dan has reported two uses of uninitialized variables in __ris_msmon_read(). If an unknown monitor type is encountered then the local variable, now, is used uninitialized. Fix this by returning early on error. If a non-mbwu monitor is being read then the local variable, overflow, is not initialized but still read. Initialize it to false as overflow is not relevant for csu monitors. Fixes: 823e7c3712c5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Fixes: 9e5afb7c3283 ("arm_mpam: Use long MBWU counters if supported") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202512091519.RBwiJcSq-lkp@intel.com/ Closes: https://lore.kernel.org/r/202512100547.N7QPYgfb-lkp@intel.com/ Signed-off-by: Ben Horgan Reviewed-by: Jonathan Cameron Signed-off-by: Catalin Marinas commit 5572ad8fddecd4a0db19801262072ff5916b7589 Merge: f2a3b12b305c7b 1e2ed4bfd50ace Author: Linus Torvalds Date: Thu Jan 8 08:47:05 2026 -1000 Merge tag 'trace-v6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Remove useless assignment of soft_mode variable The function __ftrace_event_enable_disable() sets "soft_mode" in one of the branch paths but doesn't use it after that. Remove the setting of that variable. - Add a cond_resched() in ring_buffer_resize() The resize function that allocates all the pages for the ring buffer was causing a soft lockup on PREEMPT_NONE configs when allocating large buffers on machines with many CPUs. Hopefully this is the last cond_resched() needed to be added as PREEMPT_LAZY becomes the norm in the future. - Make ftrace_graph_ent depth field signed The "depth" field of struct ftrace_graph_ent was converted from "int" to "unsigned long" for alignment reasons to work with being embedded in other structures. The conversion from a signed to unsigned caused integrity checks to always pass as they were comparing "depth" to less than zero. Make the field signed long. - Add recursion protection to stack trace events A infinite recursion was triggered by a stack trace event calling RCU which internally called rcu_read_unlock_special(), which triggered an event that was also doing stacktraces which cause it to trigger the same RCU lock that called rcu_read_unlock_special() again. Update the trace_test_and_set_recursion() to add a set of context checks for events to use, and have the stack trace event use that for recursion protection. - Make the variable ftrace_dump_on_oops static The cleanup of sysctl that moved all the updates to the files that use them moved the reference of ftrace_dump_on_oops to where it is used. It is no longer used outside of the trace.c file. Make it static. * tag 'trace-v6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: trace: ftrace_dump_on_oops[] is not exported, make it static tracing: Add recursion protection in kernel stack trace recording ftrace: Make ftrace_graph_ent depth field signed ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free tracing: Drop unneeded assignment to soft_mode commit f2a3b12b305c7bb72467b2a56d19a4587b6007f9 Merge: 79b95d74470dd9 c92510f5e3f82b Author: Linus Torvalds Date: Thu Jan 8 08:40:35 2026 -1000 Merge tag 'net-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter and wireless. Current release - fix to a fix: - net: do not write to msg_get_inq in callee - arp: do not assume dev_hard_header() does not change skb->head Current release - regressions: - wifi: mac80211: don't iterate not running interfaces - eth: mlx5: fix NULL pointer dereference in ioctl module EEPROM Current release - new code bugs: - eth: bnge: add AUXILIARY_BUS to Kconfig dependencies Previous releases - regressions: - eth: mlx5: dealloc forgotten PSP RX modify header Previous releases - always broken: - ping: fix ICMP out SNMP stats double-counting with ICMP sockets - bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - eth: bnxt: fix potential data corruption with HW GRO/LRO" * tag 'net-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits) arp: do not assume dev_hard_header() does not change skb->head net: enetc: fix build warning when PAGE_SIZE is greater than 128K atm: Fix dma_free_coherent() size tools: ynl: don't install tests net: do not write to msg_get_inq in callee bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup net: usb: pegasus: fix memory leak in update_eth_regs_async() net: 3com: 3c59x: fix possible null dereference in vortex_probe1() net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point net: airoha: Fix schedule while atomic in airoha_ppe_deinit() selftests: netdevsim: add carrier state consistency test net: netdevsim: fix inconsistent carrier state after link/unlink selftests: drv-net: Bring back tool() to driver __init__s net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy ... commit 5b577d214fcc109707bcb77b4ae72a31cfd86798 Author: Kery Qi Date: Wed Jan 7 23:48:37 2026 +0800 ASoC: davinci-evm: Fix reference leak in davinci_evm_probe The davinci_evm_probe() function calls of_parse_phandle() to acquire device nodes for "ti,audio-codec" and "ti,mcasp-controller". These functions return device nodes with incremented reference counts. However, in several error paths (e.g., when the second of_parse_phandle(), snd_soc_of_parse_card_name(), or devm_snd_soc_register_card() fails), the function returns directly without releasing the acquired nodes, leading to reference leaks. This patch adds an error handling path 'err_put' to properly release the device nodes using of_node_put() and clean up the pointers when an error occurs. Signed-off-by: Kery Qi Link: https://patch.msgid.link/20260107154836.1521-2-qikeyu2017@gmail.com Signed-off-by: Mark Brown commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 Author: Eric Dumazet Date: Wed Jan 7 21:22:50 2026 +0000 arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call. Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1f20c77496b3e253f18ea636f4f14069e383749d Merge: 4b5bdabb5449b6 4648fb2f2e7210 Author: Jakub Kicinski Date: Thu Jan 8 08:54:54 2026 -0800 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-01-06 (idpf) This series contains updates to idpf driver only. Emil fixes issues related to resets; among them timeouts, NULL pointer dereferences, and memory leaks. Sreedevi resolves issues around RSS; mainly involving operations when the interface is down and resets. She also addresses some incomplete cleanups for ntuple filters and interrupts. Erik fixes incomplete output of ntuple filters. Josh sets restriction of Rx buffer size to follow hardware restrictions. Larysa adds check to prevent NULL pointer dereference when RDMA is not enabled. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: fix aux device unplugging when rdma is not supported by vport idpf: cap maximum Rx buffer size idpf: Fix error handling in idpf_vport_open() idpf: Fix RSS LUT NULL ptr issue after soft reset idpf: Fix RSS LUT configuration on down interfaces idpf: Fix RSS LUT NULL pointer crash on early ethtool operations idpf: fix issue with ethtool -n command display idpf: fix memory leak of flow steer list on rmmod idpf: fix error handling in the init_task on load idpf: fix memory leak in idpf_vc_core_deinit() idpf: fix memory leak in idpf_vport_rel() idpf: detach and close netdevs while handling a reset idpf: keep the netdev when a reset fails ==================== Link: https://patch.msgid.link/20260107000648.1861994-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4b5bdabb5449b652122e43f507f73789041d4abe Author: Wei Fang Date: Wed Jan 7 17:12:04 2026 +0800 net: enetc: fix build warning when PAGE_SIZE is greater than 128K The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will be greater than 0xFFFF, thus causing a build warning. This will not cause any practical issues because ENETC is currently only used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch is only for fixing the build warning that occurs when compiling ENETC drivers for other platforms. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/ Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE") Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 804809ae408571d67e171e87bdd03b6b88fbfd3d Merge: 4d984b0574ff70 a203dbeeca15a9 Author: Jakub Kicinski Date: Thu Jan 8 08:49:24 2026 -0800 Merge tag 'wireless-2026-01-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Couple of fixes: - mac80211: - long-standing injection bug due to chanctx rework - more recent interface iteration issue - collect statistics before removing stations - hwsim: - fix NAN frequency typo (potential NULL ptr deref) - fix locking of radio lock (needs softirqs disabled) - wext: - ancient issue with compat and events copying some uninitialized stack data to userspace * tag 'wireless-2026-01-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: collect station statistics earlier when disconnect wifi: mac80211: restore non-chanctx injection behaviour wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock wifi: mac80211: don't iterate not running interfaces wifi: mac80211_hwsim: fix typo in frequency notification wifi: avoid kernel-infoleak from struct iw_point ==================== Link: https://patch.msgid.link/20260108140141.139687-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 4d984b0574ff708e66152763fbfdef24ea40933f Author: Thomas Fourier Date: Wed Jan 7 10:01:36 2026 +0100 atm: Fix dma_free_coherent() size The size of the buffer is not the same when alloc'd with dma_alloc_coherent() in he_init_tpdrq() and freed. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260107090141.80900-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit 790792ebc9603a7ccbf6996cb537d89607e3a75b Author: Jakub Kicinski Date: Tue Jan 6 08:34:26 2026 -0800 tools: ynl: don't install tests make's install target is meant for installing the production artifacts, AFAIU. Don't install test_ynl_cli and test_ynl_ethtool from under the main YNL install target. The install target under tests/ is retained in case someone wants the tests to be installed. Fixes: 308b7dee3e5c ("tools: ynl: add YNL test framework") Reviewed-by: Hangbin Liu Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20260106163426.1468943-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7d11e047eda5f98514ae62507065ac961981c025 Author: Willem de Bruijn Date: Tue Jan 6 10:05:46 2026 -0500 net: do not write to msg_get_inq in callee NULL pointer dereference fix. msg_get_inq is an input field from caller to callee. Don't set it in the callee, as the caller may not clear it on struct reuse. This is a kernel-internal variant of msghdr only, and the only user does reinitialize the field. So this is not critical for that reason. But it is more robust to avoid the write, and slightly simpler code. And it fixes a bug, see below. Callers set msg_get_inq to request the input queue length to be returned in msg_inq. This is equivalent to but independent from the SO_INQ request to return that same info as a cmsg (tp->recvmsg_inq). To reduce branching in the hot path the second also sets the msg_inq. That is WAI. This is a fix to commit 4d1442979e4a ("af_unix: don't post cmsg for SO_INQ unless explicitly asked for"), which fixed the inverse. Also avoid NULL pointer dereference in unix_stream_read_generic if state->msg is NULL and msg->msg_get_inq is written. A NULL state->msg can happen when splicing as of commit 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets"). Also collapse two branches using a bitwise or. Cc: stable@vger.kernel.org Fixes: 4d1442979e4a ("af_unix: don't post cmsg for SO_INQ unless explicitly asked for") Link: https://lore.kernel.org/netdev/willemdebruijn.kernel.24d8030f7a3de@gmail.com/ Signed-off-by: Willem de Bruijn Reviewed-by: Jens Axboe Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260106150626.3944363-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 9ce4aef9a5b1b76207152ba019f838f62dff97b8 Author: Alice Ryhl Date: Thu Jan 8 16:07:31 2026 +0000 drm/gpuvm: take GEM lock inside drm_gpuvm_bo_obtain_prealloc() When calling drm_gpuvm_bo_obtain_prealloc() and using immediate mode, this may result in a call to ops->vm_bo_free(vm_bo) while holding the GEMs gpuva mutex. This is a problem if ops->vm_bo_free(vm_bo) performs any operations that are not safe in the fence signalling critical path, and it turns out that Panthor (the only current user of the method) calls drm_gem_shmem_unpin() which takes a resv lock internally. This constitutes both a violation of signalling safety and lock inversion. To fix this, we modify the method to internally take the GEMs gpuva mutex so that the mutex can be unlocked before freeing the preallocated vm_bo. Note that this modification introduces a requirement that the driver uses immediate mode to call drm_gpuvm_bo_obtain_prealloc() as it would otherwise take the wrong lock. Fixes: 63e919a31625 ("panthor: use drm_gpuva_unlink_defer()") Reviewed-by: Boris Brezillon Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260108-gpuvm-rust-v2-1-dbd014005a0b@google.com Signed-off-by: Danilo Krummrich commit 3358995b1a7f9dcb52a56ec8251570d71024dad0 Author: Breno Leitao Date: Tue Jan 6 06:31:14 2026 -0800 bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called, which invokes ptp_clock_unregister(). Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events"), ptp_clock_unregister() now calls ptp_disable_all_events(), which in turn invokes the driver's .enable() callback (bnxt_ptp_enable()) to disable PTP events before completing the unregistration. bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, causing a NULL pointer dereference: bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Call Trace: __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72) bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517) ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66) ptp_clock_unregister (drivers/ptp/ptp_clock.c:518) bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134) bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889) Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3") Fix this by clearing and unregistering ptp (bnxt_ptp_clear()) before freeing HWRM resources. Suggested-by: Pavan Chebbi Signed-off-by: Breno Leitao Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") Cc: stable@vger.kernel.org Reviewed-by: Pavan Chebbi Link: https://patch.msgid.link/20260106-bnxt-v3-1-71f37e11446a@debian.org Signed-off-by: Jakub Kicinski commit afa27621a28af317523e0836dad430bec551eb54 Author: Petko Manolov Date: Tue Jan 6 10:48:21 2026 +0200 net: usb: pegasus: fix memory leak in update_eth_regs_async() When asynchronously writing to the device registers and if usb_submit_urb() fail, the code fail to release allocated to this point resources. Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission") Signed-off-by: Petko Manolov Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com Signed-off-by: Jakub Kicinski commit a4e305ed60f7c41bbf9aabc16dd75267194e0de3 Author: Thomas Fourier Date: Tue Jan 6 10:47:21 2026 +0100 net: 3com: 3c59x: fix possible null dereference in vortex_probe1() pdev can be null and free_ring: can be called in 1297 with a null pdev. Fixes: 55c82617c3e8 ("3c59x: convert to generic DMA API") Cc: Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20260106094731.25819-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit c1d73b1480235731e35c81df70b08f4714a7d095 Author: Xiang Mei Date: Mon Jan 5 20:41:00 2026 -0700 net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects may point to the same leaf_qdisc. This happens when: 1. one QFQ qdisc is attached to the dev as the root qdisc, and 2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get() / qdisc_put()) and is pending to be destroyed, as in function tc_new_tfilter. When packets are enqueued through the root QFQ qdisc, the shared leaf_qdisc->q.qlen increases. At the same time, the second QFQ qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters qfq_reset() with its own q->q.qlen == 0, but its class's leaf qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate an inactive aggregate and trigger a null-deref in qfq_deactivate_agg: [ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.903571] #PF: supervisor write access in kernel mode [ 0.903860] #PF: error_code(0x0002) - not-present page [ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0 [ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI [ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE [ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0 Code starting with the faulting instruction =========================================== 0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4b 10 mov 0x10(%rbx),%ecx d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx 14: 48 8b 78 08 mov 0x8(%rax),%rdi 18: 48 d3 e2 shl %cl,%rdx 1b: 48 21 f2 and %rsi,%rdx 1e: 48 2b 13 sub (%rbx),%rdx 21: 48 8b 30 mov (%rax),%rsi 24: 48 d3 ea shr %cl,%rdx 27: 8b 4b 18 mov 0x18(%rbx),%ecx ... [ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246 [ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000 [ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000 [ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000 [ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880 [ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000 [ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0 [ 0.910247] PKRU: 55555554 [ 0.910391] Call Trace: [ 0.910527] [ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485) [ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036) [ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076) [ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447) [ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861) [ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 0.912296] ? __alloc_skb (net/core/skbuff.c:706) [ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1)) [ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686) [ 0.913077] ksys_write (fs/read_write.c:738) [ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) [ 0.913687] RIP: 0033:0x424c34 [ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9 Code starting with the faulting instruction =========================================== 0: 89 02 mov %eax,(%rdx) 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax 9: eb bd jmp 0xffffffffffffffc8 b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 12: 00 00 00 15: 90 nop 16: f3 0f 1e fa endbr64 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e 21: 74 13 je 0x36 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a: 09 .byte 0x9 [ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34 [ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003 [ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000 [ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28 [ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001 [ 0.917039] [ 0.917158] Modules linked in: [ 0.917316] CR2: 0000000000000000 [ 0.917484] ---[ end trace 0000000000000000 ]--- [ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0 Code starting with the faulting instruction =========================================== 0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4b 10 mov 0x10(%rbx),%ecx d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx 14: 48 8b 78 08 mov 0x8(%rax),%rdi 18: 48 d3 e2 shl %cl,%rdx 1b: 48 21 f2 and %rsi,%rdx 1e: 48 2b 13 sub (%rbx),%rdx 21: 48 8b 30 mov (%rax),%rsi 24: 48 d3 ea shr %cl,%rdx 27: 8b 4b 18 mov 0x18(%rbx),%ecx ... [ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246 [ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000 [ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000 [ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000 [ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880 [ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000 [ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0 [ 0.922097] PKRU: 55555554 [ 0.922240] Kernel panic - not syncing: Fatal exception [ 0.922590] Kernel Offset: disabled Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler") Signed-off-by: Xiang Mei Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu Signed-off-by: Jakub Kicinski commit e25348c5405c38c7b5e7b833898f2d205289186a Author: Malaya Kumar Rout Date: Mon Jan 5 16:07:29 2026 +0530 PM: EM: Fix memory leak in em_create_pd() error path When ida_alloc() fails in em_create_pd(), the function returns without freeing the previously allocated 'pd' structure, leading to a memory leak. The 'pd' pointer is allocated either at line 436 (for CPU devices with cpumask) or line 442 (for other devices) using kzalloc(). Additionally, the function incorrectly returns -ENOMEM when ida_alloc() fails, ignoring the actual error code returned by ida_alloc(), which can fail for reasons other than memory exhaustion. Fix both issues by: 1. Freeing the 'pd' structure with kfree() when ida_alloc() fails 2. Returning the actual error code from ida_alloc() instead of -ENOMEM This ensures proper cleanup on the error path and accurate error reporting. Fixes: cbe5aeedecc7 ("PM: EM: Assign a unique ID when creating a performance domain") Signed-off-by: Malaya Kumar Rout Reviewed-by: Changwoo Min Link: https://patch.msgid.link/20260105103730.65626-1-mrout@redhat.com Signed-off-by: Rafael J. Wysocki commit 54b603f2db6b95495bc33a8f2bde80f044baff9a Author: Yaxiong Tian Date: Tue Dec 30 14:15:34 2025 +0800 PM: EM: Fix incorrect description of the cost field in struct em_perf_state Due to commit 1b600da51073 ("PM: EM: Optimize em_cpu_energy() and remove division"), the logic for energy consumption calculation has been modified. The actual calculation of cost is 10 * power * max_frequency / frequency instead of power * max_frequency / frequency. Therefore, the comment for cost has been updated to reflect the correct content. Fixes: 1b600da51073 ("PM: EM: Optimize em_cpu_energy() and remove division") Signed-off-by: Yaxiong Tian Reviewed-by: Lukasz Luba [ rjw: Added Fixes: tag ] Link: https://patch.msgid.link/20251230061534.816894-1-tianyaxiong@kylinos.cn Signed-off-by: Rafael J. Wysocki commit 79b95d74470dd97d7d0908d5a3c0734a23e51aa4 Merge: 108b661c79111e d7f6629bffdcb9 Author: Linus Torvalds Date: Thu Jan 8 07:44:48 2026 -0800 Merge tag 'hid-for-linus-2026010801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - build fix for HID-BPF (Benjamin Tissoires) - fix for potential buffer overflow in i2c-hid (Kwok Kin Ming) - a couple of selftests/hid fixes (Peter Hutterer) - fix for handling pressure pads in hid-multitouch (Peter Hutterer) - fix for potential NULL pointer dereference in intel-thc-hid (Even Xu) - fix for interrupt delay control in intel-thc-hid (Even Xu) - fix finger release detection on some VTL-class touchpads (DaytonCL) - fix for correct enumeration on intel-ish-hid systems with no sensors (Zhang Lixu) - assorted device ID additions and device-specific quirks * tag 'hid-for-linus-2026010801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (21 commits) HID: logitech: add HID++ support for Logitech MX Anywhere 3S HID: Elecom: Add support for ELECOM M-XT3DRBK (018C) HID: quirks: work around VID/PID conflict for appledisplay HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() selftests/hid: add a test for the Digitizer/Button Type pressurepad selftests/hid: use a enum class for the different button types selftests/hid: require hidtools 0.12 HID: multitouch: set INPUT_PROP_PRESSUREPAD based on Digitizer/Button Type HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer hid: intel-thc-hid: Select SGL_ALLOC selftests/hid: fix bpf compilations due to -fms-extensions HID: bpf: fix bpf compilation with -fms-extensions HID: Intel-thc-hid: Intel-thc: Fix wrong register reading HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL HID: intel-ish-hid: Reset enum_devices_done before enumeration HID: intel-ish-hid: Update ishtp bus match to support device ID table HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value HID: playstation: Center initial joystick axes to prevent spurious events ... commit 7f6721b767e219343cfe9a894f5bd869ff5b9d3a Author: Andy Yan Date: Fri Jul 18 14:41:14 2025 +0800 drm/rockchip: vop2: Only wait for changed layer cfg done when there is pending cfgdone bits The write of cfgdone bits always done at .atomic_flush. When userspace makes plane zpos changes of two crtc within one commit, at the .atomic_begin stage, crtcN will never receive the "layer change cfg done" event of crtcM because crtcM has not yet written "cfgdone". So only wait when there is pending cfgdone bits to avoid long timeout. Fixes: 3e89a8c68354 ("drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568") Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20250718064120.8811-2-andyshrk@163.com commit 108b661c79111ec163edb999825718aa57c3452d Merge: f0b9d8eb98dfee 9ed7a28225af02 Author: Linus Torvalds Date: Thu Jan 8 07:42:16 2026 -0800 Merge tag 'sound-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small device-specific fixes: - ASoC Intel topology fixes for conflicting Bluetooth bits - Cleanups of ASoC drivers for superfluous NULL checks - Fix for error handling in the AC97 bus - A regression fix for TAS2781 speaker ID handling - HD-audio quirks" * tag 'sound-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 ALSA: hda/tas2781: properly initialize speaker_id for TAS2563 ALSA: ac97: fix a double free in snd_ac97_controller_register() ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks ASoC: codecs: pm4125: clean up bind() device reference handling ASoC: soc_sdw_utils: drop bogus container_of() error handling ASoC: codecs: wcd937x: drop bogus container_of() error handling ASoC: codecs: pm4125: drop bogus container_of() error handling ASoC: SOF: Intel: add -bt tplg suffix if BT is present ASoC: Intel: sof_sdw: shift SSP BT mask bits. commit 9fae82450d8a5f9c8fa016cd15186e975609b2ac Author: Andy Yan Date: Fri Jul 18 14:41:13 2025 +0800 drm/rockchip: vop2: Add delay between poll registers According to the implementation of read_poll_timeout_atomic, if the delay time is 0, it will only use a simple loop based on timeout_us to decrement the count. Therefore, the final timeout time will differ significantly from the set timeout time. So, here we set a specific delay time to ensure that the calculation of the timeout duration is accurate. Fixes: 3e89a8c68354 ("drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568") Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20250718064120.8811-1-andyshrk@163.com commit 36f597bba049928004a050c132ab787ba0eba524 Author: Bartosz Golaszewski Date: Thu Jan 8 11:23:14 2026 +0100 gpiolib: fix lookup table matching If on any iteration in gpiod_find(), gpio_desc_table_match() returns NULL (which is normal and expected), we never reinitialize desc back to ERR_PTR(-ENOENT) and if we don't find a match later on, we will return NULL causing a NULL-pointer dereference in users not expecting it. Don't initialize desc, but return ERR_PTR(-ENOENT) explicitly at the end of the function. Fixes: 9700b0fccf38 ("gpiolib: allow multiple lookup tables per consumer") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/ Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20260108102314.18816-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit b7e26c8bdae70832d7c4b31ec2995b1812a60169 Author: Matthew Schwartz Date: Thu Jan 8 01:36:50 2026 -0800 ALSA: hda/tas2781: Skip UEFI calibration on ASUS ROG Xbox Ally X There is currently an issue with UEFI calibration data parsing for some TAS devices, like the ASUS ROG Xbox Ally X (RC73XA), that causes audio quality issues such as gaps in playback. Until the issue is root caused and fixed, add a quirk to skip using the UEFI calibration data and fall back to using the calibration data provided by the DSP firmware, which restores full speaker functionality on affected devices. Cc: stable@vger.kernel.org # 6.18 Link: https://lore.kernel.org/all/160aef32646c4d5498cbfd624fd683cc@ti.com/ Closes: https://lore.kernel.org/all/0ba100d0-9b6f-4a3b-bffa-61abe1b46cd5@linux.dev/ Suggested-by: Baojun Xu Signed-off-by: Matthew Schwartz Reviewed-by: Antheas Kapenekakis Link: https://patch.msgid.link/20260108093650.1142176-1-matthew.schwartz@linux.dev Signed-off-by: Takashi Iwai commit 85829b80ca29d3ac6c1770dbe12306a1d960a8ac Author: Mauro Carvalho Chehab Date: Tue Jan 6 11:24:26 2026 +0100 MAINTAINERS: add cper to APEI files The CPER records are defined as part of UEFI specs, but its primary way to report it is via APEI/GHES. As such, let's place it under the same umbrella to make easier for patch review. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ard Biesheuvel commit a203dbeeca15a9b924f0d51f510921f4bae96801 Author: Baochen Qiang Date: Mon Dec 22 10:29:07 2025 +0800 wifi: mac80211: collect station statistics earlier when disconnect In __sta_info_destroy_part2(), station statistics are requested after the IEEE80211_STA_NONE -> IEEE80211_STA_NOTEXIST transition. This is problematic because the driver may be unable to handle the request due to the STA being in the NOTEXIST state (i.e. if the driver destroys the underlying data when transitioning to NOTEXIST). Move the statistics collection to before the state transition to avoid this issue. Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20251222-mac80211-move-station-stats-collection-earlier-v1-1-12cd4e42c633@oss.qualcomm.com Signed-off-by: Johannes Berg commit d594cc6f2c588810888df70c83a9654b6bc7942d Author: Johannes Berg Date: Tue Dec 16 11:52:42 2025 +0100 wifi: mac80211: restore non-chanctx injection behaviour During the transition to use channel contexts throughout, the ability to do injection while in monitor mode concurrent with another interface was lost, since the (virtual) monitor won't have a chanctx assigned in this scenario. It's harder to fix drivers that actually transitioned to using channel contexts themselves, such as mt76, but it's easy to do those that are (still) just using the emulation. Do that. Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=218763 Reported-and-tested-by: Oscar Alfonso Diaz Fixes: 0a44dfc07074 ("wifi: mac80211: simplify non-chanctx drivers") Link: https://patch.msgid.link/20251216105242.18366-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 6f385937160174b31a5e4105e759406f0b128494 Author: Benjamin Berg Date: Wed Jan 7 14:38:05 2026 +0100 wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock The hwsim_radio_lock spinlock expects bottom-half to be disabled, fix the call in mac80211_hwsim_nan_stop to ensure BHs are disabled. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20260107143805.ce7406511608.I688f8b19346e94c1f8de0cdadde072054d4b861c@changeid Signed-off-by: Johannes Berg commit c0d82ba9612fb65a8394af639f1427dbe87fb788 Author: Miri Korenblit Date: Wed Jan 7 14:37:36 2026 +0100 wifi: mac80211: don't iterate not running interfaces for_each_chanctx_user_* was introdcued as a replacement for for_each_sdata_link, which visits also other chanctx users that are not link. for_each_sdata_link skips not running interfaces, do the same for for_each_chanctx_user_* Fixes: 1ce954c98b89 ("wifi: mac80211: add and use chanctx usage iteration") Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107143736.55c084e2a976.I38b7b904a135dadca339321923b501b2c2c5c8c0@changeid Signed-off-by: Johannes Berg commit 333418872bfecf4843f1ded7a4151685dfcf07d5 Author: Benjamin Berg Date: Wed Jan 7 14:36:51 2026 +0100 wifi: mac80211_hwsim: fix typo in frequency notification The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could result in a NULL pointer dereference in cfg80211_next_nan_dw_notif. Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device") Signed-off-by: Benjamin Berg Reviewed-by: Ilan Peer Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid Signed-off-by: Johannes Berg commit 21cbf883d073abbfe09e3924466aa5e0449e7261 Author: Eric Dumazet Date: Thu Jan 8 10:19:27 2026 +0000 wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 length; /* number of fields or size in bytes */ __u16 flags; /* Optional params */ }; Make sure to zero the structure to avoid disclosing 32bits of kernel data to user space. Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c") Reported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com Signed-off-by: Johannes Berg commit 6e62d1c6f2c7dba31db976e60ca0d6edf96cf8d5 Author: Ard Biesheuvel Date: Fri Dec 5 10:32:16 2025 +0100 efi: Wipe INITRD config table from memory after consumption When the EFI stub itself loads the initrd and puts it in memory (rather than simply passing on a struct boot_params or device tree that already carries initrd information), it exposes this information to the core kernel via a INITRD configuration table. Given that config tables are preserved across kexec, this means that subsequent kexec boots will observe the same information, even though it most likely has become stale by that point. On x86, this information is usually superseded by the initrd info passed via bootparams, in which case this stale information is simply ignored. However, when performing a kexec boot without passing an initrd, the loader falls back to this stale information and explodes. So wipe the base and size from the INITRD config table as soon as it has been consumed. This fixes the issue for kexec on all EFI architectures. Reported-by: James Le Cuirot Tested-by: James Le Cuirot Acked-by: H. Peter Anvin (Intel) Link: https://lore.kernel.org/all/20251126173209.374755-2-chewi@gentoo.org Signed-off-by: Ard Biesheuvel commit d7f6629bffdcb962d383ef8c9a30afef81e997fe Author: Dennis Marttinen Date: Sun Jan 4 13:00:51 2026 +0000 HID: logitech: add HID++ support for Logitech MX Anywhere 3S I've acquired a Logitech MX Anywhere 3S mouse, which supports HID++ over Bluetooth. Adding its PID 0xb037 to the allowlist enables the additional features, such as high-resolution scrolling. Tested working across multiple machines, with a mix of Intel and Mediatek Bluetooth chips. [jkosina@suse.com: standardize shortlog] Signed-off-by: Dennis Marttinen Signed-off-by: Jiri Kosina commit 6abcf751bc084804a9e5b3051442e8a2ce67f48a Author: Lorenzo Bianconi Date: Mon Jan 5 09:43:31 2026 +0100 net: airoha: Fix schedule while atomic in airoha_ppe_deinit() airoha_ppe_deinit() runs airoha_npu_ppe_deinit() in atomic context. airoha_npu_ppe_deinit routine allocates ppe_data buffer with GFP_KERNEL flag. Rely on rcu_replace_pointer in airoha_ppe_deinit routine in order to fix schedule while atomic issue in airoha_npu_ppe_deinit() since we do not need atomic context there. Fixes: 00a7678310fe3 ("net: airoha: Introduce flowtable offload support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260105-airoha-fw-ethtool-v2-1-3b32b158cc31@kernel.org Signed-off-by: Paolo Abeni commit 94ad504e67cd3be94fa1b2fed0cb87da0d8f9396 Author: Nicolas Ferre Date: Fri Jan 2 18:01:31 2026 +0100 ARM: dts: microchip: sama7d65: fix size-cells property for i2c3 Fix the #size-cells property for i2c3 node and remove the dtbs_check error telling that "#size-cells: 0 was expected" from schema atmel,at91sam-i2c.yaml and i2c-controller.yaml. Fixes: b51e4aea3ecf ("ARM: dts: microchip: sama7d65: Add FLEXCOMs to sama7d65 SoC") Cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20260102170135.70717-3-nicolas.ferre@microchip.com Signed-off-by: Claudiu Beznea commit aabc977aa472ccf756372ae594d890022c19c9c8 Author: Hari Prasath Gujulan Elango Date: Fri Jan 2 18:01:30 2026 +0100 ARM: dts: microchip: sama7d65: fix the ranges property for flx9 Update the ranges property for the flexcom9 as per the datasheet and align with the reg property. Fixes: b51e4aea3ecf ("ARM: dts: microchip: sama7d65: Add FLEXCOMs to sama7d65 SoC") Cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Hari Prasath Gujulan Elango Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20260102170135.70717-2-nicolas.ferre@microchip.com Signed-off-by: Claudiu Beznea commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 Author: Jaroslav Kysela Date: Wed Jan 7 22:36:42 2026 +0100 ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer Handle the error code from snd_pcm_buffer_access_lock() in snd_pcm_runtime_buffer_set_silence() function. Found by Alexandros Panagiotou Fixes: 93a81ca06577 ("ALSA: pcm: Fix race of buffer access at PCM OSS layer") Cc: stable@vger.kernel.org # 6.15 Signed-off-by: Jaroslav Kysela Link: https://patch.msgid.link/20260107213642.332954-1-perex@perex.cz Signed-off-by: Takashi Iwai commit 70b8c45d8621c4d77b5659270e9a26ce7b1123cf Author: Randy Dunlap Date: Sat Jan 3 17:00:44 2026 -0800 arm: npcm: drop unused Kconfig ERRATA symbol The code for this errata was not merged. See https://lore.kernel.org/linux-arm-kernel/CAL_JsqK--G_7nO_UQ6jyomA1Sq6GUKtXVZpBF0dXjYA2iE047w@mail.gmail.com/ Fixes: 7bffa14c9aed ("arm: npcm: add basic support for Nuvoton BMCs") Signed-off-by: Randy Dunlap Signed-off-by: Andrew Jeffery commit 9df5fad801c5c568ee5f5dacd8b53565d88e4f02 Author: Deepanshu Kartikey Date: Wed Jan 7 07:40:37 2026 +0530 bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() BPF_MAP_TYPE_INSN_ARRAY maps store instruction pointers in their ips array, not string data. The map_direct_value_addr callback for this map type returns the address of the ips array, which is not suitable for use as a constant string argument. When a BPF program passes a pointer to an insn_array map value as ARG_PTR_TO_CONST_STR (e.g., to bpf_snprintf), the verifier's null-termination check in check_reg_const_str() operates on the wrong memory region, and at runtime bpf_bprintf_prepare() can read out of bounds searching for a null terminator. Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() since this map type is not designed to hold string data. Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2c29addf92581b410079 Tested-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Deepanshu Kartikey Acked-by: Anton Protopopov Link: https://lore.kernel.org/r/20260107021037.289644-1-kartikey406@gmail.com Signed-off-by: Alexei Starovoitov commit ef56578274d2b98423c8ef82bb450223f5811b59 Author: Michal Koutný Date: Wed Jan 7 17:59:41 2026 +0100 cgroup: Eliminate cgrp_ancestor_storage in cgroup_root The cgrp_ancestor_storage has two drawbacks: - it's not guaranteed that the member immediately follows struct cgrp in cgroup_root (root cgroup's ancestors[0] might thus point to a padding and not in cgrp_ancestor_storage proper), - this idiom raises warnings with -Wflex-array-member-not-at-end. Instead of relying on the auxiliary member in cgroup_root, define the 0-th level ancestor inside struct cgroup (needed for static allocation of cgrp_dfl_root), deeper cgroups would allocate flexible _low_ancestors[]. Unionized alias through ancestors[] will transparently join the two ranges. The above change would still leave the flexible array at the end of struct cgroup inside cgroup_root, so move cgrp also towards the end of cgroup_root to resolve the -Wflex-array-member-not-at-end. Link: https://lore.kernel.org/r/5fb74444-2fbb-476e-b1bf-3f3e279d0ced@embeddedor.com/ Reported-by: Gustavo A. R. Silva Closes: https://lore.kernel.org/r/b3eb050d-9451-4b60-b06c-ace7dab57497@embeddedor.com/ Cc: David Laight Acked-by: Gustavo A. R. Silva Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit f6eac56d6bf2026437b606a69aff903941282f9a Merge: a5f207e27207fb 6b2989ac5e8c49 Author: Dave Airlie Date: Thu Jan 8 09:50:08 2026 +1000 Merge tag 'amd-drm-fixes-6.19-2026-01-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2026-01-06: amdgpu: - Clang fixes - Navi1x PCIe DPM fixes - Ring reset fixes - ISP suspend fix - Analog DC fixes - VPE fixes - Mode1 reset fix radeon: - Variable sized array fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20260107223315.16095-1-alexander.deucher@amd.com commit 12adb969658ec39265eb8c7ea9e1856867fb9ceb Author: Arnoud Willemsen Date: Sun Dec 7 03:43:19 2025 +0100 HID: Elecom: Add support for ELECOM M-XT3DRBK (018C) Wireless/new version of the Elecom trackball mouse M-XT3DRBK has a product id that differs from the existing M-XT3DRBK. The report descriptor format also seems to have changed and matches other (newer?) models instead (except for six buttons instead of eight). This patch follows the same format as the patch for the M-XT3URBK (018F) by Naoki Ueki (Nov 3rd 2025) to enable the sixth mouse button. dmesg output: [ 292.074664] usb 1-2: new full-speed USB device number 7 using xhci_hcd [ 292.218667] usb 1-2: New USB device found, idVendor=056e, idProduct=018c, bcdDevice= 1.00 [ 292.218676] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 292.218679] usb 1-2: Product: ELECOM TrackBall Mouse [ 292.218681] usb 1-2: Manufacturer: ELECOM usbhid-dump output: 001:006:000:DESCRIPTOR 1765072638.050578 05 01 09 02 A1 01 09 01 A1 00 85 01 05 09 19 01 29 05 15 00 25 01 95 08 75 01 81 02 95 01 75 00 81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10 95 02 81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75 08 95 01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75 08 15 81 25 7F 81 06 C0 C0 06 01 FF 09 00 A1 01 85 02 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0 05 0C 09 01 A1 01 85 05 15 00 26 3C 02 19 00 2A 3C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85 03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95 01 75 05 81 01 C0 06 BC FF 09 88 A1 01 85 04 95 01 75 08 15 00 26 FF 00 19 00 2A FF 00 81 00 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00 75 08 95 07 B1 02 C0 Signed-off-by: Arnoud Willemsen Signed-off-by: Jiri Kosina commit c7fabe4ad9219866c203164a214c474c95b36bf2 Author: René Rebe Date: Fri Nov 28 13:46:41 2025 +0100 HID: quirks: work around VID/PID conflict for appledisplay For years I wondered why the Apple Cinema Display driver would not just work for me. Turns out the hidraw driver instantly takes it over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver. Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display") Signed-off-by: René Rebe Signed-off-by: Jiri Kosina commit 85a866809333cd2bf8ddac93d9a3e3ba8e4f807d Author: Rodrigo Lugathe da Conceição Alves Date: Thu Nov 27 19:03:57 2025 -0300 HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) The USB speaker has a bug that causes it to reboot when changing the brightness using the physical knob. Add a new vendor and product ID entry in hid-ids.h, and register the corresponding device in hid-quirks.c with the required quirk. Signed-off-by: Rodrigo Lugathe da Conceição Alves Reviewed-by: Terry Junge Signed-off-by: Jiri Kosina commit 6b2989ac5e8c496c1814d7961bee6f2d05382b3e Author: Mario Limonciello (AMD) Date: Sat Nov 29 19:46:31 2025 -0600 Reapply "Revert "drm/amd: Skip power ungate during suspend for VPE"" Skipping power ungate exposed some scenarios that will fail like below: ``` amdgpu: Register(0) [regVPEC_QUEUE_RESET_REQ] failed to reach value 0x00000000 != 0x00000001n amdgpu 0000:c1:00.0: amdgpu: VPE queue reset failed ... amdgpu: [drm] *ERROR* wait_for_completion_timeout timeout! ``` The underlying s2idle issue that prompted this commit is going to be fixed in BIOS. This reverts commit 2a6c826cfeedd7714611ac115371a959ead55bda. This was lost in the 6.19 merge so reapply it. Fixes: 2a6c826cfeed ("drm/amd: Skip power ungate during suspend for VPE") Signed-off-by: Mario Limonciello (AMD) Acked-by: Alex Deucher Reported-by: Konstantin Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220812 Reported-by: Matthew Schwartz Signed-off-by: Alex Deucher (cherry picked from commit 3925683515e93844be204381d2d5a1df5de34f31) commit eb236fb911ca0f4243124d8a285ec0453a99a8b4 Author: Alex Hung Date: Mon Dec 8 12:11:43 2025 -0700 drm/amd/display: Check NULL before calling dac_load_detection dac_load_detection can be NULL in some scenario, so checking it before calling. Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Chenyu Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 179176134b535246f0b368b30e8ecad50066f896) commit 0de604d0357d0d22cbf03af1077d174b641707b6 Author: Perry Yuan Date: Thu Dec 25 16:43:49 2025 +0800 drm/amd/pm: Disable MMIO access during SMU Mode 1 reset During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access MMIO registers during this window (e.g., from interrupt handlers or other driver threads) can result in uncompleted PCIe transactions, leading to NMI panics or system hangs. To prevent this, set the `no_hw_access` flag to true immediately after triggering the reset. This signals other driver components to skip register accesses while the device is offline. A memory barrier `smp_mb()` is added to ensure the flag update is globally visible to all cores before the driver enters the sleep/wait state. Signed-off-by: Perry Yuan Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher (cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4) commit a5f207e27207fbd3e4b5b466c73a6f9b1170fcf3 Merge: 50cf611b0bfa6c d5bdf88d1f9d1e Author: Dave Airlie Date: Thu Jan 8 07:40:42 2026 +1000 Merge tag 'drm-misc-fixes-2026-01-07' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc5: pl111: - Fix error handling in probe mediatek/atomic/tidss: - Fix tidss in another way and revert reordering of pre-enable and post-disable operations, as it breaks other bridge drivers. nouveau: - Fix regression from fwsec s/r fix. pci/vga: - Fix multiple gpu's being reported a 'boot_display' fb-helper: - Fix vblank timeout during suspend/reset Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/f50067e6-243a-4ed8-9781-1e4e4fdebc8e@linux.intel.com commit 50cf611b0bfa6c5bccfcd28dba32837c18ee3083 Merge: c4f2ae53863de2 8e6ad0dac6266c Author: Dave Airlie Date: Thu Jan 8 07:34:36 2026 +1000 Merge tag 'exynos-drm-fixes-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes One code cleanup . Replace system_wq with system_percpu_wq in the Exynos HDMI driver. system_wq is effectively a per-cpu workqueue, but its name does not make this explicit. Recent workqueue changes introduced system_percpu_wq to clarify semantics and support ongoing workqueue API refactoring. Signed-off-by: Dave Airlie From: Inki Dae Link: https://patch.msgid.link/20260107091154.27436-1-inki.dae@samsung.com commit b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0 Author: Martin Kaiser Date: Tue Dec 23 14:50:06 2025 +0100 riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceable, echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter may get the kernel into a deadlock. (Functions in sbi_ecall.c are excluded from tracing if CONFIG_RISCV_ALTERNATIVE_EARLY is set.) __sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code raises an IPI interrupt, which results in another call to __sbi_ecall and another snapshot... All it takes to get into this endless loop is one initial __sbi_ecall. On RISC-V systems without SSTC extension, the clock events in timer-riscv.c issue periodic sbi ecalls, making the problem easy to trigger. Always exclude the sbi_ecall.c functions from tracing to fix the potential deadlock. sbi ecalls can easiliy be logged via trace events, excluding ecall functions from function tracing is not a big limitation. Signed-off-by: Martin Kaiser Link: https://patch.msgid.link/20251223135043.1336524-1-martin@kaiser.cx Signed-off-by: Paul Walmsley commit bdb32359eab94013e80cf7e3d40a3fd4972da93a Author: Ilpo Järvinen Date: Mon Nov 24 19:04:11 2025 +0200 sparc/PCI: Correct 64-bit non-pref -> pref BAR resources SPARC T5-2 dts describes some PCI BARs as 64-bit resources without the pref(etchable) bit (0x83... vs 0xc3... in assigned-addresses) for address ranges above the 4G threshold. Such resources cannot be placed into a non-prefetchable PCI bridge window that is capable only of 32-bit addressing. As such, it looks like the platform is improperly described by the dts. The kernel detects this problem (see the IORESOURCE_PREFETCH check in pci_find_parent_resource()) and fails to assign these BAR resources to the resource tree due to lack of a compatible bridge window. Prior to 754babaaf333 ("sparc/PCI: Remove pcibios_enable_device() as they do nothing extra") SPARC arch code did not test whether device resources were successfully in the resource tree when enabling a device, effectively hiding the problem. After removing the arch-specific enable code, pci_enable_resources() refuses to enable the device when it finds not all mem resources are assigned, and therefore mpt3sas can't be enabled: pci 0001:04:00.0: reg 0x14: [mem 0x801110000000-0x80111000ffff 64bit] pci 0001:04:00.0: reg 0x1c: [mem 0x801110040000-0x80111007ffff 64bit] pci 0001:04:00.0: BAR 1 [mem 0x801110000000-0x80111000ffff 64bit]: can't claim; no compatible bridge window pci 0001:04:00.0: BAR 3 [mem 0x801110040000-0x80111007ffff 64bit]: can't claim; no compatible bridge window mpt3sas 0001:04:00.0: BAR 1 [mem size 0x00010000 64bit]: not assigned; can't enable device For clarity, this filtered log only shows failures for one mpt3sas device but other devices fail similarly. In the reported case, the end result with all the failures is an unbootable system. Things appeared to "work" before 754babaaf333 ("sparc/PCI: Remove pcibios_enable_device() as they do nothing extra") because the resource tree is agnostic to whether PCI BAR resources are properly in the tree or not. So as long as there was a parent resource (e.g. a root bus resource) that contains the address range, the resource tree code just places resource request underneath it without any consideration to the intermediate BAR resource. While it worked, it's incorrect setup still. Add an OF fixup to set the IORESOURCE_PREFETCH flag for a 64-bit PCI resource that has the end address above 4G requiring placement into the prefetchable window. Also log the issue. Fixes: 754babaaf333 ("sparc/PCI: Remove pcibios_enable_device() as they do nothing extra") Reported-by: Nathaniel Roach Closes: https://github.com/sparclinux/issues/issues/22 Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Nathaniel Roach Link: https://patch.msgid.link/20251124170411.3709-1-ilpo.jarvinen@linux.intel.com commit 957afeb99b111b672b3529a737fe19b95daaf1a2 Author: Yunhui Cui Date: Tue Dec 16 09:47:19 2025 +0800 riscv: remove irqflags.h inclusion in asm/bitops.h The arch/riscv/include/asm/bitops.h does not functionally require including /linux/irqflags.h. Additionally, adding arch/riscv/include/asm/percpu.h causes a circular inclusion: kernel/bounds.c ->include/linux/log2.h ->include/linux/bitops.h ->arch/riscv/include/asm/bitops.h ->include/linux/irqflags.h ->include/linux/find.h ->return val ? __ffs(val) : size; ->arch/riscv/include/asm/bitops.h The compilation log is as follows: CC kernel/bounds.s In file included from ./include/linux/bitmap.h:11, from ./include/linux/cpumask.h:12, from ./arch/riscv/include/asm/processor.h:55, from ./arch/riscv/include/asm/thread_info.h:42, from ./include/linux/thread_info.h:60, from ./include/asm-generic/preempt.h:5, from ./arch/riscv/include/generated/asm/preempt.h:1, from ./include/linux/preempt.h:79, from ./arch/riscv/include/asm/percpu.h:8, from ./include/linux/irqflags.h:19, from ./arch/riscv/include/asm/bitops.h:14, from ./include/linux/bitops.h:68, from ./include/linux/log2.h:12, from kernel/bounds.c:13: ./include/linux/find.h: In function 'find_next_bit': ./include/linux/find.h:66:30: error: implicit declaration of function '__ffs' [-Wimplicit-function-declaration] 66 | return val ? __ffs(val) : size; | ^~~~~ Signed-off-by: Yunhui Cui Acked-by: Yury Norov (NVIDIA) Link: https://patch.msgid.link/20251216014721.42262-2-cuiyunhui@bytedance.com Signed-off-by: Paul Walmsley commit 2ca5bb54bde739b32ed42758fff8dc1025c1225f Author: Ben Dooks Date: Fri Jan 2 14:58:39 2026 +0000 riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int The print in sbi_cpu_stop() assumes smp_processor_id() returns an unsigned int, when it is actually an int. Fix the format string to avoid mismatch type warnings in rht pr_crit(). Signed-off-by: Ben Dooks Link: https://patch.msgid.link/20260102145839.657864-1-ben.dooks@codethink.co.uk Signed-off-by: Paul Walmsley commit 1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0 Author: Ben Dooks Date: Tue Jan 6 23:10:54 2026 +0000 trace: ftrace_dump_on_oops[] is not exported, make it static The ftrace_dump_on_oops string is not used outside of trace.c so make it static to avoid the export warning from sparse: kernel/trace/trace.c:141:6: warning: symbol 'ftrace_dump_on_oops' was not declared. Should it be static? Fixes: dd293df6395a2 ("tracing: Move trace sysctls into trace.c") Link: https://patch.msgid.link/20260106231054.84270-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Signed-off-by: Steven Rostedt (Google) commit 5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb Author: Steven Rostedt Date: Mon Jan 5 20:31:41 2026 -0500 tracing: Add recursion protection in kernel stack trace recording A bug was reported about an infinite recursion caused by tracing the rcu events with the kernel stack trace trigger enabled. The stack trace code called back into RCU which then called the stack trace again. Expand the ftrace recursion protection to add a set of bits to protect events from recursion. Each bit represents the context that the event is in (normal, softirq, interrupt and NMI). Have the stack trace code use the interrupt context to protect against recursion. Note, the bug showed an issue in both the RCU code as well as the tracing stacktrace code. This only handles the tracing stack trace side of the bug. The RCU fix will be handled separately. Link: https://lore.kernel.org/all/20260102122807.7025fc87@gandalf.local.home/ Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Joel Fernandes Cc: "Paul E. McKenney" Cc: Boqun Feng Link: https://patch.msgid.link/20260105203141.515cd49f@gandalf.local.home Reported-by: Yao Kai Tested-by: Yao Kai Fixes: 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") Signed-off-by: Steven Rostedt (Google) commit 5232196ff49be08350b27f1ba8e1fad87afc9cdf Author: Steven Rostedt Date: Fri Jan 2 14:31:48 2026 -0500 ftrace: Make ftrace_graph_ent depth field signed The code has integrity checks to make sure that depth never goes below zero. But the depth field has recently been converted to unsigned long from "int" (for alignment reasons). As unsigned long can never be less than zero, the integrity checks no longer work. Convert depth to long from unsigned long to allow the integrity checks to work again. Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers Cc: pengdonglin Link: https://patch.msgid.link/20260102143148.251c2e16@gandalf.local.home Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aS6kGi0maWBl-MjZ@stanley.mountain/ Fixes: f83ac7544fbf7 ("function_graph: Enable funcgraph-args and funcgraph-retaddr to work simultaneously") Signed-off-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) commit 6435ffd6c7fcba330dfa91c58dc30aed2df3d0bf Author: Wupeng Ma Date: Sun Dec 28 14:50:07 2025 +0800 ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free When user resize all trace ring buffer through file 'buffer_size_kb', then in ring_buffer_resize(), kernel allocates buffer pages for each cpu in a loop. If the kernel preemption model is PREEMPT_NONE and there are many cpus and there are many buffer pages to be freed, it may not give up cpu for a long time and finally cause a softlockup. To avoid it, call cond_resched() after each cpu buffer free as Commit f6bd2c92488c ("ring-buffer: Avoid softlockup in ring_buffer_resize()") does. Detailed call trace as follow: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 24-....: (14837 ticks this GP) idle=521c/1/0x4000000000000000 softirq=230597/230597 fqs=5329 rcu: (t=15004 jiffies g=26003221 q=211022 ncpus=96) CPU: 24 UID: 0 PID: 11253 Comm: bash Kdump: loaded Tainted: G EL 6.18.2+ #278 NONE pc : arch_local_irq_restore+0x8/0x20 arch_local_irq_restore+0x8/0x20 (P) free_frozen_page_commit+0x28c/0x3b0 __free_frozen_pages+0x1c0/0x678 ___free_pages+0xc0/0xe0 free_pages+0x3c/0x50 ring_buffer_resize.part.0+0x6a8/0x880 ring_buffer_resize+0x3c/0x58 __tracing_resize_ring_buffer.part.0+0x34/0xd8 tracing_resize_ring_buffer+0x8c/0xd0 tracing_entries_write+0x74/0xd8 vfs_write+0xcc/0x288 ksys_write+0x74/0x118 __arm64_sys_write+0x24/0x38 Cc: Link: https://patch.msgid.link/20251228065008.2396573-1-mawupeng1@huawei.com Signed-off-by: Wupeng Ma Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 7cc3fe8e754eb1b7d9876c8ae2ee77dd2fb47b6d Author: Julia Lawall Date: Fri Dec 26 12:05:31 2025 +0100 tracing: Drop unneeded assignment to soft_mode soft_mode is not read in the enable case, so drop the assignment. Drop also the comment text that refers to the assignment and realign the comment. Cc: "Paul E . McKenney" Cc: Gabriele Paoloni Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251226110531.4129794-1-Julia.Lawall@inria.fr Signed-off-by: Julia Lawall Signed-off-by: Steven Rostedt (Google) commit 003c03a4b40085784d5b661133d1124f7e587e02 Author: Lukas Bulwahn Date: Wed Jan 7 10:24:25 2026 +0100 riscv: configs: Clean up references to non-existing configs - Drop 'CONFIG_I2C_COMPAT is not set' (removed in commit 7e722083fcc3 ("i2c: Remove I2C_COMPAT config symbol and related code")) - Drop 'CONFIG_SCHED_DEBUG is not set' (removed in commit b52173065e0a ("sched/debug: Remove CONFIG_SCHED_DEBUG")) Signed-off-by: Lukas Bulwahn Link: https://patch.msgid.link/20260107092425.24737-1-lukas.bulwahn@redhat.com Signed-off-by: Paul Walmsley commit 2497ff38c530b1af0df5130ca9f5ab22c5e92f29 Author: Kwok Kin Ming Date: Thu Jan 1 02:18:26 2026 +0800 HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`. The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not). The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value. Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`. The impact is low since access to hidraw devices requires root. Signed-off-by: Kwok Kin Ming Signed-off-by: Benjamin Tissoires commit 3ea3b7891b21ce079cfc60dfd476ba59ee625a2b Author: Bartlomiej Kubik Date: Thu Dec 11 19:10:44 2025 +0100 drm/vmwgfx: Fix kernel-doc warnings for vmwgfx_fence Add missing descriptions for vmw_event_fence_action_seq_passed. This fixes the following warnings: drivers/gpu/drm/vmwgfx/vmwgfx_fence.c:526 function parameter 'f' not described in 'vmw_event_fence_action_seq_passed' drivers/gpu/drm/vmwgfx/vmwgfx_fence.c:526 function parameter 'cb' not described in 'vmw_event_fence_action_seq_passed' Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507040807.jKTxWGVQ-lkp@intel.com/ Signed-off-by: Bartlomiej Kubik Signed-off-by: Zack Rusin Link: https://lore.kernel.org/all/20251211181044.4098689-1-kubik.bartlomiej@gmail.com/ commit 60699ab7cbf0a4eb19929cce243002b39c67917d Author: Trond Myklebust Date: Fri Jan 2 18:55:08 2026 -0500 NFS/localio: Deal with page bases that are > PAGE_SIZE When resending requests, etc, the page base can quickly grow larger than the page size. Fixes: 091bdcfcece0 ("nfs/localio: refactor iocb and iov_iter_bvec initialization") Signed-off-by: Trond Myklebust Reviewed-by: Mike Snitzer commit 001945a777ec4de8610f646397a054c62d272c2d Author: Trond Myklebust Date: Fri Jan 2 16:01:06 2026 -0500 NFS/localio: Stop further I/O upon hitting an error If the call into the filesystem results in an I/O error, then the next chunk of data won't be contiguous with the end of the last successful chunk. So break out of the I/O loop and report the results. Currently the localio code will do this for a short read/write, but not for an error. Fixes: 6a218b9c3183 ("nfs/localio: do not issue misaligned DIO out-of-order") Signed-off-by: Trond Myklebust Reviewed-by: Mike Snitzer commit df56ddd057424d21483bd0bee4da3632706d6606 Author: Trond Myklebust Date: Tue Jan 6 11:54:32 2026 -0500 NFSv4.x: Directory delegations don't require any state recovery The state recovery code in nfs_end_delegation_return() is intended to allow regular files to recover cached open and lock state. It has no function for directory delegations, and may cause corruption. Fixes: 156b09482933 ("NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK") Signed-off-by: Trond Myklebust commit bf72b4b7bb7dbb643d204fa41e7463894a95999f Author: Haoxiang Li Date: Wed Dec 24 17:11:05 2025 +0800 drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() In vmw_compat_shader_add(), the return value check of vmw_shader_alloc() is not proper. Modify the check for the return pointer 'res'. Found by code review and compiled on ubuntu 20.04. Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn commit bf104037ebd5c1774fa736050a484c1f28cb2e6b Author: Rob Herring (Arm) Date: Mon Jan 5 11:40:02 2026 -0600 arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties "snps,tx_de_emphasis" is supposed to be a u8, not a u32. Since it is big endian, 0 will be read rather than 1. The DWC3 Linux driver simply ORs the value if "snps,tx_de_emphasis_quirk" is set, so the 2 properties have no effect. (The driver doesn't clear the field either which is another problem). "snps,gctl-reset-quirk" is not documented nor used in the driver, so drop it as well. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20260105174002.2997615-1-robh@kernel.org Signed-off-by: Arnd Bergmann commit c221cc877bd2e25fb496895f00eb21fbef1e9231 Merge: 51183d3ff553e6 89e87d0dc87eb3 Author: Arnd Bergmann Date: Wed Jan 7 17:48:59 2026 +0100 Merge tag 'imx-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.19: - A mba8mx fix from Alexander Stein to correct Ethernet PHY IRQ trigger type - An i.MX95 fix from Carlos Song to correct I3C2 pclk - A couple of imx8qm-mek changes from Haibo Chen to fix light sensor interrupt type and usdhc2 regulator configuration - An imx6q-ba16 change from Ian Ray to fix RTC interrupt level - An imx8mp-dhcom-som change from Marek Vasut to fix sporadic Ethernet link bouncing caused by interruptions on the PHY reference clock - A couple of imx8mp-tx8p changes from Maud Spierings to fix compatible and eqos nvmem-cells - An ARM i.MX fix from Rob Herring to correct mc13xxx LED node names - An imx8qm-ss-dma change from Sherry Sun to correct DMA channels for LPUART - A couple of imx95-toradex-smarc changes from Vitor Soares to fix ethphy1 interrupt and SMARC_SDIO_WP label position * tag 'imx-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: mba8mx: Fix Ethernet PHY IRQ support arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells arm64: dts: freescale: moduline-display: fix compatible dt-bindings: arm: fsl: moduline-display: fix compatible ARM: dts: imx6q-ba16: fix RTC interrupt level arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt arm64: dts: add off-on-delay-us for usdhc2 regulator arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level ARM: dts: nxp: imx: Fix mc13xxx LED node names arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP Signed-off-by: Arnd Bergmann commit 51183d3ff553e6bd101034e4c20bd20029316eba Author: Krzysztof Kozlowski Date: Tue Dec 23 15:27:28 2025 +0100 Documentation/process: maintainer-soc: Mark 'make' as commands Improve readability of the docs by marking 'make dtbs/dtbs_check' as shell commands. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251223142726.73417-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann commit 6efe5322f060099c8bc51aaee83b857394e42dd5 Author: Krzysztof Kozlowski Date: Tue Dec 23 15:27:27 2025 +0100 Documentation/process: maintainer-soc: Be more explicit about defconfig It is already documented but people still send noticeable amount of patches ignoring the rule - get_maintainers.pl does not work on arm64/configs/defconfig or any other shared ARM defconfig. Be more explicit, that one must not rely on typical/simple approach here for getting To/Cc list. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251223142726.73417-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Arnd Bergmann commit 902300d332a951b68dc1d75a2b55922f71dd36d5 Merge: c4c6db7ac54649 9a96cc8bbeefbc Author: Arnd Bergmann Date: Wed Jan 7 17:45:03 2026 +0100 Merge tag 'arm-soc/for-6.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes This pull request contains Broadcom ARM64-SoC Device Tree fixes for 6.19, please pull the following: - Andrea fixes the RP1 DeviceTree hierarchy and drop overlay support, this resolves a number of DTC warnings and other issues * tag 'arm-soc/for-6.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: rp1: drop RP1 overlay arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology misc: rp1: drop overlay support dt-bindings: misc: pci1de4,1: add required reg property for endpoint Signed-off-by: Arnd Bergmann commit 37a0cff4551c14aca4cfa6ef3f2f0e0f61d66825 Author: Ian Forbes Date: Wed Jan 7 09:20:59 2026 -0600 drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions Some of the warnings need to be reordered between these two functions in order to be correct. This has happened multiple times. Merging them solves this problem once and for all. Fixes: d6667f0ddf46 ("drm/vmwgfx: Fix handling of dumb buffers") Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20260107152059.3048329-1-ian.forbes@broadcom.com commit d9186faeae6efb7d0841a5e8eb213ff4c7966614 Author: Ian Forbes Date: Fri Nov 14 14:37:03 2025 -0600 drm/vmwgfx: Fix KMS with 3D on HW version 10 HW version 10 does not have GB Surfaces so there is no backing buffer for surface backed FBs. This would result in a nullptr dereference and crash the driver causing a black screen. Fixes: 965544150d1c ("drm/vmwgfx: Refactor cursor handling") Signed-off-by: Ian Forbes Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://patch.msgid.link/20251114203703.1946616-1-ian.forbes@broadcom.com commit 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd Author: Johannes Brüderl Date: Sun Dec 7 10:02:20 2025 +0100 usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor Add USB_QUIRK_NO_BOS quirk flag to skip requesting the BOS descriptor for devices that cannot handle it. Add Elgato 4K X (0fd9:009b) to the quirk table. This device hangs when the BOS descriptor is requested at SuperSpeed Plus (10Gbps). Link: https://bugzilla.kernel.org/show_bug.cgi?id=220027 Cc: stable Signed-off-by: Johannes Brüderl Link: https://patch.msgid.link/20251207090220.14807-1-johannes.bruederl@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1d32389dc52f6e0305228988243b61cbe687414d Author: Krzysztof Kozlowski Date: Tue Jan 6 19:50:14 2026 +0100 dt-bindings: usb: qcom,dwc3: Correct MSM8994 interrupts According to the reference manual, MSM8994 does have QUSB2 PHY and does not have DP/DM IRQs interrupts. It is also logical it has the same constraints as similar device: MSM8996. This fixes dtbs_check warnings like: msm8994-sony-xperia-kitakami-karin.dtb: usb@f92f8800 (qcom,msm8994-dwc3): interrupt-names:1: 'hs_phy_irq' was expected msm8994-sony-xperia-kitakami-karin.dtb: usb@f92f8800 (qcom,msm8994-dwc3): interrupt-names:2: 'dp_hs_phy_irq' was expected msm8994-sony-xperia-kitakami-karin.dtb: usb@f92f8800 (qcom,msm8994-dwc3): interrupt-names:3: 'dm_hs_phy_irq' was expected Fixes: 53c6d854be4e ("dt-bindings: usb: dwc3: Clean up hs_phy_irq in binding") Fixes: 6e762f7b8edc ("dt-bindings: usb: Introduce qcom,snps-dwc3") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260106185012.19551-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit db0635a30462f6dbdc7284a712f65ec5345a0caa Author: Krzysztof Kozlowski Date: Tue Jan 6 19:50:13 2026 +0100 dt-bindings: usb: qcom,dwc3: Correct IPQ5018 interrupts According to reference manual, IPQ5018 does not have QUSB2 PHY and its interrupts should rather match ones used in IPQ5332 (so power_event, eud_dmse_int_mx, eud_dpse_int_mx). Fixes: 53c6d854be4e ("dt-bindings: usb: dwc3: Clean up hs_phy_irq in binding") Fixes: 6e762f7b8edc ("dt-bindings: usb: Introduce qcom,snps-dwc3") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260106185012.19551-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 1366cd228b0c67b60a2c0c26ef37fe9f7cfedb7f Author: Arnaud Ferraris Date: Mon Jan 5 09:43:23 2026 +0100 tcpm: allow looking for role_sw device in the main node If ports are defined in the tcpc main node, fwnode_usb_role_switch_get() returns an error, meaning usb_role_switch_get() (which would succeed) never gets a chance to run as port->role_sw isn't NULL, causing a regression on devices where this is the case. Fix this by turning the NULL check into IS_ERR_OR_NULL(), so usb_role_switch_get() can actually run and the device get properly probed. Fixes: 2d8713f807a4 ("tcpm: switch check for role_sw device with fw_node") Cc: stable Reviewed-by: Heikki Krogerus Reviewed-by: Dragan Simic Signed-off-by: Arnaud Ferraris Link: https://patch.msgid.link/20260105-fix-ppp-power-v2-1-6924f5a41224@collabora.com Signed-off-by: Greg Kroah-Hartman commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 Author: Thinh Nguyen Date: Fri Jan 2 21:53:46 2026 +0000 usb: dwc3: Check for USB4 IP_NAME Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No functional change except checking for the IP_NAME here. The driver will treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4 will be introduced and checked separately. Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Link: https://patch.msgid.link/e6f1827754c7a7ddc5eb7382add20bfe3a9b312f.1767390747.git.Thinh.Nguyen@synopsys.com Signed-off-by: Greg Kroah-Hartman commit 9670db22e7ab4aefe2b2619589a47fef9d3e0c7e Author: Mikulas Patocka Date: Tue Jan 6 16:56:07 2026 +0100 blk-mq: avoid stall during boot due to synchronize_rcu_expedited On the kernel 6.19-rc, I am experiencing 15-second boot stall in a virtual machine when probing a virtio-scsi disk: [ 1.011641] SCSI subsystem initialized [ 1.013972] virtio_scsi virtio6: 16/0/0 default/read/poll queues [ 1.015983] scsi host0: Virtio SCSI HBA [ 1.019578] ACPI: \_SB_.GSIA: Enabled at IRQ 16 [ 1.020225] ahci 0000:00:1f.2: AHCI vers 0001.0000, 32 command slots, 1.5 Gbps, SATA mode [ 1.020228] ahci 0000:00:1f.2: 6/6 ports implemented (port mask 0x3f) [ 1.020230] ahci 0000:00:1f.2: flags: 64bit ncq only [ 1.024688] scsi host1: ahci [ 1.025432] scsi host2: ahci [ 1.025966] scsi host3: ahci [ 1.026511] scsi host4: ahci [ 1.028371] scsi host5: ahci [ 1.028918] scsi host6: ahci [ 1.029266] ata1: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23100 irq 16 lpm-pol 1 [ 1.029305] ata2: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23180 irq 16 lpm-pol 1 [ 1.029316] ata3: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23200 irq 16 lpm-pol 1 [ 1.029327] ata4: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23280 irq 16 lpm-pol 1 [ 1.029341] ata5: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23300 irq 16 lpm-pol 1 [ 1.029356] ata6: SATA max UDMA/133 abar m4096@0xfea23000 port 0xfea23380 irq 16 lpm-pol 1 [ 1.118111] scsi 0:0:0:0: Direct-Access QEMU QEMU HARDDISK 2.5+ PQ: 0 ANSI: 5 [ 1.348916] ata1: SATA link down (SStatus 0 SControl 300) [ 1.350713] ata2: SATA link down (SStatus 0 SControl 300) [ 1.351025] ata6: SATA link down (SStatus 0 SControl 300) [ 1.351160] ata5: SATA link down (SStatus 0 SControl 300) [ 1.351326] ata3: SATA link down (SStatus 0 SControl 300) [ 1.351536] ata4: SATA link down (SStatus 0 SControl 300) [ 1.449153] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input2 [ 16.483477] sd 0:0:0:0: Power-on or device reset occurred [ 16.483691] sd 0:0:0:0: [sda] 2097152 512-byte logical blocks: (1.07 GB/1.00 GiB) [ 16.483762] sd 0:0:0:0: [sda] Write Protect is off [ 16.483877] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 16.569225] sd 0:0:0:0: [sda] Attached SCSI disk I bisected it and it is caused by the commit 89e1fb7ceffd which introduces calls to synchronize_rcu_expedited. This commit replaces synchronize_rcu_expedited and kfree with a call to kfree_rcu_mightsleep, avoiding the 15-second delay. Signed-off-by: Mikulas Patocka Fixes: 89e1fb7ceffd ("blk-mq: fix potential uaf for 'queue_hw_ctx'") Reviewed-by: Uladzislau Rezki (Sony) Signed-off-by: Jens Axboe commit 2704024d83fa9eb8e5f16925aae340fd9d246694 Author: Tetsuo Handa Date: Wed Jan 7 19:41:43 2026 +0900 loop: add missing bd_abort_claiming in loop_set_status Commit 08e136ebd193 ("loop: don't change loop device under exclusive opener in loop_set_status") forgot to call bd_abort_claiming() when mutex_lock_killable() failed. Fixes: 08e136ebd193 ("loop: don't change loop device under exclusive opener in loop_set_status") Signed-off-by: Tetsuo Handa Signed-off-by: Jens Axboe commit f287ba5951a4b3a47305b64a3fcde5d0911adb9b Author: Peter Hutterer Date: Mon Dec 22 09:43:37 2025 +1000 selftests/hid: add a test for the Digitizer/Button Type pressurepad We have to resort to a bit of a hack: python-libevdev gets the properties from libevdev at module init time. If libevdev hasn't been rebuilt with the new property it won't be automatically populated. So we hack around this by constructing the property manually. Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires commit 4f36fdab084fcbe9c34bb51889e4b8c06d98fbaa Author: Peter Hutterer Date: Mon Dec 22 09:43:36 2025 +1000 selftests/hid: use a enum class for the different button types Instead of multiple spellings of a string-provided argument, let's make this a tad more type-safe and use an enum here. And while we do this fix the two wrong devices: - elan_04f3_313a (HP ZBook Fury 15) is discrete button pad - dell_044e_1220 (Dell Precision 7740) is a discrete button pad Equivalent hid-tools commit https://gitlab.freedesktop.org/libevdev/hid-tools/-/commit/8300a55bf4213c6a252cab8cb5b34c9ddb191625 Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires commit 1d6628f7f279131ac9efb743bcea7080666d7574 Author: Peter Hutterer Date: Mon Dec 22 09:43:35 2025 +1000 selftests/hid: require hidtools 0.12 Not all our tests really require it but since it's likely pip-installed anyway it's trivial to require the new version, just in case we want to start cleaning up other bits. Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires commit 2b29a90131bbb3d404e5bf5102af5ce98ccf96fe Author: Peter Hutterer Date: Mon Dec 22 09:43:34 2025 +1000 HID: multitouch: set INPUT_PROP_PRESSUREPAD based on Digitizer/Button Type A Digitizer/Button Type value of 1 indicates the device is a pressurepad, see https://learn.microsoft.com/en-us/windows-hardware/design/component-guidelines/touchpad-windows-precision-touchpad-collection#device-capabilities-feature-report Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires commit c06bc3557542307b9658fbd43cc946a14250347b Author: Chris Chiu Date: Fri Jan 2 06:56:43 2026 +0000 HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list Another Chicony Electronics HP 5MP Camera with USB ID 04F2:B882 reports a HID sensor interface that is not actually implemented. Add the device to the HID ignore list so the bogus sensor is never exposed to userspace. Then the system won't hang when runtime PM tries to wake the unresponsive device. Signed-off-by: Chris Chiu Signed-off-by: Benjamin Tissoires commit a9a917998d172ec117f9e9de1919174153c0ace4 Author: Even Xu Date: Fri Dec 26 11:39:53 2025 +0800 HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer Add DMA buffer readiness check before reading DMA buffer to avoid unexpected NULL pointer accessing. Signed-off-by: Even Xu Tested-by: Rui Zhang Signed-off-by: Benjamin Tissoires commit dd76788f9ec4f33f0f43838cac1304265d944328 Author: Tim Zimmermann Date: Fri Nov 28 08:54:22 2025 +0100 hid: intel-thc-hid: Select SGL_ALLOC intel-thc-dma.c uses sgl_alloc() resulting in a build failure if CONFIG_SGL_ALLOC is not enabled Signed-off-by: Tim Zimmermann Reviewed-by: Even Xu Signed-off-by: Benjamin Tissoires commit e03fb369b083ab66d72fb63fe7817e933c3d4a30 Author: Benjamin Tissoires Date: Tue Jan 6 16:30:55 2026 +0100 selftests/hid: fix bpf compilations due to -fms-extensions Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings due to MS extensions") The kernel is now built with -fms-extensions, therefore generated vmlinux.h contains types like: struct slab { .. struct freelist_counters; }; Use -fms-extensions and -Wno-microsoft-anon-tag flags to build bpf programs that #include "vmlinux.h" Signed-off-by: Benjamin Tissoires commit b7666c891cc7e1a157cd99bca737631c8be07504 Author: Benjamin Tissoires Date: Tue Jan 6 16:30:54 2026 +0100 HID: bpf: fix bpf compilation with -fms-extensions Similar to commit 835a50753579 ("selftests/bpf: Add -fms-extensions to bpf build flags") and commit 639f58a0f480 ("bpftool: Fix build warnings due to MS extensions") The kernel is now built with -fms-extensions, therefore generated vmlinux.h contains types like: struct slab { .. struct freelist_counters; }; Use -fms-extensions and -Wno-microsoft-anon-tag flags to build bpf programs that #include "vmlinux.h" Signed-off-by: Benjamin Tissoires commit 14adddc65340f2034751c95616861c0e888e2bb1 Author: Sebastian Reichel Date: Tue Oct 14 18:00:57 2025 +0200 drm/bridge: dw-hdmi-qp: Fix spurious IRQ on resume After resume from suspend to RAM, the following splash is generated if the HDMI driver is probed (independent of a connected cable): [ 1194.484052] irq 80: nobody cared (try booting with the "irqpoll" option) [ 1194.484074] CPU: 0 UID: 0 PID: 627 Comm: rtcwake Not tainted 6.17.0-rc7-g96f1a11414b3 #1 PREEMPT [ 1194.484082] Hardware name: Rockchip RK3576 EVB V10 Board (DT) [ 1194.484085] Call trace: [ 1194.484087] ... (stripped) [ 1194.484283] handlers: [ 1194.484285] [<00000000bc363dcb>] dw_hdmi_qp_main_hardirq [dw_hdmi_qp] [ 1194.484302] Disabling IRQ #80 Apparently the HDMI IP is losing part of its state while the system is suspended and generates spurious interrupts during resume. The bug has not yet been noticed, as system suspend does not yet work properly on upstream kernel with either the Rockchip RK3588 or RK3576 platform. Fixes: 128a9bf8ace2 ("drm/rockchip: Add basic RK3588 HDMI output support") Signed-off-by: Sebastian Reichel Reviewed-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251014-rockchip-hdmi-suspend-fix-v1-1-983fcbf44839@collabora.com commit 2fa0eaf78c4bb24c2b05a4db3e0d86a7dcd8fd9f Author: Ben Dooks Date: Tue Jan 6 22:58:46 2026 +0000 ASoC: ops: fix pointer types to be big-endian If manipulating big-endian data, make the pointers be big-endian instead of host-endian. This should stop the following sparse warnigns about endian-conversion: sound/soc/soc-ops.c:547:33: warning: invalid assignment: &= sound/soc/soc-ops.c:547:33: left side has type unsigned short sound/soc/soc-ops.c:547:33: right side has type restricted __be16 sound/soc/soc-ops.c:551:33: warning: invalid assignment: &= sound/soc/soc-ops.c:551:33: left side has type unsigned int sound/soc/soc-ops.c:551:33: right side has type restricted __be32 Signed-off-by: Ben Dooks Link: https://patch.msgid.link/20260106225846.83580-1-ben.dooks@codethink.co.uk Signed-off-by: Mark Brown commit 8e6ad0dac6266c5e13874e816b016759d7145500 Author: Marco Crivellari Date: Tue Nov 4 12:29:23 2025 +0100 drm/exynos: hdmi: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Inki Dae commit a80208072df8f4ceb53cd905c1f4362f84ce397f Author: Bartosz Golaszewski Date: Tue Jan 6 10:34:23 2026 +0100 gpio: shared: don't allocate the lookup table until we really need it We allocate memory for the GPIO lookup table at the top of gpio_shared_add_proxy_lookup() but we don't use it until the very end. Depending on the timing, we may return earlier. Move the allocation towards the end. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Tested-by: Mark Brown Link: https://lore.kernel.org/r/20260106-gpio-shared-fixes-v2-3-c7091d2f7581@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 476e44d06fc107f8cd99695d8e4f1c792dfc3379 Author: Bartosz Golaszewski Date: Tue Jan 6 10:34:22 2026 +0100 gpio: shared: fix a race condition When matching the reset-gpio reference with the actual firmware node consuming the GPIO, we also need to lock the structure associated with the latter as it can change while we're doing it. Due to triggering lockdep false-positives, we need to use a per-reference lockdep class but accidentally, this also allows us to remove the previous lockdep workaround for cleaner code. Fixes: 49416483a953 ("gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/ Tested-by: Mark Brown Link: https://lore.kernel.org/r/20260106-gpio-shared-fixes-v2-2-c7091d2f7581@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 0fe50631791bd3504dc7f32af6421bd4041f14aa Author: Bartosz Golaszewski Date: Tue Jan 6 10:34:21 2026 +0100 gpio: shared: assign the correct firmware node for reset-gpio use-case When we defer probe due to unlucky timing of adding the lookup table, we assign the matching firmware node to the shared reference for the future probing. However, the fwnode we assign is wrong so fix it and assign the one associated with the reset-gpio device. Fixes: 49416483a953 ("gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/ Tested-by: Mark Brown Link: https://lore.kernel.org/r/20260106-gpio-shared-fixes-v2-1-c7091d2f7581@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 20cf2aed89ac6d78a0122e31c875228e15247194 Author: Bartosz Golaszewski Date: Tue Jan 6 10:00:11 2026 +0100 gpio: rockchip: mark the GPIO controller as sleeping The GPIO controller is configured as non-sleeping but it uses generic pinctrl helpers which use a mutex for synchronization. This can cause the following lockdep splat with shared GPIOs enabled on boards which have multiple devices using the same GPIO: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 12, name: kworker/u16:0 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 6 locks held by kworker/u16:0/12: #0: ffff0001f0018d48 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x18c/0x604 #1: ffff8000842dbdf0 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x1b4/0x604 #2: ffff0001f18498f8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x38/0x1b0 #3: ffff0001f75f1e90 (&gdev->srcu){.+.?}-{0:0}, at: gpiod_direction_output_raw_commit+0x0/0x360 #4: ffff0001f46e3db8 (&shared_desc->spinlock){....}-{3:3}, at: gpio_shared_proxy_direction_output+0xd0/0x144 [gpio_shared_proxy] #5: ffff0001f180ee90 (&gdev->srcu){.+.?}-{0:0}, at: gpiod_direction_output_raw_commit+0x0/0x360 irq event stamp: 81450 hardirqs last enabled at (81449): [] _raw_spin_unlock_irqrestore+0x74/0x78 hardirqs last disabled at (81450): [] _raw_spin_lock_irqsave+0x84/0x88 softirqs last enabled at (79616): [] __alloc_skb+0x17c/0x1e8 softirqs last disabled at (79614): [] __alloc_skb+0x17c/0x1e8 CPU: 2 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.0-rc4-next-20260105+ #11975 PREEMPT Hardware name: Hardkernel ODROID-M1 (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x90/0xd0 dump_stack+0x18/0x24 __might_resched+0x144/0x248 __might_sleep+0x48/0x98 __mutex_lock+0x5c/0x894 mutex_lock_nested+0x24/0x30 pinctrl_get_device_gpio_range+0x44/0x128 pinctrl_gpio_direction+0x3c/0xe0 pinctrl_gpio_direction_output+0x14/0x20 rockchip_gpio_direction_output+0xb8/0x19c gpiochip_direction_output+0x38/0x94 gpiod_direction_output_raw_commit+0x1d8/0x360 gpiod_direction_output_nonotify+0x7c/0x230 gpiod_direction_output+0x34/0xf8 gpio_shared_proxy_direction_output+0xec/0x144 [gpio_shared_proxy] gpiochip_direction_output+0x38/0x94 gpiod_direction_output_raw_commit+0x1d8/0x360 gpiod_direction_output_nonotify+0x7c/0x230 gpiod_configure_flags+0xbc/0x480 gpiod_find_and_request+0x1a0/0x574 gpiod_get_index+0x58/0x84 devm_gpiod_get_index+0x20/0xb4 devm_gpiod_get_optional+0x18/0x30 rockchip_pcie_probe+0x98/0x380 platform_probe+0x5c/0xac really_probe+0xbc/0x298 Fixes: 936ee2675eee ("gpio/rockchip: add driver for rockchip gpio") Cc: stable@vger.kernel.org Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/d035fc29-3b03-4cd6-b8ec-001f93540bc6@samsung.com/ Acked-by: Heiko Stuebner Link: https://lore.kernel.org/r/20260106090011.21603-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 6acd4ac5f8f0ec9b946875553e52907700bcfc77 Author: Caleb Sander Mateos Date: Tue Jan 6 13:08:37 2026 -0700 block: don't merge bios with different app_tags nvme_set_app_tag() uses the app_tag value from the bio_integrity_payload of the struct request's first bio. This assumes all the request's bios have the same app_tag. However, it is possible for bios with different app_tag values to be merged into a single request. Add a check in blk_integrity_merge_{bio,rq}() to prevent the merging of bios/requests with different app_tag values if BIP_CHECK_APPTAG is set. Signed-off-by: Caleb Sander Mateos Fixes: 3d8b5a22d404 ("block: add support to pass user meta buffer") Signed-off-by: Jens Axboe commit 7d121d701d58a92f26decb10da1d04a88b74519d Author: Breno Leitao Date: Tue Jan 6 06:26:57 2026 -0800 blk-rq-qos: Remove unlikely() hints from QoS checks The unlikely() annotations on QUEUE_FLAG_QOS_ENABLED checks are counterproductive. Writeback throttling (WBT) might be enabled by default, mainly because CONFIG_BLK_WBT_MQ defaults to 'y'. Branch profiling on Meta servers, which have WBT enabled, confirms 100% misprediction rates on these checks. Remove the unlikely() annotations to let the CPU's branch predictor learn the actual behavior, potentially improving I/O path performance. Signed-off-by: Breno Leitao Signed-off-by: Jens Axboe commit 653267321f05316f159e05b3ef562aa700632db6 Merge: 353cfc0ef3f34e 75df712cddfd6c Author: Jakub Kicinski Date: Tue Jan 6 18:04:02 2026 -0800 Merge branch 'net-netdevsim-fix-inconsistent-carrier-state-after-link-unlink' Yohei Kojima says: ==================== net: netdevsim: fix inconsistent carrier state after link/unlink This series fixes netdevsim's inconsistent behavior between carrier and link/unlink state. More specifically, this fixes a bug that the carrier goes DOWN although two netdevsim were peered, depending on the order of peering and ifup. Especially in a NetworkManager-enabled environment, netdevsim test fails because of this. The first patch fixes the bug itself in netdevsim/bus.c by adding netif_carrier_on() into a proper function. The second patch adds a regression test for this bug. ==================== Link: https://patch.msgid.link/cover.1767624906.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit 75df712cddfd6c76e0e255584766385648ad9529 Author: Yohei Kojima Date: Tue Jan 6 00:17:33 2026 +0900 selftests: netdevsim: add carrier state consistency test This commit adds a test case for netdevsim carrier state consistency. Specifically, the added test verifies the carrier state during the following operations: 1. Unlink two netdevsims 2. ifdown one netdevsim, then ifup again 3. Link the netdevsims again 4. ifdown one netdevsim, then ifup again These steps verifies that the carrier is UP iff two netdevsims are linked and ifuped. Signed-off-by: Yohei Kojima Link: https://patch.msgid.link/481e2729e53b6074ebfc0ad85764d8feb244de8c.1767624906.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit d83dddffe1904e4a576d11a541878850a8e64cd2 Author: Yohei Kojima Date: Tue Jan 6 00:17:32 2026 +0900 net: netdevsim: fix inconsistent carrier state after link/unlink This patch fixes the edge case behavior on ifup/ifdown and linking/unlinking two netdevsim interfaces: 1. unlink two interfaces netdevsim1 and netdevsim2 2. ifdown netdevsim1 3. ifup netdevsim1 4. link two interfaces netdevsim1 and netdevsim2 5. (Now two interfaces are linked in terms of netdevsim peer, but carrier state of the two interfaces remains DOWN.) This inconsistent behavior is caused by the current implementation, which only cares about the "link, then ifup" order, not "ifup, then link" order. This patch fixes the inconsistency by calling netif_carrier_on() when two netdevsim interfaces are linked. This patch fixes buggy behavior on NetworkManager-based systems which causes the netdevsim test to fail with the following error: # timeout set to 600 # selftests: drivers/net/netdevsim: peer.sh # 2025/12/25 00:54:03 socat[9115] W address is opened in read-write mode but only supports read-only # 2025/12/25 00:56:17 socat[9115] W connect(7, AF=2 192.168.1.1:1234, 16): Connection timed out # 2025/12/25 00:56:17 socat[9115] E TCP:192.168.1.1:1234: Connection timed out # expected 3 bytes, got 0 # 2025/12/25 00:56:17 socat[9109] W exiting on signal 15 not ok 13 selftests: drivers/net/netdevsim: peer.sh # exit=1 This patch also solves timeout on TCP Fast Open (TFO) test in NetworkManager-based systems because it also depends on netdevsim's carrier consistency. Fixes: 1a8fed52f7be ("netdevsim: set the carrier when the device goes up") Signed-off-by: Yohei Kojima Reviewed-by: Breno Leitao Link: https://patch.msgid.link/602c9e1ba5bb2ee1997bb38b1d866c9c3b807ae9.1767624906.git.yk@y-koj.net Signed-off-by: Jakub Kicinski commit 353cfc0ef3f34ef7fe313ae38dac37f2454a7cf5 Author: Gal Pressman Date: Mon Jan 5 18:33:19 2026 +0200 selftests: drv-net: Bring back tool() to driver __init__s The pp_alloc_fail.py test (which doesn't run in NIPA CI?) uses tool, add back the import. Resolves: ImportError: cannot import name 'tool' from 'lib.py' Fixes: 68a052239fc4 ("selftests: drv-net: update remaining Python init files") Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20260105163319.47619-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit adb25a46dc0a43173f5ea5f5f58fc8ba28970c7c Author: Shivani Gupta Date: Mon Jan 5 00:59:05 2026 +0000 net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot reported a crash in tc_act_in_hw() during netns teardown where tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action pointer, leading to an invalid dereference. Guard against ERR_PTR entries when iterating the action IDR so teardown does not call tc_act_in_hw() on an error pointer. Fixes: 84a7d6797e6a ("net/sched: acp_api: no longer acquire RTNL in tc_action_net_exit()") Link: https://syzkaller.appspot.com/bug?extid=8f1c492ffa4644ff3826 Reported-by: syzbot+8f1c492ffa4644ff3826@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8f1c492ffa4644ff3826 Signed-off-by: Shivani Gupta Link: https://patch.msgid.link/20260105005905.243423-1-shivani07g@gmail.com Signed-off-by: Jakub Kicinski commit 13ff3e724207f579d3c814ee05516fefcb4f32e8 Author: Maxime Chevallier Date: Mon Jan 5 16:18:39 2026 +0100 net: sfp: return the number of written bytes for smbus single byte access We expect the SFP write accessors to return the number of written bytes. We fail to do so for single-byte smbus accesses, which may cause errors when setting a module's high-power state and for some cotsworks modules. Let's return the amount of written bytes, as expected. Fixes: 7662abf4db94 ("net: phy: sfp: Add support for SMBus module access") Signed-off-by: Maxime Chevallier Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260105151840.144552-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit e5c8eda39a9fc1547d1398d707aa06c1d080abdd Author: Eric Dumazet Date: Mon Jan 5 09:36:30 2026 +0000 udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path does not use skb->destructor. But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb(). This then triggers this warning in skb_attempt_defer_free(): DEBUG_NET_WARN_ON_ONCE(skb->destructor); We must call skb_orphan() to fix this issue. Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()") Reported-by: syzbot+3e68572cf2286ce5ebe9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695b83bd.050a0220.1c9965.002b.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260105093630.1976085-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7801edc9badd972cb62cf11c0427e70b6dca239d Author: Vladimir Oltean Date: Sun Jan 4 11:39:52 2026 +0200 Revert "dsa: mv88e6xxx: make serdes SGMII/Fiber tx amplitude configurable" This reverts commit 926eae604403acfa27ba5b072af458e87e634a50, which never could have produced the intended effect: https://lore.kernel.org/netdev/AM0PR06MB10396BBF8B568D77556FC46F8F7DEA@AM0PR06MB10396.eurprd06.prod.outlook.com/ The reason why it is broken beyond repair in this form is that the mv88e6xxx driver outsources its "tx-p2p-microvolt" property to the OF node of an external Ethernet PHY. This: (a) does not work if there is no external PHY (chip-to-chip connection, or SFP module) (b) pollutes the OF property namespace / bindings of said external PHY ("tx-p2p-microvolt" could have meaning for the Ethernet PHY's SerDes interface as well) We can revisit the idea of making SerDes amplitude configurable once we have proper bindings for the mv88e6xxx SerDes. Until then, remove the code that leaves us with unnecessary baggage. Fixes: 926eae604403 ("dsa: mv88e6xxx: make serdes SGMII/Fiber tx amplitude configurable") Cc: Holger Brunck Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260104093952.486606-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 44694ffaa4e27dbda1120abfafa00732f2d52760 Author: Shyam Sundar S K Date: Thu Dec 11 16:58:31 2025 +0530 MAINTAINERS: Add an additional maintainer to the AMD XGBE driver Add Raju Rangoju as an additional maintainer to support the AMD XGBE network device driver. Signed-off-by: Shyam Sundar S K Acked-by: Raju Rangoju Link: https://patch.msgid.link/20251211112831.1781030-1-Shyam-sundar.S-k@amd.com Signed-off-by: Jakub Kicinski commit 4648fb2f2e7210c53b85220ee07d42d1e4bae3f9 Author: Larysa Zaremba Date: Mon Nov 17 08:03:49 2025 +0100 idpf: fix aux device unplugging when rdma is not supported by vport If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not allocate vdev_info for this vport. This leads to kernel NULL pointer dereference in idpf_idc_vport_dev_down(), which references vdev_info for every vport regardless. Check, if vdev_info was ever allocated before unplugging aux device. Fixes: be91128c579c ("idpf: implement RDMA vport auxiliary dev create, init, and destroy") Reviewed-by: Madhu Chittim Signed-off-by: Larysa Zaremba Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Tested-by: Krishneil Singh Signed-off-by: Tony Nguyen commit 086efe0a1ecc36cffe46640ce12649a4cd3ff171 Author: Joshua Hay Date: Mon Nov 3 13:20:36 2025 -0800 idpf: cap maximum Rx buffer size The HW only supports a maximum Rx buffer size of 16K-128. On systems using large pages, the libeth logic can configure the buffer size to be larger than this. The upper bound is PAGE_SIZE while the lower bound is MTU rounded up to the nearest power of 2. For example, ARM systems with a 64K page size and an mtu of 9000 will set the Rx buffer size to 16K, which will cause the config Rx queues message to fail. Initialize the bufq/fill queue buf_len field to the maximum supported size. This will trigger the libeth logic to cap the maximum Rx buffer size by reducing the upper bound. Fixes: 74d1412ac8f37 ("idpf: use libeth Rx buffer management for payload buffer") Signed-off-by: Joshua Hay Acked-by: Alexander Lobakin Reviewed-by: Madhu Chittim Reviewed-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Reviewed-by: David Decotigny Signed-off-by: Tony Nguyen commit 87b8ee64685bc096a087af833d4594b2332bfdb1 Author: Sreedevi Joshi Date: Tue Dec 2 17:12:46 2025 -0600 idpf: Fix error handling in idpf_vport_open() Fix error handling to properly cleanup interrupts when idpf_vport_queue_ids_init() or idpf_rx_bufs_init_all() fail. Jump to 'intr_deinit' instead of 'queues_rel' to ensure interrupts are cleaned up before releasing other resources. Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport") Signed-off-by: Sreedevi Joshi Reviewed-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit ebecca5b093895da801b3eba1a55b4ec4027d196 Author: Sreedevi Joshi Date: Mon Nov 24 12:47:50 2025 -0600 idpf: Fix RSS LUT NULL ptr issue after soft reset During soft reset, the RSS LUT is freed and not restored unless the interface is up. If an ethtool command that accesses the rss lut is attempted immediately after reset, it will result in NULL ptr dereference. Also, there is no need to reset the rss lut if the soft reset does not involve queue count change. After soft reset, set the RSS LUT to default values based on the updated queue count only if the reset was a result of a queue count change and the LUT was not configured by the user. In all other cases, don't touch the LUT. Steps to reproduce: ** Bring the interface down (if up) ifconfig eth1 down ** update the queue count (eg., 27->20) ethtool -L eth1 combined 20 ** display the RSS LUT ethtool -x eth1 [82375.558338] BUG: kernel NULL pointer dereference, address: 0000000000000000 [82375.558373] #PF: supervisor read access in kernel mode [82375.558391] #PF: error_code(0x0000) - not-present page [82375.558408] PGD 0 P4D 0 [82375.558421] Oops: Oops: 0000 [#1] SMP NOPTI [82375.558516] RIP: 0010:idpf_get_rxfh+0x108/0x150 [idpf] [82375.558786] Call Trace: [82375.558793] [82375.558804] rss_prepare.isra.0+0x187/0x2a0 [82375.558827] rss_prepare_data+0x3a/0x50 [82375.558845] ethnl_default_doit+0x13d/0x3e0 [82375.558863] genl_family_rcv_msg_doit+0x11f/0x180 [82375.558886] genl_rcv_msg+0x1ad/0x2b0 [82375.558902] ? __pfx_ethnl_default_doit+0x10/0x10 [82375.558920] ? __pfx_genl_rcv_msg+0x10/0x10 [82375.558937] netlink_rcv_skb+0x58/0x100 [82375.558957] genl_rcv+0x2c/0x50 [82375.558971] netlink_unicast+0x289/0x3e0 [82375.558988] netlink_sendmsg+0x215/0x440 [82375.559005] __sys_sendto+0x234/0x240 [82375.559555] __x64_sys_sendto+0x28/0x30 [82375.560068] x64_sys_call+0x1909/0x1da0 [82375.560576] do_syscall_64+0x7a/0xfa0 [82375.561076] ? clear_bhb_loop+0x60/0xb0 [82375.561567] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks") Signed-off-by: Sreedevi Joshi Reviewed-by: Aleksandr Loktionov Reviewed-by: Sridhar Samudrala Reviewed-by: Emil Tantilov Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 445b49d13787da2fe8d51891ee196e5077feef44 Author: Sreedevi Joshi Date: Mon Nov 24 12:47:49 2025 -0600 idpf: Fix RSS LUT configuration on down interfaces RSS LUT provisioning and queries on a down interface currently return silently without effect. Users should be able to configure RSS settings even when the interface is down. Fix by maintaining RSS configuration changes in the driver's soft copy and deferring HW programming until the interface comes up. Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks") Signed-off-by: Sreedevi Joshi Reviewed-by: Aleksandr Loktionov Reviewed-by: Sridhar Samudrala Reviewed-by: Emil Tantilov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 83f38f210b85676f40ba8586b5a8edae19b56995 Author: Sreedevi Joshi Date: Mon Nov 24 12:47:48 2025 -0600 idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed before the interface is brought up for the first time. Move RSS LUT initialization from ndo_open to vport creation to ensure LUT is always available. This enables RSS configuration via ethtool before bringing the interface up. Simplify LUT management by maintaining all changes in the driver's soft copy and programming zeros to the indirection table when rxhash is disabled. Defer HW programming until the interface comes up if it is down during rxhash and LUT configuration changes. Steps to reproduce: ** Load idpf driver; interfaces will be created modprobe idpf ** Before bringing the interfaces up, turn rxhash off ethtool -K eth2 rxhash off [89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000 [89408.371908] #PF: supervisor read access in kernel mode [89408.371924] #PF: error_code(0x0000) - not-present page [89408.371940] PGD 0 P4D 0 [89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI [89408.372052] RIP: 0010:memcpy_orig+0x16/0x130 [89408.372310] Call Trace: [89408.372317] [89408.372326] ? idpf_set_features+0xfc/0x180 [idpf] [89408.372363] __netdev_update_features+0x295/0xde0 [89408.372384] ethnl_set_features+0x15e/0x460 [89408.372406] genl_family_rcv_msg_doit+0x11f/0x180 [89408.372429] genl_rcv_msg+0x1ad/0x2b0 [89408.372446] ? __pfx_ethnl_set_features+0x10/0x10 [89408.372465] ? __pfx_genl_rcv_msg+0x10/0x10 [89408.372482] netlink_rcv_skb+0x58/0x100 [89408.372502] genl_rcv+0x2c/0x50 [89408.372516] netlink_unicast+0x289/0x3e0 [89408.372533] netlink_sendmsg+0x215/0x440 [89408.372551] __sys_sendto+0x234/0x240 [89408.372571] __x64_sys_sendto+0x28/0x30 [89408.372585] x64_sys_call+0x1909/0x1da0 [89408.372604] do_syscall_64+0x7a/0xfa0 [89408.373140] ? clear_bhb_loop+0x60/0xb0 [89408.373647] entry_SYSCALL_64_after_hwframe+0x76/0x7e [89408.378887] Fixes: a251eee62133 ("idpf: add SRIOV support and other ndo_ops") Signed-off-by: Sreedevi Joshi Reviewed-by: Sridhar Samudrala Reviewed-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 36aae2ea6bd76b8246caa50e34a4f4824f0a3be8 Author: Erik Gabriel Carrillo Date: Tue Sep 30 16:23:52 2025 -0500 idpf: fix issue with ethtool -n command display When ethtool -n is executed on an interface to display the flow steering rules, "rxclass: Unknown flow type" error is generated. The flow steering list maintained in the driver currently stores only the location and q_index but other fields of the ethtool_rx_flow_spec are not stored. This may be enough for the virtchnl command to delete the entry. However, when the ethtool -n command is used to query the flow steering rules, the ethtool_rx_flow_spec returned is not complete causing the error below. Resolve this by storing the flow spec (fsp) when rules are added and returning the complete flow spec when rules are queried. Also, change the return value from EINVAL to ENOENT when flow steering entry is not found during query by location or when deleting an entry. Add logic to detect and reject duplicate filter entries at the same location and change logic to perform upfront validation of all error conditions before adding flow rules through virtchnl. This avoids the need for additional virtchnl delete messages when subsequent operations fail, which was missing in the original upstream code. Example: Before the fix: ethtool -n eth1 2 RX rings available Total 2 rules rxclass: Unknown flow type rxclass: Unknown flow type After the fix: ethtool -n eth1 2 RX rings available Total 2 rules Filter: 0 Rule Type: TCP over IPv4 Src IP addr: 10.0.0.1 mask: 0.0.0.0 Dest IP addr: 0.0.0.0 mask: 255.255.255.255 TOS: 0x0 mask: 0xff Src port: 0 mask: 0xffff Dest port: 0 mask: 0xffff Action: Direct to queue 0 Filter: 1 Rule Type: UDP over IPv4 Src IP addr: 10.0.0.1 mask: 0.0.0.0 Dest IP addr: 0.0.0.0 mask: 255.255.255.255 TOS: 0x0 mask: 0xff Src port: 0 mask: 0xffff Dest port: 0 mask: 0xffff Action: Direct to queue 0 Fixes: ada3e24b84a0 ("idpf: add flow steering support") Signed-off-by: Erik Gabriel Carrillo Co-developed-by: Sreedevi Joshi Signed-off-by: Sreedevi Joshi Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Mina Almasry Signed-off-by: Tony Nguyen commit f9841bd28b600526ca4f6713b0ca49bf7bb98452 Author: Sreedevi Joshi Date: Tue Sep 30 16:23:51 2025 -0500 idpf: fix memory leak of flow steer list on rmmod The flow steering list maintains entries that are added and removed as ethtool creates and deletes flow steering rules. Module removal with active entries causes memory leak as the list is not properly cleaned up. Prevent this by iterating through the remaining entries in the list and freeing the associated memory during module removal. Add a spinlock (flow_steer_list_lock) to protect the list access from multiple threads. Fixes: ada3e24b84a0 ("idpf: add flow steering support") Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Sreedevi Joshi Reviewed-by: Simon Horman Tested-by: Mina Almasry Signed-off-by: Tony Nguyen commit 4d792219fe6f891b5b557a607ac8a0a14eda6e38 Author: Emil Tantilov Date: Thu Nov 20 16:12:18 2025 -0800 idpf: fix error handling in the init_task on load If the init_task fails during a driver load, we end up without vports and netdevs, effectively failing the entire process. In that state a subsequent reset will result in a crash as the service task attempts to access uninitialized resources. Following trace is from an error in the init_task where the CREATE_VPORT (op 501) is rejected by the FW: [40922.763136] idpf 0000:83:00.0: Device HW Reset initiated [40924.449797] idpf 0000:83:00.0: Transaction failed (op 501) [40958.148190] idpf 0000:83:00.0: HW reset detected [40958.161202] BUG: kernel NULL pointer dereference, address: 00000000000000a8 ... [40958.168094] Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf] [40958.168865] RIP: 0010:idpf_vc_event_task+0x9b/0x350 [idpf] ... [40958.177932] Call Trace: [40958.178491] [40958.179040] process_one_work+0x226/0x6d0 [40958.179609] worker_thread+0x19e/0x340 [40958.180158] ? __pfx_worker_thread+0x10/0x10 [40958.180702] kthread+0x10f/0x250 [40958.181238] ? __pfx_kthread+0x10/0x10 [40958.181774] ret_from_fork+0x251/0x2b0 [40958.182307] ? __pfx_kthread+0x10/0x10 [40958.182834] ret_from_fork_asm+0x1a/0x30 [40958.183370] Fix the error handling in the init_task to make sure the service and mailbox tasks are disabled if the error happens during load. These are started in idpf_vc_core_init(), which spawns the init_task and has no way of knowing if it failed. If the error happens on reset, following successful driver load, the tasks can still run, as that will allow the netdevs to attempt recovery through another reset. Stop the PTP callbacks either way as those will be restarted by the call to idpf_vc_core_init() during a successful reset. Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration") Reported-by: Vivek Kumar Signed-off-by: Emil Tantilov Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit e111cbc4adf9f9974eed040aeece7e17460f6bff Author: Emil Tantilov Date: Thu Nov 20 16:12:17 2025 -0800 idpf: fix memory leak in idpf_vc_core_deinit() Make sure to free hw->lan_regs. Reported by kmemleak during reset: unreferenced object 0xff1b913d02a936c0 (size 96): comm "kworker/u258:14", pid 2174, jiffies 4294958305 hex dump (first 32 bytes): 00 00 00 c0 a8 ba 2d ff 00 00 00 00 00 00 00 00 ......-......... 00 00 40 08 00 00 00 00 00 00 25 b3 a8 ba 2d ff ..@.......%...-. backtrace (crc 36063c4f): __kmalloc_noprof+0x48f/0x890 idpf_vc_core_init+0x6ce/0x9b0 [idpf] idpf_vc_event_task+0x1fb/0x350 [idpf] process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x251/0x2b0 ret_from_fork_asm+0x1a/0x30 Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions") Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Reviewed-by: Joshua Hay Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit f6242b354605faff263ca45882b148200915a3f6 Author: Emil Tantilov Date: Thu Nov 20 16:12:16 2025 -0800 idpf: fix memory leak in idpf_vport_rel() Free vport->rx_ptype_lkup in idpf_vport_rel() to avoid leaking memory during a reset. Reported by kmemleak: unreferenced object 0xff450acac838a000 (size 4096): comm "kworker/u258:5", pid 7732, jiffies 4296830044 hex dump (first 32 bytes): 00 00 00 00 00 10 00 00 00 10 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ................ backtrace (crc 3da81902): __kmalloc_cache_noprof+0x469/0x7a0 idpf_send_get_rx_ptype_msg+0x90/0x570 [idpf] idpf_init_task+0x1ec/0x8d0 [idpf] process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x251/0x2b0 ret_from_fork_asm+0x1a/0x30 Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration") Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 2e281e1155fc476c571c0bd2ffbfe28ab829a5c3 Author: Emil Tantilov Date: Thu Nov 20 16:12:15 2025 -0800 idpf: detach and close netdevs while handling a reset Protect the reset path from callbacks by setting the netdevs to detached state and close any netdevs in UP state until the reset handling has completed. During a reset, the driver will de-allocate resources for the vport, and there is no guarantee that those will recover, which is why the existing vport_ctrl_lock does not provide sufficient protection. idpf_detach_and_close() is called right before reset handling. If the reset handling succeeds, the netdevs state is recovered via call to idpf_attach_and_open(). If the reset handling fails the netdevs remain down. The detach/down calls are protected with RTNL lock to avoid racing with callbacks. On the recovery side the attach can be done without holding the RTNL lock as there are no callbacks expected at that point, due to detach/close always being done first in that flow. The previous logic restoring the netdevs state based on the IDPF_VPORT_UP_REQUESTED flag in the init task is not needed anymore, hence the removal of idpf_set_vport_state(). The IDPF_VPORT_UP_REQUESTED is still being used to restore the state of the netdevs following the reset, but has no use outside of the reset handling flow. idpf_init_hard_reset() is converted to void, since it was used as such and there is no error handling being done based on its return value. Before this change, invoking hard and soft resets simultaneously will cause the driver to lose the vport state: ip -br a UP echo 1 > /sys/class/net/ens801f0/device/reset& \ ethtool -L ens801f0 combined 8 ip -br a DOWN ip link set up ip -br a DOWN Also in case of a failure in the reset path, the netdev is left exposed to external callbacks, while vport resources are not initialized, leading to a crash on subsequent ifup/down: [408471.398966] idpf 0000:83:00.0: HW reset detected [408471.411744] idpf 0000:83:00.0: Device HW Reset initiated [408472.277901] idpf 0000:83:00.0: The driver was unable to contact the device's firmware. Check that the FW is running. Driver state= 0x2 [408508.125551] BUG: kernel NULL pointer dereference, address: 0000000000000078 [408508.126112] #PF: supervisor read access in kernel mode [408508.126687] #PF: error_code(0x0000) - not-present page [408508.127256] PGD 2aae2f067 P4D 0 [408508.127824] Oops: Oops: 0000 [#1] SMP NOPTI ... [408508.130871] RIP: 0010:idpf_stop+0x39/0x70 [idpf] ... [408508.139193] Call Trace: [408508.139637] [408508.140077] __dev_close_many+0xbb/0x260 [408508.140533] __dev_change_flags+0x1cf/0x280 [408508.140987] netif_change_flags+0x26/0x70 [408508.141434] dev_change_flags+0x3d/0xb0 [408508.141878] devinet_ioctl+0x460/0x890 [408508.142321] inet_ioctl+0x18e/0x1d0 [408508.142762] ? _copy_to_user+0x22/0x70 [408508.143207] sock_do_ioctl+0x3d/0xe0 [408508.143652] sock_ioctl+0x10e/0x330 [408508.144091] ? find_held_lock+0x2b/0x80 [408508.144537] __x64_sys_ioctl+0x96/0xe0 [408508.144979] do_syscall_64+0x79/0x3d0 [408508.145415] entry_SYSCALL_64_after_hwframe+0x76/0x7e [408508.145860] RIP: 0033:0x7f3e0bb4caff Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration") Signed-off-by: Emil Tantilov Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 1eb217ab2e737609f8a861b517649e82e7236d05 Author: Faisal Bukhari Date: Mon Sep 22 23:38:34 2025 +0530 perf parse-events: Fix evsel allocation failure If evsel__new_idx() returns NULL, the function currently jumps to label 'out_err'. Here, references to `cpus` and `pmu_cpus` are dropped. Also, resources held by evsel->name and evsel->metric_id are freed. But if evsel__new_idx() returns NULL, it can lead to NULL pointer dereference. Fixes: cd63c22168257a0b ("perf parse-events: Minor __add_event refactoring") Signed-off-by: Faisal Bukhari Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 75ddaa4ddc86d31edb15e50152adf4ddee77a6ba Author: Christian Brauner Date: Wed Dec 24 13:00:24 2025 +0100 pidfs: protect PIDFD_GET_* ioctls() via ifdef We originally protected PIDFD_GET__NAMESPACE ioctls() through ifdefs and recent rework made it possible to drop them. There was an oversight though. When the relevant namespace is turned off ns->ops will be NULL so even though opening a file descriptor is perfectly legitimate it would fail during inode eviction when the file was closed. The simple fix would be to check ns->ops for NULL and continue allow to retrieve namespace fds from pidfds but we don't allow retrieving them when the relevant namespace type is turned off. So keep the simplification but add the ifdefs back in. Link: https://lore.kernel.org/20251222214907.GA189632@quark Link: https://patch.msgid.link/20251224-ununterbrochen-gagen-ea949b83f8f2@brauner Fixes: a71e4f103aed ("pidfs: simplify PIDFD_GET__NAMESPACE ioctls") Tested-by: Brendan Jackman Tested-by: Eric Biggers Reported-by: Eric Biggers Signed-off-by: Christian Brauner commit 8510ef5e3cfbd7d59a16845f85cd0194a8689761 Author: FUJITA Tomonori Date: Tue Jan 6 09:03:20 2026 +0900 rust: device: Remove explicit import of CStrExt Remove the explicit import of CStrExt. When CONFIG_PRINTK is disabled this import causes a build error: error: unused import: `crate::str::CStrExt` --> rust/kernel/device.rs:17:5 | 17 | use crate::str::CStrExt as _; | ^^^^^^^^^^^^^^^^^^^ | = note: `-D unused-imports` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(unused_imports)]` error: aborting due to 1 previous error CStrExt is covered by prelude::* so the explicit import is redundant. Signed-off-by: FUJITA Tomonori Fixes: 3b83f5d5e78a ("rust: replace `CStr` with `core::ffi::CStr`") Link: https://patch.msgid.link/20260106000320.2593800-1-fujita.tomonori@gmail.com Signed-off-by: Danilo Krummrich commit 3a1ec424dd9c9491138a5ebadb24ce9f33e6a822 Author: Hsiu Che Yu Date: Thu Dec 4 11:38:48 2025 +0800 rust: num: bounded: mark __new as unsafe The `Bounded::__new()` constructor relies on the caller to ensure the value can be represented within N bits. Failing to uphold this requirement breaks the type invariant. Mark it as unsafe and document this requirement in a Safety section to make the contract explicit. Update all call sites to use unsafe blocks and change their comments from `INVARIANT:` to `SAFETY:`, as they are now justifying unsafe operations rather than establishing type invariants. Fixes: 01e345e82ec3a ("rust: num: add Bounded integer wrapping type") Link: https://lore.kernel.org/all/aS1qC_ol2XEpZ44b@google.com/ Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1211 Signed-off-by: Hsiu Che Yu Acked-by: Alexandre Courbot Link: https://patch.msgid.link/20251204033849.23480-1-yu.whisper.personal@gmail.com Signed-off-by: Miguel Ojeda commit 9f92d7d1cb9cccc6c703ca53d4f1d1acca79b598 Author: Marko Turk Date: Mon Jan 5 22:37:57 2026 +0100 rust: pci: fix typos in Bar struct's comments Fix a typo in the doc-comment of the Bar structure: 'inststance -> instance'. Add also 'is' to the comment inside Bar's `new()` function (suggested by Dirk): // `pdev` is valid by the invariants of `Device`. Fixes: bf9651f84b4e ("rust: pci: implement I/O mappable `pci::Bar`") Suggested-by: Dirk Behme Signed-off-by: Marko Turk Reviewed-by: Dirk Behme Link: https://patch.msgid.link/20260105213726.73000-2-mt@markoturk.info Signed-off-by: Danilo Krummrich commit 609db7e73b3ecc6a0b44dc6486e88e4bce6fd8c0 Author: Siddhesh Poyarekar Date: Wed Dec 17 17:40:50 2025 -0500 rust: kbuild: Add -fdiagnostics-show-context to bindgen_skip_c_flags This got added with: 7454048db27d ("kbuild: Enable GCC diagnostic context for value-tracking warnings") but clang does not have this option, so avoid passing it to bindgen. [ Details about what the option does are in the commit above. Nathan also expands on this: Right, this does look correct, as this option is specific to GCC for the purpose of exposing more information from GCC internals to the user for understanding diagnostics better. I checked that in Compiler Explorer GCC 15.2 doesn't have it, but GCC trunk indeed has. - Miguel ] Fixes: 7454048db27d ("kbuild: Enable GCC diagnostic context for value-tracking warnings") Signed-off-by: Siddhesh Poyarekar Link: https://patch.msgid.link/20251217224050.1186896-1-siddhesh@gotplt.org [ Removed Cc: stable. Added title prefix. - Miguel ] Signed-off-by: Miguel Ojeda commit ab86d0bf01f6d0e37fd67761bb62918321b64efc Author: Toke Høiland-Jørgensen Date: Mon Jan 5 12:47:46 2026 +0100 selftests/bpf: Update xdp_context_test_run test to check maximum metadata size Update the selftest to check that the metadata size check takes the xdp_frame size into account in bpf_prog_test_run. The original check (for meta size 256) was broken because the data frame supplied was smaller than this, triggering a different EINVAL return. So supply a larger data frame for this test to make sure we actually exercise the check we think we are. Signed-off-by: Toke Høiland-Jørgensen Reviewed-by: Amery Hung Link: https://lore.kernel.org/r/20260105114747.1358750-2-toke@redhat.com Signed-off-by: Alexei Starovoitov commit e558cca217790286e799a8baacd1610bda31b261 Author: Toke Høiland-Jørgensen Date: Mon Jan 5 12:47:45 2026 +0100 bpf, test_run: Subtract size of xdp_frame from allowed metadata size The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_run, we don't take this into account, which makes it possible for userspace to supply a metadata size that is too large (taking up the entire headroom). If userspace supplies such a large metadata size in live packet mode, the xdp_update_frame_from_buff() call in xdp_test_run_init_page() call will fail, after which packet transmission proceeds with an uninitialised frame structure, leading to the usual Bad Stuff. The commit in the Fixes tag fixed a related bug where the second check in xdp_update_frame_from_buff() could fail, but did not add any additional constraints on the metadata size. Complete the fix by adding an additional check on the metadata size. Reorder the checks slightly to make the logic clearer and add a comment. Link: https://lore.kernel.org/r/fa2be179-bad7-4ee3-8668-4903d1853461@hust.edu.cn Fixes: b6f1f780b393 ("bpf, test_run: Fix packet size check for live packet mode") Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Signed-off-by: Toke Høiland-Jørgensen Reviewed-by: Amery Hung Link: https://lore.kernel.org/r/20260105114747.1358750-1-toke@redhat.com Signed-off-by: Alexei Starovoitov commit 8f3e00af8e52c0d2d8e0e15154d28ec7d639d4d9 Author: Menglong Dong Date: Fri Dec 19 22:29:48 2025 +0800 riscv, bpf: Fix incorrect usage of BPF_TRAMP_F_ORIG_STACK The usage of BPF_TRAMP_F_ORIG_STACK in __arch_prepare_bpf_trampoline() is wrong, and it should be BPF_TRAMP_F_CALL_ORIG, which caused crash as Andreas reported: Insufficient stack space to handle exception! Task stack: [0xff20000000010000..0xff20000000014000] Overflow stack: [0xff600000ffdad070..0xff600000ffdae070] CPU: 1 UID: 0 PID: 1 Comm: systemd Not tainted 6.18.0-rc5+ #15 PREEMPT(voluntary) Hardware name: riscv-virtio qemu/qemu, BIOS 2025.10 10/01/2025 epc : copy_from_kernel_nofault+0xa/0x198 ra : bpf_probe_read_kernel+0x20/0x60 epc : ffffffff802b732a ra : ffffffff801e6070 sp : ff2000000000ffe0 gp : ffffffff82262ed0 tp : 0000000000000000 t0 : ffffffff80022320 t1 : ffffffff801e6056 t2 : 0000000000000000 s0 : ff20000000010040 s1 : 0000000000000008 a0 : ff20000000010050 a1 : ff60000083b3d320 a2 : 0000000000000008 a3 : 0000000000000097 a4 : 0000000000000000 a5 : 0000000000000000 a6 : 0000000000000021 a7 : 0000000000000003 s2 : ff20000000010050 s3 : ff6000008459fc18 s4 : ff60000083b3d340 s5 : ff20000000010060 s6 : 0000000000000000 s7 : ff20000000013aa8 s8 : 0000000000000000 s9 : 0000000000008000 s10: 000000000058dcb0 s11: 000000000058dca7 t3 : 000000006925116d t4 : ff6000008090f026 t5 : 00007fff9b0cbaa8 t6 : 0000000000000016 status: 0000000200000120 badaddr: 0000000000000000 cause: 8000000000000005 Kernel panic - not syncing: Kernel stack overflow CPU: 1 UID: 0 PID: 1 Comm: systemd Not tainted 6.18.0-rc5+ #15 PREEMPT(voluntary) Hardware name: riscv-virtio qemu/qemu, BIOS 2025.10 10/01/2025 Call Trace: [] dump_backtrace+0x28/0x38 [] show_stack+0x3a/0x50 [] dump_stack_lvl+0x56/0x80 [] dump_stack+0x18/0x22 [] vpanic+0xf6/0x328 [] panic+0x3e/0x40 [] handle_bad_stack+0x98/0xa0 [] bpf_probe_read_kernel+0x20/0x60 Just fix it. Fixes: 47c9214dcbea ("bpf: fix the usage of BPF_TRAMP_F_SKIP_FRAME") Link: https://lore.kernel.org/bpf/20251219142948.204312-1-dongml2@chinatelecom.cn Closes: https://lore.kernel.org/bpf/874ipnkfvt.fsf@igel.home/ Reported-by: Andreas Schwab Signed-off-by: Menglong Dong Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 083029bd8b445595222a3cd14076b880781c1765 Author: Emil Tantilov Date: Thu Nov 20 16:12:14 2025 -0800 idpf: keep the netdev when a reset fails During a successful reset the driver would re-allocate vport resources while keeping the netdevs intact. However, in case of an error in the init task, the netdev of the failing vport will be unregistered, effectively removing the network interface: [ 121.211076] idpf 0000:83:00.0: enabling device (0100 -> 0102) [ 121.221976] idpf 0000:83:00.0: Device HW Reset initiated [ 124.161229] idpf 0000:83:00.0 ens801f0: renamed from eth0 [ 124.163364] idpf 0000:83:00.0 ens801f0d1: renamed from eth1 [ 125.934656] idpf 0000:83:00.0 ens801f0d2: renamed from eth2 [ 128.218429] idpf 0000:83:00.0 ens801f0d3: renamed from eth3 ip -br a ens801f0 UP ens801f0d1 UP ens801f0d2 UP ens801f0d3 UP echo 1 > /sys/class/net/ens801f0/device/reset [ 145.885537] idpf 0000:83:00.0: resetting [ 145.990280] idpf 0000:83:00.0: reset done [ 146.284766] idpf 0000:83:00.0: HW reset detected [ 146.296610] idpf 0000:83:00.0: Device HW Reset initiated [ 211.556719] idpf 0000:83:00.0: Transaction timed-out (op:526 cookie:7700 vc_op:526 salt:77 timeout:60000ms) [ 272.996705] idpf 0000:83:00.0: Transaction timed-out (op:502 cookie:7800 vc_op:502 salt:78 timeout:60000ms) ip -br a ens801f0d1 DOWN ens801f0d2 DOWN ens801f0d3 DOWN Re-shuffle the logic in the error path of the init task to make sure the netdevs remain intact. This will allow the driver to attempt recovery via subsequent resets, provided the FW is still functional. The main change is to make sure that idpf_decfg_netdev() is not called should the init task fail during a reset. The error handling is consolidated under unwind_vports, as the removed labels had the same cleanup logic split depending on the point of failure. Fixes: ce1b75d0635c ("idpf: add ptypes and MAC filter support") Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 955b263c421c6fe5075369c52199f278289ec8c4 Author: Chaoyi Chen Date: Tue Jan 6 15:15:13 2026 +0800 arm64: dts: rockchip: Fix wrong register range of rk3576 gpu According to RK3576 TRM part1 Table 1-1 Address Mapping, the size of the GPU registers is 128 KB. The current mapping incorrectly includes the addresses of multiple following IP like the eInk interface at 0x27900000. This has not been detected by the DT tooling as none of the extra mapped IP is described in the upstream RK3576 DT so far. Fixes: 57b1ce903966 ("arm64: dts: rockchip: Add rk3576 SoC base DT") Signed-off-by: Chaoyi Chen Reviewed-by: Nicolas Frattaroli Reviewed-by: Sebastian Reichel Link: https://patch.msgid.link/20260106071513.209-1-kernel@airkyi.com Signed-off-by: Heiko Stuebner commit 3e4a81881c0929b21a0577bc6e69514c09da5c3f Author: Alexey Charkov Date: Mon Dec 29 14:11:59 2025 +0400 arm64: dts: rockchip: Configure MCLK for analog sound on NanoPi M5 NanoPi M5 derives its analog sound signal from SAI2 in M0 pin mode, so the MCLK pin should be configured accordingly for the sound codec to get its I2S signal from the SoC. Request the required pin config. The clock itself should also be CLK_SAI2_MCLKOUT_TO_IO for the sound to work (otherwise there is only silence out of the audio out jack). Fixes: 96cbdfdd3ac2 ("arm64: dts: rockchip: Add FriendlyElec NanoPi M5 support") Cc: stable@vger.kernel.org Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20251229-rk3576-sound-v1-2-2f59ef0d19b1@gmail.com Signed-off-by: Heiko Stuebner commit 5ab3dd9d0a63af66377f58633fec9dad650e6827 Author: Alexey Charkov Date: Mon Dec 29 14:11:58 2025 +0400 arm64: dts: rockchip: Fix headphones widget name on NanoPi M5 Fix the mismatch between the simple-audio-card routing table vs. widget names, which caused the following error at boot preventing the sound card from getting added: [ 6.625634] asoc-simple-card sound: ASoC: DAPM unknown pin Headphones [ 6.627247] asoc-simple-card sound: ASoC: Failed to add route HPOL -> Headphones(*) [ 6.627988] asoc-simple-card sound: ASoC: Failed to add route HPOR -> Headphones(*) Fixes: 96cbdfdd3ac2 ("arm64: dts: rockchip: Add FriendlyElec NanoPi M5 support") Cc: stable@vger.kernel.org Signed-off-by: Alexey Charkov Link: https://patch.msgid.link/20251229-rk3576-sound-v1-1-2f59ef0d19b1@gmail.com Signed-off-by: Heiko Stuebner commit f33db67d914a80ec449579dddc41804857c9400d Merge: fd9a14d233fbf3 46a16d89d097ac Author: Mark Brown Date: Tue Jan 6 18:02:05 2026 +0000 ASoC: codecs: wsa88xx: fix codec initialisation Merge series from Johan Hovold : The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED. This series fixes the Qualcomm wsa88xx codec drivers that do unnecessary reinitialisation or potentially fail to initialise at all. Included is also a related clean up suppressing a related codec variant printk. commit f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1 Merge: 7f98ab9da04686 0b88bfa42e5468 Author: Linus Torvalds Date: Tue Jan 6 09:12:52 2026 -0800 Merge tag 'nfsd-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "A set of NFSD fixes for stable that arrived after the merge window: - Remove an invalid NFS status code - Fix an fstests failure when using pNFS - Fix a UAF in v4_end_grace() - Fix the administrative interface used to revoke NFSv4 state - Fix a memory leak reported by syzbot" * tag 'nfsd-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: net ref data still needs to be freed even if net hasn't startup nfsd: check that server is running in unlock_filesystem nfsd: use correct loop termination in nfsd4_revoke_states() nfsd: provide locking for v4_end_grace NFSD: Fix permission check for read access to executable-only files NFSD: Remove NFSERR_EAGAIN commit 08e136ebd193eae7d5eff4c66d576c4a2dabdc3f Author: Raphael Pinsonneault-Thibeault Date: Wed Dec 17 14:00:40 2025 -0500 loop: don't change loop device under exclusive opener in loop_set_status loop_set_status() is allowed to change the loop device while there are other openers of the device, even exclusive ones. In this case, it causes a KASAN: slab-out-of-bounds Read in ext4_search_dir(), since when looking for an entry in an inlined directory, e_value_offs is changed underneath the filesystem by loop_set_status(). Fix the problem by forbidding loop_set_status() from modifying the loop device while there are exclusive openers of the device. This is similar to the fix in loop_configure() by commit 33ec3e53e7b1 ("loop: Don't change loop device under exclusive opener") alongside commit ecbe6bc0003b ("block: use bd_prepare_to_claim directly in the loop driver"). Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397 Tested-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com Tested-by: Yongpeng Yang Signed-off-by: Raphael Pinsonneault-Thibeault Reviewed-by: Jan Kara Signed-off-by: Jens Axboe commit dd4d71f587f3908f058b516d3793aaed66cfb692 Author: Ben Horgan Date: Mon Jan 5 13:58:47 2026 +0000 arm64/efi: Don't fail check current_in_efi() if preemptible As EFI runtime services can now be run without disabling preemption remove the check for non preemptible in current_in_efi(). Without this change, firmware errors that were previously recovered from by __efi_runtime_kernel_fixup_exception() will lead to a kernel oops. Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") Signed-off-by: Ben Horgan Reviewed-by: Yeoreum Yun Acked-by: Ard Biesheuvel Reviewed-by: Richard Lyu Signed-off-by: Catalin Marinas commit fd9a14d233fbf33488cfa0cb7f59051b3233b017 Author: Rob Herring (Arm) Date: Mon Jan 5 13:32:03 2026 -0600 ASoC: dt-bindings: everest,es8316: Add interrupt support The Everest ES8316 has interrupt capability on its GPIO3 pin for headphone detection. Several of the RockPi 4 variants are using it already. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260105193203.3166320-1-robh@kernel.org Signed-off-by: Mark Brown commit 69d6c6fc79eb3a8309691250a3b0a9c1870c1f83 Author: Hans de Goede Date: Mon Dec 8 15:37:24 2025 +0100 media: ov02c10: Remove unnecessary hflip and vflip pointers The cci_update_bits() inside ov02c10_set_ctrl() can use the passed data in the ctrl argument to access the vflip control value. After changing this there is no need to store a pointer to the hflip and vflip controls inside struct ov02c10, drop these. Reviewed-by: Bryan O'Donoghue Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel # T14s Gen6 Snapdragon Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit b75710155a823369976bba9f3497cee113830ae9 Author: Hans de Goede Date: Tue Dec 9 10:18:50 2025 +0100 media: ipu-bridge: Add DMI quirk for Dell XPS laptops with upside down sensors The Dell XPS 13 9350 and XPS 16 9640 both have an upside-down mounted OV02C10 sensor. This rotation of 180° is reported in neither the SSDB nor the _PLD for the sensor (both report a rotation of 0°). Add a DMI quirk mechanism for upside-down sensors and add 2 initial entries to the DMI quirk list for these 2 laptops. Note the OV02C10 driver was originally developed on a XPS 16 9640 which resulted in inverted vflip + hflip settings making it look like the sensor was upright on the XPS 16 9640 and upside down elsewhere this has been fixed in commit d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip"). This makes this commit a regression fix since now the video is upside down on these Dell XPS models where it was not before. Fixes: d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip") Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue Reviewed-by: Sebastian Reichel Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 1d2e3b4443a85374fdd6fb8fd2c015e3e3e16100 Author: Hans de Goede Date: Mon Dec 8 15:32:58 2025 +0100 media: ov02c10: Fix the horizontal flip control During sensor calibration I noticed that with the hflip control set to false/disabled the image was mirrored. The horizontal flip control is inverted and needs to be set to 1 to not flip. This is something which seems to be common with various recent Omnivision sensors, the ov01a10 and ov08x40 also have an inverted mirror control. Invert the hflip control to fix the sensor mirroring by default. Fixes: b7cd2ba3f692 ("media: ov02c10: Support hflip and vflip") Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel # T14s Gen6 Snapdragon Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit d0bb6f1f2b79d96953bf81a3839ac2aa946ba2fa Author: Hans de Goede Date: Mon Dec 8 15:12:58 2025 +0100 media: ov02c10: Adjust x-win/y-win when changing flipping to preserve bayer-pattern The ov02c10 is capable of having its (crop) window shifted around with 1 pixel precision while streaming. This allows changing the x/y window coordinates when changing flipping to preserve the bayer-pattern. __v4l2_ctrl_handler_setup() will now write the window coordinates at 0x3810 and 0x3812 so these can be dropped from sensor_1928x1092_30fps_setting. Since the bayer-pattern is now unchanged, the V4L2_CTRL_FLAG_MODIFY_LAYOUT flag can be dropped from the flip controls. Note the original use of the V4L2_CTRL_FLAG_MODIFY_LAYOUT flag was incomplete, besides setting the flag the driver should also have reported a different mbus code when getting the source pad's format depending on the hflip / vflip settings see the ov2680.c driver for example. Fixes: b7cd2ba3f692 ("media: ov02c10: Support hflip and vflip") Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue Reviewed-by: Sebastian Reichel Tested-by: Sebastian Reichel # T14s Gen6 Snapdragon Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 905120d7470e5ed79d59b61ef6aa13344ffca229 Author: Hans de Goede Date: Sun Dec 7 22:56:50 2025 +0100 media: ov02c10: Fix bayer-pattern change after default vflip change After commit d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip") the reported bayer-pattern of MEDIA_BUS_FMT_SGRBG10_1X10 is no longer correct. Change the 16-bit x-win register (0x3810) value from 2 to 1 so that the sensor will generate data in GRBG bayer-order again. Fixes: d5ebe3f7d13d ("media: ov02c10: Fix default vertical flip") Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue Reviewed-by: Sebastian Reichel Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 63d95712309299af25ea2d170899468be051d91e Author: Jacopo Mondi Date: Fri Aug 29 13:12:14 2025 +0200 media: rzg2l-cru: csi-2: Support RZ/V2H input sizes The CRU version on the RZ/V2H SoC supports larger input sizes (4096x4096) compared to the version on the RZ/G2L (2800x4095). Store the per-SoC min/max sizes in the device match info and use them in place of the hardcoded ones. While at it, use the min sizes reported by the info structure to replace the RZG2L_CSI2_DEFAULT_WIDTH/HEIGHT macros. Signed-off-by: Jacopo Mondi Tested-by: Tommaso Merciai Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 22cd0db47f4f65ebe8afc8c34ab120c47c73da2a Author: Jacopo Mondi Date: Mon Dec 15 13:08:12 2025 +0100 media: uapi: mali-c55-config: Remove version identifier The Mali C55 driver uses the v4l2-isp framework, which defines its own versioning number which does not need to be defined again in each platform-specific header. Remove the definition of mali_c55_param_buffer_version enumeration from the Mali C55 uAPI header. Signed-off-by: Jacopo Mondi Reviewed-by: Daniel Scally Signed-off-by: Hans Verkuil commit 8c0af684bd8ec66b09daadca27d1bafd7d2891ce Author: Jacopo Mondi Date: Mon Dec 15 13:11:06 2025 +0100 media: mali-c55: Remove duplicated version check The Mali C55 driver uses the v4l2-isp framework, which performs validation of the parameters buffer versioning in the v4l2_isp_params_validate_buffer() function. It is not necessary to replicate the validation of the parameters buffer versioning in the platform-specific implementation. Remove it. Signed-off-by: Jacopo Mondi Reviewed-by: Daniel Scally Signed-off-by: Hans Verkuil commit 003c492f9e765b82fe731963d9dbd7b4ae92c2b4 Author: Jacopo Mondi Date: Mon Dec 15 13:15:57 2025 +0100 media: Documentation: mali-c55: Use v4l2-isp version identifier The Mali C55 driver uses the v4l2-isp framework, which defines its own versioning numbers. Do not use the Mali C55 specific version identifier in the code example in the documentation of the Mali C55 stats and params metadata formats. Signed-off-by: Jacopo Mondi Reviewed-by: Daniel Scally Signed-off-by: Hans Verkuil commit d5bdf88d1f9d1e4808177f03d89de3d0ba6c6e84 Author: Chengjun Yao Date: Mon Dec 15 16:18:21 2025 +0800 drm/fb-helper: Fix vblank timeout during suspend/reset During GPU reset, VBlank interrupts are disabled which causes drm_fb_helper_fb_dirty() to wait for VBlank timeout. This will create call traces like (seen on an RX7900 series dGPU): [ 101.313646] ------------[ cut here ]------------ [ 101.313648] amdgpu 0000:03:00.0: [drm] vblank wait timed out on crtc 0 [ 101.313657] WARNING: CPU: 0 PID: 461 at drivers/gpu/drm/drm_vblank.c:1320 drm_wait_one_vblank+0x176/0x220 [ 101.313663] Modules linked in: amdgpu amdxcp drm_panel_backlight_quirks gpu_sched drm_buddy drm_ttm_helper ttm drm_exec drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit nf_conntrack_netlink xt_nat xt_tcpudp veth xt_conntrack xt_MASQUERADE bridge stp llc xfrm_user xfrm_algo xt_set ip_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_addrtype nft_compat x_tables nf_tables overlay qrtr sunrpc snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic snd_hda_codec_atihdmi snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hda_core snd_intel_dspcfg snd_intel_sdw_acpi snd_hwdep snd_pcm amd_atl intel_rapl_msr snd_seq_midi intel_rapl_common asus_ec_sensors snd_seq_midi_event snd_rawmidi snd_seq eeepc_wmi snd_seq_device edac_mce_amd asus_wmi polyval_clmulni ghash_clmulni_intel snd_timer platform_profile aesni_intel wmi_bmof sparse_keymap joydev snd rapl input_leds i2c_piix4 soundcore ccp k10temp i2c_smbus gpio_amdpt mac_hid binfmt_misc sch_fq_codel msr parport_pc ppdev lp parport [ 101.313745] efi_pstore nfnetlink dmi_sysfs autofs4 hid_generic usbhid hid r8169 realtek ahci libahci video wmi [ 101.313760] CPU: 0 UID: 0 PID: 461 Comm: kworker/0:2 Not tainted 6.18.0-rc6-174403b3b920 #1 PREEMPT(voluntary) [ 101.313763] Hardware name: ASUS System Product Name/TUF GAMING X670E-PLUS, BIOS 0821 11/15/2022 [ 101.313765] Workqueue: events drm_fb_helper_damage_work [ 101.313769] RIP: 0010:drm_wait_one_vblank+0x176/0x220 [ 101.313772] Code: 7c 24 08 4c 8b 77 50 4d 85 f6 0f 84 a1 00 00 00 e8 2f 11 03 00 44 89 e9 4c 89 f2 48 c7 c7 d0 ad 0d a8 48 89 c6 e8 2a e0 4a ff <0f> 0b e9 f2 fe ff ff 48 85 ff 74 04 4c 8b 67 08 4d 8b 6c 24 50 4d [ 101.313774] RSP: 0018:ffffc99c00d47d68 EFLAGS: 00010246 [ 101.313777] RAX: 0000000000000000 RBX: 000000000200038a RCX: 0000000000000000 [ 101.313778] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 101.313779] RBP: ffffc99c00d47dc0 R08: 0000000000000000 R09: 0000000000000000 [ 101.313781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8948c4280010 [ 101.313782] R13: 0000000000000000 R14: ffff894883263a50 R15: ffff89488c384830 [ 101.313784] FS: 0000000000000000(0000) GS:ffff895424692000(0000) knlGS:0000000000000000 [ 101.313785] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 101.313787] CR2: 00007773650ee200 CR3: 0000000588e40000 CR4: 0000000000f50ef0 [ 101.313788] PKRU: 55555554 [ 101.313790] Call Trace: [ 101.313791] [ 101.313795] ? __pfx_autoremove_wake_function+0x10/0x10 [ 101.313800] drm_crtc_wait_one_vblank+0x17/0x30 [ 101.313802] drm_client_modeset_wait_for_vblank+0x61/0x80 [ 101.313805] drm_fb_helper_damage_work+0x46/0x1a0 [ 101.313808] process_one_work+0x1a1/0x3f0 [ 101.313812] worker_thread+0x2ba/0x3d0 [ 101.313816] kthread+0x107/0x220 [ 101.313818] ? __pfx_worker_thread+0x10/0x10 [ 101.313821] ? __pfx_kthread+0x10/0x10 [ 101.313823] ret_from_fork+0x202/0x230 [ 101.313826] ? __pfx_kthread+0x10/0x10 [ 101.313828] ret_from_fork_asm+0x1a/0x30 [ 101.313834] [ 101.313835] ---[ end trace 0000000000000000 ]--- Cancel pending damage work synchronously before console_lock() to ensure any in-flight framebuffer damage operations complete before suspension. Also check for FBINFO_STATE_RUNNING in drm_fb_helper_damage_work() to avoid executing damage work if it is rescheduled while the device is suspended. Fixes: d8c4bddcd8bc ("drm/fb-helper: Synchronize dirty worker with vblank") Signed-off-by: Aurabindo Pillai Signed-off-by: Chengjun Yao Signed-off-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20251215081822.432005-1-Chengjun.Yao@amd.com commit fd390ff144513eb0310c350b1cf5fa8d6ddd0c53 Author: Mario Limonciello (AMD) Date: Mon Jan 5 22:46:38 2026 -0600 PCI/VGA: Don't assume the only VGA device on a system is `boot_vga` Some systems ship with multiple display class devices but not all of them are VGA devices. If the "only" VGA device on the system is not used for displaying the image on the screen marking it as `boot_vga` because nothing was found is totally wrong. This behavior actually leads to mistakes of the wrong device being advertised to userspace and then userspace can make incorrect decisions. As there is an accurate `boot_display` sysfs file stop lying about `boot_vga` by assuming if nothing is found it's the right device. Reported-by: Aaron Erhardt Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220712 Tested-by: Aaron Erhardt Acked-by: Thomas Zimmermann Fixes: ad90860bd10ee ("fbcon: Use screen info to find primary device") Tested-by: Luke D. Jones Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260106044638.52906-1-superm1@kernel.org commit 88c72bab77aaf389beccf762e112828253ca0564 Author: Arnd Bergmann Date: Thu Dec 4 10:52:26 2025 +0100 cxl/region: fix format string for resource_size_t The size of this type is architecture specific, and the recommended way to print it portably is through the custom %pap format string. Fixes: d6602e25819d ("cxl/region: Add support to indicate region has extended linear cache") Signed-off-by: Arnd Bergmann Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang > --- Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20251204095237.1032528-1-arnd@kernel.org Signed-off-by: Dave Jiang commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 Author: Dan Williams Date: Thu Nov 6 15:13:50 2025 -0800 x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") is too narrow. The effect being mitigated in that commit is caused by ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general, lets any physical address be added to the direct-map. I.e. not only ACPI hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases. Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of this problem is limited to the PCI_P2PDMA=n case. A potential path to recover entropy would be to walk ACPI and determine the limits for hotplug and PCI MMIO before kernel_randomize_memory(). On smaller systems that could yield some KASLR address bits. This needs additional investigation to determine if some limited ACPI table scanning can happen this early without an open coded solution like arch/x86/boot/compressed/acpi.c needs to deploy. Cc: Ingo Molnar Cc: Kees Cook Cc: Bjorn Helgaas Cc: Peter Zijlstra Cc: Andy Lutomirski Cc: Logan Gunthorpe Cc: Andrew Morton Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Michal Hocko Fixes: 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems") Cc: Signed-off-by: Dan Williams Reviewed-by: Balbir Singh Tested-by: Yasunori Goto Acked-by: Dave Hansen Link: http://patch.msgid.link/692e08b2516d4_261c1100a3@dwillia2-mobl4.notmuch Signed-off-by: Dave Jiang commit 238e03d0466239410b72294b79494e43d4fabe77 Author: Mohammad Heib Date: Sun Jan 4 23:31:01 2026 +0200 net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the newly created segments. Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this truesize subtraction in skb_segment_list() was valid because fragments still carry a reference to the original socket. However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed this behavior by ensuring that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the stack. This change meant that the entire socket memory charge remained with the head SKB, but the corresponding accounting logic in skb_segment_list() was never updated. As a result, the current code unconditionally adds each fragment's truesize to delta_truesize and subtracts it from the parent SKB. Since the fragments are no longer charged to the socket, this subtraction results in an effective under-count of memory when the head is freed. This causes sk_wmem_alloc to remain non-zero, preventing socket destruction and leading to a persistent memory leak. The leak can be observed via KMEMLEAK when tearing down the networking environment: unreferenced object 0xffff8881e6eb9100 (size 2048): comm "ping", pid 6720, jiffies 4295492526 backtrace: kmem_cache_alloc_noprof+0x5c6/0x800 sk_prot_alloc+0x5b/0x220 sk_alloc+0x35/0xa00 inet6_create.part.0+0x303/0x10d0 __sock_create+0x248/0x640 __sys_socket+0x11b/0x1d0 Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST packets constructed by GRO, the truesize adjustment is removed. The call to skb_release_head_state() must be preserved. As documented in commit cf673ed0e057 ("net: fix fraglist segmentation reference count leak"), it is still required to correctly drop references to SKB extensions that may be overwritten during __copy_skb_header(). Fixes: ed4cccef64c1 ("gro: fix ownership transfer") Signed-off-by: Mohammad Heib Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com Signed-off-by: Jakub Kicinski commit 938d79ec2b059fea2f3bf0f53107650a64372acf Author: Soham Metha Date: Thu Dec 4 01:13:52 2025 +0530 riscv: kexec_image: Fix dead link to boot-image-header.rst Fix the reference to 'boot-image-header.rst', which was moved to 'Documentation/arch/riscv/' in commit 'ed843ae947f8' ("docs: move riscv under arch"). Signed-off-by: Soham Metha Link: https://patch.msgid.link/20251203194355.63265-1-sohammetha01@gmail.com Signed-off-by: Paul Walmsley commit 86c22d475cbca80532da33ed5df73e6814d7a632 Author: Jakub Kicinski Date: Sun Jan 4 08:52:32 2026 -0800 netlink: specs: netdev: clarify the page pool API a little The phrasing of the page-pool-get doc is very confusing. It's supposed to highlight that support depends on the driver doing its part but it sounds like orphaned page pools won't be visible. The description of the ifindex is completely wrong. We move the page pool to loopback and skip the attribute if ifindex is loopback. Link: https://lore.kernel.org/20260104084347.5de3a537@kernel.org Reviewed-by: Donald Hunter Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20260104165232.710460-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5e5be092ffadcab0093464ccd9e30f0c5cce16b9 Author: Guo Ren (Alibaba DAMO Academy) Date: Sun Nov 30 19:58:50 2025 -0500 riscv: pgtable: Cleanup useless VA_USER_XXX definitions These marcos are not used after commit b5b4287accd7 ("riscv: mm: Use hint address in mmap if available"). Cleanup VA_USER_XXX definitions in asm/pgtable.h. Fixes: b5b4287accd7 ("riscv: mm: Use hint address in mmap if available") Signed-off-by: Guo Ren (Alibaba DAMO Academy) Reviewed-by: Jinjie Ruan Link: https://patch.msgid.link/20251201005850.702569-1-guoren@kernel.org Signed-off-by: Paul Walmsley commit 8632180daf735074a746ce2b3808a8f2c079310e Author: Guodong Xu Date: Tue Dec 23 10:44:27 2025 +0800 riscv: cpufeature: Fix Zk bundled extension missing Zknh The Zk extension is a bundle consisting of Zkn, Zkr, and Zkt. The Zkn extension itself is a bundle consisting of Zbkb, Zbkc, Zbkx, Zknd, Zkne, and Zknh. The current implementation of riscv_zk_bundled_exts manually listed the dependencies but missed RISCV_ISA_EXT_ZKNH. Fix this by introducing a RISCV_ISA_EXT_ZKN macro that lists the Zkn components and using it in both riscv_zk_bundled_exts and riscv_zkn_bundled_exts. This adds the missing Zknh extension to Zk and reduces code duplication. Fixes: 0d8295ed975b ("riscv: add ISA extension parsing for scalar crypto") Link: https://patch.msgid.link/20231114141256.126749-4-cleger@rivosinc.com/ Signed-off-by: Guodong Xu Reviewed-by: Clément Léger Link: https://patch.msgid.link/20251223-zk-missing-zknh-v1-1-b627c990ee1a@riscstar.com Signed-off-by: Paul Walmsley commit a7fc8c641cab855824c45e5e8877e40fd528b5df Author: Lorenzo Bianconi Date: Fri Jan 2 12:29:38 2026 +0100 net: airoha: Fix npu rx DMA definitions Fix typos in npu rx DMA descriptor definitions. Fixes: b3ef7bdec66fb ("net: airoha: Add airoha_offload.h header") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260102-airoha-npu-dma-rx-def-fixes-v1-1-205fc6bf7d94@kernel.org Signed-off-by: Jakub Kicinski commit 2fa98059fd5a0936d0951bd14f8990ae0aa5272a Author: Ankit Khushwaha Date: Thu Jan 1 22:58:40 2026 +0530 selftests: mptcp: Mark xerror and die_perror __noreturn Compiler reports potential uses of uninitialized variables in mptcp_connect.c when xerror() is called from failure paths. mptcp_connect.c:1262:11: warning: variable 'raw_addr' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] xerror() terminates execution by calling exit(), but it is not visible to the compiler & assumes control flow may continue past the call. Annotate xerror() with __noreturn so the compiler can correctly reason about control flow and avoid false-positive uninitialized variable warnings. Signed-off-by: Ankit Khushwaha Link: https://patch.msgid.link/20260101172840.90186-1-ankitkhushwaha.linux@gmail.com Signed-off-by: Jakub Kicinski commit f5e9ba959960fb9771c6e4fb1f075b8b74f4e877 Merge: d96bfb686742a8 4bcd49a03b94a5 Author: Jakub Kicinski Date: Mon Jan 5 16:23:44 2026 -0800 Merge branch 'net-sched-fix-memory-leak-on-mirred-loop' Jamal Hadi Salim says: ==================== net/sched: Fix memory leak on mirred loop Initialize at_ingress earlier before the if statement. ==================== Link: https://patch.msgid.link/20260101135608.253079-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 4bcd49a03b94a5e16717961a7d750d676f044436 Author: Victor Nogueira Date: Thu Jan 1 08:56:08 2026 -0500 selftests/tc-testing: Add test case redirecting to self on egress Add single mirred test case that attempts to redirect to self on egress using clsact Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260101135608.253079-3-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 9892353726ad222219aa18c329e3a3636134dd56 Author: Jamal Hadi Salim Date: Thu Jan 1 08:56:07 2026 -0500 net/sched: act_mirred: Fix leak when redirecting to self on egress Whenever a mirred redirect to self on egress happens, mirred allocates a new skb (skb_to_send). The loop to self check was done after that allocation, but was not freeing the newly allocated skb, causing a leak. Fix this by moving the if-statement to before the allocation of the new skb. The issue was found by running the accompanying tdc test in 2/2 with config kmemleak enabled. After a few minutes the kmemleak thread ran and reported the leak coming from mirred. Fixes: 1d856251a009 ("net/sched: act_mirred: fix loop detection") Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260101135608.253079-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 2bb83bc42be6280d9bc363b8fbcd6fdab690d16d Author: Mark Harmstone Date: Fri Dec 19 18:15:28 2025 +0000 btrfs: show correct warning if can't read data reloc tree If a filesystem is missing its data reloc tree, we get something like this in dmesg: BTRFS warning (device loop11): failed to read root (objectid=4): -2 BTRFS error (device loop11): open_ctree failed: -2 objectid is BTRFS_DEV_TREE_OBJECTID, but this should actually be the value of BTRFS_DATA_RELOC_TREE_OBJECTID. btrfs_read_roots() prints location.objectid on failure, but this isn't set when reading the data reloc tree. Set location.objectid to the correct value on failure, so that the error message makes sense. Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 530e3d4af566ca44807d79359b90794dea24c4f3 Author: Suchit Karunakaran Date: Fri Dec 19 22:44:34 2025 +0530 btrfs: fix NULL pointer dereference in do_abort_log_replay() Coverity reported a NULL pointer dereference issue (CID 1666756) in do_abort_log_replay(). When btrfs_alloc_path() fails in replay_one_buffer(), wc->subvol_path is NULL, but btrfs_abort_log_replay() calls do_abort_log_replay() which unconditionally dereferences wc->subvol_path when attempting to print debug information. Fix this by adding a NULL check before dereferencing wc->subvol_path in do_abort_log_replay(). Fixes: 2753e4917624 ("btrfs: dump detailed info and specific messages on log replay failures") Reviewed-by: Filipe Manana Signed-off-by: Suchit Karunakaran Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit cefd80925180a85c818e18c2876911b002a595fd Author: Qu Wenruo Date: Thu Dec 18 15:15:29 2025 +1030 btrfs: force free space tree for bs > ps cases [BUG] Currently we only enforcing the free space tree for bs < ps cases, but with the recently added bs > ps support, we lack the free space tree enforcing, causing explicit v1 cache mount option to fail on bs > ps cases: # mount -o space_cache=v1 /dev/test/scratch1 /mnt/btrfs/ mount: /mnt/btrfs: wrong fs type, bad option, bad superblock on /dev/mapper/test-scratch1, missing codepage or helper program, or other error. dmesg(1) may have more information after failed mount system call. # dmesg -t | tail -n7 BTRFS: device fsid ac14a6fa-4ec9-449e-aec9-7d1777bfdc06 devid 1 transid 11 /dev/mapper/test-scratch1 (253:3) scanned by mount (2849) BTRFS info (device dm-3): first mount of filesystem ac14a6fa-4ec9-449e-aec9-7d1777bfdc06 BTRFS info (device dm-3): using crc32c checksum algorithm BTRFS warning (device dm-3): support for block size 8192 with page size 4096 is experimental, some features may be missing BTRFS warning (device dm-3): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 BTRFS warning (device dm-3): v1 space cache is not supported for page size 4096 with sectorsize 8192 BTRFS error (device dm-3): open_ctree failed: -22 [FIX] Just enable the same free space tree for bs > ps cases, aligning the behavior to bs < ps cases. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 30bcf4e824aa37d305502f52e1527c7b1eabef3d Author: Qu Wenruo Date: Thu Dec 18 15:15:28 2025 +1030 btrfs: only enforce free space tree if v1 cache is required for bs < ps cases [BUG] Since the introduction of btrfs bs < ps support, v1 cache was never on the plan due to its hard coded PAGE_SIZE usage, and the future plan to properly deprecate it. However for bs < ps cases, even if 'nospace_cache,clear_cache' mount option is specified, it's never respected and free space tree is always enabled: mkfs.btrfs -f -O ^bgt,fst $dev mount $dev $mnt -o clear_cache,nospace_cache umount $mnt btrfs ins dump-super $dev ... compat_ro_flags 0x3 ( FREE_SPACE_TREE | FREE_SPACE_TREE_VALID ) ... This means a different behavior compared to bs >= ps cases. [CAUSE] The forcing usage of v2 space cache is done inside btrfs_set_free_space_cache_settings(), however it never checks if we're even using space cache but always enabling v2 cache. [FIX] Instead unconditionally enable v2 cache, only forcing v2 cache if the old v1 cache is required. Now v2 space cache can be properly disabled on bs < ps cases: mkfs.btrfs -f -O ^bgt,fst $dev mount $dev $mnt -o clear_cache,nospace_cache umount $mnt btrfs ins dump-super $dev ... compat_ro_flags 0x0 ... Fixes: 9f73f1aef98b ("btrfs: force v2 space cache usage for subpage mount") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8731f2c50b0b1d2b58ed5b9671ef2c4bdc2f8347 Author: Filipe Manana Date: Tue Dec 16 14:51:52 2025 +0000 btrfs: release path before initializing extent tree in btrfs_read_locked_inode() In btrfs_read_locked_inode() we are calling btrfs_init_file_extent_tree() while holding a path with a read locked leaf from a subvolume tree, and btrfs_init_file_extent_tree() may do a GFP_KERNEL allocation, which can trigger reclaim. This can create a circular lock dependency which lockdep warns about with the following splat: [6.1433] ====================================================== [6.1574] WARNING: possible circular locking dependency detected [6.1583] 6.18.0+ #4 Tainted: G U [6.1591] ------------------------------------------------------ [6.1599] kswapd0/117 is trying to acquire lock: [6.1606] ffff8d9b6333c5b8 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1625] but task is already holding lock: [6.1633] ffffffffa4ab8ce0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x195/0xc60 [6.1646] which lock already depends on the new lock. [6.1657] the existing dependency chain (in reverse order) is: [6.1667] -> #2 (fs_reclaim){+.+.}-{0:0}: [6.1677] fs_reclaim_acquire+0x9d/0xd0 [6.1685] __kmalloc_cache_noprof+0x59/0x750 [6.1694] btrfs_init_file_extent_tree+0x90/0x100 [6.1702] btrfs_read_locked_inode+0xc3/0x6b0 [6.1710] btrfs_iget+0xbb/0xf0 [6.1716] btrfs_lookup_dentry+0x3c5/0x8e0 [6.1724] btrfs_lookup+0x12/0x30 [6.1731] lookup_open.isra.0+0x1aa/0x6a0 [6.1739] path_openat+0x5f7/0xc60 [6.1746] do_filp_open+0xd6/0x180 [6.1753] do_sys_openat2+0x8b/0xe0 [6.1760] __x64_sys_openat+0x54/0xa0 [6.1768] do_syscall_64+0x97/0x3e0 [6.1776] entry_SYSCALL_64_after_hwframe+0x76/0x7e [6.1784] -> #1 (btrfs-tree-00){++++}-{3:3}: [6.1794] lock_release+0x127/0x2a0 [6.1801] up_read+0x1b/0x30 [6.1808] btrfs_search_slot+0x8e0/0xff0 [6.1817] btrfs_lookup_inode+0x52/0xd0 [6.1825] __btrfs_update_delayed_inode+0x73/0x520 [6.1833] btrfs_commit_inode_delayed_inode+0x11a/0x120 [6.1842] btrfs_log_inode+0x608/0x1aa0 [6.1849] btrfs_log_inode_parent+0x249/0xf80 [6.1857] btrfs_log_dentry_safe+0x3e/0x60 [6.1865] btrfs_sync_file+0x431/0x690 [6.1872] do_fsync+0x39/0x80 [6.1879] __x64_sys_fsync+0x13/0x20 [6.1887] do_syscall_64+0x97/0x3e0 [6.1894] entry_SYSCALL_64_after_hwframe+0x76/0x7e [6.1903] -> #0 (&delayed_node->mutex){+.+.}-{3:3}: [6.1913] __lock_acquire+0x15e9/0x2820 [6.1920] lock_acquire+0xc9/0x2d0 [6.1927] __mutex_lock+0xcc/0x10a0 [6.1934] __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1944] btrfs_evict_inode+0x20b/0x4b0 [6.1952] evict+0x15a/0x2f0 [6.1958] prune_icache_sb+0x91/0xd0 [6.1966] super_cache_scan+0x150/0x1d0 [6.1974] do_shrink_slab+0x155/0x6f0 [6.1981] shrink_slab+0x48e/0x890 [6.1988] shrink_one+0x11a/0x1f0 [6.1995] shrink_node+0xbfd/0x1320 [6.1002] balance_pgdat+0x67f/0xc60 [6.1321] kswapd+0x1dc/0x3e0 [6.1643] kthread+0xff/0x240 [6.1965] ret_from_fork+0x223/0x280 [6.1287] ret_from_fork_asm+0x1a/0x30 [6.1616] other info that might help us debug this: [6.1561] Chain exists of: &delayed_node->mutex --> btrfs-tree-00 --> fs_reclaim [6.1503] Possible unsafe locking scenario: [6.1110] CPU0 CPU1 [6.1411] ---- ---- [6.1707] lock(fs_reclaim); [6.1998] lock(btrfs-tree-00); [6.1291] lock(fs_reclaim); [6.1581] lock(&delayed_node->mutex); [6.1874] *** DEADLOCK *** [6.1716] 2 locks held by kswapd0/117: [6.1999] #0: ffffffffa4ab8ce0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x195/0xc60 [6.1294] #1: ffff8d998344b0e0 (&type->s_umount_key#40){++++}- {3:3}, at: super_cache_scan+0x37/0x1d0 [6.1596] stack backtrace: [6.1183] CPU: 11 UID: 0 PID: 117 Comm: kswapd0 Tainted: G U 6.18.0+ #4 PREEMPT(lazy) [6.1185] Tainted: [U]=USER [6.1186] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023 [6.1187] Call Trace: [6.1187] [6.1189] dump_stack_lvl+0x6e/0xa0 [6.1192] print_circular_bug.cold+0x17a/0x1c0 [6.1194] check_noncircular+0x175/0x190 [6.1197] __lock_acquire+0x15e9/0x2820 [6.1200] lock_acquire+0xc9/0x2d0 [6.1201] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1204] __mutex_lock+0xcc/0x10a0 [6.1206] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1208] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1211] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1213] __btrfs_release_delayed_node.part.0+0x39/0x2f0 [6.1215] btrfs_evict_inode+0x20b/0x4b0 [6.1217] ? lock_acquire+0xc9/0x2d0 [6.1220] evict+0x15a/0x2f0 [6.1222] prune_icache_sb+0x91/0xd0 [6.1224] super_cache_scan+0x150/0x1d0 [6.1226] do_shrink_slab+0x155/0x6f0 [6.1228] shrink_slab+0x48e/0x890 [6.1229] ? shrink_slab+0x2d2/0x890 [6.1231] shrink_one+0x11a/0x1f0 [6.1234] shrink_node+0xbfd/0x1320 [6.1236] ? shrink_node+0xa2d/0x1320 [6.1236] ? shrink_node+0xbd3/0x1320 [6.1239] ? balance_pgdat+0x67f/0xc60 [6.1239] balance_pgdat+0x67f/0xc60 [6.1241] ? finish_task_switch.isra.0+0xc4/0x2a0 [6.1246] kswapd+0x1dc/0x3e0 [6.1247] ? __pfx_autoremove_wake_function+0x10/0x10 [6.1249] ? __pfx_kswapd+0x10/0x10 [6.1250] kthread+0xff/0x240 [6.1251] ? __pfx_kthread+0x10/0x10 [6.1253] ret_from_fork+0x223/0x280 [6.1255] ? __pfx_kthread+0x10/0x10 [6.1257] ret_from_fork_asm+0x1a/0x30 [6.1260] This is because: 1) The fsync task is holding an inode's delayed node mutex (for a directory) while calling __btrfs_update_delayed_inode() and that needs to do a search on the subvolume's btree (therefore read lock some extent buffers); 2) The lookup task, at btrfs_lookup(), triggered reclaim with the GFP_KERNEL allocation done by btrfs_init_file_extent_tree() while holding a read lock on a subvolume leaf; 3) The reclaim triggered kswapd which is doing inode eviction for the directory inode the fsync task is using as an argument to btrfs_commit_inode_delayed_inode() - but in that call chain we are trying to read lock the same leaf that the lookup task is holding while calling btrfs_init_file_extent_tree() and doing the GFP_KERNEL allocation. Fix this by calling btrfs_init_file_extent_tree() after we don't need the path anymore and release it in btrfs_read_locked_inode(). Reported-by: Thomas Hellström Link: https://lore.kernel.org/linux-btrfs/6e55113a22347c3925458a5d840a18401a38b276.camel@linux.intel.com/ Fixes: 8679d2687c35 ("btrfs: initialize inode::file_extent_tree after i_mode has been set") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1aff297ffb925ee49299f86af5fcdf854cb48c5f Author: Qu Wenruo Date: Sun Dec 7 14:53:20 2025 +1030 btrfs: avoid access-beyond-folio for bs > ps encoded writes [POTENTIAL BUG] If the system page size is 4K and fs block size is 8K, and max_inline mount option is set to 6K, we can inline a 6K sized data extent. Then a encoded write submitted a compressed extent which is at file offset 0, and the compressed length is 6K, which is allowed to be inlined. Now a read beyond page boundary is triggered inside write_extent_buffer() from insert_inline_extent(). [CAUSE] Currently the function __cow_file_range_inline() can only accept a single folio. For regular compressed write path, we always allocate the compressed folios using the minimal order matching the block size, thus the @compressed_folio should always cover a full fs block thus it is fine. But for encoded writes, they allocate page size folios, this means we can hit a case where the compressed data is smaller than block size but still larger than page size, in that case __cow_file_range_inline() will be called with @compressed_size larger than a page. In that case we will trigger a read beyond the folio inside insert_inline_extent(). Thankfully this is not that common, as the default max_inline is only 2048 bytes, smaller than PAGE_SIZE, and bs > ps support is still experimental. [FIX] We need to either allow insert_inline_extent() to accept a page array to properly support such case, or reject such inline extent. The latter is a much simpler solution, and considering bs > ps will stay as a corner case and non-default max_inline will be even rarer, I don't think we really need to fulfill such niche. So just reject any inline extent that's larger than PAGE_SIZE, and add an extra ASSERT() to insert_inline_extent() to catch such beyond-boundary access. Fixes: ec20799064c8 ("btrfs: enable encoded read/write/send for bs > ps cases") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d96bfb686742a8b11cca3fca299ff9fe307ca5a9 Merge: 1806d210e5a8f4 caa20e9e155b9d Author: Jakub Kicinski Date: Mon Jan 5 16:14:52 2026 -0800 Merge branch 'vsock-fix-so_zerocopy-on-accept-ed-vsocks' Michal Luczaj says: ==================== vsock: Fix SO_ZEROCOPY on accept()ed vsocks vsock has its own handling of setsockopt(SO_ZEROCOPY). Which works just fine unless socket comes from a call to accept(). Because SOCK_CUSTOM_SOCKOPT flag is missing, attempting to set the option always results in errno EOPNOTSUPP. ==================== Link: https://patch.msgid.link/20251229-vsock-child-sock-custom-sockopt-v2-0-64778d6c4f88@rbox.co Signed-off-by: Jakub Kicinski commit caa20e9e155b9d2afcf658e2909659c0be45ec12 Author: Michal Luczaj Date: Mon Dec 29 20:43:11 2025 +0100 vsock/test: Test setting SO_ZEROCOPY on accept()ed socket Make sure setsockopt(SOL_SOCKET, SO_ZEROCOPY) on an accept()ed socket is handled by vsock's implementation. Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20251229-vsock-child-sock-custom-sockopt-v2-2-64778d6c4f88@rbox.co Signed-off-by: Jakub Kicinski commit ce5e612dd411de096aa041b9e9325ba1bec5f9f4 Author: Michal Luczaj Date: Mon Dec 29 20:43:10 2025 +0100 vsock: Make accept()ed sockets use custom setsockopt() SO_ZEROCOPY handling in vsock_connectible_setsockopt() does not get called on accept()ed sockets due to a missing flag. Flip it. Fixes: e0718bd82e27 ("vsock: enable setting SO_ZEROCOPY") Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20251229-vsock-child-sock-custom-sockopt-v2-1-64778d6c4f88@rbox.co Signed-off-by: Jakub Kicinski commit c0fe2994f9a9d0a2ec9e42441ea5ba74b6a16176 Author: Ilya Dryomov Date: Mon Jan 5 19:23:19 2026 +0100 libceph: make calc_target() set t->paused, not just clear it Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it's able to determine when the request should be paused. Setting t->paused is left to __submit_request() which is fine for regular requests but doesn't work for linger requests -- since __submit_request() doesn't operate on linger requests, there is nowhere for lreq->t.paused to be set. One consequence of this is that watches don't get reestablished on paused -> unpaused transitions in cases where requests have been paused long enough for the (paused) unwatch request to time out and for the subsequent (re)watch request to enter the paused state. On top of the watch not getting reestablished, rbd_reregister_watch() gets stuck with rbd_dev->watch_mutex held: rbd_register_watch __rbd_register_watch ceph_osdc_watch linger_reg_commit_wait It's waiting for lreq->reg_commit_wait to be completed, but for that to happen the respective request needs to end up on need_resend_linger list and be kicked when requests are unpaused. There is no chance for that if the request in question is never marked paused in the first place. The fact that rbd_dev->watch_mutex remains taken out forever then prevents the image from getting unmapped -- "rbd unmap" would inevitably hang in D state on an attempt to grab the mutex. Cc: stable@vger.kernel.org Reported-by: Raphael Zimmer Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit e4fdbca2dc774366aca6532b57bfcdaae29aaf63 Author: Jens Axboe Date: Mon Jan 5 11:42:05 2026 -0700 io_uring/io-wq: remove io_wq_for_each_worker() return value The only use of this helper is to iterate all of the workers, and hence all callers will pass in a func that always returns false to do that. As none of the callers use the return value, get rid of it. Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 72d7f4573660287f1b66c30319efecd6fcde92ee Author: Alan Liu Date: Mon Dec 22 12:26:35 2025 +0800 drm/amdgpu: Fix query for VPE block_type and ip_count [Why] Query for VPE block_type and ip_count is missing. [How] Add VPE case in ip_block_type and hw_ip_count query. Reviewed-by: Lang Yu Signed-off-by: Alan Liu Signed-off-by: Alex Deucher (cherry picked from commit a6ea0a430aca5932b9c75d8e38deeb45665dd2ae) Cc: stable@vger.kernel.org commit e0d20a7658129fc681e392ba27edea99b77c2e21 Author: Timur Kristóf Date: Sat Dec 6 03:31:04 2025 +0100 drm/amd/display: Add missing encoder setup to DACnEncoderControl Apparently the DAC encoder needs to be set up before use. The BIOS parser in DC did not support this so I assumed it was not necessary, but the DAC doesn't work without it on some GPUs. Fixes: 69b29b894660 ("drm/amd/display: Hook up DAC to bios_parser_encoder_control") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit bb5dfe2f5630ce344c654c705d28b4e20cb9d334) commit fd40c146c8ed7f7e8ae36922dcc583bd0ca70b75 Author: Timur Kristóf Date: Sat Dec 6 03:31:03 2025 +0100 drm/amd/display: Correct color depth for SelectCRTC_Source Pass the correct enum values as expected by the VBIOS. Previously the actual bit depth integer value was passed, which was a mistake. Fixes: 7fb4f254c8eb ("drm/amd/display: Add SelectCRTC_Source to BIOS parser") Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit cdf6e4c0cdab129ffc4e41a8ac53a0738f805072) commit 7ed51e3a1381422278933d0d3ebda0268b6825de Author: Pratap Nirujogi Date: Tue Dec 9 20:22:15 2025 -0500 drm/amd/amdgpu: Fix SMU warning during isp suspend-resume ISP mfd child devices are using genpd and the system suspend-resume operations between genpd and amdgpu parent device which uses only runtime suspend-resume are not in sync. Linux power manager during suspend-resume resuming the genpd devices earlier than the amdgpu parent device. This is resulting in the below warning as SMU is in suspended state when genpd attempts to resume ISP. WARNING: CPU: 13 PID: 5435 at drivers/gpu/drm/amd/amdgpu/../pm/swsmu/amdgpu_smu.c:398 smu_dpm_set_power_gate+0x36f/0x380 [amdgpu] To fix this warning isp suspend-resume is handled as part of amdgpu parent device suspend-resume instead of genpd sequence. Each ISP MFD child device is marked as dev_pm_syscore_device to skip genpd suspend-resume and use pm_runtime_force api's to suspend-resume the devices when callbacks from amdgpu are received. Co-developed-by: Gjorgji Rosikopulos Signed-off-by: Gjorgji Rosikopulos Signed-off-by: Bin Du Signed-off-by: Pratap Nirujogi Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 0288a345f19b2162546352161509bb24614729e1) commit 531b43260928a53f4190f3e61de788551af6157e Author: Alex Deucher Date: Thu Nov 13 14:12:10 2025 -0500 drm/amdgpu: always backup and reemit fences If when we backup the ring contents for reemit before a ring reset, we skip jobs associated with the bad context, however, we need to make sure the fences are reemited as unprocessed submissions may depend on them. v2: clean up fence handling, make helpers static Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 155a748f14bc0b72783994dea7c5a12276730342) commit 9fc27cbabee6d2e63b0268ca709ad3129b3ac50d Author: Alex Deucher Date: Thu Nov 13 13:24:10 2025 -0500 drm/amdgpu: don't reemit ring contents more than once If we cancel a bad job and reemit the ring contents, and we get another timeout, cancel everything rather than reemitting. The wptr markers are only relevant for the original emit. If we reemit, the wptr markers are no longer correct. Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit fb62a2067ca4555a6572d911e05919a311c010aa) commit dc8a887de1a7d397ab4131f45676e89565417aa8 Author: Yang Wang Date: Mon Dec 15 17:51:11 2025 +0800 drm/amd/pm: force send pcie parmater on navi1x v1: the PMFW didn't initialize the PCIe DPM parameters and requires the KMD to actively provide these parameters. v2: clean & remove unused code logic (lijo) Fixes: 1a18607c07bb ("drm/amd/pm: override pcie dpm parameters only if it is necessary") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4671 Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit b0dbd5db7cf1f81e4aaedd25cb5e72ce369387b2) commit 4f74c2dd970611d3ec3bb0d58215e73af5cd7214 Author: Yang Wang Date: Thu Dec 11 10:47:18 2025 +0800 drm/amd/pm: fix wrong pcie parameter on navi1x fix wrong pcie dpm parameter on navi1x Fixes: 1a18607c07bb ("drm/amd/pm: override pcie dpm parameters only if it is necessary") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4671 Signed-off-by: Yang Wang Co-developed-by: Kenneth Feng Signed-off-by: Kenneth Feng Acked-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 5c5189cf4b0cc0a22bac74a40743ee711cff07f8) commit 19158c7332468bc28572bdca428e89c7954ee1b1 Author: Alex Deucher Date: Mon Jun 30 10:47:09 2025 -0400 drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] clockInfo[] is a generic uchar pointer to variable sized structures which vary from ASIC to ASIC. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4374 Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit dc135aa73561b5acc74eadf776e48530996529a3) Cc: stable@vger.kernel.org commit 6ce6fbfddc5b127e4f57c3b5bfdcf40239a4fc2f Author: Nathan Chancellor Date: Sat Dec 13 19:58:11 2025 +0900 drm/amd/display: Reduce number of arguments of dcn30's CalculateWatermarksAndDRAMSpeedChangeSupport() CalculateWatermarksAndDRAMSpeedChangeSupport() has a large number of parameters, which must be passed on the stack. Most of the parameters between the two callsites are the same, so they can be accessed through the existing mode_lib pointer, instead of being passed as explicit arguments. Doing this reduces the stack size of dml30_ModeSupportAndSystemConfigurationFull() from 1912 bytes to 1840 bytes building for x86_64 with clang-22, helping stay under the 2048 byte limit for display_mode_vba_30.c. Additionally, now that there is a pointer to mode_lib->vba available, use 'v' consistently throughout the entire function. Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher (cherry picked from commit 563dfbefdf633c8d958398ddfa3955f9f40e47d9) commit f54a91f5337cd918eb86cf600320d25b6cfd8209 Author: Nathan Chancellor Date: Sat Dec 13 19:58:10 2025 +0900 drm/amd/display: Reduce number of arguments of dcn30's CalculatePrefetchSchedule() After an innocuous optimization change in clang-22, dml30_ModeSupportAndSystemConfigurationFull() is over the 2048 byte stack limit for display_mode_vba_30.c. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3529:6: warning: stack frame size (2096) exceeds limit (2048) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Wframe-larger-than] 3529 | void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) | ^ With clang-21, this function was already close to the limit: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn30/display_mode_vba_30.c:3529:6: warning: stack frame size (1912) exceeds limit (1586) in 'dml30_ModeSupportAndSystemConfigurationFull' [-Wframe-larger-than] 3529 | void dml30_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) | ^ CalculatePrefetchSchedule() has a large number of parameters, which must be passed on the stack. Most of the parameters between the two callsites are the same, so they can be accessed through the existing mode_lib pointer, instead of being passed as explicit arguments. Doing this reduces the stack size of dml30_ModeSupportAndSystemConfigurationFull() from 2096 bytes to 1912 bytes with clang-22. Closes: https://github.com/ClangBuiltLinux/linux/issues/2117 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher (cherry picked from commit b20b3fc4210f83089f835cdb91deec4b0778761a) commit 70740454377f1ba3ff32f5df4acd965db99d055b Author: Nathan Chancellor Date: Sat Dec 13 15:16:43 2025 +0900 drm/amd/display: Apply e4479aecf658 to dml After an innocuous optimization change in clang-22, allmodconfig (which enables CONFIG_KASAN and CONFIG_WERROR) breaks with: drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1724:6: error: stack frame size (3144) exceeds limit (3072) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] 1724 | void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) | ^ With clang-21, this function was already pretty close to the existing limit of 3072 bytes. drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1724:6: error: stack frame size (2904) exceeds limit (2048) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than] 1724 | void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib) | ^ A similar situation occurred in dml2, which was resolved by commit e4479aecf658 ("drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang") by increasing the limit for clang when compile testing with certain sanitizer enabled, so that allmodconfig (an easy testing target) continues to work. Apply that same change to the dml folder to clear up the warning for allmodconfig, unbreaking the build. Closes: https://github.com/ClangBuiltLinux/linux/issues/2135 Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher (cherry picked from commit 25314b453cf812150e9951a32007a32bba85707e) Cc: stable@vger.kernel.org commit 7f98ab9da046865d57c102fd3ca9669a29845f67 Merge: 3609fa95fb0f2c c1c050f92d8f6a Author: Linus Torvalds Date: Mon Jan 5 14:10:48 2026 -0800 Merge tag 'for-6.19-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix potential deadlock due to mismatching transaction states when waiting for the current transaction - fix squota accounting with nested snapshots - fix quota inheritance of qgroups with multiple parent qgroups - fix NULL inode pointer in evict tracepoint - fix writes beyond end of file on systems with 64K page size and 4K block size - fix logging of inodes after exchange rename - fix use after free when using ref_tracker feature - space reservation fixes * tag 'for-6.19-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix reservation leak in some error paths when inserting inline extent btrfs: do not free data reservation in fallback from inline due to -ENOSPC btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() btrfs: always detect conflicting inodes when logging inode refs btrfs: fix beyond-EOF write handling btrfs: fix deadlock in wait_current_trans() due to ignored transaction type btrfs: fix NULL dereference on root when tracing inode eviction btrfs: qgroup: update all parent qgroups when doing quick inherit btrfs: fix qgroup_snapshot_quick_inherit() squota bug commit 11194b416ef95012c2cfe5f546d71af07b639e93 Author: Sam Edwards Date: Tue Dec 30 20:05:06 2025 -0800 libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state. If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like: libceph: [0] got 0 extents libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state. Cc: stable@vger.kernel.org Fixes: f628d7999727 ("libceph: add sparse read support to OSD client") Signed-off-by: Sam Edwards Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit e84b48d31b5008932c0a0902982809fbaa1d3b70 Author: Ilya Dryomov Date: Mon Dec 29 15:14:48 2025 +0100 libceph: return the handler error from mon_handle_auth_done() Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_done(). This results in higher layers learning that (despite the monitor considering us to be successfully authenticated) something went wrong in the authentication phase and reacting accordingly, but msgr2 still trying to proceed with establishing the session in the background. In the case of secure mode this can trigger a WARN in setup_crypto() and later lead to a NULL pointer dereference inside of prepare_auth_signature(). Cc: stable@vger.kernel.org Fixes: cd1a677cad99 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)") Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit e0392a10c9e80a3991855a81317da3039fcbe32c Author: Jens Axboe Date: Mon Jan 5 07:42:48 2026 -0700 io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic A previous commit added this helper, and had it terminate if false is returned from the handler. However, that is completely opposite, it should abort the loop if true is returned. Fix this up by having io_wq_for_each_worker() keep iterating as long as false is returned, and only abort if true is returned. Cc: stable@vger.kernel.org Fixes: 751eedc4b4b7 ("io_uring/io-wq: move worker lists to struct io_wq_acct") Reported-by: Lewis Campbell Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit 7966cf0ebe32c981bfa3db252cb5fc3bb1bf2e77 Author: Malaya Kumar Rout Date: Tue Dec 30 17:26:13 2025 +0530 PM: hibernate: Fix crash when freeing invalid crypto compressor When crypto_alloc_acomp() fails, it returns an ERR_PTR value, not NULL. The cleanup code in save_compressed_image() and load_compressed_image() unconditionally calls crypto_free_acomp() without checking for ERR_PTR, which causes crypto_acomp_tfm() to dereference an invalid pointer and crash the kernel. This can be triggered when the compression algorithm is unavailable (e.g., CONFIG_CRYPTO_LZO not enabled). Fix by adding IS_ERR_OR_NULL() checks before calling crypto_free_acomp() and acomp_request_free(), similar to the existing kthread_stop() check. Fixes: b03d542c3c95 ("PM: hibernate: Use crypto_acomp interface") Signed-off-by: Malaya Kumar Rout Cc: 6.15+ # 6.15+ [ rjw: Added 2 empty code lines ] Link: https://patch.msgid.link/20251230115613.64080-1-mrout@redhat.com Signed-off-by: Rafael J. Wysocki commit 1ca8677d9f3491e51395b0e6b9a2b7a75089dc6f Author: Lorenzo Pieralisi Date: Mon Jan 5 11:17:05 2026 +0100 ACPI: PCI: IRQ: Fix INTx GSIs signedness In ACPI Global System Interrupts (GSIs) are described using a 32-bit value. ACPI/PCI legacy interrupts (INTx) parsing code treats GSIs as 'int', which poses issues if the GSI interrupt value is a 32-bit value with the MSB set (as required in some interrupt configurations - eg ARM64 GICv5 systems) because acpi_pci_link_allocate_irq() treats a negative gsi return value as a failed GSI allocation (and acpi_irq_get_penalty() would trigger an out-of-bounds array dereference if the 'irq' param is a negative value). Fix ACPI/PCI legacy INTx parsing by converting variables representing GSIs from 'int' to 'u32' bringing the code in line with the ACPI specification and fixing the current parsing issue. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Bjorn Helgaas Link: https://patch.msgid.link/20260105101705.36703-1-lpieralisi@kernel.org Signed-off-by: Rafael J. Wysocki commit df27c03b9e3ef2baa9e9c9f56a771d463a84489d Author: Bjorn Helgaas Date: Mon Nov 3 16:19:26 2025 -0600 PCI: meson: Report that link is up while in ASPM L0s and L1 states Previously meson_pcie_link_up() only returned true if the link was in the L0 state. This was incorrect because hardware autonomously manages transitions between L0, L0s, and L1 while both components on the link stay in D0. Those states should all be treated as "link is active". Returning false when the device was in L0s or L1 broke config accesses because dw_pcie_other_conf_map_bus() fails if the link is down, which caused errors like this: meson-pcie fc000000.pcie: error: wait linkup timeout pci 0000:01:00.0: BAR 0: error updating (0xfc700004 != 0xffffffff) Remove the LTSSM state check, timeout, speed check, and error message from meson_pcie_link_up(), the dw_pcie_ops.link_up() method, so it is a simple boolean check of whether the link is active. Timeouts and error messages are handled at a higher level, e.g., dw_pcie_wait_for_link(). Fixes: 9c0ef6d34fdb ("PCI: amlogic: Add the Amlogic Meson PCIe controller driver") Reported-by: Linnaea Lavia Closes: https://lore.kernel.org/r/DM4PR05MB102707B8CDF84D776C39F22F2C7F0A@DM4PR05MB10270.namprd05.prod.outlook.com [bhelgaas: squash removal of unused WAIT_LINKUP_TIMEOUT by Martin Blumenstingl : https://patch.msgid.link/20260105125625.239497-1-martin.blumenstingl@googlemail.com] Signed-off-by: Bjorn Helgaas Tested-by: Linnaea Lavia Tested-by: Neil Armstrong # on BananaPi M2S Reviewed-by: Neil Armstrong Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251103221930.1831376-1-helgaas@kernel.org Link: https://patch.msgid.link/20260105125625.239497-1-martin.blumenstingl@googlemail.com commit c92724b40c2f36ca0f2a789cf8cb80dd51107f25 Author: Haiyue Wang Date: Tue Dec 30 21:30:50 2025 +0800 docs: fix PPR for AMD EPYC broken link As 'AMD Documentation Hub' [1] announced: "All technical documentation, including for AMD EPYC™ processors ..., and more is now hosted on the AMD Technical Information Portal (TIP) [2]". By searching the No.55898, update the new URL. [1] https://www.amd.com/en/search/documentation/hub.html [2] https://docs.amd.com/ Signed-off-by: Haiyue Wang Acked-by: Bagas Sanjaya Link: https://patch.msgid.link/20251230133101.14362-1-haiyuewa@163.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit efbc288d15ca85fecbe6c19d1e55249138d68ca9 Author: Akiyoshi Kurita Date: Wed Dec 31 06:34:31 2025 +0900 docs: alienware-wmi: fix typo Fix a typo in the manual fan control description ("aproximate" -> "approximate"). Signed-off-by: Akiyoshi Kurita Reviewed-by: Bagas Sanjaya Reviewed-by: Kurt Borja Link: https://patch.msgid.link/20251230213431.656106-1-weibu@redadmin.org Signed-off-by: Ilpo Järvinen commit a54e9902e7edf74d0f305fb9107d15daa6549c2c Author: Denis Benato Date: Sat Jan 3 01:37:31 2026 +0100 platform/x86: asus-armoury: add support for GA403UV Add TDP data for laptop model GA403UV. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260103003731.404383-4-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 487764a514e97e3b921c4eb13ab35920e09f6b7d Author: Denis Benato Date: Sat Jan 3 01:37:30 2026 +0100 asus-armoury: fix ppt data for GA403U* renaming to GA403UI As some GA403U may have different limits restrict the DMI match to the specific GA403UI model. Fixes: 39ae6c50e599 ("platform/x86: asus-armoury: add ppt_* and nv_* tuning knobs") Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260103003731.404383-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f5fc40734b0fcd356eabb8ab5abd57b80c286da6 Author: Denis Benato Date: Sat Jan 3 01:37:29 2026 +0100 platform/x86: asus-armoury: add support for GA403WM Add TDP data for laptop model GA403WM. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20260103003731.404383-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f3f380ce6b3d5c9805c7e0b3d5bc28d9ec41e2e8 Author: Kaushlendra Kumar Date: Mon Jan 5 08:48:20 2026 +0530 regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper'). Signed-off-by: Kaushlendra Kumar Link: https://patch.msgid.link/20260105031820.260119-1-kaushlendra.kumar@intel.com Signed-off-by: Mark Brown commit 22a507d7680f2c3499c133f6384349f62f916176 Author: Shengjiu Wang Date: Mon Dec 29 17:04:32 2025 +0800 ASoC: simple-card-utils: Check device node before overwrite direction Even the device node don't exist, the graph_util_parse_link_direction() will overwrite the playback_only and capture_only to be zero. Which cause the playback_only and capture_only are not correct, so check device node exist or not before update the value. Signed-off-by: Shengjiu Wang Acked-by: Kuninori Morimoto Link: https://patch.msgid.link/20251229090432.3964848-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 12cacdfb023d1b2f6c4e5af471f2d5b6f0cbf909 Author: Deep Harsora Date: Fri Jan 2 15:21:24 2026 +0000 ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43 Add missing quirks for some new Dell laptops using cs42l43's speaker outputs. Signed-off-by: Deep Harsora Signed-off-by: Maciej Strozek Link: https://patch.msgid.link/20260102152132.3053106-1-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit 46a16d89d097ac2c93b63382a37d60aa7f21dc71 Author: Johan Hovold Date: Fri Jan 2 12:14:13 2026 +0100 ASoC: codecs: wsa883x: suppress variant printk Drivers should generally be silent on successful probe. Demote the codec variant printk to debug level and instead add a warning in case an unknown variant is ever encountered. Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260102111413.9605-5-johan@kernel.org Signed-off-by: Mark Brown commit 120f3e6ff76209ee2f62a64e5e7e9d70274df42b Author: Johan Hovold Date: Fri Jan 2 12:14:12 2026 +0100 ASoC: codecs: wsa884x: fix codec initialisation The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED. Fix the inverted hw_init flag which was set to false instead of true after initialisation which defeats its purpose and may result in repeated unnecessary initialisation. Similarly, the initial state of the flag was also inverted so that the codec would only be initialised and brought out of regmap cache only mode if its status first transitions to UNATTACHED. Fixes: aa21a7d4f68a ("ASoC: codecs: wsa884x: Add WSA884x family of speakers") Cc: stable@vger.kernel.org # 6.5 Cc: Krzysztof Kozlowski Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Tested-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260102111413.9605-4-johan@kernel.org Signed-off-by: Mark Brown commit 29d71b8a5a40708b3eed9ba4953bfc2312c9c776 Author: Johan Hovold Date: Fri Jan 2 12:14:11 2026 +0100 ASoC: codecs: wsa881x: fix unnecessary initialisation The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED. Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support") Cc: stable@vger.kernel.org # 5.6 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260102111413.9605-3-johan@kernel.org Signed-off-by: Mark Brown commit 49aadf830eb048134d33ad7329d92ecff45d8dbb Author: Johan Hovold Date: Fri Jan 2 12:14:10 2026 +0100 ASoC: codecs: wsa883x: fix unnecessary initialisation The soundwire update_status() callback may be called multiple times with the same ATTACHED status but initialisation should only be done when transitioning from UNATTACHED to ATTACHED. This avoids repeated initialisation of the codecs during boot of machines like the Lenovo ThinkPad X13s: [ 11.614523] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.618022] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.621377] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.624065] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.631382] wsa883x-codec sdw:1:0:0217:0202:00:2: WSA883X Version 1_1, Variant: WSA8835_V2 [ 11.634424] wsa883x-codec sdw:1:0:0217:0202:00:2: WSA883X Version 1_1, Variant: WSA8835_V2 Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support") Cc: stable@vger.kernel.org # 6.0 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20260102111413.9605-2-johan@kernel.org Signed-off-by: Mark Brown commit e3fe30e57649c551757a02e1cad073c47e1e075e Author: Tuo Li Date: Sun Dec 21 02:11:49 2025 +0800 libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decode_choose_args(), if allocation of arg_map->args fails, execution jumps to the fail label and free_choose_arg_map() is called. Since arg_map->size is updated to a non-zero value before memory allocation, free_choose_arg_map() will iterate over arg_map->args and dereference a NULL pointer. To prevent this potential NULL pointer dereference and make free_choose_arg_map() more resilient, add checks for pointers before iterating. Cc: stable@vger.kernel.org Co-authored-by: Ilya Dryomov Signed-off-by: Tuo Li Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit bc417a4baf0badbcb30325cabdaf433d8256c0e3 Author: Viacheslav Dubeyko Date: Tue Dec 16 12:00:06 2025 -0800 ceph: update co-maintainers list in MAINTAINERS Update the list of co-maintainers for Ceph file system following Xiubo's departure. Signed-off-by: Viacheslav Dubeyko Acked-by: Alex Markuze Acked-by: Xiubo Li Signed-off-by: Ilya Dryomov commit e00c3f71b5cf75681dbd74ee3f982a99cb690c2b Author: Ilya Dryomov Date: Mon Dec 15 11:53:31 2025 +0100 libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid. Cc: stable@vger.kernel.org Reported-by: ziming zhang Signed-off-by: Ilya Dryomov commit 818156caffbf55cb4d368f9c3cac64e458fb49c9 Author: ziming zhang Date: Thu Dec 11 16:52:58 2025 +0800 libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: changelog ] Cc: stable@vger.kernel.org Signed-off-by: ziming zhang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 9efb74f84ba82a9de81fc921baf3c5e2decf8256 Author: Brendan Jackman Date: Tue Dec 16 10:16:36 2025 +0000 x86/sev: Disable GCOV on noinstr object With Debian clang version 19.1.7 (3+build5) there are calls to kasan_check_write() from __sev_es_nmi_complete(), which violates noinstr. Fix it by disabling GCOV for the noinstr object, as has been done for previous such instrumentation issues. Note that this file already disables __SANITIZE_ADDRESS__ and __SANITIZE_THREAD__, thus calls like kasan_check_write() ought to be nops regardless of GCOV. This has been fixed in other patches. However, to avoid any other accidental instrumentation showing up, (and since, in principle GCOV is instrumentation and hence should be disabled for noinstr code anyway), disable GCOV overall as well. Signed-off-by: Brendan Jackman Signed-off-by: Borislav Petkov (AMD) Acked-by: Marco Elver Link: https://patch.msgid.link/20251216-gcov-inline-noinstr-v3-3-10244d154451@google.com commit ff5860f5088e9076ebcccf05a6ca709d5935cfa9 Author: Peter Zijlstra Date: Sat Dec 20 14:14:41 2025 +0100 perf: Ensure swevent hrtimer is properly destroyed With the change to hrtimer_try_to_cancel() in perf_swevent_cancel_hrtimer() it appears possible for the hrtimer to still be active by the time the event gets freed. Make sure the event does a full hrtimer_cancel() on the free path by installing a perf_event::destroy handler. Fixes: eb3182ef0405 ("perf/core: Fix system hang caused by cpu-clock usage") Reported-by: CyberUnicorns Tested-by: CyberUnicorns Debugged-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) commit c4f2ae53863de2b5d125c3cdc9ff12668868a74a Merge: 9ace4753a5202b 97872fa28b33a1 Author: Dave Airlie Date: Mon Jan 5 14:44:12 2026 +1000 Merge tag 'drm-rust-fixes-2025-12-29' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes DRM Rust fixes for v6.19-rc4 MAINTAINERS: - Fix Nova GPU driver git links. - Fix typo in TYR driver entry preventing correct behavior of scripts/get_maintainer.pl. - Exclude TYR driver from DRM MISC. Nova Core: - Correctly select RUST_FW_LOADER_ABSTRACTIONS to prevent build errors. - Regenerate nova-core bindgen bindings with '--explicit-padding' to avoid uninitialized bytes. - Fix length of received GSP messages, due to miscalculated message payload size. - Regenerate bindings to derive MaybeZeroable. - Use a bindings alias to derive the firmware version. Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://patch.msgid.link/DFATYVSQRQ4W.1R030NZ34XUZK@kernel.org commit 3f77eda548c82564ae4a23c76b51d36c6e39c865 Author: Trond Myklebust Date: Thu Jan 1 20:16:04 2026 -0500 NFSv4: Don't free slots prematurely if requesting a directory delegation When requesting a directory delegation, it is imperative to hold the slot until the delegation state has been recorded. Otherwise, if a recall comes in, the call to referring_call_exists() will assume the processing is done, and when it doesn't find a delegation, it will assume it has been returned. Fixes: 156b09482933 ("NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK") Signed-off-by: Trond Myklebust commit 105c2db2474f50f109082ab8d070efcc8c3d52bd Author: Trond Myklebust Date: Wed Dec 31 16:41:15 2025 -0500 NFSv4: Fix nfs_clear_verifier_delegated() for delegated directories If the client returns a directory delegation, then look up all the child dentries, and clear their 'verifier delegated' bit, unless subject to a file delegation. Similarly, if a file delegation is being returned, check if there is a directory delegation before clearing a 'verifier delegated' bit. Reported-by: Christoph Hellwig Fixes: 156b09482933 ("NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK") Signed-off-by: Trond Myklebust commit 6f9bda2337f8b0a4c10ed5630e85eceb126a2c5c Author: Anna Schumaker Date: Fri Dec 19 15:13:44 2025 -0500 NFS: Fix directory delegation verifier checks Doing this check in nfs_check_verifier() resulted in many, many more lookups on the wire when running Christoph's delegation benchmarking script. After some experimentation, I found that we can treat directory delegations exactly the same as having a delegated verifier when we reach nfs4_lookup_revalidate() for the best performance. Reported-by: Christoph Hellwig Fixes: 156b09482933 ("NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK") Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 5a74af51c3a6f4cd22c128b0c1c019f68fa90011 Author: Zilin Guan Date: Thu Dec 25 08:45:26 2025 +0000 pnfs/blocklayout: Fix memory leak in bl_parse_scsi() In bl_parse_scsi(), if the block device length is zero, the function returns immediately without releasing the file reference obtained via bl_open_path(), leading to a memory leak. Fix this by jumping to the out_blkdev_put label to ensure the file reference is properly released. Fixes: d76c769c8db4c ("pnfs/blocklayout: Don't add zero-length pnfs_block_dev") Signed-off-by: Zilin Guan Signed-off-by: Trond Myklebust commit 0c728083654f0066f5e10a1d2b0bd0907af19a58 Author: Zilin Guan Date: Thu Dec 25 07:41:03 2025 +0000 pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak. Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources. Fixes: d67ae825a59d6 ("pnfs/flexfiles: Add the FlexFile Layout Driver") Signed-off-by: Zilin Guan Signed-off-by: Trond Myklebust commit cce0be6eb4971456b703aaeafd571650d314bcca Author: Trond Myklebust Date: Wed Dec 31 11:42:31 2025 -0500 NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio(). The latter cannot make progress due to state recovery being needed. It seems that the only safe thing to do here is to kick off a writeback of the folio, without waiting for completion, or else kicking off an asynchronous commit. Reported-by: Wang Zhaolong Fixes: 96780ca55e3c ("NFS: fix up nfs_release_folio() to try to release the page") Signed-off-by: Trond Myklebust commit 857bf9056291a16785ae3be1d291026b2437fc48 Author: Trond Myklebust Date: Mon Dec 8 14:45:00 2025 -0500 pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935 The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given. The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfs_roc(), so that it knows not to wait in this situation. Reported-by: Benjamin Coddington Fixes: 29ade5db1293 ("pNFS: Wait on outstanding layoutreturns to complete in pnfs_roc()") Signed-off-by: Trond Myklebust commit 3609fa95fb0f2c1b099e69e56634edb8fc03f87c Merge: 9ace4753a5202b 235a1eb8d2dcc4 Author: Linus Torvalds Date: Sun Jan 4 16:57:47 2026 -0800 Merge tag 'devicetree-fixes-for-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix an error path memory leak in DT unittest - Update Saravana's bouncing email * tag 'devicetree-fixes-for-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: unittest: Fix memory leak in unittest_data_add() MAINTAINERS: Update Saravana Kannan's email address commit c18f35e4904920db4c51620ba634e4d175b24741 Author: FUJITA Tomonori Date: Tue Dec 23 20:35:38 2025 +0900 objtool/rust: add one more `noreturn` Rust function Fix the following warning: rust/kernel.o: warning: objtool: _RNvXNtNtCs1ewLyjEZ7Le_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix() falls through to next function _RNvXNtNtCs1ewLyjEZ7Le_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated() The commit 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions") introduces u64::from_str_radix(), whose implementation contains a panic path for out-of-range radix values. The panic helper is core::num::from_ascii_radix_panic(). Note that radix is derived from strip_radix() here and is always within the valid range, so kernel never panics. Fixes: 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions") Signed-off-by: FUJITA Tomonori Reviewed-by: Alice Ryhl Tested-by: Alice Ryhl Link: https://patch.msgid.link/20251223113538.1016078-1-fujita.tomonori@gmail.com [ Reworded typo. - Miguel ] Signed-off-by: Miguel Ojeda commit f1db6538794f5af081940850a7976319d376110a Author: Tamir Duberstein Date: Sun Jan 4 08:00:27 2026 -0500 rust: fmt: fix formatting expressions Allow usage like `pr_info!("one + 1 = {}", one + 1)` to compile by ensuring that a reference is taken to the entire expression. [ The errors we would get otherwise look like: error[E0277]: `kernel::fmt::Adapter` doesn't implement `core::fmt::Display` --> ../samples/rust/rust_minimal.rs:34:9 | 34 | pr_info!("one + 1 = {}", one + 1); | ^^^^^^^^^^^^^^^^^^^^--^^^^^^^^^^^ | | | | | required by this formatting parameter | `kernel::fmt::Adapter` cannot be formatted with the default formatter | = help: the trait `core::fmt::Display` is not implemented for `kernel::fmt::Adapter` = note: in format strings you may be able to use `{:?}` (or {:#?} for pretty-print) instead = help: the trait `core::fmt::Display` is implemented for `kernel::fmt::Adapter<&T>` = note: this error originates in the macro `$crate::print_macro` which comes from the expansion of the macro `pr_info` (in Nightly builds, run with -Z macro-backtrace for more info) - Miguel ] Fixes: c5cf01ba8dfe ("rust: support formatting of foreign types") Reported-by: Janne Grunau Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/288089-General/topic/Custom.20formatting/near/566219493 Signed-off-by: Tamir Duberstein Reviewed-by: Alice Ryhl Tested-by: Janne Grunau Reviewed-by: Janne Grunau Link: https://patch.msgid.link/20260104-fmt-paren-v1-1-6b84bc0da78f@gmail.com [ Added Signed-off-by back. Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 946c5efe6a059f7d3303442644ee38384453ff68 Author: Gary Guo Date: Thu Dec 11 18:22:07 2025 +0000 rust: fix off-by-one line number in rustdoc tests When the `#![allow]` line was added, the doctest line number anchor isn't updated which causes the line number printed in kunit test to be off-by-one. Fixes: ab844cf32058 ("rust: allow `unreachable_pub` for doctests") Signed-off-by: Gary Guo Reviewed-by: David Gow Link: https://patch.msgid.link/20251211182208.2791025-1-gary@kernel.org Signed-off-by: Miguel Ojeda commit f6b8d4b7e54ffa1492db476c299c7058603108cb Author: Nakamura Shuta Date: Thu Dec 4 11:43:36 2025 +0900 rust: num: fix typos in Bounded documentation Fix several typos and grammatical errors in the Bounded type documentation: - "less significant bits" -> "least significant bits" - "with in" -> "within" - "withheld" -> "upheld" - "// This" -> "// This" (double space) - "doesn't fits" -> "doesn't fit" (2 occurrences) Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1210 Signed-off-by: Nakamura Shuta Acked-by: Alexandre Courbot Acked-by: Yury Norov (NVIDIA) Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type") Link: https://patch.msgid.link/20251204024336.246587-1-nakamura.shuta@gmail.com [ Removed Link tag due to duplicated URL. - Miguel ] Signed-off-by: Miguel Ojeda commit 1e4e2a847f3c0bb3f34f3b20229be5c0214b80fa Author: Dirk Behme Date: Fri Jan 2 09:48:21 2026 +0100 rust: fmt: Fix grammar in Adapter description Add a missing `and` in the description of the `Adapter`. Fixes: c5cf01ba8dfe ("rust: support formatting of foreign types") Signed-off-by: Dirk Behme Acked-by: Tamir Duberstein Link: https://patch.msgid.link/20260102084821.1077864-1-dirk.behme@de.bosch.com [ Reworded for typo. - Miguel ] Signed-off-by: Miguel Ojeda commit 45f6aed8a835ee2bdd0a5d5ee626a91fe285014f Author: Hang Shu Date: Fri Nov 7 09:39:17 2025 +0000 rust: rbtree: fix documentation typo in CursorMut peek_next method The peek_next method's doc comment incorrectly stated it accesses the "previous" node when it actually accesses the next node. Fix the documentation to accurately reflect the method's behavior. Fixes: 98c14e40e07a ("rust: rbtree: add cursor") Reviewed-by: Alice Ryhl Signed-off-by: Hang Shu Reported-by: Miguel Ojeda Closes: https://github.com/Rust-for-Linux/linux/issues/1205 Cc: stable@vger.kernel.org Reviewed-by: Gary Guo Link: https://patch.msgid.link/20251107093921.3379954-1-m18080292938@163.com [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 600559b9817f6eaa927035eebb12534fadb35ee8 Author: Atharv Dubey Date: Mon Dec 1 22:26:01 2025 +0530 rust: rbtree: fix minor typo in comment Fix a typo in a comment to improve clarity and readability. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/1206 Signed-off-by: Atharv Dubey Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251201165601.31484-1-atharvd440@gmail.com [ Removed one of the cases that is gone now. Reworded accordingly (and to avoid mentioning 'documentation', since it is just a comment). - Miguel ] Signed-off-by: Miguel Ojeda commit 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb Author: Linus Torvalds Date: Sun Jan 4 14:41:55 2026 -0800 Linux 6.19-rc4 commit 309a29b5965a0b2f36b3e245213eb43300a89ac2 Author: Colin Ian King Date: Fri Dec 19 21:44:28 2025 +0000 scsi: ufs: host: mediatek: Make read-only array scale_us static const Don't populate the read-only array scale_us on the stack at run time, instead make it static const. Signed-off-by: Colin Ian King Reviewed-by: Peter Wang Link: https://patch.msgid.link/20251219214428.492744-1-colin.i.king@gmail.com Signed-off-by: Martin K. Petersen commit d0f6cfb491924d42c8f5336acb68a798e49b74b1 Author: Julia Lawall Date: Wed Dec 31 17:50:27 2025 +0100 scsi: bfa: Update outdated comment The function bfa_lps_is_brcd_fabric() was eliminated, being a one-line function, in commit f7f73812e950 ("[SCSI] bfa: clean up one line functions"). Replace the call in the comment by its inlined counterpart, referring to the parameter of the subsequent function. Signed-off-by: Julia Lawall Link: https://patch.msgid.link/20251231165027.142443-1-Julia.Lawall@inria.fr Signed-off-by: Martin K. Petersen commit 001556d298723f091751e9e887f63b642890aaca Author: Ranjan Kumar Date: Tue Dec 23 16:17:21 2025 +0530 scsi: mpt3sas: Update maintainer list As an active participant in the development of the mpt3sas driver, add myself to the maintainers list. Signed-off-by: Ranjan Kumar Link: https://patch.msgid.link/20251223104721.16882-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit ee229e7c256ab5d7b277abf8d48a732c10571750 Author: Bart Van Assche Date: Thu Dec 18 15:07:37 2025 -0800 scsi: ufs: core: Configure MCQ after link startup Commit f46b9a595fa9 ("scsi: ufs: core: Allocate the SCSI host earlier") did not only cause scsi_add_host() to be called earlier. It also swapped the order of link startup and enabling and configuring MCQ mode. Before that commit, the call chains for link startup and enabling MCQ were as follows: ufshcd_init() ufshcd_link_startup() ufshcd_add_scsi_host() ufshcd_mcq_enable() Apparently this change causes link startup to fail. Fix this by configuring MCQ after link startup has completed. Reported-by: Nitin Rawat Fixes: f46b9a595fa9 ("scsi: ufs: core: Allocate the SCSI host earlier") Signed-off-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20251218230741.2661049-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 9a49157deeb23581fc5c8189b486340d7343264a Author: Brian Kao Date: Thu Dec 18 03:17:23 2025 +0000 scsi: core: Fix error handler encryption support Some low-level drivers (LLD) access block layer crypto fields, such as rq->crypt_keyslot and rq->crypt_ctx within `struct request`, to configure hardware for inline encryption. However, SCSI Error Handling (EH) commands (e.g., TEST UNIT READY, START STOP UNIT) should not involve any encryption setup. To prevent drivers from erroneously applying crypto settings during EH, this patch saves the original values of rq->crypt_keyslot and rq->crypt_ctx before an EH command is prepared via scsi_eh_prep_cmnd(). These fields in the 'struct request' are then set to NULL. The original values are restored in scsi_eh_restore_cmnd() after the EH command completes. This ensures that the block layer crypto context does not leak into EH command execution. Signed-off-by: Brian Kao Link: https://patch.msgid.link/20251218031726.2642834-1-powenkao@google.com Cc: stable@vger.kernel.org Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 1523d50abad0ef8a261a5c38099b462629941156 Author: Miao Li Date: Thu Dec 18 10:31:29 2025 +0800 scsi: core: Correct documentation for scsi_test_unit_ready() If scsi_test_unit_ready() returns zero, TEST UNIT READY was executed successfully. Signed-off-by: Miao Li Link: https://patch.msgid.link/20251218023129.284307-1-limiao870622@163.com Signed-off-by: Martin K. Petersen commit be4b7e584a0cc6715fbb14dfb2a9a39bf07cfbab Author: Zhaoming Luo Date: Wed Dec 17 22:03:38 2025 +0800 scsi: ufs: dt-bindings: Fix several grammar errors Fix several grammar errors. Signed-off-by: Zhaoming Luo Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251217-fix-minor-grammar-err-v3-1-9be220cdd56a@posteo.com Signed-off-by: Martin K. Petersen commit 1806d210e5a8f431ad4711766ae4a333d407d972 Author: Justin Iurman Date: Sat Jan 3 17:53:31 2026 +0100 MAINTAINERS: Update email address for Justin Iurman Due to a change of employer, I'll be using a permanent and personal email address. Signed-off-by: Justin Iurman Link: https://patch.msgid.link/20260103165331.20120-1-justin.iurman@gmail.com Signed-off-by: Jakub Kicinski commit d6f6c6d90965cde092d159a57f0d4eae701d63a7 Merge: 2ef02ac38d3c17 7811ba452402d5 Author: Jakub Kicinski Date: Sun Jan 4 10:59:59 2026 -0800 Merge tag 'nf-26-01-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net The following patchset contains Netfilter fixes for *net*: 1) Fix overlap detection for nf_tables with concatenated ranges. There are cases where element could not be added due to a conflict with existing range, while kernel reports success to userspace. 2) update selftest to cover this bug. 3) synproxy update path should use READ/WRITE once as we replace config struct while packet path might read it in parallel. This relies on said config struct to fit sizeof(long). From Fernando Fernandez Mancera. 4) Don't return -EEXIST from xtables in module load path, a pending patch to module infra will spot a warning if this happens. From Daniel Gomez. 5) Fix a memory leak in nf_tables when chain hits 2**32 users and rule is to be hw-offloaded, from Zilin Guan. 6) Avoid infinite list growth when insert rate is high in nf_conncount, also from Fernando. * tag 'nf-26-01-02' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_conncount: update last_gc only when GC has been performed netfilter: nf_tables: fix memory leak in nf_tables_newrule() netfilter: replace -EEXIST with -EBUSY netfilter: nft_synproxy: avoid possible data-race on update operation selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug netfilter: nft_set_pipapo: fix range overlap detection ==================== Link: https://patch.msgid.link/20260102114128.7007-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 2ef02ac38d3c17f34a00c4b267d961a8d4b45d1a Author: Florian Westphal Date: Fri Jan 2 15:00:07 2026 +0100 inet: frags: drop fraglist conntrack references Jakub added a warning in nf_conntrack_cleanup_net_list() to make debugging leaked skbs/conntrack references more obvious. syzbot reports this as triggering, and I can also reproduce this via ip_defrag.sh selftest: conntrack cleanup blocked for 60s WARNING: net/netfilter/nf_conntrack_core.c:2512 [..] conntrack clenups gets stuck because there are skbs with still hold nf_conn references via their frag_list. net.core.skb_defer_max=0 makes the hang disappear. Eric Dumazet points out that skb_release_head_state() doesn't follow the fraglist. ip_defrag.sh can only reproduce this problem since commit 6471658dc66c ("udp: use skb_attempt_defer_free()"), but AFAICS this problem could happen with TCP as well if pmtu discovery is off. The relevant problem path for udp is: 1. netns emits fragmented packets 2. nf_defrag_v6_hook reassembles them (in output hook) 3. reassembled skb is tracked (skb owns nf_conn reference) 4. ip6_output refragments 5. refragmented packets also own nf_conn reference (ip6_fragment calls ip6_copy_metadata()) 6. on input path, nf_defrag_v6_hook skips defragmentation: the fragments already have skb->nf_conn attached 7. skbs are reassembled via ipv6_frag_rcv() 8. skb_consume_udp -> skb_attempt_defer_free() -> skb ends up in pcpu freelist, but still has nf_conn reference. Possible solutions: 1 let defrag engine drop nf_conn entry, OR 2 export kick_defer_list_purge() and call it from the conntrack netns exit callback, OR 3 add skb_has_frag_list() check to skb_attempt_defer_free() 2 & 3 also solve ip_defrag.sh hang but share same drawback: Such reassembled skbs, queued to socket, can prevent conntrack module removal until userspace has consumed the packet. While both tcp and udp stack do call nf_reset_ct() before placing skb on socket queue, that function doesn't iterate frag_list skbs. Therefore drop nf_conn entries when they are placed in defrag queue. Keep the nf_conn entry of the first (offset 0) skb so that reassembled skb retains nf_conn entry for sake of TX path. Note that fixes tag is incorrect; it points to the commit introducing the 'ip_defrag.sh reproducible problem': no need to backport this patch to every stable kernel. Reported-by: syzbot+4393c47753b7808dac7d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/693b0fa7.050a0220.4004e.040d.GAE@google.com/ Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()") Signed-off-by: Florian Westphal Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260102140030.32367-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit acb4bc6e1ba34ae1a34a9334a1ce8474c909466e Author: Kommula Shiva Shankar Date: Fri Jan 2 15:49:00 2026 +0530 virtio_net: fix device mismatch in devm_kzalloc/devm_kfree Initial rss_hdr allocation uses virtio_device->device, but virtnet_set_queues() frees using net_device->device. This device mismatch causing below devres warning [ 3788.514041] ------------[ cut here ]------------ [ 3788.514044] WARNING: drivers/base/devres.c:1095 at devm_kfree+0x84/0x98, CPU#16: vdpa/1463 [ 3788.514054] Modules linked in: octep_vdpa virtio_net virtio_vdpa [last unloaded: virtio_vdpa] [ 3788.514064] CPU: 16 UID: 0 PID: 1463 Comm: vdpa Tainted: G W 6.18.0 #10 PREEMPT [ 3788.514067] Tainted: [W]=WARN [ 3788.514069] Hardware name: Marvell CN106XX board (DT) [ 3788.514071] pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 3788.514074] pc : devm_kfree+0x84/0x98 [ 3788.514076] lr : devm_kfree+0x54/0x98 [ 3788.514079] sp : ffff800084e2f220 [ 3788.514080] x29: ffff800084e2f220 x28: ffff0003b2366000 x27: 000000000000003f [ 3788.514085] x26: 000000000000003f x25: ffff000106f17c10 x24: 0000000000000080 [ 3788.514089] x23: ffff00045bb8ab08 x22: ffff00045bb8a000 x21: 0000000000000018 [ 3788.514093] x20: ffff0004355c3080 x19: ffff00045bb8aa00 x18: 0000000000080000 [ 3788.514098] x17: 0000000000000040 x16: 000000000000001f x15: 000000000007ffff [ 3788.514102] x14: 0000000000000488 x13: 0000000000000005 x12: 00000000000fffff [ 3788.514106] x11: ffffffffffffffff x10: 0000000000000005 x9 : ffff800080c8c05c [ 3788.514110] x8 : ffff800084e2eeb8 x7 : 0000000000000000 x6 : 000000000000003f [ 3788.514115] x5 : ffff8000831bafe0 x4 : ffff800080c8b010 x3 : ffff0004355c3080 [ 3788.514119] x2 : ffff0004355c3080 x1 : 0000000000000000 x0 : 0000000000000000 [ 3788.514123] Call trace: [ 3788.514125] devm_kfree+0x84/0x98 (P) [ 3788.514129] virtnet_set_queues+0x134/0x2e8 [virtio_net] [ 3788.514135] virtnet_probe+0x9c0/0xe00 [virtio_net] [ 3788.514139] virtio_dev_probe+0x1e0/0x338 [ 3788.514144] really_probe+0xc8/0x3a0 [ 3788.514149] __driver_probe_device+0x84/0x170 [ 3788.514152] driver_probe_device+0x44/0x120 [ 3788.514155] __device_attach_driver+0xc4/0x168 [ 3788.514158] bus_for_each_drv+0x8c/0xf0 [ 3788.514161] __device_attach+0xa4/0x1c0 [ 3788.514164] device_initial_probe+0x1c/0x30 [ 3788.514168] bus_probe_device+0xb4/0xc0 [ 3788.514170] device_add+0x614/0x828 [ 3788.514173] register_virtio_device+0x214/0x258 [ 3788.514175] virtio_vdpa_probe+0xa0/0x110 [virtio_vdpa] [ 3788.514179] vdpa_dev_probe+0xa8/0xd8 [ 3788.514183] really_probe+0xc8/0x3a0 [ 3788.514186] __driver_probe_device+0x84/0x170 [ 3788.514189] driver_probe_device+0x44/0x120 [ 3788.514192] __device_attach_driver+0xc4/0x168 [ 3788.514195] bus_for_each_drv+0x8c/0xf0 [ 3788.514197] __device_attach+0xa4/0x1c0 [ 3788.514200] device_initial_probe+0x1c/0x30 [ 3788.514203] bus_probe_device+0xb4/0xc0 [ 3788.514206] device_add+0x614/0x828 [ 3788.514209] _vdpa_register_device+0x58/0x88 [ 3788.514211] octep_vdpa_dev_add+0x104/0x228 [octep_vdpa] [ 3788.514215] vdpa_nl_cmd_dev_add_set_doit+0x2d0/0x3c0 [ 3788.514218] genl_family_rcv_msg_doit+0xe4/0x158 [ 3788.514222] genl_rcv_msg+0x218/0x298 [ 3788.514225] netlink_rcv_skb+0x64/0x138 [ 3788.514229] genl_rcv+0x40/0x60 [ 3788.514233] netlink_unicast+0x32c/0x3b0 [ 3788.514237] netlink_sendmsg+0x170/0x3b8 [ 3788.514241] __sys_sendto+0x12c/0x1c0 [ 3788.514246] __arm64_sys_sendto+0x30/0x48 [ 3788.514249] invoke_syscall.constprop.0+0x58/0xf8 [ 3788.514255] do_el0_svc+0x48/0xd0 [ 3788.514259] el0_svc+0x48/0x210 [ 3788.514264] el0t_64_sync_handler+0xa0/0xe8 [ 3788.514268] el0t_64_sync+0x198/0x1a0 [ 3788.514271] ---[ end trace 0000000000000000 ]--- Fix by using virtio_device->device consistently for allocation and deallocation Fixes: 4944be2f5ad8c ("virtio_net: Allocate rss_hdr with devres") Signed-off-by: Kommula Shiva Shankar Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Link: https://patch.msgid.link/20260102101900.692770-1-kshankar@marvell.com Signed-off-by: Jakub Kicinski commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 Author: Srijit Bose Date: Wed Dec 31 00:36:25 2025 -0800 bnxt_en: Fix potential data corruption with HW GRO/LRO Fix the max number of bits passed to find_first_zero_bit() in bnxt_alloc_agg_idx(). We were incorrectly passing the number of long words. find_first_zero_bit() may fail to find a zero bit and cause a wrong ID to be used. If the wrong ID is already in use, this can cause data corruption. Sometimes an error like this can also be seen: bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1 Fix it by passing the correct number of bits MAX_TPA_P5. Use DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity check to warn if a bit cannot be found and reset the ring [MChan]. Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.") Reviewed-by: Ray Jui Signed-off-by: Srijit Bose Signed-off-by: Michael Chan Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 92e6e0a87f6860a4710f9494f8c704d498ae60f8 Author: Zilin Guan Date: Tue Dec 30 07:18:53 2025 +0000 net: wwan: iosm: Fix memory leak in ipc_mux_deinit() Commit 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") allocated memory for pp_qlt in ipc_mux_init() but did not free it in ipc_mux_deinit(). This results in a memory leak when the driver is unloaded. Free the allocated memory in ipc_mux_deinit() to fix the leak. Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") Co-developed-by: Jianhao Xu Signed-off-by: Jianhao Xu Signed-off-by: Zilin Guan Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20251230071853.1062223-1-zilin@seu.edu.cn Signed-off-by: Jakub Kicinski commit 8da901ffe497a53fa4ecc3ceed0e6d771586f88e Author: Frank Liang Date: Wed Dec 31 22:58:08 2025 +0800 net/ena: fix missing lock when update devlink params Fix assert lock warning while calling devl_param_driverinit_value_set() in ena. WARNING: net/devlink/core.c:261 at devl_assert_locked+0x62/0x90, CPU#0: kworker/0:0/9 CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.19.0-rc2+ #1 PREEMPT(lazy) Hardware name: Amazon EC2 m8i-flex.4xlarge/, BIOS 1.0 10/16/2017 Workqueue: events work_for_cpu_fn RIP: 0010:devl_assert_locked+0x62/0x90 Call Trace: devl_param_driverinit_value_set+0x15/0x1c0 ena_devlink_alloc+0x18c/0x220 [ena] ? __pfx_ena_devlink_alloc+0x10/0x10 [ena] ? trace_hardirqs_on+0x18/0x140 ? lockdep_hardirqs_on+0x8c/0x130 ? __raw_spin_unlock_irqrestore+0x5d/0x80 ? __raw_spin_unlock_irqrestore+0x46/0x80 ? devm_ioremap_wc+0x9a/0xd0 ena_probe+0x4d2/0x1b20 [ena] ? __lock_acquire+0x56a/0xbd0 ? __pfx_ena_probe+0x10/0x10 [ena] ? local_clock+0x15/0x30 ? __lock_release.isra.0+0x1c9/0x340 ? mark_held_locks+0x40/0x70 ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170 ? trace_hardirqs_on+0x18/0x140 ? lockdep_hardirqs_on+0x8c/0x130 ? __raw_spin_unlock_irqrestore+0x5d/0x80 ? __raw_spin_unlock_irqrestore+0x46/0x80 ? __pfx_ena_probe+0x10/0x10 [ena] ...... Fixes: 816b52624cf6 ("net: ena: Control PHC enable through devlink") Signed-off-by: Frank Liang Reviewed-by: David Arinzon Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251231145808.6103-1-xiliang@redhat.com Signed-off-by: Jakub Kicinski commit 43b182456509b41e1b855b093da25c409cf4a1e8 Merge: 02d1e1a3f9239c 0462a15d2d1faf Author: Jakub Kicinski Date: Sun Jan 4 10:38:52 2026 -0800 Merge branch 'mlx5-misc-fixes-2025-12-25' Mark Bloch says: ==================== mlx5 misc fixes 2025-12-25 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/20251225132717.358820-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 0462a15d2d1fafd3d48cf3c7c67393e42d03908c Author: Cosmin Ratiu Date: Thu Dec 25 15:27:17 2025 +0200 net/mlx5e: Dealloc forgotten PSP RX modify header The commit which added RX steering rules for PSP forgot to free a modify header HW object on the cleanup path, which lead to health errors when reloading the driver and uninitializing the device: mlx5_core 0000:08:00.0: poll_health:803:(pid 3021): Fatal error 3 detected Fix that by saving the modify header pointer in the PSP steering struct and deallocating it after freeing the rule which references it. Fixes: 9536fbe10c9d ("net/mlx5e: Add PSP steering in local NIC RX") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20251225132717.358820-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 144297e2a24e3e54aee1180ec21120ea38822b97 Author: Gal Pressman Date: Thu Dec 25 15:27:16 2025 +0200 net/mlx5e: Don't print error message due to invalid module Dumping module EEPROM on newer modules is supported through the netlink interface only. Querying with old userspace ethtool (or other tools, such as 'lshw') which still uses the ioctl interface results in an error message that could flood dmesg (in addition to the expected error return value). The original message was added under the assumption that the driver should be able to handle all module types, but now that such flows are easily triggered from userspace, it doesn't serve its purpose. Change the log level of the print in mlx5_query_module_eeprom() to debug. Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 Author: Gal Pressman Date: Thu Dec 25 15:27:15 2025 +0200 net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query The mlx5_query_mcia() function unconditionally dereferences the status pointer to store the MCIA register status value. However, mlx5e_get_module_id() passes NULL since it doesn't need the status value. Add a NULL check before dereferencing the status pointer to prevent a NULL pointer dereference. Fixes: 2e4c44b12f4d ("net/mlx5: Refactor EEPROM query error handling to return status separately") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Reviewed-by: Dragos Tatulea Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20251225132717.358820-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 6c75dc9de40ff91ec2b621b78f6cd9031762067c Author: Alexei Lazar Date: Thu Dec 25 15:27:14 2025 +0200 net/mlx5e: Don't gate FEC histograms on ppcnt_statistical_group Currently, the ppcnt_statistical_group capability check incorrectly gates access to FEC histogram statistics. This capability applies only to statistical and physical counter groups, not for histogram data. Restrict the ppcnt_statistical_group check to the Physical_Layer_Counters and Physical_Layer_Statistical_Counters groups. Histogram statistics access remains gated by the pphcr capability. The issue is harmless as of today, as it happens that ppcnt_statistical_group is set on all existing devices that have pphcr set. Fixes: 6b81b8a0b197 ("net/mlx5e: Don't query FEC statistics when FEC is disabled") Signed-off-by: Alexei Lazar Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20251225132717.358820-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 31057979cdadfee9f934746fd84046b43506ba61 Author: Patrisious Haddad Date: Thu Dec 25 15:27:13 2025 +0200 net/mlx5: Lag, multipath, give priority for routes with smaller network prefix Today multipath offload is controlled by a single route and the route controlling is selected if it meets one of the following criteria: 1. No controlling route is set. 2. New route destination is the same as old one. 3. New route metric is lower than old route metric. This can cause unwanted behaviour in case a new route is added with a smaller network prefix which should get the priority. Fix this by adding a new criteria to give priority to new route with a smaller network prefix. Fixes: ad11c4f1d8fd ("net/mlx5e: Lag, Only handle events from highest priority multipath entry") Signed-off-by: Patrisious Haddad Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20251225132717.358820-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df Author: Di Zhu Date: Wed Dec 24 09:22:24 2025 +0800 netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates Directly increment the TSO features incurs a side effect: it will also directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device, which can cause issues such as the inability to enable the nocache copy feature on the bonding driver. The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby preventing it from being cleared. Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master") Signed-off-by: Di Zhu Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn Signed-off-by: Jakub Kicinski commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 Author: Weiming Shi Date: Wed Dec 24 04:35:35 2025 +0800 net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error queue, accessing the sock_exterr_skb structure in skb->cb via put_cmsg() triggers a usercopy hardening violation: [ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)! [ 5.382796] kernel BUG at mm/usercopy.c:102! [ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7 [ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80 [ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490 [ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246 [ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74 [ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0 [ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74 [ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001 [ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00 [ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000 [ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0 [ 5.384903] PKRU: 55555554 [ 5.384903] Call Trace: [ 5.384903] [ 5.384903] __check_heap_object+0x9a/0xd0 [ 5.384903] __check_object_size+0x46c/0x690 [ 5.384903] put_cmsg+0x129/0x5e0 [ 5.384903] sock_recv_errqueue+0x22f/0x380 [ 5.384903] tls_sw_recvmsg+0x7ed/0x1960 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? schedule+0x6d/0x270 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? mutex_unlock+0x81/0xd0 [ 5.384903] ? __pfx_mutex_unlock+0x10/0x10 [ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0 [ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 The crash offset 296 corresponds to skb2->cb within skbuff_fclones: - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 - offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 = 272 + 24 (inside sock_exterr_skb.ee) This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure. [1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885 [2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104 [3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566 [4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491 [5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719 Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski commit 62f7edd59964eb588e96fce1ad35a2327ea54424 Author: Stefano Radaelli Date: Tue Dec 23 13:09:39 2025 +0100 net: phy: mxl-86110: Add power management and soft reset support Implement soft_reset, suspend, and resume callbacks using genphy_soft_reset(), genphy_suspend(), and genphy_resume() to fix PHY initialization and power management issues. The soft_reset callback is needed to properly recover the PHY after an ifconfig down/up cycle. Without it, the PHY can remain in power-down state, causing MDIO register access failures during config_init(). The soft reset ensures the PHY is operational before configuration. The suspend/resume callbacks enable proper power management during system suspend/resume cycles. Fixes: b2908a989c59 ("net: phy: add driver for MaxLinear MxL86110 PHY") Signed-off-by: Stefano Radaelli Link: https://patch.msgid.link/20251223120940.407195-1-stefano.r@variscite.com Signed-off-by: Jakub Kicinski commit 4c0856c225b39b1def6c9a6bc56faca79550da13 Author: yuan.gao Date: Wed Dec 24 14:31:45 2025 +0800 inet: ping: Fix icmp out counting When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO messages, ICMP_MIB_OUTMSGS is counted twice. ping_v4_sendmsg ping_v4_push_pending_frames ip_push_pending_frames ip_finish_skb __ip_make_skb icmp_out_count(net, icmp_type); // first count icmp_out_count(sock_net(sk), user_icmph.type); // second count However, when the ping program uses an IPPROTO_RAW socket, ICMP_MIB_OUTMSGS is counted correctly only once. Therefore, the first count should be removed. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Signed-off-by: yuan.gao Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn Signed-off-by: Jakub Kicinski commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 Author: Jerry Wu Date: Thu Dec 25 20:36:17 2025 +0000 net: mscc: ocelot: Fix crash when adding interface under a lag Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag") fixed a similar issue in the lan966x driver caused by a NULL pointer dereference. The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic and is susceptible to the same crash. This issue specifically affects the ocelot_vsc7514.c frontend, which leaves unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as it uses the DSA framework which registers all ports. Fix this by checking if the port pointer is valid before accessing it. Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array") Signed-off-by: Jerry Wu Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com Signed-off-by: Jakub Kicinski commit 3128df6be147768fe536986fbb85db1d37806a9f Author: Alexandre Knecht Date: Sun Dec 28 03:00:57 2025 +0100 bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is incorrectly stripped from frames during egress processing. br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also moves any "next" VLAN from the payload into hwaccel: /* move next vlan tag to hw accel tag */ __skb_vlan_pop(skb, &vlan_tci); __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci); For QinQ frames where the C-VLAN sits in the payload, this moves it to hwaccel where it gets lost during VXLAN encapsulation. Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only the hwaccel S-VLAN and leaves the payload untouched. This path is only taken when vlan_tunnel is enabled and tunnel_info is configured, so 802.1Q bridges are unaffected. Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN preserved in VXLAN payload via tcpdump. Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths") Signed-off-by: Alexandre Knecht Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com Signed-off-by: Jakub Kicinski commit d7065436e8a04520f60c18240b775861be7999d2 Author: Markus Blöchl Date: Sun Dec 28 16:52:59 2025 +0100 net: bnge: add AUXILIARY_BUS to Kconfig dependencies The build can currently fail with ld: drivers/net/ethernet/broadcom/bnge/bnge_auxr.o: in function `bnge_rdma_aux_device_add': bnge_auxr.c:(.text+0x366): undefined reference to `__auxiliary_device_add' ld: drivers/net/ethernet/broadcom/bnge/bnge_auxr.o: in function `bnge_rdma_aux_device_init': bnge_auxr.c:(.text+0x43c): undefined reference to `auxiliary_device_init' if BNGE is enabled but no other driver pulls in AUXILIARY_BUS. Select AUXILIARY_BUS in BNGE like in all other drivers which create an auxiliary_device. Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support") Signed-off-by: Markus Blöchl Reviewed-by: Vikas Gupta Link: https://patch.msgid.link/20251228-bnge_aux_bus-v1-1-82e273ebfdac@blochl.de Signed-off-by: Jakub Kicinski commit a428e0da1248c353557970848994f35fd3f005e2 Author: Alok Tiwari Date: Mon Dec 29 21:21:18 2025 -0800 net: marvell: prestera: fix NULL dereference on devlink_alloc() failure devlink_alloc() may return NULL on allocation failure, but prestera_devlink_alloc() unconditionally calls devlink_priv() on the returned pointer. This leads to a NULL pointer dereference if devlink allocation fails. Add a check for a NULL devlink pointer and return NULL early to avoid the crash. Fixes: 34dd1710f5a3 ("net: marvell: prestera: Add basic devlink support") Signed-off-by: Alok Tiwari Acked-by: Elad Nachman Link: https://patch.msgid.link/20251230052124.897012-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 54e82e93ca93e49cb4c33988adec5c8cb9d0df31 Merge: aacb0a6d604ac9 4a824c31289981 Author: Linus Torvalds Date: Sun Jan 4 07:21:18 2026 -0800 Merge tag 'core_urgent_for_v6.19_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core entry fix from Borislav Petkov: - Make sure clang inlines trivial local_irq_* helpers * tag 'core_urgent_for_v6.19_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Always inline local_irq_{enable,disable}_exit_to_user() commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f Author: Haoxiang Li Date: Tue Dec 23 20:43:50 2025 +0800 EDAC/x38: Fix a resource leak in x38_probe1() If edac_mc_alloc() fails, also unmap the window. [ bp: Use separate labels, turning it into the classic unwind pattern. ] Fixes: df8bc08c192f ("edac x38: new MC driver module") Signed-off-by: Haoxiang Li Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251223124350.1496325-1-lihaoxiang@isrc.iscas.ac.cn commit d42d5715dcb559342ff356327b241c53a67584d9 Author: Haoxiang Li Date: Tue Dec 23 20:32:02 2025 +0800 EDAC/i3200: Fix a resource leak in i3200_probe1() If edac_mc_alloc() fails, also unmap the window. [ bp: Use separate labels, turning it into the classic unwind pattern. ] Fixes: dd8ef1db87a4 ("edac: i3200 memory controller driver") Signed-off-by: Haoxiang Li Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251223123202.1492038-1-lihaoxiang@isrc.iscas.ac.cn commit e8b3627bec357698f2d4d6dbf27cdcfa0e9d8715 Author: Dave Airlie Date: Fri Jan 2 14:18:29 2026 +1000 nouveau: don't attempt fwsec on sb on newer platforms. The changes to always loads fwsec sb causes problems on newer GPUs which don't use this path. Add hooks and pass through the device specific layers. Fixes: da67179e5538 ("drm/nouveau/gsp: Allocate fwsec-sb at boot") Cc: # v6.16+ Cc: Lyude Paul Cc: Timur Tabi Tested-by: Matthew Schwartz Tested-by: Christopher Snowhill Reviewed-by: Lyude Paul Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260102041829.2748009-1-airlied@gmail.com commit 2fc04340cf30d7960eed2525d26ffb8905aca02b Author: Tomi Valkeinen Date: Fri Dec 5 11:51:51 2025 +0200 drm/tidss: Fix enable/disable order TI's OLDI and DSI encoders need to be set up before the crtc is enabled, but the DRM helpers will enable the crtc first. This causes various issues on TI platforms, like visual artifacts or crtc sync lost warnings. Thus drm_atomic_helper_commit_modeset_enables() and drm_atomic_helper_commit_modeset_disables() cannot be used, as they enable the crtc before bridges' pre-enable, and disable the crtc after bridges' post-disable. Open code the drm_atomic_helper_commit_modeset_enables() and drm_atomic_helper_commit_modeset_disables(), and first call the bridges' pre-enables, then crtc enable, then bridges' post-enable (and vice versa for disable). Signed-off-by: Tomi Valkeinen Cc: stable@vger.kernel.org # v6.17+ Fixes: c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") Reviewed-by: Aradhya Bhatia Reviewed-by: Maxime Ripard Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251205-drm-seq-fix-v1-4-fda68fa1b3de@ideasonboard.com commit d1c7dc57ff2400b141e6582a8d2dc5170108cf81 Author: Linus Walleij Date: Fri Dec 5 11:51:50 2025 +0200 drm/atomic-helper: Export and namespace some functions Export and namespace those not prefixed with drm_* so it becomes possible to write custom commit tail functions in individual drivers using the helper infrastructure. Tested-by: Marek Vasut Reviewed-by: Maxime Ripard Signed-off-by: Tomi Valkeinen Cc: stable@vger.kernel.org # v6.17+ Fixes: c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") Reviewed-by: Aradhya Bhatia Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251205-drm-seq-fix-v1-3-fda68fa1b3de@ideasonboard.com commit 33e8150bd32d7dc25c977bb455f1f5d54bfd5241 Author: Tomi Valkeinen Date: Fri Dec 5 11:51:49 2025 +0200 Revert "drm/mediatek: dsi: Fix DSI host and panel bridge pre-enable order" This reverts commit f5b1819193667bf62c3c99d3921b9429997a14b2. As the original commit (c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable")) causing the issue has been reverted, let's revert the fix for mediatek. Signed-off-by: Tomi Valkeinen Cc: stable@vger.kernel.org # v6.17+ Fixes: c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") Reviewed-by: Maxime Ripard Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251205-drm-seq-fix-v1-2-fda68fa1b3de@ideasonboard.com commit c1ef9a6cabb34dbc09e31417b0c0a672fe0de13a Author: Tomi Valkeinen Date: Fri Dec 5 11:51:48 2025 +0200 Revert "drm/atomic-helper: Re-order bridge chain pre-enable and post-disable" This reverts commit c9b1150a68d9362a0827609fc0dc1664c0d8bfe1. Changing the enable/disable sequence has caused regressions on multiple platforms: R-Car, MCDE, Rockchip. A series (see link below) was sent to fix these, but it was decided that it's better to revert the original patch and change the enable/disable sequence only in the tidss driver. Reverting this commit breaks tidss's DSI and OLDI outputs, which will be fixed in the following commits. Signed-off-by: Tomi Valkeinen Link: https://lore.kernel.org/all/20251202-mcde-drm-regression-thirdfix-v6-0-f1bffd4ec0fa%40kernel.org/ Fixes: c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") Cc: stable@vger.kernel.org # v6.17+ Reviewed-by: Aradhya Bhatia Reviewed-by: Maxime Ripard Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251205-drm-seq-fix-v1-1-fda68fa1b3de@ideasonboard.com commit aacb0a6d604ac9953b261963efe25ae7521b7c58 Merge: 805f9a06137216 73cb5f6eafb0ac Author: Linus Torvalds Date: Sat Jan 3 09:18:36 2026 -0800 Merge tag 'pmdomain-v6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - mediatek: Fix spinlock recursion fix during probe - imx: Fix reference count leak during probe * tag 'pmdomain-v6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: imx: Fix reference count leak in imx_gpc_probe() pmdomain: mtk-pm-domains: Fix spinlock recursion fix in probe commit 3de49966499634454fd59e0e6fecd50baab7febd Author: Ming Qian Date: Fri Dec 5 09:54:25 2025 +0800 pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu For i.MX8MQ platform, the ADB in the VPUMIX domain has no separate reset and clock enable bits, but is ungated and reset together with the VPUs. So we can't reset G1 or G2 separately, it may led to the system hang. Remove rst_mask and clk_mask of imx8mq_vpu_blk_ctl_domain_data. Let imx8mq_vpu_power_notifier() do really vpu reset. Fixes: 608d7c325e85 ("soc: imx: imx8m-blk-ctrl: add i.MX8MQ VPU blk-ctrl") Signed-off-by: Ming Qian Reviewed-by: Benjamin Gaignard Reviewed-by: Peng Fan Reviewed-by: Frank Li Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 805f9a061372164d43ddef771d7cd63e3ba6d845 Merge: bbbc721033c076 fe072f651083c6 Author: Linus Torvalds Date: Fri Jan 2 14:24:09 2026 -0800 Merge tag 'perf-tools-fixes-for-v6.19-2026-01-02' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tool fixes and from Namhyung Kim: - skip building BPF skeletons if libopenssl is missing - a couple of test updates - handle error cases of filename__read_build_id() - support NVIDIA Olympus for ARM SPE profiling - update tool headers to sync with the kernel * tag 'perf-tools-fixes-for-v6.19-2026-01-02' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools build: Fix the common set of features test wrt libopenssl tools headers: Sync syscall table with kernel sources tools headers: Sync linux/socket.h with kernel sources tools headers: Sync linux/gfp_types.h with kernel sources tools headers: Sync arm64 headers with kernel sources tools headers: Sync x86 headers with kernel sources tools headers: Sync UAPI sound/asound.h with kernel sources tools headers: Sync UAPI linux/mount.h with kernel sources tools headers: Sync UAPI linux/fs.h with kernel sources tools headers: Sync UAPI linux/fcntl.h with kernel sources tools headers: Sync UAPI KVM headers with kernel sources tools headers: Sync UAPI drm/drm.h with kernel sources perf arm-spe: Add NVIDIA Olympus to neoverse list tools headers arm64: Add NVIDIA Olympus part perf tests top: Make the test exclusive perf tests kvm: Avoid leaving perf.data.guest file around perf symbol: Fix ENOENT case for filename__read_build_id perf tools: Disable BPF skeleton if no libopenssl found tools/build: Add a feature test for libopenssl commit 235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b Author: Zilin Guan Date: Wed Dec 31 11:49:15 2025 +0000 of: unittest: Fix memory leak in unittest_data_add() In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak. Fix this by using scope-based cleanup helper __free(kfree) for automatic resource cleanup. This ensures unittest_data is automatically freed when it goes out of scope in error paths. For the success path, use retain_and_null_ptr() to transfer ownership of the memory to the device tree and prevent double freeing. Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles") Suggested-by: Rob Herring Co-developed-by: Jianhao Xu Signed-off-by: Jianhao Xu Signed-off-by: Zilin Guan Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn Signed-off-by: Rob Herring (Arm) commit bbbc721033c076bad736c48a2b9f75bee4003607 Merge: dec1ecf2c707ff 684d3b2670a263 Author: Linus Torvalds Date: Fri Jan 2 12:35:29 2026 -0800 Merge tag 'pm-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a recent regression that affects system suspend testing at the 'core' level (Rafael Wysocki)" * tag 'pm-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: Fix suspend_test() at the TEST_CORE level commit dec1ecf2c707ff34aa3224fd49aeee0a852a62f7 Merge: 6ce4d44fb0ca00 c31f4aa8fed048 Author: Linus Torvalds Date: Fri Jan 2 12:28:24 2026 -0800 Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fix from Eric Biggers: "Fix the kunit_run_irq_test() function (which I recently added for the CRC and crypto tests) to be less timing-dependent. This fixes flakiness in the polyval kunit test suite" * tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: kunit: Enforce task execution in {soft,hard}irq contexts commit 6ce4d44fb0ca00644756c7e857166d12ffb4b833 Merge: 3d35fa1190a1b4 fcd431a9627f27 Author: Linus Torvalds Date: Fri Jan 2 12:25:47 2026 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - Fix several syzkaller found bugs: - Poor parsing of the RDMA_NL_LS_OP_IP_RESOLVE netlink - GID entry refcount leaking when CM destruction races with multicast establishment - Missing refcount put in ib_del_sub_device_and_put() - Fixup recently introduced uABI padding for 32 bit consistency - Avoid user triggered math overflow in MANA and AFA - Reading invalid netdev data during an event - kdoc fixes - Fix never-working gid copying in ib_get_gids_from_rdma_hdr - Typo in bnxt when validating the BAR - bnxt mis-parsed IB_SEND_IP_CSUM so it didn't work always - bnxt out of bounds access in bnxt related to the counters on new devices - Allocate the bnxt PDE table with the right sizing - Use dma_free_coherent() correctly in bnxt - Allow rxe to be unloadable when CONFIG_PROVE_LOCKING by adjusting the tracking of the global sockets it uses - Missing unlocking on error path in rxe - Compute the right number of pages in a MR in rtrs * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/bnxt_re: fix dma_free_coherent() pointer RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path RDMA/bnxt_re: Fix to use correct page size for PDE table RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send RDMA/core: always drop device refcount in ib_del_sub_device_and_put() RDMA/rxe: let rxe_reclassify_recv_socket() call sk_owner_put() RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() RDMA/efa: Remove possible negative shift RTRS/rtrs: clean up rtrs headers kernel-doc RDMA/irdma: avoid invalid read in irdma_net_event RDMA/mana_ib: check cqe length for kernel CQs RDMA/irdma: Fix irdma_alloc_ucontext_resp padding RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding RDMA/cm: Fix leaking the multicast GID table reference RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly commit 3d35fa1190a1b4d413cb1cfa4baf74215b0b9565 Merge: bea82c80a5d642 19b8a76cd99bde Author: Linus Torvalds Date: Fri Jan 2 12:21:34 2026 -0800 Merge tag 'linux_kselftest-fixes-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: - Fix for build failures in tests that use an empty FIXTURE() seen in Android's build environment, which uses -D_FORTIFY_SOURCE=3, a build failure occurs in tests that use an empty FIXTURE() - Fix func_traceonoff_triggers.tc sometimes failures on Kunpeng-920 board resulting from including transient trace file name in checksum compare - Fix to remove available_events requirement from toplevel-enable for instance as it isn't a valid requirement for this test * tag 'linux_kselftest-fixes-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kselftest/harness: Use helper to avoid zero-size memset warning selftests/ftrace: Test toplevel-enable for instance selftests/ftrace: traceonoff_triggers: strip off names commit bea82c80a5d64247045280b6d23e3ff95c355f56 Merge: 509b5b11521814 69153e8b97ebe2 Author: Linus Torvalds Date: Fri Jan 2 12:15:59 2026 -0800 Merge tag 'block-6.19-20260102' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Scan partition tables asynchronously for ublk, similarly to how nvme does it. This avoids potential deadlocks, which is why nvme does it that way too. Includes a set of selftests as well. - MD pull request via Yu: - Fix null-pointer dereference in raid5 sysfs group_thread_cnt store (Tuo Li) - Fix possible mempool corruption during raid1 raid_disks update via sysfs (FengWei Shih) - Fix logical_block_size configuration being overwritten during super_1_validate() (Li Nan) - Fix forward incompatibility with configurable logical block size: arrays assembled on new kernels could not be assembled on older kernels (v6.18 and before) due to non-zero reserved pad rejection (Li Nan) - Fix static checker warning about iterator not incremented (Li Nan) - Skip CPU offlining notifications on unmapped hardware queues - bfq-iosched block stats fix - Fix outdated comment in bfq-iosched * tag 'block-6.19-20260102' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block, bfq: update outdated comment blk-mq: skip CPU offline notify on unmapped hctx selftests/ublk: fix Makefile to rebuild on header changes selftests/ublk: add test for async partition scan ublk: scan partition in async way block,bfq: fix aux stat accumulation destination md: Fix forward incompatibility from configurable logical block size md: Fix logical_block_size configuration being overwritten md: suspend array while updating raid_disks via sysfs md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() md: Fix static checker warning in analyze_sbs commit 509b5b1152181447bb001f7beb0a852530ad2a74 Merge: 71b62ed6cea91f 70eafc743016b1 Author: Linus Torvalds Date: Fri Jan 2 12:07:55 2026 -0800 Merge tag 'io_uring-6.19-20260102' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Removed dead argument length for io_uring_validate_mmap_request() - Use GFP_NOWAIT for overflow CQEs on legacy ring setups rather than GFP_ATOMIC, which makes it play nicer with memcg limits - Fix a potential circular locking issue with tctx node removal and exec based cancelations * tag 'io_uring-6.19-20260102' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/memmap: drop unused sz param in io_uring_validate_mmap_request() io_uring/tctx: add separate lock for list of tctx's in ctx io_uring: use GFP_NOWAIT for overflow CQEs on legacy rings commit 71b62ed6cea91f13b05530d013d3e82bd8a856aa Merge: b993744a972722 150b1b97e27513 Author: Linus Torvalds Date: Fri Jan 2 12:04:51 2026 -0800 Merge tag 'x86-urgent-2026-01-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Fix the AMD microcode Entrysign signature checking code to include more models" * tag 'x86-urgent-2026-01-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo commit b993744a972722b4e15b8d2afee1a053767f4dd4 Merge: 9b043680446067 bb85d206be208b Author: Linus Torvalds Date: Fri Jan 2 11:33:33 2026 -0800 Merge tag 'loongarch-fixes-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Complete CPUCFG registers definition, set correct protection_map[] for VM_NONE/VM_SHARED, fix some bugs in the orc stack unwinder, ftrace and BPF JIT" * tag 'loongarch-fixes-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: samples/ftrace: Adjust LoongArch register restore order in direct calls LoongArch: BPF: Enhance the bpf_arch_text_poke() function LoongArch: BPF: Enable trampoline-based tracing for module functions LoongArch: BPF: Adjust the jump offset of tail calls LoongArch: BPF: Save return address register ra to t0 before trampoline LoongArch: BPF: Zero-extend bpf_tail_call() index LoongArch: BPF: Sign extend kfunc call arguments LoongArch: Refactor register restoration in ftrace_common_return LoongArch: Enable exception fixup for specific ADE subcode LoongArch: Remove unnecessary checks for ORC unwinder LoongArch: Remove is_entry_func() and kernel_entry_end LoongArch: Use UNWIND_HINT_END_OF_STACK for entry points LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED LoongArch: Complete CPUCFG registers definition commit 0b88bfa42e5468baff71909c2f324a495318532b Author: Edward Adam Davis Date: Tue Dec 16 18:27:37 2025 +0800 NFSD: net ref data still needs to be freed even if net hasn't startup When the NFSD instance doesn't to startup, the net ref data memory is not properly reclaimed, which triggers the memory leak issue reported by syzbot [1]. To avoid the problem reported in [1], the net ref data memory reclamation action is moved outside of nfsd_net_up when the net is shutdown. [1] unreferenced object 0xffff88812a39dfc0 (size 64): backtrace (crc a2262fc6): percpu_ref_init+0x94/0x1e0 lib/percpu-refcount.c:76 nfsd_create_serv+0xbe/0x260 fs/nfsd/nfssvc.c:605 nfsd_nl_listener_set_doit+0x62/0xb00 fs/nfsd/nfsctl.c:1882 genl_family_rcv_msg_doit+0x11e/0x190 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x2fd/0x440 net/netlink/genetlink.c:1210 BUG: memory leak Reported-by: syzbot+6ee3b889bdeada0a6226@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6ee3b889bdeada0a6226 Fixes: 39972494e318 ("nfsd: update percpu_ref to manage references on nfsd_net") Cc: stable@vger.kernel.org Signed-off-by: Edward Adam Davis Signed-off-by: Chuck Lever commit d0424066fcd294977f310964bed6f2a487fa4515 Author: Olga Kornievskaia Date: Mon Dec 15 14:10:36 2025 -0500 nfsd: check that server is running in unlock_filesystem If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens currently because nfsd4_revoke_states() access state structures (eg., conf_id_hashtbl) that has been freed as a part of the server shutdown. [ 59.465072] Call trace: [ 59.465308] nfsd4_revoke_states+0x1b4/0x898 [nfsd] (P) [ 59.465830] write_unlock_fs+0x258/0x440 [nfsd] [ 59.466278] nfsctl_transaction_write+0xb0/0x120 [nfsd] [ 59.466780] vfs_write+0x1f0/0x938 [ 59.467088] ksys_write+0xfc/0x1f8 [ 59.467395] __arm64_sys_write+0x74/0xb8 [ 59.467746] invoke_syscall.constprop.0+0xdc/0x1e8 [ 59.468177] do_el0_svc+0x154/0x1d8 [ 59.468489] el0_svc+0x40/0xe0 [ 59.468767] el0t_64_sync_handler+0xa0/0xe8 [ 59.469138] el0t_64_sync+0x1ac/0x1b0 Ensure this can't happen by taking the nfsd_mutex and checking that the server is still up, and then holding the mutex across the call to nfsd4_revoke_states(). Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Fixes: 1ac3629bf0125 ("nfsd: prepare for supporting admin-revocation of state") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit fb321998de7639f1954430674475e469fb529d9c Author: NeilBrown Date: Mon Dec 15 08:07:28 2025 +1100 nfsd: use correct loop termination in nfsd4_revoke_states() The loop in nfsd4_revoke_states() stops one too early because the end value given is CLIENT_HASH_MASK where it should be CLIENT_HASH_SIZE. This means that an admin request to drop all locks for a filesystem will miss locks held by clients which hash to the maximum possible hash value. Fixes: 1ac3629bf012 ("nfsd: prepare for supporting admin-revocation of state") Cc: stable@vger.kernel.org Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 Author: NeilBrown Date: Sat Dec 13 13:41:59 2025 -0500 nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/T/#t Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd") Cc: stable@vger.kernel.org Signed-off-by: NeilBrown Tested-by: Li Lingfeng Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit e901c7fce59e72d9f3c92733c379849c4034ac50 Author: Scott Mayhew Date: Thu Dec 11 07:34:34 2025 -0500 NFSD: Fix permission check for read access to executable-only files Commit abc02e5602f7 ("NFSD: Support write delegations in LAYOUTGET") added NFSD_MAY_OWNER_OVERRIDE to the access flags passed from nfsd4_layoutget() to fh_verify(). This causes LAYOUTGET to fail for executable-only files, and causes xfstests generic/126 to fail on pNFS SCSI. To allow read access to executable-only files, what we really want is: 1. The "permissions" portion of the access flags (the lower 6 bits) must be exactly NFSD_MAY_READ 2. The "hints" portion of the access flags (the upper 26 bits) can contain any combination of NFSD_MAY_OWNER_OVERRIDE and NFSD_MAY_READ_IF_EXEC Fixes: abc02e5602f7 ("NFSD: Support write delegations in LAYOUTGET") Cc: stable@vger.kernel.org # v6.6+ Signed-off-by: Scott Mayhew Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit c6c209ceb87f64a6ceebe61761951dcbbf4a0baa Author: Chuck Lever Date: Tue Dec 9 19:28:49 2025 -0500 NFSD: Remove NFSERR_EAGAIN I haven't found an NFSERR_EAGAIN in RFCs 1094, 1813, 7530, or 8881. None of these RFCs have an NFS status code that match the numeric value "11". Based on the meaning of the EAGAIN errno, I presume the use of this status in NFSD means NFS4ERR_DELAY. So replace the one usage of nfserr_eagain, and remove it from NFSD's NFS status conversion tables. As far as I can tell, NFSERR_EAGAIN has existed since the pre-git era, but was not actually used by any code until commit f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed."), at which time it become possible for NFSD to return a status code of 11 (which is not valid NFS protocol). Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") Cc: stable@vger.kernel.org Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a9a42f0754b6c69525612d678b73da790e28b9fd Author: FUJITA Tomonori Date: Wed Dec 31 13:57:28 2025 +0900 rust: device: fix broken intra-doc links The `pci` module is conditional on CONFIG_PCI. When it's disabled, the intra-doc link to `pci::Device` causes rustdoc warnings: warning: unresolved link to `kernel::pci::Device` --> rust/kernel/device.rs:163:22 | 163 | /// [`pci::Device`]: kernel::pci::Device | ^^^^^^^^^^^^^^^^^^^ no item named `pci` in module `kernel` | = note: `#[warn(rustdoc::broken_intra_doc_links)]` on by default Fix this by making the documentation conditional on CONFIG_PCI. Fixes: d6e26c1ae4a6 ("device: rust: expand documentation for Device") Signed-off-by: FUJITA Tomonori Reviewed-by: Dirk Behme Link: https://patch.msgid.link/20251231045728.1912024-2-fujita.tomonori@gmail.com [ Keep the "such as" part indicating a list of examples; fix typos in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit 32cb3840386fd3684fbe8294cfc0a6684417139e Author: FUJITA Tomonori Date: Wed Dec 31 13:57:27 2025 +0900 rust: dma: fix broken intra-doc links The `pci` module is conditional on CONFIG_PCI. When it's disabled, the intra-doc link to `pci::Device` causes rustdoc warnings: warning: unresolved link to `::kernel::pci::Device` --> rust/kernel/dma.rs:30:70 | 30 | /// where the underlying bus is DMA capable, such as [`pci::Device`](::kernel::pci::Device) or | ^^^^^^^^^^^^^^^^^^^^^ no item named `pci` in module `kernel` Fix this by making the documentation conditional on CONFIG_PCI. Fixes: d06d5f66f549 ("rust: dma: implement `dma::Device` trait") Signed-off-by: FUJITA Tomonori Reviewed-by: Dirk Behme Link: https://patch.msgid.link/20251231045728.1912024-1-fujita.tomonori@gmail.com [ Keep the "such as" part indicating a list of examples; fix typos in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit 9b043680446067358913edc2e9dd71bf8ffae208 Merge: e3a97ab1bbc36b 7be19f9327d9a0 Author: Linus Torvalds Date: Fri Jan 2 09:53:45 2026 -0800 Merge tag 'drm-fixes-2026-01-02' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Happy New Year, jetlagged fixes from me, still pretty quiet, xe is most of this, with i915/nouveau/imagination fixes and some shmem cleanups. shmem: - docs and MODULE_LICENSE fix xe: - Ensure svm device memory is idle before migration completes - Fix a SVM debug printout - Use READ_ONCE() / WRITE_ONCE() for g2h_fence i915: - Fix eb_lookup_vmas() failure path nouveau: - fix prepare_fb warnings imagination: - prevent export of protected objects" * tag 'drm-fixes-2026-01-02' of https://gitlab.freedesktop.org/drm/kernel: drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer drm/xe/guc: READ/WRITE_ONCE g2h_fence->done drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use drm/xe/svm: Fix a debug printout drm/gem-shmem: Fix the MODULE_LICENSE() string drm/gem-shmem: Fix typos in documentation drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb drm/imagination: Disallow exporting of PM/FW protected objects commit e3a97ab1bbc36be6467fd606c0af1120b6146ddc Merge: 047b4e783ce2af f416c556997aa5 Author: Linus Torvalds Date: Fri Jan 2 09:24:43 2026 -0800 Merge tag 'v6.19-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix memory leak - Fix two refcount leaks - Fix error path in create_smb2_pipe * tag 'v6.19-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd: smb/server: fix refcount leak in smb2_open() smb/server: fix refcount leak in parse_durable_handle_context() smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() ksmbd: Fix memory leak in get_file_all_info() commit 047b4e783ce2af73b3287dfabfeaa51684932757 Merge: b69053dd3ffbc0 fa2fd0b10f66b0 Author: Linus Torvalds Date: Fri Jan 2 09:14:13 2026 -0800 Merge tag 'v6.19-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix array out of bounds error in copy_file_range - Add tracepoint to help debug ioctl failures * tag 'v6.19-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range smb3 client: add missing tracepoint for unsupported ioctls commit 9ed7a28225af02b74f61e7880d460db49db83758 Author: Ruslan Krupitsa Date: Fri Jan 2 02:53:36 2026 +0300 ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk HP Laptop 15s-eq1xxx with ALC236 codec does not enable the mute LED automatically. This patch adds a quirk entry for subsystem ID 0x8706 using the ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED behavior. Signed-off-by: Ruslan Krupitsa Link: https://patch.msgid.link/AS8P194MB112895B8EC2D87D53A876085BBBAA@AS8P194MB1128.EURP194.PROD.OUTLOOK.COM Signed-off-by: Takashi Iwai commit 1e876e5a0875e71e34148c9feb2eedd3bf6b2b43 Author: Abdun Nihaal Date: Fri Dec 26 11:34:10 2025 +0530 gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths The reference obtained by calling usb_get_dev() is not released in the gpio_mpsse_probe() error paths. Fix that by using device managed helper functions. Also remove the usb_put_dev() call in the disconnect function since now it will be released automatically. Cc: stable@vger.kernel.org Fixes: c46a74ff05c0 ("gpio: add support for FTDI's MPSSE as GPIO") Signed-off-by: Abdun Nihaal Link: https://lore.kernel.org/r/20251226060414.20785-1-nihaal@cse.iitm.ac.in Signed-off-by: Bartosz Golaszewski commit 7811ba452402d58628e68faedf38745b3d485e3c Author: Fernando Fernandez Mancera Date: Wed Dec 17 15:46:40 2025 +0100 netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely. Update the last_gc value only when a GC has been actually performed. Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit d077e8119ddbb4fca67540f1a52453631a47f221 Author: Zilin Guan Date: Wed Dec 24 12:48:26 2025 +0000 netfilter: nf_tables: fix memory leak in nf_tables_newrule() In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to the err_release_rule label without freeing the allocated flow, leading to a memory leak. Fix this by adding a new label err_destroy_flow and jumping to it when nft_use_inc() fails. This ensures that the flow is properly released in this error case. Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow") Signed-off-by: Zilin Guan Signed-off-by: Florian Westphal commit 014a17deb41201449f76df2b20c857a9c3294a7c Author: Ernest Van Hoecke Date: Wed Dec 17 16:30:25 2025 +0100 gpio: pca953x: handle short interrupt pulses on PCAL devices GPIO drivers with latch input support may miss short pulses on input pins even when input latching is enabled. The generic interrupt logic in the pca953x driver reports interrupts by comparing the current input value against the previously sampled one and only signals an event when a level change is observed between two reads. For short pulses, the first edge is captured when the input register is read, but if the signal returns to its previous level before the read, the second edge is not observed. As a result, successive pulses can produce identical input values at read time and no level change is detected, causing interrupts to be missed. Below timing diagram shows this situation where the top signal is the input pin level and the bottom signal indicates the latched value. ─────┐ ┌──*───────────────┐ ┌──*─────────────────┐ ┌──*─── │ │ . │ │ . │ │ . │ │ │ │ │ │ │ │ │ └──*──┘ │ └──*──┘ │ └──*──┘ │ Input │ │ │ │ │ │ ▼ │ ▼ │ ▼ │ IRQ │ IRQ │ IRQ │ . . . ─────┐ .┌──────────────┐ .┌────────────────┐ .┌── │ │ │ │ │ │ │ │ │ │ │ │ └────────*┘ └────────*┘ └────────*┘ Latched │ │ │ ▼ ▼ ▼ READ 0 READ 0 READ 0 NO CHANGE NO CHANGE PCAL variants provide an interrupt status register that records which pins triggered an interrupt, but the status and input registers cannot be read atomically. The interrupt status is only cleared when the input port is read, and the input value must also be read to determine the triggering edge. If another interrupt occurs on a different line after the status register has been read but before the input register is sampled, that event will not be reflected in the earlier status snapshot, so relying solely on the interrupt status register is also insufficient. Support for input latching and interrupt status handling was previously added by [1], but the interrupt status-based logic was reverted by [2] due to these issues. This patch addresses the original problem by combining both sources of information. Events indicated by the interrupt status register are merged with events detected through the existing level-change logic. As a result: * short pulses, whose second edges are invisible, are detected via the interrupt status register, and * interrupts that occur between the status and input reads are still caught by the generic level-change logic. This significantly improves robustness on devices that signal interrupts as short pulses, while avoiding the issues that led to the earlier reversion. In practice, even if only the first edge of a pulse is observable, the interrupt is reliably detected. This fixes missed interrupts from an Ilitek touch controller with its interrupt line connected to a PCAL6416A, where active-low pulses are approximately 200 us long. [1] commit 44896beae605 ("gpio: pca953x: add PCAL9535 interrupt support for Galileo Gen2") [2] commit d6179f6c6204 ("gpio: pca953x: Improve interrupt support") Fixes: d6179f6c6204 ("gpio: pca953x: Improve interrupt support") Signed-off-by: Ernest Van Hoecke Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251217153050.142057-1-ernestvanhoecke@gmail.com Signed-off-by: Bartosz Golaszewski commit a7ac22d53d0990152b108c3f4fe30df45fcb0181 Author: Paweł Narewski Date: Wed Dec 24 09:26:40 2025 +0100 gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_with_key(), one may be traversing the srcu-protected list in gpio_name_to_desc(), meanwhile other has just added its gdev in gpiodev_add_to_list_unlocked(). This creates a non-mutexed and non-protected timeframe, when one instance is dereferencing and using &gdev->srcu, before the other has initialized it, resulting in crash: [ 4.935481] Unable to handle kernel paging request at virtual address ffff800272bcc000 [ 4.943396] Mem abort info: [ 4.943400] ESR = 0x0000000096000005 [ 4.943403] EC = 0x25: DABT (current EL), IL = 32 bits [ 4.943407] SET = 0, FnV = 0 [ 4.943410] EA = 0, S1PTW = 0 [ 4.943413] FSC = 0x05: level 1 translation fault [ 4.943416] Data abort info: [ 4.943418] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 4.946220] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 4.955261] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 4.955268] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000038e6c000 [ 4.961449] [ffff800272bcc000] pgd=0000000000000000 [ 4.969203] , p4d=1000000039739003 [ 4.979730] , pud=0000000000000000 [ 4.980210] phandle (CPU): 0x0000005e, phandle (BE): 0x5e000000 for node "reset" [ 4.991736] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP ... [ 5.121359] pc : __srcu_read_lock+0x44/0x98 [ 5.131091] lr : gpio_name_to_desc+0x60/0x1a0 [ 5.153671] sp : ffff8000833bb430 [ 5.298440] [ 5.298443] Call trace: [ 5.298445] __srcu_read_lock+0x44/0x98 [ 5.309484] gpio_name_to_desc+0x60/0x1a0 [ 5.320692] gpiochip_add_data_with_key+0x488/0xf00 5.946419] ---[ end trace 0000000000000000 ]--- Move initialization code for gdev fields before it is added to gpio_devices, with adjacent initialization code. Adjust goto statements to reflect modified order of operations Fixes: 47d8b4c1d868 ("gpio: add SRCU infrastructure to struct gpio_device") Reviewed-by: Jakub Lewalski Signed-off-by: Paweł Narewski [Bartosz: fixed a build issue, removed stray newline] Link: https://lore.kernel.org/r/20251224082641.10769-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 49416483a953662aa53c6d9bef651757d4a95ba5 Author: Bartosz Golaszewski Date: Mon Dec 22 11:01:28 2025 +0100 gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib We currently support sharing GPIOs between multiple devices whose drivers use either the GPIOLIB API *OR* the reset control API but not both at the same time. There's an unlikely corner-case where a reset-gpios pin can be shared by one driver using the GPIOLIB API and a second using the reset API. This will currently not work as the reset-gpio consumers are not described in firmware at the time of scanning so the shared GPIO just chooses one of the proxies created for the consumers when the reset-gpio driver performs the lookup. This can of course conflict in the case described above. In order to fix it: if we deal with the "reset-gpios" pin that's shared acconding to the firmware node setup, create a proxy for each described consumer as well as another one for the potential reset-gpio device. To that end: rework the matching to take this into account. Fixes: 7b78b26757e0 ("gpio: shared: handle the reset-gpios corner case") Link: https://lore.kernel.org/r/20251222-gpio-shared-reset-gpio-proxy-v1-3-8d4bba7d8c14@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit cb0451e33be047fff7137f58d9996370e11fb344 Author: Bartosz Golaszewski Date: Mon Dec 22 11:01:27 2025 +0100 gpio: shared: verify con_id when adding proxy lookup When matching the firmware node with the potential consumer, we currently omit the con_id string. This can lead to false positives in the unlikely case of the consumer having been assigned more than one shared GPIO. Check the connector ID before proceeding. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251222-gpio-shared-reset-gpio-proxy-v1-2-8d4bba7d8c14@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 9700b0fccf386b671e6f8401ddea6c5669cd0914 Author: Bartosz Golaszewski Date: Mon Dec 22 11:01:26 2025 +0100 gpiolib: allow multiple lookup tables per consumer The GPIO machine lookup mechanism dates back to old ARM board files where lookup tables would all be defined in a single place. Since then, lookup tables have also been used to address various DT and ACPI quirks like missing GPIOs and - as of recently - setting up shared GPIO proxy devices. The lookup itself stops when we find the first matching table for a consumer and - if it doesn't contain the right entry - the lookup fails. Since the tables can now be defined in multiple places and we can't know how many there are, effectively limiting a consumer to only a single lookup table is no longer viable. Rework the code to always look through all tables matching the consumer. Link: https://lore.kernel.org/r/20251222-gpio-shared-reset-gpio-proxy-v1-1-8d4bba7d8c14@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 69153e8b97ebe2afc0dd101767a9805130305500 Author: Julia Lawall Date: Wed Dec 31 18:22:07 2025 +0100 block, bfq: update outdated comment The function bfq_bfqq_may_idle() was renamed as bfq_better_to_idle() in commit 277a4a9b56cd ("block, bfq: give a better name to bfq_bfqq_may_idle"). Update the comment accordingly. Signed-off-by: Julia Lawall Signed-off-by: Jens Axboe commit 70eafc743016b1df73e00fd726ffedd44ce1bdd3 Author: Caleb Sander Mateos Date: Wed Dec 31 11:19:06 2025 -0700 io_uring/memmap: drop unused sz param in io_uring_validate_mmap_request() io_uring_validate_mmap_request() doesn't use its size_t sz argument, so remove it. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 5623eb1ed035f01dfa620366a82b667545b10c82 Author: Jens Axboe Date: Wed Dec 31 08:12:46 2025 -0700 io_uring/tctx: add separate lock for list of tctx's in ctx ctx->tcxt_list holds the tasks using this ring, and it's currently protected by the normal ctx->uring_lock. However, this can cause a circular locking issue, as reported by syzbot, where cancelations off exec end up needing to remove an entry from this list: ====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ syz.0.9999/12287 is trying to acquire lock: ffff88805851c0a8 (&ctx->uring_lock){+.+.}-{4:4}, at: io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 but task is already holding lock: ffff88802db5a2e0 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: prepare_bprm_creds fs/exec.c:1360 [inline] ffff88802db5a2e0 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: bprm_execve+0xb9/0x1400 fs/exec.c:1733 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&sig->cred_guard_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x187/0x1350 kernel/locking/mutex.c:776 proc_pid_attr_write+0x547/0x630 fs/proc/base.c:2837 vfs_write+0x27e/0xb30 fs/read_write.c:684 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (sb_writers#3){.+.+}-{0:0}: percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline] percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] __sb_start_write include/linux/fs/super.h:19 [inline] sb_start_write+0x4d/0x1c0 include/linux/fs/super.h:125 mnt_want_write+0x41/0x90 fs/namespace.c:499 open_last_lookups fs/namei.c:4529 [inline] path_openat+0xadd/0x3dd0 fs/namei.c:4784 do_filp_open+0x1fa/0x410 fs/namei.c:4814 io_openat2+0x3e0/0x5c0 io_uring/openclose.c:143 __io_issue_sqe+0x181/0x4b0 io_uring/io_uring.c:1792 io_issue_sqe+0x165/0x1060 io_uring/io_uring.c:1815 io_queue_sqe io_uring/io_uring.c:2042 [inline] io_submit_sqe io_uring/io_uring.c:2320 [inline] io_submit_sqes+0xbf4/0x2140 io_uring/io_uring.c:2434 __do_sys_io_uring_enter io_uring/io_uring.c:3280 [inline] __se_sys_io_uring_enter+0x2e0/0x2b60 io_uring/io_uring.c:3219 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&ctx->uring_lock){+.+.}-{4:4}: check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x15a6/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x187/0x1350 kernel/locking/mutex.c:776 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646 io_uring_task_cancel include/linux/io_uring.h:24 [inline] begin_new_exec+0x10ed/0x2440 fs/exec.c:1131 load_elf_binary+0x9f8/0x2d70 fs/binfmt_elf.c:1010 search_binary_handler fs/exec.c:1669 [inline] exec_binprm fs/exec.c:1701 [inline] bprm_execve+0x92e/0x1400 fs/exec.c:1753 do_execveat_common+0x510/0x6a0 fs/exec.c:1859 do_execve fs/exec.c:1933 [inline] __do_sys_execve fs/exec.c:2009 [inline] __se_sys_execve fs/exec.c:2004 [inline] __x64_sys_execve+0x94/0xb0 fs/exec.c:2004 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: &ctx->uring_lock --> sb_writers#3 --> &sig->cred_guard_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sig->cred_guard_mutex); lock(sb_writers#3); lock(&sig->cred_guard_mutex); lock(&ctx->uring_lock); *** DEADLOCK *** 1 lock held by syz.0.9999/12287: #0: ffff88802db5a2e0 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: prepare_bprm_creds fs/exec.c:1360 [inline] #0: ffff88802db5a2e0 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: bprm_execve+0xb9/0x1400 fs/exec.c:1733 stack backtrace: CPU: 0 UID: 0 PID: 12287 Comm: syz.0.9999 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2043 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain kernel/locking/lockdep.c:3908 [inline] __lock_acquire+0x15a6/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868 __mutex_lock_common kernel/locking/mutex.c:614 [inline] __mutex_lock+0x187/0x1350 kernel/locking/mutex.c:776 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646 io_uring_task_cancel include/linux/io_uring.h:24 [inline] begin_new_exec+0x10ed/0x2440 fs/exec.c:1131 load_elf_binary+0x9f8/0x2d70 fs/binfmt_elf.c:1010 search_binary_handler fs/exec.c:1669 [inline] exec_binprm fs/exec.c:1701 [inline] bprm_execve+0x92e/0x1400 fs/exec.c:1753 do_execveat_common+0x510/0x6a0 fs/exec.c:1859 do_execve fs/exec.c:1933 [inline] __do_sys_execve fs/exec.c:2009 [inline] __se_sys_execve fs/exec.c:2004 [inline] __x64_sys_execve+0x94/0xb0 fs/exec.c:2004 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff3a8b8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff3a9a97038 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 00007ff3a8de5fa0 RCX: 00007ff3a8b8f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000400 RBP: 00007ff3a8c13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff3a8de6038 R14: 00007ff3a8de5fa0 R15: 00007ff3a8f0fa28 Add a separate lock just for the tctx_list, tctx_lock. This can nest under ->uring_lock, where necessary, and be used separately for list manipulation. For the cancelation off exec side, this removes the need to grab ->uring_lock, hence fixing the circular locking dependency. Reported-by: syzbot+b0e3b77ffaa8a4067ce5@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit ebc18e9854e5a2b62a041fb57b216a903af45b85 Author: Bartosz Golaszewski Date: Wed Nov 26 13:22:19 2025 +0100 pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping The gpio_chip settings in this driver say the controller can't sleep but it actually uses a mutex for synchronization. This triggers the following BUG(): [ 9.233659] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 [ 9.233665] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 554, name: (udev-worker) [ 9.233669] preempt_count: 1, expected: 0 [ 9.233673] RCU nest depth: 0, expected: 0 [ 9.233688] Tainted: [W]=WARN [ 9.233690] Hardware name: Dell Inc. Latitude 7455/0FK7MX, BIOS 2.10.1 05/20/2025 [ 9.233694] Call trace: [ 9.233696] show_stack+0x24/0x38 (C) [ 9.233709] dump_stack_lvl+0x40/0x88 [ 9.233716] dump_stack+0x18/0x24 [ 9.233722] __might_resched+0x148/0x160 [ 9.233731] __might_sleep+0x38/0x98 [ 9.233736] mutex_lock+0x30/0xd8 [ 9.233749] lpi_config_set+0x2e8/0x3c8 [pinctrl_lpass_lpi] [ 9.233757] lpi_gpio_direction_output+0x58/0x90 [pinctrl_lpass_lpi] [ 9.233761] gpiod_direction_output_raw_commit+0x110/0x428 [ 9.233772] gpiod_direction_output_nonotify+0x234/0x358 [ 9.233779] gpiod_direction_output+0x38/0xd0 [ 9.233786] gpio_shared_proxy_direction_output+0xb8/0x2a8 [gpio_shared_proxy] [ 9.233792] gpiod_direction_output_raw_commit+0x110/0x428 [ 9.233799] gpiod_direction_output_nonotify+0x234/0x358 [ 9.233806] gpiod_configure_flags+0x2c0/0x580 [ 9.233812] gpiod_find_and_request+0x358/0x4f8 [ 9.233819] gpiod_get_index+0x7c/0x98 [ 9.233826] devm_gpiod_get+0x34/0xb0 [ 9.233829] reset_gpio_probe+0x58/0x128 [reset_gpio] [ 9.233836] auxiliary_bus_probe+0xb0/0xf0 [ 9.233845] really_probe+0x14c/0x450 [ 9.233853] __driver_probe_device+0xb0/0x188 [ 9.233858] driver_probe_device+0x4c/0x250 [ 9.233863] __driver_attach+0xf8/0x2a0 [ 9.233868] bus_for_each_dev+0xf8/0x158 [ 9.233872] driver_attach+0x30/0x48 [ 9.233876] bus_add_driver+0x158/0x2b8 [ 9.233880] driver_register+0x74/0x118 [ 9.233886] __auxiliary_driver_register+0x94/0xe8 [ 9.233893] init_module+0x34/0xfd0 [reset_gpio] [ 9.233898] do_one_initcall+0xec/0x300 [ 9.233903] do_init_module+0x64/0x260 [ 9.233910] load_module+0x16c4/0x1900 [ 9.233915] __arm64_sys_finit_module+0x24c/0x378 [ 9.233919] invoke_syscall+0x4c/0xe8 [ 9.233925] el0_svc_common+0x8c/0xf0 [ 9.233929] do_el0_svc+0x28/0x40 [ 9.233934] el0_svc+0x38/0x100 [ 9.233938] el0t_64_sync_handler+0x84/0x130 [ 9.233943] el0t_64_sync+0x17c/0x180 Mark the controller as sleeping. Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") Cc: stable@vger.kernel.org Reported-by: Val Packett Closes: https://lore.kernel.org/all/98c0f185-b0e0-49ea-896c-f3972dd011ca@packett.cool/ Signed-off-by: Bartosz Golaszewski Reviewed-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Signed-off-by: Linus Walleij commit bc277212b41ade2137b6278db24652d0847e9a91 Author: Sander Vanheule Date: Fri Dec 19 12:56:31 2025 +0100 pinctrl: pic64gx-gpio2: Add REGMAP_MMIO dependency In line with other drivers depending on REGMAP_*, select the required symbol to prevent a linker error when building with COMPILE_TEST=y: ld: drivers/pinctrl/pinctrl-pic64gx-gpio2.o: in function `pic64gx_gpio2_probe': pinctrl-pic64gx-gpio2.c:315:(.text+0x198): undefined reference to `__devm_regmap_init_mmio_clk' Fixes: 38cf9d641314 ("pinctrl: add pic64gx "gpio2" pinmux driver") Signed-off-by: Sander Vanheule Signed-off-by: Linus Walleij commit fb21116099bbea1fc59efa9207e63c4be390ab72 Author: Krzysztof Kozlowski Date: Wed Dec 24 12:55:34 2025 +0100 phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) "family" is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes: phy-bcm-ns-usb3.c:206:17: error: cast to smaller integer type 'enum bcm_ns_family' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] This was already fixed in commit bd6e74a2f0a0 ("phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning") but then got bad in commit 21bf6fc47a1e ("phy: Use device_get_match_data()"). Note that after various discussions the preferred cast is via "unsigned long", not "uintptr_t". Fixes: 21bf6fc47a1e ("phy: Use device_get_match_data()") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251224115533.154162-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Vinod Koul commit 2bafeb8d2f380c3a81d98bd7b78b854b564f9cd4 Author: Daniel Gomez Date: Fri Dec 19 06:13:20 2025 +0100 netfilter: replace -EEXIST with -EBUSY The -EEXIST error code is reserved by the module loading infrastructure to indicate that a module is already loaded. When a module's init function returns -EEXIST, userspace tools like kmod interpret this as "module already loaded" and treat the operation as successful, returning 0 to the user even though the module initialization actually failed. Replace -EEXIST with -EBUSY to ensure correct error reporting in the module initialization path. Affected modules: * ebtable_broute ebtable_filter ebtable_nat arptable_filter * ip6table_filter ip6table_mangle ip6table_nat ip6table_raw * ip6table_security iptable_filter iptable_mangle iptable_nat * iptable_raw iptable_security Signed-off-by: Daniel Gomez Signed-off-by: Florian Westphal commit 36a3200575642846a96436d503d46544533bb943 Author: Fernando Fernandez Mancera Date: Wed Dec 17 21:21:59 2025 +0100 netfilter: nft_synproxy: avoid possible data-race on update operation During nft_synproxy eval we are reading nf_synproxy_info struct which can be modified on update operation concurrently. As nf_synproxy_info struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations. Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit a675d1caa2041f05f6343fad67b04f8babf32217 Author: Florian Westphal Date: Thu Dec 4 12:20:36 2025 +0100 selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug without 'netfilter: nft_set_pipapo: fix range overlap detection': reject overlapping range on add 0s [FAIL] Returned success for add { 1.2.3.4 . 1.2.4.1-1.2.4.2 } given set: table inet filter { [..] elements = { 1.2.3.4 . 1.2.4.1 counter packets 0 bytes 0, 1.2.3.0-1.2.3.4 . 1.2.4.2 counter packets 0 bytes 0 } } The element collides with existing ones and was not added, but kernel returned success to userspace. Signed-off-by: Florian Westphal commit 7711f4bb4b360d9c0ff84db1c0ec91e385625047 Author: Florian Westphal Date: Thu Dec 4 12:20:35 2025 +0100 netfilter: nft_set_pipapo: fix range overlap detection set->klen has to be used, not sizeof(). The latter only compares a single register but a full check of the entire key is needed. Example: table ip t { map s { typeof iifname . ip saddr : verdict flags interval } } nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected nft add element t s '{ "lo" . 10.0.0.0/8 : drop }' # bug: no error The 3rd 'add element' should be rejected via -ENOTEMPTY, not -EEXIST, so userspace / nft can report an error to the user. The latter is only correct for the 2nd case (re-add of existing element). As-is, userspace is told that the command was successful, but no elements were added. After this patch, 3rd command gives: Error: Could not process rule: File exists add element t s { "lo" . 127.0.0.0/8 . "lo" : drop } ^^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: 0eb4b5ee33f2 ("netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion") Signed-off-by: Florian Westphal commit 9be25402d8522e16e5ebe84f2b1b6c5de082a388 Author: Matouš Lánský Date: Wed Dec 31 18:12:07 2025 +0100 ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 Add headset mic quirk for Acer Nitro AN517-55. This laptop uses the same audio configuration as the AN515-58 model. Signed-off-by: Matouš Lánský Link: https://patch.msgid.link/20251231171207.76943-1-matouslansky@post.cz Signed-off-by: Takashi Iwai commit 95cc9e7cf03d3646abce4129d5c013af33a7df99 Author: Ryosuke Yasuoka Date: Sat Dec 6 23:09:36 2025 +0900 x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task kvm_async_pf_queue_task() can incorrectly try to kfree() a node allocated on the stack of kvm_async_pf_task_wait_schedule(). This occurs when a task requests a PF while another task's PF request with the same token is still pending. Since the token is derived from the (u32)address in exc_page_fault(), two different tasks can generate the same token. Currently, kvm_async_pf_queue_task() assumes that any entry found in the list is a dummy entry and tries to kfree() it. To fix this, add a flag to the node structure to distinguish stack-allocated nodes, and only kfree() the node if it is a dummy entry. Signed-off-by: Ryosuke Yasuoka Message-ID: <20251206140939.144038-1-ryasuoka@redhat.com> Signed-off-by: Paolo Bonzini commit 7be19f9327d9a015ff97f97381e3bec163cd93cb Merge: 9abfe0b2e0cb93 4fe2bd195435e7 Author: Dave Airlie Date: Thu Jan 1 16:55:35 2026 +1000 Merge tag 'drm-intel-fixes-2025-12-31' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes drm/i915 fixes for v6.19-rc4: - Fix eb_lookup_vmas() failure path Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/4e79f041395bb8bcc9b2a76bb98b5e3df1c1c3eb@intel.com commit 9abfe0b2e0cb93b9cf59a82cdcc0185148c53cdf Merge: 1054f19572acbb 3fbd97618f49e0 Author: Dave Airlie Date: Thu Jan 1 16:51:30 2026 +1000 Merge tag 'drm-misc-fixes-2025-12-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc4: - Documentation fixes and MODULE_LICENSE fix for shmem helper. - Fix warnings in nouveau prepare_fb(). - Prevent export of protected objects in imagination driver. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/5506492b-02ca-47bc-8712-51e67f0e4b8b@linux.intel.com commit 1054f19572acbbec80e2339dbf61f2b40ffb918c Merge: f8f9c1f4d0c7a6 bed2a6bd20681a Author: Dave Airlie Date: Thu Jan 1 16:39:19 2026 +1000 Merge tag 'drm-xe-fixes-2025-12-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Core Changes: - Ensure a SVM device memory allocation is idle before migration complete (Thomas) Driver Changes: - Fix a SVM debug printout (Thomas) - Use READ_ONCE() / WRITE_ONCE() for g2h_fence (Jonathan) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aVOTf6-whmkgrUuq@fedora commit b69053dd3ffbc0d2dedbbc86182cdef6f641fe1b Author: Shuah Khan Date: Wed Dec 31 16:46:26 2025 -0700 wifi: mt76: Remove blank line after mt792x firmware version dmesg An extra blank line gets printed after printing firmware version because the build date is null terminated. Remove the "\n" from dev_info() calls to print firmware version and build date to fix the problem. Reported-by: Mario Limonciello Signed-off-by: Shuah Khan Signed-off-by: Linus Torvalds commit af7809f037e6e56f63a4d66b6a02826ce786af2c Author: Shuah Khan Date: Tue Dec 30 20:56:42 2025 -0700 Revert "wifi: mt76: Strip whitespace from build ddate" This reverts commit f804a5895ebad2b2d4fb8a3688d2115926e993d5. This change introduced the following panic, and mt792x_load_firmware() fails. wifi is dead on systems with mt792x wireless. kern :crit : kernel BUG at lib/string_helpers.c:1043! kern :warn : Oops: invalid opcode: 0000 [#1] SMP NOPTI kern :warn : CPU: 14 UID: 0 PID: 61 Comm: kworker/14:0 Tainted: G W 6.19.0-rc1 #1 PREEMPT(voluntary) kern :warn : Tainted: [W]=WARN kern :warn : Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.16 07/25/2025 kern :warn : Workqueue: events mt7921_init_work [mt7921_common] kern :warn : RIP: 0010:__fortify_panic+0xd/0xf kern :warn : Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 40 0f b6 ff e8 c3 55 71 00 <0f> 0b 48 8b 54 24 10 48 8b 74 24 08 4c 89 e9 48 c7 c7 00 a2 d5 a0 kern :warn : RSP: 0018:ffffa7a5c03a3d10 EFLAGS: 00010246 kern :warn : RAX: ffffffffa0d7aaf2 RBX: 0000000000000000 RCX: ffffffffa0d7aaf2 kern :warn : RDX: 0000000000000011 RSI: ffffffffa0d5a170 RDI: ffffffffa128db10 kern :warn : RBP: ffff91650ae52060 R08: 0000000000000010 R09: ffffa7a5c31b2000 kern :warn : R10: ffffa7a5c03a3bf0 R11: 00000000ffffffff R12: 0000000000000000 kern :warn : R13: ffffa7a5c31b2000 R14: 0000000000001000 R15: 0000000000000000 kern :warn : FS: 0000000000000000(0000) GS:ffff91743e664000(0000) knlGS:0000000000000000 kern :warn : CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kern :warn : CR2: 00007f10786c241c CR3: 00000003eca24000 CR4: 0000000000f50ef0 kern :warn : PKRU: 55555554 kern :warn : Call Trace: kern :warn : kern :warn : mt76_connac2_load_patch.cold+0x2b/0xa41 [mt76_connac_lib] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : mt792x_load_firmware+0x36/0x150 [mt792x_lib] kern :warn : mt7921_run_firmware+0x2c/0x4a0 [mt7921_common] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : ? mt7921_rr+0x12/0x30 [mt7921e] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : ? ____mt76_poll_msec+0x75/0xb0 [mt76] kern :warn : mt7921e_mcu_init+0x4c/0x7a [mt7921e] kern :warn : mt7921_init_work+0x51/0x190 [mt7921_common] kern :warn : process_one_work+0x18b/0x340 kern :warn : worker_thread+0x256/0x3a0 kern :warn : ? __pfx_worker_thread+0x10/0x10 kern :warn : kthread+0xfc/0x240 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ret_from_fork+0x254/0x290 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ret_from_fork_asm+0x1a/0x30 kern :warn : Signed-off-by: Shuah Khan Signed-off-by: Linus Torvalds commit 0ddd3bb4b14c9102c0267b3fd916c81fe5ab89c1 Author: Miaoqian Lin Date: Thu Dec 11 16:33:44 2025 +0400 drm/pl111: Fix error handling in pl111_amba_probe Jump to the existing dev_put label when devm_request_irq() fails so drm_dev_put() and of_reserved_mem_device_release() run instead of returning early and leaking resources. Found via static analysis and code review. Fixes: bed41005e617 ("drm/pl111: Initial drm/kms driver for pl111") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Javier Martinez Canillas Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251211123345.2392065-1-linmq006@gmail.com commit 882ddfc6b70e2535e028d4aa14a7d8bb2ca0fbd4 Author: Linus Walleij Date: Tue Dec 30 22:10:45 2025 +0100 Update .mailmap for Linus Walleij Developers run into bouncing emails from my old address, so add it to .mailmap. Stuff in the rest of my old mail addresses as well while we're at it. Reported-by: Andy Shevchenko Signed-off-by: Linus Walleij commit 19b8a76cd99bde6d299e60490f3e62b8d3df3997 Author: Wake Liu Date: Wed Dec 24 16:41:20 2025 +0800 kselftest/harness: Use helper to avoid zero-size memset warning When building kselftests with a toolchain that enables source fortification (e.g., Android's build environment, which uses -D_FORTIFY_SOURCE=3), a build failure occurs in tests that use an empty FIXTURE(). The root cause is that an empty fixture struct results in `sizeof(self_private)` evaluating to 0. The compiler's fortification checks then detect the `memset()` call with a compile-time constant size of 0, issuing a `-Wuser-defined-warnings` which is promoted to an error by `-Werror`. An initial attempt to guard the call with `if (sizeof(self_private) > 0)` was insufficient. The compiler's static analysis is aggressive enough to flag the `memset(..., 0)` pattern before evaluating the conditional, thus still triggering the error. To resolve this robustly, this change introduces a `static inline` helper function, `__kselftest_memset_safe()`. This function wraps the size check and the `memset()` call. By replacing the direct `memset()` in the `__TEST_F_IMPL` macro with a call to this helper, we create an abstraction boundary. This prevents the compiler's static analyzer from "seeing" the problematic pattern at the macro expansion site, resolving the build failure. Build Context: Compiler: Android (14488419, +pgo, +bolt, +lto, +mlgo, based on r584948) clang version 22.0.0 (https://android.googlesource.com/toolchain/llvm-project 2d65e4108033380e6fe8e08b1f1826cd2bfb0c99) Relevant Options: -O2 -Wall -Werror -D_FORTIFY_SOURCE=3 -target i686-linux-android10000 Test: m kselftest_futex_futex_requeue_pi Removed Gerrit Change-Id Shuah Khan Link: https://lore.kernel.org/r/20251224084120.249417-1-wakel@google.com Signed-off-by: Wake Liu Signed-off-by: Shuah Khan commit 9528d5c091c59b408a754a1823cf0942069867cc Merge: 349bd28a86f2bc c6703f10c8cc36 Author: Linus Torvalds Date: Wed Dec 31 12:25:22 2025 -0800 Merge tag 'platform-drivers-x86-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - alienware-wmi-wmax: Area-51, x16, and 16X Aurora laptops support - asus-armoury: - Fix FA507R PPT data - Add TDP data for more laptop models - asus-nb-wmi: Asus Zenbook 14 display toggle key support - dell-lis3lv02d: Dell Latitude 5400 support - hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - ibm_rtl: Fix EBDA signature search pointer arithmetic - ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT - intel/pmt: - Fix kobject memory leak on init failure - Use valid pointers on error handling path - intel/vsec: Correct kernel doc comments - mellanox: mlxbf-pmc: Fix event names - msi-laptop: Add sysfs_remove_group() - samsumg-galaxybook: Do not cast pointer to a shorter type - think-lmi: WMI certificate thumbprint support for ThinkCenter - uniwill: Tuxedo Book BA15 Gen10 support * tag 'platform-drivers-x86-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (22 commits) platform/x86: asus-armoury: add support for G835LW platform/x86: asus-armoury: fix ppt data for FA507R platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing platform/x86: asus-armoury: add support for G615LR platform/x86: asus-armoury: add support for FA608UM platform/x86: asus-armoury: add support for GA403WR platform/x86: asus-armoury: add support for GU605CR platform/x86: ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT platform/x86: samsung-galaxybook: Fix problematic pointer cast platform/x86/intel/pmt: Fix kobject memory leak on init failure platform/x86/intel/vsec: correct kernel-doc comments platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic platform/x86: msi-laptop: add missing sysfs_remove_group() platform/x86: think-lmi: Add WMI certificate thumbprint support for ThinkCenter platform/x86: dell-lis3lv02d: Add Latitude 5400 platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names platform/x86: asus-nb-wmi: Add keymap for display toggle platform/x86/uniwill: Add TUXEDO Book BA15 Gen10 platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora ... commit 0eccd4acd6bdcd25fef5507e002b69aed70b47ed Author: Zheng Yejian Date: Wed May 10 04:36:59 2023 +0800 selftests/ftrace: Test toplevel-enable for instance 'available_events' is actually not required by 'test.d/event/toplevel-enable.tc' and its Existence has been tested in 'test.d/00basic/basic4.tc'. So the require of 'available_events' can be dropped and then we can add 'instance' flag to test 'test.d/event/toplevel-enable.tc' for instance. Test result show as below: # ./ftracetest test.d/event/toplevel-enable.tc === Ftrace unit tests === [1] event tracing - enable/disable with top level files [PASS] [2] (instance) event tracing - enable/disable with top level files [PASS] # of passed: 2 # of failed: 0 # of unresolved: 0 # of untested: 0 # of unsupported: 0 # of xfailed: 0 # of undefined(test bug): 0 Link: https://lore.kernel.org/r/20230509203659.1173917-1-zhengyejian1@huawei.com Signed-off-by: Zheng Yejian Acked-by: Steven Rostedt (Google) Signed-off-by: Shuah Khan commit b889b4fb4cbea3ca7eb9814075d6a51936394bd9 Author: Yipeng Zou Date: Fri Aug 18 09:32:26 2023 +0800 selftests/ftrace: traceonoff_triggers: strip off names The func_traceonoff_triggers.tc sometimes goes to fail on my board, Kunpeng-920. [root@localhost]# ./ftracetest ./test.d/ftrace/func_traceonoff_triggers.tc -l fail.log === Ftrace unit tests === [1] ftrace - test for function traceon/off triggers [FAIL] [2] (instance) ftrace - test for function traceon/off triggers [UNSUPPORTED] I look up the log, and it shows that the md5sum is different between csum1 and csum2. ++ cnt=611 ++ sleep .1 +++ cnt_trace +++ grep -v '^#' trace +++ wc -l ++ cnt2=611 ++ '[' 611 -ne 611 ']' +++ cat tracing_on ++ on=0 ++ '[' 0 '!=' 0 ']' +++ md5sum trace ++ csum1='76896aa74362fff66a6a5f3cf8a8a500 trace' ++ sleep .1 +++ md5sum trace ++ csum2='ee8625a21c058818fc26e45c1ed3f6de trace' ++ '[' '76896aa74362fff66a6a5f3cf8a8a500 trace' '!=' 'ee8625a21c058818fc26e45c1ed3f6de trace' ']' ++ fail 'Tracing file is still changing' ++ echo Tracing file is still changing Tracing file is still changing ++ exit_fail ++ exit 1 So I directly dump the trace file before md5sum, the diff shows that: [root@localhost]# diff trace_1.log trace_2.log -y --suppress-common-lines dockerd-12285 [036] d.... 18385.510290: sched_stat | <...>-12285 [036] d.... 18385.510290: sched_stat dockerd-12285 [036] d.... 18385.510291: sched_swit | <...>-12285 [036] d.... 18385.510291: sched_swit <...>-740 [044] d.... 18385.602859: sched_stat | kworker/44:1-740 [044] d.... 18385.602859: sched_stat <...>-740 [044] d.... 18385.602860: sched_swit | kworker/44:1-740 [044] d.... 18385.602860: sched_swit And we can see that <...> filed be filled with names. We can strip off the names there to fix that. After strip off the names: kworker/u257:0-12 [019] d..2. 2528.758910: sched_stat | -12 [019] d..2. 2528.758910: sched_stat_runtime: comm=k kworker/u257:0-12 [019] d..2. 2528.758912: sched_swit | -12 [019] d..2. 2528.758912: sched_switch: prev_comm=kw -0 [000] d.s5. 2528.762318: sched_waki | -0 [000] d.s5. 2528.762318: sched_waking: comm=sshd pi -0 [037] dNh2. 2528.762326: sched_wake | -0 [037] dNh2. 2528.762326: sched_wakeup: comm=sshd pi -0 [037] d..2. 2528.762334: sched_swit | -0 [037] d..2. 2528.762334: sched_switch: prev_comm=sw Link: https://lore.kernel.org/r/20230818013226.2182299-1-zouyipeng@huawei.com Fixes: d87b29179aa0 ("selftests: ftrace: Use md5sum to take less time of checking logs") Suggested-by: Steven Rostedt (Google) Signed-off-by: Yipeng Zou Acked-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Signed-off-by: Shuah Khan commit 349bd28a86f2bc33b8c61f6cc7886f45d5c7cda7 Merge: c8ebd433459bcb acf44a2361b8d6 Author: Linus Torvalds Date: Wed Dec 31 10:38:48 2025 -0800 Merge tag 'vfio-v6.19-rc4' of https://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Restrict ROM access to dword to resolve a regression introduced with qword access seen on some Intel NICs. Update VGA region access to the same given lack of precedent for 64-bit users (Kevin Tian) - Fix missing .get_region_info_caps callback in the xe-vfio-pci variant driver due to integration through the DRM tree (Michal Wajdeczko) - Add aligned 64-bit access macros to tools/include/linux/types.h, allowing removal of uapi/linux/type.h includes from various vfio selftest, resolving redefinition warnings for integration with KVM selftests (David Matlack) - Fix error path memory leak in pds-vfio-pci variant driver (Zilin Guan) - Fix error path use-after-free in xe-vfio-pci variant driver (Alper Ak) * tag 'vfio-v6.19-rc4' of https://github.com/awilliam/linux-vfio: vfio/xe: Fix use-after-free in xe_vfio_pci_alloc_file() vfio/pds: Fix memory leak in pds_vfio_dirty_enable() vfio: selftests: Drop includes tools include: Add definitions for __aligned_{l,b}e64 vfio/xe: Add default handler for .get_region_info_caps vfio/pci: Disable qword access to the VGA region vfio/pci: Disable qword access to the PCI ROM bar commit 64d4fe6a4b218901e5a64e34f75586999a4a73fd Merge: e340663bbf2a75 3572ad82201bae Author: Takashi Iwai Date: Wed Dec 31 16:44:28 2025 +0100 Merge tag 'asoc-fix-v6.19-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A small collection of driver speciifc fixes, mostly relatively minor, plus an adjustment to the topology file naming for Intel systems with Bluetooth required for disambiguation. commit 9e193a06e6e5b313973de316be2d16913d42f7c3 Merge: 10845a105bbcb0 a4166f1c4893a9 Author: Jens Axboe Date: Wed Dec 31 06:55:07 2025 -0700 Merge tag 'md-6.19-20251231' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into block-6.19 Pull MD fixes from Yu Kuai: "- Fix null-pointer dereference in raid5 sysfs group_thread_cnt store (Tuo Li) - Fix possible mempool corruption during raid1 raid_disks update via sysfs (FengWei Shih) - Fix logical_block_size configuration being overwritten during super_1_validate() (Li Nan) - Fix forward incompatibility with configurable logical block size: arrays assembled on new kernels could not be assembled on kernels <=6.18 due to non-zero reserved pad rejection (Li Nan) - Fix static checker warning about iterator not incremented (Li Nan)" * tag 'md-6.19-20251231' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: md: Fix forward incompatibility from configurable logical block size md: Fix logical_block_size configuration being overwritten md: suspend array while updating raid_disks via sysfs md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() md: Fix static checker warning in analyze_sbs commit 4fe2bd195435e71c117983d87f278112c5ab364c Author: Krzysztof Niemiec Date: Tue Dec 16 19:09:01 2025 +0100 drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer Initialize the eb.vma array with values of 0 when the eb structure is first set up. In particular, this sets the eb->vma[i].vma pointers to NULL, simplifying cleanup and getting rid of the bug described below. During the execution of eb_lookup_vmas(), the eb->vma array is successively filled up with struct eb_vma objects. This process includes calling eb_add_vma(), which might fail; however, even in the event of failure, eb->vma[i].vma is set for the currently processed buffer. If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which prompts a call to eb_release_vmas() to clean up the mess. Since eb_lookup_vmas() might fail during processing any (possibly not first) buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know at what point did the lookup function fail. In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is set to NULL in case i915_gem_object_userptr_submit_init() fails; the current one needs to be cleaned up by eb_release_vmas() at this point, so the next one is set. If eb_add_vma() fails, neither the current nor the next vma is set to NULL, which is a source of a NULL deref bug described in the issue linked in the Closes tag. When entering eb_lookup_vmas(), the vma pointers are set to the slab poison value, instead of NULL. This doesn't matter for the actual lookup, since it gets overwritten anyway, however the eb_release_vmas() function only recognizes NULL as the stopping value, hence the pointers are being set to NULL as they go in case of intermediate failure. This patch changes the approach to filling them all with NULL at the start instead, rather than handling that manually during failure. Reported-by: Gangmin Kim Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15062 Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") Cc: stable@vger.kernel.org # 5.16.x Signed-off-by: Krzysztof Niemiec Reviewed-by: Janusz Krzysztofik Reviewed-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251216180900.54294-2-krzysztof.niemiec@intel.com (cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd) Signed-off-by: Jani Nikula commit bb85d206be208bbf834883e948125a35ac59993a Author: Chenghao Duan Date: Wed Dec 31 15:19:25 2025 +0800 samples/ftrace: Adjust LoongArch register restore order in direct calls Ensure that in the ftrace direct call logic, the CPU register state (with ra = parent return address) is restored to the correct state after the execution of the custom trampoline function and before returning to the traced function. Additionally, guarantee the correctness of the jump logic for jr t0 (traced function address). Cc: stable@vger.kernel.org Fixes: 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support") Reported-by: Youling Tang Acked-by: Steven Rostedt (Google) Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 73721d8676771c6c7b06d4e636cc053fc76afefd Author: Chenghao Duan Date: Wed Dec 31 15:19:21 2025 +0800 LoongArch: BPF: Enhance the bpf_arch_text_poke() function Enhance the bpf_arch_text_poke() function to enable accurate location of BPF program entry points. When modifying the entry point of a BPF program, skip the "move t0, ra" instruction to ensure the correct logic and copy of the jump address. Cc: stable@vger.kernel.org Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace") Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 26138762d9a27a7f1c33f467c4123c600f64a36e Author: Chenghao Duan Date: Wed Dec 31 15:19:21 2025 +0800 LoongArch: BPF: Enable trampoline-based tracing for module functions Remove the previous restrictions that blocked the tracing of kernel module functions. Fix the issue that previously caused kernel lockups when attempting to trace module functions. Before entering the trampoline code, the return address register ra shall store the address of the next assembly instruction after the 'bl trampoline' instruction, which is the traced function address, and the register t0 shall store the parent function return address. Refine the trampoline return logic to ensure that register data remains correct when returning to both the traced function and the parent function. Before this patch was applied, the module_attach test in selftests/bpf encountered a deadlock issue. This was caused by an incorrect jump address after the trampoline execution, which resulted in an infinite loop within the module function. Cc: stable@vger.kernel.org Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace") Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 61319d15a56093358c6822d30659fe2941f589f1 Author: Chenghao Duan Date: Wed Dec 31 15:19:21 2025 +0800 LoongArch: BPF: Adjust the jump offset of tail calls Call the next bpf prog and skip the first instruction of TCC initialization. A total of 7 instructions are skipped: 'move t0, ra' 1 inst 'move_imm + jirl' 5 inst 'addid REG_TCC, zero, 0' 1 inst Relevant test cases: the tailcalls test item in selftests/bpf. Cc: stable@vger.kernel.org Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace") Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit d314e1f48260cef3f869e3edc02a02c8a48b08e1 Author: Chenghao Duan Date: Wed Dec 31 15:19:20 2025 +0800 LoongArch: BPF: Save return address register ra to t0 before trampoline Modify the build_prologue() function to ensure the return address register ra is saved to t0 before entering trampoline operations. This change ensures the accurate return address handling when a BPF program calls another BPF program, preventing errors in the BPF-to-BPF call chain. Cc: stable@vger.kernel.org Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace") Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit eb71f5c433e1c6dff089b315881dec40a88a7baf Author: Hengqi Chen Date: Wed Dec 31 15:19:20 2025 +0800 LoongArch: BPF: Zero-extend bpf_tail_call() index The bpf_tail_call() index should be treated as a u32 value. Let's zero-extend it to avoid calling wrong BPF progs. See similar fixes for x86 [1]) and arm64 ([2]) for more details. [1]: https://github.com/torvalds/linux/commit/90caccdd8cc0215705f18b92771b449b01e2474a [2]: https://github.com/torvalds/linux/commit/16338a9b3ac30740d49f5dfed81bac0ffa53b9c7 Cc: stable@vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 3f5a238f24d7b75f9efe324d3539ad388f58536e Author: Hengqi Chen Date: Wed Dec 31 15:19:20 2025 +0800 LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they should follow LoongArch calling conventions. Sign extend its arguments properly to avoid kernel panic. This is done by adding a new emit_abi_ext() helper. The emit_abi_ext() helper performs extension in place meaning a value already store in the target register (Note: this is different from the existing sign_extend() helper and thus we can't reuse it). Cc: stable@vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen Signed-off-by: Huacai Chen commit 45cb47c628dfbd1994c619f3eac271a780602826 Author: Chenghao Duan Date: Wed Dec 31 15:19:20 2025 +0800 LoongArch: Refactor register restoration in ftrace_common_return Refactor the register restoration sequence in the ftrace_common_return function to clearly distinguish between the logic of normal returns and direct call returns in function tracing scenarios. The logic is as follows: 1. In the case of a normal return, the execution flow returns to the traced function, and ftrace must ensure that the register data is consistent with the state when the function was entered. ra = parent return address; t0 = traced function return address. 2. In the case of a direct call return, the execution flow jumps to the custom trampoline function, and ftrace must ensure that the register data is consistent with the state when ftrace was entered. ra = traced function return address; t0 = parent return address. Cc: stable@vger.kernel.org Fixes: 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support") Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 9bdc1ab5e4ce6f066119018d8f69631a46f9c5a0 Author: Chenghao Duan Date: Wed Dec 31 15:19:20 2025 +0800 LoongArch: Enable exception fixup for specific ADE subcode This patch allows the LoongArch BPF JIT to handle recoverable memory access errors generated by BPF_PROBE_MEM* instructions. When a BPF program performs memory access operations, the instructions it executes may trigger ADEM exceptions. The kernel’s built-in BPF exception table mechanism (EX_TYPE_BPF) will generate corresponding exception fixup entries in the JIT compilation phase; however, the architecture-specific trap handling function needs to proactively call the common fixup routine to achieve exception recovery. do_ade(): fix EX_TYPE_BPF memory access exceptions for BPF programs, ensure safe execution. Relevant test cases: illegal address access tests in module_attach and subprogs_extable of selftests/bpf. Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 4cd641a79e69270a062777f64a0dd330abb9044a Author: Tiezhu Yang Date: Wed Dec 31 15:19:19 2025 +0800 LoongArch: Remove unnecessary checks for ORC unwinder According to the following function definitions, __kernel_text_address() already checks __module_text_address(), so it should remove the check of __module_text_address() in bt_address() at least. int __kernel_text_address(unsigned long addr) { if (kernel_text_address(addr)) return 1; ... return 0; } int kernel_text_address(unsigned long addr) { bool no_rcu; int ret = 1; ... if (is_module_text_address(addr)) goto out; ... return ret; } bool is_module_text_address(unsigned long addr) { guard(rcu)(); return __module_text_address(addr) != NULL; } Furthermore, there are two checks of __kernel_text_address(), one is in bt_address() and the other is after calling bt_address(), it looks like redundant. Handle the exception address first and then use __kernel_text_address() to validate the calculated address for exception or the normal address in bt_address(), then it can remove the check of __kernel_text_address() after calling bt_address(). Just remove unnecessary checks, no functional changes intended. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 6e5416d63bcba2bcc280d170eaf66775771892be Author: Tiezhu Yang Date: Wed Dec 31 15:19:10 2025 +0800 LoongArch: Remove is_entry_func() and kernel_entry_end For now, the related code of is_entry_func() is useless, so they can be removed. Then the symbol kernel_entry_end is not used any more, so it can be removed too. Link: https://lore.kernel.org/lkml/kjiyla6qj3l7ezspitulrdoc5laj2e6hoecvd254hssnpddczm@g6nkaombh6va/ Suggested-by: Josh Poimboeuf Signed-off-by: Tiezhu Yang commit 1b2f4706c6a20ab6ac41533dd8032d54322076e3 Author: Tiezhu Yang Date: Wed Dec 31 15:19:10 2025 +0800 LoongArch: Use UNWIND_HINT_END_OF_STACK for entry points kernel_entry() and smpboot_entry() are the last frames for ORC unwinder, so it is proper to use the annotation UNWIND_HINT_END_OF_STACK for them. Link: https://lore.kernel.org/lkml/ots6w2ntyudj5ucs5eowncta2vmfssatpcqwzpar3ekk577hxi@j45dd4dmwx6x/ Suggested-by: Josh Poimboeuf Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit d5be446948b379f1d1a8e7bc6656d13f44c5c7b1 Author: Huacai Chen Date: Wed Dec 31 15:19:10 2025 +0800 LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED For 32BIT platform _PAGE_PROTNONE is 0, so set a VMA to be VM_NONE or VM_SHARED will make pages non-present, then cause Oops with kernel page fault. Fix it by set correct protection_map[] for VM_NONE/VM_SHARED, replacing _PAGE_PROTNONE with _PAGE_PRESENT. Signed-off-by: Huacai Chen commit 807e5d383ca8bf6c0ac0fddd5edf9dda92e97c5d Author: Huacai Chen Date: Wed Dec 31 15:19:10 2025 +0800 LoongArch: Complete CPUCFG registers definition According to the "LoongArch Reference Manual Volume 1: Basic Architecture", begin with LA664 CPU core there are more features supported which are indicated in CPUCFG2 and CPUCFG3. This patch completes the definitions of them so as to match the architecture specification. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 641ecc890038f08af160bdff5183b6b42d2313b5 Author: Jiakai Xu Date: Fri Dec 26 03:23:17 2025 +0000 riscv: fix KUnit test_kprobes crash when building with Clang Clang misinterprets the placement of test_kprobes_addresses and test_kprobes_functions arrays when they are not explicitly assigned to a data section. This can lead to kmalloc_array() allocation errors and KUnit failures. When testing the Clang-compiled code in QEMU, this warning was emitted: WARNING: CPU: 1 PID: 3000 at mm/page_alloc.c:5159 __alloc_frozen_pages_noprof+0xe6/0x2fc mm/page_alloc.c:5159 Further investigation revealed that the test_kprobes_addresses array appeared to have over 100,000 elements, including invalid addresses; whereas, according to test-kprobes-asm.S, test_kprobes_addresses should only have 25 elements. When compiling the kernel with GCC, the kernel boots correctly. This patch fixes the issue by adding .section .rodata to explicitly place arrays in the read-only data segment. For detailed debug and analysis, see: https://github.com/j1akai/temp/blob/main/20251113/readme.md v1 -> v2： - Drop changes to .align, and .globl. Signed-off-by: Jiakai Xu Signed-off-by: Jiakai Xu Link: https://patch.msgid.link/738dd4e2.ff73.19a7cd7b4d5.Coremail.xujiakai2025@iscas.ac.cn Link: https://github.com/llvm/llvm-project/issues/168308 Link: https://patch.msgid.link/20251226032317.1523764-1-jiakaiPeanut@gmail.com Signed-off-by: Paul Walmsley commit 25fd7ee7bf58ac3ec7be3c9f82ceff153451946c Author: Lukas Gerlach Date: Thu Dec 18 20:13:32 2025 +0100 riscv: Sanitize syscall table indexing under speculation The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels. Signed-off-by: Lukas Gerlach Link: https://patch.msgid.link/20251218191332.35849-3-lukas.gerlach@cispa.de Signed-off-by: Paul Walmsley commit 66562b66dcbc8f93c1e28632299f449bb2f5c47d Author: Vivian Wang Date: Tue Dec 30 21:39:17 2025 +0800 riscv: boot: Always make Image from vmlinux, not vmlinux.unstripped Since commit 4b47a3aefb29 ("kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux") vmlinux has .rel*.dyn preserved. Therefore, use vmlinux to produce Image, not vmlinux.unstripped. Doing so fixes booting a RELOCATABLE=y Image with kexec. The problem is caused by this chain of events: - Since commit 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped"), vmlinux.unstripped gets a .modinfo section. - The .modinfo section has SHF_ALLOC, so it ends up in Image, at the end of it. - The Image header's image_size field does not expect to include .modinfo and does not account for it, since it should not be in Image. - If .modinfo is large enough, the file size of Image ends up larger than image_size, which eventually leads to it failing sanity_check_segment_list(). Using vmlinux instead of vmlinux.unstripped means that the unexpected .modinfo section is gone from Image, fixing the file size problem. Cc: stable@vger.kernel.org Fixes: 3e86e4d74c04 ("kbuild: keep .modinfo section in vmlinux.unstripped") Signed-off-by: Vivian Wang Reviewed-by: Nathan Chancellor Tested-by: Han Gao Link: https://patch.msgid.link/20251230-riscv-vmlinux-not-unstripped-v1-1-15f49df880df@iscas.ac.cn Signed-off-by: Paul Walmsley commit c8ebd433459bcbf068682b09544e830acd7ed222 Merge: dbf8fe85a16a33 1f941b2c23fd34 Author: Linus Torvalds Date: Tue Dec 30 17:56:26 2025 -0800 Merge tag 'nfsd-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "A set of NFSD fixes that arrived just a bit late for the 6.19 merge window. Regression fix: - Avoid unnecessarily breaking a timestamp delegation Stable fixes: - Fix a crasher in nlm4svc_proc_test() - Fix nfsd_file reference leak during write delegation - Fix error flow in client_states_open()" * tag 'nfsd-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: Drop the client reference in client_states_open() nfsd: use ATTR_DELEG in nfsd4_finalize_deleg_timestamps() nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() lockd: fix vfs_test_lock() calls commit fc5ff2500976cd2710a7acecffd12d95ee4f98fc Author: Alexandre Negrel Date: Tue Dec 30 19:57:28 2025 +0100 io_uring: use GFP_NOWAIT for overflow CQEs on legacy rings Allocate the overflowing CQE with GFP_NOWAIT instead of GFP_ATOMIC. This changes causes allocations to fail earlier in out-of-memory situations, rather than being deferred. Using GFP_ATOMIC allows a process to exceed memory limits. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220794 Signed-off-by: Alexandre Negrel Link: https://lore.kernel.org/io-uring/20251229201933.515797-1-alexandre@negrel.dev/ Signed-off-by: Jens Axboe commit 4c9f6a782f6078dc94450fcb22e65d520bfa0775 Author: Alice Ryhl Date: Sat Dec 27 15:47:21 2025 +0000 rust: driver: fix broken intra-doc links to example driver types The `auxiliary` and `pci` modules are conditional on `CONFIG_AUXILIARY_BUS` and `CONFIG_PCI` respectively. When these are disabled, the intra-doc links to `auxiliary::Driver` and `pci::Driver` break, causing rustdoc warnings (or errors with `-D warnings`). error: unresolved link to `kernel::auxiliary::Driver` --> rust/kernel/driver.rs:82:28 | 82 | //! [`auxiliary::Driver`]: kernel::auxiliary::Driver | ^^^^^^^^^^^^^^^^^^^^^^^^^ no item named `auxiliary` in module `kernel` Fix this by making the documentation for these examples conditional on the corresponding configuration options. Fixes: 970a7c68788e ("driver: rust: expand documentation for driver infrastructure") Signed-off-by: Alice Ryhl Reported-by: FUJITA Tomonori Closes: https://lore.kernel.org/rust-for-linux/20251209.151817.744108529426448097.fujita.tomonori@gmail.com/ Link: https://patch.msgid.link/20251227-driver-types-v1-1-1916154fbe5e@google.com Signed-off-by: Danilo Krummrich commit 0cc13256b60510936c34098ee7b929098eed823b Author: Manivannan Sadhasivam Date: Wed Nov 26 13:47:18 2025 +0530 PCI: qcom: Remove ASPM L0s support for MSM8996 SoC Though I couldn't confirm ASPM L0s support with the Qcom hardware team, a bug report from Dmitry suggests that L0s is broken on this legacy SoC. Hence, remove L0s support from the Root Port Link Capabilities in this SoC. Since qcom_pcie_clear_aspm_l0s() is now used by more than one SoC config, call it from qcom_pcie_host_init() instead. Reported-by: Dmitry Baryshkov Closes: https://lore.kernel.org/linux-pci/4cp5pzmlkkht2ni7us6p3edidnk25l45xrp6w3fxguqcvhq2id@wjqqrdpkypkf Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20251126081718.8239-1-mani@kernel.org commit dbf8fe85a16a33d6b6bd01f2bc606fc017771465 Merge: 8640b74557fc8b 1adaea51c61b52 Author: Linus Torvalds Date: Tue Dec 30 08:45:58 2025 -0800 Merge tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth and WiFi. Notably this includes the fix for the iwlwifi issue you reported. Current release - regressions: - core: avoid prefetching NULL pointers - wifi: - iwlwifi: implement settime64 as stub for MVM/MLD PTP - mac80211: fix list iteration in ieee80211_add_virtual_monitor() - handshake: fix null-ptr-deref in handshake_complete() - eth: mana: fix use-after-free in reset service rescan path Previous releases - regressions: - openvswitch: avoid needlessly taking the RTNL on vport destroy - dsa: properly keep track of conduit reference - ipv4: - fix error route reference count leak with nexthop objects - fib: restore ECMP balance from loopback - mptcp: ensure context reset on disconnect() - bluetooth: fix potential UaF in btusb - nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - eth: - gve: defer interrupt enabling until NAPI registration - i40e: fix scheduling in set_rx_mode - macb: relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - rtl8150: fix memory leak on usb_submit_urb() failure - wifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() Previous releases - always broken: - ip6_gre: make ip6gre_header() robust - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT - af_unix: don't post cmsg for SO_INQ unless explicitly asked for - phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - wifi: mac80211: discard beacon frames to non-broadcast address - eth: - iavf: fix off-by-one issues in iavf_config_rss_reg() - stmmac: fix the crash issue for zero copy XDP_TX action - team: fix check for port enabled when priority changes" * tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits) ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT net: rose: fix invalid array index in rose_kill_by_device() net: enetc: do not print error log if addr is 0 net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() selftests: fib_test: Add test case for ipv4 multi nexthops net: fib: restore ECMP balance from loopback selftests: fib_nexthops: Add test cases for error routes deletion ipv4: Fix reference count leak when using error routes with nexthop objects net: usb: sr9700: fix incorrect command used to write single register ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() usbnet: avoid a possible crash in dql_completed() gve: defer interrupt enabling until NAPI registration net: stmmac: fix the crash issue for zero copy XDP_TX action octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" af_unix: don't post cmsg for SO_INQ unless explicitly asked for net: mana: Fix use-after-free in reset service rescan path net: avoid prefetching NULL pointers net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write net: usb: asix: validate PHY address before use ... commit 10845a105bbcb030647a729f1716c2309da71d33 Author: Cong Zhang Date: Tue Dec 30 17:17:05 2025 +0800 blk-mq: skip CPU offline notify on unmapped hctx If an hctx has no software ctx mapped, blk_mq_map_swqueue() never allocates tags and leaves hctx->tags NULL. The CPU hotplug offline notifier can still run for that hctx, return early since hctx cannot hold any requests. Signed-off-by: Cong Zhang Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline") Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 1384cc00bc5f444ddfb66e027fb20c33844b21e1 Author: Louis-Alexis Eyraud Date: Fri Dec 5 15:22:27 2025 +0100 drm/mediatek: mtk_hdmi_ddc_v2: Fix multi-byte writes Currently, the mtk_hdmi_ddc_v2 driver sends a i2c message by calling the mtk_ddc_wr_one function for each byte of the payload to setup SI2C_CTRL and DDC_CTRL registers, and perform a sequential write transfer of one byte at a time to the target device. This leads to incorrect transfers as the target address (at least) is also sent each time. So, rename mtk_ddc_wr_one function to mtk_ddcm_write_hdmi to match the read function name (mtk_ddcm_read_hdmi) and modify its behaviour to send all payload data in a single sequential write transfer by filling the transfer fifo first then starting the transfer with a size equal to the payload size and not one anymore. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/dri-devel/patch/20251205-mtk-hdmi-ddc-v2-fixes-v1-2-260dd0d320f4@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 2788c969d89afb1e6ff66b8530584a634d1327dd Author: Louis-Alexis Eyraud Date: Fri Dec 5 15:22:26 2025 +0100 drm/mediatek: mtk_hdmi_ddc_v2: Add transfer abort on timeout cases During a read or write transfer, the mtk_hdmi_ddc_v2 driver polls the DDC_I2C_IN_PROG bit of HPD_DDC_STATUS register to check if the transfer completes but do no particular action if a timeout is reached. It could lead the next transfer attempts to fail because the faulty transfer was not aborted. So, add in both low level read and write functions a abort action by writing the DDC_CTRL register with the ABORT_XFER command value. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/dri-devel/patch/20251205-mtk-hdmi-ddc-v2-fixes-v1-1-260dd0d320f4@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 4e7fd55411faf6c1abfa2ddd1504713b2006d166 Author: Nathan Chancellor Date: Tue Nov 25 15:14:23 2025 -0700 drm/mediatek: mtk_hdmi_v2: Fix return type of mtk_hdmi_v2_tmds_char_rate_valid() When building with -Wincompatible-function-pointer-types-strict, a warning designed to catch kernel control flow integrity (kCFI) issues at build time, there is an instance in the new HDMI v2 drm/mediatek code: drivers/gpu/drm/mediatek/mtk_hdmi_v2.c:1331:31: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(const struct drm_bridge *, const struct drm_display_mode *, unsigned long long)' with an expression of type 'int (const struct drm_bridge *, const struct drm_display_mode *, unsigned long long)' [-Werror,-Wincompatible-function-pointer-types-strict] 1331 | .hdmi_tmds_char_rate_valid = mtk_hdmi_v2_hdmi_tmds_char_rate_valid, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ While 'int' and 'enum drm_mode_status' are ABI compatible, hence no regular warning from -Wincompatible-function-pointer-types, the mismatch will trigger a kCFI violation when mtk_hdmi_v2_tmds_char_rate_valid() is called indirectly. Update the return type of mtk_hdmi_v2_tmds_char_rate_valid() to be 'enum drm_mode_status' to clear up the warning and kCFI violation. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Nathan Chancellor Link: https://patchwork.kernel.org/project/dri-devel/patch/20251125-drm-mediatek-hdmi-v2-wifpts-v1-1-a6c7582cf69a@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 2de5bdc2d9819d645b4d0e91d3a520b7fee87294 Author: Dan Carpenter Date: Tue Nov 25 16:52:39 2025 +0300 drm/mediatek: Fix platform_get_irq() error checking The platform_get_irq() function returns negative error codes on failure and positive non-zero IRQ numbers on success. It never returns NULL. Fix the error checking to look for negatives, and change "hdmi->irq" from unsigned int to just int. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Dan Carpenter https://patchwork.kernel.org/project/dri-devel/patch/aSW0p5sqnJVJsqDO@stanley.mountain/ Signed-off-by: Chun-Kuang Hu commit 3009738a855cf938bbfc9078bec725031ae623a4 Author: Shawn Lin Date: Mon Dec 22 15:11:25 2025 +0800 mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MSHC controller requires maintaining a minimum clock of 52MHz in these modes. Add a check to prevent illegal clock reduction through debugfs: root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock root@debian:/# [ 30.090146] mmc0: running CQE recovery mmc0: cqhci: Failed to halt mmc0: cqhci: spurious TCN for tag 0 WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT Hardware name: Rockchip RK3588 EVB1 V10 Board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cqhci_irq+0x254/0x818 lr : cqhci_irq+0x254/0x818 ... Fixes: c6f361cba51c ("mmc: sdhci-of-dwcmshc: add support for rk3588") Cc: Sebastian Reichel Cc: Yifeng Zhao Signed-off-by: Shawn Lin Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit fa2fd0b10f66b08bc44745feed1761d7c1539d6e Author: Henrique Carvalho Date: Mon Dec 29 14:49:43 2025 -0300 smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_range struct copychunk_ioctl_req::ChunkCount is annotated with __counted_by_le() as the number of elements in Chunks[]. smb2_copychunk_range reuses ChunkCount to store the number of chunks sent in the current iteration. If a later iteration populates more chunks than a previous one, the stale smaller value trips UBSAN. Set ChunkCount to chunk_count (allocated capacity) before populating Chunks[]. Fixes: cc26f593dc19 ("smb: move copychunk definitions to common/smb2pdu.h") Link: https://lore.kernel.org/linux-cifs/CAH2r5ms9AWLy8WZ04Cpq5XOeVK64tcrUQ6__iMW+yk1VPzo1BA@mail.gmail.com Tested-by: Youling Tang Acked-by: ChenXiaoSong Signed-off-by: Henrique Carvalho Signed-off-by: Steve French commit bc311611625a8aaa26813809a2c820fcd286ba2b Author: Steve French Date: Mon Dec 29 10:23:12 2025 -0600 smb3 client: add missing tracepoint for unsupported ioctls In debugging a recent problem with an xfstest, noticed that we weren't tracing cases where the ioctl was not supported. Add dynamic tracepoint: "trace-cmd record -e smb3_unsupported_ioctl" and then after running an app which calls unsupported ioctl, "trace-cmd show"would display e.g. xfs_io-7289 [012] ..... 1205.137765: smb3_unsupported_ioctl: xid=19 fid=0x4535bb84 ioctl cmd=0x801c581f Acked-by: Bharath SM Signed-off-by: Steve French commit d1a6f1259b0bb415107e83f6403a2ecb945d042f Author: Horatiu Vultur Date: Wed Nov 19 14:47:50 2025 +0100 ARM: dts: microchip: lan966x: Fix the access to the PHYs for pcb8290 The problem is that the MDIO controller can't detect any of the PHYs. The reason is that the lan966x is not pulling high the GPIO 53 that is connected to the PHYs reset GPIO. Without doing this the PHYs are kept in reset. The mdio controller framework has the possibility to control a GPIO to release the reset of the PHYs. So take advantage of this and set line to be high before accessing the PHYs. Signed-off-by: Horatiu Vultur Reviewed-by: Claudiu Beznea Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20251119134750.394655-1-horatiu.vultur@microchip.com [claudiu.beznea: add microchip in patch title, s/possiblity/possibility in patch description] Signed-off-by: Claudiu Beznea commit fcd431a9627f272b4c0bec445eba365fe2232a94 Author: Thomas Fourier Date: Tue Dec 30 09:51:21 2025 +0100 RDMA/bnxt_re: fix dma_free_coherent() pointer The dma_alloc_coherent() allocates a dma-mapped buffer, pbl->pg_arr[i]. The dma_free_coherent() should pass the same buffer to dma_free_coherent() and not page-aligned. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20251230085121.8023-2-fourier.thomas@gmail.com Signed-off-by: Leon Romanovsky commit 1adaea51c61b52e24e7ab38f7d3eba023b2d050d Author: Jiayuan Chen Date: Tue Dec 23 13:14:12 2025 +0800 ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route(). Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT: free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur. Link: https://syzkaller.appspot.com/bug?extid=9b35e9bc0951140d13e6 Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") Reported-by: syzbot+9b35e9bc0951140d13e6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6918cd88.050a0220.1c914e.0045.GAE@google.com/T/ Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20251223051413.124687-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni commit c6703f10c8cc36f53b867bdbdd5bacaaa47ce799 Author: Denis Benato Date: Mon Dec 29 21:44:58 2025 +0100 platform/x86: asus-armoury: add support for G835LW Add TDP data for laptop model G835LW. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251229204458.2658777-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 43bd09d5b750f700499ae8ec45fd41a4c48673e6 Author: Honggang LI Date: Mon Dec 29 10:56:17 2025 +0800 RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation If device max_mr_size bits in the range [mr_page_shift+31:mr_page_shift] are zero, the `min3` function will set clt_path::max_pages_per_mr to zero. `alloc_path_reqs` will pass zero, which is invalid, as the third parameter to `ib_alloc_mr`. Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Signed-off-by: Honggang LI Link: https://patch.msgid.link/20251229025617.13241-1-honggangli@163.com Signed-off-by: Leon Romanovsky commit 6595beb40fb0ec47223d3f6058ee40354694c8e4 Author: Pwnverse Date: Mon Dec 22 21:22:27 2025 +0000 net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device being brought down. The loop mistakenly indexes array[cnt] instead of array[i]. For cnt < ARRAY_SIZE(array), this reads an uninitialized entry; for cnt == ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to an invalid socket pointer dereference and also leaks references taken via sock_hold(). Fix the index to use i. Fixes: 64b8bc7d5f143 ("net/rose: fix races in rose_kill_by_device()") Co-developed-by: Fatma Alwasmi Signed-off-by: Fatma Alwasmi Signed-off-by: Pwnverse Link: https://patch.msgid.link/20251222212227.4116041-1-ritviktanksalkar@gmail.com Signed-off-by: Paolo Abeni commit 5939b6dbcda8b0f5f03a8e5179c13dc0195eb6cd Author: Wei Fang Date: Mon Dec 22 10:26:28 2025 +0800 net: enetc: do not print error log if addr is 0 A value of 0 for addr indicates that the IEB_LBCR register does not need to be configured, as its default value is 0. However, the driver will print an error log if addr is 0, so this issue needs to be fixed. Fixes: 50bfd9c06f0f ("net: enetc: set external PHY address in IERB for i.MX94 ENETC") Signed-off-by: Wei Fang Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251222022628.4016403-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 99537d5c476cada9cf75aef9fa75579a31faadb9 Author: Xiaolei Wang Date: Mon Dec 22 09:56:24 2025 +0800 net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() In the non-RT kernel, local_bh_disable() merely disables preemption, whereas it maps to an actual spin lock in the RT kernel. Consequently, when attempting to refill RX buffers via netdev_alloc_skb() in macb_mac_link_up(), a deadlock scenario arises as follows: WARNING: possible circular locking dependency detected 6.18.0-08691-g2061f18ad76e #39 Not tainted ------------------------------------------------------ kworker/0:0/8 is trying to acquire lock: ffff00080369bbe0 (&bp->lock){+.+.}-{3:3}, at: macb_start_xmit+0x808/0xb7c but task is already holding lock: ffff000803698e58 (&queue->tx_ptr_lock){+...}-{3:3}, at: macb_start_xmit +0x148/0xb7c which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&queue->tx_ptr_lock){+...}-{3:3}: rt_spin_lock+0x50/0x1f0 macb_start_xmit+0x148/0xb7c dev_hard_start_xmit+0x94/0x284 sch_direct_xmit+0x8c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 -> #2 (_xmit_ETHER#2){+...}-{3:3}: rt_spin_lock+0x50/0x1f0 sch_direct_xmit+0x11c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 -> #1 ((softirq_ctrl.lock)){+.+.}-{3:3}: lock_release+0x250/0x348 __local_bh_enable_ip+0x7c/0x240 __netdev_alloc_skb+0x1b4/0x1d8 gem_rx_refill+0xdc/0x240 gem_init_rings+0xb4/0x108 macb_mac_link_up+0x9c/0x2b4 phylink_resolve+0x170/0x614 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 -> #0 (&bp->lock){+.+.}-{3:3}: __lock_acquire+0x15a8/0x2084 lock_acquire+0x1cc/0x350 rt_spin_lock+0x50/0x1f0 macb_start_xmit+0x808/0xb7c dev_hard_start_xmit+0x94/0x284 sch_direct_xmit+0x8c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 other info that might help us debug this: Chain exists of: &bp->lock --> _xmit_ETHER#2 --> &queue->tx_ptr_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&queue->tx_ptr_lock); lock(_xmit_ETHER#2); lock(&queue->tx_ptr_lock); lock(&bp->lock); *** DEADLOCK *** Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0xa0/0xf0 dump_stack+0x18/0x24 print_circular_bug+0x28c/0x370 check_noncircular+0x198/0x1ac __lock_acquire+0x15a8/0x2084 lock_acquire+0x1cc/0x350 rt_spin_lock+0x50/0x1f0 macb_start_xmit+0x808/0xb7c dev_hard_start_xmit+0x94/0x284 sch_direct_xmit+0x8c/0x37c __dev_queue_xmit+0x708/0x1120 neigh_resolve_output+0x148/0x28c ip6_finish_output2+0x2c0/0xb2c __ip6_finish_output+0x114/0x308 ip6_output+0xc4/0x4a4 mld_sendpack+0x220/0x68c mld_ifc_work+0x2a8/0x4f4 process_one_work+0x20c/0x5f8 worker_thread+0x1b0/0x35c kthread+0x144/0x200 ret_from_fork+0x10/0x20 Notably, invoking the mog_init_rings() callback upon link establishment is unnecessary. Instead, we can exclusively call mog_init_rings() within the ndo_open() callback. This adjustment resolves the deadlock issue. Furthermore, since MACB_CAPS_MACB_IS_EMAC cases do not use mog_init_rings() when opening the network interface via at91ether_open(), moving mog_init_rings() to macb_open() also eliminates the MACB_CAPS_MACB_IS_EMAC check. Fixes: 633e98a711ac ("net: macb: use resolved link config in mac_link_up()") Cc: stable@vger.kernel.org Suggested-by: Kevin Hao Signed-off-by: Xiaolei Wang Link: https://patch.msgid.link/20251222015624.1994551-1-xiaolei.wang@windriver.com Signed-off-by: Paolo Abeni commit 3be42c3b3d4343f548d28fdcb509869db70dc121 Author: Vadim Fedorenko Date: Sun Dec 21 19:26:39 2025 +0000 selftests: fib_test: Add test case for ipv4 multi nexthops The test checks that with multi nexthops route the preferred route is the one which matches source ip. In case when source ip is on dummy interface, it checks that the routes are balanced. Reviewed-by: Willem de Bruijn Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251221192639.3911901-2-vadim.fedorenko@linux.dev Signed-off-by: Paolo Abeni commit 6e17474aa9fe15015c9921a5081c7ca71783aac6 Author: Vadim Fedorenko Date: Sun Dec 21 19:26:38 2025 +0000 net: fib: restore ECMP balance from loopback Preference of nexthop with source address broke ECMP for packets with source addresses which are not in the broadcast domain, but rather added to loopback/dummy interfaces. Original behaviour was to balance over nexthops while now it uses the latest nexthop from the group. To fix the issue introduce next hop scoring system where next hops with source address equal to requested will always have higher priority. For the case with 198.51.100.1/32 assigned to dummy0 and routed using 192.0.2.0/24 and 203.0.113.0/24 networks: 2: dummy0: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether d6:54:8a:ff:78:f5 brd ff:ff:ff:ff:ff:ff inet 198.51.100.1/32 scope global dummy0 valid_lft forever preferred_lft forever 7: veth1@if6: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 06:ed:98:87:6d:8a brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 192.0.2.2/24 scope global veth1 valid_lft forever preferred_lft forever inet6 fe80::4ed:98ff:fe87:6d8a/64 scope link proto kernel_ll valid_lft forever preferred_lft forever 9: veth3@if8: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether ae:75:23:38:a0:d2 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 203.0.113.2/24 scope global veth3 valid_lft forever preferred_lft forever inet6 fe80::ac75:23ff:fe38:a0d2/64 scope link proto kernel_ll valid_lft forever preferred_lft forever ~ ip ro list: default nexthop via 192.0.2.1 dev veth1 weight 1 nexthop via 203.0.113.1 dev veth3 weight 1 192.0.2.0/24 dev veth1 proto kernel scope link src 192.0.2.2 203.0.113.0/24 dev veth3 proto kernel scope link src 203.0.113.2 before: for i in {1..255} ; do ip ro get 10.0.0.$i; done | grep veth | awk ' {print $(NF-2)}' | sort | uniq -c: 255 veth3 after: for i in {1..255} ; do ip ro get 10.0.0.$i; done | grep veth | awk ' {print $(NF-2)}' | sort | uniq -c: 122 veth1 133 veth3 Fixes: 32607a332cfe ("ipv4: prefer multipath nexthop that matches source address") Signed-off-by: Vadim Fedorenko Reviewed-by: Ido Schimmel Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251221192639.3911901-1-vadim.fedorenko@linux.dev Signed-off-by: Paolo Abeni commit 44741e9de29bff4911b045b961393c5d837f51ae Author: Ido Schimmel Date: Sun Dec 21 16:48:29 2025 +0200 selftests: fib_nexthops: Add test cases for error routes deletion Add test cases that check that error routes (e.g., blackhole) are deleted when their nexthop is deleted. Output without "ipv4: Fix reference count leak when using error routes with nexthop objects": # ./fib_nexthops.sh -t "ipv4_fcnal ipv6_fcnal" IPv4 functional ---------------------- [...] WARNING: Unexpected route entry TEST: Error route removed on nexthop deletion [FAIL] IPv6 ---------------------- [...] TEST: Error route removed on nexthop deletion [ OK ] Tests passed: 20 Tests failed: 1 Tests skipped: 0 Output with "ipv4: Fix reference count leak when using error routes with nexthop objects": # ./fib_nexthops.sh -t "ipv4_fcnal ipv6_fcnal" IPv4 functional ---------------------- [...] TEST: Error route removed on nexthop deletion [ OK ] IPv6 ---------------------- [...] TEST: Error route removed on nexthop deletion [ OK ] Tests passed: 21 Tests failed: 0 Tests skipped: 0 Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20251221144829.197694-2-idosch@nvidia.com Signed-off-by: Paolo Abeni commit ac782f4e3bfcde145b8a7f8af31d9422d94d172a Author: Ido Schimmel Date: Sun Dec 21 16:48:28 2025 +0200 ipv4: Fix reference count leak when using error routes with nexthop objects When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop. The current logic in fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their nexthop object is deleted: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 # ip route show blackhole 198.51.100.2 nhid 1 dev dummy1 As such, they keep holding a reference on the nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak: # ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2 Fix by flushing error routes when their nexthop is marked as dead. IPv6 does not suffer from this problem. Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects") Reported-by: Tetsuo Handa Closes: https://lore.kernel.org/netdev/d943f806-4da6-4970-ac28-b9373b0e63ac@I-love.SAKURA.ne.jp/ Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20251221144829.197694-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit fa0b198be1c6775bc7804731a43be5d899d19e7a Author: Ethan Nelson-Moore Date: Sun Dec 21 00:24:00 2025 -0800 net: usb: sr9700: fix incorrect command used to write single register This fixes the device failing to initialize with "error reading MAC address" for me, probably because the incorrect write of NCR_RST to SR_NCR is not actually resetting the device. Fixes: c9b37458e95629b1d1171457afdcc1bf1eb7881d ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") Cc: stable@vger.kernel.org Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20251221082400.50688-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni commit 3c68cf68233e556e0102f45b69f7448908dc1f44 Author: Li Zhijian Date: Fri Dec 26 17:41:12 2025 +0800 IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path rxe_odp_map_range_and_lock() must release umem_odp->umem_mutex when an error occurs, including cases where rxe_check_pagefault() fails. Fixes: 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP") Signed-off-by: Li Zhijian Link: https://patch.msgid.link/20251226094112.3042583-1-lizhijian@fujitsu.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 89e87d0dc87eb3654c9ae01afc4a18c1c6d1e523 Author: Alexander Stein Date: Tue Dec 16 14:15:28 2025 +0100 arm64: dts: mba8mx: Fix Ethernet PHY IRQ support Ethernet PHY interrupt mode is level triggered. Adjust the mode accordingly. Signed-off-by: Alexander Stein Reviewed-by: Andrew Lunn Fixes: 70cf622bb16e ("arm64: dts: mba8mx: Add Ethernet PHY IRQ support") Signed-off-by: Shawn Guo commit a988caeed9d918452aa0a68de2c6e94d86aa43ba Author: Sherry Sun Date: Wed Dec 3 09:59:56 2025 +0800 arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart The commit 616effc0272b5 ("arm64: dts: imx8: Fix lpuart DMA channel order") swap uart rx and tx channel at common imx8-ss-dma.dtsi. But miss update imx8qm-ss-dma.dtsi. The commit 5a8e9b022e569 ("arm64: dts: imx8qm-ss-dma: Pass lpuart dma-names") just simple add dma-names as binding doc requirement. Correct lpuart0 - lpuart3 dma rx and tx channels, and use defines for the FSL_EDMA_RX flag. Fixes: 5a8e9b022e56 ("arm64: dts: imx8qm-ss-dma: Pass lpuart dma-names") Signed-off-by: Sherry Sun Reviewed-by: Frank Li Reviewed-by: Alexander Stein Signed-off-by: Shawn Guo commit c63749a7ddc59ac6ec0b05abfa0a21af9f2c1d38 Author: Marek Vasut Date: Tue Dec 2 14:41:51 2025 +0100 arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link bouncing caused by interruptions on the PHY reference clock, by letting the PHY driver manage the reference clock and assure there are no interruptions. This follows the matching PHY driver recommendation described in commit bedd8d78aba3 ("net: phy: smsc: LAN8710/20: add phy refclk in support") Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") Signed-off-by: Marek Vasut Tested-by: Christoph Niedermaier Signed-off-by: Shawn Guo commit cdf4e631eec5ddd49bb625df9fb144d6ecdd6f15 Author: Maud Spierings Date: Mon Dec 1 12:56:52 2025 +0100 arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells On this SoM eqos is the primary ethernet interface, Ka-Ro fuses the address for it in eth_mac1, eth_mac2 seems to be left unfused. In their downstream u-boot they fetch it from eth_mac1 [1][2], by setting alias of eqos to ethernet0, the driver then fetches the mac address based on the alias number. Set eqos to read from eth_mac1 instead of eth_mac2. Also set fec to point at eth_mac2 as it may be fused later even though it is disabled by default. With this changed barebox is now capable of loading the correct address. Link: https://github.com/karo-electronics/karo-tx-uboot/blob/380543278410bbf04264d80a3bfbe340b8e62439/drivers/net/dwc_eth_qos.c#L1167 [1] Link: https://github.com/karo-electronics/karo-tx-uboot/blob/380543278410bbf04264d80a3bfbe340b8e62439/arch/arm/dts/imx8mp-karo.dtsi#L12 [2] Fixes: bac63d7c5f46 ("arm64: dts: freescale: add Ka-Ro Electronics tx8p-ml81 COM") Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 056c68875122dd342782e5956ed145fe9e059614 Author: Maud Spierings Date: Mon Dec 1 12:56:51 2025 +0100 arm64: dts: freescale: moduline-display: fix compatible The compatibles should include the SoM compatible, this board is based on the Ka-Ro TX8P-ML81 SoM, so add it to allow using shared code in the bootloader which uses upstream Linux devicetrees as a base. Also add the hardware revision to the board compatible to handle revision specific quirks in the bootloader/userspace. This is a breaking change, but it is early enough that it can be corrected without causing any issues. Fixes: 03f07be54cdc ("arm64: dts: freescale: Add the GOcontroll Moduline Display baseboard") Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 1815b16d02ae471b80d7f88c8c62d3b02c18f42a Author: Maud Spierings Date: Mon Dec 1 12:56:50 2025 +0100 dt-bindings: arm: fsl: moduline-display: fix compatible The compatibles should include the SoM compatible, this board is based on the Ka-Ro TX8P-ML81 SoM, so add it to allow using shared code in the bootloader which uses upstream Linux devicetrees as a base. Also add the hardware revision to the board compatible to handle revision specific quirks in the bootloader/userspace. This is a breaking change, but it is early enough that it can be corrected without causing any issues. Fixes: 24e67d28ef95 ("dt-bindings: arm: fsl: Add GOcontroll Moduline Display") Signed-off-by: Maud Spierings Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 Author: Ian Ray Date: Mon Dec 1 11:56:05 2025 +0200 ARM: dts: imx6q-ba16: fix RTC interrupt level RTC interrupt level should be set to "LOW". This was revealed by the introduction of commit: f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode") which changed the way IRQ type is obtained. Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module") Signed-off-by: Ian Ray Signed-off-by: Shawn Guo commit f416c556997aa56ec4384c6b6efd6a0e6ac70aa7 Author: ZhangGuoDong Date: Mon Dec 29 11:15:18 2025 +0800 smb/server: fix refcount leak in smb2_open() When ksmbd_vfs_getattr() fails, the reference count of ksmbd_file must be released. Suggested-by: Namjae Jeon Signed-off-by: ZhangGuoDong Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3296c3012a9d9a27e81e34910384e55a6ff3cff0 Author: ZhangGuoDong Date: Mon Dec 29 10:13:29 2025 +0800 smb/server: fix refcount leak in parse_durable_handle_context() When the command is a replay operation and -ENOEXEC is returned, the refcount of ksmbd_file must be released. Signed-off-by: ZhangGuoDong Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7c28f8eef5ac5312794d8a52918076dcd787e53b Author: ZhangGuoDong Date: Sun Dec 28 22:51:01 2025 +0800 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close(). Signed-off-by: ZhangGuoDong Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0c56693b06a68476ba113db6347e7897475f9e4c Author: Zilin Guan Date: Wed Dec 24 14:20:16 2025 +0000 ksmbd: Fix memory leak in get_file_all_info() In get_file_all_info(), if vfs_getattr() fails, the function returns immediately without freeing the allocated filename, leading to a memory leak. Fix this by freeing the filename before returning in this error case. Fixes: 5614c8c487f6a ("ksmbd: replace generic_fillattr with vfs_getattr") Signed-off-by: Zilin Guan Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4f4f6b4467e63317ec3fd0a5b7405757ad55c169 Author: Saravana Kannan Date: Sun Dec 28 22:03:49 2025 -0800 MAINTAINERS: Update Saravana Kannan's email address I've switched employers. Updating email address to be employer-agnostic and remain reachable. Also updating mailmap so all my previous emails map to this new one. Signed-off-by: Saravana Kannan Link: https://patch.msgid.link/20251229060350.852-1-saravanak@kernel.org Signed-off-by: Rob Herring (Arm) commit 8640b74557fc8b4c300030f6ccb8cd078f665ec8 Merge: 0b34fd0feac620 1f4ea4838b13c3 Author: Linus Torvalds Date: Mon Dec 29 12:06:44 2025 -0800 Merge tag 'kbuild-fixes-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nicolas Schier: - Revert commit "scripts/clang-tools: Handle included .c files in gen_compile_commands" which is reported to cause false entries for some files. - Fix compilation of dtb specified on command-line without make rule - mcb: Add missing modpost build support * tag 'kbuild-fixes-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: mcb: Add missing modpost build support kbuild: fix compilation of dtb specified on command-line without make rule Revert "scripts/clang-tools: Handle included .c files in gen_compile_commands" commit 0b34fd0feac6202602591dc15c58e25ffde41bd5 Merge: 7839932417dd53 d6b5a8d6f142ad Author: Linus Torvalds Date: Mon Dec 29 11:40:38 2025 -0800 Merge tag 'mm-hotfixes-stable-2025-12-28-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "27 hotfixes. 12 are cc:stable, 18 are MM. There's a patch series from Jiayuan Chen which fixes some issues with KASAN and vmalloc. Apart from that it's the usual shower of singletons - please see the respective changelogs for details" * tag 'mm-hotfixes-stable-2025-12-28-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (27 commits) mm/ksm: fix pte_unmap_unlock of wrong address in break_ksm_pmd_entry mm/page_owner: fix memory leak in page_owner_stack_fops->release() mm/memremap: fix spurious large folio warning for FS-DAX MAINTAINERS: notify the "Device Memory" community of memory hotplug changes sparse: update MAINTAINERS info mm/page_alloc: report 1 as zone_batchsize for !CONFIG_MMU mm: consider non-anon swap cache folios in folio_expected_ref_count() rust: maple_tree: rcu_read_lock() in destructor to silence lockdep mm: memcg: fix unit conversion for K() macro in OOM log mm: fixup pfnmap memory failure handling to use pgoff tools/mm/page_owner_sort: fix timestamp comparison for stable sorting selftests/mm: fix thread state check in uffd-unit-tests kernel/kexec: fix IMA when allocation happens in CMA area kernel/kexec: change the prototype of kimage_map_segment() MAINTAINERS: add ABI headers to KHO and LIVE UPDATE .mailmap: remove one of the entries for WangYuli mm/damon/vaddr: fix missing pte_unmap_unlock in damos_va_migrate_pmd_entry() MAINTAINERS: update one straggling entry for Bartosz Golaszewski mm/page_alloc: change all pageblocks migrate type on coalescing mm: leafops.h: correct kernel-doc function param. names ... commit 150b1b97e27513535dcd3795d5ecd28e61b6cb8c Author: Rong Zhang Date: Tue Dec 30 02:22:21 2025 +0800 x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo Zen5 also contains family 1Ah, models 70h-7Fh, which are mistakenly missing from cpu_has_entrysign(). Add the missing range. Fixes: 8a9fb5129e8e ("x86/microcode/AMD: Limit Entrysign signature checking to known generations") Signed-off-by: Rong Zhang Signed-off-by: Borislav Petkov (AMD) Cc: stable@kernel.org Link: https://patch.msgid.link/20251229182245.152747-1-i@rong.moe commit 58fc7342b529803d3c221101102fe913df7adb83 Author: Will Rosenberg Date: Fri Dec 19 10:36:37 2025 -0700 ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of the calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb) + len_delta) < 0). The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a negative value for nhead. Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom. PoC: Using `netlabelctl` tool: netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map add default address:0::1/128 protocol:calipso,7 Then run the following PoC: int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); // setup msghdr int cmsg_size = 2; int cmsg_len = 0x60; struct msghdr msg; struct sockaddr_in6 dest_addr; struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); msg.msg_name = &dest_addr; msg.msg_namelen = sizeof(dest_addr); msg.msg_iov = NULL; msg.msg_iovlen = 0; msg.msg_control = cmsg; msg.msg_controllen = cmsg_len; msg.msg_flags = 0; // setup sockaddr dest_addr.sin6_family = AF_INET6; dest_addr.sin6_port = htons(31337); dest_addr.sin6_flowinfo = htonl(31337); dest_addr.sin6_addr = in6addr_loopback; dest_addr.sin6_scope_id = 31337; // setup cmsghdr cmsg->cmsg_len = cmsg_len; cmsg->cmsg_level = IPPROTO_IPV6; cmsg->cmsg_type = IPV6_HOPOPTS; char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 sendmsg(fd, &msg, 0); Fixes: 2917f57b6bc1 ("calipso: Allow the lsm to label the skbuff directly.") Suggested-by: Paul Moore Signed-off-by: Will Rosenberg Acked-by: Paul Moore Link: https://patch.msgid.link/20251219173637.797418-1-whrosenb@asu.edu Signed-off-by: Paolo Abeni commit e34f0df3d81ad4ae7819f14f7a9dcd2efcfbe8c1 Author: Eric Dumazet Date: Fri Dec 19 14:44:59 2025 +0000 usbnet: avoid a possible crash in dql_completed() syzbot reported a crash [1] in dql_completed() after recent usbnet BQL adoption. The reason for the crash is that netdev_reset_queue() is called too soon. It should be called after cancel_work_sync(&dev->bh_work) to make sure no more TX completion can happen. [1] kernel BUG at lib/dynamic_queue_limits.c:99 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 5197 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:dql_completed+0xbe1/0xbf0 lib/dynamic_queue_limits.c:99 Call Trace: netdev_tx_completed_queue include/linux/netdevice.h:3864 [inline] netdev_completed_queue include/linux/netdevice.h:3894 [inline] usbnet_bh+0x793/0x1020 drivers/net/usb/usbnet.c:1601 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 bh_worker+0x2b1/0x600 kernel/workqueue.c:3611 tasklet_action+0xc/0x70 kernel/softirq.c:952 handle_softirqs+0x27d/0x850 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 Fixes: 7ff14c52049e ("usbnet: Add support for Byte Queue Limits (BQL)") Reported-by: syzbot+5b55e49f8bbd84631a9c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6945644f.a70a0220.207337.0113.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Simon Schippers Link: https://patch.msgid.link/20251219144459.692715-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 3d970eda003441f66551a91fda16478ac0711617 Author: Ankit Garg Date: Fri Dec 19 10:29:45 2025 +0000 gve: defer interrupt enabling until NAPI registration Currently, interrupts are automatically enabled immediately upon request. This allows interrupt to fire before the associated NAPI context is fully initialized and cause failures like below: [ 0.946369] Call Trace: [ 0.946369] [ 0.946369] __napi_poll+0x2a/0x1e0 [ 0.946369] net_rx_action+0x2f9/0x3f0 [ 0.946369] handle_softirqs+0xd6/0x2c0 [ 0.946369] ? handle_edge_irq+0xc1/0x1b0 [ 0.946369] __irq_exit_rcu+0xc3/0xe0 [ 0.946369] common_interrupt+0x81/0xa0 [ 0.946369] [ 0.946369] [ 0.946369] asm_common_interrupt+0x22/0x40 [ 0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10 Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto enablement and explicitly enable the interrupt in NAPI initialization path (and disable it during NAPI teardown). This ensures that interrupt lifecycle is strictly coupled with readiness of NAPI context. Cc: stable@vger.kernel.org Fixes: 1dfc2e46117e ("gve: Refactor napi add and remove functions") Signed-off-by: Ankit Garg Reviewed-by: Jordan Rhee Reviewed-by: Joshua Washington Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20251219102945.2193617-1-hramamurthy@google.com Signed-off-by: Paolo Abeni commit a48e232210009be50591fdea8ba7c07b0f566a13 Author: Wei Fang Date: Thu Dec 4 15:13:32 2025 +0800 net: stmmac: fix the crash issue for zero copy XDP_TX action There is a crash issue when running zero copy XDP_TX action, the crash log is shown below. [ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000 [ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP [ 216.301694] Call trace: [ 216.304130] dcache_clean_poc+0x20/0x38 (P) [ 216.308308] __dma_sync_single_for_device+0x1bc/0x1e0 [ 216.313351] stmmac_xdp_xmit_xdpf+0x354/0x400 [ 216.317701] __stmmac_xdp_run_prog+0x164/0x368 [ 216.322139] stmmac_napi_poll_rxtx+0xba8/0xf00 [ 216.326576] __napi_poll+0x40/0x218 [ 216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt For XDP_TX action, the xdp_buff is converted to xdp_frame by xdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame depends on the memory type of the xdp_buff. For page pool based xdp_buff it produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy XSK pool based xdp_buff it produces xdp_frame with memory type MEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the memory type and always uses the page pool type, this leads to invalid mappings and causes the crash. Therefore, check the xdp_buff memory type in stmmac_xdp_xmit_back() to fix this issue. Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") Signed-off-by: Wei Fang Reviewed-by: Hariprasad Kelam Link: https://patch.msgid.link/20251204071332.1907111-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit a6694b7e39b34757c045c4dc499fb2b8a635bce0 Merge: 85f4b0c650d9f9 81d90d93d22ca4 Author: Paolo Abeni Date: Mon Dec 29 17:04:00 2025 +0100 Merge tag 'wireless-2025-12-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Various fixes all over, most are recent regressions but also some long-standing issues: - cfg80211: - fix an issue with overly long SSIDs - mac80211: - long-standing beacon protection issue on some devices - for for a multi-BSSID AP-side issue - fix a syzbot warning on OCB (not really used in practice) - remove WARN on connections using disabled channels, as that can happen due to changes in the disable flag - fix monitor mode list iteration - iwlwifi: - fix firmware loading on certain (really old) devices - add settime64 to PTP clock to avoid a warning and clock registration failure, but it's not actually supported - rtw88: - remove WQ_UNBOUND since it broke USB adapters (because it can't be used with WQ_BH) - fix SDIO issues with certain devices - rtl8192cu: fix TID array out-of-bounds (since 6.9) - wlcore (TI): add missing skb push headroom increase * tag 'wireless-2025-12-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP wifi: iwlwifi: Fix firmware version handling wifi: mac80211: ocb: skip rx_no_sta when interface is not joined wifi: mac80211: do not use old MBSSID elements wifi: mac80211: don't WARN for connections on invalid channels wifi: wlcore: ensure skb headroom before skb_push wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor() wifi: mac80211: Discard Beacon frames to non-broadcast address Revert "wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users" wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() wifi: rtw88: limit indirect IO under powered off for RTL8822CS ==================== Link: https://patch.msgid.link/20251217201441.59876-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit 85f4b0c650d9f9db10bda8d3acfa1af83bf78cf7 Author: Anshumali Gaur Date: Fri Dec 19 11:52:26 2025 +0530 octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" This patch ensures that the RX ring size (rx_pending) is not set below the permitted length. This avoids UBSAN shift-out-of-bounds errors when users passes small or zero ring sizes via ethtool -G. Fixes: d45d8979840d ("octeontx2-pf: Add basic ethtool support") Signed-off-by: Anshumali Gaur Link: https://patch.msgid.link/20251219062226.524844-1-agaur@marvell.com Signed-off-by: Paolo Abeni commit 6a02651c4c4b710ecbaf798eb4feb57c97f2bc14 Author: Denis Benato Date: Mon Dec 29 16:07:55 2025 +0100 platform/x86: asus-armoury: fix ppt data for FA507R PPT data for FA507R was reported to be wrong by a user: change limits to make them equal to Armoury Crate limits. Fixes: 39ae6c50e599 ("platform/x86: asus-armoury: add ppt_* and nv_* tuning knobs") Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251229150755.1351495-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 66e245db16f0175af656cd812b6dc1a5e1f7b80a Author: Alok Tiwari Date: Wed Dec 24 01:51:09 2025 -0800 platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe The PMT feature probe creates a child device with device_create(). If device creation fail, the code pass priv->dev (which is an ERR_PTR) to dev_err_probe(), which is not a valid device pointer. This patch change the dev_err_probe() call to use the parent auxiliary device (&auxdev->dev) and update the error message to reference the parent device name. It ensure correct error reporting and avoid passing an invalid device pointer. Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20251224095133.115678-1-alok.a.tiwari@oracle.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ef4536f15224418b327a7b5d5cae07dab042760f Author: Tingmao Wang Date: Sun Dec 28 01:27:35 2025 +0000 landlock: Improve the comment for domain_is_scoped Currently it is not obvious what "scoped" mean, and the fact that the function returns true when access should be denied is slightly surprising and in need of documentation. Cc: Tahera Fahimi Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/06393bc18aee5bc278df5ef31c64a05b742ebc10.1766885035.git.m@maowtm.org [mic: Fix formatting and improve consistency] Signed-off-by: Mickaël Salaün commit 55dc93a7c2717311d48ca0a47c5f8c1b0755a115 Author: Tingmao Wang Date: Sun Dec 28 01:27:34 2025 +0000 selftests/landlock: Use scoped_base_variants.h for ptrace_test ptrace_test.c currently contains a duplicated version of the scoped_domains fixture variants. This patch removes that and make it use the shared scoped_base_variants.h instead, like in scoped_abstract_unix_test and scoped_signal_test. This required renaming the hierarchy fixture to scoped_domains, but the test is otherwise the same. Cc: Tahera Fahimi Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/48148f0134f95f819a25277486a875a6fd88ecf9.1766885035.git.m@maowtm.org Signed-off-by: Mickaël Salaün commit 7aa593d8fb64b884bf00c13e01387b0733f3d786 Author: Tingmao Wang Date: Sun Dec 28 01:27:32 2025 +0000 selftests/landlock: Fix missing semicolon Add missing semicolon after EXPECT_EQ(0, close(stream_server_child)) in the scoped_vs_unscoped test. I suspect currently it's just not executing the close statement after the line, but this causes no observable difference. Fixes: fefcf0f7cf47 ("selftests/landlock: Test abstract UNIX socket scoping") Cc: Tahera Fahimi Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/d9e968e4cd4ecc9bf487593d7b7220bffbb3b5f5.1766885035.git.m@maowtm.org Signed-off-by: Mickaël Salaün commit 14c00e30d3a29a7fb6053fcaa54aeb6c07fb1055 Author: Tingmao Wang Date: Sun Dec 28 01:27:31 2025 +0000 selftests/landlock: Fix typo in fs_test Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/62d18e06eeb26f62bc49d24c4467b3793c5ba32b.1766885035.git.m@maowtm.org Signed-off-by: Mickaël Salaün commit 602acfb541195eb35584d7a3fc7d1db676f059bd Author: Mickaël Salaün Date: Fri Dec 19 15:22:59 2025 +0100 landlock: Optimize stack usage when !CONFIG_AUDIT Until now, each landlock_request struct were allocated on the stack, even if not really used, because is_access_to_paths_allowed() unconditionally modified the passed references. Even if the changed landlock_request variables are not used, the compiler is not smart enough to detect this case. To avoid this issue, explicitly disable the related code when CONFIG_AUDIT is not set, which enables elision of log_request_parent* and associated caller's stack variables thanks to dead code elimination. This makes it possible to reduce the stack frame by 32 bytes for the path_link and path_rename hooks, and by 20 bytes for most other filesystem hooks. Here is a summary of scripts/stackdelta before and after this change when CONFIG_AUDIT is disabled: current_check_refer_path 560 320 -240 current_check_access_path 328 184 -144 hook_file_open 328 184 -144 is_access_to_paths_allowed 376 360 -16 Also, add extra pointer checks to be more future-proof. Cc: Günther Noack Reported-by: Tingmao Wang Closes: https://lore.kernel.org/r/eb86863b-53b0-460b-b223-84dd31d765b9@maowtm.org Fixes: 2fc80c69df82 ("landlock: Log file-related denials") Link: https://lore.kernel.org/r/20251219142302.744917-2-mic@digikod.net Reviewed-by: Günther Noack [mic: Improve stack usage measurement accuracy with scripts/stackdelta] Signed-off-by: Mickaël Salaün commit e44c42c830b7ab36e3a3a86321c619f24def5206 Author: Junrui Luo Date: Fri Dec 26 19:42:05 2025 +0800 platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities. These functions parse ACPI packages into internal data structures using a for loop with index variable 'elem' that iterates through enum_obj/integer_obj/order_obj/password_obj/string_obj arrays. When processing multi-element fields like PREREQUISITES and ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array elements using expressions like 'enum_obj[elem + reqs]' and 'enum_obj[elem + pos_values]' within nested loops. The bug is that the bounds check only validated elem, but did not consider the additional offset when accessing elem + reqs or elem + pos_values. The fix changes the bounds check to validate the actual accessed index. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes") Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 15599306fb6c38c834fa0266bf71557c9be4fb12 Author: Vitor Soares Date: Fri Nov 28 15:00:28 2025 +0000 arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position Fix the SMARC_SDIO_WP gpio-line-name position. It should be on line 15 of som_gpio_expander_1, not line 17. Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95") Signed-off-by: Vitor Soares Signed-off-by: Shawn Guo commit 466798368e51d0a8fb9628730399957ec2281824 Author: Vitor Soares Date: Fri Nov 28 15:00:27 2025 +0000 arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt Change the PHY interrupt trigger type from IRQ_TYPE_LEVEL_LOW to IRQ_TYPE_EDGE_FALLING to match the PCA9745 GPIO expander hardware capabilities and avoid emulated level detection. Fixes: 90bbe88e0ea6 ("arm64: dts: freescale: add Toradex SMARC iMX95") Signed-off-by: Vitor Soares Signed-off-by: Shawn Guo commit 3691fd19ccad4c1c0e3fc4888ef36edaa6e571be Author: Yilin Chen <1479826151@qq.com> Date: Mon Dec 29 00:53:44 2025 +0800 rust: device_id: replace incorrect word in safety documentation The safety documentation incorrectly refers to `RawDeviceId` when transmuting to `RawType`. This fixes the documentation to correctly indicate that implementers must ensure layout compatibility with `RawType`, not `RawDeviceId`. Fixes: 9b90864bb42b ("rust: implement `IdArray`, `IdTable` and `RawDeviceId`") Signed-off-by: Yilin Chen <1479826151@qq.com> Link: https://patch.msgid.link/tencent_C18DD5047749311142ED455779C7CCCF3A08@qq.com Signed-off-by: Danilo Krummrich commit 499d987b65c03bacf3c17f32c2ad1408b751c708 Author: Denis Benato Date: Thu Dec 25 04:10:41 2025 +0100 platform/x86: asus-armoury: add support for G615LR Add TDP data for laptop model G615LR. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251225031041.2321249-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a22d893f490d9cd517dbf02549701add2318594c Author: Denis Benato Date: Thu Dec 25 04:03:54 2025 +0100 platform/x86: asus-armoury: add support for FA608UM Add TDP data for laptop model FA608UM. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251225030354.2315874-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a05117150256dd0787f4e6d56b577b41488f28a4 Author: Denis Benato Date: Thu Dec 25 03:53:01 2025 +0100 platform/x86: asus-armoury: add support for GA403WR Add TDP data for laptop model GA403WR. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251225025301.1980627-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 063185ba32747f69159777c66097cd8f428e8b7a Author: Denis Benato Date: Thu Dec 25 03:38:41 2025 +0100 platform/x86: asus-armoury: add support for GU605CR Add TDP data for laptop model GU605CR. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251225023841.1970513-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cbf3dc32609b9703b87fbd444c271821664478c6 Author: Tomáš Hnyk Date: Fri Dec 26 21:34:54 2025 +0100 platform/x86: ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT As per Lenovo documentation, Fn+Print-Screen should "Open the Snipping tool" which corresponds to KEY_SELECTIVE_SCREENSHOT (keycode 0x27a). It is currently assigned to KEY_CUT because keycodes under 248 were preferred due to X11 limitations. Reassign Fn+Print-Screen from KEY_CUT to KEY_SELECTIVE_SCREENSHOT. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220566 Signed-off-by: Tomáš Hnyk Link: https://patch.msgid.link/20251226203454.405520-1-tomashnyk@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 68ece1e2ce3a1cb0aac9f5af685cf18fa2fa31aa Author: Yilin Chen <1479826151@qq.com> Date: Mon Dec 29 00:52:34 2025 +0800 rust: dma: remove incorrect safety documentation Removes a safety requirement that incorrectly states callers must ensure the device does not access memory while the returned slice is live, as this method doesn't return a slice. Fixes: d37a39f607c4 ("rust: dma: add as_slice/write functions for CoherentAllocation") Signed-off-by: Yilin Chen <1479826151@qq.com> Link: https://patch.msgid.link/tencent_5195C0324923A2B67DEF8AE4B8E139BCB105@qq.com Signed-off-by: Danilo Krummrich commit 2f4ca87469b9499eb9218cf2a374018cfee6b649 Author: Matthew Maurer Date: Fri Dec 26 20:17:08 2025 +0000 docs: ABI: sysfs-devices-soc: Fix swapped sample values The sample values for `family` and `machine` were swapped relative to what the driver actually does, and doesn't match the field description. Fixes: da5a70f3519f ("Documentation: add information for new sysfs soc bus functionality") Reviewed-by: Lee Jones Signed-off-by: Matthew Maurer Link: https://patch.msgid.link/20251226-soc-bindings-v4-2-2c2fac08f820@google.com Signed-off-by: Danilo Krummrich commit d37cd54ebeac37a763fbf303ed25f8a6e98328ff Author: Armin Wolf Date: Sun Dec 28 22:41:31 2025 +0100 platform/x86: samsung-galaxybook: Fix problematic pointer cast A user reported that reading the charge threshold on his device results in very strange values (like 78497792) being returned. The reason for this seems to be the fact that the driver casts the int pointer to an u8 pointer, leaving the last 3 bytes of the destination uninitialized. Fix this by using a temporary variable instead. Cc: stable@vger.kernel.org Fixes: 56f529ce4370 ("platform/x86: samsung-galaxybook: Add samsung-galaxybook driver") Reported-by: Gianni Ceccarelli Closes: https://lore.kernel.org/platform-driver-x86/20251228115556.14362d66@thenautilus.net/ Tested-by: Gianni Ceccarelli Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251228214217.35972-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 73cb5f6eafb0ac7aea8cdeb8ff12981aa741d8fb Author: Wentao Liang Date: Thu Dec 11 04:02:52 2025 +0000 pmdomain: imx: Fix reference count leak in imx_gpc_probe() of_get_child_by_name() returns a node pointer with refcount incremented. Use the __free() attribute to manage the pgc_node reference, ensuring automatic of_node_put() cleanup when pgc_node goes out of scope. This eliminates the need for explicit error handling paths and avoids reference count leaks. Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Frank Li Signed-off-by: Ulf Hansson commit 305f254727bd379bbed0385afa0162f5bde1f51c Author: Macpaul Lin Date: Fri Nov 28 12:17:22 2025 +0800 pmdomain: mtk-pm-domains: Fix spinlock recursion fix in probe Remove scpsys_get_legacy_regmap(), replacing its usage with of_find_node_with_property(). Explicitly call of_node_get(np) before each of_find_node_with_property() to maintain correct node reference counting. The of_find_node_with_property() function "consumes" its input by calling of_node_put() internally, whether or not it finds a match. Currently, dev->of_node (np) is passed multiple times in sequence without incrementing its reference count, causing it to be decremented multiple times and risking early memory release. Adding of_node_get(np) before each call balances the reference count, preventing premature node release. Fixes: c1bac49fe91f ("pmdomains: mtk-pm-domains: Fix spinlock recursion in probe") Cc: stable@vger.kernel.org Signed-off-by: Macpaul Lin Tested-by: Louis-Alexis Eyraud Signed-off-by: Ulf Hansson commit 361e0ff456a8daf9753c18030533256e4133ce7a Author: Alice Ryhl Date: Tue Dec 2 11:24:24 2025 +0000 rust_binder: remove spin_lock() in rust_shrink_free_page() When forward-porting Rust Binder to 6.18, I neglected to take commit fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") into account, and apparently I did not end up running the shrinker callback when I sanity tested the driver before submission. This leads to crashes like the following: ============================================ WARNING: possible recursive locking detected 6.18.0-mainline-maybe-dirty #1 Tainted: G IO -------------------------------------------- kswapd0/68 is trying to acquire lock: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230 but task is already holding lock: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&l->lock); lock(&l->lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by kswapd0/68: #0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160 #1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20 #2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230 To fix this, remove the spin_lock() call from rust_shrink_free_page(). Cc: stable Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20251202-binder-shrink-unspin-v1-1-263efb9ad625@google.com Signed-off-by: Greg Kroah-Hartman commit 420f423defcf6d0af2263d38da870ca4a20c0990 Author: Alexander Usyskin Date: Mon Dec 15 12:59:15 2025 +0200 mei: me: add nova lake point S DID Add Nova Lake S device id. Cc: stable Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20251215105915.1672659-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit bed2a6bd20681aacfb063015c1edfab6f58a333e Author: Jonathan Cavitt Date: Mon Dec 22 20:19:59 2025 +0000 drm/xe/guc: READ/WRITE_ONCE g2h_fence->done Use READ_ONCE and WRITE_ONCE when operating on g2h_fence->done to prevent the compiler from ignoring important modifications to its value. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Suggested-by: Matthew Brost Signed-off-by: Jonathan Cavitt Cc: Rodrigo Vivi Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251222201957.63245-5-jonathan.cavitt@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit b5179dbd1c14743ae80f0aaa28eaaf35c361608f) Signed-off-by: Thomas Hellström commit ca643894a37a25713029b36cfe7d1bae515cac08 Author: Haibo Chen Date: Wed Nov 19 11:22:40 2025 +0800 arm64: dts: add off-on-delay-us for usdhc2 regulator For SD card, according to the spec requirement, for sd card power reset operation, it need sd card supply voltage to be lower than 0.5v and keep over 1ms, otherwise, next time power back the sd card supply voltage to 3.3v, sd card can't support SD3.0 mode again. To match such requirement on imx8qm-mek board, add 4.8ms delay between sd power off and power on. Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support") Reviewed-by: Frank Li Signed-off-by: Haibo Chen Signed-off-by: Shawn Guo commit e0d8678c2f09dca22e6197321f223fa9a0ca2839 Author: Haibo Chen Date: Wed Nov 19 11:22:39 2025 +0800 arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level light sensor isl29023 share the interrupt with lsm303arg, but these two devices use different interrupt type. According to the datasheet of these two devides, both support low level trigger type, so correct the interrupt type here to avoid the following error log: irq: type mismatch, failed to map hwirq-11 for gpio@5d0c0000! Fixes: 9918092cbb0e ("arm64: dts: imx8qm-mek: add i2c0 and children devices") Fixes: 1d8a9f043a77 ("arm64: dts: imx8: use defines for interrupts") Signed-off-by: Haibo Chen Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 1a8e81a3bcd1995e86ae5d3b7801a5f3eba0dd04 Author: Rob Herring (Arm) Date: Tue Nov 18 15:35:50 2025 -0600 ARM: dts: nxp: imx: Fix mc13xxx LED node names Node names are supposed to be generic and use hexadecimal unit-addresses. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit cd0caaf2005547eaef8170356939aaabfcad4837 Author: Carlos Song Date: Tue Nov 18 14:28:54 2025 +0800 arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP I3C2 is in WAKEUP domain. Its pclk should be IMX95_CLK_BUSWAKEUP. Fixes: 969497ebefcf ("arm64: dts: imx95: Add i3c1 and i3c2") Signed-off-by: Carlos Song Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 7839932417dd53bb09eb5a585a7a92781dfd7cb2 Merge: bba0b6a1c4006f c9894e6f016041 Author: Linus Torvalds Date: Sun Dec 28 17:21:36 2025 -0800 Merge tag 'sched_ext-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix uninitialized @ret on alloc_percpu() failure leading to ERR_PTR(0) - Fix PREEMPT_RT warning when bypass load balancer sends IPI to offline CPU by using resched_cpu() instead of resched_curr() - Fix comment referring to renamed function - Update scx_show_state.py for scx_root and scx_aborting changes * tag 'sched_ext-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: tools/sched_ext: update scx_show_state.py for scx_aborting change tools/sched_ext: fix scx_show_state.py for scx_root change sched_ext: Use the resched_cpu() to replace resched_curr() in the bypass_lb_node() sched_ext: Fix some comments in ext.c sched_ext: fix uninitialized ret on alloc_percpu() failure commit bba0b6a1c4006f8cf8736c1eafc62640b31c498b Merge: a69eddfd171f55 aa7d3a56a20f07 Author: Linus Torvalds Date: Sun Dec 28 17:19:09 2025 -0800 Merge tag 'cgroup-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: - Fix a spurious cpuset warning when disabling remote partition after CPU hotplug leaves subpartitions_cpus empty. Guard the warning and invalidate affected partitions. * tag 'cgroup-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cpuset: fix warning when disabling remote partition commit a69eddfd171f5570f5c7b333e41f3dead26ce859 Merge: f8f9c1f4d0c7a6 b74fd80d7fe578 Author: Linus Torvalds Date: Sun Dec 28 16:55:16 2025 -0800 Merge tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: - Fix UAF in seqiv - Fix regression in hisilicon * tag 'v6.19-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num() crypto: seqiv - Do not use req->iv after crypto_aead_encrypt commit 961ac9d97be72267255f1ed841aabf6694b17454 Author: Harshita Bhilwaria Date: Wed Dec 17 11:16:06 2025 +0530 crypto: qat - fix duplicate restarting msg during AER error The restarting message from PF to VF is sent twice during AER error handling: once from adf_error_detected() and again from adf_disable_sriov(). This causes userspace subservices to shutdown unexpectedly when they receive a duplicate restarting message after already being restarted. Avoid calling adf_pf2vf_notify_restarting() and adf_pf2vf_wait_for_restarting_complete() from adf_error_detected() so that the restarting msg is sent only once from PF to VF. Fixes: 9567d3dc760931 ("crypto: qat - improve aer error reset handling") Signed-off-by: Harshita Bhilwaria Reviewed-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Reviewed-by: Ravikumar PM Reviewed-by: Srikanth Thokala Signed-off-by: Herbert Xu commit f8f9c1f4d0c7a64600e2ca312dec824a0bc2f1da Author: Linus Torvalds Date: Sun Dec 28 13:24:26 2025 -0800 Linux 6.19-rc3 commit acf44a2361b8d6356b71a970ab016065b5123b0e Author: Alper Ak Date: Thu Dec 25 18:13:49 2025 +0300 vfio/xe: Fix use-after-free in xe_vfio_pci_alloc_file() migf->filp is accessed after migf has been freed. Save the error value before calling kfree() to prevent use-after-free. Fixes: 1f5556ec8b9e ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Signed-off-by: Alper Ak Link: https://lore.kernel.org/r/20251225151349.360870-1-alperyasinak1@gmail.com Signed-off-by: Alex Williamson commit 665077d78dc7941ce6a330c02023a2b469cc8cc7 Author: Zilin Guan Date: Thu Dec 25 14:31:50 2025 +0000 vfio/pds: Fix memory leak in pds_vfio_dirty_enable() pds_vfio_dirty_enable() allocates memory for region_info. If interval_tree_iter_first() returns NULL, the function returns -EINVAL immediately without freeing the allocated memory, causing a memory leak. Fix this by jumping to the out_free_region_info label to ensure region_info is freed. Fixes: 2e7c6feb4ef52 ("vfio/pds: Add multi-region support") Signed-off-by: Zilin Guan Link: https://lore.kernel.org/r/20251225143150.1117366-1-zilin@seu.edu.cn Signed-off-by: Alex Williamson commit c875a6c3246713a018d8b7b143deb3ebaeecaf1c Merge: 15225b910cb805 22201800f198ad Author: Linus Torvalds Date: Sun Dec 28 10:21:47 2025 -0800 Merge tag 'usb-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes, and bunch of reverts for 6.19-rc3. Included in here are: - reverts of some typec ucsi driver changes that had a lot of regression reports after -rc1. Let's just revert it all for now and it will come back in a way that is better tested. - other typec bugfixes - usb-storage quirk fixups - dwc3 driver fix - other minor USB fixes for reported problems. All of these have passed 0-day testing and individual testing" * tag 'usb-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits) Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" Revert "usb: typec: ucsi: Add support for message out data structure" Revert "usb: typec: ucsi: Enable debugfs for message_out data structure" Revert "usb: typec: ucsi: Add support for SET_PDOS command" Revert "usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common" Revert "usb: typec: ucsi: Get connector status after enable notifications" usb: ohci-nxp: clean up probe error labels usb: gadget: lpc32xx_udc: clean up probe error labels usb: ohci-nxp: fix device leak on probe failure usb: phy: isp1301: fix non-OF device reference imbalance usb: gadget: lpc32xx_udc: fix clock imbalance in error path usb: typec: ucsi: Get connector status after enable notifications usb: usb-storage: Maintain minimal modifications to the bcdDevice range. usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common USB: lpc32xx_udc: Fix error handling in probe usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() usb: typec: ucsi: huawei-gaokin: add DRM dependency ... commit 15225b910cb8050636c11b4a607559169a7905ad Merge: 1c55bc8710a3ce 267ee93c417e68 Author: Linus Torvalds Date: Sun Dec 28 10:14:49 2025 -0800 Merge tag 'tty-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are some small serial driver fixes for some reported issues. Included in here are: - serial sysfs fwnode fix that was much reported - sh-sci driver fix - serial device init bugfix - 8250 bugfix - xilinx_uartps bugfix All of these have passed 0-day testing and individual testing" * tag 'tty-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: xilinx_uartps: fix rs485 delay_rts_after_send serial: sh-sci: Check that the DMA cookie is valid serial: core: Fix serial device initialization serial: 8250: longson: Fix NULL vs IS_ERR() bug in probe serial: core: Restore sysfs fwnode information commit 1c55bc8710a3ce9f93a35c6376706ae3eec71749 Merge: 03de3e44a706cd c48c0fd0e19684 Author: Linus Torvalds Date: Sun Dec 28 10:11:18 2025 -0800 Merge tag 'firewire-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "A fix for PCI driver for Texas Instruments PCILyx series. The driver had a bug where it allocated a DMA-coherent buffer of 16 KB but released it using PAGE_SIZE. This disproportion was reported in 2020, but the fix was never merged. It is finally resolved" * tag 'firewire-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: nosy: Fix dma_free_coherent() size commit 03de3e44a706cd96f75ede209cb289324367ed4b Merge: cd80afff4877e1 5efaf92da4365c Author: Linus Torvalds Date: Sun Dec 28 09:44:26 2025 -0800 Merge tag 'riscv-for-linus-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "Nothing exotic here; these are the cleanup and new ISA extension probing patches (not including CFI): - Add probing and userspace reporting support for the standard RISC-V ISA extensions Zilsd and Zclsd, which implement load/store dual instructions on RV32 - Abstract the register saving code in setup_sigcontext() so it can be used for stateful RISC-V ISA extensions beyond the vector extension - Add the SBI extension ID and some initial data structure definitions for the RISC-V standard SBI debug trigger extension - Clean up some code slightly: change some page table functions to avoid atomic operations oinn !SMP and to avoid unnecessary casts to atomic_long_t; and use the existing RISCV_FULL_BARRIER macro in place of some open-coded 'fence rw,rw' instructions" * tag 'riscv-for-linus-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Add SBI debug trigger extension and function ids riscv/atomic.h: use RISCV_FULL_BARRIER in _arch_atomic* function. riscv: hwprobe: export Zilsd and Zclsd ISA extensions riscv: add ISA extension parsing for Zilsd and Zclsd dt-bindings: riscv: add Zilsd and Zclsd extension descriptions riscv: mm: use xchg() on non-atomic_long_t variables, not atomic_long_xchg() riscv: mm: ptep_get_and_clear(): avoid atomic ops when !CONFIG_SMP riscv: mm: pmdp_huge_get_and_clear(): avoid atomic ops when !CONFIG_SMP riscv: signal: abstract header saving for setup_sigcontext commit cd80afff4877e1151ce53d48b65eba9de80ac1d2 Merge: d26143bb38e254 608328ba5b0619 Author: Linus Torvalds Date: Sun Dec 28 09:40:09 2025 -0800 Merge tag 'powerpc-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix for kexec warning due to SMT disable or partial SMT enabled - Handle font bitmap pointer with reloc_offset to fix boot crash - Fix to enable cpuidle state for Power11 - Couple of misc fixes Thanks to Aboorva Devarajan, Aditya Bodkhe, Cedar Maxwell, Christian Zigotzky, Christophe Leroy, Christophe Leroy (CS GROUP), Finn Thain, Gopi Krishna Menon, Guenter Roeck, Jan Stancek, Joe Lawrence, Josh Poimboeuf, Justin M. Forbes, Madadi Vineeth Reddy, Naveen N Rao (AMD), Nysal Jan K.A., Sachin P Bappalige, Samir M, Sourabh Jain, Srikar Dronamraju, and Stan Johnson * tag 'powerpc-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/32: Restore disabling of interrupts at interrupt/syscall exit powerpc/powernv: Enable cpuidle state detection for POWER11 powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() powerpc/tools: drop `-o pipefail` in gcc check scripts selftests/powerpc/pmu/: Add check_extended_reg_test to .gitignore powerpc/kexec: Enable SMT before waking offline CPUs commit a2ce133969175d36d708b7c76536b375d0522e53 Author: Ming Lei Date: Tue Dec 23 11:27:42 2025 +0800 selftests/ublk: fix Makefile to rebuild on header changes Add header dependencies to kublk build rule so that changes to kublk.h, ublk_dep.h, or utils.h trigger a rebuild. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 60cf863720308ab89ce2fdafea7fcb2cefd9c144 Author: Ming Lei Date: Tue Dec 23 11:27:41 2025 +0800 selftests/ublk: add test for async partition scan Add test_generic_15.sh to verify that async partition scan prevents IO hang when reading partition tables. The test creates ublk devices with fault_inject target and very large delay (60s) to simulate blocked partition table reads, then kills the daemon to verify proper state transitions without hanging: 1. Without recovery support: - Create device with fault_inject and 60s delay - Kill daemon while partition scan may be blocked - Verify device transitions to DEAD state 2. With recovery support (-r 1): - Create device with fault_inject, 60s delay, and recovery - Kill daemon while partition scan may be blocked - Verify device transitions to QUIESCED state Before the async partition scan fix, killing the daemon during partition scan would cause deadlock as partition scan held ub->mutex while waiting for IO. With the async fix, partition scan happens in a work function and flush_work() ensures proper synchronization. Add _add_ublk_dev_no_settle() helper function to skip udevadm settle, which would otherwise hang waiting for partition scan events to complete when partition table read is delayed. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a Author: Ming Lei Date: Tue Dec 23 11:27:40 2025 +0800 ublk: scan partition in async way Implement async partition scan to avoid IO hang when reading partition tables. Similar to nvme_partition_scan_work(), partition scanning is deferred to a work queue to prevent deadlocks. When partition scan happens synchronously during add_disk(), IO errors can cause the partition scan to wait while holding ub->mutex, which can deadlock with other operations that need the mutex. Changes: - Add partition_scan_work to ublk_device structure - Implement ublk_partition_scan_work() to perform async scan - Always suppress sync partition scan during add_disk() - Schedule async work after add_disk() for trusted daemons - Add flush_work() in ublk_stop_dev() before grabbing ub->mutex Reviewed-by: Caleb Sander Mateos Reported-by: Yoav Cohen Closes: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/ Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit c9894e6f0160414b57e895332c580cf5c8da6780 Author: Kohei Enju Date: Fri Dec 26 17:46:50 2025 +0900 tools/sched_ext: update scx_show_state.py for scx_aborting change Commit a69040ed57f5 ("sched_ext: Simplify breather mechanism with scx_aborting flag") removed scx_in_softlockup and scx_breather_depth, replacing them with scx_aborting. Update the script accordingly. Fixes: a69040ed57f5 ("sched_ext: Simplify breather mechanism with scx_aborting flag") Signed-off-by: Kohei Enju Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit f92ff79ba2640fc482bf2bfb5b42e33957f90caf Author: Kohei Enju Date: Fri Dec 26 17:46:49 2025 +0900 tools/sched_ext: fix scx_show_state.py for scx_root change Commit 48e126777386 ("sched_ext: Introduce scx_sched") introduced scx_root and removed scx_ops, causing scx_show_state.py to fail when searching for the 'scx_ops' object. [1] Fix by using 'scx_root' instead, with NULL pointer handling. [1] # drgn -s vmlinux ./tools/sched_ext/scx_show_state.py Traceback (most recent call last): File "/root/.venv/bin/drgn", line 8, in sys.exit(_main()) ~~~~~^^ File "/root/.venv/lib64/python3.14/site-packages/drgn/cli.py", line 625, in _main runpy.run_path( ~~~~~~~~~~~~~~^ script_path, init_globals={"prog": prog}, run_name="__main__" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "", line 287, in run_path File "", line 98, in _run_module_code File "", line 88, in _run_code File "./tools/sched_ext/scx_show_state.py", line 30, in ops = prog['scx_ops'] ~~~~^^^^^^^^^^^ _drgn.ObjectNotFoundError: could not find 'scx_ops' Fixes: 48e126777386 ("sched_ext: Introduce scx_sched") Signed-off-by: Kohei Enju Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 04bdb1a04d8a2a89df504c1e34250cd3c6e31a1c Author: shechenglong Date: Sun Dec 28 21:04:26 2025 +0800 block,bfq: fix aux stat accumulation destination Route bfqg_stats_add_aux() time accumulation into the destination stats object instead of the source, aligning with other stat fields. Reviewed-by: Yu Kuai Signed-off-by: shechenglong Signed-off-by: Jens Axboe commit 4d1442979e4a53b9457ce1e373e187e1511ff688 Author: Jens Axboe Date: Thu Dec 18 15:21:28 2025 -0700 af_unix: don't post cmsg for SO_INQ unless explicitly asked for A previous commit added SO_INQ support for AF_UNIX (SOCK_STREAM), but it posts a SCM_INQ cmsg even if just msg->msg_get_inq is set. This is incorrect, as ->msg_get_inq is just the caller asking for the remainder to be passed back in msg->msg_inq, it has nothing to do with cmsg. The original commit states that this is done to make sockets io_uring-friendly", but it's actually incorrect as io_uring doesn't use cmsg headers internally at all, and it's actively wrong as this means that cmsg's are always posted if someone does recvmsg via io_uring. Fix that up by only posting a cmsg if u->recvmsg_inq is set. Additionally, mirror how TCP handles inquiry handling in that it should only be done for a successful return. This makes the logic for the two identical. Cc: stable@vger.kernel.org Fixes: df30285b3670 ("af_unix: Introduce SO_INQ.") Reported-by: Julian Orth Link: https://github.com/axboe/liburing/issues/1509 Signed-off-by: Jens Axboe Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/07adc0c2-2c3b-4d08-8af1-1c466a40b6a8@kernel.dk Signed-off-by: Paolo Abeni commit d8aef84e60bd1671e3c0593028e06f9f75367003 Merge: 9448598b22c50c 9517d76dd16020 Author: Greg Kroah-Hartman Date: Sun Dec 28 13:54:54 2025 +0100 Merge tag 'counter-fixes-for-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 6.19 A fix for interrupt-cnt dropping the IRQF_NO_THREAD configuration to allow the IRQ handler to correctly acquire a spinlock_t lock. A fix for 104-quad-8 correcting quad8_irq_handler() to return irqreturn_t enum values rather than negative errno codes on error. * tag 'counter-fixes-for-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: 104-quad-8: Fix incorrect return value in IRQ handler counter: interrupt-cnt: Drop IRQF_NO_THREAD flag commit 684d3b2670a26313bbb99de6d66f384ac0e31c9b Author: Rafael J. Wysocki Date: Fri Dec 26 14:50:57 2025 +0100 PM: sleep: Fix suspend_test() at the TEST_CORE level Commit a10ad1b10402 ("PM: suspend: Make pm_test delay interruptible by wakeup events") replaced mdelay() in suspend_test() with msleep() which does not work at the TEST_CORE test level that calls suspend_test() while running on one CPU with interrupts off. Address this by making suspend_test() check if the test level is suitable for using msleep() and use mdelay() otherwise. Fixes: a10ad1b10402 ("PM: suspend: Make pm_test delay interruptible by wakeup events") Reported-by: Sebastian Reichel Closes: https://lore.kernel.org/linux-pm/aUsAk0k1N9hw8IkY@venus/ Signed-off-by: Rafael J. Wysocki Tested-by: Sebastian Reichel Link: https://patch.msgid.link/6251576.lOV4Wx5bFT@rafael.j.wysocki commit cc8f92e41eb76f450f05234fef2054afc3633100 Author: Haoxiang Li Date: Thu Dec 18 19:14:14 2025 +0800 w1: fix redundant counter decrement in w1_attach_slave_device() In w1_attach_slave_device(), if __w1_attach_slave_device() fails, put_device() -> w1_slave_release() is called to do the cleanup job. In w1_slave_release(), sl->family->refcnt and sl->master->slave_count have already been decremented. There is no need to decrement twice in w1_attach_slave_device(). Fixes: 2c927c0c73fd ("w1: Fix slave count on 1-Wire bus (resend)") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Link: https://patch.msgid.link/20251218111414.564403-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Krzysztof Kozlowski commit 3387a7ad478b46970ae8254049167d166e398aeb Author: Dipayaan Roy Date: Thu Dec 18 05:10:54 2025 -0800 net: mana: Fix use-after-free in reset service rescan path When mana_serv_reset() encounters -ETIMEDOUT or -EPROTO from mana_gd_resume(), it performs a PCI rescan via mana_serv_rescan(). mana_serv_rescan() calls pci_stop_and_remove_bus_device(), which can invoke the driver's remove path and free the gdma_context associated with the device. After returning, mana_serv_reset() currently jumps to the out label and attempts to clear gc->in_service, dereferencing a freed gdma_context. The issue was observed with the following call logs: [ 698.942636] BUG: unable to handle page fault for address: ff6c2b638088508d [ 698.943121] #PF: supervisor write access in kernel mode [ 698.943423] #PF: error_code(0x0002) - not-present page [S[ 698.943793] Pat Dec 6 07:GD5 100000067 P4D 1002f7067 PUD 1002f8067 PMD 101bef067 PTE 0 0:56 2025] hv_[n e 698.944283] Oops: Oops: 0002 [#1] SMP NOPTI tvsc f8615163-00[ 698.944611] CPU: 28 UID: 0 PID: 249 Comm: kworker/28:1 ... [Sat Dec 6 07:50:56 2025] R10: [ 699.121594] mana 7870:00:00.0 enP30832s1: Configured vPort 0 PD 18 DB 16 000000000000001b R11: 0000000000000000 R12: ff44cf3f40270000 [Sat Dec 6 07:50:56 2025] R13: 0000000000000001 R14: ff44cf3f402700c8 R15: ff44cf3f4021b405 [Sat Dec 6 07:50:56 2025] FS: 0000000000000000(0000) GS:ff44cf7e9fcf9000(0000) knlGS:0000000000000000 [Sat Dec 6 07:50:56 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Sat Dec 6 07:50:56 2025] CR2: ff6c2b638088508d CR3: 000000011fe43001 CR4: 0000000000b73ef0 [Sat Dec 6 07:50:56 2025] Call Trace: [Sat Dec 6 07:50:56 2025] [Sat Dec 6 07:50:56 2025] mana_serv_func+0x24/0x50 [mana] [Sat Dec 6 07:50:56 2025] process_one_work+0x190/0x350 [Sat Dec 6 07:50:56 2025] worker_thread+0x2b7/0x3d0 [Sat Dec 6 07:50:56 2025] kthread+0xf3/0x200 [Sat Dec 6 07:50:56 2025] ? __pfx_worker_thread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ret_from_fork+0x21a/0x250 [Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ret_from_fork_asm+0x1a/0x30 [Sat Dec 6 07:50:56 2025] Fix this by returning immediately after mana_serv_rescan() to avoid accessing GC state that may no longer be valid. Fixes: 9bf66036d686 ("net: mana: Handle hardware recovery events when probing the device") Reviewed-by: Simon Horman Reviewed-by: Long Li Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20251218131054.GA3173@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni commit c04de0c79534ec03c3efa49b72a90a55851b2c25 Author: Eric Dumazet Date: Thu Dec 18 08:18:44 2025 +0000 net: avoid prefetching NULL pointers Aditya Gupta reported PowerPC crashes bisected to the blamed commit. Apparently some platforms do not allow prefetch() on arbitrary pointers. prefetch(next); prefetch(&next->priority); // CRASH when next == NULL Only NULL seems to be supported, with specific handling in prefetch(). Add a conditional to avoid the two prefetches and the skb->next clearing for the last skb in the list. Fixes: b2e9821cff6c ("net: prefech skb->priority in __dev_xmit_skb()") Reported-by: Aditya Gupta Closes: https://lore.kernel.org/netdev/e9f4abee-b132-440f-a50e-bced0868b5a7@linux.ibm.com/T/#mddc372b64ec5a3b181acc9ee3909110c391cc18a Signed-off-by: Eric Dumazet Tested-by: Aditya Gupta Link: https://patch.msgid.link/20251218081844.809008-1-edumazet@google.com Signed-off-by: Paolo Abeni commit f79f9b7ace1713e4b83888c385f5f55519dfb687 Author: Bagas Sanjaya Date: Thu Dec 18 11:29:37 2025 +0700 net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct Sphinx reports kernel-doc warning: WARNING: ./net/bridge/br_private.h:267 struct member 'tunnel_hash' not described in 'net_bridge_vlan_group' Fix it by describing @tunnel_hash member. Fixes: efa5356b0d9753 ("bridge: per vlan dst_metadata netlink support") Signed-off-by: Bagas Sanjaya Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251218042936.24175-2-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5 Author: Deepanshu Kartikey Date: Thu Dec 18 06:53:54 2025 +0530 net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex. The problematic lock order is: Thread A (rfkill_fop_write): rfkill_fop_write() mutex_lock(&rfkill_global_mutex) rfkill_set_block() nfc_rfkill_set_block() nfc_dev_down() device_lock(&dev->dev) <- waits for device_lock Thread B (nfc_unregister_device): nfc_unregister_device() device_lock(&dev->dev) rfkill_unregister() mutex_lock(&rfkill_global_mutex) <- waits for rfkill_global_mutex This creates a classic ABBA deadlock scenario. Fix this by moving rfkill_unregister() and rfkill_destroy() outside the device_lock critical section. Store the rfkill pointer in a local variable before releasing the lock, then call rfkill_unregister() after releasing device_lock. This change is safe because rfkill_fop_write() holds rfkill_global_mutex while calling the rfkill callbacks, and rfkill_unregister() also acquires rfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will wait for any ongoing callback to complete before proceeding, and device_del() is only called after rfkill_unregister() returns, preventing any use-after-free. The similar lock ordering in nfc_register_device() (device_lock -> rfkill_global_mutex via rfkill_register) is safe because during registration the device is not yet in rfkill_list, so no concurrent rfkill operations can occur on this device. Fixes: 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") Cc: stable@vger.kernel.org Reported-by: syzbot+4ef89409a235d804c6c2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ef89409a235d804c6c2 Link: https://lore.kernel.org/all/20251217054908.178907-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251218012355.279940-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni commit a1e077a3f76eea0dc671ed6792e7d543946227e8 Author: Deepanshu Kartikey Date: Thu Dec 18 06:41:56 2025 +0530 net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c. Reported-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232 Tested-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return") Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni commit a4f800c4487dc5d6fcc28da89c7cc3c187ccc731 Author: Rosen Penev Date: Wed Dec 17 13:01:53 2025 -0800 net: mdio: rtl9300: use scoped for loops Currently in the return path, fwnode_handle_put calls are missing. Just use _scoped to avoid the issue. Fixes: 24e31e474769 ("net: mdio: Add RTL9300 MDIO driver") Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20251217210153.14641-1-rosenp@gmail.com Signed-off-by: Paolo Abeni commit fe072f651083c612278de82ce08bccdfecf574b3 Author: Arnaldo Carvalho de Melo Date: Fri Dec 26 16:09:34 2025 -0300 tools build: Fix the common set of features test wrt libopenssl The recent introduction of the libopenssl feature test forgot to add the -lssl to the test-all.o target, which made it always fail, fix it. Noticed by looking at this file after building: $ cat /tmp/build/perf-tools/feature/test-all.make.output /usr/bin/ld: /tmp/ccBhO8WH.ltrans0.ltrans.o: in function `main': /home/acme/git/perf-tools/tools/build/feature/test-libopenssl.c:6:(.text.startup+0x2ed): undefined reference to `OPENSSL_init_ssl' collect2: error: ld returned 1 exit status $ It was added only to the individual ssl test, that works: $ cat /tmp/build/perf-tools/feature/test-libopenssl.make.output $ ldd /tmp/build/perf-tools/feature/test-libopenssl.bin | grep ssl libssl.so.3 => /usr/lib64/libssl.so.3 (0x00007fb81eda8000) $ Fixes: 7678523109d1d9ee ("tools/build: Add a feature test for libopenssl") Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 1f4ea4838b13c3b2278436a8dcb148e3c23f4b64 Author: Jose Javier Rodriguez Barbarin Date: Tue Dec 2 09:42:00 2025 +0100 mcb: Add missing modpost build support mcb bus is not prepared to autoload client drivers with the data defined on the drivers' MODULE_DEVICE_TABLE. modpost cannot access to mcb_table_id inside MODULE_DEVICE_TABLE so the data declared inside is ignored. Add modpost build support for accessing to the mcb_table_id coded on device drivers' MODULE_DEVICE_TABLE. Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus") Reviewed-by: Jorge Sanjuan Garcia Signed-off-by: Jose Javier Rodriguez Barbarin Acked-by: Nathan Chancellor Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251202084200.10410-1-dev-josejavier.rodriguez@duagon.com Signed-off-by: Nicolas Schier commit b08fc4d0ec2466558f6d5511434efdfabbddf2a6 Author: Thomas De Schampheleire Date: Wed Nov 26 11:00:16 2025 +0100 kbuild: fix compilation of dtb specified on command-line without make rule Since commit e7e2941300d2 ("kbuild: split device tree build rules into scripts/Makefile.dtbs"), it is no longer possible to compile a device tree blob that is not specified in a make rule like: dtb-$(CONFIG_FOO) += foo.dtb Before the mentioned commit, one could copy a dts file to e.g. arch/arm64/boot/dts/ (or a new subdirectory) and then convert it to a dtb file using: make ARCH=arm64 foo.dtb In this scenario, both 'dtb-y' and 'dtb-' are empty, and the inclusion of scripts/Makefile.dtbs relies on 'targets' to contain the MAKECMDGOALS. The value of 'targets', however, is only final later in the code. Move the conditional include of scripts/Makefile.dtbs down to where the value of 'targets' is final. Since Makefile.dtbs updates 'always-y' which is used as a prerequisite in the build rule, the build rule also needs to move down. Fixes: e7e2941300d2 ("kbuild: split device tree build rules into scripts/Makefile.dtbs") Signed-off-by: Thomas De Schampheleire Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251126100017.1162330-1-thomas.de_schampheleire@nokia.com Signed-off-by: Nicolas Schier commit 07fe35b766a6fcd4ec8214e5066b7b0056b6ec6a Author: Nicolas Schier Date: Wed Dec 17 20:13:43 2025 +0100 Revert "scripts/clang-tools: Handle included .c files in gen_compile_commands" This reverts commit 9362d34acf91a706c543d919ade3e651b9bd2d6f. Dmitry Vyukov reported that commit 9362d34acf91 ("scripts/clang-tools: Handle included .c files in gen_compile_commands") generates false entries in some cases for C files that are included in other C files but not meant for standalone compilation. For properly supporting clangd, including .c files is discouraged. Reported-by: Dmitry Vyukov Closes: https://lore.kernel.org/r/CACT4Y+Z8aCz0XcoJx9XXPHZSZHxGF8Kx9iUbFarhpTSEPDhMfg@mail.gmail.com Acked-by: Nathan Chancellor Acked-by: Dmitry Vyukov Fixes: 9362d34acf91 ("scripts/clang-tools: Handle included .c files in gen_compile_commands") Link: https://patch.msgid.link/20251217-revert-scripts-clang-rools-handle-included-c-files-v1-1-def5651446da@kernel.org Signed-off-by: Nicolas Schier commit d26143bb38e2546fe6f8c9860c13a88146ce5dd6 Merge: 651df419975af9 b005d618c8547b Author: Linus Torvalds Date: Sat Dec 27 08:37:26 2025 -0800 Merge tag 'spi-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "We've got more fixes here for the Cadence QSPI controller, this time fixing some issues that come up when working with slower flashes on some platforms plus a general race condition. We also add support for the Allwinner A523, this is just some new compatibles" * tag 'spi-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: Improve CQSPI_SLOW_SRAM quirk if flash is slow spi: cadence-quadspi: Prevent lost complete() call during indirect read spi: sun6i: Support A523's SPI controllers spi: dt-bindings: sun6i: Add compatibles for A523's SPI controllers commit d42bce414d1c5c0b536758466a1f63ac358e613c Author: Jonas Gorski Date: Wed Dec 17 21:57:56 2025 +0100 net: dsa: b53: skip multicast entries for fdb_dump() port_fdb_dump() is supposed to only add fdb entries, but we iterate over the full ARL table, which also includes multicast entries. So check if the entry is a multicast entry before passing it on to the callback(). Additionally, the port of those entries is a bitmask, not a port number, so any included entries would have even be for the wrong port. Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251217205756.172123-1-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni commit 352df98b7b4f94a2e0e1265d469c0926a6d1b282 Merge: d5dc28305143f1 9c72a5182ed929 Author: Paolo Abeni Date: Sat Dec 27 17:10:41 2025 +0100 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-12-17 (i40e, iavf, idpf, e1000) For i40e: Przemyslaw immediately schedules service task following changes to filters to ensure timely setup for PTP. Gregory Herrero adjusts VF descriptor size checks to be device specific. For iavf: Kohei Enju corrects a couple of condition checks which caused off-by-one issues. For idpf: Larysa fixes LAN memory region call to follow expected requirements. Brian Vazquez reduces mailbox wait time during init to avoid lengthy delays. For e1000: Guangshuo Li adds validation of data length to prevent out-of-bounds access. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000: fix OOB in e1000_tbi_should_accept() idpf: reduce mbx_task schedule delay to 300us idpf: fix LAN memory regions command on some NVMs iavf: fix off-by-one issues in iavf_config_rss_reg() i40e: validate ring_len parameter against hardware-specific values i40e: fix scheduling in set_rx_mode ==================== Link: https://patch.msgid.link/ Signed-off-by: Paolo Abeni commit 651df419975af905000c3a0b02123062360bb688 Merge: 0d362c7fa16510 60489936aced78 Author: Linus Torvalds Date: Sat Dec 27 08:04:39 2025 -0800 Merge tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes from Thomas, making the UAPI headers more robustly correct and ensuring they are covered by checkpatch, and one from Andreas fixing an update for a change to the DT bindings that I missed was requested during bindings review in the newly added fp9931 driver" * tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fp9931: fix regulator node pointer regulator: Add UAPI headers to MAINTAINERS regulator: uapi: Use UAPI integer type commit 0d362c7fa165106b4facafb23906108a9db4206a Merge: c53f467229a782 479e25d88d1681 Author: Linus Torvalds Date: Sat Dec 27 07:53:56 2025 -0800 Merge tag 'drm-fixes-2025-12-27' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Post overeating fixes, only msm for this week has anything, so quiet as expected. msm: - GPU: - Fix crash on a7xx GPUs not supporting IFPC - Fix perfcntr use with IFPC - Concurrent binning fix - DPU: - Fixed DSC and SSPP fetching issues - Switched to scnprint instead of snprintf - Added missing NULL checks in pingpong code" * tag 'drm-fixes-2025-12-27' of https://gitlab.freedesktop.org/drm/kernel: (27 commits) drm/msm: Replace unsafe snprintf usage with scnprintf drm/msm/dpu: Add missing NULL pointer check for pingpong interface Revert "drm/msm/dpu: Enable quad-pipe for DSC and dual-DSI case" Revert "drm/msm/dpu: support plane splitting in quad-pipe case" drm/msm: msm_iommu.c: fix all kernel-doc warnings drm/msm: msm_gpu.h: fix all kernel-doc warnings drm/msm: msm_gem_vma.c: fix all kernel-doc warnings drm/msm: msm_fence.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_wb.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_vbif.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_top.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_sspp.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_pingpong.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_merge3d.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_lm.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_intf.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_dspp.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_dsc.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_cwb.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_ctl.h: fix all kernel-doc warnings ... commit d5dc28305143f126dc3d8da21e1ad75865b194e2 Author: Rajashekar Hudumula Date: Wed Dec 17 02:47:48 2025 -0800 bng_en: update module description The Broadcom BCM57708/800G NIC family is branded as ThorUltra. Update the driver description accordingly. Fixes: 74715c4ab0fa0 ("bng_en: Add PCI interface") Signed-off-by: Rajashekar Hudumula Reviewed-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Link: https://patch.msgid.link/20251217104748.3004706-1-rajashekar.hudumula@broadcom.com Signed-off-by: Paolo Abeni commit 9910159f06590c17df4fbddedaabb4c0201cc4cb Author: Rasmus Villemoes Date: Mon Dec 15 14:17:23 2025 +0100 iio: core: add separate lockdep class for info_exist_lock When one iio device is a consumer of another, it is possible that the ->info_exist_lock of both ends up being taken when reading the value of the consumer device. Since they currently belong to the same lockdep class (being initialized in a single location with mutex_init()), that results in a lockdep warning CPU0 ---- lock(&iio_dev_opaque->info_exist_lock); lock(&iio_dev_opaque->info_exist_lock); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by sensors/414: #0: c31fd6dc (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0x44/0x4e4 #1: c4f5a1c4 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x1c/0xac #2: c2827548 (kn->active#34){.+.+}-{0:0}, at: kernfs_seq_start+0x30/0xac #3: c1dd2b68 (&iio_dev_opaque->info_exist_lock){+.+.}-{3:3}, at: iio_read_channel_processed_scale+0x24/0xd8 stack backtrace: CPU: 0 UID: 0 PID: 414 Comm: sensors Not tainted 6.17.11 #5 NONE Hardware name: Generic AM33XX (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x44/0x60 dump_stack_lvl from print_deadlock_bug+0x2b8/0x334 print_deadlock_bug from __lock_acquire+0x13a4/0x2ab0 __lock_acquire from lock_acquire+0xd0/0x2c0 lock_acquire from __mutex_lock+0xa0/0xe8c __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from iio_read_channel_raw+0x20/0x6c iio_read_channel_raw from rescale_read_raw+0x128/0x1c4 rescale_read_raw from iio_channel_read+0xe4/0xf4 iio_channel_read from iio_read_channel_processed_scale+0x6c/0xd8 iio_read_channel_processed_scale from iio_hwmon_read_val+0x68/0xbc iio_hwmon_read_val from dev_attr_show+0x18/0x48 dev_attr_show from sysfs_kf_seq_show+0x80/0x110 sysfs_kf_seq_show from seq_read_iter+0xdc/0x4e4 seq_read_iter from vfs_read+0x238/0x2e4 vfs_read from ksys_read+0x6c/0xec ksys_read from ret_fast_syscall+0x0/0x1c Just as the mlock_key already has its own lockdep class, add a lock_class_key for the info_exist mutex. Note that this has in theory been a problem since before IIO first left staging, but it only occurs when a chain of consumers is in use and that is not often done. Fixes: ac917a81117c ("staging:iio:core set the iio_dev.info pointer to null on unregister under lock.") Signed-off-by: Rasmus Villemoes Reviewed-by: Peter Rosin Cc: Signed-off-by: Jonathan Cameron commit 479e25d88d1681e04cac708501180db606aecd1e Merge: 9448598b22c50c 66691e272e40c9 Author: Dave Airlie Date: Sat Dec 27 16:00:43 2025 +1000 Merge tag 'drm-msm-fixes-2025-12-26' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.19: GPU: - Fix crash on a7xx GPUs not supporting IFPC - Fix perfcntr use with IFPC - Concurrent binning fix DPU: - Fixed DSC and SSPP fetching issues - Switched to scnprint instead of snprintf - Added missing NULL checks in pingpong code Also documentation fixes. Signed-off-by: Dave Airlie From: Rob Clark Link: https://patch.msgid.link/CACSVV01jcLLChsFtmqc4VDNoQ2ic2q+d86n3wdoSUdmW6xaSdQ@mail.gmail.com commit c53f467229a78287efa5b9f65bd22de64416660f Merge: 04688d6128b7c8 c9f36f04a8a272 Author: Linus Torvalds Date: Fri Dec 26 19:44:08 2025 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three HBA driver and one upper level driver (sg) fix. The sg change is the largest, but that results mostly from moving code to avoid the described race condition" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error scsi: sg: Fix occasional bogus elapsed time that exceeds timeout scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow scsi: scsi_debug: Fix atomic write enable module param description commit a4166f1c4893a9a620507255b9d1ccab44fab189 Author: Li Nan Date: Fri Dec 26 10:42:21 2025 +0800 md: Fix forward incompatibility from configurable logical block size Commit 62ed1b582246 ("md: allow configuring logical block size") used reserved pad to add 'logical_block_size' to metadata. RAID rejects non-zero reserved pad, so arrays fail when rolling back to old kernels after booting new ones. Set 'logical_block_size' only for newly created arrays to support rollback to old kernels. Importantly new arrays still won't work on old kernels to prevent data loss issue from LBS changes. For arrays created on old kernels which confirmed not to rollback, configure LBS by echo current LBS (queue/logical_block_size) to md/logical_block_size. Fixes: 62ed1b582246 ("md: allow configuring logical block size") Reported-by: BugReports Closes: https://lore.kernel.org/linux-raid/825e532d-d1e1-44bb-5581-692b7c091796@huaweicloud.com/T/#t Signed-off-by: Li Nan Link: https://lore.kernel.org/linux-raid/20251226024221.724201-2-linan666@huaweicloud.com Signed-off-by: Yu Kuai commit 864466c38c4a0446088a8e866538c83c3f2018cb Author: Li Nan Date: Fri Dec 26 10:42:20 2025 +0800 md: Fix logical_block_size configuration being overwritten In super_1_validate(), mddev->logical_block_size is directly overwritten with the value from metadata. This causes the previously configured lbs to be lost, making the configuration ineffective. Fix it. Fixes: 62ed1b582246 ("md: allow configuring logical block size") Signed-off-by: Li Nan Reviewed-by: Yu Kuai Reviewed-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20251226024221.724201-1-linan666@huaweicloud.com Signed-off-by: Yu Kuai commit 2cc583653bbe050bacd1cadcc9776d39bf449740 Author: FengWei Shih Date: Fri Dec 26 18:18:16 2025 +0800 md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze_array() is called after the update is completed. However, freeze_array() only waits until nr_sync_pending and (nr_pending - nr_queued) of all buckets reaches zero. When an I/O error occurs, nr_queued is increased and the corresponding r1bio is queued to either retry_list or bio_end_io_list. As a result, freeze_array() may unblock before these r1bios are released. This can lead to a situation where conf->raid_disks and the mempool have already been updated while queued r1bios, allocated with the old raid_disks value, are later released. Consequently, free_r1bio() may access memory out of bounds in put_all_bios() and release r1bios of the wrong size to the new mempool, potentially causing issues with the mempool as well. Since only normal I/O might increase nr_queued while an I/O error occurs, suspending the array avoids this issue. Note: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends the array. Therefore, we suspend the array when updating raid_disks via sysfs to avoid this issue too. Signed-off-by: FengWei Shih Link: https://lore.kernel.org/linux-raid/20251226101816.4506-1-dannyshih@synology.com Signed-off-by: Yu Kuai commit 7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9 Author: Tuo Li Date: Thu Dec 25 21:03:26 2025 +0800 md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() The variable mddev->private is first assigned to conf and then checked: conf = mddev->private; if (!conf) ... If conf is NULL, then mddev->private is also NULL. In this case, null-pointer dereferences can occur when calling raid5_quiesce(): raid5_quiesce(mddev, true); raid5_quiesce(mddev, false); since mddev->private is assigned to conf again in raid5_quiesce(), and conf is dereferenced in several places, for example: conf->quiesce = 0; wake_up(&conf->wait_for_quiescent); To fix this issue, the function should unlock mddev and return before invoking raid5_quiesce() when conf is NULL, following the existing pattern in raid5_change_consistency_policy(). Fixes: fa1944bbe622 ("md/raid5: Wait sync io to finish before changing group cnt") Signed-off-by: Tuo Li Reviewed-by: Xiao Ni Reviewed-by: Paul Menzel Link: https://lore.kernel.org/linux-raid/20251225130326.67780-1-islituo@gmail.com Signed-off-by: Yu Kuai commit 04688d6128b7c8b4ccec2913e7f2ff1c4437da96 Merge: 1e5e062ad84c4b cb6d5aa9c0f100 Author: Linus Torvalds Date: Fri Dec 26 16:19:45 2025 -0800 Merge tag 'v6.19-rc2-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: - Fix potential memory leak * tag 'v6.19-rc2-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix memory and information leak in smb3_reconfigure() commit 1e5e062ad84c4b700f1a6d51a548c936784f8951 Merge: b63f4a4e95d61b 2b742094582db3 Author: Linus Torvalds Date: Fri Dec 26 13:41:02 2025 -0800 Merge tag 'driver-core-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Introduce DMA Rust helpers to avoid build errors when !CONFIG_HAS_DMA - Remove unnecessary (and hence incorrect) endian conversion in the Rust PCI driver sample code - Fix memory leak in the unwind path of debugfs_change_name() - Support non-const struct software_node pointers in SOFTWARE_NODE_REFERENCE(), after introducing _Generic() - Avoid NULL pointer dereference in the unwind path of simple_xattrs_free() * tag 'driver-core-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: fs/kernfs: null-ptr deref in simple_xattrs_free() software node: Also support referencing non-constant software nodes debugfs: Fix memleak in debugfs_change_name(). samples: rust: fix endianness issue in rust_driver_pci rust: dma: add helpers for architectures without CONFIG_HAS_DMA commit b63f4a4e95d61bc7fc3db074f3689c849f27f046 Merge: 3f0e9c8cefa913 cfe54f4591e675 Author: Linus Torvalds Date: Fri Dec 26 13:37:11 2025 -0800 Merge tag 'efi-fixes-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: "A couple of fixes for EFI regressions introduced this cycle: - Make EDID handling in the EFI stub mixed mode safe - Ensure that efi_mm.user_ns has a sane value - this is needed now that EFI runtime calls are preemptible on arm64" * tag 'efi-fixes-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() arm64: efi: Fix NULL pointer dereference by initializing user_ns efi/libstub: gop: Fix EDID support in mixed-mode commit 3f0e9c8cefa913dd9bd1d79b9a68896ea130f106 Merge: 4079a38693910c 1ddb815fdfd456 Author: Linus Torvalds Date: Fri Dec 26 11:44:35 2025 -0800 Merge tag 'block-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fix for a signedness issue introduced in this kernel release for rnbd - Fix up user copy references for ublk when the server exits * tag 'block-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: rnbd-clt: Fix signedness bug in init_dev() ublk: clean up user copy references on ublk server exit commit 6548fb521822a5c0a688e423df28b2248a59543b Author: Mickaël Salaün Date: Fri Dec 19 20:38:50 2025 +0100 landlock: Fix spelling Cc: Günther Noack Link: https://lore.kernel.org/r/20251219193855.825889-4-mic@digikod.net Reviewed-by: Günther Noack Signed-off-by: Mickaël Salaün commit aa9877d74c07045f712a4ec82105505e69cd5efe Author: Mickaël Salaün Date: Fri Dec 19 20:38:49 2025 +0100 landlock: Clean up hook_ptrace_access_check() Make variable's scope minimal in hook_ptrace_access_check(). Cc: Günther Noack Link: https://lore.kernel.org/r/20251219193855.825889-3-mic@digikod.net Reviewed-by: Günther Noack Signed-off-by: Mickaël Salaün commit 03a0ff99ef2e4958141f7b4c573722fc8f4b9539 Author: Mickaël Salaün Date: Fri Dec 19 20:38:48 2025 +0100 landlock: Improve erratum documentation Improve description about scoped signal handling. Reported-by: Günther Noack Link: https://lore.kernel.org/r/20251219193855.825889-2-mic@digikod.net Reviewed-by: Günther Noack Signed-off-by: Mickaël Salaün commit 60207df2ebf3b740770aa605173d2d7d19ee66b2 Author: Mickaël Salaün Date: Fri Dec 19 20:38:47 2025 +0100 landlock: Remove useless include Remove useless audit.h include. Cc: Günther Noack Fixes: 33e65b0d3add ("landlock: Add AUDIT_LANDLOCK_ACCESS and log ptrace denials") Link: https://lore.kernel.org/r/20251219193855.825889-1-mic@digikod.net Reviewed-by: Günther Noack Signed-off-by: Mickaël Salaün commit 29fbfa46e4287c596bdc77e2c599e3a1bbf8bb67 Author: Tingmao Wang Date: Sat Dec 6 17:11:06 2025 +0000 landlock: Fix wrong type usage I think, based on my best understanding, that this type is likely a typo (even though in the end both are u16) Signed-off-by: Tingmao Wang Fixes: 2fc80c69df82 ("landlock: Log file-related denials") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/7339ad7b47f998affd84ca629a334a71f913616d.1765040503.git.m@maowtm.org Signed-off-by: Mickaël Salaün commit e4aa4461d4acb922ef45785581232f0588a6eea8 Author: Matthieu Buffet Date: Tue Dec 2 22:51:41 2025 +0100 selftests/landlock: NULL-terminate unix pathname addresses The size of Unix pathname addresses is computed in selftests using offsetof(struct sockaddr_un, sun_path) + strlen(xxx). It should have been that +1, which makes addresses passed to the libc and kernel non-NULL-terminated. unix_mkname_bsd() fixes that in Linux so there is no harm, but just using sizeof(the address struct) should improve readability. Signed-off-by: Matthieu Buffet Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20251202215141.689986-1-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit e1a57c33590a50a6639798e60a597af4a23b0340 Author: Matthieu Buffet Date: Mon Dec 1 01:36:31 2025 +0100 selftests/landlock: Remove invalid unix socket bind() Remove bind() call on a client socket that doesn't make sense. Since strlen(cli_un.sun_path) returns a random value depending on stack garbage, that many uninitialized bytes are read from the stack as an unix socket address. This creates random test failures due to the bind address being invalid or already in use if the same stack value comes up twice. Fixes: f83d51a5bdfe ("selftests/landlock: Check IOCTL restrictions for named UNIX domain sockets") Signed-off-by: Matthieu Buffet Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20251201003631.190817-1-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit 6685201ebfacff0c889bcd569181fa6e8af5575e Author: Matthieu Buffet Date: Mon Oct 27 20:07:25 2025 +0100 selftests/landlock: Add missing connect(minimal AF_UNSPEC) test connect_variant(unspec_any0) is called twice. Both calls end up in connect_variant_addrlen() with an address length of get_addrlen(minimal=false). However, the connect() syscall and its variants (e.g. iouring/compat) accept much shorter addresses of 4 bytes and that behaviour was not tested. Replace one of these calls with one using a minimal address length (just a bare sa_family=AF_UNSPEC field with no actual address). Also add a call using a truncated address for good measure. Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251027190726.626244-3-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit bd09d9a05cf04028f639e209b416bacaeffd4909 Author: Matthieu Buffet Date: Mon Oct 27 20:07:24 2025 +0100 selftests/landlock: Fix TCP bind(AF_UNSPEC) test case The nominal error code for bind(AF_UNSPEC) on an IPv6 socket is -EAFNOSUPPORT, not -EINVAL. -EINVAL is only returned when the supplied address struct is too short, which happens to be the case in current selftests because they treat AF_UNSPEC like IPv4 sockets do: as an alias for AF_INET (which is a 16-byte struct instead of the 24 bytes required by IPv6 sockets). Make the union large enough for any address (by adding struct sockaddr_storage to the union), and make AF_UNSPEC addresses large enough for any family. Test for -EAFNOSUPPORT instead, and add a dedicated test case for truncated inputs with -EINVAL. Fixes: a549d055a22e ("selftests/landlock: Add network tests") Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251027190726.626244-2-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit e4d82cbce2258f454634307fdabf33aa46b61ab0 Author: Matthieu Buffet Date: Mon Oct 27 20:07:26 2025 +0100 landlock: Fix TCP handling of short AF_UNSPEC addresses current_check_access_socket() treats AF_UNSPEC addresses as AF_INET ones, and only later adds special case handling to allow connect(AF_UNSPEC), and on IPv4 sockets bind(AF_UNSPEC+INADDR_ANY). This would be fine except AF_UNSPEC addresses can be as short as a bare AF_UNSPEC sa_family_t field, and nothing more. The AF_INET code path incorrectly enforces a length of sizeof(struct sockaddr_in) instead. Move AF_UNSPEC edge case handling up inside the switch-case, before the address is (potentially incorrectly) treated as AF_INET. Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect") Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251027190726.626244-4-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit 552dbf47a85c3b0eea1d7984ce3794b8d9b20e94 Author: Mickaël Salaün Date: Fri Dec 19 20:38:51 2025 +0100 landlock: Fix formatting Format with clang-format -i security/landlock/*.[ch] Cc: Christian Brauner Cc: Günther Noack Cc: Mateusz Guzik Fixes: b4dbfd8653b3 ("Coccinelle-based conversion to use ->i_state accessors") Link: https://lore.kernel.org/r/20251219193855.825889-5-mic@digikod.net Reviewed-by: Günther Noack Signed-off-by: Mickaël Salaün commit 4079a38693910c44780b31cd3cbd220b4144e473 Merge: 8f0cbedc86cfc9 b14fad555302a2 Author: Linus Torvalds Date: Fri Dec 26 11:34:38 2025 -0800 Merge tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix for a bug that can cause a leak of the filename with IORING_OP_OPENAT, if direct descriptors are asked for and O_CLOEXEC has been set in the request flags" * tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix filename leak in __io_openat_prep() commit 8f0cbedc86cfc93ea869bbff420a2d86f6373f57 Merge: e2cc6440895a57 d8ee3cfdc89b75 Author: Linus Torvalds Date: Fri Dec 26 11:11:30 2025 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Just a bunch of fixes, mostly trivial ones in tools/virtio" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost/vsock: improve RCU read sections around vhost_vsock_get() tools/virtio: add device, device_driver stubs tools/virtio: fix up oot build virtio_features: make it self-contained tools/virtio: switch to kernel's virtio_config.h tools/virtio: stub might_sleep and synchronize_rcu tools/virtio: add struct cpumask to cpumask.h tools/virtio: pass KCFLAGS to module build tools/virtio: add ucopysize.h stub tools/virtio: add dev_WARN_ONCE and is_vmalloc_addr stubs tools/virtio: stub DMA mapping functions tools/virtio: add struct module forward declaration tools/virtio: use kernel's virtio.h virtio: make it self-contained tools/virtio: fix up compiler.h stub commit e2cc6440895a57977ba818d4aaffcb59db7b66a0 Merge: ccd1cdca5cd433 4c7d8eb9a79ae5 Author: Linus Torvalds Date: Fri Dec 26 10:03:25 2025 -0800 Merge tag 'v6.19-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix parsing of SMB1 negotiate request by adjusting offsets affected by the removal of the RFC1002 length field from the SMB header - Update minimum PDU size macros for both SMB1 and SMB2 - Rename smb2_get_msg function to smb_get_msg to better reflect its role in handling both SMB1 and SMB2 requests * tag 'v6.19-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd: smb/server: fix minimum SMB2 PDU size smb/server: fix minimum SMB1 PDU size ksmbd: rename smb2_get_msg to smb_get_msg ksmbd: Fix to handle removal of rfc1002 header from smb_hdr commit fa917d3d570279dc3d699cbd947d0da0fde2e402 Author: Louis-Alexis Eyraud Date: Wed Dec 3 12:32:42 2025 +0100 pinctrl: mediatek: mt8189: restore previous register base name array order In mt8189-pinctrl driver, a previous commit changed the register base name array (mt8189_pinctrl_register_base_names) entry name and order to align it with the same name and order as the "mediatek,mt8189-pinctrl" devicetree bindings. The new order (by ascending register address) now causes an issue with MT8189 pinctrl configuration. MT8189 SoC has multiple base addresses for the pin configuration registers. Several constant data structures, declaring each pin configuration, are using PIN_FIELD_BASE() macro which i_base parameter indicates for a given pin the lookup index in the base register address array of the driver internal data for the configuration register read/write accesses. But in practice, this parameter is given a hardcoded numerical value that corresponds to the expected base register entry index in mt8189_pinctrl_register_base_names array. Since this array reordering, the i_base index matching is no more correct. So, in order to avoid modifying over a thousand of PIN_FIELD_BASE() calls, restore previous mt8189_pinctrl_register_base_names entry order. Fixes: 518919276c41 ("pinctrl: mediatek: mt8189: align register base names to dt-bindings ones") Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Linus Walleij commit c48c0fd0e19684b6ecdb4108a429e3a4e73f5e21 Author: Thomas Fourier Date: Tue Dec 16 17:54:18 2025 +0100 firewire: nosy: Fix dma_free_coherent() size It looks like the buffer allocated and mapped in add_card() is done with size RCV_BUFFER_SIZE which is 16 KB and 4KB. Fixes: 286468210d83 ("firewire: new driver: nosy - IEEE 1394 traffic sniffer") Co-developed-by: Thomas Fourier Signed-off-by: Thomas Fourier Co-developed-by: Christophe JAILLET Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/20251216165420.38355-2-fourier.thomas@gmail.com Signed-off-by: Takashi Sakamoto commit 97872fa28b33a1ca6acc0a7b260750c9a123b193 Author: Danilo Krummrich Date: Tue Dec 23 13:04:34 2025 +0100 MAINTAINERS: exclude the tyr driver from DRM MISC The ARM MALI TYR DRM DRIVER is already maintained through the drm-rust tree, hence exclude it from drm-misc. Fixes: cf4fd52e3236 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs") Signed-off-by: Danilo Krummrich Link: https://patch.msgid.link/20251223120436.33233-1-dakr@kernel.org Signed-off-by: Alice Ryhl commit de0bdcaf36494c9d91653cb062766846f7c51041 Author: Danilo Krummrich Date: Tue Dec 23 12:59:47 2025 +0100 MAINTAINERS: fix typo in TYR DRM driver entry Fix a missing ':' in the ARM MALI TYR DRM DRIVER entry, which does prevent script/get_maintainer.pl to properly work and pick up the corresponding maintainers. Fixes: cf4fd52e3236 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs") Reported-by: Tamir Duberstein Closes: https://lore.kernel.org/lkml/CAJ-ks9mrZtnPUjp5tD03hW+TyS0M9i-KRF_ramNY-oh-0X+ayA@mail.gmail.com/ Signed-off-by: Danilo Krummrich Reviewed-by: Tamir Duberstein Link: https://patch.msgid.link/20251223115949.32531-1-dakr@kernel.org Signed-off-by: Alice Ryhl commit b14fad555302a2104948feaff70503b64c80ac01 Author: Prithvi Tambewagh Date: Thu Dec 25 12:58:29 2025 +0530 io_uring: fix filename leak in __io_openat_prep() __io_openat_prep() allocates a struct filename using getname(). However, for the condition of the file being installed in the fixed file table as well as having O_CLOEXEC flag set, the function returns early. At that point, the request doesn't have REQ_F_NEED_CLEANUP flag set. Due to this, the memory for the newly allocated struct filename is not cleaned up, causing a memory leak. Fix this by setting the REQ_F_NEED_CLEANUP for the request just after the successful getname() call, so that when the request is torn down, the filename will be cleaned up, along with other resources needing cleanup. Reported-by: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=00e61c43eb5e4740438f Tested-by: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Prithvi Tambewagh Fixes: b9445598d8c6 ("io_uring: openat directly into fixed fd table") Signed-off-by: Jens Axboe commit 00f6c1b4d15d35fadb7f34768a1831c81aaa8936 Author: Li Nan Date: Mon Dec 15 20:44:12 2025 +0800 md: Fix static checker warning in analyze_sbs The following warn is reported: drivers/md/md.c:3912 analyze_sbs() warn: iterator 'i' not incremented Fixes: d8730f0cf4ef ("md: Remove deprecated CONFIG_MD_MULTIPATH") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-raid/7e2e95ce-3740-09d8-a561-af6bfb767f18@huaweicloud.com/T/#t Signed-off-by: Li Nan Link: https://lore.kernel.org/linux-raid/20251215124412.4015572-1-linan666@huaweicloud.com Signed-off-by: Yu Kuai commit 1f941b2c23fd34c6f3b76d36f9d0a2528fa92b8f Author: Haoxiang Li Date: Sat Dec 6 15:38:42 2025 +0800 nfsd: Drop the client reference in client_states_open() In error path, call drop_client() to drop the reference obtained by get_nfsdfs_clp(). Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Haoxiang Li Signed-off-by: Chuck Lever commit 8f9e967830ff32ab7756f530a36adf74a9f12b76 Author: Jeff Layton Date: Wed Dec 3 10:52:15 2025 -0500 nfsd: use ATTR_DELEG in nfsd4_finalize_deleg_timestamps() When finalizing timestamps that have never been updated and preparing to release the delegation lease, the notify_change() call can trigger a delegation break, and fail to update the timestamps. When this happens, there will be messages like this in dmesg: [ 2709.375785] Unable to update timestamps on inode 00:39:263: -11 Since this code is going to release the lease just after updating the timestamps, breaking the delegation is undesirable. Fix this by setting ATTR_DELEG in ia_valid, in order to avoid the delegation break. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Cc: stable@vger.kernel.org Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 8072e34e1387d03102b788677d491e2bcceef6f5 Author: Chuck Lever Date: Mon Dec 1 17:09:55 2025 -0500 nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if the client already has a SHARE_ACCESS_READ open from a previous OPEN operation, this action overwrites the existing pointer without releasing its reference, orphaning the previous reference. Additionally, the function originally stored the same nfsd_file pointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with only a single reference. When put_deleg_file() runs, it clears fi_rdeleg_file and calls nfs4_file_put_access() to release the file. However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when the fi_access[O_RDONLY] counter drops to zero. If another READ open exists on the file, the counter remains elevated and the nfsd_file reference from the delegation is never released. This potentially causes open conflicts on that file. Then, on server shutdown, these leaks cause __nfsd_file_cache_purge() to encounter files with an elevated reference count that cannot be cleaned up, ultimately triggering a BUG() in kmem_cache_destroy() because there are still nfsd_file objects allocated in that cache. Fixes: e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a49a2a1baa0c553c3548a1c414b6a3c005a8deba Author: NeilBrown Date: Sat Nov 22 12:00:36 2025 +1100 lockd: fix vfs_test_lock() calls Usage of vfs_test_lock() is somewhat confused. Documentation suggests it is given a "lock" but this is not the case. It is given a struct file_lock which contains some details of the sort of lock it should be looking for. In particular passing a "file_lock" containing fl_lmops or fl_ops is meaningless and possibly confusing. This is particularly problematic in lockd. nlmsvc_testlock() receives an initialised "file_lock" from xdr-decode, including manager ops and an owner. It then mistakenly passes this to vfs_test_lock() which might replace the owner and the ops. This can lead to confusion when freeing the lock. The primary role of the 'struct file_lock' passed to vfs_test_lock() is to report a conflicting lock that was found, so it makes more sense for nlmsvc_testlock() to pass "conflock", which it uses for returning the conflicting lock. With this change, freeing of the lock is not confused and code in __nlm4svc_proc_test() and __nlmsvc_proc_test() can be simplified. Documentation for vfs_test_lock() is improved to reflect its real purpose, and a WARN_ON_ONCE() is added to avoid a similar problem in the future. Reported-by: Olga Kornievskaia Closes: https://lore.kernel.org/all/20251021130506.45065-1-okorniev@redhat.com Signed-off-by: NeilBrown Fixes: 20fa19027286 ("nfs: add export operations") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit cfe54f4591e675cedf2c0d25287ff4c0a2e0cb9d Author: Breno Leitao Date: Tue Dec 23 02:55:44 2025 -0800 kthread: Warn if mm_struct lacks user_ns in kthread_use_mm() Add a WARN_ON_ONCE() check to detect mm_struct instances that are missing user_ns initialization when passed to kthread_use_mm(). When a kthread adopts an mm via kthread_use_mm(), LSM hooks and capability checks may access current->mm->user_ns for credential validation. If user_ns is NULL, this leads to a NULL pointer dereference crash. This was observed with efi_mm on arm64, where commit a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") introduced kthread_use_mm(&efi_mm), but efi_mm lacked user_ns initialization, causing crashes during /proc access. Adding this warning helps catch similar bugs early during development rather than waiting for hard-to-debug NULL pointer crashes in production. Signed-off-by: Breno Leitao Acked-by: Rik van Riel Signed-off-by: Ard Biesheuvel commit 61ed08c2fd1db0eb43c8b62ade249a3061e39444 Author: Breno Leitao Date: Tue Dec 23 02:55:43 2025 -0800 arm64: efi: Fix NULL pointer dereference by initializing user_ns Linux 6.19-rc2 (9448598b22c5 ("Linux 6.19-rc2")) is crashing with a NULL pointer dereference on arm64 hosts: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c8 pc : cap_capable (security/commoncap.c:82 security/commoncap.c:128) Call trace: cap_capable (security/commoncap.c:82 security/commoncap.c:128) (P) security_capable (security/security.c:?) ns_capable_noaudit (kernel/capability.c:342 kernel/capability.c:381) __ptrace_may_access (./include/linux/rcupdate.h:895 kernel/ptrace.c:326) ptrace_may_access (kernel/ptrace.c:353) do_task_stat (fs/proc/array.c:467) proc_tgid_stat (fs/proc/array.c:673) proc_single_show (fs/proc/base.c:803) I've bissected the problem to commit a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption"). >From my analyzes, the crash occurs because efi_mm lacks a user_ns field initialization. This was previously harmless, but commit a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") changed the EFI runtime call path to use kthread_use_mm(&efi_mm), which temporarily adopts efi_mm as the current mm for the calling kthread. When a thread has an active mm, LSM hooks like cap_capable() expect mm->user_ns to be valid for credential checks. With efi_mm.user_ns being NULL, capability checks during possible /proc access dereference the NULL pointer and crash. Fix by initializing efi_mm.user_ns to &init_user_ns. Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") Signed-off-by: Breno Leitao Acked-by: Rik van Riel Signed-off-by: Ard Biesheuvel commit 5688e977ed2b98b2f881cdf2b1306a7bb2ba5018 Author: Hans de Goede Date: Tue Dec 23 11:10:46 2025 +0100 efi/libstub: gop: Fix EDID support in mixed-mode The efi_edid_discovered_protocol and efi_edid_active_protocol have mixed mode fields. So all their attributes should be accessed through the efi_table_attr() helper. Doing so fixes the upper 32 bits of the 64 bit gop_edid pointer getting set to random values (followed by a crash at boot) when booting a x86_64 kernel on a machine with 32 bit UEFI like the Asus T100TA. Fixes: 17029cdd8f9d ("efi/libstub: gop: Add support for reading EDID") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Signed-off-by: Hans de Goede Signed-off-by: Ard Biesheuvel commit eb067401879118677d37d7dda2e6a75db475f825 Author: Namhyung Kim Date: Mon Dec 22 14:57:16 2025 -0800 tools headers: Sync syscall table with kernel sources To pick up changes from: b36d4b6aa88ef039 ("arch: hookup listns() system call") This should be used to beautify the syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h diff -u tools/scripts/syscall.tbl scripts/syscall.tbl diff -u tools/perf/arch/x86/entry/syscalls/syscall_32.tbl arch/x86/entry/syscalls/syscall_32.tbl diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl arch/mips/kernel/syscalls/syscall_n64.tbl diff -u tools/perf/arch/arm/entry/syscalls/syscall.tbl arch/arm/tools/syscall.tbl diff -u tools/perf/arch/sh/entry/syscalls/syscall.tbl arch/sh/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/sparc/entry/syscalls/syscall.tbl arch/sparc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/xtensa/entry/syscalls/syscall.tbl arch/xtensa/kernel/syscalls/syscall.tbl Please see tools/include/uapi/README. Note that s390 syscall table is still out of sync as it switches to use the generic table. But I'd like to minimize the change in this commit. Cc: linux-arch@vger.kernel.org Signed-off-by: Namhyung Kim commit 00a7e470a59740a4eaf28fc0fd2020c1872f9fc3 Author: Namhyung Kim Date: Mon Dec 22 14:57:15 2025 -0800 tools headers: Sync linux/socket.h with kernel sources To pick up changes from: d73c167708739137 ("socket: Split out a getsockname helper for io_uring") 4677e78800bbde62 ("socket: Unify getsockname and getpeername implementation") bf33247a90d3e85d ("net: Add struct sockaddr_unsized for sockaddr of unknown length") This should be used to beautify socket syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Please see tools/include/uapi/README. Cc: netdev@vger.kernel.org Signed-off-by: Namhyung Kim commit d0783e1fb83bf813f606fcc3254e93428654a34b Author: Namhyung Kim Date: Mon Dec 22 14:57:14 2025 -0800 tools headers: Sync linux/gfp_types.h with kernel sources To pick up changes from: 4c0a17e28340e458 ("slab: prevent recursive kmalloc() in alloc_empty_sheaf()") This would be used to handle GFP masks in the perf code and address these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/linux/gfp_types.h include/linux/gfp_types.h Please see tools/include/uapi/README. Acked-by: SeongJae Park Cc: linux-mm@kvack.org Signed-off-by: Namhyung Kim commit 0d5d3bb6cef48bbf7dbff2354acb891216102c0d Author: Namhyung Kim Date: Mon Dec 22 14:57:13 2025 -0800 tools headers: Sync arm64 headers with kernel sources To pick up changes from: b0a3f0e894f34e01 ("arm64/sysreg: Replace TCR_EL1 field macros") 3bbf004c4808e2c3 ("arm64: cputype: Add Neoverse-V3AE definitions") e185c8a0d84236d1 ("arm64: cputype: Add NVIDIA Olympus definitions") 52b49bd6de29a89a ("arm64: cputype: Remove duplicate Cortex-X1C definitions") This should address these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/arm64/include/asm/cputype.h arch/arm64/include/asm/cputype.h Please see tools/include/uapi/README. Note that this is still out of sync due to is_midr_in_range_list(). Reviewed-by: Leo Yan Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Namhyung Kim commit 369e91bd201d15a711f952ee9ac253a8b91628a3 Author: Namhyung Kim Date: Mon Dec 22 14:57:12 2025 -0800 tools headers: Sync x86 headers with kernel sources To pick up changes from: 54de197c9a5e8f52 ("Merge tag 'x86_sgx_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip") 679fcce0028bf101 ("Merge tag 'kvm-x86-svm-6.19' of https://github.com/kvm-x86/linux into HEAD") 3767def18f4cc394 ("x86/cpufeatures: Add support for L3 Smart Data Cache Injection Allocation Enforcement") f6106d41ec84e552 ("x86/bugs: Use an x86 feature to track the MMIO Stale Data mitigation") 7baadd463e147fdc ("x86/cpufeatures: Enumerate the LASS feature bits") 47955b58cf9b97fe ("x86/cpufeatures: Correct LKGS feature flag description") 5d0316e25defee47 ("x86/cpufeatures: Add X86_FEATURE_X2AVIC_EXT") 6ffdb49101f02313 ("x86/cpufeatures: Add X86_FEATURE_SGX_EUPDATESVN feature flag") 4793f990ea152330 ("KVM: x86: Advertise EferLmsleUnsupported to userspace") bb5f13df3c455110 ("perf/x86/intel: Add counter group support for arch-PEBS") 52448a0a739002ec ("perf/x86/intel: Setup PEBS data configuration and enable legacy groups") d21954c8a0ffbc94 ("perf/x86/intel: Process arch-PEBS records or record fragments") bffeb2fd0b9c99d8 ("x86/microcode/intel: Enable staging when available") 740144bc6bde9d44 ("x86/microcode/intel: Establish staging control logic") This should address these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Please see tools/include/uapi/README. Cc: x86@kernel.org Signed-off-by: Namhyung Kim commit c482993189df0bd5c7fda6c4a018ed1b8d85e9cf Author: Namhyung Kim Date: Mon Dec 22 14:57:11 2025 -0800 tools headers: Sync UAPI sound/asound.h with kernel sources To pick up changes from: 9a97857db0c5655b ("ALSA: uapi: Fix typo in asound.h comment") This should address these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/sound/asound.h include/uapi/sound/asound.h Please see tools/include/uapi/README. Cc: linux-sound@vger.kernel.org Signed-off-by: Namhyung Kim commit 45e07a6f3a19c8d8502e16bb4189ba9bee57f361 Author: Namhyung Kim Date: Mon Dec 22 14:57:10 2025 -0800 tools headers: Sync UAPI linux/mount.h with kernel sources To pick up changes from: 78f0e33cd6c939a5 ("fs/namespace: correctly handle errors returned by grab_requested_mnt_ns") This should be used to beautify mount syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/mount.h include/uapi/linux/mount.h Please see tools/include/uapi/README. Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit 4bd8d145731fb30d3e392db723e18feeb864706e Author: Namhyung Kim Date: Mon Dec 22 14:57:09 2025 -0800 tools headers: Sync UAPI linux/fs.h with kernel sources To pick up changes from: b30ffcdc0c15a88f ("block: introduce BLKREPORTZONESV2 ioctl") 0d8627cc936de8ea ("blktrace: add definitions for blk_user_trace_setup2") This should be used to beautify ioctl syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h Please see tools/include/uapi/README. Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit 673293eadbe9d0be5d11c5610472026852521d09 Author: Namhyung Kim Date: Mon Dec 22 14:57:08 2025 -0800 tools headers: Sync UAPI linux/fcntl.h with kernel sources To pick up changes from: fe93446b5ebdaa89 ("vfs: use UAPI types for new struct delegation definition") 4be9e04ebf75a5c4 ("vfs: add needed headers for new struct delegation definition") 1602bad16d7df82f ("vfs: expose delegation support to userland") This should be used to beautify fcntl syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fcntl.h include/uapi/linux/fcntl.h Please see tools/include/uapi/README. Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit 34524cde88c9137ef134df25ded59520c2fb307a Author: Namhyung Kim Date: Mon Dec 22 14:57:07 2025 -0800 tools headers: Sync UAPI KVM headers with kernel sources To pick up changes from: ad9c62bd8946621e ("KVM: arm64: VM exit to userspace to handle SEA") 8e8678e740ecde2a ("KVM: s390: Add capability that forwards operation exceptions") e0c26d47def7382d ("Merge tag 'kvm-s390-next-6.19-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD") 7a61d61396b97fd6 ("KVM: SEV: Publish supported SEV-SNP policy bits") This should be used to beautify DRM syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README. Cc: kvm@vger.kernel.org Signed-off-by: Namhyung Kim commit be6c9e82c99963a8d603c56ac74d03c1537cd5a2 Author: Namhyung Kim Date: Mon Dec 22 14:57:06 2025 -0800 tools headers: Sync UAPI drm/drm.h with kernel sources To pick up changes from: 179ab8e7d7b378f1 ("drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE") This should be used to beautify DRM syscall arguments and it addresses these tools/perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/drm/drm.h include/uapi/drm/drm.h Please see tools/include/uapi/README. Cc: dri-devel@lists.freedesktop.org Signed-off-by: Namhyung Kim commit ccd1cdca5cd433c8a5dff78b69a79b31d9b77ee1 Merge: ce93692d681e89 913f7cf77bf14c Author: Linus Torvalds Date: Wed Dec 24 09:23:04 2025 -0800 Merge tag 'nfsd-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "A set of NFSD fixes that arrived just a bit late for the 6.19 merge window. Regression fixes: - Mark variable __maybe_unused to avoid W=1 build break Stable fixes: - NFSv4 file creation neglects setting ACL - Clear TIME_DELEG in the suppattr_exclcreat bitmap - Clear SECLABEL in the suppattr_exclcreat bitmap - Fix memory leak in nfsd_create_serv error paths - Bound check rq_pages index in inline path - Return 0 on success from svc_rdma_copy_inline_range - Use rc_pageoff for memcpy byte offset - Avoid NULL deref on zero length gss_token in gss_read_proxy_verf" * tag 'nfsd-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: NFSv4 file creation neglects setting ACL NFSD: Clear TIME_DELEG in the suppattr_exclcreat bitmap NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap nfsd: fix memory leak in nfsd_create_serv error paths nfsd: Mark variable __maybe_unused to avoid W=1 build break svcrdma: bound check rq_pages index in inline path svcrdma: return 0 on success from svc_rdma_copy_inline_range svcrdma: use rc_pageoff for memcpy byte offset SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf commit ce93692d681e89d2c31aacedb055c4638deb1be9 Merge: ebb8719c1a7dd3 4012d78562193e Author: Linus Torvalds Date: Wed Dec 24 09:15:30 2025 -0800 Merge tag 'erofs-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fix from Gao Xiang: "Junbeom reported that synchronous reads could hit unintended EIOs under memory pressure due to incorrect error propagation in z_erofs_decompress_queue(), where earlier physical clusters in the same decompression queue may be served for another readahead. This addresses the issue by decompressing each physical cluster independently as long as disk I/Os succeed, rather than being impacted by the error status of previous physical clusters in the same queue. Summary: - Fix unexpected EIOs under memory pressure caused by recent incorrect error propagation logic" * tag 'erofs-for-6.19-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix unexpected EIO under memory pressure commit cb6d5aa9c0f10074f1ad056c3e2278ad2cc7ec8d Author: Zilin Guan Date: Wed Dec 24 15:21:42 2025 +0000 cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the newly allocated new_password and new_password2. This causes both a memory leak and a potential information leak. Fix this by calling kfree_sensitive() on both password buffers before returning in this error case. Fixes: 0f0e357902957 ("cifs: during remount, make sure passwords are in sync") Signed-off-by: Zilin Guan Reviewed-by: ChenXiaoSong Signed-off-by: Steve French commit 66691e272e40c91305f1704695e0cb340cd162ff Author: Evan Lambert Date: Wed Dec 24 12:44:22 2025 +0000 drm/msm: Replace unsafe snprintf usage with scnprintf The refill_buf function uses snprintf to append to a fixed-size buffer. snprintf returns the length that would have been written, which can exceed the remaining buffer size. If this happens, ptr advances beyond the buffer and rem becomes negative. In the 2nd iteration, rem is treated as a large unsigned integer, causing snprintf to write oob. While this behavior is technically mitigated by num_perfcntrs being locked at 5, it's still unsafe if num_perfcntrs were ever to change/a second source was added. Signed-off-by: Evan Lambert Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/696358/ Link: https://lore.kernel.org/r/20251224124254.17920-3-veyga@veygax.dev Signed-off-by: Dmitry Baryshkov commit d8ee3cfdc89b75dc059dc21c27bef2c1440f67eb Author: Stefano Garzarella Date: Wed Nov 26 14:38:26 2025 +0100 vhost/vsock: improve RCU read sections around vhost_vsock_get() vhost_vsock_get() uses hash_for_each_possible_rcu() to find the `vhost_vsock` associated with the `guest_cid`. hash_for_each_possible_rcu() should only be called within an RCU read section, as mentioned in the following comment in include/linux/rculist.h: /** * hlist_for_each_entry_rcu - iterate over rcu list of given type * @pos: the type * to use as a loop cursor. * @head: the head for your list. * @member: the name of the hlist_node within the struct. * @cond: optional lockdep expression if called from non-RCU protection. * * This list-traversal primitive may safely run concurrently with * the _rcu list-mutation primitives such as hlist_add_head_rcu() * as long as the traversal is guarded by rcu_read_lock(). */ Currently, all calls to vhost_vsock_get() are between rcu_read_lock() and rcu_read_unlock() except for calls in vhost_vsock_set_cid() and vhost_vsock_reset_orphans(). In both cases, the current code is safe, but we can make improvements to make it more robust. About vhost_vsock_set_cid(), when building the kernel with CONFIG_PROVE_RCU_LIST enabled, we get the following RCU warning when the user space issues `ioctl(dev, VHOST_VSOCK_SET_GUEST_CID, ...)` : WARNING: suspicious RCU usage 6.18.0-rc7 #62 Not tainted ----------------------------- drivers/vhost/vsock.c:74 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by rpc-libvirtd/3443: #0: ffffffffc05032a8 (vhost_vsock_mutex){+.+.}-{4:4}, at: vhost_vsock_dev_ioctl+0x2ff/0x530 [vhost_vsock] stack backtrace: CPU: 2 UID: 0 PID: 3443 Comm: rpc-libvirtd Not tainted 6.18.0-rc7 #62 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-7.fc42 06/10/2025 Call Trace: dump_stack_lvl+0x75/0xb0 dump_stack+0x14/0x1a lockdep_rcu_suspicious.cold+0x4e/0x97 vhost_vsock_get+0x8f/0xa0 [vhost_vsock] vhost_vsock_dev_ioctl+0x307/0x530 [vhost_vsock] __x64_sys_ioctl+0x4f2/0xa00 x64_sys_call+0xed0/0x1da0 do_syscall_64+0x73/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... This is not a real problem, because the vhost_vsock_get() caller, i.e. vhost_vsock_set_cid(), holds the `vhost_vsock_mutex` used by the hash table writers. Anyway, to prevent that warning, add lockdep_is_held() condition to hash_for_each_possible_rcu() to verify that either the caller is in an RCU read section or `vhost_vsock_mutex` is held when CONFIG_PROVE_RCU_LIST is enabled; and also clarify the comment for vhost_vsock_get() to better describe the locking requirements and the scope of the returned pointer validity. About vhost_vsock_reset_orphans(), currently this function is only called via vsock_for_each_connected_socket(), which holds the `vsock_table_lock` spinlock (which is also an RCU read-side critical section). However, add an explicit RCU read lock there to make the code more robust and explicit about the RCU requirements, and to prevent issues if the calling context changes in the future or if vhost_vsock_reset_orphans() is called from other contexts. Fixes: 834e772c8db0 ("vhost/vsock: fix use-after-free in network stack callers") Cc: stefanha@redhat.com Signed-off-by: Stefano Garzarella Reviewed-by: Stefan Hajnoczi Message-Id: <20251126133826.142496-1-sgarzare@redhat.com> Message-ID: <20251126210313.GA499503@fedora> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 7f81878b046a432837a7de3017f69092ffe8c4c4 Author: Michael S. Tsirkin Date: Thu Dec 4 13:37:07 2025 -0500 tools/virtio: add device, device_driver stubs Add stubs needed by virtio.h Message-ID: <0fabf13f6ea812ebc73b1c919fb17d4dec1545db.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 39cfe193f3b10480fb1f157cdfae1f3950934d90 Author: Michael S. Tsirkin Date: Thu Dec 4 12:55:11 2025 -0500 tools/virtio: fix up oot build oot build tends to help uncover bugs so it's worth keeping around, as long as it's low effort. add stubs for a couple of macros virtio gained recently, and disable vdpa in the test build. Message-ID: <33968faa7994b86d1f78057358a50b8f460c7a23.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit e88dfb93311c81359b00c12e0b396bd0ea13ad6c Author: Michael S. Tsirkin Date: Thu Dec 4 12:49:34 2025 -0500 virtio_features: make it self-contained virtio_features.h uses WARN_ON_ONCE and memset so it must include linux/bug.h and linux/string.h Message-ID: <579986aa9b8d023844990d2a0e267382f8ad85d5.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit cec9c5e385f6cf056365ec197433fc5448b30985 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:38 2025 -0500 tools/virtio: switch to kernel's virtio_config.h Drops stubs in virtio_config.h, use the kernel's version instead - we are now activly developing it, so the stub became too hard to maintain. Message-ID: <8e5c85dc8aad001f161f7e2d8799ffbccfc31381.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit b0fe545b3c64b327b1ef56ee57def6e1afa470a8 Author: Michael S. Tsirkin Date: Thu Dec 4 12:25:17 2025 -0500 tools/virtio: stub might_sleep and synchronize_rcu Add might_sleep() and synchronize_rcu() stubs needed by virtio_config.h. might_sleep() is a no-op, synchronize_rcu doesn't work but we don't need it to. Created using Cursor CLI. Message-ID: <5557e026335d808acd7b890693ee1382e73dd33a.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit a2f964c45b355cabdb70ecc48ef3cc8b19afaa80 Author: Michael S. Tsirkin Date: Thu Dec 4 12:25:15 2025 -0500 tools/virtio: add struct cpumask to cpumask.h Add struct cpumask stub used by virtio_config.h. Created using Cursor CLI. Message-ID: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 4e949e77fa5e335ff32f177fd37d3e469fd396f9 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:43 2025 -0500 tools/virtio: pass KCFLAGS to module build Update the mod target to pass KCFLAGS with the in-tree vhost driver include path. This way vhost_test can find vhost headers. Created using Cursor CLI. Message-ID: <5473e5a5dfd2fcd261a778f2017cac669c031f23.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit b6600eff0559ef69479cf6b7dccafddf451c6842 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:40 2025 -0500 tools/virtio: add ucopysize.h stub Add ucopysize.h with stub implementations of check_object_size, copy_overflow, and check_copy_size. Created using Cursor CLI. Message-ID: <5046df90002bb744609248404b81d33b559fe813.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit c53ad75c6236acd22a613fbcde862d3d6d2f8072 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:36 2025 -0500 tools/virtio: add dev_WARN_ONCE and is_vmalloc_addr stubs Add dev_WARN_ONCE and is_vmalloc_addr stubs needed by virtio_ring.c. is_vmalloc_addr stub always returns false - that's fine since it's merely a sanity check. Created using Cursor CLI. Message-ID: <749e7a03b7cd56baf50a27efc3b05e50cf8f36b6.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 03d768a38cead828963c0e203662b8fa4c1f4d21 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:34 2025 -0500 tools/virtio: stub DMA mapping functions Add dma_map_page_attrs and dma_unmap_page_attrs stubs. Follow the same pattern as existing DMA mapping stubs. Created using Cursor CLI. Message-ID: <3512df1fe0e2129ea493434a21c940c50381cc93.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 42059e68eaffe29f15e3e76b4536dbf368a501fb Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:32 2025 -0500 tools/virtio: add struct module forward declaration Declarate struct module in our linux/module.h stub. Created using Cursor CLI. Message-ID: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 16fe720f1d2a6fb8b53539d44d7a5566ec657240 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:31 2025 -0500 tools/virtio: use kernel's virtio.h Replace virtio stubs with an include of the kernel header. Message-ID: <33daf1033fc447eb8e3e54d21013ccfd99550e37.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit f059588c552746e0fe299214f35c58effa715b74 Author: Michael S. Tsirkin Date: Thu Dec 4 13:31:52 2025 -0500 virtio: make it self-contained virtio.h uses struct module, add a forward declaration to make the header self-contained. Message-ID: <9171b5cac60793eb59ab044c96ee038bf1363bee.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 94fb5e796ad7d72f66e893da37593f8856657251 Author: Michael S. Tsirkin Date: Thu Dec 4 12:22:28 2025 -0500 tools/virtio: fix up compiler.h stub Add #undef __user before and after including compiler_types.h to avoid redefinition warnings when compiling with system headers that also define __user. This allows tools/virtio to build without warnings. Additionally, stub out __must_check Created using Cursor CLI. Message-ID: <56424ce95c72cb4957070a7cd3c3c40ad5addaee.1764873799.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 78c850021d36d43401de2fb4758f02df93266a6f Merge: 3dd57ddec9e3a9 5c56afd204ad26 Author: Christian Brauner Date: Wed Dec 24 13:58:10 2025 +0100 Merge patch series "Fix two regressions from start_creating()/start_removing() conversion" Tyler Hicks says: When running the eCryptfs test suite on v6.19-rc2, I noticed BUG splats from every test and that the umount utility was segfaulting when tearing down after a test. Bisection led me to commit f046fbb4d81d ("ecryptfs: use new start_creating/start_removing APIs"). This patch series addresses that regression and also a mknod problem spotted during code review. * patches from https://patch.msgid.link/20251223194153.2818445-1-code@tyhicks.com: ecryptfs: Release lower parent dentry after creating dir ecryptfs: Fix improper mknod pairing of start_creating()/end_removing() Link: https://patch.msgid.link/20251223194153.2818445-1-code@tyhicks.com Signed-off-by: Christian Brauner commit 5c56afd204ad266d23889ee8823fb65b2c3b63da Author: Tyler Hicks Date: Tue Dec 23 13:41:53 2025 -0600 ecryptfs: Release lower parent dentry after creating dir Fix a mkdir-induced usage count imbalance that tripped a umount_check() BUG while unmounting the lower filesystem. Commit f046fbb4d81d ("ecryptfs: use new start_creating/start_removing APIs") added a new dget() of the lower parent dir, in ecryptfs_mkdir(), but did not dput() the dentry before returning from that function. The BUG output as seen while running the eCryptfs test suite: $ ./run_tests.sh -b 131072 -c safe,destructive -f ext4 -K -t lp-926292.sh ... Running eCryptfs filesystem tests on ext4 lp-926292 ------------[ cut here ]------------ BUG: Dentry ffff8e6692d11988{i=c,n=ECRYPTFS_FNEK_ENCRYPTED.FXZuRGZL7QAFtER.JeA46DtdKqkkQx9H2Vpmv234J5CU8YSsrUwZJK4AbXbrN5WkZ348wnqstovKKxA-} still in use (1) [unmount of ext4 loop0] WARNING: CPU: 7 PID: 950 at fs/dcache.c:1590 umount_check+0x5e/0x80 Modules linked in: md5 libmd5 ecryptfs encrypted_keys ext4 crc16 mbcache jbd2 CPU: 7 UID: 0 PID: 950 Comm: umount Not tainted 6.18.0-rc1-00013-gf046fbb4d81d #17 PREEMPT(full) Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:umount_check+0x5e/0x80 Code: 88 38 06 00 00 48 8b 40 28 4c 8b 08 48 8b 46 68 48 85 c0 74 04 48 8b 50 38 51 48 c7 c7 60 32 9c b5 48 89 f1 e8 43 5e ca ff 90 <0f> 0b 90 90 58 31 c0 e9 46 9d 6c 00 41 83 f8 01 75 b8 eb a3 66 66 RSP: 0018:ffffa19940c4bdd0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8e6692fad4c0 RCX: 0000000000000000 RDX: 0000000000000004 RSI: ffffa19940c4bc70 RDI: 00000000ffffffff RBP: ffffffffb4eb5930 R08: 00000000ffffdfff R09: 0000000000000001 R10: 00000000ffffdfff R11: ffffffffb5c8a9e0 R12: ffff8e6692fad4c0 R13: ffff8e6692fad4c0 R14: ffff8e6692d11a40 R15: ffff8e6692d11988 FS: 00007f6b4b491800(0000) GS:ffff8e670506e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6b4b5f8d40 CR3: 0000000114eb7001 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: d_walk+0xfd/0x370 shrink_dcache_for_umount+0x4d/0x140 generic_shutdown_super+0x20/0x160 kill_block_super+0x1a/0x40 ext4_kill_sb+0x22/0x40 [ext4] deactivate_locked_super+0x33/0xa0 cleanup_mnt+0xba/0x150 task_work_run+0x5c/0xa0 exit_to_user_mode_loop+0xac/0xb0 do_syscall_64+0x2ab/0xfa0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6b4b6c2a2b Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 b9 83 0d 00 f7 d8 RSP: 002b:00007ffcd5b8b498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 000055b84af0b9e0 RCX: 00007f6b4b6c2a2b RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000055b84af0bdf0 RBP: 00007ffcd5b8b570 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000103 R11: 0000000000000246 R12: 000055b84af0bae0 R13: 0000000000000000 R14: 000055b84af0bdf0 R15: 0000000000000000 ---[ end trace 0000000000000000 ]--- EXT4-fs (loop0): unmounting filesystem 00d9ea41-f61e-43d0-a449-6be03e7e8428. EXT4-fs (loop0): sb orphan head is 12 sb_info orphan list: inode loop0:12 at ffff8e66950e1df0: mode 40700, nlink 0, next 0 Assertion failure in ext4_put_super() at fs/ext4/super.c:1345: 'list_empty(&sbi->s_orphan)' Fixes: f046fbb4d81d ("ecryptfs: use new start_creating/start_removing APIs") Signed-off-by: Tyler Hicks Link: https://patch.msgid.link/20251223194153.2818445-3-code@tyhicks.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5f9ad16bccd351321d9cd65726fd09390d34b06c Author: Tyler Hicks Date: Tue Dec 23 13:41:52 2025 -0600 ecryptfs: Fix improper mknod pairing of start_creating()/end_removing() The ecryptfs_start_creating_dentry() function must be paired with the end_creating() function. Fix ecryptfs_mknod() so that end_creating() is properly called in the return path, instead of end_removing(). Fixes: f046fbb4d81d ("ecryptfs: use new start_creating/start_removing APIs") Signed-off-by: Tyler Hicks Link: https://patch.msgid.link/20251223194153.2818445-2-code@tyhicks.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 3dd57ddec9e3a98387196a3f53b8c036977d8c0f Author: Al Viro Date: Tue Dec 16 08:19:39 2025 +0000 get rid of bogus __user in struct xattr_args::value The first member of struct xattr_args is declared as __aligned_u64 __user value; which makes no sense whatsoever; __user is a qualifier and what that declaration says is "all struct xattr_args instances have .value _stored_ in user address space, no matter where the rest of the structure happens to be". Something like "int __user *p" stands for "value of p is a pointer to an instance of int that happens to live in user address space"; it says nothing about location of p itself, just as const char *p declares a pointer to unmodifiable char rather than an unmodifiable pointer to char. With xattr_args the intent clearly had been "the 64bit value represents a _pointer_ to object in user address space", but __user has nothing to do with that. All it gets us is a couple of bogus warnings in fs/xattr.c where (userland) instance of xattr_args is copied to local variable of that type (in kernel address space), followed by access to its members. Since we've told sparse that args.value must somehow be located in userland memory, we get warned that looking at that 64bit unsigned integer (in a variable already on kernel stack) is not allowed. Note that sparse has no way to express "this integer shall never be cast into a pointer to be dereferenced directly" and I don't see any way to assign a sane semantics to that. In any case, __user is not it. Signed-off-by: Al Viro Link: https://patch.msgid.link/20251216081939.GQ1712166@ZenIV Signed-off-by: Christian Brauner commit 73a91ef328a9d728c7f3357f925980937f0d520c Author: Bagas Sanjaya Date: Fri Dec 19 09:46:20 2025 +0700 VFS: fix __start_dirop() kernel-doc warnings Sphinx report kernel-doc warnings: WARNING: ./fs/namei.c:2853 function parameter 'state' not described in '__start_dirop' WARNING: ./fs/namei.c:2853 expecting prototype for start_dirop(). Prototype was for __start_dirop() instead Fix them up. Fixes: ff7c4ea11a05c8 ("VFS: add start_creating_killable() and start_removing_killable()") Signed-off-by: Bagas Sanjaya Link: https://patch.msgid.link/20251219024620.22880-3-bagasdotme@gmail.com Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit fe33729d2907415ff953d84673caebca628cbd77 Author: Bagas Sanjaya Date: Fri Dec 19 09:46:19 2025 +0700 fs: Describe @isnew parameter in ilookup5_nowait() Sphinx reports kernel-doc warning: WARNING: ./fs/inode.c:1607 function parameter 'isnew' not described in 'ilookup5_nowait' Describe the parameter. Fixes: a27628f4363435 ("fs: rework I_NEW handling to operate without fences") Signed-off-by: Bagas Sanjaya Link: https://patch.msgid.link/20251219024620.22880-2-bagasdotme@gmail.com Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 46af9ae1305f1025fd9ff7d8945de98a6ec0a52b Author: Mateusz Guzik Date: Sat Dec 20 06:40:22 2025 +0100 fs: make sure to fail try_to_unlazy() and try_to_unlazy() for LOOKUP_CACHED Otherwise the slowpath can be taken by the caller, defeating the flag. This regressed after calls to legitimize_links() started being conditionally elided and stems from the routine always failing after seeing the flag, regardless if there were any links. In order to address both the bug and the weird semantics make it illegal to call legitimize_links() with LOOKUP_CACHED and handle the problem at the two callsites. Fixes: 7c179096e77eca21 ("fs: add predicts based on nd->depth") Reported-by: Chris Mason Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251220054023.142134-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 570ad253a3455a520f03c2136af8714bc780186d Author: David Howells Date: Sat Dec 20 12:31:40 2025 +0000 netfs: Fix early read unlock of page with EOF in middle The read result collection for buffered reads seems to run ahead of the completion of subrequests under some circumstances, as can be seen in the following log snippet: 9p_client_res: client 18446612686390831168 response P9_TREAD tag 0 err 0 ... netfs_sreq: R=00001b55[1] DOWN TERM f=192 s=0 5fb2/5fb2 s=5 e=0 ... netfs_collect_folio: R=00001b55 ix=00004 r=4000-5000 t=4000/5fb2 netfs_folio: i=157f3 ix=00004-00004 read-done netfs_folio: i=157f3 ix=00004-00004 read-unlock netfs_collect_folio: R=00001b55 ix=00005 r=5000-5fb2 t=5000/5fb2 netfs_folio: i=157f3 ix=00005-00005 read-done netfs_folio: i=157f3 ix=00005-00005 read-unlock ... netfs_collect_stream: R=00001b55[0:] cto=5fb2 frn=ffffffff netfs_collect_state: R=00001b55 col=5fb2 cln=6000 n=c netfs_collect_stream: R=00001b55[0:] cto=5fb2 frn=ffffffff netfs_collect_state: R=00001b55 col=5fb2 cln=6000 n=8 ... netfs_sreq: R=00001b55[2] ZERO SUBMT f=000 s=5fb2 0/4e s=0 e=0 netfs_sreq: R=00001b55[2] ZERO TERM f=102 s=5fb2 4e/4e s=5 e=0 The 'cto=5fb2' indicates the collected file pos we've collected results to so far - but we still have 0x4e more bytes to go - so we shouldn't have collected folio ix=00005 yet. The 'ZERO' subreq that clears the tail happens after we unlock the folio, allowing the application to see the uncleared tail through mmap. The problem is that netfs_read_unlock_folios() will unlock a folio in which the amount of read results collected hits EOF position - but the ZERO subreq lies beyond that and so happens after. Fix this by changing the end check to always be the end of the folio and never the end of the file. In the future, I should look at clearing to the end of the folio here rather than adding a ZERO subreq to do this. On the other hand, the ZERO subreq can run in parallel with an async READ subreq. Further, the ZERO subreq may still be necessary to, say, handle extents in a ceph file that don't have any backing store and are thus implicitly all zeros. This can be reproduced by creating a file, the size of which doesn't align to a page boundary, e.g. 24998 (0x5fb2) bytes and then doing something like: xfs_io -c "mmap -r 0 0x6000" -c "madvise -d 0 0x6000" \ -c "mread -v 0 0x6000" /xfstest.test/x The last 0x4e bytes should all be 00, but if the tail hasn't been cleared yet, you may see rubbish there. This can be reproduced with kafs by modifying the kernel to disable the call to netfs_read_subreq_progress() and to stop afs_issue_read() from doing the async call for NETFS_READAHEAD. Reproduction can be made easier by inserting an mdelay(100) in netfs_issue_read() for the ZERO-subreq case. AFS and CIFS are normally unlikely to show this as they dispatch READ ops asynchronously, which allows the ZERO-subreq to finish first. 9P's READ op is completely synchronous, so the ZERO-subreq will always happen after. It isn't seen all the time, though, because the collection may be done in a worker thread. Reported-by: Christian Schoenebeck Link: https://lore.kernel.org/r/8622834.T7Z3S40VBb@weasel/ Signed-off-by: David Howells Link: https://patch.msgid.link/938162.1766233900@warthog.procyon.org.uk Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Tested-by: Christian Schoenebeck Acked-by: Dominique Martinet Suggested-by: Dominique Martinet cc: Dominique Martinet cc: Christian Schoenebeck cc: v9fs@lists.linux.dev cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner commit 60489936aced785ef9e5a865e23a296bd0b470b6 Author: Andreas Kemnade Date: Tue Dec 23 22:51:31 2025 +0100 regulator: fp9931: fix regulator node pointer Sync the driver with the binding. During review process a regulators subnode was requested but neither driver nor test setup was updated. Fixes: 12d821bd13d4 ("regulator: Add FP9931/JD9930 driver") Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20251223-fp9931-fix-v1-1-b19b4c1e7056@kemnade.info Signed-off-by: Mark Brown commit 88733a0b64872357e5ecd82b7488121503cb9cc6 Author: Nikolay Kuratov Date: Thu Dec 11 12:36:30 2025 +0300 drm/msm/dpu: Add missing NULL pointer check for pingpong interface It is checked almost always in dpu_encoder_phys_wb_setup_ctl(), but in a single place the check is missing. Also use convenient locals instead of phys_enc->* where available. Cc: stable@vger.kernel.org Fixes: d7d0e73f7de33 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") Signed-off-by: Nikolay Kuratov Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/693860/ Link: https://lore.kernel.org/r/20251211093630.171014-1-kniv@yandex-team.ru Signed-off-by: Dmitry Baryshkov commit da9168d8ef1cbc5dcd1cee91416bd7b408ca8377 Author: Abel Vesa Date: Fri Dec 19 12:39:02 2025 +0200 Revert "drm/msm/dpu: Enable quad-pipe for DSC and dual-DSI case" This reverts commit d7ec9366b15cd04508fa015cb94d546b1c01edfb. The dual-DSI dual-DSC scenario seems to be broken by this commit. Reported-by: Marijn Suijten Closes: https://lore.kernel.org/r/aUR2b3FOSisTfDFj@SoMainline.org Signed-off-by: Abel Vesa Fixes: d7ec9366b15c ("drm/msm/dpu: Enable quad-pipe for DSC and dual-DSI case") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695550/ Link: https://lore.kernel.org/r/20251219-drm-msm-dpu-revert-quad-pipe-broken-v1-2-654b46505f84@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 35ab5123bd24dcb082d8e7152536bb2bcda5e054 Author: Abel Vesa Date: Fri Dec 19 12:39:01 2025 +0200 Revert "drm/msm/dpu: support plane splitting in quad-pipe case" This reverts commit 5978864e34b66bdae4d7613834c03dd5d0a0c891. At least on Hamoa based devices, there are IOMMU faults: arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x3d0023, cbfrsynra=0x1c00, cb=13 arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x1c00 arm-smmu 15000000.iommu: FSYNR0 = 003d0023 [S1CBNDX=61 PNU PLVL=3] While on some of these devices, there are also all sorts of artifacts on eDP. Reverting this fixes these issues. Closes: https://lore.kernel.org/r/z75wnahrp7lrl5yhfdysr3np3qrs6xti2i4otkng4ex3blfgrx@xyiucge3xykb/ Signed-off-by: Abel Vesa Reviewed-by: Marijn Suijten Fixes: 5978864e34b6 ("drm/msm/dpu: support plane splitting in quad-pipe case") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695549/ Link: https://lore.kernel.org/r/20251219-drm-msm-dpu-revert-quad-pipe-broken-v1-1-654b46505f84@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 7c85da6f63b15b83a7d7ee2565e4020cf904f2e9 Author: Randy Dunlap Date: Fri Dec 19 10:46:38 2025 -0800 drm/msm: msm_iommu.c: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: ../drivers/gpu/drm/msm/msm_iommu.c:381 expecting prototype for alloc_pt(). Prototype was for msm_iommu_pagetable_alloc_pt() instead Warning: ../drivers/gpu/drm/msm/msm_iommu.c:426 expecting prototype for free_pt(). Prototype was for msm_iommu_pagetable_free_pt() instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695675/ Link: https://lore.kernel.org/r/20251219184638.1813181-20-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit cd5697865258d431e261c7a30bfbc43b1ff9bca4 Author: Randy Dunlap Date: Fri Dec 19 10:46:37 2025 -0800 drm/msm: msm_gpu.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/msm_gpu.h:119 Incorrect use of kernel-doc format: * devfreq: devfreq instance Warning: drivers/gpu/drm/msm/msm_gpu.h:125 Incorrect use of kernel-doc format: * idle_freq: Warning: drivers/gpu/drm/msm/msm_gpu.h:136 Incorrect use of kernel-doc format: * boost_constraint: Warning: drivers/gpu/drm/msm/msm_gpu.h:144 Incorrect use of kernel-doc format: * busy_cycles: Last busy counter value, for calculating elapsed busy Warning: drivers/gpu/drm/msm/msm_gpu.h:156 Incorrect use of kernel-doc format: * idle_work: Warning: drivers/gpu/drm/msm/msm_gpu.h:163 Incorrect use of kernel-doc format: * boost_work: Warning: drivers/gpu/drm/msm/msm_gpu.h:170 struct member 'devfreq' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:170 struct member 'boost_freq' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'devfreq' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'lock' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'governor' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'we are continuing to sample busyness and * adjust frequency while the GPU is idle' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'boost_freq' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'busy_cycles' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'time' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'idle_time' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'idle_work' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'boost_work' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:172 struct member 'suspended' not described in 'msm_gpu_devfreq' Warning: drivers/gpu/drm/msm/msm_gpu.h:472 No description found for return value of 'msm_context_is_vmbind' Warning: drivers/gpu/drm/msm/msm_gpu.h:476 struct member 'ref' not described in 'msm_context' Warning: drivers/gpu/drm/msm/msm_gpu.h:476 struct member 'elapsed_ns' not described in 'msm_context' Warning: drivers/gpu/drm/msm/msm_gpu.h:492 expecting prototype for msm_context_is_vm_bind(). Prototype was for msm_context_is_vmbind() instead Warning: drivers/gpu/drm/msm/msm_gpu.h:523 No description found for return value of 'msm_gpu_convert_priority' Warning: drivers/gpu/drm/msm/msm_gpu.h:583 expecting prototype for struct msm_gpu_submitqueues. Prototype was for struct msm_gpu_submitqueue instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695671/ Link: https://lore.kernel.org/r/20251219184638.1813181-19-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 010c98df53ced9077eef7a2eab3f8e55d4e9675b Author: Randy Dunlap Date: Fri Dec 19 10:46:36 2025 -0800 drm/msm: msm_gem_vma.c: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: ../drivers/gpu/drm/msm/msm_gem_vma.c:96 expecting prototype for struct msm_vma_op. Prototype was for struct msm_vm_op instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695679/ Link: https://lore.kernel.org/r/20251219184638.1813181-18-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 4fc510e571615a11e24c2cb20496115ce1a76ba0 Author: Randy Dunlap Date: Fri Dec 19 10:46:35 2025 -0800 drm/msm: msm_fence.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/msm_fence.h:27 Incorrect use of kernel-doc format: * last_fence: Warning: drivers/gpu/drm/msm/msm_fence.h:36 Incorrect use of kernel-doc format: * completed_fence: Warning: drivers/gpu/drm/msm/msm_fence.h:44 Incorrect use of kernel-doc format: * fenceptr: Warning: drivers/gpu/drm/msm/msm_fence.h:65 Incorrect use of kernel-doc format: * next_deadline_fence: Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'dev' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'name' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'context' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'index' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'fence' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'there is no remaining pending work */ uint32_t last_fence' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'updated from the CPU after interrupt * from GPU */ uint32_t completed_fence' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'fenceptr' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'spinlock' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'next_deadline' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'next_deadline_fence' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'deadline_timer' not described in 'msm_fence_context' Warning: drivers/gpu/drm/msm/msm_fence.h:74 struct member 'deadline_work' not described in 'msm_fence_context' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695667/ Link: https://lore.kernel.org/r/20251219184638.1813181-17-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit a6ccad66048aeb75c4e70ad7031ff3c28e249fce Author: Randy Dunlap Date: Fri Dec 19 10:46:34 2025 -0800 drm/msm/dpu: dpu_hw_wb.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.h:24 Cannot find identifier on line: * Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.h:57 struct member 'setup_roi' not described in 'dpu_hw_wb_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.h:75 struct member 'caps' not described in 'dpu_hw_wb' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695672/ Link: https://lore.kernel.org/r/20251219184638.1813181-16-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 3091c572fefd9f09ae2c54d964e6b6b2756c1ba1 Author: Randy Dunlap Date: Fri Dec 19 10:46:33 2025 -0800 drm/msm/dpu: dpu_hw_vbif.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:19 Incorrect use of kernel-doc format: * set_limit_conf - set transaction limit config Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:29 Incorrect use of kernel-doc format: * get_limit_conf - get transaction limit config Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:39 Incorrect use of kernel-doc format: * set_halt_ctrl - set halt control Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:48 Incorrect use of kernel-doc format: * get_halt_ctrl - get halt control Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:57 Incorrect use of kernel-doc format: * set_qos_remap - set QoS priority remap Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:67 Incorrect use of kernel-doc format: * set_mem_type - set memory type Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:76 Incorrect use of kernel-doc format: * clear_errors - clear any vbif errors Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:88 Incorrect use of kernel-doc format: * set_write_gather_en - set write_gather enable Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'limit' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'set_limit_conf' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'get_limit_conf' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'set_halt_ctrl' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'get_halt_ctrl' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'set_qos_remap' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'set_mem_type' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 's' not described in 'dpu_hw_vbif_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_vbif.h:93 struct member 'set_write_gather_en' not described in 'dpu_hw_vbif_ops' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695680/ Link: https://lore.kernel.org/r/20251219184638.1813181-15-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 6e945d518a573db3e257dcdf4c61d1ed1d71c42b Author: Randy Dunlap Date: Fri Dec 19 10:46:32 2025 -0800 drm/msm/dpu: dpu_hw_top.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:93 Incorrect use of kernel-doc format: * setup_traffic_shaper() : Setup traffic shaper control Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:101 Incorrect use of kernel-doc format: * setup_clk_force_ctrl - set clock force control Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:111 Incorrect use of kernel-doc format: * get_danger_status - get danger status Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:119 Incorrect use of kernel-doc format: * setup_vsync_source - setup vsync source configuration details Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:127 Incorrect use of kernel-doc format: * get_safe_status - get safe status Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:135 Incorrect use of kernel-doc format: * dp_phy_intf_sel - configure intf to phy mapping Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:142 Incorrect use of kernel-doc format: * intf_audio_select - select the external interface for audio Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:146 struct member 'setup_clk_force_ctrl' not described in 'dpu_hw_mdp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:146 struct member 'get_danger_status' not described in 'dpu_hw_mdp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:146 struct member 'setup_vsync_source' not described in 'dpu_hw_mdp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:146 struct member 'get_safe_status' not described in 'dpu_hw_mdp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:146 struct member 'dp_phy_intf_sel' not described in 'dpu_hw_mdp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.h:146 struct member 'intf_audio_select' not described in 'dpu_hw_mdp_ops' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695669/ Link: https://lore.kernel.org/r/20251219184638.1813181-14-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit f5a7145d0fb1c0780b0601ef173426fbef8c8a1f Author: Randy Dunlap Date: Fri Dec 19 10:46:31 2025 -0800 drm/msm/dpu: dpu_hw_sspp.h: fix all kernel-doc warnings Modify non-kernel-doc comments to begin with "/*" instead of "/**". Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:17 missing initial short description on line: * Flags Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:19 expecting prototype for Flags(). Prototype was for DPU_SSPP_FLIP_LR() instead Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:26 This comment starts with '/**', but isn't a kernel-doc comment. * Component indices Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:47 cannot understand function prototype: 'enum dpu_sspp_multirect_index' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:152 struct member 'dst_rect' not described in 'dpu_sw_pipe_cfg' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:174 struct member 'multirect_index' not described in 'dpu_sw_pipe' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:174 struct member 'multirect_mode' not described in 'dpu_sw_pipe' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:183 Incorrect use of kernel-doc format: * setup_format - setup pixel format cropping rectangle, flip Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:192 Incorrect use of kernel-doc format: * setup_rects - setup pipe ROI rectangles Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:200 Incorrect use of kernel-doc format: * setup_pe - setup pipe pixel extension Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:208 Incorrect use of kernel-doc format: * setup_sourceaddress - setup pipe source addresses Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:216 Incorrect use of kernel-doc format: * setup_csc - setup color space coversion Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:223 Incorrect use of kernel-doc format: * setup_solidfill - enable/disable colorfill Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:231 Incorrect use of kernel-doc format: * setup_multirect - setup multirect configuration Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:238 Incorrect use of kernel-doc format: * setup_sharpening - setup sharpening Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:247 Incorrect use of kernel-doc format: * setup_qos_lut - setup QoS LUTs Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:255 Incorrect use of kernel-doc format: * setup_qos_ctrl - setup QoS control Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:263 Incorrect use of kernel-doc format: * setup_clk_force_ctrl - setup clock force control Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:271 Incorrect use of kernel-doc format: * setup_histogram - setup histograms Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:279 Incorrect use of kernel-doc format: * setup_scaler - setup scaler Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:288 Incorrect use of kernel-doc format: * setup_cdp - setup client driven prefetch Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_format' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_rects' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_pe' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_sourceaddress' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_csc' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_solidfill' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_multirect' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_sharpening' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_qos_lut' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_qos_ctrl' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_clk_force_ctrl' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_histogram' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_scaler' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:296 struct member 'setup_cdp' not described in 'dpu_hw_sspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.h:320 struct member 'mdss_ver' not described in 'dpu_hw_sspp' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695661/ Link: https://lore.kernel.org/r/20251219184638.1813181-13-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit abc287a76e1c3b641dc2302b658574cf1e660732 Author: Randy Dunlap Date: Fri Dec 19 10:46:30 2025 -0800 drm/msm/dpu: dpu_hw_pingpong.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:36 Cannot find identifier on line: * Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:46 Incorrect use of kernel-doc format: * enables vysnc generation and sets up init value of Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:53 Incorrect use of kernel-doc format: * disables tear check block Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:58 Incorrect use of kernel-doc format: * read, modify, write to either set or clear listening to external TE Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:65 Incorrect use of kernel-doc format: * Obtain current vertical line counter Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:70 Incorrect use of kernel-doc format: * Disable autorefresh if enabled Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:75 Incorrect use of kernel-doc format: * Setup dither matix for pingpong block Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:80 Incorrect use of kernel-doc format: * Enable DSC Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:85 Incorrect use of kernel-doc format: * Disable DSC Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:90 Incorrect use of kernel-doc format: * Setup DSC Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:93 struct member 'connect_external_te' not described in 'dpu_hw_pingpong_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:93 struct member 'disable_autorefresh' not described in 'dpu_hw_pingpong_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:93 struct member 'enable_dsc' not described in 'dpu_hw_pingpong_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:93 struct member 'disable_dsc' not described in 'dpu_hw_pingpong_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_pingpong.h:93 struct member 'setup_dsc' not described in 'dpu_hw_pingpong_ops' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695659/ Link: https://lore.kernel.org/r/20251219184638.1813181-12-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 847c12befab422db8b17f9749d711ba7e2301094 Author: Randy Dunlap Date: Fri Dec 19 10:46:29 2025 -0800 drm/msm/dpu: dpu_hw_merge3d.h: fix all kernel-doc warnings Delete one "empty" kernel-doc line to eliminate a warning: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_merge3d.h:14 Cannot find identifier on line: * Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695673/ Link: https://lore.kernel.org/r/20251219184638.1813181-11-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 7ce9dd5eca99a236634ad2a105a5ffa2c1d8387c Author: Randy Dunlap Date: Fri Dec 19 10:46:28 2025 -0800 drm/msm/dpu: dpu_hw_lm.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:27 Cannot find identifier on line: * Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:52 Incorrect use of kernel-doc format: * Clear layer mixer to pipe configuration Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:59 Incorrect use of kernel-doc format: * Configure layer mixer to pipe configuration Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:69 Incorrect use of kernel-doc format: * setup_border_color : enable/disable border color Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:76 Incorrect use of kernel-doc format: * setup_misr: Enable/disable MISR Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:81 Incorrect use of kernel-doc format: * collect_misr: Read MISR signature Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'setup_mixer_out' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'setup_blend_config' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'setup_alpha_out' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'clear_all_blendstages' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'setup_blendstage' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'setup_border_color' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'setup_misr' not described in 'dpu_hw_lm_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h:84 struct member 'collect_misr' not described in 'dpu_hw_lm_ops' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695648/ Link: https://lore.kernel.org/r/20251219184638.1813181-10-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit f6d754552b55d06c2d7beb857b1afc56f9004423 Author: Randy Dunlap Date: Fri Dec 19 10:46:27 2025 -0800 drm/msm/dpu: dpu_hw_intf.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:76 duplicate section name 'Return' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:112 Incorrect use of kernel-doc format: * Disable autorefresh if enabled Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:118 struct member 'setup_timing_gen' not described in 'dpu_hw_intf_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:118 struct member 'setup_prg_fetch' not described in 'dpu_hw_intf_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:118 struct member 'enable_timing' not described in 'dpu_hw_intf_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:118 struct member 'get_status' not described in 'dpu_hw_intf_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:118 struct member 'get_line_count' not described in 'dpu_hw_intf_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h:118 struct member 'disable_autorefresh' not described in 'dpu_hw_intf_ops' dpu_hw_intf.h:119: warning: Excess struct member 'get_vsync_info' description in 'dpu_hw_intf_ops' dpu_hw_intf.h:119: warning: Excess struct member 'setup_autorefresh' description in 'dpu_hw_intf_ops' dpu_hw_intf.h:119: warning: Excess struct member 'get_autorefresh' description in 'dpu_hw_intf_ops' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695646/ Link: https://lore.kernel.org/r/20251219184638.1813181-9-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 399f4345f07a94d9b3841d4eeedb746686eb478f Author: Randy Dunlap Date: Fri Dec 19 10:46:26 2025 -0800 drm/msm/dpu: dpu_hw_dspp.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.h:33 expecting prototype for struct dpu_hw_pcc. Prototype was for struct dpu_hw_pcc_cfg instead Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.h:42 Incorrect use of kernel-doc format: * setup_pcc - setup dspp pcc Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.h:48 struct member 'setup_pcc' not described in 'dpu_hw_dspp_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.h:76 expecting prototype for dpu_hw_dspp(). Prototype was for to_dpu_hw_dspp() instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695652/ Link: https://lore.kernel.org/r/20251219184638.1813181-8-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 9d22d53ecb1576f7cadec186eac8b91ccba58da8 Author: Randy Dunlap Date: Fri Dec 19 10:46:25 2025 -0800 drm/msm/dpu: dpu_hw_dsc.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:23 Incorrect use of kernel-doc format: * dsc_disable - disable dsc Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:29 Incorrect use of kernel-doc format: * dsc_config - configures dsc encoder Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:41 Incorrect use of kernel-doc format: * dsc_config_thresh - programs panel thresholds Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:50 struct member 'dsc_disable' not described in 'dpu_hw_dsc_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:50 struct member 'dsc_config' not described in 'dpu_hw_dsc_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:50 struct member 'dsc_config_thresh' not described in 'dpu_hw_dsc_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h:50 struct member 'dsc_bind_pingpong_blk' not described in 'dpu_hw_dsc_ops' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695658/ Link: https://lore.kernel.org/r/20251219184638.1813181-7-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 70e66a0c5b1bc1923d6e91c938ed2ce1f12331df Author: Randy Dunlap Date: Fri Dec 19 10:46:24 2025 -0800 drm/msm/dpu: dpu_hw_cwb.h: fix all kernel-doc warnings Correct or add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cwb.h:30 Cannot find identifier on line: * Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cwb.h:61 expecting prototype for dpu_hw_cwb(). Prototype was for to_dpu_hw_cwb() instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695664/ Link: https://lore.kernel.org/r/20251219184638.1813181-6-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 686f6aafd39f0ea075c3bc69c9991a149e82e73e Author: Randy Dunlap Date: Fri Dec 19 10:46:23 2025 -0800 drm/msm/dpu: dpu_hw_ctl.h: fix all kernel-doc warnings Correct and add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:18 cannot understand function prototype: 'enum dpu_ctl_mode_sel' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:58 struct member 'wb' not described in 'dpu_hw_intf_cfg' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:66 Incorrect use of kernel-doc format: * kickoff hw operation for Sw controlled interfaces Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:73 Incorrect use of kernel-doc format: * check if the ctl is started Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:80 Incorrect use of kernel-doc format: * kickoff prepare is in progress hw operation for sw Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:88 Incorrect use of kernel-doc format: * Clear the value of the cached pending_flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:96 Incorrect use of kernel-doc format: * Query the value of the cached pending_flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:103 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:112 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(wb_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:121 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(cwb_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:130 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(intf_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:139 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(periph_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:148 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(merge_3d_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:157 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:166 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:175 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:185 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(dsc_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:194 Incorrect use of kernel-doc format: * OR in the given flushbits to the cached pending_(cdm_)flush_mask Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:202 Incorrect use of kernel-doc format: * Write the value of the pending_flush_mask to hardware Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:208 Incorrect use of kernel-doc format: * Read the value of the flush register Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:215 Incorrect use of kernel-doc format: * Setup ctl_path interface config Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:223 Incorrect use of kernel-doc format: * reset ctl_path interface config Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:244 Incorrect use of kernel-doc format: * Set all blend stages to disabled Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:250 Incorrect use of kernel-doc format: * Configure layer mixer to pipe configuration Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:262 Incorrect use of kernel-doc format: * Set active pipes attached to this CTL Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:270 Incorrect use of kernel-doc format: * Set active layer mixers attached to this CTL Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:277 struct member 'trigger_start' not described in 'dpu_hw_ctl_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:277 struct member 'is_started' not described in 'dpu_hw_ctl_ops' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:277 struct member 'trigger_pending' not described in 'dpu_hw_ctl_ops' [many here] Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:319 struct member 'pending_periph_flush_mask' not described in 'dpu_hw_ctl' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:319 struct member 'pending_merge_3d_flush_mask' not described in 'dpu_hw_ctl' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:319 struct member 'pending_dspp_flush_mask' not described in 'dpu_hw_ctl' Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h:327 expecting prototype for dpu_hw_ctl(). Prototype was for to_dpu_hw_ctl() instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695649/ Link: https://lore.kernel.org/r/20251219184638.1813181-5-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit ce26953807ee2a7e9f2a70eeaca249f81fd2b473 Author: Randy Dunlap Date: Fri Dec 19 10:46:22 2025 -0800 drm/msm/dpu: dpu_hw_cdm.h: fix all kernel-doc warnings Correct and add kernel-doc comments to eliminate all warnings: Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.h:91 Incorrect use of kernel-doc format: * Enable the CDM module Warning: drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.h:97 Incorrect use of kernel-doc format: * Enable/disable the connection with pingpong Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695651/ Link: https://lore.kernel.org/r/20251219184638.1813181-4-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit 23bee889e33d72e8d764b435adc6cc0e8a345e94 Author: Randy Dunlap Date: Fri Dec 19 10:46:21 2025 -0800 drm/msm/dp: fix all kernel-doc warnings Correct and add kernel-doc comments to eliminate all warnings: Warning: ../drivers/gpu/drm/msm/dp/dp_debug.h:31 expecting prototype for msm_dp_debug_get(). Prototype was for msm_dp_debug_init() instead Warning: ../drivers/gpu/drm/msm/dp/dp_drm.c:24 function parameter 'connector' not described in 'msm_dp_bridge_detect' Warning: ../drivers/gpu/drm/msm/dp/dp_link.h:90 expecting prototype for mdss_dp_test_bit_depth_to_bpp(). Prototype was for msm_dp_link_bit_depth_to_bpp() instead Warning: ../drivers/gpu/drm/msm/dp/dp_link.h:126 function parameter 'aux' not described in 'msm_dp_link_get' Warning: ../drivers/gpu/drm/msm/dp/dp_link.h:126 function parameter 'dev' not described in 'msm_dp_link_get' Warning: ../drivers/gpu/drm/msm/dp/dp_panel.h:70 function parameter 'bw_code' not described in 'is_link_rate_valid' Warning: ../drivers/gpu/drm/msm/dp/dp_panel.h:84 expecting prototype for msm_dp_link_is_lane_count_valid(). Prototype was for is_lane_count_valid() instead Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695647/ Link: https://lore.kernel.org/r/20251219184638.1813181-3-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit a50d8777159ad8ec932d5bbe0fe30a3815b63cfc Author: Randy Dunlap Date: Fri Dec 19 10:46:20 2025 -0800 drm/msm/disp: mdp_format: fix all kernel-doc warnings Correct and add kernel-doc comments to eliminate all warnings: Warning: ../drivers/gpu/drm/msm/disp/mdp_format.h:27 This comment starts with '/**', but isn't a kernel-doc comment. Warning: ../drivers/gpu/drm/msm/disp/mdp_format.h:64 struct member 'bpc_a' not described in 'msm_format' Warning: ../drivers/gpu/drm/msm/disp/mdp_format.h:64 struct member 'bpc_b_cb' not described in 'msm_format' Warning: ../drivers/gpu/drm/msm/disp/mdp_format.h:64 struct member 'bpc_g_y' not described in 'msm_format' Warning: ../drivers/gpu/drm/msm/disp/mdp_format.h:64 struct member 'bpc_r_cr' not described in 'msm_format' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/695650/ Link: https://lore.kernel.org/r/20251219184638.1813181-2-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit b246caa68037aa495390a60d080acaeb84f45fff Author: Wayne Chang Date: Fri Dec 12 11:21:16 2025 +0800 phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 The USB2 Bias Pad Control register manages analog parameters for signal detection. Previously, the HS_DISCON_LEVEL relied on hardware reset values, which may lead to the detection failure. Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect threshold is sufficient to guarantee reliable detection. Fixes: bbf711682cd5 ("phy: tegra: xusb: Add Tegra186 support") Cc: stable@vger.kernel.org Signed-off-by: Wayne Chang Link: https://patch.msgid.link/20251212032116.768307-1-waynec@nvidia.com Signed-off-by: Vinod Koul commit 193120dddd1a1f3dcae164289498588fa0544d78 Author: David Matlack Date: Fri Dec 19 23:38:18 2025 +0000 vfio: selftests: Drop includes Drop the includes now that (tools/include/linux/types.h) has a definition for __aligned_le64, which is needed by . Including is harmless but causes benign typedef redefinitions. This is not a problem for VFIO selftests but becomes an issue when the VFIO selftests library is built into KVM selftests, since they are built with -std=gnu99 which does not allow typedef redifitions. No functional change intended. Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251219233818.1965306-3-dmatlack@google.com Signed-off-by: Alex Williamson commit 30fb98ec34d3c14cb748714ea3179b597604a1d4 Author: David Matlack Date: Fri Dec 19 23:38:17 2025 +0000 tools include: Add definitions for __aligned_{l,b}e64 Add definitions for the missing __aligned_le64 and __aligned_be64 to tools/include/linux/types.h. The former is needed by for builds where tools/include/ is on the include path ahead of usr/include/. Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251219233818.1965306-2-dmatlack@google.com Signed-off-by: Alex Williamson commit 1e91505038823e51b98d1a63660606307202d5b6 Author: Michal Wajdeczko Date: Thu Dec 18 21:51:06 2025 +0100 vfio/xe: Add default handler for .get_region_info_caps New requirement for the vfio drivers was added by the commit f97859503859 ("vfio: Require drivers to implement get_region_info") followed by commit 1b0ecb5baf4a ("vfio/pci: Convert all PCI drivers to get_region_info_caps") that was missed by the new vfio/xe driver. Add handler for .get_region_info_caps to avoid -EINVAL errors. Fixes: 2e38c50ae492 ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Signed-off-by: Michal Wajdeczko Reviewed-by: Marcin Bernatowicz Tested-by: Marcin Bernatowicz Link: https://lore.kernel.org/r/20251218205106.4578-1-michal.wajdeczko@intel.com Signed-off-by: Alex Williamson commit 8bb808cea3016c11c39e6c7f40a2f772e2eed3fe Author: Kevin Tian Date: Thu Dec 18 08:16:50 2025 +0000 vfio/pci: Disable qword access to the VGA region Seems no reason to allow qword access to the old VGA resource. Better restrict it to dword access as before. Suggested-by: Alex Williamson Signed-off-by: Kevin Tian Link: https://lore.kernel.org/r/20251218081650.555015-3-kevin.tian@intel.com Signed-off-by: Alex Williamson commit dc85a46928c41423ad89869baf05a589e2975575 Author: Kevin Tian Date: Thu Dec 18 08:16:49 2025 +0000 vfio/pci: Disable qword access to the PCI ROM bar Commit 2b938e3db335 ("vfio/pci: Enable iowrite64 and ioread64 for vfio pci") enables qword access to the PCI bar resources. However certain devices (e.g. Intel X710) are observed with problem upon qword accesses to the rom bar, e.g. triggering PCI aer errors. This is triggered by Qemu which caches the rom content by simply does a pread() of the remaining size until it gets the full contents. The other bars would only perform operations at the same access width as their guest drivers. Instead of trying to identify all broken devices, universally disable qword access to the rom bar i.e. going back to the old way which worked reliably for years. Reported-by: Farrah Chen Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220740 Fixes: 2b938e3db335 ("vfio/pci: Enable iowrite64 and ioread64 for vfio pci") Cc: stable@vger.kernel.org Signed-off-by: Kevin Tian Tested-by: Farrah Chen Link: https://lore.kernel.org/r/20251218081650.555015-2-kevin.tian@intel.com Signed-off-by: Alex Williamson commit d6b5a8d6f142ad0a8e45181f06e70b4746c4abc3 Author: Sasha Levin Date: Sat Dec 20 15:29:26 2025 -0500 mm/ksm: fix pte_unmap_unlock of wrong address in break_ksm_pmd_entry On ARM32 with HIGHMEM/HIGHPTE, break_ksm_pmd_entry() triggers a BUG during KSM unmerging because pte_unmap_unlock() is passed a pointer that may be beyond the mapped PTE page. The issue occurs when the PTE iteration loop completes without finding a KSM page. After the loop, 'ptep' has been incremented past the last PTE entry. On ARM32 LPAE with 512 PTEs per page (512 * 8 = 4096 bytes), this means ptep points to the next page, outside the kmap'd region. When pte_unmap_unlock(ptep, ptl) calls kunmap_local(ptep), it unmaps the wrong page address, leaving the original kmap slot still mapped. The next kmap_local then finds this slot unexpectedly occupied: WARNING: mm/highmem.c:622 kunmap_local_indexed (address mismatch) kernel BUG at mm/highmem.c:564 __kmap_local_pfn_prot (slot not empty) Fix this by passing start_ptep to pte_unmap_unlock(), which always points within the originally mapped PTE page. Reproducer: Run LTP ksm03 test on ARM32 with HIGHMEM enabled. The test triggers KSM merging followed by unmerging (writing 0 then 2 to /sys/kernel/mm/ksm/run), which exercises break_ksm_pmd_entry(). Link: https://lkml.kernel.org/r/20251220202926.318366-1-sashal@kernel.org Fixes: 5d4939fc2258 ("ksm: perform a range-walk in break_ksm") Signed-off-by: Sasha Levin Assisted-by: claude-opus-4-5-20251101 Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Chengming Zhou Cc: Pedro Demarchi Gomes Cc: xu xin Signed-off-by: Andrew Morton commit a76a5ae2c6c645005672c2caf2d49361c6f2500f Author: Ran Xiaokai Date: Fri Dec 19 07:42:32 2025 +0000 mm/page_owner: fix memory leak in page_owner_stack_fops->release() The page_owner_stack_fops->open() callback invokes seq_open_private(), therefore its corresponding ->release() callback must call seq_release_private(). Otherwise it will cause a memory leak of struct stack_print_ctx. Link: https://lkml.kernel.org/r/20251219074232.136482-1-ranxiaokai627@163.com Fixes: 765973a09803 ("mm,page_owner: display all stacks and their count") Signed-off-by: Ran Xiaokai Acked-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Brendan Jackman Cc: Johannes Weiner Cc: Marco Elver Cc: Suren Baghdasaryan Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 077d925b60c320027dd64b69e0ab2dd2e00ed45c Author: John Groves Date: Fri Dec 19 06:37:17 2025 -0600 mm/memremap: fix spurious large folio warning for FS-DAX This patch addresses a warning that I discovered while working on famfs, which is an fs-dax file system that virtually always does PMD faults (next famfs patch series coming after the holidays). However, XFS also does PMD faults in fs-dax mode, and it also triggers the warning. It takes some effort to get XFS to do a PMD fault, but instructions to reproduce it are below. The VM_WARN_ON_ONCE(folio_test_large(folio)) check in free_zone_device_folio() incorrectly triggers for MEMORY_DEVICE_FS_DAX when PMD (2MB) mappings are used. FS-DAX legitimately creates large file-backed folios when handling PMD faults. This is a core feature of FS-DAX that provides significant performance benefits by mapping 2MB regions directly to persistent memory. When these mappings are unmapped, the large folios are freed through free_zone_device_folio(), which triggers the spurious warning. The warning was introduced by commit that added support for large zone device private folios. However, that commit did not account for FS-DAX file-backed folios, which have always supported large (PMD-sized) mappings. The check distinguishes between anonymous folios (which clear AnonExclusive flags for each sub-page) and file-backed folios. For file-backed folios, it assumes large folios are unexpected - but this assumption is incorrect for FS-DAX. The fix is to exempt MEMORY_DEVICE_FS_DAX from the large folio warning, allowing FS-DAX to continue using PMD mappings without triggering false warnings. Link: https://lkml.kernel.org/r/20251219123717.39330-1-john@groves.net Fixes: d245f9b4ab80 ("mm/zone_device: support large zone device private folios") Signed-off-by: John Groves Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Dan Williams Tested-by: Alison Schofield Cc: Alistair Popple Cc: Balbir Singh Cc: "Darrick J. Wong" Cc: Gregory Price Cc: Oscar Salvador Signed-off-by: Andrew Morton commit ffd042a23b798dfe2786c998038c1bf53ae818ef Author: Dan Williams Date: Fri Dec 19 16:03:27 2025 -0800 MAINTAINERS: notify the "Device Memory" community of memory hotplug changes The recent episode of a warning regression in memremap_pages() [1] highlights that relevant updates are being missed by folks that care about core ZONE_DEVICE changes. Yes, CXL folks should pay more attention to linux-mm@, but it also would not hurt to copy linux-cxl@, where most Device Memory folks hang out, on memory hotplug changes by default. Link: http://lore.kernel.org/20251219123717.39330-1-john@groves.net [1] Link: https://lkml.kernel.org/r/20251220000327.3502994-1-dan.j.williams@intel.com Signed-off-by: Dan Williams Acked-by: Jonathan Cameron Acked-by: John Groves Cc: David Hildenbrand Cc: Oscar Salvador Cc: Davidlohr Bueso Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Signed-off-by: Andrew Morton commit 7622292d2a4c4de36144a30b12a0d0f70d35f2c1 Author: Randy Dunlap Date: Wed Dec 17 22:09:21 2025 -0800 sparse: update MAINTAINERS info Chris Li is back as sparse maintainer. See https://git.kernel.org/pub/scm/devel/sparse/sparse.git/commit/?id=67f0a03cee4637e495151c48a02be642a158cbbb Link: https://lkml.kernel.org/r/20251218060921.995516-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Cc: Christopher Li Signed-off-by: Andrew Morton commit 0c75714095e06692f7a0e00a3dfd829c0d3c0ada Author: Joshua Hahn Date: Thu Dec 18 00:31:59 2025 -0800 mm/page_alloc: report 1 as zone_batchsize for !CONFIG_MMU Commit 2783088ef24e ("mm/page_alloc: prevent reporting pcp->batch = 0") moved the error handling (0-handling) of zone_batchsize from its callers to inside the function. However, the commit left out the error handling for the NOMMU case, leading to deadlocks on NOMMU systems. For NOMMU systems, return 1 instead of 0 for zone_batchsize, which restores the previous deadlock-free behavior. There is no functional difference expected with this patch before commit 2783088ef24e, other than the pr_debug in zone_pcp_init now printing out 1 instead of 0 for zones in NOMMU systems. Not only is this a pr_debug, the difference is purely semantic anyways. Link: https://lkml.kernel.org/r/20251218083200.2435789-1-joshua.hahnjy@gmail.com Fixes: 2783088ef24e ("mm/page_alloc: prevent reporting pcp->batch = 0") Signed-off-by: Joshua Hahn Reported-by: Daniel Palmer Closes: https://lore.kernel.org/linux-mm/CAFr9PX=_HaM3_xPtTiBn5Gw5-0xcRpawpJ02NStfdr0khF2k7g@mail.gmail.com/ Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/42143500-c380-41fe-815c-696c17241506@roeck-us.net/ Reviewed-by: Vlastimil Babka Tested-by: Daniel Palmer Tested-by: Guenter Roeck Acked-by: SeongJae Park Tested-by: Hajime Tazaki Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit f183663901f21fe0fba8bd31ae894bc529709ee0 Author: Bijan Tabatabai Date: Tue Dec 16 14:07:27 2025 -0600 mm: consider non-anon swap cache folios in folio_expected_ref_count() Currently, folio_expected_ref_count() only adds references for the swap cache if the folio is anonymous. However, according to the comment above the definition of PG_swapcache in enum pageflags, shmem folios can also have PG_swapcache set. This patch makes sure references for the swap cache are added if folio_test_swapcache(folio) is true. This issue was found when trying to hot-unplug memory in a QEMU/KVM virtual machine. When initiating hot-unplug when most of the guest memory is allocated, hot-unplug hangs partway through removal due to migration failures. The following message would be printed several times, and would be printed again about every five seconds: [ 49.641309] migrating pfn b12f25 failed ret:7 [ 49.641310] page: refcount:2 mapcount:0 mapping:0000000033bd8fe2 index:0x7f404d925 pfn:0xb12f25 [ 49.641311] aops:swap_aops [ 49.641313] flags: 0x300000000030508(uptodate|active|owner_priv_1|reclaim|swapbacked|node=0|zone=3) [ 49.641314] raw: 0300000000030508 ffffed312c4bc908 ffffed312c4bc9c8 0000000000000000 [ 49.641315] raw: 00000007f404d925 00000000000c823b 00000002ffffffff 0000000000000000 [ 49.641315] page dumped because: migration failure When debugging this, I found that these migration failures were due to __migrate_folio() returning -EAGAIN for a small set of folios because the expected reference count it calculates via folio_expected_ref_count() is one less than the actual reference count of the folios. Furthermore, all of the affected folios were not anonymous, but had the PG_swapcache flag set, inspiring this patch. After applying this patch, the memory hot-unplug behaves as expected. I tested this on a machine running Ubuntu 24.04 with kernel version 6.8.0-90-generic and 64GB of memory. The guest VM is managed by libvirt and runs Ubuntu 24.04 with kernel version 6.18 (though the head of the mm-unstable branch as a Dec 16, 2025 was also tested and behaves the same) and 48GB of memory. The libvirt XML definition for the VM can be found at [1]. CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is set in the guest kernel so the hot-pluggable memory is automatically onlined. Below are the steps to reproduce this behavior: 1) Define and start and virtual machine host$ virsh -c qemu:///system define ./test_vm.xml # test_vm.xml from [1] host$ virsh -c qemu:///system start test_vm 2) Setup swap in the guest guest$ sudo fallocate -l 32G /swapfile guest$ sudo chmod 0600 /swapfile guest$ sudo mkswap /swapfile guest$ sudo swapon /swapfile 3) Use alloc_data [2] to allocate most of the remaining guest memory guest$ ./alloc_data 45 4) In a separate guest terminal, monitor the amount of used memory guest$ watch -n1 free -h 5) When alloc_data has finished allocating, initiate the memory hot-unplug using the provided xml file [3] host$ virsh -c qemu:///system detach-device test_vm ./remove.xml --live After initiating the memory hot-unplug, you should see the amount of available memory in the guest decrease, and the amount of used swap data increase. If everything works as expected, when all of the memory is unplugged, there should be around 8.5-9GB of data in swap. If the unplugging is unsuccessful, the amount of used swap data will settle below that. If that happens, you should be able to see log messages in dmesg similar to the one posted above. Link: https://lkml.kernel.org/r/20251216200727.2360228-1-bijan311@gmail.com Link: https://github.com/BijanT/linux_patch_files/blob/main/test_vm.xml [1] Link: https://github.com/BijanT/linux_patch_files/blob/main/alloc_data.c [2] Link: https://github.com/BijanT/linux_patch_files/blob/main/remove.xml [3] Fixes: 86ebd50224c0 ("mm: add folio_expected_ref_count() for reference count calculation") Signed-off-by: Bijan Tabatabai Acked-by: David Hildenbrand (Red Hat) Acked-by: Zi Yan Reviewed-by: Baolin Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shivank Garg Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Kairui Song Cc: Signed-off-by: Andrew Morton commit 6558749ef3405c143711cbdc67ec88cbc1582d91 Author: Alice Ryhl Date: Wed Dec 17 13:10:37 2025 +0000 rust: maple_tree: rcu_read_lock() in destructor to silence lockdep When running the Rust maple tree kunit tests with lockdep, you may trigger a warning that looks like this: lib/maple_tree.c:780 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by kunit_try_catch/344. stack backtrace: CPU: 3 UID: 0 PID: 344 Comm: kunit_try_catch Tainted: G N 6.19.0-rc1+ #2 NONE Tainted: [N]=TEST Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x71/0x90 lockdep_rcu_suspicious+0x150/0x190 mas_start+0x104/0x150 mas_find+0x179/0x240 _RINvNtCs5QSdWC790r4_4core3ptr13drop_in_placeINtNtCs1cdwasc6FUb_6kernel10maple_tree9MapleTreeINtNtNtBL_5alloc4kbox3BoxlNtNtB1x_9allocator7KmallocEEECsgxAQYCfdR72_25doctests_kernel_generated+0xaf/0x130 rust_doctest_kernel_maple_tree_rs_0+0x600/0x6b0 ? lock_release+0xeb/0x2a0 ? kunit_try_catch_run+0x210/0x210 kunit_try_run_case+0x74/0x160 ? kunit_try_catch_run+0x210/0x210 kunit_generic_run_threadfn_adapter+0x12/0x30 kthread+0x21c/0x230 ? __do_trace_sched_kthread_stop_ret+0x40/0x40 ret_from_fork+0x16c/0x270 ? __do_trace_sched_kthread_stop_ret+0x40/0x40 ret_from_fork_asm+0x11/0x20 This is because the destructor of maple tree calls mas_find() without taking rcu_read_lock() or the spinlock. Doing that is actually ok in this case since the destructor has exclusive access to the entire maple tree, but it triggers a lockdep warning. To fix that, take the rcu read lock. In the future, it's possible that memory reclaim could gain a feature where it reallocates entries in maple trees even if no user-code is touching it. If that feature is added, then this use of rcu read lock would become load-bearing, so I did not make it conditional on lockdep. We have to repeatedly take and release rcu because the destructor of T might perform operations that sleep. Link: https://lkml.kernel.org/r/20251217-maple-drop-rcu-v1-1-702af063573f@google.com Fixes: da939ef4c494 ("rust: maple_tree: add MapleTree") Signed-off-by: Alice Ryhl Reported-by: Andreas Hindborg Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/x/topic/x/near/564215108 Reviewed-by: Gary Guo Reviewed-by: Daniel Almeida Cc: Andrew Ballance Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Miguel Ojeda Cc: Trevor Gross Cc: Signed-off-by: Andrew Morton commit 6db12d5c474d77016ca9130eb32490c9771fb157 Author: Shakeel Butt Date: Tue Dec 16 13:20:54 2025 -0800 mm: memcg: fix unit conversion for K() macro in OOM log The commit bc8e51c05ad5 ("mm: memcg: dump memcg protection info on oom or alloc failures") added functionality to dump memcg protections on OOM or allocation failures. It uses K() macro to dump the information and passes bytes to the macro. However the macro take number of pages instead of bytes. It is defined as: #define K(x) ((x) << (PAGE_SHIFT-10)) Let's fix this. Link: https://lkml.kernel.org/r/20251216212054.484079-1-shakeel.butt@linux.dev Fixes: bc8e51c05ad5 ("mm: memcg: dump memcg protection info on oom or alloc failures") Signed-off-by: Shakeel Butt Reported-by: Chris Mason Acked-by: Michal Hocko Acked-by: Vlastimil Babka Reviewed-by: Muchun Song Cc: Johannes Weiner Cc: Roman Gushchin Signed-off-by: Andrew Morton commit e6dbcb7c0e7b508d443a9aa6f77f63a2f83b1ae4 Author: Ankit Agrawal Date: Thu Dec 11 07:06:01 2025 +0000 mm: fixup pfnmap memory failure handling to use pgoff The memory failure handling implementation for the PFNMAP memory with no struct pages is faulty. The VA of the mapping is determined based on the the PFN. It should instead be based on the file mapping offset. At the occurrence of poison, the memory_failure_pfn is triggered on the poisoned PFN. Introduce a callback function that allows mm to translate the PFN to the corresponding file page offset. The kernel module using the registration API must implement the callback function and provide the translation. The translated value is then used to determine the VA information and sending the SIGBUS to the usermode process mapped to the poisoned PFN. The callback is also useful for the driver to be notified of the poisoned PFN, which may then track it. Link: https://lkml.kernel.org/r/20251211070603.338701-2-ankita@nvidia.com Fixes: 2ec41967189c ("mm: handle poisoning of pfn without struct pages") Signed-off-by: Ankit Agrawal Suggested-by: Jason Gunthorpe Cc: Kevin Tian Cc: Matthew R. Ochs Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Neo Jia Cc: Vikram Sethi Cc: Yishai Hadas Cc: Zhi Wang Signed-off-by: Andrew Morton commit 7013803444dd3bbbe28fd3360c084cec3057c554 Author: Kaushlendra Kumar Date: Tue Dec 9 10:15:52 2025 +0530 tools/mm/page_owner_sort: fix timestamp comparison for stable sorting The ternary operator in compare_ts() returns 1 when timestamps are equal, causing unstable sorting behavior. Replace with explicit three-way comparison that returns 0 for equal timestamps, ensuring stable qsort ordering and consistent output. Link: https://lkml.kernel.org/r/20251209044552.3396468-1-kaushlendra.kumar@intel.com Fixes: 8f9c447e2e2b ("tools/vm/page_owner_sort.c: support sorting pid and time") Signed-off-by: Kaushlendra Kumar Cc: Chongxi Zhao Cc: Signed-off-by: Andrew Morton commit 632b874d59a36caf829ab5790dafb90f9b350fd6 Author: Wake Liu Date: Wed Dec 10 17:14:08 2025 +0800 selftests/mm: fix thread state check in uffd-unit-tests In the thread_state_get() function, the logic to find the thread's state character was using `sizeof(header) - 1` to calculate the offset from the "State:\t" string. The `header` variable is a `const char *` pointer. `sizeof()` on a pointer returns the size of the pointer itself, not the length of the string literal it points to. This makes the code's behavior dependent on the architecture's pointer size. This bug was identified on a 32-bit ARM build (`gsi_tv_arm`) for Android, running on an ARMv8-based device, compiled with Clang 19.0.1. On this 32-bit architecture, `sizeof(char *)` is 4. The expression `sizeof(header) - 1` resulted in an incorrect offset of 3, causing the test to read the wrong character from `/proc/[tid]/status` and fail. On 64-bit architectures, `sizeof(char *)` is 8, so the expression coincidentally evaluates to 7, which matches the length of "State:\t". This is why the bug likely remained hidden on 64-bit builds. To fix this and make the code portable and correct across all architectures, this patch replaces `sizeof(header) - 1` with `strlen(header)`. The `strlen()` function correctly calculates the string's length, ensuring the correct offset is always used. Link: https://lkml.kernel.org/r/20251210091408.3781445-1-wakel@google.com Fixes: f60b6634cd88 ("mm/selftests: add a test to verify mmap_changing race with -EAGAIN") Signed-off-by: Wake Liu Acked-by: Peter Xu Reviewed-by: Mike Rapoport (Microsoft) Cc: Bill Wendling Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit a3785ae5d334bb71d47a593d54c686a03fb9d136 Author: Pingfan Liu Date: Tue Dec 16 09:48:52 2025 +0800 kernel/kexec: fix IMA when allocation happens in CMA area *** Bug description *** When I tested kexec with the latest kernel, I ran into the following warning: [ 40.712410] ------------[ cut here ]------------ [ 40.712576] WARNING: CPU: 2 PID: 1562 at kernel/kexec_core.c:1001 kimage_map_segment+0x144/0x198 [...] [ 40.816047] Call trace: [ 40.818498] kimage_map_segment+0x144/0x198 (P) [ 40.823221] ima_kexec_post_load+0x58/0xc0 [ 40.827246] __do_sys_kexec_file_load+0x29c/0x368 [...] [ 40.855423] ---[ end trace 0000000000000000 ]--- *** How to reproduce *** This bug is only triggered when the kexec target address is allocated in the CMA area. If no CMA area is reserved in the kernel, use the "cma=" option in the kernel command line to reserve one. *** Root cause *** The commit 07d24902977e ("kexec: enable CMA based contiguous allocation") allocates the kexec target address directly on the CMA area to avoid copying during the jump. In this case, there is no IND_SOURCE for the kexec segment. But the current implementation of kimage_map_segment() assumes that IND_SOURCE pages exist and map them into a contiguous virtual address by vmap(). *** Solution *** If IMA segment is allocated in the CMA area, use its page_address() directly. Link: https://lkml.kernel.org/r/20251216014852.8737-2-piliu@redhat.com Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Pingfan Liu Acked-by: Baoquan He Cc: Alexander Graf Cc: Steven Chen Cc: Mimi Zohar Cc: Roberto Sassu Cc: Signed-off-by: Andrew Morton commit fe55ea85939efcbf0e6baa234f0d70acb79e7b58 Author: Pingfan Liu Date: Tue Dec 16 09:48:51 2025 +0800 kernel/kexec: change the prototype of kimage_map_segment() The kexec segment index will be required to extract the corresponding information for that segment in kimage_map_segment(). Additionally, kexec_segment already holds the kexec relocation destination address and size. Therefore, the prototype of kimage_map_segment() can be changed. Link: https://lkml.kernel.org/r/20251216014852.8737-1-piliu@redhat.com Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Pingfan Liu Acked-by: Baoquan He Cc: Mimi Zohar Cc: Roberto Sassu Cc: Alexander Graf Cc: Steven Chen Cc: Signed-off-by: Andrew Morton commit 8de524774b9e79562452730d66e88f525cdd8149 Author: Pratyush Yadav Date: Fri Dec 12 16:12:02 2025 +0900 MAINTAINERS: add ABI headers to KHO and LIVE UPDATE include/linux/kho is supposed to hold KHO headers. Add it to KHO's MAINTAINERS entry so the right people can get patches to it. include/linux/kho/abi contains the live update ABI headers for LUO core and memfd. It will also hold ABI headers for other upcoming file types as well. Add it to live update entry so live update maintainers can get changes for it (currently they happen to be the same people). Link: https://lkml.kernel.org/r/20251212071204.398788-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: Mike Rapoport Signed-off-by: Andrew Morton commit fdee5216851c2e0f88690c4038eaede3bcd128bc Author: WangYuli Date: Mon Dec 8 10:57:30 2025 +0800 .mailmap: remove one of the entries for WangYuli Since commit 01ef0296d2eb (".mailmap: add entry for WangYuli") was merged into mainline, I've received feedback from former colleagues: They believe the change to .mailmap affects git log based statistics, which in turn reduces the reported “contributions from uniontech” in the Linux commit tree, and they think it's difficult to explain to everyone that future statistics must be generated with the --no-use-mailmap option. I don't have a strong opinion either way, but since my commit has caused them trouble, I'm now requesting that this line be removed to bring a little more LOVE AND PEACE to the world :-) Link: https://lkml.kernel.org/r/20251208025730.33881-1-wangyuli@aosc.io Signed-off-by: WangYuli Cc: Carlos Bilbao Cc: Hans Verkuil Cc: Martin Kepplinger Cc: Shannon Nelson Signed-off-by: Andrew Morton commit 02129e623c18ad77ebb85210340f72125ae8a7a1 Author: Akinobu Mita Date: Wed Dec 10 00:10:34 2025 +0900 mm/damon/vaddr: fix missing pte_unmap_unlock in damos_va_migrate_pmd_entry() If the PTE page table lock is acquired by pte_offset_map_lock(), the lock must be released via pte_unmap_unlock(). However, in damos_va_migrate_pmd_entry(), if damos_va_filter_out() returns true, it immediately returns without releasing the lock. This fixes the issue by not stopping page table traversal when damos_va_filter_out() returns true and ensuring that the lock is released. Link: https://lkml.kernel.org/r/20251209151034.77221-1-akinobu.mita@gmail.com Fixes: 09efc56a3b1c ("mm/damon/vaddr: consistently use only pmd_entry for damos_migrate") Signed-off-by: Akinobu Mita Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 612b595e08caffc1276e7b0680a0c95951eba185 Author: Bartosz Golaszewski Date: Thu Dec 4 11:45:31 2025 +0100 MAINTAINERS: update one straggling entry for Bartosz Golaszewski The entry for the Qualcomm bluetooth driver only now got sent upstream and still has my old address. Update it to use the kernel.org one. Link: https://lkml.kernel.org/r/20251204104531.22045-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski Cc: Hans Verkuil Signed-off-by: Andrew Morton commit 7838a4eb8a1d23160bd3f588ea7f2b8f7c00c55b Author: Alexander Gordeev Date: Fri Dec 12 16:14:57 2025 +0100 mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differs, it is expected to be updated to match the one of the page being freed. However, only the first pageblock of the buddy page is updated, while the rest of the pageblocks are left unchanged. That causes warnings in later expand() and other code paths (like below), since an inconsistency between migration type of the list containing the page and the page-owned pageblocks migration types is introduced. [ 308.986589] ------------[ cut here ]------------ [ 308.987227] page type is 0, passed migratetype is 1 (nr=256) [ 308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270 [ 308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.987439] Unloaded tainted modules: hmac_s390(E):2 [ 308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.987657] Tainted: [E]=UNSIGNED_MODULE [ 308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270) [ 308.987676] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.987688] 0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300 [ 308.987692] 0000000000000008 0000034998d57290 000002be00000100 0000023e00000008 [ 308.987696] 0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0 [ 308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2 larl %r2,000003499883abd4 00000349976fa5f6: c0e5ffe3f4b5 brasl %r14,0000034997378f60 #00000349976fa5fc: af000000 mc 0,0 >00000349976fa600: a7f4ff4c brc 15,00000349976fa498 00000349976fa604: b9040026 lgr %r2,%r6 00000349976fa608: c0300088317f larl %r3,0000034998800906 00000349976fa60e: c0e5fffdb6e1 brasl %r14,00000349976b13d0 00000349976fa614: af000000 mc 0,0 [ 308.987734] Call Trace: [ 308.987738] [<00000349976fa600>] expand+0x240/0x270 [ 308.987744] ([<00000349976fa5fc>] expand+0x23c/0x270) [ 308.987749] [<00000349976ff95e>] rmqueue_bulk+0x71e/0x940 [ 308.987754] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.987759] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.987763] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.987768] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.987774] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.987781] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.987786] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.987791] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.987799] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.987804] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.987809] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.987813] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.987822] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.987830] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.987838] 3 locks held by mempig_verify/5224: [ 308.987842] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.987859] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.987871] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.987886] Last Breaking-Event-Address: [ 308.987890] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.987897] irq event stamp: 52330356 [ 308.987901] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.987907] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.987913] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.987922] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.987929] ---[ end trace 0000000000000000 ]--- [ 308.987936] ------------[ cut here ]------------ [ 308.987940] page type is 0, passed migratetype is 1 (nr=256) [ 308.987951] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:860 __del_page_from_free_list+0x1be/0x1e0 [ 308.987960] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.988070] Unloaded tainted modules: hmac_s390(E):2 [ 308.988087] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G W E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.988095] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 308.988100] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.988105] Krnl PSW : 0404f00180000000 00000349976f9e32 (__del_page_from_free_list+0x1c2/0x1e0) [ 308.988118] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.988127] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.988133] 0000000000000005 0000034980000005 0000034998d57290 0000023efe6c8300 [ 308.988139] 0000000000000001 0000000000000008 000002be00000100 000002be803ac000 [ 308.988144] 0000000000000000 0000000000000001 00000349976f9e2e 000002c99b1eb728 [ 308.988153] Krnl Code: 00000349976f9e22: c020008a06d9 larl %r2,000003499883abd4 00000349976f9e28: c0e5ffe3f89c brasl %r14,0000034997378f60 #00000349976f9e2e: af000000 mc 0,0 >00000349976f9e32: a7f4ff4e brc 15,00000349976f9cce 00000349976f9e36: b904002b lgr %r2,%r11 00000349976f9e3a: c030008a06e7 larl %r3,000003499883ac08 00000349976f9e40: c0e5fffdbac8 brasl %r14,00000349976b13d0 00000349976f9e46: af000000 mc 0,0 [ 308.988184] Call Trace: [ 308.988188] [<00000349976f9e32>] __del_page_from_free_list+0x1c2/0x1e0 [ 308.988195] ([<00000349976f9e2e>] __del_page_from_free_list+0x1be/0x1e0) [ 308.988202] [<00000349976ff946>] rmqueue_bulk+0x706/0x940 [ 308.988208] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.988214] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.988221] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.988227] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.988233] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.988240] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.988247] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.988253] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.988260] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.988267] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.988273] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.988279] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.988286] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.988293] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.988300] 3 locks held by mempig_verify/5224: [ 308.988305] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.988322] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.988334] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.988346] Last Breaking-Event-Address: [ 308.988350] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.988356] irq event stamp: 52330356 [ 308.988360] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.988366] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.988373] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.988380] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.988388] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20251215081002.3353900A9c-agordeev@linux.ibm.com Link: https://lkml.kernel.org/r/20251212151457.3898073Add-agordeev@linux.ibm.com Fixes: e6cf9e1c4cde ("mm: page_alloc: fix up block types when merging compatible blocks") Signed-off-by: Alexander Gordeev Reported-by: Marc Hartmayer Closes: https://lore.kernel.org/linux-mm/87wmalyktd.fsf@linux.ibm.com/ Acked-by: Vlastimil Babka Acked-by: Johannes Weiner Reviewed-by: Wei Yang Cc: Marc Hartmayer Cc: Signed-off-by: Andrew Morton commit 6ba776b533ca902631fa106b8a90811b3f40b08d Author: Randy Dunlap Date: Sun Dec 14 12:15:17 2025 -0800 mm: leafops.h: correct kernel-doc function param. names Modify the kernel-doc function parameter names to prevent kernel-doc warnings: Warning: include/linux/leafops.h:135 function parameter 'entry' not described in 'leafent_type' Warning: include/linux/leafops.h:540 function parameter 'pte' not described in 'pte_is_uffd_marker' Link: https://lkml.kernel.org/r/20251214201517.2187051-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Reviewed-by: Lorenzo Stoakes Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6a0e5b333842cf65d6f4e4f0a2a4386504802515 Author: Maciej Wieczor-Retman Date: Thu Dec 4 19:00:11 2025 +0000 kasan: unpoison vms[area] addresses with a common tag A KASAN tag mismatch, possibly causing a kernel panic, can be observed on systems with a tag-based KASAN enabled and with multiple NUMA nodes. It was reported on arm64 and reproduced on x86. It can be explained in the following points: 1. There can be more than one virtual memory chunk. 2. Chunk's base address has a tag. 3. The base address points at the first chunk and thus inherits the tag of the first chunk. 4. The subsequent chunks will be accessed with the tag from the first chunk. 5. Thus, the subsequent chunks need to have their tag set to match that of the first chunk. Use the new vmalloc flag that disables random tag assignment in __kasan_unpoison_vmalloc() - pass the same random tag to all the vm_structs by tagging the pointers before they go inside __kasan_unpoison_vmalloc(). Assigning a common tag resolves the pcpu chunk address mismatch. [akpm@linux-foundation.org: use WARN_ON_ONCE(), per Andrey] Link: https://lkml.kernel.org/r/CA+fCnZeuGdKSEm11oGT6FS71_vGq1vjq-xY36kxVdFvwmag2ZQ@mail.gmail.com [maciej.wieczor-retman@intel.com: remove unneeded pr_warn()] Link: https://lkml.kernel.org/r/919897daaaa3c982a27762a2ee038769ad033991.1764945396.git.m.wieczorretman@pm.me Link: https://lkml.kernel.org/r/873821114a9f722ffb5d6702b94782e902883fdf.1764874575.git.m.wieczorretman@pm.me Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS") Signed-off-by: Maciej Wieczor-Retman Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Jiayuan Chen Cc: Kees Cook Cc: Marco Elver Cc: "Uladzislau Rezki (Sony)" Cc: Vincenzo Frascino Cc: [6.1+] Signed-off-by: Andrew Morton commit 6f13db031e27e88213381039032a9cc061578ea6 Author: Maciej Wieczor-Retman Date: Thu Dec 4 19:00:04 2025 +0000 kasan: refactor pcpu kasan vmalloc unpoison A KASAN tag mismatch, possibly causing a kernel panic, can be observed on systems with a tag-based KASAN enabled and with multiple NUMA nodes. It was reported on arm64 and reproduced on x86. It can be explained in the following points: 1. There can be more than one virtual memory chunk. 2. Chunk's base address has a tag. 3. The base address points at the first chunk and thus inherits the tag of the first chunk. 4. The subsequent chunks will be accessed with the tag from the first chunk. 5. Thus, the subsequent chunks need to have their tag set to match that of the first chunk. Refactor code by reusing __kasan_unpoison_vmalloc in a new helper in preparation for the actual fix. Link: https://lkml.kernel.org/r/eb61d93b907e262eefcaa130261a08bcb6c5ce51.1764874575.git.m.wieczorretman@pm.me Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS") Signed-off-by: Maciej Wieczor-Retman Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Jiayuan Chen Cc: Kees Cook Cc: Marco Elver Cc: "Uladzislau Rezki (Sony)" Cc: Vincenzo Frascino Cc: [6.1+] Signed-off-by: Andrew Morton commit 007f5da43b3d0ecff972e2616062b8da1f862f5e Author: Jiayuan Chen Date: Thu Dec 4 18:59:55 2025 +0000 mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN Patch series "kasan: vmalloc: Fixes for the percpu allocator and vrealloc", v3. Patches fix two issues related to KASAN and vmalloc. The first one, a KASAN tag mismatch, possibly resulting in a kernel panic, can be observed on systems with a tag-based KASAN enabled and with multiple NUMA nodes. Initially it was only noticed on x86 [1] but later a similar issue was also reported on arm64 [2]. Specifically the problem is related to how vm_structs interact with pcpu_chunks - both when they are allocated, assigned and when pcpu_chunk addresses are derived. When vm_structs are allocated they are unpoisoned, each with a different random tag, if vmalloc support is enabled along the KASAN mode. Later when first pcpu chunk is allocated it gets its 'base_addr' field set to the first allocated vm_struct. With that it inherits that vm_struct's tag. When pcpu_chunk addresses are later derived (by pcpu_chunk_addr(), for example in pcpu_alloc_noprof()) the base_addr field is used and offsets are added to it. If the initial conditions are satisfied then some of the offsets will point into memory allocated with a different vm_struct. So while the lower bits will get accurately derived the tag bits in the top of the pointer won't match the shadow memory contents. The solution (proposed at v2 of the x86 KASAN series [3]) is to unpoison the vm_structs with the same tag when allocating them for the per cpu allocator (in pcpu_get_vm_areas()). The second one reported by syzkaller [4] is related to vrealloc and happens because of random tag generation when unpoisoning memory without allocating new pages. This breaks shadow memory tracking and needs to reuse the existing tag instead of generating a new one. At the same time an inconsistency in used flags is corrected. This patch (of 3): Syzkaller reported a memory out-of-bounds bug [4]. This patch fixes two issues: 1. In vrealloc the KASAN_VMALLOC_VM_ALLOC flag is missing when unpoisoning the extended region. This flag is required to correctly associate the allocation with KASAN's vmalloc tracking. Note: In contrast, vzalloc (via __vmalloc_node_range_noprof) explicitly sets KASAN_VMALLOC_VM_ALLOC and calls kasan_unpoison_vmalloc() with it. vrealloc must behave consistently -- especially when reusing existing vmalloc regions -- to ensure KASAN can track allocations correctly. 2. When vrealloc reuses an existing vmalloc region (without allocating new pages) KASAN generates a new tag, which breaks tag-based memory access tracking. Introduce KASAN_VMALLOC_KEEP_TAG, a new KASAN flag that allows reusing the tag already attached to the pointer, ensuring consistent tag behavior during reallocation. Pass KASAN_VMALLOC_KEEP_TAG and KASAN_VMALLOC_VM_ALLOC to the kasan_unpoison_vmalloc inside vrealloc_node_align_noprof(). Link: https://lkml.kernel.org/r/cover.1765978969.git.m.wieczorretman@pm.me Link: https://lkml.kernel.org/r/38dece0a4074c43e48150d1e242f8242c73bf1a5.1764874575.git.m.wieczorretman@pm.me Link: https://lore.kernel.org/all/e7e04692866d02e6d3b32bb43b998e5d17092ba4.1738686764.git.maciej.wieczor-retman@intel.com/ [1] Link: https://lore.kernel.org/all/aMUrW1Znp1GEj7St@MiWiFi-R3L-srv/ [2] Link: https://lore.kernel.org/all/CAPAsAGxDRv_uFeMYu9TwhBVWHCCtkSxoWY4xmFB_vowMbi8raw@mail.gmail.com/ [3] Link: https://syzkaller.appspot.com/bug?extid=997752115a851cb0cf36 [4] Fixes: a0309faf1cb0 ("mm: vmalloc: support more granular vrealloc() sizing") Signed-off-by: Jiayuan Chen Co-developed-by: Maciej Wieczor-Retman Signed-off-by: Maciej Wieczor-Retman Reported-by: syzbot+997752115a851cb0cf36@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e243a2.050a0220.1696c6.007d.GAE@google.com/T/ Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Danilo Krummrich Cc: Dmitriy Vyukov Cc: Kees Cook Cc: Marco Elver Cc: "Uladzislau Rezki (Sony)" Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit c6e8e595a0798ad67da0f7bebaf69c31ef70dfff Author: Matthew Wilcox (Oracle) Date: Fri Nov 28 16:18:32 2025 +0000 idr: fix idr_alloc() returning an ID out of range If you use an IDR with a non-zero base, and specify a range that lies entirely below the base, 'max - base' becomes very large and idr_get_free() can return an ID that lies outside of the requested range. Link: https://lkml.kernel.org/r/20251128161853.3200058-1-willy@infradead.org Fixes: 6ce711f27500 ("idr: Make 1-based IDRs more efficient") Signed-off-by: Matthew Wilcox (Oracle) Reported-by: Jan Sokolowski Reported-by: Koen Koning Reported-by: Peter Senna Tschudin Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6449 Reviewed-by: Christian König Cc: Signed-off-by: Andrew Morton commit 87726567d83df9c006d506a201c3c78c3cda76ed Author: Bartosz Golaszewski Date: Fri Nov 28 14:33:18 2025 +0100 mailmap: update entry for Bartosz Golaszewski My linaro address will stop working tonight. Update my mailmap entry. Link: https://lkml.kernel.org/r/20251128133318.44912-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski Cc: Hans Verkuil Signed-off-by: Andrew Morton commit 5393802c94e0ab1295c04c94c57bcb00222d4674 Author: Andrew Morton Date: Thu Nov 27 10:39:24 2025 -0800 genalloc.h: fix htmldocs warning WARNING: include/linux/genalloc.h:52 function parameter 'start_addr' not described in 'genpool_algo_t' Fixes: 52fbf1134d47 ("lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk") Reported-by: Stephen Rothwell Closes: https://lkml.kernel.org/r/20251127130624.563597e3@canb.auug.org.au Acked-by: Randy Dunlap Tested-by: Randy Dunlap Cc: Alexey Skidanov Signed-off-by: Andrew Morton commit 11ce66c7a04b10ee42ccdd4e2af72a3773df09f7 Author: Mike Rapoport (Microsoft) Date: Tue Nov 25 15:29:08 2025 +0200 MAINTAINERS: add Mike Rapoport as maintainer for userfaultfd Link: https://lkml.kernel.org/r/20251125132908.847055-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Red Hat) Acked-by: Vlastimil Babka Acked-by: Peter Xu Acked-by: Lorenzo Stoakes Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit d852b838eb05f52c07963db2ea1ab943b45ee022 Author: Besar Wicaksono Date: Fri Dec 19 23:13:25 2025 +0000 perf arm-spe: Add NVIDIA Olympus to neoverse list Add NVIDIA Olympus MIDR to neoverse_spe range list. Signed-off-by: Besar Wicaksono Reviewed-by: Leo Yan Signed-off-by: Namhyung Kim commit d5e4c710b54a8a6b527ca21eab258f49170e756d Author: Besar Wicaksono Date: Fri Dec 19 23:13:24 2025 +0000 tools headers arm64: Add NVIDIA Olympus part Add the part number and MIDR for NVIDIA Olympus. Signed-off-by: Besar Wicaksono Reviewed-by: Leo Yan Signed-off-by: Namhyung Kim commit 9e724085dacdeec60642e25b1b89245e14f48ef9 Author: Ian Rogers Date: Thu Dec 4 14:55:22 2025 -0800 perf tests top: Make the test exclusive With sufficient tests running the load causes the top test fails with: ``` 123: perf top tests : FAILED! --- start --- test child forked, pid 629856 Basic perf top test Basic perf top test [Failed: no sample percentage found] ---- end(-1) ---- ``` Mark the test exclusive to avoid flakes. Fixes: 75e961730b9e ("perf tests top: Add basic perf top coverage test") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b3d1dcd02c8cc1da723c1e9a6b74849ed94b6d30 Author: Ian Rogers Date: Thu Dec 4 14:55:21 2025 -0800 perf tests kvm: Avoid leaving perf.data.guest file around Ensure the perf.data output when checking permissions is written to /dev/null so that it isn't left in the directory the test is run. Fixes: b58261584d2f ("perf test kvm: Add some basic perf kvm test coverage") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 Author: Luca Ceresoli Date: Thu Nov 27 11:26:17 2025 +0100 phy: rockchip: inno-usb2: fix communication disruption in gadget mode When the OTG USB port is used to power to SoC, configured as peripheral and used in gadget mode, communication stops without notice about 6 seconds after the gadget is configured and enumerated. The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs. The related code flow in the PHY driver code can be summarized as: * the first time chg_detect_work starts (6 seconds after gadget is configured and enumerated) -> rockchip_chg_detect_work(): if chg_state is UNDEFINED: property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y] * rockchip_chg_detect_work() changes state and re-triggers itself a few times until it reaches the DETECTED state: -> rockchip_chg_detect_work(): if chg_state is DETECTED: property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z] At [Y] all existing communications stop. E.g. using a CDC serial gadget, the /dev/tty* devices are still present on both host and device, but no data is transferred anymore. The later call with a 'true' argument at [Z] does not restore it. Due to the lack of documentation, what chg_det.opmode does exactly is not clear, however by code inspection it seems reasonable that is disables something needed to keep the communication working, and testing proves that disabling these lines lets gadget mode keep working. So prevent changes to chg_det.opmode when there is a cable connected (VBUS present). Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ Signed-off-by: Luca Ceresoli Reviewed-by: Théo Lebrun Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-2-dac8a02cd2ca@bootlin.com Signed-off-by: Vinod Koul commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc Author: Louis Chauvet Date: Thu Nov 27 11:26:16 2025 +0100 phy: rockchip: inno-usb2: fix disconnection in gadget mode When the OTG USB port is used to power the SoC, configured as peripheral and used in gadget mode, there is a disconnection about 6 seconds after the gadget is configured and enumerated. The problem was observed on a Radxa Rock Pi S board, which can only be powered by the only USB-C connector. That connector is the only one usable in gadget mode. This implies the USB cable is connected from before boot and never disconnects while the kernel runs. The problem happens because of the PHY driver code flow, summarized as: * UDC start code (triggered via configfs at any time after boot) -> phy_init -> rockchip_usb2phy_init -> schedule_delayed_work(otg_sm_work [A], 6 sec) -> phy_power_on -> rockchip_usb2phy_power_on -> enable clock -> rockchip_usb2phy_reset * Now the gadget interface is up and running. * 6 seconds later otg_sm_work starts [A] -> rockchip_usb2phy_otg_sm_work(): if (B_IDLE state && VBUS present && ...): schedule_delayed_work(&rport->chg_work [B], 0); * immediately the chg_detect_work starts [B] -> rockchip_chg_detect_work(): if chg_state is UNDEFINED: if (!rport->suspended): rockchip_usb2phy_power_off() <--- [X] At [X], the PHY is powered off, causing a disconnection. This quickly triggers a new connection and following re-enumeration, but any connection that had been established during the 6 seconds is broken. The code already checks for !rport->suspended (which, somewhat counter-intuitively, means the PHY is powered on), so add a guard for VBUS as well to avoid a disconnection when a cable is connected. Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/ Signed-off-by: Louis Chauvet Co-developed-by: Luca Ceresoli Signed-off-by: Luca Ceresoli Reviewed-by: Théo Lebrun Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-1-dac8a02cd2ca@bootlin.com Signed-off-by: Vinod Koul commit 4914d67da947031d6f645c81c74f7879e0844d5d Author: Johan Hovold Date: Thu Nov 27 14:48:34 2025 +0100 phy: ti: gmii-sel: fix regmap leak on probe failure The mmio regmap that may be allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind. Fixes: 5ab90f40121a ("phy: ti: gmii-sel: Do not use syscon helper to build regmap") Cc: stable@vger.kernel.org # 6.14 Cc: Andrew Davis Signed-off-by: Johan Hovold Acked-by: Andrew Davis Link: https://patch.msgid.link/20251127134834.2030-1-johan@kernel.org Signed-off-by: Vinod Koul commit d543d3eb06873f0ab8edb0d1f8364e9af93544a0 Author: Robert Marko Date: Fri Oct 31 13:18:12 2025 +0100 phy: sparx5-serdes: make it selectable for ARCH_LAN969X LAN969x uses the SparX-5 SERDES driver, so make it selectable for ARCH_LAN969X. Reviewed-by: Daniel Machon Signed-off-by: Robert Marko Tested-by: Gabor Juhos Tested-by: Vladimir Oltean Link: https://patch.msgid.link/20251031121834.665987-1-robert.marko@sartura.hr Signed-off-by: Vinod Koul commit ebb8719c1a7dd3d0c6f49e38a95bb6ac89f7f7e1 Merge: b927546677c876 17753d1755a589 Author: Linus Torvalds Date: Tue Dec 23 09:13:33 2025 -0800 Merge tag 'sound-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Likely the last pull request in 2025, again a collection of lots of small fixes. Most of them are various device-specific small fixes: - An ASoC core fix for correcting the clamping behavior of *_SX mixer elements - Various fixes for ASoC fsl, SOF, etc - Usual HD- and USB-audio quirks / fix-ups - A couple of error-handling fixes for legacy PCMCIA drivers" * tag 'sound-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits) ALSA: hda/realtek: fix PCI SSID for one of the HP 200 G2i laptop ASoC: ops: fix snd_soc_get_volsw for sx controls ALSA: hda/realtek: Add Asus quirk for TAS amplifiers ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L63 with feedback ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L56 with feedback ASoC: fsl-asoc-card: Use of_property_present() for non-boolean properties ASoC: rt1320: update VC blind write settings ASoC: fsl_xcvr: provide regmap names ASoC: fsl_sai: Add missing registers to cache default ASoC: ak4458: remove the reset operation in probe and remove ASoC: fsl_asrc_dma: fix duplicate debugfs directory error ASoC: fsl_easrc: fix duplicate debugfs directory error ALSA: hda/realtek: fix micmute LED reversed on HP Abe and Bantie ALSA: hda/realtek: Add support for HP Clipper Laptop ALSA: hda/realtek: Add support for HP Trekker Laptop ALSA: usb-mixer: us16x08: validate meter packet indices ASoC: Intel: soc-acpi-intel-nvl-match: Drop rt722 l3 from the match table ASoC: soc-acpi / SOF: Add best_effort flag to get_function_tplg_files op ASoC: SOF: Intel: pci-mtl: Change the topology path to intel/sof-ipc4-tplg ASoC: SOF: ipc4-topology: set playback channel mask ... commit 08aa19de72110df8ac10c9e67349dd884eeed41d Author: Haotian Zhang Date: Mon Nov 24 18:57:34 2025 +0800 phy: ti: da8xx-usb: Handle devm_pm_runtime_enable() errors devm_pm_runtime_enable() can fail due to memory allocation. The current code ignores its return value after calling pm_runtime_set_active(), leaving the device in an inconsistent state if runtime PM initialization fails. Check the return value of devm_pm_runtime_enable() and return on failure. Also move the declaration of 'ret' to the function scope to support this check. Fixes: ee8e41b5044f ("phy: ti: phy-da8xx-usb: Add runtime PM support") Suggested-by: Neil Armstrong Signed-off-by: Haotian Zhang Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251124105734.1027-1-vulab@iscas.ac.cn Signed-off-by: Vinod Koul commit cabd25b57216ddc132efbcc31f972baa03aad15a Author: Dan Carpenter Date: Tue Dec 9 09:53:36 2025 +0300 phy: stm32-usphyc: Fix off by one in probe() The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds. The "index" comes from the device tree so it's data that we trust and it's unlikely to be wrong, however it's obviously still worth fixing the bug. Change the > to >=. Fixes: 94c358da3a05 ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)") Signed-off-by: Dan Carpenter Reviewed-by: Amelie Delaunay Link: https://patch.msgid.link/aTfHcMJK1wFVnvEe@stanley.mountain Signed-off-by: Vinod Koul commit 1ca52c0983c34fca506921791202ed5bdafd5306 Author: Loic Poulain Date: Fri Dec 19 09:56:40 2025 +0100 phy: qcom-qusb2: Fix NULL pointer dereference on early suspend Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data. There is a small window where the suspend callback may run after PM runtime enabling and before runtime forbid. This causes a sporadic crash during boot: ``` Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 [...] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT Workqueue: pm pm_runtime_work pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] lr : pm_generic_runtime_suspend+0x2c/0x44 [...] ``` Attach the QPHY instance as driver data before enabling runtime PM to prevent NULL pointer dereference in runtime PM callbacks. Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 891a96f65ac3 ("phy: qcom-qusb2: Add support for runtime PM") Signed-off-by: Loic Poulain Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Link: https://patch.msgid.link/20251219085640.114473-1-loic.poulain@oss.qualcomm.com Signed-off-by: Vinod Koul commit 8becf9179a4b45104a1701010ed666b55bf4b3a6 Author: Stefano Radaelli Date: Fri Dec 19 17:09:12 2025 +0100 phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it Clear the PCS_TX_SWING_FULL field mask before setting the new value in PHY_CTRL5 register. Without clearing the mask first, the OR operation could leave previously set bits, resulting in incorrect register configuration. Fixes: 63c85ad0cd81 ("phy: fsl-imx8mp-usb: add support for phy tuning") Suggested-by: Leonid Segal Acked-by: Pierluigi Passaro Signed-off-by: Stefano Radaelli Reviewed-by: Xu Yang Reviewed-by: Frank Li Reviewed-by: Fabio Estevam Reviewed-by: Ahmad Fatoum Link: https://patch.msgid.link/20251219160912.561431-1-stefano.r@variscite.com Signed-off-by: Vinod Koul commit b005d618c8547b7dfb14e83a1b410a6a04ac36c6 Merge: c81f30bde5b044 5bfbbf0a49ee4b Author: Mark Brown Date: Tue Dec 23 15:18:22 2025 +0000 spi: cadence-quadspi: Prevent indirect read Merge series from Mateusz Litwin : On the Stratix10 platform, indirect reads can become very slow due to lost interrupts and/or missed `complete()` calls, causing `wait_for_completion_timeout()` to expire. Three issues were identified: 1) A race condition exists between the read loop and IRQ `complete()` call: An IRQ can call `complete()` after the inner loop ends, but before `reinit_completion()`, losing the completion event and leading to `wait_for_completion_timeout()` expire. This function will not return an error because `bytes_to_read` > 0 (indicating data is already in the FIFO) and the final `ret` value is overwritten by `cqspi_wait_for_bit()` return value (indicating request completion), masking the timeout. For test purpose, logging was added to print the count of timeouts and the outer loop count. $ dd if=/dev/mtd0 of=/dev/null bs=64M count=1 [ 2232.925219] cadence-qspi ff8d2000.spi: Indirect read error timeout (1) loop (12472) [ 2236.200391] cadence-qspi ff8d2000.spi: Indirect read error timeout (1) loop (12460) [ 2239.482836] cadence-qspi ff8d2000.spi: Indirect read error timeout (5) loop (12450) This indicates that such an event is rare, but possible. Tested on the Stratix10 platform. 2) The quirk assumes the indirect read path never leaves the inner loop on SoCFPGA. This assumption is incorrect when using slow flash. Disabling IRQs in the inner loop can cause lost interrupts. 3) The `CQSPI_SLOW_SRAM` quirk disables `CQSPI_REG_IRQ_IND_COMP` (indirect completion) interrupt, relying solely on the `CQSPI_REG_IRQ_WATERMARK` (FIFO watermark) interrupt. For small transfers sizes, the final data read might not fill the FIFO sufficiently to trigger the watermark, preventing completion and leading to wait_for_completion_timeout() expiration. Two patches have been prepared to resolve these issues. - [1/2] spi: cadence-quadspi: Prevent lost complete() call during indirect read Moving `reinit_completion()` before the inner loop prevents a race condition. This might cause a premature IRQ complete() call to occur; however, in the worst case, this will result in a spurious wakeup and another wait cycle, which is preferable to waiting for a timeout. - [2/2] spi: cadence-quadspi: Improve CQSPI_SLOW_SRAM quirk if flash is slow Re-enabling `CQSPI_REG_IRQ_IND_COMP` interrupt resolves the problem for small reads and removes the disabling of interrupts, addressing the issue with lost interrupts. This marginally increases the IRQ count. Test: $ dd if=/dev/mtd0 of=/dev/null bs=1M count=64 Results from the Stratix10 platform with mt25qu02g flash. FIFO size in all tests: 128 Serviced interrupt call counts: Without `CQSPI_SLOW_SRAM` quirk: 16 668 850 With `CQSPI_SLOW_SRAM` quirk: 204 176 With `CQSPI_SLOW_SRAM` and this patch: 224 528 Patch 2/2: Delivers a substantial read‑performance improvement for the Cadence QSPI controller on the Stratix10 platform. Patch 1/2: Applies to all platforms and should yield a modest performance gain, most noticeable with large `CQSPI_READ_TIMEOUT_MS` values and workloads dominated by many small reads. commit 2b742094582db365fe07021b0a9c5405f85049f9 Author: Will Rosenberg Date: Tue Dec 16 23:01:07 2025 -0700 fs/kernfs: null-ptr deref in simple_xattrs_free() There exists a null pointer dereference in simple_xattrs_free() as part of the __kernfs_new_node() routine. Within __kernfs_new_node(), err_out4 calls simple_xattr_free(), but kn->iattr may be NULL if __kernfs_setattr() was never called. As a result, the first argument to simple_xattrs_free() may be NULL + 0x38, and no NULL check is done internally, causing an incorrect pointer dereference. Add a check to ensure kn->iattr is not NULL, meaning __kernfs_setattr() has been called and kn->iattr is allocated. Note that struct kernfs_node kn is allocated with kmem_cache_zalloc, so we can assume kn->iattr will be NULL if not allocated. An alternative fix could be to not call simple_xattrs_free() at all. As was previously discussed during the initial patch, simple_xattrs_free() is not strictly needed and is included to be consistent with kernfs_free_rcu(), which also helps the function maintain correctness if changes are made in __kernfs_new_node(). Reported-by: syzbot+6aaf7f48ae034ab0ea97@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6aaf7f48ae034ab0ea97 Fixes: 382b1e8f30f7 ("kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node") Signed-off-by: Will Rosenberg Link: https://patch.msgid.link/20251217060107.4171558-1-whrosenb@asu.edu Signed-off-by: Greg Kroah-Hartman commit 22201800f198ad33c225e5ce2f0f254df828d01b Merge: df3e3169303f70 e7a9f6600166ef Author: Greg Kroah-Hartman Date: Tue Dec 23 15:59:03 2025 +0100 Merge patch series "usb: typec: ucsi: revert broken buffer management" Johan Hovold says: The new buffer management code has not been tested or reviewed properly and breaks boot of machines like the Lenovo ThinkPad X13s. Fixing this will require designing a proper interface for managing these transactions, something which most likely involves reverting most of the offending commit anyway. Revert the broken code to fix the regression and let Intel come up with a properly tested implementation for a later kernel. Link: https://lore.kernel.org/r/20251222152204.2846-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit e7a9f6600166efb889453c524eb644cb798acd22 Author: Johan Hovold Date: Mon Dec 22 16:22:04 2025 +0100 Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" This reverts commit 3e082978c33151d576694deac8abde021ea669a8. The new buffer management code has not been tested or reviewed properly and breaks boot of machines like the Lenovo ThinkPad X13s: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 CPU: 0 UID: 0 PID: 813 Comm: kworker/0:3 Not tainted 6.19.0-rc2 #26 PREEMPT Hardware name: LENOVO 21BYZ9SRUS/21BYZ9SRUS, BIOS N3HET87W (1.59 ) 12/05/2023 Workqueue: events ucsi_handle_connector_change [typec_ucsi] Call trace: ucsi_sync_control_common+0xe4/0x1ec [typec_ucsi] (P) ucsi_run_command+0xcc/0x194 [typec_ucsi] ucsi_send_command_common+0x84/0x2a0 [typec_ucsi] ucsi_get_connector_status+0x48/0x78 [typec_ucsi] ucsi_handle_connector_change+0x5c/0x4f4 [typec_ucsi] process_one_work+0x208/0x60c worker_thread+0x244/0x388 The new code completely ignores concurrency so that the message length can be updated while a transaction is ongoing. In the above case, the length ends up being modified by another thread while processing an ack so that the NULL cci pointer is dereferenced. Fixing this will require designing a proper interface for managing these transactions, something which most likely involves reverting most of the offending commit anyway. Revert the broken code to fix the regression and let Intel come up with a properly tested implementation for a later kernel. Fixes: 3e082978c331 ("usb: typec: ucsi: Update UCSI structure to have message in and message out fields") Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20251222152204.2846-5-johan@kernel.org commit 2e46b4e024ff61d4533b4f07bb3702ec7466479e Author: Johan Hovold Date: Mon Dec 22 16:22:03 2025 +0100 Revert "usb: typec: ucsi: Add support for message out data structure" This reverts commit db0028637cc832add6d87564fcc2ebb12781b046. The new buffer management code that this feature relies on is broken so revert for now. As for the in buffer, nothing prevents the out message size and buffer from being modified while the message is being processed due to lack of serialisation. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20251222152204.2846-4-johan@kernel.org commit 174e7d0f47e5231437bc305277fec7bf4896a8f9 Author: Johan Hovold Date: Mon Dec 22 16:22:02 2025 +0100 Revert "usb: typec: ucsi: Enable debugfs for message_out data structure" This reverts commit 775fae520e6ae62c393a8daf42dc534f09692f3f. The new buffer management code that this relies on is broken so revert for now. It also looks like the error handling needs some more thought as the message out size is not reset on errors. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20251222152204.2846-3-johan@kernel.org commit 784b756dde9151b2f44da313f390f25139f1a64e Author: Johan Hovold Date: Mon Dec 22 16:22:01 2025 +0100 Revert "usb: typec: ucsi: Add support for SET_PDOS command" This reverts commit 1b474ee01fbb73b1365adbf9b3067f7375e471ee. The new buffer management code that this feature relies on is broken so revert for now. The interface for writing data and support for UCSI_SET_PDOS looks like it could use some more thought as well. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20251222152204.2846-2-johan@kernel.org commit df3e3169303f7084db3990c999701934af0c04c0 Author: Greg Kroah-Hartman Date: Tue Dec 23 15:57:16 2025 +0100 Revert "usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common" This reverts commit 14ad4c10d5bdd413ff9a914260e89b5f54b7a2c7. The originally offending commit will be reverted instead of this fix up at this point in time, so revert this fix. Cc: Heikki Krogerus Cc: Mario Limonciello (AMD) Cc: stable Cc: Johan Hovold Fixes: 14ad4c10d5bd ("usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common") Link: https://lore.kernel.org/r/20251222152204.2846-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0dc580d4a6518b539cbb2877dd9b283df14aac6f Author: Greg Kroah-Hartman Date: Tue Dec 23 15:54:06 2025 +0100 Revert "usb: typec: ucsi: Get connector status after enable notifications" This reverts commit 5106dbab44fba8ec6dede3f4e75d17f5aa777ec8. There are reported issues in this file, so revert the commit for now so that the original offending changes can be reverted and working systems can be restored. This can come back at a later time if it is rebased yet-again (sorry.) Cc: stable Cc: Johan Hovold Link: https://lore.kernel.org/r/20251222152204.2846-1-johan@kernel.org Fixes: 5106dbab44fb ("usb: typec: ucsi: Get connector status after enable notifications") Cc: Kenneth R. Crudup Cc: Heikki Krogerus Cc: Hsin-Te Yuan Signed-off-by: Greg Kroah-Hartman commit 8ff242c04157244020888fa234a6b145415d5a65 Author: Johan Hovold Date: Thu Dec 18 16:35:19 2025 +0100 usb: ohci-nxp: clean up probe error labels Error labels should be named after what they do rather than after from where they are jumped to. Rename the probe error labels for consistency and to improve readability. Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251218153519.19453-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit ad6fb7367eaa87caa15e9be2129d8e8018a33cba Author: Johan Hovold Date: Thu Dec 18 16:35:18 2025 +0100 usb: gadget: lpc32xx_udc: clean up probe error labels Error labels should be named after what they do rather than after from where they are jumped to. Rename the probe error labels for consistency and to improve readability. Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251218153519.19453-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit b4c61e542faf8c9131d69ecfc3ad6de96d1b2ab8 Author: Johan Hovold Date: Thu Dec 18 16:35:17 2025 +0100 usb: ohci-nxp: fix device leak on probe failure Make sure to drop the reference taken when looking up the PHY I2C device during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 73108aa90cbf ("USB: ohci-nxp: Use isp1301 driver") Cc: stable@vger.kernel.org # 3.5 Reported-by: Ma Ke Link: https://lore.kernel.org/lkml/20251117013428.21840-1-make24@iscas.ac.cn/ Signed-off-by: Johan Hovold Acked-by: Alan Stern Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251218153519.19453-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 Author: Johan Hovold Date: Thu Dec 18 16:35:16 2025 +0100 usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use. Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") Cc: stable@vger.kernel.org Cc: Ma Ke Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251218153519.19453-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 782be79e4551550d7a82b1957fc0f7347e6d461f Author: Johan Hovold Date: Thu Dec 18 16:35:15 2025 +0100 usb: gadget: lpc32xx_udc: fix clock imbalance in error path A recent change fixing a device reference leak introduced a clock imbalance by reusing an error path so that the clock may be disabled before having been enabled. Note that the clock framework allows for passing in NULL clocks so there is no risk for a NULL pointer dereference. Also drop the bogus I2C client NULL check added by the offending commit as the pointer has already been verified to be non-NULL. Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe") Cc: stable@vger.kernel.org Cc: Ma Ke Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251218153519.19453-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5106dbab44fba8ec6dede3f4e75d17f5aa777ec8 Author: Hsin-Te Yuan Date: Thu Dec 18 15:37:57 2025 +0800 usb: typec: ucsi: Get connector status after enable notifications Originally, the notification for connector change will be enabled after the first read of the connector status. Therefore, if the event happens during this window, it will be missing and make the status unsynced. Get the connector status only after enabling the notification for connector change to ensure the status is synced. Fixes: c1b0bc2dabfa ("usb: typec: Add support for UCSI interface") Cc: stable Tested-by: Kenneth R. Crudup Reviewed-by: Heikki Krogerus Signed-off-by: Hsin-Te Yuan Link: https://patch.msgid.link/20251218-ucsi-v7-1-aea83e83fb12@chromium.org Signed-off-by: Greg Kroah-Hartman commit 0831269b5f71594882accfceb02638124f88955d Author: Chen Changcheng Date: Thu Dec 18 09:23:18 2025 +0800 usb: usb-storage: Maintain minimal modifications to the bcdDevice range. We cannot determine which models require the NO_ATA_1X and IGNORE_RESIDUE quirks aside from the EL-R12 optical drive device. Fixes: 955a48a5353f ("usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.") Signed-off-by: Chen Changcheng Link: https://patch.msgid.link/20251218012318.15978-1-chenchangcheng@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 6402078bd9d1ed46e79465e1faaa42e3458f8a33 Author: Yeoreum Yun Date: Wed Dec 17 08:51:15 2025 +0000 smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20 This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero. To address this issue, replace smc_special_trylock() with spin_trylock_irqsave(). Fixes: 342a93247e08 ("locking/spinlock: Provide RT variant header: ") Signed-off-by: Yeoreum Yun Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251217085115.1730036-1-yeoreum.yun@arm.com Signed-off-by: Paolo Abeni commit 3d70e0fb0f289b0c778041c5bb04d099e1aa7c1c Author: Kalesh AP Date: Tue Dec 23 18:48:55 2025 +0530 RDMA/bnxt_re: Fix to use correct page size for PDE table In bnxt_qplib_alloc_init_hwq(), while allocating memory for PDE table driver incorrectly is using the "pg_size" value passed to the function. Fixed to use the right value 4K. Also, fixed the allocation size for PBL table. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Signed-off-by: Damodharam Ammepalli Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20251223131855.145955-1-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Selvin Xavier Signed-off-by: Leon Romanovsky commit 393e132efcc5e3fc4ef2bd9bbed2a096096c9359 Author: Ziyue Zhang Date: Fri Nov 28 18:49:23 2025 +0800 dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings for qcs8300 The gcc_aux_clk is not required by the PCIe PHY on qcs8300 and is not specified in the device tree node. Hence, move the qcs8300 phy compatibility entry into the list of PHYs that require six clocks. Removed the phy_aux clock from the PCIe PHY binding as it is no longer used by any instance. Fixes: e46e59b77a9e ("dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Document the QCS8300 QMP PCIe PHY Gen4 x2") Signed-off-by: Ziyue Zhang Acked-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Reviewed-by: Johan Hovold Link: https://patch.msgid.link/20251128104928.4070050-2-ziyue.zhang@oss.qualcomm.com Signed-off-by: Vinod Koul commit 49ccab4bedd4779899246107dc19fb01c5b6fea3 Author: Franz Schnyder Date: Wed Nov 26 15:01:33 2025 +0100 phy: fsl-imx8mq-usb: fix typec orientation switch when built as module Currently, the PHY only registers the typec orientation switch when it is built in. If the typec driver is built as a module, the switch registration is skipped due to the preprocessor condition, causing orientation detection to fail. With commit 45fe729be9a6 ("usb: typec: Stub out typec_switch APIs when CONFIG_TYPEC=n") the preprocessor condition is not needed anymore and the orientation switch is correctly registered for both built-in and module builds. Fixes: b58f0f86fd61 ("phy: fsl-imx8mq-usb: add tca function driver for imx95") Cc: stable@vger.kernel.org Suggested-by: Xu Yang Signed-off-by: Franz Schnyder Reviewed-by: Frank Li Reviewed-by: Xu Yang Link: https://patch.msgid.link/20251126140136.1202241-1-fra.schnyder@gmail.com Signed-off-by: Vinod Koul commit 00c22b1e84288bf0e17ab1e7e59d75237cf0d0dc Author: Kaushlendra Kumar Date: Tue Dec 23 14:10:41 2025 +0530 platform/x86/intel/pmt: Fix kobject memory leak on init failure When kobject_init_and_add() fails in pmt_features_discovery(), the function returns without calling kobject_put(). This violates the kobject API contract where kobject_put() must be called even on initialization failure to properly release allocated resources. Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver") Signed-off-by: Kaushlendra Kumar Link: https://patch.msgid.link/20251223084041.3832933-1-kaushlendra.kumar@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2a2618c050e70d1155cb0ec53197257dc3a56690 Merge: b94f11af9d9201 252714f1e8bdd5 Author: Paolo Abeni Date: Tue Dec 23 12:55:39 2025 +0100 Merge tag 'for-net-2025-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - MGMT: report BIS capability flags in supported settings - btusb: revert use of devm_kzalloc in btusb * tag 'for-net-2025-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: btusb: revert use of devm_kzalloc in btusb Bluetooth: MGMT: report BIS capability flags in supported settings ==================== Link: https://patch.msgid.link/20251219223118.90141-1-luiz.dentz@gmail.com Signed-off-by: Paolo Abeni commit b94f11af9d9201426f4d6c8a753493fd58d6ac16 Author: Arnd Bergmann Date: Tue Dec 16 22:35:42 2025 +0100 net: wangxun: move PHYLINK dependency The LIBWX library code is what calls into phylink, so any user of it has to select CONFIG_PHYLINK at the moment, with NGBEVF missing this: x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_nway_reset': wx_ethtool.c:(.text+0x613): undefined reference to `phylink_ethtool_nway_reset' x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_get_link_ksettings': wx_ethtool.c:(.text+0x62b): undefined reference to `phylink_ethtool_ksettings_get' x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_set_link_ksettings': wx_ethtool.c:(.text+0x643): undefined reference to `phylink_ethtool_ksettings_set' x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_get_pauseparam': wx_ethtool.c:(.text+0x65b): undefined reference to `phylink_ethtool_get_pauseparam' x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_set_pauseparam': wx_ethtool.c:(.text+0x677): undefined reference to `phylink_ethtool_set_pauseparam' Add the 'select PHYLINK' line in the libwx option directly so this will always be enabled for all current and future wangxun drivers, and remove the now duplicate lines. Fixes: a0008a3658a3 ("net: wangxun: add ngbevf build") Signed-off-by: Arnd Bergmann Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251216213547.115026-1-arnd@kernel.org Signed-off-by: Paolo Abeni commit 472c5dd6b95c02b3e5d7395acf542150e91165e7 Author: Alice C. Munduruca Date: Tue Dec 16 12:06:41 2025 -0500 selftests: net: fix "buffer overflow detected" for tap.c When the selftest 'tap.c' is compiled with '-D_FORTIFY_SOURCE=3', the strcpy() in rtattr_add_strsz() is replaced with a checked version which causes the test to consistently fail when compiled with toolchains for which this option is enabled by default. TAP version 13 1..3 # Starting 3 tests from 1 test cases. # RUN tap.test_packet_valid_udp_gso ... *** buffer overflow detected ***: terminated # test_packet_valid_udp_gso: Test terminated by assertion # FAIL tap.test_packet_valid_udp_gso not ok 1 tap.test_packet_valid_udp_gso # RUN tap.test_packet_valid_udp_csum ... *** buffer overflow detected ***: terminated # test_packet_valid_udp_csum: Test terminated by assertion # FAIL tap.test_packet_valid_udp_csum not ok 2 tap.test_packet_valid_udp_csum # RUN tap.test_packet_crash_tap_invalid_eth_proto ... *** buffer overflow detected ***: terminated # test_packet_crash_tap_invalid_eth_proto: Test terminated by assertion # FAIL tap.test_packet_crash_tap_invalid_eth_proto not ok 3 tap.test_packet_crash_tap_invalid_eth_proto # FAILED: 0 / 3 tests passed. # Totals: pass:0 fail:3 xfail:0 xpass:0 skip:0 error:0 A buffer overflow is detected by the fortified glibc __strcpy_chk() since the __builtin_object_size() of `RTA_DATA(rta)` is incorrectly reported as 1, even though there is ample space in its bounding buffer `req`. Additionally, given that IFLA_IFNAME also expects a null-terminated string, callers of rtaddr_add_str{,sz}() could simply use the rtaddr_add_strsz() variant. (which has been renamed to remove the trailing `sz`) memset() has been used for this function since it is unchecked and thus circumvents the issue discussed in the previous paragraph. Fixes: 2e64fe4624d1 ("selftests: add few test cases for tap driver") Signed-off-by: Alice C. Munduruca Reviewed-by: Cengiz Can Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251216170641.250494-1-alice.munduruca@canonical.com Signed-off-by: Paolo Abeni commit 12cab1191d9890097171156d06bfa8d31f1e39c8 Author: Deepakkumar Karn Date: Tue Dec 16 20:43:05 2025 +0530 net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails. Reported-by: syzbot+8dd915c7cb0490fc8c52@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8dd915c7cb0490fc8c52 Fixes: 4d12997a9bb3 ("drivers: net: usb: rtl8150: concurrent URB bugfix") Signed-off-by: Deepakkumar Karn Link: https://patch.msgid.link/20251216151304.59865-2-dkarn@redhat.com Signed-off-by: Paolo Abeni commit dff94bc6072b420f39bd2213c0f349fd7a09363c Merge: df60c332caf95d f0e5126f5e55d4 Author: Paolo Abeni Date: Tue Dec 23 12:05:07 2025 +0100 Merge branch 'selftests-drv-net-psp-fix-templated-test-names-in-psp-py' Daniel Zahka says: ==================== selftests: drv-net: psp: fix templated test names in psp.py The templated test names in psp.py had a bug that was not exposed until 80970e0fc07e ("selftests: net: py: extract the case generation logic") changed the order of test case evaluation and test case name extraction. The test cases created in psp_ip_ver_test_builder() and ipver_test_builder() were only assigning formatted names to the test cases they returned, when the test itself was run. This series moves the test case naming to the point where the test function is created. Using netdevsim psp: Before: ./tools/testing/selftests/drivers/net/psp.py TAP version 13 1..28 ok 1 psp.test_case ok 2 psp.test_case ok 3 psp.test_case ok 4 psp.test_case ok 5 psp.test_case ok 6 psp.test_case ok 7 psp.test_case ok 8 psp.test_case ok 9 psp.test_case ok 10 psp.test_case ok 11 psp.dev_list_devices ... ok 28 psp.removal_device_bi # Totals: pass:28 fail:0 xfail:0 xpass:0 skip:0 error:0 # # Responder logs (0): # STDERR: # Set PSP enable on device 3 to 0xf # Set PSP enable on device 3 to 0x0 After: ./tools/testing/selftests/drivers/net/psp.py TAP version 13 1..28 ok 1 psp.data_basic_send_v0_ip4 ok 2 psp.data_basic_send_v0_ip6 ok 3 psp.data_basic_send_v1_ip4 ok 4 psp.data_basic_send_v1_ip6 ok 5 psp.data_basic_send_v2_ip4 ok 6 psp.data_basic_send_v2_ip6 ok 7 psp.data_basic_send_v3_ip4 ok 8 psp.data_basic_send_v3_ip6 ok 9 psp.data_mss_adjust_ip4 ok 10 psp.data_mss_adjust_ip6 ok 11 psp.dev_list_devices ... ok 28 psp.removal_device_bi # Totals: pass:28 fail:0 xfail:0 xpass:0 skip:0 error:0 # # Responder logs (0): # STDERR: # Set PSP enable on device 3 to 0xf # Set PSP enable on device 3 to 0x0 Signed-off-by: Daniel Zahka ==================== Link: https://patch.msgid.link/20251216-psp-test-fix-v1-0-3b5a6dde186f@gmail.com Signed-off-by: Paolo Abeni commit f0e5126f5e55d4939784ff61b0b7e9f9636d787d Author: Daniel Zahka Date: Tue Dec 16 06:21:36 2025 -0800 selftests: drv-net: psp: fix test names in ipver_test_builder() test_case will only take on the formatted name after being called. This does not work with the way ksft_run() currently works. Assign the name after the test_case is created. Fixes: 81236c74dba6 ("selftests: drv-net: psp: add test for auto-adjusting TCP MSS") Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251216-psp-test-fix-v1-2-3b5a6dde186f@gmail.com Signed-off-by: Paolo Abeni commit d52668cac3f98f86aa1fb238dec1320c80fbefea Author: Daniel Zahka Date: Tue Dec 16 06:21:35 2025 -0800 selftests: drv-net: psp: fix templated test names in psp_ip_ver_test_builder() test_case will only take on its formatted name after it is called by the test runner. Move the assignment to test_case.__name__ to when the test_case is constructed, not called. Fixes: 8f90dc6e417a ("selftests: drv-net: psp: add basic data transfer and key rotation tests") Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251216-psp-test-fix-v1-1-3b5a6dde186f@gmail.com Signed-off-by: Paolo Abeni commit 5bfbbf0a49ee4b5dcf46a3bfd4cd860d72cc887d Author: Mateusz Litwin Date: Thu Dec 18 22:33:05 2025 +0100 spi: cadence-quadspi: Improve CQSPI_SLOW_SRAM quirk if flash is slow CQSPI_SLOW_SRAM quirk on the Stratix10 platform causes fewer interrupts, but also causes timeouts if a small block is used or if flash devices are slower than or equal in speed to SRAM's read operations. Adding the CQSPI_REG_IRQ_IND_COMP interrupt would resolve the problem for small reads, and removing the disabling of interrupts would resolve the issue with lost interrupts. This marginally increases IRQ count. Tests show that this will cause only a few percent more interrupts. Test: $ dd if=/dev/mtd0 of=/dev/null bs=1M count=64 Results from the Stratix10 platform with mt25qu02g flash. FIFO size in all tests: 128 Serviced interrupt call counts: Without CQSPI_SLOW_SRAM quirk: 16 668 850 With CQSPI_SLOW_SRAM quirk: 204 176 With CQSPI_SLOW_SRAM and this commit: 224 528 Signed-off-by: Mateusz Litwin Link: https://patch.msgid.link/20251218-cqspi_indirect_read_improve-v2-2-396079972f2a@nokia.com Signed-off-by: Mark Brown commit d67396c9d697041b385d70ff2fd59cb07ae167e8 Author: Mateusz Litwin Date: Thu Dec 18 22:33:04 2025 +0100 spi: cadence-quadspi: Prevent lost complete() call during indirect read A race condition exists between the read loop and IRQ `complete()` call. An interrupt could call the complete() between the inner loop and reinit_completion(), potentially losing the completion event and causing an unnecessary timeout. Moving reinit_completion() before the loop prevents this. A premature signal will only result in a spurious wakeup and another wait cycle, which is preferable to waiting for a timeout. Signed-off-by: Mateusz Litwin Link: https://patch.msgid.link/20251218-cqspi_indirect_read_improve-v2-1-396079972f2a@nokia.com Signed-off-by: Mark Brown commit 267ee93c417e685d9f8e079e41c70ba6ee4df5a5 Author: j.turek Date: Sun Dec 21 11:32:21 2025 +0100 serial: xilinx_uartps: fix rs485 delay_rts_after_send RTS line control with delay should be triggered when there is no more bytes in kfifo and hardware buffer is empty. Without this patch RTS control is scheduled right after feeding hardware buffer and this is too early. RTS line may change state before hardware buffer is empty. With this patch delayed RTS state change is triggered when function cdns_uart_handle_tx is called from cdns_uart_isr on CDNS_UART_IXR_TXEMPTY exactly when hardware completed transmission Fixes: fccc9d9233f9 ("tty: serial: uartps: Add rs485 support to uartps driver") Cc: stable Link: https://patch.msgid.link/20251221103221.1971125-1-jakub.turek@elsta.tech Signed-off-by: Jakub Turek Signed-off-by: Greg Kroah-Hartman commit c3ca8a0aac832fe8047608bb2ae2cca314c6d717 Author: Claudiu Beznea Date: Wed Dec 17 15:57:59 2025 +0200 serial: sh-sci: Check that the DMA cookie is valid The driver updates struct sci_port::tx_cookie to zero right before the TX work is scheduled, or to -EINVAL when DMA is disabled. dma_async_is_complete(), called through dma_cookie_status() (and possibly through dmaengine_tx_status()), considers cookies valid only if they have values greater than or equal to 1. Passing zero or -EINVAL to dmaengine_tx_status() before any TX DMA transfer has started leads to an incorrect TX status being reported, as the cookie is invalid for the DMA subsystem. This may cause long wait times when the serial device is opened for configuration before any TX activity has occurred. Check that the TX cookie is valid before passing it to dmaengine_tx_status(). Fixes: 7cc0e0a43a91 ("serial: sh-sci: Check if TX data was written to device in .tx_empty()") Cc: stable Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251217135759.402015-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit f54151148b969fb4b62bec8093d255306d20df30 Author: Alexander Stein Date: Fri Dec 19 16:28:12 2025 +0100 serial: core: Fix serial device initialization During restoring sysfs fwnode information the information of_node_reused was dropped. This was previously set by device_set_of_node_from_dev(). Add it back manually Fixes: 24ec03cc5512 ("serial: core: Restore sysfs fwnode information") Cc: stable Suggested-by: Cosmin Tanislav Signed-off-by: Alexander Stein Tested-by: Michael Walle Tested-by: Marek Szyprowski Tested-by: Cosmin Tanislav Link: https://patch.msgid.link/20251219152813.1893982-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit e340663bbf2a75dae5d4fddf90b49281f5c9df3f Author: August Wikerfors Date: Mon Dec 22 20:47:04 2025 +0100 ALSA: hda/tas2781: properly initialize speaker_id for TAS2563 After speaker id retrieval was refactored to happen in tas2781_read_acpi, devices that do not use a speaker id need a negative speaker_id value instead of NULL, but no initialization was added to the TAS2563 code path. This causes the driver to attempt to load a non-existent firmware file name with a speaker id of 0 ("TAS2XXX38700.bin") instead of the correct file name without a speaker id ("TAS2XXX3870.bin"), resulting in low volume and these dmesg errors: tas2781-hda i2c-INT8866:00: Direct firmware load for TAS2XXX38700.bin failed with error -2 tas2781-hda i2c-INT8866:00: tasdevice_dsp_parser: load TAS2XXX38700.bin error tas2781-hda i2c-INT8866:00: dspfw load TAS2XXX38700.bin error [...] tas2781-hda i2c-INT8866:00: tasdevice_prmg_load: Firmware is NULL Fix this by setting speaker_id to -1 as is done for other models. Fixes: 945865a0ddf3 ("ALSA: hda/tas2781: fix speaker id retrieval for multiple probes") Cc: stable@vger.kernel.org Signed-off-by: August Wikerfors Link: https://patch.msgid.link/20251222194704.87232-1-git@augustwikerfors.se Signed-off-by: Takashi Iwai commit 830988b6cf197e6dcffdfe2008c5738e6c6c3c0f Author: Haoxiang Li Date: Sat Dec 20 00:28:45 2025 +0800 ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fails and in ac97_adapter_release() to do the cleanup. Found by code review. Fixes: 74426fbff66e ("ALSA: ac97: add an ac97 bus") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Link: https://patch.msgid.link/20251219162845.657525-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Takashi Iwai commit df60c332caf95d70f967aeace826e7e2f0847361 Author: Raju Rangoju Date: Mon Dec 15 20:47:28 2025 +0530 amd-xgbe: reset retries and mode on RX adapt failures During the stress tests, early RX adaptation handshakes can fail, such as missing the RX_ADAPT ACK or not receiving a coefficient update before block lock is established. Continuing to retry RX adaptation in this state is often ineffective if the current mode selection is not viable. Resetting the RX adaptation retry counter when an RX_ADAPT request fails to receive ACK or a coefficient update prior to block lock, and clearing mode_set so the next bring-up performs a fresh mode selection rather than looping on a likely invalid configuration. Fixes: 4f3b20bfbb75 ("amd-xgbe: add support for rx-adaptation") Signed-off-by: Raju Rangoju Reviewed-by: Simon Horman Reviewed-by: Shyam Sundar S K Link: https://patch.msgid.link/20251215151728.311713-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit a9f96dc59b4a50ffbf86158f315e115969172d48 Author: Vladimir Oltean Date: Mon Dec 15 17:02:36 2025 +0200 net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() of_find_net_device_by_node() searches net devices by their /sys/class/net/, entry. It is documented in its kernel-doc that: * If successful, returns a pointer to the net_device with the embedded * struct device refcount incremented by one, or NULL on failure. The * refcount must be dropped when done with the net_device. We are missing a put_device(&conduit->dev) which we could place at the end of dsa_tree_find_first_conduit(). But to explain why calling put_device() right away is safe is the same as to explain why the chosen solution is different. The code is very poorly split: dsa_tree_find_first_conduit() was first introduced in commit 95f510d0b792 ("net: dsa: allow the DSA master to be seen and changed through rtnetlink") but was first used several commits later, in commit acc43b7bf52a ("net: dsa: allow masters to join a LAG"). Assume there is a switch with 2 CPU ports and 2 conduits, eno2 and eno3. When we create a LAG (bonding or team device) and place eno2 and eno3 beneath it, we create a 3rd conduit (the LAG device itself), but this is slightly different than the first two. Namely, the cpu_dp->conduit pointer of the CPU ports does not change, and remains pointing towards the physical Ethernet controllers which are now LAG ports. Only 2 things change: - the LAG device has a dev->dsa_ptr which marks it as a DSA conduit - dsa_port_to_conduit(user port) finds the LAG and not the physical conduit, because of the dp->cpu_port_in_lag bit being set. When the LAG device is destroyed, dsa_tree_migrate_ports_from_lag_conduit() is called and this is where dsa_tree_find_first_conduit() kicks in. This is the logical mistake and the reason why introducing code in one patch and using it from another is bad practice. I didn't realize that I don't have to call of_find_net_device_by_node() again; the cpu_dp->conduit association was never undone, and is still available for direct (re)use. There's only one concern - maybe the conduit disappeared in the meantime, but the netdev_hold() call we made during dsa_port_parse_cpu() (see previous change) ensures that this was not the case. Therefore, fixing the code means reimplementing it in the simplest way. I am blaming the time of use, since this is what "git blame" would show if we were to monitor for the conduit's kobject's refcount remaining elevated instead of being freed. Tested on the NXP LS1028A, using the steps from Documentation/networking/dsa/configuration.rst section "Affinity of user ports to CPU ports", followed by (extra prints added by me): $ ip link del bond0 mscc_felix 0000:00:00.5 swp3: Link is Down bond0 (unregistering): (slave eno2): Releasing backup interface fsl_enetc 0000:00:00.2 eno2: Link is Down mscc_felix 0000:00:00.5 swp0: bond0 disappeared, migrating to eno2 mscc_felix 0000:00:00.5 swp1: bond0 disappeared, migrating to eno2 mscc_felix 0000:00:00.5 swp2: bond0 disappeared, migrating to eno2 mscc_felix 0000:00:00.5 swp3: bond0 disappeared, migrating to eno2 Fixes: acc43b7bf52a ("net: dsa: allow masters to join a LAG") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251215150236.3931670-2-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 06e219f6a706c367c93051f408ac61417643d2f9 Author: Vladimir Oltean Date: Mon Dec 15 17:02:35 2025 +0200 net: dsa: properly keep track of conduit reference Problem description ------------------- DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense. There are two distinct problems. 1. The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch: (unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind we see these lines in the output diff which appear only with the patch applied: kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000) 2. After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()). Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it. So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference. Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()? 1: Maybe yes. A switch device will still be registered even if all user ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see whether they will actually use the conduit in lack of any user port, but if they do, it seems safer to not rely on user ports for that reference. 2. Definitely yes. We support changing the conduit which a user port is associated to, and we can get into a situation where we've moved all user ports away from a conduit, thus no longer hold any reference to it via the net device tracker. But we shouldn't let it go nonetheless - see the next change in relation to dsa_tree_find_first_conduit() and LAG conduits which disappear. We have to be prepared to return to the physical conduit, so the CPU port must explicitly keep another reference to it. This is also to say: the user ports and their CPU ports may not always keep a reference to the same conduit net device, and both are needed. As for the conduit's kobject for the /sys/class/net/ entry, we don't care about it, we can release it as soon as we hold the net device object itself. History and blame attribution ----------------------------- The code has been refactored so many times, it is very difficult to follow and properly attribute a blame, but I'll try to make a short history which I hope to be correct. We have two distinct probing paths: - one for OF, introduced in 2016 in commit 83c0afaec7b7 ("net: dsa: Add new binding implementation") - one for non-OF, introduced in 2017 in commit 71e0bbde0d88 ("net: dsa: Add support for platform data") These are both complete rewrites of the original probing paths (which used struct dsa_switch_driver and other weird stuff, instead of regular devices on their respective buses for register access, like MDIO, SPI, I2C etc): - one for OF, introduced in 2013 in commit 5e95329b701c ("dsa: add device tree bindings to register DSA switches") - one for non-OF, introduced in 2008 in commit 91da11f870f0 ("net: Distributed Switch Architecture protocol support") except for tiny bits and pieces like dsa_dev_to_net_device() which were seemingly carried over since the original commit, and used to this day. The point is that the original probing paths received a fix in 2015 in the form of commit 679fb46c5785 ("net: dsa: Add missing master netdev dev_put() calls"), but the fix never made it into the "new" (dsa2) probing paths that can still be traced to today, and the fixed probing path was later deleted in 2019 in commit 93e86b3bc842 ("net: dsa: Remove legacy probing support"). That is to say, the new probing paths were never quite correct in this area. The existence of the legacy probing support which was deleted in 2019 explains why dsa_dev_to_net_device() returns a conduit with elevated refcount (because it was supposed to be released during dsa_remove_dst()). After the removal of the legacy code, the only user of dsa_dev_to_net_device() calls dev_put(conduit) immediately after this function returns. This pattern makes no sense today, and can only be interpreted historically to understand why dev_hold() was there in the first place. Change details -------------- Today we have a better netdev tracking infrastructure which we should use. Logically netdev_hold() belongs in common code (dsa_port_parse_cpu(), where dp->conduit is assigned), but there is a tradeoff to be made with the rtnl_lock() section which would become a bit too long if we did that - dsa_port_parse_cpu() also calls request_module(). So we duplicate a bit of logic in order for the callers of dsa_port_parse_cpu() to be the ones responsible of holding the conduit reference and releasing it on error. This shortens the rtnl_lock() section significantly. In the dsa_switch_probe() error path, dsa_switch_release_ports() will be called in a number of situations, one being where dsa_port_parse_cpu() maybe didn't get the chance to run at all (a different port failed earlier, etc). So we have to test for the conduit being NULL prior to calling netdev_put(). There have still been so many transformations to the code since the blamed commits (rename master -> conduit, commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown")), that it only makes sense to fix the code using the best methods available today and see how it can be backported to stable later. I suspect the fix cannot even be backported to kernels which lack dsa_switch_shutdown(), and I suspect this is also maybe why the long-lived conduit reference didn't make it into the new DSA probing paths at the time (problems during shutdown). Because dsa_dev_to_net_device() has a single call site and has to be changed anyway, the logic was just absorbed into the non-OF dsa_port_parse(). Tested on the ocelot/felix switch and on dsa_loop, both on the NXP LS1028A with CONFIG_DEBUG_KOBJECT_RELEASE=y. Reported-by: Ma Ke Closes: https://lore.kernel.org/netdev/20251214131204.4684-1-make24@iscas.ac.cn/ Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Fixes: 71e0bbde0d88 ("net: dsa: Add support for platform data") Reviewed-by: Jonas Gorski Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251215150236.3931670-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 754c23238438600e9236719f7e67aff2c4d02093 Author: Thomas Hellström Date: Fri Dec 19 12:32:59 2025 +0100 drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use In situations where no system memory is migrated to devmem, and in upcoming patches where another GPU is performing the migration to the newly allocated devmem buffer, there is nothing to ensure any ongoing clear to the devmem allocation or async eviction from the devmem allocation is complete. Address that by passing a struct dma_fence down to the copy functions, and ensure it is waited for before migration is marked complete. v3: - New patch. v4: - Update the logic used for determining when to wait for the pre_migrate_fence. - Update the logic used for determining when to warn for the pre_migrate_fence since the scheduler fences apparently can signal out-of-order. v5: - Fix a UAF (CI) - Remove references to source P2P migration (Himal) - Put the pre_migrate_fence after migration. v6: - Pipeline the pre_migrate_fence dependency (Matt Brost) Fixes: c5b3eb5a906c ("drm/xe: Add GPUSVM device memory copy vfunc functions") Cc: Matthew Brost Cc: # v6.15+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Acked-by: Maarten Lankhorst # For merging through drm-xe. Link: https://patch.msgid.link/20251219113320.183860-4-thomas.hellstrom@linux.intel.com (cherry picked from commit 16b5ad31952476fb925c401897fc171cd37f536b) Signed-off-by: Thomas Hellström commit d2d7f5636f0d752a1e0e7eadbbc1839c29177bba Author: Thomas Hellström Date: Fri Dec 19 12:32:57 2025 +0100 drm/xe/svm: Fix a debug printout Avoid spamming the log with drm_info(). Use drm_dbg() instead. Fixes: cc795e041034 ("drm/xe/svm: Make xe_svm_range_needs_migrate_to_vram() public") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Cc: # v6.17+ Signed-off-by: Thomas Hellström Reviewed-by: Himal Prasad Ghimiray Link: https://patch.msgid.link/20251219113320.183860-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 72aee5f70ba47b939345a0d3414b51b0639c5b88) Signed-off-by: Thomas Hellström commit 5e7365b5a1ac8f517a7a84442289d7de242deb76 Author: Lorenzo Bianconi Date: Sun Dec 14 10:30:07 2025 +0100 net: airoha: Move net_devs registration in a dedicated routine Since airoha_probe() is not executed under rtnl lock, there is small race where a given device is configured by user-space while the remaining ones are not completely loaded from the dts yet. This condition will allow a hw device misconfiguration since there are some conditions (e.g. GDM2 check in airoha_dev_init()) that require all device are properly loaded from the device tree. Fix the issue moving net_devices registration at the end of the airoha_probe routine. Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2") Signed-off-by: Lorenzo Bianconi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251214-airoha-fix-dev-registration-v1-1-860e027ad4c6@kernel.org Signed-off-by: Paolo Abeni commit 35ddf66c65eff93fff91406756ba273600bf61a3 Author: Frode Nordahl Date: Sat Dec 13 10:13:36 2025 +0000 erspan: Initialize options_len before referencing options. The struct ip_tunnel_info has a flexible array member named options that is protected by a counted_by(options_len) attribute. The compiler will use this information to enforce runtime bounds checking deployed by FORTIFY_SOURCE string helpers. As laid out in the GCC documentation, the counter must be initialized before the first reference to the flexible array member. After scanning through the files that use struct ip_tunnel_info and also refer to options or options_len, it appears the normal case is to use the ip_tunnel_info_opts_set() helper. Said helper would initialize options_len properly before copying data into options, however in the GRE ERSPAN code a partial update is done, preventing the use of the helper function. Before this change the handling of ERSPAN traffic in GRE tunnels would cause a kernel panic when the kernel is compiled with GCC 15+ and having FORTIFY_SOURCE configured: memcpy: detected buffer overflow: 4 byte write of buffer size 0 Call Trace: __fortify_panic+0xd/0xf erspan_rcv.cold+0x68/0x83 ? ip_route_input_slow+0x816/0x9d0 gre_rcv+0x1b2/0x1c0 gre_rcv+0x8e/0x100 ? raw_v4_input+0x2a0/0x2b0 ip_protocol_deliver_rcu+0x1ea/0x210 ip_local_deliver_finish+0x86/0x110 ip_local_deliver+0x65/0x110 ? ip_rcv_finish_core+0xd6/0x360 ip_rcv+0x186/0x1a0 Cc: stable@vger.kernel.org Link: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-counted_005fby-variable-attribute Reported-at: https://launchpad.net/bugs/2129580 Fixes: bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info") Signed-off-by: Frode Nordahl Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251213101338.4693-1-fnordahl@ubuntu.com Signed-off-by: Paolo Abeni commit 350719c3833cddcebb58e549e4398cc59989c5c4 Merge: 932ac51d9953ea 86730ac255b049 Author: Paolo Abeni Date: Tue Dec 23 09:12:29 2025 +0100 Merge branch 'mptcp-fix-warn-on-bad-status' Matthieu Baerts says: ==================== mptcp: fix warn on bad status Two somewhat related fixes addressing different issues found by syzkaller, and producing the exact same splat: a WARNING in subflow_data_ready(). - Patch 1: fallback earlier on simultaneous connections to avoid a warning. A fix for v5.19. - Patch 2: ensure context reset on disconnect, also to avoid a similar warning. A fix for v6.2. Signed-off-by: Matthieu Baerts (NGI0) ==================== Link: https://patch.msgid.link/20251212-net-mptcp-subflow_data_ready-warn-v1-0-d1f9fd1c36c8@kernel.org Signed-off-by: Paolo Abeni commit 86730ac255b0497a272704de9a1df559f5d6602e Author: Paolo Abeni Date: Fri Dec 12 13:54:04 2025 +0100 mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC subflow is already in TCP_CLOSE status or has fallback to TCP at mptcp_disconnect() time, mptcp_do_fastclose() skips setting the `send_fastclose flag` and the later __mptcp_close_ssk() does not reset anymore the related subflow context. Any later connection will be created with both the `request_mptcp` flag and the msk-level fallback status off (it is unconditionally cleared at MPTCP disconnect time), leading to a warning in subflow_data_ready(): WARNING: CPU: 26 PID: 8996 at net/mptcp/subflow.c:1519 subflow_data_ready (net/mptcp/subflow.c:1519 (discriminator 13)) Modules linked in: CPU: 26 UID: 0 PID: 8996 Comm: syz.22.39 Not tainted 6.18.0-rc7-05427-g11fc074f6c36 #1 PREEMPT(voluntary) Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: 0010:subflow_data_ready (net/mptcp/subflow.c:1519 (discriminator 13)) Code: 90 0f 0b 90 90 e9 04 fe ff ff e8 b7 1e f5 fe 89 ee bf 07 00 00 00 e8 db 19 f5 fe 83 fd 07 0f 84 35 ff ff ff e8 9d 1e f5 fe 90 <0f> 0b 90 e9 27 ff ff ff e8 8f 1e f5 fe 4c 89 e7 48 89 de e8 14 09 RSP: 0018:ffffc9002646fb30 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88813b218000 RCX: ffffffff825c8435 RDX: ffff8881300b3580 RSI: ffffffff825c8443 RDI: 0000000000000005 RBP: 000000000000000b R08: ffffffff825c8435 R09: 000000000000000b R10: 0000000000000005 R11: 0000000000000007 R12: ffff888131ac0000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f88330af6c0(0000) GS:ffff888a93dd2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88330aefe8 CR3: 000000010ff59000 CR4: 0000000000350ef0 Call Trace: tcp_data_ready (net/ipv4/tcp_input.c:5356) tcp_data_queue (net/ipv4/tcp_input.c:5445) tcp_rcv_state_process (net/ipv4/tcp_input.c:7165) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1955) __release_sock (include/net/sock.h:1158 (discriminator 6) net/core/sock.c:3180 (discriminator 6)) release_sock (net/core/sock.c:3737) mptcp_sendmsg (net/mptcp/protocol.c:1763 net/mptcp/protocol.c:1857) inet_sendmsg (net/ipv4/af_inet.c:853 (discriminator 7)) __sys_sendto (net/socket.c:727 (discriminator 15) net/socket.c:742 (discriminator 15) net/socket.c:2244 (discriminator 15)) __x64_sys_sendto (net/socket.c:2247) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f883326702d Address the issue setting an explicit `fastclosing` flag at fastclose time, and checking such flag after mptcp_do_fastclose(). Fixes: ae155060247b ("mptcp: fix duplicate reset on fastclose") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251212-net-mptcp-subflow_data_ready-warn-v1-2-d1f9fd1c36c8@kernel.org Signed-off-by: Paolo Abeni commit 71154bbe49423128c1c8577b6576de1ed6836830 Author: Paolo Abeni Date: Fri Dec 12 13:54:03 2025 +0100 mptcp: fallback earlier on simult connection Syzkaller reports a simult-connect race leading to inconsistent fallback status: WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515 subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1515 Modules linked in: CPU: 3 UID: 0 PID: 33 Comm: ksoftirqd/3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1515 Code: 89 ee e8 78 61 3c f6 40 84 ed 75 21 e8 8e 66 3c f6 44 89 fe bf 07 00 00 00 e8 c1 61 3c f6 41 83 ff 07 74 09 e8 76 66 3c f6 90 <0f> 0b 90 e8 6d 66 3c f6 48 89 df e8 e5 ad ff ff 31 ff 89 c5 89 c6 RSP: 0018:ffffc900006cf338 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888031acd100 RCX: ffffffff8b7f2abf RDX: ffff88801e6ea440 RSI: ffffffff8b7f2aca RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000004 R11: 0000000000002c10 R12: ffff88802ba69900 R13: 1ffff920000d9e67 R14: ffff888046f81800 R15: 0000000000000004 FS: 0000000000000000(0000) GS:ffff8880d69bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560fc0ca1670 CR3: 0000000032c3a000 CR4: 0000000000352ef0 Call Trace: tcp_data_queue+0x13b0/0x4f90 net/ipv4/tcp_input.c:5197 tcp_rcv_state_process+0xfdf/0x4ec0 net/ipv4/tcp_input.c:6922 tcp_v6_do_rcv+0x492/0x1740 net/ipv6/tcp_ipv6.c:1672 tcp_v6_rcv+0x2976/0x41e0 net/ipv6/tcp_ipv6.c:1918 ip6_protocol_deliver_rcu+0x188/0x1520 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1e4/0x4b0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:500 dst_input include/net/dst.h:471 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x264/0x650 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5979 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6092 process_backlog+0x442/0x15e0 net/core/dev.c:6444 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7494 napi_poll net/core/dev.c:7557 [inline] net_rx_action+0xa9f/0xfe0 net/core/dev.c:7684 handle_softirqs+0x216/0x8e0 kernel/softirq.c:579 run_ksoftirqd kernel/softirq.c:968 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:960 smpboot_thread_fn+0x3f7/0xae0 kernel/smpboot.c:160 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The TCP subflow can process the simult-connect syn-ack packet after transitioning to TCP_FIN1 state, bypassing the MPTCP fallback check, as the sk_state_change() callback is not invoked for * -> FIN_WAIT1 transitions. That will move the msk socket to an inconsistent status and the next incoming data will hit the reported splat. Close the race moving the simult-fallback check at the earliest possible stage - that is at syn-ack generation time. About the fixes tags: [2] was supposed to also fix this issue introduced by [3]. [1] is required as a dependence: it was not explicitly marked as a fix, but it is one and it has already been backported before [3]. In other words, this commit should be backported up to [3], including [2] and [1] if that's not already there. Fixes: 23e89e8ee7be ("tcp: Don't drop SYN+ACK for simultaneous connect().") [1] Fixes: 4fd19a307016 ("mptcp: fix inconsistent state on fastopen race") [2] Fixes: 1e777f39b4d7 ("mptcp: add MSG_FASTOPEN sendmsg flag support") [3] Cc: stable@vger.kernel.org Reported-by: syzbot+0ff6b771b4f7a5bce83b@syzkaller.appspotmail.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/586 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251212-net-mptcp-subflow_data_ready-warn-v1-1-d1f9fd1c36c8@kernel.org Signed-off-by: Paolo Abeni commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 Author: Jiri Pirko Date: Fri Dec 12 11:29:53 2025 +0100 team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000 RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005 RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230 R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480 FS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_rcu include/linux/rculist.h:178 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline] team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline] team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534 team_option_set drivers/net/team/team_core.c:376 [inline] team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684 __sys_sendmsg+0x16d/0x220 net/socket.c:2716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The problem is in this flow: 1) Port is enabled, queue_id != 0, in qom_list 2) Port gets disabled -> team_port_disable() -> team_queue_override_port_del() -> del (removed from list) 3) Port is disabled, queue_id != 0, not in any list 4) Priority changes -> team_queue_override_port_prio_changed() -> checks: port disabled && queue_id != 0 -> calls del - hits the BUG as it is removed already To fix this, change the check in team_queue_override_port_prio_changed() so it returns early if port is not enabled. Reported-by: syzbot+422806e5f4cce722a71f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=422806e5f4cce722a71f Fixes: 6c31ff366c11 ("team: remove synchronize_rcu() called during queue override change") Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251212102953.167287-1-jiri@resnulli.us Signed-off-by: Paolo Abeni commit ccaeeb585c7c2a0ac67ee1af9acb4d1411dc409e Author: Zqiang Date: Mon Dec 22 19:53:17 2025 +0800 sched_ext: Use the resched_cpu() to replace resched_curr() in the bypass_lb_node() For the PREEMPT_RT kernels, the scx_bypass_lb_timerfn() running in the preemptible per-CPU ktimer kthread context, this means that the following scenarios will occur(for x86 platform): cpu1 cpu2 ktimer kthread: ->scx_bypass_lb_timerfn ->bypass_lb_node ->for_each_cpu(cpu, resched_mask) migration/1: by preempt by migration/2: multi_cpu_stop() multi_cpu_stop() ->take_cpu_down() ->__cpu_disable() ->set cpu1 offline ->rq1 = cpu_rq(cpu1) ->resched_curr(rq1) ->smp_send_reschedule(cpu1) ->native_smp_send_reschedule(cpu1) ->if(unlikely(cpu_is_offline(cpu))) { WARN(1, "sched: Unexpected reschedule of offline CPU#%d!\n", cpu); return; } This commit therefore use the resched_cpu() to replace resched_curr() in the bypass_lb_node() to avoid send-ipi to offline CPUs. Signed-off-by: Zqiang Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 3572ad82201baeed840f1959787e0e1281e7f937 Merge: 6c11aa2b4cf767 870b10f61d527f Author: Mark Brown Date: Mon Dec 22 22:13:03 2025 +0000 ASoC: drop bogus container_of() error handling Merge series from Johan Hovold : The dev_to_sdw_dev() helper uses container_of() to return the containing soundwire device structure of its pointer argument and will never return NULL. commit c31f4aa8fed048fa70e742c4bb49bb48dc489ab3 Author: David Gow Date: Fri Dec 19 16:52:58 2025 +0800 kunit: Enforce task execution in {soft,hard}irq contexts The kunit_run_irq_test() helper allows a function to be run in hardirq and softirq contexts (in addition to the task context). It does this by running the user-provided function concurrently in the three contexts, until either a timeout has expired or a number of iterations have completed in the normal task context. However, on setups where the initialisation of the hardirq and softirq contexts (or, indeed, the scheduling of those tasks) is significantly slower than the function execution, it's possible for that number of iterations to be exceeded before any runs in irq contexts actually occur. This occurs with the polyval.test_polyval_preparekey_in_irqs test, which runs 20000 iterations of the relatively fast preparekey function, and therefore fails often under many UML, 32-bit arm, m68k and other environments. Instead, ensure that the max_iterations limit counts executions in all three contexts, and requires at least one of each. This will cause the test to continue iterating until at least the irq contexts have been tested, or the 1s wall-clock limit has been exceeded. This causes the test to pass in all of my environments. In so doing, we also update the task counters to atomic ints, to better match both the 'int' max_iterations input, and to ensure they are correctly updated across contexts. Finally, we also fix a few potential assertion messages to be less-specific to the original crypto usecases. Fixes: 950a81224e8b ("lib/crypto: tests: Add hash-test-template.h and gen-hash-testvecs.py") Signed-off-by: David Gow Link: https://lore.kernel.org/r/20251219085259.1163048-1-davidgow@google.com Signed-off-by: Eric Biggers commit 6c11aa2b4cf767f5ccfe290b2572d53102dbe5ea Author: Chen-Yu Tsai Date: Sun Dec 21 11:57:13 2025 +0800 ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks When sun4i_spdif_quirks was recently expanded, the kerneldoc covering the structure was not expanded to match. This ends up causing a warning when the documents are built. Add the missing fields. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202501311953.0Ox9CW5w-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202503060947.QKUUR62l-lkp@intel.com/ Fixes: 0a2319308de8 ("ASoC: sun4i-spdif: Add clock multiplier settings") Fixes: 4a5ac6cd05a7 ("ASoC: sun4i-spdif: Support SPDIF output on A523 family") Signed-off-by: Chen-Yu Tsai Reviewed-by: Marcus Cooper Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20251221035715.1722584-1-wens@kernel.org Signed-off-by: Mark Brown commit 97af54473f2a79f663bd14d7c75e97d04bd0e283 Author: Johan Hovold Date: Fri Dec 19 15:24:12 2025 +0100 ASoC: codecs: pm4125: clean up bind() device reference handling A recent change fixed a couple of device leaks on component bind failure and on unbind but did so in a confusing way by adding misleading initialisations at bind() and bogus NULL checks at unbind(). Cc: Ma Ke Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251219142412.19043-1-johan@kernel.org Signed-off-by: Mark Brown commit b927546677c876e26eba308550207c2ddf812a43 Merge: 9448598b22c50c 7f2e8e1d22f6e2 Author: Linus Torvalds Date: Mon Dec 22 09:37:59 2025 -0800 Merge tag 'dma-mapping-6.19-2025-12-22' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: - fix boot failure of parisc systems after recent rework of the DMA API infrastructure (Leon Romanovsky) * tag 'dma-mapping-6.19-2025-12-22' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: parisc: Set valid bit in high byte of 64‑bit physical address commit 20e20b147cf7cb6780a5b95da2a0e37c52cd1015 Author: Randy Dunlap Date: Mon Dec 15 22:38:00 2025 -0800 platform/x86/intel/vsec: correct kernel-doc comments Fix kernel-doc warnings in intel_vsec.h to eliminate all kernel-doc warnings: Warning: include/linux/intel_vsec.h:92 struct member 'read_telem' not described in 'pmt_callbacks' Warning: include/linux/intel_vsec.h:146 expecting prototype for struct intel_sec_device. Prototype was for struct intel_vsec_device instead Warning: include/linux/intel_vsec.h:146 struct member 'priv_data_size' not described in 'intel_vsec_device' In struct pmt_callbacks, correct the kernel-doc for @read_telem. kernel-doc doesn't support documenting callback function parameters, so drop the '@' signs on those and use "* *" to make them somewhat readable in the produced documentation output. Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251216063801.2896495-1-rdunlap@infradead.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 15dd100349b8526cbdf2de0ce3e72e700eb6c208 Author: Junrui Luo Date: Fri Dec 19 16:30:29 2025 +0800 platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic The ibm_rtl_init() function searches for the signature but has a pointer arithmetic error. The loop counter suggests searching at 4-byte intervals but the implementation only advances by 1 byte per iteration. Fix by properly advancing the pointer by sizeof(unsigned int) bytes each iteration. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 35f0ce032b0f ("IBM Real-Time "SMI Free" mode driver -v7") Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB78812D887A92DE3802D0D06EAFA9A@SYBPR01MB7881.ausprd01.prod.outlook.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1461209cf813b6ee6d40f29b96b544587df6d2b1 Author: Thomas Fourier Date: Wed Dec 17 11:36:13 2025 +0100 platform/x86: msi-laptop: add missing sysfs_remove_group() A sysfs group is created in msi_init() when old_ec_model is enabled, but never removed. Remove the msipf_old_attribute_group in that case. Fixes: 03696e51d75a ("msi-laptop: Disable brightness control for new EC") Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20251217103617.27668-2-fourier.thomas@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 05126063605f26f9228c69b1ff232ac6e78f72ab Author: Mark Pearson Date: Thu Nov 27 15:29:48 2025 -0500 platform/x86: think-lmi: Add WMI certificate thumbprint support for ThinkCenter The ThinkCenter team are adding WMI certificate thumbprint support. Updating the driver to enable it. They are using the same GUID as Thinkpad/ThinkStation. Tested on M75q Gen 5. Signed-off-by: Mark Pearson Link: https://patch.msgid.link/20251127202959.399040-1-mpearson-lenovo@squebb.ca Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a5b9fdd33c59a964a26d12c39b636ef85a25b074 Author: Dmytro Bagrii Date: Fri Nov 28 18:15:23 2025 +0200 platform/x86: dell-lis3lv02d: Add Latitude 5400 Add accelerometer address 0x29 for Dell Latitude 5400. The address is verified as below: $ cat /sys/class/dmi/id/product_name Latitude 5400 $ grep -H '' /sys/bus/pci/drivers/i801_smbus/0000\:00*/i2c-*/name /sys/bus/pci/drivers/i801_smbus/0000:00:1f.4/i2c-10/name:SMBus I801 adapter at 0000:00:1f.4 $ i2cdetect 10 WARNING! This program can confuse your I2C bus, cause data loss and worse! I will probe file /dev/i2c-10. I will probe address range 0x08-0x77. Continue? [Y/n] Y 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: 08 -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- UU -- -- -- -- -- -- 30: 30 -- -- -- -- 35 UU UU -- -- -- -- -- -- -- -- 40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- -- 50: UU -- 52 -- -- -- -- -- -- -- -- -- -- -- -- -- 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- $ xargs -n1 -a /proc/cmdline | grep ^dell_lis3lv02d dell_lis3lv02d.probe_i2c_addr=1 $ dmesg | grep lis3lv02d ... [ 206.012411] i2c i2c-10: Probing for lis3lv02d on address 0x29 [ 206.013727] i2c i2c-10: Detected lis3lv02d on address 0x29, please report this upstream to platform-driver-x86@vger.kernel.org so that a quirk can be added [ 206.240841] lis3lv02d_i2c 10-0029: supply Vdd not found, using dummy regulator [ 206.240868] lis3lv02d_i2c 10-0029: supply Vdd_IO not found, using dummy regulator [ 206.261258] lis3lv02d: 8 bits 3DC sensor found [ 206.346722] input: ST LIS3LV02DL Accelerometer as /devices/faux/lis3lv02d/input/input17 $ cat /sys/class/input/input17/name ST LIS3LV02DL Accelerometer Signed-off-by: Dmytro Bagrii Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20251128161523.6224-1-dimich.dmb@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f13bce715d1600698310a4a7832f6a52499d5395 Author: Shravan Kumar Ramani Date: Thu Dec 18 12:18:13 2025 +0000 platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names Some event names have trailing whitespaces at the end which causes programming of counters using the name for these specific events to fail and hence need to be removed. Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") Signed-off-by: Shravan Kumar Ramani Reviewed-by: David Thompson Link: https://patch.msgid.link/065cbae0717dcc1169681c4dbb1a6e050b8574b3.1766059953.git.shravankr@nvidia.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e521dc1687834d0e8c7506f1fdf00daab4ebb51d Author: Tim Wassink Date: Sun Dec 21 19:17:14 2025 +0100 platform/x86: asus-nb-wmi: Add keymap for display toggle On the Asus Zenbook 14 (UX3405MA), the Fn+F7 key combination emits WMI code 0x2d, which was previously unmapped. Map this code to KEY_DISPLAYTOGGLE. This matches the behavior of the display toggle/projector mode key found on other Asus laptops, allowing userspace to handle multi-monitor switching or screen toggling. Tested on ASUS Zenbook 14 UX3405MA. Signed-off-by: Tim Wassink Reviewed-by: Denis Benato Link: https://patch.msgid.link/20251221181724.19927-1-timwassink.dev@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 608328ba5b0619cbc28b409296b5e3840bcb97b6 Author: Christophe Leroy (CS GROUP) Date: Fri Dec 19 13:23:52 2025 +0100 powerpc/32: Restore disabling of interrupts at interrupt/syscall exit Commit 2997876c4a1a ("powerpc/32: Restore clearing of MSR[RI] at interrupt/syscall exit") delayed clearing of MSR[RI], but missed that both MSR[RI] and MSR[EE] are cleared at the same time, so the commit also delayed the disabling of interrupts, leading to unexpected behaviour. To fix that, mostly revert the blamed commit and restore the clearing of MSR[RI] in interrupt_exit_kernel_prepare() instead. For 8xx it implies adding a synchronising instruction after the mtspr in order to make sure no instruction counter interrupt (used for perf events) will fire just after clearing MSR[RI]. Reported-by: Christian Zigotzky Closes: https://lore.kernel.org/all/4d0bd05d-6158-1323-3509-744d3fbe8fc7@xenosoft.de/ Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/6b05eb1c-fdef-44e0-91a7-8286825e68f1@roeck-us.net/ Fixes: 2997876c4a1a ("powerpc/32: Restore clearing of MSR[RI] at interrupt/syscall exit") Signed-off-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/585ea521b2be99d293b539bbfae148366cfb3687.1766146895.git.chleroy@kernel.org commit ce652c98a7bfa0b7c675ef5cd85c44c186db96af Author: Geraldo Nascimento Date: Mon Nov 17 18:47:59 2025 -0300 arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s This is already the default in rk3399-base.dtsi, remove redundant declaration from rk3399-nanopi-r4s.dtsi. Fixes: db792e9adbf8 ("rockchip: rk3399: Add support for FriendlyARM NanoPi R4S") Cc: stable@vger.kernel.org Reported-by: Dragan Simic Reviewed-by: Dragan Simic Signed-off-by: Geraldo Nascimento Acked-by: Shawn Lin Link: https://patch.msgid.link/6694456a735844177c897581f785cc00c064c7d1.1763415706.git.geraldogabriel@gmail.com Signed-off-by: Heiko Stuebner commit 0368e4afcf20f377c81fa77b1c7d0dee4a625a44 Author: Geraldo Nascimento Date: Mon Nov 17 18:47:43 2025 -0300 arm64: dts: rockchip: remove dangerous max-link-speed from helios64 Shawn Lin from Rockchip strongly discourages attempts to use their RK3399 PCIe core at 5.0 GT/s speed, citing concerns about catastrophic failures that may happen. Even if the odds are low, drop from last user of this non-default property for the RK3399 platform, helios64 board dts. Fixes: 755fff528b1b ("arm64: dts: rockchip: add variables for pcie completion to helios64") Link: https://lore.kernel.org/all/e8524bf8-a90c-423f-8a58-9ef05a3db1dd@rock-chips.com/ Cc: stable@vger.kernel.org Reported-by: Shawn Lin Reviewed-by: Dragan Simic Signed-off-by: Geraldo Nascimento Acked-by: Shawn Lin Link: https://patch.msgid.link/43bb639c120f599106fca2deee6c6599b2692c5c.1763415706.git.geraldogabriel@gmail.com Signed-off-by: Heiko Stuebner commit cd8967ea3105d30adb878a9fea0e34a9378df610 Author: Quentin Schulz Date: Mon Dec 15 17:45:56 2025 +0100 arm64: dts: rockchip: fix unit-address for RK3588 NPU's core1 and core2's IOMMU The Device Tree specification specifies[1] that """ Each node in the devicetree is named according to the following convention: node-name@unit-address [...] The unit-address must match the first address specified in the reg property of the node. """ The first address in the reg property is fdaXa000 and not fdaX9000. This is likely a copy-paste error as the IOMMU for core0 has two entries in the reg property, the first one being fdab9000 and the second fdaba000. Let's fix this oversight to match what the spec is expecting. [1] https://github.com/devicetree-org/devicetree-specification/releases/download/v0.4/devicetree-specification-v0.4.pdf 2.2.1 Node Names Fixes: a31dfc060a74 ("arm64: dts: rockchip: Add nodes for NPU and its MMU to rk3588-base") Cc: stable@vger.kernel.org Signed-off-by: Quentin Schulz Link: https://patch.msgid.link/20251215-npu-dt-node-address-v1-1-840093e8a2bf@cherry.de Signed-off-by: Heiko Stuebner commit fbe409d138b1d8a8b91cdad19cf95495e8ebe1ee Author: Aboorva Devarajan Date: Mon Sep 8 14:21:23 2025 +0530 powerpc/powernv: Enable cpuidle state detection for POWER11 Extend cpuidle state detection to POWER11 by updating the PVR check. This ensures POWER11 correctly recognizes supported stop states, similar to POWER9 and POWER10. Without Patch: (Power11 - PowerNV systems) CPUidle driver: powernv_idle CPUidle governor: menu analyzing CPU 927: Number of idle states: 1 Available idle states: snooze snooze: Flags/Description: snooze Latency: 0 Usage: 251631 Duration: 207497715900 -- With Patch: (Power11 - PowerNV systems) CPUidle driver: powernv_idle CPUidle governor: menu analyzing CPU 959: Number of idle states: 4 Available idle states: snooze stop0_lite stop0 stop3 snooze: Flags/Description: snooze Latency: 0 Usage: 2 Duration: 33 stop0_lite: Flags/Description: stop0_lite Latency: 1 Usage: 1 Duration: 52 stop0: Flags/Description: stop0 Latency: 10 Usage: 13 Duration: 1920 stop3: Flags/Description: stop3 Latency: 45 Usage: 381 Duration: 21638478 Signed-off-by: Aboorva Devarajan Tested-by: Madadi Vineeth Reddy Reviewed-by: Madadi Vineeth Reddy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250908085123.216780-1-aboorvad@linux.ibm.com commit 87e7f6019097746d1d06f98874a9f179b7a68f3e Author: Sakari Ailus Date: Fri Dec 19 10:36:38 2025 +0200 software node: Also support referencing non-constant software nodes Fwnode references are be implemented differently if referenced node is a software node. _Generic() is used to differentiate between the two cases but only const software nodes were present in the selection. Also add non-const software nodes. Reported-by: Kenneth Crudup Closes: https://lore.kernel.org/all/af773b82-bef2-4209-baaf-526d4661b7fc@panix.com/ Fixes: d7cdbbc93c56 ("software node: allow referencing firmware nodes") Signed-off-by: Sakari Ailus Tested-By: Kenneth R. Crudup Tested-by: Mehdi Djait # Dell XPS 9315 Reviewed-by: Mehdi Djait Link: https://patch.msgid.link/20251219083638.2454138-1-sakari.ailus@linux.intel.com Signed-off-by: Danilo Krummrich commit b94b73567561642323617155bf4ee24ef0d258fe Author: Finn Thain Date: Mon Nov 10 10:30:22 2025 +1100 powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() Since Linux v6.7, booting using BootX on an Old World PowerMac produces an early crash. Stan Johnson writes, "the symptoms are that the screen goes blank and the backlight stays on, and the system freezes (Linux doesn't boot)." Further testing revealed that the failure can be avoided by disabling CONFIG_BOOTX_TEXT. Bisection revealed that the regression was caused by a change to the font bitmap pointer that's used when btext_init() begins painting characters on the display, early in the boot process. Christophe Leroy explains, "before kernel text is relocated to its final location ... data is addressed with an offset which is added to the Global Offset Table (GOT) entries at the start of bootx_init() by function reloc_got2(). But the pointers that are located inside a structure are not referenced in the GOT and are therefore not updated by reloc_got2(). It is therefore needed to apply the offset manually by using PTRRELOC() macro." Cc: stable@vger.kernel.org Link: https://lists.debian.org/debian-powerpc/2025/10/msg00111.html Link: https://lore.kernel.org/linuxppc-dev/d81ddca8-c5ee-d583-d579-02b19ed95301@yahoo.com/ Reported-by: Cedar Maxwell Closes: https://lists.debian.org/debian-powerpc/2025/09/msg00031.html Bisected-by: Stan Johnson Tested-by: Stan Johnson Fixes: 0ebc7feae79a ("powerpc: Use shared font data") Suggested-by: Christophe Leroy Signed-off-by: Finn Thain Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/22b3b247425a052b079ab84da926706b3702c2c7.1762731022.git.fthain@linux-m68k.org commit 7c6bbcb010b1b8e4e6452de109f0506bb05d6efb Author: Krzysztof Kozlowski Date: Wed Dec 17 10:18:08 2025 +0100 arm64: dts: rockchip: Fix wifi interrupts flag on Sakura Pi RK3308B GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. Correct the interrupt flags, assuming the author of the code wanted same logical behavior behind the name "ACTIVE_xxx", this is: ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH Fixes: 79f2a1702441 ("arm64: dts: rockchip: add DTs for Sakura Pi RK3308B") Cc: stable+noautosel@kernel.org # Needs testing, because actual level is just a guess Signed-off-by: Krzysztof Kozlowski Acked-by: Chiyuki Akatsuki Link: https://patch.msgid.link/20251217091808.38253-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Heiko Stuebner commit f1164534ad62f0cc247d99650b07bd59ad2a49fd Author: Jan Stancek Date: Tue Sep 23 17:32:16 2025 +0200 powerpc/tools: drop `-o pipefail` in gcc check scripts Fixes: 0f71dcfb4aef ("powerpc/ftrace: Add support for -fpatchable-function-entry") Fixes: b71c9ffb1405 ("powerpc: Add arch/powerpc/tools directory") Reported-by: Joe Lawrence Acked-by: Joe Lawrence Signed-off-by: Jan Stancek Fixes: 8c50b72a3b4f ("powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel") Fixes: abba759796f9 ("powerpc/kbuild: move -mprofile-kernel check to Kconfig") Tested-by: Justin M. Forbes Reviewed-by: Naveen N Rao (AMD) Reviewed-by: Josh Poimboeuf Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/cc6cdd116c3ad9d990df21f13c6d8e8a83815bbd.1758641374.git.jstancek@redhat.com commit 42f53b39004f45a6091109176c62ba33cc52ff96 Author: Gopi Krishna Menon Date: Mon Sep 22 06:11:23 2025 +0530 selftests/powerpc/pmu/: Add check_extended_reg_test to .gitignore Add the check_extended_reg_test binary to .gitignore to avoid accidentally staging the build artifact. Signed-off-by: Gopi Krishna Menon Tested-by: Aditya Bodkhe Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250922004439.2395-1-krishnagopi487@gmail.com commit c2296a1e42418556efbeb5636c4fa6aa6106713a Author: Nysal Jan K.A. Date: Tue Oct 28 16:25:12 2025 +0530 powerpc/kexec: Enable SMT before waking offline CPUs If SMT is disabled or a partial SMT state is enabled, when a new kernel image is loaded for kexec, on reboot the following warning is observed: kexec: Waking offline cpu 228. WARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc [snip] NIP kexec_prepare_cpus+0x1b0/0x1bc LR kexec_prepare_cpus+0x1a0/0x1bc Call Trace: kexec_prepare_cpus+0x1a0/0x1bc (unreliable) default_machine_kexec+0x160/0x19c machine_kexec+0x80/0x88 kernel_kexec+0xd0/0x118 __do_sys_reboot+0x210/0x2c4 system_call_exception+0x124/0x320 system_call_vectored_common+0x15c/0x2ec This occurs as add_cpu() fails due to cpu_bootable() returning false for CPUs that fail the cpu_smt_thread_allowed() check or non primary threads if SMT is disabled. Fix the issue by enabling SMT and resetting the number of SMT threads to the number of threads per core, before attempting to wake up all present CPUs. Fixes: 38253464bc82 ("cpu/SMT: Create topology_smt_thread_allowed()") Reported-by: Sachin P Bappalige Cc: stable@vger.kernel.org # v6.6+ Reviewed-by: Srikar Dronamraju Signed-off-by: Nysal Jan K.A. Tested-by: Samir M Reviewed-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251028105516.26258-1-nysal@linux.ibm.com commit dabac51b8102e1643d8e297a8e6948dab190aa4c Author: Wang Liang Date: Fri Dec 12 09:27:23 2025 +0800 net/handshake: Fix null-ptr-deref in handshake_complete() A null pointer dereference in handshake_complete() was observed [1]. When handshake_req_next() return NULL in handshake_nl_accept_doit(), function handshake_complete() will be called unexpectedly which triggers this crash. Fix it by goto out_status when req is NULL. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI RIP: 0010:handshake_complete+0x36/0x2b0 net/handshake/request.c:288 Call Trace: handshake_nl_accept_doit+0x32d/0x7e0 net/handshake/netlink.c:129 genl_family_rcv_msg_doit+0x204/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg+0x436/0x670 net/netlink/genetlink.c:1195 genl_rcv_msg+0xcc/0x170 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x14c/0x430 net/netlink/af_netlink.c:2550 genl_rcv+0x2d/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x878/0xb20 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x897/0xd70 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa39/0xbf0 net/socket.c:2592 ___sys_sendmsg+0x121/0x1c0 net/socket.c:2646 __sys_sendmsg+0x155/0x200 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x350 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: fe67b063f687 ("net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()") Reviewed-by: Chuck Lever Reported-by: Dan Carpenter Closes: https://lore.kernel.org/kernel-tls-handshake/aScekpuOYHRM9uOd@morisot.1015granger.net/T/#m7cfa5c11efc626d77622b2981591197a2acdd65e Signed-off-by: Wang Liang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251212012723.4111831-1-wangliang74@huawei.com Signed-off-by: Paolo Abeni commit db5b4e39c4e63700c68a7e65fc4e1f1375273476 Author: Eric Dumazet Date: Thu Dec 11 17:35:50 2025 +0000 ip6_gre: make ip6gre_header() robust Over the years, syzbot found many ways to crash the kernel in ip6gre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ip6gre device. [1] skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:213 ! skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Reported-by: syzbot+43a2ebcf2a64b1102d64@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/693b002c.a70a0220.33cd7b.0033.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251211173550.2032674-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 5498227676303e3ffa9a3a46214af96bc3e81314 Author: Toke Høiland-Jørgensen Date: Thu Dec 11 12:50:05 2025 +0100 net: openvswitch: Avoid needlessly taking the RTNL on vport destroy The openvswitch teardown code will immediately call ovs_netdev_detach_dev() in response to a NETDEV_UNREGISTER notification. It will then start the dp_notify_work workqueue, which will later end up calling the vport destroy() callback. This callback takes the RTNL to do another ovs_netdev_detach_port(), which in this case is unnecessary. This causes extra pressure on the RTNL, in some cases leading to "unregister_netdevice: waiting for XX to become free" warnings on teardown. We can straight-forwardly avoid the extra RTNL lock acquisition by checking the device flags before taking the lock, and skip the locking altogether if the IFF_OVS_DATAPATH flag has already been unset. Fixes: b07c26511e94 ("openvswitch: fix vport-netdev unregister") Tested-by: Adrian Moreno Signed-off-by: Toke Høiland-Jørgensen Acked-by: Eelco Chaudron Acked-by: Aaron Conole Link: https://patch.msgid.link/20251211115006.228876-1-toke@redhat.com Signed-off-by: Paolo Abeni commit 1e5a541420b8c6d87d88eb50b6b978cdeafee1c9 Author: Miaoqian Lin Date: Thu Dec 11 12:13:13 2025 +0400 net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration When nvmem_cell_read() fails in mt798x_phy_calibration(), the function returns without calling nvmem_cell_put(), leaking the cell reference. Move nvmem_cell_put() right after nvmem_cell_read() to ensure the cell reference is always released regardless of the read result. Found via static analysis and code review. Fixes: 98c485eaf509 ("net: phy: add driver for MediaTek SoC built-in GE PHYs") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251211081313.2368460-1-linmq006@gmail.com Signed-off-by: Paolo Abeni commit 15ef641a0c6728d25a400df73922e80ab2cf029c Author: Haoxiang Li Date: Thu Dec 11 15:37:56 2025 +0800 fjes: Add missing iounmap in fjes_hw_init() In error paths, add fjes_hw_iounmap() to release the resource acquired by fjes_hw_iomap(). Add a goto label to do so. Fixes: 8cdc3f6c5d22 ("fjes: Hardware initialization routine") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Simon Horman Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251211073756.101824-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Paolo Abeni commit d1a1a4bade4b20c0858d0b2f81d2611de055f675 Author: Jacky Chou Date: Thu Dec 11 14:24:58 2025 +0800 net: mdio: aspeed: add dummy read to avoid read-after-write issue The Aspeed MDIO controller may return incorrect data when a read operation follows immediately after a write. Due to a controller bug, the subsequent read can latch stale data, causing the polling logic to terminate earlier than expected. To work around this hardware issue, insert a dummy read after each write operation. This ensures that the next actual read returns the correct data and prevents premature polling exit. This workaround has been verified to stabilize MDIO transactions on affected Aspeed platforms. Fixes: f160e99462c6 ("net: phy: Add mdio-aspeed") Signed-off-by: Jacky Chou Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251211-aspeed_mdio_add_dummy_read-v3-1-382868869004@aspeedtech.com Signed-off-by: Paolo Abeni commit bf4172bd870c3a34d3065cbb39192c22cbd7b18d Author: Ethan Nelson-Moore Date: Wed Dec 10 22:24:51 2025 -0800 net: usb: sr9700: support devices with virtual driver CD Some SR9700 devices have an SPI flash chip containing a virtual driver CD, in which case they appear as a device with two interfaces and product ID 0x9702. Interface 0 is the driver CD and interface 1 is the Ethernet device. Link: https://github.com/name-kurniawan/usb-lan Link: https://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?t=2185 Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20251211062451.139036-1-enelsonmoore@gmail.com [pabeni@redhat.com: fixes link tags] Signed-off-by: Paolo Abeni commit 9517d76dd160208b7a432301ce7bec8fc1ddc305 Author: Haotian Zhang Date: Mon Dec 15 10:01:14 2025 +0800 counter: 104-quad-8: Fix incorrect return value in IRQ handler quad8_irq_handler() should return irqreturn_t enum values, but it directly returns negative errno codes from regmap operations on error. Return IRQ_NONE if the interrupt status cannot be read. If clearing the interrupt fails, return IRQ_HANDLED to prevent the kernel from disabling the IRQ line due to a spurious interrupt storm. Also, log these regmap failures with dev_WARN_ONCE. Fixes: 98ffe0252911 ("counter: 104-quad-8: Migrate to the regmap API") Suggested-by: Andy Shevchenko Signed-off-by: Haotian Zhang Link: https://lore.kernel.org/r/20251215020114.1913-1-vulab@iscas.ac.cn Cc: stable@vger.kernel.org Signed-off-by: William Breathitt Gray commit 23f9485510c338476b9735d516c1d4aacb810d46 Author: Alexander Sverdlin Date: Tue Nov 18 09:35:48 2025 +0100 counter: interrupt-cnt: Drop IRQF_NO_THREAD flag An IRQ handler can either be IRQF_NO_THREAD or acquire spinlock_t, as CONFIG_PROVE_RAW_LOCK_NESTING warns: ============================= [ BUG: Invalid wait context ] 6.18.0-rc1+git... #1 ----------------------------- some-user-space-process/1251 is trying to lock: (&counter->events_list_lock){....}-{3:3}, at: counter_push_event [counter] other info that might help us debug this: context-{2:2} no locks held by some-user-space-process/.... stack backtrace: CPU: 0 UID: 0 PID: 1251 Comm: some-user-space-process 6.18.0-rc1+git... #1 PREEMPT Call trace: show_stack (C) dump_stack_lvl dump_stack __lock_acquire lock_acquire _raw_spin_lock_irqsave counter_push_event [counter] interrupt_cnt_isr [interrupt_cnt] __handle_irq_event_percpu handle_irq_event handle_simple_irq handle_irq_desc generic_handle_domain_irq gpio_irq_handler handle_irq_desc generic_handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler el0_interrupt __el0_irq_handler_common el0t_64_irq_handler el0t_64_irq ... and Sebastian correctly points out. Remove IRQF_NO_THREAD as an alternative to switching to raw_spinlock_t, because the latter would limit all potential nested locks to raw_spinlock_t only. Cc: Sebastian Andrzej Siewior Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20251117151314.xwLAZrWY@linutronix.de/ Fixes: a55ebd47f21f ("counter: add IRQ or GPIO based counter") Signed-off-by: Alexander Sverdlin Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Oleksij Rempel Link: https://lore.kernel.org/r/20251118083603.778626-1-alexander.sverdlin@siemens.com Signed-off-by: William Breathitt Gray commit c4c6db7ac54649c0cfe7d86b4a5358296dc8d08b Author: Linus Walleij Date: Tue Dec 16 10:40:42 2025 +0100 MAINTAINERS: Fix a linusw mail address The patch adding me to the SoC maintainers was in-flight at the time I had to change my mail address. This fixes it up. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251216-maintainers-fix-v1-1-92f11231b27e@kernel.org Signed-off-by: Krzysztof Kozlowski commit a3b80161fbd06b5dbc0af8f29f8ae58c4aebf0b2 Merge: ececfba255bf36 cf5e8adebe7791 Author: Krzysztof Kozlowski Date: Mon Dec 22 10:44:23 2025 +0100 Merge tag 'ti-k3-dt-fixes-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into arm/fixes TI K3 DT fixes for v6.19 - minor fixes for overlay files * tag 'ti-k3-dt-fixes-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings arm64: dts: ti: k3-am642-phyboard-electra-x27-gpio1-spi1-uart3: Fix schema warnings arm64: dts: ti: k3-am642-phyboard-electra-peb-c-010: Fix icssg-prueth schema warning Signed-off-by: Krzysztof Kozlowski commit 870b10f61d527fec594e0888f18cc4f32c47433d Author: Johan Hovold Date: Fri Dec 19 15:27:15 2025 +0100 ASoC: soc_sdw_utils: drop bogus container_of() error handling The dev_to_sdw_dev() helper uses container_of() to return the containing soundwire device structure of its pointer argument and will never return NULL. Fixes: 4f8ef33dd44a ("ASoC: soc_sdw_utils: skip the endpoint that doesn't present") Cc: Bard Liao Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251219142715.19254-4-johan@kernel.org Signed-off-by: Mark Brown commit 61a50d6f58b41e8a7e68d8fc8fc6bfbe30d790d8 Author: Johan Hovold Date: Fri Dec 19 15:27:14 2025 +0100 ASoC: codecs: wcd937x: drop bogus container_of() error handling The dev_to_sdw_dev() helper uses container_of() to return the containing soundwire device structure of its pointer argument and will never return NULL. Fixes: 9be3ec196da4 ("ASoC: codecs: wcd937x: add wcd937x codec driver") Cc: Prasad Kumpatla Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251219142715.19254-3-johan@kernel.org Signed-off-by: Mark Brown commit 54fa71f5f965fa3ec8846cef9d1154bcb2ba2850 Author: Johan Hovold Date: Fri Dec 19 15:27:13 2025 +0100 ASoC: codecs: pm4125: drop bogus container_of() error handling The dev_to_sdw_dev() helper uses container_of() to return the containing soundwire device structure of its pointer argument and will never return NULL. Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver") Cc: Alexey Klimov Signed-off-by: Johan Hovold Acked-by: Alexey Klimov Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251219142715.19254-2-johan@kernel.org Signed-off-by: Mark Brown commit c81f30bde5b0449d9d82d31a66f0ffd608e610b5 Author: Chen-Yu Tsai Date: Sun Dec 21 19:05:09 2025 +0800 spi: sun6i: Support A523's SPI controllers The A523 has four SPI controllers. One of them supports MIPI DBI mode in addition to standard SPI. Compared to older generations, this newer controller now has a combined counter for the RX FIFO ad buffer levels. In older generations, the RX buffer level was a separate bitfield in the FIFO status register. In practice this difference is negligible. The buffer is mostly invisible to the implementation. If programmed I/O transfers are limited to the FIFO size, then the contents of the buffer seem to always be flushed over to the FIFO. For DMA, the DRQ trigger levels are only tied to the FIFO levels. In all other aspects, the controller is the same as the one in the R329. Support the standard SPI mode controllers using the settings for R329. DBI is left out as there currently is no infrastructure for enabling a DBI host controller, as was the case for the R329. Also fold the entry for the R329 to make the style consistent. Signed-off-by: Chen-Yu Tsai Reviewed-by: Jernej Skrabec Link: https://patch.msgid.link/20251221110513.1850535-3-wens@kernel.org Signed-off-by: Mark Brown commit e0c8755d44eb85afd40100586076c3dc4b62ee3b Author: Chen-Yu Tsai Date: Sun Dec 21 19:05:08 2025 +0800 spi: dt-bindings: sun6i: Add compatibles for A523's SPI controllers The A523 has four SPI controllers. One of them supports MIPI DBI mode in addition to standard SPI. Compared to older generations, this newer controller now has a combined counter for the RX FIFO ad buffer levels. In older generations, the RX buffer level was a separate bitfield in the FIFO status register. In practice this difference is negligible. The buffer is mostly invisible to the implementation. If programmed I/O transfers are limited to the FIFO size, then the contents of the buffer seem to always be flushed over to the FIFO. For DMA, the DRQ trigger levels are only tied to the FIFO levels. In all other aspects, the controller is the same as the one in the R329. Add new compatible strings for the new controllers. Signed-off-by: Chen-Yu Tsai Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251221110513.1850535-2-wens@kernel.org Signed-off-by: Mark Brown commit 9c6552cc209788b77b45ff6c4b3869131da1c47e Author: Thomas Weißschuh Date: Mon Dec 22 08:49:13 2025 +0100 regulator: Add UAPI headers to MAINTAINERS The regulator UAPI headers were missing an entry in MAINTAINERS, add it. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251222-maintainers-regulator-v1-1-7572390fdf1b@linutronix.de Signed-off-by: Mark Brown commit b61104e7a6349bd2c2b3e2fb3260d87f15eda8f4 Author: Thomas Weißschuh Date: Mon Dec 22 08:45:48 2025 +0100 regulator: uapi: Use UAPI integer type Using libc types and headers from the UAPI headers is problematic as it introduces a dependency on a full C toolchain. Use the fixed-width integer type provided by the UAPI headers instead. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251222-uapi-regulator-v1-1-a71c66eb1a94@linutronix.de Signed-off-by: Mark Brown commit a0c8ee09f94ba5a29ee5f7557eb2bc100d5e739a Author: Bard Liao Date: Fri Dec 19 11:49:37 2025 +0800 ASoC: SOF: Intel: add -bt tplg suffix if BT is present We need to distinguish the topologies with and without BT PCM. Signed-off-by: Bard Liao Reviewed-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Link: https://patch.msgid.link/20251219034937.3630569-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit e4ca5ecc3c411f2fe970369f55bb72ac96adea85 Author: Mac Chiang Date: Fri Dec 19 11:49:02 2025 +0800 ASoC: Intel: sof_sdw: shift SSP BT mask bits. The SSP BT mask bits overlapped with SOC_SDW_CODEC_SPKR, SOC_SDW_SIDECAR_AMPS, and SOC_SDW_CODEC_MIC BIT[15–17] in sdw_utils.h. Shift the SSP BT mask bits to a higher range to eliminate the conflict. Signed-off-by: Mac Chiang Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251219034902.3630537-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 9b68a1cc966bc947d00e4c0df7722d118125aa37 Author: Ding Hui Date: Mon Dec 8 15:21:10 2025 +0800 RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR. BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different num_counters values on chip_gen_p5_p7 devices. As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating hw_stats, which leads to an out-of-bounds write in bnxt_re_copy_err_stats(). The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not only p5/p7 devices. Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set. Fixes: ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") Reported-by: Yingying Zheng Signed-off-by: Ding Hui Link: https://patch.msgid.link/20251208072110.28874-1-dinghui@sangfor.com.cn Reviewed-by: Kalesh AP Tested-by: Kalesh AP Signed-off-by: Leon Romanovsky commit f01765a2361323e78e3d91b1cb1d5527a83c5cf7 Author: Alok Tiwari Date: Fri Dec 19 01:32:57 2025 -0800 RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send The bnxt_re SEND path checks wr->send_flags to enable features such as IP checksum offload. However, send_flags is a bitmask and may contain multiple flags (e.g. IB_SEND_SIGNALED | IB_SEND_IP_CSUM), while the existing code uses a switch() statement that only matches when send_flags is exactly IB_SEND_IP_CSUM. As a result, checksum offload is not enabled when additional SEND flags are present. Replace the switch() with a bitmask test: if (wr->send_flags & IB_SEND_IP_CSUM) This ensures IP checksum offload is enabled correctly when multiple SEND flags are used. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20251219093308.2415620-1-alok.a.tiwari@oracle.com Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit 4c7d8eb9a79ae5400eac19c4f6f0815bff674452 Author: ChenXiaoSong Date: Sat Dec 20 21:25:51 2025 +0800 smb/server: fix minimum SMB2 PDU size The minimum SMB2 PDU size should be updated to the size of `struct smb2_pdu` (that is, the size of `struct smb2_hdr` + 2). Suggested-by: David Howells Suggested-by: Namjae Jeon Signed-off-by: ChenXiaoSong Reviewed-by: David Howells Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3b9c30eb8f5aaad4a54cdfa470b74c0467cc71e8 Author: ChenXiaoSong Date: Sat Dec 20 21:25:50 2025 +0800 smb/server: fix minimum SMB1 PDU size Since the RFC1002 header has been removed from `struct smb_hdr`, the minimum SMB1 PDU size should be updated as well. Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") Suggested-by: David Howells Suggested-by: Namjae Jeon Signed-off-by: ChenXiaoSong Reviewed-by: David Howells Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0b444cfd8b74ebce421ccd96eac9c495e536c92e Author: Namjae Jeon Date: Fri Dec 19 10:04:25 2025 +0900 ksmbd: rename smb2_get_msg to smb_get_msg With the removal of the RFC1002 length field from the SMB header, smb2_get_msg is now used to get the smb1 request from the request buffer. Since this function is no longer exclusive to smb2 and now supports smb1 as well, This patch rename it to smb_get_msg to better reflect its usage. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 0a70cac7896712a08e3cd22c16f44be976d40dbf Author: David Howells Date: Fri Dec 19 01:20:34 2025 +0900 ksmbd: Fix to handle removal of rfc1002 header from smb_hdr The commit that removed the RFC1002 header from struct smb_hdr didn't also fix the places in ksmbd that use it in order to provide graceful rejection of SMB1 protocol requests. Fixes: 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") Reported-by: Namjae Jeon Link: https://lore.kernel.org/r/CAKYAXd9Ju4MFkkH5Jxfi1mO0AWEr=R35M3vQ_Xa7Yw34JoNZ0A@mail.gmail.com/ Cc: ChenXiaoSong Signed-off-by: David Howells Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 9448598b22c50c8a5bb77a9103e2d49f134c9578 Author: Linus Torvalds Date: Sun Dec 21 15:52:04 2025 -0800 Linux 6.19-rc2 commit 1123cfe8cfe942e604a2693494b234dfba8b9fee Merge: 10a0e846d806b7 52ad85fd33a72c Author: Linus Torvalds Date: Sun Dec 21 15:28:59 2025 -0800 Merge tag 'coccinelle-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull Coccinelle fixes from Julia Lawall: "These fix a typo and make the coccicheck script more robust by ensuring that only compatible semantic patches are executed for the chosen mode" * tag 'coccinelle-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: Coccinelle: pm_runtime: Fix typo in report message scripts: coccicheck: filter *.cocci files by MODE commit 10a0e846d806b779a059b6ee35df729b96cc3ad1 Merge: 765b233a9b9456 248d3a73a0167d Author: Linus Torvalds Date: Sun Dec 21 15:21:10 2025 -0800 Merge tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a quirk for i8042 to better handle another TUXEDO model - a quirk to atkbd to handle incorcet behavior of HONOR FMB-P internal keyboard - a definition for a new ABS_SND_PROFILE event - fixes to alps and lkkbd drivers to reliably shut down pending work on removal - a fix to apple_z2 driver tightening input report parsing - a fix for "off-by-one" error when validating config in ti_am335x_tsc driver - addition of CRKD Guitars device IDs to xpad driver. * tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation Input: xpad - add support for CRKD Guitars Input: add ABS_SND_PROFILE Input: apple_z2 - fix reading incorrect reports after exiting sleep Input: alps - fix use-after-free bugs caused by dev3_register_work Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard Input: lkkbd - disable pending work before freeing device commit 765b233a9b945671ae9c5854e349ad50973a6837 Merge: 44087d3d461994 880977fdc7f679 Author: Linus Torvalds Date: Sun Dec 21 15:05:47 2025 -0800 Merge tag 'i2c-for-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - bcm, pxa, rcar: fix void-pointer-to-enum-cast warning - new hardware IDs / DT bindings for - Intel Nova Lake-S - Mobileye - Qualcomm SM8750 * tag 'i2c-for-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: dt-bindings: i2c: qcom-cci: Document SM8750 compatible i2c: i801: Add support for Intel Nova Lake-S dt-bindings: i2c: dw: Add Mobileye I2C controllers i2c: rcar: Fix Wvoid-pointer-to-enum-cast warning i2c: pxa: Fix Wvoid-pointer-to-enum-cast warning i2c: bcm-iproc: Fix Wvoid-pointer-to-enum-cast warning commit 44087d3d461994f5b955cf8605f9457a7c230e74 Merge: 610192c229ce90 c56a12c71ad38f Author: Linus Torvalds Date: Sun Dec 21 14:41:29 2025 -0800 Merge tag 'x86-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix FPU core dumps on certain CPU models - Fix htmldocs build warning - Export TLB tracing event name via header - Remove unused constant from - Fix comments - Fix whitespace noise in documentation - Fix variadic structure's definition to un-confuse UBSAN - Fix posted MSI interrupts irq_retrigger() bug - Fix asm build failure with older GCC builds * tag 'x86-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bug: Fix old GCC compile fails x86/msi: Make irq_retrigger() functional for posted MSI x86/platform/uv: Fix UBSAN array-index-out-of-bounds mm: Remove tlb_flush_reason::NR_TLB_FLUSH_REASONS from x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in x86/sgx: Remove unmatched quote in __sgx_encl_extend function comment x86/boot/Documentation: Fix whitespace noise in boot.rst x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures x86/boot/Documentation: Fix htmldocs build warning due to malformed table in boot.rst commit 610192c229ce908dc7d04e2848751fcc3bbde273 Merge: 9094662f6707d1 fbbd7ce627af73 Author: Linus Torvalds Date: Sun Dec 21 14:34:13 2025 -0800 Merge tag 'irq-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Ingo Molnar: "Fix IRQ thread affinity flags setup regression" * tag 'irq-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Don't overwrite interrupt thread flags on setup commit 52ad85fd33a72c47877384fcf605e0bdb2ad1848 Author: Thorsten Blum Date: Sat Nov 22 12:48:04 2025 +0100 Coccinelle: pm_runtime: Fix typo in report message s/Unecessary/Unnecessary/ Reviewed-by: Julia Lawall Signed-off-by: Thorsten Blum commit 3766511de1ce62472898d0ffafeb2551c880b161 Author: Songwei Chai Date: Fri Jun 6 14:09:36 2025 +0800 scripts: coccicheck: filter *.cocci files by MODE Enhance the coccicheck script to filter *.cocci files based on the specified MODE (e.g., report, patch). This ensures that only compatible semantic patch files are executed, preventing errors such as: "virtual rule report not supported" This error occurs when a .cocci file does not define a 'virtual ' rule, yet is executed in that mode. For example: make coccicheck M=drivers/hwtracing/coresight/ MODE=report In this case, running "secs_to_jiffies.cocci" would trigger the error because it lacks support for 'report' mode. With this change, such files are skipped automatically, improving robustness and developer experience. Signed-off-by: Songwei Chai Reviewed-by: Julia Lawall commit 3fbd97618f49e07e05aad96510e5f2ed22d68809 Author: Thomas Zimmermann Date: Tue Dec 9 14:41:59 2025 +0100 drm/gem-shmem: Fix the MODULE_LICENSE() string Replace the bogus "GPL v2" with "GPL" as MODULE_LICNSE() string. The value does not declare the module's exact license, but only lets the module loader test whether the module is Free Software or not. See commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs. "GPL v2" bogosity") in the details of the issue. The fix is to use "GPL" for all modules under any variant of the GPL. Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Fixes: 4b2b5e142ff4 ("drm: Move GEM memory managers into modules") Link: https://patch.msgid.link/20251209140141.94407-3-tzimmermann@suse.de commit 8f05e411aee3ce27ab7b790181cbac9eb81bfedc Author: Thomas Zimmermann Date: Tue Dec 9 14:41:58 2025 +0100 drm/gem-shmem: Fix typos in documentation Fix the compile-time warnings Warning: drm_gem_shmem_helper.c:104 function parameter 'shmem' not described in 'drm_gem_shmem_init' Warning: drm_gem_shmem_helper.c:104 function parameter 'size' not described in 'drm_gem_shmem_init' Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Fixes: e3f4bdaf2c5b ("drm/gem/shmem: Extract drm_gem_shmem_init() from drm_gem_shmem_create()") Link: https://patch.msgid.link/20251209140141.94407-2-tzimmermann@suse.de commit 81d5a5366d3c20203fb9d7345e1aa46d668445a2 Author: Fiona Klute Date: Sat Dec 13 17:32:26 2025 +0100 iio: chemical: scd4x: fix reported channel endianness The driver converts values read from the sensor from BE to CPU endianness in scd4x_read_meas(). The result is then pushed into the buffer in scd4x_trigger_handler(), so on LE architectures parsing the buffer using the reported BE type gave wrong results. scd4x_read_raw() which provides sysfs *_raw values is not affected, it used the values returned by scd4x_read_meas() without further conversion. Fixes: 49d22b695cbb6 ("drivers: iio: chemical: Add support for Sensirion SCD4x CO2 sensor") Signed-off-by: Fiona Klute Reviewed-by: David Lechner Cc: Signed-off-by: Jonathan Cameron commit 943cbf906956a6c081636bec2458a31dbe482170 Author: Jean-Baptiste Maneyrol Date: Thu Dec 18 11:30:59 2025 +0100 iio: imu: inv_icm45600: fix temperature offset reporting Correct temperature computation is (raw + offset) * scale and not apply scale and offset afterward. Fix temperature offset reporting to the correct value and update commentaries for the new computation. Fixes: 27e072bc34d1 ("iio: imu: inv_icm45600: add IMU IIO gyroscope device") Signed-off-by: Jean-Baptiste Maneyrol Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit ea6b4feba85e996e840e0b661bc42793df6eb701 Author: Johan Hovold Date: Fri Dec 19 12:05:45 2025 +0100 iio: adc: exynos_adc: fix OF populate on driver rebind Since commit c6e126de43e7 ("of: Keep track of populated platform devices") child devices will not be created by of_platform_populate() if the devices had previously been deregistered individually so that the OF_POPULATED flag is still set in the corresponding OF nodes. Switch to using of_platform_depopulate() instead of open coding so that the child devices are created if the driver is rebound. Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") Cc: stable@vger.kernel.org # 3.16 Signed-off-by: Johan Hovold Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 4012d78562193ef5eb613bad4b0c0fa187637cfe Author: Junbeom Yeom Date: Fri Dec 19 21:40:31 2025 +0900 erofs: fix unexpected EIO under memory pressure erofs readahead could fail with ENOMEM under the memory pressure because it tries to alloc_page with GFP_NOWAIT | GFP_NORETRY, while GFP_KERNEL for a regular read. And if readahead fails (with non-uptodate folios), the original request will then fall back to synchronous read, and `.read_folio()` should return appropriate errnos. However, in scenarios where readahead and read operations compete, read operation could return an unintended EIO because of an incorrect error propagation. To resolve this, this patch modifies the behavior so that, when the PCL is for read(which means pcl.besteffort is true), it attempts actual decompression instead of propagating the privios error except initial EIO. - Page size: 4K - The original size of FileA: 16K - Compress-ratio per PCL: 50% (Uncompressed 8K -> Compressed 4K) [page0, page1] [page2, page3] [PCL0]---------[PCL1] - functions declaration: . pread(fd, buf, count, offset) . readahead(fd, offset, count) - Thread A tries to read the last 4K - Thread B tries to do readahead 8K from 4K - RA, besteffort == false - R, besteffort == true pread(FileA, buf, 4K, 12K) do readahead(page3) // failed with ENOMEM wait_lock(page3) if (!uptodate(page3)) goto do_read readahead(FileA, 4K, 8K) // Here create PCL-chain like below: // [null, page1] [page2, null] // [PCL0:RA]-----[PCL1:RA] ... do read(page3) // found [PCL1:RA] and add page3 into it, // and then, change PCL1 from RA to R ... // Now, PCL-chain is as below: // [null, page1] [page2, page3] // [PCL0:RA]-----[PCL1:R] // try to decompress PCL-chain... z_erofs_decompress_queue err = 0; // failed with ENOMEM, so page 1 // only for RA will not be uptodated. // it's okay. err = decompress([PCL0:RA], err) // However, ENOMEM propagated to next // PCL, even though PCL is not only // for RA but also for R. As a result, // it just failed with ENOMEM without // trying any decompression, so page2 // and page3 will not be uptodated. ** BUG HERE ** --> err = decompress([PCL1:R], err) return err as ENOMEM ... wait_lock(page3) if (!uptodate(page3)) return EIO <-- Return an unexpected EIO! ... Fixes: 2349d2fa02db ("erofs: sunset unneeded NOFAILs") Cc: stable@vger.kernel.org Reviewed-by: Jaewook Kim Reviewed-by: Sungjong Seo Signed-off-by: Junbeom Yeom Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit fa3c411d21ebc26ffd175c7256c37cefa35020aa Author: Tetsuo Handa Date: Sat Dec 20 11:11:33 2025 +0900 RDMA/core: always drop device refcount in ib_del_sub_device_and_put() Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add support to add/delete a sub IB device through netlink") grabs a reference using ib_device_get_by_index() before calling ib_del_sub_device_and_put(), we need to drop that reference before returning -EOPNOTSUPP error. Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Fixes: bca51197620a ("RDMA/core: Support IB sub device with type "SMI"") Signed-off-by: Tetsuo Handa Link: https://patch.msgid.link/80749a85-cbe2-460c-8451-42516013f9fa@I-love.SAKURA.ne.jp Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky commit 441ac29923c9172bc5e4b2c4f52ae756192f5715 Author: Kübrich, Andreas Date: Mon Nov 17 12:35:13 2025 +0000 iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl The chip info for this variant (I2C, four channels, 14 bit, internal reference) seems to have been left out due to oversight, so ad5686_chip_info_tbl[ID_AD5695R] is all zeroes. Initialisation of an AD5695R still succeeds, but the resulting IIO device has no channels and no /dev/iio:device* node. Add the missing chip info to the table. Fixes: 4177381b4401 ("iio:dac:ad5686: Add AD5671R/75R/94/94R/95R/96/96R support") Signed-off-by: Andreas Kübrich Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit 4ff39d6de4bf359ec6d5cd2be34b36d077dd0a07 Author: Francesco Lavra Date: Fri Nov 28 18:21:38 2025 +0100 iio: accel: adxl380: fix handling of unavailable "INT1" interrupt fwnode_irq_get_byname() returns a negative value on failure; if a negative value is returned, use it as `err` argument for dev_err_probe(). While at it, add a missing trailing newline to the dev_err_probe() error message. Fixes: df36de13677a ("iio: accel: add ADXL380 driver") Signed-off-by: Francesco Lavra Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3 Author: Francesco Lavra Date: Mon Dec 1 11:00:10 2025 +0100 iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, event detection is not supported for all sensors, and if userspace tries to configure accelerometer wakeup events on a sensor device that does not support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer when trying to write to the wakeup register. Define an additional struct iio_chan_spec array whose members have a NULL event_spec field, and use this array instead of st_lsm6dsx_acc_channels for sensors without event detection capability. Fixes: b5969abfa8b8 ("iio: imu: st_lsm6dsx: add motion events") Signed-off-by: Francesco Lavra Reviewed-by: Andy Shevchenko Acked-by: Lorenzo Bianconi Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron commit da934ef0fdff5ba21e82ec3ab3f95fe73137b0c9 Author: Thorsten Blum Date: Tue Dec 2 19:13:06 2025 +0100 iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot The local variable 'curr_energy' was never clamped to PAC_193X_MIN_POWER_ACC or PAC_193X_MAX_POWER_ACC because the return value of clamp() was not used. Fix this by assigning the clamped value back to 'curr_energy'. Cc: stable@vger.kernel.org Fixes: 0fb528c8255b ("iio: adc: adding support for PAC193x") Signed-off-by: Thorsten Blum Signed-off-by: Jonathan Cameron commit 92452b1760ff2d1d411414965d4d06f75e1bda9a Author: Tomas Melin Date: Wed Dec 3 09:28:11 2025 +0000 iio: adc: ad9467: fix ad9434 vref mask The mask setting is 5 bits wide for the ad9434 (ref. data sheet register 0x18 FLEX_VREF). Apparently the settings from ad9265 were copied by mistake when support for the device was added to the driver. Fixes: 4606d0f4b05f ("iio: adc: ad9467: add support for AD9434 high-speed ADC") Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Reviewed-by: David Lechner Signed-off-by: Tomas Melin Cc: Signed-off-by: Jonathan Cameron commit c5512e016817a150fd6de97fbb3e74aa799ea3c1 Author: Haotian Zhang Date: Wed Dec 3 13:08:44 2025 +0800 iio: adc: ad7606: Fix incorrect type for error return variable The variable ret is declared as unsigned int but is used to store return values from functions returning int, which may be negative error codes. Change ret from unsigned int to int. Fixes: 849cebf8dc67 ("iio: adc: ad7606: Add iio-backend support") Signed-off-by: Haotian Zhang Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6b39824ac4c15783787e6434449772bfb2e31214 Author: Pavel Zhigulin Date: Fri Nov 14 18:13:01 2025 +0300 iio: adc: ad7280a: handle spi_setup() errors in probe() The probe() function ignored the return value of spi_setup(), leaving SPI configuration failures undetected. If spi_setup() fails, the driver should stop initialization and propagate the error to the caller. Add proper error handling: check the return value of spi_setup() and return it on failure. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2051f25d2a26 ("iio: adc: New driver for AD7280A Lithium Ion Battery Monitoring System") Signed-off-by: Pavel Zhigulin Reviewed-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit dbdb442218cd9d613adeab31a88ac973f22c4873 Author: Pei Xiao Date: Wed Oct 29 10:40:16 2025 +0800 iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq). If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | at91_adc_workq_handler at91_adc_remove | iio_device_unregister(indio_dev) | //free indio_dev a bit later | | iio_push_to_buffers(indio_dev) | //use indio_dev Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove. Fixes: 23ec2774f1cc ("iio: adc: at91-sama5d2_adc: add support for position and pressure channels") Signed-off-by: Pei Xiao Cc: Signed-off-by: Jonathan Cameron commit de41cbc64d02ae85d56078764616b6ba75a55a48 Author: Stefan Metzmacher Date: Fri Dec 19 15:04:08 2025 +0100 RDMA/rxe: let rxe_reclassify_recv_socket() call sk_owner_put() On kernels build with CONFIG_PROVE_LOCKING, CONFIG_MODULES and CONFIG_DEBUG_LOCK_ALLOC 'rmmod rdma_rxe' is no longer possible. For the global recv sockets rxe_net_exit() is where we call rxe_release_udp_tunnel-> udp_tunnel_sock_release(), which means the sockets are destroyed before 'rmmod rdma_rxe' finishes, so there's no need to protect against rxe_recv_slock_key and rxe_recv_sk_key disappearing while the sockets are still alive. Fixes: 80a85a771deb ("RDMA/rxe: reclassify sockets in order to avoid false positives from lockdep") Cc: Zhu Yanjun Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: Shinichiro Kawasaki Cc: linux-rdma@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/20251219140408.2300163-1-metze@samba.org Reviewed-by: Zhu Yanjun Tested-by: Shin'ichiro Kawasaki Signed-off-by: Leon Romanovsky commit 17753d1755a589659433ff4ead595f2bb7f695a8 Author: Chris Chiu Date: Thu Dec 18 06:22:51 2025 +0000 ALSA: hda/realtek: fix PCI SSID for one of the HP 200 G2i laptop The PCI subsystem ID of the HP machine Abe A6U should be 0x8ee7 instead of 0x8eb7. Fixes: a30fa8122222 ("ALSA: hda/realtek: fix mute/micmute LEDs don't work for more HP laptops") Signed-off-by: Chris Chiu Link: https://patch.msgid.link/20251218062251.2039592-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit 24f171c7e145f43b9f187578e89b0982ce87e54c Merge: f7cede182c9637 56d953a8d0da5e Author: Takashi Iwai Date: Sun Dec 21 11:11:11 2025 +0100 Merge tag 'asoc-fix-v6.19-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 We've been quite busy with fixes since the merge window, though not in any particularly exciting ways - the standout thing is the fix for _SX controls which were broken by a change to how we do clamping, otherwise it's all fairly run of the mill fixes and quirks. commit 145a417a39d7efbc881f52e829817376972b278c Author: Alok Tiwari Date: Wed Dec 17 02:01:41 2025 -0800 RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() RCFW_COMM_CONS_PCI_BAR_REGION is defined as BAR 2, so checking !creq_db->reg.bar_id is incorrect and always false. pci_resource_start() returns the BAR base address, and a value of 0 indicates that the BAR is unassigned. Update the condition to test bar_base == 0 instead. This ensures the driver detects and logs an error for an unassigned RCFW communication BAR. Fixes: cee0c7bba486 ("RDMA/bnxt_re: Refactor command queue management code") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20251217100158.752504-1-alok.a.tiwari@oracle.com Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit 8aaa848eaddd9ef8680fc6aafbd3a0646da5df40 Author: Jang Ingyu Date: Fri Dec 19 13:15:08 2025 +0900 RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() Fix missing comparison operator for RDMA_NETWORK_ROCE_V1 in the conditional statement. The constant was used directly instead of being compared with net_type, causing the condition to always evaluate to true. Fixes: 1c15b4f2a42f ("RDMA/core: Modify enum ib_gid_type and enum rdma_network_type") Signed-off-by: Jang Ingyu Link: https://patch.msgid.link/20251219041508.1725947-1-ingyujang25@korea.ac.kr Signed-off-by: Leon Romanovsky commit 9094662f6707d1d4b53d18baba459604e8bb0783 Merge: 78f2a78e8db882 ba624ba88d9f5c Author: Linus Torvalds Date: Sat Dec 20 22:58:14 2025 -0800 Merge tag 'ata-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Damien Le Moal: - Disable link power management (LPM) for a Seagate drive that is misbehaving when LPM is enabled * tag 'ata-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: Disable LPM on ST2000DM008-2FR102 commit 78f2a78e8db88270006e09058f22995be281251f Merge: 91ff28ae6d050e 9d651a6c62832a Author: Linus Torvalds Date: Sat Dec 20 16:54:42 2025 -0800 Merge tag 'spi-fix-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of fixes for various SPI drivers, plus a relaxation of constraints in the DT for the DesignWare controller to reflect hardware that's been seen. There's several fixes for the Cadence QuadSPI driver since a fix during the last release made some existing issues with error handling during probe more readily visible" * tag 'spi-fix-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ spi: dt-bindings: snps,dw-abp-ssi: Allow up to 16 chip-selects spi: cadence-quadspi: Fix clock disable on probe failure path spi: cadence-quadspi: Add error logging for DMA request failure spi: fsl-cpm: Check length parity before switching to 16 bit mode spi: mpfs: Fix an error handling path in mpfs_spi_probe() commit 91ff28ae6d050e0ca01ac13eb8ba31d744cf672f Author: Eric Dumazet Date: Fri Dec 19 11:20:07 2025 +0000 x86/irqflags: Use ASM_OUTPUT_RM in native_save_fl() clang is generating very inefficient code for native_save_fl() which is used for local_irq_save() in critical spots. Allowing the "pop %0" to use memory: 1) forces the compiler to add annoying stack canaries when CONFIG_STACKPROTECTOR_STRONG=y in many places. 2) Almost always is followed by an immediate "move memory,register" One good example is _raw_spin_lock_irqsave, with 8 extra instructions ffffffff82067a30 <_raw_spin_lock_irqsave>: ffffffff82067a30: ... ffffffff82067a39: 53 push %rbx // Three instructions to ajust the stack, read the per-cpu canary // and copy it to 8(%rsp) ffffffff82067a3a: 48 83 ec 10 sub $0x10,%rsp ffffffff82067a3e: 65 48 8b 05 da 15 45 02 mov %gs:0x24515da(%rip),%rax # <__stack_chk_guard> ffffffff82067a46: 48 89 44 24 08 mov %rax,0x8(%rsp) ffffffff82067a4b: 9c pushf // instead of pop %rbx, compiler uses 2 instructions. ffffffff82067a4c: 8f 04 24 pop (%rsp) ffffffff82067a4f: 48 8b 1c 24 mov (%rsp),%rbx ffffffff82067a53: fa cli ffffffff82067a54: b9 01 00 00 00 mov $0x1,%ecx ffffffff82067a59: 31 c0 xor %eax,%eax ffffffff82067a5b: f0 0f b1 0f lock cmpxchg %ecx,(%rdi) ffffffff82067a5f: 75 1d jne ffffffff82067a7e <_raw_spin_lock_irqsave+0x4e> // three instructions to check the stack canary ffffffff82067a61: 65 48 8b 05 b7 15 45 02 mov %gs:0x24515b7(%rip),%rax # <__stack_chk_guard> ffffffff82067a69: 48 3b 44 24 08 cmp 0x8(%rsp),%rax ffffffff82067a6e: 75 17 jne ffffffff82067a87 ... // One extra instruction to adjust the stack. ffffffff82067a73: 48 83 c4 10 add $0x10,%rsp ... // One more instruction in case the stack was mangled. ffffffff82067a87: e8 a4 35 ff ff call ffffffff8205b030 <__stack_chk_fail> This patch changes nothing for gcc, but for clang saves ~20000 bytes of text even though more functions are inlined. $ size vmlinux.gcc.before vmlinux.gcc.after vmlinux.clang.before vmlinux.clang.after text data bss dec hex filename 45565821 25005462 4704800 75276083 47c9f33 vmlinux.gcc.before 45565821 25005462 4704800 75276083 47c9f33 vmlinux.gcc.after 45121072 24638617 5533040 75292729 47ce039 vmlinux.clang.before 45093887 24638633 5536808 75269328 47c84d0 vmlinux.clang.after $ scripts/bloat-o-meter -t vmlinux.clang.before vmlinux.clang.after add/remove: 1/2 grow/shrink: 21/533 up/down: 2250/-22112 (-19862) Signed-off-by: Eric Dumazet Cc: Uros Bizjak Signed-off-by: Linus Torvalds commit 4cc5373f2e749a6c96e8b9fa971931a4dd852860 Author: Eric Dumazet Date: Fri Dec 19 11:20:06 2025 +0000 clang: work around asm output constraint problems Work around clang problems with "=rm" asm constraint. clang seems to always chose the memory output, while it is almost always the worst choice. Add ASM_OUTPUT_RM so that we can replace "=rm" constraint where it matters for clang, while not penalizing gcc. Signed-off-by: Eric Dumazet Suggested-by: Uros Bizjak Signed-off-by: Linus Torvalds commit f67e8a5e3ead61692d24a68e30496bd2634f5b68 Merge: f0ae3a50624b39 dc68c0f6016910 Author: Linus Torvalds Date: Sat Dec 20 12:45:35 2025 -0800 Merge tag 'xfs-fixes-6.19-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This contains a few fixes for zoned devices support, an UAF and a compiler warning, and some cleaning up" * tag 'xfs-fixes-6.19-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix the zoned RT growfs check for zone alignment xfs: validate that zoned RT devices are zone aligned xfs: fix XFS_ERRTAG_FORCE_ZERO_RANGE for zoned file system xfs: fix a memory leak in xfs_buf_item_init() xfs: fix stupid compiler warning xfs: fix a UAF problem in xattr repair xfs: ignore discard return value commit f0ae3a50624b39f9c5a235ee6caa2566118a1740 Merge: 3ed22a356c1077 b3db91c3bfea69 Author: Linus Torvalds Date: Sat Dec 20 12:22:53 2025 -0800 Merge tag 'hwmon-for-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ltc4282: Fix reset_history file permissions - ds620: Update broken Datasheet URL in driver documentation - tmp401: Fix overflow caused by default conversion rate value - ibmpex: Fix use-after-free in high/low store - dell-smm: Limit fan multiplier to avoid overflow * tag 'hwmon-for-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ltc4282): Fix reset_history file permissions hwmon: (DS620) Update broken Datasheet URL in driver documentation hwmon: (tmp401) fix overflow caused by default conversion rate value hwmon: (ibmpex) fix use-after-free in high/low store hwmon: (dell-smm) Limit fan multiplier to avoid overflow commit 3ed22a356c107767bf8d5a6a22ac79a293e65956 Merge: a0bdd554a82146 d3ecb12e2e04ce Author: Linus Torvalds Date: Sat Dec 20 12:18:32 2025 -0800 Merge tag 'mmc-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - sdhci-esdhc-imx: Fix build problem dependency - sdhci-of-arasan: Increase card-detect stable timeout to 2 seconds - sdhci-of-aspeed: Fix DT doc for missing properties * tag 'mmc-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml commit a0bdd554a8214651717964e947c415cfac8114a2 Merge: fa084c35afa13a f66ac60dee28d0 Author: Linus Torvalds Date: Sat Dec 20 12:08:02 2025 -0800 Merge tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "rc2 fixes for the week, mostly xe, with amdgpu as usual. Then a smattering of small fixes across the core/tests/panel and amdxdna. I expect things will be quiet for rc3/4 as teams take a break, and I'm travelling but will keep an eye on things. core: - fix gem handle leak on DRM_IOCTL_GEM_CHANGE_HANDLE tests: - add EDEADLK handling amdgpu: - Fix no_console_suspend handling - DCN 3.5.x seamless boot fixes - DP audio fix - Fix race in GPU recovery - SMU 14 OD fix amdkfd: - Event fix xe: - Limit num_syncs to prevent oversized kernel allocations - Disallow 0 OA property values - Disallow 0 EU stall property values - Fix kobject leak - Workaround - Loop variable reference fix - Fix a CONFIG corner-case incorrect number of argument - Skip reason prefix while emitting array - VF migration fix - Fix context in mei interrupt top half - Don't include the CCS metadata in the dma-buf sg-table - VF queueing recovery work fix - Increase TDF timeout - GT reset registers vs scheduler ordering fix - Adjust long-running workload timeslices - Always set OA_OAGLBCTXCTRL_COUNTER_RESUME - Fix a return value - Drop preempt-fences when destroying imported dma-bufs - Use usleep_range for accurate long-running workload timeslicing amdxdna: - don't load virtualized panel: - fix visionox-rm69299 Kconfig dependency - sony-td4353-jdi probing fix" * tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel: (34 commits) drm/xe: Use usleep_range for accurate long-running workload timeslicing drm/xe: Drop preempt-fences when destroying imported dma-bufs. drm/xe/eustall: Disallow 0 EU stall property values drm/xe/oa: Disallow 0 OA property values drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported() drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME drm/xe: Adjust long-running workload timeslices to reasonable values drm/xe/oa: Limit num_syncs to prevent oversized allocations drm/xe: Limit num_syncs to prevent oversized allocations drm/amdkfd: Fix improper NULL termination of queue restore SMI event string drm/amd/pm: restore SCLK settings after S0ix resume drm/amdgpu: fix a job->pasid access race in gpu recovery drm/amd/display: Fix DP no audio issue drm/amd/display: Fix scratch registers offsets for DCN351 drm/amd/display: Fix scratch registers offsets for DCN35 drm/amd: Resume the device in thaw() callback when console suspend is disabled drm/panel: visionox-rm69299: Depend on BACKLIGHT_CLASS_DEVICE accel/amdxdna: Block running under a hypervisor drm/panel: sony-td4353-jdi: Enable prepare_prev_first drm/xe: Restore engine registers before restarting schedulers after GT reset ... commit fa084c35afa13ab07a860ef0936cd987f9aa0460 Merge: d571fe47bb86c1 c33b68801fbe9d Author: Linus Torvalds Date: Sat Dec 20 11:59:06 2025 -0800 Merge tag 'linux_kselftest-kunit-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit fixes from Shuah Khan: "Drop unused parameter from kunit_device_register_internal and make FAULT_TEST default to n when PANIC_ON_OOPS" * tag 'linux_kselftest-kunit-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: make FAULT_TEST default to n when PANIC_ON_OOPS kunit: Drop unused parameter from kunit_device_register_internal commit 1ddb815fdfd45613c32e9bd1f7137428f298e541 Author: Dan Carpenter Date: Sat Dec 20 11:46:10 2025 +0300 block: rnbd-clt: Fix signedness bug in init_dev() The "dev->clt_device_id" variable is set using ida_alloc_max() which returns an int and in particular it returns negative error codes. Change the type from u32 to int to fix the error checking. Fixes: c9b5645fd8ca ("block: rnbd-clt: Fix leaked ID in init_dev()") Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe commit daa24603d9f0808929514ee62ced30052ca7221c Author: Caleb Sander Mateos Date: Fri Dec 12 17:19:49 2025 -0700 ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char device file, any requests dispatched to the ublk server but not yet completed will retain a ref value of UBLK_REFCOUNT_INIT. Before commit e63d2228ef83 ("ublk: simplify aborting ublk request"), __ublk_fail_req() would decrement the reference count before completing the failed request. However, that commit optimized __ublk_fail_req() to call __ublk_complete_rq() directly without decrementing the request reference count. The leaked reference count incorrectly allows user copy and zero copy operations on the completed ublk request. It also triggers the WARN_ON_ONCE(refcount_read(&io->ref)) warnings in ublk_queue_reinit() and ublk_deinit_queue(). Commit c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed") already fixed the issue for ublk devices using UBLK_F_SUPPORT_ZERO_COPY or UBLK_F_AUTO_BUF_REG. However, the reference count leak also affects UBLK_F_USER_COPY, the other reference-counted data copy mode. Fix the condition in ublk_check_and_reset_active_ref() to include all reference-counted data copy modes. This ensures that any ublk requests still owned by the ublk server when it exits have their reference counts reset to 0. Signed-off-by: Caleb Sander Mateos Fixes: e63d2228ef83 ("ublk: simplify aborting ublk request") Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit d571fe47bb86c107ec57dd546b1ba4ccc209eb27 Merge: a688362b19c408 ce7b1d58609abc Author: Linus Torvalds Date: Sat Dec 20 11:49:49 2025 -0800 Merge tag 'devicetree-fixes-for-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix warnings for Mediatek overlays not getting applied - Fix regression in handling elfcorehdr region - Fix creating cpufreq device on OPPv1 platforms - Add GE7800 GPU in Renesas R-Car V3U - Simplify dma-coherent property in TI display bindings - Allow "reg" in sprd,sc9860-clk binding - Update Linus Walleij's email * tag 'devicetree-fixes-for-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: arm64: dts: mediatek: Apply mt8395-radxa DT overlay at build time arm64: dts: mediatek: mt7988: add dtbs with applied overlays for bpi-r4 (pro) arm64: dts: mediatek: mt7986: add dtbs with applied overlays for bpi-r3 dt-bindings: Updates Linus Walleij's mail address dt-bindings: gpu: img,powervr-rogue: Document GE7800 GPU in Renesas R-Car V3U cpufreq: dt-platdev: Fix creating device on OPPv1 platforms dt-bindings: clock: sprd,sc9860-clk: Allow "reg" for gate clocks dt-bindings: display/ti: Simplify dma-coherent property arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder commit a688362b19c408dc501dca3e1651e446afbd5d9a Merge: 18dfd1cbf6a633 680ad315caaa28 Author: Linus Torvalds Date: Sat Dec 20 11:40:51 2025 -0800 Merge tag 'mips-fixes_6.19_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - Fix build error for Alchemy - Fix reference leak * tag 'mips-fixes_6.19_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Fix a reference leak bug in ip22_check_gio() MIPS: Alchemy: Remove bogus static/inline specifiers commit 18dfd1cbf6a633c39256c76ca13114de46435e22 Merge: 072c0b4f0f9597 f4ea8e05f2a857 Author: Linus Torvalds Date: Sat Dec 20 11:34:37 2025 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "Two left-over updates that could not go into -rc1 due to conflicts with other series: - Simplify checks in arch_kfence_init_pool() since force_pte_mapping() already takes BBML2-noabort (break-before-make Level 2 with no aborts generated) into account - Remove unneeded SVE/SME fallback preserve/store handling in the arm64 EFI. With the recent updates, the fallback path is only taken for EFI runtime calls from hardirq or NMI contexts. In practice, this only happens under panic/oops/emergency_restart() and no restoring of the user state expected. There's a corresponding lkdtm update to trigger a BUG() or panic() from hardirq context together with a fixup not to confuse clang/objtool about the control flow GCS (guarded control stacks) fix: flush the GCS locking state on exec, otherwise the new task will not be able to enable GCS (locked as disabled)" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: lkdtm/bugs: Do not confuse the clang/objtool with busy wait loop arm64/gcs: Flush the GCS locking state on exec arm64/efi: Remove unneeded SVE/SME fallback preserve/store handling lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context arm64: mm: Simplify check in arch_kfence_init_pool() commit 072c0b4f0f9597c86ddb01fd39e784fda6b7a922 Merge: 255a918a943ba1 0499add8efd724 Author: Linus Torvalds Date: Sat Dec 20 11:31:37 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull x86 kvm fixes from Paolo Bonzini: "x86 fixes. Everyone else is already in holiday mood apparently. - Add a missing 'break' to fix param parsing in the rseq selftest - Apply runtime updates to the _current_ CPUID when userspace is setting CPUID, e.g. as part of vCPU hotplug, to fix a false positive and to avoid dropping the pending update - Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot, as it's not supported by KVM and leads to a use-after-free due to KVM failing to unbind the memslot from the previously-associated guest_memfd instance - Harden against similar KVM_MEM_GUEST_MEMFD goofs, and prepare for supporting flags-only changes on KVM_MEM_GUEST_MEMFD memlslots, e.g. for dirty logging - Set exit_code[63:32] to -1 (all 0xffs) when synthesizing a nested SVM_EXIT_ERR (a.k.a. VMEXIT_INVALID) #VMEXIT, as VMEXIT_INVALID is defined as -1ull (a 64-bit value) - Update SVI when activating APICv to fix a bug where a post-activation EOI for an in-service IRQ would effective be lost due to SVI being stale - Immediately refresh APICv controls (if necessary) on a nested VM-Exit instead of deferring the update via KVM_REQ_APICV_UPDATE, as the request is effectively ignored because KVM thinks the vCPU already has the correct APICv settings" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit KVM: VMX: Update SVI during runtime APICv activation KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits KVM: Harden and prepare for modifying existing guest_memfd memslots KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot KVM: selftests: Add a CPUID testcase for KVM_SET_CPUID2 with runtime updates KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2} KVM: selftests: Add missing "break" in rseq_test's param parsing commit 255a918a943ba17bbd8801f5eb56c9083d1def7e Merge: 44f9a00a44a010 e5aff444e3a7bd Author: Linus Torvalds Date: Sat Dec 20 11:29:32 2025 -0800 Merge tag 'for-linus-6.19-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "Just a single patch fixing a sparse warning" * tag 'for-linus-6.19-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/xen: Fix sparse warning in enlighten_pv.c commit 44f9a00a44a010f3d4611e642d9e5d6adb524170 Merge: e4a3d52ab97169 53ca00a19d3451 Author: Linus Torvalds Date: Sat Dec 20 11:24:42 2025 -0800 Merge tag 'slab-for-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - A stable fix for a missing tag reset that can happen in kfree_nolock() with KASAN+SLUB_TINY configs (Deepanshu Kartikey) * tag 'slab-for-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slub: reset KASAN tag in defer_free() before accessing freed memory commit e4a3d52ab97169bba66dd718acf43e559ed5646a Merge: d8ba32c5a46083 c7fe9384c85d31 Author: Linus Torvalds Date: Sat Dec 20 11:18:32 2025 -0800 Merge tag 'iommu-fixes-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - iommupt: Fix an oops found by syzcaller in the new generic IO-page-table code. - AMD-Vi: Fix IO_PAGE_FAULTs in kdump kernels triggered by re-using domain-ids from previous kernel. * tag 'iommu-fixes-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: amd/iommu: Make protection domain ID functions non-static amd/iommu: Preserve domain ids inside the kdump kernel iommupt: Return ERR_PTR from _table_alloc() commit d8ba32c5a460837a5f0b9619dac99fafb6faef07 Merge: d245b2e53e8167 af65faf34f6e99 Author: Linus Torvalds Date: Sat Dec 20 09:48:56 2025 -0800 Merge tag 'block-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - ublk selftests for missing coverage - two fixes for the block integrity code - fix for the newly added newly added PR read keys ioctl, limiting the memory that can be allocated - work around for a deadlock that can occur with ublk, where partition scanning ends up recursing back into file closure, which needs the same mutex grabbed. Not the prettiest thing in the world, but an acceptable work-around until we can eliminate the reliance on disk->open_mutex for this - fix for a race between enabling writeback throttling and new IO submissions - move a bit of bio flag handling code. No changes, but needed for a patchset for a future kernel - fix for an init time id leak failure in rnbd - loop/zloop state check fix * tag 'block-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: validate interval_exp integrity limit block: validate pi_offset integrity limit block: rnbd-clt: Fix leaked ID in init_dev() ublk: fix deadlock when reading partition table block: add allocation size check in blkdev_pr_read_keys() Documentation: admin-guide: blockdev: replace zone_capacity with zone_capacity_mb when creating devices zloop: use READ_ONCE() to read lo->lo_state in queue_rq path loop: use READ_ONCE() to read lo->lo_state without locking block: fix race between wbt_enable_default and IO submission selftests: ublk: add user copy test cases selftests: ublk: add support for user copy to kublk selftests: ublk: forbid multiple data copy modes selftests: ublk: don't share backing files between ublk servers selftests: ublk: use auto_zc for PER_IO_DAEMON tests in stress_04 selftests: ublk: fix fio arguments in run_io_and_recover() selftests: ublk: remove unused ios map in seq_io.bt selftests: ublk: correct last_rw map type in seq_io.bt selftests: ublk: fix overflow in ublk_queue_auto_zc_fallback() block: move around bio flagging helpers commit d245b2e53e816716637be508c90190ef471457c7 Merge: dd9b004b7ff328 114ea9bbaf7681 Author: Linus Torvalds Date: Sat Dec 20 09:38:56 2025 -0800 Merge tag 'io_uring-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix this week, for an issue with the calculation of the number of segments in the ublk kbuf import path" * tag 'io_uring-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix nr_segs calculation in io_import_kbuf commit 560271e10b2c86e95ea35afa9e79822e4847f07a Author: Lyude Paul Date: Thu Dec 11 14:02:54 2025 -0500 drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb Since we recently started warning about uses of this function after the atomic check phase completes, we've started getting warnings about this in nouveau. It appears a misplaced drm_atomic_get_crtc_state() call has been hiding in our .prepare_fb callback for a while. So, fix this by adding a new nv50_head_atom_get_new() function and use that in our .prepare_fb callback instead. Signed-off-by: Lyude Paul Reviewed-by: Dave Airlie Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") Cc: # v4.18+ Link: https://patch.msgid.link/20251211190256.396742-1-lyude@redhat.com commit d2b6e710d2706c8915fe5e2f961c3365976d2ae1 Author: Anna Maniscalco Date: Mon Dec 1 19:14:36 2025 +0100 drm/msm: Fix a7xx per pipe register programming GEN7_GRAS_NC_MODE_CNTL was only programmed for BR and not for BV pipe but it needs to be programmed for both. Program both pipes in hw_init and introducea separate reglist for it in order to add this register to the dynamic reglist which supports restoring registers per pipe. Fixes: 91389b4e3263 ("drm/msm/a6xx: Add a pwrup_list field to a6xx_info") Cc: stable@vger.kernel.org Reviewed-by: Akhil P Oommen Signed-off-by: Anna Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/691553/ Message-ID: <20251201-gras_nc_mode_fix-v3-1-92a8a10d91d0@gmail.com> Signed-off-by: Rob Clark commit 6c6915bfea212d32844b2b7f22bc1aa3669eabc4 Author: Anna Maniscalco Date: Thu Nov 27 19:22:35 2025 +0100 drm/msm: add PERFCTR_CNTL to ifpc_reglist Previously this register would become 0 after IFPC took place which broke all usages of counters. Fixes: a6a0157cc68e ("drm/msm/a6xx: Enable IFPC on Adreno X1-85") Cc: stable@vger.kernel.org Signed-off-by: Anna Maniscalco Reviewed-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/690960/ Message-ID: <20251127-ifpc_counters-v3-1-fac0a126bc88@gmail.com> Signed-off-by: Rob Clark commit ef3b04091fd8bc737dc45312375df8625b8318e2 Author: Alok Tiwari Date: Thu Nov 13 00:28:31 2025 -0800 drm/msm/a6xx: move preempt_prepare_postamble after error check Move the call to preempt_prepare_postamble() after verifying that preempt_postamble_ptr is valid. If preempt_postamble_ptr is NULL, dereferencing it in preempt_prepare_postamble() would lead to a crash. This change avoids calling the preparation function when the postamble allocation has failed, preventing potential NULL pointer dereference and ensuring proper error handling. Fixes: 50117cad0c50 ("drm/msm/a6xx: Use posamble to reset counters on preemption") Signed-off-by: Alok Tiwari Patchwork: https://patchwork.freedesktop.org/patch/687659/ Message-ID: <20251113082839.3821867-1-alok.a.tiwari@oracle.com> Signed-off-by: Rob Clark commit 129049d4fe22c998ae9fd1ec479fbb4ed5338c15 Author: Neil Armstrong Date: Mon Nov 17 15:51:35 2025 +0100 drm/msm: adreno: fix deferencing ifpc_reglist when not declared On plaforms with an a7xx GPU not supporting IFPC, the ifpc_reglist if still deferenced in a7xx_patch_pwrup_reglist() which causes a kernel crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... pc : a6xx_hw_init+0x155c/0x1e4c [msm] lr : a6xx_hw_init+0x9a8/0x1e4c [msm] ... Call trace: a6xx_hw_init+0x155c/0x1e4c [msm] (P) msm_gpu_hw_init+0x58/0x88 [msm] adreno_load_gpu+0x94/0x1fc [msm] msm_open+0xe4/0xf4 [msm] drm_file_alloc+0x1a0/0x2e4 [drm] drm_client_init+0x7c/0x104 [drm] drm_fbdev_client_setup+0x94/0xcf0 [drm_client_lib] drm_client_setup+0xb4/0xd8 [drm_client_lib] msm_drm_kms_post_init+0x2c/0x3c [msm] msm_drm_init+0x1a4/0x228 [msm] msm_drm_bind+0x30/0x3c [msm] ... Check the validity of ifpc_reglist before deferencing the table to setup the register values. Fixes: a6a0157cc68e ("drm/msm/a6xx: Enable IFPC on Adreno X1-85") Signed-off-by: Neil Armstrong Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/688944/ Message-ID: <20251117-topic-sm8x50-fix-a6xx-non-ifpc-v1-1-e4473cbf5903@linaro.org> Signed-off-by: Rob Clark commit 12494e5e2aea17dac54c0356e53e40a31c2a31e4 Author: Zqiang Date: Fri Dec 19 17:34:04 2025 +0800 sched_ext: Fix some comments in ext.c This commit update balance_scx() in the comments to balance_one(). Signed-off-by: Zqiang Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 252714f1e8bdd542025b16321c790458014d6880 Author: Raphael Pinsonneault-Thibeault Date: Wed Dec 10 11:02:28 2025 -0500 Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces, ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use of devm and go back to freeing memory explicitly. Fixes: 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file") Signed-off-by: Raphael Pinsonneault-Thibeault Signed-off-by: Luiz Augusto von Dentz commit 348240e5fa901d3d4ba8dffa0e2ba9fc7aba93ab Author: Pauli Virtanen Date: Thu Dec 4 22:40:20 2025 +0200 Bluetooth: MGMT: report BIS capability flags in supported settings MGMT_SETTING_ISO_BROADCASTER and MGMT_SETTING_ISO_RECEIVER flags are missing from supported_settings although they are in current_settings. Report them also in supported_settings to be consistent. Fixes: ae7533613133 ("Bluetooth: Check for ISO support in controller") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 9a96cc8bbeefbc64654ac9c3da619443c22f6d32 Author: Andrea della Porta Date: Thu Dec 18 20:09:09 2025 +0100 arm64: dts: broadcom: rp1: drop RP1 overlay RP1 support loaded from overlay has been dropped from the driver and the DTB intended to be loaded with the overlay no longer exists. Drop unused include file and overlay. Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/85167b815d41ed9ed690ad239a19de5cd2e8be1c.1766077285.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit bc97e616a70df55dfa893879db7ea65d225f7846 Author: Andrea della Porta Date: Thu Dec 18 20:09:08 2025 +0100 arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology The node describing the RP1 endpoint currently uses a specific name ('rp1_nexus') that does not correctly reflect the PCI topology. Update the DT with the correct topology and use generic node names. Additionally, since the driver dropped overlay support in favor of a fully described DT, rename '...-ovl-rp1.dts' to '...-base.dtsi' for inclusion in the board DTB, as it is no longer compiled as a standalone DTB. Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/827b12ba48bb47bc77a0f5e5617aea961c8bc6b5.1766077285.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit ce26f588c8310e0fdd1bc7524a86fdf0ef6b1c85 Author: Andrea della Porta Date: Thu Dec 18 20:09:07 2025 +0100 misc: rp1: drop overlay support The RP1 driver can load an overlay at runtime to describe the inner peripherals. This has led to a lot of confusion regarding the naming of nodes, their topology and the reclaiming of related node resources. Since the overlay is currently not fully functional, drop its support in the driver in favor of the fully described static DT. This also means that this driver does not depend on CONFIG_PCI_DYNAMIC_OF_NODES and no longer requires PCI quirks to dynamically create the intermediate PCI nodes. Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/4b0aa7160877cf128b9bc713776bcac73c46eb24.1766077285.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit c6d0cdf7e572c64bd72699d10b28bfddaf758a0f Author: Andrea della Porta Date: Thu Dec 18 20:09:06 2025 +0100 dt-bindings: misc: pci1de4,1: add required reg property for endpoint The PCI subsystem links an endpoint Device Tree node to its corresponding pci_dev structure only if the Bus/Device/Function (BDF) encoded in the 'reg' property matches the actual hardware topology. Add the 'reg' property and mark it as required to ensure proper binding between the device_node and the pci_dev. Update the example to reflect this requirement. Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/b58bfcd957b2270fcf932d463f2db534b2ae1a6d.1766077285.git.andrea.porta@suse.com Signed-off-by: Florian Fainelli commit b3db91c3bfea69a6c6258fea508f25a59c0feb1a Author: Nuno Sá Date: Fri Dec 19 16:11:05 2025 +0000 hwmon: (ltc4282): Fix reset_history file permissions The reset_history attributes are write only. Hence don't report them as readable just to return -EOPNOTSUPP later on. Fixes: cbc29538dbf7 ("hwmon: Add driver for LTC4282") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20251219-ltc4282-fix-reset-history-v1-1-8eab974c124b@analog.com Signed-off-by: Guenter Roeck commit d412ff9e26ebf433672ba0ff649c308b1fea2a12 Author: Kuniyuki Iwashima Date: Mon Dec 8 09:45:45 2025 +0000 debugfs: Fix memleak in debugfs_change_name(). syzbot reported memleak in debugfs_change_name(). [0] When lookup_noperm_unlocked() fails, new_name is leaked. Let's fix it by reusing kfree_const() at the end of debugfs_change_name(). [0]: BUG: memory leak unreferenced object 0xffff8881110bb308 (size 8): comm "syz.0.17", pid 6090, jiffies 4294942958 hex dump (first 8 bytes): 2e 00 00 00 00 00 00 00 ........ backtrace (crc ecfc7064): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5258 [inline] __do_kmalloc_node mm/slub.c:5651 [inline] __kmalloc_node_track_caller_noprof+0x3b2/0x670 mm/slub.c:5759 __kmemdup_nul mm/util.c:64 [inline] kstrdup+0x3c/0x80 mm/util.c:84 kstrdup_const+0x63/0x80 mm/util.c:104 kvasprintf_const+0xca/0x110 lib/kasprintf.c:48 debugfs_change_name+0xf6/0x5d0 fs/debugfs/inode.c:854 cfg80211_dev_rename+0xd8/0x110 net/wireless/core.c:149 nl80211_set_wiphy+0x102/0x1770 net/wireless/nl80211.c:3844 genl_family_rcv_msg_doit+0x11e/0x190 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x2fd/0x440 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x93/0x1d0 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x3a3/0x4f0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x335/0x6b0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:733 [inline] ____sys_sendmsg+0x562/0x5a0 net/socket.c:2608 ___sys_sendmsg+0xc8/0x130 net/socket.c:2662 __sys_sendmsg+0xc7/0x140 net/socket.c:2694 Fixes: 833d2b3a072f7 ("Add start_renaming_two_dentries()") Reported-by: syzbot+3d7ca9c802c547f8550a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69369d82.a70a0220.38f243.009f.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251208094551.46184-1-kuniyu@google.com [ Fix minor typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit ce7b1d58609abc2941a1f38094147f439fb74233 Author: Rob Herring (Arm) Date: Fri Dec 5 22:59:38 2025 +0100 arm64: dts: mediatek: Apply mt8395-radxa DT overlay at build time It's a requirement that DT overlays be applied at build time in order to validate them as overlays are not validated on their own. Add missing target for mt8395-radxa hd panel overlay. Fixes: 4c8ff61199a7 ("arm64: dts: mediatek: mt8395-radxa-nio-12l: Add Radxa 8 HD panel") Signed-off-by: Frank Wunderlich Acked-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251205215940.19287-1-linux@fw-web.de Signed-off-by: Rob Herring (Arm) commit 0773bc6ab7ec0b707632c991fe29edf28f03a641 Author: Frank Wunderlich Date: Wed Nov 19 18:51:23 2025 +0100 arm64: dts: mediatek: mt7988: add dtbs with applied overlays for bpi-r4 (pro) Build devicetree binaries for testing overlays and providing users full dtb without using overlays for Bananapi R4 (pro) variants. Signed-off-by: Frank Wunderlich Link: https://patch.msgid.link/20251119175124.48947-3-linux@fw-web.de Signed-off-by: Rob Herring (Arm) commit 987697749def9c5e10d9a2d992f012db61ae1967 Author: Frank Wunderlich Date: Wed Nov 19 18:51:22 2025 +0100 arm64: dts: mediatek: mt7986: add dtbs with applied overlays for bpi-r3 Build devicetree binaries for testing overlays and providing users full dtb without using overlays. Suggested-by: Rob Herring Signed-off-by: Frank Wunderlich Fixes: a58c36806741 ("arm64: dts: mediatek: mt7988a-bpi-r4pro: Add mmc overlays") Fixes: dec929e61a42 ("arm64: dts: mediatek: mt7988a-bpi-r4-pro: Add PCIe overlays") Fixes: 714a80ced07a ("arm64: dts: mediatek: mt7988a-bpi-r4: Add dt overlays for sd + emmc") Fixes: 312189ebb802 ("arm64: dts: mt7986: add overlay for SATA power socket on BPI-R3") Fixes: 8e01fb15b815 ("arm64: dts: mt7986: add Bananapi R3") Acked-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251119175124.48947-2-linux@fw-web.de Signed-off-by: Rob Herring (Arm) commit f4ea8e05f2a857d5447c25f7daf00807d38b307d Author: Catalin Marinas Date: Fri Dec 19 15:09:09 2025 +0000 lkdtm/bugs: Do not confuse the clang/objtool with busy wait loop Since commit eb972eab0794 ("lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context"), building with clang for x86_64 results in the following warnings: vmlinux.o: warning: objtool: lkdtm_PANIC_IN_HARDIRQ(): unexpected end of section .text.lkdtm_PANIC_IN_HARDIRQ vmlinux.o: warning: objtool: lkdtm_BUG_IN_HARDIRQ(): unexpected end of section .text.lkdtm_BUG_IN_HARDIRQ caused by busy "while (wait_for_...);" loops. Add READ_ONCE() and cpu_relax() to better indicate the intention and avoid any unwanted compiler optimisations. Fixes: eb972eab0794 ("lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512190111.jxFSqxUH-lkp@intel.com/ Signed-off-by: Catalin Marinas commit 56d953a8d0da5e53c2594edde23465ec49385b1c Merge: 01ad27827c2172 26f637fa088791 Author: Mark Brown Date: Fri Dec 19 13:25:16 2025 +0000 ASoC: Intel: mtl-match: Add 6-amp matches for CS35L56 Merge series from Richard Fitzgerald : These two commits add support for 6 amps with feedback, primarily for the CDB35L56-EIGHT-C and CDB35L63-CB8 and similar hardware. commit 01ad27827c2172e287898a7953e33c074ff3b607 Merge: 095d621141826a 4de6cea0d8e10c Author: Mark Brown Date: Fri Dec 19 13:25:12 2025 +0000 ASoC: fsl_easrc: Fix duplicate debufs entries Merge series from Alexander Stein : this series fixes the error regarding duplicate debugfs directory creation on TQMa8MPxL (imx8mp) when easrc is enabled: debugfs: '30c90000.easrc' already exists in 'tqm-tlv320aic32' This is caused because fsl_easrc adds two components which use the device name as component name. Debugfs directories for each component is created, resulting on name conflict. Fix this by adding the debugfs_prefix for both component drivers. Before: $ ls /sys/kernel/debug/asoc/tqm-tlv320aic32/ 30c30000.sai 30c90000.easrc HiFi-ASRC-FE dapm dapm_pop_time dma:30c30000.sai tlv320aic32x4.1-0018 After: $ ls /sys/kernel/debug/asoc/tqm-tlv320aic32/ 30c30000.sai HiFi-ASRC-FE asrc:30c90000.easrc dapm dapm_pop_time dma:30c30000.sai easrc:30c90000.easrc tlv320aic32x4.1-0018 commit 7f2e8e1d22f6e28edff3782535c16cfbace30902 Author: Leon Romanovsky Date: Thu Dec 18 14:08:08 2025 +0200 parisc: Set valid bit in high byte of 64‑bit physical address On 32‑bit systems, phys_addr_t is defined as u32. However, parisc expects physical addresses to be 64‑bit values so it can store a validity bit in the upper byte. Resolve this mismatch by casting the physical address to unsigned long, ensuring it is treated as a 64‑bit value where required. This fixes the failure to start block device drivers on the C3700 platform, as reported by Guenter. QEMU command line to reproduce the issue (with Debian SID as rootfs): qemu-system-hppa -machine C3700 \ -kernel arch/parisc/boot/bzImage \ -append "console=ttyS0 \ root=/dev/sda rw rootwait panic=-1" \ -nographic \ -device lsi53c895a \ -drive file=rootfs-hppa.img,if=none,format=raw,id=hd0 \ -device scsi-hd,drive=hd0 Fixes: 96ddf2ef58ec ("parisc: Convert DMA map_page to map_phys interface") Reported-by: Guenter Roeck Closes: https://lore.kernel.org/all/b184f1bf-96dc-4546-8512-9cba5ecb58f7@roeck-us.net/ Signed-off-by: Leon Romanovsky Tested-by: Guenter Roeck [mszyprow: dropped the lpa() macro removal] Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251218-fix-parisc-conversion-v1-1-4a04d26b0168@nvidia.com commit f39006965dd37e7be823dba6ca484adccc7a4dff Author: Even Xu Date: Fri Dec 19 09:14:38 2025 +0800 HID: Intel-thc-hid: Intel-thc: Fix wrong register reading Correct the read register for the setting of max input size and interrupt delay. Fixes: 22da60f0304b ("HID: Intel-thc-hid: Intel-thc: Introduce interrupt delay control") Fixes: 45e92a093099 ("HID: Intel-thc-hid: Intel-thc: Introduce max input size control") Signed-off-by: Even Xu Signed-off-by: Benjamin Tissoires commit ff3f234ff1dcd6d626a989151db067a1b7f0f215 Author: DaytonCL Date: Sun Dec 14 14:34:36 2025 +0100 HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL Some VTL-class touchpads (e.g. TOPS0102:00 35CC:0104) intermittently fail to release a finger contact. A previous slot remains logically active, accompanied by stale BTN_TOOL_DOUBLETAP state, causing gestures to stay latched and resulting in stuck two-finger scrolling and false right-clicks. Apply MT_QUIRK_STICKY_FINGERS to handle the unreleased contact correctly. Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/1225 Suggested-by: Benjamin Tissoires Tested-by: DaytonCL Signed-off-by: DaytonCL Signed-off-by: Benjamin Tissoires commit 56e230723e3a818373bd62331bccb1c6d2b3881b Author: Zhang Lixu Date: Fri Dec 12 10:51:50 2025 +0800 HID: intel-ish-hid: Reset enum_devices_done before enumeration Some systems have enabled ISH without any sensors. In this case sending HOSTIF_DM_ENUM_DEVICES results in 0 sensors. This triggers ISH hardware reset on subsequent enumeration after S3/S4 resume. The enum_devices_done flag was not reset before sending the HOSTIF_DM_ENUM_DEVICES command. On subsequent enumeration calls (such as after S3/S4 resume), this flag retains its previous true value, causing the wait loop to be skipped and returning prematurely to hid_ishtp_cl_init(). If 0 HID devices are found, hid_ishtp_cl_init() skips getting HID device descriptors and sets init_done to true. When the delayed enumeration response arrives with init_done already true, the driver treats it as a bad packet and triggers an ISH hardware reset. Set enum_devices_done to false before sending the enumeration command, consistent with similar functions like ishtp_get_hid_descriptor() and ishtp_get_report_descriptor() which reset their respective flags. Signed-off-by: Zhang Lixu Acked-by: Srinivas Pandruvada Signed-off-by: Benjamin Tissoires commit daeed86b686855adda79f13729e0c9b0530990be Author: Zhang Lixu Date: Wed Dec 10 10:53:28 2025 +0800 HID: intel-ish-hid: Update ishtp bus match to support device ID table The ishtp_cl_bus_match() function previously only checked the first entry in the driver's device ID table. Update it to iterate over the entire table, allowing proper matching for drivers with multiple supported protocol GUIDs. Signed-off-by: Zhang Lixu Acked-by: Srinivas Pandruvada Signed-off-by: Benjamin Tissoires commit 0e13150c1a13a3a3d6184c24bfd080d5999945d1 Author: Thomas Fourier Date: Wed Dec 3 17:56:35 2025 +0100 HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value The `dma_unmap_sg()` functions should be called with the same nents as the `dma_map_sg()`, not the value the map function returned. Save the number of entries in struct thc_dma_configuration. Fixes: a688404b2e20 ("HID: intel-thc-hid: intel-thc: Add THC DMA interfaces") Signed-off-by: Thomas Fourier Reviewed-by: Even Xu Reviewed-by: Andy Shevchenko Signed-off-by: Benjamin Tissoires commit e9143268d259d98e111a649affa061acb8e13c5b Author: Siarhei Vishniakou Date: Tue Nov 11 15:45:19 2025 -0800 HID: playstation: Center initial joystick axes to prevent spurious events When a new PlayStation gamepad (DualShock 4 or DualSense) is initialized, the input subsystem sets the default value for its absolute axes (e.g., ABS_X, ABS_Y) to 0. However, the hardware's actual neutral/resting state for these joysticks is 128 (0x80). This creates a mismatch. When the first HID report arrives from the device, the driver sees the resting value of 128. The kernel compares this to its initial state of 0 and incorrectly interprets this as a delta (0 -> 128). Consequently, it generates EV_ABS events for this initial, non-existent movement. This behavior can fail userspace 'sanity check' tests (e.g., in Android CTS) that correctly assert no motion events should be generated from a device that is already at rest. This patch fixes the issue by explicitly setting the initial value of the main joystick axes (e.g., ABS_X, ABS_Y, ABS_RX, ABS_RY) to 128 (0x80) in the common ps_gamepad_create() function. This aligns the kernel's initial state with the hardware's expected neutral state, ensuring that the first report (at 128) produces no delta and thus, no spurious event. Signed-off-by: Siarhei Vishniakou Reviewed-by: Benjamin Tissoires Signed-off-by: Benjamin Tissoires commit f28beb69c51517aec7067dfb2074e7c751542384 Author: Benjamin Tissoires Date: Mon Dec 15 12:57:21 2025 +0100 HID: usbhid: paper over wrong bNumDescriptor field Some faulty devices (ZWO EFWmini) have a wrong optional HID class descriptor count compared to the provided length. Given that we plainly ignore those optional descriptor, we can attempt to fix the provided number so we do not lock out those devices. Signed-off-by: Benjamin Tissoires commit c7fe9384c85d31e35bb61574d7a742ba59fb27c3 Author: Sairaj Kodilkar Date: Fri Nov 21 14:41:16 2025 +0530 amd/iommu: Make protection domain ID functions non-static So that both iommu.c and init.c can utilize them. Also define a new function 'pdom_id_destroy()' to destroy 'pdom_ids' instead of directly calling ida functions. Signed-off-by: Sairaj Kodilkar Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit c2e8dc1222c2136e714d5d972dce7e64924e4ed8 Author: Sairaj Kodilkar Date: Fri Nov 21 14:41:15 2025 +0530 amd/iommu: Preserve domain ids inside the kdump kernel Currently AMD IOMMU driver does not reserve domain ids programmed in the DTE while reusing the device table inside kdump kernel. This can cause reallocation of these domain ids for newer domains that are created by the kdump kernel, which can lead to potential IO_PAGE_FAULTs Hence reserve these ids inside pdom_ids. Fixes: 38e5f33ee359 ("iommu/amd: Reuse device table for kdump") Signed-off-by: Sairaj Kodilkar Reported-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit a305df4125d17f23d3ce777bb1af9f9bba05efb1 Author: Kuan-Wei Chiu Date: Wed Dec 10 18:14:17 2025 +0000 MAINTAINERS: Add interconnect-clk.h to interconnect API entry Commit 0ac2a08f42ce ("interconnect: add clk-based icc provider support") introduced include/linux/interconnect-clk.h but missed adding it to MAINTAINERS. Since the corresponding implementation drivers/interconnect/icc-clk.c is already covered by the drivers/interconnect/ directory entry, the header file should be listed as well. Fixes: 0ac2a08f42ce ("interconnect: add clk-based icc provider support") Signed-off-by: Kuan-Wei Chiu Link: https://lore.kernel.org/r/20251210181418.2123323-1-visitorckw@gmail.com Signed-off-by: Georgi Djakov commit 472100721b4b1d357e99512306ba7dda7bddad6f Author: Krzysztof Kozlowski Date: Sat Nov 29 10:46:13 2025 +0100 dt-bindings: interconnect: qcom,sa8775p-rpmh: Fix incorrectly added reg and clocks Commit 8a55fbe4c94d ("dt-bindings: interconnect: add reg and clocks properties to enable QoS on sa8775p") claims that all interconnects have clocks and MMIO address space, but that is just not true. Only few have. Bindings should restrict properties and should not allow specifying non-existing hardware description, so fix missing constraints for 'reg' and 'clocks'. Fixes: 8a55fbe4c94d ("dt-bindings: interconnect: add reg and clocks properties to enable QoS on sa8775p") Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251129094612.16838-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 5efaf92da4365cb8d1ae6dd7a2d1245c69e09ff5 Author: Himanshu Chauhan Date: Thu Jul 10 18:22:30 2025 +0530 riscv: Add SBI debug trigger extension and function ids Debug trigger extension is an SBI extension to support native debugging in S-mode and VS-mode. This patch adds the extension and the function IDs defined by the extension. Signed-off-by: Himanshu Chauhan Link: https://patch.msgid.link/20250710125231.653967-2-hchauhan@ventanamicro.com [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley commit f02dd254727665cc292669194b9171bb70413346 Author: Zongmin Zhou Date: Thu Nov 20 17:58:31 2025 +0800 riscv/atomic.h: use RISCV_FULL_BARRIER in _arch_atomic* function. Replace the same code with the pre-defined macro RISCV_FULL_BARRIER to simplify the code. Signed-off-by: Zongmin Zhou Link: https://patch.msgid.link/20251120095831.64211-1-min_halo@163.com Signed-off-by: Paul Walmsley commit 6118ebed3bdf896038f58d0d1804f551f33e8643 Author: Pincheng Wang Date: Wed Aug 27 00:29:37 2025 +0800 riscv: hwprobe: export Zilsd and Zclsd ISA extensions Export Zilsd and Zclsd ISA extensions through hwprobe. Signed-off-by: Pincheng Wang Reviewed-by: Nutty Liu Link: https://patch.msgid.link/20250826162939.1494021-4-pincheng.plct@isrc.iscas.ac.cn [pjw@kernel.org: fixed whitespace; updated to apply] Signed-off-by: Paul Walmsley commit 3f0cbfb8a107a9f0a6e2184425b70ddc6d51f991 Author: Pincheng Wang Date: Wed Aug 27 00:29:36 2025 +0800 riscv: add ISA extension parsing for Zilsd and Zclsd Add parsing for Zilsd and Zclsd ISA extensions which were ratified in commit f88abf1 ("Integrating load/store pair for RV32 with the main manual") of the riscv-isa-manual. Signed-off-by: Pincheng Wang Reviewed-by: Nutty Liu Link: https://patch.msgid.link/20250826162939.1494021-3-pincheng.plct@isrc.iscas.ac.cn [pjw@kernel.org: cleaned up checkpatch issues, whitespace; updated to apply] Signed-off-by: Paul Walmsley commit 4115155baf43679575fb463367cdcf8f46e76b18 Author: Pincheng Wang Date: Wed Aug 27 00:29:35 2025 +0800 dt-bindings: riscv: add Zilsd and Zclsd extension descriptions Add descriptions for the Zilsd (Load/Store pair instructions) and Zclsd (Compressed Load/Store pair instructions) ISA extensions which were ratified in commit f88abf1 ("Integrating load/store pair for RV32 with the main manual") of the riscv-isa-manual. Signed-off-by: Pincheng Wang Reviewed-by: Nutty Liu Acked-by: Conor Dooley Link: https://patch.msgid.link/20250826162939.1494021-2-pincheng.plct@isrc.iscas.ac.cn Signed-off-by: Paul Walmsley commit e0e51a0de02cf0e5008d0e167288ad1598005b9e Author: Paul Walmsley Date: Mon Nov 17 21:19:28 2025 -0700 riscv: mm: use xchg() on non-atomic_long_t variables, not atomic_long_xchg() Let's not call atomic_long_xchg() on something that's not an atomic_long_t, and just use xchg() instead. Continues the cleanup from commit 546e42c8c6d94 ("riscv: Use an atomic xchg in pudp_huge_get_and_clear()"), Cc: Alexandre Ghiti Signed-off-by: Paul Walmsley commit 425cc087fbaf267be7683b95481b46a058d63e49 Author: Paul Walmsley Date: Mon Nov 17 21:19:27 2025 -0700 riscv: mm: ptep_get_and_clear(): avoid atomic ops when !CONFIG_SMP When !CONFIG_SMP, there's no need for atomic operations in ptep_get_and_clear(), so, similar to x86, let's not use atomics in this case. Cc: Alexandre Ghiti Signed-off-by: Paul Walmsley commit 1e6084d5c433b142b18d57694a6ab555ca6bb8cc Author: Paul Walmsley Date: Mon Nov 17 21:19:27 2025 -0700 riscv: mm: pmdp_huge_get_and_clear(): avoid atomic ops when !CONFIG_SMP When !CONFIG_SMP, there's no need for atomic operations in pmdp_huge_get_and_clear(), so, similar to what x86 does, let's not use atomics in this case. See also commit 546e42c8c6d94 ("riscv: Use an atomic xchg in pudp_huge_get_and_clear()"). Cc: Alexandre Ghiti Signed-off-by: Paul Walmsley commit 818d78ba1b3f88d2bfee249f25020211488a26c3 Author: Andy Chiu Date: Wed Nov 12 16:43:14 2025 -0800 riscv: signal: abstract header saving for setup_sigcontext The function save_v_state() served two purposes. First, it saved extension context into the signal stack. Then, it constructed the extension header if there was no fault. The second part is independent of the extension itself. As a result, we can pull that part out, so future extensions may reuse it. This patch adds arch_ext_list and makes setup_sigcontext() go through all possible extensions' save() callback. The callback returns a positive value indicating the size of the successfully saved extension. Then the kernel proceeds to construct the header for that extension. The kernel skips an extension if it does not exist, or if the saving fails for some reasons. The error code is propagated out on the later case. This patch does not introduce any functional changes. Signed-off-by: Andy Chiu Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-16-b55691eacf4f@rivosinc.com Signed-off-by: Paul Walmsley commit b74fd80d7fe578898a76344064d2678ce1efda61 Author: Chenghai Huang Date: Thu Nov 20 21:21:24 2025 +0800 crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num() In qm_get_complete_eqe_num(), the function entry has already checked whether the interrupt is valid, so the interrupt event can be processed directly. Currently, the interrupt valid bit is being checked again redundantly, and no interrupt processing is performed. Therefore, the loop condition should be modified to directly process the interrupt event, and use do while instead of the current while loop, because the condition is always satisfied on the first iteration. Fixes: f5a332980a68 ("crypto: hisilicon/qm - add the save operation of eqe and aeqe") Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 50fdb78b7c0bcc550910ef69c0984e751cac72fa Author: Herbert Xu Date: Wed Dec 17 14:15:41 2025 +0800 crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encrypt is called, the underlying request may be freed by an asynchronous completion. Thus dereferencing req->iv after it returns is invalid. Instead of checking req->iv against info, create a new variable unaligned_info and use it for that purpose instead. Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator") Reported-by: Xiumei Mu Reported-by: Xin Long Signed-off-by: Herbert Xu commit 248d3a73a0167dce15ba100477c3e778c4787178 Author: Junjie Cao Date: Thu Dec 18 21:56:59 2025 -0800 Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds access when used as index in 'config_pins[wire_order[i]]'. Since config_pins has 4 elements (indices 0-3), the valid range for wire_order should be 0-3. Fix the off-by-one error by using >= instead of > in the validation check. Signed-off-by: Junjie Cao Link: https://patch.msgid.link/20251114062817.852698-1-junjie.cao@intel.com Fixes: bb76dc09ddfc ("input: ti_am33x_tsc: Order of TSC wires, made configurable") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 806ec7b797adc1cc9b11535307638a55ddfb873c Author: Sanjay Govind Date: Sat Nov 29 20:37:11 2025 +1300 Input: xpad - add support for CRKD Guitars Add support for various CRKD Guitar Controllers. Signed-off-by: Sanjay Govind Link: https://patch.msgid.link/20251129073720.2750-2-sanjay.govind9@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 733a8924229ff8c0385121a30fcd00bf70644743 Author: Gergo Koteles Date: Thu Nov 13 17:02:58 2025 +0100 Input: add ABS_SND_PROFILE ABS_SND_PROFILE used to describe the state of a multi-value sound profile switch. This will be used for the alert-slider on OnePlus phones or other phones. Profile values added as SND_PROFLE_(SILENT|VIBRATE|RING) identifiers to input-event-codes.h so they can be used from DTS. Signed-off-by: Gergo Koteles Reviewed-by: Bjorn Andersson Tested-by: Guido Günther # oneplus,fajita & oneplus,enchilada Reviewed-by: Guido Günther Signed-off-by: David Heidelberg Reviewed-by: Pavel Machek Link: https://patch.msgid.link/20251113-op6-tri-state-v8-1-54073f3874bc@ixit.cz Signed-off-by: Dmitry Torokhov commit f66ac60dee28d092bc6a3af33a04147bfcb6ba30 Merge: 77de4a273d3002 80f9c601d9c4d2 Author: Dave Airlie Date: Fri Dec 19 10:55:49 2025 +1000 Merge tag 'drm-xe-fixes-2025-12-19' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes UAPI Changes: - Limit num_syncs to prevent oversized kernel allocations (Shuicheng) - Disallow 0 OA property values (Ashutosh) - Disallow 0 EU stall property values (Ashutosh) Driver Changes: - Fix kobject leak (Shuicheng) - Workaround (Vinay) - Loop variable reference fix (Matt Brost) - Fix a CONFIG corner-case incorrect number of arguments (Arnd Bergmann) - Skip reason prefix while emitting array (Raag) - VF migration fix (Tomasz) - Fix context in mei interrupt top half (Junxiao) - Don't include the CCS metadata in the dma-buf sg-table (Thomas) - VF queueing recovery work fix (Satyanarayana) - Increase TDF timeout (Jagmeet) - GT reset registers vs scheduler ordering fix (Jan) - Adjust long-running workload timeslices (Matt Brost) - Always set OA_OAGLBCTXCTRL_COUNTER_RESUME (Ashutosh) - Fix a return value (Dan Carpenter) - Drop preempt-fences when destroying imported dma-bufs (Thomas) - Use usleep_range for accurate long-running workload timeslicing (Matthew) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aUSMlQ4iruzm0NQR@fedora commit 77de4a273d3002bcca1e5b53907b1b350b1e22f7 Merge: 46eb784f3e9a81 2bfca4fe1f36eb Author: Dave Airlie Date: Fri Dec 19 07:32:21 2025 +1000 Merge tag 'drm-misc-fixes-2025-12-18' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc2: - Add -EDEADLK handling in drm unit tests. - Plug DRM_IOCTL_GEM_CHANGE_HANDLE leak. - Fix regression in sony-td4353-jdi. - Kconfig fix for visionox-rm69299. - Do not load amdxdna when running virtualized. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/21861d1b-54bf-4853-9c35-97abe3c5deba@linux.intel.com commit dd9b004b7ff3289fb7bae35130c0a5c0537266af Merge: 51647156908974 39263f986da55c Author: Linus Torvalds Date: Fri Dec 19 09:30:55 2025 +1200 Merge tag 'trace-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Add Documentation/core-api/tracepoint.rst to TRACING in MAINTAINERS file Updates to the tracepoint.rst document should be reviewed by the tracing maintainers. - Fix warning triggered by perf attaching to synthetic events The synthetic events do not add a function to be registered when perf attaches to them. This causes a warning when perf registers a synthetic event and passes a NULL pointer to the tracepoint register function. Ideally synthetic events should be updated to work with perf, but as that's a feature and not a bug fix, simply now return -ENODEV when perf tries to register an event that has a NULL pointer for its function. This no longer causes a kernel warning and simply causes the perf code to fail with an error message. - Fix 32bit overflow in option flag test The option's flags changed from 32 bits in size to 64 bits in size. Fix one of the places that shift 1 by the option bit number to to be 1ULL. - Fix the output of printing the direct jmp functions The enabled_functions that shows how functions are being attached by ftrace wasn't updated to accommodate the new direct jmp trampolines that set the LSB of the pointer, and outputs garbage. Update the output to handle the direct jmp trampolines. * tag 'trace-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Fix address for jmp mode in t_show() tracing: Fix UBSAN warning in __remove_instance() tracing: Do not register unsupported perf events MAINTAINERS: add tracepoint core-api doc files to TRACING commit 516471569089749163be24b973ea928b56ac20d9 Merge: 5caa3808bc29de 5a0b1882506858 Author: Linus Torvalds Date: Fri Dec 19 08:39:48 2025 +1200 Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - Fix a performance issue with the scoped_ksimd() macro (new in 6.19) where it unnecessarily initialized the entire fpsimd state. - Add a missing gitignore entry for a generated file added in 6.18. * tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: riscv: Add poly1305-core.S to .gitignore arm64/simd: Avoid pointless clearing of FP/SIMD buffer commit 5caa3808bc29de989f46451124e109dd33e464c6 Merge: eb23a1198d2317 f103fa127c9301 Author: Linus Torvalds Date: Fri Dec 19 08:37:08 2025 +1200 Merge tag 'acpi-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add a missing PCC check for guaranteed_perf in the ACPI CPPC library and fix a static local variable access race condition in acpi_pcc_address_space_setup() (Pengjie Zhang)" * tag 'acpi-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PCC: Fix race condition by removing static qualifier ACPI: CPPC: Fix missing PCC check for guaranteed_perf commit eb23a1198d2317072a44ac1b8f5742f4cb48ce2c Merge: 14e0e8d0fcf249 277141a897c715 Author: Linus Torvalds Date: Fri Dec 19 08:28:02 2025 +1200 Merge tag 'pm-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix three issues in the power capping code including one recent regression and a runtime PM framework regression introduced during the 6.17 development cycle: - Fix CPU hotplug locking deadlock reported by lockdep after a recent update of the Intel RAPL power capping driver (Srinivas Pandruvada) - Fix sscanf() error return value handling in the power capping core and a race condition in register_control_type() (Sumeet Pawnikar) - Fix a concurrent bit field update issue in the runtime PM core code by only updating the bit field in question when runtime PM is disabled (Rafael Wysocki)" * tag 'pm-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: powercap: intel_rapl: Fix possible recursive lock warning PM: runtime: Do not clear needs_force_resume with enabled runtime PM powercap: fix sscanf() error return value handling powercap: fix race condition in register_control_type() commit 14e0e8d0fcf24963e641ba375aa2e069f0bd2c1c Merge: cf26839d7fca7e d113735421da32 Author: Linus Torvalds Date: Fri Dec 19 08:23:23 2025 +1200 Merge tag 'thermal-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "These enable a new hardware feature in the int340x thermal driver and fix up comments in the thermal core code: - Set a feature flag in the int340x thermal driver to enable the power slider interface for Wildcat Lake processors (Srinivas Pandruvada) - Fix typo and indentation in comments in the thermal core (Thorsten Blum)" * tag 'thermal-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: Fix typo and indentation in comments thermal: intel: int340x: Enable power slider interface for Wildcat Lake commit d579478cee228bdc0029a0c12a1f6a63ea9d1c77 Author: Sasha Finkelstein Date: Thu Dec 18 10:15:23 2025 -0800 Input: apple_z2 - fix reading incorrect reports after exiting sleep Under certain conditions (more prevalent after a suspend/resume cycle), the touchscreen controller can send the "boot complete" interrupt before it actually finished booting. In those cases, attempting to read touch data resuls in a stream of "not ready" messages being read and interpreted as a touch report. Check that the response is in fact a touch report and discard it otherwise. Reported-by: pitust Closes: https://oftc.catirclogs.org/asahi/2025-12-17#34878715; Fixes: 471a92f8a21a ("Input: apple_z2 - add a driver for Apple Z2 touchscreens") Signed-off-by: Sasha Finkelstein Link: https://patch.msgid.link/20251218-z2-init-fix-v1-1-48e3aa239caf@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit cf26839d7fca7eb33ecadb7813427dbff3a7a2cd Merge: 7b8e9264f55a9c e6a973af111354 Author: Linus Torvalds Date: Fri Dec 19 08:11:53 2025 +1200 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "A few minor fixes, other than the randconfig fix this is only relevant to test code, not releases: - Randconfig failure if CONFIG_DMA_SHARED_BUFFER is not set - Remove gcc warning in kselftest - Fix a refcount leak on an error path in the selftest support code - Fix missing overflow checks in the selftest support code" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED iommufd/selftest: Do not leak the hwpt if IOMMU_TEST_OP_MD_CHECK_MAP fails iommufd/selftest: Make it clearer to gcc that the access is not out of bounds iommufd: Fix building without dmabuf commit 173d6f64f9558ff022a777a72eb8669b6cdd2649 Author: Anirudh Rayabharam (Microsoft) Date: Tue Dec 16 14:20:30 2025 +0000 mshv: release mutex on region invalidation failure In the region invalidation failure path in mshv_region_interval_invalidate(), the region mutex is not released. Fix it by releasing the mutex in the failure path. Signed-off-by: Anirudh Rayabharam (Microsoft) Fixes: b9a66cd5ccbb ("mshv: Add support for movable memory regions") Acked-by: Stanislav Kinsburskii Reviewed-by: Roman Kisel Signed-off-by: Wei Liu commit 7b8e9264f55a9c320f398e337d215e68cca50131 Merge: a91e1138b7cb0e 21a88f5d9ce0c3 Author: Linus Torvalds Date: Fri Dec 19 07:55:35 2025 +1200 Merge tag 'net-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter and CAN. Current release - regressions: - netfilter: nf_conncount: fix leaked ct in error paths - sched: act_mirred: fix loop detection - sctp: fix potential deadlock in sctp_clone_sock() - can: fix build dependency - eth: mlx5e: do not update BQL of old txqs during channel reconfiguration Previous releases - regressions: - sched: ets: always remove class from active list before deleting it - inet: frags: flush pending skbs in fqdir_pre_exit() - netfilter: nf_nat: remove bogus direction check - mptcp: - schedule rtx timer only after pushing data - avoid deadlock on fallback while reinjecting - can: gs_usb: fix error handling - eth: - mlx5e: - avoid unregistering PSP twice - fix double unregister of HCA_PORTS component - bnxt_en: fix XDP_TX path - mlxsw: fix use-after-free when updating multicast route stats Previous releases - always broken: - ethtool: avoid overflowing userspace buffer on stats query - openvswitch: fix middle attribute validation in push_nsh() action - eth: - mlx5: fw_tracer, validate format string parameters - mlxsw: spectrum_router: fix neighbour use-after-free - ipvlan: ignore PACKET_LOOPBACK in handle_mode_l2() Misc: - Jozsef Kadlecsik retires from maintaining netfilter - tools: ynl: fix build on systems with old kernel headers" * tag 'net-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits) net: hns3: add VLAN id validation before using net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx net: hns3: using the num_tqps in the vf driver to apply for resources net: enetc: do not transmit redirected XDP frames when the link is down selftests/tc-testing: Test case exercising potential mirred redirect deadlock net/sched: act_mirred: fix loop detection sctp: Clear inet_opt in sctp_v6_copy_ip_options(). sctp: Fetch inet6_sk() after setting ->pinet6 in sctp_clone_sock(). net/handshake: duplicate handshake cancellations leak socket net/mlx5e: Don't include PSP in the hard MTU calculations net/mlx5e: Do not update BQL of old txqs during channel reconfiguration net/mlx5e: Trigger neighbor resolution for unresolved destinations net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init net/mlx5: Serialize firmware reset with devlink net/mlx5: fw_tracer, Handle escaped percent properly net/mlx5: fw_tracer, Validate format string parameters net/mlx5: Drain firmware reset in shutdown callback net/mlx5: fw reset, clear reset requested on drain_fw_reset net: dsa: mxl-gsw1xx: manually clear RANEG bit net: dsa: mxl-gsw1xx: fix .shutdown driver operation ... commit a91e1138b7cb0e4dfa12ef823c6eedb34b28bd08 Merge: 9a903e6d9649e4 d8a4af8f3d9d33 Author: Linus Torvalds Date: Fri Dec 19 07:50:20 2025 +1200 Merge tag 'v6.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - important fix for reconnect problem - minor cleanup * tag 'v6.19-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number smb: move some SMB1 definitions into common/smb1pdu.h smb: align durable reconnect v2 context to 8 byte boundary commit 52f758edc9f9f0b1f4f83eb668a5f76482ce00ca Author: Gustavo A. R. Silva Date: Fri Dec 12 15:44:50 2025 +0900 hyperv: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new __TRAILING_OVERLAP() helper to fix the following warning: include/hyperv/hvgdk_mini.h:581:25: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of MEMBERS that would otherwise follow it. This overlays the trailing MEMBER u64 gva_list[]; onto the FAM struct hv_tlb_flush_ex::hv_vp_set.bank_contents[], while keeping the FAM and the start of MEMBER aligned. The static_assert() ensures this alignment remains, and it's intentionally placed inmediately after the related structure --no blank line in between. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Wei Liu commit 9a903e6d9649e45cee9a8588fa3793fdfc5408ee Merge: ea1013c1539270 6f7c877cc397ba Author: Linus Torvalds Date: Fri Dec 19 07:41:17 2025 +1200 Merge tag 'fsnotify_for_v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fixes from Jan Kara: "Two fsnotify fixes. The fix from Ahelenia makes sure we generate event when modifying inode flags, the fix from Amir disables sending of events from device inodes to their parent directory as it could concievably create a usable side channel attack in case of some devices and so far we aren't aware of anybody depending on the functionality" * tag 'fsnotify_for_v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fs: send fsnotify_xattr()/IN_ATTRIB from vfs_fileattr_set()/chattr(1) fsnotify: do not generate ACCESS/MODIFY events on child for special files commit 277141a897c715e787f6c51e5db32f2ca90b00dc Merge: 359afc8eb02a51 dcd0b625fe440d Author: Rafael J. Wysocki Date: Thu Dec 18 20:31:10 2025 +0100 Merge branch 'pm-powercap' Merge power capping fixes for 6.19-rc2: - Fix CPU hotplug locking deadlock reported by lockdep after a recent update of the Intel RAPL power capping driver (Srinivas Pandruvada) - Fix sscanf() error return value handling in the power capping core and a race condition in register_control_type() (Sumeet Pawnikar) * pm-powercap: powercap: intel_rapl: Fix possible recursive lock warning powercap: fix sscanf() error return value handling powercap: fix race condition in register_control_type() commit 095d621141826a2841dae85b52c784c147ea99d3 Author: Stefan Binding Date: Tue Dec 16 13:49:20 2025 +0000 ASoC: ops: fix snd_soc_get_volsw for sx controls SX controls are currently broken, since the clamp introduced in commit a0ce874cfaaa ("ASoC: ops: improve snd_soc_get_volsw") does not handle SX controls, for example where the min value in the clamp is greater than the max value in the clamp. Add clamp parameter to prevent clamping in SX controls. The nature of SX controls mean that it wraps around 0, with a variable number of bits, therefore clamping the value becomes complicated and prone to error. Fixes 35 kunit tests for soc_ops_test_access. Fixes: a0ce874cfaaa ("ASoC: ops: improve snd_soc_get_volsw") Co-developed-by: Charles Keepax Signed-off-by: Stefan Binding Tested-by: Peter Ujfalusi Link: https://patch.msgid.link/20251216134938.788625-1-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 6cde588e64934858bb1553119c6b915b2fec9011 Author: Okan Akyuz Date: Mon Dec 15 20:44:22 2025 +0000 hwmon: (DS620) Update broken Datasheet URL in driver documentation The URL for the DS620 datasheet has changed. Update it to reflect the current location. Signed-off-by: Okan Akyuz Link: https://lore.kernel.org/r/20251215204423.80242-1-okan.akyuz.linux@gmail.com Signed-off-by: Guenter Roeck commit 0499add8efd72456514c6218c062911ccc922a99 Merge: ea1013c1539270 29763138830916 Author: Paolo Bonzini Date: Thu Dec 18 18:38:45 2025 +0100 Merge tag 'kvm-x86-fixes-6.19-rc1' of https://github.com/kvm-x86/linux into HEAD KVM fixes for 6.19-rc1 - Add a missing "break" to fix param parsing in the rseq selftest. - Apply runtime updates to the _current_ CPUID when userspace is setting CPUID, e.g. as part of vCPU hotplug, to fix a false positive and to avoid dropping the pending update. - Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot, as it's not supported by KVM and leads to a use-after-free due to KVM failing to unbind the memslot from the previously-associated guest_memfd instance. - Harden against similar KVM_MEM_GUEST_MEMFD goofs, and prepare for supporting flags-only changes on KVM_MEM_GUEST_MEMFD memlslots, e.g. for dirty logging. - Set exit_code[63:32] to -1 (all 0xffs) when synthesizing a nested SVM_EXIT_ERR (a.k.a. VMEXIT_INVALID) #VMEXIT, as VMEXIT_INVALID is defined as -1ull (a 64-bit value). - Update SVI when activating APICv to fix a bug where a post-activation EOI for an in-service IRQ would effective be lost due to SVI being stale. - Immediately refresh APICv controls (if necessary) on a nested VM-Exit instead of deferring the update via KVM_REQ_APICV_UPDATE, as the request is effectively ignored because KVM thinks the vCPU already has the correct APICv settings. commit 80f9c601d9c4d26f00356c0a9c461650e7089273 Author: Matthew Brost Date: Fri Dec 12 10:28:42 2025 -0800 drm/xe: Use usleep_range for accurate long-running workload timeslicing msleep is not very accurate in terms of how long it actually sleeps, whereas usleep_range is precise. Replace the timeslice sleep for long-running workloads with the more accurate usleep_range to avoid jitter if the sleep period is less than 20ms. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251212182847.1683222-3-matthew.brost@intel.com (cherry picked from commit ca415c4d4c17ad676a2c8981e1fcc432221dce79) Signed-off-by: Thomas Hellström commit fe3ccd24138fd391ae8e32289d492c85f67770fc Author: Thomas Hellström Date: Wed Dec 17 10:34:41 2025 +0100 drm/xe: Drop preempt-fences when destroying imported dma-bufs. When imported dma-bufs are destroyed, TTM is not fully individualizing the dma-resv, but it *is* copying the fences that need to be waited for before declaring idle. So in the case where the bo->resv != bo->_resv we can still drop the preempt-fences, but make sure we do that on bo->_resv which contains the fence-pointer copy. In the case where the copying fails, bo->_resv will typically not contain any fences pointers at all, so there will be nothing to drop. In that case, TTM would have ensured all fences that would have been copied are signaled, including any remaining preempt fences. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Fixes: fa0af721bd1f ("drm/ttm: test private resv obj on release/destroy") Cc: Matthew Brost Cc: # v6.16+ Signed-off-by: Thomas Hellström Tested-by: Matthew Brost Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251217093441.5073-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 425fe550fb513b567bd6d01f397d274092a9c274) Signed-off-by: Thomas Hellström commit 3767ca4166ad42fa9e34269efeaf9f15995cd92d Author: Ashutosh Dixit Date: Thu Dec 11 22:18:50 2025 -0800 drm/xe/eustall: Disallow 0 EU stall property values An EU stall property value of 0 is invalid and will cause a NPD. Reported-by: Peter Senna Tschudin Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6453 Fixes: 1537ec85ebd7 ("drm/xe/uapi: Introduce API for EU stall sampling") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Dixit Reviewed-by: Harish Chegondi Link: https://patch.msgid.link/20251212061850.1565459-4-ashutosh.dixit@intel.com (cherry picked from commit 5bf763e908bf795da4ad538d21c1ec41f8021f76) Signed-off-by: Thomas Hellström commit 3595114bc31d1eb5e1996164c901485c1ffac6f7 Author: Ashutosh Dixit Date: Thu Dec 11 22:18:49 2025 -0800 drm/xe/oa: Disallow 0 OA property values An OA property value of 0 is invalid and will cause a NPD. Reported-by: Peter Senna Tschudin Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6452 Fixes: cc4e6994d5a2 ("drm/xe/oa: Move functions up so they can be reused for config ioctl") Cc: stable@vger.kernel.org Signed-off-by: Ashutosh Dixit Reviewed-by: Harish Chegondi Link: https://patch.msgid.link/20251212061850.1565459-3-ashutosh.dixit@intel.com (cherry picked from commit 7a100e6ddcc47c1f6ba7a19402de86ce24790621) Signed-off-by: Thomas Hellström commit eb192bedf5908e63347c4923c5a1d58f9baef158 Author: Dan Carpenter Date: Fri Dec 5 14:39:19 2025 +0300 drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported() The xe_sriov_vfio_migration_supported() function is type bool so returning -EPERM means returning true. Return false instead. Fixes: bd45d46ffc8f ("drm/xe/pf: Export helpers for VFIO") Signed-off-by: Dan Carpenter Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/aTLEZ4g-FD-iMQ2V@stanley.mountain Signed-off-by: Michał Winiarski (cherry picked from commit 0a2404c8f6a3a120f79c57ef8a3302c8e8bc34d9) Signed-off-by: Thomas Hellström commit 256edb267a9d0b5aef70e408e9fba4f930f9926e Author: Ashutosh Dixit Date: Fri Dec 5 13:26:13 2025 -0800 drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME Reports can be written out to the OA buffer using ways other than periodic sampling. These include mmio trigger and context switches. To support these use cases, when periodic sampling is not enabled, OAG_OAGLBCTXCTRL_COUNTER_RESUME must be set. Fixes: 1db9a9dc90ae ("drm/xe/oa: OA stream initialization (OAG)") Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://patch.msgid.link/20251205212613.826224-4-ashutosh.dixit@intel.com (cherry picked from commit 88d98e74adf3e20f678bb89581a5c3149fdbdeaa) Signed-off-by: Thomas Hellström commit 6f0f404bd289d79a260b634c5b3f4d330b13472c Author: Matthew Brost Date: Fri Dec 12 10:28:41 2025 -0800 drm/xe: Adjust long-running workload timeslices to reasonable values A 10ms timeslice for long-running workloads is far too long and causes significant jitter in benchmarks when the system is shared. Adjust the value to 5ms for preempt-fencing VMs, as the resume step there is quite costly as memory is moved around, and set it to zero for pagefault VMs, since switching back to pagefault mode after dma-fence mode is relatively fast. Also change min_run_period_ms to 'unsiged int' type rather than 's64' as only positive values make sense. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251212182847.1683222-2-matthew.brost@intel.com (cherry picked from commit 33a5abd9a68394aa67f9618b20eee65ee8702ff4) Signed-off-by: Thomas Hellström commit f8dd66bfb4e184c71bd26418a00546ebe7f5c17a Author: Shuicheng Lin Date: Fri Dec 5 23:47:18 2025 +0000 drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations. Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS, returning -EINVAL when the limit is violated. v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh) Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties") Cc: Matthew Brost Cc: Ashutosh Dixit Signed-off-by: Shuicheng Lin Reviewed-by: Ashutosh Dixit Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20251205234715.2476561-6-shuicheng.lin@intel.com (cherry picked from commit e057b2d2b8d815df3858a87dffafa2af37e5945b) Signed-off-by: Thomas Hellström commit 8e461304009135270e9ccf2d7e2dfe29daec9b60 Author: Shuicheng Lin Date: Fri Dec 5 23:47:17 2025 +0000 drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value. Without bounds checking, a very large num_syncs can force an excessively large allocation, leading to kernel warnings from the page allocator as below. Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request exceeding this limit. " ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124 ... Call Trace: alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416 ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388 kmalloc_noprof include/linux/slab.h:909 [inline] kmalloc_array_noprof include/linux/slab.h:948 [inline] xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158 drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894 xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... " v2: Add "Reported-by" and Cc stable kernels. v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh) v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt) v5: Do the check at the top of the exec func. (Matt) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Koen Koning Reported-by: Peter Senna Tschudin Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6450 Cc: # v6.12+ Cc: Matthew Brost Cc: Michal Mrozek Cc: Carl Zhang Cc: José Roberto de Souza Cc: Lionel Landwerlin Cc: Ivan Briano Cc: Thomas Hellström Cc: Ashutosh Dixit Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20251205234715.2476561-5-shuicheng.lin@intel.com (cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c) Signed-off-by: Thomas Hellström commit af65faf34f6e9919bdd2912770d25d2a73cbcc7c Author: Caleb Sander Mateos Date: Tue Dec 16 22:34:36 2025 -0700 block: validate interval_exp integrity limit Various code assumes that the integrity interval is at least 1 sector and evenly divides the logical block size. Add these checks to blk_validate_integrity_limits(). This guards against block drivers that report invalid interval_exp values. Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit ccb8a3c08adf8121e2afb8e704f007ce99324d79 Author: Caleb Sander Mateos Date: Tue Dec 16 22:34:35 2025 -0700 block: validate pi_offset integrity limit The PI tuple must be contained within the metadata value, so validate that pi_offset + pi_tuple_size <= metadata_size. This guards against block drivers that report invalid pi_offset values. Signed-off-by: Caleb Sander Mateos Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit aa7d3a56a20f07978d9f401e13637a6479b13bd0 Author: Chen Ridong Date: Thu Dec 18 01:59:50 2025 +0000 cpuset: fix warning when disabling remote partition A warning was triggered as follows: WARNING: kernel/cgroup/cpuset.c:1651 at remote_partition_disable+0xf7/0x110 RIP: 0010:remote_partition_disable+0xf7/0x110 RSP: 0018:ffffc90001947d88 EFLAGS: 00000206 RAX: 0000000000007fff RBX: ffff888103b6e000 RCX: 0000000000006f40 RDX: 0000000000006f00 RSI: ffffc90001947da8 RDI: ffff888103b6e000 RBP: ffff888103b6e000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: ffff88810b2e2728 R12: ffffc90001947da8 R13: 0000000000000000 R14: ffffc90001947da8 R15: ffff8881081f1c00 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f55c8bbe0b2 CR3: 000000010b14c000 CR4: 00000000000006f0 Call Trace: update_prstate+0x2d3/0x580 cpuset_partition_write+0x94/0xf0 kernfs_fop_write_iter+0x147/0x200 vfs_write+0x35d/0x500 ksys_write+0x66/0xe0 do_syscall_64+0x6b/0x390 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f55c8cd4887 Reproduction steps (on a 16-CPU machine): # cd /sys/fs/cgroup/ # mkdir A1 # echo +cpuset > A1/cgroup.subtree_control # echo "0-14" > A1/cpuset.cpus.exclusive # mkdir A1/A2 # echo "0-14" > A1/A2/cpuset.cpus.exclusive # echo "root" > A1/A2/cpuset.cpus.partition # echo 0 > /sys/devices/system/cpu/cpu15/online # echo member > A1/A2/cpuset.cpus.partition When CPU 15 is offlined, subpartitions_cpus gets cleared because no CPUs remain available for the top_cpuset, forcing partitions to share CPUs with the top_cpuset. In this scenario, disabling the remote partition triggers a warning stating that effective_xcpus is not a subset of subpartitions_cpus. Partitions should be invalidated in this case to inform users that the partition is now invalid(cpus are shared with top_cpuset). To fix this issue: 1. Only emit the warning only if subpartitions_cpus is not empty and the effective_xcpus is not a subset of subpartitions_cpus. 2. During the CPU hotplug process, invalidate partitions if subpartitions_cpus is empty. Fixes: f62a5d39368e ("cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition") Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 21a88f5d9ce0c328486073b75d082d85a1e98a8b Merge: 373a34addca0a6 5a5aff6338c0f4 Author: Paolo Abeni Date: Thu Dec 18 17:23:07 2025 +0100 Merge tag 'linux-can-fixes-for-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-12-18 this is a pull request of 3 patches for net/main. Tetsuo Handa contributes 2 patches to fix race windows in the j1939 protocol to properly handle disappearing network devices. The last patch is by me, it fixes a build dependency with the CAN drivers, that got introduced while fixing a dependency between the CAN protocol and CAN device code. linux-can-fixes-for-6.19-20251218 * tag 'linux-can-fixes-for-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: fix build dependency can: j1939: make j1939_sk_bind() fail if device is no longer registered can: j1939: make j1939_session_activate() fail if device is no longer registered ==================== Link: https://patch.msgid.link/20251218123132.664533-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit 913f7cf77bf14c13cfea70e89bcb6d0b22239562 Author: Chuck Lever Date: Tue Nov 18 19:51:19 2025 -0500 NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL afterwards, and finds that it is only a default ACL (based on the mode bits) and not the ACL that was requested during file creation. This violates RFC 8881 section 6.4.1.3: "the ACL attribute is set as given". The issue occurs in nfsd_create_setattr(), which calls nfsd_attrs_valid() to determine whether to call nfsd_setattr(). However, nfsd_attrs_valid() checks only for iattr changes and security labels, but not POSIX ACLs. When only an ACL is present, the function returns false, nfsd_setattr() is skipped, and the POSIX ACL is never applied to the inode. Subsequently, when the client retrieves the ACL, the server finds no POSIX ACL on the inode and returns one generated from the file's mode bits rather than returning the originally-specified ACL. Reported-by: Aurélien Couderc Fixes: c0cbe70742f4 ("NFSD: add posix ACLs to struct nfsd_attrs") Cc: Roland Mainz Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever commit ad3cbbb0c1892c48919727fcb8dec5965da8bacb Author: Chuck Lever Date: Mon Nov 17 11:00:50 2025 -0500 NFSD: Clear TIME_DELEG in the suppattr_exclcreat bitmap >From RFC 8881: 5.8.1.14. Attribute 75: suppattr_exclcreat > The bit vector that would set all REQUIRED and RECOMMENDED > attributes that are supported by the EXCLUSIVE4_1 method of file > creation via the OPEN operation. The scope of this attribute > applies to all objects with a matching fsid. There's nothing in RFC 8881 that states that suppattr_exclcreat is or is not allowed to contain bits for attributes that are clear in the reported supported_attrs bitmask. But it doesn't make sense for an NFS server to indicate that it /doesn't/ implement an attribute, but then also indicate that clients /are/ allowed to set that attribute using OPEN(create) with EXCLUSIVE4_1. The FATTR4_WORD2_TIME_DELEG attributes are also not to be allowed for OPEN(create) with EXCLUSIVE4_1. It doesn't make sense to set a delegated timestamp on a new file. Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 27d17641cacfedd816789b75d342430f6b912bd2 Author: Chuck Lever Date: Mon Nov 17 11:00:49 2025 -0500 NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap >From RFC 8881: 5.8.1.14. Attribute 75: suppattr_exclcreat > The bit vector that would set all REQUIRED and RECOMMENDED > attributes that are supported by the EXCLUSIVE4_1 method of file > creation via the OPEN operation. The scope of this attribute > applies to all objects with a matching fsid. There's nothing in RFC 8881 that states that suppattr_exclcreat is or is not allowed to contain bits for attributes that are clear in the reported supported_attrs bitmask. But it doesn't make sense for an NFS server to indicate that it /doesn't/ implement an attribute, but then also indicate that clients /are/ allowed to set that attribute using OPEN(create) with EXCLUSIVE4_1. Ensure that the SECURITY_LABEL and ACL bits are not set in the suppattr_exclcreat bitmask when they are also not set in the supported_attrs bitmask. Fixes: 8c18f2052e75 ("nfsd41: SUPPATTR_EXCLCREAT attribute") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit df8d829bba3adcf3cc744c01d933b6fd7cf06e91 Author: Shardul Bankar Date: Mon Nov 17 17:41:21 2025 +0530 nfsd: fix memory leak in nfsd_create_serv error paths When nfsd_create_serv() calls percpu_ref_init() to initialize nn->nfsd_net_ref, it allocates both a percpu reference counter and a percpu_ref_data structure (64 bytes). However, if the function fails later due to svc_create_pooled() returning NULL or svc_bind() returning an error, these allocations are not cleaned up, resulting in a memory leak. The leak manifests as: - Unreferenced percpu allocation (8 bytes per CPU) - Unreferenced percpu_ref_data structure (64 bytes) Fix this by adding percpu_ref_exit() calls in both error paths to properly clean up the percpu_ref_init() allocations. This patch fixes the percpu_ref leak in nfsd_create_serv() seen as an auxiliary leak in syzbot report 099461f8558eb0a1f4f3; the prepare_creds() and vsock-related leaks in the same report remain to be addressed separately. Reported-by: syzbot+099461f8558eb0a1f4f3@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=099461f8558eb0a1f4f3 Fixes: 47e988147f40 ("nfsd: add nfsd_serv_try_get and nfsd_serv_put") Signed-off-by: Shardul Bankar Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 761fcf46a1bd797bd32d23f3ea0141ffd437668a Author: Thorsten Blum Date: Tue Dec 16 15:50:03 2025 +0100 w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code. Cc: stable@vger.kernel.org Fixes: e2c94d6f5720 ("w1_therm: adding alarm sysfs entry") Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251216145007.44328-2-thorsten.blum@linux.dev Signed-off-by: Krzysztof Kozlowski commit 373a34addca0a68b0eb77360035e9885183ffdca Merge: 2939203ffee818 6ef935e65902bf Author: Paolo Abeni Date: Thu Dec 18 16:58:31 2025 +0100 Merge branch 'there-are-some-bugfix-for-the-hns3-ethernet-driver' Jijie Shao says: ==================== There are some bugfix for the HNS3 ethernet driver ==================== Link: https://patch.msgid.link/20251211023737.2327018-1-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 6ef935e65902bfed53980ad2754b06a284ea8ac1 Author: Jian Shen Date: Thu Dec 11 10:37:37 2025 +0800 net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID. Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID. Fixes: fe4144d47eef ("net: hns3: sync VLAN filter entries when kill VLAN ID failed") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251211023737.2327018-4-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit d180c11aa8a6fa735f9ac2c72c61364a9afc2ba7 Author: Jian Shen Date: Thu Dec 11 10:37:36 2025 +0800 net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx Currently, rss_size = num_tqps / tc_num. If tc_num is 1, then num_tqps equals rss_size. However, if the tc_num is greater than 1, then rss_size will be less than num_tqps, causing the tqp_index check for subsequent TCs using rss_size to always fail. This patch uses the num_tqps to check whether tqp_index is out of range, instead of rss_size. Fixes: 326334aad024 ("net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251211023737.2327018-3-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit c2a16269742e176fccdd0ef9c016a233491a49ad Author: Jian Shen Date: Thu Dec 11 10:37:35 2025 +0800 net: hns3: using the num_tqps in the vf driver to apply for resources Currently, hdev->htqp is allocated using hdev->num_tqps, and kinfo->tqp is allocated using kinfo->num_tqps. However, kinfo->num_tqps is set to min(new_tqps, hdev->num_tqps); Therefore, kinfo->num_tqps may be smaller than hdev->num_tqps, which causes some hdev->htqp[i] to remain uninitialized in hclgevf_knic_setup(). Thus, this patch allocates hdev->htqp and kinfo->tqp using hdev->num_tqps, ensuring that the lengths of hdev->htqp and kinfo->tqp are consistent and that all elements are properly initialized. Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251211023737.2327018-2-shaojijie@huawei.com Signed-off-by: Paolo Abeni commit 2939203ffee818f1e5ebd60bbb85a174d63aab9c Author: Wei Fang Date: Thu Dec 11 10:09:19 2025 +0800 net: enetc: do not transmit redirected XDP frames when the link is down In the current implementation, the enetc_xdp_xmit() always transmits redirected XDP frames even if the link is down, but the frames cannot be transmitted from TX BD rings when the link is down, so the frames are still kept in the TX BD rings. If the XDP program is uninstalled, users will see the following warning logs. fsl_enetc 0000:00:00.0 eno0: timeout for tx ring #6 clear More worse, the TX BD ring cannot work properly anymore, because the HW PIR and CIR are not equal after the re-initialization of the TX BD ring. At this point, the BDs between CIR and PIR are invalid, which will cause a hardware malfunction. Another reason is that there is internal context in the ring prefetch logic that will retain the state from the first incarnation of the ring and continue prefetching from the stale location when we re-initialize the ring. The internal context is only reset by an FLR. That is to say, for LS1028A ENETC, software cannot set the HW CIR and PIR when initializing the TX BD ring. It does not make sense to transmit redirected XDP frames when the link is down. Add a link status check to prevent transmission in this condition. This fixes part of the issue, but more complex cases remain. For example, the TX BD ring may still contain unsent frames when the link goes down. Those situations require additional patches, which will build on this one. Fixes: 9d2b68cc108d ("net: enetc: add support for XDP_REDIRECT") Signed-off-by: Wei Fang Reviewed-by: Frank Li Reviewed-by: Hariprasad Kelam Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251211020919.121113-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 5cba412d6a005719d52dc72b6d7e5a59af979eaa Author: Victor Nogueira Date: Wed Dec 10 11:22:55 2025 -0500 selftests/tc-testing: Test case exercising potential mirred redirect deadlock Add a test case that reproduces deadlock scenario where the user has a drr qdisc attached to root and has a mirred action that redirects to self on egress Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251210162255.1057663-2-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 1d856251a009d64007d71d01c988bead6d3a098c Author: Jamal Hadi Salim Date: Wed Dec 10 11:22:54 2025 -0500 net/sched: act_mirred: fix loop detection Fix a loop scenario of ethx:egress->ethx:egress Example setup to reproduce: tc qdisc add dev ethx root handle 1: drr tc filter add dev ethx parent 1: protocol ip prio 1 matchall \ action mirred egress redirect dev ethx Now ping out of ethx and you get a deadlock: [ 116.892898][ T307] ============================================ [ 116.893182][ T307] WARNING: possible recursive locking detected [ 116.893418][ T307] 6.18.0-rc6-01205-ge05021a829b8-dirty #204 Not tainted [ 116.893682][ T307] -------------------------------------------- [ 116.893926][ T307] ping/307 is trying to acquire lock: [ 116.894133][ T307] ffff88800c122908 (&sch->root_lock_key){+...}-{3:3}, at: __dev_queue_xmit+0x2210/0x3b50 [ 116.894517][ T307] [ 116.894517][ T307] but task is already holding lock: [ 116.894836][ T307] ffff88800c122908 (&sch->root_lock_key){+...}-{3:3}, at: __dev_queue_xmit+0x2210/0x3b50 [ 116.895252][ T307] [ 116.895252][ T307] other info that might help us debug this: [ 116.895608][ T307] Possible unsafe locking scenario: [ 116.895608][ T307] [ 116.895901][ T307] CPU0 [ 116.896057][ T307] ---- [ 116.896200][ T307] lock(&sch->root_lock_key); [ 116.896392][ T307] lock(&sch->root_lock_key); [ 116.896605][ T307] [ 116.896605][ T307] *** DEADLOCK *** [ 116.896605][ T307] [ 116.896864][ T307] May be due to missing lock nesting notation [ 116.896864][ T307] [ 116.897123][ T307] 6 locks held by ping/307: [ 116.897302][ T307] #0: ffff88800b4b0250 (sk_lock-AF_INET){+.+.}-{0:0}, at: raw_sendmsg+0xb20/0x2cf0 [ 116.897808][ T307] #1: ffffffff88c839c0 (rcu_read_lock){....}-{1:3}, at: ip_output+0xa9/0x600 [ 116.898138][ T307] #2: ffffffff88c839c0 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x2c6/0x1ee0 [ 116.898459][ T307] #3: ffffffff88c83960 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x200/0x3b50 [ 116.898782][ T307] #4: ffff88800c122908 (&sch->root_lock_key){+...}-{3:3}, at: __dev_queue_xmit+0x2210/0x3b50 [ 116.899132][ T307] #5: ffffffff88c83960 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x200/0x3b50 [ 116.899442][ T307] [ 116.899442][ T307] stack backtrace: [ 116.899667][ T307] CPU: 2 UID: 0 PID: 307 Comm: ping Not tainted 6.18.0-rc6-01205-ge05021a829b8-dirty #204 PREEMPT(voluntary) [ 116.899672][ T307] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 116.899675][ T307] Call Trace: [ 116.899678][ T307] [ 116.899680][ T307] dump_stack_lvl+0x6f/0xb0 [ 116.899688][ T307] print_deadlock_bug.cold+0xc0/0xdc [ 116.899695][ T307] __lock_acquire+0x11f7/0x1be0 [ 116.899704][ T307] lock_acquire+0x162/0x300 [ 116.899707][ T307] ? __dev_queue_xmit+0x2210/0x3b50 [ 116.899713][ T307] ? srso_alias_return_thunk+0x5/0xfbef5 [ 116.899717][ T307] ? stack_trace_save+0x93/0xd0 [ 116.899723][ T307] _raw_spin_lock+0x30/0x40 [ 116.899728][ T307] ? __dev_queue_xmit+0x2210/0x3b50 [ 116.899731][ T307] __dev_queue_xmit+0x2210/0x3b50 Fixes: 178ca30889a1 ("Revert "net/sched: Fix mirred deadlock on device recursion"") Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251210162255.1057663-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 6b991ad8dc3abfe5720fc2e9ee96be63ae43e362 Author: Alessio Belle Date: Mon Dec 8 09:11:00 2025 +0000 drm/imagination: Disallow exporting of PM/FW protected objects These objects are meant to be used by the GPU firmware or by the PM unit within the GPU, in which case they may contain physical addresses. This adds a layer of protection against exposing potentially exploitable information outside of the driver. Fixes: ff5f643de0bf ("drm/imagination: Add GEM and VM related code") Signed-off-by: Alessio Belle Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251208-no-export-pm-fw-obj-v1-1-83ab12c61693@imgtec.com Signed-off-by: Matt Coster commit cdc3074c00dc36172247017e8bb257abf7ac710c Merge: 15564bd67e2975 d7ff61e6f3ef85 Author: Paolo Abeni Date: Thu Dec 18 16:18:02 2025 +0100 Merge branch 'sctp-fix-two-issues-in-sctp_clone_sock' Kuniyuki Iwashima says: ==================== sctp: Fix two issues in sctp_clone_sock(). syzbot reported two issues in sctp_clone_sock(). This series fixes the issues. v1: https://lore.kernel.org/netdev/20251208133728.157648-1-kuniyu@google.com/ ==================== Link: https://patch.msgid.link/20251210081206.1141086-1-kuniyu@google.com Signed-off-by: Paolo Abeni commit d7ff61e6f3ef856da82bb90cbd0391839a8917a4 Author: Kuniyuki Iwashima Date: Wed Dec 10 08:11:13 2025 +0000 sctp: Clear inet_opt in sctp_v6_copy_ip_options(). syzbot reported the splat below. [0] Since the cited commit, the child socket inherits all fields of its parent socket unless explicitly cleared. syzbot set IP_OPTIONS to AF_INET6 socket and created a child socket inheriting inet_sk(sk)->inet_opt. sctp_v6_copy_ip_options() only clones np->opt, and leaving inet_opt results in double-free. Let's clear inet_opt in sctp_v6_copy_ip_options(). [0]: BUG: KASAN: double-free in inet_sock_destruct+0x538/0x740 net/ipv4/af_inet.c:159 Free of addr ffff8880304b6d40 by task ksoftirqd/0/15 CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report_invalid_free+0xea/0x110 mm/kasan/report.c:557 check_slab_allocation+0xe1/0x130 include/linux/page-flags.h:-1 kasan_slab_pre_free include/linux/kasan.h:198 [inline] slab_free_hook mm/slub.c:2484 [inline] slab_free mm/slub.c:6630 [inline] kfree+0x148/0x6d0 mm/slub.c:6837 inet_sock_destruct+0x538/0x740 net/ipv4/af_inet.c:159 __sk_destruct+0x89/0x660 net/core/sock.c:2350 sock_put include/net/sock.h:1991 [inline] sctp_endpoint_destroy_rcu+0xa1/0xf0 net/sctp/endpointola.c:197 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xcab/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:622 run_ksoftirqd+0x9b/0x100 kernel/softirq.c:1063 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6003: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5642 [inline] __kmalloc_noprof+0x411/0x7f0 mm/slub.c:5654 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ip_options_get+0x51/0x4c0 net/ipv4/ip_options.c:517 do_ip_setsockopt+0x1d9b/0x2d00 net/ipv4/ip_sockglue.c:1087 ip_setsockopt+0x66/0x110 net/ipv4/ip_sockglue.c:1417 do_sock_setsockopt+0x17c/0x1b0 net/socket.c:2360 __sys_setsockopt net/socket.c:2385 [inline] __do_sys_setsockopt net/socket.c:2391 [inline] __se_sys_setsockopt net/socket.c:2388 [inline] __x64_sys_setsockopt+0x13f/0x1b0 net/socket.c:2388 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 15: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2539 [inline] slab_free mm/slub.c:6630 [inline] kfree+0x19a/0x6d0 mm/slub.c:6837 inet_sock_destruct+0x538/0x740 net/ipv4/af_inet.c:159 __sk_destruct+0x89/0x660 net/core/sock.c:2350 sock_put include/net/sock.h:1991 [inline] sctp_endpoint_destroy_rcu+0xa1/0xf0 net/sctp/endpointola.c:197 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xcab/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:622 run_ksoftirqd+0x9b/0x100 kernel/softirq.c:1063 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fixes: 16942cf4d3e31 ("sctp: Use sk_clone() in sctp_accept().") Reported-by: syzbot+ec33a1a006ed5abe7309@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6936d112.a70a0220.38f243.00a8.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251210081206.1141086-3-kuniyu@google.com Acked-by: Xin Long Signed-off-by: Paolo Abeni commit b98f06f9a5d3b32cf1b3998b4115fb3b5478752d Author: Kuniyuki Iwashima Date: Wed Dec 10 08:11:12 2025 +0000 sctp: Fetch inet6_sk() after setting ->pinet6 in sctp_clone_sock(). syzbot reported the lockdep splat below. [0] sctp_clone_sock() sets the child socket's ipv6_mc_list to NULL, but somehow sock_release() in an error path finally acquires lock_sock() in ipv6_sock_mc_close(). The root cause is that sctp_clone_sock() fetches inet6_sk(newsk) before setting newinet->pinet6, meaning that the parent's ipv6_mc_list was actually cleared. Also, sctp_v6_copy_ip_options() uses inet6_sk() but is called before newinet->pinet6 is set. Let's use inet6_sk() only after setting newinet->pinet6. [0]: WARNING: possible recursive locking detected syzkaller #0 Not tainted syz.0.17/5996 is trying to acquire lock: ffff888031af4c60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline] ffff888031af4c60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: ipv6_sock_mc_close+0xd3/0x140 net/ipv6/mcast.c:348 but task is already holding lock: ffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline] ffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_getsockopt+0x135/0xb60 net/sctp/socket.c:8131 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_INET6); lock(sk_lock-AF_INET6); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by syz.0.17/5996: #0: ffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline] #0: ffff888031af4320 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_getsockopt+0x135/0xb60 net/sctp/socket.c:8131 stack backtrace: CPU: 0 UID: 0 PID: 5996 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_deadlock_bug+0x279/0x290 kernel/locking/lockdep.c:3041 check_deadlock kernel/locking/lockdep.c:3093 [inline] validate_chain kernel/locking/lockdep.c:3895 [inline] __lock_acquire+0x2540/0x2cf0 kernel/locking/lockdep.c:5237 lock_acquire+0x117/0x340 kernel/locking/lockdep.c:5868 lock_sock_nested+0x48/0x100 net/core/sock.c:3780 lock_sock include/net/sock.h:1700 [inline] ipv6_sock_mc_close+0xd3/0x140 net/ipv6/mcast.c:348 inet6_release+0x47/0x70 net/ipv6/af_inet6.c:482 __sock_release net/socket.c:653 [inline] sock_release+0x85/0x150 net/socket.c:681 sctp_getsockopt_peeloff_common+0x56b/0x770 net/sctp/socket.c:5732 sctp_getsockopt_peeloff_flags+0x13b/0x230 net/sctp/socket.c:5801 sctp_getsockopt+0x3ab/0xb60 net/sctp/socket.c:8151 do_sock_getsockopt+0x2b4/0x3d0 net/socket.c:2399 __sys_getsockopt net/socket.c:2428 [inline] __do_sys_getsockopt net/socket.c:2435 [inline] __se_sys_getsockopt net/socket.c:2432 [inline] __x64_sys_getsockopt+0x1a5/0x250 net/socket.c:2432 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8f8c38f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcfdade018 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007f8f8c5e5fa0 RCX: 00007f8f8c38f749 RDX: 000000000000007a RSI: 0000000000000084 RDI: 0000000000000003 RBP: 00007f8f8c413f91 R08: 0000200000000040 R09: 0000000000000000 R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8f8c5e5fa0 R14: 00007f8f8c5e5fa0 R15: 0000000000000005 Fixes: 16942cf4d3e31 ("sctp: Use sk_clone() in sctp_accept().") Reported-by: syzbot+c59e6bb54e7620495725@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6936d112.a70a0220.38f243.00a7.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251210081206.1141086-2-kuniyu@google.com Acked-by: Xin Long Signed-off-by: Paolo Abeni commit c9b5645fd8ca10f310e41b07540f98e6a9720f40 Author: Thomas Fourier Date: Wed Dec 17 10:36:48 2025 +0100 block: rnbd-clt: Fix leaked ID in init_dev() If kstrdup() fails in init_dev(), then the newly allocated ID is lost. Fixes: 64e8a6ece1a5 ("block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name") Signed-off-by: Thomas Fourier Acked-by: Jack Wang Signed-off-by: Jens Axboe commit 15564bd67e2975002f2a8e9defee33e321d3183f Author: Scott Mayhew Date: Tue Dec 9 14:30:15 2025 -0500 net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed. If a second cancellation request arrives for the same handshake request, then remove_pending() will return false... and assuming HANDSHAKE_F_REQ_COMPLETED isn't set in req->hr_flags, we'll continue processing through the out_true label, where we put another reference on the sock and a refcount underflow occurs. This can happen for example if a handshake times out - particularly if the SUNRPC client sends the AUTH_TLS probe to the server but doesn't follow it up with the ClientHello due to a problem with tlshd. When the timeout is hit on the server, the server will send a FIN, which triggers a cancellation request via xs_reset_transport(). When the timeout is hit on the client, another cancellation request happens via xs_tls_handshake_sync(). Add a test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) in the pending cancel path so duplicate cancels can be detected. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Suggested-by: Chuck Lever Signed-off-by: Scott Mayhew Reviewed-by: Chuck Lever Link: https://patch.msgid.link/20251209193015.3032058-1-smayhew@redhat.com Signed-off-by: Paolo Abeni commit 3e82accd3e9c35acfc68e44e12b37e5fd350c768 Merge: 78a47532ab4d0b fec7b0795548b4 Author: Paolo Abeni Date: Thu Dec 18 13:55:01 2025 +0100 Merge tag 'nf-25-12-16' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net The following patchset contains Netfilter fixes for *net*: 1) Jozsef Kadlecsik is retiring. Fortunately Jozsef will still keep an eye on ipset patches. 2) remove a bogus direction check from nat core, this caused spurious flakes in the 'reverse clash' selftest, from myself. 3) nf_tables doesn't need to do chain validation on register store, from Pablo Neira Ayuso. 4) nf_tables shouldn't revisit chains during ruleset (graph) validation if possible. Both 3 and 4 were slated for -next initially but there are now two independent reports of people hitting soft lockup errors during ruleset validation, so it makes no sense anymore to route this via -next given this is -stable material. From myself. 5) call cond_resched() in a more frequently visited place during nf_tables chain validation, this wasn't possible earlier due to rcu read lock, but nowadays its not held anymore during set walks. 6) Don't fail conntrack packetdrill test with HZ=100 kernels. netfilter pull request nf-25-12-16 * tag 'nf-25-12-16' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate netfilter: nf_tables: avoid chain re-validation if possible netfilter: nf_tables: remove redundant chain validation on register store netfilter: nf_nat: remove bogus direction check MAINTAINERS: Remove Jozsef Kadlecsik from MAINTAINERS file ==================== Link: https://patch.msgid.link/20251216190904.14507-1-fw@strlen.de Signed-off-by: Paolo Abeni commit 78a47532ab4d0beebb13e67c4ef97b3fe9f56be0 Merge: 71e6b15d214e25 4198a14c8c6252 Author: Paolo Abeni Date: Thu Dec 18 13:39:31 2025 +0100 Merge branch 'mlx5-misc-fixes-2025-12-09' Tariq Toukan says: ==================== mlx5 misc fixes 2025-12-09 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1765284977-1363052-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 4198a14c8c6252fd1191afaa742dd515dcaf3487 Author: Cosmin Ratiu Date: Tue Dec 9 14:56:17 2025 +0200 net/mlx5e: Don't include PSP in the hard MTU calculations Commit [1] added the 40 bytes required by the PSP header+trailer and the UDP header to MLX5E_ETH_HARD_MTU, which limits the device-wide max software MTU that could be set. This is not okay, because most packets are not PSP packets and it doesn't make sense to always reserve space for headers which won't get added in most cases. As it turns out, for TCP connections, PSP overhead is already taken into account in the TCP MSS calculations via inet_csk(sk)->icsk_ext_hdr_len. This was added in commit [2]. This means that the extra space reserved in the hard MTU for mlx5 ends up unused and wasted. Remove the unnecessary 40 byte reservation from hard MTU. [1] commit e5a1861a298e ("net/mlx5e: Implement PSP Tx data path") [2] commit e97269257fe4 ("net: psp: update the TCP MSS to reflect PSP packet overhead") Fixes: e5a1861a298e ("net/mlx5e: Implement PSP Tx data path") Signed-off-by: Cosmin Ratiu Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-10-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit c8591decd9dbf395cb8ae398e70b0438fdd24aee Author: Tariq Toukan Date: Tue Dec 9 14:56:16 2025 +0200 net/mlx5e: Do not update BQL of old txqs during channel reconfiguration During channel reconfiguration (e.g., ethtool private flags changes), the driver can trigger a kernel BUG_ON in dql_completed() with the error "kernel BUG at lib/dynamic_queue_limits.c:99". The issue occurs in the following sequence: During mlx5e_safe_switch_params(), old channels are deactivated via mlx5e_deactivate_txqsq(). New channels are created and activated, taking ownership of the netdev_queues and their BQL state. When old channels are closed via mlx5e_close_txqsq(), there may be pending TX descriptors (sq->cc != sq->pc) that were in-flight during the deactivation. mlx5e_free_txqsq_descs() frees these pending descriptors and attempts to complete them via netdev_tx_completed_queue(). However, the BQL state (dql->num_queued and dql->num_completed) have been reset in mlx5e_activate_txqsq and belong to the new queue owner, leading to dql->num_queued - dql->num_completed < nbytes. This triggers BUG_ON(count > num_queued - num_completed) in dql_completed(). Fixes: 3b88a535a8e1 ("net/mlx5e: Defer channels closure to reduce interface down time") Signed-off-by: Tariq Toukan Signed-off-by: William Tu Reviewed-by: Dragos Tatulea Link: https://patch.msgid.link/1765284977-1363052-9-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 9ab89bde13e5251e1d0507e1cc426edcdfe19142 Author: Jianbo Liu Date: Tue Dec 9 14:56:15 2025 +0200 net/mlx5e: Trigger neighbor resolution for unresolved destinations When initializing the MAC addresses for an outbound IPsec packet offload rule in mlx5e_ipsec_init_macs, the call to dst_neigh_lookup is used to find the next-hop neighbor (typically the gateway in tunnel mode). This call might create a new neighbor entry if one doesn't already exist. This newly created entry starts in the INCOMPLETE state, as the kernel hasn't yet sent an ARP or NDISC probe to resolve the MAC address. In this case, neigh_ha_snapshot will correctly return an all-zero MAC address. IPsec packet offload requires the actual next-hop MAC address to program the rule correctly. If the neighbor state is INCOMPLETE when the rule is created, the hardware rule is programmed with an all-zero destination MAC address. Packets sent using this rule will be subsequently dropped by the receiving network infrastructure or host. This patch adds a check specifically for the outbound offload path. If neigh_ha_snapshot returns an all-zero MAC address, it proactively calls neigh_event_send(n, NULL). This ensures the kernel immediately sends the initial ARP or NDISC probe if one isn't already pending, accelerating the resolution process. This helps prevent the hardware rule from being programmed with an invalid MAC address and avoids packet drops due to unresolved neighbors. Fixes: 71670f766b8f ("net/mlx5e: Support routed networks during IPsec MACs initialization") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-8-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit e35d7da8dd9e55b37c3e8ab548f6793af0c2ab49 Author: Jianbo Liu Date: Tue Dec 9 14:56:14 2025 +0200 net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init Replace ipv6_stub->ipv6_dst_lookup_flow() with ip6_dst_lookup() in mlx5e_ipsec_init_macs() since IPsec transformations are not needed during Security Association setup - only basic routing information is required for nexthop MAC address resolution. This resolves an issue where XfrmOutNoStates error counter would be incremented when xfrm policy is configured before xfrm state, as the IPsec-aware routing function would attempt policy checks during SA initialization. Fixes: 71670f766b8f ("net/mlx5e: Support routed networks during IPsec MACs initialization") Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-7-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 367e501f8b095eca08d2eb0ba4ccea5b5e82c169 Author: Shay Drory Date: Tue Dec 9 14:56:13 2025 +0200 net/mlx5: Serialize firmware reset with devlink The firmware reset mechanism can be triggered by asynchronous events, which may race with other devlink operations like devlink reload or devlink dev eswitch set, potentially leading to inconsistent states. This patch addresses the race by using the devl_lock to serialize the firmware reset against other devlink operations. When a reset is requested, the driver attempts to acquire the lock. If successful, it sets a flag to block devlink reload or eswitch changes, ACKs the reset to firmware and then releases the lock. If the lock is already held by another operation, the driver NACKs the firmware reset request, indicating that the reset cannot proceed. Firmware reset does not keep the devl_lock and instead uses an internal firmware reset bit. This is because firmware resets can be triggered by asynchronous events, and processed in different threads. It is illegal and unsafe to acquire a lock in one thread and attempt to release it in another, as lock ownership is intrinsically thread-specific. This change ensures that firmware resets and other devlink operations are mutually exclusive during the critical reset request phase, preventing race conditions. Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") Signed-off-by: Shay Drory Reviewed-by: Mateusz Berezecki Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-6-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit c0289f67f7d6a0dfba0e92cfe661a5c70c8c6e92 Author: Shay Drory Date: Tue Dec 9 14:56:12 2025 +0200 net/mlx5: fw_tracer, Handle escaped percent properly The firmware tracer's format string validation and parameter counting did not properly handle escaped percent signs (%%). This caused fw_tracer to count more parameters when trace format strings contained literal percent characters. To fix it, allow %% to pass string validation and skip %% sequences when counting parameters since they represent literal percent signs rather than format specifiers. Fixes: 70dd6fdb8987 ("net/mlx5: FW tracer, parse traces and kernel tracing support") Signed-off-by: Shay Drory Reported-by: Breno Leitao Reviewed-by: Moshe Shemesh Closes: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5slqvelp@t3s3erottr6s/ Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-5-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit b35966042d20b14e2d83330049f77deec5229749 Author: Shay Drory Date: Tue Dec 9 14:56:11 2025 +0200 net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix. Fixes: 70dd6fdb8987 ("net/mlx5: FW tracer, parse traces and kernel tracing support") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Reported-by: Breno Leitao Closes: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5slqvelp@t3s3erottr6s/ Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 5846a365fc6476b02d6766963cf0985520f0385f Author: Moshe Shemesh Date: Tue Dec 9 14:56:10 2025 +0200 net/mlx5: Drain firmware reset in shutdown callback Invoke drain_fw_reset() in the shutdown callback to ensure all firmware reset handling is completed before shutdown proceeds. Fixes: 16d42d313350 ("net/mlx5: Drain fw_reset when removing device") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 89a898d63f6f588acf5c104c65c94a38b68c69a6 Author: Moshe Shemesh Date: Tue Dec 9 14:56:09 2025 +0200 net/mlx5: fw reset, clear reset requested on drain_fw_reset drain_fw_reset() waits for ongoing firmware reset events and blocks new event handling, but does not clear the reset requested flag, and may keep sync reset polling. To fix it, call mlx5_sync_reset_clear_reset_requested() to clear the flag, stop sync reset polling, and resume health polling, ensuring health issues are still detected after the firmware reset drain. Fixes: 16d42d313350 ("net/mlx5: Drain fw_reset when removing device") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1765284977-1363052-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 71e6b15d214e2500c8482509f7b3ae6ee5030889 Merge: 7b07be1ff1cb6c 7b103aaf0d564b Author: Paolo Abeni Date: Thu Dec 18 12:53:23 2025 +0100 Merge branch 'net-dsa-lantiq-a-bunch-of-fixes' Daniel Golle says: ==================== net: dsa: lantiq: a bunch of fixes This series is the continuation and result of comments received for a fix for the SGMII restart-an bit not actually being self-clearing, which was reported by by Rasmus Villemoes. A closer investigation and testing the .remove and the .shutdown paths of the mxl-gsw1xx.c and lantiq_gswip.c drivers has revealed a couple of existing problems, which are also addressed in this series. ==================== Link: https://patch.msgid.link/cover.1765241054.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 7b103aaf0d564b83ee1d4bb532ee7ae36ed001ed Author: Daniel Golle Date: Tue Dec 9 01:29:34 2025 +0000 net: dsa: mxl-gsw1xx: manually clear RANEG bit Despite being documented as self-clearing, the RANEG bit sometimes remains set, preventing auto-negotiation from happening. Manually clear the RANEG bit after 10ms as advised by MaxLinear. In order to not hold RTNL during the 10ms of waiting schedule delayed work to take care of clearing the bit asynchronously, which is similar to the self-clearing behavior. Fixes: 22335939ec90 ("net: dsa: add driver for MaxLinear GSW1xx switch family") Reported-by: Rasmus Villemoes Signed-off-by: Daniel Golle Link: https://patch.msgid.link/76745fceb5a3f53088110fb7a96acf88434088ca.1765241054.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 651b253b80379b0eb3669405fcf50d4039dc7a0e Author: Daniel Golle Date: Tue Dec 9 01:29:05 2025 +0000 net: dsa: mxl-gsw1xx: fix .shutdown driver operation The .shutdown operation should call dsa_switch_shutdown() just like it is done also by the sibling lantiq_gswip driver. Not doing that results in shutdown or reboot hanging and waiting for the CPU port becoming free, which introduces a longer delay and a WARNING before shutdown or reboot in case the driver is built-into the kernel. Fix this by calling dsa_switch_shutdown() in the driver's shutdown operation, harmonizing it with what is done in the lantiq_gswip driver. As a side-effect this now allows to remove the previously exported gswip_disable_switch() function which no longer got any users. Fixes: 22335939ec907 ("net: dsa: add driver for MaxLinear GSW1xx switch family") Signed-off-by: Daniel Golle Link: https://patch.msgid.link/77ed91a5206e5dbf5d3e83d7e364ebfda90d31fd.1765241054.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 8e4c0f08f6bedeb885515c5ec5a6388a45d768ec Author: Daniel Golle Date: Tue Dec 9 01:28:49 2025 +0000 net: dsa: mxl-gsw1xx: fix order in .remove operation The driver's .remove operation was calling gswip_disable_switch() which clears the GSWIP_MDIO_GLOB_ENABLE bit before calling dsa_unregister_switch() and thereby violating a Golden Rule of driver development to always unpublish userspace interfaces before disabling hardware, as pointed out by Russell King. Fix this by relying in GSWIP_MDIO_GLOB_ENABLE being cleared by the .teardown operation introduced by the previous commit ("net: dsa: lantiq_gswip: fix teardown order"). Fixes: 22335939ec907 ("net: dsa: add driver for MaxLinear GSW1xx switch family") Suggested-by: "Russell King (Oracle)" Signed-off-by: Daniel Golle Link: https://patch.msgid.link/63f882eeb910cf24503c35a443b541cc54a930f2.1765241054.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 377d66fa86654085be1f48906c1d88b7ca721c78 Author: Daniel Golle Date: Tue Dec 9 01:28:20 2025 +0000 net: dsa: lantiq_gswip: fix order in .remove operation Russell King pointed out that disabling the switch by clearing GSWIP_MDIO_GLOB_ENABLE before calling dsa_unregister_switch() is problematic, as it violates a Golden Rule of driver development to always first unpublish userspace interfaces and then disable the hardware. Fix this, and also simplify the probe() function, by introducing a dsa_switch_ops teardown() operation which takes care of clearing the GSWIP_MDIO_GLOB_ENABLE bit. Fixes: 14fceff4771e5 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Suggested-by: "Russell King (Oracle)" Signed-off-by: Daniel Golle Link: https://patch.msgid.link/4ebd72a29edc1e4059b9666a26a0bb5d906a829a.1765241054.git.daniel@makrotopia.org Reviewed-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 7b07be1ff1cb6c49869910518650e8d0abc7d25f Author: Gal Pressman Date: Mon Dec 8 14:19:01 2025 +0200 ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTOOL_GSTATS for the values. If the number of stats changes between these calls (e.g., due to device reconfiguration), userspace's buffer allocation will be incorrect, potentially leading to buffer overflow. Drivers are generally expected to maintain stable stat counts, but some drivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making this scenario possible. Some drivers try to handle this internally: - bnad_get_ethtool_stats() returns early in case stats.n_stats is not equal to the driver's stats count. - micrel/ksz884x also makes sure not to write anything beyond stats.n_stats and overflow the buffer. However, both use stats.n_stats which is already assigned with the value returned from get_sset_count(), hence won't solve the issue described here. Change ethtool_get_strings(), ethtool_get_stats(), ethtool_get_phy_stats() to not return anything in case of a mismatch between userspace's size and get_sset_size(), to prevent buffer overflow. The returned n_stats value will be equal to zero, to reflect that nothing has been returned. This could result in one of two cases when using upstream ethtool, depending on when the size change is detected: 1. When detected in ethtool_get_strings(): # ethtool -S eth2 no stats available 2. When detected in get stats, all stats will be reported as zero. Both cases are presumably transient, and a subsequent ethtool call should succeed. Other than the overflow avoidance, these two cases are very evident (no output/cleared stats), which is arguably better than presenting incorrect/shifted stats. I also considered returning an error instead of a "silent" response, but that seems more destructive towards userspace apps. Notes: - This patch does not claim to fix the inherent race, it only makes sure that we do not overflow the userspace buffer, and makes for a more predictable behavior. - RTNL lock is held during each ioctl, the race window exists between the separate ioctl calls when the lock is released. - Userspace ethtool always fills stats.n_stats, but it is likely that these stats ioctls are implemented in other userspace applications which might not fill it. The added code checks that it's not zero, to prevent any regressions. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20251208121901.3203692-1-gal@nvidia.com Signed-off-by: Paolo Abeni commit c56a12c71ad38f381105f6e5036dede64ad2dfee Author: Peter Zijlstra Date: Thu Dec 18 11:47:38 2025 +0100 x86/bug: Fix old GCC compile fails For some mysterious reasons the GCC 8 and 9 preprocessor manages to sporadically fumble _ASM_BYTES(0x0f, 0x0b): $ grep ".byte[ ]*0x0f" defconfig-build/drivers/net/wireless/realtek/rtlwifi/base.s 1: .byte0x0f,0x0b ; 1: .byte 0x0f,0x0b ; which makes the assembler upset and all that. While there are more _ASM_BYTES() users (notably the NOP instructions), those don't seem affected. Therefore replace the offending ASM_UD2 with one using the ud2 mnemonic. Reported-by: Jean Delvare Suggested-by: Uros Bizjak Fixes: 85a2d4a890dc ("x86,ibt: Use UDB instead of 0xEA") Cc: stable@kernel.org Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251218104659.GT3911114@noisy.programming.kicks-ass.net commit 7a089c5d35aa307147e78c5cbeeb1352b92790b1 Author: Jason Gunthorpe Date: Wed Dec 17 13:43:04 2025 -0400 iommupt: Return ERR_PTR from _table_alloc() syzkaller noticed that with fault injection a failure inside iommu_alloc_pages_node_sz() oops's in PT_FEAT_DMA_INCOHERENT because it goes on to make NULL incoherent. Closer inspection shows the return value has become confused, the alloc routines on the iommupt side expect ERR_PTR while iommu_alloc_pages_node_sz() returns NULL. Error out early to fix both issues. Fixes: aefd967dab64 ("iommupt: Use the incoherent start/stop functions for PT_FEAT_DMA_INCOHERENT") Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Fixes: cdb39d918579 ("iommupt: Add the basic structure of the iommu implementation") Reported-by: syzbot+e06bb7478e687f235ad7@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/693a39de.050a0220.4004e.02ce.GAE@google.com/ Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Joerg Roedel commit a05543d6b05ba998fdbb4b383319ae5121bb7407 Author: Bartosz Golaszewski Date: Wed Dec 10 06:50:26 2025 +0100 gpio: it87: balance superio enter/exit calls in error path We always call superio_enter() in it87_gpio_direction_out() but only call superio_exit() if the call to it87_gpio_set() succeeds. Move the label to balance the calls in error path as well. Fixes: ef877a159072 ("gpio: it87: use new line value setter callbacks") Reported-by: Daniel Gibson Closes: https://lore.kernel.org/all/bd0a00e3-9b8c-43e8-8772-e67b91f4c71e@gibson.sh/ Link: https://lore.kernel.org/r/20251210055026.23146-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 4a824c3128998158a093eaadd776a79abe3a601a Author: Eric Dumazet Date: Thu Dec 4 15:31:27 2025 +0000 entry: Always inline local_irq_{enable,disable}_exit_to_user() clang needs __always_inline instead of inline, even for tiny helpers. This saves some cycles in system call fast path, and saves 195 bytes on x86_64 build: $ size vmlinux.before vmlinux.after text data bss dec hex filename 34652814 22291961 5875180 62819955 3be8e73 vmlinux.before 34652619 22291961 5875180 62819760 3be8db0 vmlinux.after Signed-off-by: Eric Dumazet Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251204153127.1321824-1-edumazet@google.com commit 9d651a6c62832ac8d1c445f5fa8c61a03ebfb649 Merge: 8c04b77f87e6e3 1889dd2081975c Author: Mark Brown Date: Thu Dec 18 08:34:00 2025 +0000 spi: cadence-quadspi: Fix probe error path and logging Merge series from Anurag Dutta : This series addresses issues in the cadence-quadspi driver's probe error path: Patch 1 fixes a clock disable imbalance that occurs when probe fails after runtime PM is enabled, particularly when DMA request returns -EPROBE_DEFER. Patch 2 adds proper error logging for DMA request failures using dev_err_probe() to improve diagnostics and handle probe deferral appropriately. logs : https://gist.github.com/anuragdutta731/59925cd11a50913b7128c88cd5394db7 commit 5a5aff6338c0f4164a6a8d8a7eb400c4054df256 Author: Marc Kleine-Budde Date: Wed Dec 17 10:45:53 2025 +0100 can: fix build dependency Arnd Bergmann's patch [1] fixed the build dependency problem introduced by bugfix commit cb2dc6d2869a ("can: Kconfig: select CAN driver infrastructure by default"). This ended up as commit 6abd4577bccc ("can: fix build dependency"), but I broke Arnd's fix by removing a dependency that we thought was superfluous. [1] https://lore.kernel.org/all/20251204100015.1033688-1-arnd@kernel.org/ Meanwhile the problem was also found by intel's kernel test robot, complaining about undefined symbols: | ERROR: modpost: "m_can_class_unregister" [drivers/net/can/m_can/m_can_platform.ko] undefined! | ERROR: modpost: "m_can_class_free_dev" [drivers/net/can/m_can/m_can_platform.ko] undefined! | ERROR: modpost: "m_can_class_allocate_dev" [drivers/net/can/m_can/m_can_platform.ko] undefined! | ERROR: modpost: "m_can_class_get_clocks" [drivers/net/can/m_can/m_can_platform.ko] undefined! | ERROR: modpost: "m_can_class_register" [drivers/net/can/m_can/m_can_platform.ko] undefined! To fix this problem, add the missing dependency again. Cc: Vincent Mailhol Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512132253.vO9WFDJK-lkp@intel.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512180808.fTAUQ2XN-lkp@intel.com/ Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/all/7427949a-ea7d-4854-9fe4-e01db7d878c7@app.fastmail.com/ Fixes: 6abd4577bccc ("can: fix build dependency") Fixes: cb2dc6d2869a ("can: Kconfig: select CAN driver infrastructure by default") Acked-by: Vincent Mailhol Link: https://patch.msgid.link/20251217-can-fix-dependency-v1-1-fd2d4f2a2bf5@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 46eb784f3e9a815e653928a4b2ed90ab0e83d2ae Merge: 8f0b4cce4481fb 969faea4e9d017 Author: Dave Airlie Date: Thu Dec 18 14:17:05 2025 +1000 Merge tag 'amd-drm-fixes-6.19-2025-12-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.19-2025-12-17: amdgpu: - Fix no_console_suspend handling - DCN 3.5.x seamless boot fixes - DP audio fix - Fix race in GPU recovery - SMU 14 OD fix amdkfd: - Event fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251217171821.2033671-1-alexander.deucher@amd.com commit c258f5c4502c9667bccf5d76fa731ab9c96687c1 Author: Ming Lei Date: Fri Dec 12 22:34:15 2025 +0800 ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. The process issues read I/O to ublk backend to read partition table 3. In __ublk_complete_rq(), blk_update_request() or blk_mq_end_request() runs bio->bi_end_io() callbacks 4. If this triggers fput() on file descriptor of ublk block device, the work may be deferred to current task's task work (see fput() implementation) 5. This eventually calls blkdev_release() from the same context 6. blkdev_release() tries to grab disk->open_mutex again 7. Deadlock: same task waiting for a mutex it already holds The fix is to run blk_update_request() and blk_mq_end_request() with bottom halves disabled. This forces blkdev_release() to run in kernel work-queue context instead of current task work context, and allows ublk server to make forward progress, and avoids the deadlock. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Link: https://github.com/ublk-org/ublksrv/issues/170 [1] Signed-off-by: Ming Lei Reviewed-by: Caleb Sander Mateos [axboe: rewrite comment in ublk] Signed-off-by: Jens Axboe commit 39263f986da55c5b7bc328c757fe378a6a41799d Author: Menglong Dong Date: Wed Dec 17 11:00:53 2025 +0800 ftrace: Fix address for jmp mode in t_show() The address from ftrace_find_rec_direct() is printed directly in t_show(). This can mislead symbol offsets if it has the "jmp" bit in the last bit. Fix this by printing the address that returned by ftrace_jmp_get(). Link: https://patch.msgid.link/20251217030053.80343-1-dongml2@chinatelecom.cn Fixes: 25e4e3565d45 ("ftrace: Introduce FTRACE_OPS_FL_JMP") Signed-off-by: Menglong Dong Signed-off-by: Steven Rostedt (Google) commit 74bf97e9a8b6443ba2119dc884940e9364c91bde Author: Darrick J. Wong Date: Tue Dec 16 09:49:50 2025 -0800 tracing: Fix UBSAN warning in __remove_instance() xfs/558 triggers the following UBSAN warning: ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in kernel/trace/trace.c:10510:10 shift exponent 32 is too large for 32-bit type 'int' CPU: 1 UID: 0 PID: 888674 Comm: rmdir Not tainted 6.19.0-rc1-xfsx #rc1 PREEMPT(lazy) dbf607ef4c142c563f76d706e71af9731d7b9c90 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 Call Trace: dump_stack_lvl+0x4a/0x70 ubsan_epilogue+0x5/0x2b __ubsan_handle_shift_out_of_bounds.cold+0x5e/0x113 __remove_instance.part.0.constprop.0.cold+0x18/0x26f instance_rmdir+0xf3/0x110 tracefs_syscall_rmdir+0x4d/0x90 vfs_rmdir+0x139/0x230 do_rmdir+0x143/0x230 __x64_sys_rmdir+0x1d/0x20 do_syscall_64+0x44/0x230 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f7ae8e51f17 Code: f0 ff ff 73 01 c3 48 8b 0d de 2e 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 b1 2e 0e 00 f7 d8 64 89 02 b8 RSP: 002b:00007ffd90743f08 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007ffd907440f8 RCX: 00007f7ae8e51f17 RDX: 00007f7ae8f3c5c0 RSI: 00007ffd90744a21 RDI: 00007ffd90744a21 RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 00007f7ae8f35ac0 R11: 0000000000000246 R12: 00007ffd90744a21 R13: 0000000000000001 R14: 00007f7ae8f8b000 R15: 000055e5283e6a98 ---[ end trace ]--- whilst tearing down an ftrace instance. TRACE_FLAGS_MAX_SIZE is now 64bit, so the mask comparison expression must be typecast to a u64 value to avoid an overflow. AFAICT, ZEROED_TRACE_FLAGS is already cast to ULL so this is ok. Link: https://patch.msgid.link/20251216174950.GA7705@frogsfrogsfrogs Fixes: bbec8e28cac592 ("tracing: Allow tracer to add more than 32 options") Signed-off-by: "Darrick J. Wong" Signed-off-by: Steven Rostedt (Google) commit ef7f38df890f5dcd2ae62f8dbde191d72f3bebae Author: Steven Rostedt Date: Tue Dec 16 18:24:40 2025 -0500 tracing: Do not register unsupported perf events Synthetic events currently do not have a function to register perf events. This leads to calling the tracepoint register functions with a NULL function pointer which triggers: ------------[ cut here ]------------ WARNING: kernel/tracepoint.c:175 at tracepoint_add_func+0x357/0x370, CPU#2: perf/2272 Modules linked in: kvm_intel kvm irqbypass CPU: 2 UID: 0 PID: 2272 Comm: perf Not tainted 6.18.0-ftest-11964-ge022764176fc-dirty #323 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:tracepoint_add_func+0x357/0x370 Code: 28 9c e8 4c 0b f5 ff eb 0f 4c 89 f7 48 c7 c6 80 4d 28 9c e8 ab 89 f4 ff 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc <0f> 0b 49 c7 c6 ea ff ff ff e9 ee fe ff ff 0f 0b e9 f9 fe ff ff 0f RSP: 0018:ffffabc0c44d3c40 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff9380aa9e4060 RCX: 0000000000000000 RDX: 000000000000000a RSI: ffffffff9e1d4a98 RDI: ffff937fcf5fd6c8 RBP: 0000000000000001 R08: 0000000000000007 R09: ffff937fcf5fc780 R10: 0000000000000003 R11: ffffffff9c193910 R12: 000000000000000a R13: ffffffff9e1e5888 R14: 0000000000000000 R15: ffffabc0c44d3c78 FS: 00007f6202f5f340(0000) GS:ffff93819f00f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d3162281a8 CR3: 0000000106a56003 CR4: 0000000000172ef0 Call Trace: tracepoint_probe_register+0x5d/0x90 synth_event_reg+0x3c/0x60 perf_trace_event_init+0x204/0x340 perf_trace_init+0x85/0xd0 perf_tp_event_init+0x2e/0x50 perf_try_init_event+0x6f/0x230 ? perf_event_alloc+0x4bb/0xdc0 perf_event_alloc+0x65a/0xdc0 __se_sys_perf_event_open+0x290/0x9f0 do_syscall_64+0x93/0x7b0 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e ? trace_hardirqs_off+0x53/0xc0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Instead, have the code return -ENODEV, which doesn't warn and has perf error out with: # perf record -e synthetic:futex_wait Error: The sys_perf_event_open() syscall returned with 19 (No such device) for event (synthetic:futex_wait). "dmesg | grep -i perf" may provide additional information. Ideally perf should support synthetic events, but for now just fix the warning. The support can come later. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Namhyung Kim Link: https://patch.msgid.link/20251216182440.147e4453@gandalf.local.home Fixes: 4b147936fa509 ("tracing: Add support for 'synthetic' events") Reported-by: Ian Rogers Signed-off-by: Steven Rostedt (Google) commit 09879758d8ac345d7f08709bfcd2fbe29e96cae4 Author: Lukas Bulwahn Date: Wed Nov 5 10:24:28 2025 +0100 MAINTAINERS: add tracepoint core-api doc files to TRACING The files in Documentation/core-api/ are by virtue of their top-level directory part of the Documentation section in MAINTAINERS. Each file in Documentation/core-api/ should however also have a further section in MAINTAINERS it belongs to, which fits to the technical area of the documented API in that file. The tracepoint.rst provides some explanation to tracepoints defined in selected files under include/trace/events/, which itself is part of the TRACING section. So, add this core-api document to TRACING. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251105092428.153378-1-lukas.bulwahn@redhat.com Signed-off-by: Lukas Bulwahn Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f7cede182c963720edd1e5fb50ea4f1c7eafa30e Author: Antheas Kapenekakis Date: Tue Dec 16 22:17:14 2025 +0100 ALSA: hda/realtek: Add Asus quirk for TAS amplifiers By default, these devices use the quirk ALC294_FIXUP_ASUS_SPK. Not using it causes the headphone jack to stop working. Therefore, introduce a new quirk ALC287_FIXUP_TXNW2781_I2C_ASUS that binds to the TAS amplifier while using that quirk. Cc: stable@kernel.org Fixes: 18a4895370a7 ("ALSA: hda/realtek: Add match for ASUS Xbox Ally projects") Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251216211714.1116898-1-lkml@antheas.dev Signed-off-by: Takashi Iwai commit 9c72a5182ed92904d01057f208c390a303f00a0f Author: Guangshuo Li Date: Mon Dec 1 11:40:58 2025 +0800 e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ================================================================== BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 Read of size 1 at addr ffff888014114e54 by task sshd/363 CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5a/0x74 print_address_description+0x7b/0x440 print_report+0x101/0x200 kasan_report+0xc1/0xf0 e1000_tbi_should_accept+0x610/0x790 e1000_clean_rx_irq+0xa8c/0x1110 e1000_clean+0xde2/0x3c10 __napi_poll+0x98/0x380 net_rx_action+0x491/0xa20 __do_softirq+0x2c9/0x61d do_softirq+0xd1/0x120 __local_bh_enable_ip+0xfe/0x130 ip_finish_output2+0x7d5/0xb00 __ip_queue_xmit+0xe24/0x1ab0 __tcp_transmit_skb+0x1bcb/0x3340 tcp_write_xmit+0x175d/0x6bd0 __tcp_push_pending_frames+0x7b/0x280 tcp_sendmsg_locked+0x2e4f/0x32d0 tcp_sendmsg+0x24/0x40 sock_write_iter+0x322/0x430 vfs_write+0x56c/0xa60 ksys_write+0xd1/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f511b476b10 Code: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24 RSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10 RDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003 RBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00 R10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003 Allocated by task 1: __kasan_krealloc+0x131/0x1c0 krealloc+0x90/0xc0 add_sysfs_param+0xcb/0x8a0 kernel_add_sysfs_param+0x81/0xd4 param_sysfs_builtin+0x138/0x1a6 param_sysfs_init+0x57/0x5b do_one_initcall+0x104/0x250 do_initcall_level+0x102/0x132 do_initcalls+0x46/0x74 kernel_init_freeable+0x28f/0x393 kernel_init+0x14/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888014114000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1620 bytes to the right of 2048-byte region [ffff888014114000, ffff888014114800] The buggy address belongs to the physical page: page:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110 head:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x100000000010200(slab|head|node=0|zone=1) raw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000 raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected ================================================================== This happens because the TBI check unconditionally dereferences the last byte without validating the reported length first: u8 last_byte = *(data + length - 1); Fix by rejecting the frame early if the length is zero, or if it exceeds adapter->rx_buffer_len. This preserves the TBI workaround semantics for valid frames and prevents touching memory beyond the RX buffer. Fixes: 2037110c96d5 ("e1000: move tbi workaround code into helper function") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit b3d6bbae1d6d5638a4ab702ab195476787cde857 Author: Brian Vazquez Date: Mon Nov 10 20:58:37 2025 +0000 idpf: reduce mbx_task schedule delay to 300us During the IDPF init phase, the mailbox runs in poll mode until it is configured to properly handle interrupts. The previous delay of 300ms is excessively long for the mailbox polling mechanism, which causes a slow initialization of ~2s: echo 0000:06:12.4 > /sys/bus/pci/drivers/idpf/bind [ 52.444239] idpf 0000:06:12.4: enabling device (0000 -> 0002) [ 52.485005] idpf 0000:06:12.4: Device HW Reset initiated [ 54.177181] idpf 0000:06:12.4: PTP init failed, err=-EOPNOTSUPP [ 54.206177] idpf 0000:06:12.4: Minimum RX descriptor support not provided, using the default [ 54.206182] idpf 0000:06:12.4: Minimum TX descriptor support not provided, using the default Changing the delay to 300us avoids the delays during the initial mailbox transactions, making the init phase much faster: [ 83.342590] idpf 0000:06:12.4: enabling device (0000 -> 0002) [ 83.384402] idpf 0000:06:12.4: Device HW Reset initiated [ 83.518323] idpf 0000:06:12.4: PTP init failed, err=-EOPNOTSUPP [ 83.547430] idpf 0000:06:12.4: Minimum RX descriptor support not provided, using the default [ 83.547435] idpf 0000:06:12.4: Minimum TX descriptor support not provided, using the default Fixes: 4930fbf419a7 ("idpf: add core init and interrupt request") Signed-off-by: Brian Vazquez Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 4af1f9a47291f7d446398065e0d6eb4943f7e184 Author: Larysa Zaremba Date: Tue Oct 7 13:46:22 2025 +0200 idpf: fix LAN memory regions command on some NVMs IPU SDK versions 1.9 through 2.0.5 require send buffer to contain a single empty memory region. Set number of regions to 1 and use appropriate send buffer size to satisfy this requirement. Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions") Suggested-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Signed-off-by: Larysa Zaremba Tested-by: Krishneil Singh Signed-off-by: Tony Nguyen commit bf40644ef8c8a288742fa45580897ed0e0289474 Author: Duoming Zhou Date: Wed Dec 17 11:00:17 2025 +0800 Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis. Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data") Cc: stable@kernel.org Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.1765939397.git.duoming@zju.edu.cn Signed-off-by: Dmitry Torokhov commit 92c172ae16a2718aba0d8fec5a62fc1b8aa452dc Author: Arnd Bergmann Date: Tue Dec 16 22:36:12 2025 +0100 mshv: hide x86-specific functions on arm64 The hv_sleep_notifiers_register() and hv_machine_power_off() functions are only called and declared on x86, but cause a warning on arm64: drivers/hv/mshv_common.c:210:6: error: no previous prototype for 'hv_sleep_notifiers_register' [-Werror=missing-prototypes] 210 | void hv_sleep_notifiers_register(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/hv/mshv_common.c:224:6: error: no previous prototype for 'hv_machine_power_off' [-Werror=missing-prototypes] 224 | void hv_machine_power_off(void) | ^~~~~~~~~~~~~~~~~~~~ Hide both inside of an #ifdef block. Fixes: f0be2600ac55 ("mshv: Use reboot notifier to configure sleep state") Fixes: 615a6e7d83f9 ("mshv: Cleanly shutdown root partition with MSHV") Signed-off-by: Arnd Bergmann Signed-off-by: Wei Liu commit 85463eb6a46caf2f1e0e1a6d0731f2f3bab17780 Author: Michael Margolin Date: Wed Dec 10 17:36:56 2025 +0000 RDMA/efa: Remove possible negative shift The page size used for device might in some cases be smaller than PAGE_SIZE what results in a negative shift when calculating the number of host pages in PAGE_SIZE for a debug log. Remove the debug line together with the calculation. Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation") Link: https://patch.msgid.link/r/20251210173656.8180-1-mrgolin@amazon.com Reviewed-by: Tom Sela Reviewed-by: Yonatan Nachum Signed-off-by: Michael Margolin Reviewed-by: Gal Pressman Signed-off-by: Jason Gunthorpe commit c1776ccba661c946f2e42aaa11eda81e2cd764c5 Author: Randy Dunlap Date: Fri Nov 28 18:21:46 2025 -0800 RTRS/rtrs: clean up rtrs headers kernel-doc Fix all (30+) kernel-doc warnings in rtrs.h and rtrs-pri.h. The changes are: - add ending ':' to enum member names - change enum description separators from '-' to ':' - add "struct" keyword to kernel-doc for structs where missing - fix enum names in enum rtrs_clt_con_type - add a '-' separator and drop the "()" in enum rtrs_clt_con_type - convert struct rtrs_addr to kernel-doc format - add missing struct member descriptions for struct rtrs_attrs Link: https://patch.msgid.link/r/20251129022146.1498273-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Acked-by: Jack Wang Signed-off-by: Jason Gunthorpe commit 6f05611728e9d0ab024832a4f1abb74a5f5d0bb0 Author: Michal Schmidt Date: Thu Nov 27 15:31:50 2025 +0100 RDMA/irdma: avoid invalid read in irdma_net_event irdma_net_event() should not dereference anything from "neigh" (alias "ptr") until it has checked that the event is NETEVENT_NEIGH_UPDATE. Other events come with different structures pointed to by "ptr" and they may be smaller than struct neighbour. Move the read of neigh->dev under the NETEVENT_NEIGH_UPDATE case. The bug is mostly harmless, but it triggers KASAN on debug kernels: BUG: KASAN: stack-out-of-bounds in irdma_net_event+0x32e/0x3b0 [irdma] Read of size 8 at addr ffffc900075e07f0 by task kworker/27:2/542554 CPU: 27 PID: 542554 Comm: kworker/27:2 Kdump: loaded Not tainted 5.14.0-630.el9.x86_64+debug #1 Hardware name: [...] Workqueue: events rt6_probe_deferred Call Trace: dump_stack_lvl+0x60/0xb0 print_address_description.constprop.0+0x2c/0x3f0 print_report+0xb4/0x270 kasan_report+0x92/0xc0 irdma_net_event+0x32e/0x3b0 [irdma] notifier_call_chain+0x9e/0x180 atomic_notifier_call_chain+0x5c/0x110 rt6_do_redirect+0xb91/0x1080 tcp_v6_err+0xe9b/0x13e0 icmpv6_notify+0x2b2/0x630 ndisc_redirect_rcv+0x328/0x530 icmpv6_rcv+0xc16/0x1360 ip6_protocol_deliver_rcu+0xb84/0x12e0 ip6_input_finish+0x117/0x240 ip6_input+0xc4/0x370 ipv6_rcv+0x420/0x7d0 __netif_receive_skb_one_core+0x118/0x1b0 process_backlog+0xd1/0x5d0 __napi_poll.constprop.0+0xa3/0x440 net_rx_action+0x78a/0xba0 handle_softirqs+0x2d4/0x9c0 do_softirq+0xad/0xe0 Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") Link: https://patch.msgid.link/r/20251127143150.121099-1-mschmidt@redhat.com Signed-off-by: Michal Schmidt Signed-off-by: Jason Gunthorpe commit 887bfe5986396aca908b7afd2d214471ba7d5544 Author: Konstantin Taranov Date: Thu Oct 23 03:03:00 2025 -0700 RDMA/mana_ib: check cqe length for kernel CQs Check queue size during kernel CQ creation to prevent overflow of u32. Fixes: bec127e45d9f ("RDMA/mana_ib: create kernel-level CQs") Link: https://patch.msgid.link/r/1761213780-5457-1-git-send-email-kotaranov@linux.microsoft.com Signed-off-by: Konstantin Taranov Reviewed-by: Long Li Signed-off-by: Jason Gunthorpe commit 0edc78b82bea85e1b2165d8e870a5c3535919695 Author: Thomas Gleixner Date: Tue Nov 25 22:50:45 2025 +0100 x86/msi: Make irq_retrigger() functional for posted MSI Luigi reported that retriggering a posted MSI interrupt does not work correctly. The reason is that the retrigger happens at the vector domain by sending an IPI to the actual vector on the target CPU. That works correctly exactly once because the posted MSI interrupt chip does not issue an EOI as that's only required for the posted MSI notification vector itself. As a consequence the vector becomes stale in the ISR, which not only affects this vector but also any lower priority vector in the affected APIC because the ISR bit is not cleared. Luigi proposed to set the vector in the remap PIR bitmap and raise the posted MSI notification vector. That works, but that still does not cure a related problem: If there is ever a stray interrupt on such a vector, then the related APIC ISR bit becomes stale due to the lack of EOI as described above. Unlikely to happen, but if it happens it's not debuggable at all. So instead of playing games with the PIR, this can be actually solved for both cases by: 1) Keeping track of the posted interrupt vector handler state 2) Implementing a posted MSI specific irq_ack() callback which checks that state. If the posted vector handler is inactive it issues an EOI, otherwise it delegates that to the posted handler. This is correct versus affinity changes and concurrent events on the posted vector as the actual handler invocation is serialized through the interrupt descriptor lock. Fixes: ed1e48ea4370 ("iommu/vt-d: Enable posted mode for device MSIs") Reported-by: Luigi Rizzo Signed-off-by: Thomas Gleixner Tested-by: Luigi Rizzo Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251125214631.044440658@linutronix.de Closes: https://lore.kernel.org/lkml/20251124104836.3685533-1-lrizzo@google.com commit 6daa2893f323981c7894c68440823326e93a7d61 Author: Kohei Enju Date: Sun Oct 26 01:58:50 2025 +0900 iavf: fix off-by-one issues in iavf_config_rss_reg() There are off-by-one bugs when configuring RSS hash key and lookup table, causing out-of-bounds reads to memory [1] and out-of-bounds writes to device registers. Before commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"), the loop upper bounds were: i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX which is safe since the value is the last valid index. That commit changed the bounds to: i <= adapter->rss_{key,lut}_size / 4 where `rss_{key,lut}_size / 4` is the number of dwords, so the last valid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `<=` accesses one element past the end. Fix the issues by using `<` instead of `<=`, ensuring we do not exceed the bounds. [1] KASAN splat about rss_key_size off-by-one BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800 Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63 CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: iavf iavf_watchdog_task Call Trace: dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x1a0 iavf_config_rss+0x619/0x800 iavf_watchdog_task+0x2be7/0x3230 process_one_work+0x7fd/0x1420 worker_thread+0x4d1/0xd40 kthread+0x344/0x660 ret_from_fork+0x249/0x320 ret_from_fork_asm+0x1a/0x30 Allocated by task 63: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x246/0x6f0 iavf_watchdog_task+0x28fc/0x3230 process_one_work+0x7fd/0x1420 worker_thread+0x4d1/0xd40 kthread+0x344/0x660 ret_from_fork+0x249/0x320 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff888102c50100 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes to the right of allocated 52-byte region [ffff888102c50100, ffff888102c50134) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50 flags: 0x200000000000000(node=0|zone=2) page_type: f5(slab) raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc >ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc ^ ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS") Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 69942834215323cd9131db557091b4dec43f19c5 Author: Gregory Herrero Date: Fri Dec 12 22:06:43 2025 +0100 i40e: validate ring_len parameter against hardware-specific values The maximum number of descriptors supported by the hardware is hardware-dependent and can be retrieved using i40e_get_max_num_descriptors(). Move this function to a shared header and use it when checking for valid ring_len parameter rather than using hardcoded value. By fixing an over-acceptance issue, behavior change could be seen where ring_len could now be rejected while configuring rx and tx queues if its size is larger than the hardware-dependent maximum number of descriptors. Fixes: 55d225670def ("i40e: add validation for ring_len param") Signed-off-by: Gregory Herrero Tested-by: Rafal Romanowski Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit be43abc5514167cc129a8d8e9727b89b8e1d9719 Author: Przemyslaw Korba Date: Thu Nov 20 13:07:28 2025 +0100 i40e: fix scheduling in set_rx_mode Add service task schedule to set_rx_mode. In some cases there are error messages printed out in PTP application (ptp4l): ptp4l[13848.762]: port 1 (ens2f3np3): received SYNC without timestamp ptp4l[13848.825]: port 1 (ens2f3np3): received SYNC without timestamp ptp4l[13848.887]: port 1 (ens2f3np3): received SYNC without timestamp This happens when service task would not run immediately after set_rx_mode, and we need it for setup tasks. This service task checks, if PTP RX packets are hung in firmware, and propagate correct settings such as multicast address for IEEE 1588 Precision Time Protocol. RX timestamping depends on some of these filters set. Bug happens only with high PTP packets frequency incoming, and not every run since sometimes service task is being ran from a different place immediately after starting ptp4l. Fixes: 0e4425ed641f ("i40e: fix: do not sleep in netdev_ops") Reviewed-by: Grzegorz Nitka Reviewed-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemyslaw Korba Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e2f1081ca8f18c146e8f928486deac61eca2b517 Author: Marko Turk Date: Wed Dec 10 12:25:51 2025 +0100 samples: rust: fix endianness issue in rust_driver_pci MMIO backend of PCI Bar always assumes little-endian devices and will convert to CPU endianness automatically. Remove the u32::from_le conversion which would cause a bug on big-endian machines. Cc: stable@vger.kernel.org Reviewed-by: Dirk Behme Signed-off-by: Marko Turk Fixes: 685376d18e9a ("samples: rust: add Rust PCI sample driver") Link: https://patch.msgid.link/20251210112503.62925-2-mt@markoturk.info Signed-off-by: Danilo Krummrich commit 26f637fa08879152b9c82417d0d4096019b386ff Author: Stefan Binding Date: Wed Dec 17 16:32:27 2025 +0000 ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L63 with feedback Add match for 6x CS35L63, 3x on link 2 and 3x on link 3. This is to support 6 amps on the CDB35L63-CB8 board. Signed-off-by: Stefan Binding Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251217163227.1186373-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit e43aefb771e82f2e13a435c37ef55813f4140f93 Author: Stefan Binding Date: Wed Dec 17 16:32:26 2025 +0000 ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L56 with feedback Add a match for 6x CS35L56, 3x on link 0 and 3x on link 1. To support the CDB35L56-EIGHT-C board using 6 amps. This is the same as the existing 8-amp configuration mtl_cs35l56_x8_link0_link1_fb, but reduced to 6 amps. Signed-off-by: Stefan Binding Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251217163227.1186373-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit dcd0b625fe440d68bb4b97c71d18ca48ecd6e594 Author: Srinivas Pandruvada Date: Wed Dec 17 07:34:55 2025 -0800 powercap: intel_rapl: Fix possible recursive lock warning With the RAPL PMU addition, there is a recursive locking when CPU online callback function calls rapl_package_add_pmu(). Here cpu_hotplug_lock is already acquired by cpuhp_thread_fun() and rapl_package_add_pmu() tries to acquire again. <4>[ 8.197433] ============================================ <4>[ 8.197437] WARNING: possible recursive locking detected <4>[ 8.197440] 6.19.0-rc1-lgci-xe-xe-4242-05b7c58b3367dca84+ #1 Not tainted <4>[ 8.197444] -------------------------------------------- <4>[ 8.197447] cpuhp/0/20 is trying to acquire lock: <4>[ 8.197450] ffffffff83487870 (cpu_hotplug_lock){++++}-{0:0}, at: rapl_package_add_pmu+0x37/0x370 [intel_rapl_common] <4>[ 8.197463] but task is already holding lock: <4>[ 8.197466] ffffffff83487870 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x6d/0x290 <4>[ 8.197477] other info that might help us debug this: <4>[ 8.197480] Possible unsafe locking scenario: <4>[ 8.197483] CPU0 <4>[ 8.197485] ---- <4>[ 8.197487] lock(cpu_hotplug_lock); <4>[ 8.197490] lock(cpu_hotplug_lock); <4>[ 8.197493] *** DEADLOCK *** .. .. <4>[ 8.197542] __lock_acquire+0x146e/0x2790 <4>[ 8.197548] lock_acquire+0xc4/0x2c0 <4>[ 8.197550] ? rapl_package_add_pmu+0x37/0x370 [intel_rapl_common] <4>[ 8.197556] cpus_read_lock+0x41/0x110 <4>[ 8.197558] ? rapl_package_add_pmu+0x37/0x370 [intel_rapl_common] <4>[ 8.197561] rapl_package_add_pmu+0x37/0x370 [intel_rapl_common] <4>[ 8.197565] rapl_cpu_online+0x85/0x87 [intel_rapl_msr] <4>[ 8.197568] ? __pfx_rapl_cpu_online+0x10/0x10 [intel_rapl_msr] <4>[ 8.197570] cpuhp_invoke_callback+0x41f/0x6c0 <4>[ 8.197573] ? cpuhp_thread_fun+0x6d/0x290 <4>[ 8.197575] cpuhp_thread_fun+0x1e2/0x290 <4>[ 8.197578] ? smpboot_thread_fn+0x26/0x290 <4>[ 8.197581] smpboot_thread_fn+0x12f/0x290 <4>[ 8.197584] ? __pfx_smpboot_thread_fn+0x10/0x10 <4>[ 8.197586] kthread+0x11f/0x250 <4>[ 8.197589] ? __pfx_kthread+0x10/0x10 <4>[ 8.197592] ret_from_fork+0x344/0x3a0 <4>[ 8.197595] ? __pfx_kthread+0x10/0x10 <4>[ 8.197597] ret_from_fork_asm+0x1a/0x30 <4>[ 8.197604] Fix this issue in the same way as rapl powercap package domain is added from the same CPU online callback by introducing another interface which doesn't call cpus_read_lock(). Add rapl_package_add_pmu_locked() and rapl_package_remove_pmu_locked() which don't call cpus_read_lock(). Fixes: 748d6ba43afd ("powercap: intel_rapl: Enable MSR-based RAPL PMU support") Reported-by: Borah, Chaitanya Kumar Closes: https://lore.kernel.org/linux-pm/5427ede1-57a0-43d1-99f3-8ca4b0643e82@intel.com/T/#u Tested-by: Kuppuswamy Sathyanarayanan Tested-by: RavitejaX Veesam Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251217153455.3560176-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 5c5f6fe32df2edb4f72bdca62ec2b9f20b7c5ba4 Author: Ian Rogers Date: Sat Dec 6 18:23:45 2025 -0800 perf symbol: Fix ENOENT case for filename__read_build_id Some callers of filename__read_build_id assume the error value must be -1, fix by making them handle all < 0 values. If is_regular_file fails in filename__read_build_id then it could be the file is missing (ENOENT) and it would be wrong to return -EWOULDBLOCK in that case. Fix the logic so -EWOULDBLOCK is only reported if other errors with stat haven't occurred. Fixes: 834ebb5678d7 ("perf tools: Don't read build-ids from non-regular files") Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 114ea9bbaf7681c4d363e13b7916e6fef6a4963a Author: huang-jl Date: Wed Dec 17 14:26:32 2025 +0800 io_uring: fix nr_segs calculation in io_import_kbuf io_import_kbuf() calculates nr_segs incorrectly when iov_offset is non-zero after iov_iter_advance(). It doesn't account for the partial consumption of the first bvec. The problem comes when meet the following conditions: 1. Use UBLK_F_AUTO_BUF_REG feature of ublk. 2. The kernel will help to register the buffer, into the io uring. 3. Later, the ublk server try to send IO request using the registered buffer in the io uring, to read/write to fuse-based filesystem, with O_DIRECT. >From a userspace perspective, the ublk server thread is blocked in the kernel, and will see "soft lockup" in the kernel dmesg. When ublk registers a buffer with mixed-size bvecs like [4K]*6 + [12K] and a request partially consumes a bvec, the next request's nr_segs calculation uses bvec->bv_len instead of (bv_len - iov_offset). This causes fuse_get_user_pages() to loop forever because nr_segs indicates fewer pages than actually needed. Specifically, the infinite loop happens at: fuse_get_user_pages() -> iov_iter_extract_pages() -> iov_iter_extract_bvec_pages() Since the nr_segs is miscalculated, the iov_iter_extract_bvec_pages returns when finding that i->nr_segs is zero. Then iov_iter_extract_pages returns zero. However, fuse_get_user_pages does still not get enough data/pages, causing infinite loop. Example: - Bvecs: [4K, 4K, 4K, 4K, 4K, 4K, 12K, ...] - Request 1: 32K at offset 0, uses 6*4K + 8K of the 12K bvec - Request 2: 32K at offset 32K - iov_offset = 8K (8K already consumed from 12K bvec) - Bug: calculates using 12K, not (12K - 8K) = 4K - Result: nr_segs too small, infinite loop in fuse_get_user_pages. Fix by accounting for iov_offset when calculating the first segment's available length. Fixes: b419bed4f0a6 ("io_uring/rsrc: ensure segments counts are correct on kbuf buffers") Signed-off-by: huang-jl Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit a58383fa45c706bda3bf4a1955c3a0327dbec7e7 Author: Deepanshu Kartikey Date: Wed Dec 17 07:17:12 2025 +0530 block: add allocation size check in blkdev_pr_read_keys() blkdev_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for keys_info via struct_size(). While there is a check for SIZE_MAX (integer overflow), there is no upper bound validation on the allocation size itself. A malicious or buggy userspace can pass a large num_keys value that doesn't trigger overflow but still results in an excessive allocation attempt, causing a warning in the page allocator when the order exceeds MAX_PAGE_ORDER. Fix this by introducing PR_KEYS_MAX to limit the number of keys to a sane value. This makes the SIZE_MAX check redundant, so remove it. Also switch to kvzalloc/kvfree to handle larger allocations gracefully. Fixes: 22a1ffea5f80 ("block: add IOC_PR_READ_KEYS ioctl") Tested-by: syzbot+660d079d90f8a1baf54d@syzkaller.appspotmail.com Reported-by: syzbot+660d079d90f8a1baf54d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=660d079d90f8a1baf54d Link: https://lore.kernel.org/all/20251212013510.3576091-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey Reviewed-by: Martin K. Petersen Reviewed-by: Stefan Hajnoczi Signed-off-by: Jens Axboe commit 5edb7338d6117bb0ce17ead7973c67390da42258 Author: Dan Carpenter Date: Sat Nov 29 17:51:23 2025 +0300 serial: 8250: longson: Fix NULL vs IS_ERR() bug in probe The devm_platform_get_and_ioremap_resource() function never returns NULL, it returns error pointers. Fix the error checking to match. Fixes: 25e95d763176 ("serial: 8250: Add Loongson uart driver support") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSsIa3KdAlXh5uQC@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit 24ec03cc55126b7b3adf102f4b3d9f716532b329 Author: Andy Shevchenko Date: Thu Nov 27 17:36:50 2025 +0100 serial: core: Restore sysfs fwnode information The change that restores sysfs fwnode information does it only for OF cases. Update the fix to cover all possible types of fwnodes. Fixes: d36f0e9a0002 ("serial: core: restore of_node information in sysfs") Cc: stable Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251127163650.2942075-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3b4961313d31e200c9e974bb1536cdea217f78b5 Author: Miaoqian Lin Date: Thu Dec 11 10:49:36 2025 +0400 usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe When clk_bulk_prepare_enable() fails, the error path jumps to err_resetc_assert, skipping clk_bulk_put_all() and leaking the clock references acquired by clk_bulk_get_all(). Add err_clk_put_all label to properly release clock resources in all error paths. Found via static analysis and code review. Fixes: c0c61471ef86 ("usb: dwc3: of-simple: Convert to bulk clk API") Cc: stable Signed-off-by: Miaoqian Lin Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251211064937.2360510-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 14ad4c10d5bdd413ff9a914260e89b5f54b7a2c7 Author: Mario Limonciello (AMD) Date: Tue Dec 16 06:22:02 2025 -0600 usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common Add missing null check for cci parameter before dereferencing it in ucsi_sync_control_common(). The function can be called with cci=NULL from ucsi_acknowledge(), which leads to a null pointer dereference when accessing *cci in the condition check. The crash occurs because the code checks if cci is not null before calling ucsi->ops->read_cci(ucsi, cci), but then immediately dereferences cci without a null check in the following condition: (*cci & UCSI_CCI_COMMAND_COMPLETE). KASAN trace: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ucsi_sync_control_common+0x2ae/0x4e0 [typec_ucsi] Cc: stable Fixes: 667ecac55861 ("usb: typec: ucsi: return CCI and message from sync_control callback") Reviewed-by: Heikki Krogerus Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251216122210.5457-1-superm1@kernel.org Signed-off-by: Greg Kroah-Hartman commit c84117912bddd9e5d87e68daf182410c98181407 Author: Ma Ke Date: Mon Dec 15 10:09:31 2025 +0800 USB: lpc32xx_udc: Fix error handling in probe lpc32xx_udc_probe() acquires an i2c_client reference through isp1301_get_client() but fails to release it in both error handling paths and the normal removal path. This could result in a reference count leak for the I2C device, preventing proper cleanup and potentially leading to resource exhaustion. Add put_device() to release the reference in the probe failure path and in the remove function. Calling path: isp1301_get_client() -> of_find_i2c_device_by_node() -> i2c_find_device_by_fwnode(). As comments of i2c_find_device_by_fwnode() says, 'The user must call put_device(&client->dev) once done with the i2c client.' Found by code review. Cc: stable Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx") Signed-off-by: Ma Ke Link: https://patch.msgid.link/20251215020931.15324-1-make24@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 128bb7fab342546352603bde8b49ff54e3af0529 Author: Haoxiang Li Date: Sat Dec 6 15:04:45 2025 +0800 usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() In error paths, call typec_altmode_put_plug() to drop the device reference obtained by typec_altmode_get_plug(). Fixes: 71ba4fe56656 ("usb: typec: altmodes/displayport: add SOP' support") Cc: stable Signed-off-by: Haoxiang Li Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20251206070445.190770-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 41ca62e3e21e48c2903b3b45e232cf4f2ff7434f Author: Duoming Zhou Date: Fri Dec 5 11:48:31 2025 +0800 usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2. When the USB ID pin state changes (cable insertion/removal). A race condition occurs when the device is removed via fsl_otg_remove(): the fsl_otg instance may be freed while the delayed work is still pending or executing. This leads to use-after-free when the work function fsl_otg_event() accesses the already freed memory. The problematic scenario: (detach thread) | (delayed work) fsl_otg_remove() | kfree(fsl_otg_dev) //FREE| fsl_otg_event() | og = container_of(...) //USE | og-> //USE Fix this by calling disable_delayed_work_sync() in fsl_otg_remove() before deallocating the fsl_otg structure. This ensures the delayed work is properly canceled and completes execution prior to memory deallocation. This bug was identified through static analysis. Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver") Cc: stable Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20251205034831.12846-1-duoming@zju.edu.cn Signed-off-by: Greg Kroah-Hartman commit 36cc7e09df9e43db21b46519b740145410dd9f4a Author: Haoxiang Li Date: Thu Dec 4 21:21:29 2025 +0800 usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() usbhsp_get_pipe() set pipe's flags to IS_USED. In error paths, usbhsp_put_pipe() is required to clear pipe's flags to prevent pipe exhaustion. Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code") Cc: stable Signed-off-by: Haoxiang Li Link: https://patch.msgid.link/20251204132129.109234-1-haoxiang_li2024@163.com Signed-off-by: Greg Kroah-Hartman commit d14cd998e67ba8f1cca52a260a1ce1a60954fd8b Author: Arnd Bergmann Date: Thu Dec 4 11:11:07 2025 +0100 usb: typec: ucsi: huawei-gaokin: add DRM dependency Selecting DRM_AUX_HPD_BRIDGE is not possible from a built-in driver when CONFIG_DRM=m: WARNING: unmet direct dependencies detected for DRM_AUX_HPD_BRIDGE Depends on [m]: HAS_IOMEM [=y] && DRM [=m] && DRM_BRIDGE [=y] && OF [=y] Selected by [y]: - UCSI_HUAWEI_GAOKUN [=y] && USB_SUPPORT [=y] && TYPEC [=y] && TYPEC_UCSI [=y] && EC_HUAWEI_GAOKUN [=y] && DRM_BRIDGE [=y] && OF [=y] Add the same dependency we have in similar drivers to work around this. Fixes: 00327d7f2c8c ("usb: typec: ucsi: add Huawei Matebook E Go ucsi driver") Cc: stable Signed-off-by: Arnd Bergmann Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20251204101111.1035975-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit e1003aa7ec9eccdde4c926bd64ef42816ad55f25 Author: Udipto Goswami Date: Wed Nov 26 11:12:21 2025 +0530 usb: dwc3: keep susphy enabled during exit to avoid controller faults On some platforms, switching USB roles from host to device can trigger controller faults due to premature PHY power-down. This occurs when the PHY is disabled too early during teardown, causing synchronization issues between the PHY and controller. Keep susphy enabled during dwc3_host_exit() and dwc3_gadget_exit() ensures the PHY remains in a low-power state capable of handling required commands during role switch. Cc: stable Fixes: 6d735722063a ("usb: dwc3: core: Prevent phy suspend during init") Suggested-by: Thinh Nguyen Signed-off-by: Udipto Goswami Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251126054221.120638-1-udipto.goswami@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 74098cc06e753d3ffd8398b040a3a1dfb65260c0 Author: Łukasz Bartosik Date: Thu Nov 27 11:16:44 2025 +0000 xhci: dbgtty: fix device unregister: fixup This fixup replaces tty_vhangup() call with call to tty_port_tty_vhangup(). Both calls hangup tty device synchronously however tty_port_tty_vhangup() increases reference count during the hangup operation using scoped_guard(tty_port_tty). Cc: stable Fixes: 1f73b8b56cf3 ("xhci: dbgtty: fix device unregister") Signed-off-by: Łukasz Bartosik Link: https://patch.msgid.link/20251127111644.3161386-1-ukaszb@google.com Signed-off-by: Greg Kroah-Hartman commit 800ad1f0e27792cddf5928f590d3f2d4ab3c68ee Author: Namhyung Kim Date: Wed Dec 3 15:29:24 2025 -0800 perf tools: Disable BPF skeleton if no libopenssl found The libopenssl is required by bpftool which is needed to generate BPF skeleton. Disable it by setting BUILD_BPF_SKEL to 0 otherwise it'll see build errors like below: CC /build/util/bpf_skel/.tmp/bootstrap/sign.o sign.c:16:10: fatal error: openssl/opensslv.h: No such file or directory 16 | #include | ^~~~~~~~~~~~~~~~~~~~ compilation terminated. make[3]: *** [Makefile:256: /build/util/bpf_skel/.tmp/bootstrap/sign.o] Error 1 make[3]: *** Waiting for unfinished jobs.... make[2]: *** [Makefile.perf:1211: /build/util/bpf_skel/.tmp/bootstrap/bpftool] Error 2 make[1]: *** [Makefile.perf:287: sub-make] Error 2 make: *** [Makefile:76: all] Error 2 Now it'll skip the build with the following message: Makefile.config:729: Warning: Disabled BPF skeletons as libopenssl is required Closes: https://lore.kernel.org/r/aP7uq6eVieG8v_v4@google.com Signed-off-by: Namhyung Kim commit 7678523109d1d9ee58adfe1cadbcd8fe195164ae Author: Namhyung Kim Date: Wed Dec 3 15:29:23 2025 -0800 tools/build: Add a feature test for libopenssl It's used by bpftool and the kernel build. Let's add a feature test so that perf can decide what to do based on the availability. Signed-off-by: Namhyung Kim commit d3ecb12e2e04ce53c95f933c462f2d8b150b965b Author: Jared Kangas Date: Fri Dec 12 07:03:17 2025 -0800 mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig MMC_SDHCI_ESDHC_IMX requires ARCH_MXC despite also being used on ARCH_S32, which results in unmet dependencies when compiling strictly for ARCH_S32. Resolve this by adding ARCH_S32 as an alternative to ARCH_MXC in the driver's dependencies. Fixes: 5c4f00627c9a ("mmc: sdhci-esdhc-imx: add NXP S32G2 support") Cc: stable@bvger.kernel.org Signed-off-by: Jared Kangas Reviewed-by: Haibo Chen Signed-off-by: Ulf Hansson commit a9c4c9085ec8ce3ce01be21b75184789e74f5f19 Author: Sai Krishna Potthuri Date: Fri Dec 12 12:05:09 2025 +0530 mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds On Xilinx/AMD platforms, the CD stable bit take slightly longer than one second(about an additional 100ms) to assert after a host controller reset. Although no functional failure observed with the existing one second delay but to ensure reliable initialization, increase the CD stable timeout to 2 seconds. Fixes: e251709aaddb ("mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up") Cc: stable@vger.kernel.org Signed-off-by: Sai Krishna Potthuri Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 8c04b77f87e6e321ae6acd28ce1de5553916153f Author: Fei Shao Date: Wed Dec 17 18:10:47 2025 +0800 spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ This driver is migrated to use threaded IRQ since commit 5972eb05ca32 ("spi: spi-mt65xx: Use threaded interrupt for non-SPIMEM transfer"), and we almost always want to disable the interrupt line to avoid excess interrupts while the threaded handler is processing SPI transfer. Use IRQF_ONESHOT for that purpose. In practice, we see MediaTek devices show SPI transfer timeout errors when communicating with ChromeOS EC in certain scenarios, and with IRQF_ONESHOT, the issue goes away. Signed-off-by: Fei Shao Link: https://patch.msgid.link/20251217101131.1975131-1-fshao@chromium.org Signed-off-by: Mark Brown commit 1d24636a9c87c32ec626a56593c98544e6c49fef Author: Rob Herring (Arm) Date: Mon Dec 15 17:03:22 2025 -0600 spi: dt-bindings: snps,dw-abp-ssi: Allow up to 16 chip-selects At least the Microchip Sparx5 supports up to 16 chip-selects, so increase the maximum. The pattern for the child unit-address was unconstrained, so update it to match the maximum number of chip-selects. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251215230323.3634112-1-robh@kernel.org Signed-off-by: Mark Brown commit 1889dd2081975ce1f6275b06cdebaa8d154847a9 Author: Anurag Dutta Date: Fri Dec 12 12:53:12 2025 +0530 spi: cadence-quadspi: Fix clock disable on probe failure path When cqspi_request_mmap_dma() returns -EPROBE_DEFER after runtime PM is enabled, the error path calls clk_disable_unprepare() on an already disabled clock, causing an imbalance. Use pm_runtime_get_sync() to increment the usage counter and resume the device. This prevents runtime_suspend() from being invoked and causing a double clock disable. Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") Signed-off-by: Anurag Dutta Tested-by: Nishanth Menon Link: https://patch.msgid.link/20251212072312.2711806-3-a-dutta@ti.com Signed-off-by: Mark Brown commit b1f54d7143e0f527cca1091857a786e278d72184 Author: Anurag Dutta Date: Fri Dec 12 12:53:11 2025 +0530 spi: cadence-quadspi: Add error logging for DMA request failure Add dev_err_probe() to log DMA request failures. This properly handles -EPROBE_DEFER at debug level, reducing log spam during deferred probing. Signed-off-by: Anurag Dutta Link: https://patch.msgid.link/20251212072312.2711806-2-a-dutta@ti.com Signed-off-by: Mark Brown commit fa43ab13c59f4c047c479673792ed033ab567c65 Author: Chancel Liu Date: Tue Dec 16 16:16:56 2025 +0900 ASoC: fsl-asoc-card: Use of_property_present() for non-boolean properties The use of of_property_read_bool() for non-boolean properties is deprecated in favor of of_property_present() when testing for property presence. Otherwise there'll be kernel warning: [ 29.018081] OF: /sound-wm8962: Read of boolean property 'hp-det-gpios' with a value. Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20251216071656.648412-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit d05d125f4e123e23c89d002e9922f83cee7716e1 Author: Shuming Fan Date: Tue Dec 16 17:06:01 2025 +0800 ASoC: rt1320: update VC blind write settings This patch updates blind write settings for VC version. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20251216090601.3955252-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 08fd332eeb88515af4f1892d91f6ef4ea7558b71 Author: Alexander Stein Date: Tue Dec 16 09:49:30 2025 +0100 ASoC: fsl_xcvr: provide regmap names This driver uses multiple regmaps, which will causes name conflicts in debugfs like: debugfs: '30cc0000.xcvr' already exists in 'regmap' Fix this by adding a name for the non-core regmap configurations. Signed-off-by: Alexander Stein Link: https://patch.msgid.link/20251216084931.553328-1-alexander.stein@ew.tq-group.com Signed-off-by: Mark Brown commit 90ed688792a6b7012b3e8a2f858bc3fe7454d0eb Author: Alexander Stein Date: Tue Dec 16 11:22:45 2025 +0100 ASoC: fsl_sai: Add missing registers to cache default Drivers does cache sync during runtime resume, setting all writable registers. Not all writable registers are set in cache default, resulting in the erorr message: fsl-sai 30c30000.sai: using zero-initialized flat cache, this may cause unexpected behavior Fix this by adding missing writable register defaults. Signed-off-by: Alexander Stein Link: https://patch.msgid.link/20251216102246.676181-1-alexander.stein@ew.tq-group.com Signed-off-by: Mark Brown commit 00b960a83c764208b0623089eb70af3685e3906f Author: Shengjiu Wang Date: Tue Dec 16 15:02:01 2025 +0800 ASoC: ak4458: remove the reset operation in probe and remove The reset_control handler has the reference count for usage, as there is reset operation in runtime suspend and resume, then reset operation in probe() would cause the reference count of reset not balanced. Previously add reset operation in probe and remove is to fix the compile issue with !CONFIG_PM, as the driver has been update to use RUNTIME_PM_OPS(), so that change can be reverted. Fixes: 1e0dff741b0a ("ASoC: ak4458: remove "reset-gpios" property handler") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20251216070201.358477-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 4de6cea0d8e10c9e3f38ccff7edd45891976e67a Author: Alexander Stein Date: Tue Dec 16 10:40:43 2025 +0100 ASoC: fsl_asrc_dma: fix duplicate debugfs directory error This driver registers a component for asrc. This is also used together with easrc, both attached using the device name as component name. Eventually debugfs directories with identical name are created in soc_init_component_debugfs(), leading to error message: debugfs: '30c90000.easrc' already exists in 'tqm-tlv320aic32' Fix this by adding the debugfs_prefix. Signed-off-by: Alexander Stein Reviewed-by: Fabio Estevam Link: https://patch.msgid.link/20251216094045.623184-3-alexander.stein@ew.tq-group.com Signed-off-by: Mark Brown commit 9f5f3583ba423e6eed0a96e4d4b7d808d618f3aa Author: Alexander Stein Date: Tue Dec 16 10:40:42 2025 +0100 ASoC: fsl_easrc: fix duplicate debugfs directory error This driver registers two components: asrc and easrc, both attached using the device name as component name. Eventually debugfs directories with identical name are created in soc_init_component_debugfs(), leading to error message: debugfs: '30c90000.easrc' already exists in 'tqm-tlv320aic32' Fix this by adding the debugfs_prefix. Signed-off-by: Alexander Stein Reviewed-by: Fabio Estevam Link: https://patch.msgid.link/20251216094045.623184-2-alexander.stein@ew.tq-group.com Signed-off-by: Mark Brown commit 46cea215dc9444ec32a76b1b6a9cb809e17b64d5 Author: Tetsuo Handa Date: Tue Nov 25 22:43:12 2025 +0900 can: j1939: make j1939_sk_bind() fail if device is no longer registered There is a theoretical race window in j1939_sk_netdev_event_unregister() where two j1939_sk_bind() calls jump in between read_unlock_bh() and lock_sock(). The assumption jsk->priv == priv can fail if the first j1939_sk_bind() call once made jsk->priv == NULL due to failed j1939_local_ecu_get() call and the second j1939_sk_bind() call again made jsk->priv != NULL due to successful j1939_local_ecu_get() call. Since the socket lock is held by both j1939_sk_netdev_event_unregister() and j1939_sk_bind(), checking ndev->reg_state with the socket lock held can reliably make the second j1939_sk_bind() call fail (and close this race window). Fixes: 7fcbe5b2c6a4 ("can: j1939: implement NETDEV_UNREGISTER notification handler") Signed-off-by: Tetsuo Handa Acked-by: Oleksij Rempel Link: https://patch.msgid.link/5732921e-247e-4957-a364-da74bd7031d7@I-love.SAKURA.ne.jp Signed-off-by: Marc Kleine-Budde commit 5d5602236f5db19e8b337a2cd87a90ace5ea776d Author: Tetsuo Handa Date: Tue Nov 25 22:39:59 2025 +0900 can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Signed-off-by: Tetsuo Handa Acked-by: Oleksij Rempel Link: https://patch.msgid.link/b9653191-d479-4c8b-8536-1326d028db5c@I-love.SAKURA.ne.jp Signed-off-by: Marc Kleine-Budde commit dc68c0f601691010dd5ae53442f8523f41a53131 Author: Christoph Hellwig Date: Tue Dec 16 18:30:09 2025 +0100 xfs: fix the zoned RT growfs check for zone alignment The grofs code for zoned RT subvolums already tries to check for zone alignment, but gets it wrong by using the old instead of the new mount structure. Fixes: 01b71e64bb87 ("xfs: support growfs on zoned file systems") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Cc: stable@vger.kernel.org # v6.15 Signed-off-by: Carlos Maiolino commit 982d2616a2906113e433fdc0cfcc122f8d1bb60a Author: Christoph Hellwig Date: Tue Dec 16 18:30:08 2025 +0100 xfs: validate that zoned RT devices are zone aligned Garbage collection assumes all zones contain the full amount of blocks. Mkfs already ensures this happens, but make the kernel check it as well to avoid getting into trouble due to fuzzers or mkfs bugs. Fixes: 2167eaabe2fa ("xfs: define the zoned on-disk format") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Cc: stable@vger.kernel.org # v6.15 Signed-off-by: Carlos Maiolino commit 70d6df5cb599d92ded120ce4b6ace5d59aa1f817 Author: Dirk Su Date: Wed Dec 17 10:52:44 2025 +0800 ALSA: hda/realtek: fix micmute LED reversed on HP Abe and Bantie Quirk ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO make mute/micmute LEDs on HP Abe and Bantie functional. But the micmute LED's function is reversed, LED will be on when Mic enabled and off when Mic disabled. Create a new function to fix the micmute LED reversed issue. Fixes: b72a6ddf6af2 ("ALSA: hda/realtek: fix mute/micmute LEDs don't work for HP 200 G2i") Signed-off-by: Dirk Su Link: https://patch.msgid.link/20251217025257.44600-1-dirk.su@canonical.com Signed-off-by: Takashi Iwai commit 108c422c495dc3232aebad837408cd74d23b1794 Author: Stefan Binding Date: Tue Dec 16 16:48:13 2025 +0000 ALSA: hda/realtek: Add support for HP Clipper Laptop Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20251216164830.832148-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 720eebd514c0c56f1e9da25666b746edf82ff227 Author: Stefan Binding Date: Tue Dec 16 16:48:12 2025 +0000 ALSA: hda/realtek: Add support for HP Trekker Laptop Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20251216164830.832148-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e Author: Shipei Qu Date: Wed Dec 17 10:46:30 2025 +0800 ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_level[] in struct snd_us16x08_meter_store. Currently the function derives the channel index directly from the meter packet (MUB2(meter_urb, s) - 1) and uses it to index those arrays without validating the range. If the packet contains a negative or out-of-range channel number, the driver may write past the end of these arrays. Introduce a local channel variable and validate it before updating the arrays. We reject negative indices, limit meter_level[] and comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] updates with ARRAY_SIZE(master_level). Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") Reported-by: DARKNAVY (@DarkNavyOrg) Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com Signed-off-by: Shipei Qu Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com Signed-off-by: Takashi Iwai commit 9a068c4a77174d23c72649d16275df4c0a627510 Merge: e3b88652b66b6b 816f291fc23f32 Author: Mark Brown Date: Wed Dec 17 07:53:20 2025 +0000 ASoC: SOF: ipc4-topology: fixes for 'exotic' format Merge series from Peter Ujfalusi : The introduction of 8bit and FLOAT formats missed to cover the new corner cases they cause when the NHLT blobs are looked up. The two patch in this series fixes the 8bit and FLOAT format caused cases to be able to find the correct blob from NHLT. commit ea1013c1539270e372fc99854bc6e4d94eaeff66 Merge: 64e68f8a95eb77 1d528e794f3db5 Author: Linus Torvalds Date: Wed Dec 17 15:54:58 2025 +1200 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix BPF builds due to -fms-extensions. selftests (Alexei Starovoitov), bpftool (Quentin Monnet). - Fix build of net/smc when CONFIG_BPF_SYSCALL=y, but CONFIG_BPF_JIT=n (Geert Uytterhoeven) - Fix livepatch/BPF interaction and support reliable unwinding through BPF stack frames (Josh Poimboeuf) - Do not audit capability check in arm64 JIT (Ondrej Mosnacek) - Fix truncated dmabuf BPF iterator reads (T.J. Mercier) - Fix verifier assumptions of bpf_d_path's output buffer (Shuran Liu) - Fix warnings in libbpf when built with -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: add regression test for bpf_d_path() bpf: Fix verifier assumptions of bpf_d_path's output buffer selftests/bpf: Add test for truncated dmabuf_iter reads bpf: Fix truncated dmabuf iterator reads x86/unwind/orc: Support reliable unwinding through BPF stack frames bpf: Add bpf_has_frame_pointer() bpf, arm64: Do not audit capability check in do_jit() libbpf: Fix -Wdiscarded-qualifiers under C23 bpftool: Fix build warnings due to MS extensions net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT selftests/bpf: Add -fms-extensions to bpf build flags commit 64e68f8a95eb771273d8d19f9dc1f763524e56d9 Merge: 40fbbd64bba6c6 489e96651dfe59 Author: Linus Torvalds Date: Wed Dec 17 15:48:30 2025 +1200 Merge tag 's390-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - clear 'Search boot program' flag when 'bootprog' sysfs file is written to override a value set from Hardware Management Console - fix cyclic dead-lock in zpci_zdev_put() and zpci_scan_devices() functions when triggering PCI device recovery using sysfs - annotate the expected lock context imbalance in zpci_release_device() function to fix a sparse complaint - fix the logic to fallback to the return address register value in the topmost frame when stack tracing uses a back chain * tag 's390-6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/stacktrace: Do not fallback to RA register s390/pci: Annotate lock context imbalance in zpci_release_device() s390/pci: Fix cyclic dead-lock in zpci_zdev_put() and zpci_scan_devices() s390/ipl: Clear SBP flag when bootprog is set commit c9f36f04a8a2725172cdf2b5e32363e4addcb14c Author: Seunghwan Baek Date: Wed Dec 10 15:38:54 2025 +0900 scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error If UFS resume fails, the event history is updated in ufshcd_resume(), but there is no code anywhere to record UFS suspend. Therefore, add code to record UFS suspend error event history. Fixes: dd11376b9f1b ("scsi: ufs: Split the drivers/scsi/ufs directory") Cc: stable@vger.kernel.org Signed-off-by: Seunghwan Baek Reviewed-by: Peter Wang Link: https://patch.msgid.link/20251210063854.1483899-2-sh8267.baek@samsung.com Signed-off-by: Martin K. Petersen commit 0e1677654259a2f3ccf728de1edde922a3c4ba57 Author: Michal Rábek Date: Fri Dec 12 17:08:23 2025 +0100 scsi: sg: Fix occasional bogus elapsed time that exceeds timeout A race condition was found in sg_proc_debug_helper(). It was observed on a system using an IBM LTO-9 SAS Tape Drive (ULTRIUM-TD9) and monitoring /proc/scsi/sg/debug every second. A very large elapsed time would sometimes appear. This is caused by two race conditions. We reproduced the issue with an IBM ULTRIUM-HH9 tape drive on an x86_64 architecture. A patched kernel was built, and the race condition could not be observed anymore after the application of this patch. A reproducer C program utilising the scsi_debug module was also built by Changhui Zhong and can be viewed here: https://github.com/MichaelRabek/linux-tests/blob/master/drivers/scsi/sg/sg_race_trigger.c The first race happens between the reading of hp->duration in sg_proc_debug_helper() and request completion in sg_rq_end_io(). The hp->duration member variable may hold either of two types of information: #1 - The start time of the request. This value is present while the request is not yet finished. #2 - The total execution time of the request (end_time - start_time). If sg_proc_debug_helper() executes *after* the value of hp->duration was changed from #1 to #2, but *before* srp->done is set to 1 in sg_rq_end_io(), a fresh timestamp is taken in the else branch, and the elapsed time (value type #2) is subtracted from a timestamp, which cannot yield a valid elapsed time (which is a type #2 value as well). To fix this issue, the value of hp->duration must change under the protection of the sfp->rq_list_lock in sg_rq_end_io(). Since sg_proc_debug_helper() takes this read lock, the change to srp->done and srp->header.duration will happen atomically from the perspective of sg_proc_debug_helper() and the race condition is thus eliminated. The second race condition happens between sg_proc_debug_helper() and sg_new_write(). Even though hp->duration is set to the current time stamp in sg_add_request() under the write lock's protection, it gets overwritten by a call to get_sg_io_hdr(), which calls copy_from_user() to copy struct sg_io_hdr from userspace into kernel space. hp->duration is set to the start time again in sg_common_write(). If sg_proc_debug_helper() is called between these two calls, an arbitrary value set by userspace (usually zero) is used to compute the elapsed time. To fix this issue, hp->duration must be set to the current timestamp again after get_sg_io_hdr() returns successfully. A small race window still exists between get_sg_io_hdr() and setting hp->duration, but this window is only a few instructions wide and does not result in observable issues in practice, as confirmed by testing. Additionally, we fix the format specifier from %d to %u for printing unsigned int values in sg_proc_debug_helper(). Signed-off-by: Michal Rábek Suggested-by: Tomas Henzl Tested-by: Changhui Zhong Reviewed-by: Ewan D. Milne Reviewed-by: John Meneghini Reviewed-by: Tomas Henzl Link: https://patch.msgid.link/20251212160900.64924-1-mrabek@redhat.com Signed-off-by: Martin K. Petersen commit d373163194982f43b92c552c138c29d9f0b79553 Author: Chandrakanth Patil Date: Thu Dec 11 05:59:29 2025 +0530 scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow The driver was not reading the MAX_REQ_PER_REPLY_QUEUE_LIMIT IOCFacts flag, so the reply-queue-full handling was never enabled, even on firmware that supports it. Reading this flag enables the feature and prevents reply queue overflow. Fixes: f08b24d82749 ("scsi: mpi3mr: Avoid reply queue full condition") Cc: stable@vger.kernel.org Signed-off-by: Chandrakanth Patil Link: https://patch.msgid.link/20251211002929.22071-1-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 1f7d6e2efeedd8f545d3e0e9bf338023bf4ea584 Author: John Garry Date: Thu Dec 11 10:06:51 2025 +0000 scsi: scsi_debug: Fix atomic write enable module param description The atomic write enable module param is "atomic_wr", and not "atomic_write", so fix the module param description. Fixes: 84f3a3c01d70 ("scsi: scsi_debug: Atomic write support") Signed-off-by: John Garry Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251211100651.9056-1-john.g.garry@oracle.com Signed-off-by: Martin K. Petersen commit d95e99a74eaf35c070f5939295331e5d7857c723 Author: Arnd Bergmann Date: Mon Dec 8 14:38:44 2025 +0100 RDMA/irdma: Fix irdma_alloc_ucontext_resp padding A recent commit modified struct irdma_alloc_ucontext_resp by adding a member with implicit padding in front of it, though this does not change the offset of the data members other than m68k. Reported by scripts/check-uapi.sh: ==== ABI differences detected in include/rdma/irdma-abi.h from 1dd7bde2e91c -> HEAD ==== [C] 'struct irdma_alloc_ucontext_resp' changed: type size changed from 704 to 640 (in bits) 1 data member deletion: '__u8 rsvd3[2]', at offset 640 (in bits) at irdma-abi.h:61:1 1 data member insertion: '__u8 revd3[2]', at offset 592 (in bits) at irdma-abi.h:60:1 Change the size back to the previous version, and remove the implicit padding by making it explicit and matching what x86-64 would do by placing max_hw_srq_quanta member into a naturally aligned location. Fixes: 563e1feb5f6e ("RDMA/irdma: Add SRQ support") Link: https://patch.msgid.link/r/20251208133849.315451-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Geert Uytterhoeven Tested-by: Jacob Moroni Signed-off-by: Jason Gunthorpe commit 2dc675f614850b80deab7cf6d12902636ed8a7f4 Author: Arnd Bergmann Date: Mon Dec 8 14:33:05 2025 +0100 RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding On a few 32-bit architectures, the newly added ib_user_service_rec structure is not 64-bit aligned the way it is on most regular ones. Add explicit padding into the rdma_ucm_query_ib_service_resp and rdma_ucm_resolve_ib_service structures that embed it, so that the layout is compatible across all of them. This is an ABI change on i386, aligning it with x86_64 and the other 64-bit architectures to avoid having to use a compat ioctl handler. Fixes: 810f874eda8e ("RDMA/ucma: Support query resolved service records") Link: https://patch.msgid.link/r/20251208133311.313977-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Jason Gunthorpe commit 57f3cb6c84159d12ba343574df2115fb18dd83ca Author: Jason Gunthorpe Date: Fri Nov 28 20:53:21 2025 -0400 RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN: GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 Destroy the ah_attr after canceling the work, it is safe to call this twice. Link: https://patch.msgid.link/r/0-v1-4285d070a6b2+20a-rdma_mc_gid_leak_syz_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: fe454dc31e84 ("RDMA/ucma: Fix use-after-free bug in ucma_create_uevent") Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68232e7b.050a0220.f2294.09f6.GAE@google.com Signed-off-by: Jason Gunthorpe commit a7b8e876e0ef0232b8076972c57ce9a7286b47ca Author: Jason Gunthorpe Date: Fri Nov 28 13:37:28 2025 -0400 RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a LS_NLA_TYPE_DGID attribute, it is invalid if it does not. Use the nl parsing logic properly and call nla_parse_deprecated() to fill the nlattrs array and then directly index that array to get the data for the DGID. Just fail if it is NULL. Remove the for loop searching for the nla, and squash the validation and parsing into one function. Fixes an uninitialized read from the stack triggered by userspace if it does not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE query. BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline] BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490 hex_byte_pack include/linux/hex.h:13 [inline] ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490 ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509 ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633 pointer+0xc09/0x1bd0 lib/vsprintf.c:2542 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930 vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279 vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426 vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465 vprintk+0x36/0x50 kernel/printk/printk_safe.c:82 _printk+0x17e/0x1b0 kernel/printk/printk.c:2475 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline] ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x333/0x3d0 net/socket.c:729 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671 __sys_sendmsg+0x1aa/0x300 net/socket.c:2703 __compat_sys_sendmsg net/compat.c:346 [inline] __do_compat_sys_sendmsg net/compat.c:353 [inline] __se_compat_sys_sendmsg net/compat.c:350 [inline] __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350 ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3 Link: https://patch.msgid.link/r/0-v1-3fbaef094271+2cf-rdma_op_ip_rslv_syz_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload") Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68dc3dac.a00a0220.102ee.004f.GAE@google.com Signed-off-by: Jason Gunthorpe commit d8a4af8f3d9d3367b2c49b0d9dee529556bdd2f4 Author: Steve French Date: Sat Dec 13 12:48:49 2025 -0600 cifs: update internal module version number to 2.58 Signed-off-by: Steve French commit 94d5b8dbc5d9caa8e01c8fab8d5ed56e843ff40e Author: ZhangGuoDong Date: Tue Dec 2 15:14:17 2025 +0800 smb: move some SMB1 definitions into common/smb1pdu.h These definitions are only used by SMB1, so move them into the new common/smb1pdu.h. KSMBD only implements SMB_COM_NEGOTIATE, see MS-SMB2 3.3.5.2. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Signed-off-by: Steve French commit 05f5e355cf783b30bd6eb3dec17ed1a8b3cfa95c Author: Bharath SM Date: Tue Dec 16 21:26:05 2025 +0530 smb: align durable reconnect v2 context to 8 byte boundary Add a 4-byte Pad to create_durable_handle_reconnect_v2 so the DH2C create context is 8 byte aligned. This avoids malformed CREATE contexts on reconnect. Recent change removed this Padding, adding it back. Fixes: 81a45de432c6 ("smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h") Signed-off-by: Bharath SM Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 880977fdc7f67923d1904ee23ca75fa1e375ea46 Author: Hangxiang Ma Date: Wed Nov 26 01:38:34 2025 -0800 dt-bindings: i2c: qcom-cci: Document SM8750 compatible Add SM8750 compatible consistent with CAMSS CCI interfaces. Signed-off-by: Hangxiang Ma Reviewed-by: Bryan O'Donoghue Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251126-add-support-for-camss-on-sm8750-v1-1-646fee2eb720@oss.qualcomm.com Signed-off-by: Andi Shyti commit dde7e21311004a6d227b628f14c582313da90bde Author: Jarkko Nikula Date: Mon Nov 24 14:28:15 2025 +0100 i2c: i801: Add support for Intel Nova Lake-S Add SMBus PCI IDs on Intel Nova Lake-S. Signed-off-by: Jarkko Nikula Signed-off-by: Heikki Krogerus Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251124132816.470599-1-heikki.krogerus@linux.intel.com commit d9b85d296f3accd8957a98d78810a4ecdbdfe557 Author: Benoît Monin Date: Wed Nov 26 11:46:24 2025 +0100 dt-bindings: i2c: dw: Add Mobileye I2C controllers Add compatible string for the DesignWare-based I2C controllers present in Mobileye Eyeq6Lplus SoC, with a fallback to the default compatible. The same controllers are also present in the EyeQ7H, so add a compatible for those with a fallback to the Eyeq6Lplus compatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Benoît Monin Acked-by: Mika Westerberg Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251126-i2c-dw-v4-1-b0654598e7c5@bootlin.com commit 4c544cd6556d9193baad1a0f183e8d3b5c7baf02 Author: Krzysztof Kozlowski Date: Wed Nov 26 19:23:00 2025 +0100 i2c: rcar: Fix Wvoid-pointer-to-enum-cast warning 'i2c_types' is an enum, thus cast of pointer on 64-bit compile test with clang and W=1 causes: i2c-rcar.c:1144:18: error: cast to smaller integer type 'enum rcar_i2c_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] One of the discussions in 2023 on LKML suggested warning is not suitable for kernel. Nothing changed in this regard since that time, so assume the warning will stay and we want to have warnings-free builds. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251126182257.157439-6-krzysztof.kozlowski@oss.qualcomm.com commit 3ff79e76d31f32575fbd8a8ad6ce9108ca916d1a Author: Krzysztof Kozlowski Date: Wed Nov 26 19:22:59 2025 +0100 i2c: pxa: Fix Wvoid-pointer-to-enum-cast warning 'i2c_types' is an enum, thus cast of pointer on 64-bit compile test with clang and W=1 causes: i2c-pxa.c:1269:15: error: cast to smaller integer type 'enum pxa_i2c_types' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] One of the discussions in 2023 on LKML suggested warning is not suitable for kernel. Nothing changed in this regard since that time, so assume the warning will stay and we want to have warnings-free builds. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251126182257.157439-5-krzysztof.kozlowski@oss.qualcomm.com commit 60d7f6031b94b6dae9e7d95b49f5c7045f6c8edb Author: Krzysztof Kozlowski Date: Wed Nov 26 19:22:58 2025 +0100 i2c: bcm-iproc: Fix Wvoid-pointer-to-enum-cast warning 'type' is an enum, thus cast of pointer on 64-bit compile test with clang and W=1 causes: i2c-bcm-iproc.c:1102:3: error: cast to smaller integer type 'enum bcm_iproc_i2c_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] One of the discussions in 2023 on LKML suggested warning is not suitable for kernel. Nothing changed in this regard since that time, so assume the warning will stay and we want to have warnings-free builds. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251126182257.157439-4-krzysztof.kozlowski@oss.qualcomm.com commit 1f6ca557088eb96c8c554f853eb7c60862f8a0a8 Author: Krishna Kurapati Date: Wed Dec 3 20:18:56 2025 +0530 arm64: dts: qcom: sm8650: Fix compile warnings in USB controller node With W=1, the following error comes up: Warning (avoid_unnecessary_addr_size): /soc@0/usb@a600000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" or "ranges" property This is because the child node being removed during flattening and moving to latest bindings. Fixes: 77e1f16b9302 ("arm64: dts: qcom: sm8650: Flatten the USB nodes") Signed-off-by: Krishna Kurapati Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251203144856.2711440-3-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9dbc9bed01837717b8ab755cf5067a6f8d35b00f Author: Krishna Kurapati Date: Wed Dec 3 20:18:55 2025 +0530 arm64: dts: qcom: sm8550: Fix compile warnings in USB controller node With W=1, the following error comes up: Warning (avoid_unnecessary_addr_size): /soc@0/usb@a600000: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" or "ranges" property This is because the child node being removed during flattening and moving to latest bindings. Fixes: 33450878adfc ("arm64: dts: qcom: sm8550: Flatten the USB nodes") Signed-off-by: Krishna Kurapati Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251203144856.2711440-2-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 868b979c5328b867c95a6d5a93ba13ad0d3cd2f1 Author: Konrad Dybcio Date: Tue Dec 2 18:36:22 2025 +0100 arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links To make sure that power rail is voted for, wire it up to its consumers. Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Konrad Dybcio Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20251202-topic-8280_mxc-v2-3-46cdf47a829e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 5bc3e720e725cd5fa34875fa1e5434d565858067 Author: Konrad Dybcio Date: Tue Dec 2 18:36:21 2025 +0100 pmdomain: qcom: rpmhpd: Add MXC to SC8280XP This was apparently accounted for in dt-bindings, but never made its way into the driver. Fix it for SC8280XP and its VDD_GFX-less cousin, SA8540P. Fixes: f68f1cb3437d ("soc: qcom: rpmhpd: add sc8280xp & sa8540p rpmh power-domains") Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20251202-topic-8280_mxc-v2-2-46cdf47a829e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 45e1be5ddec98db71e7481fa7a3005673200d85c Author: Konrad Dybcio Date: Tue Dec 2 18:36:20 2025 +0100 dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO Not sure how useful it's gonna be in practice, but the definition is missing (unlike the previously-unused SC8280XP_MXC-non-_AO), so add it to allow the driver to create the corresponding pmdomain. Fixes: dbfb5f94e084 ("dt-bindings: power: rpmpd: Add sc8280xp RPMh power-domains") Acked-by: Rob Herring (Arm) Signed-off-by: Konrad Dybcio Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20251202-topic-8280_mxc-v2-1-46cdf47a829e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 8e6c237cd759b2297b38d978bd6e14bf0dc4a804 Author: David Heidelberg Date: Thu Dec 4 11:41:24 2025 +0100 arm64: dts qcom: sdm845-oneplus-enchilada: Specify panel name within the compatible sofef00 is name of the DDIC, it doesn't contain name of the panel used. The DDIC is also paired with other panels, so make clear which panel is used. New device-tree will work with old driver as expected, due to secondary compatible. Cosmetic: sort the properties in the node. Reviewed-by: Neil Armstrong Signed-off-by: David Heidelberg Link: https://lore.kernel.org/r/20251204-sofef00-rebuild-v4-1-7f6e030ae5b7@ixit.cz Signed-off-by: Bjorn Andersson commit 08a797dbcea1bf923f9d3f87738375641eaf5769 Author: Abel Vesa Date: Fri Nov 28 15:11:27 2025 +0200 mailmap: Update email address for Abel Vesa My Linaro email is going to bounce soon, so add .mailmap entry to my kernel.org alias. Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20251128-mailmap-update-abel-vesa-v1-1-2e45c25c0918@linaro.org Signed-off-by: Bjorn Andersson commit 8bb3754909cde5df4f8c1012bde220b97d8ee3bc Author: Pradeep P V K Date: Wed Nov 26 18:41:46 2025 +0530 arm64: dts: qcom: talos: Correct UFS clocks ordering The current UFS clocks does not align with their respective names, causing the ref_clk to be set to an incorrect frequency as below, which results in command timeouts. ufshcd-qcom 1d84000.ufshc: invalid ref_clk setting = 300000000 This commit fixes the issue by properly reordering the UFS clocks to match their names. Fixes: ea172f61f4fd ("arm64: dts: qcom: qcs615: Fix up UFS clocks") Cc: stable@vger.kernel.org Signed-off-by: Pradeep P V K Link: https://lore.kernel.org/r/20251126131146.16146-1-pradeep.pragallapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c1c050f92d8f6aac4e17f7f2230160794fceef0c Author: Filipe Manana Date: Fri Dec 12 17:18:25 2025 +0000 btrfs: fix reservation leak in some error paths when inserting inline extent If we fail to allocate a path or join a transaction, we return from __cow_file_range_inline() without freeing the reserved qgroup data, resulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data() in such cases. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f8da41de0bff9eb1d774a7253da0c9f637c4470a Author: Filipe Manana Date: Fri Dec 12 17:10:10 2025 +0000 btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. Fix this by freeing the reserved qgroup data in __cow_file_range_inline() only if we are not doing the fallback (ret is <= 0). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 83f59076a1ae6f5c6845d6f7ed3a1a373d883684 Author: Leo Martins Date: Fri Dec 12 17:26:26 2025 -0800 btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_get_or_create_delayed_node() set the delayed_node's refcount before acquiring the root->delayed_nodes lock. Commit e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes") moved refcount_set inside the critical section, which means there is no longer a memory barrier between setting the refcount and setting btrfs_inode->delayed_node. Without that barrier, the stores to node->refs and btrfs_inode->delayed_node may become visible out of order. Another thread can then read btrfs_inode->delayed_node and attempt to increment a refcount that hasn't been set yet, leading to a refcounting bug and a use-after-free warning. The fix is to move refcount_set back to where it was to take advantage of the implicit memory barrier provided by lock acquisition. Because the allocations now happen outside of the lock's critical section, they can use GFP_NOFS instead of GFP_ATOMIC. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511262228.6dda231e-lkp@intel.com Fixes: e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes") Tested-by: kernel test robot Reviewed-by: Filipe Manana Signed-off-by: Leo Martins Signed-off-by: David Sterba commit 7ba0b6461bc4edb3005ea6e00cdae189bcf908a5 Author: Filipe Manana Date: Thu Dec 11 15:06:26 2025 +0000 btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (either with the rename exchange operation or regular renames in multiple non-atomic steps) two inodes and at least one of them is a directory, we can end up with a log tree that contains only of the inodes and after a power failure that can result in an attempt to delete the other inode when it should not because it was not deleted before the power failure. In some case that delete attempt fails when the target inode is a directory that contains a subvolume inside it, since the log replay code is not prepared to deal with directory entries that point to root items (only inode items). 1) We have directories "dir1" (inode A) and "dir2" (inode B) under the same parent directory; 2) We have a file (inode C) under directory "dir1" (inode A); 3) We have a subvolume inside directory "dir2" (inode B); 4) All these inodes were persisted in a past transaction and we are currently at transaction N; 5) We rename the file (inode C), so at btrfs_log_new_name() we update inode C's last_unlink_trans to N; 6) We get a rename exchange for "dir1" (inode A) and "dir2" (inode B), so after the exchange "dir1" is inode B and "dir2" is inode A. During the rename exchange we call btrfs_log_new_name() for inodes A and B, but because they are directories, we don't update their last_unlink_trans to N; 7) An fsync against the file (inode C) is done, and because its inode has a last_unlink_trans with a value of N we log its parent directory (inode A) (through btrfs_log_all_parents(), called from btrfs_log_inode_parent()). 8) So we end up with inode B not logged, which now has the old name of inode A. At copy_inode_items_to_log(), when logging inode A, we did not check if we had any conflicting inode to log because inode A has a generation lower than the current transaction (created in a past transaction); 9) After a power failure, when replaying the log tree, since we find that inode A has a new name that conflicts with the name of inode B in the fs tree, we attempt to delete inode B... this is wrong since that directory was never deleted before the power failure, and because there is a subvolume inside that directory, attempting to delete it will fail since replay_dir_deletes() and btrfs_unlink_inode() are not prepared to deal with dir items that point to roots instead of inodes. When that happens the mount fails and we get a stack trace like the following: [87.2314] BTRFS info (device dm-0): start tree-log replay [87.2318] BTRFS critical (device dm-0): failed to delete reference to subvol, root 5 inode 256 parent 259 [87.2332] ------------[ cut here ]------------ [87.2338] BTRFS: Transaction aborted (error -2) [87.2346] WARNING: CPU: 1 PID: 638968 at fs/btrfs/inode.c:4345 __btrfs_unlink_inode+0x416/0x440 [btrfs] [87.2368] Modules linked in: btrfs loop dm_thin_pool (...) [87.2470] CPU: 1 UID: 0 PID: 638968 Comm: mount Tainted: G W 6.18.0-rc7-btrfs-next-218+ #2 PREEMPT(full) [87.2489] Tainted: [W]=WARN [87.2494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [87.2514] RIP: 0010:__btrfs_unlink_inode+0x416/0x440 [btrfs] [87.2538] Code: c0 89 04 24 (...) [87.2568] RSP: 0018:ffffc0e741f4b9b8 EFLAGS: 00010286 [87.2574] RAX: 0000000000000000 RBX: ffff9d3ec8a6cf60 RCX: 0000000000000000 [87.2582] RDX: 0000000000000002 RSI: ffffffff84ab45a1 RDI: 00000000ffffffff [87.2591] RBP: ffff9d3ec8a6ef20 R08: 0000000000000000 R09: ffffc0e741f4b840 [87.2599] R10: ffff9d45dc1fffa8 R11: 0000000000000003 R12: ffff9d3ee26d77e0 [87.2608] R13: ffffc0e741f4ba98 R14: ffff9d4458040800 R15: ffff9d44b6b7ca10 [87.2618] FS: 00007f7b9603a840(0000) GS:ffff9d4658982000(0000) knlGS:0000000000000000 [87.2629] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [87.2637] CR2: 00007ffc9ec33b98 CR3: 000000011273e003 CR4: 0000000000370ef0 [87.2648] Call Trace: [87.2651] [87.2654] btrfs_unlink_inode+0x15/0x40 [btrfs] [87.2661] unlink_inode_for_log_replay+0x27/0xf0 [btrfs] [87.2669] check_item_in_log+0x1ea/0x2c0 [btrfs] [87.2676] replay_dir_deletes+0x16b/0x380 [btrfs] [87.2684] fixup_inode_link_count+0x34b/0x370 [btrfs] [87.2696] fixup_inode_link_counts+0x41/0x160 [btrfs] [87.2703] btrfs_recover_log_trees+0x1ff/0x7c0 [btrfs] [87.2711] ? __pfx_replay_one_buffer+0x10/0x10 [btrfs] [87.2719] open_ctree+0x10bb/0x15f0 [btrfs] [87.2726] btrfs_get_tree.cold+0xb/0x16c [btrfs] [87.2734] ? fscontext_read+0x15c/0x180 [87.2740] ? rw_verify_area+0x50/0x180 [87.2746] vfs_get_tree+0x25/0xd0 [87.2750] vfs_cmd_create+0x59/0xe0 [87.2755] __do_sys_fsconfig+0x4f6/0x6b0 [87.2760] do_syscall_64+0x50/0x1220 [87.2764] entry_SYSCALL_64_after_hwframe+0x76/0x7e [87.2770] RIP: 0033:0x7f7b9625f4aa [87.2775] Code: 73 01 c3 48 (...) [87.2803] RSP: 002b:00007ffc9ec35b08 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [87.2817] RAX: ffffffffffffffda RBX: 0000558bfa91ac20 RCX: 00007f7b9625f4aa [87.2829] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [87.2842] RBP: 0000558bfa91b120 R08: 0000000000000000 R09: 0000000000000000 [87.2854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [87.2864] R13: 00007f7b963f1580 R14: 00007f7b963f326c R15: 00007f7b963d8a23 [87.2877] [87.2882] ---[ end trace 0000000000000000 ]--- [87.2891] BTRFS: error (device dm-0 state A) in __btrfs_unlink_inode:4345: errno=-2 No such entry [87.2904] BTRFS: error (device dm-0 state EAO) in do_abort_log_replay:191: errno=-2 No such entry [87.2915] BTRFS critical (device dm-0 state EAO): log tree (for root 5) leaf currently being processed (slot 7 key (258 12 257)): [87.2929] BTRFS info (device dm-0 state EAO): leaf 30736384 gen 10 total ptrs 7 free space 15712 owner 18446744073709551610 [87.2929] BTRFS info (device dm-0 state EAO): refs 3 lock_owner 0 current 638968 [87.2929] item 0 key (257 INODE_ITEM 0) itemoff 16123 itemsize 160 [87.2929] inode generation 9 transid 10 size 0 nbytes 0 [87.2929] block group 0 mode 40755 links 1 uid 0 gid 0 [87.2929] rdev 0 sequence 7 flags 0x0 [87.2929] atime 1765464494.678070921 [87.2929] ctime 1765464494.686606513 [87.2929] mtime 1765464494.686606513 [87.2929] otime 1765464494.678070921 [87.2929] item 1 key (257 INODE_REF 256) itemoff 16109 itemsize 14 [87.2929] index 4 name_len 4 [87.2929] item 2 key (257 DIR_LOG_INDEX 2) itemoff 16101 itemsize 8 [87.2929] dir log end 2 [87.2929] item 3 key (257 DIR_LOG_INDEX 3) itemoff 16093 itemsize 8 [87.2929] dir log end 18446744073709551615 [87.2930] item 4 key (257 DIR_INDEX 3) itemoff 16060 itemsize 33 [87.2930] location key (258 1 0) type 1 [87.2930] transid 10 data_len 0 name_len 3 [87.2930] item 5 key (258 INODE_ITEM 0) itemoff 15900 itemsize 160 [87.2930] inode generation 9 transid 10 size 0 nbytes 0 [87.2930] block group 0 mode 100644 links 1 uid 0 gid 0 [87.2930] rdev 0 sequence 2 flags 0x0 [87.2930] atime 1765464494.678456467 [87.2930] ctime 1765464494.686606513 [87.2930] mtime 1765464494.678456467 [87.2930] otime 1765464494.678456467 [87.2930] item 6 key (258 INODE_REF 257) itemoff 15887 itemsize 13 [87.2930] index 3 name_len 3 [87.2930] BTRFS critical (device dm-0 state EAO): log replay failed in unlink_inode_for_log_replay:1045 for root 5, stage 3, with error -2: failed to unlink inode 256 parent dir 259 name subvol root 5 [87.2963] BTRFS: error (device dm-0 state EAO) in btrfs_recover_log_trees:7743: errno=-2 No such entry [87.2981] BTRFS: error (device dm-0 state EAO) in btrfs_replay_log:2083: errno=-2 No such entry (Failed to recover log tr So fix this by changing copy_inode_items_to_log() to always detect if there are conflicting inodes for the ref/extref of the inode being logged even if the inode was created in a past transaction. A test case for fstests will follow soon. CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e9e3b22ddfa760762b696ac6417c8d6edd182e49 Author: Qu Wenruo Date: Thu Dec 11 12:45:17 2025 +1030 btrfs: fix beyond-EOF write handling [BUG] For the following write sequence with 64K page size and 4K fs block size, it will lead to file extent items to be inserted without any data checksum: mkfs.btrfs -s 4k -f $dev > /dev/null mount $dev $mnt xfs_io -f -c "pwrite 0 16k" -c "pwrite 32k 4k" -c pwrite "60k 64K" \ -c "truncate 16k" $mnt/foobar umount $mnt This will result the following 2 file extent items to be inserted (extra trace point added to insert_ordered_extent_file_extent()): btrfs_finish_one_ordered: root=5 ino=257 file_off=61440 num_bytes=4096 csum_bytes=0 btrfs_finish_one_ordered: root=5 ino=257 file_off=0 num_bytes=16384 csum_bytes=16384 Note for file offset 60K, we're inserting a file extent without any data checksum. Also note that range [32K, 36K) didn't reach insert_ordered_extent_file_extent(), which is the correct behavior as that OE is fully truncated, should not result any file extent. Although file extent at 60K will be later dropped by btrfs_truncate(), if the transaction got committed after file extent inserted but before the file extent dropping, we will have a small window where we have a file extent beyond EOF and without any data checksum. That will cause "btrfs check" to report error. [CAUSE] The sequence happens like this: - Buffered write dirtied the page cache and updated isize Now the inode size is 64K, with the following page cache layout: 0 16K 32K 48K 64K |/////////////| |//| |//| - Truncate the inode to 16K Which will trigger writeback through: btrfs_setsize() |- truncate_setsize() | Now the inode size is set to 16K | |- btrfs_truncate() |- btrfs_wait_ordered_range() for [16K, u64(-1)] |- btrfs_fdatawrite_range() for [16K, u64(-1)} |- extent_writepage() for folio 0 |- writepage_delalloc() | Generated OE for [0, 16K), [32K, 36K] and [60K, 64K) | |- extent_writepage_io() Then inside extent_writepage_io(), the dirty fs blocks are handled differently: - Submit write for range [0, 16K) As they are still inside the inode size (16K). - Mark OE [32K, 36K) as truncated Since we only call btrfs_lookup_first_ordered_range() once, which returned the first OE after file offset 16K. - Mark all OEs inside range [16K, 64K) as finished Which will mark OE ranges [32K, 36K) and [60K, 64K) as finished. For OE [32K, 36K) since it's already marked as truncated, and its truncated length is 0, no file extent will be inserted. For OE [60K, 64K) it has never been submitted thus has no data checksum, and we insert the file extent as usual. This is the root cause of file extent at 60K to be inserted without any data checksum. - Clear dirty flags for range [16K, 64K) It is the function btrfs_folio_clear_dirty() which searches and clears any dirty blocks inside that range. [FIX] The bug itself was introduced a long time ago, way before subpage and large folio support. At that time, fs block size must match page size, thus the range [cur, end) is just one fs block. But later with subpage and large folios, the same range [cur, end) can have multiple blocks and ordered extents. Later commit 18de34daa7c6 ("btrfs: truncate ordered extent when skipping writeback past i_size") was fixing a bug related to subpage/large folios, but it's still utilizing the old range [cur, end), meaning only the first OE will be marked as truncated. The proper fix here is to make EOF handling block-by-block, not trying to handle the whole range to @end. By this we always locate and truncate the OE for every dirty block. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 5037b342825df7094a4906d1e2a9674baab50cb2 Author: Robbie Ko Date: Thu Dec 11 13:30:33 2025 +0800 btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering whether the given transaction type actually needs to wait for that particular transaction state. The btrfs_blocked_trans_types[] array already defines which transaction types should wait for which transaction states, but this check was missing in wait_current_trans(). This can lead to a deadlock scenario involving two transactions and pending ordered extents: 1. Transaction A is in TRANS_STATE_COMMIT_DOING state 2. A worker processing an ordered extent calls start_transaction() with TRANS_JOIN 3. join_transaction() returns -EBUSY because Transaction A is in TRANS_STATE_COMMIT_DOING 4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes 5. A new Transaction B is created (TRANS_STATE_RUNNING) 6. The ordered extent from step 2 is added to Transaction B's pending ordered extents 7. Transaction B immediately starts commit by another task and enters TRANS_STATE_COMMIT_START 8. The worker finally reaches wait_current_trans(), sees Transaction B in TRANS_STATE_COMMIT_START (a blocked state), and waits unconditionally 9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START according to btrfs_blocked_trans_types[] 10. Transaction B is waiting for pending ordered extents to complete 11. Deadlock: Transaction B waits for ordered extent, ordered extent waits for Transaction B This can be illustrated by the following call stacks: CPU0 CPU1 btrfs_finish_ordered_io() start_transaction(TRANS_JOIN) join_transaction() # -EBUSY (Transaction A is # TRANS_STATE_COMMIT_DOING) # Transaction A completes # Transaction B created # ordered extent added to # Transaction B's pending list btrfs_commit_transaction() # Transaction B enters # TRANS_STATE_COMMIT_START # waiting for pending ordered # extents wait_current_trans() # waits for Transaction B # (should not wait!) Task bstore_kv_sync in btrfs_commit_transaction waiting for ordered extents: __schedule+0x2e7/0x8a0 schedule+0x64/0xe0 btrfs_commit_transaction+0xbf7/0xda0 [btrfs] btrfs_sync_file+0x342/0x4d0 [btrfs] __x64_sys_fdatasync+0x4b/0x80 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Task kworker in wait_current_trans waiting for transaction commit: Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs] __schedule+0x2e7/0x8a0 schedule+0x64/0xe0 wait_current_trans+0xb0/0x110 [btrfs] start_transaction+0x346/0x5b0 [btrfs] btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs] btrfs_work_helper+0xe8/0x350 [btrfs] process_one_work+0x1d3/0x3c0 worker_thread+0x4d/0x3e0 kthread+0x12d/0x150 ret_from_fork+0x1f/0x30 Fix this by passing the transaction type to wait_current_trans() and checking btrfs_blocked_trans_types[cur_trans->state] against the given type before deciding to wait. This ensures that transaction types which are allowed to join during certain blocked states will not unnecessarily wait and cause deadlocks. Reviewed-by: Filipe Manana Signed-off-by: Robbie Ko Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f157dd661339fc6f5f2b574fe2429c43bd309534 Author: Miquel Sabaté Solà Date: Tue Oct 21 11:11:25 2025 +0200 btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the next check that we do in btrfs_evict_inode(). Hence, we either should set the ->root_objectid to 0 in case the root is NULL, or we move tracing setup after checking that the root is not NULL. Setting the rootid to 0 at least gives us the possibility to trace this call even in the case when the root is NULL, so that's the solution taken here. Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs") Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8 Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit 68d4b3fa18d72b7f649e83012e7e08f1881f6b75 Author: Qu Wenruo Date: Thu Dec 4 14:38:23 2025 +1030 btrfs: qgroup: update all parent qgroups when doing quick inherit [BUG] There is a bug that if a subvolume has multi-level parent qgroups, and is able to do a quick inherit, only the direct parent qgroup got updated: mkfs.btrfs -f -O quota $dev mount $dev $mnt btrfs subv create $mnt/subv1 btrfs qgroup create 1/100 $mnt btrfs qgroup create 2/100 $mnt btrfs qgroup assign 1/100 2/100 $mnt btrfs qgroup assign 0/256 1/100 $mnt btrfs qgroup show -p --sync $mnt Qgroupid Referenced Exclusive Parent Path -------- ---------- --------- ------ ---- 0/5 16.00KiB 16.00KiB - 0/256 16.00KiB 16.00KiB 1/100 subv1 1/100 16.00KiB 16.00KiB 2/100 2/100<1 member qgroup> 2/100 16.00KiB 16.00KiB - <0 member qgroups> btrfs subv snap -i 1/100 $mnt/subv1 $mnt/snap1 btrfs qgroup show -p --sync $mnt Qgroupid Referenced Exclusive Parent Path -------- ---------- --------- ------ ---- 0/5 16.00KiB 16.00KiB - 0/256 16.00KiB 16.00KiB 1/100 subv1 0/257 16.00KiB 16.00KiB 1/100 snap1 1/100 32.00KiB 32.00KiB 2/100 2/100<1 member qgroup> 2/100 16.00KiB 16.00KiB - <0 member qgroups> # Note that 2/100 is not updated, and qgroup numbers are inconsistent umount $mnt [CAUSE] If the snapshot source subvolume belongs to a parent qgroup, and the new snapshot target is also added to the new same parent qgroup, we allow a quick update without marking qgroup inconsistent. But that quick update only update the parent qgroup, without checking if there is any more parent qgroups. [FIX] Iterate through all parent qgroups during the quick inherit. Reported-by: Boris Burkov Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent") Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 7ee19a59a75e3d5b9ec00499b86af8e2a46fbe86 Author: Boris Burkov Date: Mon Dec 1 12:47:14 2025 -0800 btrfs: fix qgroup_snapshot_quick_inherit() squota bug qgroup_snapshot_quick_inherit() detects conditions where the snapshot destination would land in the same parent qgroup as the snapshot source subvolume. In this case we can avoid costly qgroup calculations and just add the nodesize of the new snapshot to the parent. However, in the case of squotas this is actually a double count, and also an undercount for deeper qgroup nestings. The following annotated script shows the issue: btrfs quota enable --simple "$mnt" # Create 2-level qgroup hierarchy btrfs qgroup create 2/100 "$mnt" # Q2 (level 2) btrfs qgroup create 1/100 "$mnt" # Q1 (level 1) btrfs qgroup assign 1/100 2/100 "$mnt" # Create base subvolume btrfs subvolume create "$mnt/base" >/dev/null base_id=$(btrfs subvolume show "$mnt/base" | grep 'Subvolume ID:' | awk '{print $3}') # Create intermediate snapshot and add to Q1 btrfs subvolume snapshot "$mnt/base" "$mnt/intermediate" >/dev/null inter_id=$(btrfs subvolume show "$mnt/intermediate" | grep 'Subvolume ID:' | awk '{print $3}') btrfs qgroup assign "0/$inter_id" 1/100 "$mnt" # Create working snapshot with --inherit (auto-adds to Q1) # src=intermediate (in only Q1) # dst=snap (inheriting only into Q1) # This double counts the 16k nodesize of the snapshot in Q1, and # undercounts it in Q2. btrfs subvolume snapshot -i 1/100 "$mnt/intermediate" "$mnt/snap" >/dev/null snap_id=$(btrfs subvolume show "$mnt/snap" | grep 'Subvolume ID:' | awk '{print $3}') # Fully complete snapshot creation sync # Delete working snapshot # Q1 and Q2 will lose the full snap usage btrfs subvolume delete "$mnt/snap" >/dev/null # Delete intermediate and remove from Q1 # Q1 and Q2 will lose the full intermediate usage btrfs qgroup remove "0/$inter_id" 1/100 "$mnt" btrfs subvolume delete "$mnt/intermediate" >/dev/null # Q1 should be at 0, but still has 16k. Q2 is "correct" at 0 (for now...) # Trigger cleaner, wait for deletions mount -o remount,sync=1 "$mnt" btrfs subvolume sync "$mnt" "$snap_id" btrfs subvolume sync "$mnt" "$inter_id" # Remove Q1 from Q2 # Frees 16k more from Q2, underflowing it to 16EiB btrfs qgroup remove 1/100 2/100 "$mnt" # And show the bad state: btrfs qgroup show -pc "$mnt" Qgroupid Referenced Exclusive Parent Child Path -------- ---------- --------- ------ ----- ---- 0/5 16.00KiB 16.00KiB - - 0/256 16.00KiB 16.00KiB - - base 1/100 16.00KiB 16.00KiB - - <0 member qgroups> 2/100 16.00EiB 16.00EiB - - <0 member qgroups> Fix this by simply not doing this quick inheritance with squotas. I suspect that it is also wrong in normal qgroups to not recurse up the qgroup tree in the quick inherit case, though other consistency checks will likely fix it anyway. Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent") Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit e3b88652b66b6b899eb1049694b214267b4e6c79 Merge: 544c0494cdb373 91b7f7d0eedaaa Author: Mark Brown Date: Tue Dec 16 20:57:21 2025 +0000 ASoC: Intel: common / SOF: Use function topologies for Merge series from Peter Ujfalusi : support for NVL-S and the support using functional topology fragments for Soundwire configurations is introduced in 6.19-rc1 in parallel. The SOF projects plan is to not create individual topology files for NVL as with SDCA and the functional topology support can handle most if not all soundwire devices going forward. However one issue have been identified with the functional topology only support, which was masked by the presence of a single topology file: if the device contains a dai link for which we don't have topology fragment, then the probe will fail. This worked with a fallback to a monolithic topology file - which made the dai link to be ignored. The first patch in the series adds a flag to instruct the function discovery to make a best effort to form a card by ignoring functions without corresponding fragment (and print this out for developers) in case there is no fallback topology available. The second patch removes the match entry to refer to a topology file which will not be built by the SOF project. commit 969faea4e9d01787c58bab4d945f7ad82dad222d Author: Brian Kocoloski Date: Thu Nov 20 13:57:19 2025 -0500 drm/amdkfd: Fix improper NULL termination of queue restore SMI event string Pass character "0" rather than NULL terminator to properly format queue restoration SMI events. Currently, the NULL terminator precedes the newline character that is intended to delineate separate events in the SMI event buffer, which can break userspace parsers. Signed-off-by: Brian Kocoloski Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 6e7143e5e6e21f9d5572e0390f7089e6d53edf3c) commit 7a372e214f6b814253e940334ab6eabb5181fc6f Author: mythilam Date: Thu Dec 4 11:04:12 2025 +0530 drm/amd/pm: restore SCLK settings after S0ix resume User-configured SCLK(GPU core clock)frequencies were not persisting across S0ix suspend/resume cycles on smu v14 hardware. The issue occurred because of the code resetting clock frequency to zero during resume. This patch addresses the problem by: - Preserving user-configured values in driver and sets the clock frequency across resume - Preserved settings are sent to the hardware during resume Signed-off-by: mythilam Acked-by: Alex Deucher Reviewed-by: Yang Wang Signed-off-by: Alex Deucher (cherry picked from commit 20ba98326f4c69e6bf8d1f42942ece485a675b27) commit 77f73253015cbc7893fca1821ac3eae9eb4bc943 Author: Alex Deucher Date: Wed Dec 10 11:02:30 2025 -0500 drm/amdgpu: fix a job->pasid access race in gpu recovery Avoid a possible UAF in GPU recovery due to a race between the sched timeout callback and the tdr work queue. The gpu recovery function calls drm_sched_stop() and later drm_sched_start(). drm_sched_start() restarts the tdr queue which will eventually free the job. If the tdr queue frees the job before time out callback completes, the job will be freed and we'll get a UAF when accessing the pasid. Cache it early to avoid the UAF. Example KASAN trace: [ 493.058141] BUG: KASAN: slab-use-after-free in amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.067530] Read of size 4 at addr ffff88b0ce3f794c by task kworker/u128:1/323 [ 493.074892] [ 493.076485] CPU: 9 UID: 0 PID: 323 Comm: kworker/u128:1 Tainted: G E 6.16.0-1289896.2.zuul.bf4f11df81c1410bbe901c4373305a31 #1 PREEMPT(voluntary) [ 493.076493] Tainted: [E]=UNSIGNED_MODULE [ 493.076495] Hardware name: TYAN B8021G88V2HR-2T/S8021GM2NR-2T, BIOS V1.03.B10 04/01/2019 [ 493.076500] Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched] [ 493.076512] Call Trace: [ 493.076515] [ 493.076518] dump_stack_lvl+0x64/0x80 [ 493.076529] print_report+0xce/0x630 [ 493.076536] ? _raw_spin_lock_irqsave+0x86/0xd0 [ 493.076541] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 493.076545] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.077253] kasan_report+0xb8/0xf0 [ 493.077258] ? amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.077965] amdgpu_device_gpu_recover+0x968/0x990 [amdgpu] [ 493.078672] ? __pfx_amdgpu_device_gpu_recover+0x10/0x10 [amdgpu] [ 493.079378] ? amdgpu_coredump+0x1fd/0x4c0 [amdgpu] [ 493.080111] amdgpu_job_timedout+0x642/0x1400 [amdgpu] [ 493.080903] ? pick_task_fair+0x24e/0x330 [ 493.080910] ? __pfx_amdgpu_job_timedout+0x10/0x10 [amdgpu] [ 493.081702] ? _raw_spin_lock+0x75/0xc0 [ 493.081708] ? __pfx__raw_spin_lock+0x10/0x10 [ 493.081712] drm_sched_job_timedout+0x1b0/0x4b0 [gpu_sched] [ 493.081721] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 493.081725] process_one_work+0x679/0xff0 [ 493.081732] worker_thread+0x6ce/0xfd0 [ 493.081736] ? __pfx_worker_thread+0x10/0x10 [ 493.081739] kthread+0x376/0x730 [ 493.081744] ? __pfx_kthread+0x10/0x10 [ 493.081748] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 493.081751] ? __pfx_kthread+0x10/0x10 [ 493.081755] ret_from_fork+0x247/0x330 [ 493.081761] ? __pfx_kthread+0x10/0x10 [ 493.081764] ret_from_fork_asm+0x1a/0x30 [ 493.081771] Fixes: a72002cb181f ("drm/amdgpu: Make use of drm_wedge_task_info") Link: https://github.com/HansKristian-Work/vkd3d-proton/pull/2670 Cc: SRINIVASAN.SHANMUGAM@amd.com Cc: vitaly.prosyak@amd.com Cc: christian.koenig@amd.com Suggested-by: Matthew Brost Reviewed-by: Srinivasan Shanmugam Reviewed-by: Lijo Lazar Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit 20880a3fd5dd7bca1a079534cf6596bda92e107d) commit b0101ccb5b4641885f30fecc352ef891ed06e083 Author: Liang Jie Date: Tue Dec 16 17:39:55 2025 +0800 sched_ext: fix uninitialized ret on alloc_percpu() failure Smatch reported: kernel/sched/ext.c:5332 scx_alloc_and_add_sched() warn: passing zero to 'ERR_PTR' In scx_alloc_and_add_sched(), the alloc_percpu() failure path jumps to err_free_gdsqs without initializing @ret. That can lead to returning ERR_PTR(0), which violates the ERR_PTR() convention and confuses callers. Set @ret to -ENOMEM before jumping to the error path when alloc_percpu() fails. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202512141601.yAXDAeA9-lkp@intel.com/ Reported-by: Dan Carpenter Fixes: c201ea1578d3 ("sched_ext: Move event_stats_cpu into scx_sched") Signed-off-by: Liang Jie Reviewed-by: Emil Tsalapatis Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 3886b198bd6e49c801fe9552fcfbfc387a49fbbc Author: Charlene Liu Date: Fri Nov 28 19:38:31 2025 -0500 drm/amd/display: Fix DP no audio issue [why] need to enable APG_CLOCK_ENABLE enable first also need to wake up az from D3 before access az block Reviewed-by: Swapnil Patel Signed-off-by: Charlene Liu Signed-off-by: Chenyu Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit bf5e396957acafd46003318965500914d5f4edfa) commit fd62aa13d3ee0f21c756a40a7c2f900f98992d6a Author: Ray Wu Date: Fri Nov 28 09:14:09 2025 +0800 drm/amd/display: Fix scratch registers offsets for DCN351 [Why] Different platforms use different NBIO header files, causing display code to use differnt offset and read wrong accelerated status. [How] - Unified NBIO offset header file across platform. - Correct scratch registers offsets to proper locations. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4667 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Mario Limonciello Signed-off-by: Ray Wu Signed-off-by: Chenyu Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 576e032e909c8a6bb3d907b4ef5f6abe0f644199) Cc: stable@vger.kernel.org commit 69741d9ccc7222e6b6f138db67b012ecc0d72542 Author: Ray Wu Date: Fri Nov 28 08:58:13 2025 +0800 drm/amd/display: Fix scratch registers offsets for DCN35 [Why] Different platforms use differnet NBIO header files, causing display code to use differnt offset and read wrong accelerated status. [How] - Unified NBIO offset header file across platform. - Correct scratch registers offsets to proper locations. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4667 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Mario Limonciello Signed-off-by: Ray Wu Signed-off-by: Chenyu Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 49a63bc8eda0304ba307f5ba68305f936174f72d) Cc: stable@vger.kernel.org commit 244a07c4862d5a2e3efd56241dc979ebf2b798a4 Author: Mario Limonciello (AMD) Date: Tue Dec 9 16:00:29 2025 -0600 drm/amd: Resume the device in thaw() callback when console suspend is disabled If console suspend has been disabled using `no_console_suspend` also wake up during thaw() so that some messages can be seen for debugging. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4191 Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 63387cbbb714d9f0d179d9d4560de1408d0906de) commit 81d90d93d22ca4f61833cba921dce9a0bd82218f Author: Yao Zi Date: Thu Dec 4 12:32:04 2025 +0000 wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP Since commit dfb073d32cac ("ptp: Return -EINVAL on ptp_clock_register if required ops are NULL"), PTP clock registered through ptp_clock_register is required to have ptp_clock_info.settime64 set, however, neither MVM nor MLD's PTP clock implementation sets it, resulting in warnings when the interface starts up, like WARNING: drivers/ptp/ptp_clock.c:325 at ptp_clock_register+0x2c8/0x6b8, CPU#1: wpa_supplicant/469 CPU: 1 UID: 0 PID: 469 Comm: wpa_supplicant Not tainted 6.18.0+ #101 PREEMPT(full) ra: ffff800002732cd4 iwl_mvm_ptp_init+0x114/0x188 [iwlmvm] ERA: 9000000002fdc468 ptp_clock_register+0x2c8/0x6b8 iwlwifi 0000:01:00.0: Failed to register PHC clock (-22) I don't find an appropriate firmware interface to implement settime64() for iwlwifi MLD/MVM, thus instead create a stub that returns -EOPTNOTSUPP only, suppressing the warning and allowing the PTP clock to be registered. Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20251108044822.GA3262936@ax162/ Signed-off-by: Yao Zi Tested-by: Nathan Chancellor Reviewed-by: Simon Horman tested-by: damian Tometzki damian@riscv-rocks.de Tested-by: Oliver Hartkopp Acked-by: Miri Korenblit Link: https://patch.msgid.link/20251204123204.9316-1-ziyao@disroot.org Signed-off-by: Johannes Berg commit ca5898222914f399797cea1aeb0ce77109ca2e62 Author: Ville Syrjälä Date: Fri Nov 14 00:28:52 2025 +0200 wifi: iwlwifi: Fix firmware version handling On my system the arithmetic done on the firmware numbers results in a negative number, but since the types are unsigned it gets interpreted as a large positive number. The end result is that the firmware gets rejected and wifi is defunct. Switch to signed types to handle this case correctly. iwlwifi 0000:0c:00.0: Driver unable to support your firmware API. Driver supports FW core 4294967294..2, firmware is 2. iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-4.ucode failed with error -2 iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-3.ucode failed with error -2 iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-2.ucode failed with error -2 iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-1.ucode failed with error -2 iwlwifi 0000:0c:00.0: no suitable firmware found! iwlwifi 0000:0c:00.0: minimum version required: iwlwifi-5000-1 iwlwifi 0000:0c:00.0: maximum version supported: iwlwifi-5000-5 iwlwifi 0000:0c:00.0: check git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git Cc: stable@vger.kernel.org Fixes: 5f708cccde9d ("wifi: iwlwifi: add a new FW file numbering scheme") Signed-off-by: Ville Syrjälä Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220805 Link: https://patch.msgid.link/20251113222852.15896-1-ville.syrjala@linux.intel.com Signed-off-by: Johannes Berg commit 54de247a0efa4c6176ba6840a58e2fb0b2130e2d Author: Linus Walleij Date: Tue Dec 16 10:52:10 2025 +0100 dt-bindings: Updates Linus Walleij's mail address My name is stamped into maintainership for a big slew of DT bindings. Now that it is changing, switch it over to my kernel.org mail address, which will hopefully be stable for the rest of my life. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251216-maintainers-dt-v1-1-0b5ab102c9bb@kernel.org Signed-off-by: Rob Herring (Arm) commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 Author: Biju Das Date: Thu Nov 13 19:50:48 2025 +0000 dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() After audio full duplex testing, playing the recorded file contains a few playback frames from the previous time. The rz_dmac_terminate_all() does not reset all the hardware descriptors queued previously, leading to the wrong descriptor being picked up during the next DMA transfer. Fix the above issue by resetting all the descriptor headers for a channel in rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg(). Cc: stable@kernel.org Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC") Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Reviewed-by: Claudiu Beznea Tested-by: Claudiu Beznea Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit e6a973af11135439de32ece3b9cbe3bfc043bea8 Author: Jason Gunthorpe Date: Tue Dec 16 11:53:40 2025 -0400 iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST. Validate the user input length in the test ioctl. Fixes: f4b20bb34c83 ("iommufd: Add kernel support for testing iommufd") Link: https://patch.msgid.link/r/0-v1-cd99f6049ba5+51-iommufd_syz_add_resv_jgg@nvidia.com Reviewed-by: Samiullah Khawaja Reviewed-by: Kevin Tian Tested-by: Yi Liu Reported-by: syzbot+57fdb0cf6a0c5d1f15a2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69368129.a70a0220.38f243.008f.GAE@google.com Signed-off-by: Jason Gunthorpe commit c0732fe78728718c853ef8e7af5bbb05262acbd1 Author: Suraj Gupta Date: Wed Oct 22 00:00:06 2025 +0530 dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing When device tree lacks optional "xlnx,addrwidth" property, the addr_width variable remained uninitialized with garbage values, causing incorrect DMA mask configuration and subsequent probe failure. The fix ensures a fallback to the default 32-bit address width when this property is missing. Signed-off-by: Suraj Gupta Fixes: b72db4005fe4 ("dmaengine: vdma: Add 64 bit addressing support to the driver") Reviewed-by: Radhey Shyam Pandey Reviewed-by: Folker Schwesinger Link: https://patch.msgid.link/20251021183006.3434495-1-suraj.gupta2@amd.com Signed-off-by: Vinod Koul commit 2efd07a7c36949e6fa36a69183df24d368bf9e96 Author: Sheetal Date: Mon Nov 10 19:54:45 2025 +0530 dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree() 3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs. Fix this by properly synchronizing the virtual channel completion: - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor. - Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors. Crash logs: [ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0 [ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8 Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA") Signed-off-by: Sheetal Acked-by: Thierry Reding Link: https://patch.msgid.link/20251110142445.3842036-1-sheetal@nvidia.com Signed-off-by: Vinod Koul commit b18cd8b210417f90537d914ffb96e390c85a7379 Author: Zhen Ni Date: Tue Oct 14 17:05:22 2025 +0800 dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure When fsl_edma_alloc_chan_resources() fails after clk_prepare_enable(), the error paths only free IRQs and destroy the TCD pool, but forget to call clk_disable_unprepare(). This causes the channel clock to remain enabled, leaking power and resources. Fix it by disabling the channel clock in the error unwind path. Fixes: d8d4355861d8 ("dmaengine: fsl-edma: add i.MX8ULP edma support") Cc: stable@vger.kernel.org Suggested-by: Frank Li Signed-off-by: Zhen Ni Reviewed-by: Frank Li Link: https://patch.msgid.link/20251014090522.827726-1-zhen.ni@easystack.cn Signed-off-by: Vinod Koul commit a143545855bc2c6e1330f6f57ae375ac44af00a7 Author: Guodong Xu Date: Tue Dec 16 22:10:06 2025 +0800 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet() -> spin_lock(&desc_lock) list_move(sw->node, ...) spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1). Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock. Signed-off-by: Juan Li Signed-off-by: Guodong Xu Link: https://patch.msgid.link/20251216-mmp-pdma-race-v1-1-976a224bb622@riscstar.com Signed-off-by: Vinod Koul commit 67549b73f10b85172a0cbb1109904542b97e6177 Author: Niklas Söderlund Date: Thu Nov 6 22:23:41 2025 +0100 dt-bindings: gpu: img,powervr-rogue: Document GE7800 GPU in Renesas R-Car V3U Document Imagination Technologies PowerVR Rogue GE7800 BNVC 15.5.1.64 present in Renesas R-Car R8A779A0 V3U SoC. Signed-off-by: Niklas Söderlund Reviewed-by: Marek Vasut Reviewed-by: Matt Coster Reviewed-by: Geert Uytterhoeven Acked-by: Conor Dooley Link: https://patch.msgid.link/20251106212342.2771579-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Rob Herring (Arm) commit 0f5796dac1bb7e3b8a36eec54e3a2c6bf70aa414 Author: Krzysztof Kozlowski Date: Wed Dec 10 06:17:19 2025 +0100 cpufreq: dt-platdev: Fix creating device on OPPv1 platforms Commit 6ea891a6dd37 ("cpufreq: dt-platdev: Simplify with of_machine_get_match_data()") broke several platforms which did not have OPPv2 proprety, because it incorrectly checked for device match data after first matching from "allowlist". Almost all of "allowlist" match entries do not have match data and it is expected to create platform device for them with empty data. Fix this by first checking if platform is on the allowlist with of_machine_device_match() and only then taking the match data. This duplicates the number of checks (we match against the allowlist twice), but makes the code here much smaller. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdVJD4+J9QpUUs-sX0feKfuPD72CO0dcqN7shvF_UYpZ3Q@mail.gmail.com/ Reported-by: Pavel Pisa Closes: https://lore.kernel.org/all/6hnk7llbwdezh74h74fhvofbx4t4jihel5kvr6qwx2xuxxbjys@rmwbd7lkhrdz/ Fixes: 6ea891a6dd37 ("cpufreq: dt-platdev: Simplify with of_machine_get_match_data()") Signed-off-by: Krzysztof Kozlowski Tested-by: Pavel Pisa Acked-by: Viresh Kumar Link: https://patch.msgid.link/20251210051718.132795-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) commit 512e1568562b2a19f4b175607062c8e97c9203ec Author: Rob Herring (Arm) Date: Wed Oct 29 10:56:13 2025 -0500 dt-bindings: clock: sprd,sc9860-clk: Allow "reg" for gate clocks The gate bindings have an artificial split between a "syscon" and clock provider node. Allow "reg" properties so this split can be removed. Reviewed-by: Chunyan Zhang Link: https://patch.msgid.link/20251029155615.1167903-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 7fff398df4c44529bde2183a959bd77123fbac98 Author: Krzysztof Kozlowski Date: Sat Nov 15 13:21:21 2025 +0100 dt-bindings: display/ti: Simplify dma-coherent property Common boolean properties need to be only allowed in the binding (":true"), because their type is already defined by core DT schema. Simplify dma-coherent property to match common syntax. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251115122120.35315-4-krzk@kernel.org Signed-off-by: Rob Herring (Arm) commit 3e8ade58b71b48913d21b647b2089e03e81f117e Author: Jianpeng Chang Date: Fri Dec 5 09:59:34 2025 +0800 arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder Commit 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed") changed the processing order of reserved memory regions, causing elfcorehdr to overlap with dynamically allocated reserved memory regions during kdump kernel boot. The issue occurs because: 1. kexec-tools allocates elfcorehdr in the last crashkernel reserved memory region and passes it to the second kernel 2. The problematic commit moved dynamic reserved memory allocation (like bman-fbpr) to occur during fdt_scan_reserved_mem(), before elfcorehdr reservation in fdt_reserve_elfcorehdr() 3. bman-fbpr with 16MB alignment requirement can get allocated at addresses that overlap with the elfcorehdr location 4. When fdt_reserve_elfcorehdr() tries to reserve elfcorehdr memory, overlap detection identifies the conflict and skips reservation 5. kdump kernel fails with "Unable to handle kernel paging request" because elfcorehdr memory is not properly reserved The boot log: Before 8a6e02d0c00e: OF: fdt: Reserving 1 KiB of memory at 0xf4fff000 for elfcorehdr OF: reserved mem: 0xf3000000..0xf3ffffff bman-fbpr After 8a6e02d0c00e: OF: reserved mem: 0xf4000000..0xf4ffffff bman-fbpr OF: fdt: elfcorehdr is overlapped Fix this by ensuring elfcorehdr reservation occurs before dynamic reserved memory allocation. Fixes: 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed") Signed-off-by: Jianpeng Chang Link: https://patch.msgid.link/20251205015934.700016-1-jianpeng.chang.cn@windriver.com Signed-off-by: Rob Herring (Arm) commit b58c87b0fde0ac06d550659a7e3ddbcd9183b7b9 Author: Alexandre Courbot Date: Tue Dec 16 11:57:10 2025 +0900 gpu: nova-core: gsp: replace firmware version with "bindings" alias We have an "bindings" alias to avoid having to mention the firmware version again and again, and limit the diff when upgrading the firmware. Use it where we neglected to. Fixes: eaf0989c77e4 ("gpu: nova-core: Add bindings required by GSP sequencer") Reviewed-by: Lyude Paul Reviewed-by: Joel Fernandes Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251216-nova-fixes-v3-4-c7469a71f7c4@nvidia.com Signed-off-by: Alexandre Courbot commit 523317152c4b1b3187d14c65ceacdfc0da451931 Author: Alexandre Courbot Date: Tue Dec 16 11:57:09 2025 +0900 gpu: nova-core: bindings: derive `MaybeZeroable` Commit 4846300ba8f9 ("rust: derive `Zeroable` for all structs & unions generated by bindgen where possible") automatically derives `MaybeZeroable` for all bindings. This is better than selectively deriving `Zeroable` as it ensures all types that can implement `Zeroable` do. Regenerate the nova-core bindings so they benefit from this, and remove a now unneeded implementation of `Zeroable`. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Reviewed-by: Lyude Paul Reviewed-by: Joel Fernandes Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251216-nova-fixes-v3-3-c7469a71f7c4@nvidia.com Signed-off-by: Alexandre Courbot commit 9d250ab0cf80deb11148efe862d1184ebf5115f6 Author: Alexandre Courbot Date: Tue Dec 16 11:57:08 2025 +0900 gpu: nova-core: gsp: fix length of received messages The size of messages' payload is miscalculated, leading to extra data passed to the message handler. While this is not a problem with our current set of commands, others with a variable-length payload may misbehave. Fix this by introducing a method returning the payload size and using it. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Reviewed-by: Lyude Paul Reviewed-by: Joel Fernandes Reviewed-by: Alistair Popple Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251216-nova-fixes-v3-2-c7469a71f7c4@nvidia.com [acourbot@nvidia.com: update `PANIC:` comments as pointed out by Joel.] Signed-off-by: Alexandre Courbot commit b6c76518233e876a0f26e66b83643891c0f341db Author: Alexandre Courbot Date: Tue Dec 16 11:57:07 2025 +0900 gpu: nova-core: bindings: add missing explicit padding Explicit padding is needed in order to avoid uninitialized bytes and safely implement `AsBytes`. The `--explicit-padding` of bindgen was omitted by mistake when these bindings were generated. Fixes: 13f85988d4fa ("gpu: nova-core: gsp: Retrieve GSP static info to gather GPU information") Reviewed-by: Lyude Paul Reviewed-by: Joel Fernandes Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251216-nova-fixes-v3-1-c7469a71f7c4@nvidia.com Signed-off-by: Alexandre Courbot commit 3d3352e73a55a4ccf110f8b3419bbe2fbfd8a030 Author: Alexandre Courbot Date: Wed Nov 5 09:40:09 2025 +0900 gpu: nova-core: select RUST_FW_LOADER_ABSTRACTIONS RUST_FW_LOADER_ABSTRACTIONS was depended on by NOVA_CORE, but NOVA_CORE is selected by DRM_NOVA. This creates a situation where, if DRM_NOVA is selected, NOVA_CORE gets enabled but not RUST_FW_LOADER_ABSTRACTIONS, which results in a build error. Since the firmware loader is an implementation detail of the driver, it should be enabled along with it, so change the "depends on" to a "select". Fixes: 54e6baf123fd ("gpu: nova-core: add initial driver stub") Closes: https://lore.kernel.org/oe-kbuild-all/202512061721.rxKGnt5q-lkp@intel.com/ Tested-by: Alyssa Ross Acked-by: Danilo Krummrich Link: https://patch.msgid.link/20251106-b4-select-rust-fw-v3-2-771172257755@nvidia.com Signed-off-by: Alexandre Courbot commit d8932355f8c5673106eca49abd142f8fe0c1fe8b Author: FUJITA Tomonori Date: Fri Dec 5 01:06:39 2025 +0900 rust: dma: add helpers for architectures without CONFIG_HAS_DMA Add dma_set_mask(), dma_set_coherent_mask(), dma_map_sgtable(), and dma_max_mapping_size() helpers to fix a build error when CONFIG_HAS_DMA is not enabled. Note that when CONFIG_HAS_DMA is enabled, they are included in both bindings_generated.rs and bindings_helpers_generated.rs. The former takes precedence so behavior remains unchanged in that case. This fixes the following build error on UML: error[E0425]: cannot find function `dma_set_mask` in crate `bindings` --> rust/kernel/dma.rs:46:38 | 46 | to_result(unsafe { bindings::dma_set_mask(self.as_ref().as_raw(), mask.value()) }) | ^^^^^^^^^^^^ help: a function with a similar name exists: `xa_set_mark` | ::: rust/bindings/bindings_generated.rs:24690:5 | 24690 | pub fn xa_set_mark(arg1: *mut xarray, index: ffi::c_ulong, arg2: xa_mark_t); | ---------------------------------------------------------------------------- similarly named function `xa_set_mark` defined here error[E0425]: cannot find function `dma_set_coherent_mask` in crate `bindings` --> rust/kernel/dma.rs:63:38 | 63 | to_result(unsafe { bindings::dma_set_coherent_mask(self.as_ref().as_raw(), mask.value()) }) | ^^^^^^^^^^^^^^^^^^^^^ help: a function with a similar name exists: `dma_coherent_ok` | ::: rust/bindings/bindings_generated.rs:52745:5 | 52745 | pub fn dma_coherent_ok(dev: *mut device, phys: phys_addr_t, size: usize) -> bool_; | ---------------------------------------------------------------------------------- similarly named function `dma_coherent_ok` defined here error[E0425]: cannot find function `dma_map_sgtable` in crate `bindings` --> rust/kernel/scatterlist.rs:212:23 | 212 | bindings::dma_map_sgtable(dev.as_raw(), sgt.as_ptr(), dir.into(), 0) | ^^^^^^^^^^^^^^^ help: a function with a similar name exists: `dma_unmap_sgtable` | ::: rust/bindings/bindings_helpers_generated.rs:1351:5 | 1351 | / pub fn dma_unmap_sgtable( 1352 | | dev: *mut device, 1353 | | sgt: *mut sg_table, 1354 | | dir: dma_data_direction, 1355 | | attrs: ffi::c_ulong, 1356 | | ); | |______- similarly named function `dma_unmap_sgtable` defined here error[E0425]: cannot find function `dma_max_mapping_size` in crate `bindings` --> rust/kernel/scatterlist.rs:356:52 | 356 | let max_segment = match unsafe { bindings::dma_max_mapping_size(dev.as_raw()) } { | ^^^^^^^^^^^^^^^^^^^^ not found in `bindings` error: aborting due to 4 previous errors Cc: stable@vger.kernel.org # v6.17+ Fixes: 101d66828a4ee ("rust: dma: add DMA addressing capabilities") Signed-off-by: FUJITA Tomonori Reviewed-by: David Gow Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251204160639.364936-1-fujita.tomonori@gmail.com [ Use relative paths in the error splat; add 'dma' prefix. - Danilo ] Signed-off-by: Danilo Krummrich commit 359afc8eb02a518fbdd0cbd462c8c2827c6cbec2 Author: Rafael J. Wysocki Date: Mon Dec 15 15:21:34 2025 +0100 PM: runtime: Do not clear needs_force_resume with enabled runtime PM Commit 89d9cec3b1e9 ("PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()") added provisional clearing of power.needs_force_resume to pm_runtime_reinit(), but it is done unconditionally which is a mistake because pm_runtime_reinit() may race with driver probing and removal [1]. To address this, notice that power.needs_force_resume should never be set when runtime PM is enabled and so it only needs to be cleared when runtime PM is disabled, and update pm_runtime_init() to only clear that flag when runtime PM is disabled. Fixes: 89d9cec3b1e9 ("PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()") Reported-by: Ed Tsai Closes: https://lore.kernel.org/linux-pm/20251215122154.3180001-1-ed.tsai@mediatek.com/ [1] Signed-off-by: Rafael J. Wysocki Cc: 6.17+ # 6.17+ Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/12807571.O9o76ZdvQC@rafael.j.wysocki commit 2bfca4fe1f36eb6618e5712a8b5b41433bb6f10b Author: Guido Günther Date: Fri Oct 17 10:27:59 2025 +0200 drm/panel: visionox-rm69299: Depend on BACKLIGHT_CLASS_DEVICE We handle backlight so need that dependency. Fixes: 7911d8cab554 ("drm/panel: visionox-rm69299: Add backlight support") Reported-by: kernelci.org bot Signed-off-by: Guido Günther Reviewed-by: Neil Armstrong Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: David Heidelberg Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251017-visionox-rm69299-bl-v2-1-9dfa06606754@sigxcpu.org commit ff4071c60018a668249dc6a2df7d16330543540e Author: Moon Hee Lee Date: Mon Dec 15 19:59:32 2025 -0800 wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only present after JOIN_OCB. RX may run before JOIN_OCB is executed, in which case the OCB interface is not operational. Skip RX peer handling when the interface is not joined to avoid warnings in the RX path. Reported-by: syzbot+b364457b2d1d4e4a3054@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b364457b2d1d4e4a3054 Tested-by: syzbot+b364457b2d1d4e4a3054@syzkaller.appspotmail.com Signed-off-by: Moon Hee Lee Link: https://patch.msgid.link/20251216035932.18332-1-moonhee.lee.ca@gmail.com Signed-off-by: Johannes Berg commit a519be2f5d958c5804f2cfd68f1f384291271fab Author: Aloka Dixit Date: Mon Dec 15 09:46:56 2025 -0800 wifi: mac80211: do not use old MBSSID elements When userspace brings down and deletes a non-transmitted profile, it is expected to send a new updated Beacon template for the transmitted profile of that multiple BSSID (MBSSID) group which does not include the removed profile in MBSSID element. This update comes via NL80211_CMD_SET_BEACON. Such updates work well as long as the group continues to have at least one non-transmitted profile as NL80211_ATTR_MBSSID_ELEMS is included in the new Beacon template. But when the last non-trasmitted profile is removed, it still gets included in Beacon templates sent to driver. This happens because when no MBSSID elements are sent by the userspace, ieee80211_assign_beacon() ends up using the element stored from earlier Beacon template. Do not copy old MBSSID elements, instead userspace should always include these when applicable. Fixes: 2b3171c6fe0a ("mac80211: MBSSID beacon handling in AP mode") Signed-off-by: Aloka Dixit Link: https://patch.msgid.link/20251215174656.2866319-2-aloka.dixit@oss.qualcomm.com Signed-off-by: Johannes Berg commit 99067b58a408a384d2a45c105eb3dce980a862ce Author: Johannes Berg Date: Tue Dec 2 10:25:11 2025 +0100 wifi: mac80211: don't WARN for connections on invalid channels It's not clear (to me) how exactly syzbot managed to hit this, but it seems conceivable that e.g. regulatory changed and has disabled a channel between scanning (channel is checked to be usable by cfg80211_get_ies_channel_number) and connecting on the channel later. With one scenario that isn't covered elsewhere described above, the warning isn't good, replace it with a (more informative) error message. Reported-by: syzbot+639af5aa411f2581ad38@syzkaller.appspotmail.com Link: https://patch.msgid.link/20251202102511.5a8fb5184fa3.I961ee41b8f10538a54b8565dbf03ec1696e80e03@changeid Signed-off-by: Johannes Berg commit e75665dd096819b1184087ba5718bd93beafff51 Author: Peter Åstrand Date: Wed Dec 3 08:57:08 2025 +0100 wifi: wlcore: ensure skb headroom before skb_push This avoids occasional skb_under_panic Oops from wl1271_tx_work. In this case, headroom is less than needed (typically 110 - 94 = 16 bytes). Signed-off-by: Peter Astrand Link: https://patch.msgid.link/097bd417-e1d7-acd4-be05-47b199075013@lysator.liu.se Signed-off-by: Johannes Berg commit 2b77b9551d1184cb5af8271ff350e6e2c1b3db0d Author: Dan Carpenter Date: Wed Dec 3 14:14:47 2025 +0300 wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() The QGenie AI code review tool says we should store the capped length to wdev->u.client.ssid_len. The AI is correct. Fixes: 62b635dcd69c ("wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aTAbp5RleyH_lnZE@stanley.mountain Signed-off-by: Johannes Berg commit cbf0dc37bb4e949f1c76566657e71f8e0bdcf338 Author: Dmitry Antipov Date: Thu Dec 4 16:05:33 2025 +0300 wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor() Since 'mon_list' of 'struct ieee80211_local' is RCU-protected and an instances of 'struct ieee80211_sub_if_data' are linked there via 'u.mntr.list' member, adjust the corresponding list iteration in 'ieee80211_add_virtual_monitor()' accordingly. Reported-by: syzbot+bc1aabf52d0a31e91f96@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bc1aabf52d0a31e91f96 Fixes: a5aa46f1ac4f ("wifi: mac80211: track MU-MIMO configuration on disabled interfaces") Signed-off-by: Dmitry Antipov Link: https://patch.msgid.link/20251204130533.340069-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg commit 7623cc423e8dc6ff8dc08d140e06c31bd10d519f Merge: 193d18f60588e9 0ff5e81e151886 Author: Johannes Berg Date: Tue Dec 16 10:20:28 2025 +0100 Merge tag 'rtw-2025-12-15' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw patches for v6.19-rc1 Fix two regressions of rtw88 and one existing issue that TID out of range in rtlwifi. ================== Signed-off-by: Johannes Berg commit 193d18f60588e95d62e0f82b6a53893e5f2f19f8 Author: Jouni Malinen Date: Mon Dec 15 17:11:34 2025 +0200 wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the Beacon .. frame shall be set to the broadcast address"). A unicast Beacon frame might be used as a targeted attack to get one of the associated STAs to do something (e.g., using CSA to move it to another channel). As such, it is better have strict filtering for this on the received side and discard all Beacon frames that are sent to an unexpected address. This is even more important for cases where beacon protection is used. The current implementation in mac80211 is correctly discarding unicast Beacon frames if the Protected Frame bit in the Frame Control field is set to 0. However, if that bit is set to 1, the logic used for checking for configured BIGTK(s) does not actually work. If the driver does not have logic for dropping unicast Beacon frames with Protected Frame bit 1, these frames would be accepted in mac80211 processing as valid Beacon frames even though they are not protected. This would allow beacon protection to be bypassed. While the logic for checking beacon protection could be extended to cover this corner case, a more generic check for discard all Beacon frames based on A1=unicast address covers this without needing additional changes. Address all these issues by dropping received Beacon frames if they are sent to a non-broadcast address. Cc: stable@vger.kernel.org Fixes: af2d14b01c32 ("mac80211: Beacon protection using the new BIGTK (STA)") Signed-off-by: Jouni Malinen Link: https://patch.msgid.link/20251215151134.104501-1-jouni.malinen@oss.qualcomm.com Signed-off-by: Johannes Berg commit 8dc15b7a6e5918bad2b0583cf63d170f94a212df Author: Christoph Hellwig Date: Mon Dec 15 07:05:46 2025 +0100 xfs: fix XFS_ERRTAG_FORCE_ZERO_RANGE for zoned file system The new XFS_ERRTAG_FORCE_ZERO_RANGE error tag added by commit ea9989668081 ("xfs: error tag to force zeroing on debug kernels") fails to account for the zoned space reservation rules and this reliably fails xfs/131 because the zeroing operation returns -EIO. Fix this by reserving enough space to zero the entire range, which requires a bit of (fairly ugly) reshuffling to do the error injection early enough to affect the space reservation. Fixes: ea9989668081 ("xfs: error tag to force zeroing on debug kernels") Signed-off-by: Christoph Hellwig Reviewed-by: Brian Foster Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 2f6d2c8d9ac05a7a1c02333f6ad30868246880d8 Author: Ziyang Huang Date: Tue Dec 2 23:05:56 2025 +0800 Revert "mtd: spinand: esmt: fix id code for F50D1G41LB" This reverts commit dd26402642a0899fde59ea6b0852fad3d799b4cc. The issue George met is due to the limit of QPIC, not the issue of the flash chip. QPIC only supports 4 bytes ID. So the fifth byte is always 0. If we use spi-gpio, the fifth byte can be read correctly. Signed-off-by: Ziyang Huang Signed-off-by: Miquel Raynal commit fc40459de82543b565ebc839dca8f7987f16f62e Author: Haoxiang Li Date: Wed Dec 10 17:06:01 2025 +0800 xfs: fix a memory leak in xfs_buf_item_init() xfs_buf_item_get_format() may allocate memory for bip->bli_formats, free the memory in the error path. Fixes: c3d5f0c2fb85 ("xfs: complain if anyone tries to create a too-large buffer log item") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit f06725052098d7b1133ac3846d693c383dc427a2 Author: Darrick J. Wong Date: Thu Dec 4 13:44:15 2025 -0800 xfs: fix stupid compiler warning gcc 14.2 warns about: xfs_attr_item.c: In function ‘xfs_attr_recover_work’: xfs_attr_item.c:785:9: warning: ‘ip’ may be used uninitialized [-Wmaybe-uninitialized] 785 | xfs_trans_ijoin(tp, ip, 0); | ^~~~~~~~~~~~~~~~~~~~~~~~~~ xfs_attr_item.c:740:42: note: ‘ip’ was declared here 740 | struct xfs_inode *ip; | ^~ I think this is bogus since xfs_attri_recover_work either returns a real pointer having initialized ip or an ERR_PTR having not touched it, but the tools are smarter than me so let's just null-init the variable anyway. Cc: stable@vger.kernel.org # v6.8 Fixes: e70fb328d52772 ("xfs: recreate work items when recovering intent items") Signed-off-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 5990fd756943836978ad184aac980e2b36ab7e01 Author: Darrick J. Wong Date: Thu Dec 4 13:43:50 2025 -0800 xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, which means that any reference to ab->value before the call could become a dangling pointer. Fix this by moving an assignment to after the buffer setup. Cc: stable@vger.kernel.org # v6.10 Fixes: e47dcf113ae348 ("xfs: repair extended attributes") Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 2145f447b79ab522667cbdbdab4525c903759f7c Author: Chaitanya Kulkarni Date: Mon Nov 24 15:48:06 2025 -0800 xfs: ignore discard return value __blkdev_issue_discard() always returns 0, making all error checking in XFS discard functions dead code. Change xfs_discard_extents() return type to void, remove error variable, error checking, and error logging for the __blkdev_issue_discard() call in same function. Update xfs_trim_perag_extents() and xfs_trim_rtgroup_extents() to ignore the xfs_discard_extents() return value and error checking code. Update xfs_discard_rtdev_extents() to ignore __blkdev_issue_discard() return value and error checking code. Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Chaitanya Kulkarni Signed-off-by: Carlos Maiolino commit 40fbbd64bba6c6e7a72885d2f59b6a3be9991eeb Merge: 53ec4a79ff4b36 e1b4c6a58304fd Author: Linus Torvalds Date: Tue Dec 16 19:44:36 2025 +1200 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull shmem rename fixes from Al Viro: "A couple of shmem rename fixes - recent regression from tree-in-dcache series and older breakage from stable directory offsets stuff" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: shmem: fix recovery on rename failures shmem_whiteout(): fix regression from tree-in-dcache series commit 53ec4a79ff4b36d9711cfe030eeebc36afbc51dd Merge: 115fada16b5a9a 95d7a890e4b03e Author: Linus Torvalds Date: Tue Dec 16 19:34:09 2025 +1200 Merge tag 'v6.19-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix set xattr name validation - Fix session refcount leak - Minor cleanup - smbdirect (RDMA) fixes: improve receive completion, and connect * tag 'v6.19-rc1-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix buffer validation by including null terminator size in EA length ksmbd: Fix refcount leak when invalid session is found on session lookup ksmbd: remove redundant DACL check in smb_check_perm_dacl ksmbd: convert comma to semicolon smb: server: defer the initial recv completion logic to smb_direct_negotiate_recv_work() smb: server: initialize recv_io->cqe.done = recv_done just once smb: smbdirect: introduce smbdirect_socket.connect.{lock,work} commit 115fada16b5a9a5ee371ad656e56419fe0e63cfc Merge: dbf89321bf1eb0 37343524f000d2 Author: Linus Torvalds Date: Tue Dec 16 19:28:20 2025 +1200 Merge tag 'for-6.19-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix missing btrfs_path release after printing a relocation error message - fix extent changeset leak on mmap write after failure to reserve metadata - fix fs devices list structure freeing, it could be potentially leaked under some circumstances - tree log fixes: - fix incremental directory logging where inodes for new dentries were incorrectly skipped - don't log conflicting inode if it's a directory moved in the current transaction - regression fixes: - fix incorrect btrfs_path freeing when it's auto-cleaned - revert commit simplifying preallocation of temporary structures in qgroup functions, some cases were not handled properly * tag 'for-6.19-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix changeset leak on mmap write after failure to reserve metadata btrfs: fix memory leak of fs_devices in degraded seed device path btrfs: fix a potential path leak in print_data_reloc_error() Revert "btrfs: add ASSERTs on prealloc in qgroup functions" btrfs: do not skip logging new dentries when logging a new name btrfs: don't log conflicting inode if it's a dir moved in the current transaction btrfs: tests: fix double btrfs_path free in remove_extent_ref() commit dbf89321bf1eb0cd3115662c4fbd569abf92ef9c Merge: 6b63f90fa2afaa bb27226f0d0058 Author: Linus Torvalds Date: Tue Dec 16 19:24:35 2025 +1200 Merge tag 'sched_ext-for-6.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix memory leak when destroying helper kthread workers during scheduler disable - Fix bypass depth accounting on scx_enable() failure which could leave the system permanently in bypass mode - Fix missing preemption handling when moving tasks to local DSQs via scx_bpf_dsq_move() - Misc fixes including NULL check for put_prev_task(), flushing stdout in selftests, and removing unused code * tag 'sched_ext-for-6.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Remove unused code in the do_pick_task_scx() selftests/sched_ext: flush stdout before test to avoid log spam sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() sched_ext: Fix bypass depth leak on scx_enable() failure sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next sched_ext: Fix the memleak for sch->helper objects commit 6b63f90fa2afaa901e7edc9403014e46f0da1c69 Merge: 8f0b4cce4481fb 3309b63a2281ef Author: Linus Torvalds Date: Tue Dec 16 19:21:17 2025 +1200 Merge tag 'cgroup-for-6.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fix from Tejun Heo: - Fix a race condition in css_rstat_updated() where CMPXCHG without LOCK prefix could cause lnode corruption when the flusher runs concurrently on another CPU. The issue was introduced in 6.17 and causes memcg stats to become corrupted in production. * tag 'cgroup-for-6.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated commit e5aff444e3a7bdeef5ea796a2099fc3c60a070fa Author: Juergen Gross Date: Mon Dec 15 12:51:12 2025 +0100 x86/xen: Fix sparse warning in enlighten_pv.c The sparse tool issues a warning for arch/x76/xen/enlighten_pv.c: arch/x86/xen/enlighten_pv.c:120:9: sparse: sparse: incorrect type in initializer (different address spaces) expected void const [noderef] __percpu *__vpp_verify got bool * This is due to the percpu variable xen_in_preemptible_hcall being exported via EXPORT_SYMBOL_GPL() instead of EXPORT_PER_CPU_SYMBOL_GPL(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512140856.Ic6FetG6-lkp@intel.com/ Fixes: fdfd811ddde3 ("x86/xen: allow privcmd hypercalls to be preempted") Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross Message-ID: <20251215115112.15072-1-jgross@suse.com> commit e1b4c6a58304fd490124cc2b454d80edc786665c Author: Al Viro Date: Sat Dec 13 17:50:23 2025 -0500 shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange(). Moreover, shmem_whiteout() expects that if it succeeds, the caller will progress to d_move(), i.e. that shmem_rename2() won't fail past the successful call of shmem_whiteout(). Not hard to fix, fortunately - mtree_store() can't fail if the index we are trying to store into is already present in the tree as a singleton. For simple_offset_rename_exchange() that's enough - we just need to be careful about the order of operations. For simple_offset_rename() solution is to preinsert the target into the tree for new_dir; the rest can be done without any potentially failing operations. That preinsertion has to be done in shmem_rename2() rather than in simple_offset_rename() itself - otherwise we'd need to deal with the possibility of failure after successful shmem_whiteout(). Fixes: a2e459555c5f ("shmem: stable directory offsets") Reviewed-by: Christian Brauner Reviewed-by: Chuck Lever Signed-off-by: Al Viro commit ba624ba88d9f5c3e2ace9bb6697dbeb05b2dbc44 Author: Niklas Cassel Date: Tue Dec 9 05:24:00 2025 +0100 ata: libata-core: Disable LPM on ST2000DM008-2FR102 According to a user report, the ST2000DM008-2FR102 has problems with LPM. Reported-by: Emerson Pinter Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220693 Signed-off-by: Niklas Cassel Signed-off-by: Damien Le Moal commit b80fab281349f107a07e841eb412a86e2877ae88 Author: Jason Gunthorpe Date: Fri Dec 5 15:42:47 2025 -0400 iommufd/selftest: Do not leak the hwpt if IOMMU_TEST_OP_MD_CHECK_MAP fails If the input validation fails it returned without freeing the hwpt refcount causing a leak. This triggers a WARN_ON when closing the fd: WARNING: drivers/iommu/iommufd/main.c:369 at iommufd_fops_release+0x385/0x430, CPU#1: repro/724 Found by szykaller. Fixes: e93d5945ed5b ("iommufd: Change the selftest to use iommupt instead of xarray") Link: https://patch.msgid.link/r/0-v1-c8ed57e24380+44ae-iommufd_selftest_hwpt_leak_jgg@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Pasha Tatashin Reported-by: "Lai, Yi" Closes: https://lore.kernel.org/r/aTJGMaqwQK0ASj0G@ly-workstation Signed-off-by: Jason Gunthorpe commit 5b244b077c0b0e76573fbb9542cf038e42368901 Author: Jason Gunthorpe Date: Fri Dec 5 14:56:12 2025 -0400 iommufd/selftest: Make it clearer to gcc that the access is not out of bounds GCC gets a bit confused and reports: In function '_test_cmd_get_hw_info', inlined from 'iommufd_ioas_get_hw_info' at iommufd.c:779:3, inlined from 'wrapper_iommufd_ioas_get_hw_info' at iommufd.c:752:1: >> iommufd_utils.h:804:37: warning: array subscript 'struct iommu_test_hw_info[0]' is partly outside array bounds of 'struct iommu_test_hw_info_buffer_smaller[1]' [-Warray-bounds=] 804 | assert(!info->flags); | ~~~~^~~~~~~ iommufd.c: In function 'wrapper_iommufd_ioas_get_hw_info': iommufd.c:761:11: note: object 'buffer_smaller' of size 4 761 | } buffer_smaller; | ^~~~~~~~~~~~~~ While it is true that "struct iommu_test_hw_info[0]" is partly out of bounds of the input pointer, it is not true that info->flags is out of bounds. Unclear why it warns on this. Reuse an existing properly sized stack buffer and pass a truncated length instead to test the same thing. Fixes: af4fde93c319 ("iommufd/selftest: Add coverage for IOMMU_GET_HW_INFO ioctl") Link: https://patch.msgid.link/r/0-v1-63a2cffb09da+4486-iommufd_gcc_bounds_jgg@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512032344.kaAcKFIM-lkp@intel.com/ Signed-off-by: Jason Gunthorpe commit 69dc538a4f5a57dcc5ea4893c769d567f539a1b1 Author: Arnd Bergmann Date: Thu Dec 4 11:03:29 2025 +0100 iommufd: Fix building without dmabuf When DMABUF is disabled, trying to use it causes a link failure: x86_64-linux-ld: drivers/iommu/iommufd/io_pagetable.o: in function `iopt_map_file_pages': io_pagetable.c:(.text+0x1735): undefined reference to `dma_buf_get' x86_64-linux-ld: io_pagetable.c:(.text+0x1775): undefined reference to `dma_buf_put' Fixes: 44ebaa1744fd ("iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE") Link: https://patch.msgid.link/r/20251204100333.1034767-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Jason Gunthorpe commit f371d2afd5453f9ab9a690700bfdaa70fe1e7c2b Author: Philipp Stanner Date: Mon Dec 8 15:07:15 2025 +0100 MAINTAINERS: Update Nova GPU driver git link Nova driver development has been moved to a different git repository. Update the MAINTAINERS entry to reflect that. Reported-by: Gary Guo Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251208140713.41330-3-phasta@kernel.org Signed-off-by: Danilo Krummrich commit ececfba255bf3616301419e47a5c824e04b60ab8 Author: Linus Walleij Date: Thu Dec 11 14:05:01 2025 +0100 ARM: dts: ixp4xx: Fix up Actiontec MI424WR DTS files The KS8995 switch was unconditionally wired to EthC (eth1) on both MI424WR variants, this is wrong: the D revision has the switch connected to EthB (eth0) so pull this assingment out of the generic MI424WR DTSI file and make it a property of the respective variants instead. Signed-off-by: Linus Walleij Link: https://patch.msgid.link/20251211-ixp4xx-actiontec-dts-fix-v1-1-97af8e79d474@kernel.org Signed-off-by: Krzysztof Kozlowski commit 7bbf6d15e935abbb3d604c1fa157350e84a26f98 Author: Mario Limonciello (AMD) Date: Fri Dec 12 23:44:47 2025 -0600 accel/amdxdna: Block running under a hypervisor SVA support is required, which isn't configured by hypervisor solutions. Closes: https://github.com/QubesOS/qubes-issues/issues/10275 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4656 Reviewed-by: Lizhi Hou Link: https://patch.msgid.link/20251213054513.87925-1-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit beb15a6036fecbdc23191f09e4cd57558b0db508 Author: Stanislav Kinsburskii Date: Wed Dec 10 17:55:47 2025 +0000 mshv: Initialize local variables early upon region invalidation Ensure local variables are initialized before use so that the warning can print the right values if locking the region to invalidate fails due to inability to lock the region. Reported-by: Dan Carpenter Fixes: b9a66cd5ccbb ("mshv: Add support for movable memory regions") Signed-off-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit 3a2bcc127e6beb9c3c1e4760110275588cf322bf Author: Stanislav Kinsburskii Date: Tue Dec 9 16:37:20 2025 +0000 mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions Fix page order determination logic when CONFIG_PGTABLE_HAS_HUGE_LEAVES is undefined, as HPAGE_PMD_SHIFT is defined as BUILD_BUG in that case. Fixes: abceb4297bf8 ("mshv: Fix huge page handling in memory region traversal") Signed-off-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit aed3716db7fff74919cc5775ca3a80c8bb246489 Author: Christoffer Sandberg Date: Mon Nov 24 21:31:34 2025 +0100 Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table The device occasionally wakes up from suspend with missing input on the internal keyboard and the following suspend attempt results in an instant wake-up. The quirks fix both issues for this device. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251124203336.64072-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov commit 2aaf33c6e1e82561d7dce2345298a985a2483266 Author: Cryolitia PukNgae Date: Thu Oct 23 12:42:25 2025 -0700 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard After commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR FMB-P, aka HONOR MagicBook Pro 14 2025's internal keyboard stops working. Adding the atkbd_deactivate_fixup quirk fixes it. DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025 Fixes: 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID") Reported-by: Mikura Kyouka Reported-by: foad.elkhattabi Signed-off-by: Cryolitia PukNgae Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20251022-honor-v1-1-ff894ed271a9@linux.dev Signed-off-by: Dmitry Torokhov commit 67d85b062dcb49af9c903a58842a4ed7281f57b8 Author: Yongpeng Yang Date: Mon Dec 15 17:58:17 2025 +0800 Documentation: admin-guide: blockdev: replace zone_capacity with zone_capacity_mb when creating devices The "zone_capacity=%umb" option is no longer used. The effective option is now "zone_capacity_mb=%u", so update the documentation accordingly. Signed-off-by: Yongpeng Yang Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 4b2b03151e2e3c11a3caae6e0223964dc771b003 Author: Yongpeng Yang Date: Mon Dec 15 23:21:06 2025 +0800 zloop: use READ_ONCE() to read lo->lo_state in queue_rq path In the queue_rq path, zlo->state is accessed without locking, and direct access may read stale data. This patch uses READ_ONCE() to read zlo->state and data_race() to silence code checkers, and changes all assignments to use WRITE_ONCE(). Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Yongpeng Yang Signed-off-by: Jens Axboe commit 54891a96b7a90d77c32bd0a7d6c9987e5479a314 Author: Yongpeng Yang Date: Mon Dec 15 23:21:04 2025 +0800 loop: use READ_ONCE() to read lo->lo_state without locking When lo->lo_mutex is not held, direct access may read stale data. This patch uses READ_ONCE() to read lo->lo_state and data_race() to silence code checkers, and changes all assignments to use WRITE_ONCE(). Reviewed-by: Damien Le Moal Signed-off-by: Yongpeng Yang Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit c33b68801fbe9d5ee8a9178beb5747ec65873530 Author: Brendan Jackman Date: Sun Dec 7 02:17:10 2025 +0000 kunit: make FAULT_TEST default to n when PANIC_ON_OOPS As describe in the help string, the user might want to disable these tests if they don't like to see stacktraces/BUG etc in their kernel log. However, if they enable PANIC_ON_OOPS, these tests also crash the machine, which it's safe to assume _almost_ nobody wants. One might argue that _absolutely_ nobody ever wants their kernel to crash so this should just be a hard dependency instead of a default. However, since this is rather special code that's anyway concerned with deliberately doing "bad" things, the normal rules don't seem to apply, hence prefer flexibility and allow users to set up a crashing Kconfig if they so choose. Link: https://lore.kernel.org/r/20251207-kunit-fault-no-panic-v1-1-2ac932f26864@google.com Signed-off-by: Brendan Jackman Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 726c93b0408f3aedc87349e97fb9b4741131908b Author: Uwe Kleine-König Date: Wed Dec 10 07:58:39 2025 +0100 kunit: Drop unused parameter from kunit_device_register_internal The passed driver isn't used, so just drop this parameter. Link: https://lore.kernel.org/r/20251210065839.482608-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König Reviewed-by: David Gow Signed-off-by: Shuah Khan commit 2b973ca48ff3ef1952091c8f988d7796781836c8 Author: Marijn Suijten Date: Sun Nov 30 23:40:05 2025 +0100 drm/panel: sony-td4353-jdi: Enable prepare_prev_first The DSI host must be enabled before our prepare function can run, which has to send its init sequence over DSI. Without enabling the host first the panel will not probe. Fixes: 9e15123eca79 ("drm/msm/dsi: Stop unconditionally powering up DSI hosts at modeset") Signed-off-by: Marijn Suijten Reviewed-by: Douglas Anderson Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Martin Botka Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251130-sony-akari-fix-panel-v1-1-1d27c60a55f5@somainline.org commit bb27226f0d00588ac53be8825e021ae80aa43371 Author: Zqiang Date: Mon Dec 15 19:29:40 2025 +0800 sched_ext: Remove unused code in the do_pick_task_scx() The kick_idle variable is no longer used, this commit therefore remove it and also remove associated code in the do_pick_task_scx(). Signed-off-by: Zqiang Reviewed-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 9bd18e1262c0fec6d76ffe6e2eae2b5f6cc08e3e Author: Petr Mladek Date: Fri Dec 12 13:45:20 2025 +0100 printk/nbcon: Restore IRQ in atomic flush after each emitted record The commit d5d399efff6577 ("printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record") prevented stall of a CPU which lost nbcon console ownership because another CPU entered an emergency flush. But there is still the problem that the CPU doing the emergency flush might cause a stall on its own. Let's go even further and restore IRQ in the atomic flush after each emitted record. It is not a complete solution. The interrupts and/or scheduling might still be blocked when the emergency atomic flush was called with IRQs and/or scheduling disabled. But it should remove the following lockup: mlx5_core 0000:03:00.0: Shutdown was called kvm: exiting hardware virtualization arm-smmu-v3 arm-smmu-v3.10.auto: CMD_SYNC timeout at 0x00000103 [hwprod 0x00000104, hwcons 0x00000102] smp: csd: Detected non-responsive CSD lock (#1) on CPU#4, waiting 5000000032 ns for CPU#00 do_nothing (kernel/smp.c:1057) smp: csd: CSD lock (#1) unresponsive. [...] Call trace: pl011_console_write_atomic (./arch/arm64/include/asm/vdso/processor.h:12 drivers/tty/serial/amba-pl011.c:2540) (P) nbcon_emit_next_record (kernel/printk/nbcon.c:1049) __nbcon_atomic_flush_pending_con (kernel/printk/nbcon.c:1517) __nbcon_atomic_flush_pending.llvm.15488114865160659019 (./arch/arm64/include/asm/alternative-macros.h:254 ./arch/arm64/include/asm/cpufeature.h:808 ./arch/arm64/include/asm/irqflags.h:192 kernel/printk/nbcon.c:1562 kernel/printk/nbcon.c:1612) nbcon_atomic_flush_pending (kernel/printk/nbcon.c:1629) printk_kthreads_shutdown (kernel/printk/printk.c:?) syscore_shutdown (drivers/base/syscore.c:120) kernel_kexec (kernel/kexec_core.c:1045) __arm64_sys_reboot (kernel/reboot.c:794 kernel/reboot.c:722 kernel/reboot.c:722) invoke_syscall (arch/arm64/kernel/syscall.c:50) el0_svc_common.llvm.14158405452757855239 (arch/arm64/kernel/syscall.c:?) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (./arch/arm64/include/asm/alternative-macros.h:254 ./arch/arm64/include/asm/cpufeature.h:808 ./arch/arm64/include/asm/irqflags.h:73 arch/arm64/kernel/entry-common.c:169 arch/arm64/kernel/entry-common.c:182 arch/arm64/kernel/entry-common.c:749) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:820) el0t_64_sync (arch/arm64/kernel/entry.S:600) In this case, nbcon_atomic_flush_pending() is called from printk_kthreads_shutdown() with IRQs and scheduling enabled. Note that __nbcon_atomic_flush_pending_con() is directly called also from nbcon_device_release() where the disabled IRQs might break PREEMPT_RT guarantees. But the atomic flush is called only in emergency or panic situations where the latencies are irrelevant anyway. An ultimate solution would be a touching of watchdogs. But it would hide all problems. Let's do it later when anyone reports a stall which does not have a better solution. Closes: https://lore.kernel.org/r/sqwajvt7utnt463tzxgwu2yctyn5m6bjwrslsnupfexeml6hkd@v6sqmpbu3vvu Tested-by: Breno Leitao Reviewed-by: John Ogness Link: https://patch.msgid.link/20251212124520.244483-1-pmladek@suse.com Signed-off-by: Petr Mladek commit 340f4fc5508c2905a1f30de229e2a4b299d55735 Author: Ilikara Zheng Date: Mon Dec 8 21:23:40 2025 +0800 nvme-pci: disable secondary temp for Wodposit WPBSNM8 Secondary temperature thresholds (temp2_{min,max}) were not reported properly on this NVMe SSD. This resulted in an error while attempting to read these values with sensors(1): ERROR: Can't get value of subfeature temp2_min: I/O error ERROR: Can't get value of subfeature temp2_max: I/O error Add the device to the nvme_id_table with the NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non- composite temperature thresholds. Cc: stable@vger.kernel.org Tested-by: Wu Haotian Signed-off-by: Ilikara Zheng Signed-off-by: Keith Busch commit 680ad315caaa2860df411cb378bf3614d96c7648 Author: Haoxiang Li Date: Thu Dec 4 18:36:18 2025 +0800 MIPS: Fix a reference leak bug in ip22_check_gio() If gio_device_register fails, gio_dev_put() is required to drop the gio_dev device reference. Fixes: e84de0c61905 ("MIPS: GIO bus support for SGI IP22/28") Signed-off-by: Haoxiang Li Signed-off-by: Thomas Bogendoerfer commit bd94fbe8b55f38c24a63cca2854ff74b62780d77 Author: Thierry Reding Date: Wed Oct 29 16:03:16 2025 +0100 MIPS: Alchemy: Remove bogus static/inline specifiers The recent io_remap_pfn_range() rework applied the static and inline specifiers to the implementation of io_remap_pfn_range_pfn() on MIPS Alchemy, mirroring the same change on other platforms. However, this function is defined in a source file and that definition causes a conflict with its declaration. Fix this by dropping the specifiers. Fixes: c707a68f9468 ("mm: abstract io_remap_pfn_range() based on PFN") Signed-off-by: Thierry Reding Acked-by: Thomas Bogendoerfer Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer commit 24835a96f21ebb295d24e265b5466d9e40f12cbd Merge: ed61378b4dc63e 12965a190eaea6 Author: Christian Brauner Date: Mon Dec 15 15:20:38 2025 +0100 Merge patch series "filelock: fix conflict detection with userland file delegations" Jeff Layton says: This patchset fixes the way that conflicts are detected when userland requests file delegations. The problem is due to a hack that was added long ago which worked up until userland could request a file delegation. This fixes the bug and makes things a bit less hacky. Please consider for v6.19. * patches from https://patch.msgid.link/20251204-dir-deleg-ro-v2-0-22d37f92ce2c@kernel.org: filelock: allow lease_managers to dictate what qualifies as a conflict filelock: add lease_dispose_list() helper Link: https://patch.msgid.link/20251204-dir-deleg-ro-v2-0-22d37f92ce2c@kernel.org Signed-off-by: Christian Brauner commit 12965a190eaea614bb49e22041e8fc0d03d0310f Author: Jeff Layton Date: Thu Dec 4 08:48:33 2025 -0500 filelock: allow lease_managers to dictate what qualifies as a conflict Requesting a delegation on a file from the userland fcntl() interface currently succeeds when there are conflicting opens present. This is because the lease handling code ignores conflicting opens for FL_LAYOUT and FL_DELEG leases. This was a hack put in place long ago, because nfsd already checks for conflicts in its own way. The kernel needs to perform this check for userland delegations the same way it is done for leases, however. Make this dependent on the lease_manager by adding a new ->lm_open_conflict() lease_manager operation and have generic_add_lease() call that instead of check_conflicting_open(). Morph check_conflicting_open() into a ->lm_open_conflict() op that is only called for userland leases/delegations. Set the ->lm_open_conflict() operations for nfsd to trivial functions that always return 0. Reviewed-by: Chuck Lever Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251204-dir-deleg-ro-v2-2-22d37f92ce2c@kernel.org Signed-off-by: Christian Brauner commit 392e317a20c32d45eebe4de8dc24408c6d1765d1 Author: Jeff Layton Date: Thu Dec 4 08:48:32 2025 -0500 filelock: add lease_dispose_list() helper The lease-handling code paths always know they're disposing of leases, yet locks_dispose_list() checks flags at runtime to determine whether to call locks_free_lease() or locks_free_lock(). Split out a dedicated lease_dispose_list() helper for lease code paths. This makes the type handling explicit and prepares for the upcoming lease_manager enhancements where lease-specific operations are being consolidated. Reviewed-by: Chuck Lever Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251204-dir-deleg-ro-v2-1-22d37f92ce2c@kernel.org Signed-off-by: Christian Brauner commit ed61378b4dc63efe76cb8c23a36b228043332da3 Author: Brian Foster Date: Mon Dec 8 09:05:48 2025 -0500 iomap: replace folio_batch allocation with stack allocation Zhang Yi points out that the dynamic folio_batch allocation in iomap_fill_dirty_folios() is problematic for the ext4 on iomap work that is under development because it doesn't sufficiently handle the allocation failure case (by allowing a retry, for example). We've also seen lockdep (via syzbot) complain recently about the scope of the allocation. The dynamic allocation was initially added for simplicity and to help indicate whether the batch was used or not by the calling fs. To address these issues, put the batch on the stack of iomap_zero_range() and use a flag to control whether the batch should be used in the iomap folio lookup path. This keeps things simple and eliminates allocation issues with lockdep and for ext4 on iomap. While here, also clean up the fill helper signature to be more consistent with the underlying filemap helper. Pass through the return value of the filemap helper (folio count) and update the lookup offset via an out param. Fixes: 395ed1ef0012 ("iomap: optional zero range dirty folio processing") Signed-off-by: Brian Foster Link: https://patch.msgid.link/20251208140548.373411-1-bfoster@redhat.com Acked-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit a260bd22a355bcdb74cedac6ab9b10739cd2c62c Author: Mathias Krause Date: Tue Dec 9 22:09:03 2025 +0100 media: mc: fix potential use-after-free in media_request_alloc() Commit 6f504cbf108a ("media: convert media_request_alloc() to FD_PREPARE()") moved the call to fd_install() (now hidden in fd_publish()) before the snprintf(), making the later write to potentially already freed memory, as userland is free to call close() concurrently right after the call to fd_install() which may end up in the request_fops.release() handler freeing 'req'. Fixes: 6f504cbf108a ("media: convert media_request_alloc() to FD_PREPARE()") Signed-off-by: Mathias Krause Link: https://patch.msgid.link/20251209210903.603958-1-minipli@grsecurity.net Signed-off-by: Christian Brauner commit 91b7f7d0eedaaa8993e662c4c6db9b3cfe8a2faf Author: Peter Ujfalusi Date: Mon Dec 15 12:10:36 2025 +0200 ASoC: Intel: soc-acpi-intel-nvl-match: Drop rt722 l3 from the match table Revert "ASoC: Intel: soc-acpi-intel-nvl-match: add rt722 l3 support" NVL should be only using functional topologies for products, no monolithic topologies are planned to be released. In parallel a feature has been landed [1] which allows to remove the entries from the match table for sdca codecs to rely solely on function fragments. This reverts commit 41566e3de40616375e8dfe5455344558b79f9354. Link: https://lore.kernel.org/linux-sound/20251014071335.3844631-1-yung-chuan.liao@linux.intel.com/ Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251215101036.9370-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c8f3c9fa75ff3822b56b47d5cfa0aaa484040ea8 Author: Peter Ujfalusi Date: Mon Dec 15 12:10:35 2025 +0200 ASoC: soc-acpi / SOF: Add best_effort flag to get_function_tplg_files op When there is no fallback possibility available for the function topology use it is better to try to create a profile for the card in best effort manner, leaving out non supported links for example. As an example: some laptops present SSPx-BT link but we don't have fragment yet to support this. If we only have support for functional topology without monolithic fallback then we would fail the card creation. The reason why the monolithic topology works on the same device is that it does not have the SSPx-BT link handled, it is ignored. In case when there is no fallback possibility we should try to create the card with links that we support as best effort instead of failing and leaving the user without a card. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251215101036.9370-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 544c0494cdb3732281e1f2e279cfa561724355db Author: Peter Ujfalusi Date: Mon Dec 15 15:08:05 2025 +0200 ASoC: SOF: Intel: pci-mtl: Change the topology path to intel/sof-ipc4-tplg The default topology path for IPC4 is intel/sof-ipc4-tplg with a symlink to it as intel/sof-ace-tplg to support old kernels. sof-bin has been released in this manner for almost two years now, it is time to change the default path for MTL family. Link: https://thesofproject.github.io/latest/getting_started/intel_debug/introduction.html#topology-file Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20251215130805.31146-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit da230e232352750a80c8fc883eac1c87c8849027 Author: Bard Liao Date: Mon Dec 15 15:07:23 2025 +0200 ASoC: SOF: ipc4-topology: set playback channel mask Currently, we send all channels to all amps and copy the channel_mask to all ALH DMAs in playback. However, the amp may not have the capability to run any process and SOF may need to split the channels and send specific data channel to each amp. In that case, we need to split the channel_mask in ALH DMA. Copy the channel mask only if the widget channel count is the same the FE channels for playback, otherwise, split the channels among the aggregated DAIs. Like what we did in capture. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Liam Girdwood Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251215130723.31081-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 84085139290a38c5f8a14e5bba60936392c17c7f Author: Peter Ujfalusi Date: Mon Dec 15 15:07:41 2025 +0200 ASoC: SOF: topology: Add context when sink or source widget is missing Add some context to the error prints when sink or source widget is not found by printing the name of the other side of the connection. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Link: https://patch.msgid.link/20251215130741.31106-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 816f291fc23f325d31509d0e97873249ad75ae9a Author: Peter Ujfalusi Date: Mon Dec 15 14:06:48 2025 +0200 ASoC: SOF: ipc4-topology: Convert FLOAT to S32 during blob selection SSP/DMIC blobs have no support for FLOAT type, they are using S32 on data bus. Convert the format from FLOAT_LE to S32_LE to make sure that the correct format is used within the path. FLOAT conversion will be done on the host side (or within the path). Fixes: f7c41911ad74 ("ASoC: SOF: ipc4-topology: Add support for float sample type") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Seppo Ingalsuo Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251215120648.4827-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 26e455064983e00013c0a63ffe0eed9e9ec2fa89 Author: Peter Ujfalusi Date: Mon Dec 15 14:06:47 2025 +0200 ASoC: SOF: ipc4-topology: Prefer 32-bit DMIC blobs for 8-bit formats as well With the introduction of 8-bit formats the DMIC blob lookup also needs to be modified to prefer the 32-bit blob when 8-bit format is used on FE. At the same time we also need to make sure that in case 8-bit format is used, but only 16-bit blob is available for DMIC then we will not try to look for 8-bit blob (which is invalid) as fallback, but for a 16-bit one. Fixes: c04c2e829649 ("ASoC: SOF: ipc4-topology: Add support for 8-bit formats") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Seppo Ingalsuo Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251215120648.4827-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 4dcb6e4af15bf45aa1526834e8f5e296ad7ce867 Author: Werner Sembach Date: Fri Dec 12 19:02:22 2025 +0100 platform/x86/uniwill: Add TUXEDO Book BA15 Gen10 Add TUXEDO Book BA15 Gen10 to the list of supported devices of the Uniwill driver. Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20251212180319.712913-1-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7f3c2499da24551968640528fee9aed3bb4f0c3f Author: Kurt Borja Date: Fri Dec 5 13:50:12 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora Add AWCC support for Alienware 16X Aurora laptops. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251205-area-51-v1-3-d2cb13530851@gmail.com Signed-off-by: Ilpo Järvinen commit a584644a490d276907e56817694859eaac2a4199 Author: Kurt Borja Date: Fri Dec 5 13:50:11 2025 -0500 platform/x86: alienware-wmi-wmax: Add AWCC support for Alienware x16 Add AWCC support for Alienware x16 laptops. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251205-area-51-v1-2-d2cb13530851@gmail.com Signed-off-by: Ilpo Järvinen commit 433f7744cb302ac22800dc0cd50494319ce64ba0 Author: Kurt Borja Date: Fri Dec 5 13:50:10 2025 -0500 platform/x86: alienware-wmi-wmax: Add support for new Area-51 laptops Add AWCC support for new Alienware Area-51 laptops. Cc: stable@vger.kernel.org Signed-off-by: Kurt Borja Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251205-area-51-v1-1-d2cb13530851@gmail.com Signed-off-by: Ilpo Järvinen commit fec7b0795548b43e2c3c46e3143c34ef6070341c Author: Florian Westphal Date: Thu Dec 11 13:16:49 2025 +0100 selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel packetdrill --ip_version=ipv4 --mtu=1500 --tolerance_usecs=1000000 --non_fatal packet conntrack_syn_challenge_ack.pkt conntrack v1.4.8 (conntrack-tools): 1 flow entries have been shown. conntrack_syn_challenge_ack.pkt:32: error executing `conntrack -f $NFCT_IP_VERSION \ -L -p tcp --dport 8080 | grep UNREPLIED | grep -q SYN_SENT` command: non-zero status 1 Affected kernel had CONFIG_HZ=100; reset packet was still sitting in backlog. Reported-by: Yi Chen Fixes: a8a388c2aae4 ("selftests: netfilter: add packetdrill based conntrack tests") Signed-off-by: Florian Westphal commit 7e7a817f2dfd79098a706ee5581ea9518b2de878 Author: Florian Westphal Date: Thu Dec 11 12:55:19 2025 +0100 netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate This reverts commit 314c82841602 ("netfilter: nf_tables: can't schedule in nft_chain_validate"): Since commit a60a5abe19d6 ("netfilter: nf_tables: allow iter callbacks to sleep") the iterator callback is invoked without rcu read lock held, so this cond_resched() is now valid. Signed-off-by: Florian Westphal commit 8e1a1bc4f5a42747c08130b8242ebebd1210b32f Author: Florian Westphal Date: Sun Jul 7 01:18:25 2024 +0200 netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nft_chain_validate(): watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re:37547] [..] RIP: 0010:nft_chain_validate+0xcb/0x110 [nf_tables] [..] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_immediate_validate+0x36/0x50 [nf_tables] nft_chain_validate+0xc9/0x110 [nf_tables] nft_table_validate+0x6b/0xb0 [nf_tables] nf_tables_validate+0x8b/0xa0 [nf_tables] nf_tables_commit+0x1df/0x1eb0 [nf_tables] [..] Currently nf_tables will traverse the entire table (chain graph), starting from the entry points (base chains), exploring all possible paths (chain jumps). But there are cases where we could avoid revalidation. Consider: 1 input -> j2 -> j3 2 input -> j2 -> j3 3 input -> j1 -> j2 -> j3 Then the second rule does not need to revalidate j2, and, by extension j3, because this was already checked during validation of the first rule. We need to validate it only for rule 3. This is needed because chain loop detection also ensures we do not exceed the jump stack: Just because we know that j2 is cycle free, its last jump might now exceed the allowed stack size. We also need to update all reachable chains with the new largest observed call depth. Care has to be taken to revalidate even if the chain depth won't be an issue: chain validation also ensures that expressions are not called from invalid base chains. For example, the masquerade expression can only be called from NAT postrouting base chains. Therefore we also need to keep record of the base chain context (type, hooknum) and revalidate if the chain becomes reachable from a different hook location. Reported-by: Hamza Mahfooz Closes: https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/ Tested-by: Hamza Mahfooz Signed-off-by: Florian Westphal commit cf5e8adebe77917a4cc95e43e461cdbd857591ce Author: Wadim Egorov Date: Thu Nov 27 13:27:33 2025 +0100 arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings Rename pinctrl nodes to comply with naming conventions required by pinctrl-single schema. Fixes: e569152274fec ("arm64: dts: ti: am62-lp-sk: Add overlay for NAND expansion card") Signed-off-by: Wadim Egorov Link: https://patch.msgid.link/20251127122733.2523367-3-w.egorov@phytec.de Signed-off-by: Nishanth Menon commit d876bb9353d87dee0ae620300106e8def189c785 Author: Wadim Egorov Date: Thu Nov 27 13:27:32 2025 +0100 arm64: dts: ti: k3-am642-phyboard-electra-x27-gpio1-spi1-uart3: Fix schema warnings Rename pinctrl nodes to comply with naming conventions required by pinctrl-single schema. Also, replace invalid integer assignment in SPI node with a boolean to align with omap-spi schema. Fixes: 638ab30ce4c6 ("arm64: dts: ti: am64-phyboard-electra: Add DT overlay for X27 connector") Signed-off-by: Wadim Egorov Link: https://patch.msgid.link/20251127122733.2523367-2-w.egorov@phytec.de Signed-off-by: Nishanth Menon commit 05bbe52d0be5637dcd3c880348e3688f7ec64eb7 Author: Wadim Egorov Date: Thu Nov 27 13:27:31 2025 +0100 arm64: dts: ti: k3-am642-phyboard-electra-peb-c-010: Fix icssg-prueth schema warning Reduce length of dma-names and dmas properties for icssg1-ethernet node to comply with ti,icssg-prueth schema constraints. The previous entries exceeded the allowed count and triggered dtschema warnings during validation. Fixes: e53fbf955ea7 ("arm64: dts: ti: k3-am642-phyboard-electra: Add PEB-C-010 Overlay") Signed-off-by: Wadim Egorov Link: https://patch.msgid.link/20251127122733.2523367-1-w.egorov@phytec.de Signed-off-by: Nishanth Menon commit eed5b815fa49c17d513202f54e980eb91955d3ed Author: Jan Maslak Date: Wed Dec 10 15:56:18 2025 +0100 drm/xe: Restore engine registers before restarting schedulers after GT reset During GT reset recovery in do_gt_restart(), xe_uc_start() was called before xe_reg_sr_apply_mmio() restored engine-specific registers. This created a race window where the scheduler could run jobs before hardware state was fully restored. This caused failures in eudebug tests (xe_exec_sip_eudebug@breakpoint- waitsip-*) where TD_CTL register (containing TD_CTL_GLOBAL_DEBUG_ENABLE) wasn't restored before jobs started executing. Breakpoints would fail to trigger SIP entry because the debug enable bit wasn't set yet. Fix by moving xe_uc_start() after all MMIO register restoration, including engine registers and CCS mode configuration, ensuring all hardware state is fully restored before any jobs can be scheduled. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Jan Maslak Reviewed-by: Jonathan Cavitt Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20251210145618.169625-2-jan.maslak@intel.com (cherry picked from commit 825aed0328588b2837636c1c5a0c48795d724617) Signed-off-by: Thomas Hellström commit eafb6f62093f756535a7be1fc4559374a511e460 Author: Jagmeet Randhawa Date: Fri Dec 12 05:21:46 2025 +0800 drm/xe: Increase TDF timeout There are some corner cases where flushing transient data may take slightly longer than the 150us timeout we currently allow. Update the driver to use a 300us timeout instead based on the latest guidance from the hardware team. An update to the bspec to formally document this is expected to arrive soon. Fixes: c01c6066e6fa ("drm/xe/device: implement transient flush") Signed-off-by: Jagmeet Randhawa Reviewed-by: Jonathan Cavitt Reviewed-by: Matt Roper Link: https://patch.msgid.link/0201b1d6ec64d3651fcbff1ea21026efa915126a.1765487866.git.jagmeet.randhawa@intel.com Signed-off-by: Matt Roper (cherry picked from commit d69d3636f5f7a84bae7cd43473b3701ad9b7d544) Signed-off-by: Thomas Hellström commit c770467d28bd61391f2d2b17feadafd58af731ab Author: Satyanarayana K V P Date: Wed Dec 10 05:25:48 2025 +0000 drm/xe/vf: Fix queuing of recovery work Ensure VF migration recovery work is only queued when no recovery is already queued and teardown is not in progress. Fixes: b47c0c07c350 ("drm/xe/vf: Teardown VF post migration worker on driver unload") Signed-off-by: Satyanarayana K V P Cc: Michal Wajdeczko Cc: Matthew Brost Cc: Tomasz Lis Reviewed-by: Michal Wajdeczko Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20251210052546.622809-5-satyanarayana.k.v.p@intel.com (cherry picked from commit 8d8cf42b03f149dcb545b547906306f3b474565e) Signed-off-by: Thomas Hellström commit 449bcd5d45eb4ce26740f11f8601082fe734bed2 Author: Thomas Hellström Date: Tue Dec 9 21:49:20 2025 +0100 drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table Some Xe bos are allocated with extra backing-store for the CCS metadata. It's never been the intention to share the CCS metadata when exporting such bos as dma-buf. Don't include it in the dma-buf sg-table. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Rodrigo Vivi Cc: Matthew Brost Cc: Maarten Lankhorst Cc: # v6.8+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Reviewed-by: Karol Wachowski Link: https://patch.msgid.link/20251209204920.224374-1-thomas.hellstrom@linux.intel.com (cherry picked from commit a4ebfb9d95d78a12512b435a698ee6886d712571) Signed-off-by: Thomas Hellström commit 17445af7dcc7d645b6fb8951fd10c8b72cc7f23f Author: Junxiao Chang Date: Fri Nov 7 11:31:52 2025 +0800 drm/me/gsc: mei interrupt top half should be in irq disabled context MEI GSC interrupt comes from i915 or xe driver. It has top half and bottom half. Top half is called from i915/xe interrupt handler. It should be in irq disabled context. With RT kernel(PREEMPT_RT enabled), by default IRQ handler is in threaded IRQ. MEI GSC top half might be in threaded IRQ context. generic_handle_irq_safe API could be called from either IRQ or process context, it disables local IRQ then calls MEI GSC interrupt top half. This change fixes B580 GPU boot issue with RT enabled. Fixes: e02cea83d32d ("drm/xe/gsc: add Battlemage support") Tested-by: Baoli Zhang Signed-off-by: Junxiao Chang Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251107033152.834960-1-junxiao.chang@intel.com Signed-off-by: Maarten Lankhorst (cherry picked from commit 3efadf028783a49ab2941294187c8b6dd86bf7da) Signed-off-by: Thomas Hellström commit 61e6b711c30fc1ca690502f824c067caaf7d1a34 Author: Tomasz Lis Date: Thu Dec 4 21:08:20 2025 +0100 drm/xe/vf: Stop waiting for ring space on VF post migration recovery If wait for ring space started just before migration, it can delay the recovery process, by waiting without bailout path for up to 2 seconds. Two second wait for recovery is not acceptable, and if the ring was completely filled even without the migration temporarily stopping execution, then such a wait will result in up to a thousand new jobs (assuming constant flow) being added while the wait is happening. While this will not cause data corruption, it will lead to warning messages getting logged due to reset being scheduled on a GT under recovery. Also several seconds of unresponsiveness, as the backlog of jobs gets progressively executed. Add a bailout condition, to make sure the recovery starts without much delay. The recovery is expected to finish in about 100 ms when under moderate stress, so the condition verification period needs to be below that - settling at 64 ms. The theoretical max time which the recovery can take depends on how many requests can be emitted to engine rings and be pending execution. While stress testing, it was possible to reach 10k pending requests on rings when a platform with two GTs was used. This resulted in max recovery time of 5 seconds. But in real life situations, it is very unlikely that the amount of pending requests will ever exceed 100, and for that the recovery time will be around 50 ms - well within our claimed limit of 100ms. Fixes: a4dae94aad6a ("drm/xe/vf: Wakeup in GuC backend on VF post migration recovery") Signed-off-by: Tomasz Lis Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://patch.msgid.link/20251204200820.2206168-1-tomasz.lis@intel.com (cherry picked from commit a00e305fba02a915cf2745bf6ef3f55537e65d57) Signed-off-by: Thomas Hellström commit 17d52ab2a6ec8b91bbfc577d397d42d0776ef01f Author: Raag Jadav Date: Wed Dec 3 18:03:55 2025 +0530 drm/xe/throttle: Skip reason prefix while emitting array The newly introduced "reasons" attribute already signifies possible reasons for throttling and makes the prefix in individual attribute names redundant while emitting them as an array. Skip the prefix. Fixes: 83ccde67a3f7 ("drm/xe/gt_throttle: Avoid TOCTOU when monitoring reasons") Signed-off-by: Raag Jadav Reviewed-by: Sk Anirban Link: https://patch.msgid.link/20251203123355.571606-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit b64a14334ef3ebbcf70d11bc67d0934bdc0e390d) Signed-off-by: Thomas Hellström commit 9acc3295813b9b846791fd3eab0a78a3144af560 Author: Arnd Bergmann Date: Thu Dec 4 10:46:58 2025 +0100 drm/xe: fix drm_gpusvm_init() arguments The Xe driver fails to build when CONFIG_DRM_XE_GPUSVM is disabled but CONFIG_DRM_GPUSVM is turned on, due to the clash of two commits: In file included from drivers/gpu/drm/xe/xe_vm_madvise.c:8: drivers/gpu/drm/xe/xe_svm.h: In function 'xe_svm_init': include/linux/stddef.h:8:14: error: passing argument 5 of 'drm_gpusvm_init' makes integer from pointer without a cast [-Wint-conversion] drivers/gpu/drm/xe/xe_svm.h:217:38: note: in expansion of macro 'NULL' 217 | NULL, NULL, 0, 0, 0, NULL, NULL, 0); | ^~~~ In file included from drivers/gpu/drm/xe/xe_bo_types.h:11, from drivers/gpu/drm/xe/xe_bo.h:11, from drivers/gpu/drm/xe/xe_vm_madvise.c:11: include/drm/drm_gpusvm.h:254:35: note: expected 'long unsigned int' but argument is of type 'void *' 254 | unsigned long mm_start, unsigned long mm_range, | ~~~~~~~~~~~~~~^~~~~~~~ In file included from drivers/gpu/drm/xe/xe_vm_madvise.c:14: drivers/gpu/drm/xe/xe_svm.h:216:16: error: too many arguments to function 'drm_gpusvm_init'; expected 10, have 11 216 | return drm_gpusvm_init(&vm->svm.gpusvm, "Xe SVM (simple)", &vm->xe->drm, | ^~~~~~~~~~~~~~~ 217 | NULL, NULL, 0, 0, 0, NULL, NULL, 0); | ~ include/drm/drm_gpusvm.h:251:5: note: declared here Adapt the caller to the new argument list by removing the extraneous NULL argument. Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Fixes: 10aa5c806030 ("drm/gpusvm, drm/xe: Fix userptr to not allow device private pages") Signed-off-by: Arnd Bergmann Reviewed-by: Thomas Hellström Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20251204094704.1030933-1-arnd@kernel.org (cherry picked from commit 29bce9c8b41d5c378263a927acb9a9074d0e7a0e) Signed-off-by: Thomas Hellström commit 224a6ac0808d0f58e51df2f923332adcb80fd930 Author: Matthew Brost Date: Tue Dec 2 17:18:09 2025 -0800 drm/xe: Do not reference loop variable directly Do not reference the loop variable job after the loop has exited. Instead, save the job from the last iteration of the loop. Fixes: 3d98a7164da6 ("drm/xe/vf: Start re-emission from first unsignaled job during VF migration") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202511291102.jnnKP6IB-lkp@intel.com/ Signed-off-by: Matthew Brost Reviewed-by: Dnyaneshwar Bhadane Link: https://patch.msgid.link/20251203011809.968893-1-matthew.brost@intel.com (cherry picked from commit 76ce2313709f13a6adbcaa1a43a8539c8f509f6a) Signed-off-by: Thomas Hellström commit c88a0731ed95f9705deb127a7f1927fa59aa742b Author: Vinay Belgaumkar Date: Fri Nov 28 21:25:48 2025 -0800 drm/xe: Apply Wa_14020316580 in xe_gt_idle_enable_pg() Wa_14020316580 was getting clobbered by power gating init code later in the driver load sequence. Move the Wa so that it applies correctly. Fixes: 7cd05ef89c9d ("drm/xe/xe2hpm: Add initial set of workarounds") Suggested-by: Matt Roper Signed-off-by: Vinay Belgaumkar Reviewed-by: Riana Tauro Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251129052548.70766-1-vinay.belgaumkar@intel.com Signed-off-by: Matt Roper (cherry picked from commit 8b5502145351bde87f522df082b9e41356898ba3) Signed-off-by: Thomas Hellström commit b32045d73bb4333a2cebc5d3c005807adb03ab58 Author: Shuicheng Lin Date: Fri Nov 14 20:56:39 2025 +0000 drm/xe: Fix freq kobject leak on sysfs_create_files failure Ensure gt->freq is released when sysfs_create_files() fails in xe_gt_freq_init(). Without this, the kobject would leak. Add kobject_put() before returning the error. Fixes: fdc81c43f0c1 ("drm/xe: use devm_add_action_or_reset() helper") Signed-off-by: Shuicheng Lin Reviewed-by: Alex Zuo Reviewed-by: Xin Wang Link: https://patch.msgid.link/20251114205638.2184529-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper (cherry picked from commit 251be5fb4982ebb0f5a81b62d975bd770f3ad5c2) Signed-off-by: Thomas Hellström commit 98a97bf41528ef738b06eb07ec2b2eb1cfde6ce6 Author: Mark Brown Date: Sat Nov 29 00:48:45 2025 +0000 arm64/gcs: Flush the GCS locking state on exec When we exec a new task we forget to flush the set of locked GCS mode bits. Since we do flush the rest of the state this means that if GCS is locked the new task will be unable to enable GCS, it will be locked as being disabled. Add the expected flush. Fixes: fc84bc5378a8 ("arm64/gcs: Context switch GCS state for EL0") Cc: # 6.13.x Reported-by: Yury Khrustalev Signed-off-by: Mark Brown Tested-by: Yury Khrustalev Signed-off-by: Catalin Marinas commit 63de2b3859ba1def9f43ed0a9c25a68810208e5c Author: Ard Biesheuvel Date: Sat Dec 6 20:01:17 2025 +0100 arm64/efi: Remove unneeded SVE/SME fallback preserve/store handling Since commit 7137a203b251 ("arm64/fpsimd: Permit kernel mode NEON with IRQs off"), the only condition under which the fallback path is taken for FP/SIMD preserve/restore across a EFI runtime call is when it is called from hardirq or NMI context. In practice, this only happens when the EFI pstore driver is called to dump the kernel log buffer into a EFI variable under a panic, oops or emergency_restart() condition, and none of these can be expected to result in a return to user space for the task in question. This means that the existing EFI-specific logic for preserving and restoring SVE/SME state is pointless, and can be removed. Instead, kill the task, so that an exceedingly unlikely inadvertent return to user space does not proceed with a corrupted FP/SIMD state. Also, retain the preserve and restore of the base FP/SIMD state, as that might belong to kernel mode use of FP/SIMD. (Note that EFI runtime calls are never invoked reentrantly, even in this case, and so any interrupted kernel mode FP/SIMD usage will be unrelated to EFI) Signed-off-by: Ard Biesheuvel Signed-off-by: Catalin Marinas commit eb972eab0794dedeef5b3b1845e5f9a78793f184 Author: Ard Biesheuvel Date: Sat Dec 6 20:01:16 2025 +0100 lkdtm/bugs: Add cases for BUG and PANIC occurring in hardirq context Add lkdtm cases to trigger a BUG() or panic() from hardirq context. This is useful for testing pstore behavior being invoked from such contexts. Reviewed-by: Kees Cook Signed-off-by: Ard Biesheuvel Signed-off-by: Catalin Marinas commit b7737c38e7cb611c2fbd87af3b09afeb92c96fe7 Author: Kevin Brodsky Date: Wed Nov 19 13:00:16 2025 +0000 arm64: mm: Simplify check in arch_kfence_init_pool() TL;DR: checking force_pte_mapping() in arch_kfence_init_pool() is sufficient Commit ce2b3a50ad92 ("arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context") recently added an arm64 implementation of arch_kfence_init_pool() to ensure that the KFENCE pool is PTE-mapped. Assuming that the pool was not initialised early, block splitting is necessary if the linear mapping is not fully PTE-mapped, in other words if force_pte_mapping() is false. arch_kfence_init_pool() currently makes another check: whether BBML2-noabort is supported, i.e. whether we are *able* to split block mappings. This check is however unnecessary, because force_pte_mapping() is always true if KFENCE is enabled and BBML2-noabort is not supported. This must be the case by design, since KFENCE requires PTE-mapped pages in all cases. We can therefore remove that check. The situation is different in split_kernel_leaf_mapping(), as that function is called unconditionally regardless of the configuration. If BBML2-noabort is not supported, it cannot do anything and bails out. If force_pte_mapping() is true, there is nothing to do and it also bails out, but these are independent checks. Commit 53357f14f924 ("arm64: mm: Tidy up force_pte_mapping()") grouped these checks into a helper, split_leaf_mapping_possible(). This isn't so helpful as only split_kernel_leaf_mapping() should check both. Revert the parts of that commit that introduced the helper, reintroducing the more accurate comments in split_kernel_leaf_mapping(). Signed-off-by: Kevin Brodsky Reviewed-by: Ryan Roberts Signed-off-by: Catalin Marinas commit f103fa127c93016bcd89b05d8e11dc1a84f6990d Author: Pengjie Zhang Date: Wed Dec 10 21:26:34 2025 +0800 ACPI: PCC: Fix race condition by removing static qualifier Local variable 'ret' in acpi_pcc_address_space_setup() is currently declared as 'static'. This can lead to race conditions in a multithreaded environment. Remove the 'static' qualifier to ensure that 'ret' will be allocated directly on the stack as a local variable. Fixes: a10b1c99e2dc ("ACPI: PCC: Setup PCC Opregion handler only if platform interrupt is available") Signed-off-by: Pengjie Zhang Reviewed-by: Sudeep Holla Acked-by: lihuisong@huawei.com Cc: 6.2+ # 6.2+ [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251210132634.2050033-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki commit 6ea3a44cef28add2d93b1ef119d84886cb1e3c9b Author: Pengjie Zhang Date: Wed Dec 10 21:22:27 2025 +0800 ACPI: CPPC: Fix missing PCC check for guaranteed_perf The current implementation overlooks the 'guaranteed_perf' register in this check. If the Guaranteed Performance register is located in the PCC subspace, the function currently attempts to read it without acquiring the lock and without sending the CMD_READ doorbell to the firmware. This can result in reading stale data. Fixes: 29523f095397 ("ACPI / CPPC: Add support for guaranteed performance") Signed-off-by: Pengjie Zhang Cc: 4.20+ # 4.20+ [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251210132227.1988380-1-zhangpengjie2@huawei.com Signed-off-by: Rafael J. Wysocki commit 84318277d6334c6981ab326d4acc87c6a6ddc9b8 Merge: 630efee9493cf6 8f0b4cce4481fb Author: Maarten Lankhorst Date: Mon Dec 15 12:53:27 2025 +0100 Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes Pull in rc1 to include all changes since the merge window closed, and grab all fixes and changes from drm/drm-next. Signed-off-by: Maarten Lankhorst commit d113735421da322ea144c9778c433de6ff6bc57b Author: Thorsten Blum Date: Sat Dec 6 18:42:45 2025 +0100 thermal: core: Fix typo and indentation in comments s/tmperature/temperature/ and adjust the indentation of the @ops parameter description to improve readability. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251206174245.116391-2-thorsten.blum@linux.dev Signed-off-by: Rafael J. Wysocki commit 450f9cde66a92fd6c7f6870b3501e8debe9f69cc Author: Srinivas Pandruvada Date: Fri Dec 5 15:00:07 2025 -0800 thermal: intel: int340x: Enable power slider interface for Wildcat Lake Set the PROC_THERMAL_FEATURE_SOC_POWER_SLIDER feature flag in proc_thermal_pci_ids[] for Wildcat Lake to enable power slider interface. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251205230007.2218533-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 5497ffe305b2ea31ae62d4a311d7cabfb671f54a Author: Ondrej Jirman Date: Mon Nov 24 19:47:03 2025 -0800 arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro Previously sometimes pressing the volume-down button would register as a volume-up button. Match the thresholds as shown in the Pinephone Pro schematic. Tests: ~ $ evtest // Mashed the volume down ~100 times with varying intensity Event: time xxx, type 1 (EV_KEY), code 114 (KEY_VOLUMEDOWN), value 1 Event: time xxx, type 1 (EV_KEY), code 114 (KEY_VOLUMEDOWN), value 0 // Mashed the volume up ~100 times with varying intensity Event: time xxx, type 1 (EV_KEY), code 115 (KEY_VOLUMEUP), value 1 Event: time xxx, type 1 (EV_KEY), code 115 (KEY_VOLUMEUP), value 0 Fixes: d3150ed53580 ("arm64: dts: rockchip: Add support for volume keys to rk3399-pinephone-pro") Cc: stable@vger.kernel.org Signed-off-by: Ondrej Jirman Signed-off-by: Rudraksha Gupta Reviewed-by: Pavel Machek Link: https://patch.msgid.link/20251124-ppp_light_accel_mag_vol-down-v5-4-f9a10a0a50eb@gmail.com Signed-off-by: Heiko Stuebner commit efc4c35b741af973de90f6826bf35d3b3ac36bf1 Author: Sumeet Pawnikar Date: Sun Dec 7 20:45:48 2025 +0530 powercap: fix sscanf() error return value handling Fix inconsistent error handling for sscanf() return value check. Implicit boolean conversion is used instead of explicit return value checks. The code checks if (!sscanf(...)) which is incorrect because: 1. sscanf returns the number of successfully parsed items 2. On success, it returns 1 (one item passed) 3. On failure, it returns 0 or EOF 4. The check 'if (!sscanf(...))' is wrong because it treats success (1) as failure All occurrences of sscanf() now uses explicit return value check. With this behavior it returns '-EINVAL' when parsing fails (returns 0 or EOF), and continues when parsing succeeds (returns 1). Signed-off-by: Sumeet Pawnikar [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251207151549.202452-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki commit 7bda1910c4bccd4b8d4726620bb3d6bbfb62286e Author: Sumeet Pawnikar Date: Sat Dec 6 00:32:16 2025 +0530 powercap: fix race condition in register_control_type() The device becomes visible to userspace via device_register() even before it fully initialized by idr_init(). If userspace or another thread tries to register a zone immediately after device_register(), the control_type_valid() will fail because the control_type is not yet in the list. The IDR is not yet initialized, so this race condition causes zone registration failure. Move idr_init() and list addition before device_register() fix the race condition. Signed-off-by: Sumeet Pawnikar [ rjw: Subject adjustment, empty line added ] Link: https://patch.msgid.link/20251205190216.5032-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki commit ed724ea1b82a800af4704311cb89e5ef1b4ea7ac Author: Andrew Jeffery Date: Thu Dec 11 17:45:48 2025 +0900 dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml Enable use of common SDHCI-related properties such as sdhci-caps-mask as found in the AST2600 EVB DTS. Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Andrew Jeffery Signed-off-by: Ulf Hansson commit c196def07bbc6e8306d7a274433913444b0db20a Author: Antony Antony Date: Thu Dec 11 11:30:27 2025 +0100 xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set The XFRM_STATE_NOPMTUDISC flag is only meaningful for output SAs, but it was being applied regardless of the SA direction when the sysctl ip_no_pmtu_disc is enabled. This can unintentionally affect input SAs. Limit setting XFRM_STATE_NOPMTUDISC to output SAs when the SA direction is configured. Closes: https://github.com/strongswan/strongswan/issues/2946 Fixes: a4a87fa4e96c ("xfrm: Add Direction to the SA in or out") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert commit 6f7c877cc397ba3c6d8ba44d4a604df3d4182eec Author: Ahelenia Ziemiańska Date: Mon Dec 8 23:20:24 2025 +0100 fs: send fsnotify_xattr()/IN_ATTRIB from vfs_fileattr_set()/chattr(1) Currently it seems impossible to observe these changes to the file's attributes. It's useful to be able to do this to see when the file becomes immutable, for example, so emit IN_ATTRIB via fsnotify_xattr(), like when changing other inode attributes. Signed-off-by: Ahelenia Ziemiańska Link: https://patch.msgid.link/iyvn6qjotpu6cei5jdtsoibfcp6l6rgvn47cwgaucgtucpfy2s@tarta.nabijaczleweli.xyz Signed-off-by: Jan Kara commit 635bc4def026a24e071436f4f356ea08c0eed6ff Author: Amir Goldstein Date: Sun Dec 7 11:44:55 2025 +0100 fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the same user to subscribe for watching events on children when the user has access to the parent directory (e.g. /dev). Users with no read access to a file but with read access to its parent directory can still stat the file and see if it was accessed/modified via atime/mtime change. The same is not true for special files (e.g. /dev/null). Users will not generally observe atime/mtime changes when other users read/write to special files, only when someone sets atime/mtime via utimensat(). Align fsnotify events with this stat behavior and do not generate ACCESS/MODIFY events to parent watchers on read/write of special files. The events are still generated to parent watchers on utimensat(). This closes some side-channels that could be possibly used for information exfiltration [1]. [1] https://snee.la/pdf/pubs/file-notification-attacks.pdf Reported-by: Sudheendra Raghav Neela CC: stable@vger.kernel.org Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 Author: Haotian Zhang Date: Mon Dec 15 17:04:33 2025 +0800 ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path When pdacf_config() fails, snd_pdacf_probe() returns the error code directly without freeing the sound card resources allocated by snd_card_new(), which leads to a memory leak. Add proper error handling to free the sound card and clear the card list entry when pdacf_config() fails. Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") Suggested-by: Takashi Iwai Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn Signed-off-by: Takashi Iwai commit 0ff5e81e1518868286d7a1cda192c23db3110b7c Author: Bitterblue Smith Date: Sat Dec 6 20:32:43 2025 +0200 Revert "wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users" This reverts commit 9c194fe4625db18f93d5abcfb7f7997557a0b29d. This commit breaks all USB wifi adapters supported by rtw88: usb 1-2: new high-speed USB device number 6 using xhci_hcd usb 1-2: New USB device found, idVendor=2357, idProduct=0138, bcdDevice= 2.10 usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-2: Product: 802.11ac NIC usb 1-2: Manufacturer: Realtek usb 1-2: SerialNumber: 123456 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 152 at kernel/workqueue.c:5667 alloc_workqueue_noprof+0x676/0x770 [...] Call Trace: ? rtw_usb_probe+0x30e/0xa5c [rtw88_usb 4af3cb64eedafeecbfb08f80c1e9e2893e2ee7a6] rtw_usb_probe+0x3eb/0xa5c [rtw88_usb 4af3cb64eedafeecbfb08f80c1e9e2893e2ee7a6] usb_probe_interface+0xdd/0x2c0 really_probe+0xdb/0x340 ? pm_runtime_barrier+0x55/0x90 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x78/0x140 driver_probe_device+0x1f/0xa0 __device_attach_driver+0x89/0x110 bus_for_each_drv+0x8f/0xe0 __device_attach+0xb0/0x1c0 bus_probe_device+0x90/0xa0 device_add+0x663/0x880 usb_set_configuration+0x5a5/0x870 usb_generic_driver_probe+0x4a/0x70 usb_probe_device+0x3d/0x140 ? driver_sysfs_add+0x59/0xd0 really_probe+0xdb/0x340 ? pm_runtime_barrier+0x55/0x90 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x78/0x140 driver_probe_device+0x1f/0xa0 __device_attach_driver+0x89/0x110 bus_for_each_drv+0x8f/0xe0 __device_attach+0xb0/0x1c0 bus_probe_device+0x90/0xa0 device_add+0x663/0x880 usb_new_device.cold+0x141/0x3b5 hub_event+0x1132/0x1900 ? page_counter_uncharge+0x4a/0x90 process_one_work+0x190/0x350 worker_thread+0x2d7/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xf9/0x240 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x1c1/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 ---[ end trace 0000000000000000 ]--- rtw88_8822bu 1-2:1.0: failed to create RX work queue rtw88_8822bu 1-2:1.0: failed to init USB RX rtw88_8822bu 1-2:1.0: Firmware version 27.2.0, H2C version 13 rtw88_8822bu 1-2:1.0: probe with driver rtw88_8822bu failed with error -12 WQ_UNBOUND is not compatible with WQ_BH. Comment in enum wq_flags in workqueue.h says: /* BH wq only allows the following flags */ __WQ_BH_ALLOWS = WQ_BH | WQ_HIGHPRI | WQ_PERCPU, Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/d57efe48-b8ff-4bf1-942c-7e808535eda6@gmail.com commit dd39edb445f07400e748da967a07d5dca5c5f96e Author: Morning Star Date: Thu Nov 27 16:37:08 2025 +0800 wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn: UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]' Fixes: 8ca4cdef9329 ("wifi: rtlwifi: rtl8192cu: Fix TX aggregation") Signed-off-by: Morning Star Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/1764232628-13625-1-git-send-email-pkshih@realtek.com commit f3ccdfda345ca9a624ea425840a926b8338c1e25 Author: Ping-Ke Shih Date: Tue Nov 25 09:38:49 2025 +0800 wifi: rtw88: limit indirect IO under powered off for RTL8822CS The indirect IO is necessary for RTL8822CS, but not necessary for other chips. Otherwiese, it throws errors and becomes unusable. rtw88_8723cs mmc1:0001:1: WOW Firmware version 11.0.0, H2C version 0 rtw88_8723cs mmc1:0001:1: Firmware version 11.0.0, H2C version 0 rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110 rtw88_8723cs mmc1:0001:1: sdio write8 failed (0x1c): -110 rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110 By vendor driver, only RTL8822CS and RTL8822ES need indirect IO, but RTL8822ES isn't supported yet. Therefore, limit it to RTL8822CS only. Reported-by: Andrey Skvortsov Closes: https://lore.kernel.org/linux-wireless/07a32e2d6c764eb1bd9415b5a921a652@realtek.com/T/#m997b4522f7209ba629561c776bfd1d13ab24c1d4 Fixes: 58de1f91e033 ("wifi: rtw88: sdio: use indirect IO for device registers before power-on") Signed-off-by: Ping-Ke Shih Tested-by: Andrey Skvortsov Link: https://patch.msgid.link/1764034729-1251-1-git-send-email-pkshih@realtek.com commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f Author: Haotian Zhang Date: Mon Dec 15 12:26:52 2025 +0800 ALSA: vxpocket: Fix resource leak in vxpocket_probe error path When vxpocket_config() fails, vxpocket_probe() returns the error code directly without freeing the sound card resources allocated by snd_card_new(), which leads to a memory leak. Add proper error handling to free the sound card and clear the allocation bit when vxpocket_config() fails. Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn Signed-off-by: Takashi Iwai commit 95d7a890e4b03e198836d49d699408fd1867cb55 Author: Namjae Jeon Date: Sun Dec 14 15:06:34 2025 +0900 ksmbd: fix buffer validation by including null terminator size in EA length The smb2_set_ea function, which handles Extended Attributes (EA), was performing buffer validation checks that incorrectly omitted the size of the null terminating character (+1 byte) for EA Name. This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where the null terminator is expected to be present in the buffer, ensuring the validation accurately reflects the total required buffer size. Cc: stable@vger.kernel.org Reported-by: Roger Reported-by: Stanislas Polu Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit cafb57f7bdd57abba87725eb4e82bbdca4959644 Author: Namjae Jeon Date: Sun Dec 14 15:05:56 2025 +0900 ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it is missing to decrement the reference count acquired by the session lookup, which results in a reference count leak. This patch fixes the issue by explicitly calling ksmbd_user_session_put to release the reference to the session. Cc: stable@vger.kernel.org Reported-by: Alexandre Reported-by: Stanislas Polu Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 8dd2e58b62731a96e276ee0545fb910ffb2057d9 Author: Alexey Velichayshiy Date: Wed Dec 10 16:51:33 2025 +0300 ksmbd: remove redundant DACL check in smb_check_perm_dacl A zero value of pdacl->num_aces is already handled at the start of smb_check_perm_dacl() so the second check is useless. Drop the unreachable code block, no functional impact intended. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Alexey Velichayshiy Acked-by: Namjae Jeon Signed-off-by: Steve French commit 0446356e9f29d81757dc64ae7c61743e28d91ac0 Author: Chen Ni Date: Tue Nov 18 09:32:29 2025 +0800 ksmbd: convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Acked-by: Namjae Jeon Signed-off-by: Steve French commit d180b1d9c7a401656332b27e3428a949c00748d3 Author: Stefan Metzmacher Date: Tue Dec 2 22:15:26 2025 +0100 smb: server: defer the initial recv completion logic to smb_direct_negotiate_recv_work() The previous change to relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() seems to work around the problem that the order of initial recv completion and RDMA_CM_EVENT_ESTABLISHED is random, but it's still a bit ugly. This implements a better solution deferring the recv completion processing to smb_direct_negotiate_recv_work(), which is queued only if both events arrived. In order to avoid more basic changes to the main recv_done callback, I introduced a smb_direct_negotiate_recv_done, which is only used for the first pdu, this will allow further cleanup and simplifications in recv_done as a future patch. smb_direct_negotiate_recv_work() is also very basic with only basic error checking and the transition from SMBDIRECT_SOCKET_NEGOTIATE_NEEDED to SMBDIRECT_SOCKET_NEGOTIATE_RUNNING, which allows smb_direct_prepare() to continue as before. Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c1fb124f2a7416905047cf36fa6a110f9c48cd02 Author: Stefan Metzmacher Date: Tue Dec 2 22:15:25 2025 +0100 smb: server: initialize recv_io->cqe.done = recv_done just once smbdirect_recv_io structures are pre-allocated so we can set the callback function just once. This will make it easy to move smb_direct_post_recv to common code soon. Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 49ca2147749fb69e1caa0f56a98bec065d903bd0 Author: Stefan Metzmacher Date: Tue Dec 2 22:15:24 2025 +0100 smb: smbdirect: introduce smbdirect_socket.connect.{lock,work} This will first be used by the server in order to defer the processing of the initial recv of the negotiation request. But in future it will also be used by the client in order to implement an async connect. Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5a0b1882506858b12cc77f0e2439a5f3c5052761 Author: Charles Mirabile Date: Fri Dec 12 13:47:17 2025 -0500 lib/crypto: riscv: Add poly1305-core.S to .gitignore poly1305-core.S is an auto-generated file, so it should be ignored. Fixes: bef9c7559869 ("lib/crypto: riscv/poly1305: Import OpenSSL/CRYPTOGAMS implementation") Cc: stable@vger.kernel.org Signed-off-by: Charles Mirabile Link: https://lore.kernel.org/r/20251212184717.133701-1-cmirabil@redhat.com Signed-off-by: Eric Biggers commit c4b502d60a71cf0c0c938f133dc4c0e2adc17b44 Author: Ard Biesheuvel Date: Tue Dec 9 06:48:49 2025 +0100 arm64/simd: Avoid pointless clearing of FP/SIMD buffer The buffer provided to kernel_neon_begin() is only used if the task is scheduled out while the FP/SIMD is in use by the kernel, or when such a section is interrupted by a softirq that also uses the FP/SIMD. IOW, this happens rarely, and even if it happened often, there is still no reason for this buffer to be cleared beforehand, which happens unconditionally, due to the use of a compound literal expression. So define that buffer variable explicitly, and mark it as __uninitialized so that it will not get cleared, even when -ftrivial-auto-var-init is in effect. This requires some preprocessor gymnastics, due to the fact that the variable must be defined throughout the entire guarded scope, and the expression ({ struct user_fpsimd_state __uninitialized st; &st; }) is problematic in that regard, even though the compilers seem to permit it. So instead, repeat the 'for ()' trick that is also used in the implementation of the guarded scope helpers. Cc: Will Deacon Cc: Catalin Marinas Cc: Kees Cook Cc: Eric Biggers Signed-off-by: Ard Biesheuvel Fixes: 4fa617cc6851 ("arm64/fpsimd: Allocate kernel mode FP/SIMD buffers on the stack") Link: https://lore.kernel.org/r/20251209054848.998878-2-ardb@kernel.org Signed-off-by: Eric Biggers commit 82f2aab35a1ab2e1460de06ef04c726460aed51c Author: Alexey Simakov Date: Thu Dec 11 19:43:43 2025 +0300 hwmon: (tmp401) fix overflow caused by default conversion rate value The driver computes conversion intervals using the formula: interval = (1 << (7 - rate)) * 125ms where 'rate' is the sensor's conversion rate register value. According to the datasheet, the power-on reset value of this register is 0x8, which could be assigned to the register, after handling i2c general call. Using this default value causes a result greater than the bit width of left operand and an undefined behaviour in the calculation above, since shifting by values larger than the bit width is undefined behaviour as per C language standard. Limit the maximum usable 'rate' value to 7 to prevent undefined behaviour in calculations. Found by Linux Verification Center (linuxtesting.org) with Svace. Note (groeck): This does not matter in practice unless someone overwrites the chip configuration from outside the driver while the driver is loaded. The conversion time register is initialized with a value of 5 (500ms) when the driver is loaded, and the driver never writes a bad value. Fixes: ca53e7640de7 ("hwmon: (tmp401) Convert to _info API") Signed-off-by: Alexey Simakov Link: https://lore.kernel.org/r/20251211164342.6291-1-bigalex934@gmail.com Signed-off-by: Guenter Roeck commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d Author: Junrui Luo Date: Wed Dec 10 17:48:08 2025 +0800 hwmon: (ibmpex) fix use-after-free in high/low store The ibmpex_high_low_store() function retrieves driver data using dev_get_drvdata() and uses it without validation. This creates a race condition where the sysfs callback can be invoked after the data structure is freed, leading to use-after-free. Fix by adding a NULL check after dev_get_drvdata(), and reordering operations in the deletion path to prevent TOCTOU. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 57c7c3a0fdea ("hwmon: IBM power meter driver") Signed-off-by: Junrui Luo Link: https://lore.kernel.org/r/MEYPR01MB7886BE2F51BFE41875B74B60AFA0A@MEYPR01MB7886.ausprd01.prod.outlook.com Signed-off-by: Guenter Roeck commit 46c28bbbb150b80827e4bcbea231560af9d16854 Author: Denis Sergeev Date: Tue Dec 9 09:37:06 2025 +0300 hwmon: (dell-smm) Limit fan multiplier to avoid overflow The fan nominal speed returned by SMM is limited to 16 bits, but the driver allows the fan multiplier to be set via a module parameter. Clamp the computed fan multiplier so that fan_nominal_speed * i8k_fan_mult always fits into a signed 32-bit integer and refuse to initialize the driver if the value is too large. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 20bdeebc88269 ("hwmon: (dell-smm) Introduce helper function for data init") Signed-off-by: Denis Sergeev Link: https://lore.kernel.org/r/20251209063706.49008-1-denserg.edu@gmail.com Signed-off-by: Guenter Roeck commit 1417927df8049a0194933861e9b098669a95c762 Author: Christophe Leroy Date: Thu Nov 20 09:34:49 2025 +0100 spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM. But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd. Add the missing length parity verification and remain in 8 bit mode when the length is not even. Fixes: fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/638496dd-ec60-4e53-bad7-eb657f67d580@csgroup.eu/ Signed-off-by: Christophe Leroy Reviewed-by: Sverdlin Alexander Link: https://patch.msgid.link/3c4d81c3923c93f95ec56702a454744a4bad3cfc.1763627618.git.christophe.leroy@csgroup.eu Signed-off-by: Mark Brown commit a8a313612af7a55083ba5720f14f1835319debee Author: Christophe JAILLET Date: Sat Dec 13 08:48:51 2025 +0100 spi: mpfs: Fix an error handling path in mpfs_spi_probe() mpfs_spi_init() calls mpfs_spi_enable_ints(), so mpfs_spi_disable_ints() should be called if an error occurs after calling mpfs_spi_init(), as already done in the remove function. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/eb35f168517cc402ef7e78f26da02863e2f45c03.1765612110.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit cb0ae6f22790ead71a866f94c7a5a70ad56af16a Author: Bard Liao Date: Fri Dec 12 20:11:12 2025 +0800 ASoC: sdw_utils: subtract the endpoint that is not present When asoc_sdw_count_sdw_endpoints() count the num_ends, it doesn't skip the unpresented endpoints. But, asoc_sdw_parse_sdw_endpoints() will skip the unpresented endpoints either by quirk or the SDCA function doesn't show up the endpoint. The endpoint number mismatches between count and parse and the machine driver will show up a warning about it. Fixes: 26ee34d2f5c7 ("ASoC: sdw_utils: Add codec_conf for every DAI") Closes: https://github.com/thesofproject/linux/issues/5620 Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Vijendar Mukunda Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251212121112.3313017-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 9f4d0899efd9892fc7514c9488270e1bb7dedd2b Author: Chancel Liu Date: Wed Dec 10 15:21:09 2025 +0900 ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master mode If SAI works in master mode it will generate clocks for external codec from audio PLLs. Thus sample rates should be constrained according to audio PLL clocks. While SAI works in slave mode which means clocks are generated externally then constraints are independent of audio PLLs. Fixes: 4edc98598be4 ("ASoC: fsl_sai: Add sample rate constraint") Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20251210062109.2577735-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit 20c734cb678332883d317b17bf8fe7361648e170 Author: Robert Oscilowski Date: Sat Nov 15 19:43:58 2025 +0100 ASoC: qcom: sdm845: set quaternary MI2S codec DAI to I2S format We configure the codec DAI format for primary and secondary but not the quaternery MI2S path. Add the missing configuration to enable speaker codecs on the quaternary MI2S like the MAX9827 found on the OnePlus 6. Signed-off-by: Robert Oscilowski Signed-off-by: Casey Connolly Signed-off-by: David Heidelberg Reviewed-by: Alexey Klimov Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251115-sdm845-quaternary-v3-1-c16bf19128ac@ixit.cz Signed-off-by: Mark Brown commit e2cb8ef0372665854fca6fa7b30b20dd35acffeb Author: Andrew Elantsev Date: Wed Dec 10 23:38:00 2025 +0300 ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 Add a DMI quirk for the Honor MagicBook X16 2025 laptop fixing the issue where the internal microphone was not detected. Signed-off-by: Andrew Elantsev Link: https://patch.msgid.link/20251210203800.142822-1-elantsew.andrew@gmail.com Signed-off-by: Mark Brown commit 4d4021b0bbd1fad7c72b9155863f5b3ccb43ae91 Author: sheetal Date: Mon Dec 8 10:50:40 2025 +0530 ASoC: tegra: Fix uninitialized flat cache warning in tegra210_ahub The tegra210_ahub driver started triggering a warning after commit e062bdfdd6ad ("regmap: warn users about uninitialized flat cache"), which flags drivers using REGCACHE_FLAT without register defaults. Since the driver omits default definitions because its registers are zero initialized, the following warning is shown: WARNING KERN tegra210-ahub 2900800.ahub: using zero-initialized flat cache, this may cause unexpected behavior Switch to REGCACHE_FLAT_S which is the recommended cache type for sparse register maps without defaults. This cache type initializes entries on-demand from hardware, eliminating the warning while using memory efficiently. Signed-off-by: sheetal Link: https://patch.msgid.link/20251208052040.4025612-1-sheetal@nvidia.com Signed-off-by: Mark Brown commit 489e96651dfe59794195c6b2ddb78835edd9f2ed Author: Jens Remus Date: Thu Dec 11 12:24:50 2025 +0100 s390/stacktrace: Do not fallback to RA register The logic to fallback to the return address (RA) register value in the topmost frame when stack tracing using back chain is broken in multiple ways: When assuming the RA register 14 has not been saved yet one must assume that a new user stack frame has not been allocated either. Therefore the back chain would not contain the stack pointer (SP) at entry, but the caller's SP at its entry instead. Therefore when falling back to the RA register 14 value it would also be necessary to fallback to the SP register 15 value. Otherwise an invalid combination of RA register 14 and caller's SP at its entry (from the back chain) is used. In the topmost frame the back chain contains either the caller's SP at its entry (before having allocated a new stack frame in the prologue), the SP at entry (after having allocated a new stack frame), or an uninitialized value (during static/dynamic stack allocation). In both cases where the back chain is valid either the caller or prologue must have saved its respective RA to the respective frame. Therefore, if the RA obtained from the frame pointed to by the back chain is invalid, this does not indicate that the IP in the topmost frame is still early in the prologue and the RA has not been saved. Reviewed-by: Heiko Carstens Signed-off-by: Jens Remus Signed-off-by: Heiko Carstens commit af241e6bfc11125e6669dabf0800fce6809dd3cf Author: Benjamin Block Date: Fri Dec 5 16:47:18 2025 +0100 s390/pci: Annotate lock context imbalance in zpci_release_device() When checking `arch/s390/pci/pci.c` with `sparse` during build, the following complaint is reported: arch/s390/pci/pci.c: note: in included file (through include/linux/smp.h, include/linux/lockdep.h, include/linux/spinlock.h, include/linux/mmzone.h, include/linux/gfp.h, include/linux/slab.h): ./include/linux/list.h:237:25: warning: context imbalance in 'zpci_release_device' - unexpected unlock But this is expected, as zpci_release_device() is expected to be called with `zpci_list_lock` held, as part of `kref_put_lock()` or similar. Reflect this by annotating the function with the appropriate __releases(). Signed-off-by: Benjamin Block Reviewed-by: Farhan Ali Reviewed-by: Niklas Schnelle Reviewed-by: Gerd Bayer Signed-off-by: Heiko Carstens commit 4cb92fa763823d813d22b45b7f18fcf6e85a72ad Author: Benjamin Block Date: Fri Dec 5 16:47:17 2025 +0100 s390/pci: Fix cyclic dead-lock in zpci_zdev_put() and zpci_scan_devices() When triggering PCI device recovery by writing into the SysFS attribute `recover` of a Physical Function with existing child SR-IOV Virtual Functions, lockdep is reporting a possible deadlock between three threads: Thread (A) Thread (B) Thread (C) | | | recover_store() zpci_scan_devices() zpci_scan_devices() lock(pci_rescan_remove_lock) | | | | | | | zpci_bus_scan_busses() | | lock(zbus_list_lock) | zpci_add_device() | | lock(zpci_add_remove_lock) | | | ┴ | | zpci_bus_scan_bus() | | lock(pci_rescan_remove_lock) ┴ | zpci_zdev_put() | lock(zpci_add_remove_lock) | ┴ zpci_bus_get() lock(zbus_list_lock) In zpci_bus_scan_busses() the `zbus_list_lock` is taken for the whole duration of the function, which also includes taking `pci_rescan_remove_lock`, among other things. But `zbus_list_lock` only really needs to protect the modification of the global registration `zbus_list`, it can be dropped while the functions within the list iteration run; this way we break the cycle above. Break up zpci_bus_scan_busses() into an "iterator" zpci_bus_get_next() that iterates over `zbus_list` element by element, and acquires and releases `zbus_list_lock` as necessary, but never keep holding it. References to `zpci_bus` objects are also acquired and released. The reference counting on `zpci_bus` objects is also changed so that all put() and get() operations are done under the protection of `zbus_list_lock`, and if the operation results in a modification of `zpci_bus_list`, this modification is done in the same critical section (apart the very first initialization). This way objects are never seen on the list that are about to be released and/or half-initialized. Fixes: 14c87ba8123a ("s390/pci: separate zbus registration from scanning") Suggested-by: Niklas Schnelle Signed-off-by: Benjamin Block Reviewed-by: Niklas Schnelle Reviewed-by: Gerd Bayer Signed-off-by: Heiko Carstens commit b1aa01d31249bd116b18c7f512d3e46b4b4ad83b Author: Sven Schnelle Date: Fri Dec 5 10:58:57 2025 +0100 s390/ipl: Clear SBP flag when bootprog is set With z16 a new flag 'search boot program' was introduced for list-directed IPL (SCSI, NVMe, ECKD DASD). If this flag is set, e.g. via selecting the "Automatic" value for the "Boot program selector" control on an HMC load panel, it is copied to the reipl structure from the initial ipl structure. When a user now sets a boot prog via sysfs, the flag is not cleared and the bootloader will again automatically select the boot program, ignoring user configuration. To avoid that, clear the SBP flag when a bootprog sysfs file is written. Cc: stable@vger.kernel.org Reviewed-by: Peter Oberparleiter Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 430f7803b69cd5e5694e5dfc884c6628870af36e Author: Johan Hovold Date: Mon Nov 17 17:12:58 2025 +0100 dmaengine: ti: k3-udma: fix device leak on udma lookup Make sure to drop the reference taken when looking up the UDMA platform device. Note that holding a reference to a platform device does not prevent its driver data from going away so there is no point in keeping the reference after the lookup helper returns. Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users") Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()") Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c Cc: Grygorii Strashko Cc: Yu Kuai Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org Signed-off-by: Vinod Koul commit 646ff780338bd7305c9f2fdeb418fdb01623a71c Author: Johan Hovold Date: Mon Nov 17 17:12:57 2025 +0100 dmaengine: ti: dma-crossbar: clean up dra7x route allocation error paths Use a common exit path to drop the cross platform device reference on errors for consistency with am335x. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-16-johan@kernel.org Signed-off-by: Vinod Koul commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 Author: Johan Hovold Date: Mon Nov 17 17:12:56 2025 +0100 dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation Make sure to drop the reference taken when looking up the crossbar platform device during am335x route allocation. Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx") Cc: stable@vger.kernel.org # 4.4 Cc: Peter Ujfalusi Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org Signed-off-by: Vinod Koul commit dc7e44db01fc2498644e3106db3e62a9883a93d5 Author: Johan Hovold Date: Mon Nov 17 17:12:55 2025 +0100 dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation Make sure to drop the reference taken when looking up the crossbar platform device during dra7x route allocation. Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the reference is still leaking on successful allocation. Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x") Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate") Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e Cc: Peter Ujfalusi Cc: Miaoqian Lin Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org Signed-off-by: Vinod Koul commit 10bf494fd77b34d0749e098c939f85abf52801d1 Author: Johan Hovold Date: Mon Nov 17 17:12:54 2025 +0100 dmaengine: stm32: dmamux: clean up route allocation error labels Error labels should be named after what they do (and not after wherefrom they are jumped to). Signed-off-by: Johan Hovold Reviewed-by: Amelie Delaunay Link: https://patch.msgid.link/20251117161258.10679-13-johan@kernel.org Signed-off-by: Vinod Koul commit b1b590a590af13ded598e70f0b72bc1e515787a1 Author: Johan Hovold Date: Mon Nov 17 17:12:53 2025 +0100 dmaengine: stm32: dmamux: fix OF node leak on route allocation failure Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures. Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver") Cc: stable@vger.kernel.org # 4.15 Cc: Pierre-Yves MORDRET Signed-off-by: Johan Hovold Reviewed-by: Amelie Delaunay Link: https://patch.msgid.link/20251117161258.10679-12-johan@kernel.org Signed-off-by: Vinod Koul commit dd6e4943889fb354efa3f700e42739da9bddb6ef Author: Johan Hovold Date: Mon Nov 17 17:12:52 2025 +0100 dmaengine: stm32: dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver") Cc: stable@vger.kernel.org # 4.15 Cc: Pierre-Yves MORDRET Signed-off-by: Johan Hovold Reviewed-by: Amelie Delaunay Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org Signed-off-by: Vinod Koul commit 9fb490323997dcb6f749cd2660a17a39854600cd Author: Johan Hovold Date: Mon Nov 17 17:12:51 2025 +0100 dmaengine: sh: rz-dmac: fix device leak on probe failure Make sure to drop the reference taken when looking up the ICU device during probe also on probe failures (e.g. probe deferral). Fixes: 7de873201c44 ("dmaengine: sh: rz-dmac: Add RZ/V2H(P) support") Cc: stable@vger.kernel.org # 6.16 Cc: Fabrizio Castro Signed-off-by: Johan Hovold Reviewed-by: Fabrizio Castro Link: https://patch.msgid.link/20251117161258.10679-10-johan@kernel.org Signed-off-by: Vinod Koul commit d9847e6d1d91462890ba297f7888fa598d47e76e Author: Johan Hovold Date: Mon Nov 17 17:12:50 2025 +0100 dmaengine: lpc32xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: 5d318b595982 ("dmaengine: Add dma router for pl08x in LPC32XX SoC") Cc: stable@vger.kernel.org # 6.12 Cc: Piotr Wojtaszczyk Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251117161258.10679-9-johan@kernel.org Signed-off-by: Vinod Koul commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 Author: Johan Hovold Date: Mon Nov 17 17:12:49 2025 +0100 dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux") Cc: stable@vger.kernel.org # 4.3 Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org Signed-off-by: Vinod Koul commit 799900f01792cf8b525a44764f065f83fcafd468 Author: Johan Hovold Date: Mon Nov 17 17:12:48 2025 +0100 dmaengine: idxd: fix device leaks on compat bind and unbind Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and unbind sysfs interface. Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode") Cc: stable@vger.kernel.org # 5.15 Cc: Dave Jiang Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org Signed-off-by: Vinod Koul commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 Author: Johan Hovold Date: Mon Nov 17 17:12:47 2025 +0100 dmaengine: dw: dmamux: fix OF node leak on route allocation failure Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures. Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support") Cc: stable@vger.kernel.org # 5.19 Cc: Miquel Raynal Signed-off-by: Johan Hovold Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org Signed-off-by: Vinod Koul commit 7bb7d696e0361bbfc1411462c784998cca0afcbb Author: Johan Hovold Date: Mon Nov 17 17:12:46 2025 +0100 dmaengine: cv1800b-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: db7d07b5add4 ("dmaengine: add driver for Sophgo CV18XX/SG200X dmamux") Cc: stable@vger.kernel.org # 6.17 Cc: Inochi Amaoto Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-5-johan@kernel.org Signed-off-by: Vinod Koul commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 Author: Johan Hovold Date: Mon Nov 17 17:12:45 2025 +0100 dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind. Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver") Cc: stable@vger.kernel.org # 4.13 Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org Signed-off-by: Vinod Koul commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 Author: Johan Hovold Date: Mon Nov 17 17:12:43 2025 +0100 dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to drop the reference taken when looking up the DMA platform device during of_dma_xlate() when releasing channel resources. Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") fixed the leak in a couple of error paths but the reference is still leaking on successful allocation. Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2 Cc: Yu Kuai Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org Signed-off-by: Vinod Koul commit c7d436a6c1a274c1ac28d5fb3b8eb8f03b6d0e10 Author: Anthony Brandon Date: Mon Oct 13 17:48:49 2025 +0200 dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault: tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[1217] exited with preempt_count 1 Segmentation fault Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Reviewed-by: Lizhi Hou Reviewed-by: Radhey Shyam Pandey Reviewed-by: Alexander Stein Signed-off-by: Anthony Brandon Signed-off-by: Vinod Koul commit 49400b701eca849c1b53717b1f5d779a8d066ec0 Author: Guodong Xu Date: Thu Sep 18 22:27:27 2025 +0800 dmaengine: mmp_pdma: fix DMA mask handling The driver's existing logic for setting the DMA mask for "marvell,pdma-1.0" was flawed. It incorrectly relied on pdev->dev->coherent_dma_mask instead of declaring the hardware's fixed addressing capability. A cleaner and more correct approach is to define the mask directly based on the hardware limitations. The MMP/PXA PDMA controller is a 32-bit DMA engine. This is supported by datasheets and various dtsi files for PXA25x, PXA27x, PXA3xx, and MMP2, all of which are 32-bit systems. This patch simplifies the driver's logic by replacing the 'u64 dma_mask' field with a simpler 'u32 dma_width' to store the addressing capability in bits. The complex if/else block in probe() is then replaced with a single, clear call to dma_set_mask_and_coherent(). This sets a fixed 32-bit DMA mask for "marvell,pdma-1.0" and a 64-bit mask for "spacemit,k1-pdma," matching each device's hardware capabilities. Finally, this change also works around a specific build error encountered with clang-20 on x86_64 allyesconfig. The shift-count-overflow error is caused by a known clang compiler issue where the DMA_BIT_MASK(n) macro's ternary operator is not correctly evaluated in static initializers. By moving the macro's evaluation into the probe() function, the driver avoids this compiler bug. Fixes: 5cfe585d8624 ("dmaengine: mmp_pdma: Add SpacemiT K1 PDMA support with 64-bit addressing") Reported-by: Naresh Kamboju Closes: https://lore.kernel.org/lkml/CA+G9fYsPcMfW-e_0_TRqu4cnwqOqYF3aJOeKUYk6Z4qRStdFvg@mail.gmail.com Suggested-by: Arnd Bergmann Signed-off-by: Guodong Xu Reviewed-by: Arnd Bergmann Tested-by: Nathan Chancellor # build Tested-by: Naresh Kamboju Signed-off-by: Vinod Koul commit 21433d3e3ca14d20f9b0c2237b3d3a1355af7907 Author: Kyle Meyer Date: Fri Dec 12 12:53:36 2025 -0600 x86/platform/uv: Fix UBSAN array-index-out-of-bounds When UBSAN is enabled, multiple array-index-out-of-bounds messages are printed: [ 0.000000] [ T0] UBSAN: array-index-out-of-bounds in arch/x86/kernel/apic/x2apic_uv_x.c:276:23 [ 0.000000] [ T0] index 1 is out of range for type ' [1]' ... [ 0.000000] [ T0] UBSAN: array-index-out-of-bounds in arch/x86/kernel/apic/x2apic_uv_x.c:277:32 [ 0.000000] [ T0] index 1 is out of range for type ' [1]' ... [ 0.000000] [ T0] UBSAN: array-index-out-of-bounds in arch/x86/kernel/apic/x2apic_uv_x.c:282:16 [ 0.000000] [ T0] index 1 is out of range for type ' [1]' ... [ 0.515850] [ T1] UBSAN: array-index-out-of-bounds in arch/x86/kernel/apic/x2apic_uv_x.c:1344:23 [ 0.519851] [ T1] index 1 is out of range for type ' [1]' ... [ 0.603850] [ T1] UBSAN: array-index-out-of-bounds in arch/x86/kernel/apic/x2apic_uv_x.c:1345:32 [ 0.607850] [ T1] index 1 is out of range for type ' [1]' ... [ 0.691850] [ T1] UBSAN: array-index-out-of-bounds in arch/x86/kernel/apic/x2apic_uv_x.c:1353:20 [ 0.695850] [ T1] index 1 is out of range for type ' [1]' One-element arrays have been deprecated: https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays Switch entry in struct uv_systab to a flexible array member to fix UBSAN array-index-out-of-bounds messages. sizeof(struct uv_systab) is passed to early_memremap() and ioremap(). The flexible array member is not accessed until the UV system table size is used to remap the entire UV system table, so changes to sizeof(struct uv_systab) have no impact. Signed-off-by: Kyle Meyer Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/aTxksN-3otY41WvQ@hpe.com commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8 Author: Linus Torvalds Date: Sun Dec 14 16:05:07 2025 +1200 Linux 6.19-rc1 commit 6a1636e06625ec0dd7f2b908ab39a8beea24bfd3 Merge: 0dfb36b2dcb666 946574434aa9cf Author: Linus Torvalds Date: Sun Dec 14 15:35:35 2025 +1200 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The only core fix is in doc; all the others are in drivers, with the biggest impacts in libsas being the rollback on error handling and in ufs coming from a couple of error handling fixes, one causing a crash if it's activated before scanning and the other fixing W-LUN resumption" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: qcom: Fix confusing cleanup.h syntax scsi: libsas: Add rollback handling when an error occurs scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name() scsi: ufs: core: Fix a deadlock in the frequency scaling code scsi: ufs: core: Fix an error handler crash scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" scsi: ufs: core: Fix RPMB link error by reversing Kconfig dependencies scsi: qla4xxx: Use time conversion macros scsi: qla2xxx: Enable/disable IRQD_NO_BALANCING during reset scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset scsi: imm: Fix use-after-free bug caused by unfinished delayed work scsi: target: sbp: Remove KMSG_COMPONENT macro scsi: core: Correct documentation for scsi_device_quiesce() scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 scsi: target: Reset t_task_cdb pointer in error case scsi: ufs: core: Fix EH failure after W-LUN resume error commit 3010f06c52aa7da51493df59303ea733a614597b Author: Al Viro Date: Sat Dec 13 12:36:15 2025 -0500 shmem_whiteout(): fix regression from tree-in-dcache series Now that shmem_mknod() hashes the new dentry, d_rehash() in shmem_whiteout() should be removed. X-paperbag: brown Reported-by: Hugh Dickins Acked-by: Hugh Dickins Tested-by: Hugh Dickins Fixes: 2313598222f9 ("convert ramfs and tmpfs") Signed-off-by: Al Viro commit 0dfb36b2dcb666f116ba314e631bd3bc632c44d1 Merge: 4cfc21494ac6dd 21c1466ea25114 Author: Linus Torvalds Date: Sun Dec 14 15:24:10 2025 +1200 Merge tag 'ceph-for-6.19-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "We have a patch that adds an initial set of tracepoints to the MDS client from Max, a fix that hardens osdmap parsing code from myself (marked for stable) and a few assorted fixups" * tag 'ceph-for-6.19-rc1' of https://github.com/ceph/ceph-client: rbd: stop selecting CRC32, CRYPTO, and CRYPTO_AES ceph: stop selecting CRC32, CRYPTO, and CRYPTO_AES libceph: make decode_pool() more resilient against corrupted osdmaps libceph: Amend checking to fix `make W=1` build breakage ceph: Amend checking to fix `make W=1` build breakage ceph: add trace points to the MDS client libceph: fix log output race condition in OSD client commit 4cfc21494ac6dd8518b0ebbc73cf625523ddd870 Merge: 4a298a43f5e339 a9ea3a2e081d29 Author: Linus Torvalds Date: Sun Dec 14 15:21:02 2025 +1200 Merge tag 'tomoyo-pr-20251212' of git://git.code.sf.net/p/tomoyo/tomoyo Pull tomoyo update from Tetsuo Handa: "Trivial optimization" * tag 'tomoyo-pr-20251212' of git://git.code.sf.net/p/tomoyo/tomoyo: tomoyo: Use local kmap in tomoyo_dump_page() commit 4a298a43f5e339f48d2dda0665c02b88ee9a4e03 Merge: cba09e3ed06db4 c94291914b200e Author: Linus Torvalds Date: Sun Dec 14 06:12:46 2025 +1200 Merge tag 'smp-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU hotplug fix from Ingo Molnar: - Fix CPU hotplug callbacks to disable interrupts on UP kernels * tag 'smp-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu: Make atomic hotplug callbacks run with interrupts disabled on UP commit cba09e3ed06db4b6c87bc97e0aea080421fb8f7d Merge: db0130185ee328 9415f749d34b92 Author: Linus Torvalds Date: Sun Dec 14 06:10:35 2025 +1200 Merge tag 'perf-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fixes from Ingo Molnar: - Fix NULL pointer dereference crash in the Intel PMU driver - Fix missing read event generation on task exit - Fix AMD uncore driver init error handling - Fix whitespace noise * tag 'perf-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() perf/core: Fix missing read event generation on task exit perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error perf/uprobes: Remove whitespace noise commit db0130185ee32896524963289840c97dd73aaaa3 Merge: edbe407235ecfc 7dbc0d40d8347b Author: Linus Torvalds Date: Sun Dec 14 06:07:09 2025 +1200 Merge tag 'irq-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: - Fix error code in the irqchip/mchp-eic driver - Fix setup_percpu_irq() affinity assumptions - Remove the unused irq_domain_add_tree() function * tag 'irq-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() irqdomain: Delete irq_domain_add_tree() genirq: Allow NULL affinity for setup_percpu_irq() commit edbe407235ecfc827b6a211628988261f957df9e Merge: 9d9c1cfec01cdb bdae29d6512ddc Author: Linus Torvalds Date: Sun Dec 14 06:04:16 2025 +1200 Merge tag 'core-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc core fixes from Ingo Molnar: - Improve bug reporting - Suppress W=1 format warning - Improve rseq scalability on Clang builds * tag 'core-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Always inline rseq_debug_syscall_return() bug: Hush suggest-attribute=format for __warn_printf() bug: Let report_bug_entry() provide the correct bugaddr commit 0c01ea92f545ca7fcafdda6a8e29b65ef3a5ec74 Author: Tal Zussman Date: Fri Dec 12 04:08:08 2025 -0500 mm: Remove tlb_flush_reason::NR_TLB_FLUSH_REASONS from This has been unused since it was added 11 years ago in: d17d8f9dedb9 ("x86/mm: Add tracepoints for TLB flushes") Signed-off-by: Tal Zussman Signed-off-by: Ingo Molnar Reviewed-by: Rik van Riel Acked-by: David Hildenbrand Link: https://patch.msgid.link/20251212-tlb-trace-fix-v2-2-d322e0ad9b69@columbia.edu commit 8b62e64e6d30fa047b3aefb1a36e1f80c8acb3d2 Author: Tal Zussman Date: Fri Dec 12 04:08:07 2025 -0500 x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in When the TLB_REMOTE_WRONG_CPU enum was introduced for the tlb_flush tracepoint, the enum was not exported to user-space. Add it to the appropriate macro definition to enable parsing by userspace tools, as per: Link: https://lore.kernel.org/all/20150403013802.220157513@goodmis.org [ mingo: Capitalize IPI, etc. ] Fixes: 2815a56e4b72 ("x86/mm/tlb: Add tracepoint for TLB flush IPI to stale CPU") Signed-off-by: Tal Zussman Signed-off-by: Ingo Molnar Reviewed-by: Steven Rostedt (Google) Reviewed-by: David Hildenbrand Reviewed-by: Rik van Riel Link: https://patch.msgid.link/20251212-tlb-trace-fix-v2-1-d322e0ad9b69@columbia.edu commit 043507144ae13d3b882d40495d101bb4c4990d98 Author: Thorsten Blum Date: Wed Dec 10 13:56:28 2025 +0100 x86/sgx: Remove unmatched quote in __sgx_encl_extend function comment There is no opening quote. Remove the unmatched closing quote. Signed-off-by: Thorsten Blum Signed-off-by: Ingo Molnar Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251210125628.544916-1-thorsten.blum@linux.dev commit e64826e5e367ad45539ab245b92f009ee165025c Author: Kai Vehmanen Date: Fri Dec 12 19:46:58 2025 +0200 ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL The ALC233 codec on these Medion NM14LNL (SPRCHRGD 14 S2) systems requires a quirk to enable all speakers. Tested-by: davplsm Link: https://github.com/thesofproject/linux/issues/5611 Signed-off-by: Kai Vehmanen Link: https://patch.msgid.link/20251212174658.752641-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 7141cb1092eb5f30bbb0bcd298e01bbd2c4f0666 Author: Jussi Laako Date: Thu Dec 11 17:22:23 2025 +0200 ALSA: usb-audio: Do not expose PCM and DSD on same altsetting unless DoP Do not expose DSD altsetting as a PCM one, even if the descriptor claims it to be PCM instead of special format. Signed-off-by: Jussi Laako Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251211152224.1780782-3-jussi@sonarnerd.net commit 7fde61795df6cbdab90166df33648cc6314fcadd Author: Jussi Laako Date: Thu Dec 11 17:22:22 2025 +0200 ALSA: usb-audio: Reorder USB mode selection quirk When using mode selection quirk, apply the quirk before rate setting. Also apply this quirk on certain newer ITF interface devices. Signed-off-by: Jussi Laako Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251211152224.1780782-2-jussi@sonarnerd.net commit da3a7efff64ec0d63af4499eea3a46a2e13b5797 Author: Jussi Laako Date: Thu Dec 11 17:22:21 2025 +0200 ALSA: usb-audio: Update for native DSD support quirks Maintenance patch for native DSD support. Add set of missing device and vendor quirks; TEAC, Esoteric, Luxman and Musical Fidelity. Signed-off-by: Jussi Laako Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251211152224.1780782-1-jussi@sonarnerd.net commit cdc996667c26b3c4570881cd9ad2c080da4ce331 Author: Jiapeng Chong Date: Fri Dec 12 14:24:10 2025 +0800 ALSA: hda: Remove unnecessary print function dev_err() The print function dev_err() is redundant because platform_get_irq() already prints an error. ./sound/hda/controllers/cix-ipbloq.c:119:2-9: line 119 is redundant because platform_get_irq() already prints an error. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=28045 Signed-off-by: Jiapeng Chong Link: https://patch.msgid.link/20251212062410.3706839-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Takashi Iwai commit 9d9c1cfec01cdbf24bd9322ed555713a20422115 Merge: 2516a87153183e 601cc399a01049 Author: Linus Torvalds Date: Sat Dec 13 20:55:12 2025 +1200 Merge tag 'mm-nonmm-stable-2025-12-11-11-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc updates from Andrew Morton: "There are no significant series in this small merge. Please see the individual changelogs for details" [ Editor's note: it's mainly ocfs2 and a couple of random fixes ] * tag 'mm-nonmm-stable-2025-12-11-11-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: memfd_luo: add CONFIG_SHMEM dependency mm: shmem: avoid build warning for CONFIG_SHMEM=n ocfs2: fix memory leak in ocfs2_merge_rec_left() ocfs2: invalidate inode if i_mode is zero after block read ocfs2: avoid -Wflex-array-member-not-at-end warning ocfs2: convert remaining read-only checks to ocfs2_emergency_state ocfs2: add ocfs2_emergency_state helper and apply to setattr checkpatch: add uninitialized pointer with __free attribute check args: fix documentation to reflect the correct numbers ocfs2: fix kernel BUG in ocfs2_find_victim_chain liveupdate: luo_core: fix redundant bound check in luo_ioctl() ocfs2: validate inline xattr size and entry count in ocfs2_xattr_ibody_list fs/fat: remove unnecessary wrapper fat_max_cache() ocfs2: replace deprecated strcpy with strscpy ocfs2: check tl_used after reading it from trancate log inode liveupdate: luo_file: don't use invalid list iterator commit 2516a87153183e1797021879121ca25c95f1ea3a Merge: d2ea4d254d04a8 dafdba0964bd10 Author: Linus Torvalds Date: Sat Dec 13 20:35:41 2025 +1200 Merge tag 'mm-stable-2025-12-11-11-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: - "powerpc/pseries/cmm: two smaller fixes" (David Hildenbrand) fixes a couple of minor things in ppc land - "Improve folio split related functions" (Zi Yan) some cleanups and minorish fixes in the folio splitting code * tag 'mm-stable-2025-12-11-11-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon/tests/core-kunit: avoid damos_test_commit stack warning mm: vmscan: correct nr_requested tracing in scan_folios MAINTAINERS: add idr core-api doc file to XARRAY mm/hugetlb: fix incorrect error return from hugetlb_reserve_pages() mm: fix CONFIG_STACK_GROWSUP typo in mm.h mm/huge_memory: fix folio split stats counting mm/huge_memory: make min_order_for_split() always return an order mm/huge_memory: replace can_split_folio() with direct refcount calculation mm/huge_memory: change folio_split_supported() to folio_check_splittable() mm/sparse: fix sparse_vmemmap_init_nid_early definition without CONFIG_SPARSEMEM powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION commit d2ea4d254d04a89e17504af0230c7268e3cac6bf Author: Christian Brauner Date: Sat Dec 13 08:45:23 2025 +0100 file: ensure cleanup Brown paper bag time. This is a silly oversight where I missed to drop the error condition checking to ensure we clean up on early error returns. I have an internal unit testset coming up for this which will catch all such issues going forward. Reported-by: Chris Mason Reported-by: Jeff Layton Fixes: 011703a9acd7 ("file: add FD_{ADD,PREPARE}()") Signed-off-by: Christian Brauner Reviewed-by: Jeff Layton Signed-off-by: Linus Torvalds commit d552fc632cf5b7e3b2808fd341708bd353072c45 Author: Linus Torvalds Date: Sat Dec 13 19:57:41 2025 +1200 x86/hv: Add gitignore entry for generated header file Commit 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver") added a new generated header file for the offsets into the mshv_vtl_cpu_context structure to be used by the low-level assembly code. But it didn't add the .gitignore file to go with it, so 'git status' and friends will mention it. Let's add the gitignore file before somebody thinks that generated header should be committed. Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver") Signed-off-by: Linus Torvalds commit a859eca0e4cc96f63ff125dbe5388d961558b0e9 Merge: 237f1bbfe3d84a 5300831555cc6b Author: Linus Torvalds Date: Sat Dec 13 17:39:28 2025 +1200 Merge tag 'drm-fixes-2025-12-13' of https://gitlab.freedesktop.org/drm/kernel Pull more drm fixes from Dave Airlie: "These are the enqueued fixes that ended up in our fixes branch, nouveau mostly, along with some small fixes in other places. plane: - Handle IS_ERR vs NULL in drm_plane_create_hotspot_properties() ttm: - fix devcoredump for evicted bos panel: - Fix stack usage warning in novatek-nt35560 nouveau: - alloc fwsec sb at boot to avoid s/r problems - fix strcpy usage - fix i2c encoder crash bridge: - Ignore spurious PLL_UNLOCK bit in ti-sn65dsi83 mgag200: - Fix bigendian handling in mgag200 tilcdc: - Fix probe failure in tilcdc" * tag 'drm-fixes-2025-12-13' of https://gitlab.freedesktop.org/drm/kernel: drm/mgag200: Fix big-endian support drm/tilcdc: Fix removal actions in case of failed probe drm/ttm: Avoid NULL pointer deref for evicted BOs drm: nouveau: Replace sprintf() with sysfs_emit() drm/nouveau: fix circular dep oops from vendored i2c encoder drm/nouveau: refactor deprecated strcpy drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() drm/bridge: ti-sn65dsi83: ignore PLL_UNLOCK errors drm/nouveau/gsp: Allocate fwsec-sb at boot drm/panel: novatek-nt35560: avoid on-stack device structure commit 237f1bbfe3d84a74ad8e6e207660bdb3e6d9a84d Merge: d8cc0b917ba619 37a1cefd4d4e0b Author: Linus Torvalds Date: Sat Dec 13 17:25:26 2025 +1200 Merge tag 'drm-next-2025-12-13' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "This is the weekly fixes for what is in next tree, mostly amdgpu and some i915, panthor and a core revert. core: - revert dumb bo 8 byte alignment amdgpu: - SI fix - DC reduce stack usage - HDMI fixes - VCN 4.0.5 fix - DP MST fix - DC memory allocation fix amdkfd: - SVM fix - Trap handler fix - VGPR fixes for GC 11.5 i915: - Fix format string truncation warning - FIx runtime PM reference during fbdev BO creation panthor: - fix UAF renesas: - fix sync flag handling" * tag 'drm-next-2025-12-13' of https://gitlab.freedesktop.org/drm/kernel: Revert "drm/amd/display: Fix pbn to kbps Conversion" drm/amd: Fix unbind/rebind for VCN 4.0.5 drm/i915: Fix format string truncation warning drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation drm/amd/display: Improve HDMI info retrieval drm/amdkfd: bump minimum vgpr size for gfx1151 drm/amd/display: shrink struct members drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace drm/amd/display: Refactor dml_core_mode_support to reduce stack frame drm/amdgpu: don't attach the tlb fence for SI drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() drm/amdkfd: Trap handler support for expert scheduling mode drm/amdkfd: Use huge page size to check split svm range alignment drm/rcar-du: dsi: Handle both DRM_MODE_FLAG_N.SYNC and !DRM_MODE_FLAG_P.SYNC drm/gem-shmem: revert the 8-byte alignment constraint drm/gem-dma: revert the 8-byte alignment constraint drm/panthor: Prevent potential UAF in group creation commit d8cc0b917ba619c8f03d597f1a6612777f1096ed Merge: d324e9a9150218 136209e6bd981e Author: Linus Torvalds Date: Sat Dec 13 17:15:16 2025 +1200 Merge tag 'i3c/for-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull further i3c update from Alexandre Belloni: "We are removing a legacy API callback and having this sooner rather than later will help ensuring no one introduces a new driver using it. I've also added patches removing the "__free(...) = NULL" pattern because I'm sure we won't avoid people sending those following the mailing list discussion..." * tag 'i3c/for-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: adi: Fix confusing cleanup.h syntax i3c: master: Fix confusing cleanup.h syntax i3c: master: cleanup callback .priv_xfers() i3c: master: switch to use new callback .i3c_xfers() from .priv_xfers() commit d324e9a91502184e0ac201293a6ec0fbe10458ed Merge: a919610db43b34 16bd954c933601 Author: Linus Torvalds Date: Sat Dec 13 17:09:06 2025 +1200 Merge tag 'rtc-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Subsystem: - stop setting max_user_freq from the individual drivers as this has not been hardware related for a while New drivers: - Andes ATCRTC100 - Apple SMC - Nvidia VRS Drivers: - renesas-rtca3: add RZ/V2H support - tegra: add ACPI support" * tag 'rtc-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (34 commits) rtc: spacemit: MFD_SPACEMIT_P1 as dependencies rtc: atcrtc100: Fix signedness bug in probe() rtc: max31335: Fix ignored return value in set_alarm rtc: gamecube: Check the return value of ioremap() Documentation: ABI: testing: Fix "upto" typo in rtc-cdev rtc: Add new rtc-macsmc driver for Apple Silicon Macs dt-bindings: rtc: Add Apple SMC RTC MAINTAINERS: drop unneeded file entry in NVIDIA VRS RTC DRIVER rtc: isl12026: Add id_table rtc: renesas-rtca3: Add support for multiple reset lines dt-bindings: rtc: renesas,rz-rtca3: Add RZ/V2H support rtc: tegra: Replace deprecated SIMPLE_DEV_PM_OPS rtc: tegra: Add ACPI support rtc: tegra: Use devm_clk_get_enabled() in probe rtc: Kconfig: add MC34708 to mc13xxx help text rtc: s35390a: use u8 instead of char for register buffer rtc: nvvrs: add NVIDIA VRS RTC device driver dt-bindings: rtc: Document NVIDIA VRS RTC rtc: atcrtc100: Add ATCRTC100 RTC driver MAINTAINERS: Add entry for ATCRTC100 RTC driver ... commit a919610db43b34621d0c3b333e12db9002caf5da Merge: a6bb419c1c0061 3c180003dffbc2 Author: Linus Torvalds Date: Sat Dec 13 16:41:50 2025 +1200 Merge tag 'pwm/for-6.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fix from Uwe Kleine-König: "Fix missing th1520 Kconfig dependencies This tightens the dependency for the new pwm driver written in Rust to make build bots and obviously also users happy" * tag 'pwm/for-6.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: th1520: Fix missing Kconfig dependencies commit a6bb419c1c0061abf164eb437bf0dc0281ba7369 Merge: 41572e2c05e589 ea513dd3c06607 Author: Linus Torvalds Date: Sat Dec 13 16:36:57 2025 +1200 Merge tag 'gpio-fixes-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: - fix spinlock op type after conversion to lock guards - fix a memory leak in error path in gpio-regmap - Kconfig fixes in GPIO drivers - add a GPIO ACPI quirk for Dell Precision 7780 - set of fixes for shared GPIO management * tag 'gpio-fixes-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: shared: make locking more fine-grained gpio: shared: fix auxiliary device cleanup order gpio: shared: check if a reference is populated before cleaning its resources gpio: shared: fix NULL-pointer dereference in teardown path gpio: shared: ignore disabled nodes when traversing the device-tree gpiolib: acpi: Add quirk for Dell Precision 7780 gpio: tb10x: fix OF_GPIO dependency gpio: qixis: select CONFIG_REGMAP_MMIO gpio: regmap: Fix memleak in error path in gpio_regmap_register() gpio: mmio: fix bad guard conversion commit 41572e2c05e5892ecdb18e47fd47f208ea648ec6 Merge: db9c4387391e09 94bf74830a977a Author: Linus Torvalds Date: Sat Dec 13 16:29:22 2025 +1200 Merge tag 'pci-v6.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Initialize rzg3s_pcie_msi_irq() MSI status bitmap before use (Claudiu Beznea) * tag 'pci-v6.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: rzg3s-host: Initialize MSI status bitmap before use commit db9c4387391e09209d44d41c2791512ac45b9e3c Merge: 7f3c8f91912546 188d194be2bfe0 Author: Linus Torvalds Date: Sat Dec 13 16:26:55 2025 +1200 Merge tag 'soundwire-6.19-rc1_updated' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - Support for multiple sections in a BPT stream - Align DMA frame with BPT frames - Qualcomm support for v3.1.0 controllers * tag 'soundwire-6.19-rc1_updated' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel_ace2x: handle multi BPT sections soundwire: pass sdw_bpt_section to cdns BPT helpers soundwire: introduce BPT section soundwire: intel_ace2x: add fake frame to BRA read command soundwire: cadence_master: add fake_size parameter to sdw_cdns_prepare_read_dma_buffer ASoC: SOF: Intel: export hda_sdw_bpt_get_buf_size_aligment soundwire: cadence: export sdw_cdns_bpt_find_bandwidth soundwire: cadence_master: set data_per_frame as frame capability soundwire: only compute BPT stream in sdw_compute_dp0_port_params soundwire: cadence_master: make frame index trace more readable soundwire: qcom: adding support for v3.1.0 dt-bindings: soundwire: qcom: Document v3.1.0 version of IP block soundwire: qcom: prepare for v3.x soundwire: qcom: deprecate qcom,din/out-ports dt-bindings: soundwire: qcom: deprecate qcom,din/out-ports soundwire: qcom: remove unused rd_fifo_depth of: base: Add of_property_read_u8_index commit 7f3c8f9191254654e6a88cd757ff079dafbd2f0b Merge: 9551a26f17d944 fd324768eb2c13 Author: Linus Torvalds Date: Sat Dec 13 16:09:10 2025 +1200 Merge tag 'sound-fix-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The only slightly large change is the enablement of CIX HD-audio controller, which took a bit time to be cooked up, while most of other changes are device-specific small trivial fixes: - Default disablement of the kconfig for decades old pre-release alsa-lib PCM API; it's only the default config value change, so it can't lead to any regressions for the existing setups - Support for CIX HD-audio controller - A few ASoC ACP fixes - Fixes for ASoC cirrus, bcm, wcd, qcom, ak platforms - Trivial hardening for FireWire and USB-audio - HD-audio Intel binding fix and quirks" * tag 'sound-fix-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (30 commits) ALSA: hda/tas2781: Add new quirk for HP new project ALSA: hda: cix-ipbloq: Use modern PM ops ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback ASoC: amd: acp: update tdm channels for specific DAI ASoC: cs35l56: Fix incorrect select SND_SOC_CS35L56_CAL_SYSFS_COMMON ALSA: firewire-motu: add bounds check in put_user loop for DSP events ASoC: cs35l41: Always return 0 when a subsystem ID is found ALSA: uapi: Fix typo in asound.h comment ALSA: Do not build obsolete API ALSA: hda: add CIX IPBLOQ HDA controller support ALSA: hda/core: add addr_offset field for bus address translation ALSA: hda: dt-bindings: add CIX IPBLOQ HDA controller support ALSA: hda/realtek: Add support for ASUS UM3406GA ALSA: hda/realtek: Add support for HP Turbine Laptops ALSA: usb-audio: Initialize status1 to fix uninitialized symbol errors ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() ASoC: cros_ec_codec: Remove unnecessary selection of CRYPTO ASoc: qcom: q6afe: fix bad guard conversion ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) ... commit fbbd7ce627af733ded7971b2495b0d099a0a80da Author: Thomas Gleixner Date: Fri Dec 12 13:01:04 2025 +0900 genirq: Don't overwrite interrupt thread flags on setup Chris reported that the recent affinity management changes result in overwriting the already initialized thread flags. Use set_bit() to set the affinity bit instead of assigning the bit value to the flags. Fixes: 801afdfbfcd9 ("genirq: Fix interrupt threads affinity vs. cpuset isolated partitions") Reported-by: Chris Mason Signed-off-by: Thomas Gleixner Acked-by: Frederic Weisbecker Link: https://patch.msgid.link/87ecp0e4cf.ffs@tglx Closes: https://lore.kernel.org/all/20251212014848.3509622-1-clm@meta.com commit 5300831555cc6bb45bf824262ac044e8891b581c Merge: 7d0a66e4bb9081 6cb31fba137d45 Author: Dave Airlie Date: Sat Dec 13 10:54:28 2025 +1000 Merge tag 'drm-misc-fixes-2025-12-10' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v6.19-rc1: - Fix stack usage warning in novatek-nt35560. - Fix s/r, i2c issues in nouveau and update string handling. - Ignore spurious PLL_UNLOCK bit in ti-sn65dsi83. - Handle IS_ERR vs NULL in drm_plane_create_hotspot_properties(). - Fix devcoredump crash on reading evicted bo's. - Fix bigendian handling in mgag200. - Fix probe failure in tilcdc. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/6c371dc1-08bf-4a34-895c-9ef348b6061b@linux.intel.com commit 136209e6bd981e60db6c0e78f2919ff2f92312d4 Author: Krzysztof Kozlowski Date: Mon Dec 8 03:07:52 2025 +0100 i3c: adi: Fix confusing cleanup.h syntax Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251208020750.4727-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Alexandre Belloni commit cc3b18f9fedec517e35b973d14670a37290f133c Author: Krzysztof Kozlowski Date: Mon Dec 8 03:07:51 2025 +0100 i3c: master: Fix confusing cleanup.h syntax Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Not that other existing usage of __free() in this context is a corret exception initialized to NULL, because the actual allocation is branched in if(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251208020750.4727-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Alexandre Belloni commit 41b80d43d9a00a302b5559baa7ebafc28dd54793 Author: Frank Li Date: Wed Dec 3 15:45:51 2025 -0500 i3c: master: cleanup callback .priv_xfers() Remove the .priv_xfers() callback from the framework after all master controller drivers have switched to use the new .i3c_xfers() callback. Signed-off-by: Frank Li Tested-by: Tommaso Merciai Link: https://patch.msgid.link/20251203-i3c_xfer_cleanup_master-v2-2-7dd94d04ee2d@nxp.com Signed-off-by: Alexandre Belloni commit 9869d3a6fed381f3b98404e26e1afc75d680cbf9 Author: Ming Lei Date: Fri Dec 12 22:35:00 2025 +0800 block: fix race between wbt_enable_default and IO submission When wbt_enable_default() is moved out of queue freezing in elevator_change(), it can cause the wbt inflight counter to become negative (-1), leading to hung tasks in the writeback path. Tasks get stuck in wbt_wait() because the counter is in an inconsistent state. The issue occurs because wbt_enable_default() could race with IO submission, allowing the counter to be decremented before proper initialization. This manifests as: rq_wait[0]: inflight: -1 has_waiters: True rwb_enabled() checks the state, which can be updated exactly between wbt_wait() (rq_qos_throttle()) and wbt_track()(rq_qos_track()), then the inflight counter will become negative. And results in hung task warnings like: task:kworker/u24:39 state:D stack:0 pid:14767 Call Trace: rq_qos_wait+0xb4/0x150 wbt_wait+0xa9/0x100 __rq_qos_throttle+0x24/0x40 blk_mq_submit_bio+0x672/0x7b0 ... Fix this by: 1. Splitting wbt_enable_default() into: - __wbt_enable_default(): Returns true if wbt_init() should be called - wbt_enable_default(): Wrapper for existing callers (no init) - wbt_init_enable_default(): New function that checks and inits WBT 2. Using wbt_init_enable_default() in blk_register_queue() to ensure proper initialization during queue registration 3. Move wbt_init() out of wbt_enable_default() which is only for enabling disabled wbt from bfq and iocost, and wbt_init() isn't needed. Then the original lock warning can be avoided. 4. Removing the ELEVATOR_FLAG_ENABLE_WBT_ON_EXIT flag and its handling code since it's no longer needed This ensures WBT is properly initialized before any IO can be submitted, preventing the counter from going negative. Cc: Nilay Shroff Cc: Yu Kuai Cc: Guangwu Zhang Fixes: 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()") Signed-off-by: Ming Lei Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 63276182c51332b75293ac88f3a81d98bfca1b93 Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:07 2025 -0700 selftests: ublk: add user copy test cases The ublk selftests cover every data copy mode except user copy. Add tests for user copy based on the existing test suite: - generic_14 ("basic recover function verification (user copy)") based on generic_04 and generic_05 - null_03 ("basic IO test with user copy") based on null_01 and null_02 - loop_06 ("write and verify over user copy") based on loop_01 and loop_03 - loop_07 ("mkfs & mount & umount with user copy") based on loop_02 and loop_04 - stripe_05 ("write and verify test on user copy") based on stripe_03 - stripe_06 ("mkfs & mount & umount on user copy") based on stripe_02 and stripe_04 - stress_06 ("run IO and remove device (user copy)") based on stress_01 and stress_03 - stress_07 ("run IO and kill ublk server (user copy)") based on stress_02 and stress_04 Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit b9f0a94c3b2e7deaff93e4c4de335e3054223ff4 Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:06 2025 -0700 selftests: ublk: add support for user copy to kublk The ublk selftests mock ublk server kublk supports every data copy mode except user copy. Add support for user copy to kublk, enabled via the --user_copy (-u) command line argument. On writes, issue pread() calls to copy the write data into the ublk_io's buffer before dispatching the write to the target implementation. On reads, issue pwrite() calls to copy read data from the ublk_io's buffer before committing the request. Copy in 2 KB chunks to provide some coverage of the offseting logic. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 52bc483763262b66e51818a82e03cad0c5bfef67 Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:05 2025 -0700 selftests: ublk: forbid multiple data copy modes The kublk mock ublk server allows multiple data copy mode arguments to be passed on the command line (--zero_copy, --get_data, and --auto_zc). The ublk device will be created with all the requested feature flags, however kublk will only use one of the modes to interact with request data (arbitrarily preferring auto_zc over zero_copy over get_data). To clarify the intent of the test, don't allow multiple data copy modes to be specified. --zero_copy and --auto_zc are allowed together for --auto_zc_fallback, which uses both copy modes. Don't set UBLK_F_USER_COPY for zero_copy, as it's a separate feature. Fix the test cases in test_stress_05 passing --get_data along with --zero_copy or --auto_zc. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit d8295408e0cf529be78ee4ed8b6758a9fb209feb Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:04 2025 -0700 selftests: ublk: don't share backing files between ublk servers stress_04 is missing a wait between blocks of tests, meaning multiple ublk servers will be running in parallel using the same backing files. Add a wait after each section to ensure each backing file is in use by a single ublk server at a time. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 20da98a07bcbacb15fc627f6cf426a2f4d1501e5 Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:03 2025 -0700 selftests: ublk: use auto_zc for PER_IO_DAEMON tests in stress_04 stress_04 is described as "run IO and kill ublk server(zero copy)" but the --per_io_tasks tests cases don't use zero copy. Plus, one of the test cases is duplicated. Add --auto_zc to these test cases and --auto_zc_fallback to one of the duplicated ones. This matches the test cases in stress_03. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 58eec4f3fc2878de51239916953b736b674d5071 Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:02 2025 -0700 selftests: ublk: fix fio arguments in run_io_and_recover() run_io_and_recover() invokes fio with --size="${size}", but the variable size doesn't exist. Thus, the argument expands to --size=, which causes fio to exit immediately with an error without issuing any I/O. Pass the value for size as the first argument to the function. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit fe8c0182d49414740e639c1ca6b7d4b8e36b77fe Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:01 2025 -0700 selftests: ublk: remove unused ios map in seq_io.bt The ios map populated by seq_io.bt is never read, so remove it. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 1fd4b8d7e3cf102bd01a295460d629e15152d2b3 Author: Caleb Sander Mateos Date: Fri Dec 12 10:17:00 2025 -0700 selftests: ublk: correct last_rw map type in seq_io.bt The last_rw map is initialized with a value of 0 but later assigned the value args.sector + args.nr_sector, which has type sector_t = u64. bpftrace complains about the type mismatch between int64 and uint64: trace/seq_io.bt:18:3-59: ERROR: Type mismatch for @last_rw: trying to assign value of type 'uint64' when map already contains a value of type 'int64' @last_rw[$dev, str($2)] = (args.sector + args.nr_sector); Cast the initial value to uint64 so bpftrace will load the program. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 9637fc3bdd10c8e073f71897bd35babbd21e9b29 Author: Ming Lei Date: Fri Dec 12 10:16:59 2025 -0700 selftests: ublk: fix overflow in ublk_queue_auto_zc_fallback() The functions ublk_queue_use_zc(), ublk_queue_use_auto_zc(), and ublk_queue_auto_zc_fallback() were returning int, but performing bitwise AND on q->flags which is __u64. When a flag bit is set in the upper 32 bits (beyond INT_MAX), the result of the bitwise AND operation could overflow when cast to int, leading to incorrect boolean evaluation. For example, if UBLKS_Q_AUTO_BUF_REG_FALLBACK is 0x8000000000000000: - (u64)flags & 0x8000000000000000 = 0x8000000000000000 - Cast to int: undefined behavior / incorrect value - Used in if(): may evaluate incorrectly Fix by: 1. Changing return type from int to bool for semantic correctness 2. Using !! to explicitly convert to boolean (0 or 1) This ensures the functions return proper boolean values regardless of which bit position the flags occupy in the 64-bit field. Fixes: c3a6d48f86da ("selftests: ublk: remove ublk queue self-defined flags") Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit d9f514d3e6ee48c34d70d637479b4c9384832d4f Author: Pavel Begunkov Date: Sun Nov 23 22:51:23 2025 +0000 block: move around bio flagging helpers We'll need bio_flagged() earlier in bio.h for later patches, move it together with all related helpers, and mark the bio_flagged()'s bio argument as const. Signed-off-by: Pavel Begunkov Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 579a3297b268f0281644ead7ff574a2b4bc64d3c Author: Emil Tsalapatis Date: Fri Dec 5 13:23:14 2025 -0800 selftests/sched_ext: flush stdout before test to avoid log spam The sched_ext selftests runner runs each test in the same process, with each test possibly forking multiple times. When the main runner has not flushed its stdout, the children inherit the buffered output for previous tests and emit it during exit. This causes log spam. Make sure stdout/stderr is fully flushed before each test. Cc: Ihor Solodrai Signed-off-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 9551a26f17d9445eed497bd7c639d48dfc3c0af4 Merge: 187d0801404f41 be77cf43d2fd6e Author: Linus Torvalds Date: Sat Dec 13 05:44:03 2025 +1200 Merge tag 'loongarch-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Add basic LoongArch32 support Note: Build infrastructures of LoongArch32 are not enabled yet, because we need to adjust irqchip drivers and wait for GNU toolchain be upstream first. - Select HAVE_ARCH_BITREVERSE in Kconfig - Fix build and boot for CONFIG_RANDSTRUCT - Correct the calculation logic of thread_count - Some bug fixes and other small changes * tag 'loongarch-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (22 commits) LoongArch: Adjust default config files for 32BIT/64BIT LoongArch: Adjust VDSO/VSYSCALL for 32BIT/64BIT LoongArch: Adjust misc routines for 32BIT/64BIT LoongArch: Adjust user accessors for 32BIT/64BIT LoongArch: Adjust system call for 32BIT/64BIT LoongArch: Adjust module loader for 32BIT/64BIT LoongArch: Adjust time routines for 32BIT/64BIT LoongArch: Adjust process management for 32BIT/64BIT LoongArch: Adjust memory management for 32BIT/64BIT LoongArch: Adjust boot & setup for 32BIT/64BIT LoongArch: Adjust common macro definitions for 32BIT/64BIT LoongArch: Add adaptive CSR accessors for 32BIT/64BIT LoongArch: Add atomic operations for 32BIT/64BIT LoongArch: Add new PCI ID for pci_fixup_vgadev() LoongArch: Add and use some macros for AVEC LoongArch: Correct the calculation logic of thread_count LoongArch: Use unsigned long for _end and _text LoongArch: Use __pmd()/__pte() for swap entry conversions LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT LoongArch: Fix build errors for CONFIG_RANDSTRUCT ... commit f5e1e5ec204da11fa87fdf006d451d80ce06e118 Author: Tejun Heo Date: Thu Dec 11 15:45:04 2025 -1000 sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() move_local_task_to_local_dsq() is used when moving a task from a non-local DSQ to a local DSQ on the same CPU. It directly manipulates the local DSQ without going through dispatch_enqueue() and was missing the post-enqueue handling that triggers preemption when SCX_ENQ_PREEMPT is set or the idle task is running. The function is used by move_task_between_dsqs() which backs scx_bpf_dsq_move() and may be called while the CPU is busy. Add local_dsq_post_enq() call to move_local_task_to_local_dsq(). As the dispatch path doesn't need post-enqueue handling, add SCX_RQ_IN_BALANCE early exit to keep consume_dispatch_q() behavior unchanged and avoid triggering unnecessary resched when scx_bpf_dsq_move() is used from the dispatch path. Fixes: 4c30f5ce4f7a ("sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()") Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 530b6637c79e728d58f1d9b66bd4acf4b735b86d Author: Tejun Heo Date: Thu Dec 11 15:45:03 2025 -1000 sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() Factor out local_dsq_post_enq() which performs post-enqueue handling for local DSQs - triggering resched_curr() if SCX_ENQ_PREEMPT is specified or if the current CPU is idle. No functional change. This will be used by the next patch to fix move_local_task_to_local_dsq(). Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 37343524f000d2a64359867d7024a73233d3b438 Author: Filipe Manana Date: Thu Dec 11 11:51:19 2025 +0000 btrfs: fix changeset leak on mmap write after failure to reserve metadata If the call to btrfs_delalloc_reserve_metadata() fails we jump to the 'out_noreserve' label and there we never free the extent_changeset allocated by the previous call to btrfs_check_data_free_space() (if qgroups are enabled). Fix this by calling extent_changeset_free() under the 'out_noreserve' label. Fixes: 6599716de2d6 ("btrfs: fix -ENOSPC mmap write failure on NOCOW files/extents") Reported-by: syzbot+2f8aa76e6acc9fce6638@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/693a635a.a70a0220.33cd7b.0029.GAE@google.com/ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b57f2ddd28737db6ff0e9da8467f0ab9d707e997 Author: Deepanshu Kartikey Date: Wed Dec 10 18:58:07 2025 +0530 btrfs: fix memory leak of fs_devices in degraded seed device path In open_seed_devices(), when find_fsid() fails and we're in DEGRADED mode, a new fs_devices is allocated via alloc_fs_devices() but is never added to the seed_list before returning. This contrasts with the normal path where fs_devices is properly added via list_add(). If any error occurs later in read_one_dev() or btrfs_read_chunk_tree(), the cleanup code iterates seed_list to free seed devices, but this orphaned fs_devices is never found and never freed, causing a memory leak. Any devices allocated via add_missing_dev() and attached to this fs_devices are also leaked. Fix this by adding the newly allocated fs_devices to seed_list in the degraded path, consistent with the normal path. Fixes: 5f37583569442 ("Btrfs: move the missing device to its own fs device list") Reported-by: syzbot+eadd98df8bceb15d7fed@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=eadd98df8bceb15d7fed Tested-by: syzbot+eadd98df8bceb15d7fed@syzkaller.appspotmail.com Reviewed-by: Qu Wenruo Signed-off-by: Deepanshu Kartikey Reviewed-by: David Sterba Signed-off-by: David Sterba commit 630efee9493cf64ff7b9a1652978807fef385fdd Author: Karol Wachowski Date: Fri Dec 12 14:41:33 2025 +0100 drm: Fix object leak in DRM_IOCTL_GEM_CHANGE_HANDLE Add missing drm_gem_object_put() call when drm_gem_object_lookup() successfully returns an object. This fixes a GEM object reference leak that can prevent driver modules from unloading when using prime buffers. Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle") Cc: # v6.18+ Signed-off-by: Karol Wachowski Reviewed-by: Christian König Reviewed-by: Maciej Falkowski Signed-off-by: Christian König Link: https://lore.kernel.org/r/20251212134133.475218-1-karol.wachowski@linux.intel.com commit 187d0801404f415f22c0b31531982c7ea97fa341 Merge: 35ebee7e720944 f6a458746f905a Author: Linus Torvalds Date: Fri Dec 12 22:08:09 2025 +1200 Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: "Fixes for some recent regressions as well as some longstanding issues: - Fix incorrect output from the arm64 NEON implementation of GHASH - Merge the ksimd scopes in the arm64 XTS code to reduce stack usage - Roll up the BLAKE2b round loop on 32-bit kernels to greatly reduce code size and stack usage - Add missing RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS dependency - Fix chacha-riscv64-zvkb.S to not use frame pointer for data" * tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: arm64/ghash - Fix incorrect output from ghash-neon crypto/arm64: sm4/xts - Merge ksimd scopes to reduce stack bloat crypto/arm64: aes/xts - Use single ksimd scope to reduce stack bloat lib/crypto: blake2s: Replace manual unrolling with unrolled_full lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit lib/crypto: riscv: Depend on RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS lib/crypto: riscv/chacha: Avoid s0/fp register commit 35ebee7e720944a66befb5899c72ce1e01dfa44e Merge: 14df4eb7e7faee a0750fae73c551 Author: Linus Torvalds Date: Fri Dec 12 22:04:18 2025 +1200 Merge tag 'block-6.19-20251211' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Always initialize DMA state, fixing a potentially nasty issue on the block side - btrfs zoned write fix with cached zone reports - Fix corruption issues in bcache with chained bio's, and further make it clear that the chained IO handler is simply a marker, it's not code meant to be executed - Kill old code dealing with synchronous IO polling in the block layer, that has been dead for a long time. Only async polling is supported these days - Fix a lockdep issue in tag_set management, moving it to RCU - Fix an issue with ublks bio_vec iteration - Don't unconditionally enforce blocking issue of ublk control commands, allow some of them with non-blocking issue as they do not block * tag 'block-6.19-20251211' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: blk-mq-dma: always initialize dma state blk-mq: delete task running check in blk_hctx_poll() block: fix cached zone reports on devices with native zone append block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock ublk: don't mutate struct bio_vec in iteration block: prohibit calls to bio_chain_endio bcache: fix improper use of bi_end_io ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK issue commit 14df4eb7e7faeecec1eaa88febb6a27308a470f5 Merge: ce825345dd63f6 e15cb2200b934e Author: Linus Torvalds Date: Fri Dec 12 22:01:32 2025 +1200 Merge tag 'io_uring-6.19-20251211' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Single fix for io_uring headed to stable, fixing an issue introduced with the min_wait support earlier this year, where SQPOLL didn't get correctly woken if an event arrived once the event waiting has finished the min_wait portion. As we already have regression tests for this added and people reporting new failures there, let's get this one flushed out so it can bubble back down to stable as well" * tag 'io_uring-6.19-20251211' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix min_wait wakeups for SQPOLL commit ce825345dd63f62cdab80a8c45f943bb65511aa1 Merge: 10cc3e9a11dc0d 2e0d224d898848 Author: Linus Torvalds Date: Fri Dec 12 21:59:19 2025 +1200 Merge tag 'v6.19-rc-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - minor cleanup - minor update to comment to avoid confusion about fs type * tag 'v6.19-rc-smb3-server-fixes' of git://git.samba.org/ksmbd: smb/server: add comment to FileSystemName of FileFsAttributeInformation smb/server: remove unused nterr.h smb/server: rename include guard in smb_common.h commit 10cc3e9a11dc0d5d8450ecf6db99551c867f3203 Merge: 6bb34aff1ebdd4 ab0347e67dacd1 Author: Linus Torvalds Date: Fri Dec 12 21:56:25 2025 +1200 Merge tag 'v6.19-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix incorrect error code defines - Add missing error code definitions - Add parenthesis around NT_STATUS code defines to fix checkpatch warnings - Remove some duplicated protocol definitions, moving to common code shared by client and server - Add missing protocol documentation reference (for change notify) - Correct struct definition (for duplicate_extents_to_file_ex) * tag 'v6.19-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb/client: remove DeviceType Flags and Device Characteristics definitions smb: move File Attributes definitions into common/fscc.h smb: update struct duplicate_extents_to_file_ex smb: move file_notify_information to common/fscc.h smb: move SMB2 Notify Action Flags into common/smb2pdu.h smb: move notify completion filter flags into common/smb2pdu.h smb/client: add parentheses to NT error code definitions containing bitwise OR operator smb: add documentation references for smb2 change notify definitions smb/client: add 4 NT error code definitions smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value smb/client: fix NT_STATUS_NO_DATA_DETECTED value commit 6bb34aff1ebdd4ee8ea1721068f74d476d707f01 Merge: d358e5254674b7 bd3b04b46c7a99 Author: Linus Torvalds Date: Fri Dec 12 21:52:42 2025 +1200 Merge tag 'nfs-for-6.19-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Bugfixes: - Fix 'nlink' attribute update races when unlinking a file - Add missing initialisers for the directory verifier in various places - Don't regress the NFSv4 open state due to misordered racing replies - Ensure the NFSv4.x callback server uses the correct transport connection - Fix potential use-after-free races when shutting down the NFSv4.x callback server - Fix a pNFS layout commit crash - Assorted fixes to ensure correct propagation of mount options when the client crosses a filesystem boundary and triggers the VFS automount code - More localio fixes Features and cleanups: - Add initial support for basic directory delegations - SunRPC back channel code cleanups" * tag 'nfs-for-6.19-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (24 commits) NFSv4: Handle NFS4ERR_NOTSUPP errors for directory delegations nfs/localio: remove 61 byte hole from needless ____cacheline_aligned nfs/localio: remove alignment size checking in nfs_is_local_dio_possible NFS: Fix up the automount fs_context to use the correct cred NFS: Fix inheritance of the block sizes when automounting NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Revert "nfs: ignore SB_RDONLY when mounting nfs" Revert "nfs: clear SB_RDONLY before getting superblock" Revert "nfs: ignore SB_RDONLY when remounting nfs" NFS: Add a module option to disable directory delegations NFS: Shortcut lookup revalidations if we have a directory delegation NFS: Request a directory delegation during RENAME NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK NFS: Add support for sending GDD_GETATTR NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid NFSv4.1: protect destroying and nullifying bc_serv structure SUNRPC: new helper function for stopping backchannel server SUNRPC: cleanup common code in backchannel request NFSv4.1: pass transport for callback shutdown NFSv4: ensure the open stateid seqid doesn't go backwards ... commit bdae29d6512ddc589200b9ae6bda467bdbab863d Author: Eric Dumazet Date: Fri Dec 5 10:07:53 2025 +0000 rseq: Always inline rseq_debug_syscall_return() To get the full benefit of: eaa9088d568c ("rseq: Use static branch for syscall exit debug when GENERIC_IRQ_ENTRY=y") clang needs an __always_inline instead of a plain inline qualifier: $ for i in {1..10}; do taskset -c 4 perf5 bench syscall basic -l 100000000 | grep "ops/sec"; done Before After ops/sec 15424491 15872221 +2.9% Signed-off-by: Eric Dumazet Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251205100753.4073221-1-edumazet@google.com commit d36067d6ea00827e9b8fc087d8216710cb99b3cf Author: Brendan Jackman Date: Sun Dec 7 03:53:18 2025 +0000 bug: Hush suggest-attribute=format for __warn_printf() Recent additions to this function cause GCC 14.3.0 to get excited (W=1) and suggest a missing attribute: lib/bug.c: In function '__warn_printf': lib/bug.c:187:25: error: function '__warn_printf' be a candidate for 'gnu_printf' format attribute [-Werror=suggest-attribute=format] 187 | vprintk(fmt, *args); | ^~~~~~~ Disable the diagnostic locally, following the pattern used for stuff like va_format(). Fixes: 5c47b7f3d1a9 ("bug: Add BUG_FORMAT_ARGS infrastructure") Signed-off-by: Brendan Jackman Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251207-warn-printf-gcc-v1-1-b597d612b94b@google.com commit b5e51ef787660bffe9cd059e7abe32f3b1667a98 Author: Heiko Carstens Date: Mon Dec 8 21:06:58 2025 +0100 bug: Let report_bug_entry() provide the correct bugaddr report_bug_entry() always provides zero for bugaddr but could easily extract the correct address from the provided bug_entry. Just do that to have proper warning messages. E.g. adding an artificial: void foo(void) { WARN_ONCE(1, "bar"); } function generates this warning message: WARNING: arch/s390/kernel/setup.c:1017 at 0x0, CPU#0: swapper/0/0 ^^^ With the correct bug address this changes to: WARNING: arch/s390/kernel/setup.c:1017 at foo+0x1c/0x40, CPU#0: swapper/0/0 ^^^^^^^^^^^^^ Fixes: 7d2c27a0ec5e ("bug: Add report_bug_entry()") Signed-off-by: Heiko Carstens Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251208200658.3431511-1-hca@linux.ibm.com commit 526aafabd756cc56401b383d6ae554af3e21dcdd Author: José Expósito Date: Tue Nov 4 11:25:22 2025 +0100 drm/tests: Handle EDEADLK in set_up_atomic_state() Fedora/CentOS/RHEL CI is reporting intermittent failures while running the drm_validate_modeset test [1]: # drm_test_check_connector_changed_modeset: EXPECTATION FAILED at # drivers/gpu/drm/tests/drm_atomic_state_test.c:162 Expected ret == 0, but ret == -35 (0xffffffffffffffdd) Change the set_up_atomic_state() helper function to return on error and restart the atomic sequence when the returned error is EDEADLK. [1] https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/2106744096/test_x86_64/11762450343/artifacts/jobwatch/logs/recipes/19797909/tasks/204139142/results/945095586/logs/dmesg.log Fixes: 73d934d7b6e3 ("drm/tests: Add test for drm_atomic_helper_commit_modeset_disables()") Closes: https://datawarehouse.cki-project.org/issue/4004 Reviewed-by: Maxime Ripard Signed-off-by: José Expósito Link: https://patch.msgid.link/20251104102535.12212-2-jose.exposito89@gmail.com commit 141d95e42884628314f5ad9394657b0b35424300 Author: José Expósito Date: Tue Nov 4 11:25:21 2025 +0100 drm/tests: Handle EDEADLK in drm_test_check_valid_clones() Fedora/CentOS/RHEL CI is reporting intermittent failures while running the drm_test_check_valid_clones() KUnit test. The error log can be either [1]: # drm_test_check_valid_clones: ASSERTION FAILED at # drivers/gpu/drm/tests/drm_atomic_state_test.c:295 Expected ret == param->expected_result, but ret == -35 (0xffffffffffffffdd) param->expected_result == 0 (0x0) Or [2] depending on the test case: # drm_test_check_valid_clones: ASSERTION FAILED at # drivers/gpu/drm/tests/drm_atomic_state_test.c:295 Expected ret == param->expected_result, but ret == -35 (0xffffffffffffffdd) param->expected_result == -22 (0xffffffffffffffea) Restart the atomic sequence when EDEADLK is returned. [1] https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/2113057246/test_x86_64/11802139999/artifacts/jobwatch/logs/recipes/19824965/tasks/204347800/results/946112713/logs/dmesg.log [2] https://s3.amazonaws.com/arr-cki-prod-trusted-artifacts/trusted-artifacts/2106744297/test_aarch64/11762450907/artifacts/jobwatch/logs/recipes/19797942/tasks/204139727/results/945094561/logs/dmesg.log Fixes: 88849f24e2ab ("drm/tests: Add test for drm_atomic_helper_check_modeset()") Closes: https://datawarehouse.cki-project.org/issue/4004 Reviewed-by: Maxime Ripard Signed-off-by: José Expósito Link: https://patch.msgid.link/20251104102535.12212-1-jose.exposito89@gmail.com commit fe27e709d91fb645182751b602cb88966b4a1bb6 Author: José Expósito Date: Tue Nov 4 11:22:35 2025 +0100 drm/tests: hdmi: Handle drm_kunit_helper_enable_crtc_connector() returning EDEADLK Fedora/CentOS/RHEL CI is reporting intermittent failures while running the KUnit tests present in drm_hdmi_state_helper_test.c [1]. While the specific test causing the failure change between runs, all of them are caused by drm_kunit_helper_enable_crtc_connector() returning -EDEADLK. The error trace always follow this structure: # : ASSERTION FAILED at # drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c: Expected ret == 0, but ret == -35 (0xffffffffffffffdd) As documented, if the drm_kunit_helper_enable_crtc_connector() function returns -EDEADLK (-35), the entire atomic sequence must be restarted. Handle this error code for all function calls. Closes: https://datawarehouse.cki-project.org/issue/4039 [1] Fixes: 6a5c0ad7e08e ("drm/tests: hdmi_state_helpers: Switch to new helper") Reviewed-by: Maxime Ripard Signed-off-by: José Expósito Link: https://patch.msgid.link/20251104102258.10026-1-jose.exposito89@gmail.com commit 37a1cefd4d4e0b3d12f140e8a265757444fa6957 Merge: 6ae7ec86de355d 1c7f9e528f8f48 Author: Dave Airlie Date: Fri Dec 12 18:57:43 2025 +1000 Merge tag 'drm-intel-next-fixes-2025-12-12' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 fixes for v6.19-rc1: - Fix format string truncation warning - FIx runtime PM reference during fbdev BO creation Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/281309f78560bcceebac8d5c0511efe66baf641c@intel.com commit 9415f749d34b926b9e4853da1462f4d941f89a0d Author: Evan Li Date: Fri Dec 12 16:49:43 2025 +0800 perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() handle_pmi_common() may observe an active bit set in cpuc->active_mask while the corresponding cpuc->events[] entry has already been cleared, which leads to a NULL pointer dereference. This can happen when interrupt throttling stops all events in a group while PEBS processing is still in progress. perf_event_overflow() can trigger perf_event_throttle_group(), which stops the group and clears the cpuc->events[] entry, but the active bit may still be set when handle_pmi_common() iterates over the events. The following recent fix: 7e772a93eb61 ("perf/x86: Fix NULL event access and potential PEBS record loss") moved the cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and relied on cpuc->active_mask/pebs_enabled checks. However, handle_pmi_common() can still encounter a NULL cpuc->events[] entry despite the active bit being set. Add an explicit NULL check on the event pointer before using it, to cover this legitimate scenario and avoid the NULL dereference crash. Fixes: 7e772a93eb61 ("perf/x86: Fix NULL event access and potential PEBS record loss") Reported-by: kitta Co-developed-by: kitta Signed-off-by: Evan Li Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251212084943.2124787-1-evan.li@linux.alibaba.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220855 commit e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c Author: Minseong Kim Date: Fri Dec 12 00:29:23 2025 -0800 Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields. lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd structure without preventing the reinit work from being queued again until serio_close() returns. This can allow the work handler to run after the structure has been freed, leading to a potential use-after-free. Use disable_work_sync() instead of cancel_work_sync() to ensure the reinit work cannot be re-queued, and call it both in lkkbd_disconnect() and in lkkbd_connect() error paths after serio_open(). Signed-off-by: Minseong Kim Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251212052314.16139-1-ii4gsp@gmail.com Signed-off-by: Dmitry Torokhov commit ac87efcf9e42f07526438b67405659a8c1d0480e Author: Ingo Molnar Date: Wed Dec 10 08:36:18 2025 +0100 x86/boot/Documentation: Fix whitespace noise in boot.rst There's a lot of unnecessary whitespace damage in this file: space before tabs, etc., that has no formatting or readability effect or advantages. Fix them. Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/176535283007.498.16442167388418039352.tip-bot2@tip-bot2 commit 6ae7ec86de355dc00702364e93339d2902ff847b Merge: 685f27c1c5fee2 72e24456a54fe0 Author: Dave Airlie Date: Fri Dec 12 09:26:26 2025 +1000 Merge tag 'amd-drm-fixes-6.19-2025-12-11' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.19-2025-12-11: amdgpu: - SI fix - DC reduce stack usage - HDMI fixes - VCN 4.0.5 fix - DP MST fix - DC memory allocation fix amdkfd: - SVM fix - Trap handler fix - VGPR fixes for GC 11.5 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251211195600.1641924-1-alexander.deucher@amd.com commit 685f27c1c5fee205de2a505fd353d862ee2163ab Merge: c7685d11108acb 308eeb8ca3fdee Author: Dave Airlie Date: Fri Dec 12 09:20:22 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-12-10' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next-fixes for v6.19-rc1: - Fix uaf in panthor. - Revert 8 byte alignment constraint for pitch in dumb bo's. - Fix DRM_MODE_FLAG_N.SYNC and !DRM_MODE_FLAG_P.SYNC handling renasas. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/a82c2a2a-314f-403b-85bf-9b3ee09b903c@linux.intel.com commit 9f769637a93fac81689b80df6855f545839cf999 Author: Tejun Heo Date: Tue Dec 9 11:04:33 2025 -1000 sched_ext: Fix bypass depth leak on scx_enable() failure scx_enable() calls scx_bypass(true) to initialize in bypass mode and then scx_bypass(false) on success to exit. If scx_enable() fails during task initialization - e.g. scx_cgroup_init() or scx_init_task() returns an error - it jumps to err_disable while bypass is still active. scx_disable_workfn() then calls scx_bypass(true/false) for its own bypass, leaving the bypass depth at 1 instead of 0. This causes the system to remain permanently in bypass mode after a failed scx_enable(). Failures after task initialization is complete - e.g. scx_tryset_enable_state() at the end - already call scx_bypass(false) before reaching the error path and are not affected. This only affects a subset of failure modes. Fix it by tracking whether scx_enable() called scx_bypass(true) in a bool and having scx_disable_workfn() call an extra scx_bypass(false) to clear it. This is a temporary measure as the bypass depth will be moved into the sched instance, which will make this tracking unnecessary. Fixes: 8c2090c504e9 ("sched_ext: Initialize in bypass mode") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Chris Mason Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/stable/286e6f7787a81239e1ce2989b52391ce%40kernel.org Signed-off-by: Tejun Heo commit a67fd55f6a09f4119b7232c19e0f348fe31ab0db Author: Pablo Neira Ayuso Date: Wed Nov 19 13:42:05 2025 +0100 netfilter: nf_tables: remove redundant chain validation on register store This validation predates the introduction of the state machine that determines when to enter slow path validation for error reporting. Currently, table validation is perform when: - new rule contains expressions that need validation. - new set element with jump/goto verdict. Validation on register store skips most checks with no basechains, still this walks the graph searching for loops and ensuring expressions are called from the right hook. Remove this. Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 5ec8ca26fe93103577c904644b0957f069d0051a Author: Florian Westphal Date: Mon Dec 8 16:00:34 2025 +0100 netfilter: nf_nat: remove bogus direction check Jakub reports spurious failures of the 'conntrack_reverse_clash.sh' selftest. A bogus test makes nat core resort to port rewrite even though there is no need for this. When the test is made, nf_nat_used_tuple() would already have caused us to return if no other CPU had added a colliding entry. Moreover, nf_nat_used_tuple() would have ignored the colliding entry if their origin tuples had been the same. All that is left to check is if the colliding entry in the hash table is subject to NAT, and, if its not, if our entry matches in the reverse direction, e.g. hash table has addr1:1234 -> addr2:80, and we want to commit addr2:80 -> addr1:1234. Because we already checked that neither the new nor the committed entry is subject to NAT we only have to check origin vs. reply tuple: for non-nat entries, the reply tuple is always the inverted original. Just in case there are more problems extend the error reporting in the selftest while at it and dump conntrack table/stats on error. Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20251206175135.4a56591b@kernel.org/ Fixes: d8f84a9bc7c4 ("netfilter: nf_nat: don't try nat source port reallocation for reverse dir clash") Signed-off-by: Florian Westphal commit 99c6931fe1f5d3de1174ce771cb86c57f75bff14 Author: Jozsef Kadlecsik Date: Tue Dec 2 15:20:15 2025 +0100 MAINTAINERS: Remove Jozsef Kadlecsik from MAINTAINERS file I'm retiring from maintaining netfilter. I'll still keep an eye on ipset and respond to anything related to it. Thank you! Signed-off-by: Jozsef Kadlecsik Signed-off-by: Florian Westphal commit fd324768eb2c132bb111ba76675b4c72406251d9 Author: Baojun Xu Date: Thu Dec 11 17:24:26 2025 +0800 ALSA: hda/tas2781: Add new quirk for HP new project Add new vendor_id and subsystem_id in quirk for HP new project (NexusX). Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251211092427.1648-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 885bebac9909994050bbbeed0829c727e42bd1b7 Author: Dan Carpenter Date: Tue Dec 9 09:56:39 2025 +0300 nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() Set the error code if "transferred != sizeof(cmd)" instead of returning success. Fixes: dbafc28955fa ("NFC: pn533: don't send USB data off of the stack") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aTfIJ9tZPmeUF4W1@stanley.mountain Signed-off-by: Jakub Kicinski commit 5914428e0e44c4dcb64ad42cc37fa23a57fd1c5c Author: Victor Nogueira Date: Mon Dec 8 16:01:25 2025 -0300 selftests/tc-testing: Create tests to exercise ets classes active list misplacements Add a test case for a bug fixed by Jamal [1] and for scenario where an ets drr class is inserted into the active list twice. - Try to delete ets drr class' qdisc while still keeping it in the active list - Try to add ets class to the active list twice [1] https://lore.kernel.org/netdev/20251128151919.576920-1-jhs@mojatatu.com/ Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251208190125.1868423-2-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit b1e125ae425aba9b45252e933ca8df52a843ec70 Author: Victor Nogueira Date: Mon Dec 8 16:01:24 2025 -0300 net/sched: ets: Remove drr class from the active list if it changes to strict Whenever a user issues an ets qdisc change command, transforming a drr class into a strict one, the ets code isn't checking whether that class was in the active list and removing it. This means that, if a user changes a strict class (which was in the active list) back to a drr one, that class will be added twice to the active list [1]. Doing so with the following commands: tc qdisc add dev lo root handle 1: ets bands 2 strict 1 tc qdisc add dev lo parent 1:2 handle 20: \ tbf rate 8bit burst 100b latency 1s tc filter add dev lo parent 1: basic classid 1:2 ping -c1 -W0.01 -s 56 127.0.0.1 tc qdisc change dev lo root handle 1: ets bands 2 strict 2 tc qdisc change dev lo root handle 1: ets bands 2 strict 1 ping -c1 -W0.01 -s 56 127.0.0.1 Will trigger the following splat with list debug turned on: [ 59.279014][ T365] ------------[ cut here ]------------ [ 59.279452][ T365] list_add double add: new=ffff88801d60e350, prev=ffff88801d60e350, next=ffff88801d60e2c0. [ 59.280153][ T365] WARNING: CPU: 3 PID: 365 at lib/list_debug.c:35 __list_add_valid_or_report+0x17f/0x220 [ 59.280860][ T365] Modules linked in: [ 59.281165][ T365] CPU: 3 UID: 0 PID: 365 Comm: tc Not tainted 6.18.0-rc7-00105-g7e9f13163c13-dirty #239 PREEMPT(voluntary) [ 59.281977][ T365] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 59.282391][ T365] RIP: 0010:__list_add_valid_or_report+0x17f/0x220 [ 59.282842][ T365] Code: 89 c6 e8 d4 b7 0d ff 90 0f 0b 90 90 31 c0 e9 31 ff ff ff 90 48 c7 c7 e0 a0 22 9f 48 89 f2 48 89 c1 4c 89 c6 e8 b2 b7 0d ff 90 <0f> 0b 90 90 31 c0 e9 0f ff ff ff 48 89 f7 48 89 44 24 10 4c 89 44 ... [ 59.288812][ T365] Call Trace: [ 59.289056][ T365] [ 59.289224][ T365] ? srso_alias_return_thunk+0x5/0xfbef5 [ 59.289546][ T365] ets_qdisc_change+0xd2b/0x1e80 [ 59.289891][ T365] ? __lock_acquire+0x7e7/0x1be0 [ 59.290223][ T365] ? __pfx_ets_qdisc_change+0x10/0x10 [ 59.290546][ T365] ? srso_alias_return_thunk+0x5/0xfbef5 [ 59.290898][ T365] ? __mutex_trylock_common+0xda/0x240 [ 59.291228][ T365] ? __pfx___mutex_trylock_common+0x10/0x10 [ 59.291655][ T365] ? srso_alias_return_thunk+0x5/0xfbef5 [ 59.291993][ T365] ? srso_alias_return_thunk+0x5/0xfbef5 [ 59.292313][ T365] ? trace_contention_end+0xc8/0x110 [ 59.292656][ T365] ? srso_alias_return_thunk+0x5/0xfbef5 [ 59.293022][ T365] ? srso_alias_return_thunk+0x5/0xfbef5 [ 59.293351][ T365] tc_modify_qdisc+0x63a/0x1cf0 Fix this by always checking and removing an ets class from the active list when changing it to strict. [1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/tree/net/sched/sch_ets.c?id=ce052b9402e461a9aded599f5b47e76bc727f7de#n663 Fixes: cd9b50adc6bb9 ("net/sched: ets: fix crash when flipping from 'strict' to 'quantum'") Acked-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251208190125.1868423-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 8a11ff0948b5ad09b71896b7ccc850625f9878d1 Author: Junrui Luo Date: Thu Dec 4 21:30:47 2025 +0800 caif: fix integer underflow in cffrml_receive() The cffrml_receive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without validating that len >= 2. If an attacker sends a malicious packet with a length field of 0 or 1 to an interface with FCS disabled, the subtraction causes an integer underflow. This can lead to memory exhaustion and kernel instability, potential information disclosure if padding contains uninitialized kernel memory. Fix this by validating that len >= 2 before performing the subtraction. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: b482cd2053e3 ("net-caif: add CAIF core protocol stack") Signed-off-by: Junrui Luo Reviewed-by: Simon Horman Link: https://patch.msgid.link/SYBPR01MB7881511122BAFEA8212A1608AFA6A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Jakub Kicinski commit 71cfa7c893a05d09e7dc14713b27a8309fd4a2db Author: Marcus Hughes Date: Sun Dec 7 21:03:55 2025 +0000 net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant Some Potron SFP+ XGSPON ONU sticks are shipped with different EEPROM vendor ID and vendor name strings, but are otherwise functionally identical to the existing "Potron SFP+ XGSPON ONU Stick" handled by sfp_quirk_potron(). These modules, including units distributed under the "Better Internet" branding, use the same UART pin assignment and require the same TX_FAULT/LOS behaviour and boot delay. Re-use the existing Potron quirk for this EEPROM variant. Signed-off-by: Marcus Hughes Link: https://patch.msgid.link/20251207210355.333451-1-marcus.hughes@betterinternet.ltd Signed-off-by: Jakub Kicinski commit 95f3013e8816a24119093859b38bb11c002b5905 Merge: 898ae76a70094c 3e54d3b4a8437b Author: Jakub Kicinski Date: Thu Dec 11 01:02:29 2025 -0800 Merge tag 'linux-can-fixes-for-6.19-20251210' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-12-10 Arnd Bergmann's patch fixes a build dependency with the CAN protocols and drivers introduced in the current development cycle. The last patch is by me and fixes the error handling cleanup in the gs_usb driver. * tag 'linux-can-fixes-for-6.19-20251210' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: gs_usb: gs_can_open(): fix error handling can: fix build dependency ==================== Link: https://patch.msgid.link/20251210083448.2116869-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 898ae76a70094c5e3506908adc15a3ac7bbc2bf4 Merge: 237c1e152b4263 b8a81b0ce539e0 Author: Jakub Kicinski Date: Thu Dec 11 00:58:38 2025 -0800 Merge tag 'nf-25-12-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net 1) Fix refcount leaks in nf_conncount, from Fernando Fernandez Mancera. This addresses a recent regression that came in the last -next pull request. 2) Fix a null dereference in route error handling in IPVS, from Slavin Liu. This is an ancient issue dating back to 5.1 days. 3) Always set ifindex in route tuple in the flowtable output path, from Lorenzo Bianconi. This bug came in with the recent output path refactoring. 4) Prefer 'exit $ksft_xfail' over 'exit $ksft_skip' when we fail to trigger a nat race condition to exercise the clash resolution path in selftest infra, $ksft_skip should be reserved for missing tooling, From myself. * tag 'nf-25-12-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: selftests: netfilter: prefer xfail in case race wasn't triggered netfilter: always set route tuple out ifindex ipvs: fix ipv4 null-ptr-deref in route error path netfilter: nf_conncount: fix leaked ct in error paths ==================== Link: https://patch.msgid.link/20251210110754.22620-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 237c1e152b4263fc1e6e8a359d95227a78945e6d Merge: 6bcb7727d9e612 514520b34ba7d0 Author: Jakub Kicinski Date: Thu Dec 11 00:53:18 2025 -0800 Merge branch 'selftests-forwarding-vxlan_bridge_1q_mc_ul-fix-flakiness' Petr Machata says: ==================== selftests: forwarding: vxlan_bridge_1q_mc_ul: Fix flakiness The net/forwarding/vxlan_bridge_1q_mc_ul selftest runs an overlay traffic, forwarded over a multicast-routed VXLAN underlay. In order to determine whether packets reach their intended destination, it uses a TC match. For convenience, it uses a flower match, which however does not allow matching on the encapsulated packet. So various service traffic ends up being indistinguishable from the test packets, and ends up confusing the test. To alleviate the problem, the test uses sleep to allow the necessary service traffic to run and clear the channel, before running the test traffic. This worked for a while, but lately we have nevertheless seen flakiness of the test in the CI. In this patchset, first generalize tc_rule_stats_get() to support u32 in patch #1, then in patch #2 convert the test to use u32 to allow parsing deeper into the packet, and in #3 drop the now-unnecessary sleep. ==================== Link: https://patch.msgid.link/cover.1765289566.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 514520b34ba7d0eb36890f9f9c5c874a7e41544e Author: Petr Machata Date: Tue Dec 9 16:29:03 2025 +0100 selftests: forwarding: vxlan_bridge_1q_mc_ul: Drop useless sleeping After fixing traffic matching in the previous patch, the test does not need to use the sleep anymore. So drop vx_wait() altogether, migrate all callers of vx{10,20}_create_wait() to the corresponding _create(), and drop the now unused _create_wait() helpers. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/eabfe4fa12ae788cf3b8c5c876a989de81dfc3d3.1765289566.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 0c8b9a68b344ba2aa327278688d66c31f5f04275 Author: Petr Machata Date: Tue Dec 9 16:29:02 2025 +0100 selftests: forwarding: vxlan_bridge_1q_mc_ul: Fix flakiness This test runs an overlay traffic, forwarded over a multicast-routed VXLAN underlay. In order to determine whether packets reach their intended destination, it uses a TC match. For convenience, it uses a flower match, which however does not allow matching on the encapsulated packet. So various service traffic ends up being indistinguishable from the test packets, and ends up confusing the test. To alleviate the problem, the test uses sleep to allow the necessary service traffic to run and clear the channel, before running the test traffic. This worked for a while, but lately we have nevertheless seen flakiness of the test in the CI. Fix the issue by using u32 to match the encapsulated packet as well. The confusing packets seem to always be IPv6 multicast listener reports. Realistically they could be ARP or other ICMP6 traffic as well. Therefore look for ethertype IPv4 in the IPv4 traffic test, and for IPv6 / UDP combination in the IPv6 traffic test. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/6438cb1613a2a667d3ff64089eb5994778f247af.1765289566.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 0842e34849f65dc0aef0c7a0baae1dceb2b8bb33 Author: Petr Machata Date: Tue Dec 9 16:29:01 2025 +0100 selftests: net: lib: tc_rule_stats_get(): Don't hard-code array index Flower is commonly used to match on packets in many bash-based selftests. A dump of a flower filter including statistics looks something like this: [ { "protocol": "all", "pref": 49152, "kind": "flower", "chain": 0 }, { ... "options": { ... "actions": [ { ... "stats": { "bytes": 0, "packets": 0, "drops": 0, "overlimits": 0, "requeues": 0, "backlog": 0, "qlen": 0 } } ] } } ] The JQ query in the helper function tc_rule_stats_get() assumes this form and looks for the second element of the array. However, a dump of a u32 filter looks like this: [ { "protocol": "all", "pref": 49151, "kind": "u32", "chain": 0 }, { "protocol": "all", "pref": 49151, "kind": "u32", "chain": 0, "options": { "fh": "800:", "ht_divisor": 1 } }, { ... "options": { ... "actions": [ { ... "stats": { "bytes": 0, "packets": 0, "drops": 0, "overlimits": 0, "requeues": 0, "backlog": 0, "qlen": 0 } } ] } }, ] There's an extra element which the JQ query ends up choosing. Instead of hard-coding a particular index, look for the entry on which a selector .options.actions yields anything. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/12982a44471c834511a0ee6c1e8f57e3a5307105.1765289566.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit e33a6abdb744e3a015dd53e997c690081a8b985d Author: Nathan Chancellor Date: Thu Dec 11 10:50:03 2025 +0900 ALSA: hda: cix-ipbloq: Use modern PM ops When building without CONFIG_PM_SLEEP, there are several warnings (or errors with CONFIG_WERROR=y / W=e) from the cix-ipbloq driver: sound/hda/controllers/cix-ipbloq.c:378:12: error: 'cix_ipbloq_hda_runtime_resume' defined but not used [-Werror=unused-function] 378 | static int cix_ipbloq_hda_runtime_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/hda/controllers/cix-ipbloq.c:362:12: error: 'cix_ipbloq_hda_runtime_suspend' defined but not used [-Werror=unused-function] 362 | static int cix_ipbloq_hda_runtime_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/hda/controllers/cix-ipbloq.c:349:12: error: 'cix_ipbloq_hda_resume' defined but not used [-Werror=unused-function] 349 | static int cix_ipbloq_hda_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~ sound/hda/controllers/cix-ipbloq.c:336:12: error: 'cix_ipbloq_hda_suspend' defined but not used [-Werror=unused-function] 336 | static int cix_ipbloq_hda_suspend(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ When CONFIG_PM and CONFIG_PM_SLEEP are unset, SET_SYSTEM_SLEEP_PM_OPS() and SET_RUNTIME_PM_OPS() evaluate to nothing, so these functions appear unused to the compiler in this configuration. Use the modern SYSTEM_SLEEP_PM_OPS and RUNTIME_PM_OPS macros to resolve these warnings, which is what they are intended to do. Additionally, wrap &cix_ipbloq_hda_pm in pm_ptr() to ensure the compiler can drop the entire structure when CONFIG_PM is unset. Fixes: d91e9bd10125 ("ALSA: hda: add CIX IPBLOQ HDA controller support") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251211-hda-cix-ipbloq-modern-pm-ops-v1-1-c7a5580af021@kernel.org Signed-off-by: Takashi Iwai commit b13efb535962e26f722eada0a5b14f7bffbed29a Merge: 161a0c617ab172 f34836a8ddf921 Author: Takashi Iwai Date: Thu Dec 11 09:34:00 2025 +0100 Merge tag 'asoc-fix-v6.19-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.19 A small pile of fixes that came in during the merge window, it's all fairly standard device specific stuff. commit ab0347e67dacd121eedc2d3a6ee6484e5ccca43d Author: ZhangGuoDong Date: Fri Nov 14 16:41:20 2025 +0800 smb/client: remove DeviceType Flags and Device Characteristics definitions These definitions are already in common/smb2pdu.h, so remove the duplicated ones from the client. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Signed-off-by: Steve French commit 2b6abb893e719f4d77f7c43975e77cdadd3bbf1e Author: ChenXiaoSong Date: Sun Nov 30 21:17:15 2025 +0800 smb: move File Attributes definitions into common/fscc.h These definitions are specified in MS-FSCC 2.6, so move them into fscc.h. Modify the following places: - FILE_ATTRIBUTE__MASK -> FILE_ATTRIBUTE_MASK - Update FILE_ATTRIBUTE_MASK value - cpu_to_le32(constant) -> cpu_to_le32(MACRO DEFINITION) Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit c97503321ed3fde6e53320b388ea23118d2473d7 Author: ChenXiaoSong Date: Mon Dec 1 14:59:38 2025 +0800 smb: update struct duplicate_extents_to_file_ex Add the missing field to the structure (see MS-FSCC 2.3.9.2), and correct the section number in the documentation reference. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit d358e5254674b70f34c847715ca509e46eb81e6f Merge: 8c8081cc599fca 13ea55ea201767 Author: Linus Torvalds Date: Thu Dec 11 12:13:29 2025 +0900 Merge tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - convert crypto_shash users to direct crypto library use with simpler and faster code and reduced stack usage (Eric Biggers): - the dm-verity SHA-256 conversion also teaches it to do two-way interleaved hashing for added performance - dm-crypt MD5 conversion (used for Loop-AES compatibility) - added document for for takeover/reshape raid1 -> raid5 examples (Heinz Mauelshagen) - fix dm-vdo kerneldoc warnings (Matthew Sakai) - various random fixes and cleanups * tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits) dm pcache: fix segment info indexing dm pcache: fix cache info indexing dm-pcache: advance slot index before writing slot dm raid: add documentation for takeover/reshape raid1 -> raid5 table line examples dm log-writes: Add missing set_freezable() for freezable kthread dm-raid: fix possible NULL dereference with undefined raid type dm-snapshot: fix 'scheduling while atomic' on real-time kernels dm: ignore discard return value MAINTAINERS: add Benjamin Marzinski as a device mapper maintainer dm-mpath: Simplify the setup_scsi_dh code dm vdo: fix kerneldoc warnings dm-bufio: align write boundary on physical block size dm-crypt: enable DM_TARGET_ATOMIC_WRITES dm: test for REQ_ATOMIC in dm_accept_partial_bio() dm-verity: remove useless mempool dm-verity: disable recursive forward error correction dm-ebs: Mark full buffer dirty even on partial write dm mpath: enable DM_TARGET_ATOMIC_WRITES dm verity fec: Expose corrected block count via status dm: Don't warn if IMA_DISABLE_HTABLE is not enabled ... commit 8c8081cc599fcafa25371d50959c17e154f9fd08 Merge: 31ca9ff64ae912 8cef9b451dc6fd Author: Linus Torvalds Date: Thu Dec 11 09:57:08 2025 +0900 Merge tag 'spi-fix-v6.19-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few small fixes for SPI that came in during the merge window, nothing too exciting here" * tag 'spi-fix-v6.19-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: microchip-core: Fix an error handling path in mchp_corespi_probe() spi: cadence-qspi: Fix runtime PM imbalance in probe commit 31ca9ff64ae91283436739ce3277facb89c7901d Merge: 1de741159bbb18 99f0c3a654c4a7 Author: Linus Torvalds Date: Thu Dec 11 09:54:59 2025 +0900 Merge tag 'regulator-fix-v6.19-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few fixes that came in during the merge window, nothing too exciting - the one core fix improves error propagation from gpiolib which hopefully shouldn't actually happen but is safer" * tag 'regulator-fix-v6.19-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: spacemit: Align input supply name with the DT binding regulator: fixed: Rely on the core freeing the enable GPIO regulator: check the return value of gpiod_set_value_cansleep() commit 601cc399a01049efa76be8f496541315dc9cf914 Author: Arnd Bergmann Date: Thu Dec 4 11:01:58 2025 +0100 mm: memfd_luo: add CONFIG_SHMEM dependency The new memfd code fails to link without SHMEM: aarch64-linux-ld: mm/memfd_luo.o: in function `memfd_luo_retrieve_folios': memfd_luo.c:(.text.memfd_luo_retrieve_folios+0xdc): undefined reference to `shmem_add_to_page_cache' memfd_luo.c:(.text.memfd_luo_retrieve_folios+0x11c): undefined reference to `shmem_inode_acct_blocks' memfd_luo.c:(.text.memfd_luo_retrieve_folios+0x134): undefined reference to `shmem_recalc_inode' Add a Kconfig dependency to disallow that configuration. Link: https://lkml.kernel.org/r/20251204100203.1034394-1-arnd@kernel.org Fixes: b3749f174d68 ("mm: memfd_luo: allow preserving memfd") Signed-off-by: Arnd Bergmann Reviewed-by: Pratyush Yadav Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Signed-off-by: Andrew Morton commit 402736a591b040360d36cfc27f6c371103177641 Author: Arnd Bergmann Date: Thu Dec 4 11:28:59 2025 +0100 mm: shmem: avoid build warning for CONFIG_SHMEM=n The newly added 'flags' variable is unused and causes a warning if CONFIG_SHMEM is disabled, since the shmem_acct_size() macro it is passed into does nothing: mm/shmem.c: In function '__shmem_file_setup': mm/shmem.c:5816:23: error: unused variable 'flags' [-Werror=unused-variable] 5816 | unsigned long flags = (vm_flags & VM_NORESERVE) ? SHMEM_F_NORESERVE : 0; | ^~~~~ Replace the two macros with equivalent inline functions to get the argument checking. Link: https://lkml.kernel.org/r/20251204102905.1048000-1-arnd@kernel.org Fixes: 6ff1610ced56 ("mm: shmem: use SHMEM_F_* flags instead of VM_* flags") Signed-off-by: Arnd Bergmann Acked-by: David Hildenbrand (Red Hat) Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Baolin Wang Reviewed-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Cc: Christian Brauner Cc: guoweikang Cc: Hugh Dickins Cc: Kairui Song Cc: Kemeng Shi Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 2214ec4bf89d0fd27717322d3983a2f3b469c7f3 Author: Dmitry Antipov Date: Fri Dec 5 09:51:59 2025 +0300 ocfs2: fix memory leak in ocfs2_merge_rec_left() In 'ocfs2_merge_rec_left()', do not reset 'left_path' to NULL after move, thus allowing 'ocfs2_free_path()' to free it before return. Link: https://lkml.kernel.org/r/20251205065159.392749-1-dmantipov@yandex.ru Fixes: 677b975282e4 ("ocfs2: Add support for cross extent block") Signed-off-by: Dmitry Antipov Reported-by: syzbot+cfc7cab3bb6eaa7c4de2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cfc7cab3bb6eaa7c4de2 Reviewed-by: Heming Zhao Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 7efb45f9685fd9292413f15ea1212f7077c4a35f Author: Ahmet Eray Karadag Date: Wed Dec 3 01:45:08 2025 +0300 ocfs2: invalidate inode if i_mode is zero after block read A panic occurs in ocfs2_unlink due to WARN_ON(inode->i_nlink == 0) when handling a corrupted inode with i_mode=0 and i_nlink=0 in memory. This "zombie" inode is created because ocfs2_read_locked_inode proceeds even after ocfs2_validate_inode_block successfully validates a block that structurally looks okay (passes checksum, signature etc.) but contains semantically invalid data (specifically i_mode=0). The current validation function doesn't check for i_mode being zero. This results in an in-memory inode with i_mode=0 being added to the VFS cache, which later triggers the panic during unlink. Prevent this by adding an explicit check for (i_mode == 0, i_nlink == 0, non-orphan) within ocfs2_validate_inode_block. If the check is true, return -EFSCORRUPTED to signal corruption. This causes the caller (ocfs2_read_locked_inode) to invoke make_bad_inode(), correctly preventing the zombie inode from entering the cache. Link: https://lkml.kernel.org/r/20251202224507.53452-2-eraykrdg1@gmail.com Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag Reported-by: syzbot+55c40ae8a0e5f3659f2b@syzkaller.appspotmail.com Fixes: https://syzkaller.appspot.com/bug?extid=55c40ae8a0e5f3659f2b Link: https://lore.kernel.org/all/20251022222752.46758-2-eraykrdg1@gmail.com/T/ Reviewed-by: Joseph Qi Cc: David Hunter Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 76b9701a54a23fe45dc15aacace616cca9671823 Author: Gustavo A. R. Silva Date: Tue Nov 11 12:01:19 2025 +0900 ocfs2: avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix the following warning: fs/ocfs2/xattr.c:52:41: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of MEMBERS that would otherwise follow it. This overlays the trailing MEMBER struct ocfs2_extent_rec er; onto the FAM struct ocfs2_xattr_value_root::xr_list.l_recs[], while keeping the FAM and the start of MEMBER aligned. The static_assert() ensures this alignment remains, and it's intentionally placed inmediately after the related structure --no blank line in between. Link: https://lkml.kernel.org/r/aRKm_7aN7Smc3J5L@kspp Signed-off-by: Gustavo A. R. Silva Reviewed-by: Heming Zhao Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 7eff54dfd245fb4bf398334be663478b9ae4bb99 Author: Ahmet Eray Karadag Date: Wed Dec 3 06:34:26 2025 +0300 ocfs2: convert remaining read-only checks to ocfs2_emergency_state Now that the centralized `ocfs2_emergency_state()` helper is available, refactor remaining filesystem-wide checks for `ocfs2_is_soft_readonly` and `ocfs2_is_hard_readonly` to use this new function. To ensure strict consistency with the previous behavior and guarantee no functional changes, the call sites continue to explicitly return -EROFS when the emergency state is detected. This standardizes the check logic while preserving the existing error handling flow. Link: https://lkml.kernel.org/r/3421641b54ad6b6e4ffca052351b518eacc1bd08.1764728893.git.eraykrdg1@gmail.com Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag Reviewed-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Changwei Ge Cc: David Hunter Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit 752ba0976b25d69cfac55137573298bd5dd88aa2 Author: Ahmet Eray Karadag Date: Wed Dec 3 06:34:25 2025 +0300 ocfs2: add ocfs2_emergency_state helper and apply to setattr Patch series "ocfs2: Refactor read-only checks to use ocfs2_emergency_state", v4. Following the fix for the `make_bad_inode` validation failure (syzbot ID: b93b65ee321c97861072), this separate series introduces a new helper function, `ocfs2_emergency_state()`, to improve and centralize read-only and error state checking. This is modeled after the `ext4_emergency_state()` pattern, providing a single, unified location for checking all filesystem-level emergency conditions. This makes the code cleaner and ensures that any future checks (e.g., for fatal error states) can be added in one place. This series is structured as follows: 1. The first patch introduces the `ocfs2_emergency_state()` helper (currently checking for -EROFS) and applies it to `ocfs2_setattr` to provide a "fail-fast" mechanism, as suggested by Albin Babu Varghese. 2. The second patch completes the refactoring by converting all remaining read-only checks throughout OCFS2 to use this new helper. This patch (of 2): To centralize error checking, follow the pattern of other filesystems like ext4 (which uses `ext4_emergency_state()`), and prepare for future enhancements, this patch introduces a new helper function: `ocfs2_emergency_state()`. The purpose of this helper is to provide a single, unified location for checking all filesystem-level emergency conditions. In this initial implementation, the function only checks for the existing hard and soft read-only modes, returning -EROFS if either is set. This provides a foundation where future checks (e.g., for fatal error states returning -EIO, or shutdown states) can be easily added in one place. This patch also adds this new check to the beginning of `ocfs2_setattr()`. This ensures that operations like `ftruncate` (which triggered the original BUG) fail-fast with -EROFS when the filesystem is already in a read-only state. Link: https://lkml.kernel.org/r/cover.1764728893.git.eraykrdg1@gmail.com Link: https://lkml.kernel.org/r/e9e975bcaaff8dbc155b70fbc1b2798a2e36e96f.1764728893.git.eraykrdg1@gmail.com Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag Suggested-by: Heming Zhao Reviewed-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: David Hunter Signed-off-by: Andrew Morton commit 01da5216c572f6f8fca4e272451aad6c273b0d57 Author: Ally Heev Date: Wed Dec 3 20:58:49 2025 +0530 checkpatch: add uninitialized pointer with __free attribute check Uinitialized pointers with __free attribute can cause undefined behavior as the memory randomly assigned to the pointer is freed automatically when the pointer goes out of scope. add check in checkpatch to detect such issues. Link: https://lkml.kernel.org/r/20251203-aheev-checkpatch-uninitialized-free-v7-1-841e3b31d8f3@gmail.com Signed-off-by: Ally Heev Suggested-by: Dan Carpenter Link: https://lore.kernel.org/all/8a4c0b43-cf63-400d-b33d-d9c447b7e0b9@suswa.mountain/ Link: https://lore.kernel.org/all/58fd478f408a34b578ee8d949c5c4b4da4d4f41d.camel@HansenPartnership.com/ Acked-by: Dan Williams Reviewed-by: Krzysztof Kozlowski Acked-by: Joe Perches Cc: Andy Whitcroft Cc: David Hunter Cc: Dwaipayan Ray Cc: Geert Uytterhoeven Cc: James Bottomley Cc: Jonathan Corbet Cc: Lukas Bulwahn Cc: Menon, Nishanth Cc: Stephen Boyd Cc: Viresh Kumar Signed-off-by: Andrew Morton commit e6b4d264c8c883d8451c7b5f20cd96ddf94af3ef Author: Andy Shevchenko Date: Mon Dec 1 21:10:18 2025 +0100 args: fix documentation to reflect the correct numbers The macro uses up to 15 arguments. Reflect this in the top level comment. Link: https://lkml.kernel.org/r/20251201201018.765475-1-andriy.shevchenko@linux.intel.com Fixes: d51e783c17ba ("lsm: count the LSMs enabled at compile time") Signed-off-by: Andy Shevchenko Reviewed-by: Randy Dunlap Signed-off-by: Andrew Morton commit 039bef30e320827bac8990c9f29d2a68cd8adb5f Author: Prithvi Tambewagh Date: Mon Dec 1 18:37:11 2025 +0530 ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_find_victim_chain() because the `cl_next_free_rec` field of the allocation chain list (next free slot in the chain list) is 0, triggring the BUG_ON(!cl->cl_next_free_rec) condition in ocfs2_find_victim_chain() and panicking the kernel. To fix this, an if condition is introduced in ocfs2_claim_suballoc_bits(), just before calling ocfs2_find_victim_chain(), the code block in it being executed when either of the following conditions is true: 1. `cl_next_free_rec` is equal to 0, indicating that there are no free chains in the allocation chain list 2. `cl_next_free_rec` is greater than `cl_count` (the total number of chains in the allocation chain list) Either of them being true is indicative of the fact that there are no chains left for usage. This is addressed using ocfs2_error(), which prints the error log for debugging purposes, rather than panicking the kernel. Link: https://lkml.kernel.org/r/20251201130711.143900-1-activprithvi@gmail.com Signed-off-by: Prithvi Tambewagh Reported-by: syzbot+96d38c6e1655c1420a72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=96d38c6e1655c1420a72 Tested-by: syzbot+96d38c6e1655c1420a72@syzkaller.appspotmail.com Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Cc: Signed-off-by: Andrew Morton commit bf2c7bf5c48303b76f20537238292571e6aa29f3 Author: Pasha Tatashin Date: Sat Nov 29 20:09:19 2025 -0500 liveupdate: luo_core: fix redundant bound check in luo_ioctl() The kernel test robot reported a Smatch warning: kernel/liveupdate/luo_core.c:402 luo_ioctl() warn: unsigned 'nr' is never less than zero. This occurs because 'nr' is unsigned and LIVEUPDATE_CMD_BASE is currently defined as 0, making the check (nr < LIVEUPDATE_CMD_BASE) always false. Remove the explicit lower bound check. The logic remains correct because 'nr' is unsigned; if nr is less than LIVEUPDATE_CMD_BASE, the expression (nr - LIVEUPDATE_CMD_BASE) will wrap around to a large positive value. This will inevitably be larger than ARRAY_SIZE(luo_ioctl_ops) and be caught by the upper bound check. Link: https://lkml.kernel.org/r/20251130010919.1488230-1-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511280300.6pvBmXUS-lkp@intel.com/ Reviewed-by: Mike Rapoport (Microsoft) Cc: David Matlack Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 2a4f33430e96d0bebfa37b1d586098f61f030b06 Author: Deepanshu Kartikey Date: Thu Nov 20 09:41:45 2025 +0530 ocfs2: validate inline xattr size and entry count in ocfs2_xattr_ibody_list Add comprehensive validation of inline xattr metadata in ocfs2_xattr_ibody_list() to prevent out-of-bounds access and use-after-free bugs when processing corrupted inline xattrs. The patch adds two critical validations: 1. Validates i_xattr_inline_size before use: - Ensures it does not exceed block size - Ensures it is at least large enough for xattr header - Prevents pointer arithmetic with corrupted size values that could point outside the inode block 2. Validates xattr entry count (xh_count): - Calculates maximum entries that can fit in the inline space - Rejects counts that exceed this limit - Prevents out-of-bounds array access in subsequent code Without these checks, a corrupted filesystem with invalid inline xattr metadata can cause the code to access memory beyond the allocated space. For example: - A corrupted i_xattr_inline_size of 0 would cause header pointer calculation to point past the end of the block - A corrupted xh_count of 22 with inline_size of 256 would cause array access 7 entries beyond the 15 that actually fit (the syzbot reproducer used xh_count of 20041), leading to use-after-free when accessing freed memory pages The validation uses the correct inline_size (from di->i_xattr_inline_size) rather than block size, ensuring accurate bounds checking for inline xattrs specifically. Link: https://lkml.kernel.org/r/20251120041145.33176-1-kartikey406@gmail.com Link: https://lore.kernel.org/all/20251111073831.2027072-1-kartikey406@gmail.com/ [v1] Link: https://lore.kernel.org/all/20251117063217.5690-1-kartikey406@gmail.com/ [v2] Link: https://lore.kernel.org/all/20251117114224.12948-1-kartikey406@gmail.com/ [v3] Signed-off-by: Deepanshu Kartikey Reported-by: syzbot+ab0ad25088673470d2d9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab0ad25088673470d2d9 Tested-by: syzbot+ab0ad25088673470d2d9@syzkaller.appspotmail.com Suggested-by: Heming Zhao Reviewed-by: Heming Zhao Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit acce46aaf8c65612b2933e739b3a929986b5642b Author: Lalit Shankar Chowdhury Date: Thu Nov 27 17:54:31 2025 +0000 fs/fat: remove unnecessary wrapper fat_max_cache() fat_max_cache() always returned FAT_MAX_CACHE and did not use the inode parameter. So, use the FAT_MAX_CACHE constant directly. Link: https://lkml.kernel.org/r/20251127175431.126516-1-lalitshankarch@gmail.com Signed-off-by: Lalit Shankar Chowdhury Acked-by: OGAWA Hirofumi Cc: Christian Brauner Signed-off-by: Andrew Morton commit d86fea4294cb7878e3866eb567ee803d180a159b Author: Thorsten Blum Date: Wed Nov 26 12:44:15 2025 +0100 ocfs2: replace deprecated strcpy with strscpy strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(). No functional changes. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Link: https://lkml.kernel.org/r/20251126114419.92539-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 4ac577ae741e745ecfb64c5a9c7f52fc36aca022 Author: Edward Adam Davis Date: Thu Nov 27 11:26:40 2025 +0800 ocfs2: check tl_used after reading it from trancate log inode The fuzz image has a truncate log inode whose tl_used is bigger than tl_count so it triggers the BUG in ocfs2_truncate_log_needs_flush() [1]. As what the check in ocfs2_truncate_log_needs_flush() does, just do same check into ocfs2_get_truncate_log_info() when truncate log inode is reading in so we can bail out earlier. [1] (syz.0.17,5491,0):ocfs2_truncate_log_needs_flush:5830 ERROR: bug expression: le16_to_cpu(tl->tl_used) > le16_to_cpu(tl->tl_count) kernel BUG at fs/ocfs2/alloc.c:5830! RIP: 0010:ocfs2_truncate_log_needs_flush fs/ocfs2/alloc.c:5827 [inline] Call Trace: ocfs2_commit_truncate+0xb64/0x21d0 fs/ocfs2/alloc.c:7372 ocfs2_truncate_file+0xca2/0x1420 fs/ocfs2/file.c:509 ocfs2_setattr+0x1520/0x1b40 fs/ocfs2/file.c:1212 notify_change+0xc1a/0xf40 fs/attr.c:546 do_truncate+0x1a4/0x220 fs/open.c:68 Link: https://lkml.kernel.org/r/tencent_B24B1C1BE225DCBA44BB6933AB9E1B1B0708@qq.com Reported-by: syzbot+f82afc4d4e74d0ef7a89@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f82afc4d4e74d0ef7a89 Tested-by: syzbot+f82afc4d4e74d0ef7a89@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit b2135d1cb0e368dcdb8631ed2f232caefbd7711f Author: Dan Carpenter Date: Fri Nov 28 10:17:07 2025 +0300 liveupdate: luo_file: don't use invalid list iterator If we exit a list_for_each_entry() without hitting a break then the list iterator points to an offset from the list_head. It's a non-NULL but invalid pointer and dereferencing it isn't allowed. Introduce a new "found" variable to test instead. Link: https://lkml.kernel.org/r/aSlMc4SS09Re4_xn@stanley.mountain Fixes: 3ee1d673194e ("liveupdate: luo_file: implement file systems callbacks") Signed-off-by: Dan Carpenter Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202511280420.y9O4fyhX-lkp@intel.com/ Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 1de741159bbb187c8018c4c779acde4ea0188478 Merge: 0723a166d1f1da 0f35040de59371 Author: Linus Torvalds Date: Thu Dec 11 08:54:08 2025 +0900 Merge tag 'slab-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: - A stable fix for performance regression in tests that perform kmem_cache_destroy() a lot, due to unnecessarily wide scope of kvfree_rcu_barrier() (Harry Yoo) * tag 'slab-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction commit 0723a166d1f1da4c60d7b11289383f073e4dee9b Merge: 840b22edd5adf9 70075e3d0ca0b7 Author: Linus Torvalds Date: Thu Dec 11 08:19:46 2025 +0900 Merge tag 's390-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Heiko Carstens: - Use the MSI parent domain API instead of the legacy API for setup and teardown of PCI MSI IRQs - Select POSIX_CPU_TIMERS_TASK_WORK now that VIRT_XFER_TO_GUEST_WORK has been implemented for s390 - Fix a KVM bug which can lead to guest memory corruption - Fix KASAN shadow memory mapping for hotplugged memory - Minor bug fixes and improvements * tag 's390-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/bug: Add missing alignment s390/bug: Add missing CONFIG_BUG ifdef again KVM: s390: Fix gmap_helper_zap_one_page() again s390/pci: Migrate s390 IRQ logic to IRQ domain API genirq: Change hwirq parameter to irq_hw_number_t s390: Select POSIX_CPU_TIMERS_TASK_WORK s390: Unmap early KASAN shadow on memory offlining s390/vmem: Support 2G page splitting for KASAN shadow freeing s390/boot: Use entire page for PTEs s390/vmur: Use scnprintf() instead of sprintf() commit 840b22edd5adf9dda46f4e701815eadce8f2f3eb Merge: 5c179cac051943 31b931bebd11a0 Author: Linus Torvalds Date: Thu Dec 11 08:14:23 2025 +0900 Merge tag 'dma-mapping-6.19-2025-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: - last minute fix for missing parenthesis in recently merged code (Hans de Goede) - removal of excessive, non-fatal warnings (Dave Kleikamp) * tag 'dma-mapping-6.19-2025-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: Fix DMA_BIT_MASK() macro being broken dma/pool: eliminate alloc_pages warning in atomic_pool_expand commit 72e24456a54fe04710d89626cc5a88703e2f6202 Author: Mario Limonciello Date: Tue Dec 9 11:14:47 2025 -0600 Revert "drm/amd/display: Fix pbn to kbps Conversion" Deeply daisy chained DP/MST displays are no longer able to light up. This reverts commit e0dec00f3d05 ("drm/amd/display: Fix pbn to kbps Conversion") Cc: Jerry Zuo Reported-by: nat@nullable.se Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4756 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit e1c94109c76e8a77a21531bd53f6c63356c81158) Cc: stable@vger.kernel.org # 6.17+ commit 93a01629c8bfd30906c76921ec986802d76920c6 Author: Mario Limonciello (AMD) Date: Mon Dec 8 22:46:46 2025 -0600 drm/amd: Fix unbind/rebind for VCN 4.0.5 Unbinding amdgpu has no problems, but binding it again leads to an error of sysfs file already existing. This is because it wasn't actually cleaned up on unbind. Add the missing cleanup step. Fixes: 547aad32edac ("drm/amdgpu: add VCN4 ip block support") Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit d717e62e9b6ccff0e3cec78a58dfbd00858448b3) Cc: stable@vger.kernel.org commit 5c179cac051943f673c8baa53214e2566bfe69dc Merge: 29ba26af9a9d43 9aeed904192981 Author: Linus Torvalds Date: Thu Dec 11 08:01:52 2025 +0900 Merge tag 'alpha-for-v6.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha Pull alpha updates from Magnus Lindholm: "Two small uapi fixes. One patch hardcodes TC* ioctl values that previously depended on the deprecated termio struct, avoiding build issues with newer glibc versions. The other patch switches uapi headers to use the compiler-defined __ASSEMBLER__ macro for better consistency between kernel and userspace. - don't reference obsolete termio struct for TC* constants - Replace __ASSEMBLY__ with __ASSEMBLER__ in the alpha headers" * tag 'alpha-for-v6.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: alpha: don't reference obsolete termio struct for TC* constants alpha: Replace __ASSEMBLY__ with __ASSEMBLER__ in the alpha headers commit 29ba26af9a9d43d5dbb8aa8e653adeb159d42587 Merge: 0048fbb4011ec5 dd9143371a8619 Author: Linus Torvalds Date: Thu Dec 11 07:50:48 2025 +0900 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM updates from Russell King: - disable jump label and high PTE for PREEMPT RT kernels - fix input operand modification in load_unaligned_zeropad() - fix hash_name() / fault path induced warnings - fix branch predictor hardening * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: fix branch predictor hardening ARM: fix hash_name() fault ARM: allow __do_kernel_fault() to report execution of memory faults ARM: group is_permission_fault() with is_translation_fault() ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels ARM: 9459/1: Disable jump-label on PREEMPT_RT commit a0750fae73c55112ea11a4867bee40f11e679405 Author: Keith Busch Date: Wed Dec 10 02:43:46 2025 -0800 blk-mq-dma: always initialize dma state Ensure the dma state is initialized when we're not using the contiguous iova, otherwise the caller may be using a stale state from a previous request that could use the coalesed iova allocation. Fixes: 2f6b2565d43cdb5 ("block: accumulate memory segment gaps per bio") Reported-by: Sebastian Ott Tested-by: Sebastian Ott Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 13ea55ea20176736516b20b9ea2d8cf97dbe74f5 Author: Li Chen Date: Fri Dec 5 05:46:20 2025 +0000 dm pcache: fix segment info indexing Segment info indexing also used sizeof(struct) instead of the 4K metadata stride, so info_index could point between slots and subsequent writes would advance incorrectly. Derive info_index from the pointer returned by the segment meta search using PCACHE_SEG_INFO_SIZE and advance to the next slot for future updates. Signed-off-by: Li Chen Signed-off-by: Dongsheng Yang Signed-off-by: Mikulas Patocka Reviewed-by: Zheng Gu Cc: stable@vger.kernel.org # 6.18 commit ee7633178321f5d983db3adfdea9322456cfdaaa Author: Li Chen Date: Fri Dec 5 05:46:19 2025 +0000 dm pcache: fix cache info indexing The on-media cache_info index used sizeof(struct) instead of the 4K metadata stride, so gc_percent updates from dmsetup message were written between slots and lost after reboot. Use PCACHE_CACHE_INFO_SIZE in get_cache_info_addr() and align info_index with the slot returned by pcache_meta_find_latest(). Signed-off-by: Li Chen Signed-off-by: Dongsheng Yang Signed-off-by: Mikulas Patocka Reviewed-by: Zheng Gu Cc: stable@vger.kernel.org # 6.18 commit ebbb90344a7da2421e4b54668b94e81828b8b308 Author: Dongsheng Yang Date: Fri Dec 5 05:46:18 2025 +0000 dm-pcache: advance slot index before writing slot In dm-pcache, in order to ensure crash-consistency, a dual-copy scheme is used to alternately update metadata, and there is a slot index that records the current slot. However, in the write path the current implementation writes directly to the current slot indexed by slot index, and then advances the slot — which ends up overwriting the existing slot, violating the crash-consistency guarantee. This patch fixes that behavior, preventing metadata from being overwritten incorrectly. In addition, this patch add a missing pmem_wmb() after memcpy_flushcache(). Signed-off-by: Dongsheng Yang Signed-off-by: Mikulas Patocka Reviewed-by: Zheng Gu Cc: stable@vger.kernel.org # 6.18 commit 7799eaecfeb756664be37c079520af67d5d64f70 Author: Heinz Mauelshagen Date: Wed Dec 3 17:19:42 2025 +0100 dm raid: add documentation for takeover/reshape raid1 -> raid5 table line examples Also enhance possible takeover/reshape information and do some reformatting. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mikulas Patocka commit ab08f9c8b363297cafaf45475b08f78bf19b88ef Author: Haotian Zhang Date: Mon Dec 1 15:41:03 2025 +0800 dm log-writes: Add missing set_freezable() for freezable kthread The log_writes_kthread() calls try_to_freeze() but lacks set_freezable(), rendering the freeze attempt ineffective since kernel threads are non-freezable by default. This prevents proper thread suspension during system suspend/hibernate. Add set_freezable() to explicitly mark the thread as freezable. Fixes: 0e9cebe72459 ("dm: add log writes target") Signed-off-by: Haotian Zhang Reviewed-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka commit 2f6cfd6d7cb165a7af8877b838a9f6aab4159324 Author: Alexey Simakov Date: Tue Dec 2 20:18:38 2025 +0300 dm-raid: fix possible NULL dereference with undefined raid type rs->raid_type is assigned from get_raid_type_by_ll(), which may return NULL. This NULL value could be dereferenced later in the condition 'if (!(rs_is_raid10(rs) && rt_is_raid0(rs->raid_type)))'. Add a fail-fast check to return early with an error if raid_type is NULL, similar to other uses of this function. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 33e53f06850f ("dm raid: introduce extended superblock and new raid types to support takeover/reshaping") Signed-off-by: Alexey Simakov Signed-off-by: Mikulas Patocka commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 Author: Mikulas Patocka Date: Mon Dec 1 22:13:10 2025 +0100 dm-snapshot: fix 'scheduling while atomic' on real-time kernels There is reported 'scheduling while atomic' bug when using dm-snapshot on real-time kernels. The reason for the bug is that the hlist_bl code does preempt_disable() when taking the lock and the kernel attempts to take other spinlocks while holding the hlist_bl lock. Fix this by converting a hlist_bl spinlock into a regular spinlock. Signed-off-by: Mikulas Patocka Reported-by: Jiping Ma commit f4412c7d5a5ab34a6338e15d07fba25185fbb94c Author: Chaitanya Kulkarni Date: Mon Nov 24 15:48:03 2025 -0800 dm: ignore discard return value __blkdev_issue_discard() always returns 0, making all error checking at call sites dead code. For dm-thin change issue_discard() return type to void, in passdown_double_checking_shared_status() remove the r assignment from return value of the issue_discard(), for end_discard() hardcode value of r to 0 that matches only value returned from __blkdev_issue_discard(). Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Chaitanya Kulkarni Signed-off-by: Mikulas Patocka commit 20f85a1b1a8f3f5f2a7a215c9cf501ed9093a03a Author: Mikulas Patocka Date: Wed Nov 26 16:27:13 2025 +0100 MAINTAINERS: add Benjamin Marzinski as a device mapper maintainer Ben will be working with me as a maintainer, so add him to the MAINTAINERS file. Signed-off-by: Mikulas Patocka Acked-by: Mike Snitzer commit 27f204c215a0f5d91a963a16adb10432fa4ca0e9 Author: Benjamin Marzinski Date: Fri Nov 21 18:49:52 2025 -0500 dm-mpath: Simplify the setup_scsi_dh code There's no point to the MPATHF_RETAIN_ATTACHED_HW_HANDLER flag any more. The way setup_scsi_dh() worked, if that flag wasn't set, it would attempt to attach any passed in hardware handler. This would always fail if a different hardware handler was attached, which caused setup_scsi_dh() to rerun as if the flag was set. So the code would already retain any attached handler, because attaching a different one would always fail. Also, the code had a bug. If attached_handler_name was NULL but there was a scsi device handler attached (because either scsi_dh_attached_handler_name failed() to allocate a name, a handler got attached after it was called) the code would loop endlessly. Instead, ignore MPATHF_RETAIN_ATTACHED_HW_HANDLER, and always free the passed in handler if *attached_handler_name is set. This simplifies the code, and avoids the endless loop bug, while keeping the functionality the same. Signed-off-by: Benjamin Marzinski Signed-off-by: Mikulas Patocka commit 4efe85b0c442a47d8063fdc8ce5f31e9b33f046d Author: Matthew Sakai Date: Fri Nov 21 17:51:04 2025 -0500 dm vdo: fix kerneldoc warnings Fix kerneldoc warnings across the dm-vdo target. Also remove some unhelpful or inaccurate doc comments, and fix some format inconsistencies that did not produce warnings. No functional changes. Suggested-by: Sunday Adelodun Signed-off-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit d0ac06ae53be0cdb61f5fe6b62d25d3317c51657 Author: Mikulas Patocka Date: Mon Oct 20 14:48:13 2025 +0200 dm-bufio: align write boundary on physical block size There may be devices with physical block size larger than 4k. If dm-bufio sends I/O that is not aligned on physical block size, performance is degraded. The 4k minimum alignment limit is there because some SSDs report logical and physical block size 512 despite having 4k internally - so dm-bufio shouldn't send I/Os not aligned on 4k boundary, because they perform badly (the SSD does read-modify-write for them). Signed-off-by: Mikulas Patocka Reported-by: Uladzislau Rezki (Sony) Cc: stable@vger.kernel.org commit ce51c6963a91cc6d5c9cf6c3735991882f72587d Author: Mikulas Patocka Date: Wed Nov 5 16:02:36 2025 +0100 dm-crypt: enable DM_TARGET_ATOMIC_WRITES Allow handling of bios with REQ_ATOMIC flag set. Don't split these bios and fail them if they overrun the hard limit "BIO_MAX_VECS << PAGE_SHIFT". In order to simplify the code, this commit joins the logic that avoids splitting emulated zone append bios with the logic that avoids splitting atomic write bios. Signed-off-by: John Garry Signed-off-by: Mikulas Patocka Tested-by: John Garry commit de67c139b3846ece6b8bbb62abf1f010ae85c083 Author: Mikulas Patocka Date: Wed Nov 5 16:01:33 2025 +0100 dm: test for REQ_ATOMIC in dm_accept_partial_bio() Any bio with REQ_ATOMIC flag set should never be split or partially completed, so BUG_ON() on this scenario in dm_accept_partial_bio() (whose intent is to allow partial completions). Also, we must reject atomic bio to targets that don't support them, otherwise this BUG could be triggered by stray bios that have the REQ_ATOMIC set. Signed-off-by: John Garry Signed-off-by: Mikulas Patocka Tested-by: John Garry commit b9dd1f71e6fca46c9efed7e1328d1b2f4dacd19b Author: Mikulas Patocka Date: Mon Nov 17 21:43:54 2025 +0100 dm-verity: remove useless mempool v->fec->extra_pool has zero reserved entries, so we can remove it and use the kernel cache directly. Signed-off-by: Mikulas Patocka Reviewed-by: Eric Biggers commit d9f3e47d3fae0c101d9094bc956ed24e7a0ee801 Author: Mikulas Patocka Date: Fri Nov 14 16:54:01 2025 +0100 dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 iterations. For each iteration, we may call verity_hash_for_block recursively. There is a limit of 4 nested recursions - that means that there may be at most 253^4 (4 billion) iterations. Red Hat QE team actually created an image that pushes dm-verity to this limit - and this image just makes the udev-worker process get stuck in the 'D' state. 2. It doesn't work. In fec_read_bufs we store data into the variable "fio->bufs", but fio bufs is shared between recursive invocations, if "verity_hash_for_block" invoked correction recursively, it would overwrite partially filled fio->bufs. Signed-off-by: Mikulas Patocka Reported-by: Guangwu Zhang Reviewed-by: Sami Tolvanen Reviewed-by: Eric Biggers commit f6a458746f905adb7d70e50e8b9383dc9e3fd75f Author: Eric Biggers Date: Tue Dec 9 14:34:17 2025 -0800 crypto: arm64/ghash - Fix incorrect output from ghash-neon Commit 9a7c987fb92b ("crypto: arm64/ghash - Use API partial block handling") made ghash_finup() pass the wrong buffer to ghash_do_simd_update(). As a result, ghash-neon now produces incorrect outputs when the message length isn't divisible by 16 bytes. Fix this. (I didn't notice this earlier because this code is reached only on CPUs that support NEON but not PMULL. I haven't yet found a way to get qemu-system-aarch64 to emulate that configuration.) Fixes: 9a7c987fb92b ("crypto: arm64/ghash - Use API partial block handling") Cc: stable@vger.kernel.org Reported-by: Diederik de Haas Closes: https://lore.kernel.org/linux-crypto/DETXT7QI62KE.F3CGH2VWX1SC@cknow-tech.com/ Tested-by: Diederik de Haas Acked-by: Herbert Xu Link: https://lore.kernel.org/r/20251209223417.112294-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 161a0c617ab172bbcda7ce61803addeb2124dbff Author: Takashi Iwai Date: Wed Dec 10 14:15:51 2025 +0100 ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback When config table entries don't match with the device to be probed, currently we fall back to SND_INTEL_DSP_DRIVER_ANY, which means to allow any drivers to bind with it. This was set so with the assumption (or hope) that all controller drivers should cover the devices generally, but in practice, this caused a problem as reported recently. Namely, when a specific kconfig for SOF isn't set for the modern Intel chips like Alderlake, a wrong driver (AVS) got probed and failed. This is because we have entries like: #if IS_ENABLED(CONFIG_SND_SOC_SOF_ALDERLAKE) /* Alder Lake / Raptor Lake */ { .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = PCI_DEVICE_ID_INTEL_HDA_ADL_S, }, .... #endif so this entry is effective only when CONFIG_SND_SOC_SOF_ALDERLAKE is set. If not set, there is no matching entry, hence it returns SND_INTEL_DSP_DRIVER_ANY as fallback. OTOH, if the kconfig is set, it explicitly falls back to SND_INTEL_DSP_DRIVER_LEGACY when no DMIC or SoundWire is found -- that was the working scenario. That being said, the current setup may be broken for modern Intel chips that are supposed to work with either SOF or legacy driver when the corresponding kconfig were missing. For addressing the problem above, this patch changes the fallback driver to the legacy driver, i.e. return SND_INTEL_DSP_DRIVER_LEGACY type as much as possible. When CONFIG_SND_HDA_INTEL is also disabled, the fallback is set to SND_INTEL_DSP_DRIVER_ANY type, just to be sure. Reported-by: Askar Safin Closes: https://lore.kernel.org/all/20251014034156.4480-1-safinaskar@gmail.com/ Tested-by: Askar Safin Reviewed-by: Peter Ujfalusi Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251210131553.184404-1-tiwai@suse.de commit 53ca00a19d345197a37a1bf552e8d1e7b091666c Author: Deepanshu Kartikey Date: Wed Dec 10 07:50:24 2025 +0530 mm/slub: reset KASAN tag in defer_free() before accessing freed memory When CONFIG_SLUB_TINY is enabled, kfree_nolock() calls kasan_slab_free() before defer_free(). On ARM64 with MTE (Memory Tagging Extension), kasan_slab_free() poisons the memory and changes the tag from the original (e.g., 0xf3) to a poison tag (0xfe). When defer_free() then tries to write to the freed object to build the deferred free list via llist_add(), the pointer still has the old tag, causing a tag mismatch and triggering a KASAN use-after-free report: BUG: KASAN: slab-use-after-free in defer_free+0x3c/0xbc mm/slub.c:6537 Write at addr f3f000000854f020 by task kworker/u8:6/983 Pointer tag: [f3], memory tag: [fe] Fix this by calling kasan_reset_tag() before accessing the freed memory. This is safe because defer_free() is part of the allocator itself and is expected to manipulate freed memory for bookkeeping purposes. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Cc: stable@vger.kernel.org Reported-by: syzbot+7a25305a76d872abcfa1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7a25305a76d872abcfa1 Tested-by: syzbot+7a25305a76d872abcfa1@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Acked-by: Alexei Starovoitov Link: https://patch.msgid.link/20251210022024.3255826-1-kartikey406@gmail.com Signed-off-by: Vlastimil Babka commit dd9143371a8619f496e29160390fcafcee1371d1 Merge: fd2dee1c6e2256 fedadc4137234c Author: Russell King (Oracle) Date: Wed Dec 10 12:22:37 2025 +0000 Merge branches 'fixes' and 'misc' into for-next commit fd2dee1c6e2256f726ba33fd3083a7be0efc80d3 Author: Russell King (Oracle) Date: Fri Dec 5 10:52:12 2025 +0000 ARM: fix branch predictor hardening __do_user_fault() may be called with indeterminent interrupt enable state, which means we may be preemptive at this point. This causes problems when calling harden_branch_predictor(). For example, when called from a data abort, do_alignment_fault()->do_bad_area(). Move harden_branch_predictor() out of __do_user_fault() and into the calling contexts. Moving it into do_kernel_address_page_fault(), we can be sure that interrupts will be disabled here. Converting do_translation_fault() to use do_kernel_address_page_fault() rather than do_bad_area() means that we keep branch predictor handling for translation faults. Interrupts will also be disabled at this call site. do_sect_fault() needs special handling, so detect user mode accesses to kernel-addresses, and add an explicit call to branch predictor hardening. Finally, add branch predictor hardening to do_alignment() for the faulting case (user mode accessing kernel addresses) before interrupts are enabled. This should cover all cases where harden_branch_predictor() is called, ensuring that it is always has interrupts disabled, also ensuring that it is called early in each call path. Reviewed-by: Xie Yuanbin Tested-by: Xie Yuanbin Signed-off-by: Russell King (Oracle) commit 7733bc7d299d682f2723dc38fc7f370b9bf973e9 Author: Russell King (Oracle) Date: Fri Dec 5 11:03:07 2025 +0000 ARM: fix hash_name() fault Zizhi Wo reports: "During the execution of hash_name()->load_unaligned_zeropad(), a potential memory access beyond the PAGE boundary may occur. For example, when the filename length is near the PAGE_SIZE boundary. This triggers a page fault, which leads to a call to do_page_fault()->mmap_read_trylock(). If we can't acquire the lock, we have to fall back to the mmap_read_lock() path, which calls might_sleep(). This breaks RCU semantics because path lookup occurs under an RCU read-side critical section." This is seen with CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_KFENCE=y. Kernel addresses (with the exception of the vectors/kuser helper page) do not have VMAs associated with them. If the vectors/kuser helper page faults, then there are two possibilities: 1. if the fault happened while in kernel mode, then we're basically dead, because the CPU won't be able to vector through this page to handle the fault. 2. if the fault happened while in user mode, that means the page was protected from user access, and we want to fault anyway. Thus, we can handle kernel addresses from any context entirely separately without going anywhere near the mmap lock. This gives us an entirely non-sleeping path for all kernel mode kernel address faults. As we handle the kernel address faults before interrupts are enabled, this change has the side effect of improving the branch predictor hardening, but does not completely solve the issue. Reported-by: Zizhi Wo Reported-by: Xie Yuanbin Link: https://lore.kernel.org/r/20251126090505.3057219-1-wozizhi@huaweicloud.com Reviewed-by: Xie Yuanbin Tested-by: Xie Yuanbin Signed-off-by: Russell King (Oracle) commit 40b466db1dffb41f0529035c59c5739636d0e5b8 Author: Russell King (Oracle) Date: Fri Dec 5 17:09:44 2025 +0000 ARM: allow __do_kernel_fault() to report execution of memory faults Allow __do_kernel_fault() to detect the execution of memory, so we can provide the same fault message as do_page_fault() would do. This is required when we split the kernel address fault handling from the main do_page_fault() code path. Reviewed-by: Xie Yuanbin Tested-by: Xie Yuanbin Signed-off-by: Russell King (Oracle) commit b8a81b0ce539e021ac72825238aea1eb657000f0 Author: Florian Westphal Date: Tue Dec 9 00:03:36 2025 +0100 selftests: netfilter: prefer xfail in case race wasn't triggered Jakub says: "We try to reserve SKIP for tests skipped because tool is missing in env, something isn't built into the kernel etc." use xfail, we can't force the race condition to appear at will so its expected that the test 'fails' occasionally. Fixes: 78a588363587 ("selftests: netfilter: add conntrack clash resolution test case") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20251206175647.5c32f419@kernel.org/ Signed-off-by: Florian Westphal commit 2bdc536c9da7fa08baf0fafe9d91243b83cb9c8b Author: Lorenzo Bianconi Date: Mon Dec 1 11:22:45 2025 +0100 netfilter: always set route tuple out ifindex Always set nf_flow_route tuple out ifindex even if the indev is not one of the flowtable configured devices since otherwise the outdev lookup in nf_flow_offload_ip_hook() or nf_flow_offload_ipv6_hook() for FLOW_OFFLOAD_XMIT_NEIGH flowtable entries will fail. The above issue occurs in the following configuration since IP6IP6 tunnel does not support flowtable acceleration yet: $ip addr show 5: eth0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:11:22:33:22:55 brd ff:ff:ff:ff:ff:ff link-netns ns1 inet6 2001:db8:1::2/64 scope global nodad valid_lft forever preferred_lft forever inet6 fe80::211:22ff:fe33:2255/64 scope link tentative proto kernel_ll valid_lft forever preferred_lft forever 6: eth1: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:22:22:33:22:55 brd ff:ff:ff:ff:ff:ff link-netns ns3 inet6 2001:db8:2::1/64 scope global nodad valid_lft forever preferred_lft forever inet6 fe80::222:22ff:fe33:2255/64 scope link tentative proto kernel_ll valid_lft forever preferred_lft forever 7: tun0@NONE: mtu 1452 qdisc noqueue state UNKNOWN group default qlen 1000 link/tunnel6 2001:db8:2::1 peer 2001:db8:2::2 permaddr a85:e732:2c37:: inet6 2002:db8:1::1/64 scope global nodad valid_lft forever preferred_lft forever inet6 fe80::885:e7ff:fe32:2c37/64 scope link proto kernel_ll valid_lft forever preferred_lft forever $ip -6 route show 2001:db8:1::/64 dev eth0 proto kernel metric 256 pref medium 2001:db8:2::/64 dev eth1 proto kernel metric 256 pref medium 2002:db8:1::/64 dev tun0 proto kernel metric 256 pref medium default via 2002:db8:1::2 dev tun0 metric 1024 pref medium $nft list ruleset table inet filter { flowtable ft { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; meta l4proto { tcp, udp } flow add @ft } } Fixes: b5964aac51e0 ("netfilter: flowtable: consolidate xmit path") Signed-off-by: Lorenzo Bianconi Signed-off-by: Florian Westphal commit ad891bb3d079a46a821bf2b8867854645191bab0 Author: Slavin Liu Date: Fri Nov 21 16:52:13 2025 +0800 ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") started calling __ip_options_compile() from ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst() which dereferences skb->dev. An attempt was made to fix the NULL skb->dev dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev) dereference by using a fallback device. The fix was incomplete because fib_compute_spec_dst() later in the call chain still accesses skb->dev directly, which remains NULL when IPVS calls dst_link_failure(). The crash occurs when: 1. IPVS processes a packet in NAT mode with a misconfigured destination 2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route 3. The error path calls dst_link_failure(skb) with skb->dev == NULL 4. ipv4_link_failure() → ipv4_send_dest_unreach() → __ip_options_compile() → fib_compute_spec_dst() 5. fib_compute_spec_dst() dereferences NULL skb->dev Apply the same fix used for IPv6 in commit 326bf17ea5d4 ("ipvs: fix ipv6 route unreach panic"): set skb->dev from skb_dst(skb)->dev before calling dst_link_failure(). KASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f] CPU: 1 PID: 12732 Comm: syz.1.3469 Not tainted 6.6.114 #2 RIP: 0010:__in_dev_get_rcu include/linux/inetdevice.h:233 RIP: 0010:fib_compute_spec_dst+0x17a/0x9f0 net/ipv4/fib_frontend.c:285 Call Trace: spec_dst_fill net/ipv4/ip_options.c:232 spec_dst_fill net/ipv4/ip_options.c:229 __ip_options_compile+0x13a1/0x17d0 net/ipv4/ip_options.c:330 ipv4_send_dest_unreach net/ipv4/route.c:1252 ipv4_link_failure+0x702/0xb80 net/ipv4/route.c:1265 dst_link_failure include/net/dst.h:437 __ip_vs_get_out_rt+0x15fd/0x19e0 net/netfilter/ipvs/ip_vs_xmit.c:412 ip_vs_nat_xmit+0x1d8/0xc80 net/netfilter/ipvs/ip_vs_xmit.c:764 Fixes: ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") Signed-off-by: Slavin Liu Acked-by: Julian Anastasov Signed-off-by: Florian Westphal commit 2e2a720766886190a6d35c116794693aabd332b6 Author: Fernando Fernandez Mancera Date: Fri Dec 5 12:58:01 2025 +0100 netfilter: nf_conncount: fix leaked ct in error paths There are some situations where ct might be leaked as error paths are skipping the refcounted check and return immediately. In order to solve it make sure that the check is always called. Fixes: be102eb6a0e7 ("netfilter: nf_conncount: rework API to use sk_buff directly") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal commit 21c1466ea25114871707d95745a16ebcf231e197 Author: Ilya Dryomov Date: Sun Dec 7 17:39:44 2025 +0100 rbd: stop selecting CRC32, CRYPTO, and CRYPTO_AES None of the RBD code directly requires CRC32, CRYPTO, or CRYPTO_AES. These options are needed by CEPH_LIB code and they are selected there directly. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 3680fc138e31d8a9e8e344d72c6692e921dbb4a3 Author: Eric Biggers Date: Thu Dec 4 22:51:04 2025 -0800 ceph: stop selecting CRC32, CRYPTO, and CRYPTO_AES None of the CEPH_FS code directly requires CRC32, CRYPTO, or CRYPTO_AES. These options do get selected indirectly anyway via CEPH_LIB, which does need them, but there is no need for CEPH_FS to select them too. Signed-off-by: Eric Biggers Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit 8c738512714e8c0aa18f8a10c072d5b01c83db39 Author: Ilya Dryomov Date: Tue Dec 2 10:32:31 2025 +0100 libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped. Cc: stable@vger.kernel.org Reported-by: ziming zhang Signed-off-by: Ilya Dryomov Reviewed-by: Xiubo Li Tested-by: ziming zhang commit 04d8712b079327409b09dee628378f9583e2e035 Author: Andy Shevchenko Date: Mon Nov 10 15:46:53 2025 +0100 libceph: Amend checking to fix `make W=1` build breakage In a few cases the code compares 32-bit value to a SIZE_MAX derived constant which is much higher than that value on 64-bit platforms, Clang, in particular, is not happy about this net/ceph/osdmap.c:1441:10: error: result of comparison of constant 4611686018427387891 with expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 1441 | if (len > (SIZE_MAX - sizeof(*pg)) / sizeof(u32)) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ net/ceph/osdmap.c:1624:10: error: result of comparison of constant 2305843009213693945 with expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 1624 | if (len > (SIZE_MAX - sizeof(*pg)) / (2 * sizeof(u32))) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by casting to size_t. Note, that possible replacement of SIZE_MAX by U32_MAX may lead to the behaviour changes on the corner cases. Signed-off-by: Andy Shevchenko Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 87327d4eaaeafd3a2f6a1ffe84d6d25a96a2495d Author: Andy Shevchenko Date: Mon Nov 10 15:44:04 2025 +0100 ceph: Amend checking to fix `make W=1` build breakage In a few cases the code compares 32-bit value to a SIZE_MAX derived constant which is much higher than that value on 64-bit platforms, Clang, in particular, is not happy about this fs/ceph/snap.c:377:10: error: result of comparison of constant 2305843009213693948 with expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 377 | if (num > (SIZE_MAX - sizeof(*snapc)) / sizeof(u64)) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix this by casting to size_t. Note, that possible replacement of SIZE_MAX by U32_MAX may lead to the behaviour changes on the corner cases. Signed-off-by: Andy Shevchenko Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit d927a595ab2f6de4e10b3e3962bc70ab61d8f907 Author: Max Kellermann Date: Thu Sep 25 12:45:12 2025 +0200 ceph: add trace points to the MDS client This patch adds trace points to the Ceph filesystem MDS client: - request submission (CEPH_MSG_CLIENT_REQUEST) and completion (CEPH_MSG_CLIENT_REPLY) - capabilities (CEPH_MSG_CLIENT_CAPS) These are the central pieces that are useful for analyzing MDS latency/performance problems from the client's perspective. In the long run, all doutc() calls should be replaced with tracepoints. This way, the Ceph filesystem can be traced at any time (without spamming the kernel log). Additionally, trace points can be used in BPF programs (which can even deference the pointer parameters and extract more values). Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit d6c2f41eb99cdf41f050f5e41405d2ed143ff4ef Author: Simon Buttgereit Date: Thu Sep 25 09:57:26 2025 +0200 libceph: fix log output race condition in OSD client OSD client logging has a problem in get_osd() and put_osd(). For one logging output refcount_read() is called twice. If recount value changes between both calls logging output is not consistent. This patch prints out only the resulting value. [ idryomov: don't make the log messages more verbose ] Signed-off-by: Simon Buttgereit Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit f22ecf9c14c12918e30f2179ef516e99eb8b2e49 Author: Fengnan Chang Date: Wed Dec 10 16:55:00 2025 +0800 blk-mq: delete task running check in blk_hctx_poll() blk_hctx_poll() always checks if the task is running or not, and returns 1 if the task is running. This is a leftover from when polled IO was purely for synchronous IO, and doesn't make sense anymore when polled IO is purely asynchronous. Similarly, marking the task as TASK_RUNNING is also superflous, as the very much has to be running to enter the function in the first place. It looks like there has been this judgment for historical reasons, and in very early versions of this function the user would set the process state to TASK_UNINTERRUPTIBLE. Signed-off-by: Diangang Li Signed-off-by: Fengnan Chang [axboe: kill all remnants of task running, pointless now. massage message] Signed-off-by: Jens Axboe commit 1d528e794f3db5d32279123a89957c44c4406a09 Merge: 9489d457d48bd1 79e247d6608848 Author: Alexei Starovoitov Date: Wed Dec 10 01:33:25 2025 -0800 Merge branch 'bpf-fix-bpf_d_path-helper-prototype' Shuran Liu says: ==================== bpf: fix bpf_d_path() helper prototype Hi, This series fixes a verifier issue with bpf_d_path() and adds a regression test to cover its use within a hook function. Patch 1 updates the bpf_d_path() helper prototype so that the second argument is marked as MEM_WRITE. This makes it explicit to the verifier that the helper writes into the provided buffer. Patch 2 extends the existing d_path selftest to cover incorrect verifier assumptions caused by an incorrect function prototype. The test program calls bpf_d_path() and checks if the first character of the path can be read. It ensures the verifier does not assume the buffer remains unwritten. Changelog ========= v5: - Moved the temporary file for the fallocate test from /tmp to /dev/shm Since bpf CI's 9P filesystem under /tmp does not support fallocate. v4: - Use the fallocate hook instead of an LSM hook to simplify the selftest, as suggested by Matt and Alexei. - Add a utility function in test_d_path.c to load the BPF program, improving code reuse. v3: - Switch the pathname prefix loop to use bpf_for() instead of #pragma unroll, as suggested by Matt. - Remove /tmp/bpf_d_path_test in the test cleanup path. - Add the missing Reviewed-by tags. v2: - Merge the new test into the existing d_path selftest rather than creating new files. - Add PID filtering in the LSM program to avoid nondeterministic failures due to unrelated processes triggering bprm_check_security. - Synchronize child execution using a pipe to ensure deterministic updates to the PID. Thanks for your time and reviews. ==================== Link: https://patch.msgid.link/20251206141210.3148-1-electronlsr@gmail.com Signed-off-by: Alexei Starovoitov commit 79e247d6608848c09038d0b1e7d256432624fd84 Author: Shuran Liu Date: Sat Dec 6 22:12:10 2025 +0800 selftests/bpf: add regression test for bpf_d_path() Add a regression test for bpf_d_path() to cover incorrect verifier assumptions caused by an incorrect function prototype. The test attaches to the fallocate hook, calls bpf_d_path() and verifies that a simple prefix comparison on the returned pathname behaves correctly after the fix in patch 1. It ensures the verifier does not assume the buffer remains unwritten. Co-developed-by: Zesen Liu Signed-off-by: Zesen Liu Co-developed-by: Peili Gao Signed-off-by: Peili Gao Co-developed-by: Haoran Ni Signed-off-by: Haoran Ni Signed-off-by: Shuran Liu Link: https://lore.kernel.org/r/20251206141210.3148-3-electronlsr@gmail.com Signed-off-by: Alexei Starovoitov commit ac44dcc788b950606793e8f9690c30925f59df02 Author: Shuran Liu Date: Sat Dec 6 22:12:09 2025 +0800 bpf: Fix verifier assumptions of bpf_d_path's output buffer Commit 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking") started distinguishing read vs write accesses performed by helpers. The second argument of bpf_d_path() is a pointer to a buffer that the helper fills with the resulting path. However, its prototype currently uses ARG_PTR_TO_MEM without MEM_WRITE. Before 37cce22dbd51, helper accesses were conservatively treated as potential writes, so this mismatch did not cause issues. Since that commit, the verifier may incorrectly assume that the buffer contents are unchanged across the helper call and base its optimizations on this wrong assumption. This can lead to misbehaviour in BPF programs that read back the buffer, such as prefix comparisons on the returned path. Fix this by marking the second argument of bpf_d_path() as ARG_PTR_TO_MEM | MEM_WRITE so that the verifier correctly models the write to the caller-provided buffer. Fixes: 37cce22dbd51 ("bpf: verifier: Refactor helper access type tracking") Co-developed-by: Zesen Liu Signed-off-by: Zesen Liu Co-developed-by: Peili Gao Signed-off-by: Peili Gao Co-developed-by: Haoran Ni Signed-off-by: Haoran Ni Signed-off-by: Shuran Liu Reviewed-by: Matt Bobrowski Link: https://lore.kernel.org/r/20251206141210.3148-2-electronlsr@gmail.com Signed-off-by: Alexei Starovoitov commit 6bcb7727d9e612011b70d64a34401688b986d6ab Merge: 2f6e056e95ff50 92df4c56cf5b73 Author: Jakub Kicinski Date: Wed Dec 10 01:15:32 2025 -0800 Merge branch 'inet-frags-flush-pending-skbs-in-fqdir_pre_exit' Jakub Kicinski says: ==================== inet: frags: flush pending skbs in fqdir_pre_exit() Fix the issue reported by NIPA starting on Sep 18th [1], where pernet_ops_rwsem is constantly held by a reader, preventing writers from grabbing it (specifically driver modules from loading). The fact that reports started around that time seems coincidental. The issue seems to be skbs queued for defrag preventing conntrack from exiting. First patch fixes another theoretical issue, it's mostly a leftover from an attempt to get rid of the inet_frag_queue refcnt, which I gave up on (still think it's doable but a bit of a time sink). Second patch is a minor refactor. The real fix is in the third patch. It's the simplest fix I can think of which is to flush the frag queues. Perhaps someone has a better suggestion? Last patch adds an explicit warning for conntrack getting stuck, as this seems like something that can easily happen if bugs sneak in. The warning will hopefully save us the first 20% of the investigation effort. Link: https://lore.kernel.org/20251001082036.0fc51440@kernel.org # [1] ==================== Link: https://patch.msgid.link/20251207010942.1672972-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 92df4c56cf5b739c2977001c581badeaf82b9857 Author: Jakub Kicinski Date: Sat Dec 6 17:09:42 2025 -0800 netfilter: conntrack: warn when cleanup is stuck nf_conntrack_cleanup_net_list() calls schedule() so it does not show up as a hung task. Add an explicit check to make debugging leaked skbs/conntack references more obvious. Acked-by: Florian Westphal Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251207010942.1672972-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 006a5035b495dec008805df249f92c22c89c3d2e Author: Jakub Kicinski Date: Sat Dec 6 17:09:41 2025 -0800 inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlocks on pernet_ops_rwsem since September in NIPA. The stuck task was usually modprobe (often loading a driver like ipvlan), trying to take the lock as a Writer. lockdep does not track readers for rwsems so the read wasn't obvious from the reports. On closer inspection the Reader holding the lock was conntrack looping forever in nf_conntrack_cleanup_net_list(). Based on past experience with occasional NIPA crashes I looked thru the tests which run before the crash and noticed that the crash follows ip_defrag.sh. An immediate red flag. Scouring thru (de)fragmentation queues reveals skbs sitting around, holding conntrack references. The problem is that since conntrack depends on nf_defrag_ipv6, nf_defrag_ipv6 will load first. Since nf_defrag_ipv6 loads first its netns exit hooks run _after_ conntrack's netns exit hook. Flush all fragment queue SKBs during fqdir_pre_exit() to release conntrack references before conntrack cleanup runs. Also flush the queues in timer expiry handlers when they discover fqdir->dead is set, in case packet sneaks in while we're running the pre_exit flush. The commit under Fixes is not exactly the culprit, but I think previously the timer firing would eventually unblock the spinning conntrack. Fixes: d5dd88794a13 ("inet: fix various use-after-free in defrags units") Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251207010942.1672972-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1231eec6994be29d6bb5c303dfa54731ed9fc0e6 Author: Jakub Kicinski Date: Sat Dec 6 17:09:40 2025 -0800 inet: frags: add inet_frag_queue_flush() Instead of exporting inet_frag_rbtree_purge() which requires that caller takes care of memory accounting, add a new helper. We will need to call it from a few places in the next patch. Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251207010942.1672972-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8ef522c8a59a048117f7e05eb5213043c02f986f Author: Jakub Kicinski Date: Sat Dec 6 17:09:39 2025 -0800 inet: frags: avoid theoretical race in ip_frag_reinit() In ip_frag_reinit() we want to move the frag timeout timer into the future. If the timer fires in the meantime we inadvertently scheduled it again, and since the timer assumes a ref on frag_queue we need to acquire one to balance things out. This is technically racy, we should have acquired the reference _before_ we touch the timer, it may fire again before we take the ref. Avoid this entire dance by using mod_timer_pending() which only modifies the timer if its pending (and which exists since Linux v2.6.30) Note that this was the only place we ever took a ref on frag_queue since Eric's conversion to RCU. So we could potentially replace the whole refcnt field with an atomic flag and a bit more RCU. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251207010942.1672972-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2f6e056e95ff5020260ccfd85391a6474d87e4b5 Merge: 9580f6d47dd615 91dc09a609d944 Author: Jakub Kicinski Date: Wed Dec 10 01:08:51 2025 -0800 Merge branch 'selftests-fix-build-warnings-and-errors' (part) Guenter Roeck says: ==================== selftests: Fix build warnings and errors This series fixes build warnings and errors observed when trying to build selftests. ==================== Link: https://patch.msgid.link/20251205171010.515236-1-linux@roeck-us.net Signed-off-by: Jakub Kicinski commit 91dc09a609d9443e6b34bdb355a18d579a95e132 Author: Guenter Roeck Date: Fri Dec 5 09:10:07 2025 -0800 selftests: net: tfo: Fix build warning Fix tfo.c: In function ‘run_server’: tfo.c:84:9: warning: ignoring return value of ‘read’ declared with attribute ‘warn_unused_result’ by evaluating the return value from read() and displaying an error message if it reports an error. Fixes: c65b5bb2329e3 ("selftests: net: add passive TFO test binary") Cc: David Wei Signed-off-by: Guenter Roeck Link: https://patch.msgid.link/20251205171010.515236-14-linux@roeck-us.net Signed-off-by: Jakub Kicinski commit 59546e874403c1dd0cbc42df06fdf8c113f72022 Author: Guenter Roeck Date: Fri Dec 5 09:10:04 2025 -0800 selftests: net: Fix build warnings Fix ksft.h: In function ‘ksft_ready’: ksft.h:27:9: warning: ignoring return value of ‘write’ declared with attribute ‘warn_unused_result’ ksft.h: In function ‘ksft_wait’: ksft.h:51:9: warning: ignoring return value of ‘read’ declared with attribute ‘warn_unused_result’ by checking the return value of the affected functions and displaying an error message if an error is seen. Fixes: 2b6d490b82668 ("selftests: drv-net: Factor out ksft C helpers") Cc: Joe Damato Signed-off-by: Guenter Roeck Link: https://patch.msgid.link/20251205171010.515236-11-linux@roeck-us.net Signed-off-by: Jakub Kicinski commit 06f7cae92fe346fa49a8a9b161124b26cc5c3ed1 Author: Guenter Roeck Date: Fri Dec 5 09:10:00 2025 -0800 selftest: af_unix: Support compilers without flex-array-member-not-at-end support Fix: gcc: error: unrecognized command-line option ‘-Wflex-array-member-not-at-end’ by making the compiler option dependent on its support. Fixes: 1838731f1072c ("selftest: af_unix: Add -Wall and -Wflex-array-member-not-at-end to CFLAGS.") Cc: Kuniyuki Iwashima Signed-off-by: Guenter Roeck Link: https://patch.msgid.link/20251205171010.515236-7-linux@roeck-us.net Signed-off-by: Jakub Kicinski commit 9580f6d47dd6156c6d16e988d28faa74e5a0b8ba Author: Ankit Khushwaha Date: Fri Dec 5 22:02:42 2025 +0530 selftests: tls: fix warning of uninitialized variable In 'poll_partial_rec_async' a uninitialized char variable 'token' with is used for write/read instruction to synchronize between threads via a pipe. tls.c:2833:26: warning: variable 'token' is uninitialized when passed as a const pointer argument Initialize 'token' to '\0' to silence compiler warning. Signed-off-by: Ankit Khushwaha Link: https://patch.msgid.link/20251205163242.14615-1-ankitkhushwaha.linux@gmail.com Signed-off-by: Jakub Kicinski commit 50b3db3e11864cb4e18ff099cfb38e11e7f87a68 Author: Alexey Simakov Date: Fri Dec 5 18:58:16 2025 +0300 broadcom: b44: prevent uninitialized value usage On execution path with raised B44_FLAG_EXTERNAL_PHY, b44_readphy() leaves bmcr value uninitialized and it is used later in the code. Add check of this flag at the beginning of the b44_nway_reset() and exit early of the function with restarting autonegotiation if an external PHY is used. Fixes: 753f492093da ("[B44]: port to native ssb support") Reviewed-by: Jonas Gorski Reviewed-by: Andrew Lunn Signed-off-by: Alexey Simakov Reviewed-by: Michael Chan Link: https://patch.msgid.link/20251205155815.4348-1-bigalex934@gmail.com Signed-off-by: Jakub Kicinski commit 6af2a01d65f89e73c1cbb9267f8880d83a88cee4 Author: caoping Date: Thu Dec 4 01:10:58 2025 -0800 net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->sk_destruct but never restores it when submission fails before the request is hashed. handshake_sk_destruct() then returns early and the original destructor never runs, leaking the socket. Restore sk_destruct on the error path. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Reviewed-by: Chuck Lever Cc: stable@vger.kernel.org Signed-off-by: caoping Link: https://patch.msgid.link/20251204091058.1545151-1-caoping@cmss.chinamobile.com Signed-off-by: Jakub Kicinski commit 9e7477a427449a8a3cd00c188e20a880e3d94638 Author: Arnd Bergmann Date: Thu Dec 4 11:01:28 2025 +0100 net: ti: icssg-prueth: add PTP_1588_CLOCK_OPTIONAL dependency The new icssg-prueth driver needs the same dependency as the other parts that use the ptp-1588: WARNING: unmet direct dependencies detected for TI_ICSS_IEP Depends on [m]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_TI [=y] && PTP_1588_CLOCK_OPTIONAL [=m] && TI_PRUSS [=y] Selected by [y]: - TI_PRUETH [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_TI [=y] && PRU_REMOTEPROC [=y] && NET_SWITCHDEV [=y] Add the correct dependency on the two drivers missing it, and remove the pointless 'imply' in the process. Fixes: e654b85a693e ("net: ti: icssg-prueth: Add ICSSG Ethernet driver for AM65x SR1.0 platforms") Fixes: 511f6c1ae093 ("net: ti: icssm-prueth: Adds ICSSM Ethernet driver") Signed-off-by: Arnd Bergmann Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251204100138.1034175-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 5ace7ef87f059d68b5f50837ef3e8a1a4870c36e Author: Ilya Maximets Date: Thu Dec 4 11:53:32 2025 +0100 net: openvswitch: fix middle attribute validation in push_nsh() action The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the nla_for_each_nested() inside __ovs_nla_copy_actions(). The innermost OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested() inside nsh_key_put_from_nlattr(). But nothing checks if the attribute in the middle is OK. We don't even check that this attribute is the OVS_KEY_ATTR_NSH. We just do a double unwrap with a pair of nla_data() calls - first time directly while calling validate_push_nsh() and the second time as part of the nla_for_each_nested() macro, which isn't safe, potentially causing invalid memory access if the size of this attribute is incorrect. The failure may not be noticed during validation due to larger netlink buffer, but cause trouble later during action execution where the buffer is allocated exactly to the size: BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] Read of size 184 at addr ffff88816459a634 by task a.out/22624 CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary) Call Trace: dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x2c/0x390 kasan_report+0xdd/0x110 kasan_check_range+0x35/0x1b0 __asan_memcpy+0x20/0x60 nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] push_nsh+0x82/0x120 [openvswitch] do_execute_actions+0x1405/0x2840 [openvswitch] ovs_execute_actions+0xd5/0x3b0 [openvswitch] ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch] genl_family_rcv_msg_doit+0x1d6/0x2b0 genl_family_rcv_msg+0x336/0x580 genl_rcv_msg+0x9f/0x130 netlink_rcv_skb+0x11f/0x370 genl_rcv+0x24/0x40 netlink_unicast+0x73e/0xaa0 netlink_sendmsg+0x744/0xbf0 __sys_sendto+0x3d6/0x450 do_syscall_64+0x79/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Let's add some checks that the attribute is properly sized and it's the only one attribute inside the action. Technically, there is no real reason for OVS_KEY_ATTR_NSH to be there, as we know that we're pushing an NSH header already, it just creates extra nesting, but that's how uAPI works today. So, keeping as it is. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Reported-by: Junvy Yang Signed-off-by: Ilya Maximets Acked-by: Eelco Chaudron echaudro@redhat.com Reviewed-by: Aaron Conole Link: https://patch.msgid.link/20251204105334.900379-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 6cb31fba137d45e682ce455b8ea364f44d5d4f98 Author: René Rebe Date: Mon Dec 8 14:18:27 2025 +0100 drm/mgag200: Fix big-endian support Unlike the original, deleted Matrox mga driver, the new mgag200 driver has the XRGB frame-buffer byte swapped on big-endian "RISC" systems. Fix by enabling byte swapping "PowerPC" OPMODE for any __BIG_ENDIAN config. Fixes: 414c45310625 ("mgag200: initial g200se driver (v2)") Signed-off-by: René Rebe Cc: stable@kernel.org Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251208.141827.965103015954471168.rene@exactco.de commit 3e54d3b4a8437b6783d4145c86962a2aa51022f3 Author: Marc Kleine-Budde Date: Mon Dec 1 19:26:38 2025 +0100 can: gs_usb: gs_can_open(): fix error handling Commit 2603be9e8167 ("can: gs_usb: gs_can_open(): improve error handling") added missing error handling to the gs_can_open() function. The driver uses 2 USB anchors to track the allocated URBs: the TX URBs in struct gs_can::tx_submitted for each netdev and the RX URBs in struct gs_usb::rx_submitted for the USB device. gs_can_open() allocates the RX URBs, while TX URBs are allocated during gs_can_start_xmit(). The cleanup in gs_can_open() kills all anchored dev->tx_submitted URBs (which is not necessary since the netdev is not yet registered), but misses the parent->rx_submitted URBs. Fix the problem by killing the rx_submitted instead of the tx_submitted. Fixes: 2603be9e8167 ("can: gs_usb: gs_can_open(): improve error handling") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251210-gs_usb-fix-error-handling-v1-1-d6a5a03f10bb@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 0048fbb4011ec55c32d3148b2cda56433f273375 Merge: 2137cb863b8018 c42ba5a87bdccb Author: Linus Torvalds Date: Wed Dec 10 17:21:30 2025 +0900 Merge tag 'locking-futex-2025-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex updates from Ingo Molnar: - Standardize on ktime_t in restart_block::time as well (Thomas Weißschuh) - Futex selftests: - Add robust list testcases (André Almeida) - Formatting fixes/cleanups (Carlos Llamas) * tag 'locking-futex-2025-12-10' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Store time as ktime_t in restart block selftests/futex: Create test for robust list selftests/futex: Skip tests if shmget unsupported selftests/futex: Add newline to ksft_exit_fail_msg() selftests/futex: Remove unused test_futex_mpol() commit 6abd4577bccc66f83edfdb24dc484723ae99cbe8 Author: Arnd Bergmann Date: Thu Dec 4 11:00:09 2025 +0100 can: fix build dependency A recent bugfix introduced a new problem with Kconfig dependencies: WARNING: unmet direct dependencies detected for CAN_DEV Depends on [n]: NETDEVICES [=n] && CAN [=m] Selected by [m]: - CAN [=m] && NET [=y] Since the CAN core code now links into the CAN device code, that particular function needs to be available, though the rest of it does not. Revert the incomplete fix and instead use Makefile logic to avoid the link failure. Fixes: cb2dc6d2869a ("can: Kconfig: select CAN driver infrastructure by default") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512091523.zty3CLmc-lkp@intel.com/ Signed-off-by: Arnd Bergmann Tested-by: Oliver Hartkopp Acked-by: Oliver Hartkopp Link: https://patch.msgid.link/20251204100015.1033688-1-arnd@kernel.org [mkl: removed module option from CAN_DEV help text (thanks Vincent)] [mkl: removed '&& CAN' from Kconfig dependency (thanks Vincent)] Signed-off-by: Marc Kleine-Budde commit 2137cb863b8018710315138f40eefcceb8584d1b Merge: db28b8ae363b9d 4ab2ee30798354 Author: Linus Torvalds Date: Wed Dec 10 16:57:24 2025 +0900 Merge tag 'kbuild-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fix from Nathan Chancellor: - Fix install-extmod-build when ccache is used via CC * tag 'kbuild-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: install-extmod-build: Properly fix CC expansion when ccache is used commit 9489d457d48bd10c4eacd8670840132be00c15cd Author: T.J. Mercier Date: Wed Dec 3 16:03:48 2025 -0800 selftests/bpf: Add test for truncated dmabuf_iter reads If many dmabufs are present, reads of the dmabuf iterator can be truncated at PAGE_SIZE or user buffer size boundaries before the fix in "bpf: Fix truncated dmabuf iterator reads". Add a test to confirm truncation does not occur. Signed-off-by: T.J. Mercier Link: https://lore.kernel.org/r/20251204000348.1413593-2-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit 234483565dbb2b264fdd165927c89fbf3ecf4733 Author: T.J. Mercier Date: Wed Dec 3 16:03:47 2025 -0800 bpf: Fix truncated dmabuf iterator reads If there is a large number (hundreds) of dmabufs allocated, the text output generated from dmabuf_iter_seq_show can exceed common user buffer sizes (e.g. PAGE_SIZE) necessitating multiple start/stop cycles to iterate through all dmabufs. However the dmabuf iterator currently returns NULL in dmabuf_iter_seq_start for all non-zero pos values, which results in the truncation of the output before all dmabufs are handled. After dma_buf_iter_begin / dma_buf_iter_next, the refcount of the buffer is elevated so that the BPF iterator program can run without holding any locks. When a stop occurs, instead of immediately dropping the reference on the buffer, stash a pointer to the buffer in seq->priv until either start is called or the iterator is released. This also enables the resumption of iteration without first walking through the list of dmabufs based on the pos value. Fixes: 76ea95534995 ("bpf: Add dmabuf iterator") Signed-off-by: T.J. Mercier Link: https://lore.kernel.org/r/20251204000348.1413593-1-tjmercier@google.com Signed-off-by: Alexei Starovoitov commit c8161e5304abb26e6c0bec6efc947992500fa6c5 Author: Yongxin Liu Date: Wed Dec 10 08:02:20 2025 +0800 x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures Zero can be a valid value of num_records. For example, on Intel Atom x6425RE, only x87 and SSE are supported (features 0, 1), and fpu_user_cfg.max_features is 3. The for_each_extended_xfeature() loop only iterates feature 2, which is not enabled, so num_records = 0. This is valid and should not cause core dump failure. The issue is that dump_xsave_layout_desc() returns 0 for both genuine errors (dump_emit() failure) and valid cases (no extended features). Use negative return values for errors and only abort on genuine failures. Fixes: ba386777a30b ("x86/elf: Add a new FPU buffer layout info to x86 core files") Signed-off-by: Yongxin Liu Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251210000219.4094353-2-yongxin.liu@windriver.com commit db28b8ae363b9d05ab3779127514d2e81fe03ab1 Merge: 2f7041e59bf023 429c4727011ead Author: Linus Torvalds Date: Wed Dec 10 16:44:18 2025 +0900 Merge tag 'input-for-v6.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - DT bindings for Melfas MIP4 touchscreen controller and TWL4030 keypad have been converted to the DT schema - simple touch controller bindings have been consolidated to trivial-touch.yaml DT schema - memory allocation failure noise was removed from qnap-mcu-input and zforce_ts dirvers - ti_am335x_tsc driver was hardened to handle invalid (too large) number of coordinates specified in device tree - a cleanup in Cypress cyttsp5 driver to use %pe to print error code * tag 'input-for-v6.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ti_am335x_tsc - clamp coordinate_readouts to DT maximum (6) dt-bindings: touchscreen: consolidate simple touch controller to trivial-touch.yaml dt-bindings: touchscreen: trivial-touch: add reset-gpios and wakeup-source dt-bindings: input: ti,twl4030-keypad: convert to DT schema Input: zforce_ts - omit error message when memory allocation fails Input: qnap-mcu-input - omit error message when memory allocation fails dt-bindings: input: Convert MELFAS MIP4 Touchscreen to DT schema dt-bindings: touchscreen: move ar1021.txt to trivial-touch.yaml dt-bindings: touchscreen: rename maxim,max11801.yaml to trivial-touch.yaml Input: cyttsp5 - use %pe format specifier commit 2f7041e59bf023c9e26184b77a1a87bc5e29d83e Merge: 565848bb3bcdf1 2c22361ab628ad Author: Linus Torvalds Date: Wed Dec 10 16:38:50 2025 +0900 Merge tag 'trace-v6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix unused tracepoint build for modules only using exported tracepoints The tracepoint-update.c code that looks for unused tracepoints expects if tracepoints are used then it will have tracepoints defined. If not, it errors out which fails the build. In most cases this the way things work. A tracepoint can't be used if it is not defined. There is one exception; If a module only uses tracepoints that are defined in other modules or the vmlinux proper, where the tracepoints are exported. In this case, the tracepoint-update.c code thinks tracepoints are used but not defined and errors out, failing the build. When tracepoint-update.c detects this case, if it is a module that is being processed, exit out normally as it is a legitimate case. - Add tracepoint-update.c to MAINTAINERS file The tracepoint-update.c file is specific to tracing so add it to the tracing subsystem in the MAINTAINERS file. * tag 'trace-v6.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: MAINTAINERS: Add tracepoint-update.c to TRACING section tracing: Fix unused tracepoints when module uses only exported ones commit 5288176a541215ba48d38fb74bb619e64d4d9bab Author: Swaraj Gaikwad Date: Wed Dec 10 09:28:14 2025 +0000 x86/boot/Documentation: Fix htmldocs build warning due to malformed table in boot.rst Sphinx reports htmldocs warnings: Documentation/arch/x86/boot.rst:437: ERROR: Malformed table. Text in column margin in table line 2. The table header defined the first column width as 2 characters ("=="), which is too narrow for entries like "0x10" and "0x13". This caused the text to spill into the margin, triggering a docutils parsing failure. Fix it by extending the first column of assigned boot loader ID to 4 characters ("====") to fit the widest entries. Fixes: 1c3377bee212 ("x86/boot/Documentation: Prefix hexadecimal literals with 0x") Tested-by: Randy Dunlap Signed-off-by: Swaraj Gaikwad Signed-off-by: Ingo Molnar Reviewed-by: Randy Dunlap Reviewed-by: Bagas Sanjaya Link: https://patch.msgid.link/20251210092814.9986-1-swarajgaikwad1925@gmail.com commit 297c3fba9d766b52b6b8e99fa53f0a85c5902909 Merge: 189e5deb944a6f 01bc3b6db18d6e Author: Alexei Starovoitov Date: Tue Dec 9 23:28:49 2025 -0800 Merge branch 'bpf-x86-unwind-orc-support-reliable-unwinding-through-bpf-stack-frames' Josh Poimboeuf says: ==================== bpf, x86/unwind/orc: Support reliable unwinding through BPF stack frames Fix livepatch stalls which may be seen when a task is blocked with BPF JIT on its kernel stack. Changes since v1 (https://lore.kernel.org/cover.1764699074.git.jpoimboe@kernel.org): - fix NULL ptr deref in __arch_prepare_bpf_trampoline() ==================== Link: https://patch.msgid.link/cover.1764818927.git.jpoimboe@kernel.org Signed-off-by: Alexei Starovoitov commit 01bc3b6db18d6e0a2e93c37885996bf339bfe337 Author: Josh Poimboeuf Date: Wed Dec 3 19:32:16 2025 -0800 x86/unwind/orc: Support reliable unwinding through BPF stack frames BPF JIT programs and trampolines use a frame pointer, so the current ORC unwinder strategy of falling back to frame pointers (when an ORC entry is missing) usually works in practice when unwinding through BPF JIT stack frames. However, that frame pointer fallback is just a guess, so the unwind gets marked unreliable for live patching, which can cause livepatch transition stalls. Make the common case reliable by calling the bpf_has_frame_pointer() helper to detect the valid frame pointer region of BPF JIT programs and trampolines. Fixes: ee9f8fce9964 ("x86/unwind: Add the ORC unwinder") Reported-by: Andrey Grodzovsky Closes: https://lore.kernel.org/0e555733-c670-4e84-b2e6-abb8b84ade38@crowdstrike.com Acked-by: Song Liu Acked-and-tested-by: Andrey Grodzovsky Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/a18505975662328c8ffb1090dded890c6f8c1004.1764818927.git.jpoimboe@kernel.org Signed-off-by: Alexei Starovoitov Reviewed-by: Jiri Olsa commit ca45c84afb8c91a8d688b0012657099c24f59266 Author: Josh Poimboeuf Date: Wed Dec 3 19:32:15 2025 -0800 bpf: Add bpf_has_frame_pointer() Introduce a bpf_has_frame_pointer() helper that unwinders can call to determine whether a given instruction pointer is within the valid frame pointer region of a BPF JIT program or trampoline (i.e., after the prologue, before the epilogue). This will enable livepatch (with the ORC unwinder) to reliably unwind through BPF JIT frames. Acked-by: Song Liu Acked-and-tested-by: Andrey Grodzovsky Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/fd2bc5b4e261a680774b28f6100509fd5ebad2f0.1764818927.git.jpoimboe@kernel.org Signed-off-by: Alexei Starovoitov Reviewed-by: Jiri Olsa commit 189e5deb944a6f9c7992355d60bffd8ec2e54a9c Author: Ondrej Mosnacek Date: Thu Dec 4 13:59:16 2025 +0100 bpf, arm64: Do not audit capability check in do_jit() Analogically to the x86 commit 881a9c9cb785 ("bpf: Do not audit capability check in do_jit()"), change the capable() call to ns_capable_noaudit() in order to avoid spurious SELinux denials in audit log. The commit log from that commit applies here as well: """ The failure of this check only results in a security mitigation being applied, slightly affecting performance of the compiled BPF program. It doesn't result in a failed syscall, an thus auditing a failed LSM permission check for it is unwanted. For example with SELinux, it causes a denial to be reported for confined processes running as root, which tends to be flagged as a problem to be fixed in the policy. Yet dontauditing or allowing CAP_SYS_ADMIN to the domain may not be desirable, as it would allow/silence also other checks - either going against the principle of least privilege or making debugging potentially harder. Fix it by changing it from capable() to ns_capable_noaudit(), which instructs the LSMs to not audit the resulting denials. """ Fixes: f300769ead03 ("arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users") Signed-off-by: Ondrej Mosnacek Link: https://lore.kernel.org/r/20251204125916.441021-1-omosnace@redhat.com Signed-off-by: Alexei Starovoitov commit d70f79fef65810faf64dbae1f3a1b5623cdb2345 Author: Mikhail Gavrilov Date: Sat Dec 6 14:28:25 2025 +0500 libbpf: Fix -Wdiscarded-qualifiers under C23 glibc ≥ 2.42 (GCC 15) defaults to -std=gnu23, which promotes -Wdiscarded-qualifiers to an error. In C23, strstr() and strchr() return "const char *". Change variable types to const char * where the pointers are never modified (res, sym_sfx, next_path). Suggested-by: Florian Weimer Suggested-by: Andrii Nakryiko Signed-off-by: Mikhail Gavrilov Link: https://lore.kernel.org/r/20251206092825.1471385-1-mikhail.v.gavrilov@gmail.com Signed-off-by: Alexei Starovoitov commit 639f58a0f4808e78ff6c764747ee125c0e2f093c Author: Quentin Monnet Date: Mon Dec 8 13:07:48 2025 +0000 bpftool: Fix build warnings due to MS extensions The kernel is now built with -fms-extensions. Anonymous structs or unions permitted by these extensions have been used in several places, and can end up in the generated vmlinux.h file, for example: struct ns_tree { [...] }; [...] struct ns_common { [...] union { struct ns_tree; struct callback_head ns_rcu; }; }; Trying to include this header for compiling a tool may result in build warnings, if the compiler does not expect these extensions. This is the case, for example, with bpftool: In file included from skeleton/pid_iter.bpf.c:3: .../tools/testing/selftests/bpf/tools/build/bpftool/vmlinux.h:64057:3: warning: declaration does not declare anything [-Wmissing-declarations] 64057 | struct ns_tree; | ^~~~~~~~~~~~~~ Fix these build warnings in bpftool by turning on Microsoft extensions when compiling the two BPF programs that rely on vmlinux.h. Reported-by: Alexei Starovoitov Closes: https://lore.kernel.org/bpf/CAADnVQK9ZkPC7+R5VXKHVdtj8tumpMXm7BTp0u9CoiFLz_aPTg@mail.gmail.com/ Signed-off-by: Quentin Monnet Link: https://lore.kernel.org/r/20251208130748.68371-1-qmo@kernel.org Signed-off-by: Alexei Starovoitov commit 3c180003dffbc252a72dec4f0c697e12922e0417 Author: Michal Wilczynski Date: Tue Dec 9 21:06:03 2025 +0100 pwm: th1520: Fix missing Kconfig dependencies The driver fails to build on configurations lacking COMMON_CLK (missing clk::Clk) or HAS_IOMEM (incomplete `pwm_chip` struct on UML). Add dependencies on ARCH_THEAD and HAS_IOMEM, and add COMMON_CLK to ensure correct compilation and platform targeting. Reported-by: Markus Probst Closes: https://lore.kernel.org/all/a66b337528d700ae92d7940a04c59206e06a8495.camel@posteo.de/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512020957.PqnHfe7C-lkp@intel.com/ Fixes: e03724aac758 ("pwm: Add Rust driver for T-HEAD TH1520 SoC") Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20251209-fix_deps_pwm-v1-1-f7ed8bd1bd3d@samsung.com Signed-off-by: Uwe Kleine-König commit c94291914b200e10c72cef23c8e4c67eb4fdbcd9 Author: Sebastian Andrzej Siewior Date: Thu Nov 27 15:47:23 2025 +0100 cpu: Make atomic hotplug callbacks run with interrupts disabled on UP On SMP systems the CPU hotplug callbacks in the "starting" range are invoked while the CPU is brought up and interrupts are still disabled. Callbacks which are added later are invoked via the hotplug-thread on the target CPU and interrupts are explicitly disabled. In the UP case callbacks which are added later are invoked directly without the thread indirection. This is in principle okay since there is just one CPU but those callbacks are invoked with interrupt disabled code. That's incorrect as those callbacks assume interrupt disabled context. Disable interrupts before invoking the callbacks on UP if the state is atomic and interrupts are expected to be disabled. The "save" part is required because this is also invoked early in the boot process while interrupts are disabled and must not be enabled prematurely. Fixes: 06ddd17521bf1 ("sched/smp: Always define is_percpu_thread() and scheduler_ipi()") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251127144723.ev9DuXXR@linutronix.de commit 2c38ec934ddfe2d35c813edea2674356bea0fabe Author: Johannes Thumshirn Date: Wed Dec 10 03:10:37 2025 +0100 block: fix cached zone reports on devices with native zone append When mounting a btrfs file system on virtio-blk which supports native Zone Append there has been a WARN triggering in btrfs' space management code. Further looking into btrfs' zoned statistics uncovered the filesystem expecting the zones to be used, but the write pointers being 0: # cat /sys/fs/btrfs/8eabd2e7-3294-4f9e-9b58-7e64135c8bf4/zoned_stats active block-groups: 4 reclaimable: 0 unused: 0 need reclaim: false data relocation block-group: 1342177280 active zones: start: 1073741824, wp: 0 used: 0, reserved: 0, unusable: 0 start: 1342177280, wp: 0 used: 0, reserved: 0, unusable: 0 start: 1610612736, wp: 0 used: 16384, reserved: 0, unusable: 18446744073709535232 start: 1879048192, wp: 0 used: 131072, reserved: 0, unusable: 18446744073709420544 Looking at the blkzone report output for the zone in question (1610612736) the write pointer on the device moved, but the filesystem did not see a change on the write pointer: # blkzone report -c 1 -o 0x300000 /dev/vda start: 0x000300000, len 0x080000, cap 0x080000, wptr 0x000040 reset:0 non-seq:0, zcond: 2(oi) [type: 2(SEQ_WRITE_REQUIRED)] The zone write pointer is 0, because btrfs is using the cached version of blkdev_report_zones() and as virtio-blk is supporting native zone append, but blkdev_revalidate_zones() does not initialize the zone write plugs in this case. Not skipping the revalidate of sequential zones in blkdev_revalidate_zones() callchain fixes this issue. Signed-off-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Fixes: a6aa36e957a1 ("block: Remove zone write plugs when handling native zone append writes") Signed-off-by: Jens Axboe commit 08c2a7d2bae9175e55e5b47e77de74a2cd8ee6b7 Author: ChenXiaoSong Date: Thu Nov 6 18:00:56 2025 +0800 smb: move file_notify_information to common/fscc.h This struct definition is specified in MS-FSCC, and KSMBD will also use it, so move it into common header file. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 6539e18517b62815fa5445ad38de51036d5572d8 Author: ChenXiaoSong Date: Thu Nov 6 17:15:15 2025 +0800 smb: move SMB2 Notify Action Flags into common/smb2pdu.h Some of these definitions are already in common/smb2pdu.h. Remove the duplicate client side definitions, and add all SMB2 Notify Action Flags to common header file. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 9ec7629b430a9f8233de17b617b76abc009d9b73 Author: ChenXiaoSong Date: Thu Nov 6 15:46:56 2025 +0800 smb: move notify completion filter flags into common/smb2pdu.h Some of these definitions are already in common/smb2pdu.h, remove the duplicate client side definitions, and move FILE_NOTIFY_CHANGE_NAME to common header file. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit a71a4aab4834b366fa6e2b2f3c015f24e4366da4 Author: ChenXiaoSong Date: Mon Dec 8 10:59:25 2025 +0800 smb/client: add parentheses to NT error code definitions containing bitwise OR operator Use the following shell commands: # Add "(" sed -i '/|/s/ 0x/ (0x/' fs/smb/client/nterr.h # Add ")" if line does not end with a comment sed -i '/|/ { /.*\*\/$/! s/$/)/ }' fs/smb/client/nterr.h # Add ")" if line end with a comment sed -i '/|/ s/[[:space:]]*\/\*/)&/' fs/smb/client/nterr.h Signed-off-by: ChenXiaoSong Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit bcdd6cfaf2ec17016f9765b01a02b66f13087aa1 Author: ChenXiaoSong Date: Mon Dec 1 15:40:14 2025 +0800 smb: add documentation references for smb2 change notify definitions To make it easier to locate the documentation during development. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit a9adafd40165a9f3ecf4085274ed1a87fd2d1fde Author: ChenXiaoSong Date: Mon Dec 8 09:29:56 2025 +0800 smb/client: add 4 NT error code definitions From server/nterr.h that has been removed. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 Author: ChenXiaoSong Date: Sun Dec 7 09:22:53 2025 +0800 smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value This was reported by the KUnit tests in the later patches. See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the value in the documentation. Signed-off-by: ChenXiaoSong Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit b2b50fca34da5ec231008edba798ddf92986bd7f Author: ChenXiaoSong Date: Sun Dec 7 09:17:57 2025 +0800 smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value This was reported by the KUnit tests in the later patches. See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the value in the documentation. Signed-off-by: ChenXiaoSong Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit a1237c203f1757480dc2f3b930608ee00072d3cc Author: ChenXiaoSong Date: Sun Dec 7 09:13:06 2025 +0800 smb/client: fix NT_STATUS_NO_DATA_DETECTED value This was reported by the KUnit tests in the later patches. See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the value in the documentation. Signed-off-by: ChenXiaoSong Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 565848bb3bcdf166fd3ff982376b30806eec0180 Merge: c9b47175e91311 817d21578d51e8 Author: Linus Torvalds Date: Wed Dec 10 12:17:29 2025 +0900 Merge tag 'csky-for-linus-6.19' of https://github.com/c-sky/csky-linux Pull csky updates from Guo Ren: - Remove compile warning for CONFIG_SMP - Fix __ASSEMBLER__ typo in headers - Fix csky_cmpxchg_fixup * tag 'csky-for-linus-6.19' of https://github.com/c-sky/csky-linux: csky: Remove compile warning for CONFIG_SMP csky: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi header csky: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers csky: fix csky_cmpxchg_fixup not working commit 7dbc0d40d8347bd9de55c904f59ea44bcc8dedb7 Author: Dan Carpenter Date: Tue Dec 9 09:54:16 2025 +0300 irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks for invalid values, but doesn't set the error code. Return -EINVAL in that case, instead of returning success. Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/aTfHmOz6IBpTIPU5@stanley.mountain commit 2e0d224d89884819e6f25953bbe860ae6a49555f Author: ChenXiaoSong Date: Tue Nov 18 11:00:40 2025 +0800 smb/server: add comment to FileSystemName of FileFsAttributeInformation Explained why FileSystemName is always set to "NTFS". Link: https://github.com/namjaejeon/ksmbd/commit/84392651b0b740d2f59bcacd3b4cfff8ae0051a0 Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 98def4eb0244fbc840eb4aff16573c3924462ccd Author: ChenXiaoSong Date: Sat Dec 6 10:44:58 2025 +0800 smb/server: remove unused nterr.h KSMBD does not use these NT error code definitions. Instead, it uses the SMB2 status code definitions defined in common/smb2status.h. By the way, server/nterr.h contains the following additional definitions compared to client/nterr.h: - NT_STATUS_PENDING - NT_STATUS_INVALID_LOCK_RANGE - NT_STATUS_NETWORK_SESSION_EXPIRED - NT_STATUS_NO_PREAUTH_INTEGRITY_HASH_OVERLAP We can add them to client/nterr.h in the next patch. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 01ab0d1640e379f0a0d6602250b33ff2b45e9560 Author: ChenXiaoSong Date: Wed Dec 3 16:44:37 2025 +0800 smb/server: rename include guard in smb_common.h Make the include guard more descriptive to avoid conflicts with include guards that may be used in the future. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 2c22361ab628adbca82ab2da6d41b7cfeb14b83c Author: Steven Rostedt Date: Mon Dec 8 19:25:44 2025 -0500 MAINTAINERS: Add tracepoint-update.c to TRACING section Place the file scripts/tracepoint-update.c in the TRACING section. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Masahiro Yamada Link: https://patch.msgid.link/20251208192544.5f2392a7@debian Signed-off-by: Steven Rostedt (Google) commit 55026a9670ce8b7b3d74f7d570de1382cbfb395d Author: Andy Shevchenko Date: Tue Dec 2 21:23:27 2025 +0100 irqdomain: Delete irq_domain_add_tree() No in-tree users anymore. [ tglx: Remove the reference in the Chinese documentation as well ] Signed-off-by: Andy Shevchenko Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251202202327.1444693-1-andriy.shevchenko@linux.intel.com commit 7a7e836684feb33d4f5418e8bd44101faf6b3f44 Author: Steven Rostedt Date: Tue Dec 9 20:40:23 2025 -0500 tracing: Fix unused tracepoints when module uses only exported ones Building the KVM intel module failed to build with UT=1: no __tracepoint_strings in file: arch/x86/kvm/kvm-intel.o make[3]: *** [/work/git/test-linux.git/scripts/Makefile.modfinal:62: arch/x86/kvm/kvm-intel.ko] Error 1 The reason is that the module only uses the tracepoints defined and exported by the main kvm module. The tracepoint-update.c code fails the build if a tracepoint is used, but there's no tracepoints defined. But this is acceptable in modules if the tracepoints are defined in the vmlinux proper or another module and exported. Do not fail to build if a tracepoint is used but no tracepoints are defined if the code is a module. This should still never happen for the vmlinux itself. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Masahiro Yamada Link: https://patch.msgid.link/20251209204023.76941824@fedora Fixes: e30f8e61e2518 ("tracing: Add a tracepoint verification check at build time") Signed-off-by: Steven Rostedt (Google) commit 89acaa5537a29c742d7a6ed7241fc4cf5e2ef818 Author: Marc Zyngier Date: Fri Dec 5 09:18:14 2025 +0000 genirq: Allow NULL affinity for setup_percpu_irq() setup_percpu_irq() was forgotten when the percpu_devid infrastructure was updated to deal with CPU affinities. In order to keep ignoring users of this legacy API, provide sensible defaults by setting the affinity to cpu_online_mask if none was provided by the caller. Fixes: bdf4e2ac295fe ("genirq: Allow per-cpu interrupt sharing for non-overlapping affinities") Reported-by: Daniel Thompson Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251205091814.3944205-1-maz@kernel.org Closes: https://lore.kernel.org/r/aTFozefMQRg7lYxh@aspen.lan commit f34836a8ddf9216ff919927cddb705022bf30aab Author: Hemalatha Pinnamreddy Date: Wed Dec 3 17:31:34 2025 +0530 ASoC: amd: acp: update tdm channels for specific DAI TDM channel updates were applied to all DAIs, causing configurations to overwrite for unrelated streams. The logic is modified to update channels only for targeted DAI. This prevents corruption of other DAI settings and resolves audio issues observed during system suspend and resume cycles. Fixes: 12229b7e50cf ("ASoC: amd: acp: Add TDM support for acp i2s stream") Signed-off-by: Hemalatha Pinnamreddy Signed-off-by: Raghavendra Prasad Mallela Link: https://patch.msgid.link/20251203120136.2591395-1-raghavendraprasad.mallela@amd.com Signed-off-by: Mark Brown commit e15cb2200b934e507273510ba6bc747d5cde24a3 Author: Jens Axboe Date: Tue Dec 9 13:25:23 2025 -0700 io_uring: fix min_wait wakeups for SQPOLL Using min_wait, two timeouts are given: 1) The min_wait timeout, within which up to 'wait_nr' events are waited for. 2) The overall long timeout, which is entered if no events are generated in the min_wait window. If the min_wait has expired, any event being posted must wake the task. For SQPOLL, that isn't the case, as it won't trigger the io_has_work() condition, as it will have already processed the task_work that happened when an event was posted. This causes any event to trigger post the min_wait to not always cause the waiting application to wakeup, and instead it will wait until the overall timeout has expired. This can be shown in a test case that has a 1 second min_wait, with a 5 second overall wait, even if an event triggers after 1.5 seconds: axboe@m2max-kvm /d/iouring-mre (master)> zig-out/bin/iouring info: MIN_TIMEOUT supported: true, features: 0x3ffff info: Testing: min_wait=1000ms, timeout=5s, wait_nr=4 info: 1 cqes in 5000.2ms where the expected result should be: axboe@m2max-kvm /d/iouring-mre (master)> zig-out/bin/iouring info: MIN_TIMEOUT supported: true, features: 0x3ffff info: Testing: min_wait=1000ms, timeout=5s, wait_nr=4 info: 1 cqes in 1500.3ms When the min_wait timeout triggers, reset the number of completions needed to wake the task. This should ensure that any future events will wake the task, regardless of how many events it originally wanted to wait for. Reported-by: Tip ten Brink Cc: stable@vger.kernel.org Fixes: 1100c4a2656d ("io_uring: add support for batch wait timeout") Link: https://github.com/axboe/liburing/issues/1477 Signed-off-by: Jens Axboe commit 6f7d9481920e1bc06ff21c1e6a84fdea49c6ec3d Author: Ard Biesheuvel Date: Wed Dec 3 17:38:06 2025 +0100 crypto/arm64: sm4/xts - Merge ksimd scopes to reduce stack bloat Merge the two ksimd scopes in the implementation of SM4-XTS to prevent stack bloat in cases where the compiler fails to combine the stack slots for the kernel mode FP/SIMD buffers. Signed-off-by: Ard Biesheuvel Tested-by: Arnd Bergmann Link: https://lore.kernel.org/r/20251203163803.157541-6-ardb@kernel.org Signed-off-by: Eric Biggers commit a9a8b1a383254c9f4ed7fe23b56937f8ad3ad3ab Author: Ard Biesheuvel Date: Wed Dec 3 17:38:05 2025 +0100 crypto/arm64: aes/xts - Use single ksimd scope to reduce stack bloat The ciphertext stealing logic in the AES-XTS implementation creates a separate ksimd scope to call into the FP/SIMD core routines, and in some cases (CONFIG_KASAN_STACK is one, but there might be others), the 528 byte kernel mode FP/SIMD buffer that is allocated inside this scope is not shared with the preceding ksimd scope, resulting in unnecessary stack bloat. Considering that a) the XTS ciphertext stealing logic is never called for block encryption use cases, and XTS is rarely used for anything else, b) in the vast majority of cases, the entire input block is processed during the first iteration of the loop, we can combine both ksimd scopes into a single one with no practical impact on how often/how long FP/SIMD is en/disabled, allowing us to reuse the same stack slot for both FP/SIMD routine calls. Fixes: ba3c1b3b5ac9 ("crypto/arm64: aes-blk - Switch to 'ksimd' scoped guard API") Signed-off-by: Ard Biesheuvel Tested-by: Arnd Bergmann Link: https://lore.kernel.org/r/20251203163803.157541-5-ardb@kernel.org Signed-off-by: Eric Biggers commit 68b233b1d583f7d869fbb3afe2b0531138e001f7 Author: Eric Biggers Date: Thu Dec 4 21:11:55 2025 -0800 lib/crypto: blake2s: Replace manual unrolling with unrolled_full As we're doing in the BLAKE2b code, use unrolled_full to make the compiler handle the loop unrolling. This simplifies the code slightly. The generated object code is nearly the same with both gcc and clang. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251205051155.25274-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2e8f7b170a085f0f5522f262bffe92d6ec911abb Author: Eric Biggers Date: Thu Dec 4 21:03:30 2025 -0800 lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit BLAKE2b has a state of 16 64-bit words. Add the message data in and there are 32 64-bit words. With the current code where all the rounds are unrolled to enable constant-folding of the blake2b_sigma values, this results in a very large code size on 32-bit kernels, including a recurring issue where gcc uses a large amount of stack. There's just not much benefit to this unrolling when the code is already so large. Let's roll up the rounds when !CONFIG_64BIT. To avoid having to duplicate the code, just write the code once using a loop, and conditionally use 'unrolled_full' from . Then, fold the now-unneeded ROUND() macro into the loop. Finally, also remove the now-unneeded override of the stack frame size warning. Code size improvements for blake2b_compress_generic(): Size before (bytes) Size after (bytes) ------------------- ------------------ i386, gcc 27584 3632 i386, clang 18208 3248 arm32, gcc 19912 2860 arm32, clang 21336 3344 Running the BLAKE2b benchmark on a !CONFIG_64BIT kernel on an x86_64 processor shows a 16384B throughput change of 351 => 340 MB/s (gcc) or 442 MB/s => 375 MB/s (clang). So clearly not much of a slowdown either. But also that microbenchmark also effectively disregards cache usage, which is important in practice and is far better in the smaller code. Note: If we rolled up the loop on x86_64 too, the change would be 7024 bytes => 1584 bytes and 1960 MB/s => 1396 MB/s (gcc), or 6848 bytes => 1696 bytes and 1920 MB/s => 1263 MB/s (clang). Maybe still worth it, though not quite as clearly beneficial. Fixes: 91d689337fe8 ("crypto: blake2b - add blake2b generic implementation") Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251205050330.89704-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1cd5bb6e9e027bab33aafd58fe8340124869ba62 Author: Eric Biggers Date: Sat Dec 6 13:37:50 2025 -0800 lib/crypto: riscv: Depend on RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS Replace the RISCV_ISA_V dependency of the RISC-V crypto code with RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS, which implies RISCV_ISA_V as well as vector unaligned accesses being efficient. This is necessary because this code assumes that vector unaligned accesses are supported and are efficient. (It does so to avoid having to use lots of extra vsetvli instructions to switch the element width back and forth between 8 and either 32 or 64.) This was omitted from the code originally just because the RISC-V kernel support for detecting this feature didn't exist yet. Support has now been added, but it's fragmented into per-CPU runtime detection, a command-line parameter, and a kconfig option. The kconfig option is the only reasonable way to do it, though, so let's just rely on that. Fixes: eb24af5d7a05 ("crypto: riscv - add vector crypto accelerated AES-{ECB,CBC,CTR,XTS}") Fixes: bb54668837a0 ("crypto: riscv - add vector crypto accelerated ChaCha20") Fixes: 600a3853dfa0 ("crypto: riscv - add vector crypto accelerated GHASH") Fixes: 8c8e40470ffe ("crypto: riscv - add vector crypto accelerated SHA-{256,224}") Fixes: b3415925a08b ("crypto: riscv - add vector crypto accelerated SHA-{512,384}") Fixes: 563a5255afa2 ("crypto: riscv - add vector crypto accelerated SM3") Fixes: b8d06352bbf3 ("crypto: riscv - add vector crypto accelerated SM4") Cc: stable@vger.kernel.org Reported-by: Vivian Wang Closes: https://lore.kernel.org/r/b3cfcdac-0337-4db0-a611-258f2868855f@iscas.ac.cn/ Reviewed-by: Jerry Shih Link: https://lore.kernel.org/r/20251206213750.81474-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 43169328c7b4623b54b7713ec68479cebda5465f Author: Vivian Wang Date: Tue Dec 2 13:25:07 2025 +0800 lib/crypto: riscv/chacha: Avoid s0/fp register In chacha_zvkb, avoid using the s0 register, which is the frame pointer, by reallocating KEY0 to t5. This makes stack traces available if e.g. a crash happens in chacha_zvkb. No frame pointer maintenance is otherwise required since this is a leaf function. Signed-off-by: Vivian Wang Fixes: bb54668837a0 ("crypto: riscv - add vector crypto accelerated ChaCha20") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20251202-riscv-chacha_zvkb-fp-v2-1-7bd00098c9dc@iscas.ac.cn Signed-off-by: Eric Biggers commit c9b47175e9131118e6f221cc8fb81397d62e7c91 Merge: 9d588a1140b9ae d202341d9b0c5b Author: Linus Torvalds Date: Wed Dec 10 07:48:05 2025 +0900 Merge tag 'i2c-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - general cleanups in bcm2835, designware, pcf8584, and stm32 - amd-mp2: fix device refcount - designware: avoid interrupt storms caused by bad firmware - spacemit: fix device detection failures - new devices: Intel Diamond Rapids, Rockchip RK3506, Qualcomm Kaanapali and MSM8953 - minor fixes to i801, core documentation, elektor Kconfig dependencies - at24 updates: add new compatible for Belling BL24S64 * tag 'i2c-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (21 commits) i2c: qcom-cci: Add msm8953 compatible i2c: spacemit: fix detect issue i2c: amd-mp2: fix reference leak in MP2 PCI device i2c: i2c.h: fix a bad kernel-doc line i2c: i2c-elektor: Allow building on SMP kernels dt-bindings: i2c: qcom-cci: Document Kaanapali compatible dt-bindings: i2c: qcom-cci: Document msm8953 compatible dt-bindings: eeprom: at24: Add compatible for Belling BL24S64 i2c: i801: Fix the Intel Diamond Rapids features i2c: pcf8584: Change pcf_doAdress() to pcf_send_address() i2c: pcf8584: Make pcf_doAddress() function void i2c: pcf8584: Move 'ret' variable inside for loop, goto out if ret < 0. i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware dt-bindings: i2c: i2c-rk3x: Add compatible string for RK3506 i2c: i801: Add support for Intel Diamond Rapids i2c: stm32: Omit two variable reassignments in stm32_i2c_dma_request() i2c: designware: Omit a variable reassignment in dw_i2c_plat_probe() i2c: pcf8584: Fix do not use assignment inside if conditional i2c: pcf8584: Remove debug macros from i2c-algo-pcf.c i2c: busses: bcm2835: convert from round_rate() to determine_rate() ... commit 9d588a1140b9ae211581a7a154d0b806d8cd8238 Merge: 9f20d9bad51635 4df66a74d2a54e Author: Linus Torvalds Date: Wed Dec 10 06:38:17 2025 +0900 Merge tag 'platform-drivers-x86-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: - acer-wmi: Add PH16-72, PHN16-72, and PT14-51 fan control support - acpi: platform_profile: Add max-power profile option (power draw limited by the cooling hardware, may exceed battery power draw limit when on AC power) - amd/hsmp: Allow more than one data-fabric per socket - asus-armoury: Add WMI attributes driver to expose miscellaneous WMI functions through fw_attributes (deprecates the custom BIOS features interface through asus-wmi) - asus-wmi: Use brightness_set_blocking() for kbd led - ayaneo-ec: Add Ayaneo Embedded Controller driver - fs/nls: - Fix utf16 to utf8 string conversion when output size restricted - Improve error code consistency for utf8 to utf32 conversions - ideapad-laptop: Fast (Rapid Charge) charge type support - intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - intel/pmc: - Arrow Lake telemetry GUID improvements - Add support for Wildcat Lake PMC information - intel_pmc_ipc: Fix ACPI buffer memleak - intel/punit_ipc: Fix memory corruption - intel/vsec: Wildcat Lake PMT telemetry support - lenovo-wmi-gamezone: Map "Extreme" performance mode to max-power - lg-laptop: Add support for the HDAP opregion field - serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects - thinkpad-t14s-ec: Improve suspend/resume support (lid LEDs, keyboard backlight) - uniwill: Add Uniwill laptop driver - wmi: Move under drivers/platform/wmi as non-x86 WMI support is around the corner and other WMI features will require adding more C files as well - tools/power/x86/intel-speed-select: v1.24 - Check feature status to check if the feature enablement was successful - Reset SST-TF bucket structure to display valid bucket info - Miscellaneous cleanups / refactoring / improvements * tag 'platform-drivers-x86-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (73 commits) tools/power/x86/intel-speed-select: v1.24 release tools/power/x86/intel-speed-select: Reset isst_turbo_freq_info for invalid buckets tools/power/x86/intel-speed-select: Check feature status platform/x86: asus-wmi: use brightness_set_blocking() for kbd led fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() platform/x86: asus-armoury: add support for GA503QR platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak platform/x86: hp-wmi: Order DMI board name arrays platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks platform: surface: replace use of system_wq with system_percpu_wq platform: x86: replace use of system_wq with system_percpu_wq platform/surface: acpi-notify: add WQ_PERCPU to alloc_workqueue users platform/x86: wmi-gamezone: Add Legion Go 2 Quirks platform/x86: lenovo-wmi-gamezone Use max-power rather than balanced-performance acpi: platform_profile - Add max-power profile option platform/x86/amd/pmf: Use devm_mutex_init() for mutex initialization platform/x86/amd/pmf: Add BIOS_INPUTS_MAX macro to replace hardcoded array size platform/x86: serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects platform/x86/amd/pmf: Refactor repetitive BIOS output handling platform/x86/uniwill: Add TUXEDO devices ... commit 9f20d9bad51635973fb1117544033bb03c4c3224 Merge: 7a3984bbd69055 316f0b43fe0131 Author: Linus Torvalds Date: Wed Dec 10 06:29:40 2025 +0900 Merge tag 'pm-6.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "Fix a runtime PM unit test added during the 6.18 development cycle and change the pm_runtime_barrier() return type to void (Brian Norris)" * tag 'pm-6.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: coccinelle: Drop pm_runtime_barrier() error code checks PM: runtime: Make pm_runtime_barrier() return void PM: runtime: Stop checking pm_runtime_barrier() return code commit 7a3984bbd69055898add0fe22445f99435f33450 Merge: 12eef14bcbac77 2b6d718c8dbe61 Author: Linus Torvalds Date: Wed Dec 10 06:20:22 2025 +0900 Merge tag 'mips_6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: "Just cleanups and fixes" * tag 'mips_6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Fix whitespace damage in r4k_wait from VS timer fix mips: kvm: simplify kvm_mips_deliver_interrupts() MIPS: alchemy: mtx1: switch to static device properties mips: Remove __GFP_HIGHMEM masking MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits MIPS: dts: Always descend vendor subdirectories mips: configs: loongson1: Update defconfig MIPS: Fix HOTPLUG_PARALLEL dependency commit 12eef14bcbac77bd08dc5693ad5818e69993246f Author: Christoph Hellwig Date: Tue Dec 9 09:18:57 2025 +0100 lockref: add a __cond_lock annotation for lockref_put_or_lock Add a cond_lock annotation for lockref_put_or_lock to make sparse happy with using it. Note that for this the return value has to be double-inverted as the return value convention of lockref_put_or_lock is inverted compared to _trylock conventions expected by __cond_lock, as lockref_put_or_lock returns true when it did not need to take the lock. Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds commit c752c21c90b808a059ae8e0070ff7566a65f8577 Merge: 3d99347a2e1ae6 4ecc26fa585216 Author: Linus Torvalds Date: Wed Dec 10 05:41:10 2025 +0900 Merge tag 'auto-type-conversion-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-auto Pull __auto_type to auto conversion from Peter Anvin: "Convert '__auto_type' to 'auto', defining a macro for 'auto' unless C23+ is in use" * tag 'auto-type-conversion-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-auto: tools/virtio: replace "__auto_type" with "auto" selftests/bpf: replace "__auto_type" with "auto" arch/x86: replace "__auto_type" with "auto" arch/nios2: replace "__auto_type" and adjacent equivalent with "auto" fs/proc: replace "__auto_type" with "const auto" include/linux: change "__auto_type" to "auto" compiler_types.h: add "auto" as a macro for "__auto_type" commit dafdba0964bd10913fbaa5537201cbbe05df5b9c Author: Arnd Bergmann Date: Thu Dec 4 11:03:54 2025 +0100 mm/damon/tests/core-kunit: avoid damos_test_commit stack warning The newly added damos_test_commit() constructs multiple large structures on the stack, which exceeds the warning limit in some cases: In file included from mm/damon/core.c:2941: mm/damon/tests/core-kunit.h: In function 'damos_test_commit': mm/damon/tests/core-kunit.h:965:1: error: the frame size of 1520 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Split this function up into two separate ones that are called sequentially, so they can occupy the same stack slots. Link: https://lkml.kernel.org/r/20251204100403.1034980-1-arnd@kernel.org Fixes: 299a88f6ec13 ("mm/damon/tests/core-kunit: add damos_commit() test") Signed-off-by: Arnd Bergmann Reviewed-by: SeongJae Park Cc: Quanmin Yan Signed-off-by: Andrew Morton commit 49d921b471c51316ccfd659f4d81efbbbe3613db Author: Chen Ridong Date: Thu Dec 4 12:23:55 2025 +0000 mm: vmscan: correct nr_requested tracing in scan_folios When enabling vmscan tracing, it is observed that nr_requested is always 4096, which is confusing. mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ... This is because it prints MAX_LRU_BATCH, which is meaningless as it's a constant. To fix this, modify it to print capped valued. Link: https://lkml.kernel.org/r/20251204122355.1822919-1-chenridong@huaweicloud.com Fixes: 8c2214fc9a47 ("mm: multi-gen LRU: reuse some legacy trace events") Signed-off-by: Chen Ridong Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lance Yang Cc: Axel Rasmussen Cc: Jaewon Kim Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Lu Jialin Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Cc: Yu Zhao Signed-off-by: Andrew Morton commit 12c1fa8d4631e5fa8d1611379fc6babb558755e1 Author: Lukas Bulwahn Date: Wed Nov 5 11:58:57 2025 +0100 MAINTAINERS: add idr core-api doc file to XARRAY The files in Documentation/core-api/ are by virtue of their top-level directory part of the Documentation section in MAINTAINERS. Each file in Documentation/core-api/ should however also have a further section in MAINTAINERS it belongs to, which fits to the technical area of the documented API in that file. idr.rst provides some explanation to the ID allocation API defined in lib/idr.c, which itself is part of the XARRAY section. Add this core-api document to XARRAY. Link: https://lkml.kernel.org/r/20251105105857.156950-1-lukas.bulwahn@redhat.com Signed-off-by: Lukas Bulwahn Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 9ee5d1766c8bfa4924bd47e31c4dd193493f5a45 Author: Shameer Kolothum Date: Tue Nov 25 17:13:50 2025 +0000 mm/hugetlb: fix incorrect error return from hugetlb_reserve_pages() The function hugetlb_reserve_pages() returns the number of pages added to the reservation map on success and a negative error code on failure (e.g. -EINVAL, -ENOMEM). However, in some error paths, it may return -1 directly. For example, a failure at: if (hugetlb_acct_memory(h, gbl_reserve) < 0) goto out_put_pages; results in returning -1 (since add = -1), which may be misinterpreted in userspace as -EPERM. Fix this by explicitly capturing and propagating the return values from helper functions, and using -EINVAL for all other failure cases. Link: https://lkml.kernel.org/r/20251125171350.86441-1-skolothumtho@nvidia.com Fixes: 986f5f2b4be3 ("mm/hugetlb: make hugetlb_reserve_pages() return nr of entries updated") Signed-off-by: Shameer Kolothum Reviewed-by: Joshua Hahn Reviewed-by: Jason Gunthorpe Acked-by: Oscar Salvador Cc: Matthew R. Ochs Cc: Muchun Song Cc: Nicolin Chen Cc: Vivek Kasireddy Signed-off-by: Andrew Morton commit 40a4af52e0472dfc114aa78d6f3debec70b42048 Author: Lukas Bulwahn Date: Mon Dec 1 13:29:22 2025 +0100 mm: fix CONFIG_STACK_GROWSUP typo in mm.h Commit 2b6a3f061f11 ("mm: declare VMA flags by bit") significantly refactors the header file include/linux/mm.h. In that step, it introduces a typo in an ifdef, referring to a non-existing config option STACK_GROWS_UP, whereas the actual config option is called STACK_GROWSUP. Fix this typo in the mm header file. Link: https://lkml.kernel.org/r/20251201122922.352480-1-lukas.bulwahn@redhat.com Fixes: 2b6a3f061f11 ("mm: declare VMA flags by bit") Signed-off-by: Lukas Bulwahn Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Cc: Alice Ryhl Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9dcdc0c207fe32c576f1359deaf0efece9f36ca2 Author: Zi Yan Date: Wed Nov 26 16:06:18 2025 -0500 mm/huge_memory: fix folio split stats counting The "return " statements for error checks at the beginning of __folio_split() skip necessary count_vm_event() and count_mthp_stat() at the end of the function. Fix these by replacing them with "ret = ; goto out;". Link: https://lkml.kernel.org/r/20251126210618.1971206-5-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Wei Yang Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Red Hat) Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 2f78910659c72807b7ff03a2c0d121901bf55848 Author: Zi Yan Date: Wed Nov 26 16:06:17 2025 -0500 mm/huge_memory: make min_order_for_split() always return an order min_order_for_split() returns -EBUSY when the folio is truncated and cannot be split. In commit 77008e1b2ef7 ("mm/huge_memory: do not change split_huge_page*() target order silently"), memory_failure() does not handle it and pass -EBUSY to try_to_split_thp_page() directly. try_to_split_thp_page() returns -EINVAL since -EBUSY becomes 0xfffffff0 as new_order is unsigned int in __folio_split() and this large new_order is rejected as an invalid input. The code does not cause a bug. soft_offline_in_use_page() also uses min_order_for_split() but it always passes 0 as new_order for split. Fix it by making min_order_for_split() always return an order. When the given folio is truncated, namely folio->mapping == NULL, return 0 and let a subsequent split function handle the situation and return -EBUSY. Add kernel-doc to min_order_for_split() to clarify its use. Link: https://lkml.kernel.org/r/20251126210618.1971206-4-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Wei Yang Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lorenzo Stoakes Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 5842bcbfc316738cbfcbdb4def5a7592aa03ebf2 Author: Zi Yan Date: Wed Nov 26 16:06:16 2025 -0500 mm/huge_memory: replace can_split_folio() with direct refcount calculation can_split_folio() is just a refcount comparison, making sure only the split caller holds an extra pin. Open code it with folio_expected_ref_count() != folio_ref_count() - 1. For the extra_pins used by folio_ref_freeze(), add folio_cache_ref_count() to calculate it. Also replace folio_expected_ref_count() with folio_cache_ref_count() used by folio_ref_unfreeze(), since they are returning the same values when a folio is frozen and folio_cache_ref_count() does not have unnecessary folio_mapcount() in its implementation. Link: https://lkml.kernel.org/r/20251126210618.1971206-3-ziy@nvidia.com Signed-off-by: Zi Yan Suggested-by: David Hildenbrand (Red Hat) Reviewed-by: Wei Yang Acked-by: David Hildenbrand (Red Hat) Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit bdd0d69a32c2aa6437d23e35acc705758b835a75 Author: Zi Yan Date: Wed Nov 26 16:06:15 2025 -0500 mm/huge_memory: change folio_split_supported() to folio_check_splittable() Patch series "Improve folio split related functions", v4. This patchset improves several folio split related functions to avoid future misuse. The changes are: 1. Consolidated folio splittable checks by moving truncated folio check, huge zero folio check, and writeback folio check into folio_split_supported(). Changed the function return type. Renamed it to folio_check_splittable() for clarification. 2. Replaced can_split_folio() with open coded folio_expected_ref_count() and folio_ref_count() and introduced folio_cache_ref_count(). 3. Changed min_order_for_split() to always return an order. 4. Fixed folio split stats counting. Motivation ========== This is based on Wei's observation[1] and solves several potential issues: 1. Dereferencing NULL folio->mapping in try_folio_split_to_order() if it is called on truncated folios. 2. Not handling of negative return value of min_order_for_split() in mm/memory-failure.c There is no bug in the current code. This patch (of 4): folio_split_supported() used in try_folio_split_to_order() requires folio->mapping to be non NULL, but current try_folio_split_to_order() does not check it. There is no issue in the current code, since try_folio_split_to_order() is only used in truncate_inode_partial_folio(), where folio->mapping is not NULL. To prevent future misuse, move folio->mapping NULL check (i.e., folio is truncated) into folio_split_supported(). Since folio->mapping NULL check returns -EBUSY and folio_split_supported() == false means -EINVAL, change folio_split_supported() return type from bool to int and return error numbers accordingly. Rename folio_split_supported() to folio_check_splittable() to match the return type change. While at it, move is_huge_zero_folio() check and folio_test_writeback() check into folio_check_splittable() and add kernel-doc. Remove all warnings inside folio_check_splittable() and give warnings in __folio_split() instead, so that bool warns parameter can be removed. Link: https://lkml.kernel.org/r/20251126210618.1971206-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20251126210618.1971206-2-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Wei Yang Acked-by: Balbir Singh Acked-by: David Hildenbrand (Red Hat) Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 1cba2eba9b73d8dfee6b3e7465f510cace71637c Author: Jinhui Guo Date: Thu Nov 27 17:25:12 2025 +0800 mm/sparse: fix sparse_vmemmap_init_nid_early definition without CONFIG_SPARSEMEM When CONFIG_SPARSEMEM is disabled, the macro sparse_vmemmap_init_nid_early(_nid, _use) passes two arguments, while the actual function accepts only nid. Drop the extra argument _use. Link: https://lkml.kernel.org/r/20251127092512.278-1-guojinhui.liam@bytedance.com Fixes: d65917c42373 ("mm/sparse: allow for alternate vmemmap section init at boot") Signed-off-by: Jinhui Guo Cc: Frank van der Linden Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: "David Hildenbrand (Red Hat)" Signed-off-by: Andrew Morton commit 0da2ba35c0d532ca0fe7af698b17d74c4d084b9a Author: David Hildenbrand Date: Tue Oct 21 12:06:06 2025 +0200 powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages Let's properly adjust BALLOON_MIGRATE like the other drivers. Note that the INFLATE/DEFLATE events are triggered from the core when enqueueing/dequeueing pages. This was found by code inspection. Link: https://lkml.kernel.org/r/20251021100606.148294-3-david@redhat.com Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction") Signed-off-by: David Hildenbrand Reviewed-by: Ritesh Harjani (IBM) Cc: Christophe Leroy Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Signed-off-by: Andrew Morton commit fc6bcf9ac4de76f5e7bcd020b3c0a86faff3f2d5 Author: David Hildenbrand Date: Tue Oct 21 12:06:05 2025 +0200 powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION Patch series "powerpc/pseries/cmm: two smaller fixes". Two smaller fixes identified while doing a bigger rework. This patch (of 2): We always have to initialize the balloon_dev_info, even when compaction is not configured in: otherwise the containing list and the lock are left uninitialized. Likely not many such configs exist in practice, but let's CC stable to be sure. This was found by code inspection. Link: https://lkml.kernel.org/r/20251021100606.148294-1-david@redhat.com Link: https://lkml.kernel.org/r/20251021100606.148294-2-david@redhat.com Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction") Signed-off-by: David Hildenbrand Reviewed-by: Ritesh Harjani (IBM) Cc: Christophe Leroy Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Signed-off-by: Andrew Morton commit 94bf74830a977a027042f685c7231c5e07cc3372 Author: Claudiu Beznea Date: Tue Dec 9 14:51:22 2025 +0200 PCI: rzg3s-host: Initialize MSI status bitmap before use Initialize rzg3s_pcie_msi_irq() MSI status bitmap before use. Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202512070218.XVMUQCl7-lkp@intel.com Closes: https://lore.kernel.org/all/202512061812.Xbqmd2Gn-lkp@intel.com Signed-off-by: Claudiu Beznea Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251209125122.304129-1-claudiu.beznea.uj@bp.renesas.com commit 59e25ef2b413c72da6686d431e7759302cfccafa Author: Mohamed Khalfella Date: Fri Dec 5 13:17:02 2025 -0800 block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset. Initially a tagset starts as unshared and when the number of added queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along with all the queues attached to it. When the number of attached queues drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and the remaining queues as unshared. Both functions need to freeze current queues in tagset before setting on unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions hold set->tag_list_lock mutex, which makes sense as we do not want queues to be added or deleted in the process. This used to work fine until commit 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset") made the nvme driver quiesce tagset instead of quiscing individual queues. blk_mq_quiesce_tagset() does the job and quiesce the queues in set->tag_list while holding set->tag_list_lock also. This results in deadlock between two threads with these stacktraces: __schedule+0x47c/0xbb0 ? timerqueue_add+0x66/0xb0 schedule+0x1c/0xa0 schedule_preempt_disabled+0xa/0x10 __mutex_lock.constprop.0+0x271/0x600 blk_mq_quiesce_tagset+0x25/0xc0 nvme_dev_disable+0x9c/0x250 nvme_timeout+0x1fc/0x520 blk_mq_handle_expired+0x5c/0x90 bt_iter+0x7e/0x90 blk_mq_queue_tag_busy_iter+0x27e/0x550 ? __blk_mq_complete_request_remote+0x10/0x10 ? __blk_mq_complete_request_remote+0x10/0x10 ? __call_rcu_common.constprop.0+0x1c0/0x210 blk_mq_timeout_work+0x12d/0x170 process_one_work+0x12e/0x2d0 worker_thread+0x288/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 __schedule+0x47c/0xbb0 ? xas_find+0x161/0x1a0 schedule+0x1c/0xa0 blk_mq_freeze_queue_wait+0x3d/0x70 ? destroy_sched_domains_rcu+0x30/0x30 blk_mq_update_tag_set_shared+0x44/0x80 blk_mq_exit_queue+0x141/0x150 del_gendisk+0x25a/0x2d0 nvme_ns_remove+0xc9/0x170 nvme_remove_namespaces+0xc7/0x100 nvme_remove+0x62/0x150 pci_device_remove+0x23/0x60 device_release_driver_internal+0x159/0x200 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x112/0x1e0 vfs_write+0x2b1/0x3d0 ksys_write+0x4e/0xb0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 The top stacktrace is showing nvme_timeout() called to handle nvme command timeout. timeout handler is trying to disable the controller and as a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not to call queue callback handlers. The thread is stuck waiting for set->tag_list_lock as it tries to walk the queues in set->tag_list. The lock is held by the second thread in the bottom stack which is waiting for one of queues to be frozen. The queue usage counter will drop to zero after nvme_timeout() finishes, and this will not happen because the thread will wait for this mutex forever. Given that [un]quiescing queue is an operation that does not need to sleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking set->tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU safe list operations. Also, delete INIT_LIST_HEAD(&q->tag_set_list) in blk_mq_del_queue_tag_set() because we can not re-initialize it while the list is being traversed under RCU. The deleted queue will not be added/deleted to/from a tagset and it will be freed in blk_free_queue() after the end of RCU grace period. Signed-off-by: Mohamed Khalfella Fixes: 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset") Reviewed-by: Ming Lei Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit db339b4067eccb7fa3d9787d5d3ab5d466fd9efa Author: Caleb Sander Mateos Date: Mon Dec 8 20:14:23 2025 -0700 ublk: don't mutate struct bio_vec in iteration __bio_for_each_segment() uses the returned struct bio_vec's bv_len field to advance the struct bvec_iter at the end of each loop iteration. So it's incorrect to modify it during the loop. Don't assign to bv_len (or bv_offset, for that matter) in ublk_copy_user_pages(). Signed-off-by: Caleb Sander Mateos Fixes: e87d66ab27ac ("ublk: use rq_for_each_segment() for user copy") Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit cfdeb588ae1dff5d52da37d2797d0203e8605480 Author: Shida Zhang Date: Tue Dec 9 17:01:57 2025 +0800 block: prohibit calls to bio_chain_endio Now that all potential callers of bio_chain_endio have been eliminated, completely prohibit any future calls to this function. Suggested-by: Ming Lei Suggested-by: Andreas Gruenbacher Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Shida Zhang Signed-off-by: Jens Axboe commit 53280e398471f0bddbb17b798a63d41264651325 Author: Shida Zhang Date: Tue Dec 9 17:01:56 2025 +0800 bcache: fix improper use of bi_end_io Don't call bio->bi_end_io() directly. Use the bio_endio() helper function instead, which handles completion more safely and uniformly. Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Shida Zhang Signed-off-by: Jens Axboe commit 1c7f9e528f8f488b060b786bfb90b40540854db3 Author: Ard Biesheuvel Date: Fri Dec 5 12:35:01 2025 +0100 drm/i915: Fix format string truncation warning GCC notices that the 16-byte uabi_name field could theoretically be too small for the formatted string if the instance number exceeds 100. So grow the field to 20 bytes. drivers/gpu/drm/i915/intel_memory_region.c: In function ‘intel_memory_region_create’: drivers/gpu/drm/i915/intel_memory_region.c:273:61: error: ‘%u’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 11 [-Werror=format-truncation=] 273 | snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u", | ^~ drivers/gpu/drm/i915/intel_memory_region.c:273:58: note: directive argument in the range [0, 65535] 273 | snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u", | ^~~~~~ drivers/gpu/drm/i915/intel_memory_region.c:273:9: note: ‘snprintf’ output between 7 and 19 bytes into a destination of size 16 273 | snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 274 | intel_memory_type_str(type), instance); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 3b38d3515753 ("drm/i915: Add stable memory region names") Cc: # v6.8+ Signed-off-by: Ard Biesheuvel Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251205113500.684286-2-ardb@kernel.org (cherry picked from commit 18476087f1a18dc279d200d934ad94fba1fb51d5) Signed-off-by: Jani Nikula commit 460b31720369fc77c23301708641cfa1bf2fcb8f Author: Dibin Moolakadan Subrahmanian Date: Tue Nov 11 19:24:03 2025 +0530 drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation During fbdev probe, the xe driver allocates and pins a framebuffer BO (via xe_bo_create_pin_map_novm() → xe_ggtt_insert_bo()). Without a runtime PM reference, xe_pm_runtime_get_noresume() warns about missing outer PM protection as below: xe 0000:03:00.0: [drm] Missing outer runtime PM protection Acquire a runtime PM reference before framebuffer allocation to ensure xe_ggtt_insert_bo() executes under active runtime PM context. Changes in v2: - Update commit message to add Fixes tag (Jani Nikula) Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6350 Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Cc: Jani Nikula Signed-off-by: Dibin Moolakadan Subrahmanian Reviewed-by: Jouni Högander Signed-off-by: Ankit Nautiyal Link: https://patch.msgid.link/20251111135403.3415947-1-dibin.moolakadan.subrahmanian@intel.com (cherry picked from commit 37fc7b7b3ab0e3bb900657199cd3770a4fda03fb) Signed-off-by: Jani Nikula commit c418d8b4d7a43a86b82ee39cb52ece3034383530 Author: Thaumy Cheng Date: Tue Dec 9 12:16:00 2025 +0800 perf/core: Fix missing read event generation on task exit For events with inherit_stat enabled, a "read" event will be generated to collect per task event counts on task exit. The call chain is as follows: do_exit -> perf_event_exit_task -> perf_event_exit_task_context -> perf_event_exit_event -> perf_remove_from_context -> perf_child_detach -> sync_child_event -> perf_event_read_event However, the child event context detaches the task too early in perf_event_exit_task_context, which causes sync_child_event to never generate the read event in this case, since child_event->ctx->task is always set to TASK_TOMBSTONE. Fix that by moving context lock section backward to ensure ctx->task is not set to TASK_TOMBSTONE before generating the read event. Because perf_event_free_task calls perf_event_exit_task_context with exit = false to tear down all child events from the context, and the task never lived, accessing the task PID can lead to a use-after-free. To fix that, let sync_child_event read task from argument and move the call to the only place it should be triggered to avoid the effect of setting ctx->task to TASK_TOMESTONE, and add a task parameter to perf_event_exit_event to trigger the sync_child_event properly when needed. This bug can be reproduced by running "perf record -s" and attaching to any program that generates perf events in its child tasks. If we check the result with "perf report -T", the last line of the report will leave an empty table like "# PID TID", which is expected to contain the per-task event counts by design. Fixes: ef54c1a476ae ("perf: Rework perf_event_exit_event()") Signed-off-by: Thaumy Cheng Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: linux-perf-users@vger.kernel.org Link: https://patch.msgid.link/20251209041600.963586-1-thaumy.love@gmail.com commit 01439286514ce9d13b8123f8ec3717d7135ff1d6 Author: Sandipan Das Date: Tue Dec 9 13:56:38 2025 +0530 perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error If amd_uncore_event_init() fails, return an error irrespective of the pmu_version. Setting hwc->config should be safe even if there is an error so use this opportunity to simplify the code. Closes: https://lore.kernel.org/all/aTaI0ci3vZ44lmBn@stanley.mountain/ Fixes: d6389d3ccc13 ("perf/x86/amd/uncore: Refactor uncore management") Reported-by: Dan Carpenter Signed-off-by: Sandipan Das Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://patch.msgid.link/076935e23a70335d33bd6e23308b75ae0ad35ba2.1765268667.git.sandipan.das@amd.com commit a061deb0b4d56a9213bc05c1abe626fdd303ee52 Author: Richard Fitzgerald Date: Tue Dec 9 10:46:57 2025 +0000 ASoC: cs35l56: Fix incorrect select SND_SOC_CS35L56_CAL_SYSFS_COMMON KConfig SND_SOC_CS35L56_CAL_SET_CTRL must select SND_SOC_CS35L56_CAL_DEBUGFS_COMMON. It incorrectly selected SND_SOC_CS35L56_CAL_SYSFS_COMMON. Fixes: 32172cf3cb54 ("ASoC: cs35l56: Allow restoring factory calibration through ALSA control") Reported-by: Randy Dunlap Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/T/#u Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251209104657.485541-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit dea20281ac88226615761c570c8ff7adc18e6ac2 Author: Russell King (Oracle) Date: Tue Dec 9 08:35:57 2025 +0000 ARM: group is_permission_fault() with is_translation_fault() Group is_permission_fault() with is_translation_fault(), which is needed to use is_permission_fault() in __do_kernel_fault(). As this is static inline, there is no need for this to be under CONFIG_MMU. Signed-off-by: Russell King (Oracle) commit edb924a7211c9aa7a4a415e03caee4d875e46b8e Author: Liyuan Pang Date: Tue Dec 9 03:19:45 2025 +0100 ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() In the inline assembly inside load_unaligned_zeropad(), the "addr" is constrained as input-only operand. The compiler assumes that on exit from the asm statement these operands contain the same values as they had before executing the statement, but when kernel page fault happened, the assembly fixup code "bic %2 %2, #0x3" modify the value of "addr", which may lead to an unexpected behavior. Use a temporary variable "tmp" to handle it, instead of modifying the input-only operand, just like what arm64's load_unaligned_zeropad() does. Fixes: b9a50f74905a ("ARM: 7450/1: dcache: select DCACHE_WORD_ACCESS for little-endian ARMv6+ CPUs") Co-developed-by: Xie Yuanbin Signed-off-by: Xie Yuanbin Signed-off-by: Liyuan Pang Signed-off-by: Russell King (Oracle) commit 186468c67fc687650b7fb713d8c627d5c8566886 Merge: db6b35cffe59c6 ffb8c27b0539dd Author: Jakub Kicinski Date: Mon Dec 8 23:54:05 2025 -0800 Merge branch 'mptcp-misc-fixes-for-v6-19-rc1' Matthieu Baerts says: ==================== mptcp: misc fixes for v6.19-rc1 Here are various unrelated fixes: - Patches 1-2: ignore unknown in-kernel PM endpoint flags instead of pretending they are supported. A fix for v5.7. - Patch 3: avoid potential unnecessary rtx timer expiration. A fix for v5.15. - Patch 4: avoid a deadlock on fallback in case of SKB creation failure while re-injecting. ==================== Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-0-9e4781a6c1b8@kernel.org Signed-off-by: Jakub Kicinski commit ffb8c27b0539dd90262d1021488e7817fae57c42 Author: Paolo Abeni Date: Fri Dec 5 19:55:17 2025 +0100 mptcp: avoid deadlock on fallback while reinjecting Jakub reported an MPTCP deadlock at fallback time: WARNING: possible recursive locking detected 6.18.0-rc7-virtme #1 Not tainted -------------------------------------------- mptcp_connect/20858 is trying to acquire lock: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_try_fallback+0xd8/0x280 but task is already holding lock: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&msk->fallback_lock); lock(&msk->fallback_lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by mptcp_connect/20858: #0: ff1100001da18290 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x114/0x1bc0 #1: ff1100001db40fd0 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: __mptcp_retrans+0x2cb/0xaa0 #2: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0 stack backtrace: CPU: 0 UID: 0 PID: 20858 Comm: mptcp_connect Not tainted 6.18.0-rc7-virtme #1 PREEMPT(full) Hardware name: Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack_lvl+0x6f/0xa0 print_deadlock_bug.cold+0xc0/0xcd validate_chain+0x2ff/0x5f0 __lock_acquire+0x34c/0x740 lock_acquire.part.0+0xbc/0x260 _raw_spin_lock_bh+0x38/0x50 __mptcp_try_fallback+0xd8/0x280 mptcp_sendmsg_frag+0x16c2/0x3050 __mptcp_retrans+0x421/0xaa0 mptcp_release_cb+0x5aa/0xa70 release_sock+0xab/0x1d0 mptcp_sendmsg+0xd5b/0x1bc0 sock_write_iter+0x281/0x4d0 new_sync_write+0x3c5/0x6f0 vfs_write+0x65e/0xbb0 ksys_write+0x17e/0x200 do_syscall_64+0xbb/0xfd0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fa5627cbc5e Code: 4d 89 d8 e8 14 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa RSP: 002b:00007fff1fe14700 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa5627cbc5e RDX: 0000000000001f9c RSI: 00007fff1fe16984 RDI: 0000000000000005 RBP: 00007fff1fe14710 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff1fe16920 R13: 0000000000002000 R14: 0000000000001f9c R15: 0000000000001f9c The packet scheduler could attempt a reinjection after receiving an MP_FAIL and before the infinite map has been transmitted, causing a deadlock since MPTCP needs to do the reinjection atomically from WRT fallback. Address the issue explicitly avoiding the reinjection in the critical scenario. Note that this is the only fallback critical section that could potentially send packets and hit the double-lock. Reported-by: Jakub Kicinski Closes: https://netdev-ctrl.bots.linux.dev/logs/vmksft/mptcp-dbg/results/412720/1-mptcp-join-sh/stderr Fixes: f8a1d9b18c5e ("mptcp: make fallback action and fallback decision atomic") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-4-9e4781a6c1b8@kernel.org Signed-off-by: Jakub Kicinski commit 2ea6190f42d0416a4310e60a7fcb0b49fcbbd4fb Author: Paolo Abeni Date: Fri Dec 5 19:55:16 2025 +0100 mptcp: schedule rtx timer only after pushing data The MPTCP protocol usually schedule the retransmission timer only when there is some chances for such retransmissions to happen. With a notable exception: __mptcp_push_pending() currently schedule such timer unconditionally, potentially leading to unnecessary rtx timer expiration. The issue is present since the blamed commit below but become easily reproducible after commit 27b0e701d387 ("mptcp: drop bogus optimization in __mptcp_check_push()") Fixes: 33d41c9cd74c ("mptcp: more accurate timeout") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-3-9e4781a6c1b8@kernel.org Signed-off-by: Jakub Kicinski commit 29f4801e9c8dfd12bdcb33b61a6ac479c7162bd7 Author: Matthieu Baerts (NGI0) Date: Fri Dec 5 19:55:15 2025 +0100 selftests: mptcp: pm: ensure unknown flags are ignored This validates the previous commit: the userspace can set unknown flags -- the 7th bit is currently unused -- without errors, but only the supported ones are printed in the endpoints dumps. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-2-9e4781a6c1b8@kernel.org Signed-off-by: Jakub Kicinski commit 0ace3297a7301911e52d8195cb1006414897c859 Author: Matthieu Baerts (NGI0) Date: Fri Dec 5 19:55:14 2025 +0100 mptcp: pm: ignore unknown endpoint flags Before this patch, the kernel was saving any flags set by the userspace, even unknown ones. This doesn't cause critical issues because the kernel is only looking at specific ones. But on the other hand, endpoints dumps could tell the userspace some recent flags seem to be supported on older kernel versions. Instead, ignore all unknown flags when parsing them. By doing that, the userspace can continue to set unsupported flags, but it has a way to verify what is supported by the kernel. Note that it sounds better to continue accepting unsupported flags not to change the behaviour, but also that eases things on the userspace side by adding "optional" endpoint types only supported by newer kernel versions without having to deal with the different kernel versions. A note for the backports: there will be conflicts in mptcp.h on older versions not having the mentioned flags, the new line should still be added last, and the '5' needs to be adapted to have the same value as the last entry. Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-1-9e4781a6c1b8@kernel.org Signed-off-by: Jakub Kicinski commit db6b35cffe59c619ea3772b21d7c7c8a7b885dc1 Author: Jakub Kicinski Date: Sat Dec 6 17:38:48 2025 -0800 tools: ynl: fix build on systems with old kernel headers The wireguard YNL conversion was missing the customary .deps entry. NIPA doesn't catch this but my CentOS 9 system complains: wireguard-user.c:72:10: error: ‘WGALLOWEDIP_A_FLAGS’ undeclared here wireguard-user.c:58:67: error: parameter 1 (‘value’) has incomplete type 58 | const char *wireguard_wgallowedip_flags_str(enum wgallowedip_flag value) | ~~~~~~~~~~~~~~~~~~~~~~^~~~~ And similarly does Ubuntu 22.04. One extra complication here is that we renamed the header guard, so we need to compat with both old and new guard define. Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20251207013848.1692990-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e56cadaa27fd156106c5583ed98976927c6febc9 Author: Jakub Kicinski Date: Sat Dec 6 16:47:40 2025 -0800 ynl: add regen hint to new headers Recent commit 68e83f347266 ("tools: ynl-gen: add regeneration comment") added a hint how to regenerate the code to the headers. Update the new headers from this release cycle to also include it. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251207004740.1657799-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e9e5047df953c9b1054d9a3c7b07c68ab2714263 Author: Eric Biggers Date: Wed Dec 3 21:44:17 2025 -0800 mptcp: select CRYPTO_LIB_UTILS instead of CRYPTO Since the only crypto functions used by the mptcp code are the SHA-256 library functions and crypto_memneq(), select only the options needed for those: CRYPTO_LIB_SHA256 and CRYPTO_LIB_UTILS. Previously, CRYPTO was selected instead of CRYPTO_LIB_UTILS. That does pull in CRYPTO_LIB_UTILS as well, but it's unnecessarily broad. Years ago, the CRYPTO_LIB_* options were visible only when CRYPTO. That may be another reason why CRYPTO is selected here. However, that was fixed years ago, and the libraries can now be selected directly. Signed-off-by: Eric Biggers Reviewed-by: Mat Martineau Link: https://patch.msgid.link/20251204054417.491439-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 2183a5c8a04f554d03174ddcfd0078b44217fa54 Author: Mateusz Guzik Date: Wed Dec 3 11:01:22 2025 +0100 af_unix: annotate unix_gc_lock with __cacheline_aligned_in_smp Otherwise the lock is susceptible to ever-changing false-sharing due to unrelated changes. This in particular popped up here where an unrelated change improved performance: https://lore.kernel.org/oe-lkp/202511281306.51105b46-lkp@intel.com/ Stabilize it with an explicit annotation which also has a side effect of furher improving scalability: > in our oiginal report, 284922f4c5 has a 6.1% performance improvement comparing > to parent 17d85f33a8. > we applied your patch directly upon 284922f4c5. as below, now by > "284922f4c5 + your patch" > we observe a 12.8% performance improvements (still comparing to 17d85f33a8). Note nothing was done for the other fields, so some fluctuation is still possible. Tested-by: kernel test robot Signed-off-by: Mateusz Guzik Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251203100122.291550-1-mjguzik@gmail.com Signed-off-by: Jakub Kicinski commit 3d99347a2e1ae60d9368b1d734290bab1acde0ce Merge: cb015814f8b6ee d8f52650b24d90 Author: Linus Torvalds Date: Tue Dec 9 16:09:32 2025 +0900 Merge tag 'v6.19-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - multichannel fixes, including enabling ability to change multichannel settings with remount - debugging improvements: adding additional tracepoints, improving log messages - cleanup, including restructuring some of the transport layer for the client to make it clearer, and cleanup of status code table to be more consistent with protocol documentation - fixes for reads that start beyond end of file use cases - fix to backoff reconnects to reduce reconnect storms - locking improvement for getting mid entries - fixes for missing status code error mappings - performance improvement for status code to error mappings * tag 'v6.19-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (22 commits) smb/client: update some SMB2 status strings cifs: Remove dead function prototypes smb/client: add two elements to smb2_error_map_table array smb: rename to STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP smb/client: remove unused elements from smb2_error_map_table array smb/client: reduce loop count in map_smb2_to_linux_error() by half smb: client: Add tracepoint for krb5 auth smb: client: improve error message when creating SMB session smb: client: relax session and tcon reconnect attempts cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 cifs: client: allow changing multichannel mount options on remount cifs: Do some preparation prior to organising the function declarations cifs: Add a tracepoint to log EIO errors cifs: Don't need state locking in smb2_get_mid_entry() cifs: Remove the server pointer from smb_message cifs: Fix specification of function pointers cifs: Replace SendReceiveBlockingLock() with SendReceive() plus flags cifs: Clean up some places where an extra kvec[] was required for rfc1002 cifs: Make smb1's SendReceive() wrap cifs_send_recv() cifs: Remove the RFC1002 header from smb_hdr ... commit 298e753880b6ea99ac30df34959a7a03b0878eed Author: Junrui Luo Date: Tue Dec 9 13:16:41 2025 +0800 ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event handling code, a put_user() loop copies event data. When the user buffer size is not aligned to 4 bytes, it could overwrite beyond the buffer boundary. Fix by adding a bounds check before put_user(). Suggested-by: Takashi Iwai Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB788112C72AF8A1C8C448B4B8AFA3A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Takashi Iwai commit ea513dd3c066074b12e788114b45e0f2bda382cc Author: Bartosz Golaszewski Date: Sat Dec 6 12:53:56 2025 +0100 gpio: shared: make locking more fine-grained The global gpio_shared_lock has caused some issues when recursively removing GPIO shared proxies. The thing is: we don't really need it. Once created from an init-call, the shared GPIO data structures are never removed, there's no need to protect the linked lists of entries and references. All we need to protect is the shared GPIO descriptor (which we already do with a per-entry mutex) and the auxiliary device data in struct gpio_shared_ref. Remove the global gpio_shared_lock and use a per-reference mutex to protect shared references when adding/removing the auxiliary devices and their GPIO lookup entries. Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-4-35ac458cfce1@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit d382c765d083ad871b4a053059351edd348a2442 Author: Bartosz Golaszewski Date: Sat Dec 6 12:53:55 2025 +0100 gpio: shared: fix auxiliary device cleanup order Dropping the last reference to the internal struct device should be the last thing we do so delete the device first and then uninit it which also involves the final put_device(). Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-3-35ac458cfce1@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit c904a0d8525d5f03529ae3176e99bd32466ece7b Author: Bartosz Golaszewski Date: Sat Dec 6 12:53:54 2025 +0100 gpio: shared: check if a reference is populated before cleaning its resources It's possible that not all proxy entries will be set up when the device gets removed so check if they are before trying to dereference members which are still NULL. This can happen if some consumers never requested their shared GPIOs. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-2-35ac458cfce1@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit e2c4175b8d3b3ea65fc3801c190bd93fe8b7a7a9 Author: Bartosz Golaszewski Date: Sat Dec 6 12:53:53 2025 +0100 gpio: shared: fix NULL-pointer dereference in teardown path We need to actually store the address of the GPIO lookup table in the reference struct before we try to free it or - worse - dereference its members. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251206-gpio-shared-teardown-fixes-v1-1-35ac458cfce1@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 9e7a40a2841483d7bf51b8d9a5e1f0633a5c7a26 Author: Bartosz Golaszewski Date: Wed Dec 3 10:23:09 2025 +0100 gpio: shared: ignore disabled nodes when traversing the device-tree Don't consider disabled devices when traversing the device-tree looking for shared GPIOs. Even if they do share a phandle to a pin, they can never be instantiated and request it. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Link: https://lore.kernel.org/r/20251203092309.34737-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 313ef70a9f0f637a09d9ef45222f5bdcf30a354b Author: Qu Wenruo Date: Tue Nov 25 18:49:56 2025 +1030 btrfs: fix a potential path leak in print_data_reloc_error() Inside print_data_reloc_error(), if extent_from_logical() failed we return immediately. However there are the following cases where extent_from_logical() can return error but still holds a path: - btrfs_search_slot() returned 0 - No backref item found in extent tree - No flags_ret provided This is not possible in this call site though. So for the above two cases, we can return without releasing the path, causing extent buffer leaks. Fixes: b9a9a85059cd ("btrfs: output affected files when relocation fails") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b0ff70e9d4fe46cece25eb97b9b9b0166624af95 Author: Eric Naim Date: Sun Dec 7 03:38:12 2025 +0800 ASoC: cs35l41: Always return 0 when a subsystem ID is found When trying to get the system name in the _HID path, after successfully retrieving the subsystem ID the return value isn't set to 0 but instead still kept at -ENODATA, leading to a false negative: [ 12.382507] cs35l41 spi-VLV1776:00: Subsystem ID: VLV1776 [ 12.382521] cs35l41 spi-VLV1776:00: probe with driver cs35l41 failed with error -61 Always return 0 when a subsystem ID is found to mitigate these false negatives. Link: https://github.com/CachyOS/CachyOS-Handheld/issues/83 Fixes: 46c8b4d2a693 ("ASoC: cs35l41: Fallback to reading Subsystem ID property if not ACPI") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Eric Naim Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20251206193813.56955-1-dnaim@cachyos.org Signed-off-by: Mark Brown commit 428e1b114c1ae94c44f0ae3a15dafcfae4d8a0b4 Author: Qu Wenruo Date: Mon Dec 8 19:55:48 2025 +1030 Revert "btrfs: add ASSERTs on prealloc in qgroup functions" This reverts commit 252877a8701530fde861a4f27710c1e718e97caa. Commit 252877a87015 ("btrfs: add ASSERTs on prealloc in qgroup functions") tries to remove the kfree() on preallocated qgroup during several call sites, but this cannot work as intended: - btrfs_quota_enable() - btrfs_create_qgroup() If add_qgroup_item() failed, we go out_free_path() and at that time prealloc is not yet utilized and will trigger the new ASSERT(). - btrfs_qgroup_inherit() If qgroup_auto_inherit() failed, prealloc is not yet utilized and will trigger the new ASSERT() Reported-by: syzbot+b44d4a4885bc82af2a06@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/69369331.a70a0220.38f243.009e.GAE@google.com/ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 946574434aa9cfe175c3e8234734a3822410ff53 Author: Krzysztof Kozlowski Date: Mon Dec 8 03:08:08 2025 +0100 scsi: ufs: qcom: Fix confusing cleanup.h syntax Initializing automatic __free variables to NULL without need (e.g. branches with different allocations), followed by actual allocation is in contrary to explicit coding rules guiding cleanup.h: "Given that the "__free(...) = NULL" pattern for variables defined at the top of the function poses this potential interdependency problem the recommendation is to always define and assign variables in one statement and not group variable definitions at the top of the function when __free() is used." Code does not have a bug, but is less readable and uses discouraged coding practice, so fix that by moving declaration to the place of assignment. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251208020807.5043-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Martin K. Petersen commit 362432e9b9aefb914ab7d9f86c9fc384a6620c41 Author: Chaohai Chen Date: Sat Dec 6 14:06:16 2025 +0800 scsi: libsas: Add rollback handling when an error occurs In sas_register_phys(), if an error is triggered in the loop process, we need to roll back the resources that have already been requested. Add sas_unregister_phys() when an error occurs in sas_register_ha(). [mkp: a few coding style tweaks and address John's comment] Signed-off-by: Chaohai Chen Reviewed-by: John Garry Link: https://patch.msgid.link/20251206060616.69216-1-wdhh6@aliyun.com Signed-off-by: Martin K. Petersen commit cb015814f8b6eebcbb8e46e111d108892c5e6821 Merge: cfd4039213e7b5 76ee7fd6af6851 Author: Linus Torvalds Date: Tue Dec 9 12:06:20 2025 +0900 Merge tag 'f2fs-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "This series focuses on minor clean-ups and performance optimizations across sysfs, documentation, debugfs, tracepoints, slab allocation, and GC. Furthermore, it resolves several corner-case bugs caught by xfstests, as well as issues related to 16KB page support and f2fs_enable_checkpoint. Enhancement: - wrap ASCII tables in literal blocks to fix LaTeX build - optimize trace_f2fs_write_checkpoint with enums - support to show curseg.next_blkoff in debugfs - add a sysfs entry to show max open zones - add fadvise tracepoint - use global inline_xattr_slab instead of per-sb slab cache - set default valid_thresh_ratio to 80 for zoned devices - maintain one time GC mode is enabled during whole zoned GC cycle Bug fix: - ensure node page reads complete before f2fs_put_super() finishes - do not account invalid blocks in get_left_section_blocks() - revert summary entry count from 2048 to 512 in 16kb block support - detect recoverable inode during dryrun of find_fsync_dnodes() - fix age extent cache insertion skip on counter overflow - add sanity checks before unlinking and loading inodes - ensure minimum trim granularity accounts for all devices - block cache/dio write during f2fs_enable_checkpoint() - propagate error from f2fs_enable_checkpoint() - invalidate dentry cache on failed whiteout creation - avoid updating compression context during writeback - avoid updating zero-sized extent in extent cache - avoid potential deadlock" * tag 'f2fs-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (39 commits) f2fs: ignore discard return value f2fs: optimize trace_f2fs_write_checkpoint with enums f2fs: fix to not account invalid blocks in get_left_section_blocks() f2fs: support to show curseg.next_blkoff in debugfs docs: f2fs: wrap ASCII tables in literal blocks to fix LaTeX build f2fs: expand scalability of f2fs mount option f2fs: change default schedule timeout value f2fs: introduce f2fs_schedule_timeout() f2fs: use memalloc_retry_wait() as much as possible f2fs: add a sysfs entry to show max open zones f2fs: wrap all unusable_blocks_per_sec code in CONFIG_BLK_DEV_ZONED f2fs: simplify list initialization in f2fs_recover_fsync_data() f2fs: revert summary entry count from 2048 to 512 in 16kb block support f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() f2fs: fix return value of f2fs_recover_fsync_data() f2fs: add fadvise tracepoint f2fs: fix age extent cache insertion skip on counter overflow f2fs: Add sanity checks before unlinking and loading inodes f2fs: Rename f2fs_unlink exit label f2fs: ensure minimum trim granularity accounts for all devices ... commit fd81bc5cca8fc6936a8988de6b5d4c5693b6587e Author: Benjamin Marzinski Date: Fri Dec 5 20:00:15 2025 -0500 scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name() If scsi_dh_attached_handler_name() fails to allocate the handler name, dm-multipath (its only caller) assumes there is no attached device handler, and sets the device up incorrectly. Return an error pointer instead, so multipath can distinguish between failure, success where there is no attached device handler, or when the path device is not a SCSI device at all. Signed-off-by: Benjamin Marzinski Reviewed-by: Martin Wilck Link: https://patch.msgid.link/20251206010015.1595225-1-bmarzins@redhat.com Signed-off-by: Martin K. Petersen commit d2875b812b141d0c449541976d92c8d89b94ec72 Author: Bart Van Assche Date: Thu Dec 4 08:15:43 2025 -1000 scsi: ufs: core: Fix a deadlock in the frequency scaling code Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") accidentally introduced a deadlock in the frequency scaling code. ufshcd_clock_scaling_unprepare() may submit a device management command while SCSI command processing is blocked. The deadlock was introduced by using the SCSI core for submitting device management commands (scsi_get_internal_cmd() + blk_execute_rq()). Fix this deadlock by calling blk_mq_unquiesce_tagset() before any device management commands are submitted by ufshcd_clock_scaling_unprepare(). Fixes: 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") Reported-by: Manivannan Sadhasivam Reported-by: Roger Shimizu Closes: https://lore.kernel.org/linux-scsi/ehorjaflathzab5oekx2nae2zss5vi2r36yqkqsfjb2fgsifz2@yk3us5g3igow/ Tested-by: Roger Shimizu Cc: Nitin Rawat Signed-off-by: Bart Van Assche Reviewed-by: Peter Wang Reviewed-by: Nitin Rawat Tested-by: Alexey Klimov # RB5 board Link: https://patch.msgid.link/20251204181548.1006696-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 14be351e5cd07349377010e457a58fac99201832 Author: Bart Van Assche Date: Thu Dec 4 07:04:52 2025 -1000 scsi: ufs: core: Fix an error handler crash The UFS error handler may be activated before SCSI scanning has started and hence before hba->ufs_device_wlun has been set. Check the hba->ufs_device_wlun pointer before using it. Cc: Peter Wang Cc: Nitin Rawat Fixes: e23ef4f22db3 ("scsi: ufs: core: Fix error handler host_sem issue") Fixes: f966e02ae521 ("scsi: ufs: core: Fix runtime suspend error deadlock") Signed-off-by: Bart Van Assche Reviewed-by: Peter Wang Reviewed-by: Nitin Rawat Tested-by: Nitin Rawat #SM8750 Link: https://patch.msgid.link/20251204170457.994851-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 429c4727011ead99129b14dc9ff4c87a747a50ab Merge: ae8966b7b5bd69 70f62e52176df0 Author: Dmitry Torokhov Date: Mon Dec 8 17:52:57 2025 -0800 Merge branch 'next' into for-linus Prepare input updates for 6.19 merge window. commit 8cef9b451dc6fdf86b92c7a35d55a47465d500db Author: Christophe JAILLET Date: Fri Dec 5 22:14:10 2025 +0100 spi: microchip-core: Fix an error handling path in mchp_corespi_probe() mchp_corespi_init() calls mchp_corespi_enable_ints(), so mchp_corespi_disable_ints() should be called if an error occurs after calling mchp_corespi_init(), as already done in the remove function. Fixes: 059f545832be ("spi: add support for microchip "soft" spi controller") Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/a7aaff1f28a83303a288de2914724a874fe1a11e.1764969247.git.christophe.jaillet@wanadoo.fr Acked-by: Conor Dooley Signed-off-by: Mark Brown commit 99f0c3a654c4a762aca4fadc8d9f8636b36d570a Author: Javier Martinez Canillas Date: Sat Dec 6 14:38:48 2025 +0100 regulator: spacemit: Align input supply name with the DT binding The Device Tree binding schema for the SpacemiT P1 PMIC defines the main input supply property as "vin-supply", but the driver defines the supply name for BUCK and ALDO regulators as "vcc". This causes the regulator core to lookup for a non-existent "vcc-supply". Rename the supply from "vcc" to "vin", to match the DT binding and ensure that the regulators input supplies are correctly resolved. After this change, the regulators supply hierarchy is correctly reported: $ cat /sys/kernel/debug/regulator/regulator_summary regulator use open bypass opmode voltage current min max --------------------------------------------------------------------------------------- regulator-dummy 1 0 0 unknown 0mV 0mA 0mV 0mV dc_in_12v 2 1 0 unknown 12000mV 0mA 12000mV 12000mV vcc_4v 7 10 0 unknown 4000mV 0mA 4000mV 4000mV buck1 1 0 0 unknown 1050mV 0mA 500mV 3425mV buck2 1 0 0 unknown 900mV 0mA 500mV 3425mV buck3 1 0 0 unknown 1800mV 0mA 500mV 1800mV buck4 1 0 0 unknown 3300mV 0mA 500mV 3300mV buck5 3 7 0 unknown 2100mV 0mA 500mV 3425mV dldo1 0 0 0 unknown 1200mV 0mA 500mV 3125mV dldo2 0 0 0 unknown 500mV 0mA 500mV 3125mV dldo3 0 0 0 unknown 500mV 0mA 500mV 3125mV dldo4 1 0 0 unknown 1800mV 0mA 500mV 3125mV dldo5 0 0 0 unknown 500mV 0mA 500mV 3125mV dldo6 1 0 0 unknown 1800mV 0mA 500mV 3125mV dldo7 0 0 0 unknown 500mV 0mA 500mV 3125mV buck6 1 0 0 unknown 1100mV 0mA 500mV 3425mV aldo1 0 0 0 unknown 1800mV 0mA 500mV 3125mV aldo2 0 0 0 unknown 500mV 0mA 500mV 3125mV aldo3 0 0 0 unknown 500mV 0mA 500mV 3125mV aldo4 0 0 0 unknown 500mV 0mA 500mV 3125mV Fixes: 8b84d712ad84 ("regulator: spacemit: support SpacemiT P1 regulators") Signed-off-by: Javier Martinez Canillas Link: https://patch.msgid.link/20251206133852.1739475-1-javierm@redhat.com Signed-off-by: Mark Brown commit cfd4039213e7b5a828c5b78e1b5235cac91af53d Merge: 4482ebb2970efa 55d57b3bcc7efc Author: Linus Torvalds Date: Tue Dec 9 09:07:28 2025 +0900 Merge tag 'io_uring-6.19-20251208' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: "Followup set of fixes for io_uring for this merge window. These are either later fixes, or cleanups that don't make sense to defer. This pull request contains: - Fix for a recent regression in io-wq worker creation - Tracing cleanup - Use READ_ONCE/WRITE_ONCE consistently for ring mapped kbufs. Mostly for documentation purposes, indicating that they are shared with userspace - Fix for POLL_ADD losing a completion, if the request is updated and now is triggerable - eg, if POLLIN is set with the updated, and the polled file is readable - In conjunction with the above fix, also unify how poll wait queue entries are deleted with the head update. We had 3 different spots doing both the list deletion and head write, with one of them nicely documented. Abstract that into a helper and use it consistently - Small series from Joanne fixing an issue with buffer cloning, and cleaning up the arg validation" * tag 'io_uring-6.19-20251208' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/poll: unify poll waitqueue entry and list removal io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields io_uring/kbuf: use READ_ONCE() for userspace-mapped memory io_uring/rsrc: fix lost entries after cloned range io_uring/rsrc: rename misleading src_node variable in io_clone_buffers() io_uring/rsrc: clean up buffer cloning arg validation io_uring/trace: rename io_uring_queue_async_work event "rw" field io_uring/io-wq: always retry worker create on ERESTART* io_uring/poll: correctly handle io_poll_add() return value on update commit 4482ebb2970efa58173075c101426b2f3af40b41 Merge: 70e3083ec68610 0f45353dd48037 Author: Linus Torvalds Date: Tue Dec 9 08:53:24 2025 +0900 Merge tag 'block-6.19-20251208' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block updates from Jens Axboe: "Followup set of fixes and updates for block for the 6.19 merge window. NVMe had some late minute debates which lead to dropping some patches from that tree, which is why the initial PR didn't have NVMe included. It's here now. This pull request contains: - NVMe pull request via Keith: - Subsystem usage cleanups (Max) - Endpoint device fixes (Shin'ichiro) - Debug statements (Gerd) - FC fabrics cleanups and fixes (Daniel) - Consistent alloc API usages (Israel) - Code comment updates (Chu) - Authentication retry fix (Justin) - Fix a memory leak in the discard ioctl code, if the task is being interrupted by a signal at just the wrong time - Zoned write plugging fixes - Add ioctls for for persistent reservations - Enable per-cpu bio caching by default - Various little fixes and tweaks" * tag 'block-6.19-20251208' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (27 commits) nvme-fabrics: add ENOKEY to no retry criteria for authentication failures nvme-auth: use kvfree() for memory allocated with kvcalloc() nvmet-tcp: use kvcalloc for commands array nvmet-rdma: use kvcalloc for commands and responses arrays nvme: fix typo error in nvme target nvmet-fc: use pr_* print macros instead of dev_* nvmet-fcloop: remove unused lsdir member. nvmet-fcloop: check all request and response have been processed nvme-fc: check all request and response have been processed block: fix memory leak in __blkdev_issue_zero_pages block: fix comment for op_is_zone_mgmt() to include RESET_ALL block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs blk-mq: Abort suspend when wakeup events are pending blk-mq: add blk_rq_nr_bvec() helper block: add IOC_PR_READ_RESERVATION ioctl block: add IOC_PR_READ_KEYS ioctl nvme: reject invalid pr_read_keys() num_keys values scsi: sd: reject invalid pr_read_keys() num_keys values block: enable per-cpu bio cache by default block: use bio_alloc_bioset for passthru IO by default ... commit 70e3083ec686100682c146346efc2b3780d717df Merge: b88b2f82fab455 0695aef23d6748 Author: Linus Torvalds Date: Tue Dec 9 08:50:27 2025 +0900 Merge tag 'ubifs-for-linus-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI and UBIFS updates from Richard Weinberger: "UBIFS: - Misc code cleanups such as removal of unnecessary variables UBI: - No longer program unused bit in UBI headers" * tag 'ubifs-for-linus-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: vmalloc(array_size()) -> vmalloc_array() ubi: fastmap: fix ubi->fm memory leak mtd: ubi: skip programming unused bits in ubi headers ubifs: Remove unnecessary variable assignments ubifs: Simplify the code using ubifs_crc_node ubifs: Remove unnecessary parameters '*c' commit b88b2f82fab45521cb32c0b737266d90a66a748f Merge: a110f942672c89 08bfcf4ff9d392 Author: Linus Torvalds Date: Tue Dec 9 08:46:10 2025 +0900 Merge tag 'hwmon-for-v6.19-take-2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes Guenter Roeck: - Documentation: Fix link to g762 devicetree binding - emc2305: Fix devicetree refcount leak and double put - dell-smm: Fix channel-index off-by-one error - w83791d: Convert macros to functions to avoid TOCTOU * tag 'hwmon-for-v6.19-take-2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: docs: hwmon: fix link to g762 devicetree binding hwmon: (emc2305) fix device node refcount leak in error path hwmon: (emc2305) fix double put in emc2305_probe_childs_from_dt hwmon: (dell-smm) Fix off-by-one error in dell_smm_is_visible() hwmon: (w83791d) Convert macros to functions to avoid TOCTOU commit 4ecc26fa585216f98d71411ce182f9e823d94c8c Author: H. Peter Anvin Date: Sat Jul 19 23:47:22 2025 -0700 tools/virtio: replace "__auto_type" with "auto" Replace one instance of "__auto_type" with "auto" in: tools/virtio/linux/compiler.h This file *does* include directly, so there is no need to duplicate the definition. Signed-off-by: H. Peter Anvin (Intel) commit c278d72b99ca92e4227bda70ded38e7e7a3625f8 Author: H. Peter Anvin Date: Sat Jul 19 23:46:29 2025 -0700 selftests/bpf: replace "__auto_type" with "auto" Replace instances of "__auto_type" with "auto" in: tools/testing/selftests/bpf/prog_tests/socket_helpers.h This file does not seem to be including directly or indirectly, so copy the definition but guard it with !defined(auto). Acked-by: Eduard Zingerman Signed-off-by: H. Peter Anvin (Intel) commit 2a5b286bee941c4b8ed359de82398a1a3a19b7db Author: H. Peter Anvin Date: Sat Jul 19 23:43:55 2025 -0700 arch/x86: replace "__auto_type" with "auto" Replace instances of "__auto_type" with "auto" in: arch/x86/include/asm/bug.h arch/x86/include/asm/string_64.h arch/x86/include/asm/uaccess_64.h Signed-off-by: H. Peter Anvin (Intel) commit add9b1be777d2a4a62933b703de5bb1bd1926e85 Author: H. Peter Anvin Date: Sat Jul 19 23:45:04 2025 -0700 arch/nios2: replace "__auto_type" and adjacent equivalent with "auto" Replace uses of "__auto_type" in arch/nios2/include/asm/uaccess.h with "auto", and equivalently convert an adjacent cast to the analogous form. Acked-by: Dinh Nguyen Signed-off-by: H. Peter Anvin (Intel) commit 75beb7effa0495ae6ef6481ed507d2b9ba4abb20 Author: H. Peter Anvin Date: Sat Jul 19 23:54:10 2025 -0700 fs/proc: replace "__auto_type" with "const auto" Replace use of "__auto_type" in fs/proc/inode.c with "const auto". Suggested-by: Alexey Dobriyan Signed-off-by: H. Peter Anvin (Intel) Reviewed-by: Alexey Dobriyan commit b3b8767c290102a8d95b9d12585cc1e03381ce3f Author: H. Peter Anvin Date: Sat Jul 19 23:36:58 2025 -0700 include/linux: change "__auto_type" to "auto" Replace instances of "__auto_type" with "auto" in include/linux. Signed-off-by: H. Peter Anvin (Intel) commit 2fb6915fa22dc5524d704afba58a13305dd9f533 Author: H. Peter Anvin Date: Fri Jul 18 11:35:00 2025 -0700 compiler_types.h: add "auto" as a macro for "__auto_type" "auto" was defined as a keyword back in the K&R days, but as a storage type specifier. No one ever used it, since it was and is the default storage type for local variables. C++11 recycled the keyword to allow a type to be declared based on the type of an initializer. This was finally adopted into standard C in C23. gcc and clang provide the "__auto_type" alias keyword as an extension for pre-C23, however, there is no reason to pollute the bulk of the source base with this temporary keyword; instead define "auto" as a macro unless the compiler is running in C23+ mode. This macro is added in because that header is included in some of the tools headers, wheres is not as it has a bunch of very kernel-specific things in it. [ Cc: stable to reduce potential backporting burden. ] Signed-off-by: H. Peter Anvin (Intel) Acked-by: Miguel Ojeda Cc: commit 2e1da460916626fedbbc8518b9c4e1b064f201ed Author: Ivan Lipski Date: Fri Nov 7 16:50:37 2025 -0500 drm/amd/display: Improve HDMI info retrieval [WHY & HOW] Make a dedicated function to read HDMI-related monitor info, including monitor's SCDC support. Fixes: 3471b9a31ce3 ("drm/amd/display: Rework HDMI data channel reads") Suggested-by: Fangzhi Zuo Reviewed-by: Jerry Zuo Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit c78e31bcf586f1c910a2636650840f5ce1cb1c63) commit 9aeed9041929812a10a6d693af050846942a1d16 Author: Sam James Date: Fri Dec 5 08:14:57 2025 +0000 alpha: don't reference obsolete termio struct for TC* constants Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42 drops the legacy termio struct, but the ioctls.h header still defines some TC* constants in terms of termio (via sizeof). Hardcode the values instead. This fixes building Python for example, which falls over like: ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio' Link: https://bugs.gentoo.org/961769 Link: https://bugs.gentoo.org/962600 Signed-off-by: Sam James Reviewed-by: Magnus Lindholm Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org Signed-off-by: Magnus Lindholm commit 3cec82b4fc6a1025d4b9cfb74fbca8a363bb5cbe Author: Thomas Huth Date: Fri Nov 21 11:00:36 2025 +0100 alpha: Replace __ASSEMBLY__ with __ASSEMBLER__ in the alpha headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Richard Henderson Cc: Matt Turner Cc: linux-alpha@vger.kernel.org Signed-off-by: Thomas Huth Reviewed-by: Magnus Lindholm Link: https://lore.kernel.org/r/20251121100044.282684-2-thuth@redhat.com Signed-off-by: Magnus Lindholm commit 16bd954c93360145bc77cc601e350913fc28182d Author: Troy Mitchell Date: Tue Nov 18 14:08:06 2025 +0800 rtc: spacemit: MFD_SPACEMIT_P1 as dependencies RTC_DRV_SPACEMIT_P1 is a subdevice of P1 and should depend on MFD_SPACEMIT_P1 rather than selecting it directly. Using 'select' does not always respect the parent's dependencies, so 'depends on' is the safer and more correct choice. Additionally, the default value depends on MFD_SPACEMIT_P1 rather than ARCH_SPACEMIT. Signed-off-by: Troy Mitchell Acked-by: Alex Elder Link: https://patch.msgid.link/20251118-p1-kconfig-fix-v3-2-8839c5ac5db3@linux.spacemit.com Signed-off-by: Alexandre Belloni commit 159a740c768e4e8fe3c63d20055bf54de29c0c02 Author: Dan Carpenter Date: Tue Nov 18 13:48:56 2025 +0300 rtc: atcrtc100: Fix signedness bug in probe() The "atcrtc_dev->alarm_irq" variable is an unsigned int but it needs to be signed for the error handling to work. Use the "ret" variable instead. Fixes: 7adca706fe16 ("rtc: atcrtc100: Add ATCRTC100 RTC driver") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aRxPGBEX8hbY6sjV@stanley.mountain Signed-off-by: Alexandre Belloni commit f07640f9fb8df2158199da1da1f8282948385a84 Author: Nuno Sá Date: Fri Nov 28 16:36:38 2025 +0000 rtc: max31335: Fix ignored return value in set_alarm Return the result from regmap_update_bits() instead of ignoring it and always returning 0. Fixes: dedaf03b99d6 ("rtc: max31335: add driver support") Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20251128-max31335-handler-error-v1-1-6b6f7f78dbda@analog.com Signed-off-by: Alexandre Belloni commit a585c7ef9cabda58088916baedc6573e9a5cd2a7 Author: Kory Maincent (TI.com) Date: Tue Nov 25 10:05:44 2025 +0100 drm/tilcdc: Fix removal actions in case of failed probe The drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers should only be called when the device has been successfully registered. Currently, these functions are called unconditionally in tilcdc_fini(), which causes warnings during probe deferral scenarios. [ 7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68 ... [ 8.005820] drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108 [ 8.005858] drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8 [ 8.005885] drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144 [ 8.005911] drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc] [ 8.005957] tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc] Fix this by rewriting the failed probe cleanup path using the standard goto error handling pattern, which ensures that cleanup functions are only called on successfully initialized resources. Additionally, remove the now-unnecessary is_registered flag. Cc: stable@vger.kernel.org Fixes: 3c4babae3c4a ("drm: Call drm_atomic_helper_shutdown() at shutdown/remove time for misc drivers") Signed-off-by: Kory Maincent (TI.com) Reviewed-by: Douglas Anderson Reviewed-by: Luca Ceresoli Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251125090546.137193-1-kory.maincent@bootlin.com commit d1220e47e4bd2be8b84bc158f4dea44f2f88b226 Author: Haotian Zhang Date: Wed Nov 26 16:06:25 2025 +0800 rtc: gamecube: Check the return value of ioremap() The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail and return NULL, which is dereferenced without checking, leading to a NULL pointer dereference. Add a check for the return value of ioremap() and return -ENOMEM on failure. Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U") Signed-off-by: Haotian Zhang Reviewed-by: Link Mauve Link: https://patch.msgid.link/20251126080625.1752-1-vulab@iscas.ac.cn Signed-off-by: Alexandre Belloni commit a110f942672c8995dc1cacb5a44c6730856743aa Merge: 990fa99821b334 666065caa31aeb Author: Linus Torvalds Date: Tue Dec 9 06:45:00 2025 +0900 Merge tag 'pinctrl-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "The technical details below. For me the CIX Semi and Axis Communications ARTPEC-9 SoCs were the most interesting new drivers in this merge window. Core changes: - Handle per-direction skew control in the generic pin config - Drop the pointless subsystem boilerplate banner message during boot. Less noise in the console. It's available as debug message if someone really want it New drivers: - Samsung Exynos 8890 SoC support - Samsung Exynos derived Axis Communications ARTPEC-9 SoC support. These guys literally live next door to me, ARTPEC spells out "Axis Real-Time Picture Encoding Chip" and is tailored for camera image streams and is something they have evolved for a quarter of a century - Mediatek MT6878 SoC support - Qualcomm Glymur PMIC support (mostly just compatible strings) - Qualcomm Kaanapali SoC TLMM support - Microchip pic64gx "gpio2" SoC support - Microchip Polarfire "iomux0" SoC support - CIX Semiconductors SKY1 SoC support - Rockchip RK3506 SoC support - Airhoa AN7583 chip support Improvements: - Improvements for ST Microelectronics STM32 handling of skew settings so input and output can have different skew settings - A whole bunch of device tree binding cleanups: Marvell Armada and Berlin, Actions Semiconductor S700 and S900, Broadcom Northstar 2 (NS2), Bitmain BM1880 and Spreadtrum SC9860 are moved over to schema" * tag 'pinctrl-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (107 commits) pinctrl: add CONFIG_OF dependencies for microchip drivers pinctrl: starfive: use dynamic GPIO base allocation pinctrl: single: Fix incorrect type for error return variable MAINTAINERS: Change Linus Walleij mail address pinctrl: cix: Fix obscure dependency dt-bindings: pinctrl: cix,sky1-pinctrl: Drop duplicate newline dt-bindings: pinctrl: aspeed,ast2600-pinctrl: Add PCIe RC PERST# group pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data pinctrl: airoha: fix pinctrl function mismatch issue pinctrl: cherryview: Convert to use intel_gpio_add_pin_ranges() pinctrl: intel: Export intel_gpio_add_pin_ranges() pinctrl: renesas: rzg2l: Refactor OEN register PWPR handling pinctrl: airoha: convert comma to semicolon pinctrl: elkhartlake: Switch to INTEL_GPP() macro pinctrl: cherryview: Switch to INTEL_GPP() macro pinctrl: emmitsburg: Switch to INTEL_GPP() macro pinctrl: denverton: Switch to INTEL_GPP() macro pinctrl: cedarfork: Switch to INTEL_GPP() macro pinctrl: airoha: add support for Airoha AN7583 PINs dt-bindings: pinctrl: airoha: Document AN7583 Pin Controller ... commit 22a6db42253744f0f54ab632da0140b690feb44d Author: Akiyoshi Kurita Date: Wed Nov 12 20:37:59 2025 +0900 Documentation: ABI: testing: Fix "upto" typo in rtc-cdev The word "upto" is a common typo for "up to". Correct this. Signed-off-by: Akiyoshi Kurita Link: https://patch.msgid.link/20251112113759.2953758-1-weibu@redadmin.org Signed-off-by: Alexandre Belloni commit 49a51df427dbb5bab9b3341a3a59c248bab79d50 Author: Hector Martin Date: Wed Nov 12 21:16:49 2025 +1000 rtc: Add new rtc-macsmc driver for Apple Silicon Macs Apple Silicon Macs (M1, etc.) have an RTC that is part of the PMU IC, but most of the PMU functionality is abstracted out by the SMC. On T600x machines, the RTC counter must be accessed via the SMC to get full functionality, and it seems likely that future machines will move towards making SMC handle all RTC functionality. The SMC RTC counter access is implemented on all current machines as of the time of this writing, on firmware 12.x. However, the RTC offset (needed to set the time) is still only accessible via direct PMU access. To handle this, we expose the RTC offset as an NVMEM cell from the SPMI PMU device node, and this driver consumes that cell and uses it to compute/set the current time. Reviewed-by: Neal Gompa Signed-off-by: Hector Martin Signed-off-by: Sven Peter Signed-off-by: James Calligeros Link: https://patch.msgid.link/20251112-macsmc-subdevs-v5-3-728e4b91fe81@gmail.com Signed-off-by: Alexandre Belloni commit 07049187e83072e187d7a9f3386286e59c83e8ee Author: Sven Peter Date: Wed Nov 12 21:16:47 2025 +1000 dt-bindings: rtc: Add Apple SMC RTC Apple Silicon Macs (M1, etc.) have an RTC that is part of the PMU IC, but most of the PMU functionality is abstracted out by the SMC. An additional RTC offset stored inside NVMEM is required to compute the current date/time. Reviewed-by: Mark Kettenis Reviewed-by: Neal Gompa Reviewed-by: Rob Herring (Arm) Signed-off-by: Sven Peter Signed-off-by: James Calligeros Reviewd-by: Mark Kettenis Link: https://patch.msgid.link/20251112-macsmc-subdevs-v5-1-728e4b91fe81@gmail.com Signed-off-by: Alexandre Belloni commit 990fa99821b3349a766881c9f152561f722213e3 Merge: 0623fdf30b1105 2b11e7403a8ed8 Author: Linus Torvalds Date: Tue Dec 9 06:35:53 2025 +0900 Merge tag 'dmaengine-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: - Renesas driver conversion to RUNTIME_PM_OPS() etc - Dropping module alias on bunch of drivers - GPI Block event interrupt support in Qualcomm driver and updates to I2C driver as well * tag 'dmaengine-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (23 commits) dt-bindings: dma: xilinx: Simplify dma-coherent property dmaengine: fsl-edma: configure tcd attr with separate src and dst settings dmaengine: st_fdma: drop unused module alias dmaengine: bcm2835: enable compile testing dmaengine: tegra210-adma: drop unused module alias dmaengine: sprd: drop unused module alias dmaengine: mmp_tdma: drop unnecessary OF node check in remove dmaengine: mmp_tdma: drop unused module alias dmaengine: k3dma: drop unused module alias dmaengine: fsl-qdma: drop unused module alias dmaengine: fsl-edma: drop unused module alias dmaengine: dw: drop unused module alias dmaengine: bcm2835: drop unused module alias dmaengine: at_hdmac: add COMPILE_TEST support dmaengine: at_hdmac: fix formats under 64-bit i2c: i2c-qcom-geni: Add Block event interrupt support dmaengine: qcom: gpi: Add GPI Block event interrupt support dmaengine: idxd: drain ATS translations when disabling WQ dmaengine: sh: Kconfig: Drop ARCH_R7S72100/ARCH_RZG2L dependency dmaengine: rcar-dmac: Convert to NOIRQ_SYSTEM_SLEEP/RUNTIME_PM_OPS() ... commit 0623fdf30b1105c22f58baeeca954c803bdf5f8b Merge: feb06d2690bb82 716311dad200ed Author: Linus Torvalds Date: Tue Dec 9 06:31:47 2025 +0900 Merge tag 'phy-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "Core: - Drop Kishon as maintainer, thanks to him for helping, move to credits and add Neil to help with reviews. - Add new phy_notify_stat to notify phy from controllers during the runtime transitions and usage in samsung phy New hardware support: - Renesas RZ/G3E USB3.0 driver - NXP Support TJA1048/TJA1051 CAN phy - Rockchip support for rk3506 dsi dphy - Qualcomm Glymur QMP PCIe PHY support Updates: - PM support for rcar-gen3-usb2 driver - Samsung HDMI/eDP Transmitter Combo PHY updates - Freescale imx8mq support for alternate reference clock" * tag 'phy-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (40 commits) MAINTAINERS: phy: Add Neil Armstrong as reviewers for phy subsystem MAINTAINERS: phy: Move Kishon Vijay Abraham I to credits phy: fsl-imx8mq-usb: support alternate reference clock dt-bindings: phy: imx8mq-usb: add alternate reference clock phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode phy: ti: gmii-sel: Add a sanity check on the phy_id phy: qcom: qmp-pcie: Add support for Glymur PCIe Gen5x4 PHY phy: qcom-qmp: pcs: Add v8.50 register offsets dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Document the Glymur QMP PCIe PHY dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Restrict resets per each device phy: freescale: Initialize priv->lock phy: renesas: Remove unneeded semicolons phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE phy: qcom: qmp-combo: get the USB3 & DisplayPort lanes mapping from DT dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: Document lanes mapping when not using in USB-C complex phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 phy: renesas: rcar-gen3-usb2: Add suspend/resume support ... commit 40d8123ff7492d014d9396a458b344d59cec3c6b Author: Lukas Bulwahn Date: Mon Nov 10 08:35:44 2025 +0100 MAINTAINERS: drop unneeded file entry in NVIDIA VRS RTC DRIVER Commit 9d6d6b06933c ("rtc: nvvrs: add NVIDIA VRS RTC device driver") adds the section NVIDIA VRS RTC DRIVER in MAINTAINERS, which refers to the non-existing file include/linux/rtc/rtc-nvidia-vrs10.h Note, with the changes of v6 to v7 of the patch series adding the driver, the content of this include file was moved into the driver file, and the include file was dropped from that patch. It was simply missed to adjust the section in MAINTAINERS that was newly added with that patch. Drop the file entry to this non-existing file accordingly now. Signed-off-by: Lukas Bulwahn Acked-by: Thierry Reding Reviewed-by: Jon Hunter Reviewed-by: Shubhi Garg Link: https://patch.msgid.link/20251110073544.443816-1-lukas.bulwahn@redhat.com Signed-off-by: Alexandre Belloni commit e0784949c65b1d961d101325b11e43eb306ad04b Author: Akhilesh Patil Date: Sun Nov 9 11:18:59 2025 +0530 rtc: isl12026: Add id_table Add i2c id_table for isl12026 rtc. Signed-off-by: Akhilesh Patil Link: https://patch.msgid.link/2025119-54859-2010914@bhairav-test.ee.iitb.ac.in Signed-off-by: Alexandre Belloni commit 6ada8e24238dd57b38faca503b09757e17819b05 Author: Ovidiu Panait Date: Fri Nov 7 21:07:04 2025 +0000 rtc: renesas-rtca3: Add support for multiple reset lines Switch from devm_reset_control_get_shared() to devm_reset_control_array_get_shared() when retrieving resets. The RZ/V2H SoC requires two resets for the RTC block instead of one, so this will allow to handle multiple resets without additional changes. Signed-off-by: Ovidiu Panait Reviewed-by: Claudiu Beznea Link: https://patch.msgid.link/20251107210706.45044-3-ovidiu.panait.rb@renesas.com Signed-off-by: Alexandre Belloni commit 4800046b56a5b240ab280f55165484a9dbdf7092 Author: Ovidiu Panait Date: Fri Nov 7 21:07:03 2025 +0000 dt-bindings: rtc: renesas,rz-rtca3: Add RZ/V2H support The Renesas RZ/V2H RTC IP is based on the same RTCA3 IP as RZ/G3S (r9a08g045), with the following differences: - It lacks the time capture functionality - The maximum supported periodic interrupt frequency is 128Hz instead of 256Hz - It requires two reset lines instead of one Add new compatible string "renesas,r9a09g057-rtca3" for RZ/V2H and update the binding accordingly: - Allow "resets" to contain one or two entries depending on the SoC. - Add "reset-names" property, but make it required only for RZ/V2H. Signed-off-by: Ovidiu Panait Acked-by: Conor Dooley Link: https://patch.msgid.link/20251107210706.45044-2-ovidiu.panait.rb@renesas.com Signed-off-by: Alexandre Belloni commit bf5ef3ce42da98c59d820dfdd9513ff210622f32 Author: Kartik Rajput Date: Fri Oct 24 12:19:52 2025 +0530 rtc: tegra: Replace deprecated SIMPLE_DEV_PM_OPS Replace deprecated SIMPLE_DEV_PM_OPS with DEFINE_SIMPLE_DEV_PM_OPS macro and use pm_sleep_ptr() to initialize pm_ops. This also allows us to drop the checks for CONFIG_PM_SLEEP. Suggested-by: Andy Shevchenko Signed-off-by: Kartik Rajput Reviewed-by: Andy Shevchenko Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20251024064952.775883-3-kkartik@nvidia.com Signed-off-by: Alexandre Belloni commit 0a293451030b4ad69026b77c7d6b6bdf5cafd7e4 Author: Kartik Rajput Date: Fri Oct 24 12:19:51 2025 +0530 rtc: tegra: Add ACPI support Add ACPI support for Tegra RTC, which is available on Tegra241 and Tegra410. Both Tegra241 and Tegra410 use the same ACPI ID 'NVDA0280'. When ACPI boot is used, the RTC clock is configured by UEFI before the kernel boots. On device-tree boot, the probe must fail if clocks are not provided in the device-tree. Signed-off-by: Kartik Rajput Reviewed-by: Andy Shevchenko Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20251024064952.775883-2-kkartik@nvidia.com Signed-off-by: Alexandre Belloni commit b665c1b620e75e85ea85215735130fd4597bc47f Author: Kartik Rajput Date: Fri Oct 24 12:19:50 2025 +0530 rtc: tegra: Use devm_clk_get_enabled() in probe Simplify clock management by replacing devm_clk_get() and manual clock enable/disable with devm_clk_get_enabled(). This also simplifies the error handling logic. Also remove tegra_rtc_remove() as the clock will automatically be disabled when the device is unbound from the bus. Suggested-by: Andy Shevchenko Signed-off-by: Kartik Rajput Reviewed-by: Andy Shevchenko Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20251024064952.775883-1-kkartik@nvidia.com Signed-off-by: Alexandre Belloni commit 53e71c177cd84982138457b617342f68511e0b64 Author: Alexander Kurz Date: Sat Oct 11 06:26:05 2025 +0000 rtc: Kconfig: add MC34708 to mc13xxx help text MC34708 is one of the three mfd devices supported by DRV_MC13XXX. Update Kconfig accordingly. Signed-off-by: Alexander Kurz Link: https://patch.msgid.link/20251011062605.13591-1-akurz@blala.de Signed-off-by: Alexandre Belloni commit 73c4638a2864e69ff2251080ce874d360fd13056 Author: Nick Huang Date: Sun Sep 21 01:42:23 2025 +0800 rtc: s35390a: use u8 instead of char for register buffer The register buffer in s35390a_get_reg() was previously defined as `char *buf`. This is not ideal since register data represents raw binary values rather than textual data. Switch the type to `u8 *buf` to better reflect its intended usage and to avoid potential issues with sign extension when handling register values on platforms where `char` is signed by default. This change improves type safety and makes the code consistent with other RTC drivers that operate on raw register data. Signed-off-by: Nick Huang Link: https://patch.msgid.link/20250920174224.108795-1-sef1548@gmail.com Signed-off-by: Alexandre Belloni commit feb06d2690bb826fd33798a99ce5cff8d07b38f9 Merge: c2f2b01b74be8b 615a6e7d83f958 Author: Linus Torvalds Date: Tue Dec 9 06:10:17 2025 +0900 Merge tag 'hyperv-next-signed-20251207' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - Enhancements to Linux as the root partition for Microsoft Hypervisor: - Support a new mode called L1VH, which allows Linux to drive the hypervisor running the Azure Host directly - Support for MSHV crash dump collection - Allow Linux's memory management subsystem to better manage guest memory regions - Fix issues that prevented a clean shutdown of the whole system on bare metal and nested configurations - ARM64 support for the MSHV driver - Various other bug fixes and cleanups - Add support for Confidential VMBus for Linux guest on Hyper-V - Secure AVIC support for Linux guests on Hyper-V - Add the mshv_vtl driver to allow Linux to run as the secure kernel in a higher virtual trust level for Hyper-V * tag 'hyperv-next-signed-20251207' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (58 commits) mshv: Cleanly shutdown root partition with MSHV mshv: Use reboot notifier to configure sleep state mshv: Add definitions for MSHV sleep state configuration mshv: Add support for movable memory regions mshv: Add refcount and locking to mem regions mshv: Fix huge page handling in memory region traversal mshv: Move region management to mshv_regions.c mshv: Centralize guest memory region destruction mshv: Refactor and rename memory region handling functions mshv: adjust interrupt control structure for ARM64 Drivers: hv: use kmalloc_array() instead of kmalloc() mshv: Add ioctl for self targeted passthrough hvcalls Drivers: hv: Introduce mshv_vtl driver Drivers: hv: Export some symbols for mshv_vtl static_call: allow using STATIC_CALL_TRAMP_STR() from assembly mshv: Extend create partition ioctl to support cpu features mshv: Allow mappings that overlap in uaddr mshv: Fix create memory region overlap check mshv: add WQ_PERCPU to alloc_workqueue users Drivers: hv: Use kmalloc_array() instead of kmalloc() ... commit 5630f7557de61264ccb4f031d4734a1a97eaed16 Author: Filipe Manana Date: Wed Dec 3 17:02:00 2025 +0000 btrfs: do not skip logging new dentries when logging a new name When we are logging a directory and the log context indicates that we are logging a new name for some other file (that is or was inside that directory), we skip logging the inodes for new dentries in the directory. This is ok most of the time, but if after the rename or link operation that triggered the logging of that directory, we have an explicit fsync of that directory without the directory inode being evicted and reloaded, we end up never logging the inodes for the new dentries that we found during the new name logging, as the next directory fsync will only process dentries that were added after the last time we logged the directory (we are doing an incremental directory logging). So make sure we always log new dentries for a directory even if we are in a context of logging a new name. We started skipping logging inodes for new dentries as of commit c48792c6ee7a ("btrfs: do not log new dentries when logging that a new name exists") and it was fine back then, because when logging a directory we always iterated over all the directory entries (for leaves changed in the current transaction) so a subsequent fsync would always log anything that was previously skipped while logging a directory when logging a new name (with btrfs_log_new_name()). But later support for incrementally logging a directory was added in commit dc2872247ec0 ("btrfs: keep track of the last logged keys when logging a directory"), to avoid checking all dir items every time we log a directory, so the check to skip dentry logging added in the first commit should have been removed when the incremental support for logging a directory was added. A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/84c4e713-85d6-42b9-8dcf-0722ed26cb05@gmail.com/ Fixes: dc2872247ec0 ("btrfs: keep track of the last logged keys when logging a directory") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 266273eaf4d99475f1ae57f687b3e42bc71ec6f0 Author: Filipe Manana Date: Thu Nov 27 16:35:59 2025 +0000 btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current transaction, as this can result an attempt to have a directory with two hard links during log replay, one for the old parent directory and another for the new parent directory. The following scenario triggers that issue: 1) We have directories "dir1" and "dir2" created in a past transaction. Directory "dir1" has inode A as its parent directory; 2) We move "dir1" to some other directory; 3) We create a file with the name "dir1" in directory inode A; 4) We fsync the new file. This results in logging the inode of the new file and the inode for the directory "dir1" that was previously moved in the current transaction. So the log tree has the INODE_REF item for the new location of "dir1"; 5) We move the new file to some other directory. This results in updating the log tree to included the new INODE_REF for the new location of the file and removes the INODE_REF for the old location. This happens during the rename when we call btrfs_log_new_name(); 6) We fsync the file, and that persists the log tree changes done in the previous step (btrfs_log_new_name() only updates the log tree in memory); 7) We have a power failure; 8) Next time the fs is mounted, log replay happens and when processing the inode for directory "dir1" we find a new INODE_REF and add that link, but we don't remove the old link of the inode since we have not logged the old parent directory of the directory inode "dir1". As a result after log replay finishes when we trigger writeback of the subvolume tree's extent buffers, the tree check will detect that we have a directory a hard link count of 2 and we get a mount failure. The errors and stack traces reported in dmesg/syslog are like this: [ 3845.729764] BTRFS info (device dm-0): start tree-log replay [ 3845.730304] page: refcount:3 mapcount:0 mapping:000000005c8a3027 index:0x1d00 pfn:0x11510c [ 3845.731236] memcg:ffff9264c02f4e00 [ 3845.731751] aops:btree_aops [btrfs] ino:1 [ 3845.732300] flags: 0x17fffc00000400a(uptodate|private|writeback|node=0|zone=2|lastcpupid=0x1ffff) [ 3845.733346] raw: 017fffc00000400a 0000000000000000 dead000000000122 ffff9264d978aea8 [ 3845.734265] raw: 0000000000001d00 ffff92650e6d4738 00000003ffffffff ffff9264c02f4e00 [ 3845.735305] page dumped because: eb page dump [ 3845.735981] BTRFS critical (device dm-0): corrupt leaf: root=5 block=30408704 slot=6 ino=257, invalid nlink: has 2 expect no more than 1 for dir [ 3845.737786] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14881 owner 5 [ 3845.737789] BTRFS info (device dm-0): refs 4 lock_owner 0 current 30701 [ 3845.737792] item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160 [ 3845.737794] inode generation 3 transid 9 size 16 nbytes 16384 [ 3845.737795] block group 0 mode 40755 links 1 uid 0 gid 0 [ 3845.737797] rdev 0 sequence 2 flags 0x0 [ 3845.737798] atime 1764259517.0 [ 3845.737800] ctime 1764259517.572889464 [ 3845.737801] mtime 1764259517.572889464 [ 3845.737802] otime 1764259517.0 [ 3845.737803] item 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12 [ 3845.737805] index 0 name_len 2 [ 3845.737807] item 2 key (256 DIR_ITEM 2363071922) itemoff 16077 itemsize 34 [ 3845.737808] location key (257 1 0) type 2 [ 3845.737810] transid 9 data_len 0 name_len 4 [ 3845.737811] item 3 key (256 DIR_ITEM 2676584006) itemoff 16043 itemsize 34 [ 3845.737813] location key (258 1 0) type 2 [ 3845.737814] transid 9 data_len 0 name_len 4 [ 3845.737815] item 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34 [ 3845.737816] location key (257 1 0) type 2 [ 3845.737818] transid 9 data_len 0 name_len 4 [ 3845.737819] item 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34 [ 3845.737820] location key (258 1 0) type 2 [ 3845.737821] transid 9 data_len 0 name_len 4 [ 3845.737822] item 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160 [ 3845.737824] inode generation 9 transid 10 size 6 nbytes 0 [ 3845.737825] block group 0 mode 40755 links 2 uid 0 gid 0 [ 3845.737826] rdev 0 sequence 1 flags 0x0 [ 3845.737827] atime 1764259517.572889464 [ 3845.737828] ctime 1764259517.572889464 [ 3845.737830] mtime 1764259517.572889464 [ 3845.737831] otime 1764259517.572889464 [ 3845.737832] item 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14 [ 3845.737833] index 2 name_len 4 [ 3845.737834] item 8 key (257 INODE_REF 258) itemoff 15787 itemsize 14 [ 3845.737836] index 2 name_len 4 [ 3845.737837] item 9 key (257 DIR_ITEM 2507850652) itemoff 15754 itemsize 33 [ 3845.737838] location key (259 1 0) type 1 [ 3845.737839] transid 10 data_len 0 name_len 3 [ 3845.737840] item 10 key (257 DIR_INDEX 2) itemoff 15721 itemsize 33 [ 3845.737842] location key (259 1 0) type 1 [ 3845.737843] transid 10 data_len 0 name_len 3 [ 3845.737844] item 11 key (258 INODE_ITEM 0) itemoff 15561 itemsize 160 [ 3845.737846] inode generation 9 transid 10 size 8 nbytes 0 [ 3845.737847] block group 0 mode 40755 links 1 uid 0 gid 0 [ 3845.737848] rdev 0 sequence 1 flags 0x0 [ 3845.737849] atime 1764259517.572889464 [ 3845.737850] ctime 1764259517.572889464 [ 3845.737851] mtime 1764259517.572889464 [ 3845.737852] otime 1764259517.572889464 [ 3845.737853] item 12 key (258 INODE_REF 256) itemoff 15547 itemsize 14 [ 3845.737855] index 3 name_len 4 [ 3845.737856] item 13 key (258 DIR_ITEM 1843588421) itemoff 15513 itemsize 34 [ 3845.737857] location key (257 1 0) type 2 [ 3845.737858] transid 10 data_len 0 name_len 4 [ 3845.737860] item 14 key (258 DIR_INDEX 2) itemoff 15479 itemsize 34 [ 3845.737861] location key (257 1 0) type 2 [ 3845.737862] transid 10 data_len 0 name_len 4 [ 3845.737863] item 15 key (259 INODE_ITEM 0) itemoff 15319 itemsize 160 [ 3845.737865] inode generation 10 transid 10 size 0 nbytes 0 [ 3845.737866] block group 0 mode 100600 links 1 uid 0 gid 0 [ 3845.737867] rdev 0 sequence 2 flags 0x0 [ 3845.737868] atime 1764259517.580874966 [ 3845.737869] ctime 1764259517.586121869 [ 3845.737870] mtime 1764259517.580874966 [ 3845.737872] otime 1764259517.580874966 [ 3845.737873] item 16 key (259 INODE_REF 257) itemoff 15306 itemsize 13 [ 3845.737874] index 2 name_len 3 [ 3845.737875] BTRFS error (device dm-0): block=30408704 write time tree block corruption detected [ 3845.739448] ------------[ cut here ]------------ [ 3845.740092] WARNING: CPU: 5 PID: 30701 at fs/btrfs/disk-io.c:335 btree_csum_one_bio+0x25a/0x270 [btrfs] [ 3845.741439] Modules linked in: btrfs dm_flakey crc32c_cryptoapi (...) [ 3845.750626] CPU: 5 UID: 0 PID: 30701 Comm: mount Tainted: G W 6.18.0-rc6-btrfs-next-218+ #1 PREEMPT(full) [ 3845.752414] Tainted: [W]=WARN [ 3845.752828] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [ 3845.754499] RIP: 0010:btree_csum_one_bio+0x25a/0x270 [btrfs] [ 3845.755460] Code: 31 f6 48 89 (...) [ 3845.758685] RSP: 0018:ffffa8d9c5677678 EFLAGS: 00010246 [ 3845.759450] RAX: 0000000000000000 RBX: ffff92650e6d4738 RCX: 0000000000000000 [ 3845.760309] RDX: 0000000000000000 RSI: ffffffff9aab45b9 RDI: ffff9264c4748000 [ 3845.761239] RBP: ffff9264d4324000 R08: 0000000000000000 R09: ffffa8d9c5677468 [ 3845.762607] R10: ffff926bdc1fffa8 R11: 0000000000000003 R12: ffffa8d9c5677680 [ 3845.764099] R13: 0000000000004000 R14: ffff9264dd624000 R15: ffff9264d978aba8 [ 3845.765094] FS: 00007f751fa5a840(0000) GS:ffff926c42a82000(0000) knlGS:0000000000000000 [ 3845.766226] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3845.766970] CR2: 0000558df1815380 CR3: 000000010ed88003 CR4: 0000000000370ef0 [ 3845.768009] Call Trace: [ 3845.768392] [ 3845.768714] btrfs_submit_bbio+0x6ee/0x7f0 [btrfs] [ 3845.769640] ? write_one_eb+0x28e/0x340 [btrfs] [ 3845.770588] btree_write_cache_pages+0x2f0/0x550 [btrfs] [ 3845.771286] ? alloc_extent_state+0x19/0x100 [btrfs] [ 3845.771967] ? merge_next_state+0x1a/0x90 [btrfs] [ 3845.772586] ? set_extent_bit+0x233/0x8b0 [btrfs] [ 3845.773198] ? xas_load+0x9/0xc0 [ 3845.773589] ? xas_find+0x14d/0x1a0 [ 3845.773969] do_writepages+0xc6/0x160 [ 3845.774367] filemap_fdatawrite_wbc+0x48/0x60 [ 3845.775003] __filemap_fdatawrite_range+0x5b/0x80 [ 3845.775902] btrfs_write_marked_extents+0x61/0x170 [btrfs] [ 3845.776707] btrfs_write_and_wait_transaction+0x4e/0xc0 [btrfs] [ 3845.777379] ? _raw_spin_unlock_irqrestore+0x23/0x40 [ 3845.777923] btrfs_commit_transaction+0x5ea/0xd20 [btrfs] [ 3845.778551] ? _raw_spin_unlock+0x15/0x30 [ 3845.778986] ? release_extent_buffer+0x34/0x160 [btrfs] [ 3845.779659] btrfs_recover_log_trees+0x7a3/0x7c0 [btrfs] [ 3845.780416] ? __pfx_replay_one_buffer+0x10/0x10 [btrfs] [ 3845.781499] open_ctree+0x10bb/0x15f0 [btrfs] [ 3845.782194] btrfs_get_tree.cold+0xb/0x16c [btrfs] [ 3845.782764] ? fscontext_read+0x15c/0x180 [ 3845.783202] ? rw_verify_area+0x50/0x180 [ 3845.783667] vfs_get_tree+0x25/0xd0 [ 3845.784047] vfs_cmd_create+0x59/0xe0 [ 3845.784458] __do_sys_fsconfig+0x4f6/0x6b0 [ 3845.784914] do_syscall_64+0x50/0x1220 [ 3845.785340] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 3845.785980] RIP: 0033:0x7f751fc7f4aa [ 3845.786759] Code: 73 01 c3 48 (...) [ 3845.789951] RSP: 002b:00007ffcdba45dc8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 3845.791402] RAX: ffffffffffffffda RBX: 000055ccc8291c20 RCX: 00007f751fc7f4aa [ 3845.792688] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 3845.794308] RBP: 000055ccc8292120 R08: 0000000000000000 R09: 0000000000000000 [ 3845.795829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3845.797183] R13: 00007f751fe11580 R14: 00007f751fe1326c R15: 00007f751fdf8a23 [ 3845.798633] [ 3845.799067] ---[ end trace 0000000000000000 ]--- [ 3845.800215] BTRFS: error (device dm-0) in btrfs_commit_transaction:2553: errno=-5 IO failure (Error while writing out transaction) [ 3845.801860] BTRFS warning (device dm-0 state E): Skipping commit of aborted transaction. [ 3845.802815] BTRFS error (device dm-0 state EA): Transaction aborted (error -5) [ 3845.803728] BTRFS: error (device dm-0 state EA) in cleanup_transaction:2036: errno=-5 IO failure [ 3845.805374] BTRFS: error (device dm-0 state EA) in btrfs_replay_log:2083: errno=-5 IO failure (Failed to recover log tree) [ 3845.807919] BTRFS error (device dm-0 state EA): open_ctree failed: -5 Fix this by never logging a conflicting inode that is a directory and was moved in the current transaction (its last_unlink_trans equals the current transaction) and instead fallback to a transaction commit. A test case for fstests will follow soon. Reported-by: Vyacheslav Kovalevsky Link: https://lore.kernel.org/linux-btrfs/7bbc9419-5c56-450a-b5a0-efeae7457113@gmail.com/ CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 564d59410c39d1adb3e245f58663bad86636adaf Author: Dan Carpenter Date: Thu Nov 27 10:14:24 2025 +0300 btrfs: tests: fix double btrfs_path free in remove_extent_ref() We converted this code to use auto free cleanup.h magic but one remaining free was accidentally left behind which leads to a double free bug. Fixes: a320476ca8a3 ("btrfs: tests: do trivial BTRFS_PATH_AUTO_FREE conversions") Signed-off-by: Dan Carpenter Reviewed-by: David Sterba Signed-off-by: David Sterba commit 87213b0d847cd300285b5545598e0548baeb5208 Author: Caleb Sander Mateos Date: Mon Dec 1 14:41:44 2025 -0700 ublk: allow non-blocking ctrl cmds in IO_URING_F_NONBLOCK issue Handling most of the ublksrv_ctrl_cmd opcodes require locking a mutex, so ublk_ctrl_uring_cmd() bails out with EAGAIN when called with the IO_URING_F_NONBLOCK issue flag. However, several opcodes can be handled without blocking: - UBLK_CMD_GET_QUEUE_AFFINITY - UBLK_CMD_GET_DEV_INFO - UBLK_CMD_GET_DEV_INFO2 - UBLK_U_CMD_GET_FEATURES Handle these opcodes synchronously instead of returning EAGAIN so io_uring doesn't need to issue the command via the worker thread pool. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit cf326449637a566ba98fb82c47d46cd479608c88 Author: Jonathan Kim Date: Fri Dec 5 14:41:08 2025 -0500 drm/amdkfd: bump minimum vgpr size for gfx1151 GFX1151 has 1.5x the number of available physical VGPRs per SIMD. Bump total memory availability for acquire checks on queue creation. Signed-off-by: Jonathan Kim Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit b42f3bf9536c9b710fd1d4deb7d1b0dc819dc72d) Cc: stable@vger.kernel.org commit 7329417fc9ac128729c3a092b006c8f1fd0d04a6 Author: Rosen Penev Date: Sat Nov 8 09:40:47 2025 -0800 drm/amd/display: shrink struct members On a 32-bit ARM system, the audio_decoder struct ends up being too large for dp_retrain_link_dp_test. link_dp_cts.c:157:1: error: the frame size of 1328 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] This is mitigated by shrinking the members of the struct and avoids having to deal with dynamic allocation. feed_back_divider is assigned but otherwise unused. Remove both. pixel_repetition looks like it should be a bool since it's only ever assigned to 1. But there are checks for 2 and 4. Reduce to uint8_t. Remove ss_percentage_divider. Unused. Shrink refresh_rate as it gets assigned to at most a 3 digit integer value. Signed-off-by: Rosen Penev Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 3849efdc7888d537f09c3dcfaea4b3cd377a102e) commit 8fc2796dea6f1210e1a01573961d5836a7ce531e Author: Mario Limonciello Date: Fri Dec 5 12:41:58 2025 -0600 drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace This is important for userspace to avoid hardcoding VGPR size. Reviewed-by: Kent Russell Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 71776e0965f9f730af19c5f548827f2a7c91f5a8) Cc: stable@vger.kernel.org commit cf841f6abc26e455c68725e071450d6a29a53611 Author: Alex Hung Date: Wed Nov 26 11:44:35 2025 -0700 drm/amd/display: Refactor dml_core_mode_support to reduce stack frame [WHAT] When compiling Linux kernel with clang, the following warning / error messages pops up: drivers/gpu/drm/amd/amdgpu/../dal-dev/dc/dml2_0/display_mode_core.c:6853:12: error: stack frame size (2120) exceeds limit (2056) in 'dml_core_mode_support' [-Werror,-Wframe-larger-than] 6853 | dml_bool_t dml_core_mode_support(struct display_mode_lib_st *mode_lib) [HOW] Refactoring CalculateVMRowAndSwath_params assignments to a new function helps reduce the stack frame size in dml_core_mode_support. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4733 Reviewed-by: Austin Zheng Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Chenyu Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 29a4dc4b5d82e6b3da343391f9e784cf5c48732c) commit eb296c09805ee37dd4ea520a7fb3ec157c31090f Author: Alex Deucher Date: Tue Dec 2 14:24:03 2025 -0500 drm/amdgpu: don't attach the tlb fence for SI SI hardware doesn't support pasids, user mode queues, or KIQ/MES so there is no need for this. Doing so results in a segfault as these callbacks are non-existent for SI. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4744 Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update") Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 820b3d376e8a102c6aeab737ec6edebbbb710e04) commit 3c41114dcdabb7b25f5bc33273c6db9c7af7f4a7 Author: Alex Deucher Date: Tue Nov 11 11:17:22 2025 -0500 drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() This can get called from an atomic context. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4470 Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit 8acdad9344cc7b4e7bc01f0dfea80093eb3768db) Cc: stable@vger.kernel.org commit b7851f8c66191cd23a0a08bd484465ad74bbbb7d Author: Jay Cornwall Date: Fri Nov 14 14:32:42 2025 -0600 drm/amdkfd: Trap handler support for expert scheduling mode The trap may be entered with dependency checking disabled. Wait for dependency counters and save/restore scheduling mode. v2: Use ttmp1 instead of ttmp11. ttmp11 is not zero-initialized. While the trap handler does zero this field before use, a user-mode second-level trap handler could not rely on this being zero when using an older kernel mode driver. v3: Use ttmp11 primarily but copy to ttmp1 before jumping to the second level trap handler. ttmp1 is inspectable by a debugger. Unexpected bits in the unused space may regress existing software. Signed-off-by: Jay Cornwall Reviewed-by: Lancelot Six Signed-off-by: Alex Deucher (cherry picked from commit 423888879412e94725ca2bdccd89414887d98e31) Cc: stable@vger.kernel.org commit bf2084a7b1d75d093b6a79df4c10142d49fbaa0e Author: Xiaogang Chen Date: Mon Dec 1 14:12:29 2025 -0600 drm/amdkfd: Use huge page size to check split svm range alignment When split svm ranges that have been mapped using huge page should use huge page size(2MB) to check split range alignment, not prange->granularity that means migration granularity. Fixes: 7ef6b2d4b7e5 ("drm/amdkfd: remap unaligned svm ranges that have split") Signed-off-by: Xiaogang Chen Reviewed-by: Philip Yang Signed-off-by: Alex Deucher (cherry picked from commit 448ee45353ef9fb1a34f5f26eb3f48923c6f0898) commit 491adc6a0f9903c32b05f284df1148de39e8e644 Author: Simon Richter Date: Tue Oct 14 01:11:33 2025 +0900 drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for a BO to exist that is not currently associated with a resource, e.g. because it has been evicted. When devcoredump tries to read the contents of all BOs for dumping, we need to expect this as well -- in this case, ENODATA is recorded instead of the buffer contents. Fixes: 7d08df5d0bd3 ("drm/ttm: Add ttm_bo_access") Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2") Cc: stable Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6271 Signed-off-by: Simon Richter Reviewed-by: Matthew Brost Reviewed-by: Shuicheng Lin Reviewed-by: Christian König Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20251013161241.709916-1-Simon.Richter@hogyros.de commit 3309b63a2281efb72df7621d60cc1246b6286ad3 Author: Shakeel Butt Date: Fri Dec 5 12:01:06 2025 -0800 cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated On x86-64, this_cpu_cmpxchg() uses CMPXCHG without LOCK prefix which means it is only safe for the local CPU and not for multiple CPUs. Recently the commit 36df6e3dbd7e ("cgroup: make css_rstat_updated nmi safe") make css_rstat_updated lockless and uses lockless list to allow reentrancy. Since css_rstat_updated can invoked from process context, IRQ and NMI, it uses this_cpu_cmpxchg() to select the winner which will inset the lockless lnode into the global per-cpu lockless list. However the commit missed one case where lockless node of a cgroup can be accessed and modified by another CPU doing the flushing. Basically llist_del_first_init() in css_process_update_tree(). On a cursory look, it can be questioned how css_process_update_tree() can see a lockless node in global lockless list where the updater is at this_cpu_cmpxchg() and before llist_add() call in css_rstat_updated(). This can indeed happen in the presence of IRQs/NMI. Consider this scenario: Updater for cgroup stat C on CPU A in process context is after llist_on_list() check and before this_cpu_cmpxchg() in css_rstat_updated() where it get interrupted by IRQ/NMI. In the IRQ/NMI context, a new updater calls css_rstat_updated() for same cgroup C and successfully inserts rstatc_pcpu->lnode. Now concurrently CPU B is running the flusher and it calls llist_del_first_init() for CPU A and got rstatc_pcpu->lnode of cgroup C which was added by the IRQ/NMI updater. Now imagine CPU B calling init_llist_node() on cgroup C's rstatc_pcpu->lnode of CPU A and on CPU A, the process context updater calling this_cpu_cmpxchg(rstatc_pcpu->lnode) concurrently. The CMPXCNG without LOCK on CPU A is not safe and thus we need LOCK prefix. In Meta's fleet running the kernel with the commit 36df6e3dbd7e, we are observing on some machines the memcg stats are getting skewed by more than the actual memory on the system. On close inspection, we noticed that lockless node for a workload for specific CPU was in the bad state and thus all the updates on that CPU for that cgroup was being lost. To confirm if this skew was indeed due to this CMPXCHG without LOCK in css_rstat_updated(), we created a repro (using AI) at [1] which shows that CMPXCHG without LOCK creates almost the same lnode corruption as seem in Meta's fleet and with LOCK CMPXCHG the issue does not reproduces. Link: http://lore.kernel.org/efiagdwmzfwpdzps74fvcwq3n4cs36q33ij7eebcpssactv3zu@se4hqiwxcfxq [1] Signed-off-by: Shakeel Butt Cc: stable@vger.kernel.org # v6.17+ Fixes: 36df6e3dbd7e ("cgroup: make css_rstat_updated nmi safe") Signed-off-by: Tejun Heo commit 12b5cd99a05f7cbc2ceb88b3b9601d404ef2236a Author: John Stultz Date: Sat Dec 6 02:22:03 2025 +0000 sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next Early when trying to get sched_ext and proxy-exe working together, I kept tripping over NULL ptr in put_prev_task_scx() on the line: if (sched_class_above(&ext_sched_class, next->sched_class)) { Which was due to put_prev_task() passes a NULL next, calling: prev->sched_class->put_prev_task(rq, prev, NULL); put_prev_task_scx() already guards for a NULL next in the switch_class case, but doesn't seem to have a guard for sched_class_above() check. I can't say I understand why this doesn't trip usually without proxy-exec. And in newer kernels there are way fewer put_prev_task(), and I can't easily reproduce the issue now even with proxy-exec. But we still have one put_prev_task() call left in core.c that seems like it could trip this, so I wanted to send this out for consideration. tj: put_prev_task() can be called with NULL @next; however, when @p is queued, that doesn't happen, so this condition shouldn't currently be triggerable. The connection isn't straightforward or necessarily reliable, so add the NULL check even if it can't currently be triggered. Link: http://lkml.kernel.org/r/20251206022218.1541878-1-jstultz@google.com Signed-off-by: John Stultz Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 517a44d18537ef8ab888f71197c80116c14cee0a Author: Zqiang Date: Mon Dec 8 19:23:19 2025 +0800 sched_ext: Fix the memleak for sch->helper objects This commit use kthread_destroy_worker() to release sch->helper objects to fix the following kmemleak: unreferenced object 0xffff888121ec7b00 (size 128): comm "scx_simple", pid 1197, jiffies 4295884415 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 587b3352): kmemleak_alloc+0x62/0xa0 __kmalloc_cache_noprof+0x28d/0x3e0 kthread_create_worker_on_node+0xd5/0x1f0 scx_enable.isra.210+0x6c2/0x25b0 bpf_scx_reg+0x12/0x20 bpf_struct_ops_link_create+0x2c3/0x3b0 __sys_bpf+0x3102/0x4b00 __x64_sys_bpf+0x79/0xc0 x64_sys_call+0x15d9/0x1dd0 do_syscall_64+0xf0/0x470 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: bff3b5aec1b7 ("sched_ext: Move disable machinery into scx_sched") Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit ebae102897e760e9e6bc625f701dd666b2163bd1 Author: Andy Shevchenko Date: Thu Nov 13 09:31:31 2025 +0100 nfsd: Mark variable __maybe_unused to avoid W=1 build break Clang is not happy about set but (in some cases) unused variable: fs/nfsd/export.c:1027:17: error: variable 'inode' set but not used [-Werror,-Wunused-but-set-variable] since it's used as a parameter to dprintk() which might be configured a no-op. To avoid uglifying code with the specific ifdeffery just mark the variable __maybe_unused. The commit [1], which introduced this behaviour, is quite old and hence the Fixes tag points to the first of the Git era. Link: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=0431923fb7a1 [1] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko Signed-off-by: Chuck Lever commit d1bea0ce35b6095544ee82bb54156fc62c067e58 Author: Joshua Rogers Date: Fri Nov 7 10:09:49 2025 -0500 svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page. Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Signed-off-by: Chuck Lever commit 94972027ab55b200e031059fd6c7a649f8248020 Author: Joshua Rogers Date: Fri Nov 7 10:09:48 2025 -0500 svcrdma: return 0 on success from svc_rdma_copy_inline_range The function comment specifies 0 on success and -EINVAL on invalid parameters. Make the tail return 0 after a successful copy loop. Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Signed-off-by: Chuck Lever commit a8ee9099f30654917aa68f55d707b5627e1dbf77 Author: Joshua Rogers Date: Fri Nov 7 10:09:47 2025 -0500 svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current page. Found by ZeroPath (https://zeropath.com) Fixes: 8e122582680c ("svcrdma: Move svc_rdma_read_info::ri_pageno to struct svc_rdma_recv_ctxt") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Signed-off-by: Chuck Lever commit d4b69a6186b215d2dc1ebcab965ed88e8d41768d Author: Joshua Rogers Date: Fri Nov 7 10:05:33 2025 -0500 SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0. Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") Cc: stable@vger.kernel.org Signed-off-by: Joshua Rogers Signed-off-by: Chuck Lever commit 29763138830916f46daaa50e83e7f4f907a3236b Author: Dongli Zhang Date: Fri Dec 5 15:19:05 2025 -0800 KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit If an APICv status updated was pended while L2 was active, immediately refresh vmcs01's controls instead of pending KVM_REQ_APICV_UPDATE as kvm_vcpu_update_apicv() only calls into vendor code if a change is necessary. E.g. if APICv is inhibited, and then activated while L2 is running: kvm_vcpu_update_apicv() | -> __kvm_vcpu_update_apicv() | -> apic->apicv_active = true | -> vmx_refresh_apicv_exec_ctrl() | -> vmx->nested.update_vmcs01_apicv_status = true | -> return Then L2 exits to L1: __nested_vmx_vmexit() | -> kvm_make_request(KVM_REQ_APICV_UPDATE) vcpu_enter_guest(): KVM_REQ_APICV_UPDATE -> kvm_vcpu_update_apicv() | -> __kvm_vcpu_update_apicv() | -> return // because if (apic->apicv_active == activate) Reported-by: Chao Gao Closes: https://lore.kernel.org/all/aQ2jmnN8wUYVEawF@intel.com Fixes: 7c69661e225c ("KVM: nVMX: Defer APICv updates while L2 is active until L1 is active") Cc: stable@vger.kernel.org Signed-off-by: Dongli Zhang [sean: write changelog] Link: https://patch.msgid.link/20251205231913.441872-3-seanjc@google.com Signed-off-by: Sean Christopherson commit b2849bec936be642b5420801f902337f2507648e Author: Dongli Zhang Date: Fri Dec 5 15:19:04 2025 -0800 KVM: VMX: Update SVI during runtime APICv activation The APICv (apic->apicv_active) can be activated or deactivated at runtime, for instance, because of APICv inhibit reasons. Intel VMX employs different mechanisms to virtualize LAPIC based on whether APICv is active. When APICv is activated at runtime, GUEST_INTR_STATUS is used to configure and report the current pending IRR and ISR states. Unless a specific vector is explicitly included in EOI_EXIT_BITMAP, its EOI will not be trapped to KVM. Intel VMX automatically clears the corresponding ISR bit based on the GUEST_INTR_STATUS.SVI field. When APICv is deactivated at runtime, the VM_ENTRY_INTR_INFO_FIELD is used to specify the next interrupt vector to invoke upon VM-entry. The VMX IDT_VECTORING_INFO_FIELD is used to report un-invoked vectors on VM-exit. EOIs are always trapped to KVM, so the software can manually clear pending ISR bits. There are scenarios where, with APICv activated at runtime, a guest-issued EOI may not be able to clear the pending ISR bit. Taking vector 236 as an example, here is one scenario. 1. Suppose APICv is inactive. Vector 236 is pending in the IRR. 2. To handle KVM_REQ_EVENT, KVM moves vector 236 from the IRR to the ISR, and configures the VM_ENTRY_INTR_INFO_FIELD via vmx_inject_irq(). 3. After VM-entry, vector 236 is invoked through the guest IDT. At this point, the data in VM_ENTRY_INTR_INFO_FIELD is no longer valid. The guest interrupt handler for vector 236 is invoked. 4. Suppose a VM exit occurs very early in the guest interrupt handler, before the EOI is issued. 5. Nothing is reported through the IDT_VECTORING_INFO_FIELD because vector 236 has already been invoked in the guest. 6. Now, suppose APICv is activated. Before the next VM-entry, KVM calls kvm_vcpu_update_apicv() to activate APICv. 7. Unfortunately, GUEST_INTR_STATUS.SVI is not configured, although vector 236 is still pending in the ISR. 8. After VM-entry, the guest finally issues the EOI for vector 236. However, because SVI is not configured, vector 236 is not cleared. 9. ISR is stalled forever on vector 236. Here is another scenario. 1. Suppose APICv is inactive. Vector 236 is pending in the IRR. 2. To handle KVM_REQ_EVENT, KVM moves vector 236 from the IRR to the ISR, and configures the VM_ENTRY_INTR_INFO_FIELD via vmx_inject_irq(). 3. VM-exit occurs immediately after the next VM-entry. The vector 236 is not invoked through the guest IDT. Instead, it is saved to the IDT_VECTORING_INFO_FIELD during the VM-exit. 4. KVM calls kvm_queue_interrupt() to re-queue the un-invoked vector 236 into vcpu->arch.interrupt. A KVM_REQ_EVENT is requested. 5. Now, suppose APICv is activated. Before the next VM-entry, KVM calls kvm_vcpu_update_apicv() to activate APICv. 6. Although APICv is now active, KVM still uses the legacy VM_ENTRY_INTR_INFO_FIELD to re-inject vector 236. GUEST_INTR_STATUS.SVI is not configured. 7. After the next VM-entry, vector 236 is invoked through the guest IDT. Finally, an EOI occurs. However, due to the lack of GUEST_INTR_STATUS.SVI configuration, vector 236 is not cleared from the ISR. 8. ISR is stalled forever on vector 236. Using QEMU as an example, vector 236 is stuck in ISR forever. (qemu) info lapic 1 dumping local APIC state for CPU 1 LVT0 0x00010700 active-hi edge masked ExtINT (vec 0) LVT1 0x00010400 active-hi edge masked NMI LVTPC 0x00000400 active-hi edge NMI LVTERR 0x000000fe active-hi edge Fixed (vec 254) LVTTHMR 0x00010000 active-hi edge masked Fixed (vec 0) LVTT 0x000400ec active-hi edge tsc-deadline Fixed (vec 236) Timer DCR=0x0 (divide by 2) initial_count = 0 current_count = 0 SPIV 0x000001ff APIC enabled, focus=off, spurious vec 255 ICR 0x000000fd physical edge de-assert no-shorthand ICR2 0x00000000 cpu 0 (X2APIC ID) ESR 0x00000000 ISR 236 IRR 37(level) 236 The issue isn't applicable to AMD SVM as KVM simply writes vmcb01 directly irrespective of whether L1 (vmcs01) or L2 (vmcb02) is active (unlike VMX, there is no need/cost to switch between VMCBs). In addition, APICV_INHIBIT_REASON_IRQWIN ensures AMD SVM AVIC is not activated until the last interrupt is EOI'd. Fix the bug by configuring Intel VMX GUEST_INTR_STATUS.SVI if APICv is activated at runtime. Signed-off-by: Dongli Zhang Reviewed-by: Chao Gao Link: https://patch.msgid.link/20251110063212.34902-1-dongli.zhang@oracle.com [sean: call out that SVM writes vmcb01 directly, tweak comment] Link: https://patch.msgid.link/20251205231913.441872-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 70075e3d0ca0b72cc983d03f7cd9796e43492980 Author: Heiko Carstens Date: Mon Dec 8 13:40:56 2025 +0100 s390/bug: Add missing alignment All objects are supposed to have a minimal alignment of two, since a couple of instructions only work with even addresses. Add the missing align statement for the file string. Fixes: 6584ff203aec ("bugs/s390: Use 'cond_str' in __EMIT_BUG()") Signed-off-by: Heiko Carstens commit 1a82d430c5f05d4bf15b86a9f0349e4a24ec485c Author: Heiko Carstens Date: Tue Dec 2 14:41:00 2025 +0100 s390/bug: Add missing CONFIG_BUG ifdef again Fallback to generic BUG implementation in case CONFIG_BUG is disabled. This restores the old behaviour before 'cond_str' support was added. It probably doesn't matter, since nobody should disable CONFIG_BUG, but at least this is consistent to before. Fixes: 6584ff203aec ("bugs/s390: Use 'cond_str' in __EMIT_BUG()") Signed-off-by: Heiko Carstens commit 9a97857db0c5655b8932f86b5d18bb959079b0ee Author: Andres J Rosa Date: Wed Dec 3 10:25:01 2025 -0600 ALSA: uapi: Fix typo in asound.h comment Fix 'level-shit' to 'level-shift' in struct snd_cea_861_aud_if comment. Fixes: 7ba1c40b536e ("ALSA: Add definitions for CEA-861 Audio InfoFrames") Signed-off-by: Andres J Rosa Link: https://patch.msgid.link/20251203162509.1822-1-andyrosa@gmail.com Signed-off-by: Takashi Iwai commit 2f393c228cc519ddf19b8c6c05bf15723241aa96 Author: Claudio Imbrenda Date: Tue Nov 4 16:40:48 2025 +0100 KVM: s390: Fix gmap_helper_zap_one_page() again A few checks were missing in gmap_helper_zap_one_page(), which can lead to memory corruption in the guest under specific circumstances. Add the missing checks. Fixes: 5deafa27d9ae ("KVM: s390: Fix to clear PTE when discarding a swapped page") Cc: stable@vger.kernel.org Reported-by: Marc Hartmayer Tested-by: Marc Hartmayer Acked-by: Christian Borntraeger Signed-off-by: Claudio Imbrenda Signed-off-by: Heiko Carstens commit d202341d9b0c5b5965787061ba0d10daafb9d6c5 Author: Luca Weiss Date: Tue Oct 28 17:40:47 2025 +0100 i2c: qcom-cci: Add msm8953 compatible Add a config for the v1.2.5 CCI found on msm8953 which has different values in .params compared to others already supported in the driver. Reviewed-by: Loic Poulain Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Signed-off-by: Wolfram Sang commit f60d68e697ceb8a55c292060bd2041c6013e8c01 Merge: 414690746d2da0 25faa5364638b8 Author: Wolfram Sang Date: Mon Dec 8 20:01:14 2025 +0900 Merge tag 'i2c-host-6.19-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.19 - general cleanups in bcm2835, designware, pcf8584, and stm32 - amd-mp2: fix device refcount - designware: avoid interrupt storms caused by bad firmware - i801: fix supported features - spacemit: fix device detection failures New device support: - Intel Diamond Rapids - Rockchip RK3506 - Qualcomm Kaanapali, MSM8953 commit be77cf43d2fd6eca150594e997e40ca7df90f251 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust default config files for 32BIT/64BIT Add loongson32_defconfig (for 32BIT) and rename loongson3_defconfig to loongson64_defconfig (for 64BIT). Also adjust graphics drivers, such as FB_EFI is replaced with EFIDRM. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 4cd09f356ecc61fba53dfd27f98ecd4b8f61bdb7 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust VDSO/VSYSCALL for 32BIT/64BIT Adjust VDSO/VSYSCALL because read_cpu_id() for 32BIT/64BIT are different, and LoongArch32 doesn't support GENERIC_GETTIMEOFDAY now (will be supported in future). Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit b15dfdacd99dc0014413c71bc1157fc4e895ce68 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust misc routines for 32BIT/64BIT Adjust misc routines for both 32BIT and 64BIT, including: bitops, bswap, checksum, string, jump label, unaligned access emulator, suspend/wakeup routines, etc. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 48c7294775be0f17ffd8a7d5ef0df3ab5e696ab4 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust user accessors for 32BIT/64BIT Adjust user accessors for both 32BIT and 64BIT, including: get_user(), put_user(), copy_user(), clear_user(), etc. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 14338e631afd6d4b2c2f8fb7deba786d86c40fad Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust system call for 32BIT/64BIT Adjust system call for both 32BIT and 64BIT, including: add the uapi unistd_{32,64}.h and syscall_table_{32,64}.h inclusion, add sys_mmap2() definition, change the system call entry routines, etc. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 3f63ac8d287b2199318ee38975ed53894067fb65 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust module loader for 32BIT/64BIT Adjust module loader for both 32BIT and 64BIT, including: change the s64 type to long, change the u64 type to unsigned long, change the plt entry definition and handling, etc. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit ced7814d3a5c2275d59cb3f4bd9fa2aec8d8529a Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust time routines for 32BIT/64BIT Adjust time routines for both 32BIT and 64BIT, including: rdtime_h() / rdtime_l() definitions for 32BIT and rdtime_d() definition for 64BIT, get_cycles() and get_cycles64() definitions for 32BIT/64BIT, show time frequency info ("CPU MHz" and "BogoMIPS") in /proc/cpuinfo, etc. Use do_div() for division which works on both 32BIT and 64BIT platforms. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 4ad04e7c7eed8583bd49509f4aad4d28bc4b399d Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust process management for 32BIT/64BIT Adjust process management for both 32BIT and 64BIT, including: CPU context switching, FPU loading/restoring, process dumping and process tracing routines. Q: Why modify switch.S? A: LoongArch32 has no ldptr.d/stptr.d instructions, and asm offsets of thead_struct members are too large to be filled in the 12b immediate field of ld.w/st.w. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit dd55dd0d7e5ddceb6df451dac208af38609d1963 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust memory management for 32BIT/64BIT Adjust memory management for both 32BIT and 64BIT, including: address space definition, DMW CSR definition, page table bits definition, boot time detection of VA/PA bits, page table init, tlb exception handling, copy_page/clear_page/dump_tlb libraries, etc. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Yawei Li Signed-off-by: Huacai Chen commit 7b2afeafaf9c2d584439fc14fdc1462425b41fd3 Author: Huacai Chen Date: Mon Dec 8 18:09:17 2025 +0800 LoongArch: Adjust boot & setup for 32BIT/64BIT Adjust boot & setup for both 32BIT and 64BIT, including: efi header definition, MAX_IO_PICS definition, kernel entry and environment setup routines, etc. Add a fallback path in fdt_cpu_clk_init() to avoid 0MHz in /proc/cpuinfo if there is no valid clock freq from firmware. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 31b931bebd11a0f00967114f62c8c38952f483e5 Author: Hans de Goede Date: Sun Dec 7 19:47:56 2025 +0100 dma-mapping: Fix DMA_BIT_MASK() macro being broken After commit a50f7456f853 ("dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope"), the DMA_BIT_MASK() macro is broken when passed non trivial statements for the value of 'n'. This is caused by the new version missing parenthesis around 'n' when evaluating 'n'. One example of this breakage is the IPU6 driver now crashing due to it getting DMA-addresses with address bit 32 set even though it has tried to set a 32 bit DMA mask. The IPU6 CSI2 engine has a DMA mask of either 31 or 32 bits depending on if it is in secure mode or not and it sets this masks like this: mmu_info->aperture_end = (dma_addr_t)DMA_BIT_MASK(isp->secure_mode ? IPU6_MMU_ADDR_BITS : IPU6_MMU_ADDR_BITS_NON_SECURE); So the 'n' argument here is "isp->secure_mode ? IPU6_MMU_ADDR_BITS : IPU6_MMU_ADDR_BITS_NON_SECURE" which gets expanded into: isp->secure_mode ? IPU6_MMU_ADDR_BITS : IPU6_MMU_ADDR_BITS_NON_SECURE - 1 With the -1 only being applied in the non secure case, causing the secure mode mask to be one 1 bit too large. Fixes: a50f7456f853 ("dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope") Cc: Sakari Ailus Cc: James Clark Cc: Nathan Chancellor Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Reviewed-by: Nathan Chancellor Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251207184756.97904-1-johannes.goede@oss.qualcomm.com commit 463d439becb81383f3a5a5d840800131f265a09c Author: Dave Kleikamp Date: Tue Dec 2 09:28:10 2025 -0600 dma/pool: eliminate alloc_pages warning in atomic_pool_expand atomic_pool_expand iteratively tries the allocation while decrementing the page order. There is no need to issue a warning if an attempted allocation fails. Signed-off-by: Dave Kleikamp Reviewed-by: Robin Murphy Fixes: d7e673ec2c8e ("dma-pool: Only allocate from CMA when in same memory zone") [mszyprow: fixed typo] Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20251202152810.142370-1-dave.kleikamp@oracle.com commit 188d194be2bfe03afcc02c90d9d905b46a17f3ef Author: Bard Liao Date: Tue Oct 21 17:43:54 2025 +0800 soundwire: intel_ace2x: handle multi BPT sections Calculate required PDI buffer and pass the section number to the cdns BPT helpers. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Tested-by: Shuming Fan Link: https://patch.msgid.link/20251021094355.132943-4-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit fe8a9cf75c1efc659dbb5f53d744e6f4e8552dda Author: Bard Liao Date: Tue Oct 21 17:43:53 2025 +0800 soundwire: pass sdw_bpt_section to cdns BPT helpers We can get start_register, data_size, and buffer data from the new sdw_bpt_section parameter. Also, handle all register sections in the cdns BRA helpers. No function changes as section number is 1. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Tested-by: Shuming Fan Link: https://patch.msgid.link/20251021094355.132943-3-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit fdfa1960eee7591995cf877e9caf9cf5794ab91f Author: Bard Liao Date: Tue Oct 21 17:43:52 2025 +0800 soundwire: introduce BPT section Currently we send a BRA message with a start address with continuous registers in a BPT stream. However, a codec may need to write different register sections shortly. Introduce a register section in struct sdw_btp_msg which contain register start address, length, and buffer. This commit uses only 1 section for each BPT message. And we need to add up all BPT section length and check if it reach maximum BPT bytes. No function changes. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Tested-by: Shuming Fan Link: https://patch.msgid.link/20251021094355.132943-2-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 8931f5bce4f159a0dd438c093255d88cb8e00516 Author: Bard Liao Date: Thu Oct 30 15:02:53 2025 +0800 soundwire: intel_ace2x: add fake frame to BRA read command Intel DMA buffer size need to be a multiple of data block size. Find the minimal fake data size and extra buffer size to meet the requirement. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251030070253.1216871-8-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 9468bc0e1b95b6c737a79ae8aaeb87c16caeb3af Author: Bard Liao Date: Tue Oct 14 11:14:49 2025 +0800 soundwire: cadence_master: add fake_size parameter to sdw_cdns_prepare_read_dma_buffer We may need to add few fake frames to fit the aligned read dma buffer size. Add a fake_size parameter to allow the caller to set the fake data size. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251014031450.3781789-7-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 167efc6dfd621494c6a7e47115dc829dcc0e502c Author: Bard Liao Date: Tue Oct 14 11:14:48 2025 +0800 ASoC: SOF: Intel: export hda_sdw_bpt_get_buf_size_aligment The dma buffer need to be a multiple of data block size and the fifo size. Export a function to return the LCM of data block size and the fifo size. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251014031450.3781789-6-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 57b3a7b27e0b72df4ccee89719de12719aa9d547 Author: Bard Liao Date: Tue Oct 14 11:14:47 2025 +0800 soundwire: cadence: export sdw_cdns_bpt_find_bandwidth Currently, we calculate the required bandwidth after the PDI buffer size is calculated. However as we need to add some fake frame to align the data block size, the final PDI size and the frame number will change. Besides, we need the required bandwidth to decide the DMA channel number and the channel number will be used to calculate the data block size. Therefore, we calculate the required bandwidth and export a helper for the caller to get the required bandwidth. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251014031450.3781789-5-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 5a838e010c64b794ac990e9b19bfb0bf7083a1f2 Author: Bard Liao Date: Tue Oct 14 11:14:46 2025 +0800 soundwire: cadence_master: set data_per_frame as frame capability data_per_frame will be used for preparing the TX buffer and we may add some fake frames to ensure the data in the buffer will be flushed. So that it should indicate the frame capability even if the required data bytes are less than the frame capability. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251014031450.3781789-4-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 43b2a39183c738095a5f0b3f00fd2e57e5a48149 Author: Bard Liao Date: Tue Oct 14 11:14:45 2025 +0800 soundwire: only compute BPT stream in sdw_compute_dp0_port_params DP0 is only for BPT stream. We should not compute and update the port params of the normal audio streams. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251014031450.3781789-3-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit 4be4ac36f6ca5d3854049581be3aca20345bbe01 Author: Bard Liao Date: Tue Oct 14 11:14:44 2025 +0800 soundwire: cadence_master: make frame index trace more readable The existing code uses i as the frame index which is 0 based. And "bad frame %d/%d", i, num_frames where num_frames is 1 based. Change the frame index to i + 1 to align with num_frames and more readable. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20251014031450.3781789-2-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit b2bfe0fa1f85acd928eaa407a89411c01a4f87a8 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:25 2025 +0100 soundwire: qcom: adding support for v3.1.0 Add support for controller version v3.1.0, which has changes in register layout and some register fields compared to v2.0. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-8-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 66eca4b7d2d2d7b35625bea47f2ebdac2eab3615 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:24 2025 +0100 dt-bindings: soundwire: qcom: Document v3.1.0 version of IP block Add bindings for Soundwire controllers v3.1.0, which is available on Qualcomm Glymur SoC. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 6ed85ea1b17b0d2d1f345ded22891c8ca17a9ac8 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:23 2025 +0100 soundwire: qcom: prepare for v3.x cleanup the register layout structs to prepare for adding new 3.x controller support. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 9e53a66a2f2fd2c379fa1bd782e5cee37b0f75d3 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:22 2025 +0100 soundwire: qcom: deprecate qcom,din/out-ports Number of input and output ports can be dynamically read from the controller registers, getting this value from Device Tree is redundant and potentially lead to bugs. Remove the code parsing this property along with marking this as deprecated in device tree bindings. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 8114a05cdc20d3d8eb1b8639da33c193b53fe073 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:21 2025 +0100 dt-bindings: soundwire: qcom: deprecate qcom,din/out-ports Number of input and output ports can be dynamically read from the controller registers, getting this value from Device Tree is redundant and potentially lead to bugs. Mark these two properties as deprecated in device tree bindings. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 6504fe8cd21f624fcf21d3b60e64cf10d213cf75 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:20 2025 +0100 soundwire: qcom: remove unused rd_fifo_depth remove read fifo depth field parsing logic, as rd_fifo_depth is never used in the driver. Cleaning this up would benefit when adding new variant support which includes adding variant fields for rd_fifo_depth. ex: Glymur has this rd_fifo_depth register fields changed from v2.x Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 18223eececd66365c12275f09042e6fcb2ac5748 Author: Srinivas Kandagatla Date: Fri Sep 12 09:32:19 2025 +0100 of: base: Add of_property_read_u8_index Add support for of_property_read_u8_index(), simillar to others u16 and u32 variants. Having this helper makes the code more tidy in isome cases, specially when we are parsing multiple of these into data structures. Signed-off-by: Srinivas Kandagatla Reviewed-by: Rob Herring (Arm) Tested-by: Alexey Klimov # sm8550 Link: https://patch.msgid.link/20250912083225.228778-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Vinod Koul commit 2d967310c49ed93ac11cef408a55ddf15c3dd52e Author: Askar Safin Date: Sat Dec 6 18:04:13 2025 +0000 gpiolib: acpi: Add quirk for Dell Precision 7780 Dell Precision 7780 often wakes up on its own from suspend. Sometimes wake up happens immediately (i. e. within 7 seconds), sometimes it happens after, say, 30 minutes. Fixes: 1796f808e4bb ("HID: i2c-hid: acpi: Stop setting wakeup_capable") Link: https://lore.kernel.org/linux-i2c/197ae95ffd8.dc819e60457077.7692120488609091556@zohomail.com/ Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: Askar Safin Link: https://lore.kernel.org/r/20251206180414.3183334-2-safinaskar@gmail.com Signed-off-by: Bartosz Golaszewski commit eaa0870387f9ecbd2992ca58e73f3c7768815e8b Author: Frank Li Date: Wed Dec 3 15:45:50 2025 -0500 i3c: master: switch to use new callback .i3c_xfers() from .priv_xfers() Switch to use the new .i3c_xfers() callback, which supports all I3C transfer modes (SDR and HDR). Also replace struct i3c_priv_xfer with the new struct i3c_xfer, as i3c_priv_xfer is now an alias of i3c_xfer. No functional changes. Signed-off-by: Frank Li Tested-by: Tommaso Merciai Link: https://patch.msgid.link/20251203-i3c_xfer_cleanup_master-v2-1-7dd94d04ee2d@nxp.com Signed-off-by: Alexandre Belloni commit c2f2b01b74be8b40a2173372bcd770723f87e7b2 Merge: ba65a4e7120a61 79c3ae7ada0548 Author: Linus Torvalds Date: Mon Dec 8 11:25:14 2025 +0900 Merge tag 'i3c/for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "HDR support has finally been added. mipi-i3c-hci has been reworked and Intel Nova Lake-S support has been added. Subsystem: - Add HDR transfer support Drivers: - dw: fix bus hang on Agilex5 - mipi-i3c-hci: Intel Nova Lake-S support, IOMMU support - svc: HDR support" * tag 'i3c/for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (28 commits) regmap: i3c: switch to use i3c_xfer from i3c_priv_xfer net: mctp i3c: switch to use i3c_xfer from i3c_priv_xfer hwmon: (lm75): switch to use i3c_xfer from i3c_priv_xfer i3c: document i3c_xfers i3c: fix I3C_SDR bit number i3c: master: svc: Add basic HDR mode support i3c: master: svc: Replace bool rnw with union for HDR support i3c: Switch to use new i3c_xfer from i3c_priv_xfer i3c: Add HDR API support i3c: master: add WQ_PERCPU to alloc_workqueue users i3c: master: Remove i3c_device_free_ibi from i3c_device_remove i3c: mipi-i3c-hci-pci: Set d3cold_delay to 0 for Intel controllers i3c: mipi-i3c-hci-pci: Add LTR support for Intel controllers i3c: mipi-i3c-hci-pci: Add exit callback i3c: mipi-i3c-hci-pci: Change callback parameter i3c: mipi-i3c-hci-pci: Allocate a structure for mipi_i3c_hci_pci device information i3c: mipi-i3c-hci-pci: Factor out intel_reset() i3c: mipi-i3c-hci-pci: Factor out private registers ioremapping i3c: mipi-i3c-hci-pci: Constify driver data i3c: mipi-i3c-hci-pci: Use readl_poll_timeout() ... commit 25faa5364638b86ec0d0edb4486daa9d40a0be8f Author: Troy Mitchell Date: Thu Nov 13 21:21:50 2025 +0800 i2c: spacemit: fix detect issue This commit addresses two issues causing i2c detect to fail. The identified issues are: 1. Incorrect error handling for BED (Bus Error No ACK/NAK): Before this commit, Both ALD (Arbitration Loss Detected) and BED returned -EAGAIN. 2. Missing interrupt status clear after initialization in xfer(): On the K1 SoC, simply fixing the first issue changed the error from -EAGAIN to -ETIMEOUT. Through tracing, it was determined that this is likely due to MSD (Master Stop Detected) latency issues. That means the MSD bit in the ISR may still be set on the next transfer. As a result, the controller won't work — we can see from the scope that it doesn't issue any signal. (This only occurs during rapid consecutive I2C transfers. That explains why the issue only shows up with i2cdetect.) With these two fixes, i2c device detection now functions correctly on the K1 SoC. Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC") Tested-by: Aurelien Jarno Signed-off-by: Troy Mitchell Reviewed-by: Aurelien Jarno Tested-by: Michael Opdenacker Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251113-fix-k1-detect-failure-v2-1-b02a9a74f65a@linux.spacemit.com commit a6ee6aac66fb394b7f6e6187c73bdcd873f2d139 Author: Ma Ke Date: Wed Oct 22 17:54:02 2025 +0800 i2c: amd-mp2: fix reference leak in MP2 PCI device In i2c_amd_probe(), amd_mp2_find_device() utilizes driver_find_next_device() which internally calls driver_find_device() to locate the matching device. driver_find_device() increments the reference count of the found device by calling get_device(), but amd_mp2_find_device() fails to call put_device() to decrement the reference count before returning. This results in a reference count leak of the PCI device each time i2c_amd_probe() is executed, which may prevent the device from being properly released and cause a memory leak. Found by code review. Cc: stable@vger.kernel.org Fixes: 529766e0a011 ("i2c: Add drivers for the AMD PCIe MP2 I2C controller") Signed-off-by: Ma Ke Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20251022095402.8846-1-make24@iscas.ac.cn commit ba65a4e7120a616d9c592750d9147f6dcafedffa Merge: 67a454e6b1c604 6f172175b6f3fe Author: Linus Torvalds Date: Mon Dec 8 09:38:52 2025 +0900 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This is entirely SoC clk drivers. The majority diff wise is for the new Rockchip and Qualcomm clk drivers which is mostly lines and lines of data structures to describe the clk hardware in these SoCs. Beyond those two, Renesas continues to incrementally add clks to their SoC drivers, causing them to show up higher in the diffstat this time because they added quite a few clks all over the place. Overall it is a semi-quiet release that has some new clk drivers and the usual fixes for clock data that was wrong or missing and non-critical cleanups that plug error paths or fix typos. New Drivers: - Qualcomm IPQ5424 Network Subsystem Clock Controller - Qualcomm SM8750 Video Clock Controller - Rockchip RV1126B and RK3506 clock drivers - i.MX8ULP SIM LPAV clock driver - Samsung ACPM (firmware interface) clock driver - Altera Agilex5 clock driver" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (117 commits) clk: keystone: fix compile testing clk: keystone: syscon-clk: fix regmap leak on probe failure clk: qcom: Mark camcc_sm7150_hws static clk: samsung: exynos-clkout: Assign .num before accessing .hws clk: rockchip: Add clock and reset driver for RK3506 dt-bindings: clock: rockchip: Add RK3506 clock and reset unit clk: actions: Fix discarding const qualifier by 'container_of' macro clk: spacemit: Set clk_hw_onecell_data::num before using flex array clk: visconti: Add VIIF clocks dt-bindings: clock: tmpv770x: Add VIIF clocks dt-bindings: clock: tmpv770x: Remove definition of number of clocks clk: visconti: Do not define number of clocks in bindings clk: rockchip: Add clock controller for the RV1126B dt-bindings: clock, reset: Add support for rv1126b clk: rockchip: Implement rockchip_clk_register_armclk_multi_pll() clk: qcom: x1e80100-dispcc: Add USB4 router link resets dt-bindings: clock: qcom: x1e80100-dispcc: Add USB4 router link resets clk: qcom: videocc-sm8750: Add video clock controller driver for SM8750 dt-bindings: clock: qcom: Add SM8750 video clock controller clk: qcom: branch: Extend invert logic for branch2 mem clocks ... commit 08bfcf4ff9d39228150a757803fc02dffce84ab0 Author: Kathara Sasikumar Date: Fri Dec 5 21:58:35 2025 +0000 docs: hwmon: fix link to g762 devicetree binding The devicetree binding for g762 was converted to YAML to match vendor prefix conventions. Update the reference accordingly. Signed-off-by: Kathara Sasikumar Link: https://lore.kernel.org/r/20251205215835.783273-1-katharasasikumar007@gmail.com Fixes: 3d8e25372417 ("dt-bindings: hwmon: g762: Convert to yaml schema") Signed-off-by: Guenter Roeck commit 4910da6b36b122db50a27fabf6ab7f8611b60bf8 Author: Pei Xiao Date: Fri Dec 5 11:15:13 2025 +0800 hwmon: (emc2305) fix device node refcount leak in error path The for_each_child_of_node() macro automatically manages device node reference counts during normal iteration. However, when breaking out of the loop early with return, the current iteration's node is not automatically released, leading to a reference count leak. Fix this by adding of_node_put(child) before returning from the loop when emc2305_set_single_tz() fails. This issue could lead to memory leaks over multiple probe cycles. Signed-off-by: Pei Xiao Link: https://lore.kernel.org/r/tencent_5CDC08544C901D5ECA270573D5AEE3117108@qq.com Signed-off-by: Guenter Roeck commit 541dfb49dcb80c2509e030842de77adfb77820f5 Author: Pei Xiao Date: Fri Dec 5 10:02:41 2025 +0800 hwmon: (emc2305) fix double put in emc2305_probe_childs_from_dt ./drivers/hwmon/emc2305.c:597:4-15: ERROR: probable double put Device node iterators put the previous value of the index variable, so an explicit put causes a double put. Signed-off-by: Pei Xiao Link: https://lore.kernel.org/r/tencent_CD373F952BE48697C949E39CB5EB77841D06@qq.com Signed-off-by: Guenter Roeck commit fae00a7186cecf90a57757a63b97a0cbcf384fe9 Author: Armin Wolf Date: Wed Dec 3 21:21:09 2025 +0100 hwmon: (dell-smm) Fix off-by-one error in dell_smm_is_visible() The documentation states that on machines supporting only global fan mode control, the pwmX_enable attributes should only be created for the first fan channel (pwm1_enable, aka channel 0). Fix the off-by-one error caused by the fact that fan channels have a zero-based index. Cc: stable@vger.kernel.org Fixes: 1c1658058c99 ("hwmon: (dell-smm) Add support for automatic fan mode") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20251203202109.331528-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck commit 670d7ef945d3a84683594429aea6ab2cdfa5ceb4 Author: Gui-Dong Han Date: Wed Dec 3 02:01:05 2025 +0800 hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially causing divide-by-zero errors. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Additionally, in store_fan_div, move the calculation of the minimum limit inside the update lock. This ensures that the read-modify-write sequence operates on consistent data. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Fixes: 9873964d6eb2 ("[PATCH] HWMON: w83791d: New hardware monitoring driver for the Winbond W83791D") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251202180105.12842-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit d8f52650b24d9018dfb65d2c60e17636b077e63e Author: ChenXiaoSong Date: Sat Dec 6 23:18:25 2025 +0800 smb/client: update some SMB2 status strings The smb2maperror KUnit tests reported the following errors: KTAP version 1 1..1 KTAP version 1 # Subtest: smb2_maperror # module: cifs 1..2 ok 1 maperror_test_check_sort # maperror_test_check_search: EXPECTATION FAILED at fs/smb/client/smb2maperror_test.c:40 Expected expect->status_string == result->status_string, but expect->status_string == "STATUS_ABANDONED_WAIT_0" result->status_string == "STATUS_ABANDONED" # maperror_test_check_search: EXPECTATION FAILED at fs/smb/client/smb2maperror_test.c:40 Expected expect->status_string == result->status_string, but expect->status_string == "STATUS_FWP_TOO_MANY_CALLOUTS" result->status_string == "STATUS_FWP_TOO_MANY_BOOTTIME_FILTERS" not ok 2 maperror_test_check_search # smb2_maperror: pass:1 fail:1 skip:0 total:2 # Totals: pass:1 fail:1 skip:0 total:2 not ok 1 smb2_maperror These status codes have duplicate values, so update the status strings to make the log messages more explicit. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 0f35040de59371ad542b915d7b91176c9910dadc Author: Harry Yoo Date: Mon Dec 8 00:41:47 2025 +0900 mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction Currently, kvfree_rcu_barrier() flushes RCU sheaves across all slab caches when a cache is destroyed. This is unnecessary; only the RCU sheaves belonging to the cache being destroyed need to be flushed. As suggested by Vlastimil Babka, introduce a weaker form of kvfree_rcu_barrier() that operates on a specific slab cache. Factor out flush_rcu_sheaves_on_cache() from flush_all_rcu_sheaves() and call it from flush_all_rcu_sheaves() and kvfree_rcu_barrier_on_cache(). Call kvfree_rcu_barrier_on_cache() instead of kvfree_rcu_barrier() on cache destruction. The performance benefit is evaluated on a 12 core 24 threads AMD Ryzen 5900X machine (1 socket), by loading slub_kunit module. Before: Total calls: 19 Average latency (us): 18127 Total time (us): 344414 After: Total calls: 19 Average latency (us): 10066 Total time (us): 191264 Two performance regression have been reported: - stress module loader test's runtime increases by 50-60% (Daniel) - internal graphics test's runtime on Tegra234 increases by 35% (Jon) They are fixed by this change. Suggested-by: Vlastimil Babka Fixes: ec66e0d59952 ("slab: add sheaf support for batching kfree_rcu() operations") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-mm/1bda09da-93be-4737-aef0-d47f8c5c9301@suse.cz Reported-and-tested-by: Daniel Gomez Closes: https://lore.kernel.org/linux-mm/0406562e-2066-4cf8-9902-b2b0616dd742@kernel.org Reported-and-tested-by: Jon Hunter Closes: https://lore.kernel.org/linux-mm/e988eff6-1287-425e-a06c-805af5bbf262@nvidia.com Signed-off-by: Harry Yoo Link: https://patch.msgid.link/20251207154148.117723-1-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka commit 67a454e6b1c604555c04501c77b7fedc5d98a779 Merge: bbbf7f32843b57 83c8f7b5e194ea Author: Linus Torvalds Date: Sun Dec 7 08:56:10 2025 -0800 Merge tag 'memblock-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock update from Mike Rapoport: "Introduce a 'check_pages' boot parameter to decouple simple checks for page state on allocation and free from CONFIG_DEBUG_VM. This allows enabling page checking without building kernel with CONFIG_DEBUG_VM or forcing init_on_{alloc, free} or other heavier mechanisms" * tag 'memblock-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: mm/mm_init: Introduce a boot parameter for check_pages commit bbbf7f32843b5788786cd8d91e9430823c2777c9 Merge: 9e906a9dead17d 3e281113f871d7 Author: Linus Torvalds Date: Sun Dec 7 08:29:09 2025 -0800 Merge tag '9p-for-6.19-rc1' of https://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: - fix a bug with O_APPEND in cached mode causing data to be written multiple times on server - use kvmalloc for trans_fd to avoid problems with large msize and fragmented memory This should hopefully be used in more transports when time allows - convert to new mount API - minor cleanups * tag '9p-for-6.19-rc1' of https://github.com/martinetd/linux: 9p: fix new mount API cache option handling 9p: fix cache/debug options printing in v9fs_show_options 9p: convert to the new mount API 9p: create a v9fs_context structure to hold parsed options net/9p: move structures and macros to header files fs/fs_parse: add back fsparam_u32hex fs/9p: delete unnnecessary condition fs/9p: Don't open remote file with APPEND mode when writeback cache is used net/9p: cleanup: change p9_trans_module->def to bool 9p: Use kvmalloc for message buffers on supported transports commit f770950a4709af290f314e691897ec0003fbd8ae Author: Tobias Schumacher Date: Thu Dec 4 06:05:02 2025 +0100 s390/pci: Migrate s390 IRQ logic to IRQ domain API s390 is one of the last architectures using the legacy API for setup and teardown of PCI MSI IRQs. Migrate the s390 IRQ allocation and teardown to the MSI parent domain API. For details, see: https://lore.kernel.org/lkml/20221111120501.026511281@linutronix.de In detail, create an MSI parent domain for each PCI domain. When a PCI device sets up MSI or MSI-X IRQs, the library creates a per-device IRQ domain for this device, which is used by the device for allocating and freeing IRQs. The per-device domain delegates this allocation and freeing to the parent-domain. In the end, the corresponding callbacks of the parent domain are responsible for allocating and freeing the IRQs. The allocation is split into two parts: - zpci_msi_prepare() is called once for each device and allocates the required resources. On s390, each PCI function has its own airq vector and a summary bit, which must be configured once per function. This is done in prepare(). - zpci_msi_alloc() can be called multiple times for allocating one or more MSI/MSI-X IRQs. This creates a mapping between the virtual IRQ number in the kernel and the hardware IRQ number. Freeing is split into two counterparts: - zpci_msi_free() reverts the effects of zpci_msi_alloc() and - zpci_msi_teardown() reverts the effects of zpci_msi_prepare(). This is called once when all IRQs are freed before a device is removed. Since the parent domain in the end allocates the IRQs, the hwirq encoding must be unambiguous for all IRQs of all devices. This is achieved by encoding the hwirq using the devfn and the MSI index. Reviewed-by: Niklas Schnelle Reviewed-by: Farhan Ali Signed-off-by: Tobias Schumacher Reviewed-by: Gerd Bayer Signed-off-by: Heiko Carstens commit 455a65260f526cedd4680d4836ebdf2eaf1ab4c6 Author: Tobias Schumacher Date: Thu Dec 4 06:05:01 2025 +0100 genirq: Change hwirq parameter to irq_hw_number_t The irqdomain implementation internally represents hardware IRQs as irq_hw_number_t, which is defined as unsigned long int. When providing an irq_hw_number_t to the generic_handle_domain() functions that expect and unsigned int hwirq, this can lead to a loss of information. Change the hwirq parameter to irq_hw_number_t to support the full range of hwirqs. Reviewed-by: Thomas Gleixner Reviewed-by: Niklas Schnelle Reviewed-by: Farhan Ali Signed-off-by: Tobias Schumacher Signed-off-by: Heiko Carstens commit eb9780a1a3c4ffc1f383991ce3fc50da1fe4390d Author: Heiko Carstens Date: Fri Nov 28 10:25:29 2025 +0100 s390: Select POSIX_CPU_TIMERS_TASK_WORK After support for VIRT_XFER_TO_GUEST_WORK is available for s390 it is possible to also select HAVE_POSIX_CPU_TIMERS_TASK_WORK. See [1] for the reasons why it makes sense, also for architectures which do not support PREEMPT_RT. [1] https://lore.kernel.org/all/20200716201923.228696399@linutronix.de Signed-off-by: Heiko Carstens commit 8543ecc0e03b9367e36a93d82bdef0bf5a16dc56 Author: Vasily Gorbik Date: Fri Nov 28 23:01:08 2025 +0100 s390: Unmap early KASAN shadow on memory offlining Teach the memory hotplug path to tear down KASAN shadow that was mapped during early boot when a memory block is offlined. Track for each sclp_mem whether its range was covered by the early KASAN shadow via an early_shadow_mapped flag. When such a block is deconfigured and removed via sclp_config_mem_store(), compute the corresponding shadow range and call vmemmap_free() to unmap the boot mapped shadow, then clear the flag. Using vmemmap_free() for the early shadow is safe despite the use of large mappings in the boot-time KASAN setup. The initial shadow is mapped with 1M and 2G pages, where possible. The minimum hotplug memory block size is 128M and always aligned (the identity mapping is at least 2G aligned), which corresponds to a 16M chunk of at least 1M aligned shadow. PMD-mapped 1M shadow pages therefore never need splitting, and PUD-mapped 2G shadow pages can now be split following the preceding changes. Relax the modify_pagetable() sanity check in vmem so that, with KASAN enabled, it may also operate on the KASAN shadow region in addition to the 1:1 mapping and vmemmap area. This allows the KASAN shadow unmapping to reuse the common vmem helpers. Signed-off-by: Vasily Gorbik Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 6a35d02fec5a1e2ab6c0c94ccc5b0c57a580b098 Author: Vasily Gorbik Date: Fri Nov 28 23:01:05 2025 +0100 s390/vmem: Support 2G page splitting for KASAN shadow freeing Export split_pud_page() so it can be used from the vmem code and teach modify_pud_table() to split PUD-sized mappings when only a subrange needs to be removed. If the range to be removed covers a full PUD-sized mapping, keep the existing behavior: clear the PUD entry and free the backing large page (for non-direct mappings). Otherwise, split the PUD-mapped page into PMD mappings and let the walker handle the smaller ranges. This is needed for KASAN early shadow removal support: memory hotplug freeing the KASAN early shadow is the only expected caller that will try to free 2G PUD-mapped regions of non-direct mappings. Signed-off-by: Vasily Gorbik Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 1442bb87b878f889442c7e8e83d9125e31ef5072 Author: Vasily Gorbik Date: Fri Nov 28 23:01:02 2025 +0100 s390/boot: Use entire page for PTEs Make boot_pte_alloc() always allocate a full PAGE_SIZE page for PTE tables, instead of carving two 2K PTE tables out of a single 4K page, similar to commit daa8af80d283 ("s390/mm: Allocate page table with PAGE_SIZE granularity"). This mirrors the change in the vmem code and ensures that boot page tables backing the early KASAN shadow can later be fully freed by the vmem page-table teardown helpers (e.g. when unmapping early KASAN shadow on memory hotplug). The leftover-based allocation was originally added to reduce physmem allocator fragmentation when EDAT was disabled. On current hardware EDAT1 is available on all production systems, so the complexity is no longer justified and gets in the way of freeing the shadow mappings. Signed-off-by: Vasily Gorbik Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit d9f59178011265344a4864757cf21523668a2a75 Author: Heiko Carstens Date: Tue Oct 7 11:05:06 2025 +0200 s390/vmur: Use scnprintf() instead of sprintf() Use scnprintf() instead of sprintf() for those cases where the destination is an array and the size of the array is known at compile time. This prevents theoretical buffer overflows, but also avoids that people again and again spend time to figure out if the code is actually safe. Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 9e906a9dead17d81d6c2687f65e159231d0e3286 Merge: 37bb2e7217b014 2eeb09fe1c5173 Author: Linus Torvalds Date: Sun Dec 7 07:07:02 2025 -0800 Merge tag 'perf-tools-for-v6.19-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Namhyung Kim: "Perf event/metric description: Unify all event and metric descriptions in JSON format. Now event parsing and handling is greatly simplified by that. From users point of view, perf list will provide richer information about hardware events like the following. $ perf list hw List of pre-defined events (to be used in -e or -M): legacy hardware: branch-instructions [Retired branch instructions [This event is an alias of branches]. Unit: cpu] branch-misses [Mispredicted branch instructions. Unit: cpu] branches [Retired branch instructions [This event is an alias of branch-instructions]. Unit: cpu] bus-cycles [Bus cycles,which can be different from total cycles. Unit: cpu] cache-misses [Cache misses. Usually this indicates Last Level Cache misses; this is intended to be used in conjunction with the PERF_COUNT_HW_CACHE_REFERENCES event to calculate cache miss rates. Unit: cpu] cache-references [Cache accesses. Usually this indicates Last Level Cache accesses but this may vary depending on your CPU. This may include prefetches and coherency messages; again this depends on the design of your CPU. Unit: cpu] cpu-cycles [Total cycles. Be wary of what happens during CPU frequency scaling [This event is an alias of cycles]. Unit: cpu] cycles [Total cycles. Be wary of what happens during CPU frequency scaling [This event is an alias of cpu-cycles]. Unit: cpu] instructions [Retired instructions. Be careful,these can be affected by various issues,most notably hardware interrupt counts. Unit: cpu] ref-cycles [Total cycles; not affected by CPU frequency scaling. Unit: cpu] But most notable changes would be in the perf stat. On the right side, the default metrics are better named and aligned. :) $ perf stat -- perf test -w noploop Performance counter stats for 'perf test -w noploop': 11 context-switches # 10.8 cs/sec cs_per_second 0 cpu-migrations # 0.0 migrations/sec migrations_per_second 3,612 page-faults # 3532.5 faults/sec page_faults_per_second 1,022.51 msec task-clock # 1.0 CPUs CPUs_utilized 110,466 branch-misses # 0.0 % branch_miss_rate (88.66%) 6,934,452,104 branches # 6781.8 M/sec branch_frequency (88.66%) 4,657,032,590 cpu-cycles # 4.6 GHz cycles_frequency (88.65%) 27,755,874,218 instructions # 6.0 instructions insn_per_cycle (89.03%) TopdownL1 # 0.3 % tma_backend_bound # 9.3 % tma_bad_speculation (89.05%) # 9.7 % tma_frontend_bound (77.86%) # 80.7 % tma_retiring (88.81%) 1.025318171 seconds time elapsed 1.013248000 seconds user 0.012014000 seconds sys Deferred unwinding support: With the kernel support (commit c69993ecdd4d: "perf: Support deferred user unwind"), perf can use deferred callchains for userspace stack trace with frame pointers like below: $ perf record --call-graph fp,defer ... This will be transparent to users when it comes to other commands like perf report and perf script. They will merge the deferred callchains to the previous samples as if they were collected together. ARM SPE updates - Extensive enhancements to support various kinds of memory operations including GCS, MTE allocation tags, memcpy/memset, register access, and SIMD operations. - Add inverted data source filter (inv_data_src_filter) support to exclude certain data sources. - Improve documentation. Vendor event updates: - Intel: Updated event files for Sierra Forest, Panther Lake, Meteor Lake, Lunar Lake, Granite Rapids, and others. - Arm64: Added metrics for i.MX94 DDR PMU and Cortex-A720AE definitions. - RISC-V: Added JSON support for T-HEAD C920V2. Misc: - Improve pointer tracking in data type profiling. It'd give better output when the variable is using container_of() to convert type. - Annotation support for perf c2c report in TUI. Press 'a' key to enter annotation view from cacheline browser window. This will show which instruction is causing the cacheline contention. - Lots of fixes and test coverage improvements!" * tag 'perf-tools-for-v6.19-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (214 commits) libperf: Use 'extern' in LIBPERF_API visibility macro perf stat: Improve handling of termination by signal perf tests stat: Add test for error for an offline CPU perf stat: When no events, don't report an error if there is none perf tests stat: Add "--null" coverage perf cpumap: Add "any" CPU handling to cpu_map__snprint_mask libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map perf stat: Allow no events to open if this is a "--null" run perf test kvm: Add some basic perf kvm test coverage perf tests evlist: Add basic evlist test perf tests script dlfilter: Add a dlfilter test perf tests kallsyms: Add basic kallsyms test perf tests timechart: Add a perf timechart test perf tests top: Add basic perf top coverage test perf tests buildid: Add purge and remove testing perf tests c2c: Add a basic c2c perf c2c: Clean up some defensive gets and make asan clean perf jitdump: Fix missed dso__put perf mem-events: Don't leak online CPU map perf hist: In init, ensure mem_info is put on error paths ... commit 74ac7558ea7630113f0477cff1c718f5b1f54ec8 Author: David Heidelberg Date: Wed Dec 3 23:34:10 2025 +0100 ALSA: Do not build obsolete API ALSA 0.9.0-rc3 is from 2002, 23 years old. Signed-off-by: David Heidelberg Reviewed-by: Janusz Krzysztofik Reviewed-by: Christophe Leroy (CS GROUP) Acked-by: Christophe Leroy (CS GROUP) Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251203-old-alsa-v1-1-ac80704f52c3@ixit.cz commit d91e9bd10125a9b0427420453b11f56228a6d6d0 Author: Joakim Zhang Date: Fri Dec 5 23:46:21 2025 +0800 ALSA: hda: add CIX IPBLOQ HDA controller support Add CIX IPBLOQ HDA controller support, which is integrated into CIX SKY1 audio subsystem. HDA controller supports 64bit, but the audio subsystem can only 32bit transaction. Use jack polling mode as there is a hardware issue, lead to interrupt strom if the RIRB interrupt enabled. Host and hdac has different view of memory, so need do dma address translation. Signed-off-by: Joakim Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251205154621.3019640-4-joakim.zhang@cixtech.com commit a4f2fa516e83f11c3792405599613c12efe6135e Author: Joakim Zhang Date: Fri Dec 5 23:46:20 2025 +0800 ALSA: hda/core: add addr_offset field for bus address translation Add bus addr_offset field for dma address translation, for some SoCs such as CIX SKY1 which is ARM64 Arch, HOST and HDAC has different memory view, so need to do dma address translation between HOST and HDAC. Signed-off-by: Joakim Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251205154621.3019640-3-joakim.zhang@cixtech.com commit 85a6544777e0f57cce902f7217a377eb74b7d1a4 Author: Joakim Zhang Date: Fri Dec 5 23:46:19 2025 +0800 ALSA: hda: dt-bindings: add CIX IPBLOQ HDA controller support Add CIX IPBLOQ HDA controller support, which is integrated into CIX SKY1 audio subsystem. HDA controller supports 64bit, but the audio subsystem can only 32bit transaction. Use jack polling mode as there is a hardware issue, lead to interrupt strom if the RIRB interrupt enabled. Host and hdac has different view of memory, so need do dma address translation. Signed-off-by: Joakim Zhang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251205154621.3019640-2-joakim.zhang@cixtech.com commit 826c0b1ed09e5335abcae07292440ce72346e578 Author: Stefan Binding Date: Fri Dec 5 15:05:55 2025 +0000 ALSA: hda/realtek: Add support for ASUS UM3406GA Laptops use 2 CS35L41 Amps with HDA, using External boost, with I2C Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20251205150614.49590-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit f8b1ff655586846103ef890b53527dace4f45eff Author: Stefan Binding Date: Fri Dec 5 15:05:54 2025 +0000 ALSA: hda/realtek: Add support for HP Turbine Laptops Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20251205150614.49590-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 37bb2e7217b01404e2abf9d90d8e5705a5603b52 Merge: f5e9d31e79c1ce 502ddcc405b69f Author: Linus Torvalds Date: Sat Dec 6 18:52:00 2025 -0800 Merge tag 'staging-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the big set of staging driver updates for 6.19-rc1. Only thing "major" in here is that two subsystems, gpib and vc04 have moved out of the staging tree into the "real" portion of the kernel, which is great to see. Other than that, the rest of the changes are just tiny coding style cleanups, nothing earth-shattering. All of these have been in linux-next for a while with no reported problems" * tag 'staging-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (53 commits) staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser staging: gpib: Clean-up commented-out code staging: rtl8723bs: remove custom FIELD_OFFSET macro staging: rtl8723bs: replace FIELD_OFFSET usage with offsetof in rtw_mlme_ext.c staging: rtl8723bs: remove dead commented code from odm.c staging: rtl8723bs: use standard offsetof in cfg80211 operations staging: rtl8723bs: remove unused registry and BSSID offset macros staging: rtl8723bs: core: delete commented-out code staging: rtl8723bs: core: fix block comment style issues staging: greybus: uart: check return values during probe staging: fbtft: core: fix potential memory leak in fbtft_probe_common() staging: gpib: Destage gpib staging: gpib: Fix SPDX license for gpib headers staging: gpib: Update TODO file staging: gpib: Change // comments in uapi header file platform/raspberrypi: Destage VCHIQ MMAL driver platform/raspberrypi: Destage VCHIQ interface staging: vc04_services: Cleanup VCHIQ TODO entries ... commit f5e9d31e79c1ce8ba948ecac74d75e9c8d2f0c87 Merge: edf602a17b03e6 2585973c7f9ee3 Author: Linus Torvalds Date: Sat Dec 6 18:42:12 2025 -0800 Merge tag 'usb-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver updates for 6.19-rc1. Nothing major here, just lots of tiny updates for most of the common USB drivers. Included in here are: - more xhci driver updates and fixes - Thunderbolt driver cleanups - usb serial driver updates - typec driver updates - USB tracepoint additions - dwc3 driver updates, including support for Apple hardware - lots of other smaller driver updates and cleanups All of these have been in linux-next for a while with no reported issues" * tag 'usb-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (161 commits) usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt USB: serial: option: move Telit 0x10c7 composition in the right place USB: serial: option: add Telit Cinterion FE910C04 new compositions usb: typec: ucsi: fix use-after-free caused by uec->work usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() usb: dwc3: core: Remove redundant comment in core init usb: phy: Initialize struct usb_phy list_head USB: serial: option: add Foxconn T99W760 usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. usb: typec: hd3ss3220: Enable VBUS based on ID pin state dt-bindings: usb: ti,hd3ss3220: Add support for VBUS based on ID state usb: typec: anx7411: add WQ_PERCPU to alloc_workqueue users USB: add WQ_PERCPU to alloc_workqueue users dt-bindings: usb: dwc3-xilinx: Describe the reset constraint for the versal platform drivers/usb/storage: use min() instead of min_t() usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE usb: ohci-da8xx: remove unused platform data usb: gadget: functionfs: use dma_buf_unmap_attachment_unlocked() helper usb: uas: reduce time under spinlock usb: dwc3: eic7700: Add EIC7700 USB driver ... commit edf602a17b03e6bca31c48f34ac8fc3341503ac1 Merge: 83bd89291f5cc8 75a9f4c54770f0 Author: Linus Torvalds Date: Sat Dec 6 18:38:19 2025 -0800 Merge tag 'tty-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the big set of tty/serial driver changes for 6.19-rc1. Nothing major at all, just small constant churn to make the tty layer "cleaner" as well as serial driver updates and even a new test added! Included in here are: - More tty/serial cleanups from Jiri - tty tiocsti test added to hopefully ensure we don't regress in this area again - sc16is7xx driver updates - imx serial driver updates - 8250 driver updates - new hardware device ids added - other minor serial/tty driver cleanups and tweaks All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (60 commits) serial: sh-sci: Fix deadlock during RSCI FIFO overrun error dt-bindings: serial: rsci: Drop "uart-has-rtscts: false" LoongArch: dts: Add uart new compatible string serial: 8250: Add Loongson uart driver support dt-bindings: serial: 8250: Add Loongson uart compatible serial: 8250: add driver for KEBA UART serial: Keep rs485 settings for devices without firmware node serial: qcom-geni: Enable Serial on SA8255p Qualcomm platforms serial: qcom-geni: Enable PM runtime for serial driver serial: sprd: Return -EPROBE_DEFER when uart clock is not ready tty: serial: samsung: Declare earlycon for Exynos850 serial: icom: Convert PCIBIOS_* return codes to errnos serial: 8250-of: Fix style issues in 8250_of.c serial: add support of CPCI cards serial: mux: Fix kernel doc for mux_poll() tty: replace use of system_unbound_wq with system_dfl_wq serial: 8250_platform: simplify IRQF_SHARED handling serial: 8250: make share_irqs local to 8250_platform serial: 8250: move skip_txen_test to core serial: drop SERIAL_8250_DEPRECATED_OPTIONS ... commit 83bd89291f5cc866f60d32c34e268896c7ba8a3d Merge: 701d7d782d9824 82d12088c297fa Author: Linus Torvalds Date: Sat Dec 6 18:34:24 2025 -0800 Merge tag 'char-misc-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/IIO driver updates from Greg KH: "Here is the big set of char/misc/iio driver updates for 6.19-rc1. Lots of stuff in here including: - lots of IIO driver updates, cleanups, and additions - large interconnect driver changes as they get converted over to a dynamic system of ids - coresight driver updates - mwave driver updates - binder driver updates and changes - comedi driver fixes now that the fuzzers are being set loose on them - nvmem driver updates - new uio driver addition - lots of other small char/misc driver updates, full details in the shortlog All of these have been in linux-next for a while now" * tag 'char-misc-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (304 commits) char: applicom: fix NULL pointer dereference in ac_ioctl hangcheck-timer: fix coding style spacing hangcheck-timer: Replace %Ld with %lld hangcheck-timer: replace printk(KERN_CRIT) with pr_crit uio: Add SVA support for PCI devices via uio_pci_generic_sva.c dt-bindings: slimbus: fix warning from example intel_th: Fix error handling in intel_th_output_open misc: rp1: Fix an error handling path in rp1_probe() char: xillybus: add WQ_UNBOUND to alloc_workqueue users misc: bh1770glc: use pm_runtime_resume_and_get() in power_state_store misc: cb710: Fix a NULL vs IS_ERR() check in probe() mux: mmio: Add suspend and resume support virt: acrn: split acrn_mmio_dev_res out of acrn_mmiodev greybus: gb-beagleplay: Fix timeout handling in bootloader functions greybus: add WQ_PERCPU to alloc_workqueue users char/mwave: drop typedefs char/mwave: drop printk wrapper char/mwave: remove printk tracing char/mwave: remove unneeded fops char/mwave: remove MWAVE_FUTZ_WITH_OTHER_DEVICES ifdeffery ... commit 701d7d782d98242a64cdeed90750f88ff733bc39 Merge: 50471f8b7371c9 89373f5695dc91 Author: Linus Torvalds Date: Sat Dec 6 18:28:52 2025 -0800 Merge tag 'spdx-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull SPDX License update from Greg KH: "Here is a single patch that updates the LGPL-2.1 license text with the "alternate" SPDX tags that are allowed for this license type" * tag 'spdx-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: LICENSES: Add modern form of the LGPL-2.1 tags to the usage guide section commit 50471f8b7371c95c72c168eb45e4f42f1514fd5e Merge: 0d1d44032f7b8b dca7da244349ee Author: Linus Torvalds Date: Sat Dec 6 16:24:52 2025 -0800 Merge tag 'parisc-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture updates from Helge Deller: "A fix which allows booting on the very old 710 workstations, and two fixes in the syscall entry/exit path which allow to execute 64-bit userspace binaries. Note that although we currently have a 64-bit (static) kernel to allow more than 4 GB physical RAM, there is no support for 64-bit userspace for parisc-linux yet, but Dave and Sven are making slowly progress to port and fix glibc and gcc. Summary: - Fix boot on 710 workstation by not reprogramming ASP chip - Fix 64bit userspace syscalls (64-bit userspace is still being developed) - minor code cleanups in asm/bug.h and perf_regs.c" * tag 'parisc-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Do not reprogram affinitiy on ASP chip parisc: Drop linux/kernel.h include from asm/bug.h header parisc: remove unneeded semicolon in perf_regs.c parisc: entry.S: fix space adjustment on interruption for 64-bit userspace parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() parisc: Drop padding fields and layers entries from inventory log commit 0d1d44032f7b8b9edb14e82315fdf504740940c1 Merge: c06c303832ecd5 164312662ae976 Author: Linus Torvalds Date: Sat Dec 6 15:41:26 2025 -0800 Merge tag 'fbdev-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "The Termius 10x18 console bitmap font has been added. It is good match for modern 13-16 inch laptop displays with resolutions like 1280x800 and 1440x900 pixels. The gbefb and tcx.c drivers got some fixes to restore X11 support, pxafb was not actually clamping input values and the ssd1307fb driver leaked memory in the failure path. The other patches convert some common drivers to use dev_info() and dev_dbg() instead of printk(). Summary: Framework updates: - fonts: Add Terminus 10x18 console font [Neilay Kharwadkar] Driver fixes: - gbefb: fix to use physical address instead of dma address [René Rebe] - tcx.c fix mem_map to correct smem_start offset [René Rebe] - pxafb: Fix multiple clamped values in pxafb_adjust_timing [Thorsten Blum] - ssd1307fb: fix potential page leak in ssd1307fb_probe() [Abdun Nihaal] Cleanups: - vga16fb: Request memory region [Javier Garcia] - vga16fb: replace printk() with dev_*() in probe [Vivek BalachandharTN] - vesafb, gxt4500fb, tridentfb: Use dev_dbg() instead of printk() [Javier Garcia] - i810: use dev_info() [Shi Hao]" * tag 'fbdev-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() fbdev: i810: use appopriate log interface dev_info fbdev: tridentfb: replace printk() with dev_*() in probe lib/fonts: Add Terminus 10x18 console font fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing fbdev: tcx.c fix mem_map to correct smem_start offset fbdev: gxt4500fb: Use dev_err instead of printk fbdev: gbefb: fix to use physical address instead of dma address fbdev: vesafb: Use dev_* fn's instead printk fbdev: vga16fb: Request memory region fbdev: vga16fb: replace printk() with dev_*() in probe commit c06c303832ecd5edef90c6817a6eb0eb7fed7a64 Author: Linus Torvalds Date: Sat Dec 6 15:28:11 2025 -0800 ocfs2: fix xattr array entry __counted_by error Commit 2f26f58df041 ("ocfs2: annotate flexible array members with __counted_by_le()") started annotating the flexible arrays used by ocfs2, and now gcc complains about ocfs2_reflink_xattr_header(): In function ‘fortify_memset_chk’, inlined from ‘ocfs2_reflink_xattr_header’ at fs/ocfs2/xattr.c:6365:5: include/linux/fortify-string.h:480:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] and it looks like the complaint is valid - even if the actual error message is somewhat confusing. The 'last' pointer points to past the end of the counted flex array, but is used as an actual 'last' entry rather than a 'one-past-last'. It looks like the code copied and cleared an extra entry (which is likely harmless in practice), but I don't know ocfs2 at all. Because it's also possible that the counted-by annotations are off-by-one, and so this needs checking by somebody who actually knows ocfs2. But in the meantime this fixes the build error, and certainly _looks_ sane. Cc: Dmitry Antipov Cc: Joseph Qi Cc: Heming Zhao Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 509d3f45847627f4c5cdce004c3ec79262b5239c Merge: 09670b8c38b37b aa514a297a0c17 Author: Linus Torvalds Date: Sat Dec 6 14:01:20 2025 -0800 Merge tag 'mm-nonmm-stable-2025-12-06-11-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: - "panic: sys_info: Refactor and fix a potential issue" (Andy Shevchenko) fixes a build issue and does some cleanup in ib/sys_info.c - "Implement mul_u64_u64_div_u64_roundup()" (David Laight) enhances the 64-bit math code on behalf of a PWM driver and beefs up the test module for these library functions - "scripts/gdb/symbols: make BPF debug info available to GDB" (Ilya Leoshkevich) makes BPF symbol names, sizes, and line numbers available to the GDB debugger - "Enable hung_task and lockup cases to dump system info on demand" (Feng Tang) adds a sysctl which can be used to cause additional info dumping when the hung-task and lockup detectors fire - "lib/base64: add generic encoder/decoder, migrate users" (Kuan-Wei Chiu) adds a general base64 encoder/decoder to lib/ and migrates several users away from their private implementations - "rbree: inline rb_first() and rb_last()" (Eric Dumazet) makes TCP a little faster - "liveupdate: Rework KHO for in-kernel users" (Pasha Tatashin) reworks the KEXEC Handover interfaces in preparation for Live Update Orchestrator (LUO), and possibly for other future clients - "kho: simplify state machine and enable dynamic updates" (Pasha Tatashin) increases the flexibility of KEXEC Handover. Also preparation for LUO - "Live Update Orchestrator" (Pasha Tatashin) is a major new feature targeted at cloud environments. Quoting the cover letter: This series introduces the Live Update Orchestrator, a kernel subsystem designed to facilitate live kernel updates using a kexec-based reboot. This capability is critical for cloud environments, allowing hypervisors to be updated with minimal downtime for running virtual machines. LUO achieves this by preserving the state of selected resources, such as memory, devices and their dependencies, across the kernel transition. As a key feature, this series includes support for preserving memfd file descriptors, which allows critical in-memory data, such as guest RAM or any other large memory region, to be maintained in RAM across the kexec reboot. Mike Rappaport merits a mention here, for his extensive review and testing work. - "kexec: reorganize kexec and kdump sysfs" (Sourabh Jain) moves the kexec and kdump sysfs entries from /sys/kernel/ to /sys/kernel/kexec/ and adds back-compatibility symlinks which can hopefully be removed one day - "kho: fixes for vmalloc restoration" (Mike Rapoport) fixes a BUG which was being hit during KHO restoration of vmalloc() regions * tag 'mm-nonmm-stable-2025-12-06-11-14' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (139 commits) calibrate: update header inclusion Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" vmcoreinfo: track and log recoverable hardware errors kho: fix restoring of contiguous ranges of order-0 pages kho: kho_restore_vmalloc: fix initialization of pages array MAINTAINERS: TPM DEVICE DRIVER: update the W-tag init: replace simple_strtoul with kstrtoul to improve lpj_setup KHO: fix boot failure due to kmemleak access to non-PRESENT pages Documentation/ABI: new kexec and kdump sysfs interface Documentation/ABI: mark old kexec sysfs deprecated kexec: move sysfs entries to /sys/kernel/kexec test_kho: always print restore status kho: free chunks using free_page() instead of kfree() selftests/liveupdate: add kexec test for multiple and empty sessions selftests/liveupdate: add simple kexec-based selftest for LUO selftests/liveupdate: add userspace API selftests docs: add documentation for memfd preservation via LUO mm: memfd_luo: allow preserving memfd liveupdate: luo_file: add private argument to store runtime state mm: shmem: export some functions to internal.h ... commit 09670b8c38b37bc2d6fc5d01fa7e02c38f7adf36 Merge: cc3ee4ba57b76d c5108c58b991cb Author: Linus Torvalds Date: Sat Dec 6 13:49:40 2025 -0800 Merge tag 'trace-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix accounting of stop_count in file release On opening the trace file, if "pause-on-trace" option is set, it will increment the stop_count. On file release, it checks if stop_count is set, and if so it decrements it. Since this code was originally written, the stop_count can be incremented by other use cases. This makes just checking the stop_count not enough to know if it should be decremented. Add a new iterator flag called "PAUSE" and have it set if the open disables tracing and only decrement the stop_count if that flag is set on close. - Remove length field in trace_seq_printf() of print_synth_event() When printing the synthetic event that has a static length array field, the vsprintf() of the trace_seq_printf() triggered a "(efault)" in the output. That's because the print_fmt replaced the "%.*s" with "%s" causing the arguments to be off. - Fix a bunch of typos * tag 'trace-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix typo in trace_seq.c tracing: Fix typo in trace_probe.c tracing: Fix multiple typos in trace_osnoise.c tracing: Fix multiple typos in trace_events_user.c tracing: Fix typo in trace_events_trigger.c tracing: Fix typo in trace_events_hist.c tracing: Fix typo in trace_events_filter.c tracing: Fix multiple typos in trace_events.c tracing: Fix multiple typos in trace.c tracing: Fix typo in ring_buffer_benchmark.c tracing: Fix multiple typos in ring_buffer.c tracing: Fix typo in fprobe.c tracing: Fix typo in fpgraph.c tracing: Fix fixed array of synthetic event tracing: Fix enabling of tracing on file release commit cc3ee4ba57b76deefb52aee5f57a46dc07bda9f7 Merge: 09bcd5ef66a252 1c3377bee2127f Author: Linus Torvalds Date: Sat Dec 6 12:33:26 2025 -0800 Merge tag 'x86-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Miscellaneous documentation fixes" * tag 'x86-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot/Documentation: Prefix hexadecimal literals with 0x x86/boot/Documentation: Spell 'ID' consistently x86/platform: Fix and extend kernel-doc comments in commit 09bcd5ef66a2524545dc0bc834140606f4180d0f Merge: 08b8ddac1f4339 c2ae8b0df2d1bb Author: Linus Torvalds Date: Sat Dec 6 12:31:21 2025 -0800 Merge tag 'sched-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Miscellaneous scheduler fixes/cleanups: - Fix psi_dequeue() for Proxy Execution - Fix hrtick() vs. scheduling context bug - Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out - Fix whitespace noise in headers - Remove a preempt-disable section in rt_mutex_setprio()" * tag 'sched-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Fix psi_dequeue() for Proxy Execution sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out sched/rt: Remove a preempt-disable section in rt_mutex_setprio() sched/hrtick: Fix hrtick() vs. scheduling context sched/headers: Remove whitespace noise from kernel/sched/sched.h commit 08b8ddac1f4339fbf950df45590a032578ec35f7 Merge: 92fc1f16e22f97 2d3451ef1ef679 Author: Linus Torvalds Date: Sat Dec 6 11:56:51 2025 -0800 Merge tag 'objtool-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Ingo Molnar: "Address various objtool scalability bugs/inefficiencies exposed by allmodconfig builds, plus improve the quality of alternatives instructions generated code and disassembly" * tag 'objtool-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Simplify .annotate_insn code generation output some more objtool: Add more robust signal error handling, detect and warn about stack overflows objtool: Remove newlines and tabs from annotation macros objtool: Consolidate annotation macros x86/asm: Remove ANNOTATE_DATA_SPECIAL usage x86/alternative: Remove ANNOTATE_DATA_SPECIAL usage objtool: Fix stack overflow in validate_branch() commit 92fc1f16e22f97dd5897c9200e620ebc287e50ef Merge: 5e5ea7f6161023 90dfeef1cd38df Author: Linus Torvalds Date: Sat Dec 6 11:31:49 2025 -0800 Merge tag 'locking-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "Two fixes related to recent introduction of scoped_seqlock_read(): - Fix compiler build failures when a particular .config and compiler build options variant doesn't result in the expected removal of unused, catch-bugs portions of scoped_seqlock_read() by the inliner at build time, and cause a linker fail even in correct code - Match read-locking order in do_task_stat() and do_io_accounting(). The inconsistency here was harmless but unnecessary" * tag 'locking-urgent-2025-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: seqlock: Cure some more scoped_seqlock() optimization fails seqlock, procfs: Match scoped_seqlock_read() critical section vs. RCU ordering in do_task_stat() to do_io_accounting() commit 5e5ea7f61610239fca058011e7d4f342b34d1558 Author: Linus Torvalds Date: Sat Dec 6 11:13:50 2025 -0800 iommu/amd: fix SEV-TIO support reporting Commit eeb934137deb ("iommu/amd: Report SEV-TIO support") was confused about the config options that expose amd_iommu_sev_tio_supported(), and made the declaration (and alternative dummy function) conditional on the CONFIG_AMD_IOMMU config option. But the code is actually dependent on CONFIG_KVM_AMD_SEV, resulting in ERROR: modpost: "amd_iommu_sev_tio_supported" [drivers/crypto/ccp/ccp.ko] undefined! make[2]: *** [scripts/Makefile.modpost:147: Module.symvers] Error 1 if you have the AMD iommu enabled, but don't enable KVM_AMD_SEV support. Fix it by moving the declaration into the right #ifdef section in the header file. Fixes: eeb934137deb ("iommu/amd: Report SEV-TIO support") Cc: Alexey Kardashevskiy Cc: Joerg Roedel Cc: Vasant Hegde Cc: Tom Lendacky Cc: Dan Williams Signed-off-by: Linus Torvalds commit b0319c4642638bad4b36974055b1c0894b2c7aa9 Merge: 1a68aefc710a9f df8c841dd92a7f Author: Linus Torvalds Date: Sat Dec 6 10:57:02 2025 -0800 Merge tag 'nfsd-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: - Mike Snitzer's mechanism for disabling I/O caching introduced in v6.18 is extended to include using direct I/O. The goal is to further reduce the memory footprint consumed by NFS clients accessing large data sets via NFSD. - The NFSD community adopted a maintainer entry profile during this cycle. See Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst - Work continues on hardening NFSD's implementation of the pNFS block layout type. This type enables pNFS clients to directly access the underlying block devices that contain an exported file system, reducing server overhead and increasing data throughput. - The remaining patches are clean-ups and minor optimizations. Many thanks to the contributors, reviewers, testers, and bug reporters who participated during the v6.19 NFSD development cycle. * tag 'nfsd-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (38 commits) NFSD: nfsd-io-modes: Separate lists NFSD: nfsd-io-modes: Wrap shell snippets in literal code blocks NFSD: Add toctree entry for NFSD IO modes docs NFSD: add Documentation/filesystems/nfs/nfsd-io-modes.rst NFSD: Implement NFSD_IO_DIRECT for NFS WRITE NFSD: Make FILE_SYNC WRITEs comply with spec NFSD: Add trace point for SCSI fencing operation. NFSD: use correct reservation type in nfsd4_scsi_fence_client xdrgen: Don't generate unnecessary semicolon xdrgen: Fix union declarations NFSD: don't start nfsd if sv_permsocks is empty xdrgen: handle _XdrString in union encoder/decoder xdrgen: Fix the variable-length opaque field decoder template xdrgen: Make the xdrgen script location-independent xdrgen: Generalize/harden pathname construction lockd: don't allow locking on reexported NFSv2/3 MAINTAINERS: add a nfsd blocklayout reviewer nfsd: Use MD5 library instead of crypto_shash nfsd: stop pretending that we cache the SEQUENCE reply. NFS: nfsd-maintainer-entry-profile: Inline function name prefixes ... commit 1a68aefc710a9f5486c90c87f0424d4912429adb Merge: 249872f53d6444 150215b89bcf70 Author: Linus Torvalds Date: Sat Dec 6 10:49:19 2025 -0800 Merge tag 'for-linus-6.19-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: "This round it contains only three small cleanup patches" * tag 'for-linus-6.19-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: drivers/xen: use min() instead of min_t() drivers/xen/xenbus: Replace deprecated strcpy in xenbus_transaction_end drivers/xen/xenbus: Simplify return statement in join() commit 249872f53d64441690927853e9d3af36394802d5 Merge: fbff94967958e4 7dfbe9a6751973 Author: Linus Torvalds Date: Sat Dec 6 10:15:41 2025 -0800 Merge tag 'tsm-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull PCIe Link Encryption and Device Authentication from Dan Williams: "New PCI infrastructure and one architecture implementation for PCIe link encryption establishment via platform firmware services. This work is the result of multiple vendors coming to consensus on some core infrastructure (thanks Alexey, Yilun, and Aneesh!), and three vendor implementations, although only one is included in this pull. The PCI core changes have an ack from Bjorn, the crypto/ccp/ changes have an ack from Tom, and the iommu/amd/ changes have an ack from Joerg. PCIe link encryption is made possible by the soup of acronyms mentioned in the shortlog below. Link Integrity and Data Encryption (IDE) is a protocol for installing keys in the transmitter and receiver at each end of a link. That protocol is transported over Data Object Exchange (DOE) mailboxes using PCI configuration requests. The aspect that makes this a "platform firmware service" is that the key provisioning and protocol is coordinated through a Trusted Execution Envrionment (TEE) Security Manager (TSM). That is either firmware running in a coprocessor (AMD SEV-TIO), or quasi-hypervisor software (Intel TDX Connect / ARM CCA) running in a protected CPU mode. Now, the only reason to ask a TSM to run this protocol and install the keys rather than have a Linux driver do the same is so that later, a confidential VM can ask the TSM directly "can you certify this device?". That precludes host Linux from provisioning its own keys, because host Linux is outside the trust domain for the VM. It also turns out that all architectures, save for one, do not publish a mechanism for an OS to establish keys in the root port. So "TSM-established link encryption" is the only cross-architecture path for this capability for the foreseeable future. This unblocks the other arch implementations to follow in v6.20/v7.0, once they clear some other dependencies, and it unblocks the next phase of work to implement the end-to-end flow of confidential device assignment. The PCIe specification calls this end-to-end flow Trusted Execution Environment (TEE) Device Interface Security Protocol (TDISP). In the meantime, Linux gets a link encryption facility which has practical benefits along the same lines as memory encryption. It authenticates devices via certificates and may protect against interposer attacks trying to capture clear-text PCIe traffic. Summary: - Introduce the PCI/TSM core for the coordination of device authentication, link encryption and establishment (IDE), and later management of the device security operational states (TDISP). Notify the new TSM core layer of PCI device arrival and departure - Add a low level TSM driver for the link encryption establishment capabilities of the AMD SEV-TIO architecture - Add a library of helpers TSM drivers to use for IDE establishment and the DOE transport - Add skeleton support for 'bind' and 'guest_request' operations in support of TDISP" * tag 'tsm-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: (23 commits) crypto/ccp: Fix CONFIG_PCI=n build virt: Fix Kconfig warning when selecting TSM without VIRT_DRIVERS crypto/ccp: Implement SEV-TIO PCIe IDE (phase1) iommu/amd: Report SEV-TIO support psp-sev: Assign numbers to all status codes and add new ccp: Make snp_reclaim_pages and __sev_do_cmd_locked public PCI/TSM: Add 'dsm' and 'bound' attributes for dependent functions PCI/TSM: Add pci_tsm_guest_req() for managing TDIs PCI/TSM: Add pci_tsm_bind() helper for instantiating TDIs PCI/IDE: Initialize an ID for all IDE streams PCI/IDE: Add Address Association Register setup for downstream MMIO resource: Introduce resource_assigned() for discerning active resources PCI/TSM: Drop stub for pci_tsm_doe_transfer() drivers/virt: Drop VIRT_DRIVERS build dependency PCI/TSM: Report active IDE streams PCI/IDE: Report available IDE streams PCI/IDE: Add IDE establishment helpers PCI: Establish document for PCI host bridge sysfs attributes PCI: Add PCIe Device 3 Extended Capability enumeration PCI/TSM: Establish Secure Sessions and Link Encryption ... commit fbff94967958e46f7404b2dfbcf3b19e96aaaae2 Merge: 973ec55764d0f0 5bcc5786a0cfa9 Author: Linus Torvalds Date: Sat Dec 6 10:00:49 2025 -0800 Merge tag 'linux-watchdog-6.19-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add watchdog support for: - Renesas WWDT - AST2700 platform - MediaTek MT8189 SoC - Loongson-2k0300 watchdog - Qualcomm Kaanapali watchdog - RK3506 compatible - Airoha AN7583 SoC - DT Schema conversions: - lantiq,wdt - TI OMAP - marvell,orion-wdt - Several other fixes and improvements * tag 'linux-watchdog-6.19-rc1' of git://www.linux-watchdog.org/linux-watchdog: (30 commits) watchdog: starfive: Fix resource leak in probe error path dt-bindings: watchdog: airoha: Add support for Airoha AN7583 SoC dt-bindings: watchdog: lantiq,wdt: convert bindings to dtschema dt-bindings: watchdog: Add RK3506 compatible dt-bindings: watchdog: Document Qualcomm Kaanapali watchdog watchdog: wdat_wdt: Fix ACPI table leak in probe function watchdog: loongson1: Add Loongson-2k0300 watchdog support dt-bindings: watchdog: loongson,ls1x-wdt: Add ls2k0300-wdt compatible watchdog: loongson1: Drop CONFIG_OF watchdog: loongson1: Simplify ls1x_wdt_probe code watchdog: loongson1: Add missing MODULE_PARM_DESC watchdog/diag288: Fix module comment typos dt-bindings: watchdog: Support MediaTek MT8189 wdt dt-bindings: watchdog: mediatek,mtk-wdt: Add compatible for MT8189 SoC dt-bindings: mfd: rohm,bd96801-pmic: Correct timeout-sec length and reference watchdog schema dt-bindings: watchdog: Allow node names named 'pmic' dt-bindings: watchdog: Restrict timeout-sec to one number watchdog: renesas_wwdt: add driver dt-bindings: watchdog: Add Renesas WWDT dt-bindings: watchdog: Convert marvell,orion-wdt to DT schema ... commit 973ec55764d0f0e25d495392477056d6a0be4660 Merge: e637b37a520513 112766cdf2e5ea Author: Linus Torvalds Date: Sat Dec 6 09:58:02 2025 -0800 Merge tag 'rpmsg-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Reduce code duplication related to channel removal, and invoke the removal in one case previously missing, both in the Glink driver * tag 'rpmsg-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: glink: remove duplicate code for rpmsg device remove rpmsg: glink: fix rpmsg device leak commit e637b37a520513a04d00f4add07ec25f357e6c6d Merge: eee654ca9a55fd 641092c1bc1bbc Author: Linus Torvalds Date: Sat Dec 6 09:55:38 2025 -0800 Merge tag 'rproc-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Add support for the compute DSP in the Qualcomm SDM660 platform, and finally fix up the way MSM8974 audio DSP remoteproc driver manages its power rails - Replace the usage of of_reserved_mem_lookup() with of_reserved_mem_region_to_resource() to clean things up across most of the drivers - Perform a variety of housekeeping and cleanup work across iMX, Mediatek, and TI remoteproc drivers * tag 'rproc-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (45 commits) remoteproc: qcom_q6v5_wcss: use optional reset for wcss_q6_bcr_reset remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs remoteproc: qcom_wcnss: Fix NULL vs IS_ERR() bug in wcnss_alloc_memory_region() remoteproc: qcom: q6v5: Fix NULL vs IS_ERR() bug in q6v5_alloc_memory_region() remoteproc: qcom: pas: Fix a couple NULL vs IS_ERR() bugs remoteproc: qcom_q6v5_adsp: Fix a NULL vs IS_ERR() check in adsp_alloc_memory_region() remoteproc: imx_dsp_rproc: Fix NULL vs IS_ERR() bug in imx_dsp_rproc_add_carveout() remoteproc: st: Fix indexing of memory-regions remoteproc: qcom: pas: Add support for SDM660 CDSP dt-bindings: remoteproc: qcom: adsp: Add SDM660 CDSP compatible dt-bindings: remoteproc: qcom: adsp: Add missing constrains for SDM660 ADSP dt-bindings: remoteproc: qcom,sc8280xp-pas: Fix CDSP power desc remoteproc: omap: Remove redundant pm_runtime_mark_last_busy() calls remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region" remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8974 dt-bindings: remoteproc: qcom,adsp: Make msm8974 use CX as power domain remoteproc: Use of_reserved_mem_region_* functions for "memory-region" remoteproc: imx_dsp_rproc: Simplify start/stop error handling remoteproc: imx_rproc: Remove enum imx_rproc_method remoteproc: imx_dsp_rproc: Simplify IMX_RPROC_RESET_CONTROLLER switch case ... commit eee654ca9a55fd1e8632afb119975cba6af7d4ad Merge: 10003ff8ce7273 54f9baf537b0a0 Author: Linus Torvalds Date: Sat Dec 6 09:52:41 2025 -0800 Merge tag 'landlock-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: "This mainly fixes handling of disconnected directories and adds new tests" * tag 'landlock-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Add disconnected leafs and branch test suites selftests/landlock: Add tests for access through disconnected paths landlock: Improve variable scope landlock: Fix handling of disconnected directories selftests/landlock: Fix makefile header list landlock: Make docs in cred.h and domain.h visible landlock: Minor comments improvements commit 10003ff8ce7273d1fe045d63d1a5c9d979e3d47e Merge: 56a1a04dc9bf25 9c0bad7508a811 Author: Linus Torvalds Date: Sat Dec 6 09:35:00 2025 -0800 Merge tag 'turbostat-v2025.12.02' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: - Add LLC statistics columns: LLCkRPS = Last Level Cache Thousands of References Per Second LLC%hit = Last Level Cache Hit % - Recognize Wildcat Lake and Nova Lake platforms - Add MSR check for Android - Add APERF check for VMWARE - Add RAPL check for AWS - Minor fixes to turbostat (and x86_energy_perf_policy) * tag 'turbostat-v2025.12.02' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (21 commits) tools/power turbostat: version 2025.12.02 tools/power turbostat: Print wide names only for RAW 64-bit columns tools/power turbostat: Print percentages in 8-columns tools/power turbostat: Print "nan" for out of range percentages tools/power turbostat: Validate APERF access for VMWARE tools/power turbostat: Enhance perf probe tools/power turbostat: Validate RAPL MSRs for AWS Nitro Hypervisor tools/power x86_energy_perf_policy: Fix potential NULL pointer dereference tools/power x86_energy_perf_policy: Fix format string in error message tools/power x86_energy_perf_policy: Simplify Android MSR probe tools/power x86_energy_perf_policy: Add Android MSR device support tools/power turbostat: Add run-time MSR driver probe tools/power turbostat: Set per_cpu_msr_sum to NULL after free tools/power turbostat: Add LLC stats tools/power turbostat: Remove dead code tools/power turbostat: Refactor floating point printout code tools/power turbostat.8: Update example tools/power turbostat: Refactor added-counter value printing code tools/power turbostat: Refactor added column header printing tools/power turbostat: Add Wildcat Lake and Nova Lake support ... commit 56a1a04dc9bf252641c622aad525894dadc61a07 Merge: a7405aa92feec2 30065e73d7c018 Author: Linus Torvalds Date: Sat Dec 6 09:32:25 2025 -0800 Merge tag 'libnvdimm-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull nvdimm updates from Ira Weiny: "These are mainly bug fixes and code updates. There is a new feature to divide up memmap= carve outs and a fix caught in linux-next for that patch. Managing memmap memory on the fly for multiple VM's was proving difficult and Mike provided a driver which allows for the memory to be better manged. Summary: - Allow exposing RAM carveouts as NVDIMM DIMM devices - Prevent integer overflow in ramdax_get_config_data() - Replace use of system_wq with system_percpu_wq - Documentation: btt: Unwrap bit 31-30 nested table - tools/testing/nvdimm: Use per-DIMM device handle" * tag 'libnvdimm-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Prevent integer overflow in ramdax_get_config_data() Documentation: btt: Unwrap bit 31-30 nested table nvdimm: replace use of system_wq with system_percpu_wq tools/testing/nvdimm: Use per-DIMM device handle nvdimm: allow exposing RAM carveouts as NVDIMM DIMM devices commit a7405aa92feec2598cedc1b6c651beb1848240fe Merge: f468cf53c5240b 131971f67e2581 Author: Linus Torvalds Date: Sat Dec 6 09:25:05 2025 -0800 Merge tag 'dma-mapping-6.19-2025-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: - More DMA mapping API refactoring to physical addresses as the primary interface instead of page+offset parameters. This time dma_map_ops callbacks are converted to physical addresses, what in turn results also in some simplification of architecture specific code (Leon Romanovsky and Jason Gunthorpe) - Clarify that dma_map_benchmark is not a kernel self-test, but standalone tool (Qinxin Xia) * tag 'dma-mapping-6.19-2025-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-mapping: remove unused map_page callback xen: swiotlb: Convert mapping routine to rely on physical address x86: Use physical address for DMA mapping sparc: Use physical address DMA mapping powerpc: Convert to physical address DMA mapping parisc: Convert DMA map_page to map_phys interface MIPS/jazzdma: Provide physical address directly alpha: Convert mapping routine to rely on physical address dma-mapping: remove unused mapping resource callbacks xen: swiotlb: Switch to physical address mapping callbacks ARM: dma-mapping: Switch to physical address mapping callbacks ARM: dma-mapping: Reduce struct page exposure in arch_sync_dma*() dma-mapping: convert dummy ops to physical address mapping dma-mapping: prepare dma_map_ops to conversion to physical address tools/dma: move dma_map_benchmark from selftests to tools/dma commit f468cf53c5240bf5063d0c6fe620b5ae2de37801 Merge: 309e49039f124a 5ba71195a9cb8b Author: Linus Torvalds Date: Sat Dec 6 09:01:27 2025 -0800 Merge tag 'bitmap-for-6.19' of github.com:/norov/linux Pull bitmap updates from Yury Norov: - Runtime field_{get,prep}() (Geert) - Rust ID pool updates (Alice) - min_t() simplification (David) - __sw_hweightN kernel-doc fixes (Andy) - cpumask.h headers cleanup (Andy) * tag 'bitmap-for-6.19' of github.com:/norov/linux: (32 commits) rust_binder: use bitmap for allocation of handles rust: id_pool: do not immediately acquire new ids rust: id_pool: do not supply starting capacity rust: id_pool: rename IdPool::new() to with_capacity() rust: bitmap: add BitmapVec::new_inline() rust: bitmap: add MAX_LEN and MAX_INLINE_LEN constants cpumask: Don't use "proxy" headers soc: renesas: Use bitfield helpers clk: renesas: Use bitfield helpers ALSA: usb-audio: Convert to common field_{get,prep}() helpers soc: renesas: rz-sysc: Convert to common field_get() helper pinctrl: ma35: Convert to common field_{get,prep}() helpers iio: mlx90614: Convert to common field_{get,prep}() helpers iio: dac: Convert to common field_prep() helper gpio: aspeed: Convert to common field_{get,prep}() helpers EDAC/ie31200: Convert to common field_get() helper crypto: qat - convert to common field_get() helper clk: at91: Convert to common field_{get,prep}() helpers bitfield: Add non-constant field_{prep,get}() helpers bitfield: Add less-checking __FIELD_{GET,PREP}() ... commit 309e49039f124a9dcb99c05651af8eb8fa05bc29 Author: Miguel Ojeda Date: Thu Dec 4 15:50:35 2025 +0100 rust: sync: atomic: separate import "blocks" Commit 14e9a18b07ec ("rust: sync: atomic: Make Atomic*Ops pub(crate)") added a `pub(crate)` import in the same "block" as the `pub` one, without running `rustfmt`, which would sort them differently. Instead of running `rustfmt` as-is, add a newline to keep the import "blocks" with different visibilities separate. Signed-off-by: Miguel Ojeda Signed-off-by: Linus Torvalds commit c84d574698bad2c02aad506dfe712f83cbe3b771 Merge: 416f99c3b16f58 1ddac5cd7f2783 Author: Linus Torvalds Date: Sat Dec 6 08:27:07 2025 -0800 Merge tag 'modules-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Daniel Gomez: "Rust module parameter support: - Add Rust module parameter support, enabling Rust kernel modules to declare and use module parameters. The rust_minimal sample module demonstrates this, and the rust null block driver will be the first to use it in the next cycle. This also adds the Rust module files under the modules subsystem as agreed between the Rust and modules maintainers. Hardening: - Add compile-time check for embedded NUL characters in MODULE_*() macros. This module metadata was once used (and maybe still) to bypass license enforcement (LWN article from 2003): https://lwn.net/Articles/82305/ [1] MAINTAINERS: - Add Aaron Tomlin as reviewer for the Modules subsystem" * tag 'modules-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: MAINTAINERS: Add myself as reviewer for module support module: Add compile-time check for embedded NUL characters media: radio: si470x: Fix DRIVER_AUTHOR macro definition media: dvb-usb-v2: lmedm04: Fix firmware macro definitions modules: add rust modules files to MAINTAINERS rust: samples: add a module parameter to the rust_minimal sample rust: module: update the module macro with module parameter support rust: module: use a reference in macros::module::module rust: introduce module_param module rust: str: add radix prefixed integer parsing functions rust: sync: add `SetOnce` commit dd44d4d0c55a4ecf5eabf7856f96ed47e0684780 Author: Arnd Bergmann Date: Fri Dec 5 10:54:09 2025 +0100 gpio: tb10x: fix OF_GPIO dependency Selecting OF_GPIO is generally not allowed, it always gets enabled when both GPIOLIB and OF are turned on. The tb10x driver now warns about this after it was enabled for compile-testing: WARNING: unmet direct dependencies detected for OF_GPIO Depends on [n]: GPIOLIB [=y] && OF [=n] && HAS_IOMEM [=y] Selected by [y]: - GPIO_TB10X [=y] && GPIOLIB [=y] && HAS_IOMEM [=y] && (ARC_PLAT_TB10X || COMPILE_TEST [=y]) OF_GPIO is not required for compile-testing and is already enabled when the driver is usable, so just drop the 'select' line. Fixes: 682fbb18e14c ("gpio: tb10x: allow building the module with COMPILE_TEST=y") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20251205095429.1291866-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit c2ae8b0df2d1bb7a063f9e356e4e9a06cd4afe11 Author: John Stultz Date: Fri Dec 5 01:27:09 2025 +0000 sched/core: Fix psi_dequeue() for Proxy Execution Currently, if the sleep flag is set, psi_dequeue() doesn't change any of the psi_flags. This is because psi_task_switch() will clear TSK_ONCPU as well as other potential flags (TSK_RUNNING), and the assumption is that a voluntary sleep always consists of a task being dequeued followed shortly there after with a psi_sched_switch() call. Proxy Execution changes this expectation, as mutex-blocked tasks that would normally sleep stay on the runqueue. But in the case where the mutex-owning task goes to sleep, or the owner is on a remote cpu, we will then deactivate the blocked task shortly after. In that situation, the mutex-blocked task will have had its TSK_ONCPU cleared when it was switched off the cpu, but it will stay TSK_RUNNING. Then if we later dequeue it (as currently done if we hit a case find_proxy_task() can't yet handle, such as the case of the owner being on another rq or a sleeping owner) psi_dequeue() won't change any state (leaving it TSK_RUNNING), as it incorrectly expects a psi_task_switch() call to immediately follow. Later on when the task get woken/re-enqueued, and psi_flags are set for TSK_RUNNING, we hit an error as the task is already TSK_RUNNING: psi: inconsistent task state! task=188:kworker/28:0 cpu=28 psi_flags=4 clear=0 set=4 To resolve this, extend the logic in psi_dequeue() so that if the sleep flag is set, we also check if psi_flags have TSK_ONCPU set (meaning the psi_task_switch is imminent) before we do the shortcut return. If TSK_ONCPU is not set, that means we've already switched away, and this psi_dequeue call needs to clear the flags. Fixes: be41bde4c3a8 ("sched: Add an initial sketch of the find_proxy_task() function") Reported-by: K Prateek Nayak Signed-off-by: John Stultz Signed-off-by: Ingo Molnar Tested-by: K Prateek Nayak Tested-by: Haiyue Wang Acked-by: Johannes Weiner Link: https://patch.msgid.link/20251205012721.756394-1-jstultz@google.com Closes: https://lore.kernel.org/lkml/20251117185550.365156-1-kprateek.nayak@amd.com/ commit ca125231dd29fc0678dd3622e9cdea80a51dffe4 Author: xupengbo Date: Wed Aug 27 10:22:07 2025 +0800 sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out When a task is migrated out, there is a probability that the tg->load_avg value will become abnormal. The reason is as follows: 1. Due to the 1ms update period limitation in update_tg_load_avg(), there is a possibility that the reduced load_avg is not updated to tg->load_avg when a task migrates out. 2. Even though __update_blocked_fair() traverses the leaf_cfs_rq_list and calls update_tg_load_avg() for cfs_rqs that are not fully decayed, the key function cfs_rq_is_decayed() does not check whether cfs->tg_load_avg_contrib is null. Consequently, in some cases, __update_blocked_fair() removes cfs_rqs whose avg.load_avg has not been updated to tg->load_avg. Add a check of cfs_rq->tg_load_avg_contrib in cfs_rq_is_decayed(), which fixes the case (2.) mentioned above. Fixes: 1528c661c24b ("sched/fair: Ratelimit update to tg->load_avg") Signed-off-by: xupengbo Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Aaron Lu Reviewed-by: Vincent Guittot Tested-by: Aaron Lu Link: https://patch.msgid.link/20250827022208.14487-1-xupengbo@oppo.com commit 22abd832776b1317ae4c3f8a097c8b71bf83fb38 Author: Sebastian Andrzej Siewior Date: Thu Nov 27 16:55:29 2025 +0100 sched/rt: Remove a preempt-disable section in rt_mutex_setprio() rt_mutex_setprio() has only one caller: rt_mutex_adjust_prio(). It expects that task_struct::pi_lock and rt_mutex_base::wait_lock are held. Both locks are raw_spinlock_t and are acquired with disabled interrupts. Nevertheless rt_mutex_setprio() disables preemption while invoking __balance_callbacks() and raw_spin_rq_unlock(). Even if one of the balance callbacks unlocks the rq then it must not enable interrupts because rt_mutex_base::wait_lock is still locked. Therefore interrupts should remain disabled and disabling preemption is not needed. Commit 4c9a4bc89a9cc ("sched: Allow balance callbacks for check_class_changed()") adds a preempt-disable section to rt_mutex_setprio() and __sched_setscheduler(). In __sched_setscheduler() the preemption is disabled before rq is unlocked and interrupts enabled but I don't see why it makes a difference in rt_mutex_setprio(). Remove the preempt_disable() section from rt_mutex_setprio(). Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251127155529.t_sTatE4@linutronix.de commit e38e5299747b23015b00b0109891815db44a2f30 Author: Peter Zijlstra Date: Mon Sep 1 22:46:29 2025 +0200 sched/hrtick: Fix hrtick() vs. scheduling context The sched_class::task_tick() method is called on the donor sched_class, and sched_tick() hands it rq->donor as argument, which is consistent. However, while hrtick() uses the donor sched_class, it then passes rq->curr, which is inconsistent. Fix it. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: John Stultz Link: https://patch.msgid.link/20250918080205.442967033@infradead.org commit dde3763365d80398d1465214458d0c38cc32de9c Author: Ingo Molnar Date: Wed Dec 3 18:19:14 2025 +0000 sched/headers: Remove whitespace noise from kernel/sched/sched.h A single case of space-Tab noise snuck in recently. Fixes: 36569780b0d6 ("sched: Change nr_uninterruptible type to unsigned long") Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/176478595428.498.13816176784792752599.tip-bot2@tip-bot2 commit 90dfeef1cd38dff19f8b3a752d13bfd79f0f7694 Author: Peter Zijlstra Date: Thu Dec 4 11:43:32 2025 +0100 seqlock: Cure some more scoped_seqlock() optimization fails Arnd reported an x86 randconfig using gcc-15 tripped over __scoped_seqlock_bug(). Turns out GCC chose not to inline the scoped_seqlock helper functions and as such was not able to optimize properly. [ mingo: Clang fails the build too in some circumstances. ] Reported-by: Arnd Bergmann Tested-by: Arnd Bergmann Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Cc: Oleg Nesterov Link: https://patch.msgid.link/20251204104332.GG2528459@noisy.programming.kicks-ass.net commit 416f99c3b16f582a3fc6d64a1f77f39d94b76de5 Merge: b1ae17cd0f0a2f 473b9f33171826 Author: Linus Torvalds Date: Fri Dec 5 21:29:02 2025 -0800 Merge tag 'driver-core-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "Arch Topology: - Move parse_acpi_topology() from arm64 to common code for reuse in RISC-V CPU: - Expose housekeeping CPUs through /sys/devices/system/cpu/housekeeping - Print a newline (or 0x0A) instead of '(null)' reading /sys/devices/system/cpu/nohz_full when nohz_full= is not set debugfs - Remove (broken) 'no-mount' mode - Remove redundant access mode checks in debugfs_get_tree() and debugfs_create_*() functions Devres: - Remove unused devm_free_percpu() helper - Move devm_alloc_percpu() from device.h to devres.h Firmware Loader: - Replace simple_strtol() with kstrtoint() - Do not call cancel_store() when no upload is in progress kernfs: - Increase struct super_block::maxbytes to MAX_LFS_FILESIZE - Fix a missing unwind path in __kernfs_new_node() Misc: - Increase the name size in struct auxiliary_device_id to 40 characters - Replace system_unbound_wq with system_dfl_wq and add WQ_PERCPU to alloc_workqueue() Platform: - Replace ERR_PTR() with IOMEM_ERR_PTR() in platform ioremap functions Rust: - Auxiliary: - Unregister auxiliary device on parent device unbind - Move parent() to impl Device; implement device context aware parent() for Device - Illustrate how to safely obtain a driver's device private data when calling from an auxiliary driver into the parant device driver - DebugFs: - Implement support for binary large objects - Device: - Let probe() return the driver's device private data as pinned initializer, i.e. impl PinInit - Implement safe accessor for a driver's device private data for Device (returned reference can't out-live driver binding and guarantees the correct private data type) - Implement AsBusDevice trait, to be used by class device abstractions to derive the bus device type of the parent device - DMA: - Store raw pointer of allocation as NonNull - Use start_ptr() and start_ptr_mut() to inherit correct mutability of self - FS: - Add file::Offset type alias - I2C: - Add abstractions for I2C device / driver infrastructure - Implement abstractions for manual I2C device registrations - I/O: - Use "kernel vertical" style for imports - Define ResourceSize as resource_size_t - Move ResourceSize to top-level I/O module - Add type alias for phys_addr_t - Implement Rust version of read_poll_timeout_atomic() - PCI: - Use "kernel vertical" style for imports - Move I/O and IRQ infrastructure to separate files - Add support for PCI interrupt vectors - Implement TryInto> for IrqVector<'a> to convert an IrqVector bound to specific pci::Device into an IrqRequest bound to the same pci::Device's parent Device - Leverage pin_init_scope() to get rid of redundant Result in IRQ methods - PinInit: - Add {pin_}init_scope() to execute code before creating an initializer - Platform: - Leverage pin_init_scope() to get rid of redundant Result in IRQ methods - Timekeeping: - Implement abstraction of udelay() - Uaccess: - Implement read_slice_partial() and read_slice_file() for UserSliceReader - Implement write_slice_partial() and write_slice_file() for UserSliceWriter sysfs: - Prepare the constification of struct attribute" * tag 'driver-core-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (75 commits) rust: pci: fix build failure when CONFIG_PCI_MSI is disabled debugfs: Fix default access mode config check debugfs: Remove broken no-mount mode debugfs: Remove redundant access mode checks driver core: Check drivers_autoprobe for all added devices driver core: WQ_PERCPU added to alloc_workqueue users driver core: replace use of system_unbound_wq with system_dfl_wq tick/nohz: Expose housekeeping CPUs in sysfs tick/nohz: avoid showing '(null)' if nohz_full= not set sysfs/cpu: Use DEVICE_ATTR_RO for nohz_full attribute kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node fs/kernfs: raise sb->maxbytes to MAX_LFS_FILESIZE mod_devicetable: Bump auxiliary_device_id name size sysfs: simplify attribute definition macros samples/kobject: constify 'struct foo_attribute' samples/kobject: add is_visible() callback to attribute group sysfs: attribute_group: enable const variants of is_visible() sysfs: introduce __SYSFS_FUNCTION_ALTERNATIVE() sysfs: transparently handle const pointers in ATTRIBUTE_GROUPS() sysfs: attribute_group: allow registration of const attribute ... commit b1ae17cd0f0a2ffe1e9da007587c8eebb1bf8c69 Merge: 096571bb893b37 35bcedc1a7938d Author: Linus Torvalds Date: Fri Dec 5 20:49:24 2025 -0800 Merge tag 'for-linus-6.19-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Minor IPMI fixes: - Some device tree cleanups and a maintainer add - Fix a race when handling channel updates that could result in errors being reported to the user in some cases" * tag 'for-linus-6.19-1' of https://github.com/cminyard/linux-ipmi: MAINTAINERS: Add entry on Loongson-2K IPMI driver dt-bindings: ipmi: Convert aspeed,ast2400-ibt-bmc to DT schema dt-bindings: ipmi: Convert nuvoton,npcm750-kcs-bmc to DT schema ipmi: Skip channel scan if channels are already marked ready ipmi: Fix __scan_channels() failing to rescan channels ipmi: Fix the race between __scan_channels() and deliver_response() commit 096571bb893b3777ae1d752b7e1d5679bcf4edfc Merge: 001eefb5039016 2e983271363108 Author: Linus Torvalds Date: Fri Dec 5 20:41:20 2025 -0800 Merge tag 'ata-6.19-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fix from Niklas Cassel: - The DELLBOSS VD SATA controller times out when sending I/Os of size 4096 KiB or larger, even though it claims LBA48 support, which per the ACS standard requires support for a maximum command size of 65535 sectors, i.e. 32 MiB - 512. Thus, quirk the device so that it sets a lower maximum command size (me) * tag 'ata-6.19-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: Quirk DELLBOSS VD max_sectors ata: libata: Move quirk flags to their own enum commit 001eefb503901603de48b8dcaf06155036ed7452 Merge: f19b84186d2970 b7960b90486139 Author: Linus Torvalds Date: Fri Dec 5 20:36:28 2025 -0800 Merge tag 'tpmdd-sessions-next-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull more tpm updates from Jarkko Sakkinen: "This is targeted for tpm2-sessions updates. There's two bug fixes and two more cosmetic tweaks for HMAC protected sessions. They provide a baseine for further improvements to be implemented during the the course of the release cycle" * tag 'tpmdd-sessions-next-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm2-sessions: Open code tpm_buf_append_hmac_session() tpm2-sessions: Remove 'attributes' parameter from tpm_buf_append_auth tpm2-sessions: Fix tpm2_read_public range checks tpm2-sessions: Fix out of range indexing in name_size commit f19b84186d297063a1006ca9e1c8597f77a75581 Merge: 7eb7f5723df50a f7231cff1f3ff8 Author: Linus Torvalds Date: Fri Dec 5 20:17:50 2025 -0800 Merge tag 'media/v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media kernel-doc fix from Mauro Carvalho Chehab: "A fix to shut up a kernel-doc warning on c3-isp driver" * tag 'media/v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: uapi: c3-isp: Fix documentation warning commit 7eb7f5723df50a7d5564aa609e4c147f669a5cb4 Merge: 3af870aedbff10 82f78acd5a9270 Author: Linus Torvalds Date: Fri Dec 5 19:56:50 2025 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Usual driver updates (ufs, lpfc, target, qla2xxx) plus assorted cleanups and fixes including the WQ_PERCPU series. The biggest core change is the new allocation of pseudo-devices which allow the sending of internal commands to a given SCSI target" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (147 commits) scsi: MAINTAINERS: Add the UFS include directory scsi: scsi_debug: Support injecting unaligned write errors scsi: qla2xxx: Fix improper freeing of purex item scsi: ufs: rockchip: Fix compile error without CONFIG_GPIOLIB scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify scsi: ufs: core: Use scsi_device_busy() scsi: ufs: core: Fix single doorbell mode support scsi: pm80xx: Add WQ_PERCPU to alloc_workqueue() users scsi: target: Add WQ_PERCPU to alloc_workqueue() users scsi: qedi: Add WQ_PERCPU to alloc_workqueue() users scsi: target: ibmvscsi: Add WQ_PERCPU to alloc_workqueue() users scsi: qedf: Add WQ_PERCPU to alloc_workqueue() users scsi: bnx2fc: Add WQ_PERCPU to alloc_workqueue() users scsi: be2iscsi: Add WQ_PERCPU to alloc_workqueue() users scsi: message: fusion: Add WQ_PERCPU to alloc_workqueue() users scsi: lpfc: WQ_PERCPU added to alloc_workqueue() users scsi: scsi_transport_fc: WQ_PERCPU added to alloc_workqueue users() scsi: scsi_dh_alua: WQ_PERCPU added to alloc_workqueue() users scsi: qla2xxx: WQ_PERCPU added to alloc_workqueue() users scsi: target: sbp: Replace use of system_unbound_wq with system_dfl_wq ... commit 708ed32c84ccfa35a62da03a336f88c0df54ab52 Author: Huacai Chen Date: Sat Dec 6 10:40:32 2025 +0800 LoongArch: Adjust common macro definitions for 32BIT/64BIT Most common macros are defined in asm.h, asmmacro.h and stackframe.h. Adjust these macros for both 32BIT and 64BIT. Add SETUP_TWINS (Setup Trampoline Windows) and SETUP_MODES (Setup CRMD/ PRMD/EUEN) which will be used later. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 81f5d15c48c441a2dadd3c4132fb80d8404fe7af Author: Huacai Chen Date: Sat Dec 6 10:40:32 2025 +0800 LoongArch: Add adaptive CSR accessors for 32BIT/64BIT 32BIT platforms only have 32bit CSR/IOCSR registers, 64BIT platforms have both 32bit/64bit CSR/IOCSR registers. Now there are both 32bit and 64bit CSR accessors: csr_read32()/csr_write32()/csr_xchg32(); csr_read64()/csr_write64()/csr_xchg64(); Some CSR registers (address and timer registers) are 32bit length on 32BIT platform and 64bit length on 64BIT platform. To avoid #ifdefs here and there, they need adaptive accessors, so we define and use: csr_read()/csr_write()/csr_xchg(); IOCSR doesn't have a "natural length", which means a 64bit register can be treated as two 32bit registers, so we just use two 32bit accessors to emulate a 64bit accessors. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit 79974cc3ba45f3884e9c18da92a62b198a18ca62 Author: Huacai Chen Date: Sat Dec 6 10:40:32 2025 +0800 LoongArch: Add atomic operations for 32BIT/64BIT LoongArch64 has both AMO and LL/SC instructions, while LoongArch32 only has LL/SC intstructions. So we add a Kconfig option CPU_HAS_AMO here and implement atomic operations (also including local operations and percpu operations) for both 32BIT and 64BIT platforms. Reviewed-by: Arnd Bergmann Signed-off-by: Jiaxun Yang Signed-off-by: Huacai Chen commit bf3fa8f232a1eec8d7b88dcd9e925e60f04f018d Author: Huacai Chen Date: Sat Dec 6 10:39:49 2025 +0800 LoongArch: Add new PCI ID for pci_fixup_vgadev() Loongson-2K3000 has a new PCI ID (0x7a46) for its display controller, Add it for pci_fixup_vgadev() since we prefer a discrete graphics card as default boot device if present. Cc: stable@vger.kernel.org Signed-off-by: Tianrui Zhao Signed-off-by: Huacai Chen commit dbb994b44c330ea8e90c3f77a18449cfe64256f4 Author: Song Gao Date: Sat Dec 6 10:39:49 2025 +0800 LoongArch: Add and use some macros for AVEC Add and use some macros for AVEC interrupt controller, instead of using magic numbers. Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit 1de0ae21f136efa6c5d8a4d3e07b7d1ca39c750f Author: Qiang Ma Date: Sat Dec 6 10:39:49 2025 +0800 LoongArch: Correct the calculation logic of thread_count For thread_count, the current calculation method has a maximum of 255, which may not be sufficient in the future. Therefore, we are correcting it now. Reference: SMBIOS Specification, 7.5 Processor Information (Type 4)[1] [1]: https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.9.0.pdf Cc: stable@vger.kernel.org Signed-off-by: Qiang Ma Signed-off-by: Huacai Chen commit a258a3cb1895e3acf5f2fe245d17426e894bc935 Author: Tiezhu Yang Date: Sat Dec 6 10:39:48 2025 +0800 LoongArch: Use unsigned long for _end and _text It is better to use unsigned long rather than long for _end and _text to calculate the kernel length. Cc: stable@vger.kernel.org # v6.3+ Fixes: e5f02b51fa0c ("LoongArch: Add support for kernel address space layout randomization (KASLR)") Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 4a71df151e703b5e7e85b33369cee59ef2665e61 Author: WangYuli Date: Sat Dec 6 10:39:48 2025 +0800 LoongArch: Use __pmd()/__pte() for swap entry conversions The __pmd() and __pte() helper macros provide the correct initialization syntax and abstraction for the pmd_t and pte_t types. Use __pmd() to fix follow warning about __swp_entry_to_pmd() with gcc-15 under specific configs [1] : In file included from ./include/linux/pgtable.h:6, from ./include/linux/mm.h:31, from ./include/linux/pagemap.h:8, from arch/loongarch/mm/init.c:14: ./include/linux/swapops.h: In function ‘swp_entry_to_pmd’: ./arch/loongarch/include/asm/pgtable.h:302:34: error: missing braces around initializer [-Werror=missing-braces] 302 | #define __swp_entry_to_pmd(x) ((pmd_t) { (x).val | _PAGE_HUGE }) | ^ ./include/linux/swapops.h:559:16: note: in expansion of macro ‘__swp_entry_to_pmd’ 559 | return __swp_entry_to_pmd(arch_entry); | ^~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors Also update __swp_entry_to_pte() to use __pte() for consistency. [1]. https://download.01.org/0day-ci/archive/20251119/202511190316.luI90kAo-lkp@intel.com/config Cc: stable@vger.kernel.org Signed-off-by: Yuli Wang Signed-off-by: Huacai Chen commit a91b446e359aa96cc2655318789fd37441337415 Author: Huacai Chen Date: Sat Dec 6 10:39:48 2025 +0800 LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT Now the optimized version of arch_dup_task_struct() for LoongArch assumes 'thread' is the last member of 'task_struct'. But this is not true if CONFIG_RANDSTRUCT is enabled after Linux-6.16. So fix the arch_dup_task_struct() function for CONFIG_RANDSTRUCT by copying the whole 'task_struct'. Cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Huacai Chen commit 3c250aecef62da81deb38ac6738ac0a88d91f1fc Author: Huacai Chen Date: Sat Dec 6 10:39:40 2025 +0800 LoongArch: Fix build errors for CONFIG_RANDSTRUCT When CONFIG_RANDSTRUCT enabled, members of task_struct are randomized. There is a chance that TASK_STACK_CANARY be out of 12bit immediate's range and causes build errors. TASK_STACK_CANARY is naturally aligned, so fix it by replacing ld.d/st.d with ldptr.d/stptr.d which have 14bit immediates. Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511240656.0NaPcJs1-lkp@intel.com/ Suggested-by: Rui Wang Signed-off-by: Huacai Chen commit 17fcc4bd7edcd74bae286754ac3a377c9886b3fd Author: Xi Ruoyao Date: Sat Dec 6 10:39:39 2025 +0800 LoongArch: Simplify __arch_bitrev32() implementation LoongArch has the bitrev.w instruction to reverse bits in a 32-bit integer, thus there's no need to reverse the bytes and use bitrev.4b. Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 10eda1c51cbbd7f3f9f1f481b6725105aca4982a Author: Xi Ruoyao Date: Sat Dec 6 10:39:39 2025 +0800 LoongArch: Select HAVE_ARCH_BITREVERSE in Kconfig Without HAVE_ARCH_BITREVERSE, the architecture-optimized bit reverse implementations in arch/loongarch/include/asm/bitrev.h are not used at all. Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 3af870aedbff10bfed220e280b57a405e972229f Author: Mike Snitzer Date: Wed Nov 26 01:01:25 2025 -0500 nfs/localio: fix regression due to out-of-order __put_cred Commit f2060bdc21d7 ("nfs/localio: add refcounting for each iocb IO associated with NFS pgio header") inadvertantly reintroduced the same potential for __put_cred() triggering BUG_ON(cred == current->cred) that commit 992203a1fba5 ("nfs/localio: restore creds before releasing pageio data") fixed. Fix this by saving and restoring the cred around each {read,write}_iter call within the respective for loop of nfs_local_call_{read,write} using scoped_with_creds(). NOTE: this fix started by first reverting the following commits: 94afb627dfc2 ("nfs: use credential guards in nfs_local_call_read()") bff3c841f7bd ("nfs: use credential guards in nfs_local_call_write()") 1d18101a644e ("Merge tag 'kernel-6.19-rc1.cred' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs") followed by narrowly fixing the cred lifetime issue by using scoped_with_creds(). In doing so, this commit's changes appear more extensive than they really are (as evidenced by comparing to v6.18's fs/nfs/localio.c). Reported-by: Zorro Lang Signed-off-by: Mike Snitzer Acked-by: Trond Myklebust Reviewed-by: Christian Brauner Link: https://lore.kernel.org/linux-next/20251205111942.4150b06f@canb.auug.org.au/ Signed-off-by: Linus Torvalds commit 11efc1cb7016e300047822fd60e0f4b4158bd56d Merge: 208eed95fc7108 68f9bbf4dfc356 Author: Linus Torvalds Date: Fri Dec 5 17:47:59 2025 -0800 Merge tag 'soc-drivers-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull more SoC driver updates from Arnd Bergmann: "These updates came a little late, or were based on a later 6.18-rc tag than the others: - A new driver for cache management on cxl devices with memory shared in a coherent cluster. This is part of the drivers/cache/ tree, but unlike the other drivers that back the dma-mapping interfaces, this one is needed only during CPU hotplug. - A shared branch for reset controllers using swnode infrastructure - Added support for new SoC variants in the Amlogic soc_device identification - Minor updates in Freescale, Microchip, Samsung, and Apple SoC drivers" * tag 'soc-drivers-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) soc: samsung: exynos-pmu: fix device leak on regmap lookup soc: samsung: exynos-pmu: Fix structure initialization soc: fsl: qbman: use kmalloc_array() instead of kmalloc() soc: fsl: qbman: add WQ_PERCPU to alloc_workqueue users MAINTAINERS: Update email address for Christophe Leroy MAINTAINERS: refer to intended file in STANDALONE CACHE CONTROLLER DRIVERS cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent cache: Make top level Kconfig menu a boolean dependent on RISCV MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header arm64: Select GENERIC_CPU_CACHE_MAINTENANCE lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION soc: amlogic: meson-gx-socinfo: add new SoCs id dt-bindings: arm: amlogic: meson-gx-ao-secure: support more SoCs memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() dt-bindings: cache: sifive,ccache0: add a pic64gx compatible MAINTAINERS: rename Microchip RISC-V entry MAINTAINERS: add new soc drivers to Microchip RISC-V entry soc: microchip: add mfd drivers for two syscon regions on PolarFire SoC dt-bindings: soc: microchip: document the simple-mfd syscon on PolarFire SoC ... commit 208eed95fc710827b100266c9450ae84d46727bd Merge: 66a1025f7f0bc0 4b1e81570144f0 Author: Linus Torvalds Date: Fri Dec 5 17:29:04 2025 -0800 Merge tag 'soc-drivers-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "This is the first half of the driver changes: - A treewide interface change to the "syscore" operations for power management, as a preparation for future Tegra specific changes - Reset controller updates with added drivers for LAN969x, eic770 and RZ/G3S SoCs - Protection of system controller registers on Renesas and Google SoCs, to prevent trivially triggering a system crash from e.g. debugfs access - soc_device identification updates on Nvidia, Exynos and Mediatek - debugfs support in the ST STM32 firewall driver - Minor updates for SoC drivers on AMD/Xilinx, Renesas, Allwinner, TI - Cleanups for memory controller support on Nvidia and Renesas" * tag 'soc-drivers-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (114 commits) memory: tegra186-emc: Fix missing put_bpmp Documentation: reset: Remove reset_controller_add_lookup() reset: fix BIT macro reference reset: rzg2l-usbphy-ctrl: Fix a NULL vs IS_ERR() bug in probe reset: th1520: Support reset controllers in more subsystems reset: th1520: Prepare for supporting multiple controllers dt-bindings: reset: thead,th1520-reset: Add controllers for more subsys dt-bindings: reset: thead,th1520-reset: Remove non-VO-subsystem resets reset: remove legacy reset lookup code clk: davinci: psc: drop unused reset lookup reset: rzg2l-usbphy-ctrl: Add support for RZ/G3S SoC reset: rzg2l-usbphy-ctrl: Add support for USB PWRRDY dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G3S support reset: eswin: Add eic7700 reset driver dt-bindings: reset: eswin: Documentation for eic7700 SoC reset: sparx5: add LAN969x support dt-bindings: reset: microchip: Add LAN969x support soc: rockchip: grf: Add select correct PWM implementation on RK3368 soc/tegra: pmc: Add USB wake events for Tegra234 amba: tegra-ahb: Fix device leak on SMMU enable ... commit 66a1025f7f0bc00404ec6357af68815c70dadae2 Merge: 0cac5ce06e5247 9b418a3bfdd421 Author: Linus Torvalds Date: Fri Dec 5 17:27:12 2025 -0800 Merge tag 'soc-newsoc-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull new SoC families update from Arnd Bergmann: "These three new families of SoC are split out into a separate branch because they touch multiple parts of the source tree and are better left separate for the initial merge. - Black Sesame Technologies C1200 is an automotive SoC using Cortex-A78 CPU cores - Anlogic dr1v90 (not to be confused with Amlogic) is an FPGA platform using a single nuclei ux900 RISC-V core - Tenstorrent Blackhole is a Neural Processing Unit using custom "Tensix" cores for computation offload managed by Linux running on SiFive X280 RISC-V cores. Support for all three is rather rudimentary at the moment and will get improved as device drivers are merged through other tree" * tag 'soc-newsoc-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) MAINTAINERS: add Black Sesame Technologies (BST) ARM SoC support arm64: defconfig: enable BST platform support arm64: dts: bst: add support for Black Sesame Technologies C1200 CDCU1.0 board arm64: Kconfig: add ARCH_BST for Black Sesame Technologies SoCs dt-bindings: arm: add Black Sesame Technologies (bst) SoC dt-bindings: vendor-prefixes: Add Black Sesame Technologies Co., Ltd. MAINTAINERS: Setup support for Anlogic tree riscv: defconfig: Enable Anlogic SoC riscv: dts: anlogic: Add Milianke MLKPAI FS01 board riscv: dts: Add initial Anlogic DR1V90 SoC device tree riscv: Add Anlogic SoC famly Kconfig support dt-bindings: serial: snps-dw-apb-uart: Add Anlogic DR1V90 uart dt-bindings: timer: Add Anlogic DR1V90 ACLINT MTIMER dt-bindings: riscv: Add Anlogic DR1V90 dt-bindings: riscv: Add Nuclei UX900 compatibles dt-bindings: vendor-prefixes: Add Anlogic, Milianke and Nuclei riscv: defconfig: Enable Tenstorrent SoCs riscv: Kconfig.socs: Add ARCH_TENSTORRENT for Tenstorrent SoCs riscv: dts: Add Tenstorrent Blackhole SoC PCIe cards dt-bindings: interrupt-controller: Add Tenstorrent Blackhole compatible ... commit 0cac5ce06e524755b3dac1e0a060b05992076d93 Merge: 09cab48db950b6 79edb7f596db99 Author: Linus Torvalds Date: Fri Dec 5 17:24:29 2025 -0800 Merge tag 'soc-dt-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC devicetree updates from Arnd Bergmann: "Three new SoCs got added in existing arm64 chip families: - Renesas R-Car X5H (R8A78000) is a new generation of automotive SoCs, based on 16 Cortex-A720 (Armv9.2) cores, which makes the the currently highest-perforance embedded SoC. - TI AM62L is a new variant of the AM62 family of industrial SoCs, this one comes without a GPU. - Qualcomm MSM8937 (Snapdragon 430) is an older mobile phone chip based on Cortex-A53, and closely related to MSM8917 (Snapdragn 425), which we already support. In addition, there are a good number of newly supported machines across SoC families: - Two Aspeed AST2600 (Cortex-A7) based BMC setups for large servers - Mobile Phones and tables based on Mediatek MT6582, Nvidia Tegra124, Qualcomm MSM8937 and Qualcomm MSM8939, - Two Laptops based on Qualcomm SoCs: one using the older sdm850, the other using x1p42100. - One Router based on Rockchips RK3568 - 24 variants of the Enclustra Mercury system-on-module, all based on 32-bit Intel/Altera SocFPGA chips, plus two boards using 64-bit SocFPGA Agilex chips.. - 30 industrial/embedded boards and single-board computers, using various chips from NXP, Rockchips, Mediatek, TI, Amlogic, Qualcomm, Spacemit, and Starfive. In total there are 783 commits here, the majority of these improving hardware support and cleaning up devicetree files across the tree, with the majority of the changes going into the Qualcomm, NXP, Renesas and Rockchips platforms" * tag 'soc-dt-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (782 commits) arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs arm64: dts: Add gpio_intc node for Amlogic S7D SoCs arm64: dts: Add gpio_intc node for Amlogic S7 SoCs arm64: dts: Add gpio_intc node for Amlogic S6 SoCs arm64: dts: amlogic: s7d: add ao secure node arm64: dts: amlogic: s7: add ao secure node arm64: dts: amlogic: s6: add ao secure node arm64: dts: amlogic: Fix the register name of the 'DBI' region dts: arm64: amlogic: add a5 pinctrl node arm64: dts: amlogic: s7d: add power domain controller node arm64: dts: amlogic: s7: add power domain controller node arm64: dts: amlogic: s6: add power domain controller node dts: arm64: amlogic: Add ISP related nodes for C3 arm64: dts: meson: add initial device-tree for Tanix TX9 Pro dt-bindings: arm: amlogic: add support for Tanix TX9 Pro ... commit 09cab48db950b6fb8c114314a20c0fd5a80cf990 Merge: b4c6c76e403936 3ce8f4a501f61e Author: Linus Torvalds Date: Fri Dec 5 17:23:12 2025 -0800 Merge tag 'soc-arm-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC ARM code updates from Arnd Bergmann: "These are very minimal changes for 32-bit Arm platform code, enabling SMP bringup for one more SoC variant (mt6582) among spelling changes and a build warning fix" * tag 'soc-arm-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: omap1: avoid symbol clashes in fiq handler ARM: gemini: fix typos in comments ARM: versatile: Fix typo in versatile.c ARM: OMAP2+: Fix falg->flag typo in omap_smc2() ARM: mediatek: add MT6582 smp bring up code ARM: mediatek: add board_dt_compat entry for the MT6582 SoC commit b4c6c76e4039366017a4f568672e4ea9fc82f97d Merge: 51d90a15fedf83 00de4ef9d3abc0 Author: Linus Torvalds Date: Fri Dec 5 17:22:09 2025 -0800 Merge tag 'soc-defconfig-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "As usual, a number of newly added drivers get enabled in the arm64 defconfig, in addition to minor housekeeping work on defconfig files for arm32, arm64 and riscv" * tag 'soc-defconfig-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) arm64: defconfig: enable Exynos ACPM clocks arm64: defconfig: Remove the redundant SCHED_MC/SCHED_SMT ARM: multi_v7_defconfig: Enable TI PRU Ethernet driver arm64: defconfig: enable i.MX AIPSTZ driver ARM: mxs_defconfig: enable sound drivers for imx28-amarula-rmm arm64: defconfig: Enable i.MX95 drivers for pinctrl, Ethernet and PCIe arm64: defconfig: enable rockchip camera interface ARM: tegra: Enable EXT4 for Tegra arm64: defconfig: Enable NVIDIA VRS PSEQ RTC arm64: defconfig: Enable SX150x GPIO expander driver riscv: defconfig: enable SPI_FSL_QUADSPI as a module ARM: at91: at91_dt_defconfig: set MMC_SPI to module arm64: defconfig: Build NSS clock controller driver for IPQ5424 arm64: defconfig: Enable SCSI UFS Crypto and Block Inline encryption drivers arm64: defconfig: Add M31 eUSB2 PHY config arm64: defconfig: Enable configs for Fairphone 3, 4, 5 smartphones arm64: defconfig: Enable two Novatek display panels for MTP8750 and Tianma arm64: defconfig: Enable RZ/T2H / RZ/N2H ADC driver ARM: shmobile: defconfig: Refresh for v6.18-rc1 arm64: defconfig: Enable DW HDMI QP CEC support ... commit 51d90a15fedf8366cb96ef68d0ea2d0bf15417d2 Merge: 399ead3a6d76cb e0c26d47def738 Author: Linus Torvalds Date: Fri Dec 5 17:01:20 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "ARM: - Support for userspace handling of synchronous external aborts (SEAs), allowing the VMM to potentially handle the abort in a non-fatal manner - Large rework of the VGIC's list register handling with the goal of supporting more active/pending IRQs than available list registers in hardware. In addition, the VGIC now supports EOImode==1 style deactivations for IRQs which may occur on a separate vCPU than the one that acked the IRQ - Support for FEAT_XNX (user / privileged execute permissions) and FEAT_HAF (hardware update to the Access Flag) in the software page table walkers and shadow MMU - Allow page table destruction to reschedule, fixing long need_resched latencies observed when destroying a large VM - Minor fixes to KVM and selftests Loongarch: - Get VM PMU capability from HW GCFG register - Add AVEC basic support - Use 64-bit register definition for EIOINTC - Add KVM timer test cases for tools/selftests RISC/V: - SBI message passing (MPXY) support for KVM guest - Give a new, more specific error subcode for the case when in-kernel AIA virtualization fails to allocate IMSIC VS-file - Support KVM_DIRTY_LOG_INITIALLY_SET, enabling dirty log gradually in small chunks - Fix guest page fault within HLV* instructions - Flush VS-stage TLB after VCPU migration for Andes cores s390: - Always allocate ESCA (Extended System Control Area), instead of starting with the basic SCA and converting to ESCA with the addition of the 65th vCPU. The price is increased number of exits (and worse performance) on z10 and earlier processor; ESCA was introduced by z114/z196 in 2010 - VIRT_XFER_TO_GUEST_WORK support - Operation exception forwarding support - Cleanups x86: - Skip the costly "zap all SPTEs" on an MMIO generation wrap if MMIO SPTE caching is disabled, as there can't be any relevant SPTEs to zap - Relocate a misplaced export - Fix an async #PF bug where KVM would clear the completion queue when the guest transitioned in and out of paging mode, e.g. when handling an SMI and then returning to paged mode via RSM - Leave KVM's user-return notifier registered even when disabling virtualization, as long as kvm.ko is loaded. On reboot/shutdown, keeping the notifier registered is ok; the kernel does not use the MSRs and the callback will run cleanly and restore host MSRs if the CPU manages to return to userspace before the system goes down - Use the checked version of {get,put}_user() - Fix a long-lurking bug where KVM's lack of catch-up logic for periodic APIC timers can result in a hard lockup in the host - Revert the periodic kvmclock sync logic now that KVM doesn't use a clocksource that's subject to NTP corrections - Clean up KVM's handling of MMIO Stale Data and L1TF, and bury the latter behind CONFIG_CPU_MITIGATIONS - Context switch XCR0, XSS, and PKRU outside of the entry/exit fast path; the only reason they were handled in the fast path was to paper of a bug in the core #MC code, and that has long since been fixed - Add emulator support for AVX MOV instructions, to play nice with emulated devices whose guest drivers like to access PCI BARs with large multi-byte instructions x86 (AMD): - Fix a few missing "VMCB dirty" bugs - Fix the worst of KVM's lack of EFER.LMSLE emulation - Add AVIC support for addressing 4k vCPUs in x2AVIC mode - Fix incorrect handling of selective CR0 writes when checking intercepts during emulation of L2 instructions - Fix a currently-benign bug where KVM would clobber SPEC_CTRL[63:32] on VMRUN and #VMEXIT - Fix a bug where KVM corrupt the guest code stream when re-injecting a soft interrupt if the guest patched the underlying code after the VM-Exit, e.g. when Linux patches code with a temporary INT3 - Add KVM_X86_SNP_POLICY_BITS to advertise supported SNP policy bits to userspace, and extend KVM "support" to all policy bits that don't require any actual support from KVM x86 (Intel): - Use the root role from kvm_mmu_page to construct EPTPs instead of the current vCPU state, partly as worthwhile cleanup, but mostly to pave the way for tracking per-root TLB flushes, and elide EPT flushes on pCPU migration if the root is clean from a previous flush - Add a few missing nested consistency checks - Rip out support for doing "early" consistency checks via hardware as the functionality hasn't been used in years and is no longer useful in general; replace it with an off-by-default module param to WARN if hardware fails a check that KVM does not perform - Fix a currently-benign bug where KVM would drop the guest's SPEC_CTRL[63:32] on VM-Enter - Misc cleanups - Overhaul the TDX code to address systemic races where KVM (acting on behalf of userspace) could inadvertantly trigger lock contention in the TDX-Module; KVM was either working around these in weird, ugly ways, or was simply oblivious to them (though even Yan's devilish selftests could only break individual VMs, not the host kernel) - Fix a bug where KVM could corrupt a vCPU's cpu_list when freeing a TDX vCPU, if creating said vCPU failed partway through - Fix a few sparse warnings (bad annotation, 0 != NULL) - Use struct_size() to simplify copying TDX capabilities to userspace - Fix a bug where TDX would effectively corrupt user-return MSR values if the TDX Module rejects VP.ENTER and thus doesn't clobber host MSRs as expected Selftests: - Fix a math goof in mmu_stress_test when running on a single-CPU system/VM - Forcefully override ARCH from x86_64 to x86 to play nice with specifying ARCH=x86_64 on the command line - Extend a bunch of nested VMX to validate nested SVM as well - Add support for LA57 in the core VM_MODE_xxx macro, and add a test to verify KVM can save/restore nested VMX state when L1 is using 5-level paging, but L2 is not - Clean up the guest paging code in anticipation of sharing the core logic for nested EPT and nested NPT guest_memfd: - Add NUMA mempolicy support for guest_memfd, and clean up a variety of rough edges in guest_memfd along the way - Define a CLASS to automatically handle get+put when grabbing a guest_memfd from a memslot to make it harder to leak references - Enhance KVM selftests to make it easer to develop and debug selftests like those added for guest_memfd NUMA support, e.g. where test and/or KVM bugs often result in hard-to-debug SIGBUS errors - Misc cleanups Generic: - Use the recently-added WQ_PERCPU when creating the per-CPU workqueue for irqfd cleanup - Fix a goof in the dirty ring documentation - Fix choice of target for directed yield across different calls to kvm_vcpu_on_spin(); the function was always starting from the first vCPU instead of continuing the round-robin search" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (260 commits) KVM: arm64: at: Update AF on software walk only if VM has FEAT_HAFDBS KVM: arm64: at: Use correct HA bit in TCR_EL2 when regime is EL2 KVM: arm64: Document KVM_PGTABLE_PROT_{UX,PX} KVM: arm64: Fix spelling mistake "Unexpeced" -> "Unexpected" KVM: arm64: Add break to default case in kvm_pgtable_stage2_pte_prot() KVM: arm64: Add endian casting to kvm_swap_s[12]_desc() KVM: arm64: Fix compilation when CONFIG_ARM64_USE_LSE_ATOMICS=n KVM: arm64: selftests: Add test for AT emulation KVM: arm64: nv: Expose hardware access flag management to NV guests KVM: arm64: nv: Implement HW access flag management in stage-2 SW PTW KVM: arm64: Implement HW access flag management in stage-1 SW PTW KVM: arm64: Propagate PTW errors up to AT emulation KVM: arm64: Add helper for swapping guest descriptor KVM: arm64: nv: Use pgtable definitions in stage-2 walk KVM: arm64: Handle endianness in read helper for emulated PTW KVM: arm64: nv: Stop passing vCPU through void ptr in S2 PTW KVM: arm64: Call helper for reading descriptors directly KVM: arm64: nv: Advertise support for FEAT_XNX KVM: arm64: Teach ptdump about FEAT_XNX permissions KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions ... commit bd3b04b46c7a9940989ff4b29376e899e93d3a4a Author: Trond Myklebust Date: Wed Dec 3 11:17:25 2025 -0500 NFSv4: Handle NFS4ERR_NOTSUPP errors for directory delegations The error NFS4ERR_NOTSUPP will be returned for operations that are legal, but not supported by the server. Fixes: 156b09482933 ("NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK") Signed-off-by: Trond Myklebust commit 0b873de2c02f9cc655bef6bee0eb9e404126ed6c Author: Mike Snitzer Date: Wed Nov 26 01:01:27 2025 -0500 nfs/localio: remove 61 byte hole from needless ____cacheline_aligned struct nfs_local_kiocb used ____cacheline_aligned on its iters[] array and as the structure evolved it caused a 61 byte hole to form. Fix this by removing ____cacheline_aligned and reordering iters[] before iter_is_dio_aligned[]. Fixes: 6a218b9c3183 ("nfs/localio: do not issue misaligned DIO out-of-order") Signed-off-by: Mike Snitzer Signed-off-by: Trond Myklebust commit f50d0328d02fe38ba196a73c143e5d87e341d4f7 Author: Mike Snitzer Date: Wed Nov 26 01:01:26 2025 -0500 nfs/localio: remove alignment size checking in nfs_is_local_dio_possible This check to ensure dio_offset_align isn't larger than PAGE_SIZE is no longer relevant (older iterations of NFS Direct was allocating misaligned head and tail pages but no longer does, so this check isn't needed). Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE") Signed-off-by: Mike Snitzer Signed-off-by: Trond Myklebust commit 399ead3a6d76cbdd29a716660db5c84a314dab70 Merge: 07025b51c11499 a3209bb94b3635 Author: Linus Torvalds Date: Fri Dec 5 16:30:56 2025 -0800 Merge tag 'uml-for-linux-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML updates from Johannes Berg: "Apart from the usual small churn, we have - initial SMP support (only kernel) - major vDSO cleanups (and fixes for 32-bit)" * tag 'uml-for-linux-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (33 commits) um: Disable KASAN_INLINE when STATIC_LINK is selected um: Don't rename vmap to kernel_vmap um: drivers: virtio: use string choices helper um: Always set up AT_HWCAP and AT_PLATFORM x86/um: Remove FIXADDR_USER_START and FIXADDR_USE_END um: Remove __access_ok_vsyscall() um: Remove redundant range check from __access_ok_vsyscall() um: Remove fixaddr_user_init() x86/um: Drop gate area handling x86/um: Do not inherit vDSO from host um: Split out default elf_aux_hwcap x86/um: Move ELF_PLATFORM fallback to x86-specific code um: Split out default elf_aux_platform um: Avoid circular dependency on asm-offsets in pgtable.h um: Enable SMP support on x86 asm-generic: percpu: Add assembly guard um: vdso: Remove getcpu support on x86 um: Add initial SMP support um: Define timers on a per-CPU basis um: Determine sleep based on need_resched() ... commit 07025b51c1149951d64804c73014499bb3564dca Merge: ad952db4a865e9 a131fd60796dbf Author: Linus Torvalds Date: Fri Dec 5 16:26:57 2025 -0800 Merge tag 'riscv-for-linus-6.19-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: - Enable parallel hotplug for RISC-V - Optimize vector regset allocation for ptrace() - Add a kernel selftest for the vector ptrace interface - Enable the userspace RAID6 test to build and run using RISC-V vectors - Add initial support for the Zalasr RISC-V ratified ISA extension - For the Zicbop RISC-V ratified ISA extension to userspace, expose hardware and kernel support to userspace and add a kselftest for Zicbop - Convert open-coded instances of 'asm goto's that are controlled by runtime ALTERNATIVEs to use riscv_has_extension_{un,}likely(), following arm64's alternative_has_cap_{un,}likely() - Remove an unnecessary mask in the GFP flags used in some calls to pagetable_alloc() * tag 'riscv-for-linus-6.19-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: selftests/riscv: Add Zicbop prefetch test riscv: hwprobe: Expose Zicbop extension and its block size riscv: Introduce Zalasr instructions riscv: hwprobe: Export Zalasr extension dt-bindings: riscv: Add Zalasr ISA extension description riscv: Add ISA extension parsing for Zalasr selftests: riscv: Add test for the Vector ptrace interface riscv: ptrace: Optimize the allocation of vector regset raid6: test: Add support for RISC-V raid6: riscv: Allow code to be compiled in userspace raid6: riscv: Prevent compiler from breaking inline vector assembly code riscv: cmpxchg: Use riscv_has_extension_likely riscv: bitops: Use riscv_has_extension_likely riscv: hweight: Use riscv_has_extension_likely riscv: checksum: Use riscv_has_extension_likely riscv: pgtable: Use riscv_has_extension_unlikely riscv: Remove __GFP_HIGHMEM masking RISC-V: Enable HOTPLUG_PARALLEL for secondary CPUs commit ad952db4a865e96ec98d4c5874a4699fe3286d56 Merge: 87c9e88ac4a16a 9b36c7fc5aa5f2 Author: Linus Torvalds Date: Fri Dec 5 16:18:21 2025 -0800 Merge tag 'powerpc-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Restore clearing of MSR[RI] at interrupt/syscall exit on 32-bit - Fix unpaired stwcx on interrupt exit on 32-bit - Fix race condition leading to double list-add in mac_hid_toggle_emumouse() - Fix mprotect on book3s 32-bit - Fix SLB multihit issue during SLB preload with 64-bit hash MMU - Add support for crashkernel CMA reservation - Add die_id and die_cpumask for Power10 & later to expose chip hemispheres - A series of minor fixes and improvements to the hash SLB code Thanks to Antonio Alvarez Feijoo, Ben Collins, Bhaskar Chowdhury, Christophe Leroy, Daniel Thompson, Dave Vasilevsky, Donet Tom, J. Neuschäfer, Kunwu Chan, Long Li, Naresh Kamboju, Nathan Chancellor, Ritesh Harjani (IBM), Shirisha G, Shrikanth Hegde, Sourabh Jain, Srikar Dronamraju, Stephen Rothwell, Thomas Zimmermann, Venkat Rao Bagalkote, and Vishal Chourasia. * tag 'powerpc-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (32 commits) macintosh/via-pmu-backlight: Include and powerpc/powermac: backlight: Include powerpc/64s/slb: Add no_slb_preload early cmdline param powerpc/64s/slb: Make preload_add return type as void powerpc/ptdump: Dump PXX level info for kernel_page_tables powerpc/64s/pgtable: Enable directMap counters in meminfo for Hash powerpc/64s/hash: Update directMap page counters for Hash powerpc/64s/hash: Hash hpt_order should be only available with Hash MMU powerpc/64s/hash: Improve hash mmu printk messages powerpc/64s/hash: Fix phys_addr_t printf format in htab_initialize() powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit powerpc/64s/slb: Fix SLB multihit issue during SLB preload powerpc, mm: Fix mprotect on book3s 32-bit powerpc/smp: Expose die_id and die_cpumask powerpc/83xx: Add a null pointer check to mcu_gpiochip_add arch:powerpc:tools This file was missing shebang line, so added it kexec: Include kernel-end even without crashkernel powerpc: p2020: Rename wdt@ nodes to watchdog@ powerpc: 86xx: Rename wdt@ nodes to watchdog@ ... commit 87c9e88ac4a16a7aba99862c41b33d7eeb75d375 Author: Christian Brauner Date: Fri Dec 5 13:10:48 2025 +0100 ovl: pass original credentials, not mounter credentials during create When creating new files the security layer expects the original credentials to be passed. When cleaning up the code this was accidently changed to pass the mounter's credentials by relying on current->cred which is already overriden at this point. Pass the original credentials directly. Reported-by: Ondrej Mosnacek Reported-by: Paul Moore Fixes: e566bff96322 ("ovl: port ovl_create_or_link() to new ovl_override_creator_creds") Link: https://lore.kernel.org/CAFqZXNvL1ciLXMhHrnoyBmQu1PAApH41LkSWEhrcvzAAbFij8Q@mail.gmail.com Signed-off-by: Christian Brauner Tested-by: Ondrej Mosnacek Reviewed-by: Amir Goldstein Signed-off-by: Linus Torvalds commit 9146c7e53fa8e5024e0f61d67129afd45a179a3b Author: David Howells Date: Fri Dec 5 17:53:29 2025 -0600 cifs: Remove dead function prototypes Remove a bunch of dead function prototypes. Signed-off-by: David Howells cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 4b9d25b4d38035b7b2624afd6852dfe4684f0226 Merge: e40e023591ff7f fe93446b5ebdaa Author: Linus Torvalds Date: Fri Dec 5 15:52:30 2025 -0800 Merge tag 'vfs-6.19-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a type conversion bug in the ipc subsystem - Fix per-dentry timeout warning in autofs - Drop the fd conversion from sockets - Move assert from iput_not_last() to iput() - Fix reversed check in filesystems_freeze_callback() - Use proper uapi types for new struct delegation definitions * tag 'vfs-6.19-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: vfs: use UAPI types for new struct delegation definition mqueue: correct the type of ro to int Revert "net/socket: convert sock_map_fd() to FD_ADD()" autofs: fix per-dentry timeout warning fs: assert on I_FREEING not being set in iput() and iput_not_last() fs: PM: Fix reverse check in filesystems_freeze_callback() commit e40e023591ff7fa7863cacced9d6452f7805f8cf Merge: 4b6b4321280ea1 51fc7b4ce10cca Author: Linus Torvalds Date: Fri Dec 5 15:48:09 2025 -0800 Merge tag 'exfat-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Fix a remount failure caused by differing process masks by inheriting the original mount options during the remount process - Fix a potential divide-by-zero error and system crash in exfat_allocate_bitmap that occurred when the readahead count was zero - Add validation for directory cluster bitmap bits to prevent directory and root cluster from being incorrectly zeroed out on corrupted images - Clear the post-EOF page cache when extending a file to prevent stale mmap data from becoming visible, addressing an generic/363 failure - Fix a reference count leak in exfat_find by properly releasing the dentry set in specific error paths * tag 'exfat-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix remount failure in different process environments exfat: fix divide-by-zero in exfat_allocate_bitmap exfat: validate the cluster bitmap bits of directory exfat: zero out post-EOF page cache on file extension exfat: fix refcount leak in exfat_find commit d159702c9492de46cc1b39b3d83fd0c8a6bdb829 Author: ChenXiaoSong Date: Fri Dec 5 21:25:30 2025 +0800 smb/client: add two elements to smb2_error_map_table array Both status codes are mapped to -EIO. Now all status codes from common/smb2status.h are included in the smb2_error_map_table array(except for the first two zero definitions). Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 523ecd976632523006c1b442e0eba4fe3c4f7e0c Author: ChenXiaoSong Date: Fri Dec 5 21:25:29 2025 +0800 smb: rename to STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP See MS-SMB2 3.3.5.4. To keep the name consistent with the documentation. Additionally, move STATUS_INVALID_LOCK_RANGE to correct position in order. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit bf80d1517dc847eb7b4d8b3c14bfe6ed48fa27ae Author: ChenXiaoSong Date: Fri Dec 5 21:25:28 2025 +0800 smb/client: remove unused elements from smb2_error_map_table array STATUS_SUCCESS and STATUS_WAIT_0 are both zero, and since zero indicates success, they are not needed. Since smb2_print_status() has been removed, the last element in the array is no longer needed. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 6c1eb31ecb97c07b4a880d59b3a83665359def36 Author: ChenXiaoSong Date: Fri Dec 5 21:25:27 2025 +0800 smb/client: reduce loop count in map_smb2_to_linux_error() by half The smb2_error_map_table array currently has 1743 elements. When searching for the last element and calling smb2_print_status(), 3486 comparisons are needed. The loop in smb2_print_status() is unnecessary, smb2_print_status() can be removed, and only iterate over the array once, printing the message when the target status code is found. Signed-off-by: ChenXiaoSong Signed-off-by: Steve French commit 7ad785927d9eb348adb381d168ed73d0dd3c7670 Author: Paulo Alcantara Date: Thu Dec 4 18:39:14 2025 -0300 smb: client: Add tracepoint for krb5 auth Add tracepoint to help debugging krb5 auth failures. Example: $ trace-cmd record -e smb3_kerberos_auth $ mount.cifs ... $ trace-cmd report mount.cifs-1667 [003] ..... 5810.668549: smb3_kerberos_auth: vers=2 host=w22-dc1.zelda.test ip=192.168.124.30:445 sec=krb5 uid=0 cruid=0 user=root pid=1667 upcall_target=app err=-126 Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Pierguido Lambri Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit a8fce7c807b13be5ccefe8f93528c255d4669d73 Author: Paulo Alcantara Date: Thu Dec 4 15:06:24 2025 -0300 smb: client: improve error message when creating SMB session When failing to create a new SMB session with 'sec=krb5' for example, the following error message isn't very useful CIFS: VFS: \\srv Send error in SessSetup = -126 Improve it by printing the following instead on dmesg CIFS: VFS: \\srv failed to create a new SMB session with Kerberos: -126 Signed-off-by: Paulo Alcantara (Red Hat) Cc: Pierguido Lambri Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 855982a52ff7d188188f0ecf86c2ce95957202c6 Author: Paulo Alcantara Date: Thu Dec 4 15:06:23 2025 -0300 smb: client: relax session and tcon reconnect attempts When the client re-establishes connection to the server, it will queue a worker thread that will attempt to reconnect sessions and tcons on every two seconds, which is kinda overkill as it is a very common scenario when having expired passwords or KRB5 TGT tickets, or deleted shares. Use an exponential backoff strategy to handle session/tcon reconnect attempts in the worker thread to prevent the client from overloading the system when it is very unlikely to re-establish any session/tcon soon while client is idle. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Pierguido Lambri Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 4b6b4321280ea1ea1e101fd39d8664195d18ecb0 Merge: 7cd122b55283d3 8da059f2a497a2 Author: Linus Torvalds Date: Fri Dec 5 15:25:13 2025 -0800 Merge tag 'fuse-update-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Add mechanism for cleaning out unused, stale dentries; controlled via a module option (Luis Henriques) - Fix various bugs - Cleanups * tag 'fuse-update-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: Uninitialized variable in fuse_epoch_work() fuse: fix io-uring list corruption for terminated non-committed requests fuse: signal that a fuse inode should exhibit local fs behaviors fuse: Always flush the page cache before FOPEN_DIRECT_IO write fuse: Invalidate the page cache after FOPEN_DIRECT_IO write fuse: rename 'namelen' to 'namesize' fuse: use strscpy instead of strcpy fuse: refactor fuse_conn_put() to remove negative logic. fuse: new work queue to invalidate dentries from old epochs fuse: new work queue to periodically invalidate expired dentries dcache: export shrink_dentry_list() and add new helper d_dispose_if_unused() fuse: add WARN_ON and comment for RCU revalidate fuse: Fix whitespace for fuse_uring_args_to_ring() comment fuse: missing copy_finish in fuse-over-io-uring argument copies fuse: fix readahead reclaim deadlock commit 615a6e7d83f958e7ef3bc818e818f7c6433b4c2a Author: Praveen K Paladugu Date: Fri Dec 5 14:17:08 2025 -0600 mshv: Cleanly shutdown root partition with MSHV Root partitions running on MSHV currently attempt ACPI power-off, which MSHV intercepts and triggers a Machine Check Exception (MCE), leading to a kernel panic. Root partitions panic with a trace similar to: [ 81.306348] reboot: Power down [ 81.314709] mce: [Hardware Error]: CPU 0: Machine Check Exception: 4 Bank 0: b2000000c0060001 [ 81.314711] mce: [Hardware Error]: TSC 3b8cb60a66 PPIN 11d98332458e4ea9 [ 81.314713] mce: [Hardware Error]: PROCESSOR 0:606a6 TIME 1759339405 SOCKET 0 APIC 0 microcode ffffffff [ 81.314715] mce: [Hardware Error]: Run the above through 'mcelog --ascii' [ 81.314716] mce: [Hardware Error]: Machine check: Processor context corrupt [ 81.314717] Kernel panic - not syncing: Fatal machine check To avoid this, configure the sleep state in the hypervisor and invoke the HVCALL_ENTER_SLEEP_STATE hypercall as the final step in the shutdown sequence. This ensures a clean and safe shutdown of the root partition. Signed-off-by: Praveen K Paladugu Co-developed-by: Anatol Belski Signed-off-by: Anatol Belski Reviewed-by: Easwar Hariharan Acked-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit f0be2600ac55a5845d536c56787daca50dbcb2a1 Author: Praveen K Paladugu Date: Fri Dec 5 14:17:07 2025 -0600 mshv: Use reboot notifier to configure sleep state Configure sleep state information from ACPI in MSHV hypervisor using a reboot notifier. This data allows the hypervisor to correctly power off the host during shutdown. Signed-off-by: Praveen K Paladugu Co-developed-by: Anatol Belski Signed-off-by: Anatol Belski Reviewed-by: Easwar Hariharan Reviewed-by: Stansialv Kinsburskii Acked-by: Ingo Molnar Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 723c47a221ee407901055c9d9b4434e68c5d650e Author: Praveen K Paladugu Date: Fri Dec 5 14:17:06 2025 -0600 mshv: Add definitions for MSHV sleep state configuration Add the definitions required to configure sleep states in mshv hypervsior. Signed-off-by: Praveen K Paladugu Co-developed-by: Anatol Belski Signed-off-by: Anatol Belski Reviewed-by: Easwar Hariharan Reviewed-by: Nuno Das Neves Acked-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 Author: Stanislav Kinsburskii Date: Wed Dec 3 21:41:09 2025 +0000 mshv: Add support for movable memory regions Introduce support for movable memory regions in the Hyper-V root partition driver to improve memory management flexibility and enable advanced use cases such as dynamic memory remapping. Mirror the address space between the Linux root partition and guest VMs using HMM. The root partition owns the memory, while guest VMs act as devices with page tables managed via hypercalls. MSHV handles VP intercepts by invoking hmm_range_fault() and updating SLAT entries. When memory is reclaimed, HMM invalidates the relevant regions, prompting MSHV to clear SLAT entries; guest VMs will fault again on access. Integrate mmu_interval_notifier for movable regions, implement handlers for HMM faults and memory invalidation, and update memory region mapping logic to support movable regions. While MMU notifiers are commonly used in virtualization drivers, this implementation leverages HMM (Heterogeneous Memory Management) for its specialized functionality. HMM provides a framework for mirroring, invalidation, and fault handling, reducing boilerplate and improving maintainability compared to generic MMU notifiers. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit c39dda08286f4d5ce4d114f8d5dbfdb85effbd6a Author: Stanislav Kinsburskii Date: Wed Dec 3 21:41:02 2025 +0000 mshv: Add refcount and locking to mem regions Introduce kref-based reference counting and spinlock protection for memory regions in Hyper-V partition management. This change improves memory region lifecycle management and ensures thread-safe access to the region list. Previously, the regions list was protected by the partition mutex. However, this approach is too heavy for frequent fault and invalidation operations. Finer grained locking is now used to improve efficiency and concurrency. This is a precursor to supporting movable memory regions. Fault and invalidation handling for movable regions will require safe traversal of the region list and holding a region reference while performing invalidation or fault operations. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Wei Liu commit abceb4297bf88340ce06016895babe292510a262 Author: Stanislav Kinsburskii Date: Wed Dec 3 21:40:56 2025 +0000 mshv: Fix huge page handling in memory region traversal The previous code assumed that if a region's first page was huge, the entire region consisted of huge pages and stored this in a large_pages flag. This premise is incorrect not only for movable regions (where pages can be split and merged on invalidate callbacks or page faults), but even for pinned regions: THPs can be split and merged during allocation, so a large, pinned region may contain a mix of huge and regular pages. This change removes the large_pages flag and replaces region-wide assumptions with per-chunk inspection of the actual page size when mapping, unmapping, sharing, and unsharing. This makes huge page handling correct for mixed-page regions and avoids relying on stale metadata that can easily become invalid as memory is remapped. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit e950c30a1051d27fd6dd9a48c53ffbc41ee773f2 Author: Stanislav Kinsburskii Date: Wed Dec 3 21:40:50 2025 +0000 mshv: Move region management to mshv_regions.c Refactor memory region management functions from mshv_root_main.c into mshv_regions.c for better modularity and code organization. Adjust function calls and headers to use the new implementation. Improve maintainability and separation of concerns in the mshv_root module. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 6f6aed2c497e8d80d8ed6b5a87c6f65dc7548b8f Author: Stanislav Kinsburskii Date: Wed Dec 3 21:40:45 2025 +0000 mshv: Centralize guest memory region destruction Centralize guest memory region destruction to prevent resource leaks and inconsistent cleanup across unmap and partition destruction paths. Unify region removal, encrypted partition access recovery, and region invalidation to improve maintainability and reliability. Reduce code duplication and make future updates less error-prone by encapsulating cleanup logic in a single helper. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Nuno Das Neves Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit df4ff5f6cf7864714d66c65ec7df582240a596a4 Author: Stanislav Kinsburskii Date: Wed Dec 3 21:40:39 2025 +0000 mshv: Refactor and rename memory region handling functions Simplify and unify memory region management to improve code clarity and reliability. Consolidate pinning and invalidation logic, adopt consistent naming, and remove redundant checks to reduce complexity. Enhance documentation and update call sites for maintainability. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Nuno Das Neves Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit 9d70ef7a18e0ec1653ac63020a13a5d4dda7cc0d Author: Jinank Jain Date: Mon Nov 24 14:25:59 2025 +0000 mshv: adjust interrupt control structure for ARM64 Interrupt control structure (union hv_interupt_control) has different fields when it comes to x86 vs ARM64. Bring in the correct structure from HyperV header files and adjust the existing interrupt routing code accordingly. Signed-off-by: Jinank Jain Signed-off-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit b5110eaf67530091343b519d8abd0cddd14660f2 Author: Gongwei Li Date: Fri Nov 21 11:10:41 2025 +0800 Drivers: hv: use kmalloc_array() instead of kmalloc() Replace kmalloc() with kmalloc_array() to prevent potential overflow, as recommended in Documentation/process/deprecated.rst. Signed-off-by: Gongwei Li Signed-off-by: Wei Liu commit c720e6a873cc97bdfe8912986e26ceaeeaa6b240 Author: Anirudh Rayabharam (Microsoft) Date: Wed Nov 19 17:17:08 2025 +0000 mshv: Add ioctl for self targeted passthrough hvcalls Allow MSHV_ROOT_HVCALL IOCTL on the /dev/mshv fd. This IOCTL would execute a passthrough hypercall targeting the root/parent partition i.e. HV_PARTITION_ID_SELF. This will be useful for the VMM to query things like supported synthetic processor features, supported VMM capabiliites etc. Since hypercalls targeting the host partition could potentially perform privileged operations, allow only a limited set of hypercalls. To begin with, allow only: HVCALL_GET_PARTITION_PROPERTY HVCALL_GET_PARTITION_PROPERTY_EX Signed-off-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 7bfe3b8ea6e30437e01fcb8e4f56ef6e4d986d0f Author: Naman Jain Date: Thu Nov 13 04:41:49 2025 +0000 Drivers: hv: Introduce mshv_vtl driver Provide an interface for Virtual Machine Monitor like OpenVMM and its use as OpenHCL paravisor to control VTL0 (Virtual trust Level). Expose devices and support IOCTLs for features like VTL creation, VTL0 memory management, context switch, making hypercalls, mapping VTL0 address space to VTL2 userspace, getting new VMBus messages and channel events in VTL2 etc. Co-developed-by: Roman Kisel Signed-off-by: Roman Kisel Co-developed-by: Saurabh Sengar Signed-off-by: Saurabh Sengar Reviewed-by: Michael Kelley Signed-off-by: Naman Jain Signed-off-by: Wei Liu commit 4ae4dde6f34a4124c65468ae4fa1f915fb40f900 Author: David Howells Date: Wed Dec 3 21:55:27 2025 +0000 cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 If a DIO read or an unbuffered read request extends beyond the EOF, the server will return a short read and a status code indicating that EOF was hit, which gets translated to -ENODATA. Note that the client does not cap the request at i_size, but asks for the amount requested in case there's a race on the server with a third party. Now, on the client side, the request will get split into multiple subrequests if rsize is smaller than the full request size. A subrequest that starts before or at the EOF and returns short data up to the EOF will be correctly handled, with the NETFS_SREQ_HIT_EOF flag being set, indicating to netfslib that we can't read more. If a subrequest, however, starts after the EOF and not at it, HIT_EOF will not be flagged, its error will be set to -ENODATA and it will be abandoned. This will cause the request as a whole to fail with -ENODATA. Fix this by setting NETFS_SREQ_HIT_EOF on any subrequest that lies beyond the EOF marker. Fixes: 1da29f2c39b6 ("netfs, cifs: Fix handling of short DIO read") Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit ef529f655a2c9f06b4d1cb8f2b3e577c7f6f7012 Author: Rajasi Mandal Date: Fri Dec 5 20:11:51 2025 +0000 cifs: client: allow changing multichannel mount options on remount Previously, the client did not update a session's channel state when multichannel or max_channels mount options were changed via remount. This led to inconsistent behavior and prevented enabling or disabling multichannel support without a full unmount/remount cycle. Enable dynamic reconfiguration of multichannel and max_channels during remount by: - Introducing smb3_sync_ses_chan_max(), a centralized function for channel updates which synchronizes the session's channels with the updated configuration. - Replacing cifs_disable_secondary_channels() with cifs_decrease_secondary_channels(), which accepts a disable_mchan flag to support multichannel disable when the server stops supporting multichannel. - Updating remount logic to detect changes in multichannel or max_channels and trigger appropriate session/channel updates. Current limitation: - The query_interfaces worker runs even when max_channels=1 so that multichannel can be enabled later via remount without requiring an unmount. This is a temporary approach and may be refined in the future. Users can safely modify multichannel and max_channels on an existing mount. The client will correctly adjust the session's channel state to match the new configuration, preserving durability where possible and avoiding unnecessary disconnects. Reviewed-by: Shyam Prasad N Signed-off-by: Rajasi Mandal Signed-off-by: Steve French commit 32a60868093aed5ccaa5e57f3b57f791f22ac133 Author: David Howells Date: Mon Dec 1 08:40:25 2025 +0000 cifs: Do some preparation prior to organising the function declarations Make some preparatory cleanups prior to running a script to organise the function declarations within the fs/smb/client/ headers. These include: (1) Remove "inline" from the dummy cifs_proc_init/clean() functions as they are in a .c file. (2) Move should_compress()'s kdoc comment to the .c file and remove kdoc markers from the comments. (3) Rename CIFS_ALLOW_INSECURE_LEGACY in #endif comments to have CONFIG_ on the front to allow the script to recognise it. (4) Don't let comments have bare words at the left margin as that confused the simplistic function detection code in the script. (5) Adjust some argument lists so that when and if the cleanup script is run they don't end up over 100 chars. (6) Fix a few comments to have missing '*' added or the "*/" moved to their own lines so that checkpatch doesn't moan over the cleanup script patch. (7) Move struct cifs_calc_sig_ctx to cifsglob.h. (8) Remove some __KERNEL__ conditionals. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit f80ac7eda1cf5205aaa2b676827ae1e312a5a894 Author: David Howells Date: Fri Oct 24 09:25:31 2025 +0100 cifs: Add a tracepoint to log EIO errors Add a tracepoint to log EIO errors and give it the capacity to convey up to two integers of information. This is then wrapped with three functions: int smb_EIO(enum smb_eio_trace trace) int smb_EIO1(enum smb_eio_trace trace, unsigned long info) int smb_EIO2(enum smb_eio_trace trace, unsigned long info, unsigned long info2) depending on how many bits of info are desired to be logged with any particular trace. The functions all return -EIO and can be used in place of -EIO. The trace argument is an enum value that gets translated to a string when the trace is printed. This makes is easier to log EIO instances when the client is under high load than turning on a printk wrapper such as cifs_dbg(). Granted, EIO could have its own separate EIO printing since EIO shouldn't happen. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 3a7b6d0afe6e01d054c9334cf1203953a0f72a1e Author: David Howells Date: Mon Aug 4 09:38:21 2025 +0100 cifs: Don't need state locking in smb2_get_mid_entry() There's no need to get ->srv_lock or ->ses_lock in smb2_get_mid_entry() as all that happens of relevance (to the lock) inside the locked sections is the reading of one status value in each. Replace the locking with READ_ONCE() and use a switch instead of a chain of if-statements. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 87fba18abbb8433a47045c785f2edc027e4d2bc5 Author: David Howells Date: Fri Oct 3 09:58:45 2025 +0100 cifs: Remove the server pointer from smb_message Remove the server pointer from smb_message and instead pass it down to all the things that access it. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: Tom Talpey (RDMA, smbdirect) cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 6a86a4cc281a5cfceda7af60ea6fa506b3db7430 Author: David Howells Date: Mon Dec 1 21:45:35 2025 +0000 cifs: Fix specification of function pointers Change the mid_receive_t, mid_callback_t and mid_handle_t function pointers to have the pointer marker in the typedef. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 28405cb5b2fde276036526b0143e60516e26b325 Author: David Howells Date: Tue Aug 5 14:16:28 2025 +0100 cifs: Replace SendReceiveBlockingLock() with SendReceive() plus flags Replace the smb1 transport's SendReceiveBlockingLock() with SendReceive() plus a couple of flags. This will then allow that to pick up the transport changes there. The first flag, CIFS_INTERRUPTIBLE_WAIT, is added to indicate that the wait should be interruptible and the second, CIFS_WINDOWS_LOCK, indicates that we need to send a Lock command with unlock type rather than a Cancel. send_lock_cancel() is then called from cifs_lock_cancel() which is called from the main transport loop in compound_send_recv(). [!] I *think* the error code handling is probably right. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 62432a3f514509b023ae053c4d6d631c2b347e94 Author: David Howells Date: Wed Aug 6 13:40:45 2025 +0100 cifs: Clean up some places where an extra kvec[] was required for rfc1002 Clean up some places where previously an extra element in the kvec array was being used to hold an rfc1002 header for SMB1 (a previous patch removed this and generated it on the fly as for SMB2/3). Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 6be09580df5cf87e601c1ec56b9a0c891d3a0bc8 Author: David Howells Date: Tue Aug 5 13:58:43 2025 +0100 cifs: Make smb1's SendReceive() wrap cifs_send_recv() Make the smb1 transport's SendReceive() simply wrap cifs_send_recv() as does SendReceive2(). This will then allow that to pick up the transport changes there. Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 83bfbd0bb9025f98fa62b44f93bd67466773d1db Author: David Howells Date: Fri Sep 5 15:34:15 2025 +0100 cifs: Remove the RFC1002 header from smb_hdr Remove the RFC1002 header from struct smb_hdr as used for SMB-1.0. This simplifies the SMB-1.0 code by simplifying a lot of places that have to add or subtract 4 to work around the fact that the RFC1002 header isn't really part of the message and the base for various offsets within the message is from the base of the smb_hdr, not the RFC1002 header. Further, clean up a bunch of places that require an extra kvec struct specifically pointing to the RFC1002 header, such that kvec[0].iov_base must be exactly 4 bytes before kvec[1].iov_base. This allows the header preamble size stuff to be removed too. The size of the request and response message are then handed around either directly or by summing the size of all the iov_len members in the kvec array for which we have a count. Also, this simplifies and cleans up the common transmission and receive paths for SMB1 and SMB2/3 as there no longer needs to be special handling casing for SMB1 messages as the RFC1002 header is now generated on the fly for SMB1 as it is for SMB2/3. Signed-off-by: David Howells Reviewed-by: Tom Talpey Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 9d85ac939d52e93d80efb01a299c6f0bedb30487 Author: David Howells Date: Tue Dec 2 16:24:53 2025 +0000 cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 If a DIO read or an unbuffered read request extends beyond the EOF, the server will return a short read and a status code indicating that EOF was hit, which gets translated to -ENODATA. Note that the client does not cap the request at i_size, but asks for the amount requested in case there's a race on the server with a third party. Now, on the client side, the request will get split into multiple subrequests if rsize is smaller than the full request size. A subrequest that starts before or at the EOF and returns short data up to the EOF will be correctly handled, with the NETFS_SREQ_HIT_EOF flag being set, indicating to netfslib that we can't read more. If a subrequest, however, starts after the EOF and not at it, HIT_EOF will not be flagged, its error will be set to -ENODATA and it will be abandoned. This will cause the request as a whole to fail with -ENODATA. Fix this by setting NETFS_SREQ_HIT_EOF on any subrequest that lies beyond the EOF marker. This can be reproduced by mounting with "cache=none,sign,vers=1.0" and doing a read of a file that's significantly bigger than the size of the file (e.g. attempting to read 64KiB from a 16KiB file). Fixes: a68c74865f51 ("cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3") Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) cc: Shyam Prasad N cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 7cd122b55283d3ceef71a5b723ccaa03a72284b4 Merge: 7203ca412fc8e8 eb028c33451af0 Author: Linus Torvalds Date: Fri Dec 5 14:36:21 2025 -0800 Merge tag 'pull-persistency' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull persistent dentry infrastructure and conversion from Al Viro: "Some filesystems use a kinda-sorta controlled dentry refcount leak to pin dentries of created objects in dcache (and undo it when removing those). A reference is grabbed and not released, but it's not actually _stored_ anywhere. That works, but it's hard to follow and verify; among other things, we have no way to tell _which_ of the increments is intended to be an unpaired one. Worse, on removal we need to decide whether the reference had already been dropped, which can be non-trivial if that removal is on umount and we need to figure out if this dentry is pinned due to e.g. unlink() not done. Usually that is handled by using kill_litter_super() as ->kill_sb(), but there are open-coded special cases of the same (consider e.g. /proc/self). Things get simpler if we introduce a new dentry flag (DCACHE_PERSISTENT) marking those "leaked" dentries. Having it set claims responsibility for +1 in refcount. The end result this series is aiming for: - get these unbalanced dget() and dput() replaced with new primitives that would, in addition to adjusting refcount, set and clear persistency flag. - instead of having kill_litter_super() mess with removing the remaining "leaked" references (e.g. for all tmpfs files that hadn't been removed prior to umount), have the regular shrink_dcache_for_umount() strip DCACHE_PERSISTENT of all dentries, dropping the corresponding reference if it had been set. After that kill_litter_super() becomes an equivalent of kill_anon_super(). Doing that in a single step is not feasible - it would affect too many places in too many filesystems. It has to be split into a series. This work has really started early in 2024; quite a few preliminary pieces have already gone into mainline. This chunk is finally getting to the meat of that stuff - infrastructure and most of the conversions to it. Some pieces are still sitting in the local branches, but the bulk of that stuff is here" * tag 'pull-persistency' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (54 commits) d_make_discardable(): warn if given a non-persistent dentry kill securityfs_recursive_remove() convert securityfs get rid of kill_litter_super() convert rust_binderfs convert nfsctl convert rpc_pipefs convert hypfs hypfs: swich hypfs_create_u64() to returning int hypfs: switch hypfs_create_str() to returning int hypfs: don't pin dentries twice convert gadgetfs gadgetfs: switch to simple_remove_by_name() convert functionfs functionfs: switch to simple_remove_by_name() functionfs: fix the open/removal races functionfs: need to cancel ->reset_work in ->kill_sb() functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}() functionfs: don't abuse ffs_data_closed() on fs shutdown convert selinuxfs ... commit 7203ca412fc8e8a0588e9adc0f777d3163f8dff3 Merge: ac20755937e037 faf3c923523e5c Author: Linus Torvalds Date: Fri Dec 5 13:52:43 2025 -0800 Merge tag 'mm-stable-2025-12-03-21-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: "__vmalloc()/kvmalloc() and no-block support" (Uladzislau Rezki) Rework the vmalloc() code to support non-blocking allocations (GFP_ATOIC, GFP_NOWAIT) "ksm: fix exec/fork inheritance" (xu xin) Fix a rare case where the KSM MMF_VM_MERGE_ANY prctl state is not inherited across fork/exec "mm/zswap: misc cleanup of code and documentations" (SeongJae Park) Some light maintenance work on the zswap code "mm/page_owner: add debugfs files 'show_handles' and 'show_stacks_handles'" (Mauricio Faria de Oliveira) Enhance the /sys/kernel/debug/page_owner debug feature by adding unique identifiers to differentiate the various stack traces so that userspace monitoring tools can better match stack traces over time "mm/page_alloc: pcp->batch cleanups" (Joshua Hahn) Minor alterations to the page allocator's per-cpu-pages feature "Improve UFFDIO_MOVE scalability by removing anon_vma lock" (Lokesh Gidra) Address a scalability issue in userfaultfd's UFFDIO_MOVE operation "kasan: cleanups for kasan_enabled() checks" (Sabyrzhan Tasbolatov) "drivers/base/node: fold node register and unregister functions" (Donet Tom) Clean up the NUMA node handling code a little "mm: some optimizations for prot numa" (Kefeng Wang) Cleanups and small optimizations to the NUMA allocation hinting code "mm/page_alloc: Batch callers of free_pcppages_bulk" (Joshua Hahn) Address long lock hold times at boot on large machines. These were causing (harmless) softlockup warnings "optimize the logic for handling dirty file folios during reclaim" (Baolin Wang) Remove some now-unnecessary work from page reclaim "mm/damon: allow DAMOS auto-tuned for per-memcg per-node memory usage" (SeongJae Park) Enhance the DAMOS auto-tuning feature "mm/damon: fixes for address alignment issues in DAMON_LRU_SORT and DAMON_RECLAIM" (Quanmin Yan) Fix DAMON_LRU_SORT and DAMON_RECLAIM with certain userspace configuration "expand mmap_prepare functionality, port more users" (Lorenzo Stoakes) Enhance the new(ish) file_operations.mmap_prepare() method and port additional callsites from the old ->mmap() over to ->mmap_prepare() "Fix stale IOTLB entries for kernel address space" (Lu Baolu) Fix a bug (and possible security issue on non-x86) in the IOMMU code. In some situations the IOMMU could be left hanging onto a stale kernel pagetable entry "mm/huge_memory: cleanup __split_unmapped_folio()" (Wei Yang) Clean up and optimize the folio splitting code "mm, swap: misc cleanup and bugfix" (Kairui Song) Some cleanups and a minor fix in the swap discard code "mm/damon: misc documentation fixups" (SeongJae Park) "mm/damon: support pin-point targets removal" (SeongJae Park) Permit userspace to remove a specific monitoring target in the middle of the current targets list "mm: MISC follow-up patches for linux/pgalloc.h" (Harry Yoo) A couple of cleanups related to mm header file inclusion "mm/swapfile.c: select swap devices of default priority round robin" (Baoquan He) improve the selection of swap devices for NUMA machines "mm: Convert memory block states (MEM_*) macros to enums" (Israel Batista) Change the memory block labels from macros to enums so they will appear in kernel debug info "ksm: perform a range-walk to jump over holes in break_ksm" (Pedro Demarchi Gomes) Address an inefficiency when KSM unmerges an address range "mm/damon/tests: fix memory bugs in kunit tests" (SeongJae Park) Fix leaks and unhandled malloc() failures in DAMON userspace unit tests "some cleanups for pageout()" (Baolin Wang) Clean up a couple of minor things in the page scanner's writeback-for-eviction code "mm/hugetlb: refactor sysfs/sysctl interfaces" (Hui Zhu) Move hugetlb's sysfs/sysctl handling code into a new file "introduce VM_MAYBE_GUARD and make it sticky" (Lorenzo Stoakes) Make the VMA guard regions available in /proc/pid/smaps and improves the mergeability of guarded VMAs "mm: perform guard region install/remove under VMA lock" (Lorenzo Stoakes) Reduce mmap lock contention for callers performing VMA guard region operations "vma_start_write_killable" (Matthew Wilcox) Start work on permitting applications to be killed when they are waiting on a read_lock on the VMA lock "mm/damon/tests: add more tests for online parameters commit" (SeongJae Park) Add additional userspace testing of DAMON's "commit" feature "mm/damon: misc cleanups" (SeongJae Park) "make VM_SOFTDIRTY a sticky VMA flag" (Lorenzo Stoakes) Address the possible loss of a VMA's VM_SOFTDIRTY flag when that VMA is merged with another "mm: support device-private THP" (Balbir Singh) Introduce support for Transparent Huge Page (THP) migration in zone device-private memory "Optimize folio split in memory failure" (Zi Yan) "mm/huge_memory: Define split_type and consolidate split support checks" (Wei Yang) Some more cleanups in the folio splitting code "mm: remove is_swap_[pte, pmd]() + non-swap entries, introduce leaf entries" (Lorenzo Stoakes) Clean up our handling of pagetable leaf entries by introducing the concept of 'software leaf entries', of type softleaf_t "reparent the THP split queue" (Muchun Song) Reparent the THP split queue to its parent memcg. This is in preparation for addressing the long-standing "dying memcg" problem, wherein dead memcg's linger for too long, consuming memory resources "unify PMD scan results and remove redundant cleanup" (Wei Yang) A little cleanup in the hugepage collapse code "zram: introduce writeback bio batching" (Sergey Senozhatsky) Improve zram writeback efficiency by introducing batched bio writeback support "memcg: cleanup the memcg stats interfaces" (Shakeel Butt) Clean up our handling of the interrupt safety of some memcg stats "make vmalloc gfp flags usage more apparent" (Vishal Moola) Clean up vmalloc's handling of incoming GFP flags "mm: Add soft-dirty and uffd-wp support for RISC-V" (Chunyan Zhang) Teach soft dirty and userfaultfd write protect tracking to use RISC-V's Svrsw60t59b extension "mm: swap: small fixes and comment cleanups" (Youngjun Park) Fix a small bug and clean up some of the swap code "initial work on making VMA flags a bitmap" (Lorenzo Stoakes) Start work on converting the vma struct's flags to a bitmap, so we stop running out of them, especially on 32-bit "mm/swapfile: fix and cleanup swap list iterations" (Youngjun Park) Address a possible bug in the swap discard code and clean things up a little [ This merge also reverts commit ebb9aeb980e5 ("vfio/nvgrace-gpu: register device memory for poison handling") because it looks broken to me, I've asked for clarification - Linus ] * tag 'mm-stable-2025-12-03-21-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (321 commits) mm: fix vma_start_write_killable() signal handling mm/swapfile: use plist_for_each_entry in __folio_throttle_swaprate mm/swapfile: fix list iteration when next node is removed during discard fs/proc/task_mmu.c: fix make_uffd_wp_huge_pte() huge pte handling mm/kfence: add reboot notifier to disable KFENCE on shutdown memcg: remove inc/dec_lruvec_kmem_state helpers selftests/mm/uffd: initialize char variable to Null mm: fix DEBUG_RODATA_TEST indentation in Kconfig mm: introduce VMA flags bitmap type tools/testing/vma: eliminate dependency on vma->__vm_flags mm: simplify and rename mm flags function for clarity mm: declare VMA flags by bit zram: fix a spelling mistake mm/page_alloc: optimize lowmem_reserve max lookup using its semantic monotonicity mm/vmscan: skip increasing kswapd_failures when reclaim was boosted pagemap: update BUDDY flag documentation mm: swap: remove scan_swap_map_slots() references from comments mm: swap: change swap_alloc_slow() to void mm, swap: remove redundant comment for read_swap_cache_async mm, swap: use SWP_SOLIDSTATE to determine if swap is rotational ... commit c5108c58b991cb6cac78947ac3811321895190e2 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:35 2025 +0100 tracing: Fix typo in trace_seq.c Fix typo "wont" to "won't". Link: https://patch.msgid.link/20251121221835.28032-15-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 0f17df72a7149b65e51e03d4ab7b2fd6d5cab0dc Author: Maurice Hieronymus Date: Fri Nov 21 23:18:34 2025 +0100 tracing: Fix typo in trace_probe.c Fix typo "separater" to "separator". Link: https://patch.msgid.link/20251121221835.28032-14-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit fa3f733d97e5482a63e8d55b86810d67999d9f07 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:33 2025 +0100 tracing: Fix multiple typos in trace_osnoise.c Fix multiple typos in comments: "Anotate" -> "Annotate" "infor" -> "info" "timestemp" -> "timestamp" "tread" -> "thread" "varaibles" -> "variables" "wast" -> "waste" Link: https://patch.msgid.link/20251121221835.28032-13-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 6ce5725d73734434ca91bd6d9f24524248584c27 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:32 2025 +0100 tracing: Fix multiple typos in trace_events_user.c Fix multiple typos in comments: "ambigious" -> "ambiguous" "explictly" -> "explicitly" "Uknown" -> "Unknown" Link: https://patch.msgid.link/20251121221835.28032-12-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 0166d3e31aaf831145520bd8c6f16f6ff5ddb1e6 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:31 2025 +0100 tracing: Fix typo in trace_events_trigger.c Fix typo "componenents" to "components". Link: https://patch.msgid.link/20251121221835.28032-11-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit c29e75532e98d78cc557038017247643286c4e86 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:30 2025 +0100 tracing: Fix typo in trace_events_hist.c Fix typo "tigger" to "trigger". Link: https://patch.msgid.link/20251121221835.28032-10-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 86f320904e2f8795e3f1851f18ad7bf3f43d1c79 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:29 2025 +0100 tracing: Fix typo in trace_events_filter.c Fix typo "singe" to "single". Link: https://patch.msgid.link/20251121221835.28032-9-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit d4290963d5af2f10810a8887c1037f6d70e5a9bd Author: Maurice Hieronymus Date: Fri Nov 21 23:18:28 2025 +0100 tracing: Fix multiple typos in trace_events.c Fix multiple typos in comments: "appened" -> "appended" "paranthesis" -> "parenthesis" "parethesis" -> "parenthesis" "wont" -> "won't" Link: https://patch.msgid.link/20251121221835.28032-8-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 8d4cdbd45cd4c1671359cc408f900d51c7e1d107 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:27 2025 +0100 tracing: Fix multiple typos in trace.c Fix multiple typos in comments: "alse" -> "also" "enabed" -> "enabled" "instane" -> "instance" "outputing" -> "outputting" "seperated" -> "separated" Link: https://patch.msgid.link/20251121221835.28032-7-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 81354f63359fb66b205650c62859e0ac414e6ecf Author: Maurice Hieronymus Date: Fri Nov 21 23:18:26 2025 +0100 tracing: Fix typo in ring_buffer_benchmark.c Fix typo "overwite" to "overwrite". Link: https://patch.msgid.link/20251121221835.28032-6-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 1edb820ae9779ae29526d4285298b0bf93a8d542 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:25 2025 +0100 tracing: Fix multiple typos in ring_buffer.c Fix multiple typos in comments: "ording" -> "ordering" "scatch" -> "scratch" "wont" -> "won't" Link: https://patch.msgid.link/20251121221835.28032-5-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 2ec7345c2d589f3e7358e753ef5b6ae7be66d846 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:24 2025 +0100 tracing: Fix typo in fprobe.c Fix typo "funciton" to "function". Link: https://patch.msgid.link/20251121221835.28032-4-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 9c3f3b8fea2d615e128418a12c430e2890169859 Author: Maurice Hieronymus Date: Fri Nov 21 23:18:23 2025 +0100 tracing: Fix typo in fpgraph.c Fix typo "reservered" to "reserved". Link: https://patch.msgid.link/20251121221835.28032-3-mhi@mailbox.org Signed-off-by: Maurice Hieronymus Signed-off-by: Steven Rostedt (Google) commit 47ef834209e5981f443240d8a8b45bf680df22aa Author: Steven Rostedt Date: Thu Dec 4 15:19:35 2025 -0500 tracing: Fix fixed array of synthetic event The commit 4d38328eb442d ("tracing: Fix synth event printk format for str fields") replaced "%.*s" with "%s" but missed removing the number size of the dynamic and static strings. The commit e1a453a57bc7 ("tracing: Do not add length to print format in synthetic events") fixed the dynamic part but did not fix the static part. That is, with the commands: # echo 's:wake_lat char[] wakee; u64 delta;' >> /sys/kernel/tracing/dynamic_events # echo 'hist:keys=pid:ts=common_timestamp.usecs if !(common_flags & 0x18)' > /sys/kernel/tracing/events/sched/sched_waking/trigger # echo 'hist:keys=next_pid:delta=common_timestamp.usecs-$ts:onmatch(sched.sched_waking).trace(wake_lat,next_comm,$delta)' > /sys/kernel/tracing/events/sched/sched_switch/trigger That caused the output of: -0 [001] d..5. 193.428167: wake_lat: wakee=(efault)sshd-sessiondelta=155 sshd-session-879 [001] d..5. 193.811080: wake_lat: wakee=(efault)kworker/u34:5delta=58 -0 [002] d..5. 193.811198: wake_lat: wakee=(efault)bashdelta=91 The commit e1a453a57bc7 fixed the part where the synthetic event had "char[] wakee". But if one were to replace that with a static size string: # echo 's:wake_lat char[16] wakee; u64 delta;' >> /sys/kernel/tracing/dynamic_events Where "wakee" is defined as "char[16]" and not "char[]" making it a static size, the code triggered the "(efaul)" again. Remove the added STR_VAR_LEN_MAX size as the string is still going to be nul terminated. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Douglas Raillard Link: https://patch.msgid.link/20251204151935.5fa30355@gandalf.local.home Fixes: e1a453a57bc7 ("tracing: Do not add length to print format in synthetic events") Signed-off-by: Steven Rostedt (Google) commit 02e7769e38c87c92b82db59923d3b0598d153903 Author: Steven Rostedt Date: Tue Dec 2 16:17:51 2025 -0500 tracing: Fix enabling of tracing on file release The trace file will pause tracing if the tracing instance has the "pause-on-trace" option is set. This happens when the file is opened, and it is unpaused when the file is closed. When this was first added, there was only one user that paused tracing. On open, the check to pause was: if (!iter->snapshot && (tr->trace_flags & TRACE_ITER(PAUSE_ON_TRACE))) Where if it is not the snapshot tracer and the "pause-on-trace" option is set, then it increments a "stop_count" of the trace instance. On close, the check is: if (!iter->snapshot && tr->stop_count) That is, if it is not the snapshot buffer and it was stopped, it will re-enable tracing. Now there's more places that stop tracing. This means, if something else stops tracing the tr->stop_count will be non-zero, and that means if the trace file is closed, it will decrement the stop_count even though it never incremented it. This causes a warning because when the user that stopped tracing enables it again, the stop_count goes below zero. Instead of relying on the stop_count being set to know if the close of the trace file should enable tracing again, add a new flag to the trace iterator. The trace iterator is unique per open of the trace file, and if the open stops tracing set the trace iterator PAUSE flag. On close, if the PAUSE flag is set, then re-enable it again. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251202161751.24abaaf1@gandalf.local.home Fixes: 06e0a548bad0f ("tracing: Do not disable tracing when reading the trace file") Reported-by: syzbot+ccdec3bfe0beec58a38d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/692f44a5.a70a0220.2ea503.00c8.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) commit 979e2ec58de2b600955b8290d1df549e33d67347 Author: Madhur Kumar Date: Fri Dec 5 14:48:04 2025 +0530 drm: nouveau: Replace sprintf() with sysfs_emit() Replace sprintf() calls with sysfs_emit() to follow current kernel coding standards. sysfs_emit() is the preferred method for formatting sysfs output as it provides better bounds checking and is more secure. Signed-off-by: Madhur Kumar Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251205091804.317801-1-madhurkumar004@gmail.com Fixes: 11b7d895216f ("drm/nouveau/pm: manual pwm fanspeed management for nv40+ boards") Cc: # v3.3+ commit d84e47edf156a953ed340ba6a202dcd3ea39ba0a Author: René Rebe Date: Tue Dec 2 16:49:52 2025 +0100 drm/nouveau: fix circular dep oops from vendored i2c encoder Since commit a73583107af9 ("drm/nouveau: vendor in drm_encoder_slave API") nouveau appears to be broken for all dispnv04 GPUs (before NV50). Depending on the kernel version, either having no display output and hanging in kernel for a long time, or even oopsing in the cleanup path like: Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac ... nouveau 0000:0a:00.0: drm: 0x14C5: Parsing digital output script table BUG: Unable to handle kernel data access on read at 0x00041520 Faulting instruction address: 0xc0003d0001be0844 Oops: Kernel access of bad area, sig: 11 [#1] BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=8 NUMA PowerMac Modules linked in: windfarm_cpufreq_clamp windfarm_smu_sensors windfarm_smu_controls windfarm_pm112 snd_aoa_codec_onyx snd_aoa_fabric_layout snd_aoa windfarm_pid jo apple_mfi_fastcharge rndis_host cdc_ether usbnet mii snd_aoa_i2sbus snd_aoa_soundbus snd_pcm snd_timer snd soundcore rack_meter windfarm_smu_sat windfarm_max6690_s m75_sensor windfarm_core gpu_sched drm_gpuvm drm_exec drm_client_lib drm_ttm_helper ttm drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks syscopyar _sys_fops i2c_algo_bit backlight uio_pdrv_genirq uio uninorth_agp agpgart zram dm_mod dax ipv6 nfsv4 dns_resolver nfs lockd grace sunrpc offb cfbfillrect cfbimgblt ont input_leds sr_mod cdrom sd_mod uas ata_generic hid_apple hid_generic usbhid hid usb_storage pata_macio sata_svw libata firewire_ohci scsi_mod firewire_core ohci ehci_pci ehci_hcd tg3 ohci_hcd libphy usbcore usb_common nls_base led_class CPU: 0 UID: 0 PID: 245 Comm: (udev-worker) Not tainted 6.14.0-09584-g7d06015d936c #7 PREEMPTLAZY Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac NIP: c0003d0001be0844 LR: c0003d0001be0830 CTR: 0000000000000000 REGS: c0000000053f70e0 TRAP: 0300 Not tainted (6.14.0-09584-g7d06015d936c) MSR: 9000000000009032 CR: 24222220 XER: 00000000 DAR: 0000000000041520 DSISR: 40000000 IRQMASK: 0 \x0aGPR00: c0003d0001be0830 c0000000053f7380 c0003d0000911900 c000000007bc6800 \x0aGPR04: 0000000000000000 0000000000000000 c000000007bc6e70 0000000000000001 \x0aGPR08: 01f3040000000000 0000000000041520 0000000000000000 c0003d0000813958 \x0aGPR12: c000000000071a48 c000000000e28000 0000000000000020 0000000000000000 \x0aGPR16: 0000000000000000 0000000000f52630 0000000000000000 0000000000000000 \x0aGPR20: 0000000000000000 0000000000000000 0000000000000001 c0003d0000928528 \x0aGPR24: c0003d0000928598 0000000000000000 c000000007025480 c000000007025480 \x0aGPR28: c0000000010b4000 0000000000000000 c000000007bc1800 c000000007bc6800 NIP [c0003d0001be0844] nv_crtc_destroy+0x44/0xd4 [nouveau] LR [c0003d0001be0830] nv_crtc_destroy+0x30/0xd4 [nouveau] Call Trace: [c0000000053f7380] [c0003d0001be0830] nv_crtc_destroy+0x30/0xd4 [nouveau] (unreliable) [c0000000053f73c0] [c0003d00007f7bf4] drm_mode_config_cleanup+0x27c/0x30c [drm] [c0000000053f7490] [c0003d0001bdea50] nouveau_display_create+0x1cc/0x550 [nouveau] [c0000000053f7500] [c0003d0001bcc29c] nouveau_drm_device_init+0x1c8/0x844 [nouveau] [c0000000053f75e0] [c0003d0001bcc9ec] nouveau_drm_probe+0xd4/0x1e0 [nouveau] [c0000000053f7670] [c000000000557d24] local_pci_probe+0x50/0xa8 [c0000000053f76f0] [c000000000557fa8] pci_device_probe+0x22c/0x240 [c0000000053f7760] [c0000000005fff3c] really_probe+0x188/0x31c [c0000000053f77e0] [c000000000600204] __driver_probe_device+0x134/0x13c [c0000000053f7860] [c0000000006002c0] driver_probe_device+0x3c/0xb4 [c0000000053f78a0] [c000000000600534] __driver_attach+0x118/0x128 [c0000000053f78e0] [c0000000005fe038] bus_for_each_dev+0xa8/0xf4 [c0000000053f7950] [c0000000005ff460] driver_attach+0x2c/0x40 [c0000000053f7970] [c0000000005fea68] bus_add_driver+0x130/0x278 [c0000000053f7a00] [c00000000060117c] driver_register+0x9c/0x1a0 [c0000000053f7a80] [c00000000055623c] __pci_register_driver+0x5c/0x70 [c0000000053f7aa0] [c0003d0001c058a0] nouveau_drm_init+0x254/0x278 [nouveau] [c0000000053f7b10] [c00000000000e9bc] do_one_initcall+0x84/0x268 [c0000000053f7bf0] [c0000000001a0ba0] do_init_module+0x70/0x2d8 [c0000000053f7c70] [c0000000001a42bc] init_module_from_file+0xb4/0x108 [c0000000053f7d50] [c0000000001a4504] sys_finit_module+0x1ac/0x478 [c0000000053f7e10] [c000000000023230] system_call_exception+0x1a4/0x20c [c0000000053f7e50] [c00000000000c554] system_call_common+0xf4/0x258 --- interrupt: c00 at 0xfd5f988 NIP: 000000000fd5f988 LR: 000000000ff9b148 CTR: 0000000000000000 REGS: c0000000053f7e80 TRAP: 0c00 Not tainted (6.14.0-09584-g7d06015d936c) MSR: 100000000000d032 CR: 28222244 XER: 00000000 IRQMASK: 0 \x0aGPR00: 0000000000000161 00000000ffcdc2d0 00000000405db160 0000000000000020 \x0aGPR04: 000000000ffa2c9c 0000000000000000 000000000000001f 0000000000000045 \x0aGPR08: 0000000011a13770 0000000000000000 0000000000000000 0000000000000000 \x0aGPR12: 0000000000000000 0000000010249d8c 0000000000000020 0000000000000000 \x0aGPR16: 0000000000000000 0000000000f52630 0000000000000000 0000000000000000 \x0aGPR20: 0000000000000000 0000000000000000 0000000000000000 0000000011a11a70 \x0aGPR24: 0000000011a13580 0000000011a11950 0000000011a11a70 0000000000020000 \x0aGPR28: 000000000ffa2c9c 0000000000000000 000000000ffafc40 0000000011a11a70 NIP [000000000fd5f988] 0xfd5f988 LR [000000000ff9b148] 0xff9b148 --- interrupt: c00 Code: f821ffc1 418200ac e93f0000 e9290038 e9291468 eba90000 48026c0d e8410018 e93f06aa 3d290001 392982a4 79291f24 <7fdd482a> 2c3e0000 41820030 7fc3f378 ---[ end trace 0000000000000000 ]--- This is caused by the i2c encoder modules vendored into nouveau/ now depending on the equally vendored nouveau_i2c_encoder_destroy function. Trying to auto-load this modules hangs on nouveau initialization until timeout, and nouveau continues without i2c video encoders. Fix by avoiding nouveau dependency by __always_inlining that helper functions into those i2c video encoder modules. Fixes: a73583107af9 ("drm/nouveau: vendor in drm_encoder_slave API") Signed-off-by: René Rebe Reviewed-by: Lyude Paul [Lyude: fixed commit reference in description] Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251202.164952.2216481867721531616.rene@exactco.de commit 2bdc2c0e12fac56e41ec05fb771ead986ea6dac0 Author: Madhur Kumar Date: Thu Dec 4 17:38:22 2025 +0530 drm/nouveau: refactor deprecated strcpy strcpy() has been deprecated because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Use the safer strscpy() instead. Signed-off-by: Madhur Kumar Reviewed-by: Lyude Paul Fixes: 15a996bbb697 ("drm/nouveau: assign fence_chan->name correctly") Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251204120822.17502-1-madhurkumar004@gmail.com commit ac20755937e037e586b1ca18a6717d31b1cbce93 Merge: d1d36025a61790 564195c1a33c8f Author: Linus Torvalds Date: Fri Dec 5 11:15:37 2025 -0800 Merge tag 'sysctl-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Move jiffies converters out of kernel/sysctl.c Move the jiffies converters into kernel/time/jiffies.c and replace the pipe-max-size proc_handler converter with a macro based version. This is all part of the effort to relocate non-sysctl logic out of kernel/sysctl.c into more relevant subsystems. No functional changes. - Generalize proc handler converter creation Remove duplicated sysctl converter logic by consolidating it in macros. These are used inside sysctl core as well as in pipe.c and jiffies.c. Converter kernel and user space pointer args are now automatically const qualified for the convenience of the caller. No functional changes. - Miscellaneous Fix kernel-doc format warnings, remove unnecessary __user qualifiers, and move the nmi_watchdog sysctl into .rodata. - Testing This series was run through sysctl selftests/kunit test suite in x86_64. It went into linux-next after rc2, giving it a good 4/5 weeks of testing. * tag 'sysctl-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: (21 commits) sysctl: Wrap do_proc_douintvec with the public function proc_douintvec_conv sysctl: Create pipe-max-size converter using sysctl UINT macros sysctl: Move proc_doulongvec_ms_jiffies_minmax to kernel/time/jiffies.c sysctl: Move jiffies converters to kernel/time/jiffies.c sysctl: Move UINT converter macros to sysctl header sysctl: Move INT converter macros to sysctl header sysctl: Allow custom converters from outside sysctl sysctl: remove __user qualifier from stack_erasing_sysctl buffer argument sysctl: Create macro for user-to-kernel uint converter sysctl: Add optional range checking to SYSCTL_UINT_CONV_CUSTOM sysctl: Create unsigned int converter using new macro sysctl: Add optional range checking to SYSCTL_INT_CONV_CUSTOM sysctl: Create integer converters with one macro sysctl: Create converter functions with two new macros sysctl: Discriminate between kernel and user converter params sysctl: Indicate the direction of operation with macro names sysctl: Remove superfluous __do_proc_* indirection sysctl: Remove superfluous tbl_data param from "dovec" functions sysctl: Replace void pointer with const pointer to ctl_table sysctl: fix kernel-doc format warning ... commit d1d36025a617906c1f442fe47af4a43532bff374 Merge: 2e8c1c6a504399 cd06078a38aaed Author: Linus Torvalds Date: Fri Dec 5 10:55:47 2025 -0800 Merge tag 'probes-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: "fprobe performance enhancement using rhltable: - use rhltable for fprobe_ip_table. The fprobe IP table has been converted to use an rhltable for improved performance when dealing with a large number of probed functions - Fix a suspicious RCU usage warning of the above change in the fprobe entry handler - Remove an unused local variable of the above change - Fix to initialize fprobe_ip_table in core_initcall() Performance optimization of fprobe by ftrace: - Use ftrace instead of fgraph for entry only probes. This avoids the unneeded overhead of fgraph stack setup - Also update fprobe selftest for entry-only probe - fprobe: Use ftrace only if CONFIG_DYNAMIC_FTRACE_WITH_ARGS or WITH_REGS is defined Cleanup probe event subsystems: - Allocate traceprobe_parse_context per probe instead of each probe argument parsing. This reduce memory allocation/free of temporary working memory - Cleanup code using __free() - Replace strcpy() with memcpy() in __trace_probe_log_err()" * tag 'probes-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: fprobe: use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_ARGS lib/test_fprobe: add testcase for mixed fprobe tracing: fprobe: optimization for entry only case tracing: fprobe: Fix to init fprobe_ip_table earlier tracing: fprobe: Remove unused local variable tracing: probes: Replace strcpy() with memcpy() in __trace_probe_log_err() tracing: fprobe: fix suspicious rcu usage in fprobe_entry tracing: uprobe: eprobes: Allocate traceprobe_parse_context per probe tracing: uprobes: Cleanup __trace_uprobe_create() with __free() tracing: eprobe: Cleanup eprobe event using __free() tracing: probes: Use __free() for trace_probe_log tracing: fprobe: use rhltable for fprobe_ip_table commit 2e8c1c6a5043999d867d0dcf38be96903c99601a Merge: 2ba59045fba395 d3042cbe84a060 Author: Linus Torvalds Date: Fri Dec 5 10:53:43 2025 -0800 Merge tag 'ktest-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest fix from Steven Rostedt: - Fix incorrect variable in error message in config-bisect.pl If the old config file fails to get copied as the last good or bad config file, then it fails the program and prints an error message. But the variable used to print what the old config's name was incorrect. It was $config when it should have been $output_config. * tag 'ktest-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest.pl: Fix uninitialized var in config-bisect.pl commit 2ba59045fba395c076a4880012583fdac25c6d7f Merge: 0b1b4a3d8ebec3 b1e7a590a01336 Author: Linus Torvalds Date: Fri Dec 5 10:50:24 2025 -0800 Merge tag 'trace-ringbuffer-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull trace ring-buffer cleanup from Steven Rostedt: - Add helper functions for allocations The allocation of the per CPU buffer descriptor, the buffer page descriptors and the buffer page data itself can be pretty ugly. Add some helper macros and a function to have the code that allocates buffer pages and such look a little cleaner. * tag 'trace-ringbuffer-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Add helper functions for allocations commit 2eeb09fe1c5173b659929f92fee4461796ca8c14 Author: Arnaldo Carvalho de Melo Date: Thu Dec 4 13:11:49 2025 -0300 libperf: Use 'extern' in LIBPERF_API visibility macro Use 'extern' on LIBPERF_API to address this issue that started appearing with gcc 15, first seen in ubuntu 25.10: evlist.c: In function 'perf_evlist__purge': evlist.c:202:17: error: implicit declaration of function 'perf_evsel__delete'; did you mean 'perf_evsel__exit'? [-Wimplicit-function-declaration] 202 | perf_evsel__delete(pos); | ^~~~~~~~~~~~~~~~~~ | perf_evsel__exit evlist.c:202:17: error: nested extern declaration of 'perf_evsel__delete' [-Werror=nested-externs] evlist.c: In function 'perf_evlist__open': evlist.c:261:23: error: implicit declaration of function 'perf_evsel__open'; did you mean 'perf_evsel__exit'? [-Wimplicit-function-declaration] 261 | err = perf_evsel__open(evsel, evsel->cpus, evsel->threads); | ^~~~~~~~~~~~~~~~ | perf_evsel__exit evlist.c:261:23: error: nested extern declaration of 'perf_evsel__open' [-Werror=nested-externs] Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 0b1b4a3d8ebec3c42231c306d4b9a5153d047674 Merge: 0771cee974607f bbaacdc339d4bd Author: Linus Torvalds Date: Fri Dec 5 10:17:00 2025 -0800 Merge tag 'trace-rv-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier updates from Steven Rostedt: - Adapt the ftracetest script to be run from a different folder This uses the already existing OPT_TEST_DIR but extends it further to run independent tests, then add an --rv flag to allow using the script for testing RV (mostly) independently on ftrace. - Add basic RV selftests in selftests/verification for more validations Add more validations for available/enabled monitors and reactors. This could have caught the bug introducing kernel panic solved above. Tests use ftracetest. - Convert react() function in reactor to use va_list directly Use a central helper to handle the variadic arguments. Clean up macros and mark functions as static. - Add lockdep annotations to reactors to have lockdep complain of errors If the reactors are called from improper context. Useful to develop new reactors. This highlights a warning in the panic reactor that is related to the printk subsystem and not to RV. - Convert core RV code to use lock guards and __free helpers This completely removes goto statements. - Fix compilation if !CONFIG_RV_REACTORS Fix the warning by keeping LTL monitor variable as always static. * tag 'trace-rv-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv: Fix compilation if !CONFIG_RV_REACTORS rv: Convert to use __free rv: Convert to use lock guard rv: Add explicit lockdep context for reactors rv: Make rv_reacting_on() static rv: Pass va_list to reactors selftests/verification: Add initial RV tests selftest/ftrace: Generalise ftracetest to use with RV commit 0771cee974607ffcf19ff6022f971865db8e0b4a Merge: 69c5079b49fa12 c264534c394a29 Author: Linus Torvalds Date: Fri Dec 5 10:13:04 2025 -0800 Merge tag 'ftrace-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace updates from Steven Rostedt: - Fix regression of pid filtering of function graph tracer When the function graph tracer allowed multiple instances of graph tracing using subops, the filtering by pid broke. The ftrace_ops->private that was used for pid filtering wasn't updated on creation. The wrong function entry callback was used when pid filtering was enabled when the function graph tracer started, which meant that the pid filtering wasn't happening. - Remove no longer needed ftrace_trace_task() With PID filtering working via ftrace_pids_enabled() and fgraph_pid_func(), the coarse-grained ftrace_trace_task() check in graph_entry() is obsolete. It was only a fallback for uninitialized op->private (now fixed), and its removal ensures consistent PID filtering with standard function tracing. * tag 'ftrace-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: fgraph: Remove coarse PID filtering from graph_entry() fgraph: Check ftrace_pids_enabled on registration for early filtering fgraph: Initialize ftrace_ops->private for function graph ops commit 69c5079b49fa120c1a108b6e28b3a6a8e4ae2db5 Merge: 36492b7141b9ab f6ed9c5d3190cf Author: Linus Torvalds Date: Fri Dec 5 09:51:37 2025 -0800 Merge tag 'trace-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Extend tracing option mask to 64 bits The trace options were defined by a 32 bit variable. This limits the tracing instances to have a total of 32 different options. As that limit has been hit, and more options are being added, increase the option mask to a 64 bit number, doubling the number of options available. As this is required for the kprobe topic branches as well as the tracing topic branch, a separate branch was created and merged into both. - Make trace_user_fault_read() available for the rest of tracing The function trace_user_fault_read() is used by trace_marker file read to allow reading user space to be done fast and without locking or allocations. Make this available so that the system call trace events can use it too. - Have system call trace events read user space values Now that the system call trace events callbacks are called in a faultable context, take advantage of this and read the user space buffers for various system calls. For example, show the path name of the openat system call instead of just showing the pointer to that path name in user space. Also show the contents of the buffer of the write system call. Several system call trace events are updated to make tracing into a light weight strace tool for all applications in the system. - Update perf system call tracing to do the same - And a config and syscall_user_buf_size file to control the size of the buffer Limit the amount of data that can be read from user space. The default size is 63 bytes but that can be expanded to 165 bytes. - Allow the persistent ring buffer to print system calls normally The persistent ring buffer prints trace events by their type and ignores the print_fmt. This is because the print_fmt may change from kernel to kernel. As the system call output is fixed by the system call ABI itself, there's no reason to limit that. This makes reading the system call events in the persistent ring buffer much nicer and easier to understand. - Add options to show text offset to function profiler The function profiler that counts the number of times a function is hit currently lists all functions by its name and offset. But this becomes ambiguous when there are several functions with the same name. Add a tracing option that changes the output to be that of '_text+offset' instead. Now a user space tool can use this information to map the '_text+offset' to the unique function it is counting. - Report bad dynamic event command If a bad command is passed to the dynamic_events file, report it properly in the error log. - Clean up tracer options Clean up the tracer option code a bit, by removing some useless code and also using switch statements instead of a series of if statements. - Have tracing options be instance specific Tracers can have their own options (function tracer, irqsoff tracer, function graph tracer, etc). But now that the same tracer can be enabled in multiple trace instances, their options are still global. The API is per instance, thus changing one affects other instances. This isn't even consistent, as the option take affect differently depending on when an tracer started in an instance. Make the options for instances only affect the instance it is changed under. - Optimize pid_list lock contention Whenever the pid_list is read, it uses a spin lock. This happens at every sched switch. Taking the lock at sched switch can be removed by instead using a seqlock counter. - Clean up the trace trigger structures The trigger code uses two different structures to implement a single tigger. This was due to trying to reuse code for the two different types of triggers (always on trigger, and count limited trigger). But by adding a single field to one structure, the other structure could be absorbed into the first structure making he code easier to understand. - Create a bulk garbage collector for trace triggers If user space has triggers for several hundreds of events and then removes them, it can take several seconds to complete. This is because each removal calls tracepoint_synchronize_unregister() that can take hundreds of milliseconds to complete. Instead, create a helper thread that will do the clean up. When a trigger is removed, it will create the kthread if it isn't already created, and then add the trigger to a llist. The kthread will take the items off the llist, call tracepoint_synchronize_unregister(), and then remove the items it took off. It will then check if there's more items to free before sleeping. This makes user space removing all these triggers to finish in less than a second. - Allow function tracing of some of the tracing infrastructure code Because the tracing code can cause recursion issues if it is traced by the function tracer the entire tracing directory disables function tracing. But not all of tracing causes issues if it is traced. Namely, the event tracing code. Add a config that enables some of the tracing code to be traced to help in debugging it. Note, when this is enabled, it does add noise to general function tracing, especially if events are enabled as well (which is a common case). - Add boot-time backup instance for persistent buffer The persistent ring buffer is used mostly for kernel crash analysis in the field. One issue is that if there's a crash, the data in the persistent ring buffer must be read before tracing can begin using it. This slows down the boot process. Once tracing starts in the persistent ring buffer, the old data must be freed and the addresses no longer match and old events can't be in the buffer with new events. Create a way to create a backup buffer that copies the persistent ring buffer at boot up. Then after a crash, the always on tracer can begin immediately as well as the normal boot process while the crash analysis tooling uses the backup buffer. After the backup buffer is finished being read, it can be removed. - Enable function graph args and return address options at the same time Currently the when reading of arguments in the function graph tracer is enabled, the option to record the parent function in the entry event can not be enabled. Update the code so that it can. - Add new struct_offset() helper macro Add a new macro that takes a pointer to a structure and a name of one of its members and it will return the offset of that member. This allows the ring buffer code to simplify the following: From: size = struct_size(entry, buf, cnt - sizeof(entry->id)); To: size = struct_offset(entry, id) + cnt; There should be other simplifications that this macro can help out with as well * tag 'trace-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (42 commits) overflow: Introduce struct_offset() to get offset of member function_graph: Enable funcgraph-args and funcgraph-retaddr to work simultaneously tracing: Add boot-time backup of persistent ring buffer ftrace: Allow tracing of some of the tracing code tracing: Use strim() in trigger_process_regex() instead of skip_spaces() tracing: Add bulk garbage collection of freeing event_trigger_data tracing: Remove unneeded event_mutex lock in event_trigger_regex_release() tracing: Merge struct event_trigger_ops into struct event_command tracing: Remove get_trigger_ops() and add count_func() from trigger ops tracing: Show the tracer options in boot-time created instance ftrace: Avoid redundant initialization in register_ftrace_direct tracing: Remove unused variable in tracing_trace_options_show() fgraph: Make fgraph_no_sleep_time signed tracing: Convert function graph set_flags() to use a switch() statement tracing: Have function graph tracer option sleep-time be per instance tracing: Move graph-time out of function graph options tracing: Have function graph tracer option funcgraph-irqs be per instance trace/pid_list: optimize pid_list->lock contention tracing: Have function graph tracer define options per instance tracing: Have function tracer define options per instance ... commit 36492b7141b9abc967e92c991af32c670351dc16 Merge: 5779de8d36ac5a b21f90e2e45038 Author: Linus Torvalds Date: Fri Dec 5 09:37:41 2025 -0800 Merge tag 'tracepoints-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull unused tracepoints update from Steven Rostedt: "Detect unused tracepoints. If a tracepoint is defined but never used (TRACE_EVENT() created but no trace_() called), it can take up to or more than 5K of memory each. This can add up as there are around a hundred unused tracepoints with various configs. That is 500K of wasted memory. Add a make build parameter of "UT=1" to have the build warn if an unused tracepoint is detected in the build. This allows detection of unused tracepoints to be upstream so that outreachy and the mentoring project can have new developers look for fixing them, without having these warnings suddenly show up when someone upgrades their kernel. When all known unused tracepoints are removed, then the "UT=1" build parameter can be removed and unused tracepoints will always warn. This will catch new unused tracepoints after the current ones have been removed. Summary: - Separate out elf functions from sorttable.c Move out the ELF parsing functions from sorttable.c so that the tracing tooling can use it. - Add a tracepoint verifier tool to the build process If "UT=1" is added to the kernel command line, any unused tracepoints will trigger a warning at build time. - Do not warn about unused tracepoints for tracepoints that are exported There are sever cases where a tracepoint is created by the kernel and used by modules. Since there's no easy way to detect if these are truly unused since the users are in modules, if a tracepoint is exported, assume it will eventually be used by a module. Note, there's not many exported tracepoints so this should not be a problem to ignore them. - Have building of modules also detect unused tracepoints Do not only check the main vmlinux for unused tracepoints, also check modules. If a module is defining a tracepoint it should be using it. - Add the tracepoint-update program to the ignore file The new tracepoint-update program needs to be ignored by git" * tag 'tracepoints-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: scripts: add tracepoint-update to the list of ignores files tracing: Add warnings for unused tracepoints for modules tracing: Allow tracepoint-update.c to work with modules tracepoint: Do not warn for unused event that is exported tracing: Add a tracepoint verification check at build time sorttable: Move ELF parsing into scripts/elf-parse.[ch] commit 5779de8d36ac5a0c929f276096a499b03ae0afa7 Merge: ed1b409137bb9f 3138df6f0cd04a Author: Linus Torvalds Date: Fri Dec 5 09:34:01 2025 -0800 Merge tag 'trace-tools-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull rtla trace tooling updates from Steven Rostedt: - Officially add Tomas Glozar as a maintainer to RTLA tool - Add for_each_monitored_cpu() helper In multiple places, RTLA tools iterate over the list of CPUs running tracer threads. Use single helper instead of repeating the for/if combination. - Remove unused variable option_index in argument parsing RTLA tools use getopt_long() for argument parsing. For its last argument, an unused variable "option_index" is passed. Remove the variable and pass NULL to getopt_long() to shorten the naturally long parsing functions, and make them more readable. - Fix unassigned nr_cpus after code consolidation In recent code consolidation, timerlat tool cleanup, previously implemented separately for each tool, was moved to a common function timerlat_free(). The cleanup relies on nr_cpus being set. This was not done in the new function, leaving the variable uninitialized. Initialize the variable properly, and remove silencing of compiler warning for uninitialized variables. - Stop tracing on user latency in BPF mode Despite the name, rtla-timerlat's -T/--thread option sets timerlat's stop_tracing_total_us option, which also stops tracing on return-from-user latency, not only on thread latency. Implement the same behavior also in BPF sample collection stop tracing handler to avoid a discrepancy and restore correspondence of behavior with the equivalent option of cyclictest. - Fix threshold actions always triggering A bug in threshold action logic caused the action to execute even if tracing did not stop because of threshold. Fix the logic to stop correctly. - Fix few minor issues in tests Extend tests that were shown to need it to 5s, fix osnoise test calling timerlat by mistake, and use new, more reliable output checking in timerlat's "top stop at failed action" test. - Do not print usage on argument parsing error RTLA prints the entire usage message on encountering errors in argument parsing, like a malformed CPU list. The usage message has gotten too long. Instead of printing it, use newly added fatal() helper function to simply exit with the error message, excluding the usage. - Fix unintuitive -C/--cgroup interface "-C cgroup" and "--cgroup cgroup" are invalid syntax, despite that being a common way to specify an option with argument. Moreover, using them fails silently and no cgroup is set. Create new helper function to unify the handling of all such options and allow all of: -Xsomething -X=something -X something as well as the equivalent for the long option. - Fix -a overriding -t argument filename Fix a bug where -a following -t custom_file.txt overrides the custom filename with the default timerlat_trace.txt. - Stop tracing correctly on multiple events at once In some race scenarios, RTLA BPF sample collection might send multiple stop tracing events via the BPF ringbuffer at once. Compare the number of events for != 0 instead of == 1 to cover for this scenario and stop tracing properly. * tag 'trace-tools-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/timerlat: Exit top main loop on any non-zero wait_retval rtla/tests: Don't rely on matching ^1ALL rtla: Fix -a overriding -t argument rtla: Fix -C/--cgroup interface tools/rtla: Replace osnoise_hist_usage("...") with fatal("...") tools/rtla: Replace osnoise_top_usage("...") with fatal("...") tools/rtla: Replace timerlat_hist_usage("...") with fatal("...") tools/rtla: Replace timerlat_top_usage("...") with fatal("...") tools/rtla: Add fatal() and replace error handling pattern rtla/tests: Fix osnoise test calling timerlat rtla/tests: Extend action tests to 5s tools/rtla: Fix --on-threshold always triggering rtla/timerlat_bpf: Stop tracing on user latency tools/rtla: Fix unassigned nr_cpus tools/rtla: Remove unused optional option_index tools/rtla: Add for_each_monitored_cpu() helper MAINTAINERS: Add Tomas Glozar as a maintainer to RTLA tool commit 55d57b3bcc7efcab812a8179e2dc17d781302997 Author: Jens Axboe Date: Fri Dec 5 10:20:47 2025 -0700 io_uring/poll: unify poll waitqueue entry and list removal For some cases, the order in which the waitq entry list and head writing happens is important, for others it doesn't really matter. But it's somewhat confusing to have them spread out over the file. Abstract out the nicely documented code in io_pollfree_wake() and move it into a helper, and use that helper consistently rather than having other call sites manually do the same thing. While at it, correct a comment function name as well. Signed-off-by: Jens Axboe commit ed1b409137bb9f49090362d34360ab80f88b9a5e Merge: 3ee37abbbd6ebc 7454048db27d68 Author: Linus Torvalds Date: Fri Dec 5 09:11:02 2025 -0800 Merge tag 'hardening-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - string: Add missing kernel-doc return descriptions (Kriish Sharma) - Update some mis-typed allocations These correct some accidentally wrong types used in allocations (that didn't affect the resulting size) that never got picked up from the batch I sent a few months ago. - Enable GCC diagnostic context for value-tracking warnings This results in better GCC diagnostics for the value range tracking, so we can get better visibility into where those values are coming from when we get out-of-bounds warnings at compile time. * tag 'hardening-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: kbuild: Enable GCC diagnostic context for value-tracking warnings string: Add missing kernel-doc return descriptions media: iris: Cast iris_hfi_gen2_get_instance() allocation type drm/plane: Remove const qualifier from plane->modifiers allocation type comedi: Adjust range_table_list allocation type commit 3ee37abbbd6ebc84284f32b91145932074f9ae47 Merge: 5d45c729edd34e b692553573683b Author: Linus Torvalds Date: Fri Dec 5 09:08:13 2025 -0800 Merge tag 'pstore-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore update from Kees Cook: - pstore/ram: Update module parameters from platform data (Tzung-Bi Shih) * tag 'pstore-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Update module parameters from platform data commit 5d45c729edd34eae25987b45bb5e0c5a534a9f5b Merge: 2061f18ad76eca f7f78098690d60 Author: Linus Torvalds Date: Fri Dec 5 08:59:41 2025 -0800 Merge tag 'configfs-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux Pull configfs updates from Andreas Hindborg: "Two commits changing constness of the configfs vtable pointers. We plan to follow up with changes at call sites down the road" * tag 'configfs-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/a.hindborg/linux: configfs: Constify ct_item_ops in struct config_item_type configfs: Constify ct_group_ops in struct config_item_type commit a4c694bfc2455e82b7caf6045ca893d123e0ed11 Author: Joanne Koong Date: Thu Dec 4 15:54:50 2025 -0800 io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields buf->addr and buf->len reside in memory shared with userspace. They should be written with WRITE_ONCE() to guarantee atomic stores and prevent tearing or other unsafe compiler optimizations. Signed-off-by: Joanne Koong Cc: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 79edb7f596db99c01b25c1deebeffede6b48b505 Merge: 3aa9940035a17e 2ff147fdfa99b8 Author: Arnd Bergmann Date: Fri Dec 5 15:32:21 2025 +0100 Merge tag 'samsung-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM changes for v6.19 Fix WiFi on Exynos4210 and Exynos4412 boards with Broadcom chip after system suspend and resume, by using cap-power-off-card to power off the WiFi during suspend. * tag 'samsung-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Signed-off-by: Arnd Bergmann commit 68f9bbf4dfc356ccc6586ba6e7dd79576c48f7f0 Merge: 8e2baac0f2bb5c 990eb9a8eb4540 Author: Arnd Bergmann Date: Fri Dec 5 15:31:33 2025 +0100 Merge tag 'samsung-drivers-6.19-2-late' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers-late Samsung SoC drivers for v6.19, part two Two fixes for Exynos PMU (Power Management Unit) driver: 1. Silence lockdep warning being actually a false positive, but quite disturbing during testing. Issue was introduced in v6.18. 2. Drop device refcount when requesting device regmap with exynos_get_pmu_regmap_by_phandle(). Issue was introduced much earlier (around v6.9), with code being rewritten in between. * tag 'samsung-drivers-6.19-2-late' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: soc: samsung: exynos-pmu: fix device leak on regmap lookup soc: samsung: exynos-pmu: Fix structure initialization Signed-off-by: Arnd Bergmann commit d740d52e342bae9c88c719b015d6065783b961a1 Author: HariKrishna Sagala Date: Thu Dec 4 10:52:03 2025 +0530 ALSA: usb-audio: Initialize status1 to fix uninitialized symbol errors Initialize 'status1' with a default value to resolve the static analysis smatch reported error "uninitialized symbol 'status1'". The 'status1' variable is used to create a buff using "kmemdup". So, ensure to initialize the value before it is read. Suggested-by: Takashi Iwai Signed-off-by: HariKrishna Sagala Link: https://patch.msgid.link/20251204052201.16286-3-hariconscious@gmail.com Signed-off-by: Takashi Iwai commit 210d77cca3d0494ed30a5c628b20c1d95fa04fb1 Author: Junrui Luo Date: Wed Dec 3 12:27:03 2025 +0800 ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller than the event header size (8 bytes). Fix by using min_t() to clamp the copy size, This ensures we never copy more than the user requested. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB78810656377E79E58350D951AFD9A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Takashi Iwai commit 3ce8f4a501f61edbb5cb3fe13520f09ffb33396e Author: Arnd Bergmann Date: Thu Dec 4 10:53:47 2025 +0100 ARM: omap1: avoid symbol clashes in fiq handler The ams-delta-fiq-handler.S file has a number of symbols with fairly generic names, including one named 'exit' that causes a compiler warning in some configuration options: vmlinux.o: error: exit() function name creates ambiguity with -ffunction-sections Change all these symbols to use a .L prefix to make them local to the fiq handler. Reviewed-by: Janusz Krzysztofik Link: https://lore.kernel.org/r/20251204095355.1032786-1-arnd@kernel.org Signed-off-by: Arnd Bergmann commit 79a45ddcdbba330f5139c7c7ff7042d69cf147b2 Author: Mark Brown Date: Thu Dec 4 19:39:34 2025 +0000 regulator: fixed: Rely on the core freeing the enable GPIO In order to simplify ownership rules for enable GPIOs supplied by drivers regulator_register() always takes ownership of them, even if it ends up failing for some other reason. We therefore should not free the GPIO if registration fails but just let the core worry about things. Fixes: 636f4618b1cd (regulator: fixed: fix GPIO descriptor leak on register failure) Reported-by: Diederik de Haas Closes: https://lore.kernel.org/r/DEPEYUF5BRGY.UKFBWRRE8HNP@cknow-tech.com Tested-by: Diederik de Haas Signed-off-by: Mark Brown Link: https://patch.msgid.link/20251204-regulator-fixed-fix-gpiod-leak-v1-1-48efea5b82c2@kernel.org Signed-off-by: Mark Brown commit c34b04cc6178f33c08331568c7fd25c5b9a39f66 Author: Denis Arefev Date: Tue Dec 2 13:13:36 2025 +0300 ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() The acpi_get_first_physical_node() function can return NULL, in which case the get_device() function also returns NULL, but this value is then dereferenced without checking,so add a check to prevent a crash. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7b2f3eb492da ("ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Reviewed-by: Richard Fitzgerald Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251202101338.11437-1-arefev@swemel.ru commit fe93446b5ebdaa89a8f97b15668c077921a65140 Author: Thomas Weißschuh Date: Wed Dec 3 14:57:57 2025 +0100 vfs: use UAPI types for new struct delegation definition Using libc types and headers from the UAPI headers is problematic as it introduces a dependency on a full C toolchain. Use the fixed-width integer types provided by the UAPI headers instead. Fixes: 1602bad16d7d ("vfs: expose delegation support to userland") Fixes: 4be9e04ebf75 ("vfs: add needed headers for new struct delegation definition") Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251203-uapi-fcntl-v1-1-490c67bf3425@linutronix.de Acked-by: Arnd Bergmann Acked-by: Jeff Layton Signed-off-by: Christian Brauner commit 8cf01d0c4372ef5777d20c3c3a83936fd1c670f8 Author: Edward Adam Davis Date: Thu Dec 4 21:16:22 2025 +0800 mqueue: correct the type of ro to int The ro variable, being of type bool, caused the -EROFS return value from mnt_want_write() to be implicitly converted to 1. This prevented the file from being correctly acquired, thus triggering the issue reported by syzbot [1]. Changing the type of ro to int allows the system to correctly identify the reason for the file open failure. [1] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] Call Trace: do_mq_open+0x5a0/0x770 ipc/mqueue.c:932 __do_sys_mq_open ipc/mqueue.c:945 [inline] __se_sys_mq_open ipc/mqueue.c:938 [inline] __x64_sys_mq_open+0x16a/0x1c0 ipc/mqueue.c:938 Fixes: f2573685bd0c ("ipc: convert do_mq_open() to FD_ADD()") Reported-by: syzbot+40f42779048f7476e2e0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=40f42779048f7476e2e0 Tested-by: syzbot+40f42779048f7476e2e0@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://patch.msgid.link/tencent_369728EA76ED36CD98793A6D942C956C4C0A@qq.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit afb9917d9b374ecb77d478c2a052e20875c6e232 Author: Christian Brauner Date: Fri Dec 5 13:50:31 2025 +0100 Revert "net/socket: convert sock_map_fd() to FD_ADD()" This reverts commit 245f0d1c622b0183ce4f44b3e39aeacf78fae594. When allocating a file sock_alloc_file() consumes the socket reference unconditionally which isn't correctly handled in the conversion. This can be fixed by massaging this appropriately but this is best left for next cycle. Reported-by: Xin Long Link: https://lore.kernel.org/CADvbK_ewub4ZZK-tZg8GBQbDFHWhd9a48C+AFXZ93pMsssCrUg@mail.gmail.com Signed-off-by: Christian Brauner commit 3e281113f871d7f9c69ca55a4d806a72180b7e8a Author: Eric Sandeen Date: Tue Dec 2 16:34:51 2025 -0600 9p: fix new mount API cache option handling After commit 4eb3117888a92, 9p needs to be able to accept numerical cache= mount options as well as the string "shortcuts" because the option is printed numerically in /proc/mounts rather than by string. This was missed in the mount API conversion, which used an enum for the shortcuts and therefore could not handle a numeric equivalent as an argument to the cache option. Fix this by removing the enum and reverting to the slightly more open-coded option handling for Opt_cache, with the reinstated get_cache_mode() helper. Signed-off-by: Eric Sandeen Message-ID: <48cdeec9-5bb9-4c7a-a203-39bb8e0ef443@redhat.com> Tested-by: Remi Pommarel Signed-off-by: Dominique Martinet commit f0445613314f474c1a0ec6fa8a5cd153a618f1b6 Author: Eric Sandeen Date: Tue Dec 2 16:30:53 2025 -0600 9p: fix cache/debug options printing in v9fs_show_options commit 4eb3117888a92 changed the cache= option to accept either string shortcuts or bitfield values. It also changed /proc/mounts to emit the option as the hexadecimal numeric value rather than the shortcut string. However, by printing "cache=%x" without the leading 0x, shortcuts such as "cache=loose" will emit "cache=f" and 'f' is not a string that is parseable by kstrtoint(), so remounting may fail if a remount with "cache=f" is attempted. debug=%x has had the same problem since options have been displayed in c4fac9100456 ("9p: Implement show_options") Fix these by adding the 0x prefix to the hexadecimal value shown in /proc/mounts. Fixes: 4eb3117888a92 ("fs/9p: Rework cache modes and add new options to Documentation") Signed-off-by: Eric Sandeen Message-ID: <54b93378-dcf1-4b04-922d-c8b4393da299@redhat.com> [Dominique: use %#x at Al Viro's suggestion, also handle debug] Tested-by: Remi Pommarel Signed-off-by: Dominique Martinet commit 164312662ae9764b83b84d97afb25c42eb2be473 Author: Abdun Nihaal Date: Wed Dec 3 09:25:44 2025 +0530 fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() The page allocated for vmem using __get_free_pages() is not freed on the error paths after it. Fix that by adding a corresponding __free_pages() call to the error path. Fixes: facd94bc458a ("fbdev: ssd1307fb: Allocate page aligned video memory.") Signed-off-by: Abdun Nihaal Signed-off-by: Helge Deller commit 479acb9db3199cdb70e5478a6f633b5f20c7d8df Author: Dan Carpenter Date: Wed Dec 3 20:35:23 2025 +0300 drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() The drm_property_create_signed_range() function doesn't return error pointers it returns NULL on error. Fix the error checking to match. Fixes: 8f7179a1027d ("drm/atomic: Add support for mouse hotspots") Signed-off-by: Dan Carpenter Reviewed-by: Javier Martinez Canillas Reviewed-by: Zack Rusin Link: https://patch.msgid.link/aTB023cfcIPkCsFS@stanley.mountain Signed-off-by: Maxime Ripard commit 35e282c1868de3c9d15f9a8812cbb2e7da06b0c1 Author: Luca Ceresoli Date: Thu Nov 27 09:42:40 2025 +0100 drm/bridge: ti-sn65dsi83: ignore PLL_UNLOCK errors On hardware based on Toradex Verdin AM62 the recovery mechanism added by commit ad5c6ecef27e ("drm: bridge: ti-sn65dsi83: Add error recovery mechanism") has been reported [0] to make the display turn on and off and and the kernel logging "Unexpected link status 0x01". According to the report, the error recovery mechanism is triggered by the PLL_UNLOCK error going active. Analysis suggested the board is unable to provide the correct DSI clock neede by the SN65DSI84, to which the TI SN65DSI84 reacts by raising the PLL_UNLOCK, while the display still works apparently without issues. On other hardware, where all the clocks are within the components specifications, the PLL_UNLOCK bit does not trigger while the display is in normal use. It can trigger for e.g. electromagnetic interference, which is a transient event and exactly the reason why the error recovery mechanism has been implemented. Idelly the PLL_UNLOCK bit could be ignored when working out of specification, but this requires to detect in software whether it triggers because the device is working out of specification but visually correctly for the user or for good reasons (e.g. EMI, or even because working out of specifications but compromising the visual output). The ongoing analysis as of this writing [1][2] has not yet found a way for the driver to discriminate among the two cases. So as a temporary measure mask the PLL_UNLOCK error bit unconditionally. [0] https://lore.kernel.org/r/bhkn6hley4xrol5o3ytn343h4unkwsr26p6s6ltcwexnrsjsdx@mgkdf6ztow42 [1] https://lore.kernel.org/all/b71e941c-fc8a-4ac1-9407-0fe7df73b412@gmail.com/ [2] https://lore.kernel.org/all/20251125103900.31750-1-francesco@dolcini.it/ Fixes: ad5c6ecef27e ("drm: bridge: ti-sn65dsi83: Add error recovery mechanism") Closes: https://lore.kernel.org/r/bhkn6hley4xrol5o3ytn343h4unkwsr26p6s6ltcwexnrsjsdx@mgkdf6ztow42 Cc: stable@vger.kernel.org # 6.15+ Reported-by: João Paulo Gonçalves Tested-by: Emanuele Ghidoli Co-developed-by: Hervé Codina Signed-off-by: Hervé Codina Signed-off-by: Luca Ceresoli Link: https://patch.msgid.link/20251127-drm-ti-sn65dsi83-ignore-pll-unlock-v1-1-8a03fdf562e9@bootlin.com Signed-off-by: Maxime Ripard commit db9c67bfca8585bb7f00f289056e7b83502861c8 Author: Arnd Bergmann Date: Thu Dec 4 10:48:47 2025 +0100 gpio: qixis: select CONFIG_REGMAP_MMIO The regmap drivers need to be selected by each user, without that there can be configurations that fail to link: x86_64-linux-ld: drivers/gpio/gpio-qixis-fpga.o: in function `qixis_cpld_gpio_probe': gpio-qixis-fpga.c:(.text+0x13a): undefined reference to `__devm_regmap_init_mmio_clk' Fixes: e88500247dc3 ("gpio: add QIXIS FPGA GPIO controller") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20251204094928.1031494-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit 52721cfc78c76b09c66e092b52617006390ae96a Author: Wentao Guan Date: Thu Dec 4 18:13:04 2025 +0800 gpio: regmap: Fix memleak in error path in gpio_regmap_register() Call gpiochip_remove() to free the resources allocated by gpiochip_add_data() in error path. Fixes: 553b75d4bfe9 ("gpio: regmap: Allow to allocate regmap-irq device") Fixes: ae495810cffe ("gpio: regmap: add the .fixed_direction_output configuration parameter") CC: stable@vger.kernel.org Co-developed-by: WangYuli Signed-off-by: WangYuli Signed-off-by: Wentao Guan Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251204101303.30353-1-guanwentao@uniontech.com [Bartosz: reworked the commit message] Signed-off-by: Bartosz Golaszewski commit 150215b89bcf708356abcb7d3cafdd1e6068598b Author: David Laight Date: Wed Nov 19 22:41:25 2025 +0000 drivers/xen: use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Reviewed-by: Juergen Gross Message-ID: <20251119224140.8616-30-david.laight.linux@gmail.com> Signed-off-by: Juergen Gross commit b7960b90486139022d2d39caad90db252c469bab Author: Jarkko Sakkinen Date: Tue Sep 30 23:44:19 2025 +0300 tpm2-sessions: Open code tpm_buf_append_hmac_session() Open code 'tpm_buf_append_hmac_session_opt' to the call site, as it only masks a call sequence and does otherwise nothing particularly useful. Signed-off-by: Jarkko Sakkinen Reviewed-by: Jonathan McDowell commit bc677a9216e1396322e42692e9c01cce04a7afc0 Author: Jarkko Sakkinen Date: Tue Sep 30 16:07:35 2025 +0300 tpm2-sessions: Remove 'attributes' parameter from tpm_buf_append_auth Remove 'attributes' parameter from 'tpm_buf_append_auth', as it is not used by the function. Fixes: 27184f8905ba ("tpm: Opt-in in disable PCR integrity protection") Signed-off-by: Jarkko Sakkinen Reviewed-by: Jonathan McDowell commit bda1cbf73c6e241267c286427f2ed52b5735d872 Author: Jarkko Sakkinen Date: Mon Dec 1 15:38:02 2025 +0200 tpm2-sessions: Fix tpm2_read_public range checks tpm2_read_public() has some rudimentary range checks but the function does not ensure that the response buffer has enough bytes for the full TPMT_HA payload. Re-implement the function with necessary checks and validation, and return name and name size for all handle types back to the caller. Cc: stable@vger.kernel.org # v6.10+ Fixes: d0a25bb961e6 ("tpm: Add HMAC session name/handle append") Signed-off-by: Jarkko Sakkinen Reviewed-by: Jonathan McDowell commit 6e9722e9a7bfe1bbad649937c811076acf86e1fd Author: Jarkko Sakkinen Date: Sun Nov 30 21:07:12 2025 +0200 tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the issue by only processing known values and returning -EINVAL for unrecognized values. Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so that errors are detected before causing any spurious TPM traffic. End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted. Cc: stable@vger.kernel.org # v6.10+ Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API") Reviewed-by: Jonathan McDowell Signed-off-by: Jarkko Sakkinen commit 2061f18ad76ecaddf8ed17df81b8611ea88dbddd Merge: deb879faa9d2f3 9891d2f79a9fe9 Author: Linus Torvalds Date: Thu Dec 4 20:10:28 2025 -0800 Merge tag 'caps-pr-20251204' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux Pull capabilities update from Serge Hallyn: "Ryan Foster had sent a patch to add testing of the rootid_owns_currentns() function. That patch pointed out that this function was not as clear as it should be. Fix it: - Clarify the intent of the function in the name - Split the function so that the base functionality is easier to test from a kunit test" * tag 'caps-pr-20251204' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux: Clarify the rootid_owns_currentns commit 0f45353dd48037af61f70df3468d25ca46afe909 Merge: f7e3f852a42d7c 13989207ee29c4 Author: Jens Axboe Date: Thu Dec 4 20:58:19 2025 -0700 Merge tag 'nvme-6.19-2025-12-04' of git://git.infradead.org/nvme into block-6.19 Pull NVMe updates from Keith: "- Subsystem usage cleanups (Max) - Endpoint device fixes (Shin'ichiro) - Debug statements (Gerd) - FC fabrics cleanups and fixes (Daniel) - Consistent alloc API usages (Israel) - Code comment updates (Chu) - Authentication retry fix (Justin)" * tag 'nvme-6.19-2025-12-04' of git://git.infradead.org/nvme: nvme-fabrics: add ENOKEY to no retry criteria for authentication failures nvme-auth: use kvfree() for memory allocated with kvcalloc() nvmet-tcp: use kvcalloc for commands array nvmet-rdma: use kvcalloc for commands and responses arrays nvme: fix typo error in nvme target nvmet-fc: use pr_* print macros instead of dev_* nvmet-fcloop: remove unused lsdir member. nvmet-fcloop: check all request and response have been processed nvme-fc: check all request and response have been processed nvme-fc: don't hold rport lock when putting ctrl nvme-pci: add debug message on fail to read CSTS nvme-pci: print error message on failure in nvme_probe nvmet: pci-epf: fix DMA channel debug print nvmet: pci-epf: move DMA initialization to EPC init callback nvmet: remove redundant subsysnqn field from ctrl nvmet: add sanity checks when freeing subsystem commit deb879faa9d2f327ac5c079d9d1a1747b79260e3 Merge: 028bd4a14631ea c7685d11108acb Author: Linus Torvalds Date: Thu Dec 4 19:42:53 2025 -0800 Merge tag 'drm-next-2025-12-05' of https://gitlab.freedesktop.org/drm/kernel Pull more drm updates from Dave Airlie: "There was some additional intel code for color operations we wanted to land. However I discovered I missed a pull for the xe vfio driver which I had sorted into 6.20 in my brain, until Thomas mentioned it. This contains the xe vfio code, a bunch of xe fixes that were waiting and the i915 color management support. I'd like to include it as part of keeping the two main vendors on the same page and giving a good cross-driver experience for userspace when it starts using it. vfio: - add a vfio_pci variant driver for Intel xe/i915 display: - add plane color management support xe: - Add scope-based cleanup helper for runtime PM - vfio xe driver prerequisites and exports - fix vfio link error - Fix a memory leak - Fix a 64-bit division - vf migration fix - LRC pause fix" * tag 'drm-next-2025-12-05' of https://gitlab.freedesktop.org/drm/kernel: (25 commits) drm/i915/color: Enable Plane Color Pipelines drm/i915/color: Add 3D LUT to color pipeline drm/i915/color: Add registers for 3D LUT drm/i915/color: Program Plane Post CSC Registers drm/i915/color: Program Pre-CSC registers drm/i915/color: Add framework to program PRE/POST CSC LUT drm/i915: Add register definitions for Plane Post CSC drm/i915: Add register definitions for Plane Degamma drm/i915/color: Add plane CTM callback for D12 and beyond drm/i915/color: Preserve sign bit when int_bits is Zero drm/i915/color: Add framework to program CSC drm/i915/color: Create a transfer function color pipeline drm/i915/color: Add helper to create intel colorop drm/i915: Add intel_color_op drm/i915/display: Add identifiers for driver specific blocks drm/xe/pf: fix VFIO link error drm/xe: Protect against unset LRC when pausing submissions drm/xe/vf: Start re-emission from first unsignaled job during VF migration drm/xe/pf: Use div_u64 when calculating GGTT profile drm/xe: Fix memory leak when handling pagefault vma ... commit 028bd4a14631ea2a1c923930bff96ffd0fda03a6 Merge: 16460bf96c3137 09b71a58ee355a Author: Linus Torvalds Date: Thu Dec 4 19:30:09 2025 -0800 Merge tag 'tpmdd-next-6.19-rc1-v4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "This contains changes to unify TPM return code translation between trusted_tpm2 and TPM driver itself. Other than that the changes are either bug fixes or minor imrovements" * tag 'tpmdd-next-6.19-rc1-v4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: Use tpm_ret_to_err() in trusted_tpm2 tpm: Use -EPERM as fallback error code in tpm_ret_to_err tpm: Cap the number of PCR banks tpm: Remove tpm_find_get_ops tpm: add WQ_PERCPU to alloc_workqueue users tpm_crb: add missing loc parameter to kerneldoc tpm_crb: Fix a spelling mistake selftests: tpm2: Fix ill defined assertions commit 16460bf96c31377c14d9f11a6da8c6f508e3443e Merge: bc69ed975203c3 6ce0dd9f54ea97 Author: Linus Torvalds Date: Thu Dec 4 19:27:11 2025 -0800 Merge tag 'ata-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Niklas Cassel: - Add DT binding for the Eswin EIC7700 SoC SATA Controller (Yulin Lu) - Allow 'iommus' property in the Synopsys DWC AHCI SATA controller DT binding (Rob Herring) - Replace deprecated strcpy with strscpy in the pata_it821x driver (Thorsten Blum) - Add Iomega Clik! PCMCIA ATA/ATAPI Adapter PCMCIA ID to the pata_pcmcia driver (René Rebe) - Add ATA_QUIRK_NOLPM quirk for two Silicon Motion SSDs with broken LPM support (me) - Add flag WQ_PERCPU to the workqueue in the libata-sff helper library to explicitly request the use of the per-CPU behavior (Marco Crivellari) * tag 'ata-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC ata: pata_pcmcia: Add Iomega Clik! PCMCIA ATA/ATAPI Adapter ata: libata-sff: add WQ_PERCPU to alloc_workqueue users dt-bindings: ata: snps,dwc-ahci: Allow 'iommus' property ata: pata_it821x: Replace deprecated strcpy with strscpy in it821x_display_disk dt-bindings: ata: eswin: Document for EIC7700 SoC ahci commit bc69ed975203c3ffe34f873531f3052914d4e497 Merge: 55aa394a5ed871 205dd7a5d6ad6f Author: Linus Torvalds Date: Thu Dec 4 18:59:21 2025 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Just a bunch of fixes and cleanups, mostly very simple. Several features were merged through net-next this time around" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_pci: drop kernel.h vhost: switch to arrays of feature bits vhost/test: add test specific macro for features virtio: clean up features qword/dword terms vduse: add WQ_PERCPU to alloc_workqueue users virtio_balloon: add WQ_PERCPU to alloc_workqueue users vdpa/pds: use %pe for ERR_PTR() in event handler registration vhost: Fix kthread worker cgroup failure handling virtio: vdpa: Fix reference count leak in octep_sriov_enable() vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues virtio: fix map ops comment virtio: fix virtqueue_set_affinity() docs virtio: standardize Returns documentation style virtio: fix grammar in virtio_map_ops docs virtio: fix grammar in virtio_queue_info docs virtio: fix whitespace in virtio_config_ops virtio: fix typo in virtio_device_ready() comment virtio: fix kernel-doc for mapping/free_coherent functions virtio_vdpa: fix misleading return in void function commit 55aa394a5ed871208eac11c5f4677cafd258c4dd Merge: 056daec2925dc2 80a85a771deb11 Author: Linus Torvalds Date: Thu Dec 4 18:54:37 2025 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "This has another new RDMA driver 'bng_en' for latest generation Broadcom NICs. There might be one more new driver still to come. Otherwise it is a fairly quite cycle. Summary: - Minor driver bug fixes and updates to cxgb4, rxe, rdmavt, bnxt_re, mlx5 - Many bug fix patches for irdma - WQ_PERCPU annotations and system_dfl_wq changes - Improved mlx5 support for "other eswitches" and multiple PFs - 1600Gbps link speed reporting support. Four Digits Now! - New driver bng_en for latest generation Broadcom NICs - Bonding support for hns - Adjust mlx5's hmm based ODP to work with the very large address space created by the new 5 level paging default on x86 - Lockdep fixups in rxe and siw" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (65 commits) RDMA/rxe: reclassify sockets in order to avoid false positives from lockdep RDMA/siw: reclassify sockets in order to avoid false positives from lockdep RDMA/bng_re: Remove prefetch instruction RDMA/core: Reduce cond_resched() frequency in __ib_umem_release RDMA/irdma: Fix SRQ shadow area address initialization RDMA/irdma: Remove doorbell elision logic RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY RDMA/irdma: Add missing mutex destroy RDMA/irdma: Fix SIGBUS in AEQ destroy RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 RDMA/irdma: Fix data race in irdma_free_pble RDMA/irdma: Fix data race in irdma_sc_ccq_arm RDMA/mlx5: Add support for 1600_8x lane speed RDMA/core: Add new IB rate for XDR (8x) support IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled RDMA/bnxt_re: Pass correct flag for dma mr creation RDMA/bnxt_re: Fix the inline size for GenP7 devices RDMA/hns: Support reset recovery for bond RDMA/hns: Support link state reporting for bond ... commit 056daec2925dc200b22c30419bc7b9e01f7843c4 Merge: a3ebb59eee2e55 5185c4d8a56b34 Author: Linus Torvalds Date: Thu Dec 4 18:50:11 2025 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "This is a pretty consequential cycle for iommufd, though this pull is not too big. It is based on a shared branch with VFIO that introduces VFIO_DEVICE_FEATURE_DMA_BUF a DMABUF exporter for VFIO device's MMIO PCI BARs. This was a large multiple series journey over the last year and a half. Based on that work IOMMUFD gains support for VFIO DMABUF's in its existing IOMMU_IOAS_MAP_FILE, which closes the last major gap to support PCI peer to peer transfers within VMs. In Joerg's iommu tree we have the "generic page table" work which aims to consolidate all the duplicated page table code in every iommu driver into a single algorithm. This will be used by iommufd to implement unique page table operations to start adding new features and improve performance. In here: - Expand IOMMU_IOAS_MAP_FILE to accept a DMABUF exported from VFIO. This is the first step to broader DMABUF support in iommufd, right now it only works with VFIO. This closes the last functional gap with classic VFIO type 1 to safely support PCI peer to peer DMA by mapping the VFIO device's MMIO into the IOMMU. - Relax SMMUv3 restrictions on nesting domains to better support qemu's sequence to have an identity mapping before the vSID is established" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommu/arm-smmu-v3-iommufd: Allow attaching nested domain for GBPA cases iommufd/selftest: Add some tests for the dmabuf flow iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE iommufd: Have iopt_map_file_pages convert the fd to a file iommufd: Have pfn_reader process DMABUF iopt_pages iommufd: Allow MMIO pages in a batch iommufd: Allow a DMABUF to be revoked iommufd: Do not map/unmap revoked DMABUFs iommufd: Add DMABUF to iopt_pages vfio/pci: Add vfio_pci_dma_buf_iommufd_map() commit a3ebb59eee2e558e8f8f27fc3f75cd367f17cd8e Merge: ce5cfb0fa20dc6 d721f52e31553a Author: Linus Torvalds Date: Thu Dec 4 18:42:48 2025 -0800 Merge tag 'vfio-v6.19-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Move libvfio selftest artifacts in preparation of more tightly coupled integration with KVM selftests (David Matlack) - Fix comment typo in mtty driver (Chu Guangqing) - Support for new hardware revision in the hisi_acc vfio-pci variant driver where the migration registers can now be accessed via the PF. When enabled for this support, the full BAR can be exposed to the user (Longfang Liu) - Fix vfio cdev support for VF token passing, using the correct size for the kernel structure, thereby actually allowing userspace to provide a non-zero UUID token. Also set the match token callback for the hisi_acc, fixing VF token support for this this vfio-pci variant driver (Raghavendra Rao Ananta) - Introduce internal callbacks on vfio devices to simplify and consolidate duplicate code for generating VFIO_DEVICE_GET_REGION_INFO data, removing various ioctl intercepts with a more structured solution (Jason Gunthorpe) - Introduce dma-buf support for vfio-pci devices, allowing MMIO regions to be exposed through dma-buf objects with lifecycle managed through move operations. This enables low-level interactions such as a vfio-pci based SPDK drivers interacting directly with dma-buf capable RDMA devices to enable peer-to-peer operations. IOMMUFD is also now able to build upon this support to fill a long standing feature gap versus the legacy vfio type1 IOMMU backend with an implementation of P2P support for VM use cases that better manages the lifecycle of the P2P mapping (Leon Romanovsky, Jason Gunthorpe, Vivek Kasireddy) - Convert eventfd triggering for error and request signals to use RCU mechanisms in order to avoid a 3-way lockdep reported deadlock issue (Alex Williamson) - Fix a 32-bit overflow introduced via dma-buf support manifesting with large DMA buffers (Alex Mastro) - Convert nvgrace-gpu vfio-pci variant driver to insert mappings on fault rather than at mmap time. This conversion serves both to make use of huge PFNMAPs but also to both avoid corrected RAS events during reset by now being subject to vfio-pci-core's use of unmap_mapping_range(), and to enable a device readiness test after reset (Ankit Agrawal) - Refactoring of vfio selftests to support multi-device tests and split code to provide better separation between IOMMU and device objects. This work also enables a new test suite addition to measure parallel device initialization latency (David Matlack) * tag 'vfio-v6.19-rc1' of https://github.com/awilliam/linux-vfio: (65 commits) vfio: selftests: Add vfio_pci_device_init_perf_test vfio: selftests: Eliminate INVALID_IOVA vfio: selftests: Split libvfio.h into separate header files vfio: selftests: Move vfio_selftests_*() helpers into libvfio.c vfio: selftests: Rename vfio_util.h to libvfio.h vfio: selftests: Stop passing device for IOMMU operations vfio: selftests: Move IOVA allocator into iova_allocator.c vfio: selftests: Move IOMMU library code into iommu.c vfio: selftests: Rename struct vfio_dma_region to dma_region vfio: selftests: Upgrade driver logging to dev_err() vfio: selftests: Prefix logs with device BDF where relevant vfio: selftests: Eliminate overly chatty logging vfio: selftests: Support multiple devices in the same container/iommufd vfio: selftests: Introduce struct iommu vfio: selftests: Rename struct vfio_iommu_mode to iommu_mode vfio: selftests: Allow passing multiple BDFs on the command line vfio: selftests: Split run.sh into separate scripts vfio: selftests: Move run.sh into scripts directory vfio/nvgrace-gpu: wait for the GPU mem to be ready vfio/nvgrace-gpu: Inform devmem unmapped after reset ... commit 7dfbe9a6751973c17138ddc0d33deff5f5f35b94 Author: Dan Williams Date: Tue Dec 2 19:19:48 2025 -0800 crypto/ccp: Fix CONFIG_PCI=n build It turns out that the PCI driver for ccp is unconditionally built into the kernel in the CONFIG_PCI=y case. This means that the new SEV-TIO support needs an explicit dependency on PCI to avoid build errors when CONFIG_CRYPTO_DEV_SP_PSP=y and CONFIG_PCI=n. Reported-by: kernel test robot Closes: http://lore.kernel.org/202512030743.6pVPA4sx-lkp@intel.com Cc: Alexey Kardashevskiy Cc: Tom Lendacky Cc: John Allen Acked-by: Alexey Kardashevskiy Link: https://patch.msgid.link/20251203031948.2471431-1-dan.j.williams@intel.com Signed-off-by: Dan Williams commit ce5cfb0fa20dc6454da039612e34325b7b4a8243 Merge: 5797d10ea4fade 0d081b16946ef4 Author: Linus Torvalds Date: Thu Dec 4 18:05:06 2025 -0800 Merge tag 'iommu-updates-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Joerg Roedel: - Introduction of the generic IO page-table framework with support for Intel and AMD IOMMU formats from Jason. This has good potential for unifying more IO page-table implementations and making future enhancements more easy. But this also needed quite some fixes during development. All known issues have been fixed, but my feeling is that there is a higher potential than usual that more might be needed. - Intel VT-d updates: - Use right invalidation hint in qi_desc_iotlb() - Reduce the scope of INTEL_IOMMU_FLOPPY_WA - ARM-SMMU updates: - Qualcomm device-tree binding updates for Kaanapali and Glymur SoCs and a new clock for the TBU. - Fix error handling if level 1 CD table allocation fails. - Permit more than the architectural maximum number of SMRs for funky Qualcomm mis-implementations of SMMUv2. - Mediatek driver: - MT8189 iommu support - Move ARM IO-pgtable selftests to kunit - Device leak fixes for a couple of drivers - Random smaller fixes and improvements * tag 'iommu-updates-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (81 commits) iommupt/vtd: Support mgaw's less than a 4 level walk for first stage iommupt/vtd: Allow VT-d to have a larger table top than the vasz requires powerpc/pseries/svm: Make mem_encrypt.h self contained genpt: Make GENERIC_PT invisible iommupt: Avoid a compiler bug with sw_bit iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal iommupt: Fix unlikely flows in increase_top() iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() MAINTAINERS: Update my email address iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables dt-bindings: iommu: qcom_iommu: Allow 'tbu' clock iommu/vt-d: Restore previous domain::aperture_end calculation iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD iommu/tegra: fix device leak on probe_device() iommu/sun50i: fix device leak on of_xlate() iommu/omap: simplify probe_device() error handling iommu/omap: fix device leaks on probe_device() iommu/mediatek-v1: add missing larb count sanity check iommu/mediatek-v1: fix device leaks on probe() ... commit 5797d10ea4fade7df0f920c368cad07f705afc63 Merge: 43dfc13ca97298 ea5514e300568c Author: Linus Torvalds Date: Thu Dec 4 17:55:18 2025 -0800 Merge tag 'cxl-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull compute express link (CXL) updates from Dave Jiang: "The additions of note are adding CXL region remove support for locked CXL decoders, adding unit testing support for XOR address translation, and adding unit testing support for extended linear cache. Misc: - Remove incorrect page-allocator quirk section in documentation - Remove unused devm_cxl_port_enumerate_dports() function - Fix typo in cdat.c code comment - Replace use of system_wq with system_percpu_wq - Add locked CXL decoder support for region removal - Return when generic target updated - Rename region_res_match_cxl_range() to spa_maps_hpa() - Clarify comment in spa_maps_hpa() Enable unit testing for XOR address translation of SPA to DPA and vice versa: - Refactor address translation funcs for testing in cxl_region - Make the XOR calculations available for testing - Add cxl_translate module for address translation testing in cxl_test Extended Linear Cache changes: - Add extended linear cache size sysfs attribute - Adjust failure emission of extended linear cache detection in cxl_acpi - Added extended linear cache unit testing support in cxl_test Preparation refactor patches for PRM translation support: - Simplify cxl_rd_ops allocation and handling - Group xor arithmetric setup code in a single block - Remove local variable @inc in cxl_port_setup_targets()" * tag 'cxl-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (22 commits) cxl/test: Assign overflow_err_count from log->nr_overflow cxl/test: Remove ret_limit race condition in mock_get_event() cxl/test: remove unused mock function for cxl_rcd_component_reg_phys() cxl/test: Add support for acpi extended linear cache cxl/test: Add cxl_test CFMWS support for extended linear cache cxl/test: Standardize CXL auto region size cxl/region: Remove local variable @inc in cxl_port_setup_targets() cxl/acpi: Group xor arithmetric setup code in a single block cxl: Simplify cxl_rd_ops allocation and handling cxl: Clarify comment in spa_maps_hpa() cxl: Rename region_res_match_cxl_range() to spa_maps_hpa() acpi/hmat: Return when generic target is updated cxl: Add handling of locked CXL decoder cxl/region: Add support to indicate region has extended linear cache cxl: Adjust extended linear cache failure emission in cxl_acpi cxl/test: Add cxl_translate module for address translation testing cxl/acpi: Make the XOR calculations available for testing cxl/region: Refactor address translation funcs for testing cxl/pci: replace use of system_wq with system_percpu_wq cxl: fix typos in cdat.c comments ... commit 0373d5c387f24de749cc22e694a14b3a7c7eb515 Author: Michael Chan Date: Tue Dec 2 16:30:24 2025 -0800 bnxt_en: Fix XDP_TX path For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not correct. __bnxt_poll_work() -> bnxt_rx_pkt() -> bnxt_rx_xdp() may be looping within NAPI and some event flags may be set in earlier iterations. In particular, if BNXT_TX_EVENT is set earlier indicating some XDP_TX packets are ready and pending, it will be cleared if it is XDP_TX action again. Normally, we will set BNXT_TX_EVENT again when we successfully call __bnxt_xmit_xdp(). But if the TX ring has no more room, the flag will not be set. This will cause the TX producer to be ahead but the driver will not hit the TX doorbell. For multi-buf XDP_TX, there is no need to clear the event flags and set BNXT_AGG_EVENT. The BNXT_AGG_EVENT flag should have been set earlier in bnxt_rx_pkt(). The visible symptom of this is that the RX ring associated with the TX XDP ring will eventually become empty and all packets will be dropped. Because this condition will cause the driver to not refill the RX ring seeing that the TX ring has forever pending XDP_TX packets. The fix is to only clear BNXT_RX_EVENT when we have successfully called __bnxt_xmit_xdp(). Fixes: 7f0a168b0441 ("bnxt_en: Add completion ring pointer in TX and RX ring structures") Reported-by: Pavel Dubovitsky Reviewed-by: Andy Gospodarek Reviewed-by: Pavan Chebbi Reviewed-by: Kalesh AP Signed-off-by: Michael Chan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251203003024.2246699-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit a479a27f4da4d1f8a9b7540a800f80253ed1bad0 Author: Tim Hostetler Date: Tue Dec 2 20:02:07 2025 +0000 gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call commit 46e7860ef941 ("gve: Move ptp_schedule_worker to gve_init_clock") moved the first invocation of the AQ command REPORT_NIC_TIMESTAMP to gve_probe(). However, gve_init_clock() invoking REPORT_NIC_TIMESTAMP is not valid until after gve_probe() invokes the AQ command CONFIGURE_DEVICE_RESOURCES. Failure to do so results in the following error: gve 0000:00:07.0: failed to read NIC clock -11 This was missed earlier because the driver under test was loaded at runtime instead of boot-time. The boot-time driver had already initialized the device, causing the runtime driver to successfully call gve_init_clock() incorrectly. Fixes: 46e7860ef941 ("gve: Move ptp_schedule_worker to gve_init_clock") Reviewed-by: Ankit Garg Signed-off-by: Tim Hostetler Signed-off-by: Harshitha Ramamurthy Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251202200207.1434749-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit dd75c723ef566f7f009c047f47e0eee95fe348ab Author: René Rebe Date: Tue Dec 2 19:41:37 2025 +0100 r8169: fix RTL8117 Wake-on-Lan in DASH mode Wake-on-Lan does currently not work for r8169 in DASH mode, e.g. the ASUS Pro WS X570-ACE with RTL8168fp/RTL8117. Fix by not returning early in rtl_prepare_power_down when dash_enabled. While this fixes WoL, it still kills the OOB RTL8117 remote management BMC connection. Fix by not calling rtl8168_driver_stop if WoL is enabled. Fixes: 065c27c184d6 ("r8169: phy power ops") Signed-off-by: René Rebe Cc: stable@vger.kernel.org Reviewed-by: Heiner Kallweit Link: https://patch.msgid.link/20251202.194137.1647877804487085954.rene@exactco.de Signed-off-by: Jakub Kicinski commit e7a9530d125becb49393cb476672b1f7d9278256 Merge: c4cdf7376271bc 8ac1dacec458f5 Author: Jakub Kicinski Date: Thu Dec 4 17:53:52 2025 -0800 Merge branch 'mlxsw-three-m-router-fixes' Petr Machata says: ==================== mlxsw: Three (m)router fixes This patchset contains two fixes in mlxsw Spectrum router code, and one for the Spectrum multicast router code. Please see the individual patches for more details. ==================== Link: https://patch.msgid.link/cover.1764695650.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 8ac1dacec458f55f871f7153242ed6ab60373b90 Author: Ido Schimmel Date: Tue Dec 2 18:44:13 2025 +0100 mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver periodically traverses it in order to update the kernel about multicast route stats that were queried from the device. One instance of list entry deletion (during route replace) was missed and it can result in a use-after-free [1]. Fix by acquiring the mutex before deleting the entry from the list and releasing it afterwards. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] Read of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043 CPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full) Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017 Workqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum] Call Trace: dump_stack_lvl+0xba/0x110 print_report+0x174/0x4f5 kasan_report+0xdf/0x110 mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 Allocated by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 Freed by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x43/0x70 kfree+0x14e/0x700 mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 Fixes: f38656d06725 ("mlxsw: spectrum_mr: Protect multicast route list with a lock") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/f996feecfd59fde297964bfc85040b6d83ec6089.1764695650.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 8b0e69763ef948fb872a7767df4be665d18f5fd4 Author: Ido Schimmel Date: Tue Dec 2 18:44:12 2025 +0100 mlxsw: spectrum_router: Fix neighbour use-after-free We sometimes observe use-after-free when dereferencing a neighbour [1]. The problem seems to be that the driver stores a pointer to the neighbour, but without holding a reference on it. A reference is only taken when the neighbour is used by a nexthop. Fix by simplifying the reference counting scheme. Always take a reference when storing a neighbour pointer in a neighbour entry. Avoid taking a referencing when the neighbour is used by a nexthop as the neighbour entry associated with the nexthop already holds a reference. Tested by running the test that uncovered the problem over 300 times. Without this patch the problem was reproduced after a handful of iterations. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310 Read of size 8 at addr ffff88817f8e3420 by task ip/3929 CPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full) Hardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023 Call Trace: dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x6e/0x300 print_report+0xfc/0x1fb kasan_report+0xe4/0x110 mlxsw_sp_neigh_entry_update+0x2d4/0x310 mlxsw_sp_router_rif_gone_sync+0x35f/0x510 mlxsw_sp_rif_destroy+0x1ea/0x730 mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0 __mlxsw_sp_inetaddr_lag_event+0xcc/0x130 __mlxsw_sp_inetaddr_event+0xf5/0x3c0 mlxsw_sp_router_netdevice_event+0x1015/0x1580 notifier_call_chain+0xcc/0x150 call_netdevice_notifiers_info+0x7e/0x100 __netdev_upper_dev_unlink+0x10b/0x210 netdev_upper_dev_unlink+0x79/0xa0 vrf_del_slave+0x18/0x50 do_set_master+0x146/0x7d0 do_setlink.isra.0+0x9a0/0x2880 rtnl_newlink+0x637/0xb20 rtnetlink_rcv_msg+0x6fe/0xb90 netlink_rcv_skb+0x123/0x380 netlink_unicast+0x4a3/0x770 netlink_sendmsg+0x75b/0xc90 __sock_sendmsg+0xbe/0x160 ____sys_sendmsg+0x5b2/0x7d0 ___sys_sendmsg+0xfd/0x180 __sys_sendmsg+0x124/0x1c0 do_syscall_64+0xbb/0xfd0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [...] Allocated by task 109: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x2c1/0x790 neigh_alloc+0x6af/0x8f0 ___neigh_create+0x63/0xe90 mlxsw_sp_nexthop_neigh_init+0x430/0x7e0 mlxsw_sp_nexthop_type_init+0x212/0x960 mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280 mlxsw_sp_nexthop6_group_get+0x392/0x6a0 mlxsw_sp_fib6_entry_create+0x46a/0xfd0 mlxsw_sp_router_fib6_replace+0x1ed/0x5f0 mlxsw_sp_router_fib6_event_work+0x10a/0x2a0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Freed by task 154: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kmem_cache_free_bulk.part.0+0x1eb/0x5e0 kvfree_rcu_bulk+0x1f2/0x260 kfree_rcu_work+0x130/0x1b0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Last potentially related work creation: kasan_save_stack+0x30/0x50 kasan_record_aux_stack+0x8c/0xa0 kvfree_call_rcu+0x93/0x5b0 mlxsw_sp_router_neigh_event_work+0x67d/0x860 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Fixes: 6cf3c971dc84 ("mlxsw: spectrum_router: Add private neigh table") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/92d75e21d95d163a41b5cea67a15cd33f547cba6.1764695650.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit b6b638bda240395dff49a87403b2e32493e56d2a Author: Ido Schimmel Date: Tue Dec 2 18:44:11 2025 +0100 mlxsw: spectrum_router: Fix possible neighbour reference count leak mlxsw_sp_router_schedule_work() takes a reference on a neighbour, expecting a work item to release it later on. However, we might fail to schedule the work item, in which case the neighbour reference count will be leaked. Fix by taking the reference just before scheduling the work item. Note that mlxsw_sp_router_schedule_work() can receive a NULL neighbour pointer, but neigh_clone() handles that correctly. Spotted during code review, did not actually observe the reference count leak. Fixes: 151b89f6025a ("mlxsw: spectrum_router: Reuse work neighbor initialization in work scheduler") Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://patch.msgid.link/ec2934ae4aca187a8d8c9329a08ce93cca411378.1764695650.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit c4cdf7376271bce5714c06d79ec67759b18910eb Author: Thorsten Blum Date: Tue Dec 2 18:27:44 2025 +0100 net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write The local variable 'val' was never clamped to -75000 or 180000 because the return value of clamp_val() was not used. Fix this by assigning the clamped value back to 'val', and use clamp() instead of clamp_val(). Cc: stable@vger.kernel.org Fixes: a557a92e6881 ("net: phy: marvell-88q2xxx: add support for temperature sensor") Signed-off-by: Thorsten Blum Reviewed-by: Dimitri Fedrau Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251202172743.453055-3-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit da67179e5538b473a47c87e87cb35b1a7551ad9b Author: Lyude Paul Date: Tue Dec 2 12:59:12 2025 -0500 drm/nouveau/gsp: Allocate fwsec-sb at boot At the moment - the memory allocation for fwsec-sb is created as-needed and is released after being used. Typically this is at some point well after driver load, which can cause runtime suspend/resume to initially work on driver load but then later fail on a machine that has been running for long enough with sufficiently high enough memory pressure: kworker/7:1: page allocation failure: order:5, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0 CPU: 7 UID: 0 PID: 875159 Comm: kworker/7:1 Not tainted 6.17.8-300.fc43.x86_64 #1 PREEMPT(lazy) Hardware name: SLIMBOOK Executive/Executive, BIOS N.1.10GRU06 02/02/2024 Workqueue: pm pm_runtime_work Call Trace: dump_stack_lvl+0x5d/0x80 warn_alloc+0x163/0x190 ? __alloc_pages_direct_compact+0x1b3/0x220 __alloc_pages_slowpath.constprop.0+0x57a/0xb10 __alloc_frozen_pages_noprof+0x334/0x350 __alloc_pages_noprof+0xe/0x20 __dma_direct_alloc_pages.isra.0+0x1eb/0x330 dma_direct_alloc_pages+0x3c/0x190 dma_alloc_pages+0x29/0x130 nvkm_firmware_ctor+0x1ae/0x280 [nouveau] nvkm_falcon_fw_ctor+0x3e/0x60 [nouveau] nvkm_gsp_fwsec+0x10e/0x2c0 [nouveau] ? sysvec_apic_timer_interrupt+0xe/0x90 nvkm_gsp_fwsec_sb+0x27/0x70 [nouveau] tu102_gsp_fini+0x65/0x110 [nouveau] ? ktime_get+0x3c/0xf0 nvkm_subdev_fini+0x67/0xc0 [nouveau] nvkm_device_fini+0x94/0x140 [nouveau] nvkm_udevice_fini+0x50/0x70 [nouveau] nvkm_object_fini+0xb1/0x140 [nouveau] nvkm_object_fini+0x70/0x140 [nouveau] ? __pfx_pci_pm_runtime_suspend+0x10/0x10 nouveau_do_suspend+0xe4/0x170 [nouveau] nouveau_pmops_runtime_suspend+0x3e/0xb0 [nouveau] pci_pm_runtime_suspend+0x67/0x1a0 ? __pfx_pci_pm_runtime_suspend+0x10/0x10 __rpm_callback+0x45/0x1f0 ? __pfx_pci_pm_runtime_suspend+0x10/0x10 rpm_callback+0x6d/0x80 rpm_suspend+0xe5/0x5e0 ? finish_task_switch.isra.0+0x99/0x2c0 pm_runtime_work+0x98/0xb0 process_one_work+0x18f/0x350 worker_thread+0x25a/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xf9/0x240 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0xf1/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 The reason this happens is because the fwsec-sb firmware image only supports being booted from a contiguous coherent sysmem allocation. If a system runs into enough memory fragmentation from memory pressure, such as what can happen on systems with low amounts of memory, this can lead to a situation where it later becomes impossible to find space for a large enough contiguous allocation to hold fwsec-sb. This causes us to fail to boot the firmware image, causing the GPU to fail booting and causing the driver to fail. Since this firmware can't use non-contiguous allocations, the best solution to avoid this issue is to simply allocate the memory for fwsec-sb during initial driver-load, and reuse the memory allocation when fwsec-sb needs to be used. We then release the memory allocations on driver unload. Signed-off-by: Lyude Paul Fixes: 594766ca3e53 ("drm/nouveau/gsp: move booter handling to GPU-specific code") Cc: # v6.16+ Reviewed-by: Timur Tabi Link: https://patch.msgid.link/20251202175918.63533-1-lyude@redhat.com commit 311607017e13d087161586e1d6cf28bb3a0ca942 Author: Nathan Chancellor Date: Wed Dec 3 15:25:07 2025 -0700 virt: Fix Kconfig warning when selecting TSM without VIRT_DRIVERS After commit 3225f52cde56 ("PCI/TSM: Establish Secure Sessions and Link Encryption"), there is a Kconfig warning when selecting CONFIG_TSM without CONFIG_VIRT_DRIVERS: WARNING: unmet direct dependencies detected for TSM Depends on [n]: VIRT_DRIVERS [=n] Selected by [y]: - PCI_TSM [=y] && PCI [=y] CONFIG_TSM is defined in drivers/virt/coco/Kconfig but this Kconfig is only sourced when CONFIG_VIRT_DRIVERS is enabled. Since this symbol is hidden with no dependencies, it should be available without a symbol that just enables a menu. Move the sourcing of drivers/virt/coco/Kconfig outside of CONFIG_VIRT_DRIVERS and wrap the other source statements in drivers/virt/coco/Kconfig with CONFIG_VIRT_DRIVERS to ensure users do not get any additional prompts while ensuring CONFIG_TSM is always available to select. This complements commit 110c155e8a68 ("drivers/virt: Drop VIRT_DRIVERS build dependency"), which addressed the build issue that this Kconfig warning was pointing out. Fixes: 3225f52cde56 ("PCI/TSM: Establish Secure Sessions and Link Encryption") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511140712.NubhamPy-lkp@intel.com/ Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251203-fix-pci-tsm-select-tsm-warning-v1-1-c3959c1cb110@kernel.org Signed-off-by: Dan Williams commit 43dfc13ca972988e620a6edb72956981b75ab6b0 Merge: b1dd1e2f3e4ed9 cd6b7c82b69139 Author: Linus Torvalds Date: Thu Dec 4 17:29:41 2025 -0800 Merge tag 'pci-v6.19-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Enable host bridge emulation for PCI_DOMAINS_GENERIC platforms (Dan Williams) - Switch vmd from custom domain number allocator to the common allocator to prevent a potential race with new non-VMD buses (Dan Williams) - Enable Precision Time Measurement (PTM) only if device advertises support for a relevant role, to prevent invalid PTM Requests that cause ACS violations that are reported as AER Uncorrectable Non-Fatal errors (Mika Westerberg) Resource management: - Prevent resource tree corruption when BAR resize fails (Ilpo Järvinen) - Restore BARs to the original size if a BAR resize fails (Ilpo Järvinen) - Remove BAR release from BAR resize attempts by the xe, i915, and amdgpu drivers so the PCI core can restore BARs if the resize fails (Ilpo Järvinen) - Move Resizable BAR code to rebar.c (Ilpo Järvinen) - Add pci_rebar_size_supported() and use it in i915 and xe (Ilpo Järvinen) - Add pci_rebar_get_max_size() and use it in xe and amdgpu (Ilpo Järvinen) Power management and error handling: - For drivers using PCI legacy suspend, save config state at suspend so that state (not any earlier state from enumeration, probe, or error recovery) will be restored when resuming (Lukas Wunner) - For devices with no driver or a driver that lacks power management, save config state at hibernate so that state (not any earlier state from enumeration, probe, or error recovery) will be restored when resuming (Lukas Wunner) - Save device config space on device addition, before driver binding, so error recovery works more reliably (Lukas Wunner) - Drop pci_save_state() from several drivers that no longer need it since the PCI core always does it and pci_restore_state() no longer invalidates the saved state (Lukas Wunner) - Document use of pci_save_state() by drivers to capture the state they want restored during error recovery (Lukas Wunner) Power control: - Add a struct pci_ops.assert_perst() function pointer to assert/deassert PCIe PERST# and implement it for the qcom driver (Krishna Chaitanya Chundru) - Add DT binding and pwrctrl driver for the Toshiba TC9563 PCIe switch, which must be held in reset after poweron so the pwrctrl driver can configure the switch via I2C before bringing up the links (Krishna Chaitanya Chundru) Endpoint framework: - Convert the endpoint doorbell test to use a threaded IRQ to fix a 'sleeping while atomic' issue (Bhanu Seshu Kumar Valluri) - Add endpoint VNTB MSI doorbell support to reduce latency between host and endpoint (Frank Li) New native PCIe controller drivers: - Add CIX Sky1 host controller DT binding and driver (Hans Zhang) - Add NXP S32G host controller DT binding and driver (Vincent Guittot) - Add Renesas RZ/G3S host controller DT binding and driver (Claudiu Beznea) - Add SpacemiT K1 host controller DT binding and driver (Alex Elder) Amlogic Meson PCIe controller driver: - Update DT binding to name DBI region 'dbi', not 'elbi', and update driver to support both (Manivannan Sadhasivam) Apple PCIe controller driver: - Move struct pci_host_bridge allocation from pci_host_common_init() to callers, which significantly simplifies pcie-apple (Marc Zyngier) Broadcom STB PCIe controller driver: - Disable advertising ASPM L0s support correctly (Jim Quinlan) - Add a panic/die handler to print diagnostic info in case PCIe caused an unrecoverable abort (Jim Quinlan) Cadence PCIe controller driver: - Add module support for Cadence platform host and endpoint controller driver (Manikandan K Pillai) - Split headers into 'legacy' (LGA) and 'high perf' (HPA) to prepare for new CIX Sky1 driver (Manikandan K Pillai) MediaTek PCIe controller driver: - Convert DT binding to YAML schema (Christian Marangi) - Add Airoha AN7583 DT compatible and driver support (Christian Marangi) Qualcomm PCIe controller driver: - Add Qualcomm Kaanapali to SM8550 DT binding (Qiang Yu) - Add required 'power-domains' and 'resets' to qcom sa8775p, sc7280, sc8280xp, sm8150, sm8250, sm8350, sm8450, sm8550, x1e80100 DT schemas (Krzysztof Kozlowski) - Look up OPP using both frequency and data rate (not just frequency) so RPMh votes can account for both (Krishna Chaitanya Chundru) Rockchip DesignWare PCIe controller driver: - Add Rockchip RK3528 compatible strings in DT binding (Yao Zi) STMicroelectronics STM32MP25 PCIe controller driver: - Fix a race between link training and endpoint register initialization (Christian Bruel) - Align endpoint allocations to match the ATU requirements (Christian Bruel) Synopsys DesignWare PCIe controller driver: - Clear L1 PM Substate Capability 'Supported' bits unless glue driver says it's supported, which prevents users from enabling non-working L1SS. Currently only qcom and tegra194 support L1SS (Bjorn Helgaas) - Remove now-superfluous L1SS disable code from tegra194 (Bjorn Helgaas) - Configure L1SS support in dw-rockchip when DT says 'supports-clkreq' (Shawn Lin) TI Keystone PCIe controller driver: - Fail the probe instead of silently succeeding if ks_pcie_of_data didn't specify Root Complex or Endpoint mode (Siddharth Vadapalli) - Make keystone buildable as a loadable module, except on ARM32 where hook_fault_code() is __init (Siddharth Vadapalli)" * tag 'pci-v6.19-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (100 commits) MAINTAINERS: Add Manivannan Sadhasivam as PCI/pwrctrl maintainer MAINTAINERS: Add CIX Sky1 PCIe controller driver maintainer PCI: sky1: Add PCIe host support for CIX Sky1 dt-bindings: PCI: Add CIX Sky1 PCIe Root Complex bindings PCI: cadence: Add support for High Perf Architecture (HPA) controller MAINTAINERS: Add NXP S32G PCIe controller driver maintainer PCI: s32g: Add NXP S32G PCIe controller driver (RC) PCI: dwc: Add register and bitfield definitions dt-bindings: PCI: s32g: Add NXP S32G PCIe controller PCI: Add Renesas RZ/G3S host controller driver PCI: host-generic: Move bridge allocation outside of pci_host_common_init() dt-bindings: PCI: Add Renesas RZ/G3S PCIe controller binding PCI: Validate pci_rebar_size_supported() input Documentation: PCI: Amend error recovery doc with pci_save_state() rules treewide: Drop pci_save_state() after pci_restore_state() PCI/ERR: Ensure error recoverability at all times PCI/PM: Stop needlessly clearing state_saved on enumeration and thaw PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths PCI: dw-rockchip: Configure L1SS support PCI: tegra194: Remove unnecessary L1SS disable code ... commit b1dd1e2f3e4ed970949ab4bb982bb0165f3e979d Merge: b0206c4eb63751 7a2ff00c3b5e3c Author: Linus Torvalds Date: Thu Dec 4 17:10:08 2025 -0800 Merge tag 'efi-next-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "The usual trickle of EFI contributions: - Parse SMBIOS tables in memory directly on Macbooks that do not implement the EFI SMBIOS protocol - Obtain EDID information from the primary display while running in the EFI stub, and expose it via bootparams on x86 (generic method is in the works, and will likely land during the next cycle) - Bring CPER handling for ARM systems up to data with the latest EFI spec changes - Various cosmetic changes" * tag 'efi-next-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: docs: efi: add CPER functions to driver-api efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs efi/cper: Add a new helper function to print bitmasks efi/cper: Adjust infopfx size to accept an extra space RAS: Report all ARM processor CPER information to userspace efi/libstub: x86: Store EDID in boot_params efi/libstub: gop: Add support for reading EDID efi/libstub: gop: Initialize screen_info in helper function efi/libstub: gop: Find GOP handle instead of GOP data efi: Fix trailing whitespace in header file efi/memattr: Convert efi_memattr_init() return type to void efi: stmm: fix kernel-doc "bad line" warnings efi/riscv: Remove the useless failure return message print efistub/x86: Add fallback for SMBIOS record lookup commit c7685d11108acb387e44e3d81194d0d8959eaa44 Merge: 86fafc584c1977 860daa4b0d09a3 Author: Dave Airlie Date: Fri Dec 5 10:27:56 2025 +1000 Merge tag 'topic/drm-intel-plane-color-pipeline-2025-12-04' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 topic pull request for v6.19: Features and functionality: - Add plane color management support (Uma, Chaitanya) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/e7129c6afd6208719d2f5124da86e810505e7a7b@intel.com commit 86fafc584c1977e2bfa05a88bfb8eae78f984f5b Merge: e73c2262041abd 3f1c07fc21c68b Author: Dave Airlie Date: Fri Dec 5 10:21:11 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-12-04' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - Fix a memory leak (Mika) - Fix a 64-bit division (Michal Wajdeczko) - vf migration fix (Matt Brost) - LRC pause Fix (Tomasz lis) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aTIGiHJnnMtqbDOO@fedora commit e73c2262041abd630699224159646aa31e5b7697 Merge: 55a271a0f7e073 e45b5df47b07e6 Author: Dave Airlie Date: Fri Dec 5 10:16:43 2025 +1000 Merge tag 'topic/xe-vfio-2025-12-04' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - fix VFIO link error for built-in xe module (Arnd Bergmann) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aTIA9in2Bo_fA9TN@fedora commit 55a271a0f7e073032e9c8b1c1e30916d90be5a8a Merge: 0692602defb0c2 1f5556ec8b9efb Author: Dave Airlie Date: Fri Dec 5 10:16:14 2025 +1000 Merge tag 'topic/xe-vfio-2025-12-01' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Cross-subsystem Changes: - Add device specific vfio_pci driver variant for intel graphics (Michal Winiarski) Driver Changes: - Add scope-based cleanup helper for runtime PM (Matt Roper) - Additional xe driver prerequisites and exports (Michal Winiarski) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aS1bNpqeem6PIHrA@fedora commit b0206c4eb6375155b9d50cad1500d2bca5cc8b3f Merge: 6044a1ee9dca90 8e8856396b54be Author: Linus Torvalds Date: Thu Dec 4 16:12:03 2025 -0800 Merge tag 'for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - documentation fixes power-supply drivers: - add BD71828 charger driver - add Richtek RT9756 driver - max77705: add adaptive input current support - max77705: add support for multiple devices - misc small fixes reset drivers: - add spacemit-p1 poweroff/reboot driver" * tag 'for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: Revert "power: supply: qcom_battmgr: support disabling charge control" Documentation: power: rt9756: Document exported sysfs entries power: supply: rt9756: Add Richtek RT9756 smart cap divider charger dt-bindings: power: supply: Add Richtek RT9756 smart cap divider charger driver: reset: spacemit-p1: add driver for poweroff/reboot power: supply: apm_power: only unset own apm_get_power_status power: supply: use ktime_divns() to avoid 64-bit division docs: power: clean up power_supply_class.rst power: supply: qcom_battmgr: support disabling charge control power: supply: qcom_battmgr: clamp charge control thresholds power: supply: wm831x: Check wm831x_set_bits() return value power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() power: supply: max17040: Check iio_read_channel_processed() return code power: supply: cw2015: Check devm_delayed_work_autocancel() return code power: supply: rt5033_charger: Fix device node reference leaks power: supply: max77705: Fix potential IRQ chip conflict when probing two devices power: supply: max77705_charger: implement aicl feature MAINTAINERS: Add entry for BD71828 charger power: supply: Add bd718(15/28/78) charger driver commit 6044a1ee9dca906a807ba786421dc4254191ffd5 Merge: fde4ce068d1bcc 954c55c658e11c Author: Linus Torvalds Date: Thu Dec 4 15:50:37 2025 -0800 Merge tag 'devicetree-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT bindings: - Convert lattice,ice40-fpga-mgr, apm,xgene-storm-dma, brcm,sr-thermal, amazon,al-thermal, brcm,ocotp, mt8173-mdp, Actions Owl SPS, Marvell AP80x System Controller, Marvell CP110 System Controller, cznic,moxtet, and apm,xgene-slimpro-mbox to DT schema format - Add i.MX95 fsl,irqsteer, MT8365 Mali Bifrost GPU, Anvo ANV32C81W EEPROM, and Microchip pic64gx PLIC - Add missing LGE, AMD Seattle, and APM X-Gene SoC platform compatibles - Updates to brcm,bcm2836-l1-intc, brcm,bcm2835-hvs, and bcm2711-hdmi bindings to fix warnings on BCM2712 platforms - Drop obsolete db8500-thermal.txt - Treewide clean-up of extra blank lines and inconsistent quoting - Ensure all .dtbo targets are applied to a base .dtb - Speed up dt_binding_check by skipping running validation on empty examples DT core: - Add of_machine_device_match() and of_machine_get_match_data() helpers and convert users treewide - Fix bounds checking of address properties in FDT code. Rework the code to have a single implementation of the bounds checks. - Rework of_irq_init() to ignore any implicit interrupt-parent (i.e. in a parent node) on nodes without an interrupt. This matches the spec description and fixes some RISC-V platforms. - Avoid a spurious message on overlay removal - Skip DT kunit tests on RISCV+ACPI" * tag 'devicetree-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (55 commits) dt-bindings: kbuild: Skip validating empty examples dt-bindings: interrupt-controller: brcm,bcm2836-l1-intc: Drop interrupt-controller requirement dt-bindings: display: Fix brcm,bcm2835-hvs bindings for BCM2712 dt-bindings: display: bcm2711-hdmi: Add interrupt details for BCM2712 of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node soc: tegra: Simplify with of_machine_device_match() soc: qcom: ubwc: Simplify with of_machine_get_match_data() powercap: dtpm: Simplify with of_machine_get_match_data() platform: surface: Simplify with of_machine_get_match_data() irqchip/atmel-aic: Simplify with of_machine_get_match_data() firmware: qcom: scm: Simplify with of_machine_device_match() cpuidle: big_little: Simplify with of_machine_device_match() cpufreq: sun50i: Simplify with of_machine_device_match() cpufreq: mediatek: Simplify with of_machine_get_match_data() cpufreq: dt-platdev: Simplify with of_machine_get_match_data() of: Add wrappers to match root node with OF device ID tables dt-bindings: eeprom: at25: Add Anvo ANV32C81W of/reserved_mem: Simplify the logic of __reserved_mem_alloc_size() of/reserved_mem: Simplify the logic of fdt_scan_reserved_mem_reg_nodes() of/reserved_mem: Simplify the logic of __reserved_mem_reserve_reg() ... commit fde4ce068d1bccacf1e2d6a28697a3847f28e0a6 Merge: d1b46f53a51e32 8af1d3fe5f186b Author: Linus Torvalds Date: Thu Dec 4 15:44:48 2025 -0800 Merge tag 'hid-for-linus-2025120201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - Proper mapping of HID_GD_Z to ABS_DISTANCE for stylus/pen types of devices (Ping Cheng) - Power management/hibernation improvements in intel-ish (Zhang Lixu) - Improved support for several Logitech devices, e.g. G Pro X Superlight 2, new iteration of Lighspeed receiver, G13, G510 (Nathan Rossi, Mavroudis Chatzilazaridis, Leo L Schwab, Hans de Goede) - Support for UcLogic XP-PEN Artist 24 Pro (Joshua Goins) - WinWing Orion2 throttle support improvement (Ivan Gorinov) - other assorted small fixes and device ID additions * tag 'hid-for-linus-2025120201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (37 commits) drivers: hid: renegotiate resolution multipliers with device after reset HID: evision: Fix Report Descriptor for Evision Wireless Receiver 320f:226f HID: logitech-dj: Fix probe failure when used with KVM HID: logitech-dj: Remove duplicate error logging HID: logitech-dj: Add support for G Pro X Superlight 2 receiver selftests/hid-tablet: add ABS_DISTANCE test for stylus/pen HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen HID: bpf: fix typo in HID usage table HID: bpf: add the Huion Kamvas 27 Pro HID: bpf: add heuristics to the Huion Inspiroy 2S eraser button HID: bpf: Add support for XP-Pen Deco02 HID: bpf: Add support for the XP-Pen Deco 01 V3 HID: bpf: Add support for the Waltop Batteryless Tablet HID: bpf: Add fixup for Logitech SpaceNavigator variants HID: bpf: support for Huion Kamvas 16 Gen 3 HID: bpf: add support for Huion Kamvas 13 (Gen 3) (model GS1333) HID: bpf: Add support for the Inspiroy 2M Documentation: hid-alps: Format DataByte* subsection headings Documentation: hid-alps: Fix packet format section headings HID: nintendo: add WQ_PERCPU to alloc_workqueue users ... commit d509d14fff783969904954eaf5d94f092c6fce19 Author: Ian Rogers Date: Wed Dec 3 13:47:06 2025 -0800 perf stat: Improve handling of termination by signal When interrupting perf stat in repeat mode with a signal the signal is passed to the child process but the repeat doesn't terminate: ``` $ perf stat -v --null --repeat 10 sleep 1 Control descriptor is not initialized [ perf stat: executing run #1 ... ] [ perf stat: executing run #2 ... ] ^Csleep: Interrupt [ perf stat: executing run #3 ... ] [ perf stat: executing run #4 ... ] [ perf stat: executing run #5 ... ] [ perf stat: executing run #6 ... ] [ perf stat: executing run #7 ... ] [ perf stat: executing run #8 ... ] [ perf stat: executing run #9 ... ] [ perf stat: executing run #10 ... ] Performance counter stats for 'sleep 1' (10 runs): 0.9500 +- 0.0512 seconds time elapsed ( +- 5.39% ) 0.01user 0.02system 0:09.53elapsed 0%CPU (0avgtext+0avgdata 18940maxresident)k 29944inputs+0outputs (0major+2629minor)pagefaults 0swaps ``` Terminate the repeated run and give a reasonable exit value: ``` $ perf stat -v --null --repeat 10 sleep 1 Control descriptor is not initialized [ perf stat: executing run #1 ... ] [ perf stat: executing run #2 ... ] [ perf stat: executing run #3 ... ] ^Csleep: Interrupt Performance counter stats for 'sleep 1' (10 runs): 0.680 +- 0.321 seconds time elapsed ( +- 47.16% ) Command exited with non-zero status 130 0.00user 0.01system 0:02.05elapsed 0%CPU (0avgtext+0avgdata 70688maxresident)k 0inputs+0outputs (0major+5002minor)pagefaults 0swaps ``` Note, this also changes the exit value for non-repeat runs when interrupted by a signal. Reported-by: Ingo Molnar Closes: https://lore.kernel.org/lkml/aS5wjmbAM9ka3M2g@gmail.com/ Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 5123509628e1ebe74bb5ec801de088f36df07d64 Author: Ian Rogers Date: Wed Dec 3 13:47:05 2025 -0800 perf tests stat: Add test for error for an offline CPU Add a test that if an offline CPU is requested perf stat will fail. $ perf test -vv "perf stat tests" 101: perf stat tests: --- start --- test child forked, pid 46965 Basic stat command test Basic stat command test [Success] Null stat command test Null stat command test [Success] Offline CPU stat command test (cpu 8) Offline CPU stat command test [Success] stat record and report test stat record and report test [Success] stat record and script test stat record and script test [Success] stat repeat weak groups test stat repeat weak groups test [Success] Topdown event group test Topdown event group test [Success] Topdown weak groups test Topdown weak groups test [Skipped event parsing failed] cputype test cputype test [Success] hybrid test hybrid test [Success] ---- end(0) ---- 101: perf stat tests : Ok Reported-by: Thomas Richter Closes: https://lore.kernel.org/linux-perf-users/94313b82-888b-4f42-9fb0-4585f9e90080@linux.ibm.com/ Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit d1b46f53a51e328202ae049f44b86336d124aeac Merge: 7b8653a5799b9b d3cc7cd7bc46af Author: Linus Torvalds Date: Thu Dec 4 15:29:27 2025 -0800 Merge tag 'backlight-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Additions: - Add support for Awinic AW99706 backlight driver Fixes: - Add GPIOLIB dependency to backlight ktd2801 driver - Add devlink to LED Backlight's supplier LEDs to enforce correct removal order and prevent NULL pointer dereferences - Fix kernel-doc warnings in lp855x.h Removals: - Do not include in backlight.h - Fix unused function warnings from suspend/resume ops in aw99706.c by switching to DEFINE_SIMPLE_DEV_PM_OPS and using pm_ptr() Bindings: - Add Awinic AW99706 backlight binding to MAINTAINERS - Add Awinic AW99706 backlight binding documentation" * tag 'backlight-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: aw99706: Fix unused function warnings from suspend/resume ops backlight: lp855x: Fix lp855x.h kernel-doc warnings dt-bindings: leds: backlight: Add Awinic AW99706 backlight backlight: aw99706: Add support for Awinic AW99706 backlight backlight: led-bl: Add devlink to supplier LEDs backlight: ktd2801: Depend on GPIOLIB backlight: Do not include in header file commit 7b8653a5799b9b15d7b3d98a0203d09963be4c87 Merge: 980190a9473dd2 072cd5f458d76b Author: Linus Torvalds Date: Thu Dec 4 15:25:19 2025 -0800 Merge tag 'leds-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "Updates: - Add optional GPIO enable pin support to PWM LED driver Fixes: - Allow LED module 0 to be added to module bank in lp50xx driver - Fix upboard LED driver module alias to ensure proper auto-loading - Update LP5009 to support 3 modules for a total of 9 LEDs - Skip LEDs without color components in cros_ec driver instead of failing probe - Fix GPIO descriptor leaks in netxbig error paths by releasing acquired GPIOs - Allow LED_COLOR_ID_MULTI in qcom-lpg driver for greater flexibility - Enable LP55XX common LED use without FW_LOADER_USER_HELPER - Ensure lp50xx chip is enabled before any I2C communication Cleanups: - Use fwnode_for_each_child_node() instead of fwnode_for_each_available_child_node() in LED drivers - Use device_get_next_child_node() instead of fwnode_get_next_available_child_node() in LED flash drivers - Replace sprintf() with sysfs_emit() in sysfs show functions for improved bounds checking - Replace system_wq() with system_percpu_wq() in the input event trigger - Reorder include files to alphabetic order in the PWM LED driver - Do not enable TRILED in qcom-lpg when configuring PWM - Drop duplicate LEDS_EXPRESSWIRE config from Kconfig Removals: - Remove arcxcnn_bl.txt Device Tree binding documentation Devicetree bindings: - Convert ArcticSand arc2c0608 LED driver binding to DT Schema - Add default-brightness property to common LED binding - Add enable-gpios property to PWM LED binding - Add PM7550 to qcom,spmi-flash-led compatible - Explain standalone PWM usage in qcom-lpg binding" * tag 'leds-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (21 commits) leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM dt-bindings: leds: qcom-lpg: Explain standalone PWM usage leds: rgb: leds-qcom-lpg: Allow LED_COLOR_ID_MULTI leds: pwm: Reorder include files to alphabetic order leds: pwm: Add optional GPIO enable pin support dt-bindings: leds: pwm: Add enable-gpios property leds: trigger: Replace use of system_wq() with system_percpu_wq() leds: led-class: Replace sprintf() with sysfs_emit() in sysfs show functions dt-bindings: leds: qcom,spmi-flash-led: Add PM7550 leds: netxbig: Fix GPIO descriptor leak in error paths leds: leds-lp50xx: Enable chip before any communication leds: Drop duplicate LEDS_EXPRESSWIRE config leds: leds-cros_ec: Skip LEDs without color components leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs leds: upboard: Fix module alias leds: leds-lp50xx: Allow LED 0 to be added to module bank leds: lp55xx_common: Enable use without FW_LOADER_USER_HELPER dt-bindings: leds: Add default-brightness property to common.yaml leds: flash: Use fwnode_get_next_child_node() instead leds: Use fwnode_for_each_child_node() instead ... commit 980190a9473dd2c842518057bf9ddcbaeba75209 Merge: aa833fc394baad 44c603f35cad3f Author: Linus Torvalds Date: Thu Dec 4 15:18:33 2025 -0800 Merge tag 'mfd-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Updates: - Add Core, Regulator, Onkey and Battery Charger support for the NXP PF1550 Power Management IC (PMIC) - Introduce __SMC_KEY macro to fix GCC 15.2.1 errors in macsmc - Add board definitions for TQMxCU1-HPCM and TQMxCU2-HPCM to the tqmx86 driver - Add support for Broadcom BCM2712 SoC to the bcm2835-pm driver - Hook up the qnap-mcu-eeprom sub-device to qnap-mcu Fixes: - Enable compile testing for the Altera SOCFPGA System Manager driver - Fix device reference leak in altr_sysmgr_regmap_lookup_by_phandle() - Reserve the unused second I2C address for DA9063 to prevent userspace interference - Fix resource leak in da9055_device_init() by calling regmap_del_irq_chip() in the error path - Fix potential IRQ chip conflict when probing multiple MAX77620 devices by using devm_kmemdup for regmap_irq_chip - Return -EPROBE_DEFER when a syscon devuice is not found to allow deferred probing - Update email address for the PF1550 PMIC driver in MAINTAINERS - Correct file entry for PF1550 MFD driver in MAINTAINERS from pfd1550.h to pf1550.h - Calculate checksum on the actual number of received bytes in qnap-mcu for error messages - Use -EPROTO instead of -EIO for checksum errors in qnap-mcu - Add proper error handling for command errors (e.g., "@8", "@9") in qnap-mcu - Fix missing irq_domain_remove() in error path of mt63{58,97}_irq_init() Cleanups: - Mark SMC write buffer arguments as const in apple_smc_write(), apple_smc_rw(), and apple_smc_write_atomic() - Simplify the error handling path in da9055_device_init() by removing a redundant mfd_remove_devices() call - Use regmap_reg_range() and a real one-element array for pmic_status_range in rohm-bd718x7 for cleaner initialization - Remove select I2C_K1 from MFD_SPACEMIT_P1 to avoid build failures when I2C_K1's dependencies are disabled - Remove unneeded semicolon from ls2k_bmc_recover_pci_data() - Drop OF dependency for MFD_MAX5970 in Kconfig to allow wider compile testing and non-OF systems - Make OF ID table style consistent in simple-mfd-i2c driver - Update header inclusions in simple-mfd-i2c to follow IWYU (Include What You Use) principle - Move checksum verification logic to a separate function in qnap-mcu - Use chained IRQs for S2MPG10 in the Samsung SEC driver to simplify interrupt handling - Drop a stray semicolon from sec-irq.c Removals: - Remove the unused TI WL1273 FM radio core driver - Remove the unused wl1273-core.h header and tidy up its reference in documentation Device tree bindings: - Add Device Tree binding for the NXP PF1550 PMIC - Add missing GPIO pins and supply properties to the Silergy SY7636A PMIC binding - Add interrupt-controller property to the Maxim MAX77705 binding for sub-device interrupt source determination - Add Device Tree binding for the Renesas R2A11302FT PMIC - Allow the wakeup-source property in the Dialog DA9063 binding - Make interrupt-related properties optional in the TI TPS65910 PMIC binding - Document the Qualcomm PMIV0104 PMIC compatible string - Document the Qualcomm PM7550 PMIC compatible string - Enable power button subnode for TWL603x in the TI TWL binding - Convert the Dialog DA9052/53 I2C binding from .txt to .yaml format, including compatible string fallback and interrupt properties - Document control-scb and sysreg-scb syscons on pic64gx with fallback compatibles - Document sama7g5-sfrbu and sama7d65-sfrbu syscons with fallback to atmel,sama5d2-sfrbu - Fix LEDs node schema in fsl,mc13xxx binding by adding led@ child nodes and missing properties - Add mt7981-topmisc compatible string to the syscon binding" * tag 'mfd-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (42 commits) mfd: sec: Drop a stray semicolon mfd: qnap-mcu: Hook up the EEPROM sub-device dt-bindings: mfd: syscon: Add mt7981-topmisc dt-bindings: mfd: fsl,mc13xxx: Fix LEDs node schema mfd: mt6358-irq: Fix missing irq_domain_remove() in error path mfd: mt6397-irq: Fix missing irq_domain_remove() in error path dt-bindings: mfd: Document syscons falling back to atmel,sama5d2-sfrbu dt-bindings: mfd: Document control-scb and sysreg-scb on pic64gx dt-bindings: mfd: Convert dlg,da9052-i2c.txt to yaml format mfd: sec: Use chained IRQs for s2mpg10 mfd: qnap-mcu: Add proper error handling for command errors mfd: qnap-mcu: Move checksum verification to its own function mfd: qnap-mcu: Use EPROTO in stead of EIO on checksum errors mfd: qnap-mcu: Calculate the checksum on the actual number of bytes received mfd: simple-mfd-i2c: Don't use "proxy" headers mfd: simple-mfd-i2c: Make ID table style consistent mfd: Kconfig: Drop OF dependency on MFD_MAX5970 mfd: ls2kbmc: Remove unneeded semicolon from ls2k_bmc_recover_pci_data() dt-bindings: mfd: twl: Enable power button also for TWL603X MAINTAINERS: Adjust file entry in NXP PF1550 PMIC MFD DRIVER ... commit 78385c7299f7514697d196b3233a91bd5e485591 Author: Caleb Sander Mateos Date: Thu Dec 4 15:43:31 2025 -0700 io_uring/kbuf: use READ_ONCE() for userspace-mapped memory The struct io_uring_buf elements in a buffer ring are in a memory region accessible from userspace. A malicious/buggy userspace program could therefore write to them at any time, so they should be accessed with READ_ONCE() in the kernel. Commit 98b6fa62c84f ("io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths") already switched the reads of the len field to READ_ONCE(). Do the same for bid and addr. Signed-off-by: Caleb Sander Mateos Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Cc: Joanne Koong Signed-off-by: Jens Axboe commit 13989207ee29c40501e719512e8dc90768325895 Author: Justin Tee Date: Mon Nov 17 10:43:43 2025 -0800 nvme-fabrics: add ENOKEY to no retry criteria for authentication failures With authentication, in addition to EKEYREJECTED there is also no point in retrying reconnects when status is ENOKEY. Thus, add -ENOKEY as another criteria to determine when to stop retries. Cc: Daniel Wagner Cc: Hannes Reinecke Closes: https://lore.kernel.org/linux-nvme/20250829-nvme-fc-sync-v3-0-d69c87e63aee@kernel.org/ Signed-off-by: Justin Tee Tested-by: Daniel Wagner Reviewed-by: Daniel Wagner Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch commit bb9f4cca7c031de6f0e85f7ba24abf0172829f85 Author: Israel Rukshin Date: Sun Nov 23 16:46:48 2025 +0200 nvme-auth: use kvfree() for memory allocated with kvcalloc() Memory allocated by kvcalloc() may come from vmalloc or kmalloc, so use kvfree() instead of kfree() for proper deallocation. Fixes: aa36d711e945 ("nvme-auth: convert dhchap_auth_list to an array") Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 5c8d134f01556affce430a25e1551d78d45ebc9d Author: Israel Rukshin Date: Mon Nov 24 08:49:21 2025 +0200 nvmet-tcp: use kvcalloc for commands array Replace kcalloc with kvcalloc for allocation of the commands array. Each command structure is 712 bytes. The array typically exceeds a single page, and grows much larger with high queue depths (e.g., commands >182KB). kvcalloc automatically falls back to vmalloc for large or fragmented allocations, improving reliability. In our case, this memory is not aimed for DMA operations and could be safely allocated by kvcalloc. Using virtually contiguous memory helps to avoid allocation failures and out-of-memory conditions common with kcalloc on large pools. Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ce234d838d3b0566bcbf3fd13b546f176564ca07 Author: Israel Rukshin Date: Mon Nov 24 08:49:20 2025 +0200 nvmet-rdma: use kvcalloc for commands and responses arrays Replace kcalloc with kvcalloc for allocation of the commands and responses arrays. Each command structure is 272 bytes and each response structure is 672 bytes. These arrays typically exceed a single page, and grow much larger with high queue depths (e.g., commands >2MB, responses >170KB) kvcalloc automatically falls back to vmalloc for large or fragmented allocations, improving reliability. In our case, this memory is not aimed for DMA operations and could be safely allocated by kvcalloc. Using virtually contiguous memory helps to avoid allocation failures and out-of-memory conditions common with kcalloc on large pools. Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit b645d5a25d49a515026ec444f2ccb087fe9daa7f Author: Chu Guangqing Date: Mon Nov 3 10:41:31 2025 +0800 nvme: fix typo error in nvme target Fix two spelling mistakes. Reviewed-by: Christoph Hellwig Signed-off-by: Chu Guangqing Signed-off-by: Keith Busch commit 525916ce496615f531091855604eab9ca573b195 Author: Joanne Koong Date: Thu Dec 4 13:51:16 2025 -0800 io_uring/rsrc: fix lost entries after cloned range When cloning with node replacements (IORING_REGISTER_DST_REPLACE), destination entries after the cloned range are not copied over. Add logic to copy them over to the new destination table. Fixes: c1329532d5aa ("io_uring/rsrc: allow cloning with node replacements") Cc: stable@vger.kernel.org Signed-off-by: Joanne Koong Signed-off-by: Jens Axboe commit 57413f0899fab78be87bdb4272ac2f8be83a9b39 Author: Daniel Wagner Date: Tue Oct 28 16:26:24 2025 +0100 nvmet-fc: use pr_* print macros instead of dev_* Many of the nvmet-fc log messages cannot print the device used, because it's not there yet: (NULL device *): {0:0} Association deleted Use the pr_* macros consistently throughout the module and match the output of the nvme-fc module. Using port:association ids are more useful when debugging what's going on, because these match now with the log entries from nvme-fc. Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit e29af2aba262833c8eba578b58d6bbb6b0866a67 Author: Joanne Koong Date: Thu Dec 4 13:51:15 2025 -0800 io_uring/rsrc: rename misleading src_node variable in io_clone_buffers() The variable holds nodes from the destination ring's existing buffer table. In io_clone_buffers(), the term "src" is used to refer to the source ring. Rename to node for clarity. Signed-off-by: Joanne Koong Signed-off-by: Jens Axboe commit b8201b50e403815f941d1c6581a27fdbfe7d0fd4 Author: Joanne Koong Date: Thu Dec 4 13:51:14 2025 -0800 io_uring/rsrc: clean up buffer cloning arg validation Get rid of some redundant checks and move the src arg validation to before the buffer table allocation, which simplifies error handling. Signed-off-by: Joanne Koong Signed-off-by: Jens Axboe commit 86ef6f7fc7412e462a4e9ae7490862dfee06b913 Author: Daniel Wagner Date: Tue Oct 28 16:26:23 2025 +0100 nvmet-fcloop: remove unused lsdir member. Nothing is using lsdir member in struct fcloop_lsreq. Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit f9929c518de861716117e52c363d140e0156e9ad Author: Daniel Wagner Date: Tue Oct 28 16:26:22 2025 +0100 nvmet-fcloop: check all request and response have been processed When the remoteport or the targetport are removed check that there are no inflight requests or responses. Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit 67582dfd870a138ec385de88c5f9df62a7c20254 Author: Daniel Wagner Date: Tue Oct 28 16:26:21 2025 +0100 nvme-fc: check all request and response have been processed When the rport is removed there shouldn't be any in flight request or responses. Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit f7e3f852a42d7cd8f1af2c330d9d153e30c8adcf Author: Shaurya Rane Date: Thu Dec 4 23:42:59 2025 +0530 block: fix memory leak in __blkdev_issue_zero_pages Move the fatal signal check before bio_alloc() to prevent a memory leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending. Previously, the bio was allocated before checking for a fatal signal. If a signal was pending, the code would break out of the loop without freeing or chaining the just-allocated bio, causing a memory leak. This matches the pattern already used in __blkdev_issue_write_zeroes() where the signal check precedes the allocation. Fixes: bf86bcdb4012 ("blk-lib: check for kill signal in ioctl BLKZEROOUT") Reported-by: syzbot+527a7e48a3d3d315d862@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=527a7e48a3d3d315d862 Signed-off-by: Shaurya Rane Reviewed-by: Keith Busch Tested-by: syzbot+527a7e48a3d3d315d862@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 8a32282175c964eb15638e8dfe199fc13c060f67 Author: shechenglong Date: Wed Dec 3 23:17:49 2025 +0800 block: fix comment for op_is_zone_mgmt() to include RESET_ALL REQ_OP_ZONE_RESET_ALL is a zone management request, and op_is_zone_mgmt() has returned true for it. Update the comment to remove the misleading exception note so the documentation matches the implementation. Fixes: 12a1c9353c47 ("block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL") Signed-off-by: shechenglong Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit 552c1149af7ac0cffab6fccd13feeaf816dd1f53 Author: Damien Le Moal Date: Thu Dec 4 19:59:52 2025 +0900 block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs Commit fe0418eb9bd6 ("block: Prevent potential deadlocks in zone write plug error recovery") added a WARN check in disk_put_zone_wplug() to verify that when the last reference to a zone write plug is dropped, this zone write plug does not have the BLK_ZONE_WPLUG_PLUGGED flag set, that is, that it is not plugged. However, the function disk_zone_wplug_abort(), which is called for zone reset and zone finish operations, does not clear this flag after emptying a zone write plug BIO list. This can result in the disk_put_zone_wplug() warning to trigger if the user (erroneously as that is bad pratcice) issues zone reset or zone finish operations while the target zone still has plugged BIOs. Modify disk_put_zone_wplug() to clear the BLK_ZONE_WPLUG_PLUGGED flag. And while at it, also add a lockdep annotation to ensure that this function is called with the zone write plug spinlock held. Fixes: fe0418eb9bd6 ("block: Prevent potential deadlocks in zone write plug error recovery") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Johannes Thumshirn Signed-off-by: Jens Axboe commit aa833fc394baad601b8f7779c1ae2ada3a06ce07 Author: Thomas Hellström Date: Thu Dec 4 21:20:59 2025 +0100 drm/xe: Fix duplicated put due to merge resolution An incorrect backmerge resolution resulted in an incorrect duplicate put. Fix. Reported-by: Linus Torvalds Closes: https://lore.kernel.org/dri-devel/CAHk-=whaiMayMx=LrL7P119MLBX6exM_mEu4S2uBRT+xWQ-mbA@mail.gmail.com/ Fixes: Fixes: ce0478b02ed2 ("Merge tag 'v6.18-rc6' into drm-next") Signed-off-by: Thomas Hellström Acked-by: Dave Airlie Signed-off-by: Linus Torvalds commit dd463c51a327d341d3ece63dd50e1a0f8f09c468 Merge: 52206f82d92445 79cf71c0b177c0 Author: Linus Torvalds Date: Thu Dec 4 14:10:16 2025 -0800 Merge tag 'mmc-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Allow more host caps to be modified through debugfs - Skip to set the default 200mA SD current limit MMC host: - Convert a few more DT bindings to the DT schema - dw_mmc: Add Shawn Lin as co-maintainer for the dw_mmc drivers - dw_mmc-rockchip: - Add memory clock auto-gating support - Add support for the RK3506 variant - meson-mx-sdio: - Ignore disabled "mmc-slot" child-nodes - Refactoring and general code improvements - renesas_sdhi: - Enable bigger data ports where available - Manage reset in probe and during system-wide suspend/resume - sdhci-brcmstb: - Add support for the BCM72116 and BCM74371 variants - Save/restore registers during system-wide suspend/resume - sdhci-msm: - Add support for the sm8750 and the Kaanapali variants - Avoid early clock doubling during HS400 transition - sdhci-of-dwcmshc: - Add command queue support for Rockchip SOCs - Add support for the Eswin EIC7700 variant" * tag 'mmc-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (40 commits) mmc: sdhci-of-dwcmshc: reduce CIT for better performance mmc: sdhci-of-dwcmshc: Disable internal clock auto gate for Rockchip SOCs mmc: sdhci-msm: Avoid early clock doubling during HS400 transition MAINTAINERS: Add Shawn Lin as co-maintainer for dw_mmc drivers mmc: sdhci-of-dwcmshc: Fix command queue support for RK3576 mmc: renesas_sdhi: Add suspend/resume hooks mmc: renesas_sdhi: Switch to SYSTEM_SLEEP_PM_OPS()/RUNTIME_PM_OPS() and pm_ptr() mmc: renesas_sdhi: Deassert the reset signal on probe dt-bindings: mmc: am654: Simplify dma-coherent property mmc: meson-mx-sdio: Ignore disabled "mmc-slot" child-nodes mmc: meson-mx-sdio: Fix indentation in meson_mx_mmc_irq_thread() mmc: meson-mx-sdio: Use dev_err_probe() where appropriate mmc: meson-mx-sdio: Use devm_mmc_alloc_host() helper mmc: meson-mx-sdio: Refactor internal clock initialization mmc: meson-mx-sdio: Use devm_clk_get_enabled() mmc: meson-mx-sdio: Switch to regmap for register access mmc: core: add WQ_PERCPU to alloc_workqueue users mmc: dw_mmc-rockchip: Add memory clock auto-gating support mmc: omap: add WQ_PERCPU to alloc_workqueue users mmc: mtk-sd: replace use of system_wq with system_percpu_wq ... commit 3f1c07fc21c68bd3bd2df9d2c9441f6485e934d9 Merge: d72312d730450a 0692602defb0c2 Author: Thomas Hellström Date: Thu Dec 4 22:54:56 2025 +0100 Merge drm/drm-next into drm-xe-next-fixes Backmerging to be able do to a clean PR. Signed-off-by: Thomas Hellström commit 52206f82d9244546e5790f5ad64465343aa7ffd5 Merge: 500920fa76819b 1f67707fafa598 Author: Linus Torvalds Date: Thu Dec 4 13:50:39 2025 -0800 Merge tag 'pmdomain-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Allow power-off for out-of-band wakeup-capable devices - Drop the redundant call to dev_pm_domain_detach() for the amba bus - Extend the genpd governor for CPUs to account for IPIs pmdomain providers: - bcm: Add support for BCM2712 - mediatek: Add support for MFlexGraphics power domains - mediatek: Add support for MT8196 power domains - qcom: Add RPMh power domain support for Kaanapali - rockchip: Add support for RV1126B pmdomain consumers: - usb: dwc3: Enable out of band wakeup for i.MX95 - usb: chipidea: Enable out of band wakeup for i.MX95" * tag 'pmdomain-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (26 commits) pmdomain: Extend the genpd governor for CPUs to account for IPIs smp: Introduce a helper function to check for pending IPIs pmdomain: mediatek: convert from clk round_rate() to determine_rate() amba: bus: Drop dev_pm_domain_detach() call pmdomain: bcm: bcm2835-power: Prepare to support BCM2712 pmdomain: mediatek: mtk-mfg: select MAILBOX in Kconfig pmdomain: mediatek: Add support for MFlexGraphics pmdomain: mediatek: Fix build-errors cpuidle: psci: Replace deprecated strcpy in psci_idle_init_cpu pmdomain: rockchip: Add support for RV1126B pmdomain: mediatek: Add support for MT8196 HFRPSYS power domains pmdomain: mediatek: Add support for MT8196 SCPSYS power domains pmdomain: mediatek: Add support for secure HWCCF infra power on pmdomain: mediatek: Add support for Hardware Voter power domains pmdomain: qcom: rpmhpd: Add RPMh power domain support for Kaanapali usb: dwc3: imx8mp: Set out of band wakeup for i.MX95 usb: chipidea: ci_hdrc_imx: Set out of band wakeup for i.MX95 usb: chipidea: core: detach power domain for ci_hdrc platform device pmdomain: core: Allow power-off for out-of-band wakeup-capable devices PM: wakeup: Add out-of-band system wakeup support for devices ... commit 500920fa76819b4909a32081e153bce80ce74824 Merge: 205f1a0d188658 dae9750105cf93 Author: Linus Torvalds Date: Thu Dec 4 12:33:38 2025 -0800 Merge tag 'gpio-updates-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "There's one new driver, lots of various updates to existing ones, some refactoring support for new models and misc tweaks and fixes. The biggest new feature in GPIO core is adding support for managed, enable-counted sharing of GPIO pins, something that - until now - was only hacked around with the GPIOD_FLAGS_BIT_NONEXCLUSIVE request flag which basically allowed drivers to "fight it out" for the descriptor and provided no synchronization. It was enabled on Qualcomm platforms (and thus is enabled on arm64 defconfig) and I plan on removing GPIOD_FLAGS_BIT_NONEXCLUSIVE once all drivers using it are switched to the new mechanism. GPIO core: - add proper support for shared GPIOs that's aiming to replace the current sharing mechanism (which provides no synchronization ot enable counting) and enable it for Qualcomm platforms - improve the software node GPIO lookup by using the fwnode representation instead of the software node's name which was prone to bugs (GPIO controllers don't have to use the software node's name as their kernel label) - remove the last user of legacy-of-mm-gpiochip.h and drop the header - move closer to removing the legacy gpio_request_one() routine - rename some symbols for consistency - shrink GPIO printk() helpers by reusing existing code - remove some redundant kernel messages - use min() instead of min_t() in GPIO ACPI code - use system_percpu_wq instead of system_wq in GPIO character device code New drivers: - add a driver for the QIXIS FPGA GPIO controller Driver improvements: - use modernized variants of power management macros across a wide array of drivers in order to avoid having to use the __maybe_unused attribute - convert gpio-elkhartlake and reset-gpio to using the auxiliary bus instead of the platform bus as they are not really described in firmware - use lock guards and update symbol prefixes in gpio-mmio - support the bryx radio interface kit in gpio-mpsse + refactor the driver - use software nodes for configuring the reset-gpio driver, including setting up the reference to the shared "reset" pin - check and propagate the return value of gpiod_set_value() to user-space in gpio-virtuser (this was previously not possible as this function returned void) - extend the gpio-regmap helper with more features (bypass cache for aliased inputs, force writes for aliased data registers, add a new configuration parameter) - remove unneeded includes from gpio-aspeed and gpio-latch - add support for Tegra410 to gpio-tegra186 - replace PCI-specific PM with generic device-level PM in gpio-bt8xx - use dynamic GPIO range allocation in gpio-loongson-64bit - improve handling of level-triggered interrupts in gpio-pca953x - add suspend/resume support to gpio-fxl6408 - add support for more models to gpio-menz127 - optimize gpio-mvebu interrupt handling by avoiding unnecessary calls to mvebu_gpio_irq_handler() - make locking more consistent in gpio-grgpio Device-tree bindings: - document new NXP and Microchip models Documentation: - add a comprehensive compatibility and feature list for gpio-pca953x, which is a great addition as it's probably the most commonly used GPIO expander driver - kernel-doc tweaks Late fixes: - use BYTE_CTRL_MODE for 2K2000/3000 models in gpio-loongson" * tag 'gpio-updates-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (80 commits) gpio: loongson: Switch 2K2000/3000 GPIO to BYTE_CTRL_MODE gpio: regmap: fix kernel-doc notation gpio: shared: fix a deadlock gpio: shared-proxy: set suppress_bind_attrs gpio: shared: ignore GPIO hogs when traversing the device tree gpio: shared: ignore special __symbols__ node when traversing device tree gpio: shared: handle the reset-gpios corner case gpio: zynq: Use modern PM macros gpio: xilinx: Use modern PM macros gpio: xgene: Use modern PM macros gpio: uniphier: Use modern PM macros gpio: tqmx86: Use modern PM macros gpio: pch: Use modern PM macros gpio: omap: Use modern PM macros gpio: msc313: Use modern PM macros gpio: mlxbf2: Use modern PM macros gpio: ml-ioh: Use modern PM macros gpio: pl061: Use modern PM macros gpio: htc-egpio: Use modern PM macros gpio: brcmstb: Use modern PM macros ... commit 205f1a0d188658ff3043d91c988378d8a81344c2 Merge: 02892f90a9851f 036176d9dba74e Author: Linus Torvalds Date: Thu Dec 4 12:26:36 2025 -0800 Merge tag 'firewire-updates-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "This includes two changes for core functions, which affects all use cases of this subsystem: - Handle per-device interoperability quirks Some devices have quirks affecting interoperability. To identify such quirks at an early stages of device detection, the step for reading the configuration ROM contents has been changed. As a side effect, the entire detection process is now performed at the basic transaction speed (S100), without a trial to probe higher supported speeds. With this change, the following devices should now work with fewer issues: - TASCAM FW-1884, FW-1804, and FW-1082 - MOTU Audio Express - Safer removals of host card There was a race condition between host card removal and handling of bus reset events in the workqueue. This appears to be a long standing issue, and recent changes to use more workqueues escalate it. To solve it, a new callback has been added to the 1394 OHCI PCI driver to unregister the interrupt sources and wait for workqueue completions when removing a card instance" * tag 'firewire-updates-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: abort pending transactions at card removal firewire: core: add WQ_UNBOUND to alloc_workqueue users firewire: core: clear sources of hardware interrupt at card removal firewire: core: code refactoring to find and pop transaction entry firewire: core: code refactoring to remove transaction entry firewire: core: use cleanup function to release cached configuration ROM ALSA: firewire-tascam: reserve resources for transferred isochronous packets at S400 firewire: core: handle device quirk of TASCAM FW-1884/FW-1804/FW-1082 firewire: core: determine transaction speed after detecting quirks firewire: core: code refactoring to compute transaction speed firewire: core: handle device quirk of MOTU Audio Express firewire: core: detect device quirk when reading configuration ROM commit 02892f90a9851f508e557b3c75e93fc178310d5f Merge: fca5327eaa8117 30ca0e049f5070 Author: Linus Torvalds Date: Thu Dec 4 12:19:49 2025 -0800 Merge tag 'hwmon-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Apple Silicon SMC - TSC1641 I2C power monitor - MPS MP9945 - MAX17616 - MP2925 and MP2929 Added support for new devices to existing drivers: - dell-smm: Add Dell G5 5505 to fan control whitelist - aspeed-g6-pwm-tach: Support for AST2700 - asus-ec-sensors: Support for ROG STRIX X470-I GAMING, ROG STRIX X870-F GAMING WIFI, ROG STRIX X870E-H GAMING WIFI7, and Pro WS TRX50-SAGE WIFI - k10temp: Support for AMD Steam Deck APU ID - pmbus/isl68137: Support for raa229141 - aht10: Support for dht20 - adt7410: Support for ADT7422 - peci: Support for Intel Emerald Rapids - nct6775: Support for ASUS ROG STRIX X870E-H GAMING WIFI7 - pmbus/max34440: Support for ADPM12200 - ntc-thermistor: Support for Murata ncp18wm474 Infrastructure updates: - Utilize subsystem locking in various drivers - ltc4282, ltc2947: Use the new energy64 attribute Bug fixes: - Various drivers: Fixes to avoid TOCTOU, mostly in macro functions evaluating parameters multiple times, as well as missing locks - max6697: Fix regmap leak on probe failure - sy7636a: Fix regulator_enable resource leak on error path - asus-ec-sensors: Correct Pro WS TRX50-SAGE WIFI entry Other changes and improvements: - w83781d, lm78: Drop REALLY_SLOW_IO - Fix broken datasheet links in various drivers And various other minor fixes and improvements" * tag 'hwmon-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (110 commits) hwmon: (dell-smm) Add Dell G5 5505 to fan control whitelist hwmon: (max16065) Use local variable to avoid TOCTOU hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU hwmon: (max6697) fix regmap leak on probe failure hwmon/w83781d: Drop REALLY_SLOW_IO setting hwmon/lm78: Drop REALLY_SLOW_IO setting hwmon: sy7636a: Fix regulator_enable resource leak on error path hwmon: (adm1026) Convert macros to functions to avoid TOCTOU hwmon: (adm1029) Add locking to avoid TOCTOU hwmon: (lm87) Convert macros to functions to avoid TOCTOU hwmon: (asus-ec-sensors) correct Pro WS TRX50-SAGE WIFI entry hwmon: (vt8231) Convert macros to functions to avoid TOCTOU hwmon: (emc2103) Add locking to avoid TOCTOU hwmon: (aspeed-g6-pwm-tach): Add AST2700 compatible string dt-bindings: hwmon: Add AST2700 compatible hwmon: (asus-ec-sensors) add ROG STRIX X470-I GAMING hwmon: (vt1211) Convert macros to functions to avoid TOCTOU hwmon: (k10temp) Add AMD Steam Deck APU ID hwmon: Add Apple Silicon SMC hwmon driver Documentation/hwmon: Fix broken datasheet links for zl6100 ... commit 666065caa31aeb812978740bae21871067bb14b6 Author: Arnd Bergmann Date: Thu Dec 4 10:50:14 2025 +0100 pinctrl: add CONFIG_OF dependencies for microchip drivers The two newly added drivers fail to link on builds without CONFIG_OF: x86_64-linux-ld: drivers/pinctrl/pinctrl-pic64gx-gpio2.o: in function `pinconf_generic_dt_node_to_map_all': pinctrl-pic64gx-gpio2.c:(.text+0xc9): undefined reference to `pinconf_generic_dt_node_to_map' x86_64-linux-ld: drivers/pinctrl/pinctrl-mpfs-iomux0.o: in function `pinconf_generic_dt_node_to_map_all': pinctrl-mpfs-iomux0.c:(.text+0xc9): undefined reference to `pinconf_generic_dt_node_to_map' Add a Kconfig dependencies. Fixes: 38cf9d641314 ("pinctrl: add pic64gx "gpio2" pinmux driver") Fixes: 46397274da22 ("pinctrl: add polarfire soc iomux0 pinmux driver") Signed-off-by: Arnd Bergmann Acked-by: Conor Dooley Signed-off-by: Linus Walleij commit 316f0b43fe0131af869a5a58e20ec6e0b6038fa8 Author: Brian Norris Date: Tue Dec 2 11:30:26 2025 -0800 coccinelle: Drop pm_runtime_barrier() error code checks This function doesn't return anything any more, so the compiler would notice any bad error handling before any cocci script would. Signed-off-by: Brian Norris Tested-by: Guenter Roeck Link: https://patch.msgid.link/20251202193129.1411419-3-briannorris@chromium.org Signed-off-by: Rafael J. Wysocki commit 41f7351fc47283822c4b70b0f42741f52cc1e6f6 Author: Brian Norris Date: Tue Dec 2 11:30:25 2025 -0800 PM: runtime: Make pm_runtime_barrier() return void No callers check the return code, and that's a good thing. Doing so would be racy and unhelpful. Drop the return code entirely, so we don't make anyone think about its complexities. Signed-off-by: Brian Norris Tested-by: Guenter Roeck Link: https://patch.msgid.link/20251202193129.1411419-2-briannorris@chromium.org Signed-off-by: Rafael J. Wysocki commit 3df2470adc1ce91f19021109c83c6e497d362835 Author: Brian Norris Date: Tue Dec 2 11:30:24 2025 -0800 PM: runtime: Stop checking pm_runtime_barrier() return code Apparently this test is the only code that checks the return code from pm_runtime_barrier(), and it turns out that's for good reason -- it's inherently racy, and a bad idea. We're going to make pm_runtime_barrier() return void, so prepare for that by dropping any return code checks. This resolves some test failures seen like the following: [ 34.559694] # pm_runtime_error_test: EXPECTATION FAILED at drivers/base/power/runtime-test.c:177 [ 34.559694] Expected 1 == pm_runtime_barrier(dev), but [ 34.559694] pm_runtime_barrier(dev) == 0 (0x0) [ 34.563604] # pm_runtime_error_test: pass:0 fail:1 skip:0 total:1 Reported-by: Guenter Roeck Closes: https://lore.kernel.org/lkml/93259f2b-7017-4096-a31b-cabbf6152e9b@roeck-us.net/ Signed-off-by: Brian Norris Tested-by: Guenter Roeck Link: https://patch.msgid.link/20251202193129.1411419-1-briannorris@chromium.org Signed-off-by: Rafael J. Wysocki commit fca5327eaa8117b18c8faf79154d6eafecaf4892 Merge: fa5ef105618ae9 f5ef3f722d76eb Author: Linus Torvalds Date: Thu Dec 4 11:37:13 2025 -0800 Merge tag 'gnss-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss Pull GNSS updates from Johan Hovold: - add support for claiming and deasserting the safeboot pin found on recent u-blox receivers - fix timepulse pin description in the devicetree binding ... and some related binding updates * tag 'gnss-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss: dt-bindings: gnss: fix timepulse description dt-bindings: gnss: u-blox: use lowercase company name dt-bindings: gnss: u-blox: use open-drain reset and safeboot in example gnss: ubx: add support for the safeboot gpio dt-bindings: gnss: u-blox: add safeboot gpio commit fa5ef105618ae9b5aaa51b3f09e41d88d4514207 Merge: 0a9431fa74ac9b cb5c2eb459f4c9 Author: Linus Torvalds Date: Thu Dec 4 11:24:24 2025 -0800 Merge tag 'spi-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "This release is almost entirely new drivers, with a couple of small changes in generic code. The biggest individual update is a rename of the existing Microchip driver and the addition of a new driver for the silicon SPI controller in their PolarFire SoCs. The overlap between the soft IP supported by the current driver and this new one is regrettably all in the IP and not in the register interface offered to software. - Add a time offset parameter for offloads, allowing them to be defined in relation to each other. This is useful for IIO type applcations where you trigger an operation then read the result after a delay. - Add a tracepoint for flash exec_ops, bringing the flash support more in line with the debuggability of vanilla SPI. - Support for Airoha EN7523, Arduino MCUs, Aspeed AST2700, Microchip PolarFire SPI controllers, NXP i.MX51 ECSPI target mode, Qualcomm IPQ5414 and IPQ5332, Renesas RZ/T2H, RZ/V2N and RZ/2NH and SpacemiT K1 QuadSPI. There's also a small set of ASoC cleanups that I mistakenly applied to the SPI tree and then put more stuff on top of before it was brought to my attention, sorry about that" * tag 'spi-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (80 commits) spi: microchip-core: Refactor FIFO read and write handlers spi: ch341: fix out-of-bounds memory access in ch341_transfer_one spi: microchip-core: Remove unneeded PM related macro spi: microchip-core: Use SPI_MODE_X_MASK spi: microchip-core: Utilise temporary variable for struct device spi: microchip-core: Replace dead code (-ENOMEM error message) spi: microchip-core: use min() instead of min_t() spi: dt-bindings: airoha: add compatible for EN7523 spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/V2N SoC support spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/V2N SoC support spi: microchip: Enable compile-testing for FPGA SPI controllers spi: Fix potential uninitialized variable in probe() spi: rzv2h-rspi: add support for RZ/T2H and RZ/N2H spi: dt-bindings: renesas,rzv2h-rspi: document RZ/T2H and RZ/N2H spi: rzv2h-rspi: add support for loopback mode spi: rzv2h-rspi: add support for variable transfer clock spi: rzv2h-rspi: add support for using PCLK for transfer clock spi: rzv2h-rspi: make transfer clock rate finding chip-specific spi: rzv2h-rspi: avoid recomputing transfer frequency ... commit 0a9431fa74ac9b744bff5b65082ff96fd3d80297 Merge: ba1401f9cced49 81d431130ae1af Author: Linus Torvalds Date: Thu Dec 4 11:20:29 2025 -0800 Merge tag 'regulator-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This is a relatively busy release for the regulator API, as well as a good collection of new drivers we've got a little bit of core work and a bunch of cleanup throughout the subsystem: - Support for propagating undervoltage events to child regulators - Undo enables done on supplies when setting enabling regulators via constraints fails - Pull in some gpiolib changes adding support for shared GPIOs to the gpiolib core, using them to replace the open coded variant of this that we've had in the regulator API for a long time - Support for Fitipower FP9931 and JD9330, Mediatek MT6316, MT6363 and MT6373, NXP PF1550 and Qualcomm PMH01XX and PMCX0102 The PF1550 support was originally going to go via the MFD tree but Krzysztof's cleanup work overlapped with it so I pulled in Lee's signed tag with support for the device" * tag 'regulator-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (50 commits) regulator: fp9931: Fix spelling mistake "failid" -> "failed" regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex regulator: pf9453: Constify pointers to 'regulator_desc' wrap struct regulator: pca9450: Constify pointers to 'regulator_desc' wrap struct regulator: mt6358: Constify pointers to 'regulator_desc' wrap struct regulator: bd96801: Constify pointers to 'regulator_desc' wrap struct regulator: bd718x7: Constify pointers to 'regulator_desc' wrap struct regulator: bd71828: Constify pointers to 'regulator_desc' wrap struct regulator: bd71815: Constify pointers to 'regulator_desc' wrap struct regulator: Use container_of_const() when all types are const regulator: pca9450: Fix error code in probe() regulator: qcomm-labibb: replace use of system_wq with system_dfl_wq regulator: Add FP9931/JD9930 driver dt-bindings: regulator: Add Fitipower FP9931/JD9930 dt-bindings: vendor-prefixes: Add Fitipower regulator: make the subsystem aware of shared GPIOs regulator: renesas-usb-vbus-regulator: Remove unused headers regulator: pca9450: Add support for setting debounce settings regulator: dt-bindings: pca9540: add debounce timer configuration regulator: core: disable supply if enabling main regulator fails ... commit ba1401f9cced493948a691a670308832588e8f60 Merge: edd2b9832d604a 6985defd1d832f Author: Linus Torvalds Date: Thu Dec 4 11:16:44 2025 -0800 Merge tag 'regmap-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "Another small update for regmap, we have one new feature plus a little bit of cleanup: - Support for sparseness information in the flat cache, allowing users that really need the performance properties it provides to benefit from the interface and startup time improvements that sparsness provides without needing to go all the way to a more fancy data structure - Cleanup work from Andy Shevchenko, refactoring the cache interface in preparation for some future stuff he's working on" * tag 'regmap-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: sdw-mbq: Reorder regmap_mbq_context struct for better packing regmap: i3c: Use ARRAY_SIZE() regcache: maple: Split ->populate() from ->init() regcache: flat: Split ->populate() from ->init() regcache: flat: Remove unneeded check and error message for -ENOMEM regcache: rbtree: Split ->populate() from ->init() regcache: Add ->populate() callback to separate from ->init() regmap: warn users about uninitialized flat cache regmap: add flat cache with sparse validity commit edd2b9832d604a234b60a4910c7496f351cd1e12 Merge: 77956cf36494cc 801b0840b09d93 Author: Linus Torvalds Date: Thu Dec 4 11:07:46 2025 -0800 Merge tag 'mtd/for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "Core MTD changes: - We must ignore error -ENOENT from parsers on subpartitions which is a legitimate return value - PM support is added to the intel-dg driver Raw NAND changes: - The major change in this is the support for the Allwinner H616 NAND controller, which lead to numerous changes and cleanups in the driver. - Another notable change in this driver is the use of field_get() and field_prep(), but since the global support for this helpers is going to be merged in the same release as we start using these helpers, we undefine them in the first place to avoid warnings. - Marvell drivers layout handling changes have also landed, they fix previous definitions and abuses that have been made previously, which implied to relax the ECC parameters validation in the core a bit. - The Cadence NAND controller driver gets NV-DDR interface support. SPI NAND changes: - Support for FudanMicro FM25S01BI3 and ESMT F50L1G41LC is added. SPI NOR changes: - Fix SMPT parsing for S25FS-S flash family. They report variable dummy cycles for reads. This results in the default of 0 being used. This works for other Infineon chips, but not for the S25FS-S family. They need 8 dummy cycles. Add fixup hooks to specify that. Also add fixup hooks to fix incorrect map ID data in SFDP. - Add support for a bunch of Winbond flashes. Their block protection information is not discoverable, so they need to have an entry in the flash tables to describe that. - Some cleanups for Micron flash support. - Add support for Micron mt35xu01gbba. - Some SPI controllers like the Intel one on the PCI bus do not support the read CR opcode (0x35). Do not use the opcode if the controller does not support it. Aside from these main changes, there is the usual load of API updates, kdoc fixes, potential memory leaks fixes, etc" * tag 'mtd/for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (51 commits) mtd: sm_ftl: Fix typo in comment in sm_read_lba mtd: sm_ftl: Replace deprecated strncpy with sysfs_emit in sm_attr_show mtd: lpddr_cmds: fix signed shifts in lpddr_cmds mtd: docg3: fix kernel-doc warnings mtd: spinand: add support for FudanMicro FM25S01BI3 mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors mtd: nand: realtek-ecc: Fix Kconfig dependencies mtd: rawnand: sunxi: #undef field_{get,prep}() before local definition mailmap: update Pratyush Yadav's email address mtd: spi-nor: core: Check read CR support mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba mtd: spi-nor: micron-st: add mt35xu01gbba support mtd: spi-nor: micron-st: use SFDP of mt35xu512aba mtd: spi-nor: micron-st: move set_octal_dtr to late_init() mtd: spi-nor: micron-st: rename the die_late_init functions mtd: spinand: esmt: add support for F50L1G41LC mtd: rawnand: lpc32xx_slc: Convert to use devm_gpiod_get_optional() mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() mtd: spi-nor: spansion: SMPT fixups for S25FS-S ... commit 861111b69896145a928c889d9344797ea3711028 Author: Geert Uytterhoeven Date: Thu Dec 4 11:29:16 2025 +0100 net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT If CONFIG_BPF_SYSCALL=y, but CONFIG_BPF_JIT=n: net/smc/smc_hs_bpf.c: In function ‘bpf_smc_hs_ctrl_init’: include/linux/bpf.h:2068:50: error: statement with no effect [-Werror=unused-value] 2068 | #define register_bpf_struct_ops(st_ops, type) ({ (void *)(st_ops); 0; }) | ^~~~~~~~~~~~~~~~ net/smc/smc_hs_bpf.c:139:16: note: in expansion of macro ‘register_bpf_struct_ops’ 139 | return register_bpf_struct_ops(&bpf_smc_hs_ctrl_ops, smc_hs_ctrl); | ^~~~~~~~~~~~~~~~~~~~~~~ While this compile error is caused by a bug in , none of the code in net/smc/smc_hs_bpf.c becomes effective if CONFIG_BPF_JIT is not enabled. Hence add a dependency on BPF_JIT. While at it, add the missing newline at the end of the file. Fixes: 15f295f55656658e ("net/smc: bpf: Introduce generic hook for handshake flow") Signed-off-by: Geert Uytterhoeven Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/988c61e5fea280872d81b3640f1f34d0619cfbbf.1764843951.git.geert@linux-m68k.org commit 77956cf36494cc5e5649b187f552b90fb14d0674 Merge: 04265849c856ac fae00ea9f00367 Author: Linus Torvalds Date: Thu Dec 4 11:04:38 2025 -0800 Merge tag 'pwm/for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "In addition to the usual mix of core cleanups, driver changes, minor fixes and device tree updates the highlight this cycle is Rust support for the core and a first Rust driver both provided by Michal Wilczynski. Michal wrote about these changes on https://mwilczynski.dev/posts/bringing-rust-to-the-pwm-subsystem/ which is a nice read" * tag 'pwm/for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (22 commits) pwm: rzg2l-gpt: Allow checking period_tick cache value only if sibling channel is enabled pwm: bcm2835: Make sure the channel is enabled after pwm_request() pwm: mediatek: Make use of struct_size macro pwm: mediatek: Remove unneeded semicolon pwm: airoha: Add support for EN7581 SoC pwm: mediatek: Convert to waveform API pwm: max7360: Clean MAX7360 code pwm: Drop unused function pwm_apply_args() pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id pwm: Simplify printf to emit chip->npwm in $debugfs/pwm pwm: th1520: Use module_pwm_platform_driver! macro pwm: th1520: Fix clippy warning for redundant struct field init pwm: Fix Rust formatting dt-bindings: pwm: thead: Add T-HEAD TH1520 PWM controller pwm: Add Rust driver for T-HEAD TH1520 SoC rust: pwm: Fix broken intra-doc link rust: pwm: Drop wrapping of PWM polarity and state rust: pwm: Add module_pwm_platform_driver! macro rust: pwm: Add complete abstraction layer rust: pwm: Add Kconfig and basic data structures ... commit 04265849c856ace113e75ae88069b8665bd4dcbe Merge: 2aa680df68062e 52075d2c7595cf Author: Linus Torvalds Date: Thu Dec 4 10:36:54 2025 -0800 Merge tag 'chrome-platform-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "Improvements: - Support legacy probe behavior in cros_ec_lightbar and cros_ec_sensorhub Fixes: - Don't fall back to legacy probe behavior if it isn't a legacy device in cros_usbpd_notify - Fix an UAF after unbinding driver in cros_ec_ishtp" * tag 'chrome-platform-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: sensorhub: Support devices without FIFO_INT_ENABLE platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver platform/chrome: cros_ec_lightbar: Check if ec supports suspend commands platform/chrome: cros_usbpd_notify: defer probe when parent EC driver isn't ready commit 2aa680df68062e4e0c356ec2aa7100c13654907b Merge: 6dfafbd0299a60 eaf526cfa4e537 Author: Linus Torvalds Date: Thu Dec 4 10:08:40 2025 -0800 Merge tag 'sound-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "The majority of changes at this time were about ASoC with a lot of code refactoring works. From the functionality POV, there isn't much to see, but we have a wide range of device-specific fixes and updates. Here are some highlights: - Continued ASoC API cleanup work, spanned over many files - Added a SoundWire SCDA generic class driver with regmap support - Enhancements and fixes for Cirrus, Intel, Maxim and Qualcomm. - Support for ASoC Allwinner A523, Mediatek MT8189, Qualcomm QCM2290, QRB2210 and SM6115, SpacemiT K1, and TI TAS2568, TAS5802, TAS5806, TAS5815, TAS5828 and TAS5830 - Usual HD-audio and USB-audio quirks and fixups - Support for Onkyo SE-300PCIE, TASCAM IF-FW/DM MkII Some gpiolib changes for shared GPIOs are included along with this PR for covering ASoC drivers changes" * tag 'sound-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (739 commits) ALSA: hda/realtek: Add PCI SSIDs to HP ProBook quirks ALSA: usb-audio: Simplify with usb_endpoint_max_periodic_payload() ALSA: hda/realtek: fix mute/micmute LEDs don't work for more HP laptops ALSA: rawmidi: Fix inconsistent indenting warning reported by smatch ALSA: dice: fix buffer overflow in detect_stream_formats() ASoC: codecs: Modify awinic amplifier dsp read and write functions ASoC: SDCA: Fixup some more Kconfig issues ASoC: cs35l56: Log a message if firmware is missing ASoC: nau8325: Delete a stray tab firmware: cs_dsp: Add test cases for client_ops == NULL firmware: cs_dsp: Don't require client to provide a struct cs_dsp_client_ops ASoC: fsl_micfil: Set channel range control ASoC: fsl_micfil: Add default quality for different platforms ASoC: intel: sof_sdw: Add codec_info for cs42l45 ASoC: sdw_utils: Add cs42l45 support functions ASoC: intel: sof_sdw: Add ability to have auxiliary devices ASoC: sdw_utils: Move codec_name to dai info ASoC: sdw_utils: Add codec_conf for every DAI ASoC: SDCA: Add terminal type into input/output widget name ASoC: SDCA: Align mute controls to ALSA expectations ... commit 860daa4b0d09a398a0ac9ae6fe67efd73a275968 Author: Uma Shankar Date: Wed Dec 3 14:22:11 2025 +0530 drm/i915/color: Enable Plane Color Pipelines Expose color pipeline and add ability to program it. v2: Set bit to enable multisegmented lut v3: s/drm_color_lut_32/drm_color_lut32 (Simon) v4: - Fix dsb programming - Remove multi-segment LUT, they will be added in later patches - Add pipeline only to TGL+ - Code Refactor Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Signed-off-by: Jani Nikula Link: https://patch.msgid.link/20251203085211.3663374-16-uma.shankar@intel.com commit 65db7a1f9cf772d733358de032fee60ad770c1e8 Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:22:10 2025 +0530 drm/i915/color: Add 3D LUT to color pipeline Add helpers to program the 3D LUT registers and arm them. LUT_3D_READY in LUT_3D_CLT is cleared off by the HW once the LUT buffer is loaded into it's internal working RAM. So by the time we try to load/commit new values, we expect it to be cleared off. If not, log an error and return without writing new values. Do it only when writing with MMIO. There is no way to read register within DSB execution. v2: - Add information regarding LUT_3D_READY to commit message (Jani) - Log error instead of a drm_warn and return without committing changes if 3DLUT HW is not ready to accept new values. - Refactor intel_color_crtc_has_3dlut() Also remove Gen10 check (Suraj) v3: - Addressed review comments (Suraj) Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-15-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 55b0f3cd09a1d8e29f4a33d229ef82d69b25d917 Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:22:09 2025 +0530 drm/i915/color: Add registers for 3D LUT Add registers needed to program 3D LUT v2: - Follow convention documented in i915_reg.h (Jani) - Removing space in trailer (Suraj) - Move registers to intel_color_regs.h BSpec: 69378, 69379, 69380 Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-14-uma.shankar@intel.com Signed-off-by: Jani Nikula commit bf0fd7375466b7fd58b9b98193cc19b90c856faa Author: Uma Shankar Date: Wed Dec 3 14:22:08 2025 +0530 drm/i915/color: Program Plane Post CSC Registers Extract the LUT and program plane post csc registers. v2: Add DSB support v3: Add support for single segment 1D LUT v4: - s/drm_color_lut_32/drm_color_lut32 (Simon) - Move declaration to beginning of the function (Suraj) - Remove multisegmented code, add it later - Remove dead code for SDR planes, add it later v5: - Fix iterator issues v6: Removed redundant variable (Suraj) Reviewed-by: Suraj Kandpal Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251203085211.3663374-13-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 82caa1c8813fb333303f21dd553c85d36ffb01fe Author: Uma Shankar Date: Wed Dec 3 14:22:07 2025 +0530 drm/i915/color: Program Pre-CSC registers Add callback to program Pre-CSC LUT for TGL and beyond v2: Add DSB support v3: Add support for single segment 1D LUT color op v4: - s/drm_color_lut_32/drm_color_lut32/ (Simon) - Change commit message (Suraj) - Improve comments (Suraj) - Remove multisegmented programming, to be added later - Remove dead code for SDR planes, add when needed BSpec: 50411, 50412, 50413, 50414 Reviewed-by: Suraj Kandpal Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251203085211.3663374-12-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 3b7476e786c2250177c5db0b6b9f1348813b9ce0 Author: Uma Shankar Date: Wed Dec 3 14:22:06 2025 +0530 drm/i915/color: Add framework to program PRE/POST CSC LUT Add framework that will help in loading LUT to Pre/Post CSC color blocks. v2: Add dsb support v3: Align enum names v4: Propagate change in lut data to crtc_state Reviewed-by: Suraj Kandpal Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251203085211.3663374-11-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 05df71544c44a1767be021285648c090123a92ff Author: Uma Shankar Date: Wed Dec 3 14:22:05 2025 +0530 drm/i915: Add register definitions for Plane Post CSC Add macros to define Plane Post CSC registers v2: - Add Plane Post CSC Gamma Multi Segment Enable bit - Add BSpec entries (Suraj) v3: - Fix checkpatch issues (Suraj) BSpec: 50403, 50404, 50405, 50406, 50409, 50410, Reviewed-by: Suraj Kandpal Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251203085211.3663374-10-uma.shankar@intel.com Signed-off-by: Jani Nikula commit ed0ebbc89f847eebce790a6a308c8c3c1251655a Author: Uma Shankar Date: Wed Dec 3 14:22:04 2025 +0530 drm/i915: Add register definitions for Plane Degamma Add macros to define Plane Degamma registers v2: - Add BSpec links (Suraj) v3: - Add Bspec links in trailer (Suraj) - Fix checkpatch issues (Suraj) BSpec: 50411, 50412, 50413, 50414 Reviewed-by: Suraj Kandpal Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251203085211.3663374-9-uma.shankar@intel.com Signed-off-by: Jani Nikula commit f00d02707dc2265c120756f074f27fd3c158ec9c Author: Uma Shankar Date: Wed Dec 3 14:22:03 2025 +0530 drm/i915/color: Add plane CTM callback for D12 and beyond Add callback for setting CTM block in platforms D12 and beyond v2: - Add dsb support - Pass plane_state as we are now doing a uapi to hw state copy - Add support for 3x4 matrix v3: - Add relevant header file - Fix typo (Suraj) - Add callback to TGL+ (Suraj) Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-8-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 6f1e094fb6e98b99bda21133fea55970d82c2045 Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:22:02 2025 +0530 drm/i915/color: Preserve sign bit when int_bits is Zero When int_bits == 0, we lose the sign bit when we do the range check and apply the mask. Fix this by ensuring a minimum of one integer bit, which guarantees space for the sign bit in fully fractional representations (e.g. S0.12) Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-7-uma.shankar@intel.com Signed-off-by: Jani Nikula commit a78f1b6baf4dc240b67155209c81ef0503accf3b Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:22:01 2025 +0530 drm/i915/color: Add framework to program CSC Add framework to program CSC. It enables copying of matrix from UAPI to intel plane state. Also add helper functions which will eventually program values to hardware. Add a crtc state variable to track plane color change. v2: - Add crtc_state->plane_color_changed - Improve comments (Suraj) - s/intel_plane_*_color/intel_plane_color_* (Suraj) v3: - align parameters with open braces (Suraj) - Improve commit message (Suraj) v4: - Re-arrange variable declaration (Suraj) Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-6-uma.shankar@intel.com Signed-off-by: Jani Nikula commit ef105316819d448630b83044fa83ba12905d9086 Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:22:00 2025 +0530 drm/i915/color: Create a transfer function color pipeline Add a color pipeline with three colorops in the sequence 1D LUT - 3x4 CTM - 1D LUT This pipeline can be used to do any color space conversion or HDR tone mapping v2: Change namespace to drm_plane_colorop* v3: Use simpler/pre-existing colorops for first iteration v4: - s/*_tf_*/*_color_* (Jani) - Refactor to separate files (Jani) - Add missing space in comment (Suraj) - Consolidate patch that adds/attaches pipeline property v5: - Limit MAX_COLOR_PIPELINES to 2.(Suraj) Increase it as and when we add more pipelines. - Remove redundant initialization code (Suraj) v6: - Use drm_plane_create_color_pipeline_property() (Arun) Now MAX_COLOR_PIPELINES is 1 Reviewed-by: Suraj Kandpal Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251203085211.3663374-5-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 730df5065ee9d64f972159995832ab1a5626bd4e Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:21:59 2025 +0530 drm/i915/color: Add helper to create intel colorop Add intel colorop create helper v2: - Make function names consistent (Jani) - Remove redundant code related to colorop state - Refactor code to separate files Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-4-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 3e9b06559aa1c3daa21ff34a25b103f3fa7f0c7a Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:21:58 2025 +0530 drm/i915: Add intel_color_op Add data structure to store intel specific details of colorop v2: - Remove dead code - Convert macro to function (Jani) - Remove colorop state as it is not being used - Refactor to separate file Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-3-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 4cd8a64b15c1c61fbe164deacd7829899a7c5030 Author: Chaitanya Kumar Borah Date: Wed Dec 3 14:21:57 2025 +0530 drm/i915/display: Add identifiers for driver specific blocks Add macros to identify intel specific color blocks. It will help in mapping drm_color_ops to intel color HW blocks v2:- Prefix enums with INTEL_* (Jani, Suraj) - Remove unnecessary comments (Jani) - Commit message improvements (Suraj) Reviewed-by: Suraj Kandpal Signed-off-by: Chaitanya Kumar Borah Signed-off-by: Uma Shankar Link: https://patch.msgid.link/20251203085211.3663374-2-uma.shankar@intel.com Signed-off-by: Jani Nikula commit 83c8f7b5e194eaf3fb268c513e23e23e892de8ed Author: Joshua Hahn Date: Mon Dec 1 10:07:38 2025 -0800 mm/mm_init: Introduce a boot parameter for check_pages Use-after-free and double-free bugs can be very difficult to track down. The kernel is good at tracking these and preventing bad pages from being used/created through simple checks gated behind "check_pages_enabled". Currently, the only ways to enable this flag is by building with CONFIG_DEBUG_VM, or as a side effect of other checks such as init_on_{alloc, free}, page_poisoning, or debug_pagealloc among others. These solutions are powerful, but may often be too coarse in balancing the performance vs. safety that a user may want, particularly in latency-sensitive production environments. Introduce a new boot parameter "check_pages", which enables page checking with no other side effects. It takes kstrbool-able inputs as an argument (i.e. 0/1, true/false, on/off, ...). This patch is backwards-compatible; setting CONFIG_DEBUG_VM still enables page checking. Acked-by: SeongJae Park Acked-by: Michal Hocko Acked-by: Vlastimil Babka Reviewed-by: Anshuman Khandual Signed-off-by: Joshua Hahn Link: https://patch.msgid.link/20251201180739.2330474-1-joshua.hahnjy@gmail.com Signed-off-by: Mike Rapoport (Microsoft) commit 1a7a7b80a22448dff55e1ad69a4681fd8b760b85 Author: Arnd Bergmann Date: Thu Dec 4 10:45:45 2025 +0100 drm/panel: novatek-nt35560: avoid on-stack device structure A cleanup patch apparently by accident used a local device structure instead of a pointer to one in the nt35560_read_id() function, causing a warning about stack usage: drivers/gpu/drm/panel/panel-novatek-nt35560.c: In function 'nt35560_read_id': drivers/gpu/drm/panel/panel-novatek-nt35560.c:249:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Change this to a pointer as was liley intended here. Fixes: 5fbc0dbb92d6 ("drm/panel: novatek-nt35560: Clean up driver") Signed-off-by: Arnd Bergmann Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251204094550.1030506-1-arnd@kernel.org commit 6dfafbd0299a60bfb5d5e277fdf100037c7ded07 Merge: 94e244d9ccab57 0692602defb0c2 Author: Linus Torvalds Date: Thu Dec 4 08:53:30 2025 -0800 Merge tag 'drm-next-2025-12-03' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "There was a rather late merge of a new color pipeline feature, that some userspace projects are blocked on, and has seen a lot of work in amdgpu. This should have seen some time in -next. There is additional support for this for Intel, that if it arrives in the next day or two I'll pass it on in another pull request and you can decide if you want to take it. Highlights: - Arm Ethos NPU accelerator driver - new DRM color pipeline support - amdgpu will now run discrete SI/CIK cards instead of radeon, which enables vulkan support in userspace - msm gets gen8 gpu support - initial Xe3P support in xe Full detail summary: New driver: - Arm Ethos-U65/U85 accel driver Core: - support the drm color pipeline in vkms/amdgfx - add support for drm colorop pipeline - add COLOR PIPELINE plane property - add DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE - throttle dirty worker with vblank - use drm_for_each_bridge_in_chain_scoped in drm's bridge code - Ensure drm_client_modeset tests are enabled in UML - add simulated vblank interrupt - use in drivers - dumb buffer sizing helper - move freeing of drm client memory to driver - crtc sharpness strength property - stop using system_wq in scheduler/drivers - support emergency restore in drm-client Rust: - make slice::as_flattened usable on all supported rustc - add FromBytes::from_bytes_prefix() method - remove redundant device ptr from Rust GEM object - Change how AlwaysRefCounted is implemented for GEM objects gpuvm: - Add deferred vm_bo cleanup to GPUVM (for rust) atomic: - cleanup and improve state handling interfaces buddy: - optimize block management dma-buf: - heaps: Create heap per CMA reserved location - improve userspace documentation dp: - add POST_LT_ADJ_REQ training sequence - DPCD dSC quirk for synaptics panamera devices - helpers to query branch DSC max throughput ttm: - Rename ttm_bo_put to ttm_bo_fini - allow page protection flags on risc-v - rework pipelined eviction fence handling amdgpu: - enable amdgpu by default for SI/CI dGPUs - enable DC by default on SI - refactor CIK/SI enablement - add ABM KMS property - Re-enable DM idle optimizations - DC Analog encoders support - Powerplay fixes for fiji/iceland - Enable DC on bonaire by default - HMM cleanup - Add new RAS framework - DML2.1 updates - YCbCr420 fixes - DC FP fixes - DMUB fixes - LTTPR fixes - DTBCLK fixes - DMU cursor offload handling - Userq validation improvements - Unify shutdown callback handling - Suspend improvements - Power limit code cleanup - SR-IOV fixes - AUX backlight fixes - DCN 3.5 fixes - HDMI compliance fixes - DCN 4.0.1 cursor updates - DCN interrupt fix - DC KMS full update improvements - Add additional HDCP traces - DCN 3.2 fixes - DP MST fixes - Add support for new SR-IOV mailbox interface - UQ reset support - HDP flush rework - VCE1 support amdkfd: - HMM cleanups - Relax checks on save area overallocations - Fix GPU mappings after prefetch radeon: - refactor CIK/SI enablement xe: - Initial Xe3P support - panic support on VRAM for display - fix stolen size check - Loosen used tracking restriction - New SR-IOV debugfs structure and debugfs updates - Hide the GPU madvise flag behind a VM_BIND flag - Always expose VRAM provisioning data on discrete GPUs - Allow VRAM mappings for userptr when used with SVM - Allow pinning of p2p dma-buf - Use per-tile debugfs where appropriate - Add documentation for Execution Queues - PF improvements - VF migration recovery redesign work - User / Kernel VRAM partitioning - Update Tile-based messages - Allow configfs to disable specific GT types - VF provisioning and migration improvements - use SVM range helpers in PT layer - Initial CRI support - access VF registers using dedicated MMIO view - limit number of jobs per exec queue - add sriov_admin sysfs tree - more crescent island specific support - debugfs residency counter - SRIOV migration work - runtime registers for GFX 35 i915: - add initial Xe3p_LPD display version 35 support - Enable LNL+ content adaptive sharpness filter - Use optimized VRR guardband - Enable Xe3p LT PHY - enable FBC support for Xe3p_LPD display - add display 30.02 firmware support - refactor SKL+ watermark latency setup - refactor fbdev handling - call i915/xe runtime PM via function pointers - refactor i915/xe stolen memory/display interfaces - use display version instead of gfx version in display code - extend i915_display_info with Type-C port details - lots of display cleanups/refactorings - set O_LARGEFILE in __create_shmem - skuip guc communication warning on reset - fix time conversions - defeature DRRS on LNL+ - refactor intel_frontbuffer split between i915/xe/display - convert inteL_rom interfaces to struct drm_device - unify display register polling interfaces - aovid lock inversion when pinning to GGTT on CHV/BXT+VTD panel: - Add KD116N3730A08/A12, chromebook mt8189 - JT101TM023, LQ079L1SX01, - GLD070WX3-SL01 MIPI DSI - Samsung LTL106AL0, Samsung LTL106AL01 - Raystar RFF500F-AWH-DNN - Winstar WF70A8SYJHLNGA - Wanchanglong w552946aaa - Samsung SOFEF00 - Lenovo X13s panel - ilitek-ili9881c - add rpi 5" support - visionx-rm69299 - add backlight support - edp - support AUI B116XAN02.0 bridge: - improve ref counting - ti-sn65dsi86 - add support for DP mode with HPD - synopsis: support CEC, init timer with correct freq - ASL CS5263 DP-to-HDMI bridge support nova-core: - introduce bitfield! macro - introduce safe integer converters - GSP inits to fully booted state on Ampere - Use more future-proof register for GPU identification nova-drm: - select NOVA_CORE - 64-bit only nouveau: - improve reclocking on tegra 186+ - add large page and compression support msm: - GPU: - Gen8 support: A840 (Kaanapali) and X2-85 (Glymur) - A612 support - MDSS: - Added support for Glymur and QCS8300 platforms - DPU: - Enabled Quad-Pipe support, unlocking higher resolutions support - Added support for Glymur platform - Documented DPU on QCS8300 platform as supported - DisplayPort: - Added support for Glymur platform - Added support lame remapping inside DP block - Documented DisplayPort controller on QCS8300 and SM6150/QCS615 as supported tegra: - NVJPG driver panfrost: - display JM contexts over debugfs - export JM contexts to userspace - improve error and job handling panthor: - support custom ASN_HASH for mt8196 - support mali-G1 GPU - flush shmem write before mapping buffers uncached - make timeout per-queue instead of per-job mediatek: - MT8195/88 HDMIv2/DDCv2 support rockchip: - dsi: add support for RK3368 amdxdna: - enhance runtime PM - last hardware error reading uapi - support firmware debug output - add resource and telemetry data uapi - preemption support imx: - add driver for HDMI TX Parallel audio interface ivpu: - add support for user-managed preemption buffer - add userptr support - update JSM firware API to 3.33.0 - add better alloc/free warnings - fix page fault in unbind all bos - rework bind/unbind of imported buffers - enable MCA ECC signalling - split fw runtime and global memory buffers - add fdinfo memory statistics tidss: - convert to drm logging - logging cleanup ast: - refactor generation init paths - add per chip generation detect_tx_chip - set quirks for each chip model atmel-hlcdc: - set LCDC_ATTRE register in plane disable - set correct values for plane scaler solomon: - use drm helper for get_modes and move_valid sitronix: - fix output position when clearing screens qaic: - support dma-buf exports - support new firmware's READ_DATA implementation - sahara AIC200 image table update - add sysfs support - add coredump support - add uevents support - PM support sun4i: - layer refactors to decouple plane from output - improve DE33 support vc4: - switch to generic CEC helpers komeda: - use drm_ logging functions vkms: - configfs support for display configuration vgem: - fix fence timer deadlock etnaviv: - add HWDB entry for GC8000 Nano Ultra VIP r6205" * tag 'drm-next-2025-12-03' of https://gitlab.freedesktop.org/drm/kernel: (1869 commits) Revert "drm/amd: Skip power ungate during suspend for VPE" drm/amdgpu: use common defines for HUB faults drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling drm/amdgpu: use static ids for ACP platform devs drm/amdgpu/sdma6: Update SDMA 6.0.3 FW version to include UMQ protected-fence fix drm/amdgpu: Forward VMID reservation errors drm/amdgpu/gmc8: Delegate VM faults to soft IRQ handler ring drm/amdgpu/gmc7: Delegate VM faults to soft IRQ handler ring drm/amdgpu/gmc6: Delegate VM faults to soft IRQ handler ring drm/amdgpu/gmc6: Cache VM fault info drm/amdgpu/gmc6: Don't print MC client as it's unknown drm/amdgpu/cz_ih: Enable soft IRQ handler ring drm/amdgpu/tonga_ih: Enable soft IRQ handler ring drm/amdgpu/iceland_ih: Enable soft IRQ handler ring drm/amdgpu/cik_ih: Enable soft IRQ handler ring drm/amdgpu/si_ih: Enable soft IRQ handler ring drm/amd/display: fix typo in display_mode_core_structs.h drm/amd/display: fix Smart Power OLED not working after S4 drm/amd/display: Move RGB-type check for audio sync to DCE HW sequence ... commit 94e244d9ccab578f83a218ec58376d025014fcce Merge: d7aa60d966461c 00de283c53c996 Author: Linus Torvalds Date: Thu Dec 4 08:29:28 2025 -0800 Merge tag 'auxdisplay-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay Pull auxdisplay updates from Andy Shevchenko: - Support linedisp attribute attachment to auxdisplay parent devices * tag 'auxdisplay-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay: auxdisplay: linedisp: support attribute attachment to auxdisplay devices auxdisplay: linedisp: add num_chars sysfs attribute auxdisplay: linedisp: display static message when length <= display size auxdisplay: linedisp: encapsulate container_of usage within to_linedisp docs: ABI: auxdisplay: document linedisp library sysfs attributes commit d7aa60d966461ca6114dc348e97889dc8850ff7f Merge: 559e608c46553c 1f2353f5a1af99 Author: Linus Torvalds Date: Thu Dec 4 08:15:19 2025 -0800 Merge tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - New drivers: - Mali-C55 ISP - Rockchip VICAP (RKCIF) - RKVDEC HEVC Decoder - Renesas RZV2H IVC - Sony IMX111 CMOS sensor driver - Removed STi C8SECTPFE Driver - Added a V4L2 ISP generic framework - Usual set of cleanup, fixes and driver improvements * tag 'media/v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (249 commits) media: rockchip: rkcif: add support for rk3568 vicap mipi capture media: rockchip: rkcif: add support for rk3568 vicap dvp capture media: rockchip: rkcif: add support for px30 vip dvp capture media: rockchip: rkcif: add abstraction for dma blocks media: rockchip: rkcif: add abstraction for interface and crop blocks media: rockchip: add driver for the rockchip camera interface media: dt-bindings: add rockchip rk3568 vicap media: dt-bindings: add rockchip px30 vip media: dt-bindings: video-interfaces: add defines for sampling modes Documentation: admin-guide: media: add rockchip camera interface media: mali-c55: Mark pm handlers as __maybe_unused media: mali-c55: Assert ISP blocks size correctness media: v4l2-isp: Rename block_info to block_type_info MAINTAINERS: Add entry for rzv2h-ivc driver media: platform: Add Renesas Input Video Control block driver dt-bindings: media: Add bindings for the RZ/V2H(P) IVC block Documentation: media: mali-c55: Document the mali-c55 parameter setting media: platform: Add mali-c55 parameters video node media: uapi: Add parameters structs to mali-c55-config.h media: mali-c55: Add image formats for Mali-C55 parameters buffer ... commit 4df66a74d2a54e265c0b0dda81b7a00e4d5140f1 Merge: ccb61a328321ba ad374eb9b33fc4 Author: Ilpo Järvinen Date: Thu Dec 4 17:56:11 2025 +0200 Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into for-next commit e45b5df47b07e6ce1138b0a4e70ad0b0c4d72881 Author: Arnd Bergmann Date: Thu Dec 4 10:41:36 2025 +0100 drm/xe/pf: fix VFIO link error The Makefile logic for building xe_sriov_vfio.o was added incorrectly, as setting CONFIG_XE_VFIO_PCI=m means it doesn't get included into a built-in xe driver: ERROR: modpost: "xe_sriov_vfio_stop_copy_enter" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_stop_copy_exit" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_suspend_device" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_wait_flr_done" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_error" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_resume_data_enter" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_resume_device" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_resume_data_exit" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_data_write" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! ERROR: modpost: "xe_sriov_vfio_migration_supported" [drivers/vfio/pci/xe/xe-vfio-pci.ko] undefined! WARNING: modpost: suppressed 3 unresolved symbol warnings because there were too many) Check for CONFIG_XE_VFIO_PCI being enabled in the Makefile to decide whether to include the object instead. Fixes: bd45d46ffc8f ("drm/xe/pf: Export helpers for VFIO") Signed-off-by: Arnd Bergmann Reviewed-by: Michal Wajdeczko Signed-off-by: Thomas Hellström Link: https://patch.msgid.link/20251204094154.1029357-1-arnd@kernel.org (cherry picked from commit ef7de33544a7a6783d7afe09496da362d1e90ba1) Signed-off-by: Thomas Hellström commit f402ecd7a8b6446547076f4bd24bd5d4dcc94481 Author: Sean Christopherson Date: Thu Nov 13 14:56:14 2025 -0800 KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) Set exit_code_hi to -1u as a temporary band-aid to fix a long-standing (effectively since KVM's inception) bug where KVM treats the exit code as a 32-bit value, when in reality it's a 64-bit value. Per the APM, offset 0x70 is a single 64-bit value: 070h 63:0 EXITCODE And a sane reading of the error values defined in "Table C-1. SVM Intercept Codes" is that negative values use the full 64 bits: –1 VMEXIT_INVALID Invalid guest state in VMCB. –2 VMEXIT_BUSYBUSY bit was set in the VMSA –3 VMEXIT_IDLE_REQUIREDThe sibling thread is not in an idle state -4 VMEXIT_INVALID_PMC Invalid PMC state And that interpretation is confirmed by testing on Milan and Turin (by setting bits in CR0[63:32] to generate VMEXIT_INVALID on VMRUN). Furthermore, Xen has treated exitcode as a 64-bit value since HVM support was adding in 2006 (see Xen commit d1bd157fbc ("Big merge the HVM full-virtualisation abstractions.")). Cc: Jim Mattson Cc: Yosry Ahmed Cc: stable@vger.kernel.org Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20251113225621.1688428-3-seanjc@google.com Signed-off-by: Sean Christopherson commit da01f64e7470988f8607776aa7afa924208863fb Author: Sean Christopherson Date: Thu Nov 13 14:56:13 2025 -0800 KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits Explicitly clear exit_code_hi in the VMCB when synthesizing "normal" nested VM-Exits, as the full exit code is a 64-bit value (spoiler alert), and all exit codes for non-failing VMRUN use only bits 31:0. Cc: Jim Mattson Cc: Yosry Ahmed Cc: stable@vger.kernel.org Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20251113225621.1688428-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 6a107cfe9c99a079e578a4c5eb70038101a3599f Author: Gerd Bayer Date: Tue Dec 2 12:12:57 2025 +0100 net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through mlx5_unload_one() might try to unregister it again and trip over use-after-free. On s390 almost all PCI level recovery events trigger two passes through mxl5_unload_one() - one through the poll_health() method and one through mlx5_pci_err_detected() as callback from generic PCI error recovery. While testing PCI error recovery paths with more kernel debug features enabled, this issue reproducibly led to kernel panics with the following call chain: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI Fault in home space mode while using kernel ASCE. AS:00000000705c4007 R3:0000000000000024 Oops: 0038 ilc:3 [#1]SMP CPU: 14 UID: 0 PID: 156 Comm: kmcheck Kdump: loaded Not tainted 6.18.0-20251130.rc7.git0.16131a59cab1.300.fc43.s390x+debug #1 PREEMPT Krnl PSW : 0404e00180000000 0000020fc86aa1dc (__lock_acquire+0x5c/0x15f0) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 0000020f00000001 6b6b6b6b6b6b6c33 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000020fca28b820 0000000000000000 0000010a1ced8100 0000010a1ced8100 0000020fc9775068 0000018fce14f8b8 0000018fce14f7f8 Krnl Code: 0000020fc86aa1cc: e3b003400004 lg %r11,832 0000020fc86aa1d2: a7840211 brc 8,0000020fc86aa5f4 *0000020fc86aa1d6: c09000df0b25 larl %r9,0000020fca28b820 >0000020fc86aa1dc: d50790002000 clc 0(8,%r9),0(%r2) 0000020fc86aa1e2: a7840209 brc 8,0000020fc86aa5f4 0000020fc86aa1e6: c0e001100401 larl %r14,0000020fca8aa9e8 0000020fc86aa1ec: c01000e25a00 larl %r1,0000020fca2f55ec 0000020fc86aa1f2: a7eb00e8 aghi %r14,232 Call Trace: __lock_acquire+0x5c/0x15f0 lock_acquire.part.0+0xf8/0x270 lock_acquire+0xb0/0x1b0 down_write+0x5a/0x250 mlx5_detach_device+0x42/0x110 [mlx5_core] mlx5_unload_one_devl_locked+0x50/0xc0 [mlx5_core] mlx5_unload_one+0x42/0x60 [mlx5_core] mlx5_pci_err_detected+0x94/0x150 [mlx5_core] zpci_event_attempt_error_recovery+0xcc/0x388 Fixes: 5a977b5833b7 ("net/mlx5: Lag, move devcom registration to LAG layer") Signed-off-by: Gerd Bayer Reviewed-by: Moshe Shemesh Acked-by: Tariq Toukan Link: https://patch.msgid.link/20251202-fix_lag-v1-1-59e8177ffce0@linux.ibm.com Signed-off-by: Paolo Abeni commit c196bf43d706592d8801a7513603765080e495fb Author: Cong Zhang Date: Wed Dec 3 11:34:21 2025 +0800 blk-mq: Abort suspend when wakeup events are pending During system suspend, wakeup capable IRQs for block device can be delayed, which can cause blk_mq_hctx_notify_offline() to hang indefinitely while waiting for pending request to complete. Skip the request waiting loop and abort suspend when wakeup events are pending to prevent the deadlock. Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline") Signed-off-by: Cong Zhang Signed-off-by: Jens Axboe commit 71075d25ca5cae732fb57da065fbf14aeb3bcfc7 Author: Chaitanya Kulkarni Date: Tue Dec 2 19:58:09 2025 -0800 blk-mq: add blk_rq_nr_bvec() helper Add a new helper function blk_rq_nr_bvec() that returns the number of bvecs in a request. This count represents the number of iterations rq_for_each_bvec() would perform on a request. Drivers need to pre-allocate bvec arrays before iterating through a request's bvecs. Currently, they manually count bvecs using rq_for_each_bvec() in a loop, which is repetitive. The new helper centralizes this logic. This pattern exists in loop and zloop drivers, where multi-bio requests require copying bvecs into a contiguous array before creating an iov_iter for file operations. Update loop and zloop drivers to use the new helper, eliminating duplicate code. This patch also provides a clear API to avoid any potential misuse of blk_nr_phys_segments() for calculating the bvecs since, one bvec can have more than one segments and use of blk_nr_phys_segments() can lead to extra memory allocation :- [ 6155.673749] nullb_bio: 128K bio as ONE bvec: sector=0, size=131072 [ 6155.673846] null_blk: #### null_handle_data_transfer:1375 [ 6155.673850] null_blk: nr_bvec=1 blk_rq_nr_phys_segments=2 [ 6155.674263] null_blk: #### null_handle_data_transfer:1375 [ 6155.674267] null_blk: nr_bvec=1 blk_rq_nr_phys_segments=1 Reviewed-by: Niklas Cassel Signed-off-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 3e2cb9ee76c27f57bfdb7b4753b909594d4fa31a Author: Stefan Hajnoczi Date: Mon Dec 1 16:43:29 2025 -0500 block: add IOC_PR_READ_RESERVATION ioctl Add a Persistent Reservations ioctl to read the current reservation. This calls the pr_ops->read_reservation() function that was previously added in commit c787f1baa503 ("block: Add PR callouts for read keys and reservation") but was only used by the in-kernel SCSI target so far. The IOC_PR_READ_RESERVATION ioctl is necessary so that userspace applications that rely on Persistent Reservations ioctls have a way of inspecting the current state. Cluster managers and validation tests need this functionality. Signed-off-by: Stefan Hajnoczi Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 22a1ffea5f805dfa21b64d1c7b5fe39c0c78c997 Author: Stefan Hajnoczi Date: Mon Dec 1 16:43:28 2025 -0500 block: add IOC_PR_READ_KEYS ioctl Add a Persistent Reservations ioctl to read the list of currently registered reservation keys. This calls the pr_ops->read_keys() function that was previously added in commit c787f1baa503 ("block: Add PR callouts for read keys and reservation") but was only used by the in-kernel SCSI target so far. The IOC_PR_READ_KEYS ioctl is necessary so that userspace applications that rely on Persistent Reservations ioctls have a way of inspecting the current state. Cluster managers and validation tests need this functionality. Signed-off-by: Stefan Hajnoczi Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 38ec8469f39e0e96e7dd9b76f05e0f8eb78be681 Author: Stefan Hajnoczi Date: Mon Dec 1 16:43:27 2025 -0500 nvme: reject invalid pr_read_keys() num_keys values The pr_read_keys() interface has a u32 num_keys parameter. The NVMe Reservation Report command has a u32 maximum length. Reject num_keys values that are too large to fit. This will become important when pr_read_keys() is exposed to untrusted userspace via an ioctl. Signed-off-by: Stefan Hajnoczi Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit ab4fb1d8f6e98575703474491538febff6b1a2c9 Author: Stefan Hajnoczi Date: Mon Dec 1 16:43:26 2025 -0500 scsi: sd: reject invalid pr_read_keys() num_keys values The pr_read_keys() interface has a u32 num_keys parameter. The SCSI PERSISTENT RESERVE IN command has a maximum READ KEYS service action size of 65536 bytes. Reject num_keys values that are too large to fit into the SCSI command. This will become important when pr_read_keys() is exposed to untrusted userspace via an ioctl. Signed-off-by: Stefan Hajnoczi Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 48f22f80938d94c34319f90674de6102ca37eabc Author: Fengnan Chang Date: Fri Nov 14 17:21:49 2025 +0800 block: enable per-cpu bio cache by default Since after commit 12e4e8c7ab59 ("io_uring/rw: enable bio caches for IRQ rw"), bio_put is safe for task and irq context, bio_alloc_bioset is safe for task context and no one calls in irq context, so we can enable per cpu bio cache by default. Benchmarked with t/io_uring and ext4+nvme: taskset -c 6 /root/fio/t/io_uring -p0 -d128 -b4096 -s1 -c1 -F1 -B1 -R1 -X1 -n1 -P1 /mnt/testfile base IOPS is 562K, patch IOPS is 574K. The CPU usage of bio_alloc_bioset decrease from 1.42% to 1.22%. The worst case is allocate bio in CPU A but free in CPU B, still use t/io_uring and ext4+nvme: base IOPS is 648K, patch IOPS is 647K. Also use fio test ext4/xfs with libaio/sync/io_uring on null_blk and nvme, no obvious performance regression. Signed-off-by: Fengnan Chang Signed-off-by: Jens Axboe commit 05ce4c584cc6b783f3f113e9daa5a19f9bcd6e27 Author: Fengnan Chang Date: Fri Nov 14 17:21:48 2025 +0800 block: use bio_alloc_bioset for passthru IO by default Use bio_alloc_bioset for passthru IO by default, so that we can enable bio cache for irq and polled passthru IO in later. Signed-off-by: Fengnan Chang Signed-off-by: Jens Axboe commit f345be751b961ce91e0b883345eaa1d0993a4949 Author: Caleb Sander Mateos Date: Tue Dec 2 11:21:31 2025 -0700 io_uring/trace: rename io_uring_queue_async_work event "rw" field The io_uring_queue_async_work tracepoint event stores an int rw field that represents whether the work item is hashed. Rename it to "hashed" and change its type to bool to more accurately reflect its value. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 34c78b8610a9befdcc139d34a7c98365f018026d Author: Caleb Sander Mateos Date: Tue Dec 2 13:57:44 2025 -0700 io_uring/io-wq: always retry worker create on ERESTART* If a task has a pending signal when create_io_thread() is called, copy_process() will return -ERESTARTNOINTR. io_should_retry_thread() will request a retry of create_io_thread() up to WORKER_INIT_LIMIT = 3 times. If all retries fail, the io_uring request will fail with ECANCELED. Commit 3918315c5dc ("io-wq: backoff when retrying worker creation") added a linear backoff to allow the thread to handle its signal before the retry. However, a thread receiving frequent signals may get unlucky and have a signal pending at every retry. Since the userspace task doesn't control when it receives signals, there's no easy way for it to prevent the create_io_thread() failure due to pending signals. The task may also lack the information necessary to regenerate the canceled SQE. So always retry the create_io_thread() on the ERESTART* errors, analogous to what a fork() syscall would do. EAGAIN can occur due to various persistent conditions such as exceeding RLIMIT_NPROC, so respect the WORKER_INIT_LIMIT retry limit for EAGAIN errors. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 84230ad2d2afbf0c44c32967e525c0ad92e26b4e Author: Jens Axboe Date: Mon Dec 1 13:25:22 2025 -0700 io_uring/poll: correctly handle io_poll_add() return value on update When the core of io_uring was updated to handle completions consistently and with fixed return codes, the POLL_REMOVE opcode with updates got slightly broken. If a POLL_ADD is pending and then POLL_REMOVE is used to update the events of that request, if that update causes the POLL_ADD to now trigger, then that completion is lost and a CQE is never posted. Additionally, ensure that if an update does cause an existing POLL_ADD to complete, that the completion value isn't always overwritten with -ECANCELED. For that case, whatever io_poll_add() set the value to should just be retained. Cc: stable@vger.kernel.org Fixes: 97b388d70b53 ("io_uring: handle completions in the core") Reported-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com Tested-by: syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 8fb817335ad8d960ea05af3882cea113e59cb4e1 Author: Eric Biggers Date: Wed Dec 3 21:29:54 2025 -0800 ASoC: cros_ec_codec: Remove unnecessary selection of CRYPTO The only crypto-related functionality this codec uses is the sha256() function, which is provided by CRYPTO_LIB_SHA256. Originally CRYPTO_LIB_SHA256 was visible only when CRYPTO; however, that was fixed years ago and the libraries can now be selected on their own. So, remove the unnecessary selection of CRYPTO. Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20251204052954.488568-1-ebiggers@kernel.org Signed-off-by: Mark Brown commit 308eeb8ca3fdee54bcd3ec7272c05688e178299a Author: Marek Vasut Date: Tue Dec 2 19:11:06 2025 +0100 drm/rcar-du: dsi: Handle both DRM_MODE_FLAG_N.SYNC and !DRM_MODE_FLAG_P.SYNC Since commit 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") the driver does not set TXVMVPRMSET0R_VSPOL_LOW and TXVMVPRMSET0R_HSPOL_LOW for modes which set neither DRM_MODE_FLAG_[PN].SYNC. The previous behavior was to assume that neither flag means DRM_MODE_FLAG_N.SYNC . Restore the previous behavior for maximum compatibility. The change of behavior is visible below, consider Vertical mode->flags for simplicity sake, although the same applies to Horizontal ones: Before 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") : - DRM_MODE_FLAG_PVSYNC => vprmset0r |= 0 - DRM_MODE_FLAG_NVSYNC => vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW - Neither DRM_MODE_FLAG_[PN]VSYNC => vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW After 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") : - DRM_MODE_FLAG_PVSYNC => vprmset0r |= 0 - DRM_MODE_FLAG_NVSYNC => vprmset0r |= TXVMVPRMSET0R_VSPOL_LOW - Neither DRM_MODE_FLAG_[PN]VSYNC => vprmset0r |= 0 <---------- This broke The "Neither" case behavior is different, because DRM_MODE_FLAG_N[HV]SYNC is really not equivalent !DRM_MODE_FLAG_P[HV]SYNC . Fixes: 94fe479fae96 ("drm/rcar-du: dsi: Clean up handling of DRM mode flags") Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20251202181146.138365-1-marek.vasut+renesas@mailbox.org Signed-off-by: Tomi Valkeinen commit 0c57ff008a11f24f7f05fa760222692a00465fec Author: Dmitry Skorodumov Date: Tue Dec 2 13:39:03 2025 +0300 ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() Packets with pkt_type == PACKET_LOOPBACK are captured by handle_frame() function, but they don't have L2 header. We should not process them in handle_mode_l2(). This doesn't affect old L2 functionality, since handling was anyway incorrect. Handle them the same way as in br_handle_frame(): just pass the skb. To observe invalid behaviour, just start "ping -b" on bcast address of port-interface. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: Dmitry Skorodumov Link: https://patch.msgid.link/20251202103906.4087675-1-skorodumov.dmitry@huawei.com Signed-off-by: Paolo Abeni commit 5b48f49ee94888f3cd4360286ee9921eff2b2e46 Author: Daniel Golle Date: Tue Dec 2 09:57:21 2025 +0000 net: dsa: mxl-gsw1xx: fix SerDes RX polarity According to MaxLinear engineer Benny Weng the RX lane of the SerDes port of the GSW1xx switches is inverted in hardware, and the SGMII_PHY_RX0_CFG2_INVERT bit is set by default in order to compensate for that. Hence also set the SGMII_PHY_RX0_CFG2_INVERT bit by default in gsw1xx_pcs_reset(). Fixes: 22335939ec90 ("net: dsa: add driver for MaxLinear GSW1xx switch family") Reported-by: Rasmus Villemoes Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/ca10e9f780c0152ecf9ae8cbac5bf975802e8f99.1764668951.git.daniel@makrotopia.org Signed-off-by: Paolo Abeni commit 434f8154bf475c7932e62f455551947b7473e91a Merge: 9b30ceba1c1d79 3ef4d9ede20db3 Author: Mark Brown Date: Thu Dec 4 11:38:34 2025 +0000 ASoC: codecs: wcd93xx: fix OF node leaks on probe Merge series from Johan Hovold : The original wcd938x driver has a couple of OF node reference leaks which have been reproduced in the two later added drivers. commit 9b30ceba1c1d7973f62a6d63b520f275e312e22a Merge: 39191ce5dbfd65 1f8f726a2a29c2 Author: Mark Brown Date: Thu Dec 4 11:38:30 2025 +0000 ASoC: ak4458 & ak5558: disable regulator if error Merge series from Shengjiu Wang : Disable regulator when error happens to balance the reference count. commit 4f0638b12451112de4138689fa679315c8d388dc Author: Ivan Galkin Date: Tue Dec 2 10:07:42 2025 +0100 net: phy: RTL8211FVD: Restore disabling of PHY-mode EEE When support for RTL8211F(D)(I)-VD-CG was introduced in commit bb726b753f75 ("net: phy: realtek: add support for RTL8211F(D)(I)-VD-CG") the implementation assumed that this PHY model doesn't have the control register PHYCR2 (Page 0xa43 Address 0x19). This assumption was based on the differences in CLKOUT configurations between RTL8211FVD and the remaining RTL8211F PHYs. In the latter commit 2c67301584f2 ("net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present") this assumption was expanded to the PHY-mode EEE. I performed tests on RTL8211FI-VD-CG and confirmed that disabling PHY-mode EEE works correctly and is uniform with other PHYs supported by the driver. To validate the correctness, I contacted Realtek support. Realtek confirmed that PHY-mode EEE on RTL8211F(D)(I)-VD-CG is configured via Page 0xa43 Address 0x19 bit 5. Moreover, Realtek informed me that the most recent datasheet for RTL8211F(D)(I)-VD-CG v1.1 is incomplete and the naming of control registers is partly inconsistent. The errata I received from Realtek corrects the naming as follows: | Register | Datasheet v1.1 | Errata | |-------------------------|----------------|--------| | Page 0xa44 Address 0x11 | PHYCR2 | PHYCR3 | | Page 0xa43 Address 0x19 | N/A | PHYCR2 | This information confirms that the supposedly missing control register, PHYCR2, exists in the RTL8211F(D)(I)-VD-CG under the same address and the same name. It controls widely the same configs as other PHYs from the RTL8211F series (e.g. PHY-mode EEE). Clock out configuration is an exception. Given all this information, restore disabling of the PHY-mode EEE. Fixes: 2c67301584f2 ("net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present") Signed-off-by: Ivan Galkin Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20251202-phy_eee-v1-1-fe0bf6ab3df0@axis.com Signed-off-by: Paolo Abeni commit eb1e937e0064bfabd25a6715d74b9df2e64835a0 Merge: ce052b9402e461 35e93736f69963 Author: Paolo Abeni Date: Thu Dec 4 11:55:21 2025 +0100 Merge branch 'mlx5-misc-fixes-2025-12-01' Tariq Toukan says: ==================== mlx5 misc fixes 2025-12-01 This small patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. ==================== Link: https://patch.msgid.link/1764602008-1334866-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 35e93736f69963337912594eb3951ab320b77521 Author: Cosmin Ratiu Date: Mon Dec 1 17:13:28 2025 +0200 net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in some conditions: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0 [...] mlx5e_psp_unregister+0x26/0x50 [mlx5_core] mlx5e_nic_cleanup+0x26/0x90 [mlx5_core] mlx5e_remove+0xe6/0x1f0 [mlx5_core] auxiliary_bus_remove+0x18/0x30 device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 mlx5_rescan_drivers_locked+0xbc/0x2a0 [mlx5_core] [...] Do not directly remove psp from the _mlx5e_remove path, the PSP cleanup happens as part of profile cleanup. Fixes: 89ee2d92f66c ("net/mlx5e: Support PSP offload functionality") Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1764602008-1334866-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit cd7671ef4cf2edf73cd2a3dca3a2f522a4525bf5 Author: Moshe Shemesh Date: Mon Dec 1 17:13:27 2025 +0200 net/mlx5: make enable_mpesw idempotent The enable_mpesw() function returns -EINVAL if ldev->mode is not MLX5_LAG_MODE_NONE. This means attempting to enable MPESW mode when it's already enabled will fail. In contrast, disable_mpesw() properly checks if the mode is MLX5_LAG_MODE_MPESW before proceeding, making it naturally idempotent and safe to call multiple times. Fix enable_mpesw() to return success if mpesw is already enabled. Fixes: a32327a3a02c ("net/mlx5: Lag, Control MultiPort E-Switch single FDB mode") Signed-off-by: Moshe Shemesh Reviewed-by: Shay Drori Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1764602008-1334866-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit ce052b9402e461a9aded599f5b47e76bc727f7de Author: Jamal Hadi Salim Date: Fri Nov 28 10:19:19 2025 -0500 net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue` and `ets_qdisc_change`. It leads to UAF on `struct Qdisc` object. Attacker requires the capability to create new user and network namespace in order to trigger the bug. See my additional commentary at the end of the analysis. Analysis: static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { ... // (1) this lock is preventing .change handler (`ets_qdisc_change`) //to race with .dequeue handler (`ets_qdisc_dequeue`) sch_tree_lock(sch); for (i = nbands; i < oldbands; i++) { if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) list_del_init(&q->classes[i].alist); qdisc_purge_queue(q->classes[i].qdisc); } WRITE_ONCE(q->nbands, nbands); for (i = nstrict; i < q->nstrict; i++) { if (q->classes[i].qdisc->q.qlen) { // (2) the class is added to the q->active list_add_tail(&q->classes[i].alist, &q->active); q->classes[i].deficit = quanta[i]; } } WRITE_ONCE(q->nstrict, nstrict); memcpy(q->prio2band, priomap, sizeof(priomap)); for (i = 0; i < q->nbands; i++) WRITE_ONCE(q->classes[i].quantum, quanta[i]); for (i = oldbands; i < q->nbands; i++) { q->classes[i].qdisc = queues[i]; if (q->classes[i].qdisc != &noop_qdisc) qdisc_hash_add(q->classes[i].qdisc, true); } // (3) the qdisc is unlocked, now dequeue can be called in parallel // to the rest of .change handler sch_tree_unlock(sch); ets_offload_change(sch); for (i = q->nbands; i < oldbands; i++) { // (4) we're reducing the refcount for our class's qdisc and // freeing it qdisc_put(q->classes[i].qdisc); // (5) If we call .dequeue between (4) and (5), we will have // a strong UAF and we can control RIP q->classes[i].qdisc = NULL; WRITE_ONCE(q->classes[i].quantum, 0); q->classes[i].deficit = 0; gnet_stats_basic_sync_init(&q->classes[i].bstats); memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats)); } return 0; } Comment: This happens because some of the classes have their qdiscs assigned to NULL, but remain in the active list. This commit fixes this issue by always removing the class from the active list before deleting and freeing its associated qdisc Reproducer Steps (trimmed version of what was sent by zdi-disclosures@trendmicro.com) ``` DEV="${DEV:-lo}" ROOT_HANDLE="${ROOT_HANDLE:-1:}" BAND2_HANDLE="${BAND2_HANDLE:-20:}" # child under 1:2 PING_BYTES="${PING_BYTES:-48}" PING_COUNT="${PING_COUNT:-200000}" PING_DST="${PING_DST:-127.0.0.1}" SLOW_TBF_RATE="${SLOW_TBF_RATE:-8bit}" SLOW_TBF_BURST="${SLOW_TBF_BURST:-100b}" SLOW_TBF_LAT="${SLOW_TBF_LAT:-1s}" cleanup() { tc qdisc del dev "$DEV" root 2>/dev/null } trap cleanup EXIT ip link set "$DEV" up tc qdisc del dev "$DEV" root 2>/dev/null || true tc qdisc add dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2 tc qdisc add dev "$DEV" parent 1:2 handle "$BAND2_HANDLE" \ tbf rate "$SLOW_TBF_RATE" burst "$SLOW_TBF_BURST" latency "$SLOW_TBF_LAT" tc filter add dev "$DEV" parent 1: protocol all prio 1 u32 match u32 0 0 flowid 1:2 tc -s qdisc ls dev $DEV ping -I "$DEV" -f -c "$PING_COUNT" -s "$PING_BYTES" -W 0.001 "$PING_DST" \ >/dev/null 2>&1 & tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 0 tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2 tc -s qdisc ls dev $DEV tc qdisc del dev "$DEV" parent 1:2 || true tc -s qdisc ls dev $DEV tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 1 strict 1 ``` KASAN report ``` ================================================================== BUG: KASAN: slab-use-after-free in ets_qdisc_dequeue+0x1071/0x11b0 kernel/net/sched/sch_ets.c:481 Read of size 8 at addr ffff8880502fc018 by task ping/12308 > CPU: 0 UID: 0 PID: 12308 Comm: ping Not tainted 6.18.0-rc4-dirty #1 PREEMPT(full) Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack kernel/lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 kernel/lib/dump_stack.c:120 print_address_description kernel/mm/kasan/report.c:378 print_report+0x156/0x4c9 kernel/mm/kasan/report.c:482 kasan_report+0xdf/0x110 kernel/mm/kasan/report.c:595 ets_qdisc_dequeue+0x1071/0x11b0 kernel/net/sched/sch_ets.c:481 dequeue_skb kernel/net/sched/sch_generic.c:294 qdisc_restart kernel/net/sched/sch_generic.c:399 __qdisc_run+0x1c9/0x1b00 kernel/net/sched/sch_generic.c:417 __dev_xmit_skb kernel/net/core/dev.c:4221 __dev_queue_xmit+0x2848/0x4410 kernel/net/core/dev.c:4729 dev_queue_xmit kernel/./include/linux/netdevice.h:3365 [...] Allocated by task 17115: kasan_save_stack+0x30/0x50 kernel/mm/kasan/common.c:56 kasan_save_track+0x14/0x30 kernel/mm/kasan/common.c:77 poison_kmalloc_redzone kernel/mm/kasan/common.c:400 __kasan_kmalloc+0xaa/0xb0 kernel/mm/kasan/common.c:417 kasan_kmalloc kernel/./include/linux/kasan.h:262 __do_kmalloc_node kernel/mm/slub.c:5642 __kmalloc_node_noprof+0x34e/0x990 kernel/mm/slub.c:5648 kmalloc_node_noprof kernel/./include/linux/slab.h:987 qdisc_alloc+0xb8/0xc30 kernel/net/sched/sch_generic.c:950 qdisc_create_dflt+0x93/0x490 kernel/net/sched/sch_generic.c:1012 ets_class_graft+0x4fd/0x800 kernel/net/sched/sch_ets.c:261 qdisc_graft+0x3e4/0x1780 kernel/net/sched/sch_api.c:1196 [...] Freed by task 9905: kasan_save_stack+0x30/0x50 kernel/mm/kasan/common.c:56 kasan_save_track+0x14/0x30 kernel/mm/kasan/common.c:77 __kasan_save_free_info+0x3b/0x70 kernel/mm/kasan/generic.c:587 kasan_save_free_info kernel/mm/kasan/kasan.h:406 poison_slab_object kernel/mm/kasan/common.c:252 __kasan_slab_free+0x5f/0x80 kernel/mm/kasan/common.c:284 kasan_slab_free kernel/./include/linux/kasan.h:234 slab_free_hook kernel/mm/slub.c:2539 slab_free kernel/mm/slub.c:6630 kfree+0x144/0x700 kernel/mm/slub.c:6837 rcu_do_batch kernel/kernel/rcu/tree.c:2605 rcu_core+0x7c0/0x1500 kernel/kernel/rcu/tree.c:2861 handle_softirqs+0x1ea/0x8a0 kernel/kernel/softirq.c:622 __do_softirq kernel/kernel/softirq.c:656 [...] Commentary: 1. Maher Azzouzi working with Trend Micro Zero Day Initiative was reported as the person who found the issue. I requested to get a proper email to add to the reported-by tag but got no response. For this reason i will credit the person i exchanged emails with i.e zdi-disclosures@trendmicro.com 2. Neither i nor Victor who did a much more thorough testing was able to reproduce a UAF with the PoC or other approaches we tried. We were both able to reproduce a null ptr deref. After exchange with zdi-disclosures@trendmicro.com they sent a small change to be made to the code to add an extra delay which was able to simulate the UAF. i.e, this: qdisc_put(q->classes[i].qdisc); mdelay(90); q->classes[i].qdisc = NULL; I was informed by Thomas Gleixner(tglx@linutronix.de) that adding delays was acceptable approach for demonstrating the bug, quote: "Adding such delays is common exploit validation practice" The equivalent delay could happen "by virt scheduling the vCPU out, SMIs, NMIs, PREEMPT_RT enabled kernel" 3. I asked the OP to test and report back but got no response and after a few days gave up and proceeded to submit this fix. Fixes: de6d25924c2a ("net/sched: sch_ets: don't peek at classes beyond 'nbands'") Reported-by: zdi-disclosures@trendmicro.com Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20251128151919.576920-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 188e0fa5a679570ea35474575e724d8211423d17 Author: Shaurya Rane Date: Sat Nov 29 15:07:18 2025 +0530 net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed. If __pskb_copy() returns NULL, skb_clone() is called with a NULL pointer, causing a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041 Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c RSP: 0018:ffffc9000d00f200 EFLAGS: 00010207 RAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000 RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000 R13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00 FS: 0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0 Call Trace: hsr_forward_do net/hsr/hsr_forward.c:-1 [inline] hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741 hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84 __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966 __netif_receive_skb_one_core net/core/dev.c:6077 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6192 netif_receive_skb_internal net/core/dev.c:6278 [inline] netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337 tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485 tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0449f8e1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff RDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8 RBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001 R13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003 Add a NULL check immediately after __pskb_copy() to handle allocation failures gracefully. Reported-by: syzbot+2fa344348a579b779e05@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2fa344348a579b779e05 Fixes: f266a683a480 ("net/hsr: Better frame dispatch") Cc: stable@vger.kernel.org Signed-off-by: Shaurya Rane Reviewed-by: Felix Maurer Tested-by: Felix Maurer Link: https://patch.msgid.link/20251129093718.25320-1-ssrane_b23@ee.vjti.ac.in Signed-off-by: Paolo Abeni commit 613d12dd794e078be8ff3cf6b62a6b9acf7f4619 Author: Wang Liang Date: Sat Nov 29 12:13:15 2025 +0800 netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb() return NULL in nr_output(), the original skb is not freed, which was allocated in nr_sendmsg(). Fix this by freeing it before return. [1] BUG: memory leak unreferenced object 0xffff888129f35500 (size 240): comm "syz.0.17", pid 6119, jiffies 4294944652 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 10 52 28 81 88 ff ff ..........R(.... backtrace (crc 1456a3e4): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4983 [inline] slab_alloc_node mm/slub.c:5288 [inline] kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5340 __alloc_skb+0x203/0x240 net/core/skbuff.c:660 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671 sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965 sock_alloc_send_skb include/net/sock.h:1859 [inline] nr_sendmsg+0x287/0x450 net/netrom/af_netrom.c:1105 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] sock_write_iter+0x293/0x2a0 net/socket.c:1195 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x45d/0x710 fs/read_write.c:686 ksys_write+0x143/0x170 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+d7abc36bbbb6d7d40b58@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7abc36bbbb6d7d40b58 Tested-by: syzbot+d7abc36bbbb6d7d40b58@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Liang Link: https://patch.msgid.link/20251129041315.1550766-1-wangliang74@huawei.com Signed-off-by: Paolo Abeni commit b6cb3ccef6e1e275f238d7ecc5986fd6b993e870 Author: Ian Kent Date: Tue Nov 11 14:04:38 2025 +0800 autofs: fix per-dentry timeout warning The check that determines if the message that warns about the per-dentry timeout being greater than the super block timeout is not correct. The initial value for this field is -1 and the type of the field is unsigned long. I could change the type to long but the message is in the wrong place too, it should come after the timeout setting. So leave everything else as it is and move the message and check the timeout is actually set as an additional condition on issuing the message. Also fix the timeout comparison. Signed-off-by: Ian Kent Link: https://patch.msgid.link/20251111060439.19593-2-raven@themaw.net Signed-off-by: Christian Brauner commit 3d5221af9c7711b7aec8da1298c8fc393ef6183d Author: Jianbo Liu Date: Thu Nov 20 05:56:09 2025 +0200 xfrm: Fix inner mode lookup in tunnel mode GSO segmentation Commit 61fafbee6cfe ("xfrm: Determine inner GSO type from packet inner protocol") attempted to fix GSO segmentation by reading the inner protocol from XFRM_MODE_SKB_CB(skb)->protocol. This was incorrect because the field holds the inner L4 protocol (TCP/UDP) instead of the required tunnel protocol. Also, the memory location (shared by XFRM_SKB_CB(skb) which could be overwritten by xfrm_replay_overflow()) is prone to corruption. This combination caused the kernel to select the wrong inner mode and get the wrong address family. The correct value is in xfrm_offload(skb)->proto, which is set from the outer tunnel header's protocol field by esp[4|6]_gso_encap(). It is initialized by xfrm[4|6]_tunnel_encap_add() to either IPPROTO_IPIP or IPPROTO_IPV6, using xfrm_af2proto() and correctly reflects the inner packet's address family. Fixes: 61fafbee6cfe ("xfrm: Determine inner GSO type from packet inner protocol") Signed-off-by: Jianbo Liu Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit e8e032cd24dda7cceaa27bc2eb627f82843f0466 Author: Wei Fang Date: Fri Nov 28 10:59:15 2025 +0800 net: fec: ERR007885 Workaround for XDP TX path The ERR007885 will lead to a TDAR race condition for mutliQ when the driver sets TDAR and the UDMA clears TDAR simultaneously or in a small window (2-4 cycles). And it will cause the udma_tx and udma_tx_arbiter state machines to hang. Therefore, the commit 53bb20d1faba ("net: fec: add variable reg_desc_active to speed things up") and the commit a179aad12bad ("net: fec: ERR007885 Workaround for conventional TX") have added the workaround to fix the potential issue for the conventional TX path. Similarly, the XDP TX path should also have the potential hang issue, so add the workaround for XDP TX path. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251128025915.2486943-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit c9a8c343ef2f9769a33650b7429f5a83ecba8380 Author: Ian Rogers Date: Wed Dec 3 13:47:04 2025 -0800 perf stat: When no events, don't report an error if there is none Events may fail to open as no supported CPUs were specified on the command line. In this case a confusing "error" message of "success" can be reported. Let's skip the error in that case. Before: ``` $ perf stat -C2048 -e cycles -- true WARNING: A requested CPU in '2048' is not supported by PMU 'cpu' (CPUs 0-7) for event 'cycles' Error: No supported events found. The sys_perf_event_open() syscall returned with 0 (Success) for event (cpu/unknown-hardware/). "dmesg | grep -i perf" may provide additional information. ``` After: ``` $ perf stat -C2048 -e cycles -- true WARNING: A requested CPU in '2048' is not supported by PMU 'cpu' (CPUs 0-7) for event 'cycles' Error: No supported events found. ``` Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 279b5a85ebdd17b8e6713583d0ad6cf00f53eb10 Author: Ian Rogers Date: Wed Dec 3 13:47:03 2025 -0800 perf tests stat: Add "--null" coverage Ensure "--null" does a minimal run. Reported-by: Ingo Molnar Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/ Tested-by: Ingo Molnar Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit e2de90bdc9f55a2a98fe6ee014c070d5c1d7cfb7 Author: Ian Rogers Date: Wed Dec 3 13:47:02 2025 -0800 perf cpumap: Add "any" CPU handling to cpu_map__snprint_mask If the perf_cpu_map is empty or is just the any CPU value, then early return. Don't process the "any" CPU when creating the bitmap. Tested-by: Ingo Molnar Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a Author: Ian Rogers Date: Wed Dec 3 13:47:01 2025 -0800 libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly test for the empty map. Reported-by: Ingo Molnar Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/ Tested-by: Ingo Molnar Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 6744c0b182c1f371135bc3f4e62b96ad884c9f89 Author: Ian Rogers Date: Wed Dec 3 13:47:00 2025 -0800 perf stat: Allow no events to open if this is a "--null" run It is intended that a "--null" run doesn't open any events. Fixes: 2cc7aa995ce9 ("perf stat: Refactor retry/skip/fatal error handling") Tested-by: Ingo Molnar Signed-off-by: Ian Rogers Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 1ef15fbe6771119dc1d3bd4ed201100cfacb842e Author: Rajasi Mandal Date: Tue Nov 18 02:26:55 2025 +0000 cifs: client: enforce consistent handling of multichannel and max_channels Previously, the behavior of the multichannel and max_channels mount options was inconsistent and order-dependent. For example, specifying "multichannel,max_channels=1" would result in 2 channels, while "max_channels=1,multichannel" would result in 1 channel. Additionally, conflicting combinations such as "nomultichannel,max_channels=3" or "multichannel,max_channels=1" did not produce errors and could lead to unexpected channel counts. This commit introduces two new fields in smb3_fs_context to explicitly track whether multichannel and max_channels were specified during mount. The option parsing and validation logic is updated to ensure: - The outcome is no longer dependent on the order of options. - Conflicting combinations (e.g., "nomultichannel,max_channels=3" or "multichannel,max_channels=1") are detected and result in an error. - The number of channels created is consistent with the specified options. This improves the reliability and predictability of mount option handling for SMB3 multichannel support. Reviewed-by: Shyam Prasad N Signed-off-by: Rajasi Mandal Signed-off-by: Steve French commit 559e608c46553c107dbba19dae0854af7b219400 Merge: fbeea4db51a6ea 1b2ae190ea43be Author: Linus Torvalds Date: Wed Dec 3 20:45:43 2025 -0800 Merge tag 'ntfs3_for_6.19' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "New code: - support timestamps prior to epoch - do not overwrite uptodate pages - disable readahead for compressed files - setting of dummy blocksize to read boot_block when mounting - the run_lock initialization when loading $Extend - initialization of allocated memory before use - support for the NTFS3_IOC_SHUTDOWN ioctl - check for minimum alignment when performing direct I/O reads - check for shutdown in fsync Fixes: - mount failure for sparse runs in run_unpack() - use-after-free of sbi->options in cmp_fnames - KMSAN uninit bug after failed mi_read in mi_format_new - uninit error after buffer allocation by __getname() - KMSAN uninit-value in ni_create_attr_list - double free of sbi->options->nls and ownership of fc->fs_private - incorrect vcn adjustments in attr_collapse_range() - mode update when ACL can be reduced to mode - memory leaks in add sub record Changes: - refactor code, updated terminology, spelling - do not kmap pages in (de)compression code - after ntfs_look_free_mft(), code that fails must put mft_inode - default mount options for "acl" and "prealloc" Replaced: - use unsafe_memcpy() to avoid memcpy size warning - ntfs_bio_pages with page cache for compressed files" * tag 'ntfs3_for_6.19' of https://github.com/Paragon-Software-Group/linux-ntfs3: (26 commits) fs/ntfs3: check for shutdown in fsync fs/ntfs3: change the default mount options for "acl" and "prealloc" fs/ntfs3: Prevent memory leaks in add sub record fs/ntfs3: out1 also needs to put mi fs/ntfs3: Fix spelling mistake "recommened" -> "recommended" fs/ntfs3: update mode in xattr when ACL can be reduced to mode fs/ntfs3: check minimum alignment for direct I/O fs/ntfs3: implement NTFS3_IOC_SHUTDOWN ioctl fs/ntfs3: correct attr_collapse_range when file is too fragmented ntfs3: fix double free of sbi->options->nls and clarify ownership of fc->fs_private fs/ntfs3: Initialize allocated memory before use fs/ntfs3: remove ntfs_bio_pages and use page cache for compressed I/O ntfs3: avoid memcpy size warning fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list ntfs3: init run lock for extend inode ntfs: set dummy blocksize to read boot_block when mounting fs/ntfs3: disable readahead for compressed files ntfs3: Fix uninit buffer allocated by __getname() ntfs3: fix uninit memory after failed mi_read in mi_format_new ntfs3: fix use-after-free of sbi->options in cmp_fnames ... commit fbeea4db51a6eaf62b4784f718844726dd2199b9 Merge: afcbce74f358a5 91ef18b567dae8 Author: Linus Torvalds Date: Wed Dec 3 20:37:15 2025 -0800 Merge tag 'ext4_for_linus-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "New features and improvements for the ext4 file system: - Optimize online defragmentation by using folios instead of individual buffer heads - Improve error codes stored in the superblock when the journal aborts - Minor cleanups and clarifications in ext4_map_blocks() - Add documentation of the casefold and encrypt flags - Add support for file systems with a blocksize greater than the pagesize - Improve performance by enabling the caching the fact that an inode does not have a Posix ACL Various Bug Fixes: - Fix false positive complaints from smatch - Fix error code which is returned by ext4fs_dirhash() when Siphash is used without the encryption key - Fix races when writing to inline data files which could trigger a BUG - Fix potential NULL dereference when there is an corrupt file system with an extended attribute value stored in a inode - Fix false positive lockdep report when syzbot uses ext4 and ocfs2 together - Fix false positive reported by DEPT by adjusting lock annotation - Avoid a potential BUG_ON in jbd2 when a file system is massively corrupted - Fix a WARN_ON when superblock is corrupted with a non-NULL terminated mount options field - Add check if the userspace passes in a non-NULL terminated mount options field to EXT4_IOC_SET_TUNE_SB_PARAM - Fix a potential journal checksum failure whena file system is copied while it is mounted read-only - Fix a potential potential orphan file tracking error which only showed on 32-bit systems - Fix assertion checks in mballoc (which have to be explicitly enbled by manually enabling AGGRESSIVE_CHECKS and recompiling) - Avoid complaining about overly large orphan files created by mke2fs with with file systems with a 64k block size" * tag 'ext4_for_linus-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (58 commits) ext4: mark inodes without acls in __ext4_iget() ext4: enable block size larger than page size ext4: add checks for large folio incompatibilities when BS > PS ext4: support verifying data from large folios with fs-verity ext4: make data=journal support large block size ext4: support large block size in __ext4_block_zero_page_range() ext4: support large block size in mpage_prepare_extent_to_map() ext4: support large block size in mpage_map_and_submit_buffers() ext4: support large block size in ext4_block_write_begin() ext4: support large block size in ext4_mpage_readpages() ext4: rename 'page' references to 'folio' in multi-block allocator ext4: prepare buddy cache inode for BS > PS with large folios ext4: support large block size in ext4_mb_init_cache() ext4: support large block size in ext4_mb_get_buddy_page_lock() ext4: support large block size in ext4_mb_load_buddy_gfp() ext4: add EXT4_LBLK_TO_PG and EXT4_PG_TO_LBLK for block/page conversion ext4: add EXT4_LBLK_TO_B macro for logical block to bytes conversion ext4: support large block size in ext4_readdir() ext4: support large block size in ext4_calculate_overhead() ext4: introduce s_min_folio_order for future BS > PS support ... commit afcbce74f358a540761aa893939590a667162dff Merge: 869737543b39a1 8a157e0a0aa514 Author: Linus Torvalds Date: Wed Dec 3 20:28:50 2025 -0800 Merge tag 'gfs2-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Major withdraw / error handling overhaul based on dlm's new DLM_RELEASE_RECOVER feature: this allows gfs to treat withdraws like node failures. Make withdraws asynchronous - Fix a bug in commit e4a8b5481c59a that caused 'df' to remain out of sync. ('df' is still allowed to go slightly out of sync for short periods of time) - Prevent recusive memory reclaim in gfs2_unstuff_dinode() - Clean up SDF_JOURNAL_LIVE flag handling - Fix remote evict for read-only filesystems - Fix a misuse of bio_chain() - Various other minor cleanups * tag 'gfs2-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: (35 commits) gfs2: Fix use of bio_chain gfs2: Clean up SDF_JOURNAL_LIVE flag handling gfs2: No longer thaw filesystems during a withdraw gfs2: Withdraw immediately in gfs2_trans_add_meta gfs2: New gfs2_withdraw_helper gfs2: Clean up properly during a withdraw gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} Revert "gfs2: fix infinite loop when checking ail item count before go_inval" Revert "gfs2: Allow some glocks to be used during withdraw" Revert "gfs2: Check for log write errors before telling dlm to unlock" Revert "gfs2: fix a deadlock on withdraw-during-mount" Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) Revert "gfs2: don't stop reads while withdraw in progress" gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} gfs2: Kill gfs2_io_error_bh_wd ... commit 869737543b39a145809c41a7253c6ee777e22729 Merge: 3ed1c68307c4ce e1469f56089fc0 Author: Linus Torvalds Date: Wed Dec 3 20:23:41 2025 -0800 Merge tag 'v6.19-rc-smb-fixes' of git://git.samba.org/ksmbd Pull smb client and server updates from Steve French: - server fixes: - IPC use after free locking fix - fix locking bug in delete paths - fix use after free in disconnect - fix underflow in locking check - error mapping improvement - socket listening improvement - return code mapping fixes - crypto improvements (use default libraries) - cleanup patches: - netfs - client checkpatch cleanup - server cleanup - move server/client duplicate code to common code - fix some defines to better match protocol specification - smbdirect (RDMA) fixes - client debugging improvements for leases * tag 'v6.19-rc-smb-fixes' of git://git.samba.org/ksmbd: (44 commits) cifs: Use netfs_alloc/free_folioq_buffer() smb: client: show smb lease key in open_dirs output smb: client: show smb lease key in open_files output ksmbd: ipc: fix use-after-free in ipc_msg_send_request smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd: Replace strcpy + strcat to improve convert_to_nt_pathname smb: move FILE_SYSTEM_ATTRIBUTE_INFO to common/fscc.h ksmbd: implement error handling for STATUS_INFO_LENGTH_MISMATCH in smb server ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency ksmbd: server: avoid busy polling in accept loop smb: move create_durable_reconn to common/smb2pdu.h smb: fix some warnings reported by scripts/checkpatch.pl smb: do some cleanups smb: move FILE_SYSTEM_SIZE_INFO to common/fscc.h smb: move some duplicate struct definitions to common/fscc.h smb: move list of FileSystemAttributes to common/fscc.h ... commit 835a50753579aa8368a08fca307e638723207768 Author: Alexei Starovoitov Date: Wed Dec 3 20:14:30 2025 -0800 selftests/bpf: Add -fms-extensions to bpf build flags The kernel is now built with -fms-extensions, therefore generated vmlinux.h contains types like: struct slab { .. struct freelist_counters; }; Use -fms-extensions and -Wno-microsoft-anon-tag flags to build bpf programs that #include "vmlinux.h" Signed-off-by: Alexei Starovoitov commit 3ed1c68307c4ce53256e15b8a8830b12bdba1ff5 Merge: 477e31fd1e81ef 69ceb8a2d66656 Author: Linus Torvalds Date: Wed Dec 3 20:19:38 2025 -0800 Merge tag 'xfs-merge-6.19' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "There are no major changes in xfs. This contains mostly some code cleanups, a few bug fixes and documentation update. Highlights are: - Quota locking cleanup - Getting rid of old xlog_in_core_2_t type" * tag 'xfs-merge-6.19' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (33 commits) docs: remove obsolete links in the xfs online repair documentation xfs: move some code out of xfs_iget_recycle xfs: use zi more in xfs_zone_gc_mount xfs: remove the unused bv field in struct xfs_gc_bio xfs: remove xarray mark for reclaimable zones xfs: remove the xlog_in_core_t typedef xfs: remove l_iclog_heads xfs: remove the xlog_rec_header_t typedef xfs: remove xlog_in_core_2_t xfs: remove a very outdated comment from xlog_alloc_log xfs: cleanup xlog_alloc_log a bit xfs: don't use xlog_in_core_2_t in struct xlog_in_core xfs: add a on-disk log header cycle array accessor xfs: add a XLOG_CYCLE_DATA_SIZE constant xfs: reduce ilock roundtrips in xfs_qm_vop_dqalloc xfs: move xfs_dquot_tree calls into xfs_qm_dqget_cache_{lookup,insert} xfs: move quota locking into xrep_quota_item xfs: move quota locking into xqcheck_commit_dquot xfs: move q_qlock locking into xqcheck_compare_dquot xfs: move q_qlock locking into xchk_quota_item ... commit 477e31fd1e81ef925ce55931bcdbf609ba2207c8 Merge: ca010e2ef64ce2 0bdbf89a8bbeb1 Author: Linus Torvalds Date: Wed Dec 3 20:14:44 2025 -0800 Merge tag 'erofs-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: - Fix a WARNING caused by a recent FSDAX misdetection regression - Fix the filesystem stacking limit for file-backed mounts - Print more informative diagnostics on decompression errors - Switch the on-disk definition `erofs_fs.h` to the MIT license - Minor cleanups * tag 'erofs-for-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: switch on-disk header `erofs_fs.h` to MIT license erofs: get rid of raw bi_end_io() usage erofs: enable error reporting for z_erofs_fixup_insize() erofs: enable error reporting for z_erofs_stream_switch_bufs() erofs: improve Zstd, LZMA and DEFLATE error strings erofs: improve decompression error reporting erofs: tidy up z_erofs_lz4_handle_overlap() erofs: limit the level of fs stacking for file-backed mounts erofs: correct FSDAX detection commit ca010e2ef64ce2a8f3907a5c02f8109012ea5dc6 Merge: 7696286034ac72 ec95cd103c3a1e Author: Linus Torvalds Date: Wed Dec 3 20:08:32 2025 -0800 Merge tag 'hfs-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull hfs/hfsplus updates from Viacheslav Dubeyko: "Several fixes for syzbot reported issues, HFS/HFS+ fixes of xfstests failures, Kunit-based unit-tests introduction, and code cleanup: - Dan Carpenter fixed a potential use-after-free issue in hfs_correct_next_unused_CNID() method. Tetsuo Handa has made nice fix of syzbot reported issue related to incorrect inode->i_mode management if volume has been corrupted somehow. Yang Chenzhi has made really good fix of potential race condition in __hfs_bnode_create() method for HFS+ file system. - Several fixes to xfstests failures. Particularly, generic/070, generic/073, and generic/101 test-cases finish successfully for the case of HFS+ file system right now. - HFS and HFS+ drivers share multiple structures of on-disk layout declarations. Some structures are used without any change. However, we had two independent declarations of the same structures in HFS and HFS+ drivers. The on-disk layout declarations have been moved into include/linux/hfs_common.h with the goal to exclude the declarations duplication and to keep the HFS/HFS+ on-disk layout declarations in one place. Also, this patch prepares the basis for creating a hfslib that can aggregate common functionality without necessity to duplicate the same code in HFS and HFS+ drivers. - HFS/HFS+ really need unit-tests because of multiple xfstests failures. The first two patches introduce Kunit-based unit-tests for the case string operations in HFS/HFS+ file system drivers" * tag 'hfs-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfs/hfsplus: move on-disk layout declarations into hfs_common.h hfsplus: fix volume corruption issue for generic/101 hfsplus: introduce KUnit tests for HFS+ string operations hfs: introduce KUnit tests for HFS string operations hfsplus: fix volume corruption issue for generic/073 hfsplus: Verify inode mode when loading from disk hfsplus: fix volume corruption issue for generic/070 hfs/hfsplus: prevent getting negative values of offset/length hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create hfs: fix potential use after free in hfs_correct_next_unused_CNID() commit 7696286034ac72cf9b46499be1715ac62fd302c3 Merge: cc25df3e2e22a9 9e0e6577b3e5e5 Author: Linus Torvalds Date: Wed Dec 3 20:03:46 2025 -0800 Merge tag 'for-6.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Features: - shutdown ioctl support (needs CONFIG_BTRFS_EXPERIMENTAL for now): - set filesystem state as being shut down (also named going down in other filesystems), where all active operations return EIO and this cannot be changed until unmount - pending operations are attempted to be finished but error messages may still show up depending on where exactly the shutdown happened - scrub (and device replace) vs suspend/hibernate: - a running scrub will prevent suspend, which can be annoying as suspend is an immediate request and scrub is not critical - filesystem freezing before suspend was not sufficient as the problem was in process freezing - behaviour change: on suspend scrub and device replace are cancelled, where scrub can record the last state and continue from there; the device replace has to be restarted from the beginning - zone stats exported in sysfs, from the perspective of the filesystem this includes active, reclaimable, relocation etc zones Performance: - improvements when processing space reservation tickets by optimizing locking and shrinking critical sections, cumulative improvements in lockstat numbers show +15% Notable fixes: - use vmalloc fallback when allocating bios as high order allocations can happen with wide checksums (like sha256) - scrub will always track the last position of progress so it's not starting from zero after an error Core: - under experimental config, checksum calculations are offloaded to process context, simplifies locking and allows to remove compression write worker kthread(s): - speed improvement in direct IO throughput with buffered IO fallback is +15% when not offloaded but this is more related to internal crypto subsystem improvements - this will be probably default in the future removing the sysfs tunable - (experimental) block size > page size updates: - support more operations when not using large folios (encoded read/write and send) - raid56 - more preparations for fscrypt support Other: - more conversions to auto-cleaned variables - parameter cleanups and removals - extended warning fixes - improved printing of structured values like keys - lots of other cleanups and refactoring" * tag 'for-6.19-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (147 commits) btrfs: remove unnecessary inode key in btrfs_log_all_parents() btrfs: remove redundant zero/NULL initializations in btrfs_alloc_root() btrfs: remaining BTRFS_PATH_AUTO_FREE conversions btrfs: send: do not allocate memory for xattr data when checking it exists btrfs: send: add unlikely to all unexpected overflow checks btrfs: reduce arguments to btrfs_del_inode_ref_in_log() btrfs: remove root argument from btrfs_del_dir_entries_in_log() btrfs: use test_and_set_bit() in btrfs_delayed_delete_inode_ref() btrfs: don't search back for dir inode item in INO_LOOKUP_USER btrfs: don't rewrite ret from inode_permission btrfs: add orig_logical to btrfs_bio for encryption btrfs: disable verity on encrypted inodes btrfs: disable various operations on encrypted inodes btrfs: remove redundant level reset in btrfs_del_items() btrfs: simplify leaf traversal after path release in btrfs_next_old_leaf() btrfs: optimize balance_level() path reference handling btrfs: factor out root promotion logic into promote_child_to_root() btrfs: raid56: remove the "_step" infix btrfs: raid56: enable bs > ps support btrfs: raid56: prepare finish_parity_scrub() to support bs > ps cases ... commit cc25df3e2e22a956d3a0d427369367b4a901d203 Merge: 0abcfd8983e3d3 d211a2803551c8 Author: Linus Torvalds Date: Wed Dec 3 19:26:18 2025 -0800 Merge tag 'for-6.19/block-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block updates from Jens Axboe: - Fix head insertion for mq-deadline, a regression from when priority support was added - Series simplifying and improving the ublk user copy code - Various ublk related cleanups - Fixup REQ_NOWAIT handling in loop/zloop, clearing NOWAIT when the request is punted to a thread for handling - Merge and then later revert loop dio nowait support, as it ended up causing excessive stack usage for when the inline issue code needs to dip back into the full file system code - Improve auto integrity code, making it less deadlock prone - Speedup polled IO handling, but manually managing the hctx lookups - Fixes for blk-throttle for SSD devices - Small series with fixes for the S390 dasd driver - Add support for caching zones, avoiding unnecessary report zone queries - MD pull requests via Yu: - fix null-ptr-dereference regression for dm-raid0 - fix IO hang for raid5 when array is broken with IO inflight - remove legacy 1s delay to speed up system shutdown - change maintainer's email address - data can be lost if array is created with different lbs devices, fix this problem and record lbs of the array in metadata - fix rcu protection for md_thread - fix mddev kobject lifetime regression - enable atomic writes for md-linear - some cleanups - bcache updates via Coly - remove useless discard and cache device code - improve usage of per-cpu workqueues - Reorganize the IO scheduler switching code, fixing some lockdep reports as well - Improve the block layer P2P DMA support - Add support to the block tracing code for zoned devices - Segment calculation improves, and memory alignment flexibility improvements - Set of prep and cleanups patches for ublk batching support. The actual batching hasn't been added yet, but helps shrink down the workload of getting that patchset ready for 6.20 - Fix for how the ps3 block driver handles segments offsets - Improve how block plugging handles batch tag allocations - nbd fixes for use-after-free of the configuration on device clear/put - Set of improvements and fixes for zloop - Add Damien as maintainer of the block zoned device code handling - Various other fixes and cleanups * tag 'for-6.19/block-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (162 commits) block/rnbd: correct all kernel-doc complaints blk-mq: use queue_hctx in blk_mq_map_queue_type md: remove legacy 1s delay in md_notify_reboot md/raid5: fix IO hang when array is broken with IO inflight md: warn about updating super block failure md/raid0: fix NULL pointer dereference in create_strip_zones() for dm-raid sbitmap: fix all kernel-doc warnings ublk: add helper of __ublk_fetch() ublk: pass const pointer to ublk_queue_is_zoned() ublk: refactor auto buffer register in ublk_dispatch_req() ublk: add `union ublk_io_buf` with improved naming ublk: add parameter `struct io_uring_cmd *` to ublk_prep_auto_buf_reg() kfifo: add kfifo_alloc_node() helper for NUMA awareness blk-mq: fix potential uaf for 'queue_hw_ctx' blk-mq: use array manage hctx map instead of xarray ublk: prevent invalid access with DEBUG s390/dasd: Use scnprintf() instead of sprintf() s390/dasd: Move device name formatting into separate function s390/dasd: Remove unnecessary debugfs_create() return checks s390/dasd: Fix gendisk parent after copy pair swap ... commit 0abcfd8983e3d3d27b8f5f7d01fed4354eb422c4 Merge: 8f7aa3d3c7323f 5d24321e4c1590 Author: Linus Torvalds Date: Wed Dec 3 18:58:57 2025 -0800 Merge tag 'for-6.19/io_uring-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Unify how task_work cancelations are detected, placing it in the task_work running state rather than needing to check the task state - Series cleaning up and moving the cancelation code to where it belongs, in cancel.c - Cleanup of waitid and futex argument handling - Add support for mixed sized SQEs. 6.18 added support for mixed sized CQEs, improving flexibility and efficiency of workloads that need big CQEs. This adds similar support for SQEs, where the occasional need for a 128b SQE doesn't necessitate having all SQEs be 128b in size - Introduce zcrx and SQ/CQ layout queries. The former returns what zcrx features are available. And both return the ring size information to help with allocation size calculation for user provided rings like IORING_SETUP_NO_MMAP and IORING_MEM_REGION_TYPE_USER - Zcrx updates for 6.19. It includes a bunch of small patches, IORING_REGISTER_ZCRX_CTRL and RQ flushing and David's work on sharing zcrx b/w multiple io_uring instances - Series cleaning up ring initializations, notable deduplicating ring size and offset calculations. It also moves most of the checking before doing any allocations, making the code simpler - Add support for getsockname and getpeername, which is mostly a trivial hookup after a bit of refactoring on the networking side - Various fixes and cleanups * tag 'for-6.19/io_uring-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (68 commits) io_uring: Introduce getsockname io_uring cmd socket: Split out a getsockname helper for io_uring socket: Unify getsockname and getpeername implementation io_uring/query: drop unused io_handle_query_entry() ctx arg io_uring/kbuf: remove obsolete buf_nr_pages and update comments io_uring/register: use correct location for io_rings_layout io_uring/zcrx: share an ifq between rings io_uring/zcrx: add io_fill_zcrx_offsets() io_uring/zcrx: export zcrx via a file io_uring/zcrx: move io_zcrx_scrub() and dependencies up io_uring/zcrx: count zcrx users io_uring/zcrx: add sync refill queue flushing io_uring/zcrx: introduce IORING_REGISTER_ZCRX_CTRL io_uring/zcrx: elide passing msg flags io_uring/zcrx: use folio_nr_pages() instead of shift operation io_uring/zcrx: convert to use netmem_desc io_uring/query: introduce rings info query io_uring/query: introduce zcrx query io_uring: move cq/sq user offset init around io_uring: pre-calculate scq layout ... commit 76ee7fd6af6851ef78016139bd727057ba467c4e Author: Chaitanya Kulkarni Date: Mon Nov 24 15:48:05 2025 -0800 f2fs: ignore discard return value __blkdev_issue_discard() always returns 0, making the error assignment in __submit_discard_cmd() dead code. Initialize err to 0 and remove the error assignment from the __blkdev_issue_discard() call to err. Move fault injection code into already present if branch where err is set to -EIO. This preserves the fault injection behavior while removing dead error handling. Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Chaitanya Kulkarni Signed-off-by: Jaegeuk Kim commit 8d1cb17aca466b361cca17834b8bb1cf3e3d1818 Author: YH Lin Date: Fri Nov 28 11:23:57 2025 +0800 f2fs: optimize trace_f2fs_write_checkpoint with enums This patch optimizes the tracepoint by replacing these hardcoded strings with a new enumeration f2fs_cp_phase. 1.Defines enum f2fs_cp_phase with values for each checkpoint phase. 2.Updates trace_f2fs_write_checkpoint to accept a u16 phase argument instead of a string pointer. 3.Uses __print_symbolic in TP_printk to convert the enum values back to their corresponding strings for human-readable trace output. This change reduces the storage overhead for each trace event by replacing a variable-length string with a 2-byte integer, while maintaining the same readable output in ftrace. Signed-off-by: YH Lin Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 37345eae9deaa2e4f372eeb98f6594cd0ee0916e Author: Chao Yu Date: Fri Nov 28 17:25:07 2025 +0800 f2fs: fix to not account invalid blocks in get_left_section_blocks() w/ LFS mode, in get_left_section_blocks(), we should not account the blocks which were used before and now are invalided, otherwise those blocks will be counted as freed one in has_curseg_enough_space(), result in missing to trigger GC in time. Cc: stable@kernel.org Fixes: 249ad438e1d9 ("f2fs: add a method for calculating the remaining blocks in the current segment in LFS mode.") Fixes: bf34c93d2645 ("f2fs: check curseg space before foreground GC") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8f11fe52fc1fa39ccfaa7c1e256f53e35d2839fa Author: Chao Yu Date: Fri Nov 28 17:25:34 2025 +0800 f2fs: support to show curseg.next_blkoff in debugfs cat /sys/kernel/debug/f2fs/status Main area: 17 segs, 17 secs 17 zones TYPE blkoff segno secno zoneno dirty_seg full_seg valid_blk - COLD data: 0 4 4 4 0 0 0 - WARM data: 0 7 7 7 0 0 0 - HOT data: 1 5 5 5 2 0 512 - Dir dnode: 3 0 0 0 1 0 2 - File dnode: 0 1 1 1 0 0 0 - Indir nodes: 0 2 2 2 0 0 0 - Pinned file: 0 -1 -1 -1 - ATGC data: 0 -1 -1 -1 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fbc0774b6d55722c90a4509ec8089071b9e7aa18 Author: Masaharu Noguchi Date: Mon Nov 17 21:27:54 2025 +0900 docs: f2fs: wrap ASCII tables in literal blocks to fix LaTeX build Sphinx's LaTeX builder fails when converting the nested ASCII tables in f2fs.rst, producing the following error: "Markup is unsupported in LaTeX: longtable does not support nesting a table." Wrap the affected ASCII tables in literal code blocks to force Sphinx to render them verbatim. This prevents nested longtables and fixes the PDF build failure on Sphinx 8.2.x. Acked-by: Bagas Sanjaya Reviewed-by: Akira Yokosawa Signed-off-by: Masaharu Noguchi Acked-by: Jonathan Corbet Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1627a303bca692edc6552630aa2f878c8a726a01 Author: Chao Yu Date: Mon Nov 17 20:45:59 2025 +0800 f2fs: expand scalability of f2fs mount option opt field in structure f2fs_mount_info and opt_mask field in structure f2fs_fs_context is 32-bits variable, now we're running out of available bits in them, let's expand them to 64-bits for better scalability. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d31e0de8b8625874d2fc4f5506b3bf30610555a0 Author: Chao Yu Date: Wed Nov 12 09:47:49 2025 +0800 f2fs: change default schedule timeout value This patch changes default schedule timeout value from 20ms to 1ms, in order to give caller more chances to check whether IO or non-IO congestion condition has already been mitigable. In addition, default interval of periodical discard submission is kept to 20ms. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 76e780d88c771921ea643fb8a6c8d0b08c17cb7b Author: Chao Yu Date: Wed Nov 12 09:47:48 2025 +0800 f2fs: introduce f2fs_schedule_timeout() In f2fs retry logic, we will call f2fs_io_schedule_timeout() to sleep as uninterruptible state (waiting for IO) for a while, however, in several paths below, we are not blocked by IO: - f2fs_write_single_data_page() return -EAGAIN due to racing on cp_rwsem. - f2fs_flush_device_cache() failed to submit preflush command. - __issue_discard_cmd_range() sleeps periodically in between two in batch discard submissions. So, in order to reveal state of task more accurate, let's introduce f2fs_schedule_timeout() and call it in above paths in where we are waiting for non-IO reasons. Then we can get real reason of uninterruptible sleep for a thread in tracepoint, perfetto, etc. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 30a8496694f1a93328e5d7f19206380346918b5a Author: Chao Yu Date: Wed Nov 12 09:47:47 2025 +0800 f2fs: use memalloc_retry_wait() as much as possible memalloc_retry_wait() is recommended in memory allocation retry logic, use it as much as possible. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 89732017890e8ce0826e18c743b71dc564d3a674 Author: Yongpeng Yang Date: Mon Nov 10 16:22:22 2025 +0800 f2fs: add a sysfs entry to show max open zones This patch adds a sysfs entry showing the max zones that F2FS can write concurrently. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 581251e03077f2fb83f9d10f5e21ec7e546a82b4 Author: Yongpeng Yang Date: Mon Nov 10 16:22:21 2025 +0800 f2fs: wrap all unusable_blocks_per_sec code in CONFIG_BLK_DEV_ZONED The usage of unusable_blocks_per_sec is already wrapped by CONFIG_BLK_DEV_ZONED, except for its declaration and the definitions of CAP_BLKS_PER_SEC and CAP_SEGS_PER_SEC. This patch ensures that all code related to unusable_blocks_per_sec is properly wrapped under the CONFIG_BLK_DEV_ZONED option. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 24fd7f00161055e1ca0dd137a1d67f87fa781f99 Author: Baolin Liu Date: Tue Nov 11 20:17:28 2025 +0800 f2fs: simplify list initialization in f2fs_recover_fsync_data() In f2fs_recover_fsync_data(),use LIST_HEAD() to declare and initialize the list_head in one step instead of using INIT_LIST_HEAD() separately. No functional change. Signed-off-by: Baolin Liu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7ee8bc3942f20964ad730871b885688ea3a2961a Author: Daeho Jeong Date: Tue Nov 11 09:52:46 2025 -0800 f2fs: revert summary entry count from 2048 to 512 in 16kb block support The recent increase in the number of Segment Summary Area (SSA) entries from 512 to 2048 was an unintentional change in logic of 16kb block support. This commit corrects the issue. To better utilize the space available from the erroneous 2048-entry calculation, we are implementing a solution to share the currently unused SSA space with neighboring segments. This enhances overall SSA utilization without impacting the established 8MB segment size. Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size") Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 68d05693f8c031257a0822464366e1c2a239a512 Author: Chao Yu Date: Wed Nov 5 14:50:23 2025 +0800 f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync # avoid CP_UMOUNT_FLAG in last f2fs_checkpoint.ckpt_flags touch /mnt/f2fs/bar f2fs_io fsync /mnt/f2fs/bar f2fs_io shutdown 2 /mnt/f2fs umount /mnt/f2fs blockdev --setro /dev/vdd mount /dev/vdd /mnt/f2fs mount: /mnt/f2fs: WARNING: source write-protected, mounted read-only. For the case if we create and fsync a new inode before sudden power-cut, without norecovery or disable_roll_forward mount option, the following mount will succeed w/o recovering last fsynced inode. The problem here is that we only check inode_list list after find_fsync_dnodes() in f2fs_recover_fsync_data() to find out whether there is recoverable data in the iamge, but there is a missed case, if last fsynced inode is not existing in last checkpoint, then, we will fail to get its inode due to nat of inode node is not existing in last checkpoint, so the inode won't be linked in inode_list. Let's detect such case in dyrun mode to fix this issue. After this change, mount will fail as expected below: mount: /mnt/f2fs: cannot mount /dev/vdd read-only. dmesg(1) may have more information after failed mount system call. demsg: F2FS-fs (vdd): Need to recover fsync data, but write access unavailable, please try mount w/ disable_roll_forward or norecovery Cc: stable@kernel.org Fixes: 6781eabba1bd ("f2fs: give -EINVAL for norecovery and rw mount") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 01fba45deaddcce0d0b01c411435d1acf6feab7b Author: Chao Yu Date: Wed Nov 5 14:50:22 2025 +0800 f2fs: fix return value of f2fs_recover_fsync_data() With below scripts, it will trigger panic in f2fs: mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 >> /mnt/f2fs/foo f2fs_io fsync /mnt/f2fs/foo f2fs_io shutdown 2 /mnt/f2fs umount /mnt/f2fs mount -o ro,norecovery /dev/vdd /mnt/f2fs or mount -o ro,disable_roll_forward /dev/vdd /mnt/f2fs F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 F2FS-fs (vdd): Mounted with checkpoint version = 7f5c361f F2FS-fs (vdd): Stopped filesystem due to reason: 0 F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 Filesystem f2fs get_tree() didn't set fc->root, returned 1 ------------[ cut here ]------------ kernel BUG at fs/super.c:1761! Oops: invalid opcode: 0000 [#1] SMP PTI CPU: 3 UID: 0 PID: 722 Comm: mount Not tainted 6.18.0-rc2+ #721 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:vfs_get_tree.cold+0x18/0x1a Call Trace: fc_mount+0x13/0xa0 path_mount+0x34e/0xc50 __x64_sys_mount+0x121/0x150 do_syscall_64+0x84/0x800 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa6cc126cfe The root cause is we missed to handle error number returned from f2fs_recover_fsync_data() when mounting image w/ ro,norecovery or ro,disable_roll_forward mount option, result in returning a positive error number to vfs_get_tree(), fix it. Cc: stable@kernel.org Fixes: 6781eabba1bd ("f2fs: give -EINVAL for norecovery and rw mount") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2e2e0d679a1fb88a960049496373f415b67f274f Author: Jaegeuk Kim Date: Tue Oct 28 19:50:11 2025 +0000 f2fs: add fadvise tracepoint This adds a tracepoint in the fadvise call path. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 27bf6a637b7613fc85fa6af468b7d612d78cd5c0 Author: Xiaole He Date: Mon Oct 27 17:23:41 2025 +0800 f2fs: fix age extent cache insertion skip on counter overflow The age extent cache uses last_blocks (derived from allocated_data_blocks) to determine data age. However, there's a conflict between the deletion marker (last_blocks=0) and legitimate last_blocks=0 cases when allocated_data_blocks overflows to 0 after reaching ULLONG_MAX. In this case, valid extents are incorrectly skipped due to the "if (!tei->last_blocks)" check in __update_extent_tree_range(). This patch fixes the issue by: 1. Reserving ULLONG_MAX as an invalid/deletion marker 2. Limiting allocated_data_blocks to range [0, ULLONG_MAX-1] 3. Using F2FS_EXTENT_AGE_INVALID for deletion scenarios 4. Adjusting overflow age calculation from ULLONG_MAX to (ULLONG_MAX-1) Reproducer (using a patched kernel with allocated_data_blocks initialized to ULLONG_MAX - 3 for quick testing): Step 1: Mount and check initial state # dd if=/dev/zero of=/tmp/test.img bs=1M count=100 # mkfs.f2fs -f /tmp/test.img # mkdir -p /mnt/f2fs_test # mount -t f2fs -o loop,age_extent_cache /tmp/test.img /mnt/f2fs_test # cat /sys/kernel/debug/f2fs/status | grep -A 4 "Block Age" Allocated Data Blocks: 18446744073709551612 # ULLONG_MAX - 3 Inner Struct Count: tree: 1(0), node: 0 Step 2: Create files and write data to trigger overflow # touch /mnt/f2fs_test/{1,2,3,4}.txt; sync # cat /sys/kernel/debug/f2fs/status | grep -A 4 "Block Age" Allocated Data Blocks: 18446744073709551613 # ULLONG_MAX - 2 Inner Struct Count: tree: 5(0), node: 1 # dd if=/dev/urandom of=/mnt/f2fs_test/1.txt bs=4K count=1; sync # cat /sys/kernel/debug/f2fs/status | grep -A 4 "Block Age" Allocated Data Blocks: 18446744073709551614 # ULLONG_MAX - 1 Inner Struct Count: tree: 5(0), node: 2 # dd if=/dev/urandom of=/mnt/f2fs_test/2.txt bs=4K count=1; sync # cat /sys/kernel/debug/f2fs/status | grep -A 4 "Block Age" Allocated Data Blocks: 18446744073709551615 # ULLONG_MAX Inner Struct Count: tree: 5(0), node: 3 # dd if=/dev/urandom of=/mnt/f2fs_test/3.txt bs=4K count=1; sync # cat /sys/kernel/debug/f2fs/status | grep -A 4 "Block Age" Allocated Data Blocks: 0 # Counter overflowed! Inner Struct Count: tree: 5(0), node: 4 Step 3: Trigger the bug - next write should create node but gets skipped # dd if=/dev/urandom of=/mnt/f2fs_test/4.txt bs=4K count=1; sync # cat /sys/kernel/debug/f2fs/status | grep -A 4 "Block Age" Allocated Data Blocks: 1 Inner Struct Count: tree: 5(0), node: 4 Expected: node: 5 (new extent node for 4.txt) Actual: node: 4 (extent insertion was incorrectly skipped due to last_blocks = allocated_data_blocks = 0 in __get_new_block_age) After this fix, the extent node is correctly inserted and node count becomes 5 as expected. Fixes: 71644dff4811 ("f2fs: add block_age-based extent cache") Cc: stable@kernel.org Signed-off-by: Xiaole He Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f37981edcd06cd552c15c153c3202a6b2fa450e4 Author: Nikola Z. Ivanov Date: Wed Nov 5 13:09:43 2025 +0200 f2fs: Add sanity checks before unlinking and loading inodes Add check for inode->i_nlink == 1 for directories during unlink, as their value is decremented twice, which can trigger a warning in drop_nlink. In such case mark the filesystem as corrupted and return from the function call with the relevant failure return value. Additionally add the check for i_nlink == 1 in sanity_check_inode in order to detect on-disk corruption early. Reported-by: syzbot+c07d47c7bc68f47b9083@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c07d47c7bc68f47b9083 Tested-by: syzbot+c07d47c7bc68f47b9083@syzkaller.appspotmail.com Signed-off-by: Nikola Z. Ivanov Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9b3c8336c633ca11778a1ff42b7c37b0563e6430 Author: Nikola Z. Ivanov Date: Wed Nov 5 13:09:42 2025 +0200 f2fs: Rename f2fs_unlink exit label Rename "fail" label to "out" as it's used as a default exit path out of f2fs_unlink as well as error path. Signed-off-by: Nikola Z. Ivanov Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d8bdf7856e17b31263bcd37d60903ee36bd2f857 Author: Yongpeng Yang Date: Fri Oct 24 22:37:46 2025 +0800 f2fs: ensure minimum trim granularity accounts for all devices When F2FS uses multiple block devices, each device may have a different discard granularity. The minimum trim granularity must be at least the maximum discard granularity of all devices, excluding zoned devices. Use max_t instead of the max() macro to compute the maximum value. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 392711ef18bff524a873b9c239a73148c5432262 Author: Xiaole He Date: Wed Oct 29 13:18:07 2025 +0800 f2fs: fix uninitialized one_time_gc in victim_sel_policy The one_time_gc field in struct victim_sel_policy is conditionally initialized but unconditionally read, leading to undefined behavior that triggers UBSAN warnings. In f2fs_get_victim() at fs/f2fs/gc.c:774, the victim_sel_policy structure is declared without initialization: struct victim_sel_policy p; The field p.one_time_gc is only assigned when the 'one_time' parameter is true (line 789): if (one_time) { p.one_time_gc = one_time; ... } However, this field is unconditionally read in subsequent get_gc_cost() at line 395: if (p->one_time_gc && (valid_thresh_ratio < 100) && ...) When one_time is false, p.one_time_gc contains uninitialized stack memory. Hence p.one_time_gc is an invalid bool value. UBSAN detects this invalid bool value: UBSAN: invalid-load in fs/f2fs/gc.c:395:7 load of value 77 is not a valid value for type '_Bool' CPU: 3 UID: 0 PID: 1297 Comm: f2fs_gc-252:16 Not tainted 6.18.0-rc3 #5 PREEMPT(voluntary) Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x70/0x90 dump_stack+0x14/0x20 __ubsan_handle_load_invalid_value+0xb3/0xf0 ? dl_server_update+0x2e/0x40 ? update_curr+0x147/0x170 f2fs_get_victim.cold+0x66/0x134 [f2fs] ? sched_balance_newidle+0x2ca/0x470 ? finish_task_switch.isra.0+0x8d/0x2a0 f2fs_gc+0x2ba/0x8e0 [f2fs] ? _raw_spin_unlock_irqrestore+0x12/0x40 ? __timer_delete_sync+0x80/0xe0 ? timer_delete_sync+0x14/0x20 ? schedule_timeout+0x82/0x100 gc_thread_func+0x38b/0x860 [f2fs] ? gc_thread_func+0x38b/0x860 [f2fs] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0x10b/0x220 ? __pfx_gc_thread_func+0x10/0x10 [f2fs] ? _raw_spin_unlock_irq+0x12/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x11a/0x160 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 This issue is reliably reproducible with the following steps on a 100GB SSD /dev/vdb: mkfs.f2fs -f /dev/vdb mount /dev/vdb /mnt/f2fs_test fio --name=gc --directory=/mnt/f2fs_test --rw=randwrite \ --bs=4k --size=8G --numjobs=12 --fsync=4 --runtime=10 \ --time_based echo 1 > /sys/fs/f2fs/vdb/gc_urgent The uninitialized value causes incorrect GC victim selection, leading to unpredictable garbage collection behavior. Fix by zero-initializing the entire victim_sel_policy structure to ensure all fields have defined values. Fixes: e791d00bd06c ("f2fs: add valid block ratio not to do excessive GC for one time GC") Cc: stable@kernel.org Signed-off-by: Xiaole He Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5b5578c3b06eba4c256bc3a2788f5a65cd9f31ea Author: Chao Yu Date: Wed Oct 29 14:31:04 2025 +0800 f2fs: fix to access i_size w/ i_size_read() It recommends to use i_size_{read,write}() to access and update i_size, otherwise, we may get wrong tearing value due to high 32-bits value and low 32-bits value of i_size field are not updated atomically in 32-bits archicture machine. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 297baa4aa263ff8f5b3d246ee16a660d76aa82c4 Author: Jan Prusakowski Date: Mon Oct 6 10:46:15 2025 +0200 f2fs: ensure node page reads complete before f2fs_put_super() finishes Xfstests generic/335, generic/336 sometimes crash with the following message: F2FS-fs (dm-0): detect filesystem reference count leak during umount, type: 9, count: 1 ------------[ cut here ]------------ kernel BUG at fs/f2fs/super.c:1939! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 609351 Comm: umount Tainted: G W 6.17.0-rc5-xfstests-g9dd1835ecda5 #1 PREEMPT(none) Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_put_super+0x3b3/0x3c0 Call Trace: generic_shutdown_super+0x7e/0x190 kill_block_super+0x1a/0x40 kill_f2fs_super+0x9d/0x190 deactivate_locked_super+0x30/0xb0 cleanup_mnt+0xba/0x150 task_work_run+0x5c/0xa0 exit_to_user_mode_loop+0xb7/0xc0 do_syscall_64+0x1ae/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ---[ end trace 0000000000000000 ]--- It appears that sometimes it is possible that f2fs_put_super() is called before all node page reads are completed. Adding a call to f2fs_wait_on_all_pages() for F2FS_RD_NODE fixes the problem. Cc: stable@kernel.org Fixes: 20872584b8c0b ("f2fs: fix to drop all dirty meta/node pages during umount()") Signed-off-by: Jan Prusakowski Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 196c81fdd438f7ac429d5639090a9816abb9760a Author: Chao Yu Date: Mon Oct 27 14:35:34 2025 +0800 f2fs: block cache/dio write during f2fs_enable_checkpoint() If there are too many background IOs during f2fs_enable_checkpoint(), sync_inodes_sb() may be blocked for long time due to it will loop to write dirty datas which are generated by in parallel write() continuously. Let's change as below to resolve this issue: - hold cp_enable_rwsem write lock to block any cache/dio write - decrease DEF_ENABLE_INTERVAL from 16 to 5 In addition, dump more logs during f2fs_enable_checkpoint(). Testcase: 1. fill data into filesystem until 90% usage. 2. mount -o remount,checkpoint=disable:10% /data 3. fio --rw=randwrite --bs=4kb --size=1GB --numjobs=10 \ --iodepth=64 --ioengine=psync --time_based --runtime=600 \ --directory=/data/fio_dir/ & 4. mount -o remount,checkpoint=enable /data Before: F2FS-fs (dm-51): f2fs_enable_checkpoint() finishes, writeback:7232, sync:39793, cp:457 After: F2FS-fs (dm-51): f2fs_enable_checkpoint end, writeback:5032, lock:0, sync_inode:5552, sync_fs:84 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit be112e7449a6e1b54aa9feac618825d154b3a5c7 Author: Chao Yu Date: Mon Oct 27 14:35:33 2025 +0800 f2fs: fix to propagate error from f2fs_enable_checkpoint() In order to let userspace detect such error rather than suffering silent failure. Fixes: 4354994f097d ("f2fs: checkpoint disabling") Cc: stable@kernel.org Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 89c16629e3136f0972dfa270d9318f07fa1c4053 Author: Yongpeng Yang Date: Mon Oct 27 20:55:43 2025 +0800 f2fs: change the unlock parameter of f2fs_put_page to bool Change the type of the unlock parameter of f2fs_put_page to bool. All callers should consistently pass true or false. No logical change. Signed-off-by: Yongpeng Yang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d33f89b34aa313f50f9a512d58dd288999f246b0 Author: Deepanshu Kartikey Date: Mon Oct 27 18:36:34 2025 +0530 f2fs: invalidate dentry cache on failed whiteout creation F2FS can mount filesystems with corrupted directory depth values that get runtime-clamped to MAX_DIR_HASH_DEPTH. When RENAME_WHITEOUT operations are performed on such directories, f2fs_rename performs directory modifications (updating target entry and deleting source entry) before attempting to add the whiteout entry via f2fs_add_link. If f2fs_add_link fails due to the corrupted directory structure, the function returns an error to VFS, but the partial directory modifications have already been committed to disk. VFS assumes the entire rename operation failed and does not update the dentry cache, leaving stale mappings. In the error path, VFS does not call d_move() to update the dentry cache. This results in new_dentry still pointing to the old inode (new_inode) which has already had its i_nlink decremented to zero. The stale cache causes subsequent operations to incorrectly reference the freed inode. This causes subsequent operations to use cached dentry information that no longer matches the on-disk state. When a second rename targets the same entry, VFS attempts to decrement i_nlink on the stale inode, which may already have i_nlink=0, triggering a WARNING in drop_nlink(). Example sequence: 1. First rename (RENAME_WHITEOUT): file2 → file1 - f2fs updates file1 entry on disk (points to inode 8) - f2fs deletes file2 entry on disk - f2fs_add_link(whiteout) fails (corrupted directory) - Returns error to VFS - VFS does not call d_move() due to error - VFS cache still has: file1 → inode 7 (stale!) - inode 7 has i_nlink=0 (already decremented) 2. Second rename: file3 → file1 - VFS uses stale cache: file1 → inode 7 - Tries to drop_nlink on inode 7 (i_nlink already 0) - WARNING in drop_nlink() Fix this by explicitly invalidating old_dentry and new_dentry when f2fs_add_link fails during whiteout creation. This forces VFS to refresh from disk on subsequent operations, ensuring cache consistency even when the rename partially succeeds. Reproducer: 1. Mount F2FS image with corrupted i_current_depth 2. renameat2(file2, file1, RENAME_WHITEOUT) 3. renameat2(file3, file1, 0) 4. System triggers WARNING in drop_nlink() Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Reported-by: syzbot+632cf32276a9a564188d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=632cf32276a9a564188d Suggested-by: Chao Yu Link: https://lore.kernel.org/all/20251022233349.102728-1-kartikey406@gmail.com/ [v1] Cc: stable@vger.kernel.org Signed-off-by: Deepanshu Kartikey Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1f27ef42bb0b7c0740c5616ec577ec188b8a1d05 Author: Chao Yu Date: Tue Oct 21 11:48:56 2025 +0800 f2fs: use global inline_xattr_slab instead of per-sb slab cache As Hong Yun reported in mailing list: loop7: detected capacity change from 0 to 131072 ------------[ cut here ]------------ kmem_cache of name 'f2fs_xattr_entry-7:7' already exists WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 kmem_cache_sanity_check mm/slab_common.c:109 [inline] WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 __kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307 CPU: 0 UID: 0 PID: 24426 Comm: syz.7.1370 Not tainted 6.17.0-rc4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:109 [inline] RIP: 0010:__kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307 Call Trace:  __kmem_cache_create include/linux/slab.h:353 [inline]  f2fs_kmem_cache_create fs/f2fs/f2fs.h:2943 [inline]  f2fs_init_xattr_caches+0xa5/0xe0 fs/f2fs/xattr.c:843  f2fs_fill_super+0x1645/0x2620 fs/f2fs/super.c:4918  get_tree_bdev_flags+0x1fb/0x260 fs/super.c:1692  vfs_get_tree+0x43/0x140 fs/super.c:1815  do_new_mount+0x201/0x550 fs/namespace.c:3808  do_mount fs/namespace.c:4136 [inline]  __do_sys_mount fs/namespace.c:4347 [inline]  __se_sys_mount+0x298/0x2f0 fs/namespace.c:4324  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0x8e/0x3a0 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x76/0x7e The bug can be reproduced w/ below scripts: - mount /dev/vdb /mnt1 - mount /dev/vdc /mnt2 - umount /mnt1 - mounnt /dev/vdb /mnt1 The reason is if we created two slab caches, named f2fs_xattr_entry-7:3 and f2fs_xattr_entry-7:7, and they have the same slab size. Actually, slab system will only create one slab cache core structure which has slab name of "f2fs_xattr_entry-7:3", and two slab caches share the same structure and cache address. So, if we destroy f2fs_xattr_entry-7:3 cache w/ cache address, it will decrease reference count of slab cache, rather than release slab cache entirely, since there is one more user has referenced the cache. Then, if we try to create slab cache w/ name "f2fs_xattr_entry-7:3" again, slab system will find that there is existed cache which has the same name and trigger the warning. Let's changes to use global inline_xattr_slab instead of per-sb slab cache for fixing. Fixes: a999150f4fe3 ("f2fs: use kmem_cache pool during inline xattr lookups") Cc: stable@kernel.org Reported-by: Hong Yun Tested-by: Hong Yun Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 10b591e7fb7cdc8c1e53e9c000dc0ef7069aaa76 Author: Chao Yu Date: Wed Oct 22 11:06:36 2025 +0800 f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng reported a bug as below: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 Not tainted 6.17.0 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:f2fs_all_cluster_page_ready+0x106/0x550 fs/f2fs/compress.c:857 Call Trace: f2fs_write_cache_pages fs/f2fs/data.c:3078 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3290 [inline] f2fs_write_data_pages+0x1c19/0x3600 fs/f2fs/data.c:3317 do_writepages+0x38e/0x640 mm/page-writeback.c:2634 filemap_fdatawrite_wbc mm/filemap.c:386 [inline] __filemap_fdatawrite_range mm/filemap.c:419 [inline] file_write_and_wait_range+0x2ba/0x3e0 mm/filemap.c:794 f2fs_do_sync_file+0x6e6/0x1b00 fs/f2fs/file.c:294 generic_write_sync include/linux/fs.h:3043 [inline] f2fs_file_write_iter+0x76e/0x2700 fs/f2fs/file.c:5259 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x7e9/0xe00 fs/read_write.c:686 ksys_write+0x19d/0x2d0 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf7/0x470 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The bug was triggered w/ below race condition: fsync setattr ioctl - f2fs_do_sync_file - file_write_and_wait_range - f2fs_write_cache_pages : inode is non-compressed : cc.cluster_size = F2FS_I(inode)->i_cluster_size = 0 - tag_pages_for_writeback - f2fs_setattr - truncate_setsize - f2fs_truncate - f2fs_fileattr_set - f2fs_setflags_common - set_compress_context : F2FS_I(inode)->i_cluster_size = 4 : set_inode_flag(inode, FI_COMPRESSED_FILE) - f2fs_compressed_file : return true - f2fs_all_cluster_page_ready : "pgidx % cc->cluster_size" trigger dividing 0 issue Let's change as below to fix this issue: - introduce a new atomic type variable .writeback in structure f2fs_inode_info to track the number of threads which calling f2fs_write_cache_pages(). - use .i_sem lock to protect .writeback update. - check .writeback before update compression context in f2fs_setflags_common() to avoid race w/ ->writepages. Fixes: 4c8ff7095bef ("f2fs: support data compression") Cc: stable@kernel.org Reported-by: Bai, Shuangpeng Tested-by: Bai, Shuangpeng Closes: https://lore.kernel.org/lkml/44D8F7B3-68AD-425F-9915-65D27591F93F@psu.edu Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7c37c79510329cd951a4dedf3f7bf7e2b18dccec Author: Chao Yu Date: Mon Oct 20 10:42:12 2025 +0800 f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678 Call Trace: f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline] f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030 vfs_fallocate+0x669/0x7e0 fs/open.c:342 ioctl_preallocate fs/ioctl.c:289 [inline] file_ioctl+0x611/0x780 fs/ioctl.c:-1 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576 __do_sys_ioctl fs/ioctl.c:595 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f07bc58eec9 In error path of f2fs_zero_range(), it may add a zero-sized extent into extent cache, it should be avoided. Fixes: 6e9619499f53 ("f2fs: support in batch fzero in dnode page") Cc: stable@kernel.org Reported-by: syzbot+24124df3170c3638b35f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68e5d698.050a0220.256323.0032.GAE@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ca8b201f28547e28343a6f00a6e91fa8c09572fe Author: Chao Yu Date: Tue Oct 14 19:47:35 2025 +0800 f2fs: fix to avoid potential deadlock As Jiaming Zhang and syzbot reported, there is potential deadlock in f2fs as below: Chain exists of: &sbi->cp_rwsem --> fs_reclaim --> sb_internal#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(sb_internal#2); lock(fs_reclaim); lock(sb_internal#2); rlock(&sbi->cp_rwsem); *** DEADLOCK *** 3 locks held by kswapd0/73: #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline] #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389 #1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline] #1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197 #2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890 stack backtrace: CPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537 f2fs_down_read fs/f2fs/f2fs.h:2278 [inline] f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline] f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791 f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867 f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925 f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897 evict+0x504/0x9c0 fs/inode.c:810 f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853 evict+0x504/0x9c0 fs/inode.c:810 dispose_list fs/inode.c:852 [inline] prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000 super_cache_scan+0x39b/0x4b0 fs/super.c:224 do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437 shrink_slab_memcg mm/shrinker.c:550 [inline] shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628 shrink_one+0x28a/0x7c0 mm/vmscan.c:4955 shrink_many mm/vmscan.c:5016 [inline] lru_gen_shrink_node mm/vmscan.c:5094 [inline] shrink_node+0x315d/0x3780 mm/vmscan.c:6081 kswapd_shrink_node mm/vmscan.c:6941 [inline] balance_pgdat mm/vmscan.c:7124 [inline] kswapd+0x147c/0x2800 mm/vmscan.c:7389 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The root cause is deadlock among four locks as below: kswapd - fs_reclaim --- Lock A - shrink_one - evict - f2fs_evict_inode - sb_start_intwrite --- Lock B - iput - evict - f2fs_evict_inode - sb_start_intwrite --- Lock B - f2fs_truncate - f2fs_truncate_blocks - f2fs_do_truncate_blocks - f2fs_lock_op --- Lock C ioctl - f2fs_ioc_commit_atomic_write - f2fs_lock_op --- Lock C - __f2fs_commit_atomic_write - __replace_atomic_write_block - f2fs_get_dnode_of_data - __get_node_folio - f2fs_check_nid_range - f2fs_handle_error - f2fs_record_errors - f2fs_down_write --- Lock D open - do_open - do_truncate - security_inode_need_killpriv - f2fs_getxattr - lookup_all_xattrs - f2fs_handle_error - f2fs_record_errors - f2fs_down_write --- Lock D - f2fs_commit_super - read_mapping_folio - filemap_alloc_folio_noprof - prepare_alloc_pages - fs_reclaim_acquire --- Lock A In order to avoid such deadlock, we need to avoid grabbing sb_lock in f2fs_handle_error(), so, let's use asynchronous method instead: - remove f2fs_handle_error() implementation - rename f2fs_handle_error_async() to f2fs_handle_error() - spread f2fs_handle_error() Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock") Cc: stable@kernel.org Reported-by: syzbot+14b90e1156b9f6fc1266@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68eae49b.050a0220.ac43.0001.GAE@google.com Reported-by: Jiaming Zhang Closes: https://lore.kernel.org/lkml/CANypQFa-Gy9sD-N35o3PC+FystOWkNuN8pv6S75HLT0ga-Tzgw@mail.gmail.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c1cdb0048832e84549cd24964ba6bdd71d44a4ae Author: Chao Yu Date: Tue Oct 14 14:27:04 2025 +0800 f2fs: use f2fs_filemap_get_folio() to support fault injection Use f2fs_filemap_get_folio() instead of __filemap_get_folio() in: - f2fs_find_data_folio - f2fs_write_begin - f2fs_read_merkle_tree_page So that, we can trigger fault injection in those places. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e0b89d00ea9f846da42fc92f200c96254d0e2fef Author: Chao Yu Date: Tue Oct 14 14:27:03 2025 +0800 f2fs: use f2fs_filemap_get_folio() instead of f2fs_pagecache_get_page() Let's use f2fs_filemap_get_folio() instead of f2fs_pagecache_get_page() in ra_data_block() and move_data_block(), then remove f2fs_pagecache_get_page() since it has no user. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3b7e73ddc07f77eeb67474354b44ec7fed8e8b56 Author: Chao Yu Date: Tue Oct 14 14:27:02 2025 +0800 f2fs: convert add_ipu_page() to use folio No logic changes. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 28b68b2a3b2fae3789717ca9e306ae8f01269849 Author: Chao Yu Date: Tue Oct 14 14:27:01 2025 +0800 f2fs: clean up w/ bio_add_folio_nofail() In add_bio_entry(), adding a page to newly allocated bio should never fail, let's use bio_add_folio_nofail() instead of bio_add_page() & unnecessary error handling for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8f7aa3d3c7323f4ca2768a9e74ebbe359c4f8f88 Merge: 015e7b0b0e8e51 4de44542991ed4 Author: Linus Torvalds Date: Wed Dec 3 17:24:33 2025 -0800 Merge tag 'net-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core & protocols: - Replace busylock at the Tx queuing layer with a lockless list. Resulting in a 300% (4x) improvement on heavy TX workloads, sending twice the number of packets per second, for half the cpu cycles. - Allow constantly busy flows to migrate to a more suitable CPU/NIC queue. Normally we perform queue re-selection when flow comes out of idle, but under extreme circumstances the flows may be constantly busy. Add sysctl to allow periodic rehashing even if it'd risk packet reordering. - Optimize the NAPI skb cache, make it larger, use it in more paths. - Attempt returning Tx skbs to the originating CPU (like we already did for Rx skbs). - Various data structure layout and prefetch optimizations from Eric. - Remove ktime_get() from the recvmsg() fast path, ktime_get() is sadly quite expensive on recent AMD machines. - Extend threaded NAPI polling to allow the kthread busy poll for packets. - Make MPTCP use Rx backlog processing. This lowers the lock pressure, improving the Rx performance. - Support memcg accounting of MPTCP socket memory. - Allow admin to opt sockets out of global protocol memory accounting (using a sysctl or BPF-based policy). The global limits are a poor fit for modern container workloads, where limits are imposed using cgroups. - Improve heuristics for when to kick off AF_UNIX garbage collection. - Allow users to control TCP SACK compression, and default to 33% of RTT. - Add tcp_rcvbuf_low_rtt sysctl to let datacenter users avoid unnecessarily aggressive rcvbuf growth and overshot when the connection RTT is low. - Preserve skb metadata space across skb_push / skb_pull operations. - Support for IPIP encapsulation in the nftables flowtable offload. - Support appending IP interface information to ICMP messages (RFC 5837). - Support setting max record size in TLS (RFC 8449). - Remove taking rtnl_lock from RTM_GETNEIGHTBL and RTM_SETNEIGHTBL. - Use a dedicated lock (and RCU) in MPLS, instead of rtnl_lock. - Let users configure the number of write buffers in SMC. - Add new struct sockaddr_unsized for sockaddr of unknown length, from Kees. - Some conversions away from the crypto_ahash API, from Eric Biggers. - Some preparations for slimming down struct page. - YAML Netlink protocol spec for WireGuard. - Add a tool on top of YAML Netlink specs/lib for reporting commonly computed derived statistics and summarized system state. Driver API: - Add CAN XL support to the CAN Netlink interface. - Add uAPI for reporting PHY Mean Square Error (MSE) diagnostics, as defined by the OPEN Alliance's "Advanced diagnostic features for 100BASE-T1 automotive Ethernet PHYs" specification. - Add DPLL phase-adjust-gran pin attribute (and implement it in zl3073x). - Refactor xfrm_input lock to reduce contention when NIC offloads IPsec and performs RSS. - Add info to devlink params whether the current setting is the default or a user override. Allow resetting back to default. - Add standard device stats for PSP crypto offload. - Leverage DSA frame broadcast to implement simple HSR frame duplication for a lot of switches without dedicated HSR offload. - Add uAPI defines for 1.6Tbps link modes. Device drivers: - Add Motorcomm YT921x gigabit Ethernet switch support. - Add MUCSE driver for N500/N210 1GbE NIC series. - Convert drivers to support dedicated ops for timestamping control, and away from the direct IOCTL handling. While at it support GET operations for PHY timestamping. - Add (and convert most drivers to) a dedicated ethtool callback for reading the Rx ring count. - Significant refactoring efforts in the STMMAC driver, which supports Synopsys turn-key MAC IP integrated into a ton of SoCs. - Ethernet high-speed NICs: - Broadcom (bnxt): - support PPS in/out on all pins - Intel (100G, ice, idpf): - ice: implement standard ethtool and timestamping stats - i40e: support setting the max number of MAC addresses per VF - iavf: support RSS of GTP tunnels for 5G and LTE deployments - nVidia/Mellanox (mlx5): - reduce downtime on interface reconfiguration - disable being an XDP redirect target by default (same as other drivers) to avoid wasting resources if feature is unused - Meta (fbnic): - add support for Linux-managed PCS on 25G, 50G, and 100G links - Wangxun: - support Rx descriptor merge, and Tx head writeback - support Rx coalescing offload - support 25G SPF and 40G QSFP modules - Ethernet virtual: - Google (gve): - allow ethtool to configure rx_buf_len - implement XDP HW RX Timestamping support for DQ descriptor format - Microsoft vNIC (mana): - support HW link state events - handle hardware recovery events when probing the device - Ethernet NICs consumer, and embedded: - usbnet: add support for Byte Queue Limits (BQL) - AMD (amd-xgbe): - add device selftests - NXP (enetc): - add i.MX94 support - Broadcom integrated MACs (bcmgenet, bcmasp): - bcmasp: add support for PHY-based Wake-on-LAN - Broadcom switches (b53): - support port isolation - support BCM5389/97/98 and BCM63XX ARL formats - Lantiq/MaxLinear switches: - support bridge FDB entries on the CPU port - use regmap for register access - allow user to enable/disable learning - support Energy Efficient Ethernet - support configuring RMII clock delays - add tagging driver for MaxLinear GSW1xx switches - Synopsys (stmmac): - support using the HW clock in free running mode - add Eswin EIC7700 support - add Rockchip RK3506 support - add Altera Agilex5 support - Cadence (macb): - cleanup and consolidate descriptor and DMA address handling - add EyeQ5 support - TI: - icssg-prueth: support AF_XDP - Airoha access points: - add missing Ethernet stats and link state callback - add AN7583 support - support out-of-order Tx completion processing - Power over Ethernet: - pd692x0: preserve PSE configuration across reboots - add support for TPS23881B devices - Ethernet PHYs: - Open Alliance OATC14 10BASE-T1S PHY cable diagnostic support - Support 50G SerDes and 100G interfaces in Linux-managed PHYs - micrel: - support for non PTP SKUs of lan8814 - enable in-band auto-negotiation on lan8814 - realtek: - cable testing support on RTL8224 - interrupt support on RTL8221B - motorcomm: support for PHY LEDs on YT853 - microchip: support for LAN867X Rev.D0 PHYs w/ SQI and cable diag - mscc: support for PHY LED control - CAN drivers: - m_can: add support for optional reset and system wake up - remove can_change_mtu() obsoleted by core handling - mcp251xfd: support GPIO controller functionality - Bluetooth: - add initial support for PASTa - WiFi: - split ieee80211.h file, it's way too big - improvements in VHT radiotap reporting, S1G, Channel Switch Announcement handling, rate tracking in mesh networks - improve multi-radio monitor mode support, and add a cfg80211 debugfs interface for it - HT action frame handling on 6 GHz - initial chanctx work towards NAN - MU-MIMO sniffer improvements - WiFi drivers: - RealTek (rtw89): - support USB devices RTL8852AU and RTL8852CU - initial work for RTL8922DE - improved injection support - Intel: - iwlwifi: new sniffer API support - MediaTek (mt76): - WED support for >32-bit DMA - airoha NPU support - regdomain improvements - continued WiFi7/MLO work - Qualcomm/Atheros: - ath10k: factory test support - ath11k: TX power insertion support - ath12k: BSS color change support - ath12k: statistics improvements - brcmfmac: Acer A1 840 tablet quirk - rtl8xxxu: 40 MHz connection fixes/support" * tag 'net-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1381 commits) net: page_pool: sanitise allocation order net: page pool: xa init with destroy on pp init net/mlx5e: Support XDP target xmit with dummy program net/mlx5e: Update XDP features in switch channels selftests/tc-testing: Test CAKE scheduler when enqueue drops packets net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop wireguard: netlink: generate netlink code wireguard: uapi: generate header with ynl-gen wireguard: uapi: move flag enums wireguard: uapi: move enum wg_cmd wireguard: netlink: add YNL specification selftests: drv-net: Fix tolerance calculation in devlink_rate_tc_bw.py selftests: drv-net: Fix and clarify TC bandwidth split in devlink_rate_tc_bw.py selftests: drv-net: Set shell=True for sysfs writes in devlink_rate_tc_bw.py selftests: drv-net: Use Iperf3Runner in devlink_rate_tc_bw.py selftests: drv-net: introduce Iperf3Runner for measurement use cases selftests: drv-net: Add devlink_rate_tc_bw.py to TEST_PROGS net: ps3_gelic_net: Use napi_alloc_skb() and napi_gro_receive() Documentation: net: dsa: mention simple HSR offload helpers Documentation: net: dsa: mention availability of RedBox ... commit 015e7b0b0e8e51f7321ec2aafc1d7fc0a8a5536f Merge: b6d993310a65b9 ff34657aa72a4d Author: Linus Torvalds Date: Wed Dec 3 16:54:54 2025 -0800 Merge tag 'bpf-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Convert selftests/bpf/test_tc_edt and test_tc_tunnel from .sh to test_progs runner (Alexis Lothoré) - Convert selftests/bpf/test_xsk to test_progs runner (Bastien Curutchet) - Replace bpf memory allocator with kmalloc_nolock() in bpf_local_storage (Amery Hung), and in bpf streams and range tree (Puranjay Mohan) - Introduce support for indirect jumps in BPF verifier and x86 JIT (Anton Protopopov) and arm64 JIT (Puranjay Mohan) - Remove runqslower bpf tool (Hoyeon Lee) - Fix corner cases in the verifier to close several syzbot reports (Eduard Zingerman, KaFai Wan) - Several improvements in deadlock detection in rqspinlock (Kumar Kartikeya Dwivedi) - Implement "jmp" mode for BPF trampoline and corresponding DYNAMIC_FTRACE_WITH_JMP. It improves "fexit" program type performance from 80 M/s to 136 M/s. With Steven's Ack. (Menglong Dong) - Add ability to test non-linear skbs in BPF_PROG_TEST_RUN (Paul Chaignon) - Do not let BPF_PROG_TEST_RUN emit invalid GSO types to stack (Daniel Borkmann) - Generalize buildid reader into bpf_dynptr (Mykyta Yatsenko) - Optimize bpf_map_update_elem() for map-in-map types (Ritesh Oedayrajsingh Varma) - Introduce overwrite mode for BPF ring buffer (Xu Kuohai) * tag 'bpf-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (169 commits) bpf: optimize bpf_map_update_elem() for map-in-map types bpf: make kprobe_multi_link_prog_run always_inline selftests/bpf: do not hardcode target rate in test_tc_edt BPF program selftests/bpf: remove test_tc_edt.sh selftests/bpf: integrate test_tc_edt into test_progs selftests/bpf: rename test_tc_edt.bpf.c section to expose program type selftests/bpf: Add success stats to rqspinlock stress test rqspinlock: Precede non-head waiter queueing with AA check rqspinlock: Disable spinning for trylock fallback rqspinlock: Use trylock fallback when per-CPU rqnode is busy rqspinlock: Perform AA checks immediately rqspinlock: Enclose lock/unlock within lock entry acquisitions bpf: Remove runqslower tool selftests/bpf: Remove usage of lsm/file_alloc_security in selftest bpf: Disable file_alloc_security hook bpf: check for insn arrays in check_ptr_alignment bpf: force BPF_F_RDONLY_PROG on insn array creation bpf: Fix exclusive map memory leak selftests/bpf: Make CS length configurable for rqspinlock stress test selftests/bpf: Add lock wait time stats to rqspinlock stress test ... commit b6d993310a65b994f37e3347419d9ed398ee37a3 Merge: 2488655b2f6b9d 7bc16e72ddb993 Author: Linus Torvalds Date: Wed Dec 3 15:50:11 2025 -0800 Merge tag 'linux_kselftest-kunit-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: - Make filter parameters configurable via Kconfig - Add description of kunit.enable parameter to documentation * tag 'linux_kselftest-kunit-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Make filter parameters configurable via Kconfig Documentation: kunit: add description of kunit.enable parameter commit d3042cbe84a060b4df764eb6c5300bbe20d125ca Author: Steven Rostedt Date: Wed Dec 3 18:09:24 2025 -0500 ktest.pl: Fix uninitialized var in config-bisect.pl The error path of copying the old config used the wrong variable in the error message: $ mkdir /tmp/build $ ./tools/testing/ktest/config-bisect.pl -b /tmp/build config-good /tmp/config-bad $ chmod 0 /tmp/build $ ./tools/testing/ktest/config-bisect.pl -b /tmp/build config-good /tmp/config-bad good cp /tmp/build//.config config-good.tmp ... [0 seconds] FAILED! Use of uninitialized value $config in concatenation (.) or string at ./tools/testing/ktest/config-bisect.pl line 744. failed to copy to config-good.tmp When it should have shown: failed to copy /tmp/build//.config to config-good.tmp Cc: stable@vger.kernel.org Cc: John 'Warthog9' Hawley Fixes: 0f0db065999cf ("ktest: Add standalone config-bisect.pl program") Link: https://patch.msgid.link/20251203180924.6862bd26@gandalf.local.home Reported-by: "John W. Krahn" Signed-off-by: Steven Rostedt commit 9dc966799ac9a2573d970080334a801fcc283a1b Author: Ali Tariq Date: Sun Oct 26 11:42:40 2025 +0000 pinctrl: starfive: use dynamic GPIO base allocation The JH7110 pinctrl driver currently sets a static GPIO base number from platform data: sfp->gc.base = info->gc_base; Static base assignment is deprecated and results in the following warning: gpio gpiochip0: Static allocation of GPIO base is deprecated, use dynamic allocation. Set `sfp->gc.base = -1` to let the GPIO core dynamically allocate the base number. This removes the warning and aligns the driver with current GPIO guidelines. Since the GPIO base is now allocated dynamically, remove `gc_base` field in `struct jh7110_pinctrl_soc_info` and the associated `JH7110_SYS_GC_BASE` and `JH7110_AON_GC_BASE` constants as they are no longer used anywhere in the driver. Tested on VisionFive 2 (JH7110 SoC). Signed-off-by: Ali Tariq Reviewed-by: Emil Renner Berthing Reviewed-by: Bartosz Golaszewski Signed-off-by: Linus Walleij commit 61d1bb53547d42c6bdaec9da4496beb3a1a05264 Author: Haotian Zhang Date: Wed Dec 3 14:13:47 2025 +0800 pinctrl: single: Fix incorrect type for error return variable pcs_pinconf_get() and pcs_pinconf_set() declare ret as unsigned int, but assign it the return values of pcs_get_function() that may return negative error codes. This causes negative error codes to be converted to large positive values. Change ret from unsigned int to int in both functions. Fixes: 9dddb4df90d1 ("pinctrl: single: support generic pinconf") Signed-off-by: Haotian Zhang Signed-off-by: Linus Walleij commit 2488655b2f6b9d7d4afc19ecc1e7b1dccd67b13c Merge: 2ddcf4962c1834 a2f7990d330937 Author: Linus Torvalds Date: Wed Dec 3 15:08:18 2025 -0800 Merge tag 'linux_kselftest-next-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - Add basic test for trace_marker_raw file to tracing selftest - Fix invalid array access in printf dma_map_benchmark selftest - Add tprobe enable/disable testcase to tracing selftest - Update fprobe selftest for ftrace based fprobe * tag 'linux_kselftest-next-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: tracing: Update fprobe selftest for ftrace based fprobe selftests: tracing: Add tprobe enable/disable testcase selftests/run_kselftest.sh: exit with error if tests fail selftests/dma: fix invalid array access in printf selftests/tracing: Add basic test for trace_marker_raw file commit 2ddcf4962c1834a14340a1f50afafc3276c015bd Merge: 784faa8eca8270 2a9c8c0b59d366 Author: Linus Torvalds Date: Wed Dec 3 14:42:21 2025 -0800 Merge tag 'kbuild-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild updates from Nicolas Schier: - Enable -fms-extensions, allowing anonymous use of tagged struct or union in struct/union (tag kbuild-ms-extensions-6.19). An exemplary conversion patch is added here, too (btrfs). [ Editor's note: the core of this actually came in early through a shared branch and a few other trees - Linus ] - Introduce architecture-specific CC_CAN_LINK and flags for userprogs - Add new packaging target 'modules-cpio-pkg' for building a initramfs cpio w/ kmods - Handle included .c files in gen_compile_commands - Minor kbuild changes: - Use objtree for module signing key path, fixing oot kmod signing - Improve documentation of KBUILD_BUILD_TIMESTAMP - Reuse KBUILD_USERCFLAGS for UAPI, instead of defining twice - Rename scripts/Makefile.extrawarn to Makefile.warn - Drop obsolete types.h check from headers_check.pl - Remove outdated config leak ignore entries * tag 'kbuild-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: add target to build a cpio containing modules initramfs: add gen_init_cpio to hostprogs unconditionally kbuild: allow architectures to override CC_CAN_LINK init: deduplicate cc-can-link.sh invocations kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings scripts: headers_install.sh: Remove two outdated config leak ignore entries scripts/clang-tools: Handle included .c files in gen_compile_commands kbuild: uapi: Drop types.h check from headers_check.pl kbuild: Rename Makefile.extrawarn to Makefile.warn MAINTAINERS, .mailmap: Update mail address for Nicolas Schier kbuild: uapi: reuse KBUILD_USERCFLAGS kbuild: doc: improve KBUILD_BUILD_TIMESTAMP documentation kbuild: Use objtree for module signing key path btrfs: send: make use of -fms-extensions for defining struct fs_path commit 784faa8eca8270671e0ed6d9d21f04bbb80fc5f7 Merge: 51ab33fc0a8bef 54e3eae8556297 Author: Linus Torvalds Date: Wed Dec 3 14:16:49 2025 -0800 Merge tag 'rust-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Add support for 'syn'. Syn is a parsing library for parsing a stream of Rust tokens into a syntax tree of Rust source code. Currently this library is geared toward use in Rust procedural macros, but contains some APIs that may be useful more generally. 'syn' allows us to greatly simplify writing complex macros such as 'pin-init' (Benno has already prepared the 'syn'-based version). We will use it in the 'macros' crate too. 'syn' is the most downloaded Rust crate (according to crates.io), and it is also used by the Rust compiler itself. While the amount of code is substantial, there should not be many updates needed for these crates, and even if there are, they should not be too big, e.g. +7k -3k lines across the 3 crates in the last year. 'syn' requires two smaller dependencies: 'quote' and 'proc-macro2'. I only modified their code to remove a third dependency ('unicode-ident') and to add the SPDX identifiers. The code can be easily verified to exactly match upstream with the provided scripts. They are all licensed under "Apache-2.0 OR MIT", like the other vendored 'alloc' crate we had for a while. Please see the merge commit with the cover letter for more context. - Allow 'unreachable_pub' and 'clippy::disallowed_names' for doctests. Examples (i.e. doctests) may want to do things like show public items and use names such as 'foo'. Nevertheless, we still try to keep examples as close to real code as possible (this is part of why running Clippy on doctests is important for us, e.g. for safety comments, which userspace Rust does not support yet but we are stricter). 'kernel' crate: - Replace our custom 'CStr' type with 'core::ffi::CStr'. Using the standard library type reduces our custom code footprint, and we retain needed custom functionality through an extension trait and a new 'fmt!' macro which replaces the previous 'core' import. This started in 6.17 and continued in 6.18, and we finally land the replacement now. This required quite some stamina from Tamir, who split the changes in steps to prepare for the flag day change here. - Replace 'kernel::c_str!' with C string literals. C string literals were added in Rust 1.77, which produce '&CStr's (the 'core' one), so now we can write: c"hi" instead of: c_str!("hi") - Add 'num' module for numerical features. It includes the 'Integer' trait, implemented for all primitive integer types. It also includes the 'Bounded' integer wrapping type: an integer value that requires only the 'N' least significant bits of the wrapped type to be encoded: // An unsigned 8-bit integer, of which only the 4 LSBs are used. let v = Bounded::::new::<15>(); assert_eq!(v.get(), 15); 'Bounded' is useful to e.g. enforce guarantees when working with bitfields that have an arbitrary number of bits. Values can also be constructed from simple non-constant expressions or, for more complex ones, validated at runtime. 'Bounded' also comes with comparison and arithmetic operations (with both their backing type and other 'Bounded's with a compatible backing type), casts to change the backing type, extending/shrinking and infallible/fallible conversions from/to primitives as applicable. - 'rbtree' module: add immutable cursor ('Cursor'). It enables to use just an immutable tree reference where appropriate. The existing fully-featured mutable cursor is renamed to 'CursorMut'. kallsyms: - Fix wrong "big" kernel symbol type read from procfs. 'pin-init' crate: - A couple minor fixes (Benno asked me to pick these patches up for him this cycle). Documentation: - Quick Start guide: add Debian 13 (Trixie). Debian Stable is now able to build Linux, since Debian 13 (released 2025-08-09) packages Rust 1.85.0, which is recent enough. We are planning to propose that the minimum supported Rust version in Linux follows Debian Stable releases, with Debian 13 being the first one we upgrade to, i.e. Rust 1.85. MAINTAINERS: - Add entry for the new 'num' module. - Remove Alex as Rust maintainer: he hasn't had the time to contribute for a few years now, so it is a no-op change in practice. And a few other cleanups and improvements" * tag 'rust-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (53 commits) rust: macros: support `proc-macro2`, `quote` and `syn` rust: syn: enable support in kbuild rust: syn: add `README.md` rust: syn: remove `unicode-ident` dependency rust: syn: add SPDX License Identifiers rust: syn: import crate rust: quote: enable support in kbuild rust: quote: add `README.md` rust: quote: add SPDX License Identifiers rust: quote: import crate rust: proc-macro2: enable support in kbuild rust: proc-macro2: add `README.md` rust: proc-macro2: remove `unicode_ident` dependency rust: proc-macro2: add SPDX License Identifiers rust: proc-macro2: import crate rust: kbuild: support using libraries in `rustc_procmacro` rust: kbuild: support skipping flags in `rustc_test_library` rust: kbuild: add proc macro library support rust: kbuild: simplify `--cfg` handling rust: kbuild: introduce `core-flags` and `core-skip_flags` ... commit 51ab33fc0a8bef9454849371ef897a1241911b37 Merge: 02baaa67d9afc2 5cb5575308bce9 Author: Linus Torvalds Date: Wed Dec 3 13:46:48 2025 -0800 Merge tag 'livepatching-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Petr Mladek: - Support both paths where tracefs is typically mounted in selftests - Make old_sympos 0 and 1 equal. They both are valid when there is only one symbol with the given name. * tag 'livepatching-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: selftests: livepatch: use canonical ftrace path livepatch: Match old_sympos 0 and 1 in klp_find_func() commit 02baaa67d9afc2e56c6e1ac6a1fb1f1dd2be366f Merge: 8449d3252c2603 1dd6c84f1c544e Author: Linus Torvalds Date: Wed Dec 3 13:25:39 2025 -0800 Merge tag 'sched_ext-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - Improve recovery from misbehaving BPF schedulers. When a scheduler puts many tasks with varying affinity restrictions on a shared DSQ, CPUs scanning through tasks they cannot run can overwhelm the system, causing lockups. Bypass mode now uses per-CPU DSQs with a load balancer to avoid this, and hooks into the hardlockup detector to attempt recovery. Add scx_cpu0 example scheduler to demonstrate this scenario. - Add lockless peek operation for DSQs to reduce lock contention for schedulers that need to query queue state during load balancing. - Allow scx_bpf_reenqueue_local() to be called from anywhere in preparation for deprecating cpu_acquire/release() callbacks in favor of generic BPF hooks. - Prepare for hierarchical scheduler support: add scx_bpf_task_set_slice() and scx_bpf_task_set_dsq_vtime() kfuncs, make scx_bpf_dsq_insert*() return bool, and wrap kfunc args in structs for future aux__prog parameter. - Implement cgroup_set_idle() callback to notify BPF schedulers when a cgroup's idle state changes. - Fix migration tasks being incorrectly downgraded from stop_sched_class to rt_sched_class across sched_ext enable/disable. Applied late as the fix is low risk and the bug subtle but needs stable backporting. - Various fixes and cleanups including cgroup exit ordering, SCX_KICK_WAIT reliability, and backward compatibility improvements. * tag 'sched_ext-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (44 commits) sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks sched_ext: tools: Removing duplicate targets during non-cross compilation sched_ext: Use kvfree_rcu() to release per-cpu ksyncs object sched_ext: Pass locked CPU parameter to scx_hardlockup() and add docs sched_ext: Update comments replacing breather with aborting mechanism sched_ext: Implement load balancer for bypass mode sched_ext: Factor out abbreviated dispatch dequeue into dispatch_dequeue_locked() sched_ext: Factor out scx_dsq_list_node cursor initialization into INIT_DSQ_LIST_CURSOR sched_ext: Add scx_cpu0 example scheduler sched_ext: Hook up hardlockup detector sched_ext: Make handle_lockup() propagate scx_verror() result sched_ext: Refactor lockup handlers into handle_lockup() sched_ext: Make scx_exit() and scx_vexit() return bool sched_ext: Exit dispatch and move operations immediately when aborting sched_ext: Simplify breather mechanism with scx_aborting flag sched_ext: Use per-CPU DSQs instead of per-node global DSQs in bypass mode sched_ext: Refactor do_enqueue_task() local and global DSQ paths sched_ext: Use shorter slice in bypass mode sched_ext: Mark racy bitfields to prevent adding fields that can't tolerate races sched_ext: Minor cleanups to scx_task_iter ... commit 8449d3252c2603a51ffc7c36cb5bd94874378b7d Merge: 2b60145734a0e5 b1bcaed1e39a9e Author: Linus Torvalds Date: Wed Dec 3 13:04:07 2025 -0800 Merge tag 'cgroup-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Defer task cgroup unlink until after the dying task's final context switch so that controllers see the cgroup properly populated until the task is truly gone - cpuset cleanups and simplifications. Enforce that domain isolated CPUs stay in root or isolated partitions and fail if isolated+nohz_full would leave no housekeeping CPU. Fix sched/deadline root domain handling during CPU hot-unplug and race for tasks in attaching cpusets - Misc fixes including memory reclaim protection documentation and selftest KTAP conformance * tag 'cgroup-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (21 commits) cpuset: Treat cpusets in attaching as populated sched/deadline: Walk up cpuset hierarchy to decide root domain when hot-unplug cgroup/cpuset: Introduce cpuset_cpus_allowed_locked() docs: cgroup: No special handling of unpopulated memcgs docs: cgroup: Note about sibling relative reclaim protection docs: cgroup: Explain reclaim protection target selftests/cgroup: conform test to KTAP format output cpuset: remove need_rebuild_sched_domains cpuset: remove global remote_children list cpuset: simplify node setting on error cgroup: include missing header for struct irq_work cgroup: Fix sleeping from invalid context warning on PREEMPT_RT cgroup/cpuset: Globally track isolated_cpus update cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition cgroup/cpuset: Move up prstate_housekeeping_conflict() helper cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks() cgroup: Defer task cgroup unlink until after the task is done switching out cgroup: Move dying_tasks cleanup from cgroup_task_release() to cgroup_task_free() cgroup: Rename cgroup lifecycle hooks to cgroup_task_*() ... commit 09b71a58ee355ae09f302bd0875a29ffbcbbe3ac Author: Jarkko Sakkinen Date: Tue Sep 30 16:06:51 2025 +0300 KEYS: trusted: Use tpm_ret_to_err() in trusted_tpm2 Use tpm_ret_to_err() to transmute TPM return codes in trusted_tpm2. Signed-off-by: Jarkko Sakkinen Acked-by: Stefano Garzarella Signed-off-by: Jarkko Sakkinen commit 7fcf459ac84c42a4ef63a650dccc345602cf4da6 Author: Jarkko Sakkinen Date: Tue Sep 30 16:02:54 2025 +0300 tpm: Use -EPERM as fallback error code in tpm_ret_to_err Using -EFAULT as the tpm_ret_to_err() fallback error code causes makes it incompatible on how trusted keys transmute TPM return codes. Change the fallback as -EPERM in order to gain compatibility with trusted keys. In addition, map TPM_RC_HASH to -EINVAL in order to be compatible with tpm2_seal_trusted() return values. Signed-off-by: Jarkko Sakkinen Reviewed-by: Stefano Garzarella Signed-off-by: Jarkko Sakkinen commit faf07e611dfa464b201223a7253e9dc5ee0f3c9e Author: Jarkko Sakkinen Date: Tue Sep 30 15:58:02 2025 +0300 tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm. Cc: stable@vger.kernel.org # v5.10+ Fixes: bcfff8384f6c ("tpm: dynamically allocate the allocated_banks array") Tested-by: Lai Yi Reviewed-by: Jonathan McDowell Reviewed-by: Roberto Sassu Signed-off-by: Jarkko Sakkinen commit 020a0d8feac0fd8a6f6c545c55f5990875226a0b Author: Jonathan McDowell Date: Thu Nov 27 17:02:29 2025 +0000 tpm: Remove tpm_find_get_ops tpm_find_get_ops() looks for the first valid TPM if the caller passes in NULL. All internal users have been converted to either associate themselves with a TPM directly, or call tpm_default_chip() as part of their setup. Remove the no longer necessary tpm_find_get_ops(). Reviewed-by: Jarkko Sakkinen Signed-off-by: Jonathan McDowell Signed-off-by: Jarkko Sakkinen commit e68407b6b0c7c5a4b873bbbd0758a2aed857dc3f Author: Marco Crivellari Date: Thu Nov 6 17:28:00 2025 +0100 tpm: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 61872214870e0cb0dc2e6d823f2362f11e87f4eb Author: Stuart Yoder Date: Mon Oct 27 21:09:21 2025 -0500 tpm_crb: add missing loc parameter to kerneldoc Update the kerneldoc parameter definitions for __crb_go_idle and __crb_cmd_ready to include the loc parameter. Signed-off-by: Stuart Yoder Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 76b1a8aebe0d326fe85f7af139ab86a5c628a016 Author: Chu Guangqing Date: Tue Nov 25 10:30:30 2025 +0800 tpm_crb: Fix a spelling mistake The spelling of the word "requrest" is incorrect; it should be "request". Signed-off-by: Chu Guangqing Signed-off-by: Jarkko Sakkinen commit cffc934c0d81c9dea3d63cc108e6f925a4bac18e Author: Maurice Hieronymus Date: Sun Nov 23 12:18:09 2025 +0100 selftests: tpm2: Fix ill defined assertions Remove parentheses around assert statements in Python. With parentheses, assert always evaluates to True, making the checks ineffective. Signed-off-by: Maurice Hieronymus Signed-off-by: Jarkko Sakkinen commit 2b60145734a0e5a4b73952a540928d2c4f4fed64 Merge: 4d38b88fd17e99 6d90215dc015f7 Author: Linus Torvalds Date: Wed Dec 3 12:50:10 2025 -0800 Merge tag 'wq-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - Rescuer affinity management: Affinity is now updated only when detached using wq_unbound_cpumask consistently. DISASSOCIATED workers also follow unbound cpumask changes to avoid breaking CPU isolation - Rescuer cleanups preparing for fetching work items one by one from pool list: Work assignment factored out, optimized to skip pwqs no longer needing rescue, and shutdown logic simplified - Unused assert_rcu_or_wq_mutex_or_pool_mutex() removed * tag 'wq-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Don't rely on wq->rescuer to stop rescuer workqueue: Only assign rescuer work when really needed workqueue: Factor out assign_rescuer_work() workqueue: Init rescuer's affinities as wq_unbound_cpumask workqueue: Let DISASSOCIATED workers follow unbound wq cpumask changes workqueue: Update the rescuer's affinity only when it is detached workqueue: Remove unused assert_rcu_or_wq_mutex_or_pool_mutex commit 4d38b88fd17e9989429e65420bf3c33ca53b2085 Merge: 4a4e0199378f30 5cae92e622300d Author: Linus Torvalds Date: Wed Dec 3 12:42:36 2025 -0800 Merge tag 'printk-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Allow creaing nbcon console drivers with an unsafe write_atomic() callback that can only be called by the final nbcon_atomic_flush_unsafe(). Otherwise, the driver would rely on the kthread. It is going to be used as the-best-effort approach for an experimental nbcon netconsole driver, see https://lore.kernel.org/r/20251121-nbcon-v1-2-503d17b2b4af@debian.org Note that a safe .write_atomic() callback is supposed to work in NMI context. But some networking drivers are not safe even in IRQ context: https://lore.kernel.org/r/oc46gdpmmlly5o44obvmoatfqo5bhpgv7pabpvb6sjuqioymcg@gjsma3ghoz35 In an ideal world, all networking drivers would be fixed first and the atomic flush would be blocked only in NMI context. But it brings the question how reliable networking drivers are when the system is in a bad state. They might block flushing more reliable serial consoles which are more suitable for serious debugging anyway. - Allow to use the last 4 bytes of the printk ring buffer. - Prevent queuing IRQ work and block printk kthreads when consoles are suspended. Otherwise, they create non-necessary churn or even block the suspend. - Release console_lock() between each record in the kthread used for legacy consoles on RT. It might significantly speed up the boot. - Release nbcon context between each record in the atomic flush. It prevents stalls of the related printk kthread after it has lost the ownership in the middle of a record - Add support for NBCON consoles into KDB - Add %ptsP modifier for printing struct timespec64 and use it where possible - Misc code clean up * tag 'printk-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: (48 commits) printk: Use console_is_usable on console_unblank arch: um: kmsg_dump: Use console_is_usable drivers: serial: kgdboc: Drop checks for CON_ENABLED and CON_BOOT lib/vsprintf: Unify FORMAT_STATE_NUM handlers printk: Avoid irq_work for printk_deferred() on suspend printk: Avoid scheduling irq_work on suspend printk: Allow printk_trigger_flush() to flush all types tracing: Switch to use %ptSp scsi: snic: Switch to use %ptSp scsi: fnic: Switch to use %ptSp s390/dasd: Switch to use %ptSp ptp: ocp: Switch to use %ptSp pps: Switch to use %ptSp PCI: epf-test: Switch to use %ptSp net: dsa: sja1105: Switch to use %ptSp mmc: mmc_test: Switch to use %ptSp media: av7110: Switch to use %ptSp ipmi: Switch to use %ptSp igb: Switch to use %ptSp e1000e: Switch to use %ptSp ... commit 4a4e0199378f309fa7259132e1443efe56c1e276 Merge: 98e7dcbb82fa57 7f8fcc6f09fb73 Author: Linus Torvalds Date: Wed Dec 3 12:41:00 2025 -0800 Merge tag 'lkmm.2025.12.01a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull lkmm documentation update from Paul McKenney: - Sort the memory-barriers.txt file's wait_event* and wait_on_bit* list alphabetically * tag 'lkmm.2025.12.01a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: memory-barriers.txt: Sort wait_event* and wait_on_bit* list alphabetically commit cd6b7c82b69139070ee1aaa73f768ecac99e4c3e Merge: 9f1aa395ad7889 7eba05e79ca20b Author: Bjorn Helgaas Date: Wed Dec 3 14:18:46 2025 -0600 Merge branch 'pci/misc' - Use max() instead of max_t() to ease static analysis (David Laight) - Add Manivannan Sadhasivam as PCI/pwrctrl maintainer (Bartosz Golaszewski) * pci/misc: MAINTAINERS: Add Manivannan Sadhasivam as PCI/pwrctrl maintainer PCI: Use max() instead of max_t() to ease static analysis commit 9f1aa395ad7889685ce7ea69a1a5badfacfce5e4 Merge: 7a13e837d20f7b 4c9c7be47310c1 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:45 2025 -0600 Merge branch 'pci/pwrctrl-tc9563' - Add a struct pci_ops.assert_perst() function pointer to assert/deassert PCIe PERST# and implement it for the qcom driver (Krishna Chaitanya Chundru) - Add DT binding and pwrctrl driver for the Toshiba TC9563 PCIe switch, which must be held in reset after poweron so the pwrctrl driver can configure the switch via I2C before bringing up the links (Krishna Chaitanya Chundru) * pci/pwrctrl-tc9563: PCI: pwrctrl: Add power control driver for TC9563 PCI: qcom: Implement .assert_perst() PCI: dwc: Implement .assert_perst() for dwc glue drivers PCI: Add .assert_perst() to control PCIe PERST# dt-bindings: PCI: Add binding for Toshiba TC9563 PCIe switch commit 7a13e837d20f7b02304df596fdcf63dc7ef05d59 Merge: 388f9a600f1000 cfa3c76e059a2e Author: Bjorn Helgaas Date: Wed Dec 3 14:18:45 2025 -0600 Merge branch 'pci/controller/stm32' - Fix a race between link training and endpoint register initialization (Christian Bruel) - Align endpoint allocations to match the ATU requirements (Christian Bruel) - Add #includes to avoid depending on 'proxy' headers (Andy Shevchenko) * pci/controller/stm32: PCI: stm32: Don't use 'proxy' headers PCI: stm32: Fix EP page_size alignment PCI: stm32: Fix LTSSM EP race with start link commit 388f9a600f10000b15fbfa2ee748530b4876db78 Merge: 80a4441ce30431 ff64e078e45fae Author: Bjorn Helgaas Date: Wed Dec 3 14:18:44 2025 -0600 Merge branch 'pci/controller/spacemit-k1' - Add DT binding and driver for SpacemiT K1 (Alex Elder) * pci/controller/spacemit-k1: PCI: spacemit: Add SpacemiT PCIe host driver dt-bindings: pci: spacemit: Introduce PCIe host controller commit 80a4441ce30431eeeba2a9a3e1b6059828cb4d8a Merge: af257c730f04c9 51f38bef0485f7 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:43 2025 -0600 Merge branch 'pci/controller/sky1' - Add module support for platform controller driver (Manikandan K Pillai) - Split headers into 'legacy' (LGA) and 'high perf' (HPA) (Manikandan K Pillai) - Add DT binding and driver for CIX Sky1 (Hans Zhang) * pci/controller/sky1: MAINTAINERS: Add CIX Sky1 PCIe controller driver maintainer PCI: sky1: Add PCIe host support for CIX Sky1 dt-bindings: PCI: Add CIX Sky1 PCIe Root Complex bindings PCI: cadence: Add support for High Perf Architecture (HPA) controller PCI: cadence: Move PCIe RP common functions to a separate file PCI: cadence: Split PCIe controller header file PCI: cadence: Add module support for platform controller driver commit af257c730f04c9dace3efb091b37d57ed3a4f239 Merge: dfb77c81a68309 932ec9dff6da40 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:43 2025 -0600 Merge branch 'pci/controller/sg2042' - Fix sg2042_pcie_remove() reference count issue (Christophe JAILLET) * pci/controller/sg2042: PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove() commit dfb77c81a68309182a458cb76c72fedfe8834482 Merge: c934541253d074 de45401e27bcec Author: Bjorn Helgaas Date: Wed Dec 3 14:18:42 2025 -0600 Merge branch 'pci/controller/s32g' - Add NXP S32G host controller DT binding and driver (Vincent Guittot) * pci/controller/s32g: MAINTAINERS: Add NXP S32G PCIe controller driver maintainer PCI: s32g: Add NXP S32G PCIe controller driver (RC) PCI: dwc: Add register and bitfield definitions dt-bindings: PCI: s32g: Add NXP S32G PCIe controller commit c934541253d074c6aaa1ad9ce233e5c160ac43eb Merge: e4f4424f062dd0 7ef502fb35b283 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:41 2025 -0600 Merge branch 'pci/controller/rzg3s-host' - Add Renesas RZ/G3S host controller DT binding and driver (Claudiu Beznea) * pci/controller/rzg3s-host: PCI: Add Renesas RZ/G3S host controller driver dt-bindings: PCI: Add Renesas RZ/G3S PCIe controller binding commit e4f4424f062dd0a497aa5321b61e92f938ff799e Merge: 368485218c7aba d312742f686582 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:41 2025 -0600 Merge branch 'pci/controller/rcar-gen2' - Drop ARM dependency so we can build test on other arches (Geert Uytterhoeven) * pci/controller/rcar-gen2: PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 commit 368485218c7aba3268978d1cbad4836deef4bdc9 Merge: 88b8b5b3eab25c 50433f6eeaed21 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:40 2025 -0600 Merge branch 'pci/controller/qcom' - Look up OPP using both frequency and data rate (not just frequency) so RPMh votes can account for both (Krishna Chaitanya Chundru) * pci/controller/qcom: PCI: qcom: Use frequency and level based OPP lookup commit 88b8b5b3eab25cdd3ef9b4efafd1db1d1b83d5e7 Merge: 9563c343d92133 eff0306b109f2d Author: Bjorn Helgaas Date: Wed Dec 3 14:18:39 2025 -0600 Merge branch 'pci/controller/meson' - Update DT binding to name DBI region "dbi", not "elbi", and update driver to support both (Manivannan Sadhasivam) * pci/controller/meson: PCI: meson: Fix parsing the DBI register region dt-bindings: PCI: amlogic: Fix the register name of the DBI region commit 9563c343d921332a939c58b7a9dffb383d3136b4 Merge: 5606b7bad00c65 09150ab1a7d204 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:38 2025 -0600 Merge branch 'pci/controller/mediatek' - Convert DT binding to YAML schema (Christian Marangi) - Add Airoha AN7583 DT compatible and driver support (Christian Marangi) * pci/controller/mediatek: PCI: mediatek: Add support for Airoha AN7583 SoC PCI: mediatek: Use generic MACRO for TPVPERL delay PCI: mediatek: Convert bool to single quirks entry and bitmap dt-bindings: PCI: mediatek: Add support for Airoha AN7583 dt-bindings: PCI: mediatek: Convert to YAML schema commit 5606b7bad00c65b4d006f4555bb111332fce4384 Merge: 51f8276926bc60 bc10d0ad540df5 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:38 2025 -0600 Merge branch 'pci/controller/keystone' - Fail the probe instead of silently succeeding if ks_pcie_of_data didn't specify Root Complex or Endpoint mode (Siddharth Vadapalli) - Make keystone buildable as a loadable module, except on ARM32 where hook_fault_code() is __init (Siddharth Vadapalli) * pci/controller/keystone: PCI: keystone: Add support to build as a loadable module PCI: dwc: Export dw_pcie_allocate_domains() and dw_pcie_ep_raise_msix_irq() PCI: Export pci_get_host_bridge_device() for use by pci-keystone PCI: keystone: Exit ks_pcie_probe() for invalid mode commit 51f8276926bc600eeefe4c3dfbc1cf8cf73b9042 Merge: 30418204caa4e0 444a43bf3c029c Author: Bjorn Helgaas Date: Wed Dec 3 14:18:37 2025 -0600 Merge branch 'pci/controller/j721e' - Use devm_clk_get_optional_enabled() instead of open-coding devm_clk_get_optional() and clk_prepare_enable() (Anand Moon) * pci/controller/j721e: PCI: j721e: Use 'pcie->reset_gpio' directly and drop the local variable PCI: j721e: Use devm_clk_get_optional_enabled() to get and enable the clock commit 30418204caa4e037da50518e096a05b879f220ab Merge: dddd6122d026b0 d2713dfda04ebc Author: Bjorn Helgaas Date: Wed Dec 3 14:18:36 2025 -0600 Merge branch 'pci/controller/ixp4xx' - Guard ARM32-specific hook_fault_code() with ifdefs so we can build test on other arches (Bjorn Helgaas) * pci/controller/ixp4xx: PCI: ixp4xx: Guard ARM32-specific hook_fault_code() commit dddd6122d026b00eed28b55ed06be097f3fc78c0 Merge: 2b12e31cb39d68 c930b10f17c038 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:36 2025 -0600 Merge branch 'pci/controller/dw-rockchip' - Use devm_regulator_get_enable_optional() to simplify probing (Anand Moon) * pci/controller/dw-rockchip: PCI: dw-rockchip: Simplify regulator setup with devm_regulator_get_enable_optional() commit 2b12e31cb39d681d8844254ca9db1e92cb562c8f Merge: f4620f6216dbfb b5e719f26107f4 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:35 2025 -0600 Merge branch 'pci/controller/dwc' - Update PORT_LOGIC_LTSSM_STATE_MASK to be a 6-bit mask as per spec, not a 5-bit mask (Shawn Lin) - Clear L1 PM Substate Capability 'Supported' bits unless glue driver says it's supported, which prevents users from enabling non-working L1SS. Currently only qcom and tegra194 support L1SS (Bjorn Helgaas) - Remove now-superfluous L1SS disable code from tegra194 (Bjorn Helgaas) - Configure L1SS support in dw-rockchip when DT says 'supports-clkreq' (Shawn Lin) * pci/controller/dwc: PCI: dw-rockchip: Configure L1SS support PCI: tegra194: Remove unnecessary L1SS disable code PCI: dwc: Advertise L1 PM Substates only if driver requests it PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition commit f4620f6216dbfb5ef8b31bc3eb558cde0b20913a Merge: 12390db236b395 8d4ec3fbb15e97 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:35 2025 -0600 Merge branch 'pci/controller/brcmstb' - Disable advertising ASPM L0s support correctly (Jim Quinlan) - Add a panic/die handler to print diagnostic info in case PCIe caused an unrecoverable abort (Jim Quinlan) * pci/controller/brcmstb: PCI: brcmstb: Add panic/die handler to driver PCI: brcmstb: Add a way to indicate if PCIe bridge is active PCI: brcmstb: Fix disabling L0s capability commit 12390db236b395609178114d259f9f4ac62acaaf Merge: 87a194e67202a1 b1e24e05e14086 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:34 2025 -0600 Merge branch 'pci/controller/host-common' - Move struct pci_host_bridge allocation from pci_host_common_init() to callers, which significantly simplifies pcie-apple (Marc Zyngier) * pci/controller/host-common: PCI: host-generic: Move bridge allocation outside of pci_host_common_init() commit 87a194e67202a1279c7484ba438eb14206359349 Merge: f26a75c9b3b918 dc693d60664470 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:33 2025 -0600 Merge branch 'pci/endpoint' - Convert the endpoint doorbell test to use a threaded IRQ to fix a 'sleeping while atomic' issue (Bhanu Seshu Kumar Valluri) - Add endpoint VNTB MSI doorbell support to reduce latency between host and endpoint (Frank Li) * pci/endpoint: PCI: endpoint: pci-epf-vntb: Add MSI doorbell support PCI: endpoint: Add pci_epf_assign_bar_space() API PCI: endpoint: Add pci_epf_get_required_bar_size() helper PCI: endpoint: Rename 'epf_bar::aligned_size' to 'epf_bar:mem_size' PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context commit f26a75c9b3b918b499de538d6c3e324e29ed4c05 Merge: 13571584e1dafb 3b83eea6334acd Author: Bjorn Helgaas Date: Wed Dec 3 14:18:33 2025 -0600 Merge branch 'pci/dt-binding' - Add Rockchip RK3528 compatible strings in DT binding (Yao Zi) - Add Qualcomm Kaanapali to SM8550 DT binding (Qiang Yu) - Add 'contains' to the 'select' schema to enable the amlogic,axg-pcie binding (Rob Herring) - Update Manivannan Sadhasivam's email address in bindings (Manivannan Sadhasivam) - Add required 'power-domains' and 'resets' to qcom sa8775p, sc7280, sc8280xp, sm8150, sm8250, sm8350, sm8450, sm8550, x1e80100 DT schemas (Krzysztof Kozlowski) * pci/dt-binding: dt-bindings: PCI: qcom,pcie-x1e80100: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets dt-bindings: PCI: qcom,pcie-sa8775p: Add missing required power-domains and resets dt-bindings: PCI: Update the email address for Manivannan Sadhasivam dt-bindings: PCI: amlogic,axg-pcie: Fix select schema dt-bindings: PCI: qcom,pcie-sm8550: Add Kaanapali compatible dt-bindings: PCI: dwc: rockchip: Add RK3528 variant commit 13571584e1dafb6465243772bd61edfc5231b30b Merge: c1e900de220905 48f014356698a3 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:32 2025 -0600 Merge branch 'pci/resource' - Prevent resource tree corruption when BAR resize fails (Ilpo Järvinen) - Restore BARs to the original size if a BAR resize fails (Ilpo Järvinen) - Remove BAR release from BAR resize attempts by the xe, i915, and amdgpu drivers so the PCI core can restore BARs if the resize fails (Ilpo Järvinen) - Move Resizable BAR code to rebar.c (Ilpo Järvinen) - Add pci_rebar_size_supported() and use it in i915 and xe (Ilpo Järvinen) - Add pci_rebar_get_max_size() and use it in xe and amdgpu (Ilpo Järvinen) * pci/resource: PCI: Validate pci_rebar_size_supported() input PCI: Convert BAR sizes bitmasks to u64 drm/amdgpu: Use pci_rebar_get_max_size() drm/xe/vram: Use pci_rebar_get_max_size() PCI: Add pci_rebar_get_max_size() drm/xe/vram: Use PCI rebar helpers in resize_vram_bar() drm/i915/gt: Use pci_rebar_size_supported() PCI: Add pci_rebar_size_supported() helper PCI: Improve Resizable BAR functions kernel doc PCI: Move pci_rebar_size_to_bytes() and export it PCI: Move pci_rebar_bytes_to_size() and clean it up PCI: Move Resizable BAR code to rebar.c PCI: Prevent restoring assigned resources drm/amdgpu: Remove driver side BAR release before resize drm/i915: Remove driver side BAR release before resize drm/xe: Remove driver side BAR release before resize PCI: Add kerneldoc for pci_resize_resource() PCI: Fix restoring BARs on BAR resize rollback path PCI: Free saved list without holding pci_bus_sem PCI: Try BAR resize even when no window was released PCI: Change pci_dev variable from 'bridge' to 'dev' PCI/IOV: Adjust ->barsz[] when changing BAR size PCI: Prevent resource tree corruption when BAR resize fails commit c1e900de220905173c6cef42adf97e8020f64027 Merge: 5c5b8751e563ff 044b9f1a7f4f3d Author: Bjorn Helgaas Date: Wed Dec 3 14:18:31 2025 -0600 Merge branch 'pci/ptm' - Enable PTM only if device advertises support for a relevant role, to prevent invalid PTM Requests that cause ACS violations that are reported as AER Uncorrectable Non-Fatal errors (Mika Westerberg) * pci/ptm: PCI/PTM: Enable only if device advertises relevant role commit 5c5b8751e563ff8e9ef45816d703b5cf1feb80fa Merge: e0910b31ebda61 5e09895b4063e9 Author: Bjorn Helgaas Date: Wed Dec 3 14:18:31 2025 -0600 Merge branch 'pci/err' - For drivers using PCI legacy suspend, save config state at suspend so that state (not any earlier state from enumeration, probe, or error recovery) will be restored when resuming (Lukas Wunner) - For devices with no driver or a driver that lacks PM, save config state at hibernate so that state (not any earlier state from enumeration, probe, or error recovery) will be restored when resuming (Lukas Wunner) - Save device config space on device addition, before driver binding, so error recovery works more reliably (Lukas Wunner) - Drop pci_save_state() from several drivers that no longer need it since the PCI core always does it and pci_restore_state() no longer invalidates the saved state (Lukas Wunner) - Document use of pci_save_state() by drivers to capture the state they want restored during error recovery (Lukas Wunner) * pci/err: Documentation: PCI: Amend error recovery doc with pci_save_state() rules treewide: Drop pci_save_state() after pci_restore_state() PCI/ERR: Ensure error recoverability at all times PCI/PM: Stop needlessly clearing state_saved on enumeration and thaw PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths commit e0910b31ebda61b9914698892ab1b8a33feaf595 Merge: 3a8660878839fa b37b6095a94e1c Author: Bjorn Helgaas Date: Wed Dec 3 14:18:30 2025 -0600 Merge branch 'pci/enumeration' - Enable host bridge emulation for PCI_DOMAINS_GENERIC platforms (Dan Williams) - Switch vmd from custom domain number allocator to the common allocator (Dan Williams) * pci/enumeration: PCI: vmd: Switch to pci_bus_find_emul_domain_nr() PCI: Enable host bridge emulation for PCI_DOMAINS_GENERIC platforms commit 98e7dcbb82fa57de8dfad357f9b851c3625797fa Merge: b687034b1a4d85 9a08942f17017b Author: Linus Torvalds Date: Wed Dec 3 12:18:07 2025 -0800 Merge tag 'rcu.release.v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Frederic Weisbecker: "SRCU: - Properly handle SRCU readers within IRQ disabled sections in tiny SRCU - Preparation to reimplement RCU Tasks Trace on top of SRCU fast: - Introduce API to expedite a grace period and test it through rcutorture - Split srcu-fast in two flavours: SRCU-fast and SRCU-fast-updown. Both are still targeted toward faster readers (without full barriers on LOCK and UNLOCK) at the expense of heavier write side (using full RCU grace period ordering instead of simply full ordering) as compared to "traditional" non-fast SRCU. But those srcu-fast flavours are going to be optimized in two different ways: - SRCU-fast will become the reimplementation basis for RCU-TASK-TRACE for consolidation. Since RCU-TASK-TRACE must be NMI safe, SRCU-fast must be as well. - SRCU-fast-updown will be needed for uretprobes code in order to get rid of the read-side memory barriers while still allowing entering the reader at task level while exiting it in a timer handler. It is considered semaphore-like in that it can have different owners between LOCK and UNLOCK. However it is not NMI-safe. The actual optimizations are work in progress for the next cycle. Only the new interfaces are added for now, along with related torture and scalability test code. - Create/document/debug/torture new proper initializers for RCU fast: DEFINE_SRCU_FAST() and init_srcu_struct_fast() This allows for using right away the proper ordering on the write side (either full ordering or full RCU grace period ordering) without waiting for the read side to tell which to use. This also optimizes the read side altogether with moving flavour debug checks under debug config and with removing a costly RmW operation on their first call. - Make some diagnostic functions tracing safe Refscale: - Add performance testing for common context synchronizations (Preemption, IRQ, Softirq) and per-cpu increments. Those are relevant comparisons against SRCU-fast read side APIs, especially as they are planned to synchronize further tracing fast-path code Miscellanous: - In order to prepare the layout for nohz_full work deferral to user exit, the context tracking state must shrink the counter of transitions to/from RCU not watching. The only possible hazard is to trigger wrap-around more easily, delaying a bit grace periods when that happens. This should be a rare event though. Yet add debugging and torture code to test that assumption - Fix memory leak on locktorture module - Annotate accesses in rculist_nulls.h to prevent from KCSAN warnings. On recent discussions, we also concluded that all those WRITE_ONCE() and READ_ONCE() on list APIs deserve appropriate comments. Something to be expected for the next cycle - Provide a script to apply several configs to several commits with torture - Allow torture to reuse a build directory in order to save needless rebuild time - Various cleanups" * tag 'rcu.release.v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (29 commits) refscale: Add SRCU-fast-updown readers refscale: Exercise DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast() rcutorture: Make srcu{,d}_torture_init() announce the SRCU type srcu: Create an SRCU-fast-updown API refscale: Do not disable interrupts for tests involving local_bh_enable() refscale: Add non-atomic per-CPU increment readers refscale: Add this_cpu_inc() readers refscale: Add preempt_disable() readers refscale: Add local_bh_disable() readers refscale: Add local_irq_disable() and local_irq_save() readers torture: Permit negative kvm.sh --kconfig numberic arguments srcu: Add SRCU_READ_FLAVOR_FAST_UPDOWN CPP macro rcu: Mark diagnostic functions as notrace rcutorture: Make TREE04 use CONFIG_RCU_DYNTICKS_TORTURE rcutorture: Remove redundant rcutorture_one_extend() from rcu_torture_one_read() rcutorture: Permit kvm-again.sh to re-use the build directory torture: Add kvm-series.sh to test commit/scenario combination rcu: use WRITE_ONCE() for ->next and ->pprev of hlist_nulls locktorture: Fix memory leak in param_set_cpumask() doc: Update for SRCU-fast definitions and initialization ... commit b687034b1a4d85333ced0fe07f67b17276cccdc8 Merge: f96163865a1346 a8ec08bf32595e Author: Linus Torvalds Date: Wed Dec 3 11:53:47 2025 -0800 Merge tag 'slab-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - mempool_alloc_bulk() support for upcoming users in the block layer that need to allocate multiple objects at once with the mempool's guaranteed progress semantics, which is not achievable with an allocation single objects in a loop. Along with refactoring and various improvements (Christoph Hellwig) - Preparations for the upcoming separation of struct slab from struct page, mostly by removing the struct folio layer, as the purpose of struct folio has shifted since it became used in slab code (Matthew Wilcox) - Modernisation of slab's boot param API usage, which removes some unexpected parsing corner cases (Petr Tesarik) - Refactoring of freelist_aba_t (now struct freelist_counters) and associated functions for double cmpxchg, enabled by -fms-extensions (Vlastimil Babka) - Cleanups and improvements related to sheaves caching layer, that were part of the full conversion to sheaves, which is planned for the next release (Vlastimil Babka) * tag 'slab-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (42 commits) slab: Remove unnecessary call to compound_head() in alloc_from_pcs() mempool: clarify behavior of mempool_alloc_preallocated() mempool: drop the file name in the top of file comment mempool: de-typedef mempool: remove mempool_{init,create}_kvmalloc_pool mempool: legitimize the io_schedule_timeout in mempool_alloc_from_pool mempool: add mempool_{alloc,free}_bulk mempool: factor out a mempool_alloc_from_pool helper slab: Remove references to folios from virt_to_slab() kasan: Remove references to folio in __kasan_mempool_poison_object() memcg: Convert mem_cgroup_from_obj_folio() to mem_cgroup_from_obj_slab() mempool: factor out a mempool_adjust_gfp helper mempool: add error injection support mempool: improve kerneldoc comments mm: improve kerneldoc comments for __alloc_pages_bulk fault-inject: make enum fault_flags available unconditionally usercopy: Remove folio references from check_heap_object() slab: Remove folio references from kfree_nolock() slab: Remove folio references from kfree_rcu_sheaf() slab: Remove folio references from build_detached_freelist() ... commit f96163865a1346b199cc38e827269296f0f24ab0 Merge: a619fe35ab41fd 464257baf99200 Author: Linus Torvalds Date: Wed Dec 3 11:34:28 2025 -0800 Merge tag 'docs-6.19' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "This has been another busy cycle for documentation, with a lot of build-system thrashing. That work should slow down from here on out. - The various scripts and tools for documentation were spread out in several directories; now they are (almost) all coalesced under tools/docs/. The holdout is the kernel-doc script, which cannot be easily moved without some further thought. - As the amount of Python code increases, we are accumulating modules that are imported by multiple programs. These modules have been pulled together under tools/lib/python/ -- at least, for documentation-related programs. There is other Python code in the tree that might eventually want to move toward this organization. - The Perl kernel-doc.pl script has been removed. It is no longer used by default, and nobody has missed it, least of all anybody who actually had to look at it. - The docs build was controlled by a complex mess of makefilese that few dared to touch. Mauro has moved that logic into a new program (tools/docs/sphinx-build-wrapper) that, with any luck at all, will be far easier to understand and maintain. - The get_feat.pl program, used to access information under Documentation/features/, has been rewritten in Python, bringing an end to the use of Perl in the docs subsystem. - The top-level README file has been reorganized into a more reader-friendly presentation. - A lot of Chinese translation additions - Typo fixes and documentation updates as usual" * tag 'docs-6.19' of git://git.lwn.net/linux: (164 commits) docs: makefile: move rustdoc check to the build wrapper README: restructure with role-based documentation and guidelines docs: kdoc: various fixes for grammar, spelling, punctuation docs: kdoc_parser: use '@' for Excess enum value docs: submitting-patches: Clarify that removal of Acks needs explanation too docs: kdoc_parser: add data/function attributes to ignore docs: MAINTAINERS: update Mauro's files/paths docs/zh_CN: Add wd719x.rst translation docs/zh_CN: Add libsas.rst translation get_feat.pl: remove it, as it got replaced by get_feat.py Documentation/sphinx/kernel_feat.py: use class directly tools/docs/get_feat.py: convert get_feat.pl to Python Documentation/admin-guide: fix typo and comment in cscope example docs/zh_CN: Add data-integrity.rst translation docs/zh_CN: Add blk-mq.rst translation docs/zh_CN: Add block/index.rst translation docs/zh_CN: Update the Chinese translation of kbuild.rst docs: bring some order to our Python module hierarchy docs: Move the python libraries to tools/lib/python Documentation/kernel-parameters: Move the kernel build options ... commit a619fe35ab41fded440d3762d4fbad84ff86a4d4 Merge: c8321831480d80 48bc9da3c97c15 Author: Linus Torvalds Date: Wed Dec 3 11:28:38 2025 -0800 Merge tag 'v6.19-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Rewrite memcpy_sglist from scratch - Add on-stack AEAD request allocation - Fix partial block processing in ahash Algorithms: - Remove ansi_cprng - Remove tcrypt tests for poly1305 - Fix EINPROGRESS processing in authenc - Fix double-free in zstd Drivers: - Use drbg ctr helper when reseeding xilinx-trng - Add support for PCI device 0x115A to ccp - Add support of paes in caam - Add support for aes-xts in dthev2 Others: - Use likely in rhashtable lookup - Fix lockdep false-positive in padata by removing a helper" * tag 'v6.19-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (71 commits) crypto: zstd - fix double-free in per-CPU stream cleanup crypto: ahash - Zero positive err value in ahash_update_finish crypto: ahash - Fix crypto_ahash_import with partial block data crypto: lib/mpi - use min() instead of min_t() crypto: ccp - use min() instead of min_t() hwrng: core - use min3() instead of nested min_t() crypto: aesni - ctr_crypt() use min() instead of min_t() crypto: drbg - Delete unused ctx from struct sdesc crypto: testmgr - Add missing DES weak and semi-weak key tests Revert "crypto: scatterwalk - Move skcipher walk and use it for memcpy_sglist" crypto: scatterwalk - Fix memcpy_sglist() to always succeed crypto: iaa - Request to add Kanchana P Sridhar to Maintainers. crypto: tcrypt - Remove unused poly1305 support crypto: ansi_cprng - Remove unused ansi_cprng algorithm crypto: asymmetric_keys - fix uninitialized pointers with free attribute KEYS: Avoid -Wflex-array-member-not-at-end warning crypto: ccree - Correctly handle return of sg_nents_for_len crypto: starfive - Correctly handle return of sg_nents_for_len crypto: iaa - Fix incorrect return value in save_iaa_wq() crypto: zstd - Remove unnecessary size_t cast ... commit c8321831480d80af01ce001bd6626fc130fd13b1 Merge: 777f8171602d59 d7ba853c0e47d5 Author: Linus Torvalds Date: Wed Dec 3 11:19:34 2025 -0800 Merge tag 'ipe-pr-20251202' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe Pull IPE udates from Fan Wu: "The primary change is the addition of support for the AT_EXECVE_CHECK flag. This allows interpreters to signal the kernel to perform IPE security checks on script files before execution, extending IPE enforcement to indirectly executed scripts. Update documentation for it, and also fix a comment" * tag 'ipe-pr-20251202' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe: ipe: Update documentation for script enforcement ipe: Add AT_EXECVE_CHECK support for script enforcement ipe: Drop a duplicated CONFIG_ prefix in the ifdeffery commit 777f8171602d5954cac024b66afa1b5b030641a4 Merge: 204a920f284e72 738c9738e690f5 Author: Linus Torvalds Date: Wed Dec 3 11:08:03 2025 -0800 Merge tag 'integrity-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity updates from Mimi Zohar: "Bug fixes: - defer credentials checking from the bprm_check_security hook to the bprm_creds_from_file security hook - properly ignore IMA policy rules based on undefined SELinux labels IMA policy rule extensions: - extend IMA to limit including file hashes in the audit logs (dont_audit action) - define a new filesystem subtype policy option (fs_subtype) Misc: - extend IMA to support in-kernel module decompression by deferring the IMA signature verification in kernel_read_file() to after the kernel module is decompressed" * tag 'integrity-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Handle error code returned by ima_filter_rule_match() ima: Access decompressed kernel module to verify appended signature ima: add fs_subtype condition for distinguishing FUSE instances ima: add dont_audit action to suppress audit actions ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook commit b58261584d2f6b5241ac1693026242ef2f2148b4 Author: Ian Rogers Date: Sat Nov 22 00:19:29 2025 -0800 perf test kvm: Add some basic perf kvm test coverage Setup qemu with KVM then run kvm stat and some host recording/reporting/build-id tests. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit db452961de9392258a3de60960919c17b5e39a50 Author: Ian Rogers Date: Sat Nov 22 00:19:28 2025 -0800 perf tests evlist: Add basic evlist test Add test that evlist reports expected events from perf record. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 199d5e872a9ce73728ec0669bb5e31be6f9cf261 Author: Ian Rogers Date: Sat Nov 22 00:19:27 2025 -0800 perf tests script dlfilter: Add a dlfilter test Compile a simple dlfilter and make sure it remove samples from everything other than a test_loop. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 526ed2f8a7fb6017df74d87ded0d32c86deb5803 Author: Ian Rogers Date: Sat Nov 22 00:19:26 2025 -0800 perf tests kallsyms: Add basic kallsyms test Add test that kallsyms finds a well known symbol and fails for another. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 279385cf634b50ad25aabc10dd334fdd78b09e7c Author: Ian Rogers Date: Sat Nov 22 00:19:25 2025 -0800 perf tests timechart: Add a perf timechart test Basic coverage for `perf timechart` doing a record and then a basic sanity test of the generated SVG file. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 75e961730b9e8506aa9b5cb670bdd674ce80e46a Author: Ian Rogers Date: Sat Nov 22 00:19:24 2025 -0800 perf tests top: Add basic perf top coverage test The test starts a backgroup thloop workload and monitors it using cpu-clock ensuring test_loop appears in the output. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 0eb307d954c10ef2dbf8d4597954e013dfe263ed Author: Ian Rogers Date: Sat Nov 22 00:19:23 2025 -0800 perf tests buildid: Add purge and remove testing Add testing for the purge and remove commands. Use the noploop workload rather than just a return to avoid missing samples in the workload in perf record. Tidy up the cleanup code to cleanup when signals happen. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit ac881007c4bf7be4dae713c36b7f0309f2843611 Author: Ian Rogers Date: Sat Nov 22 00:19:22 2025 -0800 perf tests c2c: Add a basic c2c Add basic c2c record and report testing to gain some coverage. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 3118d14349cdbef112aa8b60c22b74c12478c4b1 Author: Ian Rogers Date: Sat Nov 22 00:19:21 2025 -0800 perf c2c: Clean up some defensive gets and make asan clean To deal with histogram code that had missing gets the c2c code had some defensive gets. Those other issues were cleaned up by the reference count checker, clean them up for the c2c command here. Signed-off-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 1da7c10b2e36541a9c74bc6cf04992f089fa7e00 Author: Ian Rogers Date: Sat Nov 22 00:19:20 2025 -0800 perf jitdump: Fix missed dso__put Reference count checking caught a missing dso__put following a machine__findnew_dso_id. Signed-off-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 69d247295a51db53294efc14dc7e73b3c57df0f8 Author: Ian Rogers Date: Sat Nov 22 00:19:19 2025 -0800 perf mem-events: Don't leak online CPU map Reference count checking found the online CPU map was being gotten but not put. Add in the missing put. Signed-off-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit f60efb4454b24cc944ff3eac164bb9dce9169f71 Author: Ian Rogers Date: Sat Nov 22 00:19:18 2025 -0800 perf hist: In init, ensure mem_info is put on error paths Rather than exit the internal map_symbols directly, put the mem-info that does this and also lowers the reference count on the mem-info itself otherwise the mem-info is being leaked. Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit") Signed-off-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit dc4d16543e60c22cd342135f321e99f2ecad3d54 Author: Ian Rogers Date: Sat Nov 22 00:19:17 2025 -0800 perf probe-event: Ensure probe event nsinfo is always cleared Move nsinfo__zput from cleanup_perf_probe_events to clear_perf_probe_event so it is always executed. Clean up clear_perf_probe_events to not call nsinfo__zput and use the pev variable to avoid repeated array accesses. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b4e44399eb2ebe21d3b00ae14e8ebaab1a3aa094 Author: Ian Rogers Date: Sat Nov 22 00:19:16 2025 -0800 perf symbol: Add missed dso__put Add missing dso__put for the dso created in maps__split_kallsyms. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b3ea721b804f9b7ae1de2a651aa4aca9bf5ff04b Author: Ian Rogers Date: Sat Nov 22 00:19:15 2025 -0800 perf symbol-elf: Add missing puts on error path In dso__process_kernel_symbol if inserting a map fails, probably ENOMEM, then the reference count puts were missing on the dso and map. Signed-off-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim commit 830f1854c4a02d70d2d7d7e2e8f71cb3b928c0d6 Author: Ian Rogers Date: Sat Nov 22 00:19:14 2025 -0800 perf timechart: Add record support for output perf.data path The '-o' option exists for the SVG creation but not for `perf timechart record`. Add to better allow testing. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 27e711257902475097dea3f79cbdf241fe37ec00 Author: Ian Rogers Date: Sat Nov 22 00:19:13 2025 -0800 perf kvm: Fix debug assertion There are 2 slots left for kvm_add_default_arch_event, fix the assertion so that debug builds don't fail the assert and to agree with the comment. Fixes: 45ff39f6e70aa55d0 ("perf tools kvm: Fix the potential out of range memory access issue") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 492689ba72d0391e2c263b159a17beeea7b130a8 Author: Ian Rogers Date: Tue Dec 2 08:53:40 2025 -0800 perf vendor events intel: Update sierraforest events from 1.12 to 1.13 The updated events were published in: https://github.com/intel/perfmon/commit/445e38f5128592f8b5c38da30267fff025e37613 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 77621ef2d649f5698da0877af6ff940ba9cad1a1 Author: Ian Rogers Date: Tue Dec 2 08:53:39 2025 -0800 perf vendor events intel: Update pantherlake events from 1.00 to 1.02 The updated events were published in: https://github.com/intel/perfmon/commit/6edacf434dffa046435de2f6a182c00df3cf4edc Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit aa2f558bf6e145ccc248f3b8c4f02b8f2a3bd380 Author: Ian Rogers Date: Tue Dec 2 08:53:38 2025 -0800 perf vendor events intel: Update meteorlake events from 1.17 to 1.18 The updated events were published in: https://github.com/intel/perfmon/commit/348f33fae477f281812c32e1c07812b7e35614dd Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 60688cfd84d748cb582581dc47e33294037ce485 Author: Ian Rogers Date: Tue Dec 2 08:53:37 2025 -0800 perf vendor events intel: Update lunarlake events from 1.18 to 1.19 The updated events were published in: https://github.com/intel/perfmon/commit/09a0c74b23b5d20adf1f97e5022856568d05494c Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit cf99cdf53e30101c0e6dfef845e06c22a866f573 Author: Ian Rogers Date: Tue Dec 2 08:53:36 2025 -0800 perf vendor events intel: Update icelakex events from 1.28 to 1.30 The updated events were published in: https://github.com/intel/perfmon/commit/dc6ffee20c74bfd21d7a7e338345578d4b7ca9ca Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 1d341e543f1cdbca4fbf00f55f005e937762f7a3 Author: Ian Rogers Date: Tue Dec 2 08:53:35 2025 -0800 perf vendor events intel: Update graniterapids events from 1.15 to 1.16 The updated events were published in: https://github.com/intel/perfmon/commit/b4acc3fd520eb098db41083010b65b75ae906c96 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 5a341ccbdda901b5b492101bc98e443540f5598d Author: Ian Rogers Date: Tue Dec 2 08:53:34 2025 -0800 perf vendor events intel: Update cascadelakex metric units The updated metrics were published in: https://github.com/intel/perfmon/pull/348/commits/2dce436130ddfb8b442fc373d103f970de26cb78 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 99eb7146cd6d04bb4bf1b1193cd17e8c04761ed9 Author: Ian Rogers Date: Tue Dec 2 08:53:33 2025 -0800 perf vendor events intel: Update arrowlake events from 1.13 to 1.14 The updated events were published in: https://github.com/intel/perfmon/commit/588dd77675039e1aaacee27a414cbcf3625c58a3 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit c914d68371b0defc7dbc06a404eb0ef03180014b Author: Ian Rogers Date: Tue Dec 2 08:53:32 2025 -0800 perf vendor events intel: Update alderlake events from 1.34 to 1.35 The updated events were published in: https://github.com/intel/perfmon/commit/c74f1cefa94d224cb3338507961b59d8a2a1c4e9 Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit c4fe074b61556536d515ccf2737fb1c185f55ee4 Author: Leo Yan Date: Thu Nov 13 10:57:39 2025 +0000 perf arm_spe: Add CPU variants supporting common data source packet Add the following CPU variants to the list for data source decoding: - Cortex-A715 [1] - Cortex-A78C [2] - Cortex-X1 [3] - Cortex-X4 [4] - Neoverse V3 [5] [1] https://developer.arm.com/documentation/101590/0103/Statistical-Profiling-Extension-Support/Statistical-Profiling-Extension-data-source-packet [2] https://developer.arm.com/documentation/102226/0002/Debug-descriptions/Statistical-Profiling-Extension/implementation-defined-features-of-SPE [3] https://developer.arm.com/documentation/101433/0102/Debug-descriptions/Statistical-Profiling-Extension/implementation-defined-features-of-SPE [4] https://developer.arm.com/documentation/102484/0003/Statistical-Profiling-Extension-support/Statistical-Profiling-Extension-data-source-packet [5] https://developer.arm.com/documentation/107734/0002/Statistical-Profiling-Extension-support/Statistical-Profiling-Extension-data-source-packet Signed-off-by: Leo Yan Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit e28f834f57131be2cfd60a1c9c580f0a71995dc9 Author: Arnaldo Carvalho de Melo Date: Wed Dec 3 11:50:03 2025 -0300 perf auxtrace: Include sys/types.h for pid_t In 754187ad73b73bcb ("perf build: Remove NO_AUXTRACE build option") sys/types.h was removed, which broke the build in all Alpine Linux releases, as musl libc has pid_t defined via sys/types.h, add it back. Fixes: 754187ad73b73bcb ("perf build: Remove NO_AUXTRACE build option") Signed-off-by: Arnaldo Carvalho de Melo Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 204a920f284e7264aa6dcd5876cbb1e03a7e4ebc Merge: 0eae3283c3024d 29c701f90b9341 Author: Linus Torvalds Date: Wed Dec 3 10:58:59 2025 -0800 Merge tag 'Smack-for-6.19' of https://github.com/cschaufler/smack-next Pull smack updates from Casey Schaufler: - fix several cases where labels were treated inconsistently when imported from user space - clean up the assignment of extended attributes - documentation improvements * tag 'Smack-for-6.19' of https://github.com/cschaufler/smack-next: Smack: function parameter 'gfp' not described smack: fix kernel-doc warnings for smk_import_valid_label() smack: fix bug: setting task label silently ignores input garbage smack: fix bug: unprivileged task can create labels smack: fix bug: invalid label of unix socket file smack: always "instantiate" inode in smack_inode_init_security() smack: deduplicate xattr setting in smack_inode_init_security() smack: fix bug: SMACK64TRANSMUTE set on non-directory smack: deduplicate "does access rule request transmutation" commit 0eae3283c3024d576623736eeafcde75135ad585 Merge: 51e3b98d737aa3 c8a3dfe7315945 Author: Linus Torvalds Date: Wed Dec 3 10:52:01 2025 -0800 Merge tag 'audit-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: - Consolidate the loops in __audit_inode_child() to improve performance When logging a child inode in __audit_inode_child(), we first run through the list of recorded inodes looking for the parent and then we repeat the search looking for a matching child entry. This pull request consolidates both searches into one pass through the recorded inodes, resuling in approximately a 50% reduction in audit overhead. See the commit description for the testing details. - Combine kmalloc()/memset() into kzalloc() in audit_krule_to_data() - Comment fixes * tag 'audit-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: merge loops in __audit_inode_child() audit: Use kzalloc() instead of kmalloc()/memset() in audit_krule_to_data() audit: fix comment misindentation in audit.h commit 51e3b98d737aa3e76e077db77b9aa749436c93ac Merge: 121cc35cfb55ab 20d387d7ceab95 Author: Linus Torvalds Date: Wed Dec 3 10:45:47 2025 -0800 Merge tag 'selinux-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Improve the granularity of SELinux labeling for memfd files Currently when creating a memfd file, SELinux treats it the same as any other tmpfs, or hugetlbfs, file. While simple, the drawback is that it is not possible to differentiate between memfd and tmpfs files. This adds a call to the security_inode_init_security_anon() LSM hook and wires up SELinux to provide a set of memfd specific access controls, including the ability to control the execution of memfds. As usual, the commit message has more information. - Improve the SELinux AVC lookup performance Adopt MurmurHash3 for the SELinux AVC hash function instead of the custom hash function currently used. MurmurHash3 is already used for the SELinux access vector table so the impact to the code is minimal, and performance tests have shown improvements in both hash distribution and latency. See the commit message for the performance measurments. - Introduce a Kconfig option for the SELinux AVC bucket/slot size While we have the ability to grow the number of AVC hash buckets today, the size of the buckets (slot size) is fixed at 512. This pull request makes that slot size configurable at build time through a new Kconfig knob, CONFIG_SECURITY_SELINUX_AVC_HASH_BITS. * tag 'selinux-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: improve bucket distribution uniformity of avc_hash() selinux: Move avtab_hash() to a shared location for future reuse selinux: Introduce a new config to make avc cache slot size adjustable memfd,selinux: call security_inode_init_security_anon() commit 2d3451ef1ef679ae496f8e335f4b1305885e8083 Author: Josh Poimboeuf Date: Wed Dec 3 10:07:38 2025 -0800 objtool: Simplify .annotate_insn code generation output some more Remove the superfluous section name quotes, and combine the longs into a single command. Before: 911: .pushsection ".discard.annotate_insn", "M", @progbits, 8; .long 911b - .; .long 2; .popsection After: 911: .pushsection .discard.annotate_insn, "M", @progbits, 8; .long 911b - ., 2; .popsection No change in functionality. Suggested-by: Linus Torvalds Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/hpsfcihgqmhcdrg7pop7z73ptymakgjq7qlxrawrjxilosk43l@xikqif3ievj4 commit 799647ddb4c0ce1d7084fcf5b524e9a0c7728325 Author: Josh Poimboeuf Date: Tue Dec 2 15:01:17 2025 -0800 objtool: Add more robust signal error handling, detect and warn about stack overflows When the kernel build fails due to an objtool segfault, the error message is a bit obtuse and confusing: make[5]: *** [scripts/Makefile.build:503: drivers/scsi/qla2xxx/qla2xxx.o] Error 139 ^^^^^^^^^ make[5]: *** Deleting file 'drivers/scsi/qla2xxx/qla2xxx.o' make[4]: *** [scripts/Makefile.build:556: drivers/scsi/qla2xxx] Error 2 make[3]: *** [scripts/Makefile.build:556: drivers/scsi] Error 2 make[2]: *** [scripts/Makefile.build:556: drivers] Error 2 make[1]: *** [/home/jpoimboe/git/linux/Makefile:2013: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Add a signal handler to objtool which prints an error message like if the local stack has overflown (for which there's a chance as objtool makes heavy use of recursion): drivers/scsi/qla2xxx/qla2xxx.o: error: SIGSEGV: objtool stack overflow! or: drivers/scsi/qla2xxx/qla2xxx.o: error: SIGSEGV: objtool crash! Also, re-raise the signal so the core dump still gets triggered. [ mingo: Applied a build fix, added more comments and prettified the code. ] Suggested-by: Ingo Molnar Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Alexandre Chartre Cc: David Laight Cc: Linus Torvalds Cc: Nathan Chancellor Cc: Peter Zijlstra Link: https://patch.msgid.link/mi4tihk4dbncn7belrhp6ooudhpw4vdggerktu5333w3gqf3uf@vqlhc3y667mg commit ed3bf863dc9150b56233b01ec073cbbd1fc9c6a3 Author: Josh Poimboeuf Date: Tue Dec 2 09:59:39 2025 -0800 objtool: Remove newlines and tabs from annotation macros Remove newlines and tabs from the annotation macros so the invoking code can insert them as needed to match the style of the surrounding code. Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Linus Torvalds Link: https://patch.msgid.link/66305834c2eb78f082217611b756231ae9c0b555.1764694625.git.jpoimboe@kernel.org commit 305c8dc477175eb29df18accc95c868acd2cdd4e Author: Josh Poimboeuf Date: Tue Dec 2 09:59:38 2025 -0800 objtool: Consolidate annotation macros Consolidate __ASM_ANNOTATE into a single macro which is used by both C and asm. This also makes the code generation a bit more palatable by putting it all on a single line. Turn this: 911: .pushsection .discard.annotate_insn,"M", @progbits, 8 .long 911b - . .long 1 .popsection jmp __x86_return_thunk Into: 911: .pushsection ".discard.annotate_insn", "M", @progbits, 8; .long 911b - .; .long 1; .popsection jmp __x86_return_thunk Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Linus Torvalds Link: https://patch.msgid.link/c05ff40d3383e85c3b59018ef0b3c7aaf993a60d.1764694625.git.jpoimboe@kernel.org commit 92546f6b523b1d4757c2ee606d4d0eefc98ea26b Author: Ingo Molnar Date: Wed Dec 3 18:19:08 2025 +0000 perf/uprobes: Remove whitespace noise A few cases of space-Tab noise snuck in. Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/176478594889.498.15611228524880763978.tip-bot2@tip-bot2 commit 6f172175b6f3fe35b5d519fc314f7a0b603a9af9 Merge: 0999df60329e3e b65e179b986a48 d409f53d20933f b5b9e93bbfc020 53fbbc29dd20b9 1413717ad0c6d3 Author: Stephen Boyd Date: Wed Dec 3 10:22:37 2025 -0800 Merge branches 'clk-visconti', 'clk-imx', 'clk-microchip', 'clk-rockchip' and 'clk-qcom' into clk-next * clk-visconti: clk: visconti: Add VIIF clocks dt-bindings: clock: tmpv770x: Add VIIF clocks dt-bindings: clock: tmpv770x: Remove definition of number of clocks clk: visconti: Do not define number of clocks in bindings * clk-imx: clk: imx: add driver for imx8ulp's sim lpav dt-bindings: clock: document 8ULP's SIM LPAV clk: imx: imx8mp-audiomix: use devm_auxiliary_device_create() to simple code clk: imx: Add some delay before deassert the reset * clk-microchip: reset: mpfs: add non-auxiliary bus probing clk: lan966x: remove unused dt-bindings include clk: microchip: mpfs: use regmap for clocks dt-bindings: clk: microchip: mpfs: remove first reg region * clk-rockchip: clk: rockchip: Add clock and reset driver for RK3506 dt-bindings: clock: rockchip: Add RK3506 clock and reset unit clk: rockchip: Add clock controller for the RV1126B dt-bindings: clock, reset: Add support for rv1126b clk: rockchip: Implement rockchip_clk_register_armclk_multi_pll() dt-bindings: clock: rk3568: Drop CLK_NR_CLKS define clk: rockchip: rk3568: Drop CLK_NR_CLKS usage dt-bindings: clock: rk3568: Add SCMI clock ids * clk-qcom: (48 commits) clk: qcom: Mark camcc_sm7150_hws static clk: qcom: x1e80100-dispcc: Add USB4 router link resets dt-bindings: clock: qcom: x1e80100-dispcc: Add USB4 router link resets clk: qcom: videocc-sm8750: Add video clock controller driver for SM8750 dt-bindings: clock: qcom: Add SM8750 video clock controller clk: qcom: branch: Extend invert logic for branch2 mem clocks clk: qcom: ecpricc-qdu100: Add mem_enable_mask to the clock memory branch clk: qcom: clk_mem_branch: add enable mask and invert flags clk: qcom: mmcc-sdm660: Add missing MDSS reset dt-bindings: clock: mmcc-sdm660: Add missing MDSS reset clk: qcom: use different Kconfig prompts for APSS IPQ5424/6018 drivers clk: qcom: apss-ipq5424: remove unused 'apss_clk' structure dt-bindings: clock: qcom: Add Kaanapali Global clock controller dt-bindings: clock: qcom: Document the Kaanapali TCSR Clock Controller dt-bindings: clock: qcom-rpmhcc: Add RPMHCC for Kaanapali clk: qcom: tcsrcc-glymur: Update register offsets for clock refs clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops clk: qcom: camcc-sm7150: Fix PLL config of PLL2 clk: qcom: camcc-sm6350: Fix PLL config of PLL2 clk: qcom: Add NSS clock controller driver for IPQ5424 ... commit 0999df60329e3e643ef3f9de72d85e712e481766 Merge: 5c534939ddfb88 f700b882a7aede b276445e98fe28 7ee9719771eb31 1c0608d860db97 Author: Stephen Boyd Date: Wed Dec 3 10:22:24 2025 -0800 Merge branches 'clk-socfpga', 'clk-renesas', 'clk-cleanup', 'clk-samsung' and 'clk-mediatek' into clk-next * clk-socfpga: clk: socfpga: agilex5: add clock driver for Agilex5 * clk-renesas: (35 commits) clk: renesas: r9a09g077: Add SPI module clocks clk: renesas: r9a09g056: Add USB3.0 clocks/resets clk: renesas: r9a09g057: Add USB3.0 clocks/resets clk: renesas: r9a09g047: Add RSCI clocks/resets dt-bindings: clock: renesas,r9a09g056-cpg: Add USB3.0 core clocks dt-bindings: clock: renesas,r9a09g057-cpg: Add USB3.0 core clocks clk: renesas: r9a06g032: Fix memory leak in error path clk: renesas: r9a09g077: Use devm_ helpers for divider clock registration clk: renesas: r9a09g077: Remove stray blank line clk: renesas: r9a09g077: Propagate rate changes to parent clocks clk: renesas: r8a779a0: Add 3DGE module clock clk: renesas: r8a779a0: Add ZG Core clock clk: renesas: rcar-gen4: Add support for clock dividers in FRQCRB dt-bindings: clock: r8a779a0: Add ZG core clock clk: renesas: r9a09g056: Add clock and reset entries for ISP clk: renesas: r9a09g056: Add support for PLLVDO, CRU clocks, and resets clk: renesas: r9a09g056: Add clocks and resets for DSI and LCDC modules clk: renesas: r9a09g077: Add TSU module clock clk: renesas: r9a09g057: Add clock and reset entries for DSI and LCDC clk: renesas: rzv2h: Add support for DSI clocks ... * clk-cleanup: clk: keystone: fix compile testing clk: keystone: syscon-clk: fix regmap leak on probe failure clk: samsung: exynos-clkout: Assign .num before accessing .hws clk: actions: Fix discarding const qualifier by 'container_of' macro clk: spacemit: Set clk_hw_onecell_data::num before using flex array clk: spacemit: fix comment typo clk: keystone: Fix discarded const qualifiers clk: sprd: sc9860: Simplify with of_device_get_match_data() * clk-samsung: firmware: exynos-acpm: add empty method to allow compile test MAINTAINERS: add ACPM clock bindings and driver clk: samsung: add Exynos ACPM clock driver firmware: exynos-acpm: register ACPM clocks pdev firmware: exynos-acpm: add DVFS protocol dt-bindings: firmware: google,gs101-acpm-ipc: add ACPM clocks clk: samsung: clk-pll: simplify samsung_pll_lock_wait() clk: samsung: exynosautov920: add block mfc clock support clk: samsung: exynosautov920: add clock support dt-bindings: clock: exynosautov920: add mfc clock definitions dt-bindings: clock: exynosautov920: add m2m clock definitions dt-bindings: clock: google,gs101-clock: add power-domains * clk-mediatek: clk: en7523: Add reset-controller support for EN7523 SoC dt-bindings: clock: airoha: Add reset support to EN7523 clock binding commit 121cc35cfb55ab0bcf04c8ba6b364a0990eb2449 Merge: 7fc2cd2e4b398c 9a948eefad594c Author: Linus Torvalds Date: Wed Dec 3 09:53:48 2025 -0800 Merge tag 'lsm-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull LSM updates from Paul Moore: - Rework the LSM initialization code What started as a "quick" patch to enable a notification event once all of the individual LSMs were initialized, snowballed a bit into a 30+ patch patchset when everything was done. Most of the patches, and diffstat, is due to splitting out the initialization code into security/lsm_init.c and cleaning up some of the mess that was there. While not strictly necessary, it does cleanup the code signficantly, and hopefully makes the upkeep a bit easier in the future. Aside from the new LSM_STARTED_ALL notification, these changes also ensure that individual LSM initcalls are only called when the LSM is enabled at boot time. There should be a minor reduction in boot times for those who build multiple LSMs into their kernels, but only enable a subset at boot. It is worth mentioning that nothing at present makes use of the LSM_STARTED_ALL notification, but there is work in progress which is dependent upon LSM_STARTED_ALL. - Make better use of the seq_put*() helpers in device_cgroup * tag 'lsm-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (36 commits) lsm: use unrcu_pointer() for current->cred in security_init() device_cgroup: Refactor devcgroup_seq_show to use seq_put* helpers lsm: add a LSM_STARTED_ALL notification event lsm: consolidate all of the LSM framework initcalls selinux: move initcalls to the LSM framework ima,evm: move initcalls to the LSM framework lockdown: move initcalls to the LSM framework apparmor: move initcalls to the LSM framework safesetid: move initcalls to the LSM framework tomoyo: move initcalls to the LSM framework smack: move initcalls to the LSM framework ipe: move initcalls to the LSM framework loadpin: move initcalls to the LSM framework lsm: introduce an initcall mechanism into the LSM framework lsm: group lsm_order_parse() with the other lsm_order_*() functions lsm: output available LSMs when debugging lsm: cleanup the debug and console output in lsm_init.c lsm: add/tweak function header comment blocks in lsm_init.c lsm: fold lsm_init_ordered() into security_init() lsm: cleanup initialize_lsm() and rename to lsm_init_single() ... commit 1c3377bee2127f98f16705376a36326c98113d1c Author: Ingo Molnar Date: Wed Dec 3 18:29:59 2025 +0100 x86/boot/Documentation: Prefix hexadecimal literals with 0x The x86 bootloader ID specification text uses hexadecimal values without a 0x prefix: D kexec-tools E Extended (see ext_loader_type) F Special (0xFF = undefined) 10 Reserved 11 Minimal Linux Bootloader 12 OVMF UEFI virtualization stack 13 barebox Which beyond the ambiguity of '13' in isolation, also made me fail a grep -wi '0xd' when I was looking for the kexec bootloader ID definition and caused quite a bit of head-scratching before I found out why it didn't show up. Furthermore, the actual explanatory text uses the 0x prefix: For boot loader IDs above T = 0xD, write T = 0xE to this field and write the extended ID minus 0x10 to the ext_loader_type field. Similarly, the ext_loader_ver field can be used to provide more than four bits for the bootloader version. So make it all both unambiguous, easy to grep and consistent across the entire documentation by prefixing the IDs with 0x. Signed-off-by: Ingo Molnar Cc: "H. Peter Anvin" Cc: linux-kernel@vger.kernel.org commit c7957da77708c74a95d60340c6d3c1a3617cd248 Author: Ingo Molnar Date: Wed Dec 3 18:25:13 2025 +0100 x86/boot/Documentation: Spell 'ID' consistently The bootloader ID specification text uses 2 capitalization variants for the same thing: 'id', 'ids', 'ID' and 'IDs'. Use 'ID/IDs' consistently. Signed-off-by: Ingo Molnar Cc: "H. Peter Anvin" Cc: linux-kernel@vger.kernel.org commit 7fc2cd2e4b398c57c9cf961cfea05eadbf34c05c Merge: b082c4b0605613 62cd5d480b9762 Author: Linus Torvalds Date: Wed Dec 3 09:45:23 2025 -0800 Merge tag 'keys-trusted-next-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull trusted key updates from Jarkko Sakkinen: - Remove duplicate 'tpm2_hash_map' in favor of 'tpm2_find_hash_alg()' - Fix a memory leak on failure paths of 'tpm2_load_cmd' * tag 'keys-trusted-next-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: Fix a memory leak in tpm2_load_cmd KEYS: trusted: Replace a redundant instance of tpm2_hash_map commit b082c4b06056139b2f3e0a8a0fa3235e145fba80 Merge: f2310b6271dc54 8c8e3df3d2f51e Author: Linus Torvalds Date: Wed Dec 3 09:41:04 2025 -0800 Merge tag 'keys-next-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull keys update from Jarkko Sakkinen: "This contains only three fixes" * tag 'keys-next-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: keys: Fix grammar and formatting in 'struct key_type' comments keys: Replace deprecated strncpy in ecryptfs_fill_auth_tok keys: Remove redundant less-than-zero checks commit f2310b6271dc54278337987ec8140175e8df16f4 Merge: 82d7a9da6e5ba4 1d573464749cfc Author: Linus Torvalds Date: Wed Dec 3 09:23:25 2025 -0800 Merge tag 'nolibc-20251130-for-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: - Preparations to the use of nolibc in UML: - Cleanup of sparse warnings - Library mode without _start() - More consistency when disabling errno - Unconditional installation of all architecture support files - Always 64-bit wide ino_t and off_t - Various cleanups and bug fixes * tag 'nolibc-20251130-for-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (25 commits) selftests/nolibc: error out on linker warnings selftests/nolibc: use lld to link loongarch binaries tools/nolibc: remove more __nolibc_enosys() fallbacks tools/nolibc: remove now superfluous overflow check in llseek tools/nolibc: use 64-bit off_t tools/nolibc: prefer the llseek syscall tools/nolibc: handle 64-bit off_t for llseek tools/nolibc: use 64-bit ino_t tools/nolibc: avoid using plain integer as NULL pointer tools/nolibc: add support for fchdir() tools/nolibc: clean up outdated comments in generic arch.h tools/nolibc: make the "headers" target install all supported archs tools/nolibc: add the more portable inttypes.h tools/nolibc: provide the portable sys/select.h tools/nolibc: add missing memchr() to string.h tools/nolibc: fix misleading help message regarding installation path tools/nolibc: add uio.h with readv and writev tools/nolibc: add option to disable runtime tools/nolibc: use __fallthrough__ rather than fallthrough tools/nolibc: implement %m if errno is not defined ... commit 39191ce5dbfd65fededb4f0d408d6232c45766ba Author: Johan Hovold Date: Wed Dec 3 11:55:41 2025 +0100 ASoc: qcom: q6afe: fix bad guard conversion A recent spinlock guard conversion used the wrong guard so that interrupts are no longer disabled while holding the port list lock. Based on a cursory look this appears to be safe currently, but it could cause a deadlock if one of these helpers are ever called in interrupt context. Fixes: 4b1edbb028fb ("ASoC: qcom: q6afe: Use guard() for spin locks") Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251203105542.24765-2-johan@kernel.org Signed-off-by: Mark Brown commit 82d7a9da6e5ba41623c0959fbe03574cbae4ce9c Author: Rob Herring (Arm) Date: Wed Dec 3 09:24:36 2025 -0600 dt-bindings: thermal: qcom-tsens: Remove invalid tab character Commit 1ee90870ce79 ("dt-bindings: thermal: tsens: Add QCS8300 compatible") uses a tab character which is illegal in YAML (at the beginning of a line). The original patch was correct, so this got corrupted when applied. Fixes: 1ee90870ce79 ("dt-bindings: thermal: tsens: Add QCS8300 compatible") Signed-off-by: Rob Herring (Arm) Signed-off-by: Linus Torvalds commit ad374eb9b33fc4738f21e57658073a04f77d493d Author: Srinivas Pandruvada Date: Fri Nov 7 17:03:34 2025 -0800 tools/power/x86/intel-speed-select: v1.24 release This version includes the following changes: - Check feature status to check if the feature enablement was successful - Reset SST-TF bucket structure to display valid bucket info Signed-off-by: Srinivas Pandruvada commit 3bd486e2d990194bf696423f9a639b3674d8c4e5 Author: Srinivas Pandruvada Date: Wed Jun 11 11:29:49 2025 -0700 tools/power/x86/intel-speed-select: Reset isst_turbo_freq_info for invalid buckets With SST-TF version 2 only 3 buckets are present. The information in others buckets can be junk. So initialize the info structure of type isst_turbo_freq_info, before issing ioctl to get bucket information. Signed-off-by: Srinivas Pandruvada commit 6dc93d689068a2e41cca3c8977f2d3efd47146ee Author: Srinivas Pandruvada Date: Thu May 1 12:49:36 2025 -0700 tools/power/x86/intel-speed-select: Check feature status After change of enable/disable status of SST-CP, SST-TF and SST-BF check if the hardware status change was successful. If not successful even after retries, return failure. Signed-off-by: Srinivas Pandruvada commit f387d0e1027f2d13cbfc1305b54198af701ede19 Author: Josh Poimboeuf Date: Tue Dec 2 09:59:37 2025 -0800 x86/asm: Remove ANNOTATE_DATA_SPECIAL usage Instead of manually annotating each __ex_table entry, just make the section mergeable and store the entry size in the ELF section header. Either way works for objtool create_fake_symbols(), this way produces cleaner code generation. Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Linus Torvalds Link: https://patch.msgid.link/b858cb7891c1ba0080e22a9c32595e6c302435e2.1764694625.git.jpoimboe@kernel.org commit a818f28f017b23cfe830dd82e89b5aa6b0fea8e5 Author: Josh Poimboeuf Date: Tue Dec 2 09:59:36 2025 -0800 x86/alternative: Remove ANNOTATE_DATA_SPECIAL usage Instead of manually annotating each .altinstructions entry, just make the section mergeable and store the entry size in the ELF section header. Either way works for objtool create_fake_symbols(), this way produces cleaner code generation. Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Linus Torvalds Link: https://patch.msgid.link/5ac04e6db5be6453dce8003a771ebb0c47b4cd7a.1764694625.git.jpoimboe@kernel.org commit 954c55c658e11c0cdc4cfa85968a0a5df975e26a Author: Rob Herring (Arm) Date: Mon Dec 1 11:50:29 2025 -0600 dt-bindings: kbuild: Skip validating empty examples Extracting empty examples results in just the empty template being generated and then validated. That's pointless and not free, so filter out the schemas without any examples from the targets. There's currently a little less than 10% of the binding schema files without examples. Removing them improves the build time by ~6%. Link: https://patch.msgid.link/20251201175030.3785060-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 57d508b5f718730f74b11e0dc9609ac7976802d1 Author: Krzysztof Kozlowski Date: Wed Dec 3 15:16:45 2025 +0100 ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) 'version' is an enum, thus cast of pointer on 64-bit compile test with clang W=1 causes: rockchip_pdm.c:583:17: error: cast to smaller integer type 'enum rk_pdm_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] This was already fixed in commit 49a4a8d12612 ("ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning") but then got bad in commit 9958d85968ed ("ASoC: Use device_get_match_data()"). Discussion on LKML also pointed out that 'uintptr_t' is not the correct type and either 'kernel_ulong_t' or 'unsigned long' should be used, with several arguments towards the latter [1]. Link: https://lore.kernel.org/r/CAMuHMdX7t=mabqFE5O-Cii3REMuyaePHmqX+j_mqyrn6XXzsoA@mail.gmail.com/ [1] Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251203141644.106459-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit 2c7e5e17c05f1d5e10e63e1baff2b362cd08dcd6 Author: Krzysztof Kozlowski Date: Wed Dec 3 15:06:12 2025 +0100 ASoC: codecs: nau8325: Silence uninitialized variables warnings clang W=1 builds warn: nau8325.c:430:13: error: variable 'n2_max' is uninitialized when used here [-Werror,-Wuninitialized] which are false positive, because the variables will be always initialized when used (guarded by mclk_max!=0 check). However initializing them upfront makes the code more obvious and easier, plus it silences the warning. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251203140611.87191-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Mark Brown commit df8c841dd92a7f262ad4fa649aa493b181e02812 Author: Bagas Sanjaya Date: Wed Dec 3 08:09:11 2025 +0700 NFSD: nfsd-io-modes: Separate lists Sphinx reports htmldocs indentation warnings: Documentation/filesystems/nfs/nfsd-io-modes.rst:58: ERROR: Unexpected indentation. [docutils] Documentation/filesystems/nfs/nfsd-io-modes.rst:59: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] These caused the lists to be shown as long running paragraphs merged with their previous paragraphs. Fix these by separating the lists with a blank line. Fixes: fa8d4e6784d1b6 ("NFSD: add Documentation/filesystems/nfs/nfsd-io-modes.rst") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251202152506.7a2d2d41@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Jeff Layton Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Chuck Lever commit 4fcf9952fb3137c64e32edb5fcd03da6febe4724 Author: Bagas Sanjaya Date: Wed Dec 3 08:09:10 2025 +0700 NFSD: nfsd-io-modes: Wrap shell snippets in literal code blocks Sphinx reports htmldocs indentation warnings: Documentation/filesystems/nfs/nfsd-io-modes.rst:29: ERROR: Unexpected indentation. [docutils] Documentation/filesystems/nfs/nfsd-io-modes.rst:34: ERROR: Unexpected indentation. [docutils] Fix these by wrapping shell snippets in literal code blocks. Fixes: fa8d4e6784d1b6 ("NFSD: add Documentation/filesystems/nfs/nfsd-io-modes.rst") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251202152506.7a2d2d41@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Jeff Layton Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Chuck Lever commit 21478b6ecaa443ee5a89ae744559583ffbe50f30 Author: Bagas Sanjaya Date: Wed Dec 3 08:09:09 2025 +0700 NFSD: Add toctree entry for NFSD IO modes docs Commit fa8d4e6784d1b6 ("NFSD: add Documentation/filesystems/nfs/nfsd-io-modes.rst") adds documentation for NFSD I/O modes, but it forgets to add toctree entry for it. Hence, Sphinx reports: Documentation/filesystems/nfs/nfsd-io-modes.rst: WARNING: document isn't included in any toctree [toc.not_included] Add the entry. Fixes: fa8d4e6784d1b6 ("NFSD: add Documentation/filesystems/nfs/nfsd-io-modes.rst") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251202152506.7a2d2d41@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Jeff Layton Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Chuck Lever commit 84c8097e677478b64e10b6e44e3857eb0f02ba68 Author: Bartosz Golaszewski Date: Wed Dec 3 09:47:37 2025 +0100 regulator: check the return value of gpiod_set_value_cansleep() gpiod_set_value_cansleep() now returns an integer and can indicate failures in the GPIO layer. Propagate any potential errors to regulator core. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251203084737.15891-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Mark Brown commit 1f8f726a2a29c28f65b30880335a1610c5e63594 Author: Shengjiu Wang Date: Wed Dec 3 18:05:29 2025 +0800 ASoC: ak5558: Disable regulator when error happens Disable regulator in runtime resume when error happens to balance the reference count of regulator. Fixes: 2ff6d5a108c6 ("ASoC: ak5558: Add regulator support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20251203100529.3841203-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit ae585fabb9713a43e358cf606451386757225c95 Author: Shengjiu Wang Date: Wed Dec 3 18:05:28 2025 +0800 ASoC: ak4458: Disable regulator when error happens Disable regulator in runtime resume when error happens to balance the reference count of regulator. Fixes: 7e3096e8f823 ("ASoC: ak4458: Add regulator support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20251203100529.3841203-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 7d80e248e8fc4c70f8feac4989f3666878039565 Author: Johan Hovold Date: Wed Dec 3 11:52:06 2025 +0100 gpio: mmio: fix bad guard conversion A recent spinlock guard conversion consistently used the wrong guard so that interrupts are no longer disabled while holding the chip lock (which can cause deadlocks). Fixes: 7e061b462b3d ("gpio: mmio: use lock guards") Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20251203105206.24453-1-johan@kernel.org Signed-off-by: Bartosz Golaszewski commit 3ee257aba1d56c3f0f1028669a8ad0f1a477f05b Author: Hemalatha Pinnamreddy Date: Wed Dec 3 12:16:48 2025 +0530 ASoC: amd: acp: Audio is not resuming after s0ix Audio fails to resume after system exits suspend mode due to accessing incorrect ring buffer address during resume. This patch resolves issue by selecting correct address based on the ACP version. Fixes: f6f7d25b11033 ("ASoC: amd: acp: Add pte configuration for ACP7.0 platform") Signed-off-by: Hemalatha Pinnamreddy Signed-off-by: Raghavendra Prasad Mallela Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251203064650.2554625-1-raghavendraprasad.mallela@amd.com Signed-off-by: Mark Brown commit 270d32cd0efc2ac87584883c0c2f3eb0f47f1415 Author: Shengjiu Wang Date: Wed Dec 3 18:28:36 2025 +0800 ASoC: dt-bindings: cirrus,cs42xx8: Reference common DAI properties Reference the dai-common.yaml schema to allow '#sound-dai-cells' and "sound-name-prefix' to be used because cirrus,cs42xx8 is codec DAI. Signed-off-by: Shengjiu Wang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251203102836.3856471-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 0ebbd45c33d0049ebf5a22c1434567f0c420b333 Author: Haotian Zhang Date: Tue Dec 2 18:16:42 2025 +0800 ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() bcm63xx_soc_pcm_new() does not check the return value of of_dma_configure(), which may fail with -EPROBE_DEFER or other errors, allowing PCM setup to continue with incomplete DMA configuration. Add error checking for of_dma_configure() and return on failure. Fixes: 88eb404ccc3e ("ASoC: brcm: Add DSL/PON SoC audio driver") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251202101642.492-1-vulab@iscas.ac.cn Signed-off-by: Mark Brown commit 473b9f331718267815649cd93801da832200db71 Author: Danilo Krummrich Date: Wed Dec 3 10:01:50 2025 +1300 rust: pci: fix build failure when CONFIG_PCI_MSI is disabled When CONFIG_PCI_MSI is disabled pci_alloc_irq_vectors() and pci_free_irq_vectors() are defined as inline functions and hence require a Rust helper. error[E0425]: cannot find function `pci_alloc_irq_vectors` in crate `bindings` --> rust/kernel/pci/irq.rs:144:23 | 144 | ...s::pci_alloc_irq_vectors(dev.as_raw(), min_vecs, max_vecs, irq_types.as_raw()) | ^^^^^^^^^^^^^^^^^^^^^ help: a function with a similar name exists: `pci_irq_vector` | ::: .../rust/bindings/bindings_helpers_generated.rs:1197:5 | 1197 | pub fn pci_irq_vector(pdev: *mut pci_dev, nvec: ffi::c_uint) -> ffi::c_int; | --------------------------------------------------------------------------- similarly named function `pci_irq_vector` defined here error[E0425]: cannot find function `pci_free_irq_vectors` in crate `bindings` --> rust/kernel/pci/irq.rs:170:28 | 170 | unsafe { bindings::pci_free_irq_vectors(self.dev.as_raw()) }; | ^^^^^^^^^^^^^^^^^^^^ help: a function with a similar name exists: `pci_irq_vector` | ::: .../rust/bindings/bindings_helpers_generated.rs:1197:5 | 1197 | pub fn pci_irq_vector(pdev: *mut pci_dev, nvec: ffi::c_uint) -> ffi::c_int; | --------------------------------------------------------------------------- similarly named function `pci_irq_vector` defined here error: aborting due to 2 previous errors Fix this by adding the corresponding helpers. Fixes: 340ccc973544 ("rust: pci: Allocate and manage PCI interrupt vectors") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512012238.YgVvRRUx-lkp@intel.com/ Reviewed-by: Alice Ryhl Reviewed-by: Joel Fernandes Link: https://patch.msgid.link/20251202210501.40998-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit aa8aba61d4e17e23ae048098b81f65840a7d5722 Author: Mateusz Guzik Date: Mon Dec 1 14:20:37 2025 +0100 fs: assert on I_FREEING not being set in iput() and iput_not_last() Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251201132037.22835-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 222047f68e8565c558728f792f6fef152a1d4d51 Author: Rafael J. Wysocki Date: Tue Dec 2 19:27:29 2025 +0100 fs: PM: Fix reverse check in filesystems_freeze_callback() The freeze_all_ptr check in filesystems_freeze_callback() introduced by commit a3f8f8662771 ("power: always freeze efivarfs") is reverse which quite confusingly causes all file systems to be frozen when filesystem_freeze_enabled is false. On my systems it causes the WARN_ON_ONCE() in __set_task_frozen() to trigger, most likely due to an attempt to freeze a file system that is not ready for that. Add a logical negation to the check in question to reverse it as appropriate. Fixes: a3f8f8662771 ("power: always freeze efivarfs") Cc: 6.18+ # 6.18+ Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12788397.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Christian Brauner commit 4cbae3748fc479f1944e8ef2b3ed4a05cd799ce8 Author: Ludovic Desroches Date: Wed Nov 26 15:44:45 2025 +0100 drm/gem-shmem: revert the 8-byte alignment constraint Using drm_mode_size_dumb() to compute the size of dumb buffers introduced an 8-byte alignment constraint on the pitch that wasn’t present before. Let’s remove this constraint, which isn’t necessarily required and may cause buffers to be allocated larger than needed. Signed-off-by: Ludovic Desroches Reviewed-by: Thomas Zimmermann Fixes: 4977dcecb931 ("drm/gem-shmem: Compute dumb-buffer sizes with drm_mode_size_dumb()") Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251126-lcd_pitch_alignment-v1-2-991610a1e369@microchip.com commit 56715b45e3bfecf82e6404df19a10699a67c3a74 Author: Ludovic Desroches Date: Wed Nov 26 15:44:44 2025 +0100 drm/gem-dma: revert the 8-byte alignment constraint Using drm_mode_size_dumb() to compute the size of dumb buffers introduced an 8-byte alignment constraint on the pitch that wasn’t present before. Let’s remove this constraint, which isn’t necessarily required and may cause buffers to be allocated larger than needed. Signed-off-by: Ludovic Desroches Reviewed-by: Thomas Zimmermann Fixes: dcacfcd35cef ("drm/gem-dma: Compute dumb-buffer sizes with drm_mode_size_dumb()") Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251126-lcd_pitch_alignment-v1-1-991610a1e369@microchip.com commit ccb61a328321ba3f8567e350664c9ca7a42b6c70 Author: Anton Khirnov Date: Sat Nov 29 11:13:08 2025 +0100 platform/x86: asus-wmi: use brightness_set_blocking() for kbd led kbd_led_set() can sleep, and so may not be used as the brightness_set() callback. Otherwise using this led with a trigger leads to system hangs accompanied by: BUG: scheduling while atomic: acpi_fakekeyd/2588/0x00000003 CPU: 4 UID: 0 PID: 2588 Comm: acpi_fakekeyd Not tainted 6.17.9+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.9-1 Hardware name: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B9403CVAR/B9403CVAR, BIOS B9403CVAR.311 12/24/2024 Call Trace: [...] schedule_timeout+0xbd/0x100 __down_common+0x175/0x290 down_timeout+0x67/0x70 acpi_os_wait_semaphore+0x57/0x90 [...] asus_wmi_evaluate_method3+0x87/0x190 [asus_wmi] led_trigger_event+0x3f/0x60 [...] Fixes: 9fe44fc98ce4 ("platform/x86: asus-wmi: Simplify the keyboard brightness updating process") Signed-off-by: Anton Khirnov Reviewed-by: Andy Shevchenko Reviewed-by: Denis Benato Link: https://patch.msgid.link/20251129101307.18085-3-anton@khirnov.net Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f7231cff1f3ff8259bef02dc4999bc132abf29cf Author: Jacopo Mondi Date: Wed Dec 3 08:55:34 2025 +0000 media: uapi: c3-isp: Fix documentation warning Building htmldocs generates a warning: WARNING: include/uapi/linux/media/amlogic/c3-isp-config.h:199 error: Cannot parse struct or union! Which correctly highlights that the c3_isp_params_block_header symbol is wrongly documented as a struct while it's a plain #define instead. Fix this by removing the 'struct' identifier from the documentation of the c3_isp_params_block_header symbol. [ribalda: Add Closes:] Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20251127131425.4b5b6644@canb.auug.org.au/ Fixes: 45662082855c ("media: uapi: Convert Amlogic C3 to V4L2 extensible params") Cc: stable@vger.kernel.org Signed-off-by: Jacopo Mondi Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c Author: Xingui Yang Date: Tue Dec 2 14:56:27 2025 +0800 scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d. When probing the exp-attached sata device, libsas/libata will issue a hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a broadcast event will be received after the disk probe fails, and this commit causes the probe will be re-executed on the disk, and a faulty disk may get into an indefinite loop of probe. Therefore, revert this commit, although it can fix some temporary issues with disk probe failure. Signed-off-by: Xingui Yang Reviewed-by: Jason Yan Reviewed-by: John Garry Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com Signed-off-by: Martin K. Petersen commit d98b4d52bff02d15ea73b1790d7610a2f4f023ab Author: Bean Huo Date: Tue Dec 2 16:51:38 2025 +0100 scsi: ufs: core: Fix RPMB link error by reversing Kconfig dependencies When CONFIG_SCSI_UFSHCD=y and CONFIG_RPMB=m, the kernel fails to link with undefined references to ufs_rpmb_probe() and ufs_rpmb_remove(): ld: drivers/ufs/core/ufshcd.c:8950: undefined reference to `ufs_rpmb_probe' ld: drivers/ufs/core/ufshcd.c:10505: undefined reference to `ufs_rpmb_remove' The issue is that RPMB depends on its consumers (MMC, UFS) in Kconfig, which is backwards. This prevents proper module dependency handling when the library is modular but consumers are built-in. Fix by reversing the dependency: - Remove 'depends on MMC || SCSI_UFSHCD' from RPMB Kconfig - Add 'depends on RPMB || !RPMB' to SCSI_UFSHCD Kconfig This allows RPMB to be an independent library while ensuring correct linking in all module/built-in combinations. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511300443.h7sotuL0-lkp@intel.com/ Suggested-by: Arnd Bergmann Cc: Bart Van Assche Cc: Jens Wiklander Cc: Ulf Hansson Signed-off-by: Bean Huo Reviewed-by: Arnd Bergmann Reviewed-by: Jens Wiklander Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251202155138.2607210-1-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen commit 34e271ae55382fbdb04f3e13e856457d8e0dee45 Author: Namhyung Kim Date: Tue Dec 2 15:57:18 2025 -0800 perf test: Add kallsyms split test Create a fake root directory for /proc/{version,modules,kallsyms} in /tmp for testing. The kallsyms has a bad symbol in the module and it causes the main map splitted. The test ensures it only has two maps - kernel and the module and it finds the initial map after the module without creating the split maps like [kernel].0 and so on. $ perf test -vv "split kallsyms" 69: split kallsyms: --- start --- test child forked, pid 1016196 try to create fake root directory create kernel maps from the fake root directory maps__set_modules_path_dir: cannot open /tmp/perf-test.Zrv6Sy/lib/modules/X.Y.Z dir Problems setting modules path maps, continuing anyway... Failed to open /tmp/perf-test.Zrv6Sy/proc/kcore. Note /proc/kcore requires CAP_SYS_RAWIO capability to access. Using /tmp/perf-test.Zrv6Sy/proc/kallsyms for symbols kernel map loaded - check symbol and map ---- end(0) ---- 69: split kallsyms : Ok Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 4fba95fc383f9231ba486512ee1c9d60b8f4a9a4 Author: Namhyung Kim Date: Tue Dec 2 15:57:17 2025 -0800 perf tools: Use machine->root_dir to find /proc/kallsyms This is for test functions to find the kallsyms correctly. It can find the machine from the kernel maps and use its root_dir. This is helpful to setup fake /proc directory for testing. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 295d8a03ca04858d956efdaf4ac2a3be3fc05108 Author: Namhyung Kim Date: Tue Dec 2 15:57:16 2025 -0800 perf tools: Fallback to initial kernel map properly In maps__split_kallsyms(), it assumes new kernel map when it finds a symbol without module after any module and the initial kernel map has some symbols. Because it expects modules are out of the kernel map so modules should not have symbols in the kernel map. For example, the following memory map shows symbols and maps. Any symbols in the module 1 area will go to the module 1. The main kernel map starts at 0xffffffffbc200000. But if any symbol has a module between the symbols in that area, next symbols after 0xffffffffbd008000 will generate new kernel maps like [kernel].1. kernel address | | | | 0xffffffffc0000000 |---------------------| | (symbols) | | ... | <--- [kernel].N 0xffffffffbc400000 |---------------------| | (symbols) | | module 2 | <--- bad? 0xffffffffbc380000 |---------------------| | ... | | (symbols) | | [kernel.kallsyms] | <--- initial map 0xffffffffbc200000 |---------------------| | | | | 0xffffffffabcde000 |---------------------| | (symbols) | | module 1 | 0xffffffffabcd0000 |---------------------| This is very fragile when the module has a symbol that falls into the main kernel map for some reason. My system has a livepatch module with such symbols. And it created a lot of new kernel maps after those symbols. But the symbol may have broken addresses and the later symbols can still be found in the initial kernel map. Let's check the symbol address in the initial map and use it if found. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit ad0b9c4865b98dc37f4d606d26b1c19808796805 Author: Namhyung Kim Date: Tue Dec 2 15:57:15 2025 -0800 perf tools: Fix split kallsyms DSO counting It's counted twice as it's increased after calling maps__insert(). I guess we want to increase it only after it's added properly. Reviewed-by: Ian Rogers Fixes: 2e538c4a1847291cf ("perf tools: Improve kernel/modules symbol lookup") Signed-off-by: Namhyung Kim commit 7da4d60db33cccd8f4c445ab20bba71531435ee5 Author: Namhyung Kim Date: Tue Dec 2 15:57:14 2025 -0800 perf tools: Mark split kallsyms DSOs as loaded The maps__split_kallsyms() will split symbols to module DSOs if it comes from a module. It also handled some unusual kernel symbols after modules by creating new kernel maps like "[kernel].0". But they are pseudo DSOs to have those unexpected symbols. They should not be considered as unloaded kernel DSOs. Otherwise the dso__load() for them will end up calling dso__load_kallsyms() and then maps__split_kallsyms() again and again. Reviewed-by: Ian Rogers Fixes: 2e538c4a1847291cf ("perf tools: Improve kernel/modules symbol lookup") Signed-off-by: Namhyung Kim commit 405f5756bbd231e6b70949909a526bdaf538e2fc Author: Namhyung Kim Date: Thu Nov 20 15:48:04 2025 -0800 perf tools: Flush remaining samples w/o deferred callchains It's possible that some kernel samples don't have matching deferred callchain records when the profiling session was ended before the threads came back to userspace. Let's flush the samples before finish the session. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 9b4525fd089decf3557eff4a3ef348cdc2b68353 Author: Namhyung Kim Date: Thu Nov 20 15:48:03 2025 -0800 perf tools: Merge deferred user callchains Save samples with deferred callchains in a separate list and deliver them after merging the user callchains. If users don't want to merge they can set tool->merge_deferred_callchains to false to prevent the behavior. With previous result, now perf script will show the merged callchains. $ perf script ... pwd 2312 121.163435: 249113 cpu/cycles/P: ffffffff845b78d8 __build_id_parse.isra.0+0x218 ([kernel.kallsyms]) ffffffff83bb5bf6 perf_event_mmap+0x2e6 ([kernel.kallsyms]) ffffffff83c31959 mprotect_fixup+0x1e9 ([kernel.kallsyms]) ffffffff83c31dc5 do_mprotect_pkey+0x2b5 ([kernel.kallsyms]) ffffffff83c3206f __x64_sys_mprotect+0x1f ([kernel.kallsyms]) ffffffff845e6692 do_syscall_64+0x62 ([kernel.kallsyms]) ffffffff8360012f entry_SYSCALL_64_after_hwframe+0x76 ([kernel.kallsyms]) 7f18fe337fa7 mprotect+0x7 (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) 7f18fe330e0f _dl_sysdep_start+0x7f (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) 7f18fe331448 _dl_start_user+0x0 (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) ... The old output can be get using --no-merge-callchain option. Also perf report can get the user callchain entry at the end. $ perf report --no-children --stdio -q -S __build_id_parse.isra.0 # symbol: __build_id_parse.isra.0 8.40% pwd [kernel.kallsyms] | ---__build_id_parse.isra.0 perf_event_mmap mprotect_fixup do_mprotect_pkey __x64_sys_mprotect do_syscall_64 entry_SYSCALL_64_after_hwframe mprotect _dl_sysdep_start _dl_start_user Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 25a9dd56cf84300f0e08609aeef1418bcf0f097d Author: Namhyung Kim Date: Thu Nov 20 15:48:02 2025 -0800 perf script: Display PERF_RECORD_CALLCHAIN_DEFERRED Handle the deferred callchains in the script output. $ perf script ... pwd 2312 121.163435: 249113 cpu/cycles/P: ffffffff845b78d8 __build_id_parse.isra.0+0x218 ([kernel.kallsyms]) ffffffff83bb5bf6 perf_event_mmap+0x2e6 ([kernel.kallsyms]) ffffffff83c31959 mprotect_fixup+0x1e9 ([kernel.kallsyms]) ffffffff83c31dc5 do_mprotect_pkey+0x2b5 ([kernel.kallsyms]) ffffffff83c3206f __x64_sys_mprotect+0x1f ([kernel.kallsyms]) ffffffff845e6692 do_syscall_64+0x62 ([kernel.kallsyms]) ffffffff8360012f entry_SYSCALL_64_after_hwframe+0x76 ([kernel.kallsyms]) b00000006 (cookie) ([unknown]) pwd 2312 121.163447: DEFERRED CALLCHAIN [cookie: b00000006] 7f18fe337fa7 mprotect+0x7 (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) 7f18fe330e0f _dl_sysdep_start+0x7f (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) 7f18fe331448 _dl_start_user+0x0 (/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2) Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 27ddc1d7a6b79ae76f5c07af293fde966da8221b Author: Namhyung Kim Date: Thu Nov 20 15:48:01 2025 -0800 perf record: Add --call-graph fp,defer option for deferred callchains Add a new callchain record mode option for deferred callchains. For now it only works with FP (frame-pointer) mode. And add the missing feature detection logic to clear the flag on old kernels. $ perf record --call-graph fp,defer -vv true ... ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) size 136 config 0 (PERF_COUNT_HW_CPU_CYCLES) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CALLCHAIN|PERIOD read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 freq 1 enable_on_exec 1 task 1 sample_id_all 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 defer_callchain 1 defer_output 1 ------------------------------------------------------------ sys_perf_event_open: pid 162755 cpu 0 group_fd -1 flags 0x8 sys_perf_event_open failed, error -22 switching off deferred callchain support Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit d7ba853c0e47d57805181f5269ba250270d2adde Author: Yanzhu Huang Date: Wed Nov 5 23:26:15 2025 +0000 ipe: Update documentation for script enforcement This patch adds explanation of script enforcement mechanism in admin guide documentation. Describes how IPE supports integrity enforcement for indirectly executed scripts through the AT_EXECVE_CHECK flag, and how this differs from kernel enforcement for compiled executables. Signed-off-by: Yanzhu Huang Signed-off-by: Fan Wu commit 67678189e492dc119b91c30beccd12cdbb32350e Author: Yanzhu Huang Date: Wed Nov 5 23:26:14 2025 +0000 ipe: Add AT_EXECVE_CHECK support for script enforcement This patch adds a new ipe_bprm_creds_for_exec() hook that integrates with the AT_EXECVE_CHECK mechanism. To enable script enforcement, interpreters need to incorporate the AT_EXECVE_CHECK flag when calling execveat() on script files before execution. When a userspace interpreter calls execveat() with the AT_EXECVE_CHECK flag, this hook triggers IPE policy evaluation on the script file. The hook only triggers IPE when bprm->is_check is true, ensuring it's being called from an AT_EXECVE_CHECK context. It then builds an evaluation context for an IPE_OP_EXEC operation and invokes IPE policy. The kernel returns the policy decision to the interpreter, which can then decide whether to proceed with script execution. This extends IPE enforcement to indirectly executed scripts, permitting trusted scripts to execute while denying untrusted ones. Signed-off-by: Yanzhu Huang Signed-off-by: Fan Wu commit 864468ae309943fc9a1067606098b30959e4db33 Author: Borislav Petkov (AMD) Date: Thu Oct 9 17:45:25 2025 +0200 ipe: Drop a duplicated CONFIG_ prefix in the ifdeffery Looks like it got added by mistake, perhaps editor auto-completion artifact. Drop it. No functional changes. Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Fan Wu commit 3f9f0252130e7dd60d41be0802bf58f6471c691d Merge: f617d246065531 90fb9b98fcf5e6 Author: Linus Torvalds Date: Tue Dec 2 19:00:26 2025 -0800 Merge tag 'random-6.19-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator updates from Jason Donenfeld: - Dynamically allocate cpumasks off of the stack if the kernel is configured for a lot of CPUs, to handle a -Wframe-larger-than case - The removal of next_pseudo_random32() after the last user was switched over to the prandom interface - The removal of get_random_u{8,16,32,64}_wait() functions, as there were no users of those at all - Some house keeping changes - a few grammar cleanups in the comments, system_unbound_wq was renamed to system_dfl_wq, and static_key_initialized no longer needs to be checked * tag 'random-6.19-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: complete sentence of comment random: drop check for static_key_initialized random: remove unused get_random_var_wait functions random: replace use of system_unbound_wq with system_dfl_wq random: use offstack cpumask when necessary prandom: remove next_pseudo_random32 media: vivid: use prandom random: add missing words in function comments commit f617d24606553159a271f43e36d1c71a4c317e48 Merge: 906003e1516064 5dc8d277520be6 Author: Linus Torvalds Date: Tue Dec 2 18:53:50 2025 -0800 Merge tag 'fpsimd-on-stack-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull arm64 FPSIMD on-stack buffer updates from Eric Biggers: "This is a core arm64 change. However, I was asked to take this because most uses of kernel-mode FPSIMD are in crypto or CRC code. In v6.8, the size of task_struct on arm64 increased by 528 bytes due to the new 'kernel_fpsimd_state' field. This field was added to allow kernel-mode FPSIMD code to be preempted. Unfortunately, 528 bytes is kind of a lot for task_struct. This regression in the task_struct size was noticed and reported. Recover that space by making this state be allocated on the stack at the beginning of each kernel-mode FPSIMD section. To make it easier for all the users of kernel-mode FPSIMD to do that correctly, introduce and use a 'scoped_ksimd' abstraction" * tag 'fpsimd-on-stack-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (23 commits) lib/crypto: arm64: Move remaining algorithms to scoped ksimd API lib/crypto: arm/blake2b: Move to scoped ksimd API arm64/fpsimd: Allocate kernel mode FP/SIMD buffers on the stack arm64/fpu: Enforce task-context only for generic kernel mode FPU net/mlx5: Switch to more abstract scoped ksimd guard API on arm64 arm64/xorblocks: Switch to 'ksimd' scoped guard API crypto/arm64: sm4 - Switch to 'ksimd' scoped guard API crypto/arm64: sm3 - Switch to 'ksimd' scoped guard API crypto/arm64: sha3 - Switch to 'ksimd' scoped guard API crypto/arm64: polyval - Switch to 'ksimd' scoped guard API crypto/arm64: nhpoly1305 - Switch to 'ksimd' scoped guard API crypto/arm64: aes-gcm - Switch to 'ksimd' scoped guard API crypto/arm64: aes-blk - Switch to 'ksimd' scoped guard API crypto/arm64: aes-ccm - Switch to 'ksimd' scoped guard API raid6: Move to more abstract 'ksimd' guard API crypto: aegis128-neon - Move to more abstract 'ksimd' guard API crypto/arm64: sm4-ce-gcm - Avoid pointless yield of the NEON unit crypto/arm64: sm4-ce-ccm - Avoid pointless yield of the NEON unit crypto/arm64: aes-ce-ccm - Avoid pointless yield of the NEON unit lib/crc: Switch ARM and arm64 to 'ksimd' scoped guard API ... commit 906003e15160642658358153e7598302d1b38166 Merge: 8f4c9978de91a9 4f0382b0901b43 Author: Linus Torvalds Date: Tue Dec 2 18:26:54 2025 -0800 Merge tag 'libcrypto-at-least-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull 'at_least' array size update from Eric Biggers: "C supports lower bounds on the sizes of array parameters, using the static keyword as follows: 'void f(int a[static 32]);'. This allows the compiler to warn about a too-small array being passed. As discussed, this reuse of the 'static' keyword, while standard, is a bit obscure. Therefore, add an alias 'at_least' to compiler_types.h. Then, add this 'at_least' annotation to the array parameters of various crypto library functions" * tag 'libcrypto-at-least-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: sha2: Add at_least decoration to fixed-size array params lib/crypto: sha1: Add at_least decoration to fixed-size array params lib/crypto: poly1305: Add at_least decoration to fixed-size array params lib/crypto: md5: Add at_least decoration to fixed-size array params lib/crypto: curve25519: Add at_least decoration to fixed-size array params lib/crypto: chacha: Add at_least decoration to fixed-size array params lib/crypto: chacha20poly1305: Statically check fixed array lengths compiler_types: introduce at_least parameter decoration pseudo keyword wifi: iwlwifi: trans: rename at_least variable to min_mode commit 8f4c9978de91a9a3b37df1e74d6201acfba6cefd Merge: db425f7a0b158d 0e253e250ed0e4 Author: Linus Torvalds Date: Tue Dec 2 18:24:35 2025 -0800 Merge tag 'aes-gcm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull AES-GCM optimizations from Eric Biggers: "More optimizations and cleanups for the x86_64 AES-GCM code: - Add a VAES+AVX2 optimized implementation of AES-GCM. This is very helpful on CPUs that have VAES but not AVX512, such as AMD Zen 3. - Make the VAES+AVX512 optimized implementation of AES-GCM handle large amounts of associated data efficiently. - Remove the "avx10_256" implementation of AES-GCM. It's superseded by the VAES+AVX2 optimized implementation. - Rename the "avx10_512" implementation to "avx512" Overall, this fills in a gap where AES-GCM wasn't fully optimized on some recent CPUs. It also drops code that won't be as useful as initially expected due to AVX10/256 being dropped from the AVX10 spec" * tag 'aes-gcm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: x86/aes-gcm-vaes-avx2 - initialize full %rax return register crypto: x86/aes-gcm - optimize long AAD processing with AVX512 crypto: x86/aes-gcm - optimize AVX512 precomputation of H^2 from H^1 crypto: x86/aes-gcm - revise some comments in AVX512 code crypto: x86/aes-gcm - reorder AVX512 precompute and aad_update functions crypto: x86/aes-gcm - clean up AVX512 code to assume 512-bit vectors crypto: x86/aes-gcm - rename avx10 and avx10_512 to avx512 crypto: x86/aes-gcm - remove VAES+AVX10/256 optimized code crypto: x86/aes-gcm - add VAES+AVX2 optimized code commit db425f7a0b158d0dbb07c4f4653795aaad3a7a15 Merge: 5abe8d8efc022c 578fe3ff3d5bc9 Author: Linus Torvalds Date: Tue Dec 2 18:20:06 2025 -0800 Merge tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library test updates from Eric Biggers: - Add KUnit test suites for SHA-3, BLAKE2b, and POLYVAL. These are the algorithms that have new crypto library interfaces this cycle. - Remove the crypto_shash POLYVAL tests. They're no longer needed because POLYVAL support was removed from crypto_shash. Better POLYVAL test coverage is now provided via the KUnit test suite. * tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: testmgr - Remove polyval tests lib/crypto: tests: Add KUnit tests for POLYVAL lib/crypto: tests: Add additional SHAKE tests lib/crypto: tests: Add SHA3 kunit tests lib/crypto: tests: Add KUnit tests for BLAKE2b commit 5abe8d8efc022cc78b6273d01e4a453242b9f4d8 Merge: 619f4edc8d4f78 2dbb6f4a25d38f Author: Linus Torvalds Date: Tue Dec 2 18:01:03 2025 -0800 Merge tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: "This is the main crypto library pull request for 6.19. It includes: - Add SHA-3 support to lib/crypto/, including support for both the hash functions and the extendable-output functions. Reimplement the existing SHA-3 crypto_shash support on top of the library. This is motivated mainly by the upcoming support for the ML-DSA signature algorithm, which needs the SHAKE128 and SHAKE256 functions. But even on its own it's a useful cleanup. This also fixes the longstanding issue where the architecture-optimized SHA-3 code was disabled by default. - Add BLAKE2b support to lib/crypto/, and reimplement the existing BLAKE2b crypto_shash support on top of the library. This is motivated mainly by btrfs, which supports BLAKE2b checksums. With this change, all btrfs checksum algorithms now have library APIs. btrfs is planned to start just using the library directly. This refactor also improves consistency between the BLAKE2b code and BLAKE2s code. And as usual, it also fixes the issue where the architecture-optimized BLAKE2b code was disabled by default. - Add POLYVAL support to lib/crypto/, replacing the existing POLYVAL support in crypto_shash. Reimplement HCTR2 on top of the library. This simplifies the code and improves HCTR2 performance. As usual, it also makes the architecture-optimized code be enabled by default. The generic implementation of POLYVAL is greatly improved as well. - Clean up the BLAKE2s code - Add FIPS self-tests for SHA-1, SHA-2, and SHA-3" * tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (37 commits) fscrypt: Drop obsolete recommendation to enable optimized POLYVAL crypto: polyval - Remove the polyval crypto_shash crypto: hctr2 - Convert to use POLYVAL library lib/crypto: x86/polyval: Migrate optimized code into library lib/crypto: arm64/polyval: Migrate optimized code into library lib/crypto: polyval: Add POLYVAL library crypto: polyval - Rename conflicting functions lib/crypto: x86/blake2s: Use vpternlogd for 3-input XORs lib/crypto: x86/blake2s: Avoid writing back unchanged 'f' value lib/crypto: x86/blake2s: Improve readability lib/crypto: x86/blake2s: Use local labels for data lib/crypto: x86/blake2s: Drop check for nblocks == 0 lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit lib/crypto: arm, arm64: Drop filenames from file comments lib/crypto: arm/blake2s: Fix some comments crypto: s390/sha3 - Remove superseded SHA-3 code crypto: sha3 - Reimplement using library API crypto: jitterentropy - Use default sha3 implementation lib/crypto: s390/sha3: Add optimized one-shot SHA-3 digest functions lib/crypto: sha3: Support arch overrides of one-shot digest functions ... commit 619f4edc8d4f785dcabf564786e787fa8108deb4 Merge: d348c22394ad3c 63d26c3811421c Author: Linus Torvalds Date: Tue Dec 2 17:49:12 2025 -0800 Merge tag 'thermal-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These add Nova Lake processor support to the Intel thermal drivers and DPTF code, update thermal control documentation, simplify the ACPI DPTF code related to thermal control, add QCS8300 compatible to the tsens thermal DT bindings, add DT bindings for NXP i.MX91 thermal module and add support for it to the imx91 thermal driver, update a few other thermal drivers and fix a format string issue in a thermal utility: - Add Nova Lake processor thermal device to the int340x processor_thermal driver, add DLVR support for Nova Lake to it, add Nova Lake support to the ACPI DPTF code, document thermal throttling on Intel platforms, and update workload type hint interface documentation (Srinivas Pandruvada) - Remove int340x thermal scan handler from the ACPI DPTF code because it turned out to be unnecessary (Slawomir Rosek) - Clean up the Intel int340x thermal driver (Kaushlendra Kumar) - Document the RZ/V2H TSU DT bindings (Ovidiu Panait) - Document the Kaanapali Temperature Sensor (Manaf Meethalavalappu Pallikunhi) - Document R-Car Gen4 and RZ/G2 support in driver comment (Marek Vasut) - Convert to DEFINE_SIMPLE_DEV_PM_OPS() in R-Car [Gen3] (Geert Uytterhoeven) - Fix format string bug in thermal-engine (Malaya Kumar Rout) - Make ipq5018 tsens standalone compatible (George Moussalem) - Add the QCS8300 compatible for QCom Tsens (Gaurav Kohli) - Add support for the NXP i.MX91 thermal module, including the DT bindings (Pengfei Li)" * tag 'thermal-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal/drivers/imx91: Add support for i.MX91 thermal monitoring unit dt-bindings: thermal: fsl,imx91-tmu: add bindings for NXP i.MX91 thermal module dt-bindings: thermal: tsens: Add QCS8300 compatible dt-bindings: thermal: qcom-tsens: make ipq5018 tsens standalone compatible tools/thermal/thermal-engine: Fix format string bug in thermal-engine docs: driver-api/thermal/intel_dptf: Add new workload type hint thermal/drivers/rcar_gen3: Convert to DEFINE_SIMPLE_DEV_PM_OPS() thermal/drivers/rcar: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Documentation: thermal: Document thermal throttling on Intel platforms ACPI: DPTF: Support Nova Lake thermal: intel: int340x: Add DLVR support for Nova Lake thermal: int340x: processor_thermal: Add Nova Lake processor thermal device thermal: intel: int340x: Replace sprintf() with sysfs_emit() thermal: intel: int340x: Use symbolic constant for UUID comparison thermal/drivers/rcar_gen3: Document R-Car Gen4 and RZ/G2 support in driver comment dt-bindings: thermal: qcom-tsens: document the Kaanapali Temperature Sensor dt-bindings: thermal: r9a09g047-tsu: Document RZ/V2H TSU ACPI: DPTF: Remove int340x thermal scan handler thermal: intel: Select INT340X_THERMAL from INTEL_SOC_DTS_THERMAL commit d348c22394ad3c8eaf7bc693cb0ca0edc2ec5246 Merge: 959bfe496bbaf3 7cede21e9f04f1 Author: Linus Torvalds Date: Tue Dec 2 17:31:22 2025 -0800 Merge tag 'pm-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "There are quite a few interesting things here, including new hardware support, new features, some bug fixes and documentation updates. In addition, there are a usual bunch of minor fixes and cleanups all over. In the new hardware support category, there are intel_pstate and intel_rapl driver updates to support new processors, Panther Lake, Wildcat Lake, Noval Lake, and Diamond Rapids in the OOB mode, OPP and bandwidth allocation support in the tegra186 cpufreq driver, and JH7110S SOC support in dt-platdev cpufreq. The new features are the PM QoS CPU latency limit for suspend-to-idle, the netlink support for the energy model management, support for terminating system suspend via a wakeup event during the sync of file systems, configurable number of hibernation compression threads, the runtime PM auto-cleanup macros, and the "poweroff" PM event that is expected to be used during system shutdown. Bugs are mostly fixed in cpuidle governors, but there are also fixes elsewhere, like in the amd-pstate cpufreq driver. Documentation updates include, but are not limited to, a new doc on debugging shutdown hangs, cross-referencing fixes and cleanups in the intel_pstate documentation, and updates of comments in the core hibernation code. Specifics: - Introduce and document a QoS limit on CPU exit latency during wakeup from suspend-to-idle (Ulf Hansson) - Add support for building libcpupower statically (Zuo An) - Add support for sending netlink notifications to user space on energy model updates (Changwoo Mini, Peng Fan) - Minor improvements to the Rust OPP interface (Tamir Duberstein) - Fixes to scope-based pointers in the OPP library (Viresh Kumar) - Use residency threshold in polling state override decisions in the menu cpuidle governor (Aboorva Devarajan) - Add sanity check for exit latency and target residency in the cpufreq core (Rafael Wysocki) - Use this_cpu_ptr() where possible in the teo governor (Christian Loehle) - Rework the handling of tick wakeups in the teo cpuidle governor to increase the likelihood of stopping the scheduler tick in the cases when tick wakeups can be counted as non-timer ones (Rafael Wysocki) - Fix a reverse condition in the teo cpuidle governor and drop a misguided target residency check from it (Rafael Wysocki) - Clean up multiple minor defects in the teo cpuidle governor (Rafael Wysocki) - Update header inclusion to make it follow the Include What You Use principle (Andy Shevchenko) - Enable MSR-based RAPL PMU support in the intel_rapl power capping driver and arrange for using it on the Panther Lake and Wildcat Lake processors (Kuppuswamy Sathyanarayanan) - Add support for Nova Lake and Wildcat Lake processors to the intel_rapl power capping driver (Kaushlendra Kumar, Srinivas Pandruvada) - Add OPP and bandwidth support for Tegra186 (Aaron Kling) - Optimizations for parameter array handling in the amd-pstate cpufreq driver (Mario Limonciello) - Fix for mode changes with offline CPUs in the amd-pstate cpufreq driver (Gautham Shenoy) - Preserve freq_table_sorted across suspend/hibernate in the cpufreq core (Zihuan Zhang) - Adjust energy model rules for Intel hybrid platforms in the intel_pstate cpufreq driver and improve printing of debug messages in it (Rafael Wysocki) - Replace deprecated strcpy() in cpufreq_unregister_governor() (Thorsten Blum) - Fix duplicate hyperlink target errors in the intel_pstate cpufreq driver documentation and use :ref: directive for internal linking in it (Swaraj Gaikwad, Bagas Sanjaya) - Add Diamond Rapids OOB mode support to the intel_pstate cpufreq driver (Kuppuswamy Sathyanarayanan) - Use mutex guard for driver locking in the intel_pstate driver and eliminate some code duplication from it (Rafael Wysocki) - Replace udelay() with usleep_range() in ACPI cpufreq (Kaushlendra Kumar) - Minor improvements to various cpufreq drivers (Christian Marangi, Hal Feng, Jie Zhan, Marco Crivellari, Miaoqian Lin, and Shuhao Fu) - Replace snprintf() with scnprintf() in show_trace_dev_match() (Kaushlendra Kumar) - Fix memory allocation error handling in pm_vt_switch_required() (Malaya Kumar Rout) - Introduce CALL_PM_OP() macro and use it to simplify code in generic PM operations (Kaushlendra Kumar) - Add module param to backtrace all CPUs in the device power management watchdog (Sergey Senozhatsky) - Rework message printing in swsusp_save() (Rafael Wysocki) - Make it possible to change the number of hibernation compression threads (Xueqin Luo) - Clarify that only cgroup1 freezer uses PM freezer (Tejun Heo) - Add document on debugging shutdown hangs to PM documentation and correct a mistaken configuration option in it (Mario Limonciello) - Shut down wakeup source timer before removing the wakeup source from the list (Kaushlendra Kumar, Rafael Wysocki) - Introduce new PMSG_POWEROFF event for system shutdown handling with the help of PM device callbacks (Mario Limonciello) - Make pm_test delay interruptible by wakeup events (Riwen Lu) - Clean up kernel-doc comment style usage in the core hibernation code and remove unuseful comments from it (Sunday Adelodun, Rafael Wysocki) - Add support for handling wakeup events and aborting the suspend process while it is syncing file systems (Samuel Wu, Rafael Wysocki) - Add WQ_UNBOUND to pm_wq workqueue (Marco Crivellari) - Add runtime PM wrapper macros for ACQUIRE()/ACQUIRE_ERR() and use them in the PCI core and the ACPI TAD driver (Rafael Wysocki) - Improve runtime PM in the ACPI TAD driver (Rafael Wysocki) - Update pm_runtime_allow/forbid() documentation (Rafael Wysocki) - Fix typos in runtime.c comments (Malaya Kumar Rout) - Move governor.h from devfreq under include/linux/ and rename to devfreq-governor.h to allow devfreq governor definitions in out of drivers/devfreq/ (Dmitry Baryshkov) - Use min() to improve readability in tegra30-devfreq.c (Thorsten Blum) - Fix potential use-after-free issue of OPP handling in hisi_uncore_freq.c (Pengjie Zhang) - Fix typo in DFSO_DOWNDIFFERENTIAL macro name in governor_simpleondemand.c in devfreq (Riwen Lu)" * tag 'pm-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (96 commits) PM / devfreq: Fix typo in DFSO_DOWNDIFFERENTIAL macro name cpuidle: Warn instead of bailing out if target residency check fails cpuidle: Update header inclusion Documentation: power/cpuidle: Document the CPU system wakeup latency QoS cpuidle: Respect the CPU system wakeup QoS limit for cpuidle sched: idle: Respect the CPU system wakeup QoS limit for s2idle pmdomain: Respect the CPU system wakeup QoS limit for cpuidle pmdomain: Respect the CPU system wakeup QoS limit for s2idle PM: QoS: Introduce a CPU system wakeup QoS limit cpuidle: governors: teo: Add missing space to the description PM: hibernate: Extra cleanup of comments in swap handling code PM / devfreq: tegra30: use min to simplify actmon_cpu_to_emc_rate PM / devfreq: hisi: Fix potential UAF in OPP handling PM / devfreq: Move governor.h to a public header location powercap: intel_rapl: Enable MSR-based RAPL PMU support powercap: intel_rapl: Prepare read_raw() interface for atomic-context callers cpufreq: qcom-nvmem: fix compilation warning for qcom_cpufreq_ipq806x_match_list PM: sleep: Call pm_sleep_fs_sync() instead of ksys_sync_helper() PM: sleep: Add support for wakeup during filesystem sync cpufreq: ACPI: Replace udelay() with usleep_range() ... commit 959bfe496bbaf3daa5dca32d397e29ea12471779 Merge: 44fc84337b6eae af47d98064e900 Author: Linus Torvalds Date: Tue Dec 2 17:24:03 2025 -0800 Merge tag 'acpi-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These add Microsoft fan extensions support to the ACPI fan driver, fix a bug in ACPICA, update other ACPI drivers (processor, time and alarm device), update ACPI power management code and ACPI device properties management, and fix an ACPI utility: - Avoid walking the ACPI namespace in the AML interpreter if the starting node cannot be determined (Cryolitia PukNgae) - Use min() instead of min_t() in the ACPI device properties handling code to avoid discarding significant bits (David Laight) - Fix potential fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() that may prevent the parent fwnode from being released (Haotian Zhang) - Rework acpi_graph_get_next_endpoint() to use ACPI functions only, remove unnecessary conditionals from it to make it easier to follow, and make acpi_get_next_subnode() static (Sakari Ailus) - Drop unused function acpi_get_lps0_constraint(), make some Low-Power S0 callback functions for suspend-to-idle static, and rearrange the code retrieving Low-Power S0 constraints so it only runs when the constraints are actually used (Rafael Wysocki) - Drop redundant locking from the ACPI battery driver (Rafael Wysocki) - Improve runtime PM in the ACPI time and alarm device (TAD) driver using guard macros and rearrange code related to runtime PM in acpi_tad_remove() (Rafael Wysocki) - Add support for Microsoft fan extensions to the ACPI fan driver along with notification support and work around a 64-bit firmware bug in that driver (Armin Wolf) - Use ACPI_FREE() to free ACPI buffer in the ACPI DPTF code (Kaushlendra Kumar) - Fix a memory leak and a resource leak in the ACPI pfrut utility (Malaya Kumar Rout) - Replace `core::mem::zeroed` with `pin_init::zeroed` in the ACPI Rust code (Siyuan Huang) - Update the ACPI code to use the new style of allocating workqueues and new global workqueues (Marco Crivellari) - Fix two spelling mistakes in the ACPI code (Chu Guangqing) - Fix ISAPNP to generate uevents to auto-load modules (René Rebe) - Relocate the state flags initialization in the ACPI processor idle driver and drop redundant C-state count checks from it (Huisong Li) - Fix map_x2apic_id() in the ACPI processor core driver for amd-pstate on am4 (René Rebe)" * tag 'acpi-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (30 commits) ACPI: PM: Fix a spelling mistake ACPI: LPSS: Fix a spelling mistake ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 ACPICA: Avoid walking the Namespace if start_node is NULL ACPI: tools: pfrut: fix memory leak and resource leak in pfrut.c ACPI: property: use min() instead of min_t() PNP: Fix ISAPNP to generate uevents to auto-load modules ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() ACPI: DPTF: Use ACPI_FREE() for ACPI buffer deallocation ACPI: processor: idle: Drop redundant C-state count checks ACPI: thermal: Add WQ_PERCPU to alloc_workqueue() users ACPI: OSL: Add WQ_PERCPU to alloc_workqueue() users ACPI: EC: Add WQ_PERCPU to alloc_workqueue() users ACPI: OSL: replace use of system_wq with system_percpu_wq ACPI: scan: replace use of system_unbound_wq with system_dfl_wq ACPI: fan: Add support for Microsoft fan extensions ACPI: fan: Add hwmon notification support ACPI: fan: Add basic notification support ACPI: TAD: Improve runtime PM using guard macros ACPI: TAD: Rearrange runtime PM operations in acpi_tad_remove() ... commit 44fc84337b6eae580a51cf6f7ca6a22ef1349556 Merge: 2547f79b0b0cd9 edde060637b926 Author: Linus Torvalds Date: Tue Dec 2 17:03:55 2025 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "These are the arm64 updates for 6.19. The biggest part is the Arm MPAM driver under drivers/resctrl/. There's a patch touching mm/ to handle spurious faults for huge pmd (similar to the pte version). The corresponding arm64 part allows us to avoid the TLB maintenance if a (huge) page is reused after a write fault. There's EFI refactoring to allow runtime services with preemption enabled and the rest is the usual perf/PMU updates and several cleanups/typos. Summary: Core features: - Basic Arm MPAM (Memory system resource Partitioning And Monitoring) driver under drivers/resctrl/ which makes use of the fs/rectrl/ API Perf and PMU: - Avoid cycle counter on multi-threaded CPUs - Extend CSPMU device probing and add additional filtering support for NVIDIA implementations - Add support for the PMUs on the NoC S3 interconnect - Add additional compatible strings for new Cortex and C1 CPUs - Add support for data source filtering to the SPE driver - Add support for i.MX8QM and "DB" PMU in the imx PMU driver Memory managemennt: - Avoid broadcast TLBI if page reused in write fault - Elide TLB invalidation if the old PTE was not valid - Drop redundant cpu_set_*_tcr_t0sz() macros - Propagate pgtable_alloc() errors outside of __create_pgd_mapping() - Propagate return value from __change_memory_common() ACPI and EFI: - Call EFI runtime services without disabling preemption - Remove unused ACPI function Miscellaneous: - ptrace support to disable streaming on SME-only systems - Improve sysreg generation to include a 'Prefix' descriptor - Replace __ASSEMBLY__ with __ASSEMBLER__ - Align register dumps in the kselftest zt-test - Remove some no longer used macros/functions - Various spelling corrections" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (94 commits) arm64/mm: Document why linear map split failure upon vm_reset_perms is not problematic arm64/pageattr: Propagate return value from __change_memory_common arm64/sysreg: Remove unused define ARM64_FEATURE_FIELD_BITS KVM: arm64: selftests: Consider all 7 possible levels of cache KVM: arm64: selftests: Remove ARM64_FEATURE_FIELD_BITS and its last user arm64: atomics: lse: Remove unused parameters from ATOMIC_FETCH_OP_AND macros Documentation/arm64: Fix the typo of register names ACPI: GTDT: Get rid of acpi_arch_timer_mem_init() perf: arm_spe: Add support for filtering on data source perf: Add perf_event_attr::config4 perf/imx_ddr: Add support for PMU in DB (system interconnects) perf/imx_ddr: Get and enable optional clks perf/imx_ddr: Move ida_alloc() from ddr_perf_init() to ddr_perf_probe() dt-bindings: perf: fsl-imx-ddr: Add compatible string for i.MX8QM, i.MX8QXP and i.MX8DXL arm64: remove duplicate ARCH_HAS_MEM_ENCRYPT arm64: mm: use untagged address to calculate page index MAINTAINERS: new entry for MPAM Driver arm_mpam: Add kunit tests for props_mismatch() arm_mpam: Add kunit test for bitmap reset arm_mpam: Add helper to reset saved mbwu state ... commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef Author: Yuezhang Mo Date: Fri Nov 28 17:51:10 2025 +0800 exfat: fix remount failure in different process environments The kernel test robot reported that the exFAT remount operation failed. The reason for the failure was that the process's umask is different between mount and remount, causing fs_fmask and fs_dmask are changed. Potentially, both gid and uid may also be changed. Therefore, when initializing fs_context for remount, inherit these mount options from the options used during mount. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com Signed-off-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit d70a5804c563b5e34825353ba9927509df709651 Author: Namjae Jeon Date: Tue Nov 18 11:10:26 2025 +0900 exfat: fix divide-by-zero in exfat_allocate_bitmap The variable max_ra_count can be 0 in exfat_allocate_bitmap(), which causes a divide-by-zero error in the subsequent modulo operation (i % max_ra_count), leading to a system crash. When max_ra_count is 0, it means that readahead is not used. This patch load the bitmap without readahead. Fixes: 9fd688678dd8 ("exfat: optimize allocation bitmap loading time") Reported-by: Jiaming Zhang Signed-off-by: Namjae Jeon commit 866cba3675416c6cf446acb25d7c700eead1420e Author: Namjae Jeon Date: Wed Nov 12 09:42:25 2025 +0900 exfat: validate the cluster bitmap bits of directory Syzbot created this issue by testing an image that did not have the root cluster bitmap bit marked. After accessing a file through the root directory via exfat_lookup, when creating a file again with mkdir, the root cluster bit can be allocated for direcotry, which can cause the root cluster to be zeroed out and the same entry can be allocated in the same cluster. This patch improved this issue by adding exfat_test_bitmap to validate the cluster bits of the root directory and directory. And the first cluster bit of the root directory should never be unset except when storage is corrupted. This bit is set to allow operations after mount. Reported-by: syzbot+5216036fc59c43d1ee02@syzkaller.appspotmail.com Tested-by: syzbot+5216036fc59c43d1ee02@syzkaller.appspotmail.com Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 4e163c39dd4e70fcdce948b8774d96e0482b4a11 Author: Yuezhang Mo Date: Mon Oct 27 17:03:41 2025 +0800 exfat: zero out post-EOF page cache on file extension xfstests generic/363 was failing due to unzeroed post-EOF page cache that allowed mmap writes beyond EOF to become visible after file extension. For example, in following xfs_io sequence, 0x22 should not be written to the file but would become visible after the extension: xfs_io -f -t -c "pwrite -S 0x11 0 8" \ -c "mmap 0 4096" \ -c "mwrite -S 0x22 32 32" \ -c "munmap" \ -c "pwrite -S 0x33 512 32" \ $testfile This violates the expected behavior where writes beyond EOF via mmap should not persist after the file is extended. Instead, the extended region should contain zeros. Fix this by using truncate_pagecache() to truncate the page cache after the current EOF when extending the file. Signed-off-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 9aee8de970f18c2aaaa348e3de86c38e2d956c1d Author: Shuhao Fu Date: Tue Oct 21 16:42:28 2025 +0800 exfat: fix refcount leak in exfat_find Fix refcount leaks in `exfat_find` related to `exfat_get_dentry_set`. Function `exfat_get_dentry_set` would increase the reference counter of `es->bh` on success. Therefore, `exfat_put_dentry_set` must be called after `exfat_get_dentry_set` to ensure refcount consistency. This patch relocate two checks to avoid possible leaks. Fixes: 82ebecdc74ff ("exfat: fix improper check of dentry.stream.valid_size") Fixes: 13940cef9549 ("exfat: add a check for invalid data size") Signed-off-by: Shuhao Fu Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 2547f79b0b0cd969ae6f736890af4ebd9368cda5 Merge: 4a21d1b33f47b7 283f90b50de077 Author: Linus Torvalds Date: Tue Dec 2 16:37:00 2025 -0800 Merge tag 's390-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Provide a new interface for dynamic configuration and deconfiguration of hotplug memory, allowing with and without memmap_on_memory support. This makes the way memory hotplug is handled on s390 much more similar to other architectures - Remove compat support. There shouldn't be any compat user space around anymore, therefore get rid of a lot of code which also doesn't need to be tested anymore - Add stackprotector support. GCC 16 will get new compiler options, which allow to generate code required for kernel stackprotector support - Merge pai_crypto and pai_ext PMU drivers into a new driver. This removes a lot of duplicated code. The new driver is also extendable and allows to support new PMUs - Add driver override support for AP queues - Rework and extend zcrypt and AP trace events to allow for tracing of crypto requests - Support block sizes larger than 65535 bytes for CCW tape devices - Since the rework of the virtual kernel address space the module area and the kernel image are within the same 4GB area. This eliminates the need of weak per cpu variables. Get rid of ARCH_MODULE_NEEDS_WEAK_PER_CPU - Various other small improvements and fixes * tag 's390-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (92 commits) watchdog: diag288_wdt: Remove KMSG_COMPONENT macro s390/entry: Use lay instead of aghik s390/vdso: Get rid of -m64 flag handling s390/vdso: Rename vdso64 to vdso s390: Rename head64.S to head.S s390/vdso: Use common STABS_DEBUG and DWARF_DEBUG macros s390: Add stackprotector support s390/modules: Simplify module_finalize() slightly s390: Remove KMSG_COMPONENT macro s390/percpu: Get rid of ARCH_MODULE_NEEDS_WEAK_PER_CPU s390/ap: Restrict driver_override versus apmask and aqmask use s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex s390/ap: Support driver_override for AP queue devices s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks s390/debug: Update description of resize operation s390/syscalls: Switch to generic system call table generation s390/syscalls: Remove system call table pointer from thread_struct s390/uapi: Remove 31 bit support from uapi header files s390: Remove compat support tools: Remove s390 compat support ... commit 4a21d1b33f47b7fb330f8e7af69192493e3125d1 Merge: d61f1cc5db799f aaf4e92341b081 Author: Linus Torvalds Date: Tue Dec 2 16:32:02 2025 -0800 Merge tag 'm68k-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k update from Geert Uytterhoeven: - defconfig update * tag 'm68k-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v6.18-rc1 commit f4e3381648be205365cb475512ee536e108e060e Author: Namhyung Kim Date: Thu Nov 20 15:48:00 2025 -0800 perf tools: Minimal DEFERRED_CALLCHAIN support Add a new event type for deferred callchains and a new callback for the struct perf_tool. For now it doesn't actually handle the deferred callchains but it just marks the sample if it has the PERF_CONTEXT_ USER_DEFFERED in the callchain array. At least, perf report can dump the raw data with this change. Actually this requires the next commit to enable attr.defer_callchain, but if you already have a data file, it'll show the following result. $ perf report -D ... 0x2158@perf.data [0x40]: event: 22 . . ... raw event: size 64 bytes . 0000: 16 00 00 00 02 00 40 00 06 00 00 00 0b 00 00 00 ......@......... . 0010: 03 00 00 00 00 00 00 00 a7 7f 33 fe 18 7f 00 00 ..........3..... . 0020: 0f 0e 33 fe 18 7f 00 00 48 14 33 fe 18 7f 00 00 ..3.....H.3..... . 0030: 08 09 00 00 08 09 00 00 e6 7a e7 35 1c 00 00 00 .........z.5.... 121163447014 0x2158 [0x40]: PERF_RECORD_CALLCHAIN_DEFERRED(IP, 0x2): 2312/2312: 0xb00000006 ... FP chain: nr:3 ..... 0: 00007f18fe337fa7 ..... 1: 00007f18fe330e0f ..... 2: 00007f18fe331448 : unhandled! Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 22b0ceee1c48178ed3a69a17ea36150ab1f1eb9a Author: Namhyung Kim Date: Thu Nov 20 15:47:59 2025 -0800 tools headers UAPI: Sync linux/perf_event.h for deferred callchains It needs to sync with the kernel to support user space changes for the deferred callchains. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit d9f2ce394c91c28728481564168a59aa5bac376f Author: Ian Rogers Date: Tue Dec 2 09:50:07 2025 -0800 perf jevents: Skip optional metrics in metric group list For metric groups, skip metrics in the list that are None. This allows functions to better optionally return metrics. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit a1d9bb1a047286b36a06a5353a266e8baac4b93d Author: Ian Rogers Date: Tue Dec 2 09:50:06 2025 -0800 perf jevents: Drop duplicate pending metrics Drop adding a pending metric if there is an existing one. Ensure the PMUs differ for hybrid systems. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 3f31651a06f3e42cd96b04e9e822e662a9517583 Author: Ian Rogers Date: Tue Dec 2 09:50:05 2025 -0800 perf jevents: Move json encoding to its own functions Have dedicated encode functions rather than having them embedded in MetricGroup. This is to provide some uniformity in the Metric ToXXX routines. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit b90e94aed9080a2cfb0142e99ca4eba3e341c45e Author: Ian Rogers Date: Tue Dec 2 09:50:04 2025 -0800 perf jevents: Add threshold expressions to Metric Allow threshold expressions for metrics to be generated. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 7d5b4061a86ac1bafe9e34dcb8b79aaad42a99b7 Author: Ian Rogers Date: Tue Dec 2 09:50:03 2025 -0800 perf jevents: Term list fix in event parsing Fix events seemingly broken apart at a comma. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 826650f76e6a634ae6e92f5f7341087b12bda4d0 Author: Ian Rogers Date: Tue Dec 2 09:50:02 2025 -0800 perf jevents: Support parsing negative exponents Support negative exponents when parsing from a json metric string by making the numbers after the 'e' optional in the 'Event' insertion fix up. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit e90c66c37c646962d5a7e525f5e04c75ea31f167 Author: Ian Rogers Date: Tue Dec 2 09:50:01 2025 -0800 perf jevents: Allow metric groups not to be named It can be convenient to have unnamed metric groups for the sake of organizing other metrics and metric groups. An unspecified name shouldn't contribute to the MetricGroup json value, so don't record it. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 38d9d511ed923f8fe9fa901d64c3c31bc812032c Author: Ian Rogers Date: Tue Dec 2 09:50:00 2025 -0800 perf jevents: Add descriptions to metricgroup abstraction Add a function to recursively generate metric group descriptions. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit e7b9e750b3ce1b4105ecf7200d709113552ecd54 Author: Ian Rogers Date: Tue Dec 2 09:49:59 2025 -0800 perf jevents: Update metric constraint support Previous metric constraints were binary, either none or don't group when the NMI watchdog is present. Update to match the definitions in 'enum metric_event_groups' in pmu-events.h. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 33c44bbcd48917275de7a43af9b2f25e03d3a52d Author: Ian Rogers Date: Tue Dec 2 09:49:58 2025 -0800 perf jevents: Allow multiple metricgroups.json files Allow multiple metricgroups.json files by handling any file ending with metricgroups.json as a metricgroups file. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 4b11c983f453689ac9d51d6528891ab4beb7393e Author: Ian Rogers Date: Tue Dec 2 09:49:57 2025 -0800 perf ilist: Be tolerant of reading a metric on the wrong CPU This happens on hybrid machine metrics. Be tolerant and don't cause the ilist application to crash with an exception. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 6603c3c1fe8257e522496da7fd7b75ac52c2323f Author: Ian Rogers Date: Tue Dec 2 09:49:56 2025 -0800 perf python: Correct copying of metric_leader in an evsel Ensure the metric_leader is copied and set up correctly. In compute_metric determine the correct metric_leader event to match the requested CPU. Fixes the handling of metrics particularly on hybrid machines. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit c9cd0c7e529e80e9be79867d2ebb874f67dbc35e Author: Namhyung Kim Date: Tue Nov 25 00:07:47 2025 -0800 perf test: Add python JIT dump test Add a test case for the python interpreter like below so that we can make sure it won't break again. To validate the effect of build-ID generation, it adds and removes the JIT'ed DSOs to/from the build-ID cache for the test. $ perf test -vv jitdump 84: python profiling with jitdump: --- start --- test child forked, pid 214316 Run python with -Xperf_jit [ perf record: Woken up 5 times to write data ] [ perf record: Captured and wrote 1.180 MB /tmp/__perf_test.perf.data.XbqZNm (140 samples) ] Generate JIT-ed DSOs using perf inject Add JIT-ed DSOs to the build-ID cache Check the symbol containing the script name Found 108 matching lines Remove JIT-ed DSOs from the build-ID cache ---- end(0) ---- 84: python profiling with jitdump : Ok Cc: Pablo Galindo Link: https://docs.python.org/3/howto/perf_profiling.html#how-to-work-without-frame-pointers Signed-off-by: Namhyung Kim commit 25d498e636d1f8d138d65246cfb5b1fc3069ca56 Author: Namhyung Kim Date: Tue Nov 25 00:07:46 2025 -0800 perf jitdump: Add sym/str-tables to build-ID generation It was reported that python backtrace with JIT dump was broken after the change to built-in SHA-1 implementation. It seems python generates the same JIT code for each function. They will become separate DSOs but the contents are the same. Only difference is in the symbol name. But this caused a problem that every JIT'ed DSOs will have the same build-ID which makes perf confused. And it resulted in no python symbols (from JIT) in the output. Looking back at the original code before the conversion, it used the load_addr as well as the code section to distinguish each DSO. But it'd be better to use contents of symtab and strtab instead as it aligns with some linker behaviors. This patch adds a buffer to save all the contents in a single place for SHA-1 calculation. Probably we need to add sha1_update() or similar to update the existing hash value with different contents and use it here. But it's out of scope for this change and I'd like something that can be backported to the stable trees easily. Reviewed-by: Ian Rogers Cc: Eric Biggers Cc: Pablo Galindo Cc: Fangrui Song Link: https://github.com/python/cpython/issues/139544 Fixes: e3f612c1d8f3945b ("perf genelf: Remove libcrypto dependency and use built-in sha1()") Signed-off-by: Namhyung Kim commit 44f6b44027910eb9e6e6a67840f818038946e24f Author: Ian Rogers Date: Mon Dec 1 15:11:36 2025 -0800 perf test: Fix hybrid testing of event fallback test The mem-loads-aux event exists on hybrid systems but the "cpu" PMU does not. This causes an event parsing error which erroneously makes the test look like it is failing. Avoid naming the PMU to avoid this. Rather than cleaning up perf.data in the directory the test is run, explicitly send the 'perf record' output to /dev/null and avoid any cleanup scripts. Fixes: fc9c17b22352 ("perf test: Add a perf event fallback test") Signed-off-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Namhyung Kim commit 441863ae3de61dd813049a120e5656df2e210a4b Author: Namhyung Kim Date: Tue Dec 2 15:01:31 2025 -0800 perf tools: Remove a trailing newline in the event terms So that it can show the correct encoding info in the JSON output. $ perf list -j hw [ { "Unit": "cpu", "Topic": "legacy hardware", "EventName": "branch-instructions", "EventType": "Kernel PMU event", "BriefDescription": "Retired branch instructions [This event is an alias of branches]", "Encoding": "cpu/event=0xc4/" }, ... Reviewed-by: Ian Rogers Suggested-by: Ian Rogers Signed-off-by: Namhyung Kim commit 0692602defb0c273f80dec9c564ca50726404aca Merge: b3239df349c2c2 3925683515e938 Author: Dave Airlie Date: Wed Dec 3 09:43:09 2025 +1000 Merge tag 'amd-drm-next-6.19-2025-12-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.19-2025-12-02: amdgpu: - Unified MES fix - SMU 11 unbalanced irq fix - Fix for driver reloading on APUs - pp_table sysfs fix - Fix memory leak in fence handling - HDMI fix - DC cursor fixes - eDP panel parsing fix - Brightness fix - DC analog fixes - EDID retry fixes - UserQ fixes - RAS fixes - IP discovery fix - Add missing locking in amdgpu_ttm_access_memory_sdma() - Smart Power OLED fix - PRT and page fault fixes for GC 6-8 - VMID reservation fix - ACP platform device fix - Add missing vm fault handling for GC 11-12 - VPE fix amdkfd: - Partitioning fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251202220101.2039347-1-alexander.deucher@amd.com commit 4de44542991ed4cb8c9fb2ccd766d6e6015101b0 Merge: 9954464d737dd1 108f9405ce8108 Author: Jakub Kicinski Date: Tue Dec 2 15:37:48 2025 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes in preparation for the net-next PR. Signed-off-by: Jakub Kicinski commit d61f1cc5db799f4e44a63418b2dc19396787427b Merge: a7610b8465393e d5cb9574391cc0 Author: Linus Torvalds Date: Tue Dec 2 14:48:08 2025 -0800 Merge tag 'x86_cpu_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CPU feature updates from Dave Hansen: "The biggest thing of note here is Linear Address Space Separation (LASS). It represents the first time I can think of that the upper=>kernel/lower=>user address space convention is actually recognized by the hardware on x86. It ensures that userspace can not even get the hardware to _start_ page walks for the kernel address space. This, of course, is a really nice generic side channel defense. This is really only a down payment on LASS support. There are still some details to work out in its interaction with EFI calls and vsyscall emulation. For now, LASS is disabled if either of those features is compiled in (which is almost always the case). There's also one straggler commit in here which converts an under-utilized AMD CPU feature leaf into a generic Linux-defined leaf so more feature can be packed in there. Summary: - Enable Linear Address Space Separation (LASS) - Change X86_FEATURE leaf 17 from an AMD leaf to Linux-defined" * tag 'x86_cpu_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Enable LASS during CPU initialization selftests/x86: Update the negative vsyscall tests to expect a #GP x86/traps: Communicate a LASS violation in #GP message x86/kexec: Disable LASS during relocate kernel x86/alternatives: Disable LASS when patching kernel code x86/asm: Introduce inline memcpy and memset x86/cpu: Add an LASS dependency on SMAP x86/cpufeatures: Enumerate the LASS feature bits x86/cpufeatures: Make X86_FEATURE leaf 17 Linux-specific commit a7610b8465393edc936c2640b903cb7758d5d155 Merge: e2aa39b368bb14 4ab13be5ed12f4 Author: Linus Torvalds Date: Tue Dec 2 14:24:21 2025 -0800 Merge tag 'x86_entry_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 entry update from Dave Hansen: "This one is pretty trivial: fix a badly-named FRED data structure member" * tag 'x86_entry_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fred: Fix 64bit identifier in fred_ss commit e2aa39b368bb147afe8f6bd63d962494354f6498 Merge: 54de197c9a5e8f 6276c67f2bc4ae Author: Linus Torvalds Date: Tue Dec 2 14:16:42 2025 -0800 Merge tag 'x86_misc_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Dave Hansen: "The most significant are some changes to ensure that symbols exported for KVM are used only by KVM modules themselves, along with some related cleanups. In true x86/misc fashion, the other patch is completely unrelated and just enhances an existing pr_warn() to make it clear to users how they have tainted their kernel when something is mucking with MSRs. Summary: - Make MSR-induced taint easier for users to track down - Restrict KVM-specific exports to KVM itself" * tag 'x86_misc_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Restrict KVM-induced symbol exports to KVM modules where obvious/possible x86/mm: Drop unnecessary export of "ptdump_walk_pgd_level_debugfs" x86/mtrr: Drop unnecessary export of "mtrr_state" x86/bugs: Drop unnecessary export of "x86_spec_ctrl_base" x86/msr: Add CPU_OUT_OF_SPEC taint name to "unrecognized" pr_warn(msg) commit 54de197c9a5e8f522cb0a472e68e3e9888c91aa3 Merge: c76431e3b53a42 f2f22721aca46c Author: Linus Torvalds Date: Tue Dec 2 14:03:05 2025 -0800 Merge tag 'x86_sgx_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SGX updates from Dave HansenL "The main content here is adding support for the new EUPDATESVN SGX ISA. Before this, folks who updated microcode had to reboot before enclaves could attest to the new microcode. The new functionality lets them do this without a reboot. The rest are some nice, but relatively mundane comment and kernel-doc fixups. Summary: - Allow security version (SVN) updates so enclaves can attest to new microcode - Fix kernel docs typos" * tag 'x86_sgx_for_6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sgx: Fix a typo in the kernel-doc comment for enum sgx_attribute x86/sgx: Remove superfluous asterisk from copyright comment in asm/sgx.h x86/sgx: Document structs and enums with '@', not '%' x86/sgx: Add kernel-doc descriptions for params passed to vDSO user handler x86/sgx: Add a missing colon in kernel-doc markup for "struct sgx_enclave_run" x86/sgx: Enable automatic SVN updates for SGX enclaves x86/sgx: Implement ENCLS[EUPDATESVN] x86/sgx: Define error codes for use by ENCLS[EUPDATESVN] x86/cpufeatures: Add X86_FEATURE_SGX_EUPDATESVN feature flag x86/sgx: Introduce functions to count the sgx_(vepc_)open() commit c76431e3b53a426de565fa75f8278c59ca6f5ed6 Merge: a9a10e920e2e1e 84361123413efc Author: Linus Torvalds Date: Tue Dec 2 13:32:52 2025 -0800 Merge tag 'x86_mm_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Borislav Petkov: - Use the proper accessors when reading CR3 as part of the page level transitions (5-level to 4-level, the use case being kexec) so that only the physical address in CR3 is picked up and not flags which are above the physical mask shift - Clean up and unify __phys_addr_symbol() definitions * tag 'x86_mm_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/libstub: Fix page table access in 5-level to 4-level paging transition x86/boot: Fix page table access in 5-level to 4-level paging transition x86/mm: Unify __phys_addr_symbol() commit a9a10e920e2e1ece946c584aa68f8a4fcedab791 Merge: cb502f0e5e87f7 e67997021fd0d7 Author: Linus Torvalds Date: Tue Dec 2 13:27:09 2025 -0800 Merge tag 'x86_bugs_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CPU mitigation updates from Borislav Petkov: - Convert the tsx= cmdline parsing to use early_param() - Cleanup forward declarations gunk in bugs.c * tag 'x86_bugs_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Get rid of the forward declarations x86/tsx: Get the tsx= command line parameter with early_param() x86/tsx: Make tsx_ctrl_state static commit 9c0bad7508a81110b3216231bde2a10baf7126f0 Author: Len Brown Date: Tue Dec 2 11:45:42 2025 -0500 tools/power turbostat: version 2025.12.02 Since release 2025.09.09: Add LLC statistics columns: LLCkRPS = Last Level Cache Thousands of References Per Second LLC%hit = Last Level Cache Hit % Recognize Wildcat Lake and Nova Lake platforms Add MSR check for Android Add APERF check for VMWARE Add RAPL check for AWS minor fixes This patch: White-space only, resulting from running Lindent on everything except the tab-justified data-tables, and using -l150 instead of -l80 to allow long lines. Signed-off-by: Len Brown commit 1a23ba6a1ba28f990d4d5fd730f663261f4de913 Author: Len Brown Date: Tue Dec 2 13:32:34 2025 -0500 tools/power turbostat: Print wide names only for RAW 64-bit columns Print a wide column header only for the case of a 64-bit RAW counter. It turns out that wide column headers otherwise are more harm than good. Signed-off-by: Len Brown commit 2ba8b24e9da49ea25fdae82c2f093a1c688d7b99 Author: Len Brown Date: Tue Dec 2 12:55:26 2025 -0500 tools/power turbostat: Print percentages in 8-columns Added counters that are FORMAT_PERCENT do not need to be 64-bits -- 32 is plenty. This allows the output code to fit them, and their header, into 8-columns. Signed-off-by: Len Brown commit 8808292799b0eafd32d89e12a2536debcecaac11 Author: Len Brown Date: Tue Dec 2 15:30:36 2025 -0500 tools/power turbostat: Print "nan" for out of range percentages Sometimes counters return junk. For the cases where values > 100% is invalid, print "nan". Signed-off-by: Len Brown commit 951845d51d1dd27ecd28a3743af3a8b22bc930ac Author: Len Brown Date: Tue Dec 2 11:29:27 2025 -0500 tools/power turbostat: Validate APERF access for VMWARE VMWARE correctly enumerates lack of APERF and MPERF in CPUID, but turbostat didn't consult that before attempting to access them. Since VMWARE allows access, but always returns 0, turbostat got confusd into an infinite reset loop. Head this off by listening to CPUID.6.APERF_MPERF (and rename the existing variable to make this more clear) Reported-by: David Arcari Tested-by: David Arcari Signed-off-by: Len Brown commit 68769a0b5ada367d6911a8dfe50fc1e480c89fd1 Author: Len Brown Date: Tue Dec 2 15:15:32 2025 -0500 tools/power turbostat: Enhance perf probe check_perf_access() will now check both IPC and LLC perf counters if they are enabled. If any fail, it now disables perf and all perf counters. Signed-off-by: Len Brown commit 19476a592bf255b9eb0308999a9ccf96b314d314 Author: Len Brown Date: Sun Nov 30 00:11:22 2025 -0500 tools/power turbostat: Validate RAPL MSRs for AWS Nitro Hypervisor Even though the platform->plat_rapl_msrs enumeration may be accurate, a VM, such as AWS Nitro Hypervisor, may deny access to the underlying MSRs. Probe if PKG_ENERGY is readable and non-zero. If no, ignore all RAPL MSRs. Reported-by: Emily Ehlert Tested-by: Emily Ehlert Signed-off-by: Len Brown commit 51860d6330b6cda355a7e30b3e09e7a22ec4b6ae Author: Malaya Kumar Rout Date: Sat Nov 22 20:46:52 2025 +0530 tools/power x86_energy_perf_policy: Fix potential NULL pointer dereference In err_on_hypervisor(), strstr() is called to search for "flags" in the buffer, but the return value is not checked before being used in pointer arithmetic (flags - buffer). If strstr() returns NULL because "flags" is not found in /proc/cpuinfo, this will cause undefined behavior and likely a crash. Add a NULL check after the strstr() call and handle the error appropriately by cleaning up resources and reporting a meaningful error message. Signed-off-by: Malaya Kumar Rout Signed-off-by: Len Brown commit cb502f0e5e87f769417691c7060a358a8b117c22 Merge: d7489818348e53 73029e73ccd07b Author: Linus Torvalds Date: Tue Dec 2 13:07:53 2025 -0800 Merge tag 'x86_sev_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Largely cleanups along with a change to save XSS to the GHCB (Guest-Host Communication Block) in SEV-ES guests so that the hypervisor can determine the guest's XSAVES buffer size properly and thus support shadow stacks in AMD confidential guests * tag 'x86_sev_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cc: Fix enum spelling to fix kernel-doc warnings x86/boot: Drop unused sev_enable() fallback x86/coco/sev: Convert has_cpuflag() to use cpu_feature_enabled() x86/sev: Include XSS value in GHCB CPUID request x86/boot: Move boot_*msr helpers to asm/shared/msr.h commit ac52b4a98509de3760919fa33e03384a5e770d7a Author: Linus Walleij Date: Sun Nov 30 17:14:45 2025 +0100 MAINTAINERS: Change Linus Walleij mail address I will be using my kernel.org mail address going forward. There is no point in splitting this MAINTAINERS patch up per subsystem, I will just include it with the rest of my patches to pin control in the next merge window. Signed-off-by: Linus Walleij commit 7446bd6119fa77f75a41d7870953dbf467ffd40b Author: Malaya Kumar Rout Date: Sat Nov 22 19:14:54 2025 +0530 tools/power x86_energy_perf_policy: Fix format string in error message The error message in validate_cpu_selected_set() uses an incomplete format specifier "cpu%" instead of "cpu%d", resulting in the error message printing "Requested cpu% is not present" rather than showing the actual CPU number. Fix the format string to properly display the CPU number. Signed-off-by: Malaya Kumar Rout Signed-off-by: Len Brown commit 90a2fe257679ee931a99e7555a5844e05ed3945c Author: Len Brown Date: Tue Nov 25 11:47:04 2025 -0500 tools/power x86_energy_perf_policy: Simplify Android MSR probe no functional change Signed-off-by: Len Brown commit 2ff4b59f2e6222a13d76c4178bcd1878be3d23ac Author: Kaushlendra Kumar Date: Fri Oct 3 16:33:19 2025 +0530 tools/power x86_energy_perf_policy: Add Android MSR device support Add support for Android MSR device paths which use /dev/msrN format instead of the standard Linux /dev/cpu/N/msr format. The tool now probes both path formats at startup and uses the appropriate one. This enables x86_energy_perf_policy to work on Android systems where MSR devices follow a different naming convention while maintaining full compatibility with standard Linux systems. Signed-off-by: Kaushlendra Kumar Signed-off-by: Len Brown commit d71cb404f002d0aa012e6b394752ff3cfc8d9f73 Author: Len Brown Date: Sat Nov 29 22:57:50 2025 -0500 tools/power turbostat: Add run-time MSR driver probe Rather than starting down the conditional-compile road... Probe the location of the MSR files at run-time. Signed-off-by: Len Brown commit 2313b97bc0ccedf951ffdd85ffd3629169cfd80b Author: Emily Ehlert Date: Thu Nov 13 19:16:08 2025 +0000 tools/power turbostat: Set per_cpu_msr_sum to NULL after free Set per_cpu_msr_sum to NULL after freeing it in the error path of msr_sum_record() to prevent potential use-after-free issues. Signed-off-by: Emily Ehlert Signed-off-by: Len Brown commit 28a3ad1fd2abdf45357ffd46614a6129cd395ca3 Author: Len Brown Date: Tue Oct 21 20:23:49 2025 -0300 tools/power turbostat: Add LLC stats LLCkRPS = Last Level Cache Thousands of References Per Second LLC%hit = Last Level Cache Hit % These columns are enabled by-default. They can be controlled with the --show/--hide options by individual column names above, or together using the "llc" or "cache" groups. Signed-off-by: Len Brown commit 4be423572da1f4c11f45168e3fafda870ddac9f8 Author: Alexey Kardashevskiy Date: Tue Dec 2 13:44:49 2025 +1100 crypto/ccp: Implement SEV-TIO PCIe IDE (phase1) Implement the SEV-TIO (Trusted I/O) firmware interface for PCIe TDISP (Trust Domain In-Socket Protocol). This enables secure communication between trusted domains and PCIe devices through the PSP (Platform Security Processor). The implementation includes: - Device Security Manager (DSM) operations for establishing secure links - SPDM (Security Protocol and Data Model) over DOE (Data Object Exchange) - IDE (Integrity Data Encryption) stream management for secure PCIe This module bridges the SEV firmware stack with the generic PCIe TSM framework. This is phase1 as described in Documentation/driver-api/pci/tsm.rst. On AMD SEV, the AMD PSP firmware acts as TSM (manages the security/trust). The CCP driver provides the interface to it and registers in the TSM subsystem. Detect the PSP support (reported via FEATURE_INFO + SNP_PLATFORM_STATUS) and enable SEV-TIO in the SNP_INIT_EX call if the hardware supports TIO. Implement SEV TIO PSP command wrappers in sev-dev-tio.c and store the data in the SEV-TIO-specific structs. Implement TSM hooks and IDE setup in sev-dev-tsm.c. Signed-off-by: Alexey Kardashevskiy Link: https://patch.msgid.link/692f506bb80c9_261c11004@dwillia2-mobl4.notmuch Acked-by: Tom Lendacky Signed-off-by: Dan Williams commit b1e7a590a0133606d3efd41aee38cdeac630b52f Author: Steven Rostedt Date: Tue Nov 25 12:11:53 2025 -0500 ring-buffer: Add helper functions for allocations The allocation of the per CPU buffer descriptor, the buffer page descriptors and the buffer page data itself can be pretty ugly: kzalloc_node(ALIGN(sizeof(struct buffer_page), cache_line_size()), GFP_KERNEL, cpu_to_node(cpu)); And the data pages: page = alloc_pages_node(cpu_to_node(cpu), GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_COMP | __GFP_ZERO, order); if (!page) return NULL; bpage->page = page_address(page); rb_init_page(bpage->page); Add helper functions to make the code easier to read. This does make all allocations of the data page (bpage->page) allocated with the __GFP_RETRY_MAYFAIL flag (and not just the bulk allocator). Which is actually better, as allocating the data page for the ring buffer tracing should try hard but not trigger the OOM killer. Link: https://lore.kernel.org/all/CAHk-=wjMMSAaqTjBSfYenfuzE1bMjLj+2DLtLWJuGt07UGCH_Q@mail.gmail.com/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251125121153.35c07461@gandalf.local.home Suggested-by: Linus Torvalds Signed-off-by: Steven Rostedt (Google) commit 7eba05e79ca20b7169bf25da1e6cac1d31269f90 Author: Bartosz Golaszewski Date: Thu Nov 20 09:27:47 2025 +0100 MAINTAINERS: Add Manivannan Sadhasivam as PCI/pwrctrl maintainer Manivannan is doing a lot of work on the PCI power control. Add him as maintainer. Signed-off-by: Bartosz Golaszewski Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251120082747.10541-1-brgl@bgdev.pl commit 51f38bef0485f71c09755455df5bcf6f64320468 Author: Hans Zhang Date: Sat Nov 8 22:03:03 2025 +0800 MAINTAINERS: Add CIX Sky1 PCIe controller driver maintainer Add Hans Zhang as maintainer of the CIX Sky1 PCIe host driver. Signed-off-by: Hans Zhang Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251108140305.1120117-9-hans.zhang@cixtech.com commit a0d9f2c08f45ff3dfdb9eb0a843a486ad4875dbe Author: Hans Zhang Date: Sat Nov 8 22:03:02 2025 +0800 PCI: sky1: Add PCIe host support for CIX Sky1 Add driver for the CIX Sky1 SoC PCIe Gen4 16 GT/s controller based on the Cadence High Performance Architecture (HPA) PCIe core. The controller supports MSI/MSI-X via GICv3, Single Virtual Channel, and Single Function. Signed-off-by: Hans Zhang [mani: moved the PCI ID definitions and squashed Kconfig change] Signed-off-by: Manivannan Sadhasivam [bhelgaas: sort Kconfig menu entry, squash https://lore.kernel.org/r/aSBqp0cglr-Sc8na@stanley.mountain] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251108140305.1120117-8-hans.zhang@cixtech.com commit 33c139dcff751d4d545ecc0a174adc0767274c1f Author: Hans Zhang Date: Sat Nov 8 22:03:00 2025 +0800 dt-bindings: PCI: Add CIX Sky1 PCIe Root Complex bindings Document the bindings for CIX Sky1 PCIe Controller configured in Root Complex mode with five Root Ports. The controller supports 4 INTx, MSI and MSI-X interrupts with the help of the ARM GICv3 interrupt controller. Signed-off-by: Hans Zhang Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251108140305.1120117-6-hans.zhang@cixtech.com commit d7489818348e5374a8a12a309183fa44b3df41cc Merge: 2ae20d651091c7 d911fe6e942e60 Author: Linus Torvalds Date: Tue Dec 2 12:17:47 2025 -0800 Merge tag 'x86_cleanups_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Borislav Petkov: - The mandatory pile of cleanups the cat drags in every merge window * tag 'x86_cleanups_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Clean up whitespace in a20.c x86/mm: Delete disabled debug code x86/{boot,mtrr}: Remove unused function declarations x86/percpu: Use BIT_WORD() and BIT_MASK() macros x86/cpufeatures: Correct LKGS feature flag description x86/idtentry: Add missing '*' to kernel-doc lines commit 8babd8afe58a65c8d3cb9b5a6a8d24d4f93033ab Author: Manikandan K Pillai Date: Sat Nov 8 22:02:59 2025 +0800 PCI: cadence: Add support for High Perf Architecture (HPA) controller Add support for Cadence PCIe RP configuration for High Performance Architecture (HPA) controllers. The Cadence High Performance controllers are the latest PCIe controllers that have support for DMA, optional IDE and updated register set. Add a common library for High Performance Architecture (HPA) PCIe controllers. Signed-off-by: Manikandan K Pillai Signed-off-by: Manivannan Sadhasivam [bhelgaas: squash https://lore.kernel.org/r/20251120093518.2760492-1-jiapeng.chong@linux.alibaba.com, squash https://lore.kernel.org/all/52abaad8-a43e-4e29-93d7-86a3245692c3@cixtech.com/] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251108140305.1120117-5-hans.zhang@cixtech.com commit eeb934137debfbe98be61a27756a605edf492ed3 Author: Alexey Kardashevskiy Date: Tue Dec 2 13:44:48 2025 +1100 iommu/amd: Report SEV-TIO support The SEV-TIO switch in the AMD BIOS is reported to the OS via the IOMMU Extended Feature 2 register (EFR2), bit 1. Add helper to parse the bit and report the feature presence. Signed-off-by: Alexey Kardashevskiy Link: https://patch.msgid.link/20251202024449.542361-4-aik@amd.com Acked-by: Joerg Roedel Reviewed-by: Vasant Hegde Acked-by: Tom Lendacky Signed-off-by: Dan Williams commit c3859de858aa7ae0d0a5ca21e8ee9792f2f256b6 Author: Alexey Kardashevskiy Date: Tue Dec 2 13:44:47 2025 +1100 psp-sev: Assign numbers to all status codes and add new Make the definitions explicit. Add some more new codes. The following patches will be using SPDM_REQUEST and EXPAND_BUFFER_LENGTH_REQUEST, others are useful for the PSP FW diagnostics. Signed-off-by: Alexey Kardashevskiy Link: https://patch.msgid.link/20251202024449.542361-3-aik@amd.com Acked-by: Tom Lendacky Signed-off-by: Dan Williams commit 8a5dd102e48752f8c4144f051eccc602774f1a93 Author: Alexey Kardashevskiy Date: Tue Dec 2 13:44:46 2025 +1100 ccp: Make snp_reclaim_pages and __sev_do_cmd_locked public The snp_reclaim_pages() helper reclaims pages in the FW state. SEV-TIO and the TMPM driver (a hardware engine which smashes IOMMU PDEs among other things) will use to reclaim memory when cleaning up. Share and export snp_reclaim_pages(). Most of the SEV-TIO code uses sev_do_cmd() which locks the sev_cmd_mutex and already exported. But the SNP init code (which also sets up SEV-TIO) executes under the sev_cmd_mutex lock so the SEV-TIO code has to use the __sev_do_cmd_locked() helper. This one though does not need to be exported/shared globally as SEV-TIO is a part of the CCP driver still. Share __sev_do_cmd_locked() via the CCP internal header. Signed-off-by: Alexey Kardashevskiy Link: https://patch.msgid.link/20251202024449.542361-2-aik@amd.com Acked-by: Tom Lendacky Signed-off-by: Dan Williams commit de45401e27bcecbc56ff2f02edc00a37beb1501b Author: Vincent Guittot Date: Fri Nov 21 17:49:20 2025 +0100 MAINTAINERS: Add NXP S32G PCIe controller driver maintainer Add a new entry for S32G PCIe controller driver. Signed-off-by: Vincent Guittot Signed-off-by: Manivannan Sadhasivam [bhelgaas: update to Ciprian Marian Costea per https://lore.kernel.org/r/f38396c7-0605-4876-9ea6-0a179d6577c7@oss.nxp.com] Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Link: https://patch.msgid.link/20251121164920.2008569-5-vincent.guittot@linaro.org commit 5cbc7d3e316e4251035e5d54c52540a8a7aa81c4 Author: Vincent Guittot Date: Fri Nov 21 17:49:19 2025 +0100 PCI: s32g: Add NXP S32G PCIe controller driver (RC) Add initial support of the PCIe controller for the NXP S32G SoC family. Only host mode is supported. Co-developed-by: Ionut Vicovan Signed-off-by: Ionut Vicovan Co-developed-by: Ciprian Marian Costea Signed-off-by: Ciprian Marian Costea Co-developed-by: Ghennadi Procopciuc Signed-off-by: Ghennadi Procopciuc Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Signed-off-by: Vincent Guittot [mani: replaced memblock_start_of_DRAM with hardcoded boundary addr] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Link: https://patch.msgid.link/20251121164920.2008569-4-vincent.guittot@linaro.org commit 045ad2c623d607f2c7720e2b8fcda675d96f7381 Author: Vincent Guittot Date: Fri Nov 21 17:49:18 2025 +0100 PCI: dwc: Add register and bitfield definitions Add register and bitfield definitions: - GEN3_RELATED_OFF_EQ_PHASE_2_3 field of GEN3_RELATED_OFF - Coherency control registers Signed-off-by: Vincent Guittot Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Link: https://patch.msgid.link/20251121164920.2008569-3-vincent.guittot@linaro.org commit 0472132df8489c56ae446646214f3cb2b7cd3946 Author: Vincent Guittot Date: Fri Nov 21 17:49:17 2025 +0100 dt-bindings: PCI: s32g: Add NXP S32G PCIe controller Describe the PCIe host controller available on the S32G platforms. Co-developed-by: Ionut Vicovan Signed-off-by: Ionut Vicovan Co-developed-by: Bogdan-Gabriel Roman Signed-off-by: Bogdan-Gabriel Roman Co-developed-by: Larisa Grigore Signed-off-by: Larisa Grigore Co-developed-by: Ghennadi Procopciuc Signed-off-by: Ghennadi Procopciuc Co-developed-by: Ciprian Marian Costea Signed-off-by: Ciprian Marian Costea Co-developed-by: Bogdan Hamciuc Signed-off-by: Bogdan Hamciuc Signed-off-by: Vincent Guittot Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Reviewed-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251121164920.2008569-2-vincent.guittot@linaro.org commit 2ae20d651091c71ef182d28cbf10ce6f8be79c99 Merge: 2a47c26e55a2bc ac7de456a37f9b Author: Linus Torvalds Date: Tue Dec 2 11:55:58 2025 -0800 Merge tag 'x86_cache_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Add support for AMD's Smart Data Cache Injection feature which allows for direct insertion of data from I/O devices into the L3 cache, thus bypassing DRAM and saving its bandwidth; the resctrl side of the feature allows the size of the L3 used for data injection to be controlled - Add Intel Clearwater Forest to the list of CPUs which support Sub-NUMA clustering - Other fixes and cleanups * tag 'x86_cache_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: fs/resctrl: Update bit_usage to reflect io_alloc fs/resctrl: Introduce interface to modify io_alloc capacity bitmasks fs/resctrl: Modify struct rdt_parse_data to pass mode and CLOSID fs/resctrl: Introduce interface to display io_alloc CBMs fs/resctrl: Add user interface to enable/disable io_alloc feature fs/resctrl: Introduce interface to display "io_alloc" support x86,fs/resctrl: Implement "io_alloc" enable/disable handlers x86,fs/resctrl: Detect io_alloc feature x86/resctrl: Add SDCIAE feature in the command line options x86/cpufeatures: Add support for L3 Smart Data Cache Injection Allocation Enforcement fs/resctrl: Consider sparse masks when initializing new group's allocation x86/resctrl: Support Sub-NUMA Cluster (SNC) mode on Clearwater Forest commit 2a47c26e55a2bc085a2349ed1d4e065ee298155f Merge: a61288200e8b6f ca8313fd83399e Author: Linus Torvalds Date: Tue Dec 2 11:35:49 2025 -0800 Merge tag 'x86_microcode_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loading updates from Borislav Petkov: - Add microcode staging support on Intel: it moves the sole microcode blobs loading to a non-critical path so that microcode loading latencies are kept at minimum. The actual "directing" the hardware to load microcode is the only step which is done on the critical path. This scheme is also opportunistic as in: on a failure, the machinery falls back to normal loading - Add the capability to the AMD side of the loader to select one of two per-family/model/stepping patches: one is pre-Entrysign and the other is post-Entrysign; with the goal to take care of machines which haven't updated their BIOS yet - something they should absolutely do as this is the only proper Entrysign fix - Other small cleanups and fixlets * tag 'x86_microcode_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Mark early_parse_cmdline() as __init x86/microcode/AMD: Select which microcode patch to load x86/microcode/intel: Enable staging when available x86/microcode/intel: Support mailbox transfer x86/microcode/intel: Implement staging handler x86/microcode/intel: Define staging state struct x86/microcode/intel: Establish staging control logic x86/microcode: Introduce staging step to reduce late-loading time x86/cpu/topology: Make primary thread mask available with SMP=n commit 5ba71195a9cb8bb573c7165685a63654af4d7401 Author: Alice Ryhl Date: Tue Nov 25 13:59:42 2025 +0000 rust_binder: use bitmap for allocation of handles To find an unused Binder handle, Rust Binder currently iterates the red/black tree from the beginning until it finds a gap in the keys. This is extremely slow. To improve the performance, add a bitmap that keeps track of which indices are actually in use. This allows us to quickly find an unused key in the red/black tree. For a benchmark, please see the below numbers that were obtained from modifying binderThroughputTest to send a node with each transaction and stashing it in the server. This results in the number of nodes increasing by one for every transaction sent. I got the following table of roundtrip latencies (in µs): Transaction Range │ Baseline (Rust) │ Bitmap (Rust) │ Comparison (C) 0 - 10,000 │ 176.88 │ 92.93 │ 99.41 10,000 - 20,000 │ 437.37 │ 87.74 │ 98.55 20,000 - 30,000 │ 677.49 │ 76.24 │ 96.37 30,000 - 40,000 │ 901.76 │ 83.39 │ 96.73 40,000 - 50,000 │ 1126.62 │ 100.44 │ 94.57 50,000 - 60,000 │ 1288.98 │ 94.38 │ 96.64 60,000 - 70,000 │ 1588.74 │ 88.27 │ 96.36 70,000 - 80,000 │ 1812.97 │ 93.97 │ 91.24 80,000 - 90,000 │ 2062.95 │ 92.22 │ 102.01 90,000 - 100,000 │ 2330.03 │ 97.18 │ 100.31 It should be clear that the current Rust code becomes linearly slower per insertion as the number of calls to rb_next() per transaction increases. After this change, the time to find an ID number appears constant. (Technically it is not constant-time as both insertion and removal scan the entire bitmap. However, quick napkin math shows that scanning the entire bitmap with N=100k takes ~1.5µs, which is neglible in a benchmark where the rountrip latency is 100µs.) I've included a comparison to the C driver, which uses the same bitmap algorithm as this patch since commit 15d9da3f818c ("binder: use bitmap for faster descriptor lookup"). This currently checks if the bitmap should be shrunk after every removal. One potential future change is introducing a shrinker to make this operation O(1), but based on the benchmark above this does not seem required at this time. Reviewed-by: Burak Emir Reviewed-by: Yury Norov (NVIDIA) Acked-by: Carlos Llamas Signed-off-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit f523d110a63b5b38ab5d54df1d06f1e0988c9b74 Author: Alice Ryhl Date: Tue Nov 25 13:59:41 2025 +0000 rust: id_pool: do not immediately acquire new ids When Rust Binder assigns a new ID, it performs various fallible operations before it "commits" to actually using the new ID. To support this pattern, change acquire_next_id() so that it does not immediately call set_bit(), but instead returns an object that may be used to call set_bit() later. The UnusedId type holds a exclusive reference to the IdPool, so it's guaranteed that nobody else can call find_unused_id() while the UnusedId object is live. [Miguel: rust: id_pool: fix example] Reviewed-by: Burak Emir Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit 93b22a4bf0b4945abc7c45345f2a52fd3098c16c Author: Shi Hao Date: Fri Oct 31 13:39:42 2025 +0530 fbdev: i810: use appopriate log interface dev_info There were many printk log interfaces which do no had any KERN_INFO with them and they can be replaced with dev_info which will allow better log level handling making messages clear and manageable. No functional changes to the driver behavior are introduced. Only the logging method has been replaced as per modern kernel coding guidelines. Signed-off-by: Shi Hao Signed-off-by: Helge Deller commit 69ec6a1bed3017293a3430e2f8e3c01b29496446 Author: Alice Ryhl Date: Tue Nov 25 13:59:40 2025 +0000 rust: id_pool: do not supply starting capacity Rust Binder wants to use inline bitmaps whenever possible to avoid allocations, so introduce a constructor for an IdPool with arbitrary capacity that stores the bitmap inline. The existing constructor could be renamed to with_capacity() to match constructors for other similar types, but it is removed as there is currently no user for it. [Miguel: rust: id_pool: fix broken intra-doc link] Acked-by: Yury Norov (NVIDIA) Reviewed-by: Burak Emir Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit 9954464d737dd12f12b274d3da46397e3656f079 Author: Pavel Begunkov Date: Sun Nov 30 23:35:17 2025 +0000 net: page_pool: sanitise allocation order We're going to give more control over rx buffer sizes to user space, and since we can't always rely on driver validation, let's sanitise it in page_pool_init() as well. Note that we only need to reject over MAX_PAGE_ORDER allocations for normal page pools, as current memory providers don't need to use the buddy allocator and must check the order on init.i Suggested-by: Stanislav Fomichev Reviewed-by: Mina Almasry Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/77ad83c1aec66cbd00e7b3952f74bc3b7a988150.1764542851.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski commit 854858848bc7ac6ea3bf896ef1b541cb9d4bca20 Author: Pavel Begunkov Date: Sun Nov 30 23:35:16 2025 +0000 net: page pool: xa init with destroy on pp init The free_ptr_ring label path initialises ->dma_mapped xarray but doesn't destroy it in case of an error. That's not a real problem since init itself doesn't do anything requiring destruction, but still match it with xa_destroy() to silence warnings. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/02904c6d83dbe5cc1c671106a5c97bd93ab31006.1764542851.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski commit af0fa9b449d7952f231903262b0a96bad8399dd1 Author: Javier Garcia Date: Sat Nov 15 13:57:01 2025 +0100 fbdev: tridentfb: replace printk() with dev_*() in probe Signed-off-by: Javier Garcia Signed-off-by: Helge Deller commit a61288200e8b6f42bff116508dc72ebcc206f10a Merge: 49219bba014915 5c4663ed1eac01 Author: Linus Torvalds Date: Tue Dec 2 11:04:37 2025 -0800 Merge tag 'ras_core_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: - The second part of the AMD MCA interrupts rework after the last-minute show-stopper from the last merge window was sorted out. After this, the AMD MCA deferred errors, thresholding and corrected errors interrupt handlers use common MCA code and are tightly integrated into the core MCA code, thereby getting rid of considerable duplication. All culminating into allowing CMCI error thresholding storms to be detected at AMD too, using the common infrastructure - Add support for two new MCA bank bits on AMD Zen6 which denote whether the error address logged is a system physical address, which obviates the need for it to be translated before further error recovery can be done * tag 'ras_core_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Handle AMD threshold interrupt storms x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems x86/mce: Add support for physical address valid bit x86/mce: Save and use APEI corrected threshold limit x86/mce/amd: Define threshold restart function for banks x86/mce/amd: Remove redundant reset_block() x86/mce/amd: Support SMCA Corrected Error Interrupt x86/mce/amd: Enable interrupt vectors once per-CPU on SMCA systems x86/mce: Unify AMD DFR handler with MCA Polling x86/mce: Unify AMD THR handler with MCA Polling commit b08ee4d666f216a6f9e7194a9b335147d4717f33 Author: Neilay Kharwadkar Date: Sun Nov 16 19:20:29 2025 +0000 lib/fonts: Add Terminus 10x18 console font Add a compile-in option for Terminus 10x18 bitmap console font to improve readability on modern laptop displays. On modern 13-16 inch laptop displays with high pixel density, common scaled resolutions like 1280x800 and 1440x900 are widely used. At these resolutions, VGA 8x16 is too small and difficult to read for extended periods, while Terminus 16x32 is too large, providing only 25-28 rows. The existing 10x18 font has poor readability. Terminus 10x18 provides improved readability with its clean, fixed-width design while maintaining practical row counts (44-50 rows). A comfortable and readable built-in font for early boot messages, kernel panics or whenever userspace is unavailable. The font was converted from standard Terminus ter-i18b.psf using psftools and formatted to match kernel font conventions. This patch is non-intrusive, no options are enabled by default so most users won't notice a thing. Signed-off-by: Neilay Kharwadkar Signed-off-by: Helge Deller commit 0155e868cbc111846cc2809c1546ea53810a56ae Author: Thorsten Blum Date: Tue Dec 2 19:15:32 2025 +0100 fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing The variables were never clamped because the return value of clamp_val() was not used. Fix this by assigning the clamped values, and use clamp() instead of clamp_val(). Cc: stable@vger.kernel.org Fixes: 3f16ff608a75 ("[ARM] pxafb: cleanup of the timing checking code") Signed-off-by: Thorsten Blum Signed-off-by: Helge Deller commit 49219bba0149157774b7091c3ea9ad22b2114285 Merge: 7f8d5f70fffe21 e2349c5811ae64 Author: Linus Torvalds Date: Tue Dec 2 10:45:50 2025 -0800 Merge tag 'edac_updates_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - imh_edac: Add a new EDAC driver for Intel Diamond Rapids and future incarnations of this memory controllers architecture - amd64_edac: Remove the legacy csrow sysfs interface which has been deprecated and unused (we assume) for at least a decade - Add the capability to fallback to BIOS-provided address translation functionality (ACPI PRM) which can be used on systems unsupported by the current AMD address translation library - The usual fixes, fixlets, cleanups and improvements all over the place * tag 'edac_updates_for_v6.19_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: RAS/AMD/ATL: Replace bitwise_xor_bits() with hweight16() EDAC/igen6: Fix error handling in igen6_edac driver EDAC/imh: Setup 'imh_test' debugfs testing node EDAC/{skx_comm,imh}: Detect 2-level memory configuration EDAC/skx_common: Extend the maximum number of DRAM chip row bits EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers EDAC/skx_common: Prepare for skx_set_hi_lo() EDAC/skx_common: Prepare for skx_get_edac_list() EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev EDAC/ghes: Replace deprecated strcpy() in ghes_edac_report_mem_error() EDAC/ie31200: Fix error handling in ie31200_register_mci RAS/CEC: Replace use of system_wq with system_percpu_wq EDAC: Remove the legacy EDAC sysfs interface EDAC/amd64: Remove NUM_CONTROLLERS macro EDAC/amd64: Generate ctl_name string at runtime RAS/AMD/ATL: Require PRM support for future systems ACPI: PRM: Add acpi_prm_handler_available() RAS/AMD/ATL: Return error codes from helper functions commit 35fa2b4bf96415b88d7edaa5cf8af5185d9ce76e Author: René Rebe Date: Thu Nov 20 14:24:00 2025 +0100 fbdev: tcx.c fix mem_map to correct smem_start offset 403ae52ac047 ("sparc: fix drivers/video/tcx.c warning") changed the physbase initializing breaking the user-space mmap, e.g. for Xorg entirely. Fix fbdev mmap table so the sbus mmap helper work correctly, and not try to map vastly (physbase) offset memory. Fixes: 403ae52ac047 ("sparc: fix drivers/video/tcx.c warning") Cc: Signed-off-by: René Rebe Signed-off-by: Helge Deller commit 7f8d5f70fffe2177afcc62f02feead5827dfe8dd Merge: d42e504a555d0d 70e0a80a1f3580 Author: Linus Torvalds Date: Tue Dec 2 10:18:49 2025 -0800 Merge tag 'core-core-2025-12-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core irq cleanup from Thomas Gleixner: "Tree wide cleanup of the remaining users of in_irq() which got replaced by in_hardirq() and marked deprecated in 2020" * tag 'core-core-2025-12-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: treewide: Remove in_irq() commit e0c26d47def7382d7dbd9cad58bc653aed75737a Merge: f58e70cc31e310 2bd1337a1295e0 Author: Paolo Bonzini Date: Tue Dec 2 18:58:47 2025 +0100 Merge tag 'kvm-s390-next-6.19-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD - SCA rework - VIRT_XFER_TO_GUEST_WORK support - Operation exception forwarding support - Cleanups commit d42e504a555d0da2a10001e697f0c8a7f633fb05 Merge: 5028f42416eaec 7dec062cfcf278 Author: Linus Torvalds Date: Tue Dec 2 09:58:33 2025 -0800 Merge tag 'timers-core-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: - Prevent a thundering herd problem when the timekeeper CPU is delayed and a large number of CPUs compete to acquire jiffies_lock to do the update. Limit it to one CPU with a separate "uncontended" atomic variable. - A set of improvements for the timer migration mechanism: - Support imbalanced NUMA trees correctly - Support dynamic exclusion of CPUs from the migrator duty to allow the cpuset/isolation mechanism to exclude them from handling timers of remote idle CPUs - The usual small updates, cleanups and enhancements * tag 'timers-core-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timers/migration: Exclude isolated cpus from hierarchy cpumask: Add initialiser to use cleanup helpers sched/isolation: Force housekeeping if isolcpus and nohz_full don't leave any cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks() timers/migration: Use scoped_guard on available flag set/clear timers/migration: Add mask for CPUs available in the hierarchy timers/migration: Rename 'online' bit to 'available' selftests/timers/nanosleep: Add tests for return of remaining time selftests/timers: Clean up kernel version check in posix_timers time: Fix a few typos in time[r] related code comments time: tick-oneshot: Add missing Return and parameter descriptions to kernel-doc hrtimer: Store time as ktime_t in restart block timers/migration: Remove dead code handling idle CPU checking for remote timers timers/migration: Remove unused "cpu" parameter from tmigr_get_group() timers/migration: Assert that hotplug preparing CPU is part of stable active hierarchy timers/migration: Fix imbalanced NUMA trees timers/migration: Remove locking on group connection timers/migration: Convert "while" loops to use "for" tick/sched: Limit non-timekeeper CPUs calling jiffies update commit 5028f42416eaec08d3f6aa4f98ccca669b3f8ab3 Merge: 9ce62ebbb7b24c 2437f798809d44 Author: Linus Torvalds Date: Tue Dec 2 09:54:27 2025 -0800 Merge tag 'timers-clocksource-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull clocksource updates from Thomas Gleixner: "Updates for clocksource and clockevent drivers: - A new driver for the Realtel system timer - Prevent the unbinding of timers when the drivers do not support that - Expand the timer counter readout for the SPRD driver to 64 bit to allow IOT devices suspend times of more than 36 hours, which is the current limit of the 32-bi readout - The usual small cleanups, fixes and enhancements all over the place" * tag 'timers-clocksource-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers: Add Realtek system timer driver dt-bindings: timer: Add Realtek SYSTIMER clocksource/drivers/stm32-lp: Drop unused module alias clocksource/drivers/rda: Add sched_clock_register for RDA8810PL SoC clocksource/drivers/nxp-stm: Prevent driver unbind clocksource/drivers/nxp-pit: Prevent driver unbind clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind clocksource/drivers/nxp-stm: Fix section mismatches clocksource/drivers/sh_cmt: Always leave device running after probe clocksource/drivers/stm: Fix double deregistration on probe failure clocksource/drivers/ralink: Fix resource leaks in init error path clocksource/drivers/timer-sp804: Fix read_current_timer() issue when clock source is not registered clocksource/drivers/sprd: Enable register for timer counter from 32 bit to 64 bit commit f58e70cc31e3109b4f81688c74146702b05199c7 Merge: 63a9b0bc65d5d3 3eef0c83c3f3e5 Author: Paolo Bonzini Date: Tue Dec 2 18:36:26 2025 +0100 Merge tag 'kvmarm-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.19 - Support for userspace handling of synchronous external aborts (SEAs), allowing the VMM to potentially handle the abort in a non-fatal manner. - Large rework of the VGIC's list register handling with the goal of supporting more active/pending IRQs than available list registers in hardware. In addition, the VGIC now supports EOImode==1 style deactivations for IRQs which may occur on a separate vCPU than the one that acked the IRQ. - Support for FEAT_XNX (user / privileged execute permissions) and FEAT_HAF (hardware update to the Access Flag) in the software page table walkers and shadow MMU. - Allow page table destruction to reschedule, fixing long need_resched latencies observed when destroying a large VM. - Minor fixes to KVM and selftests commit 9ce62ebbb7b24c28a1781f6b3bc6fdcd0b961392 Merge: 15b87bec89cb22 9c1fbc56ca0a98 Author: Linus Torvalds Date: Tue Dec 2 09:35:59 2025 -0800 Merge tag 'irq-msi-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MSI updates from Thomas Gleixner: "Updates for [PCI] MSI related code: - Remove one variant of PCI/MSI management as all users have been converted to use per device domains. That reduces the variants to two: The modern and the real archaic legacy variant, which keeps the usual suspects in the museum category alive. - Rework the platform MSI device ID detection mechanism in the ARM GIC world to address resource leaks, duplicated code and other details. This requires a corresponding preparatory step in the PCI/iproc driver. - Trivial core code cleanups" * tag 'irq-msi-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-its: Rework platform MSI deviceID detection PCI: iproc: Implement MSI controller node detection with of_msi_xlate() genirq/msi: Slightly simplify msi_domain_alloc() PCI/MSI: Delete pci_msi_create_irq_domain() commit 63a9b0bc65d5d3ea96a57e7985ea22a8582fbbe5 Merge: 80402804053648 3239c52fd21257 Author: Paolo Bonzini Date: Tue Dec 2 18:35:25 2025 +0100 Merge tag 'kvm-riscv-6.19-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.19 - SBI MPXY support for KVM guest - New KVM_EXIT_FAIL_ENTRY_NO_VSFILE for the case when in-kernel AIA virtualization fails to allocate IMSIC VS-file - Support enabling dirty log gradually in small chunks - Fix guest page fault within HLV* instructions - Flush VS-stage TLB after VCPU migration for Andes cores commit 8040280405364822f50c4c91cdbc29cf391c4091 Merge: 679fcce0028bf1 0f90fa6e2e9d98 Author: Paolo Bonzini Date: Tue Dec 2 18:34:22 2025 +0100 Merge tag 'loongarch-kvm-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.19 1. Get VM PMU capability from HW GCFG register. 2. Add AVEC basic support. 3. Use 64-bit register definition for EIOINTC. 4. Add KVM timer test cases for tools/selftests. commit bbaacdc339d4bde2690b659dc090af7c20a1937e Author: Gabriele Monaco Date: Thu Nov 13 16:06:18 2025 +0100 rv: Fix compilation if !CONFIG_RV_REACTORS The kernel test robot spotted a compilation error if reactors are disabled. Fix the warning by keeping LTL monitor variable as always static. Cc: Thomas Weißschuh Link: https://patch.msgid.link/20251113150618.185479-2-gmonaco@redhat.com Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511131948.vxi5mdjU-lkp@intel.com/ Fixes: 4f739ed19d22 ("rv: Pass va_list to reactors") Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 15b87bec89cb227b55b3689bf5de31b85cf88559 Merge: 6863c8385c28ba fc584d871c1641 Author: Linus Torvalds Date: Tue Dec 2 09:32:53 2025 -0800 Merge tag 'irq-drivers-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq driver updates from Thomas Gleixner: "Boring updates for interrupt drivers: - Support for a couple of new ARM64 and RISCV SoC variants and their magic interrupt controllers which either can reuse existing code or require quirks due to a botched hardware implementation - More section mismatch fixes - The usual cleanups and fixes all over the place" * tag 'irq-drivers-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (32 commits) irqchip/meson-gpio: Add support for Amlogic S6 S7 and S7D SoCs dt-bindings: interrupt-controller: Add support for Amlogic S6 S7 and S7D SoCs dt-bindings: interrupt-controller: aspeed,ast2700: Correct #interrupt-cells and interrupts count irqchip/aclint-sswi: Add Nuclei UX900 support dt-bindings: interrupt-controller: Add Anlogic DR1V90 ACLINT SSWI dt-bindings: interrupt-controller: Add Anlogic DR1V90 ACLINT MSWI dt-bindings: interrupt-controller: Add Anlogic DR1V90 PLIC irqchip/irq-bcm7038-l1: Remove unused reg_mask_status() irqchip/sifive-plic: Fix call to __plic_toggle() in M-Mode code path irqchip/sifive-plic: Add support for UltraRISC DP1000 PLIC irqchip/sifive-plic: Cache the interrupt enable state dt-bindings: interrupt-controller: Add UltraRISC DP1000 PLIC dt-bindings: vendor-prefixes: Add UltraRISC irqchip/qcom-irq-combiner: Rename driver structure irqchip/riscv-imsic: Inline imsic_vector_from_local_id() irqchip/riscv-imsic: Embed the vector array in lpriv irqchip/riscv-imsic: Remove redundant irq_data lookups irqchip/ts4800: Drop unused module alias irqchip/mvebu-pic: Drop unused module alias irqchip/meson-gpio: Drop unused module alias ... commit 6863c8385c28ba4d30391f1d1fce39f62581d362 Merge: 312f5b18663a6d 3de5e46e50abc0 Author: Linus Torvalds Date: Tue Dec 2 09:14:26 2025 -0800 Merge tag 'irq-core-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq core updates from Thomas Gleixner: "Updates for the interrupt core and treewide cleanups: - Rework of the Per Processor Interrupt (PPI) management on ARM[64] PPI support was built under the assumption that the systems are homogenous so that the same CPU local device types are connected to them. That's unfortunately wishful thinking and created horrible workarounds. This rework provides affinity management for PPIs so that they can be individually configured in the firmware tables and mops up the related drivers all over the place. - Prevent CPUSET/isolation changes to arbitrarily affine interrupt threads to random CPUs, which ignores user or driver settings. - Plug a harmless race in the interrupt affinity proc interface, which allows to see a half updated mask - Adjust the priority of secondary interrupt threads on RT, so that the combination of primary and secondary thread emulates the hardware interrupt plus thread scenario. Having them at the same priority can cause starvation issues in some drivers" * tag 'irq-core-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits) genirq: Remove cpumask availability check on kthread affinity setting genirq: Fix interrupt threads affinity vs. cpuset isolated partitions genirq: Prevent early spurious wake-ups of interrupt threads genirq: Use raw_spinlock_irq() in irq_set_affinity_notifier() genirq/manage: Reduce priority of forced secondary interrupt handler genirq/proc: Fix race in show_irq_affinity() genirq: Fix percpu_devid irq affinity documentation perf: arm_pmu: Kill last use of per-CPU cpu_armpmu pointer irqdomain: Kill of_node_to_fwnode() helper genirq: Kill irq_{g,s}et_percpu_devid_partition() irqchip: Kill irq-partition-percpu irqchip/apple-aic: Drop support for custom PMU irq partitions irqchip/gic-v3: Drop support for custom PPI partitions coresight: trbe: Request specific affinities for per CPU interrupts perf: arm_spe_pmu: Request specific affinities for per CPU interrupts perf: arm_pmu: Request specific affinities for per CPU NMIs/interrupts genirq: Add request_percpu_irq_affinity() helper genirq: Allow per-cpu interrupt sharing for non-overlapping affinities genirq: Update request_percpu_nmi() to take an affinity genirq: Add affinity to percpu_devid interrupt requests ... commit 312f5b18663a6dd8d8e6ad5a3fce0059a11686b2 Merge: 2b09f480f0a1e6 37de2dbc318ee1 Author: Linus Torvalds Date: Tue Dec 2 09:07:48 2025 -0800 Merge tag 'core-debugobjects-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "Two small updates for debugobjects: - Allow pool refill on RT enabled kernels before the scheduler is up and running to prevent pool exhaustion - Correct the lockdep override to prevent false positives" * tag 'core-debugobjects-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING commit eaf526cfa4e537af86543d77f402b9ae803f606e Author: Ilyas Gasanov Date: Tue Dec 2 19:49:30 2025 +0400 ALSA: hda/realtek: Add PCI SSIDs to HP ProBook quirks According to HW probes, there exist upgraded variants of HP ProBook 440/450 G8 notebook PC hardware, with PCI SSIDs not yet covered: - https://linux-hardware.org/?id=pci:8086-a0c8-103c-8a76 (HP ProBook 440 G8, SSID 103C:8A76, Tiger Lake HDA, ALC236) - https://linux-hardware.org/?id=pci:8086-a0c8-103c-8a77 (HP ProBook 450 G8, SSID 103C:8A77, Tiger Lake HDA, ALC236) The HDA GPIO indices for the mic mute (0x1) and speaker mute (0x2) LEDs are virtually guaranteed to be identical for the HP ProBook 440/450 G8 variants with motherboard SSIDs 8A74/8A75 (BIOS T87) and 8A76/8A77 (BIOS T88); especially since spare keyboard parts are interchangeable between different revisions of the same notebook models, and thus necessarily have the same slot pinouts. Signed-off-by: Ilyas Gasanov Link: https://patch.msgid.link/20251202154930.74481-1-public@gsnoff.com Signed-off-by: Takashi Iwai commit af62fe2494da84eb01752282c8228c9bb3fe9f67 Author: Sean Christopherson Date: Mon Dec 1 18:03:34 2025 -0800 KVM: Harden and prepare for modifying existing guest_memfd memslots Unbind guest_memfd memslots if KVM commits a MOVE or FLAGS_ONLY memslot change to harden against use-after-free, and to prepare for eventually supporting dirty logging on guest_memfd memslots, at which point FLAGS_ONLY changes will be expected/supported. Add two separate WARNs, once to yell if a guest_memfd memslot is moved (which KVM is never expected to allow/support), and again if the unbind() is triggered, to help detect uAPI goofs prior to deliberately allowing FLAGS_ONLY changes. Link: https://patch.msgid.link/20251202020334.1171351-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 9935df5333aa503a18de5071f53762b65c783c4c Author: Sean Christopherson Date: Mon Dec 1 18:03:33 2025 -0800 KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was initially created with a guest_memfd binding, as KVM doesn't support toggling KVM_MEM_GUEST_MEMFD on existing memslots. KVM prevents enabling KVM_MEM_GUEST_MEMFD, but doesn't prevent clearing the flag. Failure to reject the new memslot results in a use-after-free due to KVM not unbinding from the guest_memfd instance. Unbinding on a FLAGS_ONLY change is easy enough, and can/will be done as a hardening measure (in anticipation of KVM supporting dirty logging on guest_memfd at some point), but fixing the use-after-free would only address the immediate symptom. ================================================================== BUG: KASAN: slab-use-after-free in kvm_gmem_release+0x362/0x400 [kvm] Write of size 8 at addr ffff8881111ae908 by task repro/745 CPU: 7 UID: 1000 PID: 745 Comm: repro Not tainted 6.18.0-rc6-115d5de2eef3-next-kasan #3 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack_lvl+0x51/0x60 print_report+0xcb/0x5c0 kasan_report+0xb4/0xe0 kvm_gmem_release+0x362/0x400 [kvm] __fput+0x2fa/0x9d0 task_work_run+0x12c/0x200 do_exit+0x6ae/0x2100 do_group_exit+0xa8/0x230 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0x737/0x740 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f581f2eac31 Allocated by task 745 on cpu 6 at 9.746971s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_kmalloc+0x77/0x90 kvm_set_memory_region.part.0+0x652/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 745 on cpu 6 at 9.747467s: kasan_save_stack+0x20/0x40 kasan_save_track+0x13/0x50 __kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x3b/0x60 kfree+0xf5/0x440 kvm_set_memslot+0x3c2/0x1160 [kvm] kvm_set_memory_region.part.0+0x86a/0x1110 [kvm] kvm_vm_ioctl+0x14b0/0x3290 [kvm] __x64_sys_ioctl+0x129/0x1a0 do_syscall_64+0x5b/0x900 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Reported-by: Alexander Potapenko Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251202020334.1171351-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 824d227324dcd328857b70e37b41780f02225729 Author: Sean Christopherson Date: Mon Dec 1 17:50:49 2025 -0800 KVM: selftests: Add a CPUID testcase for KVM_SET_CPUID2 with runtime updates Add a CPUID testcase to verify that KVM allows KVM_SET_CPUID2 after (or in conjunction with) runtime updates. This is a regression test for the bug introduced by commit 93da6af3ae56 ("KVM: x86: Defer runtime updates of dynamic CPUID bits until CPUID emulation"), where KVM would incorrectly reject KVM_SET_CPUID due to a not handling a pending runtime update on the current CPUID, resulting in a false mismatch between the "old" and "new" CPUID entries. Link: https://lore.kernel.org/all/20251128123202.68424a95@imammedo Link: https://patch.msgid.link/20251202015049.1167490-3-seanjc@google.com Signed-off-by: Sean Christopherson commit e2b43fb25243d502ad36b07bab9de09f4b76fff9 Author: Sean Christopherson Date: Mon Dec 1 17:50:48 2025 -0800 KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2} When handling KVM_SET_CPUID{,2}, do runtime CPUID updates on the vCPU's current CPUID (and caps) prior to swapping in the incoming CPUID state so that KVM doesn't lose pending updates if the incoming CPUID is rejected, and to prevent a false failure on the equality check. Note, runtime updates are unconditionally performed on the incoming/new CPUID (and associated caps), i.e. clearing the dirty flag won't negatively affect the new CPUID. Fixes: 93da6af3ae56 ("KVM: x86: Defer runtime updates of dynamic CPUID bits until CPUID emulation") Reported-by: Igor Mammedov Closes: https://lore.kernel.org/all/20251128123202.68424a95@imammedo Cc: stable@vger.kernel.org Acked-by: Igor Mammedov Tested-by: Igor Mammedov Link: https://patch.msgid.link/20251202015049.1167490-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 1b9439c933b500cb24710bbd81fe56e9b0025b6f Author: Gavin Shan Date: Mon Nov 24 15:04:27 2025 +1000 KVM: selftests: Add missing "break" in rseq_test's param parsing In commit 0297cdc12a87 ("KVM: selftests: Add option to rseq test to override /dev/cpu_dma_latency"), a 'break' is missed before the option 'l' in the argument parsing loop, which leads to an unexpected core dump in atoi_paranoid(). It tries to get the latency from non-existent argument. host$ ./rseq_test -u Random seed: 0x6b8b4567 Segmentation fault (core dumped) Add a 'break' before the option 'l' in the argument parsing loop to avoid the unexpected core dump. Fixes: 0297cdc12a87 ("KVM: selftests: Add option to rseq test to override /dev/cpu_dma_latency") Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Gavin Shan Link: https://patch.msgid.link/20251124050427.1924591-1-gshan@redhat.com [sean: describe code change in shortlog] Signed-off-by: Sean Christopherson commit 2b09f480f0a1e68111ae36a7be9aa1c93e067255 Merge: 1dce50698a5cee 653fda7ae73d80 Author: Linus Torvalds Date: Tue Dec 2 08:48:53 2025 -0800 Merge tag 'core-rseq-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq updates from Thomas Gleixner: "A large overhaul of the restartable sequences and CID management: The recent enablement of RSEQ in glibc resulted in regressions which are caused by the related overhead. It turned out that the decision to invoke the exit to user work was not really a decision. More or less each context switch caused that. There is a long list of small issues which sums up nicely and results in a 3-4% regression in I/O benchmarks. The other detail which caused issues due to extra work in context switch and task migration is the CID (memory context ID) management. It also requires to use a task work to consolidate the CID space, which is executed in the context of an arbitrary task and results in sporadic uncontrolled exit latencies. The rewrite addresses this by: - Removing deprecated and long unsupported functionality - Moving the related data into dedicated data structures which are optimized for fast path processing. - Caching values so actual decisions can be made - Replacing the current implementation with a optimized inlined variant. - Separating fast and slow path for architectures which use the generic entry code, so that only fault and error handling goes into the TIF_NOTIFY_RESUME handler. - Rewriting the CID management so that it becomes mostly invisible in the context switch path. That moves the work of switching modes into the fork/exit path, which is a reasonable tradeoff. That work is only required when a process creates more threads than the cpuset it is allowed to run on or when enough threads exit after that. An artificial thread pool benchmarks which triggers this did not degrade, it actually improved significantly. The main effect in migration heavy scenarios is that runqueue lock held time and therefore contention goes down significantly" * tag 'core-rseq-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (54 commits) sched/mmcid: Switch over to the new mechanism sched/mmcid: Implement deferred mode change irqwork: Move data struct to a types header sched/mmcid: Provide CID ownership mode fixup functions sched/mmcid: Provide new scheduler CID mechanism sched/mmcid: Introduce per task/CPU ownership infrastructure sched/mmcid: Serialize sched_mm_cid_fork()/exit() with a mutex sched/mmcid: Provide precomputed maximal value sched/mmcid: Move initialization out of line signal: Move MMCID exit out of sighand lock sched/mmcid: Convert mm CID mask to a bitmap cpumask: Cache num_possible_cpus() sched/mmcid: Use cpumask_weighted_or() cpumask: Introduce cpumask_weighted_or() sched/mmcid: Prevent pointless work in mm_update_cpus_allowed() sched/mmcid: Move scheduler code out of global header sched: Fixup whitespace damage sched/mmcid: Cacheline align MM CID storage sched/mmcid: Use proper data structures sched/mmcid: Revert the complex CID management ... commit 8a157e0a0aa5143b5d94201508c0ca1bb8cfb941 Author: Andreas Gruenbacher Date: Sun Nov 30 21:19:52 2025 +0000 gfs2: Fix use of bio_chain In gfs2_chain_bio(), the call to bio_chain() has its arguments swapped. The result is leaked bios and incorrect synchronization (only the last bio will actually be waited for). This code is only used during mount and filesystem thaw, so the bug normally won't be noticeable. Reported-by: Stephen Zhang Signed-off-by: Andreas Gruenbacher commit 0c314a881cac61a80a0e05309fafd48c55dd3afc Author: Josh Poimboeuf Date: Tue Dec 2 08:16:28 2025 -0800 objtool: Fix stack overflow in validate_branch() On an allmodconfig kernel compiled with Clang, objtool is segfaulting in drivers/scsi/qla2xxx/qla2xxx.o due to a stack overflow in validate_branch(). Due in part to KASAN being enabled, the qla2xxx code has a large number of conditional jumps, causing objtool to go quite deep in its recursion. By far the biggest offender of stack usage is the recently added 'prev_state' stack variable in validate_insn(), coming in at 328 bytes. Move that variable (and its tracing usage) to handle_insn_ops() and make handle_insn_ops() noinline to keep its stack frame outside the recursive call chain. Reported-by: Nathan Chancellor Fixes: fcb268b47a2f ("objtool: Trace instruction state changes during function validation") Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/21bb161c23ca0d8c942a960505c0d327ca2dc7dc.1764691895.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/20251201202329.GA3225984@ax162 commit 79c3ae7ada0548d5097bdb65dde5d24a7d660fae Author: Frank Li Date: Tue Oct 28 10:57:54 2025 -0400 regmap: i3c: switch to use i3c_xfer from i3c_priv_xfer Switch to use i3c_xfer instead of i3c_priv_xfer because framework will update to support HDR mode. i3c_priv_xfer is now an alias of i3c_xfer. Replace i3c_device_do_priv_xfers() with i3c_device_do_xfers(..., I3C_SDR) to align with the new API. Prepare for removal of i3c_priv_xfer and i3c_device_do_priv_xfers(). Signed-off-by: Frank Li Acked-by: Mark Brown Link: https://patch.msgid.link/20251028-lm75-v1-3-9bf88989c49c@nxp.com Signed-off-by: Alexandre Belloni commit 57c4011d36374568b24d9e8cba892e81697ed9f4 Author: Frank Li Date: Tue Oct 28 10:57:53 2025 -0400 net: mctp i3c: switch to use i3c_xfer from i3c_priv_xfer Switch to use i3c_xfer instead of i3c_priv_xfer because framework will update to support HDR mode. i3c_priv_xfer is now an alias of i3c_xfer. Replace i3c_device_do_priv_xfers() with i3c_device_do_xfers(..., I3C_SDR) to align with the new API. Prepare for removal of i3c_priv_xfer and i3c_device_do_priv_xfers(). Signed-off-by: Frank Li Acked-by: Matt Johnston Link: https://patch.msgid.link/20251028-lm75-v1-2-9bf88989c49c@nxp.com Signed-off-by: Alexandre Belloni commit 1f08a91cec5f405ee121c920933fbcf90487c9de Author: Frank Li Date: Tue Oct 28 10:57:52 2025 -0400 hwmon: (lm75): switch to use i3c_xfer from i3c_priv_xfer Switch to use i3c_xfer instead of i3c_priv_xfer because framework will update to support HDR mode. i3c_priv_xfer is now an alias of i3c_xfer. Replace i3c_device_do_priv_xfers() with i3c_device_do_xfers(..., I3C_SDR) to align with the new API. Prepare for removal of i3c_priv_xfer and i3c_device_do_priv_xfers(). Signed-off-by: Frank Li Acked-by: Guenter Roeck Link: https://patch.msgid.link/20251028-lm75-v1-1-9bf88989c49c@nxp.com Signed-off-by: Alexandre Belloni commit e01a8baf60af43f6f87a5850dee29cf31377ec25 Author: Alexandre Belloni Date: Tue Dec 2 16:38:03 2025 +0100 i3c: document i3c_xfers i3c_xfers was left undocumented, document it. Reported-by: Stephen Rothwell Link: https://patch.msgid.link/20251202153804.2640623-2-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 4b011b538f2b90d07580ff778e28954a4a6520eb Author: Alexandre Belloni Date: Tue Dec 2 16:38:02 2025 +0100 i3c: fix I3C_SDR bit number 0x31 is decimal 49 and doesn't fit in a 32 bit integer, switch to the intended decimal 31. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512020956.Dnz8A2H0-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512021613.97jVprvJ-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202512021644.lp8ZMSx5-lkp@intel.com/ Link: https://patch.msgid.link/20251202153804.2640623-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 3925683515e93844be204381d2d5a1df5de34f31 Author: Mario Limonciello (AMD) Date: Sat Nov 29 19:46:31 2025 -0600 Revert "drm/amd: Skip power ungate during suspend for VPE" Skipping power ungate exposed some scenarios that will fail like below: ``` amdgpu: Register(0) [regVPEC_QUEUE_RESET_REQ] failed to reach value 0x00000000 != 0x00000001n amdgpu 0000:c1:00.0: amdgpu: VPE queue reset failed ... amdgpu: [drm] *ERROR* wait_for_completion_timeout timeout! ``` The underlying s2idle issue that prompted this commit is going to be fixed in BIOS. This reverts commit 2a6c826cfeedd7714611ac115371a959ead55bda. Fixes: 2a6c826cfeed ("drm/amd: Skip power ungate during suspend for VPE") Cc: stable@vger.kernel.org Signed-off-by: Mario Limonciello (AMD) Acked-by: Alex Deucher Reported-by: Konstantin Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220812 Reported-by: Matthew Schwartz Signed-off-by: Alex Deucher commit 817356048e38e2284a04319b7c78b3c5a5f3d7c3 Author: Alex Deucher Date: Tue Nov 18 16:56:54 2025 -0500 drm/amdgpu: use common defines for HUB faults Use common definitions for the fault bits in the IH sourc data for the gmc9-12 memory hub faults Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit ff28ff98db6a8eeb469e02fb8bd1647b353232a9 Author: Alex Deucher Date: Thu Nov 13 15:57:43 2025 -0500 drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling We need to call amdgpu_vm_handle_fault() on page fault on all gfx9 and newer parts to properly update the page tables, not just for recoverable page faults. Cc: stable@vger.kernel.org Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 3f2289b56cd98f5741056bdb6e521324eff07ce5 Author: Alex Deucher Date: Thu Nov 13 15:55:19 2025 -0500 drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling We need to call amdgpu_vm_handle_fault() on page fault on all gfx9 and newer parts to properly update the page tables, not just for recoverable page faults. Cc: stable@vger.kernel.org Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 0300e6d6ff63ff86f9acca65071ecbfff50eb575 Author: Brady Norander Date: Tue Mar 25 17:05:17 2025 -0400 drm/amdgpu: use static ids for ACP platform devs mfd_add_hotplug_devices() assigns child platform devices with PLATFORM_DEVID_AUTO, but the ACP machine drivers expect the platform device names to never change. Use mfd_add_devices() instead and give each cell a unique id. Signed-off-by: Brady Norander Signed-off-by: Alex Deucher commit c8e7e3c2215e286ebfe66fe828ed426546c519e6 Author: Srinivasan Shanmugam Date: Tue Nov 25 21:20:45 2025 +0530 drm/amdgpu/sdma6: Update SDMA 6.0.3 FW version to include UMQ protected-fence fix On GFX11.0.3, earlier SDMA firmware versions issue the PROTECTED_FENCE write from the user VMID (e.g. VMID 8) instead of VMID 0. This causes a GPU VM protection fault when SDMA tries to write the secure fence location, as seen in the UMQ SDMA test (cs-sdma-with-IP-DMA-UMQ) Fixes the below GPU page fault: [ 514.037189] amdgpu 0000:0b:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:40 vmid:8 pasid:32770) [ 514.037199] amdgpu 0000:0b:00.0: amdgpu: Process pid 0 thread pid 0 [ 514.037205] amdgpu 0000:0b:00.0: amdgpu: in page starting at address 0x00007fff00409000 from client 10 [ 514.037212] amdgpu 0000:0b:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00841A51 [ 514.037217] amdgpu 0000:0b:00.0: amdgpu: Faulty UTCL2 client ID: SDMA0 (0xd) [ 514.037223] amdgpu 0000:0b:00.0: amdgpu: MORE_FAULTS: 0x1 [ 514.037227] amdgpu 0000:0b:00.0: amdgpu: WALKER_ERROR: 0x0 [ 514.037232] amdgpu 0000:0b:00.0: amdgpu: PERMISSION_FAULTS: 0x5 [ 514.037236] amdgpu 0000:0b:00.0: amdgpu: MAPPING_ERROR: 0x0 [ 514.037241] amdgpu 0000:0b:00.0: amdgpu: RW: 0x1 v2: Updated commit message v3: s/gfx11.0.3/sdma 6.0.3/ in patch title (Alex) Cc: Alex Deucher Cc: Christian König Cc: stable@vger.kernel.org Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 8defb4f081a5feccc3ea8372d0c7af3522124e1f Author: Natalie Vock Date: Mon Dec 1 12:52:38 2025 -0500 drm/amdgpu: Forward VMID reservation errors Otherwise userspace may be fooled into believing it has a reserved VMID when in reality it doesn't, ultimately leading to GPU hangs when SPM is used. Fixes: 80e709ee6ecc ("drm/amdgpu: add option params to enforce process isolation between graphics and compute") Cc: stable@vger.kernel.org Reviewed-by: Christian König Signed-off-by: Natalie Vock Signed-off-by: Alex Deucher commit 40cc2b423d9da17ac622dbcc858fa94d428a4f03 Author: Timur Kristóf Date: Wed Nov 26 14:29:52 2025 +0100 drm/amdgpu/gmc8: Delegate VM faults to soft IRQ handler ring On old GPUs, it may be an issue that handling the interrupts from VM faults is too slow and the interrupt handler (IH) ring may overflow, which can cause an eventual hang. Delegate the processing of all VM faults to the soft IRQ handler ring. As a result, we spend much less time in the IRQ handler that interacts with the HW IH ring, which significantly reduces the chance of hangs/reboots. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 8715a7ab382a7e92d1431b565d7bdb5e13b3715e Author: Timur Kristóf Date: Wed Nov 26 14:29:51 2025 +0100 drm/amdgpu/gmc7: Delegate VM faults to soft IRQ handler ring On old GPUs, it may be an issue that handling the interrupts from VM faults is too slow and the interrupt handler (IH) ring may overflow, which can cause an eventual hang. Delegate the processing of all VM faults to the soft IRQ handler ring. As a result, we spend much less time in the IRQ handler that interacts with the HW IH ring, which significantly reduces the chance of hangs/reboots. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 4996b4c19984a71ec7eae6301a24565252291433 Author: Timur Kristóf Date: Wed Nov 26 14:29:50 2025 +0100 drm/amdgpu/gmc6: Delegate VM faults to soft IRQ handler ring On old GPUs, it may be an issue that handling the interrupts from VM faults is too slow and the interrupt handler (IH) ring may overflow, which can cause an eventual hang. Delegate the processing of all VM faults to the soft IRQ handler ring. As a result, we spend much less time in the IRQ handler that interacts with the HW IH ring, which significantly reduces the chance of hangs/reboots. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 61673efc1f5b883ecbeaf7957c5594b70015572b Author: Timur Kristóf Date: Wed Nov 26 14:29:49 2025 +0100 drm/amdgpu/gmc6: Cache VM fault info Call amdgpu_vm_update_fault_cache on GMC v6 similarly to how we do in GMC v7-v8 so that VM fault info can be used later by userspace for debugging. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit d56aabaa562bcf9ac915b265c565d22f72ca2dd2 Author: Timur Kristóf Date: Wed Nov 26 14:29:48 2025 +0100 drm/amdgpu/gmc6: Don't print MC client as it's unknown The VM_CONTEXT1_PROTECTION_FAULT_MCCLIENT register doesn't exist on GMC v6 so we can't print the MC client as a string like we do on GMC v7-v8. However, we still print the mc_id from VM_CONTEXT1_PROTECTION_FAULT_STATUS. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 488d9e7cd68ced0fa62bb6641a2b9a8329d399d5 Author: Timur Kristóf Date: Wed Nov 26 14:29:47 2025 +0100 drm/amdgpu/cz_ih: Enable soft IRQ handler ring We are going to use the soft IRQ handler ring on GMC v8 to process interrupts from VM faults. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit f8085859a5b0ab587256149832d218902e41463a Author: Timur Kristóf Date: Wed Nov 26 14:29:46 2025 +0100 drm/amdgpu/tonga_ih: Enable soft IRQ handler ring We are going to use the soft IRQ handler ring on GMC v8 to process interrupts from VM faults. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit f4fa4c9e2dcf4c02da63c995fc584e4427c22a4d Author: Timur Kristóf Date: Wed Nov 26 14:29:45 2025 +0100 drm/amdgpu/iceland_ih: Enable soft IRQ handler ring We are going to use the soft IRQ handler ring on GMC v8 to process interrupts from VM faults. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 45bef8999a641573dbfac4f80fa47cee90a5aa2d Author: Timur Kristóf Date: Wed Nov 26 14:29:44 2025 +0100 drm/amdgpu/cik_ih: Enable soft IRQ handler ring We are going to use the soft IRQ handler ring on GMC v7 (CIK) to process interrupts from VM faults. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 2a38b0ece1923cb626b639507a9c6e633b511291 Author: Timur Kristóf Date: Wed Nov 26 14:29:43 2025 +0100 drm/amdgpu/si_ih: Enable soft IRQ handler ring We are going to use the soft IRQ handler ring on GMC v6 (SI) to process interrupts from VM faults. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 1dce50698a5ceedaca806e0a78573886a363dc95 Merge: 4a26e7032d7d57 4322c8f81c58da Author: Linus Torvalds Date: Tue Dec 2 08:01:39 2025 -0800 Merge tag 'core-uaccess-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scoped user access updates from Thomas Gleixner: "Scoped user mode access and related changes: - Implement the missing u64 user access function on ARM when CONFIG_CPU_SPECTRE=n. This makes it possible to access a 64bit value in generic code with [unsafe_]get_user(). All other architectures and ARM variants provide the relevant accessors already. - Ensure that ASM GOTO jump label usage in the user mode access helpers always goes through a local C scope label indirection inside the helpers. This is required because compilers are not supporting that a ASM GOTO target leaves a auto cleanup scope. GCC silently fails to emit the cleanup invocation and CLANG fails the build. [ Editor's note: gcc-16 will have fixed the code generation issue in commit f68fe3ddda4 ("eh: Invoke cleanups/destructors in asm goto jumps [PR122835]"). But we obviously have to deal with clang and older versions of gcc, so.. - Linus ] This provides generic wrapper macros and the conversion of affected architecture code to use them. - Scoped user mode access with auto cleanup Access to user mode memory can be required in hot code paths, but if it has to be done with user controlled pointers, the access is shielded with a speculation barrier, so that the CPU cannot speculate around the address range check. Those speculation barriers impact performance quite significantly. This cost can be avoided by "masking" the provided pointer so it is guaranteed to be in the valid user memory access range and otherwise to point to a guaranteed unpopulated address space. This has to be done without branches so it creates an address dependency for the access, which the CPU cannot speculate ahead. This results in repeating and error prone programming patterns: if (can_do_masked_user_access()) from = masked_user_read_access_begin((from)); else if (!user_read_access_begin(from, sizeof(*from))) return -EFAULT; unsafe_get_user(val, from, Efault); user_read_access_end(); return 0; Efault: user_read_access_end(); return -EFAULT; which can be replaced with scopes and automatic cleanup: scoped_user_read_access(from, Efault) unsafe_get_user(val, from, Efault); return 0; Efault: return -EFAULT; - Convert code which implements the above pattern over to scope_user.*.access(). This also corrects a couple of imbalanced masked_*_begin() instances which are harmless on most architectures, but prevent PowerPC from implementing the masking optimization. - Add a missing speculation barrier in copy_from_user_iter()" * tag 'core-uaccess-2025-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lib/strn*,uaccess: Use masked_user_{read/write}_access_begin when required scm: Convert put_cmsg() to scoped user access iov_iter: Add missing speculation barrier to copy_from_user_iter() iov_iter: Convert copy_from_user_iter() to masked user access select: Convert to scoped user access x86/futex: Convert to scoped user access futex: Convert to get/put_user_inline() uaccess: Provide put/get_user_inline() uaccess: Provide scoped user access regions arm64: uaccess: Use unsafe wrappers for ASM GOTO s390/uaccess: Use unsafe wrappers for ASM GOTO riscv/uaccess: Use unsafe wrappers for ASM GOTO powerpc/uaccess: Use unsafe wrappers for ASM GOTO x86/uaccess: Use unsafe wrappers for ASM GOTO uaccess: Provide ASM GOTO safe wrappers for unsafe_*_user() ARM: uaccess: Implement missing __get_user_asm_dword() commit a7fa4f2d9665eb09564cd9801b5c4aec93188d1d Author: Aditya Gollamudi Date: Sun Oct 12 12:13:19 2025 -0700 drm/amd/display: fix typo in display_mode_core_structs.h Fix a typo in a comment, change "enviroment" to "environment" in drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h Fixes: e6a8a000cfe6 ("drm/amd/display: Rename dml2 to dml2_0 folder") Acked-by: Aurabindo Pillai Signed-off-by: Aditya Gollamudi Signed-off-by: Alex Deucher Signed-off-by: Roman Li Signed-off-by: Alex Deucher commit 54da09c768ebe85efa043ad0d0695d0ee374c2d7 Author: Ian Chen Date: Thu Nov 13 13:07:58 2025 +0800 drm/amd/display: fix Smart Power OLED not working after S4 [HOW] Before enable smart power OLED, we need to call set pipe to let DMUB get correct ABM config. Reviewed-by: Robin Chen Signed-off-by: Ian Chen Signed-off-by: Roman Li Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 5fdd03c7e2ec19476d7598e5604c09ca4062764b Author: Ivan Lipski Date: Fri Nov 21 15:03:57 2025 -0500 drm/amd/display: Move RGB-type check for audio sync to DCE HW sequence [Why&How] DVI-A & VGA connectors are applicable to DCE ASICs, so move them to dce110_hwseq.c to block audio sync on SIGNAL_TYPE_RGB for DCE ASICs. Signed-off-by: Ivan Lipski Reviewed-by: Harry Wentland Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 4fa944255be521b1bbd9780383f77206303a3a5c Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 25 10:48:39 2025 +0100 drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma Users of ttm entities need to hold the gtt_window_lock before using them to guarantee proper ordering of jobs. Cc: stable@vger.kernel.org Fixes: cb5cc4f573e1 ("drm/amdgpu: improve debug VRAM access performance using sdma") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3c4159b3019cc3444495f54c18083cda579cba84 Merge: 31a3ed492dd419 d4aa0cc9bd31f3 Author: Paolo Abeni Date: Tue Dec 2 15:20:41 2025 +0100 Merge branch 'net-mlx5e-disable-egress-xdp-redirect-in-default' Tariq Toukan says: ==================== net/mlx5e: Disable egress xdp-redirect in default This small series disables the egress xdp-redirect feature in default. It can still be enabled by loading a dummy XDP program. Patches were previously submitted as part of [1]. This reduces the default number of SQs in each channel from 4 to 3, and saves resources in device and host memory. This also improves the latency of channel configuration operations, like interface up (create channels), interface down (destroy channels), and channels reconfiguration (create new set, destroy old one). Perf numbers: NIC: Connect-X7. Setup: 248 channels, default mtu and rx/tx ring sizes. Interface up + down: Before: 2.246 secs After: 1.798 secs (-0.448 sec) Saves ~1.8 msec per channel. [1] https://lore.kernel.org/all/1762939749-1165658-1-git-send-email-tariqt@nvidia.com/ ==================== Link: https://patch.msgid.link/1764497617-1326331-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit d4aa0cc9bd31f3e0cd5f067d649bf39135e4b46b Author: Tariq Toukan Date: Sun Nov 30 12:13:37 2025 +0200 net/mlx5e: Support XDP target xmit with dummy program Save per-channel resources in default, in device and host memory. As no better API exist, make the XDP-redirect-target SQ available by loading a dummy XDP program. This improves the latency of interface up/down operations when feature is disabled. Perf numbers: NIC: Connect-X7. Setup: 248 channels, default mtu and rx/tx ring sizes. Interface up + down: Before: 2.246 secs After: 1.798 secs (-0.448 sec) Saves ~1.8 msec per channel. Signed-off-by: Tariq Toukan Reviewed-by: Dragos Tatulea Reviewed-by: William Tu Link: https://patch.msgid.link/1764497617-1326331-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 96a8395061358adcd4b6a4f0f4c8989ec69e8659 Author: Tariq Toukan Date: Sun Nov 30 12:13:36 2025 +0200 net/mlx5e: Update XDP features in switch channels The XDP features state might depend of the state of other features, like HW-LRO / HW-GRO. In general, move the re-evaluation announcement of the XDP features (xdp_set_features_flag_locked) into the flow where configuration gets changed. There's no point in updating them elsewhere. This is a more appropriate place, as this modifies the announced features while channels are inactive, which avoids the small interval between channel activation and the proper setting of the XDP features. Signed-off-by: Tariq Toukan Reviewed-by: Dragos Tatulea Reviewed-by: William Tu Link: https://patch.msgid.link/1764497617-1326331-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni commit 8af1d3fe5f186bff53057c6856046b0752fe71e8 Merge: 4e9aaf9cab0eb2 e64e190044de88 Author: Jiri Kosina Date: Tue Dec 2 14:56:19 2025 +0100 Merge branch 'for-6.19/alps' into for-linus - hid-alps documentation fixes (Bagas Sanjaya) commit 4e9aaf9cab0eb2dc69a549f3ff9632b248a7b0a5 Merge: 1a2f09ae11b465 10c64d4ff42a9c Author: Jiri Kosina Date: Tue Dec 2 14:55:26 2025 +0100 Merge branch 'for-6.19/core' into for-linus - Proper mapping of HID_GD_Z to ABS_DISTANCE for stylus/pen types of devices (Ping Cheng) commit 1a2f09ae11b4657d49df6fa86744795f99c2ee27 Merge: 59c752c59f12cf 3b86c87f8dcbb8 Author: Jiri Kosina Date: Tue Dec 2 14:52:36 2025 +0100 Merge branch 'for-6.19/hid-bpf' into for-linus - Bring in a couple more BPF drivers for various devices (Benjamin Tissoires) commit 59c752c59f12cfb56bbc0b213a4d24407959688a Merge: b68822a9c91d13 3644f4411713f5 Author: Jiri Kosina Date: Tue Dec 2 14:51:23 2025 +0100 Merge branch 'for-6.19/intel-ish-v2' into for-linus - Power management/hibernation improvements in intel-ish (Zhang Lixu) - Switch of intel-ish to unbound workqueues (Zhang Lixu) commit b68822a9c91d13047736a48959d17eb60c8fbf1b Merge: 4b2dda7374c706 c430f56be32ec0 Author: Jiri Kosina Date: Tue Dec 2 14:51:03 2025 +0100 Merge branch 'for-6.19/intel-thc' into for-linus commit 4b2dda7374c7068f3b3a072f1afc985b6b10b372 Merge: 7362b5b493102c ae9416f1f4adcc Author: Jiri Kosina Date: Tue Dec 2 14:48:03 2025 +0100 Merge branch 'for-6.19/logitech' into for-linus - Support for Logitech G Pro X Superlight 2 receiver (Nathan Rossi) - Fix for retry logic in hidpp_send_message_sync() (Mavroudis Chatzilazaridis) - Support for new Lighspeed receiver version (Mavroudis Chatzilazaridis) - Support for Logitech G13 (Leo L. Schwab) - Backlight support improvement for Logitech G510 (Hans de Goede) commit 7362b5b493102c6b71827c2da22117b475528f6d Merge: eb41c955b05ea0 06416555c883e3 Author: Jiri Kosina Date: Tue Dec 2 14:46:11 2025 +0100 Merge branch 'for-6.19/nintendo' into for-linus - switch to WQ_PERCPU workaueues (Marco Crivellari) - reduce potential initialization blocking time of hid-nintendo (Willy Huang) commit eb41c955b05ea015275b3188b27b3960a95ae149 Merge: eacdef84e64005 ee35448c89aaa2 Author: Jiri Kosina Date: Tue Dec 2 14:44:41 2025 +0100 Merge branch 'for-6.19/uclogic' into for-linus - support for UcLogic XP-PEN Artist 24 Pro (Joshua Goins) commit eacdef84e64005406ac9919b509340c504ec071e Merge: d6f4941f1b4f3e d43ae847cb53ef Author: Jiri Kosina Date: Tue Dec 2 14:44:04 2025 +0100 Merge branch 'for-6.19/winwing' into for-linus - WinWing Orion2 throttle support improvement (Ivan Gorinov) commit e1f2e77624dbc35f317efd7e092aa91f7136f3f9 Author: Ali Tariq Date: Sun Nov 30 09:12:51 2025 +0000 spi: cadence-qspi: Fix runtime PM imbalance in probe The probe function incorrectly calls pm_runtime_put_autosuspend() twice in succession at the end of successful probe, dropping two runtime PM references while only one was acquired earlier with pm_runtime_get_sync(). This causes a usage count underflow: cadence-qspi 13010000.spi: Runtime PM usage count underflow! Remove the first redundant pm_runtime_put_autosuspend() call to balance the reference count. Tested on StarFive VisionFive 2 v1.2A board. Fixes: 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled") Signed-off-by: Ali Tariq Link: https://patch.msgid.link/20251130091251.12120-1-alitariq45892@gmail.com Signed-off-by: Mark Brown commit 2b69bee5a2d07bc0583f2a8f17d262ddf7c58466 Author: Richard Fitzgerald Date: Mon Dec 1 11:14:29 2025 +0000 ASoC: cs-amp-lib: Revert use of __free(kfree) back to normal C cleanup Revert commit 6797540c8b76 ("ASoC: cs-amp-lib: Use __free(kfree) instead of manual freeing"). Krzysztof Kozlowski pointed out that __free() can be dangerous. It can introduce new cleanup bugs. These are more subtle and difficult to spot than a missing goto in traditional cleanup, because they are triggered by writing regular idiomatic C code instead of using C++ conventions. As it's regular C style it's more likely to be missed because the code is as would be expected for C. The traditional goto also more obviously flags to anyone changing the code in the future that they must be careful about the cleanup. We can just revert the change. There was nothing wrong with the original code and as Krzysztof noted: "it does not make the code simpler." Signed-off-by: Richard Fitzgerald Fixes: 6797540c8b76 ("ASoC: cs-amp-lib: Use __free(kfree) instead of manual freeing") Link: https://patch.msgid.link/20251201111429.43517-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 3ef4d9ede20db39bff34a559b04a1938fb31251e Author: Johan Hovold Date: Mon Dec 1 10:34:19 2025 +0100 ASoC: codecs: wcd939x: fix OF node leaks on probe failure The component match entry release function will drop the references taken while looking up the soundwire OF nodes when the platform device is unbound. Drop the additional references taken to avoid leaking them on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 10f514bd172a ("ASoC: codecs: Add WCD939x Codec driver") Cc: Neil Armstrong Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251201093419.24474-4-johan@kernel.org Signed-off-by: Mark Brown commit 32ae6ebe171aca9ce10f5790523a9865b6c08b02 Author: Johan Hovold Date: Mon Dec 1 10:34:18 2025 +0100 ASoC: codecs: wcd938x: fix OF node leaks on probe failure The component match entry release function will drop the references taken while looking up the soundwire OF nodes when the platform device is unbound. Drop the additional references taken to avoid leaking them on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 8d78602aa87a ("ASoC: codecs: wcd938x: add basic driver") Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251201093419.24474-3-johan@kernel.org Signed-off-by: Mark Brown commit 22a03ca7c20c4ed3a75047709b0ad15160e29d58 Author: Johan Hovold Date: Mon Dec 1 10:34:17 2025 +0100 ASoC: codecs: wcd937x: fix OF node leaks on probe failure The component match entry release function will drop the references taken while looking up the soundwire OF nodes when the platform device is unbound. Drop the additional references taken to avoid leaking them on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 9be3ec196da4 ("ASoC: codecs: wcd937x: add wcd937x codec driver") Cc: Prasad Kumpatla Cc: Mohammad Rafi Shaik Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251201093419.24474-2-johan@kernel.org Signed-off-by: Mark Brown commit 108f9405ce81085284c7ab09b84784b94b611435 Author: Xiang Mei Date: Thu Nov 27 17:14:16 2025 -0700 selftests/tc-testing: Test CAKE scheduler when enqueue drops packets Add tests that trigger packet drops in cake_enqueue(): "CAKE with QFQ Parent - CAKE enqueue with packets dropping". It forces CAKE_enqueue to return NET_XMIT_CN after dropping the packets when it has a QFQ parent. Signed-off-by: Xiang Mei Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20251128001415.377823-3-xmei5@asu.edu Signed-off-by: Paolo Abeni commit 9fefc78f7f02d71810776fdeb119a05a946a27cc Author: Xiang Mei Date: Thu Nov 27 17:14:14 2025 -0700 net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes that the parent qdisc will enqueue the current packet. However, this assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent qdisc stops enqueuing current packet, leaving the tree qlen/backlog accounting inconsistent. This mismatch can lead to a NULL dereference (e.g., when the parent Qdisc is qfq_qdisc). This patch computes the qlen/backlog delta in a more robust way by observing the difference before and after the series of cake_drop() calls, and then compensates the qdisc tree accounting if cake_enqueue() returns NET_XMIT_CN. To ensure correct compensation when ACK thinning is enabled, a new variable is introduced to keep qlen unchanged. Fixes: 15de71d06a40 ("net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit") Signed-off-by: Xiang Mei Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20251128001415.377823-1-xmei5@asu.edu Signed-off-by: Paolo Abeni commit fedadc4137234c3d00c4785eeed3e747fe9036ae Author: Sebastian Andrzej Siewior Date: Tue Nov 11 16:54:37 2025 +0100 ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels gup_pgd_range() is invoked with disabled interrupts and invokes __kmap_local_page_prot() via pte_offset_map(), gup_p4d_range(). With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get() which uses a spinlock_t via lock_kmap_any(). This leads to an sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a sleeping lock and must not be acquired in atomic context. The loop in map_new_virtual() uses wait_queue_head_t for wake up which also is using a spinlock_t. Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT to allow the use of get_user_pages_fast(). [arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP] Co-developed-by: Arnd Bergmann Acked-by: Linus Walleij Reviewed-by: Arnd Bergmann Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit 256d97d3587b441630c345ab3d773a9e7dcd964b Author: Thomas Gleixner Date: Tue Nov 11 16:54:36 2025 +0100 ARM: 9459/1: Disable jump-label on PREEMPT_RT jump-labels are used to efficiently switch between two possible code paths. To achieve this, stop_machine() is used to keep the CPU in a known state while the opcode is modified. The usage of stop_machine() here leads to large latency spikes which can be observed on PREEMPT_RT. Jump labels may change the target during runtime and are not restricted to debug or "configuration/ setup" part of a PREEMPT_RT system where high latencies could be defined as acceptable. On 64-bit Arm, it is possible to use jump labels without the stop_machine() call, which architecturally provides a way to atomically change one 32-bit instruction word while keeping maintaining consistency, but this is not generally the case on 32-bit, in particular in thumb2 mode. Disable jump-label support on a PREEMPT_RT system when SMP is enabled. [bigeasy: Patch description.] [arnd: add !SMP case, extend changelog] Signed-off-by: Thomas Gleixner Cc: Mark Rutland Cc: Ard Biesheuvel Signed-off-by: Arnd Bergmann Reviewed-by: Linus Walleij Acked-by: Ard Biesheuvel Acked-by: Linus Walleij Reviewed-by: Arnd Bergmann Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Russell King (Oracle) commit 716311dad200edf01a3776b62466571dfd217106 Author: Vinod Koul Date: Mon Dec 1 14:16:50 2025 +0530 MAINTAINERS: phy: Add Neil Armstrong as reviewers for phy subsystem Acked-by: Neil Armstrong Link: https://patch.msgid.link/20251201084652.422057-1-vkoul@kernel.org Signed-off-by: Vinod Koul commit 9b36c7fc5aa5f2c6e6eeb9f312fdfe61b4291c9f Author: Thomas Zimmermann Date: Mon Oct 27 15:05:41 2025 +0100 macintosh/via-pmu-backlight: Include and Include and to avoid dependency on backlight header to include them. Declares of_machine_is_compatible() and defines FB_BACKLIGHT_MAX. Signed-off-by: Thomas Zimmermann Fixes: 243ce64b2b37 ("backlight: Do not include in header file") Reported-by: Naresh Kamboju Reviewed-by: Daniel Thompson (RISCstar) Closes: https://lore.kernel.org/linuxppc-dev/CA+G9fYs8fn5URQx2+s2oNxdUgZkSrdLC0P1tNBW_n-6BaBkK2Q@mail.gmail.com/ Signed-off-by: Michael Ellerman commit 8d398324967a6e380e92a82e28581ac1e1c2982f Author: Thomas Zimmermann Date: Mon Oct 27 15:05:40 2025 +0100 powerpc/powermac: backlight: Include Include to avoid dependency on backlight header to include it. Declares of_find_node_by_name(), of_property_match_string() and of_node_put(). Signed-off-by: Thomas Zimmermann Fixes: 243ce64b2b37 ("backlight: Do not include in header file") Reported-by: Naresh Kamboju Reviewed-by: Daniel Thompson (RISCstar) Closes: https://lore.kernel.org/linuxppc-dev/CA+G9fYs8fn5URQx2+s2oNxdUgZkSrdLC0P1tNBW_n-6BaBkK2Q@mail.gmail.com/ Signed-off-by: Michael Ellerman commit 24bc5ea5c01a7695a1308ac24435810855ec71c9 Author: Ingo Molnar Date: Tue Dec 2 10:05:10 2025 +0100 seqlock, procfs: Match scoped_seqlock_read() critical section vs. RCU ordering in do_task_stat() to do_io_accounting() There's two patterns of taking the RCU read-lock and the sig->stats_lock read-seqlock in do_task_stat() and do_io_accounting(), with a different ordering: # do_io_accounting(): guard(rcu)(); scoped_seqlock_read (&sig->stats_lock, ss_lock_irqsave) { # do_task_stat(): scoped_seqlock_read (&sig->stats_lock, ss_lock_irqsave) { ... rcu_read_lock(); The ordering is RCU-read+seqlock_read in the first case, seqlock_read+RCU-read in the second case. While technically these read locks can be taken in any order, nevertheless it's good practice to use the more intrusive lock on the inside (which is the IRQs-off section in this case), and reduces head-scratching during review when done consistently, so let's use the do_io_accounting() pattern in do_task_stat(). This will also reduce irqs-off latencies in do_task_stat() a tiny bit. Signed-off-by: Ingo Molnar Acked-by: Oleg Nesterov Cc: Peter Zijlstra Cc: Linus Torvalds Cc: Thomas Gleixner Cc: Christian Brauner Cc: Al Viro Link: https://patch.msgid.link/aS6rwnaPbHFCdHp1@gmail.com commit 2e983271363108b3813b38754eb96d9b1cb252bb Author: Niklas Cassel Date: Mon Dec 1 13:35:04 2025 +0100 ata: libata-core: Quirk DELLBOSS VD max_sectors Commit 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") increased the default max_sectors_kb from 1280 KiB to 4096 KiB. DELLBOSS VD with FW rev MV.R00-0 times out when sending I/Os of size 4096 KiB. Enable ATA_QUIRK_MAX_SEC, with value 8191 (sectors) for this device, since any I/O with more sectors than that lead to I/O timeouts. With this, the DELLBOSS VD SATA controller is usable again. Cc: stable+noautosel@kernel.org # depends on Move quirk flags to their own enum Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit a42b71d49945aac0b943987cbdec1d1c805caab3 Author: Niklas Cassel Date: Mon Dec 1 13:35:03 2025 +0100 ata: libata: Move quirk flags to their own enum The anonymous enum in include/linux/libata.h that is used to store various global constants can currently be backed by type int. (It contains both negative and positive constants.) __ATA_QUIRK_MAX is currently 31. The quirk flags in the various global constants enum are defined as "1U << quirk_flag_bit". Thus if we simply add an additional quirk, the quirk flag will be 1 << 31, which is a value that is too large to be represented by a signed int. The various global constants enum will thus therefore be backed by type long. This will lead to error prints like e.g.: ata_port_err(ap, "EH pending after %d tries, giving up\n", ATA_EH_MAX_TRIES); now failing to build, with build error: error: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘long int’ [-Werror=format=] This is because all constants in the various global constants enum now has to be printed as a long, as that is now the backing type of the enum. Since the compiler will use the smallest possible backing type for an enum, it is good practice to not mix unrelated things in a single enum. Move the quirk flags to a separate enum, so that we don't need to change the printf specifier for all other constants in the "various global constants" enum when adding an additional quirk. Reviewed-by: Damien Le Moal Reviewed-by: Martin K. Petersen Signed-off-by: Niklas Cassel commit d3666c1f8a31b7ff6805effcfedfac22454c6517 Author: Aaron Thompson Date: Tue Dec 2 07:12:40 2025 +0000 debugfs: Fix default access mode config check This typo caused debugfs to always behave as if CONFIG_DEBUG_FS_ALLOW_NONE was selected. Fixes: f278809475f6 ("debugfs: Remove broken no-mount mode") Reported-by: Mark Brown Tested-by: Chen-Yu Tsai Signed-off-by: Aaron Thompson Link: https://patch.msgid.link/20251202070927.14198-1-dev@null.aaront.org Signed-off-by: Greg Kroah-Hartman commit b3239df349c2c2c94686674489c9629c89ca49a1 Merge: 62433efe0b0604 db2bad93fe206c Author: Dave Airlie Date: Tue Dec 2 18:09:01 2025 +1000 Merge tag 'drm-misc-next-2025-12-01-1' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Extra drm-misc-next for v6.19-rc1: UAPI Changes: - Add support for drm colorop pipeline. - Add COLOR PIPELINE plane property. - Add DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE. Cross-subsystem Changes: - Attempt to use higher order mappings in system heap allocator. - Always taint kernel with sw-sync. Core Changes: - Small fixes to drm/gem. - Support emergency restore to drm-client. - Allocate and release fb_info in single place. - Rework ttm pipelined eviction fence handling. Driver Changes: - Support the drm color pipeline in vkms, amdgfx. - Add NVJPG driver for tegra. - Assorted small fixes and updates to rockchip, bridge/dw-hdmi-qp, panthor. - Add ASL CS5263 DP-to-HDMI simple bridge. - Add and improve support for G LD070WX3-SL01 MIPI DSI, Samsung LTL106AL0, Samsung LTL106AL01, Raystar RFF500F-AWH-DNN, Winstar WF70A8SYJHLNGA, Wanchanglong w552946aaa, Samsung SOFEF00, Lenovo X13s panel. - Add support for it66122 to it66121. - Support mali-G1 gpu in panthor. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/aa5cbd50-7676-4a59-bbed-e8428af86804@linux.intel.com commit cf5425e207351c962990da6a69aebec5948cc1f3 Author: Takashi Iwai Date: Tue Dec 2 08:08:27 2025 +0100 ALSA: usb-audio: Simplify with usb_endpoint_max_periodic_payload() Recently we received a new helper function, usb_endpoint_max_periodic_payload(), for calculating the max packet size for periodic transfer. Simplify the former open code with the new helper function. Fixes: a748e1dbb2df ("ALSA: usb-audio: Fix max bytes-per-interval calculation") Suggested-by: Michal Pecio Link: https://lore.kernel.org/20251124210518.90054-1-dylan_robinson@motu.com Link: https://patch.msgid.link/20251202070828.145656-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a30fa812222278ba8484f1817ea772960e3038c3 Author: Chris Chiu Date: Tue Dec 2 04:25:34 2025 +0000 ALSA: hda/realtek: fix mute/micmute LEDs don't work for more HP laptops More HP laptops with codec ALC3247 need the extra coefbit2 to make mic-mute/audio-mute working. Signed-off-by: Chris Chiu Link: https://patch.msgid.link/20251202042534.174755-1-chris.chiu@canonical.com Signed-off-by: Takashi Iwai commit b30f635bb6492f02f2f704b46d898679371015cb Author: Nam Cao Date: Mon Nov 17 09:06:03 2025 +0000 rv: Convert to use __free Convert to use __free to tidy up the code. Signed-off-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/62854e2fcb8f8dd2180a98a9700702dcf89a6980.1763370183.git.namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 8db3790c4d57946aaf446704dfd020a39513e213 Author: Nam Cao Date: Mon Nov 17 09:06:02 2025 +0000 rv: Convert to use lock guard Convert to use lock guard to tidy up the code. Signed-off-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/dbefeb868093c40d4b29fd6b57294a6aa011b719.1763370183.git.namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 9747b22a417d2a7c478678143863b9777de104e4 Merge: ef5e0a02d842b2 c5fae31f60a91d Author: Takashi Iwai Date: Tue Dec 2 07:12:56 2025 +0100 Merge tag 'asoc-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v6.19 This is a very large set of updates, as well as some more extensive cleanup work from Morimto-san we've also added a generic SCDA class driver for SoundWire devices enabling us to support many chips with no custom code. There's also a batch of new drivers added for both SoCs and CODECs. - Added a SoundWire SCDA generic class driver, pulling in a little regmap work to support it. - A *lot* of cleaup and API improvement work from Morimoto-san. - Lots of work on the existing Cirrus, Intel, Maxim and Qualcomm drivers. - Support for Allwinner A523, Mediatek MT8189, Qualcomm QCM2290, QRB2210 and SM6115, SpacemiT K1, and TI TAS2568, TAS5802, TAS5806, TAS5815, TAS5828 and TAS5830. This also pulls in some gpiolib changes supporting shared GPIOs in the core there so we can convert some of the ASoC drivers open coding handling of that to the core functionality. commit 4a26e7032d7d57c998598c08a034872d6f0d3945 Merge: dcd8637edb873b b0a848f4a47a91 Author: Linus Torvalds Date: Mon Dec 1 21:33:01 2025 -0800 Merge tag 'core-bugs-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull bug handling infrastructure updates from Ingo Molnar: "Core updates: - Improve WARN(), which has vararg printf like arguments, to work with the x86 #UD based WARN-optimizing infrastructure by hiding the format in the bug_table and replacing this first argument with the address of the bug-table entry, while making the actual function that's called a UD1 instruction (Peter Zijlstra) - Introduce the CONFIG_DEBUG_BUGVERBOSE_DETAILED Kconfig switch (Ingo Molnar, s390 support by Heiko Carstens) Fixes and cleanups: - bugs/s390: Remove private WARN_ON() implementation (Heiko Carstens) - : Make i386 use GENERIC_BUG_RELATIVE_POINTERS (Peter Zijlstra)" * tag 'core-bugs-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) x86/bugs: Make i386 use GENERIC_BUG_RELATIVE_POINTERS x86/bug: Fix BUG_FORMAT vs KASLR x86_64/bug: Inline the UD1 x86/bug: Implement WARN_ONCE() x86_64/bug: Implement __WARN_printf() x86/bug: Use BUG_FORMAT for DEBUG_BUGVERBOSE_DETAILED x86/bug: Add BUG_FORMAT basics bug: Allow architectures to provide __WARN_printf() bug: Implement WARN_ON() using __WARN_FLAGS() bug: Add report_bug_entry() bug: Add BUG_FORMAT_ARGS infrastructure bug: Clean up CONFIG_GENERIC_BUG_RELATIVE_POINTERS bug: Add BUG_FORMAT infrastructure x86: Rework __bug_table helpers bugs/s390: Remove private WARN_ON() implementation bugs/core: Reorganize fields in the first line of WARNING output, add ->comm[] output bugs/sh: Concatenate 'cond_str' with '__FILE__' in __WARN_FLAGS(), to extend WARN_ON/BUG_ON output bugs/parisc: Concatenate 'cond_str' with '__FILE__' in __WARN_FLAGS(), to extend WARN_ON/BUG_ON output bugs/riscv: Concatenate 'cond_str' with '__FILE__' in __BUG_FLAGS(), to extend WARN_ON/BUG_ON output bugs/riscv: Pass in 'cond_str' to __BUG_FLAGS() ... commit dcd8637edb873bd940e6aa82417dfb33ae980778 Merge: e7d81c1ed665e7 ced37e9ceae50e Author: Linus Torvalds Date: Mon Dec 1 21:31:02 2025 -0800 Merge tag 'x86-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core x86 updates from Ingo Molnar: - x86/alternatives: Drop unnecessary test after call to alt_replace_call() (Juergen Gross) - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() (Tengda Wu) * tag 'x86-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() x86/alternative: Drop not needed test after call of alt_replace_call() commit e7d81c1ed665e72c55ae5cf2d7601c09842b4013 Merge: de2f75d55ef858 780813d7018067 Author: Linus Torvalds Date: Mon Dec 1 21:28:23 2025 -0800 Merge tag 'x86-build-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 math-emu fix from Ingo Molnar: "A single fix for an ancient prototype in the math-emu code, by Arnd Bergmann" * tag 'x86-build-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/math-emu: Fix div_Xsig() prototype commit de2f75d55ef85861ffc81c7583e0715453eb7235 Merge: 6d2c10e889db59 ed4f9638d905a9 Author: Linus Torvalds Date: Mon Dec 1 21:26:35 2025 -0800 Merge tag 'x86-apic-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 apic updates from Ingo Molnar: - x86/apic: Fix the frequency in apic=verbose log output (Julian Stecklina) - Simplify mp_irqdomain_alloc() slightly (Christophe JAILLET) * tag 'x86-apic-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Fix frequency in apic=verbose log output x86/ioapic: Simplify mp_irqdomain_alloc() slightly commit 6d2c10e889db596938bb7b4d3cdd42d67208439a Merge: 6c26fbe8c9d3e9 c04507ac500e2c Author: Linus Torvalds Date: Mon Dec 1 21:04:45 2025 -0800 Merge tag 'sched-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Scalability and load-balancing improvements: - Enable scheduler feature NEXT_BUDDY (Mel Gorman) - Reimplement NEXT_BUDDY to align with EEVDF goals (Mel Gorman) - Skip sched_balance_running cmpxchg when balance is not due (Tim Chen) - Implement generic code for architecture specific sched domain NUMA distances (Tim Chen) - Optimize the NUMA distances of the sched-domains builds of Intel Granite Rapids (GNR) and Clearwater Forest (CWF) platforms (Tim Chen) - Implement proportional newidle balance: a randomized algorithm that runs newidle balancing proportional to its success rate. (Peter Zijlstra) Scheduler infrastructure changes: - Implement the 'sched_change' scoped_guard() pattern for the entire scheduler (Peter Zijlstra) - More broadly utilize the sched_change guard (Peter Zijlstra) - Add support to pick functions to take runqueue-flags (Joel Fernandes) - Provide and use set_need_resched_current() (Peter Zijlstra) Fair scheduling enhancements: - Forfeit vruntime on yield (Fernand Sieber) - Only update stats for allowed CPUs when looking for dst group (Adam Li) CPU-core scheduling enhancements: - Optimize core cookie matching check (Fernand Sieber) Deadline scheduler fixes: - Only set free_cpus for online runqueues (Doug Berger) - Fix dl_server time accounting (Peter Zijlstra) - Fix dl_server stop condition (Peter Zijlstra) Proxy scheduling fixes: - Yield the donor task (Fernand Sieber) Fixes and cleanups: - Fix do_set_cpus_allowed() locking (Peter Zijlstra) - Fix migrate_disable_switch() locking (Peter Zijlstra) - Remove double update_rq_clock() in __set_cpus_allowed_ptr_locked() (Hao Jia) - Increase sched_tick_remote timeout (Phil Auld) - sched/deadline: Use cpumask_weight_and() in dl_bw_cpus() (Shrikanth Hegde) - sched/deadline: Clean up select_task_rq_dl() (Shrikanth Hegde)" * tag 'sched-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits) sched: Provide and use set_need_resched_current() sched/fair: Proportional newidle balance sched/fair: Small cleanup to update_newidle_cost() sched/fair: Small cleanup to sched_balance_newidle() sched/fair: Revert max_newidle_lb_cost bump sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals sched/fair: Enable scheduler feature NEXT_BUDDY sched: Increase sched_tick_remote timeout sched/fair: Have SD_SERIALIZE affect newidle balancing sched/fair: Skip sched_balance_running cmpxchg when balance is not due sched/deadline: Minor cleanup in select_task_rq_dl() sched/deadline: Use cpumask_weight_and() in dl_bw_cpus sched/deadline: Document dl_server sched/deadline: Fix dl_server stop condition sched/deadline: Fix dl_server time accounting sched/core: Remove double update_rq_clock() in __set_cpus_allowed_ptr_locked() sched/eevdf: Fix min_vruntime vs avg_vruntime sched/core: Add comment explaining force-idle vruntime snapshots sched/core: Optimize core cookie matching check sched/proxy: Yield the donor task ... commit 6c26fbe8c9d3e932dce6afe2505b19b4b261cae9 Merge: 63e6995005be8c 9929dffce5ed7e Author: Linus Torvalds Date: Mon Dec 1 20:42:01 2025 -0800 Merge tag 'perf-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull performance events updates from Ingo Molnar: "Callchain support: - Add support for deferred user-space stack unwinding for perf, enabled on x86. (Peter Zijlstra, Steven Rostedt) - unwind_user/x86: Enable frame pointer unwinding on x86 (Josh Poimboeuf) x86 PMU support and infrastructure: - x86/insn: Simplify for_each_insn_prefix() (Peter Zijlstra) - x86/insn,uprobes,alternative: Unify insn_is_nop() (Peter Zijlstra) Intel PMU driver: - Large series to prepare for and implement architectural PEBS support for Intel platforms such as Clearwater Forest (CWF) and Panther Lake (PTL). (Dapeng Mi, Kan Liang) - Check dynamic constraints (Kan Liang) - Optimize PEBS extended config (Peter Zijlstra) - cstates: - Remove PC3 support from LunarLake (Zhang Rui) - Add Pantherlake support (Zhang Rui) - Clearwater Forest support (Zide Chen) AMD PMU driver: - x86/amd: Check event before enable to avoid GPF (George Kennedy) Fixes and cleanups: - task_work: Fix NMI race condition (Peter Zijlstra) - perf/x86: Fix NULL event access and potential PEBS record loss (Dapeng Mi) - Misc other fixes and cleanups (Dapeng Mi, Ingo Molnar, Peter Zijlstra)" * tag 'perf-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (38 commits) perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use perf/x86/intel: Optimize PEBS extended config perf/x86/intel: Check PEBS dyn_constraints perf/x86/intel: Add a check for dynamic constraints perf/x86/intel: Add counter group support for arch-PEBS perf/x86/intel: Setup PEBS data configuration and enable legacy groups perf/x86/intel: Update dyn_constraint base on PEBS event precise level perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR perf/x86/intel: Process arch-PEBS records or record fragments perf/x86/intel/ds: Factor out PEBS group processing code to functions perf/x86/intel/ds: Factor out PEBS record processing code to functions perf/x86/intel: Initialize architectural PEBS perf/x86/intel: Correct large PEBS flag check perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call perf/x86: Fix NULL event access and potential PEBS record loss perf/x86: Remove redundant is_x86_event() prototype entry,unwind/deferred: Fix unwind_reset_info() placement unwind_user/x86: Fix arch=um build perf: Support deferred user unwind unwind_user/x86: Teach FP unwind about start of function ... commit 31a3ed492dd41908b60b57d82f0ba878eae685fd Merge: cbc19b3229f1d5 3fd2f3d2f4259d Author: Jakub Kicinski Date: Mon Dec 1 20:33:06 2025 -0800 Merge tag 'wireguard-6.19-rc1-for-jakub' of https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/wireguard-linux Jason A. Donenfeld says: ==================== WireGuard updates for Linux 6.19-rc1. Please find here Asbjørn's ynl series. This has been sitting in my testing for the last week or so, since he sent out the latest series. I've dropped the yml sample code, as he found an issue in that last minute, but otherwise, we've sat on this code for long enough, so let's see how it goes. * tag 'wireguard-6.19-rc1-for-jakub' of https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/wireguard-linux: wireguard: netlink: generate netlink code wireguard: uapi: generate header with ynl-gen wireguard: uapi: move flag enums wireguard: uapi: move enum wg_cmd wireguard: netlink: add YNL specification wireguard: netlink: lower .maxattr for WG_CMD_GET_DEVICE wireguard: netlink: convert to split ops wireguard: netlink: use WG_KEY_LEN in policies wireguard: netlink: validate nested arrays in policy wireguard: netlink: enable strict genetlink validation ==================== Link: https://patch.msgid.link/ Signed-off-by: Jakub Kicinski commit 63e6995005be8ceb8a1d56a18df1a1a40c28356d Merge: b53440f8e5a146 6ec33db1aaf06a Author: Linus Torvalds Date: Mon Dec 1 20:18:59 2025 -0800 Merge tag 'objtool-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - klp-build livepatch module generation (Josh Poimboeuf) Introduce new objtool features and a klp-build script to generate livepatch modules using a source .patch as input. This builds on concepts from the longstanding out-of-tree kpatch project which began in 2012 and has been used for many years to generate livepatch modules for production kernels. However, this is a complete rewrite which incorporates hard-earned lessons from 12+ years of maintaining kpatch. Key improvements compared to kpatch-build: - Integrated with objtool: Leverages objtool's existing control-flow graph analysis to help detect changed functions. - Works on vmlinux.o: Supports late-linked objects, making it compatible with LTO, IBT, and similar. - Simplified code base: ~3k fewer lines of code. - Upstream: No more out-of-tree #ifdef hacks, far less cruft. - Cleaner internals: Vastly simplified logic for symbol/section/reloc inclusion and special section extraction. - Robust __LINE__ macro handling: Avoids false positive binary diffs caused by the __LINE__ macro by introducing a fix-patch-lines script which injects #line directives into the source .patch to preserve the original line numbers at compile time. - Disassemble code with libopcodes instead of running objdump (Alexandre Chartre) - Disassemble support (-d option to objtool) by Alexandre Chartre, which supports the decoding of various Linux kernel code generation specials such as alternatives: 17ef: sched_balance_find_dst_group+0x62f mov 0x34(%r9),%edx 17f3: sched_balance_find_dst_group+0x633 | | X86_FEATURE_POPCNT 17f3: sched_balance_find_dst_group+0x633 | call 0x17f8 <__sw_hweight64> | popcnt %rdi,%rax 17f8: sched_balance_find_dst_group+0x638 cmp %eax,%edx ... jump table alternatives: 1895: sched_use_asym_prio+0x5 test $0x8,%ch 1898: sched_use_asym_prio+0x8 je 0x18a9 189a: sched_use_asym_prio+0xa | | JUMP 189a: sched_use_asym_prio+0xa | jmp 0x18ae | nop2 189c: sched_use_asym_prio+0xc mov $0x1,%eax 18a1: sched_use_asym_prio+0x11 and $0x80,%ecx ... exception table alternatives: native_read_msr: 5b80: native_read_msr+0x0 mov %edi,%ecx 5b82: native_read_msr+0x2 | | EXCEPTION 5b82: native_read_msr+0x2 | rdmsr | resume at 0x5b84 5b84: native_read_msr+0x4 shl $0x20,%rdx .... x86 feature flag decoding (also see the X86_FEATURE_POPCNT example in sched_balance_find_dst_group() above): 2faaf: start_thread_common.constprop.0+0x1f jne 0x2fba4 2fab5: start_thread_common.constprop.0+0x25 | | X86_FEATURE_ALWAYS | X86_BUG_NULL_SEG 2fab5: start_thread_common.constprop.0+0x25 | jmp 0x2faba <.altinstr_aux+0x2f4> | jmp 0x4b0 | nop5 2faba: start_thread_common.constprop.0+0x2a mov $0x2b,%eax ... NOP sequence shortening: 1048e2: snapshot_write_finalize+0xc2 je 0x104917 1048e4: snapshot_write_finalize+0xc4 nop6 1048ea: snapshot_write_finalize+0xca nop11 1048f5: snapshot_write_finalize+0xd5 nop11 104900: snapshot_write_finalize+0xe0 mov %rax,%rcx 104903: snapshot_write_finalize+0xe3 mov 0x10(%rdx),%rax ... and much more. - Function validation tracing support (Alexandre Chartre) - Various -ffunction-sections fixes (Josh Poimboeuf) - Clang AutoFDO (Automated Feedback-Directed Optimizations) support (Josh Poimboeuf) - Misc fixes and cleanups (Borislav Petkov, Chen Ni, Dylan Hatch, Ingo Molnar, John Wang, Josh Poimboeuf, Pankaj Raghav, Peter Zijlstra, Thorsten Blum) * tag 'objtool-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (129 commits) objtool: Fix segfault on unknown alternatives objtool: Build with disassembly can fail when including bdf.h objtool: Trim trailing NOPs in alternative objtool: Add wide output for disassembly objtool: Compact output for alternatives with one instruction objtool: Improve naming of group alternatives objtool: Add Function to get the name of a CPU feature objtool: Provide access to feature and flags of group alternatives objtool: Fix address references in alternatives objtool: Disassemble jump table alternatives objtool: Disassemble exception table alternatives objtool: Print addresses with alternative instructions objtool: Disassemble group alternatives objtool: Print headers for alternatives objtool: Preserve alternatives order objtool: Add the --disas= action objtool: Do not validate IBT for .return_sites and .call_sites objtool: Improve tracing of alternative instructions objtool: Add functions to better name alternatives objtool: Identify the different types of alternatives ... commit b53440f8e5a1466870d7a1d255e0f9966e0041fb Merge: 1b5dd29869b1e6 43decb6b628eb0 Author: Linus Torvalds Date: Mon Dec 1 19:50:58 2025 -0800 Merge tag 'locking-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Mutexes: - Redo __mutex_init() to reduce generated code size (Sebastian Andrzej Siewior) Seqlocks: - Introduce scoped_seqlock_read() (Peter Zijlstra) - Change thread_group_cputime() to use scoped_seqlock_read() (Oleg Nesterov) - Change do_task_stat() to use scoped_seqlock_read() (Oleg Nesterov) - Change do_io_accounting() to use scoped_seqlock_read() (Oleg Nesterov) - Fix the incorrect documentation of read_seqbegin_or_lock() / need_seqretry() (Oleg Nesterov) - Allow KASAN to fail optimizing (Peter Zijlstra) Local lock updates: - Fix all kernel-doc warnings (Randy Dunlap) - Add the headers to MAINTAINERS (Sebastian Andrzej Siewior) - Reduce the risk of shadowing via s/l/__l/ and s/tl/__tl/ (Vincent Mailhol) Lock debugging: - spinlock/debug: Fix data-race in do_raw_write_lock (Alexander Sverdlin) Atomic primitives infrastructure: - atomic: Skip alignment check for try_cmpxchg() old arg (Arnd Bergmann) Rust runtime integration: - sync: atomic: Enable generated Atomic usage (Boqun Feng) - sync: atomic: Implement Debug for Atomic (Boqun Feng) - debugfs: Remove Rust native atomics and replace them with Linux versions (Boqun Feng) - debugfs: Implement Reader for Mutex only when T is Unpin (Boqun Feng) - lock: guard: Add T: Unpin bound to DerefMut (Daniel Almeida) - lock: Pin the inner data (Daniel Almeida) - lock: Add a Pin<&mut T> accessor (Daniel Almeida)" * tag 'locking-core-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/local_lock: Fix all kernel-doc warnings locking/local_lock: s/l/__l/ and s/tl/__tl/ to reduce the risk of shadowing locking/local_lock: Add the headers to MAINTAINERS locking/mutex: Redo __mutex_init() to reduce generated code size rust: debugfs: Replace the usage of Rust native atomics rust: sync: atomic: Implement Debug for Atomic rust: sync: atomic: Make Atomic*Ops pub(crate) seqlock: Allow KASAN to fail optimizing rust: debugfs: Implement Reader for Mutex only when T is Unpin seqlock: Change do_io_accounting() to use scoped_seqlock_read() seqlock: Change do_task_stat() to use scoped_seqlock_read() seqlock: Change thread_group_cputime() to use scoped_seqlock_read() seqlock: Introduce scoped_seqlock_read() documentation: seqlock: fix the wrong documentation of read_seqbegin_or_lock/need_seqretry atomic: Skip alignment check for try_cmpxchg() old arg rust: lock: Add a Pin<&mut T> accessor rust: lock: Pin the inner data rust: lock: guard: Add T: Unpin bound to DerefMut locking/spinlock/debug: Fix data-race in do_raw_write_lock commit 3fd2f3d2f4259df19eec3ea5a188d7c50a37e216 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:42 2025 +0000 wireguard: netlink: generate netlink code This patch adopts netlink policies and command definitions generated by ynl-gen, thus completing the conversion to YNL. Given that the old and new policies are functionally identical and have just been moved to a new file, it serves to verify that the policies generated from the spec are identical to the previous policy code. The following functions are renamed: wg_get_device_dump() -> wg_get_device_dumpit() wg_set_device() -> wg_set_device_doit() The new files are covered by the existing drivers/net/wireguard/ pattern in MAINTAINERS. No behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 88cedad45ba14097e06d2c9f6578688097a94691 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:40 2025 +0000 wireguard: uapi: generate header with ynl-gen Use ynl-gen to generate the UAPI header for WireGuard. The cosmetic changes in this patch confirms that the spec is aligned with the implementation. By using the generated version, it ensures that they stay in sync. Changes in the generated header: * Trivial header guard rename. * Trivial white space changes. * Trivial comment changes. * Precompute bitflags in ynl-gen (see [1]). * Drop __*_F_ALL constants (see [1]). [1] https://lore.kernel.org/r/20251014123201.6ecfd146@kernel.org/ No behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 8d974872ab29eeb93a5b0b698007257d8be07968 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:39 2025 +0000 wireguard: uapi: move flag enums Move the wg*_flag enums, so they are defined above the attribute set enums, where ynl-gen would place them. This is an incremental step towards adopting an UAPI header generated by ynl-gen. This is split out to keep the patches readable. This is a trivial patch with no behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit b5c5a82bf5cb96e14a6627ef21be962052a0c6d8 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:38 2025 +0000 wireguard: uapi: move enum wg_cmd This patch moves enum wg_cmd to the end of the file, where ynl-gen would generate it. This is an incremental step towards adopting an UAPI header generated by ynl-gen. This is split out to keep the patches readable. This is a trivial patch with no behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 6b0f4ca079dbe6ae4aa57e529d67c7dc00d63577 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:37 2025 +0000 wireguard: netlink: add YNL specification This patch adds a near[1] complete YNL specification for WireGuard, documenting the protocol in a machine-readable format, rather than comments in wireguard.h, and eases usage from C and non-C programming languages alike. The generated C library will be featured in a later patch, so in this patch I will use the in-kernel python client for examples. This makes the documentation in the UAPI header redundant, it is therefore removed. The in-line documentation in the spec is based on the existing comment in wireguard.h, and once released it will be available in the kernel documentation at: https://docs.kernel.org/netlink/specs/wireguard.html (until then run: make htmldocs) Generate wireguard.rst from this spec: $ make -C tools/net/ynl/generated/ wireguard.rst Query wireguard interface through pyynl: $ sudo ./tools/net/ynl/pyynl/cli.py --family wireguard \ --dump get-device \ --json '{"ifindex":3}' [{'fwmark': 0, 'ifindex': 3, 'ifname': 'wg-test', 'listen-port': 54318, 'peers': [{0: {'allowedips': [{0: {'cidr-mask': 0, 'family': 2, 'ipaddr': '0.0.0.0'}}, {0: {'cidr-mask': 0, 'family': 10, 'ipaddr': '::'}}], 'endpoint': b'[...]', 'last-handshake-time': {'nsec': 42, 'sec': 42}, 'persistent-keepalive-interval': 42, 'preshared-key': '[...]', 'protocol-version': 1, 'public-key': '[...]', 'rx-bytes': 42, 'tx-bytes': 42}}], 'private-key': '[...]', 'public-key': '[...]'}] Add another allowed IP prefix: $ sudo ./tools/net/ynl/pyynl/cli.py --family wireguard \ --do set-device --json '{"ifindex":3,"peers":[ {"public-key":"6a df b1 83 a4 ..","allowedips":[ {"cidr-mask":0,"family":10,"ipaddr":"::"}]}]}' [1] As can be seen above, the "endpoint" is only dumped as binary data, as it can't be fully described in YNL. It's either a struct sockaddr_in or struct sockaddr_in6 depending on the attribute length. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 1b5dd29869b1e63f7e5c37d7552e2dcf22de3c26 Merge: ffbf700df204dd 0512bf9701f339 Author: Linus Torvalds Date: Mon Dec 1 17:32:07 2025 -0800 Merge tag 'vfs-6.19-rc1.fd_prepare.fs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull fd prepare updates from Christian Brauner: "This adds the FD_ADD() and FD_PREPARE() primitive. They simplify the common pattern of get_unused_fd_flags() + create file + fd_install() that is used extensively throughout the kernel and currently requires cumbersome cleanup paths. FD_ADD() - For simple cases where a file is installed immediately: fd = FD_ADD(O_CLOEXEC, vfio_device_open_file(device)); if (fd < 0) vfio_device_put_registration(device); return fd; FD_PREPARE() - For cases requiring access to the fd or file, or additional work before publishing: FD_PREPARE(fdf, O_CLOEXEC, sync_file->file); if (fdf.err) { fput(sync_file->file); return fdf.err; } data.fence = fd_prepare_fd(fdf); if (copy_to_user((void __user *)arg, &data, sizeof(data))) return -EFAULT; return fd_publish(fdf); The primitives are centered around struct fd_prepare. FD_PREPARE() encapsulates all allocation and cleanup logic and must be followed by a call to fd_publish() which associates the fd with the file and installs it into the caller's fdtable. If fd_publish() isn't called, both are deallocated automatically. FD_ADD() is a shorthand that does fd_publish() immediately and never exposes the struct to the caller. I've implemented this in a way that it's compatible with the cleanup infrastructure while also being usable separately. IOW, it's centered around struct fd_prepare which is aliased to class_fd_prepare_t and so we can make use of all the basica guard infrastructure" * tag 'vfs-6.19-rc1.fd_prepare.fs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (42 commits) io_uring: convert io_create_mock_file() to FD_PREPARE() file: convert replace_fd() to FD_PREPARE() vfio: convert vfio_group_ioctl_get_device_fd() to FD_ADD() tty: convert ptm_open_peer() to FD_ADD() ntsync: convert ntsync_obj_get_fd() to FD_PREPARE() media: convert media_request_alloc() to FD_PREPARE() hv: convert mshv_ioctl_create_partition() to FD_ADD() gpio: convert linehandle_create() to FD_PREPARE() pseries: port papr_rtas_setup_file_interface() to FD_ADD() pseries: convert papr_platform_dump_create_handle() to FD_ADD() spufs: convert spufs_gang_open() to FD_PREPARE() papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() spufs: convert spufs_context_open() to FD_PREPARE() net/socket: convert __sys_accept4_file() to FD_ADD() net/socket: convert sock_map_fd() to FD_ADD() net/kcm: convert kcm_ioctl() to FD_PREPARE() net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() secretmem: convert memfd_secret() to FD_ADD() memfd: convert memfd_create() to FD_ADD() bpf: convert bpf_token_create() to FD_PREPARE() ... commit cbc19b3229f1d509b45816a5afd42cc34c03d284 Merge: 4a18b6cd7c5703 5cc1bddcfeb298 Author: Jakub Kicinski Date: Mon Dec 1 17:18:43 2025 -0800 Merge branch 'selftests-drv-net-fix-issues-in-devlink_rate_tc_bw-py' Carolina Jubran says: ==================== selftests: drv-net: Fix issues in devlink_rate_tc_bw.py This series fixes issues in the devlink_rate_tc_bw.py selftest and introduces a new Iperf3Runner that helps with measurement handling. ==================== Link: https://patch.msgid.link/20251130091938.4109055-1-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 5cc1bddcfeb298fe7e67952a50894de8afa46db5 Author: Carolina Jubran Date: Sun Nov 30 11:19:38 2025 +0200 selftests: drv-net: Fix tolerance calculation in devlink_rate_tc_bw.py Currently, tolerance is computed against the TC’s expected percentage, making TC3 (20%) validation overly strict and TC4 (80%) overly loose. Update BandwidthValidator to take a dict of shares and compute bounds relative to the overall total, so that all shares are validated consistently. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20251130091938.4109055-7-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 9ecd05a2c872d5eb2ae360d2907cf9375cf2ef5a Author: Carolina Jubran Date: Sun Nov 30 11:19:37 2025 +0200 selftests: drv-net: Fix and clarify TC bandwidth split in devlink_rate_tc_bw.py Correct the documented bandwidth distribution between TC3 and TC4 from 80/20 to 20/80. Update test descriptions and printed messages to consistently reflect the intended split. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20251130091938.4109055-6-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 3796e549e305194ac379c843f0eec5e013276fc3 Author: Carolina Jubran Date: Sun Nov 30 11:19:36 2025 +0200 selftests: drv-net: Set shell=True for sysfs writes in devlink_rate_tc_bw.py Commit 7c32f7a2d3db ("selftests: net: py: don't default to shell=True") changed the cmd() helper to avoid spawning a shell unless explicitly requested. The devlink_rate_tc_bw test enables SR-IOV by writing to the sriov_numvfs sysfs attribute using redirection. Without shell=True the redirection is not interpreted and the VF device never appears, causing the test to fail. Fix by explicitly passing shell=True in the two places that update sriov_numvfs. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20251130091938.4109055-5-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit cb1acbd30a42204b39e4846e1139b6fa9a40fafe Author: Carolina Jubran Date: Sun Nov 30 11:19:35 2025 +0200 selftests: drv-net: Use Iperf3Runner in devlink_rate_tc_bw.py Replace the inline iperf3 subprocess and JSON parsing with Iperf3Runner. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20251130091938.4109055-4-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 2a60ce94c6e871cbe761e6019d40bb8cabb8d15d Author: Carolina Jubran Date: Sun Nov 30 11:19:34 2025 +0200 selftests: drv-net: introduce Iperf3Runner for measurement use cases GenerateTraffic was added to spin up long-running iperf3 load, mainly to drive high PPS background traffic. It was never meant to provide stable throughput numbers, and trying to repurpose it for measurement does not make sense. Introduce Iperf3Runner to allow tests to split out server/client configuration, control start/stop, and collect JSON output for analysis. This makes it possible to measure bandwidth directly when validating egress shaping. GenerateTraffic stays as the background load generator, reusing the common iperf3 helpers under the hood. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20251130091938.4109055-3-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit a8658f7bb6504af125242bb4d4e49ca032eccf91 Author: Carolina Jubran Date: Sun Nov 30 11:19:33 2025 +0200 selftests: drv-net: Add devlink_rate_tc_bw.py to TEST_PROGS This makes devlink_rate_tc_bw.py present in the Makefile under the same directory. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Link: https://patch.msgid.link/20251130091938.4109055-2-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit 4a18b6cd7c5703219a8256956904c47c0e7beade Merge: d8e08149a5ed50 525459da4bd62a Author: Jakub Kicinski Date: Mon Dec 1 17:10:52 2025 -0800 Merge tag 'for-net-next-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - HCI: Add initial support for PAST - hci_core: Introduce HCI_CONN_FLAG_PAST - ISO: Add support to bind to trigger PAST - HCI: Always use the identity address when initializing a connection - ISO: Attempt to resolve broadcast address - MGMT: Allow use of Set Device Flags without Add Device - ISO: Fix not updating BIS sender source address - HCI: Add support for LL Extended Feature Set driver: - btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - btusb: MT7920: Add VID/PID 0489/e135 - btusb: MT7922: Add VID/PID 0489/e170 - btusb: Add new VID/PID 13d3/3533 for RTL8821CE - btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT - btusb: Add new VID/PID 0x13d3/0x3618 for RTL8852BE-VT - btusb: Add new VID/PID 0x13d3/0x3619 for RTL8852BE-VT - btusb: Reclassify Qualcomm WCN6855 debug packets - btintel_pcie: Introduce HCI Driver protocol - btintel_pcie: Support for S4 (Hibernate) - btintel_pcie: Suspend/Resume: Controller doorbell interrupt handling - dt-bindings: net: Convert Marvell 8897/8997 bindings to DT schema - btbcm: Use kmalloc_array() to prevent overflow - btrtl: Add the support for RTL8761CUV - hci_h5: avoid sending two SYNC messages - hci_h5: implement CRC data integrity MAINTAINERS: - Add Bartosz Golaszewski as Qualcomm hci_qca maintainer * tag 'for-net-next-2025-12-01' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (29 commits) Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE Bluetooth: HCI: Add support for LL Extended Feature Set drivers/bluetooth: btbcm: Use kmalloc_array() to prevent overflow Bluetooth: btintel_pcie: Introduce HCI Driver protocol Bluetooth: btusb: add new custom firmwares Bluetooth: btusb: Add new VID/PID 0x13d3/0x3619 for RTL8852BE-VT Bluetooth: btusb: Add new VID/PID 0x13d3/0x3618 for RTL8852BE-VT Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT Bluetooth: iso: fix socket matching ambiguity between BIS and CIS Bluetooth: MAINTAINERS: Add Bartosz Golaszewski as Qualcomm hci_qca maintainer Bluetooth: btrtl: Add the support for RTL8761CUV Bluetooth: Remove redundant pm_runtime_mark_last_busy() calls dt-bindings: net: Convert Marvell 8897/8997 bindings to DT schema Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV Bluetooth: btintel_pcie: Suspend/Resume: Controller doorbell interrupt handling Bluetooth: btintel_pcie: Support for S4 (Hibernate) Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 Bluetooth: ISO: Fix not updating BIS sender source address ... ==================== Link: https://patch.msgid.link/20251201213818.97249-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit d8e08149a5ed501d515dbe9f53cc46d25acb4a2a Author: Florian Fuchs Date: Sun Nov 30 20:41:55 2025 +0100 net: ps3_gelic_net: Use napi_alloc_skb() and napi_gro_receive() Use the napi functions napi_alloc_skb() and napi_gro_receive() instead of netdev_alloc_skb() and netif_receive_skb() for more efficient packet receiving. The switch to napi aware functions increases the RX throughput, reduces the occurrence of retransmissions and improves the resilience against SKB allocation failures. Signed-off-by: Florian Fuchs Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251130194155.1950980-1-fuchsfl@gmail.com Signed-off-by: Jakub Kicinski commit 3101f3e116452548f1a2da311328543207b10bf8 Merge: b4dcaeea5e9a9a 4e4c00f34d5dbb Author: Jakub Kicinski Date: Mon Dec 1 16:45:10 2025 -0800 Merge branch 'dsa-simple-hsr-offload' Vladimir Oltean says: ==================== DSA simple HSR offload Provide a "simple" form of HSR offload for 8 DSA drivers (just the NETIF_F_HW_HSR_DUP feature) based on the fact that their taggers use the dsa_xmit_port_mask() function. This is in patches 6-13/15. The helpers per se are introduced in patch 5/15, and documented in patch 15/15. Patch 14/15 is another small (and related) documentation update. For HSR interlink ports the offloading rules are not quite so clear, and for now we completely reject the offload. We can revise that once we see a full offload implementation and understand what is needed. To reject the offload, we need to know the port type, and patch 2/15 helps with that. xrs700x is another driver which should have rejected offload based on port type (patch 4/15). This is a bug fix submitted through net-next due to the extra API required to fix it. If necessary, it could also be picked up separately for backporting. There is also patch 3/15, which makes the HSR offload like the others supported by DSA: if we fall back to the software implementation, don't call port_hsr_leave(), because by definition there won't be anything to do. A slightly unrelated change is patch 1/15, but I noticed this along the way, and if I were to submit it separately, it would conflict with this work (it would appear in patch 12/15's context). Most of the driver additions are trivial. By far the most complex was ocelot (which I could test). Microchip ksz (which I cannot test, and did not patch) would also have some complexity. Essentially, ksz_hsr_join() could fall back to a partial offload through the simple helpers, if the full offload is not possible. But keeping track of which offload kind was used is necessary later in ksz_hsr_leave(). This is left as homework for interested developers. With this patch set, one can observe a 50% reduction in transmitted traffic over HSR interfaces. ==================== Link: https://patch.msgid.link/20251130131657.65080-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4e4c00f34d5dbbb2b7174fc419747f0b3fe7a4d5 Author: Vladimir Oltean Date: Sun Nov 30 15:16:57 2025 +0200 Documentation: net: dsa: mention simple HSR offload helpers Keep the documentation up to date. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-16-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 977839161f26862e77a2c9a46b4d7b0b00b20dad Author: Vladimir Oltean Date: Sun Nov 30 15:16:56 2025 +0200 Documentation: net: dsa: mention availability of RedBox Since commit 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)"), RedBox is available (including for offload in DSA). Update the DSA documentation that states it isn't. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-15-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7271d4a08c399104de663762806a9a521352a0d1 Author: Vladimir Oltean Date: Sun Nov 30 15:16:55 2025 +0200 net: dsa: a5psw: use simple HSR offload helpers The "a5psw" tagging protocol uses dsa_xmit_port_mask(), which means we can offload HSR packet duplication on transmit. Enable that feature. Cc: "Clément Léger" Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-14-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 585943b7ad3092257ce2d696af32e2c783a566b8 Author: Vladimir Oltean Date: Sun Nov 30 15:16:54 2025 +0200 net: dsa: mt7530: use simple HSR offload helpers The "mtk" tagging protocol uses dsa_xmit_port_mask(), which means we can offload HSR packet duplication on transmit. Enable that feature. Cc: Daniel Golle Cc: DENG Qingfang Cc: Sean Wang Signed-off-by: Vladimir Oltean Acked-by: Chester A. Unal Link: https://patch.msgid.link/20251130131657.65080-13-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 017bcff7321af438f1190dbdf417815ea8ef60c0 Author: Vladimir Oltean Date: Sun Nov 30 15:16:53 2025 +0200 net: dsa: hellcreek: use simple HSR offload helpers The "hellcreek" tagging protocol uses dsa_xmit_port_mask(), which means we can offload HSR packet duplication on transmit. Enable that feature. Cc: Kurt Kanzenbach Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-12-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4af9fa2ba65aa6bdad6f343b9e44704dce1ddf79 Author: Vladimir Oltean Date: Sun Nov 30 15:16:52 2025 +0200 net: dsa: mv88e6060: use simple HSR offload helpers The "trailer" tagging protocol uses dsa_xmit_port_mask(), which means we can offload HSR packet duplication on transmit. Enable that feature. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-11-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b6ad21ef286a00de103ef6d94292e4da649d6453 Author: Vladimir Oltean Date: Sun Nov 30 15:16:51 2025 +0200 net: dsa: lantiq_gswip: use simple HSR offload helpers Both the "gswip" and "gsw1xx" protocols use dsa_xmit_port_mask(), so they are compatible with accelerating TX packet duplication for HSR rings. Enable that feature by setting the port_hsr_join() and port_hsr_leave() operations to the simple helpers provided by DSA. Cc: Hauke Mehrtens Cc: Daniel Golle Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-10-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 6db31942e3470607be155d2c641c7a15da3c826c Author: Vladimir Oltean Date: Sun Nov 30 15:16:50 2025 +0200 net: dsa: realtek: use simple HSR offload helpers All known Realtek protocols: "rtl4a", "rtl8_4" and "rtl8_4t" use dsa_xmit_port_mask(), so they are compatible with accelerating TX packet duplication for HSR rings. Enable that feature by setting the port_hsr_join() and port_hsr_leave() operations to the simple helpers provided by DSA. Cc: "Alvin Šipraga" Signed-off-by: Vladimir Oltean Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20251130131657.65080-9-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4b65d445556d398b54fbeed8780ea9f07813f757 Author: Vladimir Oltean Date: Sun Nov 30 15:16:49 2025 +0200 net: dsa: ocelot: use simple HSR offload helpers Accelerate TX packet duplication with HSR rings. This is only possible with the NPI-based "ocelot" tagging protocol, not with "ocelot-8021q", because the latter does not use dsa_xmit_port_mask(). This has 2 implications: - Depending on tagging protocol, we should set (or not set) the offload feature flags. Switching tagging protocols is done with ports down, by design. Additional calls to dsa_port_simple_hsr_join() can be put in the ds->ops->change_tag_protocol() path, as I had originally tried, but this would not work: dsa_user_setup_tagger() would later clear the feature flag that we just set. So the additional call to dsa_port_simple_hsr_join() should sit in the ds->ops->port_enable() call. - When joining a HSR ring and we are currently using "ocelot-8021q", there are cases when we should return -EOPNOTSUPP (pessimistic) and cases when we shouldn't (optimistic). In the pessimistic case, it is a configuration that the port won't support even with the right tagging protocol. Distinguishing between these 2 cases matters because if we just return -EOPNOTSUPP regardless, we lose the dp->hsr_dev pointer and can no longer replay the offload later for the optimistic case, from felix_port_enable(). Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-8-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 42e63b1373a32bd136dc51325684727f3b9a4986 Author: Vladimir Oltean Date: Sun Nov 30 15:16:48 2025 +0200 net: dsa: yt921x: use simple HSR offloading helpers Accelerate TX packet duplication with HSR rings. Cc: David Yang Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-7-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0e75bfe340bf05d1586eaf02942438573bda69e3 Author: Vladimir Oltean Date: Sun Nov 30 15:16:47 2025 +0200 net: dsa: add simple HSR offload helpers It turns out that HSR offloads are so fine-grained that many DSA switches can do a small part even though they weren't specifically designed for the protocols supported by that driver (HSR and PRP). Specifically NETIF_F_HW_HSR_DUP - it is simple packet duplication on transmit, towards all (aka 2) ports members of the HSR device. For many DSA switches, we know how to duplicate a packet, even though we never typically use that feature. The transmit port mask from the tagging protocol can have multiple bits set, and the switch should send the packet once to every port with a bit set from that mask. Nonetheless, not all tagging protocols are like this, and sometimes the port is a single numeric value rather than a bit mask. For that reason, and also because switches can sometimes change tagging protocols for different ones, we need to make HSR offload helpers opt-in. For devices that can do nothing else HSR-specific, we introduce dsa_port_simple_hsr_join() and dsa_port_simple_hsr_leave(). These functions monitor when two user ports of the same switch are part of the same HSR device, and when that condition is true, they toggle the NETIF_F_HW_HSR_DUP feature flag of both net devices. Normally only dsa_port_simple_hsr_join() and dsa_port_simple_hsr_leave() are needed. The dsa_port_simple_hsr_validate() helper is just to see what kind of configuration could be offloadable using the generic helpers. This is used by switch drivers which are not currently using the right tagging protocol to offload this HSR ring, but could in principle offload it after changing the tagger. Suggested-by: David Yang Cc: "Alvin Šipraga" Cc: Chester A. Unal" Cc: "Clément Léger" Cc: Daniel Golle Cc: DENG Qingfang Cc: Florian Fainelli Cc: George McCollister Cc: Hauke Mehrtens Cc: Jonas Gorski Cc: Kurt Kanzenbach Cc: Linus Walleij Cc: Sean Wang Cc: UNGLinuxDriver@microchip.com Cc: Woojung Huh Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 30296ac7642652428396222e720718f2661e9425 Author: Vladimir Oltean Date: Sun Nov 30 15:16:46 2025 +0200 net: dsa: xrs700x: reject unsupported HSR configurations As discussed here: https://lore.kernel.org/netdev/20240620090210.drop6jwh7e5qw556@skbuf/ the fact is that the xrs700x.c driver only supports offloading HSR_PT_SLAVE_A and HSR_PT_SLAVE_B (which were the only port types at the time the offload was written, _for this driver_). Up until now, the API did not explicitly tell offloading drivers what port has what role. So xrs700x can get confused and think that it can support a configuration which it actually can't. There was a table in the attached link which gave an example: $ ip link add name hsr0 type hsr slave1 swp0 slave2 swp1 \ interlink swp2 supervision 45 version 1 HSR_PT_SLAVE_A HSR_PT_SLAVE_B HSR_PT_INTERLINK ---------------------------------------------------------------- user space 0 1 2 requests ---------------------------------------------------------------- XRS700X driver 1 2 - understands The switch would act as if the ring ports were swp1 and swp2. Now that we have explicit hsr_get_port_type() API, let's use that to work around the unintended semantical changes of the offloading API brought by the introduction of interlink ports in HSR. Fixes: 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)") Cc: Lukasz Majewski Signed-off-by: Vladimir Oltean Reviewed-by: George McCollister Link: https://patch.msgid.link/20251130131657.65080-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit bed59a86e91ad680331ecad4bf8717cbd4f5fc7f Author: Vladimir Oltean Date: Sun Nov 30 15:16:45 2025 +0200 net: dsa: avoid calling ds->ops->port_hsr_leave() when unoffloaded This mirrors what we do in dsa_port_lag_leave() and dsa_port_bridge_leave(): when ds->ops->port_hsr_join() returns -EOPNOTSUPP, we fall back to a software implementation where dp->hsr_dev is NULL, and the unoffloaded port is no longer bothered with calls from the HSR layer. This helps, for example, with interlink ports which current DSA drivers don't know how to offload. We have to check only in port_hsr_join() for the port type, then in port_hsr_leave() we are sure we're dealing only with known port types. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251130131657.65080-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit a0244e76213980f3b9bb5d40b0b6705fcf24230d Author: Xiaoliang Yang Date: Sun Nov 30 15:16:44 2025 +0200 net: hsr: create an API to get hsr port type Since the introduction of HSR_PT_INTERLINK in commit 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)"), we see that different port types require different settings for hardware offload, which was not the case before when we only had HSR_PT_SLAVE_A and HSR_PT_SLAVE_B. But there is currently no way to know which port is which type, so create the hsr_get_port_type() API function and export it. When hsr_get_port_type() is called from the device driver, the port can must be found in the HSR port list. An important use case is for this function to work from offloading drivers' NETDEV_CHANGEUPPER handler, which is triggered by hsr_portdev_setup() -> netdev_master_upper_dev_link(). Therefore, we need to move the addition of the hsr_port to the HSR port list prior to calling hsr_portdev_setup(). This makes the error restoration path also more similar to hsr_del_port(), where kfree_rcu(port) is already used. Cc: Sebastian Andrzej Siewior Cc: Lukasz Majewski Signed-off-by: Xiaoliang Yang Signed-off-by: Vladimir Oltean Reviewed-by: Łukasz Majewski Link: https://patch.msgid.link/20251130131657.65080-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 3b87e60d213150bc1f8475ec3c542f4c8cdd2e2c Author: Vladimir Oltean Date: Sun Nov 30 15:16:43 2025 +0200 net: dsa: mt7530: unexport mt7530_switch_ops Commit cb675afcddbb ("net: dsa: mt7530: introduce separate MDIO driver") exported mt7530_switch_ops for use from mt7530-mmio.c. Later in the patch set, mt7530-mmio.c used mt7530_probe_common() to access the mt7530_switch_ops still from mt7530.c - see commit 110c18bfed41 ("net: dsa: mt7530: introduce driver for MT7988 built-in switch"). This proves that exporting mt7530_switch_ops was unnecessary, so unexport it back. Cc: DENG Qingfang Cc: Sean Wang Signed-off-by: Vladimir Oltean Reviewed-by: Daniel Golle Acked-by: Daniel Golle Acked-by: Chester A. Unal Link: https://patch.msgid.link/20251130131657.65080-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ffbf700df204dd25a48a19979a126e37f5dd1e6a Merge: d0deeb803cd65c 922a6f34c1756d Author: Linus Torvalds Date: Mon Dec 1 16:38:21 2025 -0800 Merge tag 'vfs-6.19-rc1.autofs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull autofs update from Christian Brauner: "Prevent futile mount triggers in private mount namespaces. Fix a problematic loop in autofs when a mount namespace contains autofs mounts that are propagation private and there is no namespace-specific automount daemon to handle possible automounting. Previously, attempted path resolution would loop until MAXSYMLINKS was reached before failing, causing significant noise in the log. The fix adds a check in autofs ->d_automount() so that the VFS can immediately return EPERM in this case. Since the mount is propagation private, EPERM is the most appropriate error code" * tag 'vfs-6.19-rc1.autofs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: autofs: dont trigger mount if it cant succeed commit d0deeb803cd65c41c37ac106063c46c51d5d43ab Merge: a8058f8442df31 2579e21be53245 Author: Linus Torvalds Date: Mon Dec 1 16:31:21 2025 -0800 Merge tag 'vfs-6.19-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull overlayfs cred guard conversion from Christian Brauner: "This converts all of overlayfs to use credential guards, eliminating manual credential management throughout the filesystem. Credential guard conversion: - Convert all of overlayfs to use credential guards, replacing the manual ovl_override_creds()/ovl_revert_creds() pattern with scoped guards. This makes credential handling visually explicit and eliminates a class of potential bugs from mismatched override/revert calls. (1) Basic credential guard (with_ovl_creds) (2) Creator credential guard (ovl_override_creator_creds): Introduced a specialized guard for file creation operations that handles the two-phase credential override (mounter credentials, then fs{g,u}id override). The new pattern is much clearer: with_ovl_creds(dentry->d_sb) { scoped_class(prepare_creds_ovl, cred, dentry, inode, mode) { if (IS_ERR(cred)) return PTR_ERR(cred); /* creation operations */ } } (3) Copy-up credential guard (ovl_cu_creds): Introduced a specialized guard for copy-up operations, simplifying the previous struct ovl_cu_creds helper and associated functions. Ported ovl_copy_up_workdir() and ovl_copy_up_tmpfile() to this pattern. Cleanups: - Remove ovl_revert_creds() after all callers converted to guards - Remove struct ovl_cu_creds and associated functions - Drop ovl_setup_cred_for_create() after conversion - Refactor ovl_fill_super(), ovl_lookup(), ovl_iterate(), ovl_rename() for cleaner credential guard scope - Introduce struct ovl_renamedata to simplify rename handling - Don't override credentials for ovl_check_whiteouts() (unnecessary) - Remove unneeded semicolon" * tag 'vfs-6.19-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (54 commits) ovl: remove unneeded semicolon ovl: remove struct ovl_cu_creds and associated functions ovl: port ovl_copy_up_tmpfile() to cred guard ovl: mark *_cu_creds() as unused temporarily ovl: port ovl_copy_up_workdir() to cred guard ovl: add copy up credential guard ovl: drop ovl_setup_cred_for_create() ovl: port ovl_create_or_link() to new ovl_override_creator_creds cleanup guard ovl: mark ovl_setup_cred_for_create() as unused temporarily ovl: reflow ovl_create_or_link() ovl: port ovl_create_tmpfile() to new ovl_override_creator_creds cleanup guard ovl: add ovl_override_creator_creds cred guard ovl: remove ovl_revert_creds() ovl: port ovl_fill_super() to cred guard ovl: refactor ovl_fill_super() ovl: port ovl_lower_positive() to cred guard ovl: port ovl_lookup() to cred guard ovl: refactor ovl_lookup() ovl: port ovl_copyfile() to cred guard ovl: port ovl_rename() to cred guard ... commit a8058f8442df3150fa58154672f4a62a13e833e5 Merge: db74a7d02ae244 eeec741ee0df36 Author: Linus Torvalds Date: Mon Dec 1 16:13:46 2025 -0800 Merge tag 'vfs-6.19-rc1.directory.locking' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull directory locking updates from Christian Brauner: "This contains the work to add centralized APIs for directory locking operations. This series is part of a larger effort to change directory operation locking to allow multiple concurrent operations in a directory. The ultimate goal is to lock the target dentry(s) rather than the whole parent directory. To help with changing the locking protocol, this series centralizes locking and lookup in new helper functions. The helpers establish a pattern where it is the dentry that is being locked and unlocked (currently the lock is held on dentry->d_parent->d_inode, but that can change in the future). This also changes vfs_mkdir() to unlock the parent on failure, as well as dput()ing the dentry. This allows end_creating() to only require the target dentry (which may be IS_ERR() after vfs_mkdir()), not the parent" * tag 'vfs-6.19-rc1.directory.locking' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: nfsd: fix end_creating() conversion VFS: introduce end_creating_keep() VFS: change vfs_mkdir() to unlock on failure. ecryptfs: use new start_creating/start_removing APIs Add start_renaming_two_dentries() VFS/ovl/smb: introduce start_renaming_dentry() VFS/nfsd/ovl: introduce start_renaming() and end_renaming() VFS: add start_creating_killable() and start_removing_killable() VFS: introduce start_removing_dentry() smb/server: use end_removing_noperm for for target of smb2_create_link() VFS: introduce start_creating_noperm() and start_removing_noperm() VFS/nfsd/cachefiles/ovl: introduce start_removing() and end_removing() VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating() VFS: tidy up do_unlinkat() VFS: introduce start_dirop() and end_dirop() debugfs: rename end_creating() to debugfs_end_creating() commit db74a7d02ae244ec0552d18f51054f9ae0d921ad Merge: 4664fb427c8fd0 4be9e04ebf75a5 Author: Linus Torvalds Date: Mon Dec 1 15:34:41 2025 -0800 Merge tag 'vfs-6.19-rc1.directory.delegations' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull directory delegations update from Christian Brauner: "This contains the work for recall-only directory delegations for knfsd. Add support for simple, recallable-only directory delegations. This was decided at the fall NFS Bakeathon where the NFS client and server maintainers discussed how to merge directory delegation support. The approach starts with recallable-only delegations for several reasons: 1. RFC8881 has gaps that are being addressed in RFC8881bis. In particular, it requires directory position information for CB_NOTIFY callbacks, which is difficult to implement properly under Linux. The spec is being extended to allow that information to be omitted. 2. Client-side support for CB_NOTIFY still lags. The client side involves heuristics about when to request a delegation. 3. Early indication shows simple, recallable-only delegations can help performance. Anna Schumaker mentioned seeing a multi-minute speedup in xfstests runs with them enabled. With these changes, userspace can also request a read lease on a directory that will be recalled on conflicting accesses. This may be useful for applications like Samba. Users can disable leases altogether via the fs.leases-enable sysctl if needed. VFS changes: - Dedicated Type for Delegations Introduce struct delegated_inode to track inodes that may have delegations that need to be broken. This replaces the previous approach of passing raw inode pointers through the delegation breaking code paths, providing better type safety and clearer semantics for the delegation machinery. - Break parent directory delegations in open(..., O_CREAT) codepath - Allow mkdir to wait for delegation break on parent - Allow rmdir to wait for delegation break on parent - Add try_break_deleg calls for parents to vfs_link(), vfs_rename(), and vfs_unlink() - Make vfs_create(), vfs_mknod(), and vfs_symlink() break delegations on parent directory - Clean up argument list for vfs_create() - Expose delegation support to userland Filelock changes: - Make lease_alloc() take a flags argument - Rework the __break_lease API to use flags - Add struct delegated_inode - Push the S_ISREG check down to ->setlease handlers - Lift the ban on directory leases in generic_setlease NFSD changes: - Allow filecache to hold S_IFDIR files - Allow DELEGRETURN on directories - Wire up GET_DIR_DELEGATION handling Fixes: - Fix kernel-doc warnings in __fcntl_getlease - Add needed headers for new struct delegation definition" * tag 'vfs-6.19-rc1.directory.delegations' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: vfs: add needed headers for new struct delegation definition filelock: __fcntl_getlease: fix kernel-doc warnings vfs: expose delegation support to userland nfsd: wire up GET_DIR_DELEGATION handling nfsd: allow DELEGRETURN on directories nfsd: allow filecache to hold S_IFDIR files filelock: lift the ban on directory leases in generic_setlease vfs: make vfs_symlink break delegations on parent dir vfs: make vfs_mknod break delegations on parent directory vfs: make vfs_create break delegations on parent directory vfs: clean up argument list for vfs_create() vfs: break parent dir delegations in open(..., O_CREAT) codepath vfs: allow rmdir to wait for delegation break on parent vfs: allow mkdir to wait for delegation break on parent vfs: add try_break_deleg calls for parents to vfs_{link,rename,unlink} filelock: push the S_ISREG check down to ->setlease handlers filelock: add struct delegated_inode filelock: rework the __break_lease API to use flags filelock: make lease_alloc() take a flags argument commit 4664fb427c8fd0080f40109f5e2b2090a6fb0c84 Merge: 978d337c2ed6e5 0d534518ce8731 Author: Linus Torvalds Date: Mon Dec 1 15:22:40 2025 -0800 Merge tag 'vfs-6.19-rc1.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull minix fixes from Christian Brauner: "Fix two syzbot corruption bugs in the minix filesystem. Syzbot fuzzes filesystems by trying to mount and manipulate deliberately corrupted images. This should not lead to BUG_ONs and WARN_ONs for easy to detect corruptions. - Add error handling to minix filesystem for inode corruption detection, enabling the filesystem to report such corruptions cleanly. - Fix a drop_nlink warning in minix_rmdir() triggered by corrupted directory link counts. - Fix a drop_nlink warning in minix_rename() triggered by corrupted inode link counts" * tag 'vfs-6.19-rc1.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: Fix a drop_nlink warning in minix_rename Fix a drop_nlink warning in minix_rmdir Add error handling to minix filesystem for inode corruption detection commit b4dcaeea5e9a9a27d9dca3e746f1423c218a7ca0 Merge: a2027019e9cea7 633b1d010ce838 Author: Jakub Kicinski Date: Mon Dec 1 15:10:15 2025 -0800 Merge branch 'net-dsa-yt921x-add-stp-mst-support' David Yang says: ==================== net: dsa: yt921x: Add STP/MST support Support for these features was deferred from the initial submission of the driver. v3: https://lore.kernel.org/20251126093240.2853294-1-mmyangfl@gmail.com v2: https://lore.kernel.org/20251025170606.1937327-1-mmyangfl@gmail.com v1: https://lore.kernel.org/20251024033237.1336249-1-mmyangfl@gmail.com ==================== Link: https://patch.msgid.link/20251201094232.3155105-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 633b1d010ce838bd5e9dd71e738328e16e3df81d Author: David Yang Date: Mon Dec 1 17:42:29 2025 +0800 net: dsa: yt921x: Add STP/MST support Support for STP/MST was deferred from the initial submission of the driver. Signed-off-by: David Yang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251201094232.3155105-3-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit d973ac83ad0d0292c81d4bcbb4a335834f90aa5d Author: David Yang Date: Mon Dec 1 17:42:28 2025 +0800 net: dsa: yt921x: Use *_ULL bitfield macros for VLAN_CTRL VLAN_CTRL should be treated as a 64-bit register. GENMASK and BIT macros use unsigned long as the underlying type, which will result in a build error on architectures where sizeof(long) == 4. Replace them with unsigned long long variants. Signed-off-by: David Yang Reviewed-by: Andrew Lunn Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251201094232.3155105-2-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit a2027019e9cea7f0d82141a2ac2b5709c1dcd88c Merge: 8d537e333e3704 16416c8352875d Author: Jakub Kicinski Date: Mon Dec 1 15:08:26 2025 -0800 Merge branch 'add-sqi-and-sqi-support-for-oatc14-10base-t1s-phys-and-microchip-t1s-driver' Parthiban Veerasooran says: ==================== Add SQI and SQI+ support for OATC14 10Base-T1S PHYs and Microchip T1S driver This patch series adds Signal Quality Indicator (SQI) and enhanced SQI+ support for OATC14 10Base-T1S PHYs, along with integration into the Microchip T1S PHY driver. This enables ethtool to report the SQI value for OATC14 10Base-T1S PHYs. ==================== Link: https://patch.msgid.link/20251201032346.6699-1-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 16416c8352875deca61d359e44a419fae0d8993c Author: Parthiban Veerasooran Date: Mon Dec 1 08:53:46 2025 +0530 net: phy: microchip_t1s: add SQI support for LAN867x Rev.D0 PHYs Add support for Signal Quality Index (SQI) reporting in the Microchip T1S PHY driver for LAN867x Rev.D0 (OATC14-compliant) PHYs. This patch registers the following callbacks in the microchip_t1s driver structure: - .get_sqi - returns the current SQI value - .get_sqi_max - returns the maximum SQI value This enables ethtool to report the SQI value for LAN867x Rev.D0 PHYs. Signed-off-by: Parthiban Veerasooran Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251201032346.6699-3-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 5e1bf5ae5e3ba3588b474669ba05f5d202003d84 Author: Parthiban Veerasooran Date: Mon Dec 1 08:53:45 2025 +0530 net: phy: phy-c45: add SQI and SQI+ support for OATC14 10Base-T1S PHYs Add support for reading Signal Quality Indicator (SQI) and enhanced SQI+ from OATC14 10Base-T1S PHYs. - Introduce MDIO register definitions for DCQ_SQI and DCQ_SQIPLUS. - Add `genphy_c45_oatc14_get_sqi_max()` to return the maximum supported SQI/SQI+ level. - Add `genphy_c45_oatc14_get_sqi()` to return the current SQI or SQI+ value. - Update `include/linux/phy.h` to expose the new APIs. SQI+ capability is read from the Advanced Diagnostic Features Capability register (ADFCAP). If SQI+ is supported, the driver calculates the value from the MSBs of the DCQ_SQIPLUS register; otherwise, it falls back to basic SQI (0-7 levels). This enables ethtool to report the SQI value for OATC14 10Base-T1S PHYs. Open Alliance TC14 10BASE-T1S Advanced Diagnostic PHY Features Specification ref: https://opensig.org/wp-content/uploads/2025/06/OPEN_Alliance_10BASE-T1S_Advanced_PHY_features_for-automotive_Ethernet_V2.1b.pdf Signed-off-by: Parthiban Veerasooran Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251201032346.6699-2-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 8d537e333e3704ff1093878e83e553daa2e98d95 Merge: 596c696301b1bc 87a5112bfc406a Author: Jakub Kicinski Date: Mon Dec 1 14:56:30 2025 -0800 Merge branch 'net-mlx5e-enhance-dcbnl-get-set-maxrate-code' Tariq Toukan says: ==================== net/mlx5e: Enhance DCBNL get/set maxrate code This series by Gal introduces multiple small code quality improvements for the DCBNL operations mlx5e_dcbnl_ieee_[gs]etmaxrate(). No functional change. ==================== Link: https://patch.msgid.link/1764498334-1327918-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 87a5112bfc406a72c6bf1e8cdef9b0169dc1df6a Author: Gal Pressman Date: Sun Nov 30 12:25:34 2025 +0200 net/mlx5e: Use standard unit definitions for bandwidth conversion MLX5E_100MB and MLX5E_1GB defines are confusing, MLX5E_100MB is not equal to 100 * MEGA, and MLX5E_1GB is not equal to one GIGA, as they hide the Kbps rate conversion required for ieee_maxrate. Replace hardcoded bandwidth conversion values with standard unit definitions from linux/units.h. Rename MLX5E_100MB/MLX5E_1GB to MLX5E_100MB_TO_KB/MLX5E_1GB_TO_KB to clarify these are conversion factors to Kbps, not absolute bandwidth values. Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1764498334-1327918-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 53f7a771285182be7bfba6d59ccdd0d47fc1a097 Author: Gal Pressman Date: Sun Nov 30 12:25:33 2025 +0200 net/mlx5e: Use U8_MAX instead of hard coded magic number Replace hard coded 255 magic number with U8_MAX (the register field is 8 bits). Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1764498334-1327918-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e1098bb02f2d9a85a127aecad6378e4f159acce5 Author: Gal Pressman Date: Sun Nov 30 12:25:32 2025 +0200 net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps Clarify that the limit represents the threshold for using 100 Mbps units rather than a general Mbps limit. Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1764498334-1327918-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e1de33c377b685298da406bb4838bd9814194f96 Author: Gal Pressman Date: Sun Nov 30 12:25:31 2025 +0200 net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate Change upper_limit_mbps/gbps from __u64 to u64 to follow kernel coding conventions. Signed-off-by: Gal Pressman Reviewed-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1764498334-1327918-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 596c696301b1bcb9e482e22a4f7f582858eefbcc Author: Jakub Kicinski Date: Mon Dec 1 14:51:02 2025 -0800 Revert "r8169: add DASH support for RTL8127AP" This reverts commit 17e9f841dd227a4dc976b22d000d5f669bc14493. Nathan reports error messages appearing in dmesg since commit under Fixes: [ 3.844125] r8169 0000:01:00.0 (unnamed net_device) (uninitialized): rtl_eriar_cond == 0 (loop: 100, delay: 100). [ 3.864844] r8169 0000:01:00.0 eth0: rtl_eriar_cond == 1 (loop: 100, delay: 100). [ 3.878825] r8169 0000:01:00.0 eth0: rtl_eriar_cond == 1 (loop: 100, delay: 100). [ 3.892632] r8169 0000:01:00.0 eth0: rtl_eriar_cond == 1 (loop: 100, delay: 100). [ 5.002551] r8169 0000:01:00.0 eth0: rtl_eriar_cond == 1 (loop: 100, delay: 100). [ 5.016286] r8169 0000:01:00.0 eth0: rtl_eriar_cond == 1 (loop: 100, delay: 100). [ 5.030027] r8169 0000:01:00.0 eth0: rtl_eriar_cond == 1 (loop: 100, delay: 100). Let's drop the bad change and revisit in the next release cycle. Repoted-by: Nathan Chancellor Link: https://lore.kernel.org/20251201224238.GA604467@ax162 Fixes: 17e9f841dd22 ("r8169: add DASH support for RTL8127AP") Signed-off-by: Jakub Kicinski commit 8d92057c4a9bb14683c9f87f2f26b97564d72b2f Merge: 4e3583cb61a9e1 0b2b27058692d4 Author: Jakub Kicinski Date: Mon Dec 1 14:46:41 2025 -0800 Merge branch 'net-dsa-b53-fix-arl-accesses-for-bcm5325-65-and-allow-vid-0' Jonas Gorski says: ==================== net: dsa: b53: fix ARL accesses for BCM5325/65 and allow VID 0 ARL entries on BCM5325 and BCM5365 were broken significantly in two ways: - Entries for the CPU port were using the wrong port id, pointing to a non existing port. - Setting the VLAN ID for entries was not done, adding them all to VLAN 0 instead. While the former technically broke any communication to the CPU port, with the latter they were added to the currently unused VID 0, so they never became effective. Presumably the default PVID was set to 1 because of these issues 0 was broken (and the root cause not found). So fix writing and reading entries on BCM5325/65 by first fixing the CPU port entries, then fixing setting the VLAN ID for entries. Finally, re-allow VID 0 for BCM5325/65 to allow the whole 1-15 VLAN ID range to be available to users, and align VLAN handling with all other switch chips. ==================== Link: https://patch.msgid.link/20251128080625.27181-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 0b2b27058692d437b12d3f2a3bf0fa699af7376e Author: Jonas Gorski Date: Fri Nov 28 09:06:25 2025 +0100 net: dsa: b53: allow VID 0 for BCM5325/65 Now that writing ARL entries works properly, we can actually use VID 0 as the default untagged VLAN for BCM5325 and BCM5365 as well. So use 0 as default PVID for all chips and do not reject VLAN 0 anymore, which we ignored since commit 45e9d59d3950 ("net: dsa: b53: do not allow to configure VLAN 0") anyway. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251128080625.27181-8-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit d39514e6a2d14f57830d649e2bf03b49612c2f73 Author: Jonas Gorski Date: Fri Nov 28 09:06:24 2025 +0100 net: dsa: b53: fix BCM5325/65 ARL entry VIDs BCM5325/65's ARL entry registers do not contain the VID, only the search result register does. ARL entries have a separate VID entry register for the index into the VLAN table. So make ARL entry accessors use the VID entry registers instead, and move the VLAN ID field definition to the search register definition. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251128080625.27181-7-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 3b08863469aa6028ac7c3120966f4e2f6051cf6b Author: Jonas Gorski Date: Fri Nov 28 09:06:23 2025 +0100 net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks We currently use the mask 0xf for writing and reading b53_entry::port, but this is only correct for unicast ARL entries. Multicast ARL entries use a bitmask, and 0xf is not enough space for ports > 3, which includes the CPU port. So extend the mask accordingly to also fit port 4 (bit 4) and MII (bit 5). According to the datasheet the multicast port mask is [60:48], making it 12 bit wide, but bits 60-55 are reserved anyway, and collide with the priority field at [60:59], so I am not sure if this is valid. Therefore leave it at the actual used range, [53:48]. The ARL search result register differs a bit, and there the mask is only [52:48], so only spanning the user ports. The MII port bit is contained in the Search Result Extension register. So create a separate search result parse function that properly handles this. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Reviewed-by: Florian Fainelli Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20251128080625.27181-6-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 85132103f700b1340fc17df8a981509d17bf4872 Author: Jonas Gorski Date: Fri Nov 28 09:06:22 2025 +0100 net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65 On BCM5325 and BCM5365, unicast ARL entries use 8 as the value for the CPU port, so we need to translate it to/from 5 as used for the CPU port at most other places. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251128080625.27181-5-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 8e46aacea4264bcb8d4265fb07577afff58ae78d Author: Jonas Gorski Date: Fri Nov 28 09:06:21 2025 +0100 net: dsa: b53: use same ARL search result offset for BCM5325/65 BCM5365's search result is at the same offset as BCM5325's search result, and they (mostly) share the same format, so switch BCM5365 to BCM5325's arl ops. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Reviewed-by: Florian Fainelli Tested-by: Álvaro Fernández Rojas Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20251128080625.27181-4-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 9316012dd01952f75e37035360138ccc786ef727 Author: Jonas Gorski Date: Fri Nov 28 09:06:20 2025 +0100 net: dsa: b53: fix extracting VID from entry for BCM5325/65 BCM5325/65's Entry register uses the highest three bits for VALID/STATIC/AGE, so shifting by 53 only will add these to b53_arl_entry::vid. So make sure to mask the vid value as well, to not get invalid VIDs. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Reviewed-by: Florian Fainelli Tested-by: Álvaro Fernández Rojas Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20251128080625.27181-3-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 6f268e275c74dae0536e0b61982a8db25bcf4f16 Author: Jonas Gorski Date: Fri Nov 28 09:06:19 2025 +0100 net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 Since BCM5325 and BCM5365 only support up to 256 VLANs, the VLAN_ID_IDX register is only 8 bit wide, not 16 bit, so use an appropriate accessor. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Reviewed-by: Florian Fainelli Tested-by: Álvaro Fernández Rojas Signed-off-by: Jonas Gorski Link: https://patch.msgid.link/20251128080625.27181-2-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 978d337c2ed6e5313ee426871a410eddc796ccfd Merge: afdf0fb340948a 73fd0dba0beb1d Author: Linus Torvalds Date: Mon Dec 1 14:39:03 2025 -0800 Merge tag 'vfs-6.19-rc1.guards' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull superblock lock guard updates from Christian Brauner: "This starts the work of introducing guards for superblock related locks. Introduce super_write_guard for scoped superblock write protection. This provides a guard-based alternative to the manual sb_start_write() and sb_end_write() pattern, allowing the compiler to automatically handle the cleanup" * tag 'vfs-6.19-rc1.guards' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: xfs: use super write guard in xfs_file_ioctl() open: use super write guard in do_ftruncate() btrfs: use super write guard in relocating_repair_kthread() ext4: use super write guard in write_mmp_block() btrfs: use super write guard in sb_start_write() btrfs: use super write guard btrfs_run_defrag_inode() btrfs: use super write guard in btrfs_reclaim_bgs_work() fs: add super_write_guard commit 4e3583cb61a9e1306bbc8146c891292405003d9e Merge: aee0f01b4f1188 ab96af7004c76d Author: Jakub Kicinski Date: Mon Dec 1 14:30:09 2025 -0800 Merge branch 'amd-xgbe-schedule-napi-on-rbu-event' Raju Rangoju says: ==================== amd-xgbe: schedule NAPI on RBU event During the RX overload the Rx buffers may not be refilled, trying to schedule the NAPI when an Rx Buffer Unavailable is signaled may help in improving the such situation, in case we missed an IRQ. ==================== Link: https://patch.msgid.link/20251129175016.3034185-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit ab96af7004c76de5fdca077b1e3732a7ec96f69b Author: Raju Rangoju Date: Sat Nov 29 23:20:16 2025 +0530 amd-xgbe: schedule NAPI on Rx Buffer Unavailable (RBU) Under heavy load, Rx Buffer Unavailable (RBU) can occur if Rx processing is slower than network. When an RBU is signaled, try to schedule NAPI to help recover from such situation (including cases where an IRQ may be missed or such) Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20251129175016.3034185-3-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit c3b744fd20191963f1739498446b5efb812c99d8 Author: Raju Rangoju Date: Sat Nov 29 23:20:15 2025 +0530 amd-xgbe: refactor the dma IRQ handling code path Refactor the DMA interrupt bottom-half handling to improve the readability, maintainability, without changing the intended behavior. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20251129175016.3034185-2-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit aee0f01b4f118844cb126a5f27e91c2adf087c59 Author: Nikola Z. Ivanov Date: Fri Nov 28 09:25:44 2025 +0200 team: Add matching error label for failed action Follow the "action" - "err_action" pairing of labels found across the source code of team net device. Currently in team_port_add the err_set_slave_promisc label is reused for exiting on error when setting allmulti level of the new slave. Signed-off-by: Nikola Z. Ivanov Reviewed-by: Simon Horman Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251128072544.223645-1-zlatistiv@gmail.com Signed-off-by: Jakub Kicinski commit afdf0fb340948a8c0f581ed1dc42828af89b80b6 Merge: 1d18101a644e6e dca3aa666fbd71 Author: Linus Torvalds Date: Mon Dec 1 14:18:01 2025 -0800 Merge tag 'vfs-6.19-rc1.fs_header' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull fs header updates from Christian Brauner: "This contains initial work to start splitting up fs.h. Begin the long-overdue work of splitting up the monolithic fs.h header. The header has grown to over 3000 lines and includes types and functions for many different subsystems, making it difficult to navigate and causing excessive compilation dependencies. This series introduces new focused headers for superblock-related code: - Rename fs_types.h to fs_dirent.h to better reflect its actual content (directory entry types) - Add fs/super_types.h containing superblock type definitions - Add fs/super.h containing superblock function declarations This is the first step in a longer effort to modularize the VFS headers. Cleanups: - Inode Field Layout Optimization (Mateusz Guzik) Move inode fields used during fast path lookup closer together to improve cache locality during path resolution. - current_umask() Optimization (Mateusz Guzik) Inline current_umask() and move it to fs_struct.h. This improves performance by avoiding function call overhead for this frequently-used function, and places it in a more appropriate header since it operates on fs_struct" * tag 'vfs-6.19-rc1.fs_header' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: move inode fields used during fast path lookup closer together fs: inline current_umask() and move it to fs_struct.h fs: add fs/super.h header fs: add fs/super_types.h header fs: rename fs_types.h to fs_dirent.h commit 9bf66036d686b9a67000ba22bd94be13a4ea79ac Author: Long Li Date: Wed Nov 26 13:45:52 2025 -0800 net: mana: Handle hardware recovery events when probing the device When MANA is being probed, it's possible that hardware is in recovery mode and the device may get GDMA_EQE_HWC_RESET_REQUEST over HWC in the middle of the probe. Detect such condition and go through the recovery service procedure. Signed-off-by: Long Li Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/1764193552-9712-1-git-send-email-longli@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 6ab578739a4c1f5ae3c5416d9c7339a2f50d83f1 Author: Jeremy Kerr Date: Wed Nov 26 16:48:54 2025 +0800 net: mctp: test: move TX packetqueue from dst to dev To capture TX packets during a test, we are currently intercepting the dst->output with an implementation that adds the transmitted packet to a skb queue attached to the test-specific mock dst. The netdev itself is not involved in the test TX path. Instead, we can just use our test device to stash TXed packets for later inspection by the test. This means we can include the actual mctp_dst_output() implementation in the test (by setting dst.output in the test case), and don't need to be creating fake dst objects, or their corresponding skb queues. We need to ensure that the netdev is up to allow delivery to ndo_start_xmit, but the tests assume active devices at present anyway. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20251126-dev-mctp-test-tx-queue-v2-1-4e5bbd1d6c57@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 56435627d90f252017237fa66a9fa081b11113f9 Author: Vladimir Oltean Date: Tue Nov 25 12:35:07 2025 +0200 net: pcs: lynx: accept in-band autoneg for 2500base-x Testing in two circumstances: 1. back to back optical SFP+ connection between two LS1028A-QDS ports with the SCH-26908 riser card 2. T1042 with on-board AQR115 PHY using "OCSGMII", as per https://lore.kernel.org/lkml/aIuEvaSCIQdJWcZx@FUE-ALEWI-WINX/ strongly suggests that enabling in-band auto-negotiation is actually possible when the lane baud rate is 3.125 Gbps. It was previously thought that this would not be the case, because it was only tested on 2500base-x links with on-board Aquantia PHYs, where it was noticed that MII_LPA is always reported as zero, and it was thought that this is because of the PCS. Test case #1 above shows it is not, and the configured MII_ADVERTISE on system A ends up in the MII_LPA on system B, when in 2500base-x mode (IF_MODE=0). Test case #2, which uses "SGMII" auto-negotiation (IF_MODE=3) for the 3.125 Gbps lane, is actually a misconfiguration, but it is what led to the discovery. There is actually an old bug in the Lynx PCS driver - it expects all register values to contain their default out-of-reset values, as if the PCS were initialized by the Reset Configuration Word (RCW) settings. There are 2 cases in which this is problematic: - if the bootloader (or previous kexec-enabled Linux) wrote a different IF_MODE value - if dynamically changing the SerDes protocol from 1000base-x to 2500base-x, e.g. by replacing the optical SFP module. Specifically in test case #2, an accidental alignment between the bootloader configuring the PCS to expect SGMII in-band code words, and the AQR115 PHY actually transmitting SGMII in-band code words when operating in the "OCSGMII" system interface protocol, led to the PCS transmitting replicated symbols at 3.125 Gbps baud rate. This could only have happened if the PCS saw and reacted to the SGMII code words in the first place. Since test #2 is invalid from a protocol perspective (there seems to be no standard way of negotiating the data rate of 2500 Mbps with SGMII, and the lower data rates should remain 10/100/1000), in-band auto-negotiation for 2500base-x effectively means Clause 37 (i.e. IF_MODE=0). Make 2500base-x be treated like 1000base-x in this regard, by removing all prior limitations and calling lynx_pcs_config_giga(). This adds a new feature: LINK_INBAND_ENABLE and at the same time fixes the Lynx PCS's long standing problem that the registers (specifically IF_MODE, but others could be misconfigured as well) are not written by the driver to the known valid values for 2500base-x. Co-developed-by: Alexander Wilhelm Signed-off-by: Alexander Wilhelm Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251125103507.749654-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b71cbcf7d170e51148d5467820ae8a72febcb651 Author: Daniel Wagner Date: Thu Oct 30 11:05:45 2025 +0100 nvme-fc: don't hold rport lock when putting ctrl nvme_fc_ctrl_put can acquire the rport lock when freeing the ctrl object: nvme_fc_ctrl_put nvme_fc_ctrl_free spin_lock_irqsave(rport->lock) Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. Justin suggested use the safe list iterator variant because nvme_fc_ctrl_put will also modify the rport->list. Cc: Justin Tee Reviewed-by: Christoph Hellwig Signed-off-by: Daniel Wagner Signed-off-by: Keith Busch commit 78723fe309f189ee4010d5b7a55f6a14644a40c2 Author: Gerd Bayer Date: Fri Oct 24 13:05:32 2025 +0200 nvme-pci: add debug message on fail to read CSTS Add a debug log spelling out that reading the CSTS register failed - to distinguish this from other reasons for ENODEV. Reviewed-by: Wilfred Mallawa Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Gerd Bayer Signed-off-by: Keith Busch commit c9adfb5b68cb623a37eea76432c09f478c593d0e Author: Gerd Bayer Date: Fri Oct 24 13:05:31 2025 +0200 nvme-pci: print error message on failure in nvme_probe Add a new error message that makes failures to probe visible in the kernel log, like: nvme 0008:00:00.0: error -ENODEV: probe failed This highlights issues with a particular device right away instead of leaving users to search for missing drives. Reviewed-by: Christoph Hellwig Reviewed-by: Wilfred Mallawa Signed-off-by: Gerd Bayer Signed-off-by: Keith Busch commit 3c1fb0ce60ef41eda52e8f847613b003e1ca35c9 Author: Shin'ichiro Kawasaki Date: Sat Sep 13 15:53:50 2025 +0900 nvmet: pci-epf: fix DMA channel debug print Currently, nvmet_pci_epf_init_dma() has two dev_dbg() calls intended to print debug information about the DMA channels for RX and TX. However, both calls mistakenly are made for the TX channel. Fix it by referreing to 'nvme_epf->rx_chan' and 'nvme_epf->tx_chan' and instead of the local variable 'chan'. Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Damien Le Moal Signed-off-by: Keith Busch commit 511b3b644e28d9b66e32515a74c57ff599e89035 Author: Shin'ichiro Kawasaki Date: Tue Sep 9 13:21:22 2025 +0200 nvmet: pci-epf: move DMA initialization to EPC init callback For DMA initialization to work across all EPC drivers, the DMA initialization has to be done in the .init() callback. This is because not all EPC drivers will have a refclock (which is often needed to access registers of a DMA controller embedded in a PCIe controller) at the time the .bind() callback is called. However, all EPC drivers are guaranteed to have a refclock by the time the .init() callback is called. Thus, move the DMA initialization to the .init() callback. This change was already done for other EPF drivers in commit 60bd3e039aa2 ("PCI: endpoint: pci-epf-{mhi/test}: Move DMA initialization to EPC init callback"). Cc: stable@vger.kernel.org Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver") Signed-off-by: Shin'ichiro Kawasaki Signed-off-by: Niklas Cassel Reviewed-by: Damien Le Moal Signed-off-by: Keith Busch commit edd17206e363aebc9595b2ffefa7e4d8aba096ef Author: Max Gurtovoy Date: Wed Sep 24 23:34:02 2025 +0300 nvmet: remove redundant subsysnqn field from ctrl The subsysnqn field in the nvmet controller structure is redundant, since the subsystem NQN can always be accessed via the controller's subsystem reference. Remove this field to save memory and avoid unnecessary duplication. Signed-off-by: Max Gurtovoy Signed-off-by: Keith Busch commit 1d18101a644e6ece450d5b0a93f21a71a21b6222 Merge: f2e74ecfba1b0d c8e00cdc7425d5 Author: Linus Torvalds Date: Mon Dec 1 13:45:41 2025 -0800 Merge tag 'kernel-6.19-rc1.cred' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull cred guard updates from Christian Brauner: "This contains substantial credential infrastructure improvements adding guard-based credential management that simplifies code and eliminates manual reference counting in many subsystems. Features: - Kernel Credential Guards Add with_kernel_creds() and scoped_with_kernel_creds() guards that allow using the kernel credentials without allocating and copying them. This was requested by Linus after seeing repeated prepare_kernel_creds() calls that duplicate the kernel credentials only to drop them again later. The new guards completely avoid the allocation and never expose the temporary variable to hold the kernel credentials anywhere in callers. - Generic Credential Guards Add scoped_with_creds() guards for the common override_creds() and revert_creds() pattern. This builds on earlier work that made override_creds()/revert_creds() completely reference count free. - Prepare Credential Guards Add prepare credential guards for the more complex pattern of preparing a new set of credentials and overriding the current credentials with them: - prepare_creds() - modify new creds - override_creds() - revert_creds() - put_cred() Cleanups: - Make init_cred static since it should not be directly accessed - Add kernel_cred() helper to properly access the kernel credentials - Fix scoped_class() macro that was introduced two cycles ago - coredump: split out do_coredump() from vfs_coredump() for cleaner credential handling - coredump: move revert_cred() before coredump_cleanup() - coredump: mark struct mm_struct as const - coredump: pass struct linux_binfmt as const - sev-dev: use guard for path" * tag 'kernel-6.19-rc1.cred' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (36 commits) trace: use override credential guard trace: use prepare credential guard coredump: use override credential guard coredump: use prepare credential guard coredump: split out do_coredump() from vfs_coredump() coredump: mark struct mm_struct as const coredump: pass struct linux_binfmt as const coredump: move revert_cred() before coredump_cleanup() sev-dev: use override credential guards sev-dev: use prepare credential guard sev-dev: use guard for path cred: add prepare credential guard net/dns_resolver: use credential guards in dns_query() cgroup: use credential guards in cgroup_attach_permissions() act: use credential guards in acct_write_process() smb: use credential guards in cifs_get_spnego_key() nfs: use credential guards in nfs_idmap_get_key() nfs: use credential guards in nfs_local_call_write() nfs: use credential guards in nfs_local_call_read() erofs: use credential guards ... commit 525459da4bd62a81142fea3f3d52188ceb4d8907 Author: Gongwei Li Date: Wed Nov 19 15:33:38 2025 +0800 Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE Add VID 13d3 & PID 3533 for Realtek RTL8821CE USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3533 Rev= 1.10 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Gongwei Li Signed-off-by: Luiz Augusto von Dentz commit a106e50be74b0896583f4d010a69f9806e4194f4 Author: Luiz Augusto von Dentz Date: Fri Nov 14 09:29:28 2025 -0500 Bluetooth: HCI: Add support for LL Extended Feature Set This adds support for emulating LL Extended Feature Set introduced in 6.0 that adds the following: Commands: - HCI_LE_Read_All_Local_Supported_­Features(0x2087)(Feature:47,1) - HCI_LE_Read_All_Remote_Features(0x2088)(Feature:47,2) Events: - HCI_LE_Read_All_Remote_Features_Complete(0x2b)(Mask bit:42) Signed-off-by: Luiz Augusto von Dentz commit 6f7cf13ef6b0fe2bdd539e5aa1b1fc8a1213cfc3 Author: Ayaan Mirza Baig Date: Tue Nov 11 19:50:41 2025 +0530 drivers/bluetooth: btbcm: Use kmalloc_array() to prevent overflow Replace the open-coded multiplication in kmalloc() with a call to kmalloc_array() to prevent potential integer overflows. This is a mechanical change, replacing BCM_FW_NAME_LEN with the type-safe sizeof(*fw_name) as the element size Signed-off-by: Ayaan Mirza Baig Signed-off-by: Luiz Augusto von Dentz commit bc6f557b3387d807e08ffb8d638f149fedb75bf6 Author: Chethan T N Date: Fri Nov 7 11:10:11 2025 +0530 Bluetooth: btintel_pcie: Introduce HCI Driver protocol This patch adds the infrastructure that allow the user space program to talk to intel pcie driver directly for fetching basic driver details. The changes introduced are referred form commit 04425292a62c15 ("Bluetooth: Introduce HCI Driver protocol") Signed-off-by: Chethan T N Signed-off-by: Luiz Augusto von Dentz commit a8b38d19857d42a1f2e90c9d9b0f74de2500acd7 Author: Shuai Zhang Date: Sun Nov 9 17:24:37 2025 +0800 Bluetooth: btusb: add new custom firmwares The new platform uses the QCA2066 chip along with a new board ID, which requires a dedicated firmware file to ensure proper initialization. Without this entry, the driver cannot locate and load the correct firmware, resulting in Bluetooth bring-up failure. This patch adds a new entry to the firmware table for QCA2066 so that the driver can correctly identify the board ID and load the appropriate firmware from 'qca/QCA2066/' in the linux-firmware repository. Signed-off-by: Shuai Zhang Acked-by: Dmitry Baryshkov Signed-off-by: Luiz Augusto von Dentz commit 1216462f4e7c4b7e5cf31545fa5fa4d1c53214cb Author: Max Chou Date: Wed Nov 5 13:50:41 2025 +0800 Bluetooth: btusb: Add new VID/PID 0x13d3/0x3619 for RTL8852BE-VT Add the support ID(0x13d3, 0x3619) to usb_device_id table for Realtek RTL8852BE-VT. The device info from /sys/kernel/debug/usb/devices as below. T: Bus=04 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 86 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3619 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit f460768bba2a548abba1df0fd1df5ec77341a539 Author: Max Chou Date: Wed Nov 5 13:50:40 2025 +0800 Bluetooth: btusb: Add new VID/PID 0x13d3/0x3618 for RTL8852BE-VT Add the support ID(0x13d3, 0x3618) to usb_device_id table for Realtek RTL8852BE-VT. The device info from /sys/kernel/debug/usb/devices as below. T: Bus=04 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 86 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3618 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit 32caa197b9b603e20f49fd3a0dffecd0cd620499 Author: Max Chou Date: Wed Nov 5 13:50:39 2025 +0800 Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT Add the support ID(0x0489, 0xE12F) to usb_device_id table for Realtek RTL8852BE-VT. The device info from /sys/kernel/debug/usb/devices as below. T: Bus=04 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 86 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e12f Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit 56f765ce73b4303ec5d85439ca7ce1bc0736d18b Author: Yang Li Date: Mon Oct 27 14:10:02 2025 +0800 Bluetooth: iso: fix socket matching ambiguity between BIS and CIS When both BIS and CIS links exist, their sockets are in the BT_LISTEN state. dump sock: sk 000000001977ef51 state 6 src 10:a5:62:31:05:cf dst 00:00:00:00:00:00 sk 0000000031d28700 state 7 src 10:a5:62:31:05:cf dst00:00:00:00:00:00 sk 00000000613af00e state 4 # listen sock of bis src 10:a5:62:31:05:cf dst 54:00:00:d4:99:30 sk 000000001710468c state 9 src 10:a5:62:31:05:cf dst 54:00:00:d4:99:30 sk 000000005d97dfde state 4 #listen sock of cis src 10:a5:62:31:05:cf dst 00:00:00:00:00:00 To locate the CIS socket correctly, check both the BT_LISTEN state and whether dst addr is BDADDR_ANY. Link: https://github.com/bluez/bluez/issues/1224 Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 027473ef6a83f28cd6b12551d93dfa24662bdcce Author: Krzysztof Kozlowski Date: Tue Oct 28 16:53:21 2025 +0100 Bluetooth: MAINTAINERS: Add Bartosz Golaszewski as Qualcomm hci_qca maintainer There are no dedicated maintainers of Qualcomm hci_qca Bluetooth drivers, but there should be, because these are actively used on many old and new platforms. Bartosz Golaszewski agreed to take care of this code. Link: https://lore.kernel.org/r/CAMRc=MdqAATOcDPhd=u0vOb8nLxSRd7N8rLGLO8F5Ywq3+=JCw@mail.gmail.com/ Signed-off-by: Krzysztof Kozlowski Acked-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz commit 4a23ce935f74d19df48d1906497fad1cef391392 Author: Max Chou Date: Tue Oct 28 14:24:13 2025 +0800 Bluetooth: btrtl: Add the support for RTL8761CUV Add support for RTL8761CUV BT controller on the USB interface. Do not apply IC_MATCH_FL_HCIVER when hci_ver is 0 in the ic_id_table. The device info from /sys/kernel/debug/usb/devices as below. T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=c761 Rev= 2.00 S: Manufacturer=Realtek S: Product=Bluetooth Controller S: SerialNumber=10000 C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Max Chou Signed-off-by: Luiz Augusto von Dentz commit b8414ba5a0e66ab0c5203cd015fc2d2948860af3 Author: Sakari Ailus Date: Mon Oct 27 15:35:38 2025 +0200 Bluetooth: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Signed-off-by: Luiz Augusto von Dentz commit 73d2d709cc172da53402c9b2ead39bebc774ea16 Author: Ariel D'Alessandro Date: Wed Oct 1 15:33:20 2025 -0300 dt-bindings: net: Convert Marvell 8897/8997 bindings to DT schema Convert the existing text-based DT bindings for Marvell 8897/8997 (sd8897/sd8997) bluetooth devices controller to a DT schema. While here, bindings for "usb1286,204e" (USB interface) are dropped from the DT schema definition as these are currently documented in file [0]. [0] Documentation/devicetree/bindings/net/btusb.txt Signed-off-by: Ariel D'Alessandro Reviewed-by: Rob Herring (Arm) Signed-off-by: Luiz Augusto von Dentz commit 0b00bee940cb16bfd42e764465705dbf2a95b55c Author: Pascal Giard Date: Tue Oct 7 11:33:15 2025 -0400 Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets Some Qualcomm Bluetooth controllers, e.g., QCNFA765 with WCN6855 chip, send debug packets as ACL frames with header 0x2EDC. The kernel misinterprets these as malformed ACL packets, causing repeated errors: Bluetooth: hci0: ACL packet for unknown connection handle 3804 This can occur hundreds of times per minute, greatly cluttering logs. On my computer, I am observing approximately 7 messages per second when streaming audio to a speaker. For Qualcomm controllers exchanging over UART, hci_qca.c already filters out these debug packets. This patch is for controllers not going through UART, but USB. This patch uses the classify_pkt_type callback to reclassify the packets with handle 0x2EDC as HCI_DIAG_PKT before they reach the HCI layer. This change is only applied to Qualcomm devices marked as BTUSB_QCA_WCN6855. Tested on: Thinkpad T14 gen2 (AMD) with QCNFA765 (0489:E0D0) Signed-off-by: Pascal Giard Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 8dbbb5423c0802ec21266765de80fd491868fab1 Author: Chingbin Li Date: Mon Oct 6 16:46:47 2025 +0800 Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV Add VID 2b89 & PID 6275 for Realtek RTL8761BUV USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 6 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2b89 ProdID=6275 Rev= 2.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00E04C239987 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Chingbin Li Signed-off-by: Luiz Augusto von Dentz commit 88c6216a52ea592ec351dddd042ecb0247325be5 Author: Ravindra Date: Wed Oct 15 15:09:03 2025 +0530 Bluetooth: btintel_pcie: Suspend/Resume: Controller doorbell interrupt handling Due to a hardware bug during suspend/resume, the controller may miss a doorbell interrupt. To address this, a retry mechanism has been added to inform the controller before reporting a failure. Test case: - run suspend and resume cycles. Signed-off-by: Ravindra Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 1fb0d830dab89d0dc99bb84a7087b0ceca63d2d8 Author: Ravindra Date: Wed Oct 15 15:09:02 2025 +0530 Bluetooth: btintel_pcie: Support for S4 (Hibernate) During S4 (hibernate), the Bluetooth device loses power. Upon resume, the driver performs the following actions: 1. Unregisters hdev 2. Calls function level reset 3. Registers hdev Test case: - run command sudo rtcwake -m disk -s 60 Signed-off-by: Ravindra Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 5a6700a31c953af9a17a7e2681335f31d922614d Author: Chris Lu Date: Wed Oct 15 11:31:50 2025 +0800 Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 Add VID 0489 & PID e170 for MediaTek MT7922 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e170 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Chris Lu Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit c126f98c011f5796ba118ef2093122d02809d30d Author: Chris Lu Date: Wed Oct 15 11:31:49 2025 +0800 Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 Add VID 0489 & PID e135 for MediaTek MT7920 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e135 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us Signed-off-by: Chris Lu Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 577cf4c0a1e8471a0d6c0f36bb3716285e27ad5e Author: Luiz Augusto von Dentz Date: Mon Oct 6 16:53:35 2025 -0400 Bluetooth: ISO: Fix not updating BIS sender source address The source address for a BIS sender/Broadcast Source shall be updated with the advertisement address since in case privacy is enabled it may use an RPA rather than an identity address. Signed-off-by: Luiz Augusto von Dentz commit a3b76bf4c4c90994248e3211b300d2d9834874f9 Author: Luiz Augusto von Dentz Date: Mon Oct 6 16:32:24 2025 -0400 Bluetooth: MGMT: Allow use of Set Device Flags without Add Device In certain cases setting devices flags like HCI_CONN_FLAG_PAST it shouldn't require to do Add Device first since it may not need to add an auto-connect policy, so this instead just automatically creates a hci_conn_params if one cannot be found using HCI_AUTO_CONN_DISABLED. Signed-off-by: Luiz Augusto von Dentz commit f817db10dc80d5d1eece60d93eba11062afe5154 Author: Luiz Augusto von Dentz Date: Mon Sep 29 17:43:53 2025 -0400 Bluetooth: ISO: Attempt to resolve broadcast address Broadcasters maybe using RPAs which can change over time and not matching the address used as destination in the socket, so this attempts to resolve the addresses then match with the socket address, in case that uses an indentity address, or then match the IRKs if both broadcaster and socket are using RPAs. Signed-off-by: Luiz Augusto von Dentz commit 14b06c3a88f7031d64fbce197fad1d400e507663 Author: Luiz Augusto von Dentz Date: Fri Sep 26 15:56:43 2025 -0400 Bluetooth: HCI: Always use the identity address when initializing a connection This makes sure hci_conn is initialized with the identity address if a matching IRK exists which avoids the trouble of having to do it at multiple places which seems to be missing (e.g. CIS, BIS and PA). Signed-off-by: Luiz Augusto von Dentz commit d3413703d5f8b7d1e6f514f9440ed5da1bc30796 Author: Luiz Augusto von Dentz Date: Fri Sep 5 11:34:44 2025 -0400 Bluetooth: ISO: Add support to bind to trigger PAST This makes it possible to bind to a different destination address after being connected (BT_CONNECTED, BT_CONNECT2) which then triggers PAST Sender proceedure to transfer the PA Sync to the destination address. Signed-off-by: Luiz Augusto von Dentz commit c530569adc19b5f0c62955de41f067bad34e3fe0 Author: Luiz Augusto von Dentz Date: Tue Sep 2 11:14:28 2025 -0400 Bluetooth: hci_core: Introduce HCI_CONN_FLAG_PAST This introduces a new device flag so userspace can indicate if it wants to enable PAST Receiver for a specific device. Signed-off-by: Luiz Augusto von Dentz commit 33b2835f0b7e2a458473b0e3a23b54b92108b6b0 Author: Luiz Augusto von Dentz Date: Tue Sep 2 11:11:40 2025 -0400 Bluetooth: HCI: Add initial support for PAST This adds PAST related commands (HCI_OP_LE_PAST, HCI_OP_LE_PAST_SET_INFO and HCI_OP_LE_PAST_PARAMS) and events (HCI_EV_LE_PAST_RECEIVED) along with handling of PAST sender and receiver features bits including new MGMG settings ( HCI_EV_LE_PAST_RECEIVED and MGMT_SETTING_PAST_RECEIVER) which userspace can use to determine if PAST is supported by the controller. Signed-off-by: Luiz Augusto von Dentz commit 97fdb2ea06efdde784480934d1ff60eb21e88b58 Author: Javier Nieto Date: Mon Sep 29 15:59:21 2025 -0700 Bluetooth: hci_h5: implement CRC data integrity The UART-based H5 protocol supports CRC data integrity checks for reliable packets. The host sets bit 5 in the configuration field of the CONFIG link control message to indicate that CRC is supported. The controller sets the same bit in the CONFIG RESPONSE message to indicate that CRC may be used from then on. Tested on a MangoPi MQ-Pro with a Realtek RTL8723DS Bluetooth controller using the tip of the bluetooth-next tree. Signed-off-by: Javier Nieto Signed-off-by: Luiz Augusto von Dentz commit 01622e9a5336015f657df423b700e488fbcd2f39 Author: Javier Nieto Date: Mon Sep 29 15:14:41 2025 -0700 Bluetooth: hci_h5: avoid sending two SYNC messages Previously, h5_open() called h5_link_control() to send a SYNC message. But h5_link_control() only enqueues the packet and requires the caller to call hci_uart_tx_wakeup(). Thus, after H5_SYNC_TIMEOUT ran out (100ms), h5_timed_event() would be called and, realizing that the state was still H5_UNINITIALIZED, it would re-enqueue the SYNC and call hci_uart_tx_wakeup(). Consequently, two SYNC packets would be sent and initialization would unnecessarily wait for 100ms. The naive solution of calling hci_uart_tx_wakeup() in h5_open() does not work because it will only schedule tx work if the HCI_PROTO_READY bit is set and hci_serdev only sets it after h5_open() returns. This patch removes the extraneous SYNC being enqueued and makes h5_timed_event() wake up on the next jiffy. Signed-off-by: Javier Nieto Signed-off-by: Luiz Augusto von Dentz commit 484f1176896e85b5ae4f04403c8cd5b79aced95e Author: Zhangchao Zhang Date: Fri Sep 26 18:10:46 2025 +0800 Bluetooth: mediatek: add gpio pin to reset bt Support the platform Bluetooth to be reset by hardware pin, when a Bluetooth exception occurs, attempt to reset the Bluetooth module using the hardware reset pin, as this method is generally more stable and reliable than a software reset. If the hardware reset pin is not specified in the device tree, fall back to the existing software reset mechanism to ensure backward compatibility. Co-developed: Sean Wang Co-developed: Hao Qin Co-developed: Chris Lu Signed-off-by: Zhangchao Zhang Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Luiz Augusto von Dentz commit 1dd6c84f1c544e552848a8968599220bd464e338 Author: Zqiang Date: Mon Dec 1 19:25:40 2025 +0800 sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks When loading the ebpf scheduler, the tasks in the scx_tasks list will be traversed and invoke __setscheduler_class() to get new sched_class. however, this would also incorrectly set the per-cpu migration task's->sched_class to rt_sched_class, even after unload, the per-cpu migration task's->sched_class remains sched_rt_class. The log for this issue is as follows: ./scx_rustland --stats 1 [ 199.245639][ T630] sched_ext: "rustland" does not implement cgroup cpu.weight [ 199.269213][ T630] sched_ext: BPF scheduler "rustland" enabled 04:25:09 [INFO] RustLand scheduler attached bpftrace -e 'iter:task /strcontains(ctx->task->comm, "migration")/ { printf("%s:%d->%pS\n", ctx->task->comm, ctx->task->pid, ctx->task->sched_class); }' Attaching 1 probe... migration/0:24->rt_sched_class+0x0/0xe0 migration/1:27->rt_sched_class+0x0/0xe0 migration/2:33->rt_sched_class+0x0/0xe0 migration/3:39->rt_sched_class+0x0/0xe0 migration/4:45->rt_sched_class+0x0/0xe0 migration/5:52->rt_sched_class+0x0/0xe0 migration/6:58->rt_sched_class+0x0/0xe0 migration/7:64->rt_sched_class+0x0/0xe0 sched_ext: BPF scheduler "rustland" disabled (unregistered from user space) EXIT: unregistered from user space 04:25:21 [INFO] Unregister RustLand scheduler bpftrace -e 'iter:task /strcontains(ctx->task->comm, "migration")/ { printf("%s:%d->%pS\n", ctx->task->comm, ctx->task->pid, ctx->task->sched_class); }' Attaching 1 probe... migration/0:24->rt_sched_class+0x0/0xe0 migration/1:27->rt_sched_class+0x0/0xe0 migration/2:33->rt_sched_class+0x0/0xe0 migration/3:39->rt_sched_class+0x0/0xe0 migration/4:45->rt_sched_class+0x0/0xe0 migration/5:52->rt_sched_class+0x0/0xe0 migration/6:58->rt_sched_class+0x0/0xe0 migration/7:64->rt_sched_class+0x0/0xe0 This commit therefore generate a new scx_setscheduler_class() and add check for stop_sched_class to replace __setscheduler_class(). Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Zqiang Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 33b4c26d4d3ccd24d9721a577671f2c73c1a7cd9 Author: Randy Dunlap Date: Fri Nov 28 16:25:24 2025 -0800 x86/platform: Fix and extend kernel-doc comments in Fix most (17) kernel-doc warnings in x86_init.h (except for struct x86_init_ops). The changes are: - fix struct member name typos - add ending ':' to struct member names - add some missing struct member descriptions Signed-off-by: Randy Dunlap Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251129002524.1196500-1-rdunlap@infradead.org commit e3b8cbf40c6e60a7a935bd8980884d5741a7a77b Author: Andre Carvalho Date: Sat Nov 29 12:24:19 2025 +0000 selftests: netconsole: remove log noise due to socat exit This removes some noise that can be distracting while looking at selftests by redirecting socat stderr to /dev/null. Before this commit, netcons_basic would output: Running with target mode: basic (ipv6) 2025/11/29 12:08:03 socat[259] W exiting on signal 15 2025/11/29 12:08:03 socat[271] W exiting on signal 15 basic : ipv6 : Test passed Running with target mode: basic (ipv4) 2025/11/29 12:08:05 socat[329] W exiting on signal 15 2025/11/29 12:08:05 socat[322] W exiting on signal 15 basic : ipv4 : Test passed Running with target mode: extended (ipv6) 2025/11/29 12:08:08 socat[386] W exiting on signal 15 2025/11/29 12:08:08 socat[386] W exiting on signal 15 2025/11/29 12:08:08 socat[380] W exiting on signal 15 extended : ipv6 : Test passed Running with target mode: extended (ipv4) 2025/11/29 12:08:10 socat[440] W exiting on signal 15 2025/11/29 12:08:10 socat[435] W exiting on signal 15 2025/11/29 12:08:10 socat[435] W exiting on signal 15 extended : ipv4 : Test passed After these changes, output looks like: Running with target mode: basic (ipv6) basic : ipv6 : Test passed Running with target mode: basic (ipv4) basic : ipv4 : Test passed Running with target mode: extended (ipv6) extended : ipv6 : Test passed Running with target mode: extended (ipv4) extended : ipv4 : Test passed Signed-off-by: Andre Carvalho Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251129-netcons-socat-noise-v1-1-605a0cea8fca@gmail.com Signed-off-by: Jakub Kicinski commit ea2d3befcf29cca5221d0572d54e4d71b683175d Author: David Yang Date: Sat Nov 29 12:21:34 2025 +0800 net: dsa: yt921x: Set ageing_time_min/ageing_time_max The ageing time is in 5s step, ranging from 1 step to 0xffff steps, so add appropriate attributes. Signed-off-by: David Yang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251129042137.3034032-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 09339d0d83108fd4f59b94677ac99bde870aa0ae Author: Alok Tiwari Date: Fri Nov 28 00:52:57 2025 -0800 l2tp: correct debugfs label for tunnel tx stats l2tp_dfs_seq_tunnel_show prints two groups of tunnel statistics. The first group reports transmit counters, but the code labels it as rx. Set the label to "tx" so the debugfs output reflects the actual meaning. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251128085300.3377210-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit aadff9f766399a350aa3e09fc671617bdc0b365f Author: Jakub Kicinski Date: Thu Nov 27 11:45:56 2025 -0800 selftests: net: add a hint about MACAddressPolicy=persistent New NIPA installation had been reporting a few flaky tests. arp_ndisc_evict_nocarrier is most flaky of them all. I suspect that the flakiness is due to udev swapping the MAC addresses on the interfaces. Extend the message in arp_ndisc_evict_nocarrier to hint at this potential issue. Having the neigh get fail right after ping is rather unusual, unless udev changes the MAC addr causing a flush in the meantime. Link: https://patch.msgid.link/20251127194556.2409574-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4b1639cac04cbc0d19321fc26476ea4f89ff4c8a Author: Jakub Kicinski Date: Thu Nov 27 16:48:46 2025 -0800 selftests: net: py: handle interrupt during cleanup Following up on the old discussion [1]. Let the BaseExceptions out of defer()'ed cleanup. And handle it in the main loop. This allows us to exit the tests if user hit Ctrl-C during defer(). Link: https://lore.kernel.org/20251119063228.3adfd743@kernel.org # [1] Reviewed-by: Simon Horman Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251128004846.2602687-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 40d5ce4af2067aab275b8aef690e77455da5314a Author: Yeounsu Moon Date: Mon Dec 1 07:06:53 2025 +0900 net: dlink: fix several spelling mistakes in comments This patch fixes multiple spelling mistakes in dl2k driver comments: - "deivices" -> "devices" - "Ttransmit" -> "Transmit" - "catastronphic" -> "catastrophic" - "Extened" -> "Extended" Also fix incorrect unit description: `rx_timeout` uses 640ns increments, not 64ns. - "64ns" -> "640ns" These are comment-only changes and do not affect runtime behavior. Signed-off-by: Yeounsu Moon Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251130220652.5425-2-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit cbca440dc329b39f18a1121e385aed830bbdfb12 Merge: 7adf0efb41fc38 ca8df5b877d4b0 Author: Jakub Kicinski Date: Mon Dec 1 11:54:49 2025 -0800 Merge branch 'net-freescale-migrate-to-get_rx_ring_count-ethtool-callback' Breno Leitao says: ==================== net: freescale: migrate to .get_rx_ring_count() ethtool callback This series migrates Freescale network drivers to use the new .get_rx_ring_count() ethtool callback introduced in commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries"). The new callback simplifies the .get_rxnfc() implementation by removing ETHTOOL_GRXRINGS handling and moving it to a dedicated callback. This provides a cleaner separation of concerns and aligns these drivers with the modern ethtool API. The series updates the following Freescale drivers: - enetc - dppa2 - gianfar ==================== Link: https://patch.msgid.link/20251128-gxring_freescale-v1-0-22a978abf29e@debian.org Signed-off-by: Jakub Kicinski commit ca8df5b877d4b027fcd3968c0519af2b33de4e8a Author: Breno Leitao Date: Fri Nov 28 05:11:47 2025 -0800 net: enetc: convert to use .get_rx_ring_count Convert the enetc driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc for handling ETHTOOL_GRXRINGS command. This simplifies the code in two ways: 1. For enetc_get_rxnfc(): Remove the ETHTOOL_GRXRINGS case from the switch statement while keeping other cases for classifier rules. 2. For enetc4_get_rxnfc(): Remove it completely and use enetc_get_rxnfc() instead. Now on, enetc_get_rx_ring_count() is the callback that returns the number of RX rings for enetc driver. Also, remove the documentation around enetc4_get_rxnfc(), which was not matching what the function did(?!). Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251128-gxring_freescale-v1-3-22a978abf29e@debian.org Signed-off-by: Jakub Kicinski commit b2d63392690156285e53562ed91b87131c9a97ac Author: Breno Leitao Date: Fri Nov 28 05:11:46 2025 -0800 net: dpaa2: convert to use .get_rx_ring_count Convert the dpaa2 driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc for handling ETHTOOL_GRXRINGS command. This simplifies the code by removing the ETHTOOL_GRXRINGS case from the switch statement and replacing it with a direct return of the queue count. The driver still maintains .get_rxnfc for other commands including ETHTOOL_GRXCLSRLCNT, ETHTOOL_GRXCLSRULE, and ETHTOOL_GRXCLSRLALL. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251128-gxring_freescale-v1-2-22a978abf29e@debian.org Signed-off-by: Jakub Kicinski commit d3fbfb8b2c4a352bf9167809d2e2e8f8e685d348 Author: Breno Leitao Date: Fri Nov 28 05:11:45 2025 -0800 net: gianfar: convert to use .get_rx_ring_count Convert the gianfar driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc for handling ETHTOOL_GRXRINGS command. This simplifies the code by removing the ETHTOOL_GRXRINGS case from the switch statement and replacing it with a direct return of the queue count. The driver still maintains .get_rxnfc for other commands including ETHTOOL_GRXCLSRLCNT, ETHTOOL_GRXCLSRULE, and ETHTOOL_GRXCLSRLALL. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251128-gxring_freescale-v1-1-22a978abf29e@debian.org Signed-off-by: Jakub Kicinski commit 7adf0efb41fc386daed9f74b9fe8d7e28f0f6f3d Author: Colin Ian King Date: Fri Nov 28 17:38:02 2025 +0000 ynl: samples: Fix spelling mistake "failedq" -> "failed" There is a spelling mistake in an error message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20251128173802.318520-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski commit 30ca0e049f507001c6377e28482a636689351f64 Author: Gabriel Marcano Date: Fri Nov 28 11:16:44 2025 -0800 hwmon: (dell-smm) Add Dell G5 5505 to fan control whitelist Allow manual PWM control on Dell G5 5505 (and SE). Signed-off-by: Gabriel Marcano Link: https://lore.kernel.org/r/20251128191650.6191-1-gabemarcano@yahoo.com Acked-by: Pali Rohár Signed-off-by: Guenter Roeck commit f2e74ecfba1b0d407f04b671a240cc65e309e529 Merge: 212c4053a1502e 37d369fa97cc07 Author: Linus Torvalds Date: Mon Dec 1 10:26:38 2025 -0800 Merge tag 'vfs-6.19-rc1.folio' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull folio updates from Christian Brauner: "Add a new folio_next_pos() helper function that returns the file position of the first byte after the current folio. This is a common operation in filesystems when needing to know the end of the current folio. The helper is lifted from btrfs which already had its own version, and is now used across multiple filesystems and subsystems: - btrfs - buffer - ext4 - f2fs - gfs2 - iomap - netfs - xfs - mm This fixes a long-standing bug in ocfs2 on 32-bit systems with files larger than 2GiB. Presumably this is not a common configuration, but the fix is backported anyway. The other filesystems did not have bugs, they were just mildly inefficient. This also introduce uoff_t as the unsigned version of loff_t. A recent commit inadvertently changed a comparison from being unsigned (on 64-bit systems) to being signed (which it had always been on 32-bit systems), leading to sporadic fstests failures. Generally file sizes are restricted to being a signed integer, but in places where -1 is passed to indicate "up to the end of the file", it is convenient to have an unsigned type to ensure comparisons are always unsigned regardless of architecture" * tag 'vfs-6.19-rc1.folio' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: Add uoff_t mm: Use folio_next_pos() xfs: Use folio_next_pos() netfs: Use folio_next_pos() iomap: Use folio_next_pos() gfs2: Use folio_next_pos() f2fs: Use folio_next_pos() ext4: Use folio_next_pos() buffer: Use folio_next_pos() btrfs: Use folio_next_pos() filemap: Add folio_next_pos() commit 212c4053a1502e5117d8cbbbd1c15579ce1839bb Merge: 415d34b92c1f92 390d967653e172 Author: Linus Torvalds Date: Mon Dec 1 10:17:39 2025 -0800 Merge tag 'vfs-6.19-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfd and coredump updates from Christian Brauner: "Features: - Expose coredump signal via pidfd Expose the signal that caused the coredump through the pidfd interface. The recent changes to rework coredump handling to rely on unix sockets are in the process of being used in systemd. The previous systemd coredump container interface requires the coredump file descriptor and basic information including the signal number to be sent to the container. This means the signal number needs to be available before sending the coredump to the container. - Add supported_mask field to pidfd Add a new supported_mask field to struct pidfd_info that indicates which information fields are supported by the running kernel. This allows userspace to detect feature availability without relying on error codes or kernel version checks. Cleanups: - Drop struct pidfs_exit_info and prepare to drop exit_info pointer, simplifying the internal publication mechanism for exit and coredump information retrievable via the pidfd ioctl - Use guard() for task_lock in pidfs - Reduce wait_pidfd lock scope - Add missing PIDFD_INFO_SIZE_VER1 constant - Add missing BUILD_BUG_ON() assert on struct pidfd_info Fixes: - Fix PIDFD_INFO_COREDUMP handling Selftests: - Split out coredump socket tests and common helpers into separate files for better organization - Fix userspace coredump client detection issues - Handle edge-triggered epoll correctly - Ignore ENOSPC errors in tests - Add debug logging to coredump socket tests, socket protocol tests, and test helpers - Add tests for PIDFD_INFO_COREDUMP_SIGNAL - Add tests for supported_mask field - Update pidfd header for selftests" * tag 'vfs-6.19-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (23 commits) pidfs: reduce wait_pidfd lock scope selftests/coredump: add second PIDFD_INFO_COREDUMP_SIGNAL test selftests/coredump: add first PIDFD_INFO_COREDUMP_SIGNAL test selftests/coredump: ignore ENOSPC errors selftests/coredump: add debug logging to coredump socket protocol tests selftests/coredump: add debug logging to coredump socket tests selftests/coredump: add debug logging to test helpers selftests/coredump: handle edge-triggered epoll correctly selftests/coredump: fix userspace coredump client detection selftests/coredump: fix userspace client detection selftests/coredump: split out coredump socket tests selftests/coredump: split out common helpers selftests/pidfd: add second supported_mask test selftests/pidfd: add first supported_mask test selftests/pidfd: update pidfd header pidfs: expose coredump signal pidfs: drop struct pidfs_exit_info pidfs: prepare to drop exit_info pointer pidfd: add a new supported_mask field pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info ... commit 415d34b92c1f921a9ff3c38f56319cbc5536f642 Merge: ebaeabfa5ab711 a71e4f103aed69 Author: Linus Torvalds Date: Mon Dec 1 09:47:41 2025 -0800 Merge tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace updates from Christian Brauner: "This contains substantial namespace infrastructure changes including a new system call, active reference counting, and extensive header cleanups. The branch depends on the shared kbuild branch for -fms-extensions support. Features: - listns() system call Add a new listns() system call that allows userspace to iterate through namespaces in the system. This provides a programmatic interface to discover and inspect namespaces, addressing longstanding limitations: Currently, there is no direct way for userspace to enumerate namespaces. Applications must resort to scanning /proc/*/ns/ across all processes, which is: - Inefficient - requires iterating over all processes - Incomplete - misses namespaces not attached to any running process but kept alive by file descriptors, bind mounts, or parent references - Permission-heavy - requires access to /proc for many processes - No ordering or ownership information - No filtering per namespace type The listns() system call solves these problems: ssize_t listns(const struct ns_id_req *req, u64 *ns_ids, size_t nr_ns_ids, unsigned int flags); struct ns_id_req { __u32 size; __u32 spare; __u64 ns_id; struct /* listns */ { __u32 ns_type; __u32 spare2; __u64 user_ns_id; }; }; Features include: - Pagination support for large namespace sets - Filtering by namespace type (MNT_NS, NET_NS, USER_NS, etc.) - Filtering by owning user namespace - Permission checks respecting namespace isolation - Active Reference Counting Introduce an active reference count that tracks namespace visibility to userspace. A namespace is visible in the following cases: - The namespace is in use by a task - The namespace is persisted through a VFS object (namespace file descriptor or bind-mount) - The namespace is a hierarchical type and is the parent of child namespaces The active reference count does not regulate lifetime (that's still done by the normal reference count) - it only regulates visibility to namespace file handles and listns(). This prevents resurrection of namespaces that are pinned only for internal kernel reasons (e.g., user namespaces held by file->f_cred, lazy TLB references on idle CPUs, etc.) which should not be accessible via (1)-(3). - Unified Namespace Tree Introduce a unified tree structure for all namespaces with: - Fixed IDs assigned to initial namespaces - Lookup based solely on inode number - Maintained list of owned namespaces per user namespace - Simplified rbtree comparison helpers Cleanups - Header Reorganization: - Move namespace types into separate header (ns_common_types.h) - Decouple nstree from ns_common header - Move nstree types into separate header - Switch to new ns_tree_{node,root} structures with helper functions - Use guards for ns_tree_lock - Initial Namespace Reference Count Optimization - Make all reference counts on initial namespaces a nop to avoid pointless cacheline ping-pong for namespaces that can never go away - Drop custom reference count initialization for initial namespaces - Add NS_COMMON_INIT() macro and use it for all namespaces - pid: rely on common reference count behavior - Miscellaneous Cleanups - Rename exit_task_namespaces() to exit_nsproxy_namespaces() - Rename is_initial_namespace() and make argument const - Use boolean to indicate anonymous mount namespace - Simplify owner list iteration in nstree - nsfs: raise SB_I_NODEV, SB_I_NOEXEC, and DCACHE_DONTCACHE explicitly - nsfs: use inode_just_drop() - pidfs: raise DCACHE_DONTCACHE explicitly - pidfs: simplify PIDFD_GET__NAMESPACE ioctls - libfs: allow to specify s_d_flags - cgroup: add cgroup namespace to tree after owner is set - nsproxy: fix free_nsproxy() and simplify create_new_namespaces() Fixes: - setns(pidfd, ...) race condition Fix a subtle race when using pidfds with setns(). When the target task exits after prepare_nsset() but before commit_nsset(), the namespace's active reference count might have been dropped. If setns() then installs the namespaces, it would bump the active reference count from zero without taking the required reference on the owner namespace, leading to underflow when later decremented. The fix resurrects the ownership chain if necessary - if the caller succeeded in grabbing passive references, the setns() should succeed even if the target task exits or gets reaped. - Return EFAULT on put_user() error instead of success - Make sure references are dropped outside of RCU lock (some namespaces like mount namespace sleep when putting the last reference) - Don't skip active reference count initialization for network namespace - Add asserts for active refcount underflow - Add asserts for initial namespace reference counts (both passive and active) - ipc: enable is_ns_init_id() assertions - Fix kernel-doc comments for internal nstree functions - Selftests - 15 active reference count tests - 9 listns() functionality tests - 7 listns() permission tests - 12 inactive namespace resurrection tests - 3 threaded active reference count tests - commit_creds() active reference tests - Pagination and stress tests - EFAULT handling test - nsid tests fixes" * tag 'namespace-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (103 commits) pidfs: simplify PIDFD_GET__NAMESPACE ioctls nstree: fix kernel-doc comments for internal functions nsproxy: fix free_nsproxy() and simplify create_new_namespaces() selftests/namespaces: fix nsid tests ns: drop custom reference count initialization for initial namespaces pid: rely on common reference count behavior ns: add asserts for initial namespace active reference counts ns: add asserts for initial namespace reference counts ns: make all reference counts on initial namespace a nop ipc: enable is_ns_init_id() assertions fs: use boolean to indicate anonymous mount namespace ns: rename is_initial_namespace() ns: make is_initial_namespace() argument const nstree: use guards for ns_tree_lock nstree: simplify owner list iteration nstree: switch to new structures nstree: add helper to operate on struct ns_tree_{node,root} nstree: move nstree types into separate header nstree: decouple from ns_common header ns: move namespace types into separate header ... commit ebaeabfa5ab711a9b69b686d58329e258fdae75f Merge: 9368f0f9419cde 4952f35f0545f3 Author: Linus Torvalds Date: Mon Dec 1 09:20:51 2025 -0800 Merge tag 'vfs-6.19-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull writeback updates from Christian Brauner: "Features: - Allow file systems to increase the minimum writeback chunk size. The relatively low minimal writeback size of 4MiB means that written back inodes on rotational media are switched a lot. Besides introducing additional seeks, this also can lead to extreme file fragmentation on zoned devices when a lot of files are cached relative to the available writeback bandwidth. This adds a superblock field that allows the file system to override the default size, and sets it to the zone size for zoned XFS. - Add logging for slow writeback when it exceeds sysctl_hung_task_timeout_secs. This helps identify tasks waiting for a long time and pinpoint potential issues. Recording the starting jiffies is also useful when debugging a crashed vmcore. - Wake up waiting tasks when finishing the writeback of a chunk Cleanups: - filemap_* writeback interface cleanups. Adding filemap_fdatawrite_wbc ended up being a mistake, as all but the original btrfs caller should be using better high level interfaces instead. This series removes all these low-level interfaces, switches btrfs to a more specific interface, and cleans up other too low-level interfaces. With this the writeback_control that is passed to the writeback code is only initialized in three places. - Remove __filemap_fdatawrite, __filemap_fdatawrite_range, and filemap_fdatawrite_wbc - Add filemap_flush_nr helper for btrfs - Push struct writeback_control into start_delalloc_inodes in btrfs - Rename filemap_fdatawrite_range_kick to filemap_flush_range - Stop opencoding filemap_fdatawrite_range in 9p, ocfs2, and mm - Make wbc_to_tag() inline and use it in fs" * tag 'vfs-6.19-rc1.writeback' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: Make wbc_to_tag() inline and use it in fs. xfs: set s_min_writeback_pages for zoned file systems writeback: allow the file system to override MIN_WRITEBACK_PAGES writeback: cleanup writeback_chunk_size mm: rename filemap_fdatawrite_range_kick to filemap_flush_range mm: remove __filemap_fdatawrite_range mm: remove filemap_fdatawrite_wbc mm: remove __filemap_fdatawrite mm,btrfs: add a filemap_flush_nr helper btrfs: push struct writeback_control into start_delalloc_inodes btrfs: use the local tmp_inode variable in start_delalloc_inodes ocfs2: don't opencode filemap_fdatawrite_range in ocfs2_journal_submit_inode_data_buffers 9p: don't opencode filemap_fdatawrite_range in v9fs_mmap_vm_close mm: don't opencode filemap_fdatawrite_range in filemap_invalidate_inode writeback: Add logging for slow writeback (exceeds sysctl_hung_task_timeout_secs) writeback: Wake up waiting tasks when finishing the writeback of a chunk. commit 9368f0f9419cde028a6e58331065900ff089bc36 Merge: b04b2e7a61830c ca0d620b0afae2 Author: Linus Torvalds Date: Mon Dec 1 09:02:34 2025 -0800 Merge tag 'vfs-6.19-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs inode updates from Christian Brauner: "Features: - Hide inode->i_state behind accessors. Open-coded accesses prevent asserting they are done correctly. One obvious aspect is locking, but significantly more can be checked. For example it can be detected when the code is clearing flags which are already missing, or is setting flags when it is illegal (e.g., I_FREEING when ->i_count > 0) - Provide accessors for ->i_state, converts all filesystems using coccinelle and manual conversions (btrfs, ceph, smb, f2fs, gfs2, overlayfs, nilfs2, xfs), and makes plain ->i_state access fail to compile - Rework I_NEW handling to operate without fences, simplifying the code after the accessor infrastructure is in place Cleanups: - Move wait_on_inode() from writeback.h to fs.h - Spell out fenced ->i_state accesses with explicit smp_wmb/smp_rmb for clarity - Cosmetic fixes to LRU handling - Push list presence check into inode_io_list_del() - Touch up predicts in __d_lookup_rcu() - ocfs2: retire ocfs2_drop_inode() and I_WILL_FREE usage - Assert on ->i_count in iput_final() - Assert ->i_lock held in __iget() Fixes: - Add missing fences to I_NEW handling" * tag 'vfs-6.19-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (22 commits) dcache: touch up predicts in __d_lookup_rcu() fs: push list presence check into inode_io_list_del() fs: cosmetic fixes to lru handling fs: rework I_NEW handling to operate without fences fs: make plain ->i_state access fail to compile xfs: use the new ->i_state accessors nilfs2: use the new ->i_state accessors overlayfs: use the new ->i_state accessors gfs2: use the new ->i_state accessors f2fs: use the new ->i_state accessors smb: use the new ->i_state accessors ceph: use the new ->i_state accessors btrfs: use the new ->i_state accessors Manual conversion to use ->i_state accessors of all places not covered by coccinelle Coccinelle-based conversion to use ->i_state accessors fs: provide accessors for ->i_state fs: spell out fenced ->i_state accesses with explicit smp_wmb/smp_rmb fs: move wait_on_inode() from writeback.h to fs.h fs: add missing fences to I_NEW handling ocfs2: retire ocfs2_drop_inode() and I_WILL_FREE usage ... commit 7fce856f1180c2db3c9f5a88b04bb7124a20cb21 Author: Max Gurtovoy Date: Wed Sep 24 23:35:44 2025 +0300 nvmet: add sanity checks when freeing subsystem Add WARN_ON_ONCE checks in nvmet_subsys_free() to ensure that the ctrls and hosts lists are all empty during subsystem release. This helps catch resource leaks. Signed-off-by: Max Gurtovoy Signed-off-by: Keith Busch commit b04b2e7a61830cabd00c6f95308a8e2f5d82fa52 Merge: 1885cdbfbb51ed ebf8538979101e Author: Linus Torvalds Date: Mon Dec 1 08:44:26 2025 -0800 Merge tag 'vfs-6.19-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "Features: - Cheaper MAY_EXEC handling for path lookup. This elides MAY_WRITE permission checks during path lookup and adds the IOP_FASTPERM_MAY_EXEC flag so filesystems like btrfs can avoid expensive permission work. - Hide dentry_cache behind runtime const machinery. - Add German Maglione as virtiofs co-maintainer. Cleanups: - Tidy up and inline step_into() and walk_component() for improved code generation. - Re-enable IOCB_NOWAIT writes to files. This refactors file timestamp update logic, fixing a layering bypass in btrfs when updating timestamps on device files and improving FMODE_NOCMTIME handling in VFS now that nfsd started using it. - Path lookup optimizations extracting slowpaths into dedicated routines and adding branch prediction hints for mntput_no_expire(), fd_install(), lookup_slow(), and various other hot paths. - Enable clang's -fms-extensions flag, requiring a JFS rename to avoid conflicts. - Remove spurious exports in fs/file_attr.c. - Stop duplicating union pipe_index declaration. This depends on the shared kbuild branch that brings in -fms-extensions support which is merged into this branch. - Use MD5 library instead of crypto_shash in ecryptfs. - Use largest_zero_folio() in iomap_dio_zero(). - Replace simple_strtol/strtoul with kstrtoint/kstrtouint in init and initrd code. - Various typo fixes. Fixes: - Fix emergency sync for btrfs. Btrfs requires an explicit sync_fs() call with wait == 1 to commit super blocks. The emergency sync path never passed this, leaving btrfs data uncommitted during emergency sync. - Use local kmap in watch_queue's post_one_notification(). - Add hint prints in sb_set_blocksize() for LBS dependency on THP" * tag 'vfs-6.19-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (35 commits) MAINTAINERS: add German Maglione as virtiofs co-maintainer fs: inline step_into() and walk_component() fs: tidy up step_into() & friends before inlining orangefs: use inode_update_timestamps directly btrfs: fix the comment on btrfs_update_time btrfs: use vfs_utimes to update file timestamps fs: export vfs_utimes fs: lift the FMODE_NOCMTIME check into file_update_time_flags fs: refactor file timestamp update logic include/linux/fs.h: trivial fix: regualr -> regular fs/splice.c: trivial fix: pipes -> pipe's fs: mark lookup_slow() as noinline fs: add predicts based on nd->depth fs: move mntput_no_expire() slowpath into a dedicated routine fs: remove spurious exports in fs/file_attr.c watch_queue: Use local kmap in post_one_notification() fs: touch up predicts in path lookup fs: move fd_install() slowpath into a dedicated routine and provide commentary fs: hide dentry_cache behind runtime const machinery fs: touch predicts in do_dentry_open() ... commit 1885cdbfbb51ede3637166c895d0b8040c9899cc Merge: 7d0a66e4bb9081 7fd8720dff2d9c Author: Linus Torvalds Date: Mon Dec 1 08:14:00 2025 -0800 Merge tag 'vfs-6.19-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull iomap updates from Christian Brauner: "FUSE iomap Support for Buffered Reads: This adds iomap support for FUSE buffered reads and readahead. This enables granular uptodate tracking with large folios so only non-uptodate portions need to be read. Also fixes a race condition with large folios + writeback cache that could cause data corruption on partial writes followed by reads. - Refactored iomap read/readahead bio logic into helpers - Added caller-provided callbacks for read operations - Moved buffered IO bio logic into new file - FUSE now uses iomap for read_folio and readahead Zero Range Folio Batch Support: Add folio batch support for iomap_zero_range() to handle dirty folios over unwritten mappings. Fix raciness issues where dirty data could be lost during zero range operations. - filemap_get_folios_tag_range() helper for dirty folio lookup - Optional zero range dirty folio processing - XFS fills dirty folios on zero range of unwritten mappings - Removed old partial EOF zeroing optimization DIO Write Completions from Interrupt Context: Restore pre-iomap behavior where pure overwrite completions run inline rather than being deferred to workqueue. Reduces context switches for high-performance workloads like ScyllaDB. - Removed unused IOCB_DIO_CALLER_COMP code - Error completions always run in user context (fixes zonefs) - Reworked REQ_FUA selection logic - Inverted IOMAP_DIO_INLINE_COMP to IOMAP_DIO_OFFLOAD_COMP Buffered IO Cleanups: Some performance and code clarity improvements: - Replace manual bitmap scanning with find_next_bit() - Simplify read skip logic for writes - Optimize pending async writeback accounting - Better variable naming - Documentation for iomap_finish_folio_write() requirements Misaligned Vectors for Zoned XFS: Enables sub-block aligned vectors in XFS always-COW mode for zoned devices via new IOMAP_DIO_FSBLOCK_ALIGNED flag. Bug Fixes: - Allocate s_dio_done_wq for async reads (fixes syzbot report after error completion changes) - Fix iomap_read_end() for already uptodate folios (regression fix)" * tag 'vfs-6.19-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (40 commits) iomap: allocate s_dio_done_wq for async reads as well iomap: fix iomap_read_end() for already uptodate folios iomap: invert the polarity of IOMAP_DIO_INLINE_COMP iomap: support write completions from interrupt context iomap: rework REQ_FUA selection iomap: always run error completions in user context fs, iomap: remove IOCB_DIO_CALLER_COMP iomap: use find_next_bit() for uptodate bitmap scanning iomap: use find_next_bit() for dirty bitmap scanning iomap: simplify when reads can be skipped for writes iomap: simplify ->read_folio_range() error handling for reads iomap: optimize pending async writeback accounting docs: document iomap writeback's iomap_finish_folio_write() requirement iomap: account for unaligned end offsets when truncating read range iomap: rename bytes_pending/bytes_accounted to bytes_submitted/bytes_not_submitted xfs: support sub-block aligned vectors in always COW mode iomap: add IOMAP_DIO_FSBLOCK_ALIGNED flag xfs: error tag to force zeroing on debug kernels iomap: remove old partial eof zeroing optimization xfs: fill dirty folios on zero range of unwritten mappings ... commit ef5e0a02d842b2c6dfcfd9b80feb185769b892ef Author: HariKrishna Sagala Date: Mon Dec 1 20:41:40 2025 +0530 ALSA: rawmidi: Fix inconsistent indenting warning reported by smatch Fix smatch reported inconsistent indenting warning in rawmidi. sound/core/rawmidi.c:2115 alsa_rawmidi_init() warn: inconsistent indenting. No functional changes were introduced. Signed-off-by: HariKrishna Sagala Link: https://patch.msgid.link/20251201151137.29536-4-hariconscious@gmail.com Signed-off-by: Takashi Iwai commit 72987d2ddc7e4d883d23be87eb858a003b81e2e0 Merge: b72a6ddf6af225 324f3e03e8a859 Author: Takashi Iwai Date: Mon Dec 1 16:25:31 2025 +0100 Merge branch 'for-linus' into for-next Pull remaining 6.18-devel changes. Signed-off-by: Takashi Iwai commit fa8d4e6784d1b6a6eaa3911bac993181631d2856 Author: Mike Snitzer Date: Tue Nov 11 09:59:32 2025 -0500 NFSD: add Documentation/filesystems/nfs/nfsd-io-modes.rst This document details the NFSD IO modes that are configurable using NFSD's experimental debugfs interfaces: /sys/kernel/debug/nfsd/io_cache_read /sys/kernel/debug/nfsd/io_cache_write This document will evolve as NFSD's interfaces do (e.g. if/when NFSD's debugfs interfaces are replaced with per-export controls). Future updates will provide more specific guidance and howto information to help others use and evaluate NFSD's IO modes: BUFFERED, DONTCACHE and DIRECT. Signed-off-by: Mike Snitzer Signed-off-by: Chuck Lever commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 Author: Mike Snitzer Date: Tue Nov 11 09:59:31 2025 -0500 NFSD: Implement NFSD_IO_DIRECT for NFS WRITE When NFSD_IO_DIRECT is selected via the /sys/kernel/debug/nfsd/io_cache_write experimental tunable, split incoming unaligned NFS WRITE requests into a prefix, middle and suffix segment, as needed. The middle segment is now DIO-aligned and the prefix and/or suffix are unaligned. Synchronous buffered IO is used for the unaligned segments, and IOCB_DIRECT is used for the middle DIO-aligned extent. Although IOCB_DIRECT avoids the use of the page cache, by itself it doesn't guarantee data durability. For UNSTABLE WRITE requests, durability is obtained by a subsequent NFS COMMIT request. Signed-off-by: Mike Snitzer Co-developed-by: Chuck Lever Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit e3e8e176ca4876e6212582022ad80835dddc9de4 Author: Chuck Lever Date: Tue Nov 11 09:59:30 2025 -0500 NFSD: Make FILE_SYNC WRITEs comply with spec Mike noted that when NFSD responds to an NFS_FILE_SYNC WRITE, it does not also persist file time stamps. To wit, Section 18.32.3 of RFC 8881 mandates: > The client specifies with the stable parameter the method of how > the data is to be processed by the server. If stable is > FILE_SYNC4, the server MUST commit the data written plus all file > system metadata to stable storage before returning results. This > corresponds to the NFSv2 protocol semantics. Any other behavior > constitutes a protocol violation. If stable is DATA_SYNC4, then > the server MUST commit all of the data to stable storage and > enough of the metadata to retrieve the data before returning. Commit 3f3503adb332 ("NFSD: Use vfs_iocb_iter_write()") replaced: - flags |= RWF_SYNC; with: + kiocb.ki_flags |= IOCB_DSYNC; which appears to be correct given: if (flags & RWF_SYNC) kiocb_flags |= IOCB_DSYNC; in kiocb_set_rw_flags(). However the author of that commit did not appreciate that the previous line in kiocb_set_rw_flags() results in IOCB_SYNC also being set: kiocb_flags |= (__force int) (flags & RWF_SUPPORTED); RWF_SUPPORTED contains RWF_SYNC, and RWF_SYNC is the same bit as IOCB_SYNC. Reviewers at the time did not catch the omission. Reported-by: Mike Snitzer Closes: https://lore.kernel.org/linux-nfs/20251018005431.3403-1-cel@kernel.org/T/#t Fixes: 3f3503adb332 ("NFSD: Use vfs_iocb_iter_write()") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit d211a2803551c8ffdf0b97d129388f7d9cc129b5 Author: Randy Dunlap Date: Sat Nov 29 14:35:42 2025 -0800 block/rnbd: correct all kernel-doc complaints Fix all kernel-doc warnings in rnbd-proto.h: - use correct enum name in kdoc comment - mark several struct members as "/* private: */" so that no kdoc is required for them - don't use "/**" for a non-kernel-doc comment - use the correct struct member name for "dev_name" - use " *" for a blank kernel-doc line Fixes these warnings: Warning: drivers/block/rnbd/rnbd-proto.h:41 expecting prototype for enum rnbd_msg_types. Prototype was for enum rnbd_msg_type instead Warning: drivers/block/rnbd/rnbd-proto.h:50 struct member '__padding' not described in 'rnbd_msg_hdr' Warning: drivers/block/rnbd/rnbd-proto.h:53 This comment starts with '/**', but isn't a kernel-doc comment. * We allow to map RO many times and RW only once. We allow to map yet another Warning: drivers/block/rnbd/rnbd-proto.h:81 struct member 'reserved' not described in 'rnbd_msg_sess_info' Warning: drivers/block/rnbd/rnbd-proto.h:92 struct member 'reserved' not described in 'rnbd_msg_sess_info_rsp' Warning: drivers/block/rnbd/rnbd-proto.h:107 struct member 'resv1' not described in 'rnbd_msg_open' Warning: drivers/block/rnbd/rnbd-proto.h:107 struct member 'dev_name' not described in 'rnbd_msg_open' Warning: drivers/block/rnbd/rnbd-proto.h:107 struct member 'reserved' not described in 'rnbd_msg_open' Warning: drivers/block/rnbd/rnbd-proto.h:158 struct member 'reserved' not described in 'rnbd_msg_open_rsp' Warning: drivers/block/rnbd/rnbd-proto.h:189 bad line: Signed-off-by: Randy Dunlap Acked-by: Jack Wang Signed-off-by: Jens Axboe commit 4d0e1f2139ad452d0e209a16b3d016af2f8ef1f7 Author: Fengnan Chang Date: Mon Dec 1 20:25:04 2025 +0800 blk-mq: use queue_hctx in blk_mq_map_queue_type Some caller of blk_mq_map_queue_type now didn't grab 'q_usage_counter', such as blk_mq_cpu_mapped_to_hctx, so we need protect 'queue_hw_ctx' through rcu. Also checked all other functions, no more missed cases. Fixes: 89e1fb7ceffd ("blk-mq: fix potential uaf for 'queue_hw_ctx'") Reported-by: Jens Axboe Signed-off-by: Fengnan Chang Signed-off-by: Jens Axboe commit a9ea3a2e081d29350b7a3c0731729efbc70458b8 Author: Davidlohr Bueso Date: Fri Nov 28 14:27:47 2025 -0800 tomoyo: Use local kmap in tomoyo_dump_page() Replace the now deprecated kmap_atomic() with kmap_local_page(). The memcpy does not need atomic semantics, and the removed comment is now stale - this patch now makes it in sync again. Last but not least, highmem is going to be removed[0]. Link: https://lore.kernel.org/all/4ff89b72-03ff-4447-9d21-dd6a5fe1550f@app.fastmail.com/ [0] Signed-off-by: Davidlohr Bueso Signed-off-by: Tetsuo Handa commit 5cae92e622300d04ff23cc721dc67d8f5788e51c Merge: 4f132d81f9f8e4 187de7c212e5fa Author: Petr Mladek Date: Mon Dec 1 14:17:04 2025 +0100 Merge branch 'rework/write_atomic-unsafe' into for-linus commit 4f132d81f9f8e47a8866d162698adb7df7184466 Merge: 3a9a3f5fb22415 20793955835fe2 Author: Petr Mladek Date: Mon Dec 1 14:16:45 2025 +0100 Merge branch 'rework/threaded-printk' into for-linus commit 3a9a3f5fb224155bb719c337527ffdffca0c1d7f Merge: b1e6c41ef9daf5 66e7c1e0ee08cf Author: Petr Mladek Date: Mon Dec 1 14:16:28 2025 +0100 Merge branch 'rework/suspend-fixes' into for-linus commit b1e6c41ef9daf5a975a677c3570c5f805c6c7514 Merge: 2d786a5b80a715 1bc9a28f076fa6 Author: Petr Mladek Date: Mon Dec 1 14:16:08 2025 +0100 Merge branch 'rework/preempt-legacy-kthread' into for-linus commit 2d786a5b80a715dab2ef570fefbca8ef0753c7ed Merge: 475bb520c39442 466348abb0c364 Author: Petr Mladek Date: Mon Dec 1 14:15:43 2025 +0100 Merge branch 'rework/nbcon-in-kdb' into for-linus commit 475bb520c39442443a8a8e9c8d72197bd3d2934c Merge: 3869e431b51f30 d5d399efff6577 Author: Petr Mladek Date: Mon Dec 1 14:15:26 2025 +0100 Merge branch 'rework/atomic-flush-hardlockup' into for-linus commit 3869e431b51f3010f0d3bfc007c4a1b957c0ae1f Merge: a9f349e3c0bebe ace38521705bd7 Author: Petr Mladek Date: Mon Dec 1 14:14:34 2025 +0100 Merge branch 'for-6.19-vsprintf-timespec64' into for-linus commit 7838c7a9e2690609f137b6b8943454054ffae3cb Author: Dave Stevenson Date: Fri Dec 20 18:11:13 2024 +0000 dt-bindings: interrupt-controller: brcm,bcm2836-l1-intc: Drop interrupt-controller requirement Since commit 88bbe85dcd37 ("irqchip: bcm2836: Move SMP startup code to arch/arm (v2)") the bcm2836-l1-intc block on bcm2711 is only used as a base address for the smp_boot_secondary hook on 32 bit kernels. It is not used as an interrupt controller. Drop the binding requirement for interrupt-controller and interrupt-cells to satisfy validation on this platform. Signed-off-by: Dave Stevenson Acked-by: Krzysztof Kozlowski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20241220-dt-bcm2712-fixes-v5-3-cbbf13d2e97a@raspberrypi.com Signed-off-by: Rob Herring (Arm) commit 1705bbe7fec5d930baba4a88bbe6a8e08c2adbf9 Author: Dave Stevenson Date: Fri Dec 20 18:11:12 2024 +0000 dt-bindings: display: Fix brcm,bcm2835-hvs bindings for BCM2712 Commit 6cfcbe548a3a ("dt-bindings: display: Add BCM2712 HVS bindings") added the compatible string for BCM2712, but missed out that the number of interrupts and clocks changed too. The driver commit 7687a12153d3 ("drm/vc4: hvs: Add support for BCM2712 HVS") also requires that both interrupts and clocks are named, so the relevant -names properties are also added to "required" for BCM2712. Update to validate clock, interrupts, and their names for the BCM2712 variant. (There should be no change in the binding requirements for the other variants). Fixes: 6cfcbe548a3a ("dt-bindings: display: Add BCM2712 HVS bindings") Signed-off-by: Dave Stevenson Link: https://patch.msgid.link/20241220-dt-bcm2712-fixes-v5-2-cbbf13d2e97a@raspberrypi.com Signed-off-by: Rob Herring (Arm) commit 3f7f66530425b1d080ef1c742fef7ace3fd0ebe1 Author: Dave Stevenson Date: Fri Dec 20 18:11:11 2024 +0000 dt-bindings: display: bcm2711-hdmi: Add interrupt details for BCM2712 Commit 62948c62abca ("dt-bindings: display: Add BCM2712 HDMI bindings") added the compatible strings for BCM2712, but missed out that the number of interrupts changed with the "wakeup" interrupt not present in the BCM7212. Update the schema to correct the interrupt requirements for BCM2712. (Requirements for BCM2711 should be unchanged). Fixes: 62948c62abca ("dt-bindings: display: Add BCM2712 HDMI bindings") Signed-off-by: Dave Stevenson Link: https://patch.msgid.link/20241220-dt-bcm2712-fixes-v5-1-cbbf13d2e97a@raspberrypi.com Signed-off-by: Rob Herring (Arm) commit e2349c5811ae642f6d948d1ee4bfc4a93566c178 Merge: 69acbdbbefbda7 ef1b6d904993d3 24e3848a2e903f Author: Borislav Petkov (AMD) Date: Mon Dec 1 12:06:08 2025 +0100 Merge remote-tracking branches 'ras/edac-amd-atl', 'ras/edac-drivers' and 'ras/edac-misc' into edac-updates Signed-off-by: Borislav Petkov (AMD) commit a3209bb94b36351f11e0d9e72ac44e5dd777a069 Author: Christophe Leroy (CS GROUP) Date: Sat Nov 29 10:56:02 2025 +0100 um: Disable KASAN_INLINE when STATIC_LINK is selected um doesn't support KASAN_INLINE together with STATIC_LINK. Instead of failing the build, disable KASAN_INLINE when STATIC_LINK is selected. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511290451.x9GZVJ1l-lkp@intel.com/ Fixes: 1e338f4d99e6 ("kasan: introduce ARCH_DEFER_KASAN and unify static key across modes") Signed-off-by: Christophe Leroy (CS GROUP) Link: https://patch.msgid.link/2620ab0bbba640b6237c50b9c0dca1c7d1142f5d.1764410067.git.chleroy@kernel.org Signed-off-by: Johannes Berg commit 48bc9da3c97c15f1ea24934bcb3b736acd30163d Author: Giovanni Cabiddu Date: Thu Nov 20 16:26:09 2025 +0000 crypto: zstd - fix double-free in per-CPU stream cleanup The crypto/zstd module has a double-free bug that occurs when multiple tfms are allocated and freed. The issue happens because zstd_streams (per-CPU contexts) are freed in zstd_exit() during every tfm destruction, rather than being managed at the module level. When multiple tfms exist, each tfm exit attempts to free the same shared per-CPU streams, resulting in a double-free. This leads to a stack trace similar to: BUG: Bad page state in process kworker/u16:1 pfn:106fd93 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106fd93 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: nonzero entire_mapcount Modules linked in: ... CPU: 3 UID: 0 PID: 2506 Comm: kworker/u16:1 Kdump: loaded Tainted: G B Hardware name: ... Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: dump_stack_lvl+0x5d/0x80 bad_page+0x71/0xd0 free_unref_page_prepare+0x24e/0x490 free_unref_page+0x60/0x170 crypto_acomp_free_streams+0x5d/0xc0 crypto_acomp_exit_tfm+0x23/0x50 crypto_destroy_tfm+0x60/0xc0 ... Change the lifecycle management of zstd_streams to free the streams only once during module cleanup. Fixes: f5ad93ffb541 ("crypto: zstd - convert to acomp") Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Suman Kumar Chakraborty Signed-off-by: Herbert Xu commit c36f9d7b2869a003a2f7d6ff2c6bac9e62fd7d68 Author: Armin Wolf Date: Sat Nov 29 12:15:35 2025 +0100 fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() After commit 25524b619029 ("fs/nls: Fix utf16 to utf8 conversion"), the return values of utf8_to_utf32() and utf32_to_utf8() are inconsistent when encountering an error: utf8_to_utf32() returns -1, while utf32_to_utf8() returns errno codes. Fix this inconsistency by modifying utf8_to_utf32() to return errno codes as well. Fixes: 25524b619029 ("fs/nls: Fix utf16 to utf8 conversion") Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251129111535.8984-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 859d4ceacfc1149f29d47bd19fe7a8f59cf6255e Author: Denis Benato Date: Sat Nov 29 15:26:21 2025 +0100 platform/x86: asus-armoury: add support for GA503QR Add TDP data for laptop model GA503QR. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251129142621.152027-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 611cf41ef6ac8301d23daadd8e78b013db0c5071 Author: Yongxin Liu Date: Fri Nov 28 18:24:38 2025 +0800 platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak The intel_pmc_ipc() function uses ACPI_ALLOCATE_BUFFER to allocate memory for the ACPI evaluation result but never frees it, causing a 192-byte memory leak on each call. This leak is triggered during network interface initialization when the stmmac driver calls intel_mac_finish() -> intel_pmc_ipc(). unreferenced object 0xffff96a848d6ea80 (size 192): comm "dhcpcd", pid 541, jiffies 4294684345 hex dump (first 32 bytes): 04 00 00 00 05 00 00 00 98 ea d6 48 a8 96 ff ff ...........H.... 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace (crc b1564374): kmemleak_alloc+0x2d/0x40 __kmalloc_noprof+0x2fa/0x730 acpi_ut_initialize_buffer+0x83/0xc0 acpi_evaluate_object+0x29a/0x2f0 intel_pmc_ipc+0xfd/0x170 intel_mac_finish+0x168/0x230 stmmac_mac_finish+0x3d/0x50 phylink_major_config+0x22b/0x5b0 phylink_mac_initial_config.constprop.0+0xf1/0x1b0 phylink_start+0x8e/0x210 __stmmac_open+0x12c/0x2b0 stmmac_open+0x23c/0x380 __dev_open+0x11d/0x2c0 __dev_change_flags+0x1d2/0x250 netif_change_flags+0x2b/0x70 dev_change_flags+0x40/0xb0 Add __free(kfree) for ACPI object to properly release the allocated buffer. Cc: stable@vger.kernel.org Fixes: 7e2f7e25f6ff ("arch: x86: add IPC mailbox accessor function and add SoC register access") Signed-off-by: Yongxin Liu Link: https://patch.msgid.link/20251128102437.3412891-2-yongxin.liu@windriver.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 68779adbabdbb1891ba4d9b8c7d3be99ed5e0b3d Author: Ilpo Järvinen Date: Fri Nov 28 14:02:15 2025 +0200 platform/x86: hp-wmi: Order DMI board name arrays The hp-wmi driver has a number of arrays that are getting new entries and all/most entries have been added to the end of the array. As a result, the numerical order is mixed up in a few entries. Reorder the array entries. Split lines for each two leading chars to make the arrays easier to read. Add also trailing commas. Link: https://patch.msgid.link/20251128120215.4450-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Ilpo Järvinen commit 594f9cce51bf80ef2908d13485720277435e88a9 Merge: b169e1733cadb6 9b9c0adbc3f8a5 Author: Ilpo Järvinen Date: Mon Dec 1 11:53:59 2025 +0200 Merge branch 'fixes' of into for-next The current set of DMI board IDs from the fixes branch is required to reorder them in the for-next branch. commit 6ec33db1aaf06a76fb063610e668f8e12f32ebbf Author: Ingo Molnar Date: Mon Dec 1 10:42:27 2025 +0100 objtool: Fix segfault on unknown alternatives So 'objtool --link -d vmlinux.o' gets surprised by this endbr64+endbr64 pattern in ___bpf_prog_run(): ___bpf_prog_run: 1e7680: ___bpf_prog_run+0x0 push %r12 1e7682: ___bpf_prog_run+0x2 mov %rdi,%r12 1e7685: ___bpf_prog_run+0x5 push %rbp 1e7686: ___bpf_prog_run+0x6 xor %ebp,%ebp 1e7688: ___bpf_prog_run+0x8 push %rbx 1e7689: ___bpf_prog_run+0x9 mov %rsi,%rbx 1e768c: ___bpf_prog_run+0xc movzbl (%rbx),%esi 1e768f: ___bpf_prog_run+0xf movzbl %sil,%edx 1e7693: ___bpf_prog_run+0x13 mov %esi,%eax 1e7695: ___bpf_prog_run+0x15 mov 0x0(,%rdx,8),%rdx 1e769d: ___bpf_prog_run+0x1d jmp 0x1e76a2 <__x86_indirect_thunk_rdx> 1e76a2: ___bpf_prog_run+0x22 endbr64 1e76a6: ___bpf_prog_run+0x26 endbr64 1e76aa: ___bpf_prog_run+0x2a mov 0x4(%rbx),%edx And crashes due to blindly dereferencing alt->insn->alt_group. Bail out on NULL ->alt_group, which produces this warning and continues with the disassembly, instead of a segfault: .git/O/vmlinux.o: warning: objtool: : failed to disassemble alternative Cc: Alexandre Chartre Cc: Peter Zijlstra (Intel) Cc: Josh Poimboeuf Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 2b6d718c8dbe61aedffd7d12cf7bc60fab6f3d0e Author: Maciej W. Rozycki Date: Sun Oct 19 12:49:02 2025 +0100 MIPS: Fix whitespace damage in r4k_wait from VS timer fix Remove stray spaces/tabs introduced with commit 56651128e2fb ("MIPS: Fix idle VS timer enqueue") and add missing indentation for a branch delay slot. Signed-off-by: Maciej W. Rozycki Signed-off-by: Thomas Bogendoerfer commit d72312d730450aab225a80bc84436757b85b08b5 Author: Tomasz Lis Date: Mon Nov 24 23:28:53 2025 +0100 drm/xe: Protect against unset LRC when pausing submissions While pausing submissions, it is possible to encouner an exec queue which is during creation, and therefore doesn't have a valid xe_lrc struct reference. Protect agains such situation, by checking for NULL before access. Reviewed-by: Matthew Brost Fixes: c25c1010df88 ("drm/xe/vf: Replay GuC submission state on pause / unpause") Signed-off-by: Tomasz Lis Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20251124222853.1900800-1-tomasz.lis@intel.com (cherry picked from commit 07cf4b864f523f01d2bb522a05813df30b076ba8) Signed-off-by: Thomas Hellström commit 3d98a7164da666634c76647abc94218fff3d4f92 Author: Matthew Brost Date: Fri Nov 21 07:27:50 2025 -0800 drm/xe/vf: Start re-emission from first unsignaled job during VF migration The LRC software ring tail is reset to the first unsignaled pending job's head. Fix the re-emission logic to begin submitting from the first unsignaled job detected, rather than scanning all pending jobs, which can cause imbalance. v2: - Include missing local changes v3: - s/skip_replay/restore_replay (Tomasz) Fixes: c25c1010df88 ("drm/xe/vf: Replay GuC submission state on pause / unpause") Signed-off-by: Matthew Brost Reviewed-by: Tomasz Lis Link: https://patch.msgid.link/20251121152750.240557-1-matthew.brost@intel.com (cherry picked from commit 00937fe1921ab346b6f6a4beaa5c38e14733caa3) Signed-off-by: Thomas Hellström commit 14a8d83cbe7b929ee601fd2a48b4642cf80b39f4 Author: Michal Wajdeczko Date: Sat Nov 15 16:13:22 2025 +0100 drm/xe/pf: Use div_u64 when calculating GGTT profile This will fix the following error seen on some 32-bit config: "ERROR: modpost: "__udivdi3" [drivers/gpu/drm/xe/xe.ko] undefined!" Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511150929.3vUi6PEJ-lkp@intel.com/ Fixes: e448372e8a8e ("drm/xe/pf: Use migration-friendly GGTT auto-provisioning") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20251115151323.10828-1-michal.wajdeczko@intel.com (cherry picked from commit 0f4435a1f46efc3177eb082cd3f73e29da5ab86a) Signed-off-by: Thomas Hellström commit bf213ac63721b8fbbf0fc07eea6366419826ae8b Author: Mika Kuoppala Date: Thu Nov 20 18:14:35 2025 +0200 drm/xe: Fix memory leak when handling pagefault vma When the pagefault handling code was moved to a new file, an extra drm_exec_init() was added to the VMA path. This call is unnecessary because xe_validation_ctx_init() already performs a drm_exec_init(), resulting in a memory leak reported by kmemleak. Remove the redundant drm_exec_init() from the VMA pagefault handling code. Fixes: fb544b844508 ("drm/xe: Implement xe_pagefault_queue_work") Cc: Matthew Brost Cc: Stuart Summers Cc: Lucas De Marchi Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: Sumit Semwal Cc: "Christian König" Cc: intel-xe@lists.freedesktop.org Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Signed-off-by: Mika Kuoppala Reviewed-by: Thomas Hellström Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20251120161435.3674556-1-mika.kuoppala@linux.intel.com (cherry picked from commit 62519b77aecad22b525eda482660ffa127e7ad80) Signed-off-by: Thomas Hellström commit 263e954a4c92467d011faa458d127a76715547e5 Author: Yury Norov Date: Wed Jul 16 13:29:17 2025 -0400 mips: kvm: simplify kvm_mips_deliver_interrupts() The function opencodes for_each_set_bit() macro, which makes it bulky. Using the proper API makes all the housekeeping code go away. Signed-off-by: Yury Norov Signed-off-by: Thomas Bogendoerfer commit 4ebb6c951551714e7c1304c251a7d166cecd5a03 Author: Dmitry Torokhov Date: Mon Aug 11 15:41:28 2025 -0700 MIPS: alchemy: mtx1: switch to static device properties Convert GPIO-connected buttons and LEDs on MTX1 board to software nodes/properties, so that support for platform data can be removed from gpio-keys driver (which will rely purely on generic device properties for configuration). Signed-off-by: Dmitry Torokhov Signed-off-by: Thomas Bogendoerfer commit 58508479b5ccf10b8626b6e4a115e042c47c7fb7 Author: Vishal Moola (Oracle) Date: Fri Nov 7 15:27:58 2025 -0800 mips: Remove __GFP_HIGHMEM masking Remove unnecessary __GFP_HIGHMEM masking, which was introduced with commit 3e14fb19ad7c ("mips: convert various functions to use ptdescs"). GFP_KERNEL doesn't contain __GFP_HIGHMEM. Signed-off-by: Vishal Moola (Oracle) Signed-off-by: Thomas Bogendoerfer commit 36dac9a3dda1f2bae343191bc16b910c603cac25 Author: Gregory CLEMENT Date: Fri Nov 28 09:30:06 2025 +0100 MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section. This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot. This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel. Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 4f0b3cd7b664e662e9c4480e8d58574ece8aea57 Author: Rob Herring (Arm) Date: Thu Nov 20 14:47:16 2025 -0600 MIPS: dts: Always descend vendor subdirectories Commit 41528ba6afe6 ("MIPS: DTS: Only build subdir of current platform") broke building of all DTBs when CONFIG_OF_ALL_DTBS is enabled unless all the various kconfig options were also enabled. The only effect that commit had was getting rid of some harmless build lines such as: AR arch/mips/boot/dts/mti/built-in.a Those lines were part of the built-in DTB support. Since commit 04e4ec98e405 ("MIPS: migrate to generic rule for built-in DTBs"), how the built-in DTBs are handled has changed and those lines are no longer generated, so revert to the prior behavior. Signed-off-by: Rob Herring (Arm) Signed-off-by: Thomas Bogendoerfer commit eb6ac268a7c9b9e1c57daac4c68b634049d3d8c6 Author: Keguang Zhang Date: Sun Nov 16 18:08:33 2025 +0800 mips: configs: loongson1: Update defconfig Update loongson1_defconfig to reflect recent Kconfig changes: - Replace CONFIG_MTD_NAND_LOONGSON1 with CONFIG_MTD_NAND_LOONGSON, since commit 7a1e3a452a57 ("mtd: rawnand: loongson1: Rename the prefix from ls1x to loongson"). - Enable CONFIG_ETHTOOL_NETLINK, since commit 9ff2aa4206ef ("net: ethtool: mm: extract stmmac verification logic into common library") makes STMMAC_ETH depend on it. In addition: - Enable CONFIG_JUMP_LABEL to allow optimized static branch handling. - Disable unnecessary options. - Enable CONFIG_TEST_DHRY as a module. Fixes: 7a1e3a452a57 ("mtd: rawnand: loongson1: Rename the prefix from ls1x to loongson") Fixes: 9ff2aa4206ef ("net: ethtool: mm: extract stmmac verification logic into common library") Signed-off-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer commit c8610c021be3808f0913b8d79822d22e05a5fbcf Author: Gregory CLEMENT Date: Mon Oct 27 17:15:35 2025 +0100 MIPS: Fix HOTPLUG_PARALLEL dependency With MIPS, it is possible to have SMP enabled without HOTPLUG_CPU selected. However, in kernel/cpu.c, some code that uses HOTPLUG_PARALLEL also requires HOTPLUG_CPU to be selected. Therefore, we should fix the HOTPLUG_PARALLEL dependency to depend on HOTPLUG_CPU, not just SMP. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510270120.21wA1aX1-lkp@intel.com/ Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 3eef0c83c3f3e58933e98e678ddf4e95457d4d14 Merge: 938309b028baa8 d52aca16356548 Author: Oliver Upton Date: Mon Dec 1 00:47:41 2025 -0800 Merge branch 'kvm-arm64/nv-xnx-haf' into kvmarm/next * kvm-arm64/nv-xnx-haf: (22 commits) : Support for FEAT_XNX and FEAT_HAF in nested : : Add support for a couple of MMU-related features that weren't : implemented by KVM's software page table walk: : : - FEAT_XNX: Allows the hypervisor to describe execute permissions : separately for EL0 and EL1 : : - FEAT_HAF: Hardware update of the Access Flag, which in the context of : nested means software walkers must also set the Access Flag. : : The series also adds some basic support for testing KVM's emulation of : the AT instruction, including the implementation detail that AT sets the : Access Flag in KVM. KVM: arm64: at: Update AF on software walk only if VM has FEAT_HAFDBS KVM: arm64: at: Use correct HA bit in TCR_EL2 when regime is EL2 KVM: arm64: Document KVM_PGTABLE_PROT_{UX,PX} KVM: arm64: Fix spelling mistake "Unexpeced" -> "Unexpected" KVM: arm64: Add break to default case in kvm_pgtable_stage2_pte_prot() KVM: arm64: Add endian casting to kvm_swap_s[12]_desc() KVM: arm64: Fix compilation when CONFIG_ARM64_USE_LSE_ATOMICS=n KVM: arm64: selftests: Add test for AT emulation KVM: arm64: nv: Expose hardware access flag management to NV guests KVM: arm64: nv: Implement HW access flag management in stage-2 SW PTW KVM: arm64: Implement HW access flag management in stage-1 SW PTW KVM: arm64: Propagate PTW errors up to AT emulation KVM: arm64: Add helper for swapping guest descriptor KVM: arm64: nv: Use pgtable definitions in stage-2 walk KVM: arm64: Handle endianness in read helper for emulated PTW KVM: arm64: nv: Stop passing vCPU through void ptr in S2 PTW KVM: arm64: Call helper for reading descriptors directly KVM: arm64: nv: Advertise support for FEAT_XNX KVM: arm64: Teach ptdump about FEAT_XNX permissions KVM: arm64: nv: Forward FEAT_XNX permissions to the shadow stage-2 ... Signed-off-by: Oliver Upton commit 938309b028baa877909782bd4c0befee8d46e059 Merge: 11b8e6edc15113 64d67e7add109b Author: Oliver Upton Date: Mon Dec 1 00:47:32 2025 -0800 Merge branch 'kvm-arm64/vgic-lr-overflow' into kvmarm/next * kvm-arm64/vgic-lr-overflow: (50 commits) : Support for VGIC LR overflows, courtesy of Marc Zyngier : : Address deficiencies in KVM's GIC emulation when a vCPU has more active : IRQs than can be represented in the VGIC list registers. Sort the AP : list to prioritize inactive and pending IRQs, potentially spilling : active IRQs outside of the LRs. : : Handle deactivation of IRQs outside of the LRs for both EOImode=0/1, : which involves special consideration for SPIs being deactivated from a : different vCPU than the one that acked it. KVM: arm64: Convert ICH_HCR_EL2_TDIR cap to EARLY_LOCAL_CPU_FEATURE KVM: arm64: selftests: vgic_irq: Add timer deactivation test KVM: arm64: selftests: vgic_irq: Add Group-0 enable test KVM: arm64: selftests: vgic_irq: Add asymmetric SPI deaectivation test KVM: arm64: selftests: vgic_irq: Perform EOImode==1 deactivation in ack order KVM: arm64: selftests: vgic_irq: Remove LR-bound limitation KVM: arm64: selftests: vgic_irq: Exclude timer-controlled interrupts KVM: arm64: selftests: vgic_irq: Change configuration before enabling interrupt KVM: arm64: selftests: vgic_irq: Fix GUEST_ASSERT_IAR_EMPTY() helper KVM: arm64: selftests: gic_v3: Disable Group-0 interrupts by default KVM: arm64: selftests: gic_v3: Add irq group setting helper KVM: arm64: GICv2: Always trap GICV_DIR register KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps KVM: arm64: GICv2: Handle LR overflow when EOImode==0 KVM: arm64: GICv3: Force exit to sync ICH_HCR_EL2.En KVM: arm64: GICv3: nv: Plug L1 LR sync into deactivation primitive KVM: arm64: GICv3: nv: Resync LRs/VMCR/HCR early for better MI emulation KVM: arm64: GICv3: Avoid broadcast kick on CPUs lacking TDIR KVM: arm64: GICv3: Handle in-LR deactivation when possible KVM: arm64: GICv3: Add SPI tracking to handle asymmetric deactivation ... Signed-off-by: Oliver Upton commit 11b8e6edc15113058fff6d468ed0f53e2419b217 Merge: 404c2027d52809 4debb5e8952e43 Author: Oliver Upton Date: Mon Dec 1 00:47:20 2025 -0800 Merge branch 'kvm-arm64/sea-user' into kvmarm/next * kvm-arm64/sea-user: : Userspace handling of SEAs, courtesy of Jiaqi Yan : : Add support for processing external aborts in userspace in situations : where the host has failed to do so, allowing the VMM to potentially : reinject an external abort into the VM. Documentation: kvm: new UAPI for handling SEA KVM: selftests: Test for KVM_EXIT_ARM_SEA KVM: arm64: VM exit to userspace to handle SEA Signed-off-by: Oliver Upton commit 404c2027d52809494f43fe5fe9b1af54778ecc44 Merge: dcb6fa37fd7bc9 4ddfab5436b691 Author: Oliver Upton Date: Mon Dec 1 00:47:12 2025 -0800 Merge branch 'kvm-arm64/misc' into kvmarm/next * kvm-arm64/misc: : Miscellaneous fixes/cleanups for KVM/arm64 : : - Fix for need_resched warnings on non-preemptible kernels when : tearing down a VM's stage-2 : : - Improvements to KVM struct allocation, getting rid of pointless : __GFP_HIGHMEM and switching to kvzalloc() : : - SYNC ITS configuration before injecting LPIs in vgic_lpi_stress : selftest KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables KVM: arm64: Split kvm_pgtable_stage2_destroy() KVM: arm64: Only drop references on empty tables in stage2_free_walker KVM: selftests: SYNC after guest ITS setup in vgic_lpi_stress KVM: selftests: Assert GICR_TYPER.Processor_Number matches selftest CPU number KVM: arm64: Use kvzalloc() for kvm struct allocation KVM: arm64: Drop useless __GFP_HIGHMEM from kvm struct allocation Signed-off-by: Oliver Upton commit 1f5556ec8b9efbb784aeb3536e147182dee73d0f Author: Michał Winiarski Date: Thu Nov 27 10:39:34 2025 +0100 vfio/xe: Add device specific vfio_pci driver variant for Intel graphics In addition to generic VFIO PCI functionality, the driver implements VFIO migration uAPI, allowing userspace to enable migration for Intel Graphics SR-IOV Virtual Functions. The driver binds to VF device and uses API exposed by Xe driver to transfer the VF migration data under the control of PF device. Acked-by: Rodrigo Vivi Reviewed-by: Kevin Tian Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20251127093934.1462188-5-michal.winiarski@intel.com Link: https://lore.kernel.org/all/20251128125322.34edbeaf.alex@shazbot.org/ Signed-off-by: Michał Winiarski (cherry picked from commit 2e38c50ae4929f0b954fee69d428db7121452867) Signed-off-by: Thomas Hellström commit d52aca1635654805a682afef176473793a63b588 Author: Alexandru Elisei Date: Fri Nov 28 10:09:46 2025 +0000 KVM: arm64: at: Update AF on software walk only if VM has FEAT_HAFDBS A guest can write 1 to TCR_ELx.HA, making the KVM software walker update the access flag in a table descriptor even if FEAT_HAFDBS is not present. Avoid this by making wi->ha depend on FEAT_HAFDBS being enabled in the VM, similar to how the software walker treats FEAT_HPDS. This is not needed for VTCR_EL2.HA, since a guest will always write to the in-memory copy of the register, where the HA bit is masked (set to 0) by KVM if the VM doesn't have FEAT_HAFDBS. Fixes: c59ca4b5b0c3 ("KVM: arm64: Implement HW access flag management in stage-1 SW PTW") Signed-off-by: Alexandru Elisei Link: https://msgid.link/20251128100946.74210-5-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit e88d60c0aa0abbaade177b84f54a868c67231cd7 Author: Alexandru Elisei Date: Fri Nov 28 10:09:44 2025 +0000 KVM: arm64: at: Use correct HA bit in TCR_EL2 when regime is EL2 According to ARM DDI 0487L.b, the HA bit in TCR_EL2 when the translation regime is EL2 (or !ELIsInHost(EL2)) is bit 21, not 39. Fixes: c59ca4b5b0c3 ("KVM: arm64: Implement HW access flag management in stage-1 SW PTW") Signed-off-by: Alexandru Elisei Link: https://msgid.link/20251128100946.74210-3-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit 93e8d997812b315bbec946e874171a8b7d785eaf Author: Alexandru Elisei Date: Fri Nov 28 10:09:43 2025 +0000 KVM: arm64: Document KVM_PGTABLE_PROT_{UX,PX} Commit 2608563b466b ("KVM: arm64: Add support for FEAT_XNX stage-2 permissions") added the KVM_PGTABLE_PROX_{UX,PX} permissions to stage 2 and to EL2 translation regimes, but left them undocumented. Let's fix that. Signed-off-by: Alexandru Elisei Link: https://msgid.link/20251128100946.74210-2-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit 05474b7bc75d215a147b44b339ba4e9638b74382 Author: Colin Ian King Date: Fri Nov 28 17:51:24 2025 +0000 KVM: arm64: Fix spelling mistake "Unexpeced" -> "Unexpected" There is a spelling mistake in a TEST_FAIL message. Fix it. Signed-off-by: Colin Ian King Link: https://msgid.link/20251128175124.319094-1-colin.i.king@gmail.com Signed-off-by: Oliver Upton commit d98a04dc190672bbd29654a159f7621e0c63adcf Author: Nathan Chancellor Date: Tue Nov 25 10:59:15 2025 -0700 KVM: arm64: Add break to default case in kvm_pgtable_stage2_pte_prot() Clang warns (or errors with CONFIG_WERROR=y / W=e): arch/arm64/kvm/hyp/pgtable.c:757:2: error: label at end of compound statement is a C23 extension [-Werror,-Wc23-extensions] 757 | } | ^ With older versions of clang (15 and older) and GCC (at least the minimum supported, 8.1), this is an unconditional hard error: arch/arm64/kvm/hyp/pgtable.c: In function 'kvm_pgtable_stage2_pte_prot': arch/arm64/kvm/hyp/pgtable.c:756:2: error: label at end of compound statement default: ^~~~~~~ arch/arm64/kvm/hyp/pgtable.c:756:10: error: label at end of compound statement: expected statement default: ^ ; Add a break statement to this default case to clear up the error/warning. Fixes: 2608563b466b ("KVM: arm64: Add support for FEAT_XNX stage-2 permissions") Signed-off-by: Nathan Chancellor Acked-by: Marc Zyngier Link: https://msgid.link/20251125-arm64-kvm-hyp-pgtable-fix-c23-ext-warn-v1-1-98b506ddefbf@kernel.org Signed-off-by: Oliver Upton commit b0fc8329ec98ea891a5e47821db6aee1d564bff6 Author: Marc Zyngier Date: Tue Nov 25 20:48:48 2025 +0000 KVM: arm64: Add endian casting to kvm_swap_s[12]_desc() Keep sparse quiet by explicitly casting endianness conversion when swapping S1 and S2 descriptors. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511260246.JQDGsQKa-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511260344.9XehvH5Q-lkp@intel.com/ Fixes: c59ca4b5b0c3f ("KVM: arm64: Implement HW access flag management in stage-1 SW PTW") Fixes: 39db933ba67f8 ("KVM: arm64: nv: Implement HW access flag management in stage-2 SW PTW") Signed-off-by: Marc Zyngier Link: https://msgid.link/20251125204848.1136383-1-maz@kernel.org Signed-off-by: Oliver Upton commit 36fe022f884bb936d911a0d2e93819aba11daceb Author: Oliver Upton Date: Mon Nov 24 15:54:09 2025 -0800 KVM: arm64: Fix compilation when CONFIG_ARM64_USE_LSE_ATOMICS=n __lse_swap_desc() is compiled unconditionally, even if LSE is disabled using the config option. Align with the spirit of the config option and fix some build errors due to __LSE_PREAMBLE being undefined with the application of some ifdeffery. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511250700.kAutzJFm-lkp@intel.com/ Link: https://msgid.link/20251124235409.1731253-1-oupton@kernel.org Signed-off-by: Oliver Upton commit 66f188858385d640163fbf866d9c11b7741da91a Author: Oliver Upton Date: Mon Nov 24 11:01:57 2025 -0800 KVM: arm64: selftests: Add test for AT emulation Add a basic test for AT emulation in the EL2&0 and EL1&0 translation regimes. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-16-oupton@kernel.org Signed-off-by: Oliver Upton commit d5bbb76f447420681abdcfa4ad32344d11188d00 Author: Oliver Upton Date: Mon Nov 24 11:01:56 2025 -0800 KVM: arm64: nv: Expose hardware access flag management to NV guests Everything is in place to update the access flag at S1 and S2. Expose support for the access flag flavor of FEAT_HAFDBS to NV guests. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-15-oupton@kernel.org Signed-off-by: Oliver Upton commit e4c7dfac2f1ab848ffd356b3e76827ea404bbd94 Author: Oliver Upton Date: Mon Nov 24 11:01:55 2025 -0800 KVM: arm64: nv: Implement HW access flag management in stage-2 SW PTW Give the stage-2 walk similar treatment to stage-1: update the access flag during the table walk and do so for any walk context. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-14-oupton@kernel.org Signed-off-by: Oliver Upton commit bff8aa213dee742b09151a34494418050afed948 Author: Oliver Upton Date: Mon Nov 24 11:01:54 2025 -0800 KVM: arm64: Implement HW access flag management in stage-1 SW PTW Atomically update the Access flag at stage-1 when the guest has configured the MMU to do so. Make the implementation choice (and liberal interpretation of speculation) that any access type updates the Access flag, including AT and CMO instructions. Restart the entire walk by returning to the exception-generating instruction in the case of a failed Access flag update. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-13-oupton@kernel.org Signed-off-by: Oliver Upton commit 92c6443222ca4289191d797ac79176c560886998 Author: Oliver Upton Date: Mon Nov 24 11:01:53 2025 -0800 KVM: arm64: Propagate PTW errors up to AT emulation KVM's software PTW will soon support 'hardware' updates to the access flag. Similar to fault handling, races to update the descriptor will be handled by restarting the instruction. Prepare for this by propagating errors up to the AT emulation, only retiring the instruction if the walk succeeds. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-12-oupton@kernel.org Signed-off-by: Oliver Upton commit f6927b41d57390c597a126063e2e518911976878 Author: Oliver Upton Date: Mon Nov 24 11:01:52 2025 -0800 KVM: arm64: Add helper for swapping guest descriptor Implementing FEAT_HAFDBS in KVM's software PTWs requires the ability to CAS a descriptor to update the in-memory value. Add an accessor to do exactly that, coping with the fact that guest descriptors are in user memory (duh). While FEAT_LSE required on any system that implements NV, KVM now uses the stage-1 PTW for non-nested use cases meaning an LL/SC implementation is necessary as well. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-11-oupton@kernel.org Signed-off-by: Oliver Upton commit 590e694820bfd70e3de78fcb98b16c98a905230e Author: Oliver Upton Date: Mon Nov 24 11:01:51 2025 -0800 KVM: arm64: nv: Use pgtable definitions in stage-2 walk Use the existing page table definitions instead of magic numbers for the stage-2 table walk. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-10-oupton@kernel.org Signed-off-by: Oliver Upton commit fabf321cba4be0d0dcbb39e97c3deb572fec2f8d Author: Oliver Upton Date: Mon Nov 24 11:01:50 2025 -0800 KVM: arm64: Handle endianness in read helper for emulated PTW Implementing FEAT_HAFDBS means adding another descriptor accessor that needs to deal with the guest-configured endianness. Prepare by moving the endianness handling into the read accessor and out of the main body of the S1/S2 PTWs. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-9-oupton@kernel.org Signed-off-by: Oliver Upton commit 977d1bf15c5179276d93468abbc00a224908ff72 Author: Oliver Upton Date: Mon Nov 24 11:01:49 2025 -0800 KVM: arm64: nv: Stop passing vCPU through void ptr in S2 PTW The stage-2 table walker passes down the vCPU as a void pointer. That might've made sense if the walker was generic although at this point it is clear this will only ever be used in the context of a vCPU. Suggested-by: Marc Zyngier Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-8-oupton@kernel.org Signed-off-by: Oliver Upton commit cdba9da34b145eb2f3c502279a454f9a1a8346c1 Author: Oliver Upton Date: Mon Nov 24 11:01:48 2025 -0800 KVM: arm64: Call helper for reading descriptors directly Going through a function pointer doesn't serve much purpose when there's only one implementation. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-7-oupton@kernel.org Signed-off-by: Oliver Upton commit 692650bd7b12532798c2022cb53869a07a288fbe Author: Oliver Upton Date: Mon Nov 24 11:01:47 2025 -0800 KVM: arm64: nv: Advertise support for FEAT_XNX Everything is in place to support FEAT_XNX, advertise support. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-6-oupton@kernel.org Signed-off-by: Oliver Upton commit 6b49f70022ed607bab66da60c7b332f39cda4ff1 Author: Oliver Upton Date: Mon Nov 24 11:01:46 2025 -0800 KVM: arm64: Teach ptdump about FEAT_XNX permissions Although KVM doesn't make direct use of the feature, guest hypervisors can use FEAT_XNX which influences the permissions of the shadow stage-2. Update ptdump to separately print the privileged and unprivileged execute permissions. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-5-oupton@kernel.org Signed-off-by: Oliver Upton commit bd45d46ffc8fa96e8ee9fa078cef53e0c1221ff4 Author: Michał Winiarski Date: Thu Nov 27 10:39:33 2025 +0100 drm/xe/pf: Export helpers for VFIO Device specific VFIO driver variant for Xe will implement VF migration. Export everything that's needed for migration ops. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251127093934.1462188-4-michal.winiarski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 17f22465c5a5573724c942ca7147b4024631ef87) Signed-off-by: Thomas Hellström commit 5be29ebe9f059f2afadd2a725e12aa25e900b6fb Author: Michał Winiarski Date: Thu Nov 27 10:39:32 2025 +0100 drm/xe/pci: Introduce a helper to allow VF access to PF xe_device In certain scenarios (such as VF migration), VF driver needs to interact with PF driver. Add a helper to allow VF driver access to PF xe_device. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251127093934.1462188-3-michal.winiarski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 8b3cce3ad9c78ce3dae1c178f99352d50e12a3c0) Signed-off-by: Thomas Hellström commit 73834d03a523e09d64e7978265f1edd33640bf3f Author: Michał Winiarski Date: Thu Nov 27 10:39:31 2025 +0100 drm/xe/pf: Enable SR-IOV VF migration All of the necessary building blocks are now in place to support SR-IOV VF migration. Flip the enable/disable logic to match VF code and disable the feature only for platforms that don't meet the necessary prerequisites. To allow more testing and experiments, on DEBUG builds any missing prerequisites will be ignored. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251127093934.1462188-2-michal.winiarski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 01c724aa7bf84e9d081a56e0cbf1d282678ce144) Signed-off-by: Thomas Hellström commit 50a59230fa63989d59253622a8dd6386cca0db07 Author: Matt Roper Date: Tue Nov 18 08:43:41 2025 -0800 drm/xe/pm: Add scope-based cleanup helper for runtime PM Add a scope-based helpers for runtime PM that may be used to simplify cleanup logic and potentially avoid goto-based cleanup. For example, using guard(xe_pm_runtime)(xe); will get runtime PM and cause a corresponding put to occur automatically when the current scope is exited. 'xe_pm_runtime_noresume' can be used as a guard replacement for the corresponding 'noresume' variant. There's also an xe_pm_runtime_ioctl conditional guard that can be used as a replacement for xe_runtime_ioctl(): ACQUIRE(xe_pm_runtime_ioctl, pm)(xe); if ((ret = ACQUIRE_ERR(xe_pm_runtime_ioctl, &pm)) < 0) /* failed */ In a few rare cases (such as gt_reset_worker()) we need to ensure that runtime PM is dropped when the function is exited by any means (including error paths), but the function does not need to acquire runtime PM because that has already been done earlier by a different function. For these special cases, an 'xe_pm_runtime_release_only' guard can be used to handle the release without doing an acquisition. These guards will be used in future patches to eliminate some of our goto-based cleanup. v2: - Specify success condition for xe_pm runtime_ioctl as _RET >= 0 so that positive values will be properly identified as success and trigger destructor cleanup properly. v3: - Add comments to the kerneldoc for the existing 'get' functions indicating that scope-based handling should be preferred where possible. (Gustavo) Cc: Gustavo Sousa Reviewed-by: Michal Wajdeczko Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20251118164338.3572146-31-matthew.d.roper@intel.com Signed-off-by: Matt Roper (cherry picked from commit 59e7528dbfd52efbed05e0f11b2143217a12bc74) Signed-off-by: Thomas Hellström commit 7448a8d6909a488304ff402c414b14606b8472c4 Author: Krzysztof Kozlowski Date: Thu Nov 20 18:55:38 2025 +0100 MAINTAINERS: phy: Move Kishon Vijay Abraham I to credits There wasn't much of reviewing activity from Kishon of PHY subsystem during last few years [1] and last maintainer commit is from 2020, so move Kishon to Credits to indicate that PHY subsystem has only one active maintainer. Thank you Kishon for working on the PHY subsystem and for all the maintenance effort. Link: https://lore.kernel.org/all/?q=f%3A%22Kishon+Vijay+Abraham+I%22 [1] Cc: Kishon Vijay Abraham I Cc: Kishon Vijay Abraham I Cc: Vinod Koul Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251120175537.171340-2-krzk@kernel.org Signed-off-by: Vinod Koul commit 0bdbf89a8bbeb155644b69dc2d071a1ce23414f8 Author: Gao Xiang Date: Mon Dec 1 10:38:16 2025 +0800 erofs: switch on-disk header `erofs_fs.h` to MIT license Switch to the permissive MIT license to make the EROFS on-disk format more interoperable across various use cases. It was previously recommended by the Composefs folks, for example: https://github.com/composefs/composefs/pull/216#discussion_r1356409501 Signed-off-by: Gao Xiang Acked-by: Jingbo Xu Acked-by: Yue Hu Acked-by: Chao Yu Acked-by: Jianan Huang Acked-by: Chunhai Guo Acked-by: Hongbo Li commit 43decb6b628eb033a1b6188e5018773c0d38be1d Author: Randy Dunlap Date: Thu Nov 27 22:59:25 2025 -0800 locking/local_lock: Fix all kernel-doc warnings Modify kernel-doc comments in local_lock.h to prevent warnings: Warning: include/linux/local_lock.h:9 function parameter 'lock' not described in 'local_lock_init' Warning: include/linux/local_lock.h:56 function parameter 'lock' not described in 'local_trylock_init' Warning: include/linux/local_lock.h:56 expecting prototype for local_lock_init(). Prototype was for local_trylock_init() instead Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251128065925.917917-1-rdunlap@infradead.org commit 719e357fc09c63238956eb7cd546627f9e050640 Author: Vincent Mailhol Date: Thu Nov 27 15:41:40 2025 +0100 locking/local_lock: s/l/__l/ and s/tl/__tl/ to reduce the risk of shadowing The Linux kernel coding style advises to avoid common variable names in function-like macros to reduce the risk of namespace collisions. Throughout local_lock_internal.h, several macros use the rather common variable names 'l' and 'tl'. This already resulted in an actual collision: the __local_lock_acquire() function like macro is currently shadowing the parameter 'l' of the: class_##_name##_t class_##_name##_constructor(_type *l) function factory from . Rename the variable 'l' to '__l' and the variable 'tl' to '__tl' throughout the file to fix the current namespace collision and to prevent future ones. [ bigeasy: Rebase, update all l and tl instances in macros ] Signed-off-by: Vincent Mailhol Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Waiman Long Link: https://patch.msgid.link/20251127144140.215722-3-bigeasy@linutronix.de commit 52ed746147140e30419ee852c1916531b4ef9b0a Author: Sebastian Andrzej Siewior Date: Thu Nov 27 15:41:39 2025 +0100 locking/local_lock: Add the headers to MAINTAINERS The local_lock_t was never added to the MAINTAINERS file since its inclusion. Add local_lock_t to the locking primitives section. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Waiman Long Link: https://patch.msgid.link/20251127144140.215722-2-bigeasy@linutronix.de commit 51d7a054521de7085783a9a1ba15c3530863409a Author: Sebastian Andrzej Siewior Date: Wed Nov 5 15:23:50 2025 +0100 locking/mutex: Redo __mutex_init() to reduce generated code size mutex_init() invokes __mutex_init() providing the name of the lock and a pointer to a the lock class. With LOCKDEP enabled this information is useful but without LOCKDEP it not used at all. Passing the pointer information of the lock class might be considered negligible but the name of the lock is passed as well and the string is stored. This information is wasting storage. Split __mutex_init() into a _genereic() variant doing the initialisation of the lock and a _lockdep() version which does _genereic() plus the lockdep bits. Restrict the lockdep version to lockdep enabled builds allowing the compiler to remove the unused parameter. This results in the following size reduction: text data bss dec filename | 30237599 8161430 1176624 39575653 vmlinux.defconfig | 30233269 8149142 1176560 39558971 vmlinux.defconfig.patched -4.2KiB -12KiB | 32455099 8471098 12934684 53860881 vmlinux.defconfig.lockdep | 32455100 8471098 12934684 53860882 vmlinux.defconfig.patched.lockdep | 27152407 7191822 2068040 36412269 vmlinux.defconfig.preempt_rt | 27145937 7183630 2067976 36397543 vmlinux.defconfig.patched.preempt_rt -6.3KiB -8KiB | 29382020 7505742 13784608 50672370 vmlinux.defconfig.preempt_rt.lockdep | 29376229 7505742 13784544 50666515 vmlinux.defconfig.patched.preempt_rt.lockdep -5.6KiB [peterz: folded fix from boqun] Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Boqun Feng Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Waiman Long Link: https://lkml.kernel.org/r/20251125145425.68319-1-boqun.feng@gmail.com Link: https://patch.msgid.link/20251105142350.Tfeevs2N@linutronix.de commit e1469f56089fc00bc94706a07c5cd63fa3e8625b Author: David Howells Date: Tue Aug 5 09:57:45 2025 +0100 cifs: Use netfs_alloc/free_folioq_buffer() Use netfs_alloc/free_folioq_buffer() rather than doing its own version. Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: Shyam Prasad N cc: Tom Talpey (RDMA, smbdirect) cc: linux-cifs@vger.kernel.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit f78b83dce273ff2d9a4515b2945ec427e675c204 Author: Bharath SM Date: Thu Oct 30 00:40:36 2025 +0530 smb: client: show smb lease key in open_dirs output Show cached directory smb lease key in /proc/fs/cifs/open_dirs for debugging purposes. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 9cfcd8601e56fd5e1fdb3adae57322fa5d7d3689 Author: Bharath SM Date: Thu Oct 30 00:34:29 2025 +0530 smb: client: show smb lease key in open_files output Add the SMB lease key in /proc/fs/cifs/open_files for debugging purposes. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 1fab1fa091f5aa97265648b53ea031deedd26235 Author: Qianchang Zhao Date: Wed Nov 26 12:24:18 2025 +0900 ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event(): BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd] Write of size 12 at addr ffff888198ee6e20 by task pool/109349 ... Freed by task: kvfree ipc_msg_send_request [ksmbd] ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd] Fix by: - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table. - Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock. - Returning NULL in the error path, preserving the original API semantics. This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF. Cc: stable@vger.kernel.org Reported-by: Qianchang Zhao Reported-by: Zhitong Liu Signed-off-by: Qianchang Zhao Acked-by: Namjae Jeon Signed-off-by: Steve French commit dc10cf1368af8cb816dcaa2502ba7d44fff20612 Author: Stefan Metzmacher Date: Tue Nov 25 15:21:54 2025 +0100 smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() sc->first_error might already be set and sc->status is thus unexpected, so this should avoid the WARN[_ON]_ONCE() if sc->first_error is already set and have a usable error path. While there set sc->first_error as soon as possible. This is done based on a problem seen in similar places on the server. And there it was already very useful in order to find the problem when we have a meaningful WARN_ONCE() that prints details about the connection. This is much more useful: [ 309.560973] expected[NEGOTIATE_NEEDED] != RDMA_CONNECT_RUNNING first_error=0 local=192.168.0.200:445 remote=192.168.0.100:60445 [ 309.561034] WARNING: CPU: 2 PID: 78 at transport_rdma.c:643 recv_done+0x2fa/0x3d0 [ksmbd] than what we had before (only): [ 894.140316] WARNING: CPU: 1 PID: 116 at fs/smb/server/transport_rdma.c:642 recv_done+0x308/0x360 [ksmbd] Fixes: 58dfba8a2d4e ("smb: client/smbdirect: replace SMBDIRECT_SOCKET_CONNECTING with more detailed states") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Paulo Alcantara Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 425c32750b48956a6e156b6a4609d281ee471359 Author: Stefan Metzmacher Date: Tue Nov 25 15:21:53 2025 +0100 smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() Namjae reported the following: I have a simple file copy test with windows 11 client, and get the following error message. [ 894.140312] ------------[ cut here ]------------ [ 894.140316] WARNING: CPU: 1 PID: 116 at fs/smb/server/transport_rdma.c:642 recv_done+0x308/0x360 [ksmbd] [ 894.140335] Modules linked in: ksmbd cmac nls_utf8 nls_ucs2_utils libarc4 nls_iso8859_1 snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic rpcrdma intel_rapl_msr rdma_ucm intel_rapl_common snd_hda_intel ib_iser snd_hda_codec intel_uncore_frequency intel_uncore_frequency_common snd_hda_core intel_tcc_cooling x86_pkg_temp_thermal intel_powerclamp snd_intel_dspcfg libiscsi snd_intel_sdw_acpi coretemp scsi_transport_iscsi snd_hwdep kvm_intel i915 snd_pcm ib_umad rdma_cm snd_seq_midi ib_ipoib kvm snd_seq_midi_event iw_cm snd_rawmidi ghash_clmulni_intel ib_cm aesni_intel snd_seq mei_hdcp drm_buddy rapl snd_seq_device eeepc_wmi asus_wmi snd_timer intel_cstate ttm snd drm_client_lib drm_display_helper sparse_keymap soundcore platform_profile mxm_wmi wmi_bmof joydev mei_me cec acpi_pad mei rc_core drm_kms_helper input_leds i2c_algo_bit mac_hid sch_fq_codel msr parport_pc ppdev lp nfsd parport auth_rpcgss binfmt_misc nfs_acl lockd grace drm sunrpc ramoops efi_pstore [ 894.140414] reed_solomon pstore_blk pstore_zone autofs4 btrfs blake2b_generic xor raid6_pq mlx5_ib ib_uverbs ib_core hid_generic uas usbhid hid r8169 i2c_i801 usb_storage i2c_mux i2c_smbus mlx5_core realtek ahci mlxfw psample libahci video wmi [last unloaded: ksmbd] [ 894.140442] CPU: 1 UID: 0 PID: 116 Comm: kworker/1:1H Tainted: G W 6.18.0-rc5+ #1 PREEMPT(voluntary) [ 894.140447] Tainted: [W]=WARN [ 894.140448] Hardware name: System manufacturer System Product Name/H110M-K, BIOS 3601 12/12/2017 [ 894.140450] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core] [ 894.140476] RIP: 0010:recv_done+0x308/0x360 [ksmbd] [ 894.140487] Code: 2e f2 ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 41 8b 55 10 49 8b 75 08 b9 02 00 00 00 e8 ed f4 f2 c3 e9 59 fd ff ff <0f> 0b e9 02 ff ff ff 49 8b 74 24 28 49 8d 94 24 c8 00 00 00 bf 00 [ 894.140490] RSP: 0018:ffffa47ec03f3d78 EFLAGS: 00010293 [ 894.140492] RAX: 0000000000000001 RBX: ffff8eb84c818000 RCX: 000000010002ba00 [ 894.140494] RDX: 0000000037600001 RSI: 0000000000000083 RDI: ffff8eb92ec9ee40 [ 894.140496] RBP: ffffa47ec03f3da0 R08: 0000000000000000 R09: 0000000000000010 [ 894.140498] R10: ffff8eb801705680 R11: fefefefefefefeff R12: ffff8eb7454b8810 [ 894.140499] R13: ffff8eb746deb988 R14: ffff8eb746deb980 R15: ffff8eb84c818000 [ 894.140501] FS: 0000000000000000(0000) GS:ffff8eb9a7355000(0000) knlGS:0000000000000000 [ 894.140503] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 894.140505] CR2: 00002d9401d60018 CR3: 0000000010a40006 CR4: 00000000003726f0 [ 894.140507] Call Trace: [ 894.140509] [ 894.140512] __ib_process_cq+0x8e/0x190 [ib_core] [ 894.140530] ib_cq_poll_work+0x2f/0x90 [ib_core] [ 894.140545] process_scheduled_works+0xd4/0x430 [ 894.140554] worker_thread+0x12a/0x270 [ 894.140558] kthread+0x10d/0x250 [ 894.140564] ? __pfx_worker_thread+0x10/0x10 [ 894.140567] ? __pfx_kthread+0x10/0x10 [ 894.140571] ret_from_fork+0x11a/0x160 [ 894.140574] ? __pfx_kthread+0x10/0x10 [ 894.140577] ret_from_fork_asm+0x1a/0x30 [ 894.140584] [ 894.140585] ---[ end trace 0000000000000000 ]--- [ 894.154363] ------------[ cut here ]------------ [ 894.154367] WARNING: CPU: 3 PID: 5543 at fs/smb/server/transport_rdma.c:1728 smb_direct_cm_handler+0x121/0x130 [ksmbd] [ 894.154384] Modules linked in: ksmbd cmac nls_utf8 nls_ucs2_utils libarc4 nls_iso8859_1 snd_hda_codec_intelhdmi snd_hda_codec_hdmi snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic rpcrdma intel_rapl_msr rdma_ucm intel_rapl_common snd_hda_intel ib_iser snd_hda_codec intel_uncore_frequency intel_uncore_frequency_common snd_hda_core intel_tcc_cooling x86_pkg_temp_thermal intel_powerclamp snd_intel_dspcfg libiscsi snd_intel_sdw_acpi coretemp scsi_transport_iscsi snd_hwdep kvm_intel i915 snd_pcm ib_umad rdma_cm snd_seq_midi ib_ipoib kvm snd_seq_midi_event iw_cm snd_rawmidi ghash_clmulni_intel ib_cm aesni_intel snd_seq mei_hdcp drm_buddy rapl snd_seq_device eeepc_wmi asus_wmi snd_timer intel_cstate ttm snd drm_client_lib drm_display_helper sparse_keymap soundcore platform_profile mxm_wmi wmi_bmof joydev mei_me cec acpi_pad mei rc_core drm_kms_helper input_leds i2c_algo_bit mac_hid sch_fq_codel msr parport_pc ppdev lp nfsd parport auth_rpcgss binfmt_misc nfs_acl lockd grace drm sunrpc ramoops efi_pstore [ 894.154456] reed_solomon pstore_blk pstore_zone autofs4 btrfs blake2b_generic xor raid6_pq mlx5_ib ib_uverbs ib_core hid_generic uas usbhid hid r8169 i2c_i801 usb_storage i2c_mux i2c_smbus mlx5_core realtek ahci mlxfw psample libahci video wmi [last unloaded: ksmbd] [ 894.154483] CPU: 3 UID: 0 PID: 5543 Comm: kworker/3:6 Tainted: G W 6.18.0-rc5+ #1 PREEMPT(voluntary) [ 894.154487] Tainted: [W]=WARN [ 894.154488] Hardware name: System manufacturer System Product Name/H110M-K, BIOS 3601 12/12/2017 [ 894.154490] Workqueue: ib_cm cm_work_handler [ib_cm] [ 894.154499] RIP: 0010:smb_direct_cm_handler+0x121/0x130 [ksmbd] [ 894.154507] Code: e7 e8 13 b1 ef ff 44 89 e1 4c 89 ee 48 c7 c7 80 d7 59 c1 48 89 c2 e8 2e 4d ef c3 31 c0 5b 41 5c 41 5d 41 5e 5d c3 cc cc cc cc <0f> 0b eb a5 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 [ 894.154510] RSP: 0018:ffffa47ec1b27c00 EFLAGS: 00010206 [ 894.154512] RAX: ffffffffc1304e00 RBX: ffff8eb89ae50880 RCX: 0000000000000000 [ 894.154514] RDX: ffff8eb730960000 RSI: ffffa47ec1b27c60 RDI: ffff8eb7454b9400 [ 894.154515] RBP: ffffa47ec1b27c20 R08: 0000000000000002 R09: ffff8eb730b8c18b [ 894.154517] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000009 [ 894.154518] R13: ffff8eb7454b9400 R14: ffff8eb7454b8810 R15: ffff8eb815c43000 [ 894.154520] FS: 0000000000000000(0000) GS:ffff8eb9a7455000(0000) knlGS:0000000000000000 [ 894.154522] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 894.154523] CR2: 00007fe1310e99d0 CR3: 0000000010a40005 CR4: 00000000003726f0 [ 894.154525] Call Trace: [ 894.154527] [ 894.154530] cma_cm_event_handler+0x27/0xd0 [rdma_cm] [ 894.154541] cma_ib_handler+0x99/0x2e0 [rdma_cm] [ 894.154551] cm_process_work+0x28/0xf0 [ib_cm] [ 894.154557] cm_queue_work_unlock+0x41/0xf0 [ib_cm] [ 894.154563] cm_work_handler+0x2eb/0x25b0 [ib_cm] [ 894.154568] ? pwq_activate_first_inactive+0x52/0x70 [ 894.154572] ? pwq_dec_nr_in_flight+0x244/0x330 [ 894.154575] process_scheduled_works+0xd4/0x430 [ 894.154579] worker_thread+0x12a/0x270 [ 894.154581] kthread+0x10d/0x250 [ 894.154585] ? __pfx_worker_thread+0x10/0x10 [ 894.154587] ? __pfx_kthread+0x10/0x10 [ 894.154590] ret_from_fork+0x11a/0x160 [ 894.154593] ? __pfx_kthread+0x10/0x10 [ 894.154596] ret_from_fork_asm+0x1a/0x30 [ 894.154602] [ 894.154603] ---[ end trace 0000000000000000 ]--- [ 894.154931] ksmbd: smb_direct: disconnected [ 894.157278] ksmbd: smb_direct: disconnected I guess sc->first_error is already set and sc->status is thus unexpected, so this should avoid the WARN[_ON]_ONCE() if sc->first_error is already set and have a usable error path. While there set sc->first_error as soon as possible. v1 of this patch revealed the real problem with this message: [ 309.560973] expected[NEGOTIATE_NEEDED] != RDMA_CONNECT_RUNNING first_error=0 local=192.168.0.200:445 remote=192.168.0.100:60445 [ 309.561034] WARNING: CPU: 2 PID: 78 at transport_rdma.c:643 recv_done+0x2fa/0x3d0 [ksmbd] Some drivers (at least mlx5_ib) might post a recv completion before RDMA_CM_EVENT_ESTABLISHED, so we need to adjust our expectation in that case. Fixes: e2d5e516c663 ("smb: server: only turn into SMBDIRECT_SOCKET_CONNECTED when negotiation is done") Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Paulo Alcantara Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1adb2dab9727c5beaaf253f67bf4fc2c54ae70e7 Author: Stefan Metzmacher Date: Tue Nov 25 09:55:55 2025 +0100 smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() These will be used in various places in order to assert the current status mostly during the connect and negotiation phase. It will replace the WARN_ON_ONCE(sc->status != ...) calls, which are very useless in order to identify the problem that happened. As a start client and server will need to define their own __SMBDIRECT_SOCKET_DISCONNECT(__sc) macro in order to use SMBDIRECT_CHECK_STATUS_DISCONNECT(). Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Paulo Alcantara Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1f3fd108c5c5a9885c6c276a2489c49b60a6b90d Author: Stefan Metzmacher Date: Tue Nov 25 09:55:54 2025 +0100 smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper This can be used like this: int err = somefunc(); pr_warn("err=%1pe\n", SMBDIRECT_DEBUG_ERR_PTR(err)); This will be used in the following fixes in order to be prepared to identify real world problems more easily. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: Paulo Alcantara Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 991f8a79db99b14c48d20d2052c82d65b9186cad Author: Qianchang Zhao Date: Mon Nov 24 16:05:09 2025 +0900 ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under inconsistent locking: some paths read and modify m_flags under ci->m_lock while others do so without taking the lock at all. Examples: - ksmbd_query_inode_status() and __ksmbd_inode_close() use ci->m_lock when checking or updating m_flags. - ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete() and ksmbd_fd_set_delete_on_close() used to read and modify m_flags without ci->m_lock. This creates a potential data race on m_flags when multiple threads open, close and delete the same file concurrently. In the worst case delete-on-close and pending-delete bits can be lost or observed in an inconsistent state, leading to confusing delete semantics (files that stay on disk after delete-on-close, or files that disappear while still in use). Fix it by: - Making ksmbd_query_inode_status() look at m_flags under ci->m_lock after dropping inode_hash_lock. - Adding ci->m_lock protection to all helpers that read or modify m_flags (ksmbd_inode_pending_delete(), ksmbd_set_inode_pending_delete(), ksmbd_clear_inode_pending_delete(), ksmbd_fd_set_delete_on_close()). - Keeping the existing ci->m_lock protection in __ksmbd_inode_close(), and moving the actual unlink/xattr removal outside the lock. This unifies the locking around m_flags and removes the data race while preserving the existing delete-on-close behaviour. Reported-by: Qianchang Zhao Reported-by: Zhitong Liu Signed-off-by: Qianchang Zhao Acked-by: Namjae Jeon Signed-off-by: Steve French commit dc81b8f4f0fc9e1be0c9ce8a918503e175b2c9b2 Author: Thorsten Blum Date: Wed Nov 19 14:02:30 2025 +0100 ksmbd: Replace strcpy + strcat to improve convert_to_nt_pathname strcpy() is deprecated [1] and using strcat() is discouraged. Replace them by assigning the prefix directly and by using memcpy() to copy the pathname. Using memcpy() is safe because we already know the length of the source string and that it is guaranteed to be NUL-terminated. Allocate only as many bytes as needed and replace kzalloc() with kmalloc() since memcpy() overwrites the entire buffer anyway. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Acked-by: Namjae Jeon Signed-off-by: Steve French commit c4a2a49f7df48147529158a092edfde1597d12f3 Author: ChenXiaoSong Date: Mon Nov 17 19:28:38 2025 +0800 smb: move FILE_SYSTEM_ATTRIBUTE_INFO to common/fscc.h Modify the following places: - struct filesystem_attribute_info -> FILE_SYSTEM_ATTRIBUTE_INFO - Remove MIN_FS_ATTR_INFO_SIZE definition - Introduce MAX_FS_NAME_LEN - max_len of FileFsAttributeInformation -> sizeof(FILE_SYSTEM_ATTRIBUTE_INFO) + MAX_FS_NAME_LEN - min_len of FileFsAttributeInformation -> sizeof(FILE_SYSTEM_ATTRIBUTE_INFO) - SMB2_QFS_attr(): memcpy(..., min_len) Then move FILE_SYSTEM_ATTRIBUTE_INFO to common header file. I have tested the relevant code related to FILE_SYSTEM_ATTRIBUTE_INFO (Link[1]). Link[1]: https://chenxiaosong.com/en/FILE_SYSTEM_ATTRIBUTE_INFO.html Suggested-by: Namjae Jeon Tested-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit e4442b2e95baf0901830c924d0a197b100aca970 Author: Aaditya Kansal Date: Tue Nov 18 00:20:31 2025 +0530 ksmbd: implement error handling for STATUS_INFO_LENGTH_MISMATCH in smb server Add STATUS_INFO_LENGTH_MISMATCH mapping to EMSGSIZE. Currently, STATUS_INFO_LENGTH_MISMATCH has no mapping to any error code, making it difficult to distinguish between invalid parameters and length mismatch. Map STATUS_INFO_LENGTH_MISMATCH to EMSGSIZE while keeping the EINVAL for invalid parameters. Although the buf_len check only checks for buf_size being less than required, there was no error code for lower buf_size. Hence, EMSGSIZE is used. Signed-off-by: Aaditya Kansal Acked-by: Namjae Jeon Signed-off-by: Steve French commit b39a1833cc4a2755b02603eec3a71a85e9dff926 Author: Namjae Jeon Date: Tue Nov 18 09:05:46 2025 +0900 ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it. Reported-by: Qianchang Zhao Reported-by: Zhitong Liu Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3316a8fc840d82fad5efcf76ad0ea3f76fdca209 Author: Qingfang Deng Date: Mon Nov 17 16:59:00 2025 +0800 ksmbd: server: avoid busy polling in accept loop The ksmbd listener thread was using busy waiting on a listening socket by calling kernel_accept() with SOCK_NONBLOCK and retrying every 100ms on -EAGAIN. Since this thread is dedicated to accepting new connections, there is no need for non-blocking mode. Switch to a blocking accept() call instead, allowing the thread to sleep until a new connection arrives. This avoids unnecessary wakeups and CPU usage. During teardown, call shutdown() on the listening socket so that accept() returns -EINVAL and the thread exits cleanly. The socket release mutex is redundant because kthread_stop() blocks until the listener thread returns, guaranteeing safe teardown ordering. Also remove sk_rcvtimeo and sk_sndtimeo assignments, which only caused accept() to return -EAGAIN prematurely. Signed-off-by: Qingfang Deng Reviewed-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5003ad718af7705d6a519445a897843fac88167a Author: ChenXiaoSong Date: Thu Nov 13 21:32:51 2025 +0800 smb: move create_durable_reconn to common/smb2pdu.h The fields in struct create_durable_reconn_req and struct create_durable are exactly the same, so remove create_durable_reconn_req from server, and use typedef to define both create_durable_req_t and create_durable_reconn_t for a single struct. Rename the following places: - struct create_durable -> create_durable_req_t - struct create_durable_reconn_req -> create_durable_reconn_t The documentation references are: - SMB2_CREATE_DURABLE_HANDLE_REQUEST in MS-SMB2 2.2.13.2.3 - SMB2_CREATE_DURABLE_HANDLE_RECONNECT in MS-SMB2 2.2.13.2.4 - SMB2_FILEID in MS-SMB2 2.2.14.1 Descriptions of the struct fields: - __u8 Reserved[16]: DurableRequest field of SMB2_CREATE_DURABLE_HANDLE_REQUEST. A 16-byte field that MUST be reserved. - __u64 PersistentFileId: Persistent field of 2.2.14.1 SMB2_FILEID - __u64 VolatileFileId: Volatile field of 2.2.14.1 SMB2_FILEID - struct Fid: Data field of SMB2_CREATE_DURABLE_HANDLE_RECONNECT. An SMB2_FILEID structure, as specified in section 2.2.14.1. Suggested-by: Namjae Jeon Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit e7e60e8bfcc5bfff0dc40a3b8ab275a4da6990a0 Author: ChenXiaoSong Date: Sun Nov 2 15:30:59 2025 +0800 smb: fix some warnings reported by scripts/checkpatch.pl Fix the following warnings: WARNING: __always_unused or __maybe_unused is preferred over \ __attribute__((__unused__)) WARNING: Prefer __packed over __attribute__((packed)) Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 95e8c1bfa56ebbc243779ee23782b30744da02f6 Author: ChenXiaoSong Date: Sun Nov 2 15:30:58 2025 +0800 smb: do some cleanups Modify the following places: - Add documentation references - ATTR_REPARSE -> ATTR_REPARSE_POINT: consistent with MS-SMB 2.2.1.2.1 - Remove unused File Attribute flags from server, if the server uses them in the future, we can move the client-side definitions to common - Remove unused SMB1_CLIENT_GUID_SIZE from server Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 464b913993a14b539e978db10c755bb202ab14ed Author: ChenXiaoSong Date: Sun Nov 2 15:30:56 2025 +0800 smb: move FILE_SYSTEM_SIZE_INFO to common/fscc.h Rename the following places: - struct filesystem_info -> FILE_SYSTEM_SIZE_INFO - FILE_SYSTEM_INFO -> FILE_SYSTEM_SIZE_INFO - FreeAllocationUnits -> AvailableAllocationUnits: consistent with MS-FSCC 2.5.8 Then move duplicate definitions to common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit d7edd3892d97e6746e30f36f4f13f887ec4d80ed Author: ChenXiaoSong Date: Sun Nov 2 15:30:55 2025 +0800 smb: move some duplicate struct definitions to common/fscc.h Modify the following places: - smb2_file_ntwrk_info -> smb2_file_network_open_info - struct filesystem_device_info -> FILE_SYSTEM_DEVICE_INFO - struct file_directory_info -> FILE_DIRECTORY_INFO - struct file_full_directory_info -> FILE_FULL_DIRECTORY_INFO - struct file_both_directory_info -> FILE_BOTH_DIRECTORY_INFO - struct file_id_full_dir_info -> FILE_ID_FULL_DIR_INFO - struct filesystem_posix_info -> FILE_SYSTEM_POSIX_INFO The fields of these structures are exactly the same on both client and server, so move duplicate definitions to common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 84d8d4cf8873b4a9da0d76e9ba9d94ec88311cfd Author: ChenXiaoSong Date: Sun Nov 2 15:30:54 2025 +0800 smb: move list of FileSystemAttributes to common/fscc.h These definitions are exactly the same on both client and server, so move them to new common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit d8ac9879182a1e1f3b97d166f5ba5e2f1b3e8535 Author: ChenXiaoSong Date: Sun Nov 2 15:30:53 2025 +0800 smb: move SMB_NEGOTIATE_REQ to common/smb2pdu.h Modify the following places: - negotiate_req -> smb_negotiate_req - NEGOTIATE_REQ -> SMB_NEGOTIATE_REQ - negotiate_rsp -> smb_negotiate_rsp - NEGOTIATE_RSP -> SMB_NEGOTIATE_RSP Then move SMB_NEGOTIATE_REQ to common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1172d8598499a006d172bb24bebaa3fdc99064a8 Author: ZhangGuoDong Date: Sun Nov 2 15:30:52 2025 +0800 smb: move some duplicate definitions to common/smb2pdu.h In order to maintain the code more easily, move duplicate definitions to common header file. There are only 4 different definitions, the client uses cpu_to_le16() but the server does not: - RSS_CAPABLE - RDMA_CAPABLE - INTERNETWORK - INTERNETWORKV6 The other definitions are exactly the same on both client and server. The struct smb_hdr is defined in MS-CIFS and MS-SMB, but it's also used by SMB2 and SMB3, so move it to the common smb2pdu.h. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 96721fd292264d712b7b9a51752ab87de5035db4 Author: ChenXiaoSong Date: Sun Nov 2 15:30:50 2025 +0800 smb: move create_durable_rsp_v2 to common/smb2pdu.h Modify the following places: - some fields in "struct create_durable_v2_rsp" -> struct durable_context_v2_rsp - durable_reconnect_context_v2_rsp -> durable_context_v2_rsp - create_durable_v2_rsp -> create_durable_rsp_v2 Then move them to common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 81a45de432c6c7d82821fb09cb9fc1cf58629f3a Author: ChenXiaoSong Date: Sun Nov 2 15:30:49 2025 +0800 smb: move create_durable_handle_reconnect_v2 to common/smb2pdu.h Modify the following places: - some fields in "struct create_durable_reconn_v2_req" -> struct durable_reconnect_context_v2 - create_durable_reconn_v2_req -> create_durable_handle_reconnect_v2 Then move duplicate definitions to common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 833a75fc9ecc3856a52223d8c245e52703e0a9f1 Author: ChenXiaoSong Date: Sun Nov 2 15:30:48 2025 +0800 smb: move create_durable_req_v2 to common/smb2pdu.h Modify the following places: - some fields in "struct create_durable_req_v2" -> struct durable_context_v2 - durable_context_v2 -> durable_context_v2_req - create_durable_v2 -> create_durable_req_v2 Then move duplicate definitions to common header file. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 884a1d4e9c09b4a0dbe748890bdd48aac8e5a6b6 Author: ChenXiaoSong Date: Sun Nov 2 15:30:47 2025 +0800 smb: move MAX_CIFS_SMALL_BUFFER_SIZE to common/smbglob.h In order to maintain the code more easily, move duplicate definitions to common header file. By the way, add the copyright and author information for Namjae to common/smbglob.h. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 4a7f9607803203fe637c12b4ffce9973d85ee169 Author: ChenXiaoSong Date: Sun Nov 2 15:30:46 2025 +0800 smb/client: fix CAP_BULK_TRANSFER value See MS-CIFS 2.2.4.52.2. Keep it consistent with the value in the documentation. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 5d510ac31626ed157d2182149559430350cf2104 Author: Qianchang Zhao Date: Sun Nov 9 10:00:55 2025 +0900 ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0. Skip the equal case. Cc: stable@vger.kernel.org Reported-by: Qianchang Zhao Reported-by: Zhitong Liu Signed-off-by: Qianchang Zhao Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9c98f5eec877976dad1179149038a4b164e236b1 Author: ZhangGuoDong Date: Mon Oct 27 15:22:05 2025 +0800 smb: move resume_key_ioctl_rsp to common/smb2pdu.h Rename 2 places: - resume_key_req -> resume_key_ioctl_rsp - server: ResumeKey -> ResumeKeyU64 Merge the struct members of the server and the client, then move duplicate definitions to common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit cc26f593dc193567bdb059a6ffde58e627a44f65 Author: ZhangGuoDong Date: Mon Oct 27 15:22:04 2025 +0800 smb: move copychunk definitions to common/smb2pdu.h Rename 3 places: - copychunk_ioctl -> copychunk_ioctl_req - copychunk -> srv_copychunk - server: ResumeKey -> SourceKeyU64 Merge the struct members of the server and the client, then move duplicate definitions to common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7844d50ca239f0788e732608820f7026cb0cc8fb Author: ZhangGuoDong Date: Mon Oct 27 15:22:03 2025 +0800 smb: move smb_sockaddr_in and smb_sockaddr_in6 to common/smb2pdu.h Rename 4 places: - iface_info_ipv4 -> smb_sockaddr_in - iface_info_ipv6 -> smb_sockaddr_in6 - IPv4address -> IPv4Address - IPv6address -> IPv6Address Then move duplicate definitions to common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit cd311445d9f5510979f6e9f4344178b9f5a4d981 Author: ZhangGuoDong Date: Mon Oct 27 15:12:56 2025 +0800 smb: move SMB1_PROTO_NUMBER to common/smbglob.h Replace the constant of client with SMB1_PROTO_NUMBER, then move the macro definition from server/smb_common.h to common/smbglob.h. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Suggested-by: Christophe JAILLET Acked-by: Namjae Jeon Signed-off-by: Steve French commit 36c31540cf5279262bfd148d8537cd04866499f2 Author: ZhangGuoDong Date: Fri Nov 21 15:44:49 2025 -0600 smb: move get_rfc1002_len() to common/smbglob.h Rename get_rfc1002_length() to get_rfc1002_len(), then move duplicate definitions to common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 34cf191bb6a349dc88ec2c4f6355fe006ac669e0 Author: ZhangGuoDong Date: Mon Oct 27 15:12:54 2025 +0800 smb: move smb_version_values to common/smbglob.h Merge the struct members of the server and the client: - req_capabilities: from client - header_preamble_size: from client - cap_unicode: from client - capabilities: from server, rename to req_capabilities - max_read_size: from server - max_write_size: from server - max_trans_size: from server - max_credits: from server - create_durable_size: from server - create_durable_v2_size: from server - create_mxac_size: from server - create_disk_id_size: from server - create_posix_size: from server Then move duplicate definitions to common header file. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 94b955167e3b11372e314f45f4b2fbf4f92493b9 Author: ZhangGuoDong Date: Mon Oct 27 15:12:53 2025 +0800 smb: rename common/cifsglob.h to common/smbglob.h "cifs" is a legacy name, rename it to "smbglob.h" according to Namjae's suggestions. Co-developed-by: ChenXiaoSong Signed-off-by: ChenXiaoSong Signed-off-by: ZhangGuoDong Suggested-by: Namjae Jeon Acked-by: Namjae Jeon Signed-off-by: Steve French commit 7d9f51d36b6c24e02b8a379cbaf1a273511ed403 Author: ChenXiaoSong Date: Fri Oct 17 18:46:12 2025 +0800 smb/server: update some misguided comment of smb2_0_server_cmds proc These functions return error code rather than always returning 0. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit a3c4445fdbbb83aa94ea1778717ef57006164814 Author: ChenXiaoSong Date: Fri Oct 17 18:46:11 2025 +0800 smb/server: fix return value of smb2_oplock_break() smb2_oplock_break() should return error code when an error occurs, __process_request() will print the error messages. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 269df046c1e15ab34fa26fd90db9381f022a0963 Author: ChenXiaoSong Date: Fri Oct 17 18:46:10 2025 +0800 smb/server: fix return value of smb2_ioctl() __process_request() will not print error messages if smb2_ioctl() always returns 0. Fix this by returning the correct value at the end of function. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit dafe22bc676d4fcb1ccb193c8cc3dda57942509d Author: ChenXiaoSong Date: Fri Oct 17 18:46:09 2025 +0800 smb/server: fix return value of smb2_query_dir() __process_request() will not print error messages if smb2_query_dir() always returns 0. Fix this by returning the correct value at the end of function. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit d1a30b9ddc3d4c0e38666bd166d51863cb39f1c4 Author: ChenXiaoSong Date: Fri Oct 17 18:46:08 2025 +0800 smb/server: fix return value of smb2_notify() smb2_notify() should return error code when an error occurs, __process_request() will print the error messages. I may implement the SMB2 CHANGE_NOTIFY response (see MS-SMB2 2.2.36) in the future. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit c5b462e35373a68a5a7954f5e00383998cc7fe92 Author: ChenXiaoSong Date: Fri Oct 17 18:46:07 2025 +0800 smb/server: fix return value of smb2_read() STATUS_END_OF_FILE maps to the linux error -ENODATA. Perhaps in the future we can move client/smb2maperror.c into common/ and then call map_smb2_to_linux_error() to get the linux error. Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 3a597e6e9701eb7af04864ffdc0a6a91bc8c6496 Author: Eric Biggers Date: Tue Oct 14 16:17:59 2025 -0700 ksmbd: Use HMAC-MD5 library for NTLMv2 For the HMAC-MD5 computations in NTLMv2, use the HMAC-MD5 library instead of a "hmac(md5)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-MD5 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. To preserve the existing behavior of NTLMv2 support being disabled when the kernel is booted with "fips=1", make ksmbd_auth_ntlmv2() check fips_enabled itself. Previously it relied on the error from crypto_alloc_shash("hmac(md5)") being bubbled up. I don't know for sure that this is actually needed, but this preserves the existing behavior. Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit 924067ef183bd17f39d790752190f99982524598 Author: Eric Biggers Date: Tue Oct 14 16:17:58 2025 -0700 ksmbd: Use HMAC-SHA256 library for message signing and key generation Convert ksmbd_sign_smb2_pdu() and generate_key() to use the HMAC-SHA256 library instead of a "hmac(sha256)" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the HMAC-SHA256 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit e009cb1e3093977c5b96a1c6697a7dc9332222d5 Author: Eric Biggers Date: Tue Oct 14 16:17:57 2025 -0700 ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash Convert ksmbd_gen_preauth_integrity_hash() to use the SHA-512 library instead of a "sha512" crypto_shash. This is simpler and faster. With the library there's no need to allocate memory, no need to handle errors, and the SHA-512 code is accessed directly without inefficient indirect calls and other unnecessary API overhead. Signed-off-by: Eric Biggers Acked-by: Namjae Jeon Signed-off-by: Steve French commit b8bcc17f583b87f9913659d69cd796fbc203e510 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:36 2025 +0000 wireguard: netlink: lower .maxattr for WG_CMD_GET_DEVICE Previously .maxattr was shared for both WG_CMD_GET_DEVICE and WG_CMD_SET_DEVICE. Now that it is split, then we can lower it for WG_CMD_GET_DEVICE to follow the documentation which defines .maxattr as WGDEVICE_A_IFNAME for WG_CMD_GET_DEVICE. $ grep -hC5 'one but not both of:' include/uapi/linux/wireguard.h * WG_CMD_GET_DEVICE * ----------------- * * May only be called via NLM_F_REQUEST | NLM_F_DUMP. The command * should contain one but not both of: * * WGDEVICE_A_IFINDEX: NLA_U32 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1 * * The kernel will then return several messages [...] While other attributes weren't rejected previously, the consensus is that nobody sends those attributes, so nothing should break. Link: https://lore.kernel.org/r/aRyLoy2iqbkUipZW@zx2c4.com/ Suggested-by: Jason A. Donenfeld Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 73af07d7f2f60914d9ad6b4ec102248196f8ceb9 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:35 2025 +0000 wireguard: netlink: convert to split ops This patch converts WireGuard from using the legacy struct genl_ops to struct genl_split_ops, by applying the same transformation as genl_cmd_full_to_split() would otherwise do at runtime. WGDEVICE_A_MAX is swapped for WGDEVICE_A_PEERS, while they are currently equivalent, then .maxattr should be the maximum attribute that a given command supports, and not change along with WGDEVICE_A_MAX. This is an incremental step towards adopting netlink policy code generated by ynl-gen, ensuring that the code and spec is aligned. This is a trivial patch with no behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 9755f9de8fac62ed36f1925d6996daf4060d8839 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:34 2025 +0000 wireguard: netlink: use WG_KEY_LEN in policies When converting the netlink policies to YNL, the constants used in the policy have to be visible to userspace. As NOISE_*_KEY_LEN isn't visible to userspace, change the policy to use WG_KEY_LEN, as also documented in the UAPI header: $ grep WG_KEY_LEN include/uapi/linux/wireguard.h * WGDEVICE_A_PRIVATE_KEY: NLA_EXACT_LEN, len WG_KEY_LEN * WGDEVICE_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN * WGPEER_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN * WGPEER_A_PRESHARED_KEY: NLA_EXACT_LEN, len WG_KEY_LEN [...] Add a couple of BUILD_BUG_ON() to ensure that they stay in sync. No behavioural changes intended. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit aea199fa157164ed0824d14dddd6c6fa28e130e4 Author: Asbjørn Sloth Tønnesen Date: Wed Nov 26 17:35:33 2025 +0000 wireguard: netlink: validate nested arrays in policy Use NLA_POLICY_NESTED_ARRAY() to perform nested array validation in the policy validation step. The nested policy was already enforced through nla_parse_nested(), however extack wasn't passed previously, so no fancy error messages. With the nested attributes being validated directly in the policy, the policy argument can be set to NULL in the calls to nla_parse_nested(). Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit e0e1b6db2e4b8fae44e222c188d3e96259d00c8e Author: Asbjørn Sloth Tønnesen Date: Wed Nov 5 18:32:12 2025 +0000 wireguard: netlink: enable strict genetlink validation WireGuard is a modern enough genetlink family, that it doesn't need resv_start_op. It already had policies in place when it was first merged, it has also never used the reserved field, or other things toggled by resv_start_op. wireguard-tools have always used zero initialized memory, and have never touched the reserved field, neither have any other clients I have checked. Closed-source clients are much more likely to use the embeddedable library from wireguard-tools, than a DIY implementation using uninitialized memory. Signed-off-by: Asbjørn Sloth Tønnesen Signed-off-by: Jason A. Donenfeld commit 205dd7a5d6ad6f4c8e8fcd3c3b95a7c0e7067fee Author: Michael S. Tsirkin Date: Tue Nov 18 18:06:31 2025 -0500 virtio_pci: drop kernel.h virtio UAPI headers really have no business pulling in kernel.h Replace it with const.h which seems to be what's needed for __KERNEL_DIV_ROUND_UP. Fixes: 7c1ae151e812 ("virtio_pci: Introduce device parts access commands") Cc: Yishai Hadas Cc: Alex Williamson Message-ID: <7a73b6c6af67e13b86633cd7bf11ad56b5d9809b.1763535341.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin commit dfe44d177afc0cc56507c80b34f6f1e4e106441f Author: Michael S. Tsirkin Date: Thu Nov 13 17:42:05 2025 -0500 vhost: switch to arrays of feature bits The current interface where caller has to know in which 64 bit chunk each bit is, is inelegant and fragile. Let's simply use arrays of bits. By using unroll macros text size grows only slightly. Message-ID: <637e182e139980e5930d50b928ba5ac072d628a9.1764225384.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin commit 9a08942f17017b708991c5089843d4a1bfac4420 Merge: a50413848f1cf6 82a224498005b2 Author: Frederic Weisbecker Date: Sun Nov 30 22:20:33 2025 +0100 Merge branch 'rcu/misc' into next - In order to prepare the layout for nohz_full work deferral to user exit, the context tracking state must shrink the counter of transitions to/from RCU not watching. The only possible hazard is to trigger wrap-around more easily, delaying a bit grace periods when that happens. This should be a rare event though. Yet add debugging and torture code to test that assumption. - Fix memory leak on locktorture module - Annotate accesses in rculist_nulls.h to prevent from KCSAN warnings. On recent discussions, we also concluded that all those WRITE_ONCE() and READ_ONCE() on list APIs deserve appropriate comments. Something to be expected for the next cycle. - Provide a script to apply several configs to several commits with torture. - Allow torture to reuse a build directory in order to save needless rebuild time. - Various cleanups. commit b276445e98fe28609688fb85b89a81b803910e63 Author: Johan Hovold Date: Thu Nov 27 14:53:25 2025 +0100 clk: keystone: fix compile testing Some keystone clock drivers can be selected when COMPILE_TEST is enabled but since commit b745c0794e2f ("clk: keystone: Add sci-clk driver support") they are never actually built. Enable compile testing by allowing the build system to process the keystone drivers. Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support") Signed-off-by: Johan Hovold Signed-off-by: Stephen Boyd commit 9c75986a298f121ed2c6599b05e51d9a34e77068 Author: Johan Hovold Date: Thu Nov 27 14:42:43 2025 +0100 clk: keystone: syscon-clk: fix regmap leak on probe failure The mmio regmap allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind. Fixes: a250cd4c1901 ("clk: keystone: syscon-clk: Do not use syscon helper to build regmap") Cc: stable@vger.kernel.org # 6.15 Cc: Andrew Davis Signed-off-by: Johan Hovold Signed-off-by: Stephen Boyd commit 1413717ad0c6d3887192b0119ad6420dbf0c26ae Author: Stephen Boyd Date: Sun Nov 30 12:02:31 2025 -0800 clk: qcom: Mark camcc_sm7150_hws static This isn't used outside this file. Mark it static. Fixes: 9f0532da4226 ("clk: qcom: Add Camera Clock Controller driver for SM7150") Signed-off-by: Stephen Boyd commit c2c332d78c8600e1fc661c5c8cd178f48c701bcb Merge: 3a8660878839fa 3664282f3345fd Author: Stephen Boyd Date: Sun Nov 30 11:47:23 2025 -0800 Merge tag 'qcom-clk-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Qualcomm IPQ5424 Network Subsystem Clock Controller - Qualcomm SM8750 Video Clock Controller - Describe parent/child relationship among the Qualcomm Titan GDSCs on SM845, SM6350, SM7150, SM8250, SM8450, and SM8550 - Define display subsystem reset signals for SM6350, SM7150, and SDM660 - Add missing USB4 clocks and resets on Hamoa - Address a variety of smaller issues across the drivers, and a few more Kconfig dependency issues * tag 'qcom-clk-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (47 commits) clk: qcom: x1e80100-dispcc: Add USB4 router link resets dt-bindings: clock: qcom: x1e80100-dispcc: Add USB4 router link resets clk: qcom: videocc-sm8750: Add video clock controller driver for SM8750 dt-bindings: clock: qcom: Add SM8750 video clock controller clk: qcom: branch: Extend invert logic for branch2 mem clocks clk: qcom: ecpricc-qdu100: Add mem_enable_mask to the clock memory branch clk: qcom: clk_mem_branch: add enable mask and invert flags clk: qcom: mmcc-sdm660: Add missing MDSS reset dt-bindings: clock: mmcc-sdm660: Add missing MDSS reset clk: qcom: use different Kconfig prompts for APSS IPQ5424/6018 drivers clk: qcom: apss-ipq5424: remove unused 'apss_clk' structure dt-bindings: clock: qcom: Add Kaanapali Global clock controller dt-bindings: clock: qcom: Document the Kaanapali TCSR Clock Controller dt-bindings: clock: qcom-rpmhcc: Add RPMHCC for Kaanapali clk: qcom: tcsrcc-glymur: Update register offsets for clock refs clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops clk: qcom: camcc-sm7150: Fix PLL config of PLL2 clk: qcom: camcc-sm6350: Fix PLL config of PLL2 clk: qcom: Add NSS clock controller driver for IPQ5424 clk: qcom: gcc-ipq5424: Add gpll0_out_aux clock ... commit 53fbbc29dd20b96760ae6c147de1532dc85dc3c4 Merge: 3a8660878839fa 18191dd750e6c9 Author: Stephen Boyd Date: Sun Nov 30 11:41:09 2025 -0800 Merge tag 'v6.19-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - SCMI clock-ids and max-clk-number removal from dt-binding on RK3568 - Clock drivers for the new Rockchip SoCs RV1126B and RK3506 * tag 'v6.19-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: Add clock and reset driver for RK3506 dt-bindings: clock: rockchip: Add RK3506 clock and reset unit clk: rockchip: Add clock controller for the RV1126B dt-bindings: clock, reset: Add support for rv1126b clk: rockchip: Implement rockchip_clk_register_armclk_multi_pll() dt-bindings: clock: rk3568: Drop CLK_NR_CLKS define clk: rockchip: rk3568: Drop CLK_NR_CLKS usage dt-bindings: clock: rk3568: Add SCMI clock ids commit b5b9e93bbfc0200d0480ccc03f83069254e73261 Merge: 3a8660878839fa 781f60e45bdfe3 Author: Stephen Boyd Date: Sun Nov 30 11:35:42 2025 -0800 Merge tag 'clk-microchip-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clk driver updates from Claudiu Beznea: - PolarFire SoC clock driver updates to use regmaps instead of iomem addresses; with it, the reset control driver support for non-auxiliary bus probing was included as it now depends on the regmap registered by the clock controller driver - A cleanup patch for the LAN966X clk driver * tag 'clk-microchip-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: reset: mpfs: add non-auxiliary bus probing clk: lan966x: remove unused dt-bindings include clk: microchip: mpfs: use regmap for clocks dt-bindings: clk: microchip: mpfs: remove first reg region commit cf33f0b7df13685234ccea7be7bfe316b60db4db Author: Nathan Chancellor Date: Mon Nov 24 12:11:06 2025 -0700 clk: samsung: exynos-clkout: Assign .num before accessing .hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS) about the number of elements in .hws[], so that it can warn when .hws[] is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in exynos_clkout_probe() due to .num being assigned after .hws[] has been accessed: UBSAN: array-index-out-of-bounds in drivers/clk/samsung/clk-exynos-clkout.c:178:18 index 0 is out of range for type 'clk_hw *[*]' Move the .num initialization to before the first access of .hws[], clearing up the warning. Cc: stable@vger.kernel.org Fixes: f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") Reported-by: Jochen Sprickerhof Closes: https://lore.kernel.org/aSIYDN5eyKFKoXKL@eldamar.lan/ Tested-by: Jochen Sprickerhof Signed-off-by: Nathan Chancellor Reviewed-by: Kees Cook Reviewed-by: Sam Protsenko Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit 80d0c27a0a4af8e0678d7412781482e6f73c22c7 Author: Gao Xiang Date: Thu Nov 27 16:07:56 2025 +0800 erofs: get rid of raw bi_end_io() usage These BIOs are actually harmless in practice, as they are all pseudo BIOs and do not use advanced features like chaining. Using the BIO interface is a more friendly and unified approach for both bdev and and file-backed I/Os (compared to awkward bvec interfaces). Let's use bio_endio() instead. Reviewed-by: Christoph Hellwig Reviewed-by: Ming Lei Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 30e13e41a0eb6bcc97e7c21eafee832b36851969 Author: Gao Xiang Date: Thu Nov 27 15:31:22 2025 +0800 erofs: enable error reporting for z_erofs_fixup_insize() Enable propagation of detailed errors to callers. Signed-off-by: Gao Xiang commit c1536df9427dc90ec796fb755adcad3cfc469ac7 Merge: 418de94e759308 fdd0c6a649d241 Author: Jens Axboe Date: Sun Nov 30 06:31:01 2025 -0700 Merge tag 'md-6.19-20251130' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into for-6.19/block Pull MD changes from Yu: "- fix null-ptr-dereference regression for dm-raid0 (Yu Kuai) - fix IO hang for raid5 when array is broken with IO inflight (Yu Kuai) - remove legacy 1s delay to speed up system shutdown (Tarun Sahu)" * tag 'md-6.19-20251130' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: md: remove legacy 1s delay in md_notify_reboot md/raid5: fix IO hang when array is broken with IO inflight md: warn about updating super block failure md/raid0: fix NULL pointer dereference in create_strip_zones() for dm-raid commit 0177f0f07886e54e12c6f18fa58f63e63ddd3c58 Merge: ff736a286116d4 cb2dc6d2869a4f Author: Jakub Kicinski Date: Sat Nov 29 17:45:25 2025 -0800 Merge tag 'linux-can-next-for-6.19-20251129' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-11-29 The patch is by Oliver Hartkopp and fixes the compilation of the CAN_RAW protocol if the CAN driver infrastructure is not enabled. This problem was introduced in the current development cycle of net-next. * tag 'linux-can-next-for-6.19-20251129' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: Kconfig: select CAN driver infrastructure by default ==================== Link: https://patch.msgid.link/20251129125036.467177-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit fdd0c6a649d24107bbadd249c87feab67b9037c5 Author: Tarun Sahu Date: Fri Nov 21 19:14:22 2025 +0000 md: remove legacy 1s delay in md_notify_reboot During system shutdown, the md driver registered notifier function (md_notify_reboot) currently imposes a hardcoded one-second delay. This delay was introduced approximately 23 years ago and was likely necessary for the hardware generation of that time. Proposing this patch to make sure there are no known devices that need this delay. Link: https://lore.kernel.org/linux-raid/20251121191422.2758555-1-tarunsahu@google.com Signed-off-by: Tarun Sahu Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit a913d1f6a7f607c110aeef8b58c8988f47a4b24e Author: Yu Kuai Date: Mon Nov 17 16:55:57 2025 +0800 md/raid5: fix IO hang when array is broken with IO inflight Following test can cause IO hang: mdadm -CvR /dev/md0 -l10 -n4 /dev/sd[abcd] --assume-clean --chunk=64K --bitmap=none sleep 5 echo 1 > /sys/block/sda/device/delete echo 1 > /sys/block/sdb/device/delete echo 1 > /sys/block/sdc/device/delete echo 1 > /sys/block/sdd/device/delete dd if=/dev/md0 of=/dev/null bs=8k count=1 iflag=direct Root cause: 1) all disks removed, however all rdevs in the array is still in sync, IO will be issued normally. 2) IO failure from sda, and set badblocks failed, sda will be faulty and MD_SB_CHANGING_PENDING will be set. 3) error recovery try to recover this IO from other disks, IO will be issued to sdb, sdc, and sdd. 4) IO failure from sdb, and set badblocks failed again, now array is broken and will become read-only. 5) IO failure from sdc and sdd, however, stripe can't be handled anymore because MD_SB_CHANGING_PENDING is set: handle_stripe handle_stripe if (test_bit MD_SB_CHANGING_PENDING) set_bit STRIPE_HANDLE goto finish // skip handling failed stripe release_stripe if (test_bit STRIPE_HANDLE) list_add_tail conf->hand_list 6) later raid5d can't handle failed stripe as well: raid5d md_check_recovery md_update_sb if (!md_is_rdwr()) // can't clear pending bit return if (test_bit MD_SB_CHANGING_PENDING) break; // can't handle failed stripe Since MD_SB_CHANGING_PENDING can never be cleared for read-only array, fix this problem by skip this checking for read-only array. Link: https://lore.kernel.org/linux-raid/20251117085557.770572-3-yukuai@fnnas.com Fixes: d87f064f5874 ("md: never update metadata when array is read-only.") Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 8c9e376b9d1a222fa02b93b615d2e25be0a91fed Author: Yu Kuai Date: Mon Nov 17 16:55:56 2025 +0800 md: warn about updating super block failure Many personalities will handle IO error from daemon thread(like raid1d, raid10d, raid5d), and sb will require to be clean before hanlding these failed IO. However update sb can fail, for example array is broken by IO failure, or user config sysfs api array_state. This patch adds warning if updating sb failed first, in case this will be related to IO hang. Link: https://lore.kernel.org/linux-raid/20251117085557.770572-2-yukuai@fnnas.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit 46f21952c492243b138281dc4cb755ab63b637c4 Author: Yu Kuai Date: Sun Nov 16 10:18:16 2025 +0800 md/raid0: fix NULL pointer dereference in create_strip_zones() for dm-raid Commit 2107457e31fa ("md/raid0: Move queue limit setup before r0conf initialization") dereference mddev->gendisk unconditionally, which is NULL for dm-raid. Fix this problem by reverting to old codes for dm-raid. Link: https://lore.kernel.org/linux-raid/20251116021816.107648-1-yukuai@fnnas.com Fixes: 2107457e31fa ("md/raid0: Move queue limit setup before r0conf initialization") Reported-and-tested-by: Changhui Zhong Closes: https://lore.kernel.org/all/CAGVVp+VqVnvGeneUoTbYvBv2cw6GwQRrR3B-iQ-_9rVfyumoKA@mail.gmail.com/ Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni Reviewed-by: Li Nan Reviewed-by: Paul Menzel commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 Author: Trond Myklebust Date: Fri Nov 28 18:56:46 2025 -0500 NFS: Fix up the automount fs_context to use the correct cred When automounting, the fs_context should be fixed up to use the cred from the parent filesystem, since the operation is just extending the namespace. Authorisation to enter that namespace will already have been provided by the preceding lookup. Signed-off-by: Trond Myklebust commit 2b092175f5e301cdaa935093edfef2be9defb6df Author: Trond Myklebust Date: Fri Nov 28 16:06:41 2025 -0500 NFS: Fix inheritance of the block sizes when automounting Only inherit the block sizes that were actually specified as mount parameters for the parent mount. Fixes: 62a55d088cd8 ("NFS: Additional refactoring for fs_context conversion") Signed-off-by: Trond Myklebust commit 8675c69816e4276b979ff475ee5fac4688f80125 Author: Trond Myklebust Date: Fri Nov 28 14:22:44 2025 -0500 NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag. Reported-by: Li Lingfeng Link: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.com/ Fixes: f2aedb713c28 ("NFS: Add fs_context support.") Signed-off-by: Trond Myklebust commit d4a26d34f1946142f9d32e540490e4926ae9a46b Author: Trond Myklebust Date: Fri Nov 28 13:39:45 2025 -0500 Revert "nfs: ignore SB_RDONLY when mounting nfs" This reverts commit 52cb7f8f177878b4f22397b9c4d2c8f743766be3. Silently ignoring the "ro" and "rw" mount options causes user confusion, and regressions. Reported-by: Alkis Georgopoulos Cc: Li Lingfeng Fixes: 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs") Signed-off-by: Trond Myklebust commit d216b698d44e33417ad4cc796cb04ccddbb8c0ee Author: Trond Myklebust Date: Fri Nov 28 13:39:38 2025 -0500 Revert "nfs: clear SB_RDONLY before getting superblock" This reverts commit 8cd9b785943c57a136536250da80ba1eb6f8eb18. Silently ignoring the "ro" and "rw" mount options causes user confusion, and regressions. Reported-by: Alkis Georgopoulos Cc: Li Lingfeng Fixes: 8cd9b785943c ("nfs: clear SB_RDONLY before getting superblock") Signed-off-by: Trond Myklebust commit 400fa37afbb11a601c204b72af0f0e5bc2db695c Author: Trond Myklebust Date: Fri Nov 28 13:39:07 2025 -0500 Revert "nfs: ignore SB_RDONLY when remounting nfs" This reverts commit 80c4de6ab44c14e910117a02f2f8241ffc6ec54a. Silently ignoring the "ro" and "rw" mount options causes user confusion, and regressions. Reported-by: Alkis Georgopoulos Cc: Li Lingfeng Fixes: 80c4de6ab44c ("nfs: ignore SB_RDONLY when remounting nfs") Signed-off-by: Trond Myklebust commit 9086cac895c3bfd9bdd9a4d850da1749e447ed32 Author: Shi Hao Date: Tue Nov 18 01:39:49 2025 +0530 scsi: qla4xxx: Use time conversion macros Replace the raw use of 500 value in schedule_timeout() function with msecs_to_jiffies() to ensure intended value across different kernel configurations regardless of HZ value. Signed-off-by: Shi Hao Link: https://patch.msgid.link/20251117200949.42557-1-i.shihao.999@gmail.com Signed-off-by: Martin K. Petersen commit 641092c1bc1bbc3be059d9d723b1cec10a368617 Author: Alexandru Gagniuc Date: Fri Nov 28 19:32:06 2025 -0600 remoteproc: qcom_q6v5_wcss: use optional reset for wcss_q6_bcr_reset The "wcss_q6_bcr_reset" is not used on IPQ8074, and IPQ6018. Use devm_reset_control_get_optional_exclusive() for this reset so that probe() does not fail on platforms where it is not used. Signed-off-by: Alexandru Gagniuc Link: https://lore.kernel.org/r/20251129013207.3981517-2-mr.nuke.me@gmail.com Signed-off-by: Bjorn Andersson commit 7e81fa8d809ed1e67ae9ecd52d20a20c2c65d877 Author: Alexandru Gagniuc Date: Fri Nov 28 19:32:05 2025 -0600 remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs The "qcom,halt-regs" consists of a phandle reference followed by the three offsets within syscon for halt registers. Thus, we need to request 4 integers from of_property_read_variable_u32_array(), with the halt_reg ofsets at indexes 1, 2, and 3. Offset 0 is the phandle. With MAX_HALT_REG at 3, of_property_read_variable_u32_array() returns -EOVERFLOW, causing .probe() to fail. Increase MAX_HALT_REG to 4, and update the indexes accordingly. Fixes: 0af65b9b915e ("remoteproc: qcom: wcss: Add non pas wcss Q6 support for QCS404") Signed-off-by: Alexandru Gagniuc Link: https://lore.kernel.org/r/20251129013207.3981517-1-mr.nuke.me@gmail.com Signed-off-by: Bjorn Andersson commit 62cd5d480b9762ce70d720a81fa5b373052ae05f Author: Jarkko Sakkinen Date: Sat Oct 18 13:30:36 2025 +0300 KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping the blob into with a cleanup helper. Cc: stable@vger.kernel.org # v5.13+ Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs") Signed-off-by: Jarkko Sakkinen commit 127fa2ae9e2b1f9b9d876dfaa39fe3640cec5764 Author: Jarkko Sakkinen Date: Sat Oct 18 20:41:36 2025 +0300 KEYS: trusted: Replace a redundant instance of tpm2_hash_map 'trusted_tpm2' duplicates 'tpm2_hash_map' originally part of the TPN driver, which is suboptimal. Implement and export `tpm2_find_hash_alg()` in the driver, and substitute the redundant code in 'trusted_tpm2' with a call to the new function. Reviewed-by: Jonathan McDowell Signed-off-by: Jarkko Sakkinen commit eaea513077cde23f70d4414288839eb26632ef36 Author: Wen Xiong Date: Tue Oct 28 09:24:27 2025 -0500 scsi: qla2xxx: Enable/disable IRQD_NO_BALANCING during reset A dynamic remove/add storage adapter test hits EEH on PowerPC: EEH: [c00000000004f77c] __eeh_send_failure_event+0x7c/0x160 EEH: [c000000000048464] eeh_dev_check_failure.part.0+0x254/0x660 EEH: [c000000000934e0c] __pci_read_msi_msg+0x1ac/0x280 EEH: [c000000000100f68] pseries_msi_compose_msg+0x28/0x40 EEH: [c00000000020e1cc] irq_chip_compose_msi_msg+0x5c/0x90 EEH: [c000000000214b1c] msi_domain_set_affinity+0xbc/0x100 EEH: [c000000000206be4] irq_do_set_affinity+0x214/0x2c0 EEH: [c000000000206e04] irq_set_affinity_locked+0x174/0x230 EEH: [c000000000207044] irq_set_affinity+0x64/0xa0 EEH: [c000000000212890] write_irq_affinity.constprop.0.isra.0+0x130/0x150 EEH: [c00000000068868c] proc_reg_write+0xfc/0x160 EEH: [c0000000005adb48] vfs_write+0xf8/0x4e0 EEH: [c0000000005ae234] ksys_write+0x84/0x140 EEH: [c00000000002e994] system_call_exception+0x164/0x310 EEH: [c00000000000bfe8] system_call_vectored_common+0xe8/0x278 The irqbalance daemon kicks in before invoking qla2xxx->slot_reset during the EEH recovery process. irqbalance daemon ->irq_set_affinity() ->msi_domain_set_affinity() ->irq_chip_set_affiinity_parent() ->xive_irq_set_affinity() ->pseries_msi_compose_ms() ->__pci_read_msi_msg() ->irq_chip_compose_msi_msg() In __pci_read_msi_msg(), the first MSI-X vector is set to all F by the irqbalance daemon. pci_write_msg_msix: index=0, lo=ffffffff hi=fffffff IRQ balancing is not required during adapter reset. Enable "IRQ_NO_BALANCING" bit before starting adapter reset and disable it calling pci_restore_state(). The irqbalance daemon is disabled for this short period of time (~2s). Co-developed-by: Kyle Mahlkuch Signed-off-by: Kyle Mahlkuch Signed-off-by: Wen Xiong Link: https://patch.msgid.link/20251028142427.3969819-3-wenxiong@linux.ibm.com Signed-off-by: Martin K. Petersen commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 Author: Wen Xiong Date: Tue Oct 28 09:24:26 2025 -0500 scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset A dynamic remove/add storage adapter test hits EEH on PowerPC: EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160 EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650 EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr] EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr] EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr] EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440 EEH: [c00000000017e558] process_one_work+0x298/0x590 EEH: [c00000000017eef8] worker_thread+0xa8/0x620 EEH: [c00000000018be34] kthread+0x124/0x130 EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64 A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by irqbalance daemon. If we disable irqbalance daemon, we won't see the issue. With debug enabled in ipr driver: [ 44.103071] ipr: Entering __ipr_remove [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown [ 44.149918] ipr: Entering ipr_reset_ucode_download [ 44.149935] ipr: Entering ipr_reset_alert [ 44.150032] ipr: Entering ipr_reset_start_timer [ 44.150038] ipr: Leaving ipr_reset_alert [ 44.244343] scsi 1:2:3:0: alua: Detached [ 44.254300] ipr: Entering ipr_reset_start_bist [ 44.254320] ipr: Entering ipr_reset_start_timer [ 44.254325] ipr: Leaving ipr_reset_start_bist [ 44.364329] scsi 1:2:4:0: alua: Detached [ 45.134341] scsi 1:2:5:0: alua: Detached [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa [ 45.860966] ipr: Entering ipr_reset_alert [ 45.861028] ipr: Entering ipr_reset_start_timer [ 45.861035] ipr: Leaving ipr_reset_alert [ 45.964302] ipr: Entering ipr_reset_start_bist [ 45.964309] ipr: Entering ipr_reset_start_timer [ 45.964313] ipr: Leaving ipr_reset_start_bist [ 46.264301] ipr: Entering ipr_reset_bist_done [ 46.264309] ipr: Leaving ipr_reset_bist_done During adapter reset, ipr device driver blocks config space access but can't block MMIO access for MSI-X entries. There is very small window: irqbalance daemon kicks in during adapter reset before ipr driver calls pci_restore_state(pdev) to restore MSI-X table. irqbalance daemon reads back all 0 for that MSI-X vector in __pci_read_msi_msg(). irqbalance daemon: msi_domain_set_affinity() ->irq_chip_set_affinity_patent() ->xive_irq_set_affinity() ->irq_chip_compose_msi_msg() ->pseries_msi_compose_msg() ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state ->irq_chip_write_msi_msg() -> pci_write_msg_msi(): write 0 to the msix vector entry When ipr driver calls pci_restore_state(pdev) in ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared by irqbalance daemon in pci_write_msg_msix(). pci_restore_state() ->__pci_restore_msix_state() Below is the MSI-X table for ipr adapter after irqbalance daemon kicked in during adapter reset: Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0 Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0 Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0 Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0 Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0 Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0 Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0 Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0 Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0 ---------> Hit EEH since msix vector of index=8 are 0 Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0 Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0 Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0 Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0 Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0 Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0 Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0 [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space [ 46.267439] ipr: Entering ipr_fail_all_ops [ 46.267447] ipr: Leaving ipr_fail_all_ops [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space [ 46.267454] ipr: Entering ipr_ioa_bringdown_done [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done [ 46.267467] ipr: Entering ipr_worker_thread [ 46.267470] ipr: Leaving ipr_worker_thread IRQ balancing is not required during adapter reset. Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable it after calling pci_restore_state(). The irqbalance daemon is disabled for this short period of time (~2s). Co-developed-by: Kyle Mahlkuch Signed-off-by: Kyle Mahlkuch Signed-off-by: Wen Xiong Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com Signed-off-by: Martin K. Petersen commit ab58153ec64fa3fc9aea09ca09dc9322e0b54a7c Author: Duoming Zhou Date: Tue Oct 28 18:01:49 2025 +0800 scsi: imm: Fix use-after-free bug caused by unfinished delayed work The delayed work item 'imm_tq' is initialized in imm_attach() and scheduled via imm_queuecommand() for processing SCSI commands. When the IMM parallel port SCSI host adapter is detached through imm_detach(), the imm_struct device instance is deallocated. However, the delayed work might still be pending or executing when imm_detach() is called, leading to use-after-free bugs when the work function imm_interrupt() accesses the already freed imm_struct memory. The race condition can occur as follows: CPU 0(detach thread) | CPU 1 | imm_queuecommand() | imm_queuecommand_lck() imm_detach() | schedule_delayed_work() kfree(dev) //FREE | imm_interrupt() | dev = container_of(...) //USE dev-> //USE Add disable_delayed_work_sync() in imm_detach() to guarantee proper cancellation of the delayed work item before imm_struct is deallocated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20251028100149.40721-1-duoming@zju.edu.cn Signed-off-by: Martin K. Petersen commit 971bb08704e227a7815fef31713f25c6b25e2599 Author: Heiko Carstens Date: Wed Nov 26 15:40:27 2025 +0100 scsi: target: sbp: Remove KMSG_COMPONENT macro The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" from 2008 [1] which never made it upstream. The macro was added to s390 code to allow for an out-of-tree patch which used this to generate unique message ids. Also this out-of-tree doesn't exist anymore. The pattern of how the KMSG_COMPONENT is used was partially also used for non s390 specific code, for whatever reasons. Remove the macro in order to get rid of a pointless indirection. [1] https://lwn.net/Articles/292650/ Signed-off-by: Heiko Carstens Link: https://patch.msgid.link/20251126144027.2213895-1-hca@linux.ibm.com Signed-off-by: Martin K. Petersen commit 267c2e633af6e9461477bed91e428993f8b36ee8 Author: Namhyung Kim Date: Wed Nov 26 20:44:18 2025 -0800 perf trace: Skip internal syscall arguments Recent changes in the linux-next kernel will add new field for syscalls to have contents in the userspace like below. # cat /sys/kernel/tracing/events/syscalls/sys_enter_write/format name: sys_enter_write ID: 758 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:int __syscall_nr; offset:8; size:4; signed:1; field:unsigned int fd; offset:16; size:8; signed:0; field:const char * buf; offset:24; size:8; signed:0; field:size_t count; offset:32; size:8; signed:0; field:__data_loc char[] __buf_val; offset:40; size:4; signed:0; print fmt: "fd: 0x%08lx, buf: 0x%08lx (%s), count: 0x%08lx", ((unsigned long)(REC->fd)), ((unsigned long)(REC->buf)), __print_dynamic_array(__buf_val, 1), ((unsigned long)(REC->count)) We have a different way to handle those arguments and this change confuses perf trace then make some tests failing. Fix it by skipping the new fields that have "__data_loc char[]" type. Maybe we can switch to this instead of the BPF augmentation later. Reviewed-by: Howard Chu Tested-by: Thomas Richter Tested-by: Steven Rostedt (Google) Cc: Steven Rostedt Cc: Howard Chu Reported-by: Thomas Richter Signed-off-by: Namhyung Kim commit c131c9bf98d940bfe8b0562baf94d6372c495df6 Author: Miao Li Date: Mon Nov 24 15:54:44 2025 +0800 scsi: core: Correct documentation for scsi_device_quiesce() If scsi_device_quiesce() returns zero, the function executed successfully. Signed-off-by: Miao Li Reviewed-by: Johannes Thumshirn Link: https://patch.msgid.link/20251124075444.32699-1-limiao870622@163.com Signed-off-by: Martin K. Petersen commit cda5dc12eb12cd1dd125c2bfc8952bc498a77cba Author: Dan Carpenter Date: Sat Nov 29 17:51:10 2025 +0300 remoteproc: qcom_wcnss: Fix NULL vs IS_ERR() bug in wcnss_alloc_memory_region() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/09a43da41ee277a80a3265348831e747f7b62620.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson commit cb200e41ed61c571f9b7fe9fbeb5dd8976e80c60 Author: Dan Carpenter Date: Sat Nov 29 17:51:05 2025 +0300 remoteproc: qcom: q6v5: Fix NULL vs IS_ERR() bug in q6v5_alloc_memory_region() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/674b32a78563282adeaf3cdf941314a0b8181026.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson commit e7839f773eef2072144fc858b4456aa346fcd665 Author: Dan Carpenter Date: Sat Nov 29 17:51:00 2025 +0300 remoteproc: qcom: pas: Fix a couple NULL vs IS_ERR() bugs The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/0599691acc394d9390da8fa0b5de3399b132b187.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson commit 5e6fee736ee0d85acd74f955cab0110b15de4d11 Author: Dan Carpenter Date: Sat Nov 29 17:50:53 2025 +0300 remoteproc: qcom_q6v5_adsp: Fix a NULL vs IS_ERR() check in adsp_alloc_memory_region() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the check to match. Fixes: c70b9d5fdcd7 ("remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/6d6b1b0fb6a61b5155a640507217fd7e658858cf.1764427595.git.dan.carpenter@linaro.org Signed-off-by: Bjorn Andersson commit 4588e65cfd66fc8bbd9969ea730db39b60a36a30 Author: Suganath Prabu S Date: Thu Nov 20 12:49:55 2025 +0530 scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 Avoid scanning SAS/SATA devices in channel 1 when SAS transport is enabled, as the SAS/SATA devices are exposed through channel 0. Signed-off-by: Suganath Prabu S Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/stable/20251120071955.463475-1-suganath-prabu.subramani%40broadcom.com Link: https://patch.msgid.link/20251120071955.463475-1-suganath-prabu.subramani@broadcom.com Signed-off-by: Martin K. Petersen commit 5053eab38a4c4543522d0c320c639c56a8b59908 Author: Andrey Vatoropin Date: Tue Nov 18 08:42:31 2025 +0000 scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point at the default fixed-size buffer. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 9e95fb805dc0 ("scsi: target: Fix NULL pointer dereference") Cc: stable@vger.kernel.org Signed-off-by: Andrey Vatoropin Reviewed-by: Mike Christie Link: https://patch.msgid.link/20251118084014.324940-1-a.vatoropin@crpt.ru Signed-off-by: Martin K. Petersen commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 Author: Brian Kao Date: Wed Nov 12 06:32:02 2025 +0000 scsi: ufs: core: Fix EH failure after W-LUN resume error When a W-LUN resume fails, its parent devices in the SCSI hierarchy, including the scsi_target, may be runtime suspended. Subsequently, the error handler in ufshcd_recover_pm_error() fails to set the W-LUN device back to active because the parent target is not active. This results in the following errors: google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ... ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000 ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5 ... ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active Address this by: 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before attempting to set the W-LUN to active within ufshcd_recover_pm_error(). 2. Explicitly checking for power.runtime_error on the HBA and W-LUN devices before calling pm_runtime_set_active() to clear the error state. 3. Adding pm_runtime_get_sync(hba->dev) in ufshcd_err_handling_prepare() to ensure the HBA itself is active during error recovery, even if a child device resume failed. These changes ensure the device power states are managed correctly during error recovery. Signed-off-by: Brian Kao Tested-by: Brian Kao Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com Signed-off-by: Martin K. Petersen commit faf3c923523e5c8fc3baaa413d62e913774ae52f Author: Matthew Wilcox (Oracle) Date: Fri Nov 28 04:00:58 2025 +0000 mm: fix vma_start_write_killable() signal handling If we get a signal, we need to restore the vm_refcnt. We don't think that the refcount can actually be decremented to zero here as it requires the VMA to be detached, and the vma_mark_detached() uses TASK_UNINTERRUPTIBLE. However, that's a bit subtle, so handle it as if the refcount was zero at the start of this function. Link: https://lkml.kernel.org/r/20251128040100.3022561-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reported-by: syzbot+5b19bad23ac7f44bf8b8@syzkaller.appspotmail.com Fixes: 2197bb60f890 ("mm: add vma_start_write_killable()") Reviewed-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit b60a3ef7848dbcc9549137f8d42dcd82210c0b66 Author: Youngjun Park Date: Thu Nov 27 19:03:03 2025 +0900 mm/swapfile: use plist_for_each_entry in __folio_throttle_swaprate The loop breaks immediately after finding the first swap device and never modifies the list. Replace plist_for_each_entry_safe() with plist_for_each_entry() and remove the unused next variable. Link: https://lkml.kernel.org/r/20251127100303.783198-3-youngjun.park@lge.com Signed-off-by: Youngjun Park Reviewed-by: Baoquan He Acked-by: Kairui Song Acked-by: Chris Li Cc: Barry Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit f9e82f99b3771eef396dbf97e0f3c76e20af60dd Author: Youngjun Park Date: Thu Nov 27 19:03:02 2025 +0900 mm/swapfile: fix list iteration when next node is removed during discard Patch series "mm/swapfile: fix and cleanup swap list iterations", v2. This series fixes a potential list iteration issue in swap_sync_discard() when devices are removed, and includes a cleanup for __folio_throttle_swaprate(). This patch (of 2): When the next node is removed from the plist (e.g. by swapoff), plist_del() makes the node point to itself, causing the iteration to loop on the same entry indefinitely. Add a plist_node_empty() check to detect this case and restart iteration, allowing swap_sync_discard() to continue processing remaining swap devices that still have pending discard entries. Additionally, switch from swap_avail_lock/swap_avail_head to swap_lock/swap_active_head so that iteration is only affected by swapoff operations rather than frequent availability changes, reducing exceptional condition checks and lock contention. Link: https://lkml.kernel.org/r/20251127100303.783198-1-youngjun.park@lge.com Link: https://lkml.kernel.org/r/20251127100303.783198-2-youngjun.park@lge.com Fixes: 686ea517f471 ("mm, swap: do not perform synchronous discard during allocation") Signed-off-by: Youngjun Park Suggested-by: Kairui Song Acked-by: Kairui Song Reviewed-by: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit 12f0cd393369d700c16b47bc33e4120dc8b2c608 Author: Lorenzo Stoakes Date: Thu Nov 27 17:45:17 2025 +0000 fs/proc/task_mmu.c: fix make_uffd_wp_huge_pte() huge pte handling make_uffd_wp_huge_pte() should return after handling a huge_pte_none() pte. Link: https://lkml.kernel.org/r/66178124-ebdf-4e23-b8ca-ed3eb8030c81@lucifer.local Fixes: 03bfbc3ad6e4 ("mm: remove is_hugetlb_entry_[migration, hwpoisoned]()") Signed-off-by: Lorenzo Stoakes Reported-by: Vlastimil Babka Closes: https://lkml.kernel.org/r/dc483db3-be4d-45f7-8b40-a28f5d8f5738@suse.cz Signed-off-by: Andrew Morton commit ce2bba89566bef9d4a0ff2122ee75739a72a92be Author: Breno Leitao Date: Wed Nov 26 09:46:18 2025 -0800 mm/kfence: add reboot notifier to disable KFENCE on shutdown During system shutdown, KFENCE can cause IPI synchronization issues if it remains active through the reboot process. To prevent this, register a reboot notifier that disables KFENCE and cancels any pending timer work early in the shutdown sequence. This is only necessary when CONFIG_KFENCE_STATIC_KEYS is enabled, as this configuration sends IPIs that can interfere with shutdown. Without static keys, no IPIs are generated and KFENCE can safely remain active. The notifier uses maximum priority (INT_MAX) to ensure KFENCE shuts down before other subsystems that might still depend on stable memory allocation behavior. This fixes a late kexec CSD lockup[1] when kfence is trying to IPI a CPU that is busy in a IRQ-disabled context printing characters to the console. Link: https://lkml.kernel.org/r/20251127-kfence-v2-1-daeccb5ef9aa@debian.org Link: https://lkml.kernel.org/r/20251126-kfence-v1-1-5a6e1d7c681c@debian.org Link: https://lore.kernel.org/all/sqwajvt7utnt463tzxgwu2yctyn5m6bjwrslsnupfexeml6hkd@v6sqmpbu3vvu/ [1] Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Breno Leitao Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Dmitriy Vyukov Signed-off-by: Andrew Morton commit f3b566d726357df591602f195a9379494f005225 Author: Chen Ridong Date: Wed Nov 26 02:04:35 2025 +0000 memcg: remove inc/dec_lruvec_kmem_state helpers The dec_lruvec_kmem_state helper is unused by any caller and can be safely removed. Meanwhile, the inc_lruvec_kmem_state helper is only referenced by shadow_lru_isolate, retaining these two helpers is unnecessary. This patch removes both helper functions to eliminate redundant code. Link: https://lkml.kernel.org/r/20251126020435.1511637-1-chenridong@huaweicloud.com Signed-off-by: Chen Ridong Acked-by: Qi Zheng Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Lu Jialin Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 0384c8ea96bfe49e82e624e53bfd5f80c3230ea9 Author: Ankit Khushwaha Date: Wed Nov 26 21:38:30 2025 +0530 selftests/mm/uffd: initialize char variable to Null In "uffd-stress.c" & "uffd-unit-tests.c". address of char variable having garbage value (uninitialized) is passed to 'write' syscall triggers warning. uffd-stress.c:246:39: warning: variable 'c' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer] uffd-unit-tests.c:581:31: warning: variable 'c' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer] so the fix is to assign char variable to '\0' to prevent writing of garbage value. Link: https://lkml.kernel.org/r/20251126160830.52124-1-ankitkhushwaha.linux@gmail.com Signed-off-by: Ankit Khushwaha Reviewed-by: Mike Rapoport (Microsoft) Cc: Bill Wendling Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Nathan Chancellor Cc: Peter Xu Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f65372cd7acbe3c4980d404e99a7017afed607b4 Author: Geert Uytterhoeven Date: Tue Nov 25 09:19:30 2025 +0100 mm: fix DEBUG_RODATA_TEST indentation in Kconfig Most of the DEBUG_RODATA_TEST section is indented by four spaces instead of the customary single TAB. Link: https://lkml.kernel.org/r/74f39b1bffc6ed802088cb3e7d17b4c82330e8b3.1764058676.git.geert@linux-m68k.org Fixes: 2959a5f726f6 ("mm: add arch-independent testcases for RODATA") Signed-off-by: Geert Uytterhoeven Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Anshuman Khandual Cc: Jinbum Park Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9ea35a25d51b13013b724943a177a7aaf4bfed71 Author: Lorenzo Stoakes Date: Tue Nov 25 10:01:02 2025 +0000 mm: introduce VMA flags bitmap type It is useful to transition to using a bitmap for VMA flags so we can avoid running out of flags, especially for 32-bit kernels which are constrained to 32 flags, necessitating some features to be limited to 64-bit kernels only. By doing so, we remove any constraint on the number of VMA flags moving forwards no matter the platform and can decide in future to extend beyond 64 if required. We start by declaring an opaque types, vma_flags_t (which resembles mm_struct flags of type mm_flags_t), setting it to precisely the same size as vm_flags_t, and place it in union with vm_flags in the VMA declaration. We additionally update struct vm_area_desc equivalently placing the new opaque type in union with vm_flags. This change therefore does not impact the size of struct vm_area_struct or struct vm_area_desc. In order for the change to be iterative and to avoid impacting performance, we designate VM_xxx declared bitmap flag values as those which must exist in the first system word of the VMA flags bitmap. We therefore declare vma_flags_clear_all(), vma_flags_overwrite_word(), vma_flags_overwrite_word(), vma_flags_overwrite_word_once(), vma_flags_set_word() and vma_flags_clear_word() in order to allow us to update the existing vm_flags_*() functions to utilise these helpers. This is a stepping stone towards converting users to the VMA flags bitmap and behaves precisely as before. By doing this, we can eliminate the existing private vma->__vm_flags field in the vma->vm_flags union and replace it with the newly introduced opaque type vma_flags, which we call flags so we refer to the new bitmap field as vma->flags. We update vma_flag_[test, set]_atomic() to account for the change also. We adapt vm_flags_reset_once() to only clear those bits above the first system word providing write-once semantics to the first system word (which it is presumed the caller requires - and in all current use cases this is so). As we currently only specify that the VMA flags bitmap size is equal to BITS_PER_LONG number of bits, this is a noop, but is defensive in preparation for a future change that increases this. We additionally update the VMA userland test declarations to implement the same changes there. Finally, we update the rust code to reference vma->vm_flags on update rather than vma->__vm_flags which has been removed. This is safe for now, albeit it is implicitly performing a const cast. Once we introduce flag helpers we can improve this more. No functional change intended. Link: https://lkml.kernel.org/r/bab179d7b153ac12f221b7d65caac2759282cfe9.1764064557.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Reviewed-by: Pedro Falcato Acked-by: Alice Ryhl [rust] Cc: Alex Gaynor Cc: Alistair Popple Cc: Andreas Hindborg Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Ben Segall Cc: Björn Roy Baron Cc: Boqun Feng Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Danilo Krummrich Cc: David Hildenbrand Cc: David Rientjes Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gary Guo Cc: Gregory Price Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Jann Horn Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Joshua Hahn Cc: Juri Lelli Cc: Kairui Song Cc: Kees Cook Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Trevor Gross Cc: Valentin Schneider Cc: Vincent Guittot Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 4c613f518f786fb0ca4850e4ca5f1933d6a4a304 Author: Lorenzo Stoakes Date: Tue Nov 25 10:01:01 2025 +0000 tools/testing/vma: eliminate dependency on vma->__vm_flags The userland VMA test code relied on an internal implementation detail - the existence of vma->__vm_flags to directly access VMA flags. There is no need to do so when we have the vm_flags_*() helper functions available. This is ugly, but also a subsequent commit will eliminate this field altogether so this will shortly become broken. This patch has us utilise the helper functions instead. Link: https://lkml.kernel.org/r/6275c53a6bb20743edcbe92d3e130183b47d18d0.1764064557.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Acked-by: Pedro Falcato Acked-by: Alice Ryhl [rust] Cc: Alex Gaynor Cc: Alistair Popple Cc: Andreas Hindborg Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Ben Segall Cc: Björn Roy Baron Cc: Boqun Feng Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Danilo Krummrich Cc: David Hildenbrand Cc: David Rientjes Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gary Guo Cc: Gregory Price Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Jann Horn Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Joshua Hahn Cc: Juri Lelli Cc: Kairui Song Cc: Kees Cook Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Trevor Gross Cc: Valentin Schneider Cc: Vincent Guittot Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 58eac97a8ba0bcfc5dffb347e40ea3006347ff38 Author: Lorenzo Stoakes Date: Tue Nov 25 10:01:00 2025 +0000 mm: simplify and rename mm flags function for clarity The __mm_flags_set_word() function is slightly ambiguous - we use 'set' to refer to setting individual bits (such as in mm_flags_set()) but here we use it to refer to overwriting the value altogether. Rename it to __mm_flags_overwrite_word() to eliminate this ambiguity. We additionally simplify the functions, eliminating unnecessary bitmap_xxx() operations (the compiler would have optimised these out but it's worth being as clear as we can be here). Link: https://lkml.kernel.org/r/8f0bc556e1b90eca8ea5eba41f8d5d3f9cd7c98a.1764064557.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Reviewed-by: Pedro Falcato Acked-by: Alice Ryhl [rust] Cc: Alex Gaynor Cc: Alistair Popple Cc: Andreas Hindborg Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Ben Segall Cc: Björn Roy Baron Cc: Boqun Feng Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Danilo Krummrich Cc: David Hildenbrand Cc: David Rientjes Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gary Guo Cc: Gregory Price Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Jann Horn Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Joshua Hahn Cc: Juri Lelli Cc: Kairui Song Cc: Kees Cook Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Trevor Gross Cc: Valentin Schneider Cc: Vincent Guittot Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 2b6a3f061f11372af79b862d6184d43193ae927f Author: Lorenzo Stoakes Date: Tue Nov 25 10:00:59 2025 +0000 mm: declare VMA flags by bit Patch series "initial work on making VMA flags a bitmap", v3. We are in the rather silly situation that we are running out of VMA flags as they are currently limited to a system word in size. This leads to absurd situations where we limit features to 64-bit architectures only because we simply do not have the ability to add a flag for 32-bit ones. This is very constraining and leads to hacks or, in the worst case, simply an inability to implement features we want for entirely arbitrary reasons. This also of course gives us something of a Y2K type situation in mm where we might eventually exhaust all of the VMA flags even on 64-bit systems. This series lays the groundwork for getting away from this limitation by establishing VMA flags as a bitmap whose size we can increase in future beyond 64 bits if required. This is necessarily a highly iterative process given the extensive use of VMA flags throughout the kernel, so we start by performing basic steps. Firstly, we declare VMA flags by bit number rather than by value, retaining the VM_xxx fields but in terms of these newly introduced VMA_xxx_BIT fields. While we are here, we use sparse annotations to ensure that, when dealing with VMA bit number parameters, we cannot be passed values which are not declared as such - providing some useful type safety. We then introduce an opaque VMA flag type, much like the opaque mm_struct flag type introduced in commit bb6525f2f8c4 ("mm: add bitmap mm->flags field"), which we establish in union with vma->vm_flags (but still set at system word size meaning there is no functional or data type size change). We update the vm_flags_xxx() helpers to use this new bitmap, introducing sensible helpers to do so. This series lays the foundation for further work to expand the use of bitmap VMA flags and eventually eliminate these arbitrary restrictions. This patch (of 4): In order to lay the groundwork for VMA flags being a bitmap rather than a system word in size, we need to be able to consistently refer to VMA flags by bit number rather than value. Take this opportunity to do so in an enum which we which is additionally useful for tooling to extract metadata from. This additionally makes it very clear which bits are being used for what at a glance. We use the VMA_ prefix for the bit values as it is logical to do so since these reference VMAs. We consistently suffix with _BIT to make it clear what the values refer to. We declare bit values even when the flags that use them would not be enabled by config options as this is simply clearer and clearly defines what bit numbers are used for what, at no additional cost. We declare a sparse-bitwise type vma_flag_t which ensures that users can't pass around invalid VMA flags by accident and prepares for future work towards VMA flags being a bitmap where we want to ensure bit values are type safe. To make life easier, we declare some macro helpers - DECLARE_VMA_BIT() allows us to avoid duplication in the enum bit number declarations (and maintaining the sparse __bitwise attribute), and INIT_VM_FLAG() is used to assist with declaration of flags. Unfortunately we can't declare both in the enum, as we run into issue with logic in the kernel requiring that flags are preprocessor definitions, and additionally we cannot have a macro which declares another macro so we must define each flag macro directly. Additionally, update the VMA userland testing vma_internal.h header to include these changes. We also have to fix the parameters to the vma_flag_*_atomic() functions since VMA_MAYBE_GUARD_BIT is now of type vma_flag_t and sparse will complain otherwise. We have to update some rather silly if-deffery found in mm/task_mmu.c which would otherwise break. Finally, we update the rust binding helper as now it cannot auto-detect the flags at all. Link: https://lkml.kernel.org/r/cover.1764064556.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/3a35e5a0bcfa00e84af24cbafc0653e74deda64a.1764064556.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Reviewed-by: Pedro Falcato Acked-by: Alice Ryhl [rust] Cc: Alex Gaynor Cc: Alistair Popple Cc: Andreas Hindborg Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Ben Segall Cc: Björn Roy Baron Cc: Boqun Feng Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Danilo Krummrich Cc: David Hildenbrand Cc: David Rientjes Cc: Dev Jain Cc: Dietmar Eggemann Cc: Gary Guo Cc: Gregory Price Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Jann Horn Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Joshua Hahn Cc: Juri Lelli Cc: Kairui Song Cc: Kees Cook Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Muchun Song Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Shakeel Butt Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Trevor Gross Cc: Valentin Schneider Cc: Vincent Guittot Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 8f4338b1141e1e44a405ce245d18a29a834d32b6 Author: Chu Guangqing Date: Tue Nov 25 10:05:22 2025 +0800 zram: fix a spelling mistake The spelling of the word "relases" is incorrect; it should be "releases". Link: https://lkml.kernel.org/r/20251125020522.1913-1-chuguangqing@inspur.com Signed-off-by: Chu Guangqing Reviewed-by: Sergey Senozhatsky Cc: Jens Axboe Cc: Minchan Kim Signed-off-by: Andrew Morton commit a493c7a65074e182e52306fc05b10896f9634855 Author: fujunjie Date: Sat Nov 15 03:02:55 2025 +0000 mm/page_alloc: optimize lowmem_reserve max lookup using its semantic monotonicity calculate_totalreserve_pages() currently finds the maximum lowmem_reserve[j] for a zone by scanning the full forward range [j = zone_idx .. MAX_NR_ZONES). However, for a given zone i, the lowmem_reserve[j] array (for j > i) is naturally expected to form a monotonically non-decreasing sequence in j, not as an implementation detail, but as a consequence that naturally arises from the semantics of lowmem_reserve[]. For zone "i", lowmem_reserve[j] expresses how many pages in zone i must effectively be kept in reserve when deciding whether an allocation class that may allocate from zones up to j is allowed to fall back into i. It protects less flexible allocation classes (which cannot use higher zones) from being starved by more flexible ones. Viewed from this semantics, it is natural to expect a partial ordering in j: as j increases, the allocation class gains access to a strictly larger set of fallback zones. Therefore lowmem_reserve[j] is expected to be monotonically non-decreasing in j: more flexible allocation classes must not be allowed to deplete low zones more aggressively than less flexible ones. In other words, if lowmem_reserve[j] were ever observed to *decrease* as j grows, that would be unexpected from the reserve semantics' point of view and would likely indicate a semantic change or a misconfiguration. The current implementation in setup_per_zone_lowmem_reserve() reflects this policy by accumulating managed pages from higher zones and applying the configured ratio, which results in a non-decreasing sequence. This patch makes calculate_totalreserve_pages() rely on that monotonicity explicitly and finds the maximum reserve value by scanning backward and stopping at the first non-zero entry. This avoids unnecessary iteration and reflects the conceptual model more directly. No functional behavior changes. To maintain this assumption explicitly, a comment is added next to setup_per_zone_lowmem_reserve() documenting the monotonicity expectation and noting that calculate_totalreserve_pages() relies on it. Link: https://lkml.kernel.org/r/tencent_EB0FED91B01B1F8B6DAEE96719C5F5797F07@qq.com Signed-off-by: fujunjie Acked-by: Zi Yan Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3cf41edc2067de9265f9f58b905317723c59a0c7 Author: Jiayuan Chen Date: Fri Oct 24 10:27:11 2025 +0800 mm/vmscan: skip increasing kswapd_failures when reclaim was boosted We have a colocation cluster used for deploying both offline and online services simultaneously. In this environment, we encountered a scenario where direct memory reclamation was triggered due to kswapd not running. 1. When applications start up, rapidly consume memory, or experience network traffic bursts, the kernel reaches steal_suitable_fallback(), which sets watermark_boost and subsequently wakes kswapd. 2. In the core logic of kswapd thread (balance_pgdat()), when reclaim is triggered by watermark_boost, the maximum priority is 10. Higher priority values mean less aggressive LRU scanning, which can result in no pages being reclaimed during a single scan cycle: if (nr_boost_reclaim && sc.priority == DEF_PRIORITY - 2) raise_priority = false; 3. Additionally, many of our pods are configured with memory.low, which prevents memory reclamation in certain cgroups, further increasing the chance of failing to reclaim memory. 4. This eventually causes pgdat->kswapd_failures to continuously accumulate, exceeding MAX_RECLAIM_RETRIES, and consequently kswapd stops working. At this point, the system's available memory is still significantly above the high watermark -- it's inappropriate for kswapd to stop under these conditions. The final observable issue is that a brief period of rapid memory allocation causes kswapd to stop running, ultimately triggering direct reclaim and making the applications unresponsive. This problem leading to direct memory reclamation has been a long-standing issue in our production environment. We initially held the simple assumption that it was caused by applications allocating memory too rapidly for kswapd to keep up with reclamation. However, after we began monitoring kswapd's runtime behavior, we discovered a different pattern: kswapd initially exhibits very aggressive activity even when there is still considerable free memory, but it subsequently stops running entirely, even as memory levels approach the low watermark. In summary, both boosted watermarks and memory.low increase the probability of kswapd operation failures. This patch specifically addresses the scenario involving boosted watermarks by not incrementing kswapd_failures when reclamation fails. A more general solution, potentially addressing memory.low or other cases, requires further discussion. Link: https://lkml.kernel.org/r/53de0b3ee0b822418e909db29bfa6513faff9d36@linux.dev Link: https://lkml.kernel.org/r/20251024022711.382238-1-jiayuan.chen@linux.dev Signed-off-by: Jiayuan Chen Reviewed-by: Shakeel Butt Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit ff34657aa72a4dab9c2fd38e1b31a506951f4b1c Author: Ritesh Oedayrajsingh Varma Date: Fri Nov 28 01:02:35 2025 +0100 bpf: optimize bpf_map_update_elem() for map-in-map types Updating a BPF_MAP_TYPE_HASH_OF_MAPS or BPF_MAP_TYPE_ARRAY_OF_MAPS via bpf_map_update_elem() is very expensive. In one of our workloads, we're inserting ~1400 maps of type BPF_MAP_TYPE_ARRAY into a BPF_MAP_TYPE_ARRAY_OF_MAPS. This takes ~21 seconds on a single thread, with an average of ~15ms per call: Function Name: map_update_elem Number of calls: 1369 Total time: 21s 182ms 966µs Maximum: 47ms 937µs Average: 15ms 473µs Minimum: 7µs Profiling shows that nearly all of this time is going to synchronize_rcu(), via maybe_wait_bpf_programs() in map_update_elem(). The call to synchronize_rcu() is done to ensure that after bpf_map_update_elem() returns, no BPF programs are still looking at the old value of the map, per commit 1ae80cf31938 ("bpf: wait for running BPF programs when updating map-in-map"). As discussed on the bpf mailing list, replace synchronize_rcu() with synchronize_rcu_expedited(). This is 175x faster: it now takes an average of 88 microseconds per call, for a total of 127 milliseconds in the same benchmark: Function Name: map_update_elem Number of calls: 1439 Total time: 127ms 626µs Maximum: 445µs Average: 88µs Minimum: 10µs Link: https://lore.kernel.org/bpf/CAH6OuBR=w2kybK6u7aH_35B=Bo1PCukeMZefR=7V4Z2tJNK--Q@mail.gmail.com/ Signed-off-by: Ritesh Oedayrajsingh Varma Link: https://lore.kernel.org/r/20251128000422.20462-1-ritesh@superluminal.eu Signed-off-by: Alexei Starovoitov commit c1af4465b9b983d9e7cefa01ec869e91c3dea11c Author: Menglong Dong Date: Wed Nov 26 16:52:46 2025 +0800 bpf: make kprobe_multi_link_prog_run always_inline Make kprobe_multi_link_prog_run() always inline to obtain better performance. Before this patch, the bench performance is: ./bench trig-kprobe-multi Setting up benchmark 'trig-kprobe-multi'... Benchmark 'trig-kprobe-multi' started. Iter 0 ( 95.485us): hits 62.462M/s ( 62.462M/prod), [...] Iter 1 (-80.054us): hits 62.486M/s ( 62.486M/prod), [...] Iter 2 ( 13.572us): hits 62.287M/s ( 62.287M/prod), [...] Iter 3 ( 76.961us): hits 62.293M/s ( 62.293M/prod), [...] Iter 4 (-77.698us): hits 62.394M/s ( 62.394M/prod), [...] Iter 5 (-13.399us): hits 62.319M/s ( 62.319M/prod), [...] Iter 6 ( 77.573us): hits 62.250M/s ( 62.250M/prod), [...] Summary: hits 62.338 ± 0.083M/s ( 62.338M/prod) And after this patch, the performance is: Iter 0 (454.148us): hits 66.900M/s ( 66.900M/prod), [...] Iter 1 (-435.540us): hits 68.925M/s ( 68.925M/prod), [...] Iter 2 ( 8.223us): hits 68.795M/s ( 68.795M/prod), [...] Iter 3 (-12.347us): hits 68.880M/s ( 68.880M/prod), [...] Iter 4 ( 2.291us): hits 68.767M/s ( 68.767M/prod), [...] Iter 5 ( -1.446us): hits 68.756M/s ( 68.756M/prod), [...] Iter 6 ( 13.882us): hits 68.657M/s ( 68.657M/prod), [...] Summary: hits 68.792 ± 0.087M/s ( 68.792M/prod) As we can see, the performance of kprobe-multi increase from 62M/s to 68M/s. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20251126085246.309942-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 85bdeeb48f8731143f08e9ef7639ebca0464b1af Merge: 34235a3544f202 1d17bcce6a0e55 Author: Alexei Starovoitov Date: Sat Nov 29 09:37:41 2025 -0800 Merge branch 'selftests-bpf-convert-test_tc_edt-sh-into-test_progs' Alexis Lothoré says: ==================== selftests/bpf: convert test_tc_edt.sh into test_progs Hello, this is a (late) v2 to my first attempt to convert the test_tc_edt script to test_progs. This new version is way simpler, thanks to Martin's suggestion about properly using the existing network_helpers rather than reinventing the wheel. It also fixes a small bug in the measured effective rate. The converted test roughly follows the original script logic, with two veths in two namespaces, a TCP connection between a client and a server, and the client pushing a specific amount of data. Time is recorded before and after the transmission to compute the effective rate. There are two knobs driving the robustness of the test in CI: - the amount of pushed data (the higher, the more precise is the effective rate) - the tolerated error margin The original test was configured with a 20s duration and a 1% error margin. The new test is configured with 1MB of data being pushed and a 2% error margin, to: - make the duration tolerable in CI - while keeping enough margin for rate measure fluctuations depending on the CI machines load This has been run multiple times locally to ensure that those values are sane, and once in CI before sending the series, but I suggest to let it live a few days in CI to see how it really behaves. Signed-off-by: Alexis Lothoré (eBPF Foundation) Changes in v2: - drop custom client/server management - update bpf program now that server pushes data - fix effective rate computation - Link to v1: https://lore.kernel.org/r/20251031-tc_edt-v1-0-5d34a5823144@bootlin.com --- Alexis Lothoré (eBPF Foundation) (4): selftests/bpf: rename test_tc_edt.bpf.c section to expose program type selftests/bpf: integrate test_tc_edt into test_progs selftests/bpf: remove test_tc_edt.sh selftests/bpf: do not hardcode target rate in test_tc_edt BPF program tools/testing/selftests/bpf/Makefile | 2 - .../testing/selftests/bpf/prog_tests/test_tc_edt.c | 145 +++++++++++++++++++++ tools/testing/selftests/bpf/progs/test_tc_edt.c | 11 +- tools/testing/selftests/bpf/test_tc_edt.sh | 100 -------------- 4 files changed, 151 insertions(+), 107 deletions(-) --- base-commit: 233a075a1b27070af76d64541cf001340ecff917 change-id: 20251030-tc_edt-3ea8e8d3d14e Best regards, ==================== Link: https://patch.msgid.link/20251128-tc_edt-v2-0-26db48373e73@bootlin.com Signed-off-by: Alexei Starovoitov commit 1d17bcce6a0e55b075309418199be212f70817ff Author: Alexis Lothoré (eBPF Foundation) Date: Fri Nov 28 23:27:21 2025 +0100 selftests/bpf: do not hardcode target rate in test_tc_edt BPF program test_tc_edt currently defines the target rate in both the userspace and BPF parts. This value could be defined once in the userspace part if we make it able to configure the BPF program before starting the test. Add a target_rate variable in the BPF part, and make the userspace part set it to the desired rate before attaching the shaping program. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20251128-tc_edt-v2-4-26db48373e73@bootlin.com Signed-off-by: Alexei Starovoitov commit 50ce5ea5f7929b7a0267a2ab70115a6b8800a1d7 Author: Alexis Lothoré (eBPF Foundation) Date: Fri Nov 28 23:27:20 2025 +0100 selftests/bpf: remove test_tc_edt.sh Now that test_tc_edt has been integrated in test_progs, remove the legacy shell script. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20251128-tc_edt-v2-3-26db48373e73@bootlin.com Signed-off-by: Alexei Starovoitov commit b0f82e7ab6fb2f8501ef87ae928cbf7358d7845e Author: Alexis Lothoré (eBPF Foundation) Date: Fri Nov 28 23:27:19 2025 +0100 selftests/bpf: integrate test_tc_edt into test_progs test_tc_edt.sh uses a pair of veth and a BPF program attached to the TX veth to shape the traffic to 5MBps. It then checks that the amount of received bytes (at interface level), compared to the TX duration, indeed matches 5Mbps. Convert this test script to the test_progs framework: - keep the double veth setup, isolated in two veths - run a small tcp server, and connect client to server - push a pre-configured amount of bytes, and measure how much time has been needed to push those - ensure that this rate is in a 2% error margin around the target rate This two percent value, while being tight, is hopefully large enough to not make the test too flaky in CI, while also turning it into a small example of BPF-based shaping. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20251128-tc_edt-v2-2-26db48373e73@bootlin.com Signed-off-by: Alexei Starovoitov commit 4b4833acc63e9c8ea9d5897ee84b694f30b23882 Author: Alexis Lothoré (eBPF Foundation) Date: Fri Nov 28 23:27:18 2025 +0100 selftests/bpf: rename test_tc_edt.bpf.c section to expose program type The test_tc_edt BPF program uses a custom section name, which works fine when manually loading it with tc, but prevents it from being loaded with libbpf. Update the program section name to "tc" to be able to manipulate it with a libbpf-based C test. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20251128-tc_edt-v2-1-26db48373e73@bootlin.com Signed-off-by: Alexei Starovoitov commit 34235a3544f20291819c20d1d6c4ba07784045a2 Merge: bd5bdd200c9e98 3448375e71a49c Author: Alexei Starovoitov Date: Sat Nov 29 09:35:36 2025 -0800 Merge branch 'limited-queueing-in-nmi-for-rqspinlock' Kumar Kartikeya Dwivedi says: ==================== Limited queueing in NMI for rqspinlock Ritesh reported that he was frequently seeing timeouts in cases which should have been covered by the AA heuristics. This led to the discovery of multiple gaps in the current code that could lead to timeouts when AA heuristics could work to prevent them. More details and investigation is available in the original threads. [0][1] This set restores the ability for NMI waiters to queue in the slow path, and reduces the cases where they would attempt to trylock. However, such queueing must not happen when interrupting waiters which the NMI itself depends upon for forward progress; in those cases the trylock fallback remains, but with a single attempt to avoid aimless attempts to acquire the lock. It also closes a possible window in the lock fast path and the unlock path where NMIs landing between cmpxchg and entry creation, or entry deletion and unlock would miss the detection of an AA scenario and end up timing out. This virtually eliminates all the cases where existing heuristics can prevent timeouts and quickly recover from a deadlock. More details are available in the commit logs for each patch. [0]: https://lore.kernel.org/bpf/CAH6OuBTjG+N=+GGwcpOUbeDN563oz4iVcU3rbse68egp9wj9_A@mail.gmail.com [1]: https://lore.kernel.org/bpf/20251125203253.3287019-1-memxor@gmail.com ==================== Link: https://patch.msgid.link/20251128232802.1031906-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 3448375e71a49cc29cc62cc941bea137d723956e Author: Kumar Kartikeya Dwivedi Date: Fri Nov 28 23:28:02 2025 +0000 selftests/bpf: Add success stats to rqspinlock stress test Add stats to observe the success and failure rate of lock acquisition attempts in various contexts. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251128232802.1031906-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 087849cca31d35e3643dedb0d35ba3f7e9cc6758 Author: Kumar Kartikeya Dwivedi Date: Fri Nov 28 23:28:01 2025 +0000 rqspinlock: Precede non-head waiter queueing with AA check While previous commits sufficiently address the deadlocks, there are still scenarios where queueing of waiters in NMIs can exacerbate the possibility of timeouts. Consider the case below: CPU 0 res_spin_lock(A) -> becomes non-head waiter lock owner in CS or pending waiter spinning CPU 1 res_spin_lock(A) -> head waiter spinning on owner/pending bits In such a scenario, the non-head waiter in NMI on CPU 0 will not poll for deadlocks or timeout since it will simply queue behind previous waiter (head on CPU 1), and also not enter the trylock fallback since no rqspinlock queue waiter is active on CPU 0. In such a scenario, the transaction initiated by the head waiter on CPU 1 will timeout, signalling the NMI and ending the cyclic dependency, but it will cost 250 ms of time. Instead, the NMI on CPU 0 could simply check for the presence of an AA deadlock and only proceed with queueing on success. Add such a check right before any form of queueing is initiated. The reason the AA deadlock check is not used in conjunction with in_nmi() is that a similar case could occur due to a reentrant path in the owner's critical section, and unconditionally checking for AA before entering the queueing path avoids expensive timeouts. Non-NMI reentrancy only happens at controlled points in the slow path (with specific tracepoints which do not impede the forward progress of a waiter loop), or in the owner CS, while NMIs can land anywhere. While this check is only needed for non-head waiter queueing, checking whether we are head or not is racy without xchg_tail, and after that point, we are already queued, hence for simplicity we must invoke the check unconditionally. Note that a more contrived case could still be constructed by using two locks, and interrupting the progress of the respective owners by non-head waiters of the other lock, in an ABBA fashion, which would still not be covered by the current set of checks and conditions. It would still lead to a timeout though, and not a deadlock. An ABBA check cannot happen optimistically before the queueing, since it can be racy, and needs to be happen continuously during the waiting period, which would then require an unlinking step for queued NMI/reentrant waiters. This is beyond the scope of this patch. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251128232802.1031906-6-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 30dc2f7025fe461132595500c761075a250f0e16 Author: Kumar Kartikeya Dwivedi Date: Fri Nov 28 23:28:00 2025 +0000 rqspinlock: Disable spinning for trylock fallback The original trylock fallback was inherited from qspinlock, and then reused for the reentrant NMIs while the slow path is active. However, under contention, it is very unlikely for the trylock to succeed in taking the lock. In addition, a trylock also has no fairness guarantees, and thus is prone to starvation issues under extreme scenarios. The original qspinlock had no choice in terms of returning an error the caller; if the node count was breached, it had to fall back to trylock to attempt to take the lock. In case of rqspinlock, we do have the option of returning to the user. Thus, simply attempt the trylock once, and instead of spinning, return an error in case the lock cannot be taken. This ends up significantly reducing the time spent in the trylock fallback, since we no longer wait for the timeout duration trying to aimlessly acquire the lock when there's a high-probability that under contention, it won't be available to us anyway. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251128232802.1031906-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 81d5a6a438595e46be191d602e5c2d6d73992fdc Author: Kumar Kartikeya Dwivedi Date: Fri Nov 28 23:27:59 2025 +0000 rqspinlock: Use trylock fallback when per-CPU rqnode is busy In addition to deferring to the trylock fallback in NMIs, only do so when an rqspinlock waiter is queued on the current CPU. This is detected by noticing a non-zero node index. This allows NMI waiters to join the waiter queue if it isn't interrupting an existing rqspinlock waiter, and increase the chances of fairly obtaining the lock, performing deadlock detection as the head, and not being starved while attempting the trylock. The trylock path in particular is unlikely to succeed under contention, as it relies on the lock word becoming 0, which indicates no contention. This means that the most likely result for NMIs attempting a trylock is a timeout under contention if they don't hit an AA or ABBA case. The core problem being addressed through the fixed commit was removing the dependency edge between an NMI queue waiter and the queue waiter it is interrupting. Whenever a circular dependency forms, and with no way to break it (as non-head waiters don't poll for deadlocks or timeouts), we would enter into a deadlock. A trylock either breaks such an edge by probing for deadlocks, and finally terminating the waiting loop using a timeout. By excluding queueing on CPUs where the node index is non-zero for NMIs, this sort of dependency is broken. The CPU enters the trylock path for those cases, and falls back to deadlock checks and timeouts. However, in other case where it doesn't interrupt the CPU in the slow path while its queued on the lock, it can join the queue as a normal waiter, and avoid trylock associated starvation and subsequent timeouts. There are a few remaining cases here that matter: the NMI can still preempt the owner in its critical section, and if it queues as a non-head waiter, it can end up impeding the progress of the owner. While this won't deadlock, since the head waiter will eventually signal the NMI waiter to either stop (due to a timeout), it can still lead to long timeouts. These gaps will be addressed in subsequent commits. Note that while the node count detection approach is less conservative than simply deferring NMIs to trylock, it is going to return errors where attempts to lock B in NMI happen while waiters for lock A are in a lower context on the same CPU. However, this only occurs when the lower context is queued in the slow path, and the NMI attempt can proceed without failure in all other cases. To continue to prevent AA deadlocks (or ABBA in a similar NMI interrupting lower context pattern), we'd need a more fleshed out algorithm to unlink NMI waiters after they queue and detect such cases. However, all that complexity isn't appealing yet to reduce the failure rate in the small window inside the slow path. It is important to note that reentrancy in the slow path can also happen through trace_contention_{begin,end}, but in those cases, unlike an NMI, the forward progress of the head waiter (or the predecessor in general) is not being blocked. Fixes: 0d80e7f951be ("rqspinlock: Choose trylock fallback for NMI waiters") Reported-by: Ritesh Oedayrajsingh Varma Suggested-by: Alexei Starovoitov Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251128232802.1031906-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5860f5ce479f42b29fabab8f668859f13cae44bb Author: Kumar Kartikeya Dwivedi Date: Fri Nov 28 23:27:58 2025 +0000 rqspinlock: Perform AA checks immediately Currently, while we enter the check_timeout call immediately due to the way the ts.spin is initialized, we still invoke the AA and ABBA checks in the second invocation, and only initialize the timestamp in the first one. Since each iteration is at least done with a 1ms delay, this can add delays in detection of AA deadlocks, up to a ms. Rework check_timeout() to avoid this. First, call check_deadlock_AA() while initializing the timestamps for the wait period. This also means that we only do it once per waiting period, instead of every invocation. Finally, drop check_deadlock() and call check_deadlock_ABBA() directly. To save on unnecessary ktime_get_mono_fast_ns() in case of AA deadlock, sample the time only if it returns 0. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251128232802.1031906-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit beb7021a6003d9c6a463fffca0d6311efb8e0e66 Author: Kumar Kartikeya Dwivedi Date: Fri Nov 28 23:27:57 2025 +0000 rqspinlock: Enclose lock/unlock within lock entry acquisitions Ritesh reported that timeouts occurred frequently for rqspinlock despite reentrancy on the same lock on the same CPU in [0]. This patch closes one of the races leading to this behavior, and reduces the frequency of timeouts. We currently have a tiny window between the fast-path cmpxchg and the grabbing of the lock entry where an NMI could land, attempt the same lock that was just acquired, and end up timing out. This is not ideal. Instead, move the lock entry acquisition from the fast path to before the cmpxchg, and remove the grabbing of the lock entry in the slow path, assuming it was already taken by the fast path. The TAS fallback is invoked directly without being preceded by the typical fast path, therefore we must continue to grab the deadlock detection entry in that case. Case on lock leading to missed AA: cmpxchg lock A ... rqspinlock acquisition of A ... timeout grab_held_lock_entry(A) There is a similar case when unlocking the lock. If the NMI lands between the WRITE_ONCE and smp_store_release, it is possible that we end up in a situation where the NMI fails to diagnose the AA condition, leading to a timeout. Case on unlock leading to missed AA: WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL) ... rqspinlock acquisition of A ... timeout smp_store_release(A->locked, 0) The patch changes the order on unlock to smp_store_release() succeeded by WRITE_ONCE() of NULL. This avoids the missed AA detection described above, but may lead to a false positive if the NMI lands between these two statements, which is acceptable (and preferred over a timeout). The original intention of the reverse order on unlock was to prevent the following possible misdiagnosis of an ABBA scenario: grab entry A lock A grab entry B lock B unlock B smp_store_release(B->locked, 0) grab entry B lock B grab entry A lock A ! WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL) If the store release were is after the WRITE_ONCE, the other CPU would not observe B in the table of the CPU unlocking the lock B. However, since the threads are obviously participating in an ABBA deadlock, it is no longer appealing to use the order above since it may lead to a 250 ms timeout due to missed AA detection. [0]: https://lore.kernel.org/bpf/CAH6OuBTjG+N=+GGwcpOUbeDN563oz4iVcU3rbse68egp9wj9_A@mail.gmail.com Fixes: 0d80e7f951be ("rqspinlock: Choose trylock fallback for NMI waiters") Reported-by: Ritesh Oedayrajsingh Varma Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251128232802.1031906-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 464257baf99200d1be1c053f15aa617056361e81 Author: Mauro Carvalho Chehab Date: Fri Nov 21 12:05:28 2025 +0100 docs: makefile: move rustdoc check to the build wrapper The makefile logic to detect if rust is enabled is not working the way it was expected: instead of using the current setup for CONFIG_RUST, it uses a cached version from a previous build. The root cause is that the current logic inside docs/Makefile uses a cached version of CONFIG_RUST, from the last time a non documentation target was executed. That's perfectly fine for Sphinx build, as it doesn't need to read or depend on any CONFIG_*. So, instead of relying at the cache, move the logic to the wrapper script and let it check the current content of .config, to verify if CONFIG_RUST was selected. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit b9a565b3e4d852d8af14f2c4be0b1dc45f0884b6 Author: Sasha Levin Date: Fri Nov 21 13:00:09 2025 -0500 README: restructure with role-based documentation and guidelines Reorganize README to provide targeted documentation paths for different user roles including developers, researchers, security experts, and maintainers. Add quick start section and essential docs links. Signed-off-by: Sasha Levin Reviewed-by: Randy Dunlap Reviewed-by: Mauro Carvalho Chehab Reviewed-by: Kees Cook Reviewed-by: SeongJae Park Reviewed-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Message-ID: <20251121180009.2634393-1-sashal@kernel.org> commit 5f88f44d8427a97347afda3a6114aed0df472a0b Author: Randy Dunlap Date: Sun Nov 23 20:10:11 2025 -0800 docs: kdoc: various fixes for grammar, spelling, punctuation Correct grammar, spelling, and punctuation in comments, strings, print messages, logs. Change two instances of two spaces between words to just one space. codespell was used to find misspelled words. Signed-off-by: Randy Dunlap Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Cc: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20251124041011.3030571-1-rdunlap@infradead.org> commit 18182f9758de45f5ea1e46b95f3a9548a30eb61d Author: Randy Dunlap Date: Tue Nov 25 22:17:52 2025 -0800 docs: kdoc_parser: use '@' for Excess enum value kdoc is looking for "@value" here, so use that kind of string in the warning message. The "%value" can be confusing. This changes: Warning: drivers/net/wireless/mediatek/mt76/testmode.h:92 Excess enum value '%MT76_TM_ATTR_TX_PENDING' description in 'mt76_testmode_attr' to this: Warning: drivers/net/wireless/mediatek/mt76/testmode.h:92 Excess enum value '@MT76_TM_ATTR_TX_PENDING' description in 'mt76_testmode_attr' Signed-off-by: Randy Dunlap Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20251126061752.3497106-1-rdunlap@infradead.org> commit e36a7b1e173459bb250cb6a70681b64aa6d04915 Author: Krzysztof Kozlowski Date: Wed Nov 26 09:19:06 2025 +0100 docs: submitting-patches: Clarify that removal of Acks needs explanation too The paragraph mentions only removal of Tested-by and Reviewed-by tags as action needing mentioning in patch changelog, so some developers treat it too literally. Acks, as a weaker form of review/approval, should rarely be removed, but if that happens it should be explained as well. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Jonathan Corbet Message-ID: <20251126081905.7684-2-krzysztof.kozlowski@oss.qualcomm.com> commit 2006f468bbf2f44fa3e295491c94ec116aa4b026 Author: Randy Dunlap Date: Wed Nov 26 22:31:17 2025 -0800 docs: kdoc_parser: add data/function attributes to ignore Recognize and ignore __rcu (in struct members), __private (in struct members), and __always_unused (in function parameters) to prevent kernel-doc warnings: Warning: include/linux/rethook.h:38 struct member 'void (__rcu *handler' not described in 'rethook' Warning: include/linux/hrtimer_types.h:47 Invalid param: enum hrtimer_restart (*__private function)(struct hrtimer *) Warning: security/ipe/hooks.c:81 function parameter '__always_unused' not described in 'ipe_mmap_file' Warning: security/ipe/hooks.c:109 function parameter '__always_unused' not described in 'ipe_file_mprotect' There are more of these (in compiler_types.h, compiler_attributes.h) that can be added as needed. Signed-off-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251127063117.150384-1-rdunlap@infradead.org> commit 4d23db5b24a60c4add4755763e1275b2e5d14ffb Author: Randy Dunlap Date: Wed Nov 26 22:31:25 2025 -0800 docs: MAINTAINERS: update Mauro's files/paths Update Mauro's F: (files/paths) entry for docs scripts so that get_maintainer.pl will report these correctly. This is copied from Jon's entries for these paths. Signed-off-by: Randy Dunlap Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <20251127063125.150441-1-rdunlap@infradead.org> commit 0dd5cf95b737f9917fce095578b1c9549e38c132 Merge: d879c2e0195bd5 f12ae9ba4d2347 Author: Jonathan Corbet Date: Sat Nov 29 08:09:58 2025 -0700 Merge tag 'Chinese-docs-6.19' of gitolite.kernel.org:pub/scm/linux/kernel/git/alexs/linux into tmp Chinese translation docs for 6.19 This is the Chinese translation subtree for 6.19. It includes the following changes: - Add block part translations - Update kbuild.rst translations - Add more scsi translations and fixes Above patches are tested by 'make htmldocs' Signed-off-by: Alex Shi commit 801b0840b09d93c51d23df9f92c063979058c153 Merge: de95c587981a98 f6dffe2a9ed1bd Author: Miquel Raynal Date: Sat Nov 29 14:10:16 2025 +0100 Merge tag 'nand/for-6.19' into mtd/next Raw NAND changes: * The major change in this MR will be the support for the Allwinner H616 NAND controller, which lead to numerous changes and cleanups in the driver. * Another notable change on this driver is the use of field_get()/field_prep(), but since the global support for this helpers is going to be merged in the same release as we start using these helpers, it implies undefining them in the first place to avoid warnings. Depending on the merging order (Yuri's bitmap branch or mtd/next), a temporary warning may arise. * Marvell drivers layout handling changes have also landed, they fix previous definitions and abuses that have been made previously, which implied to relax the ECC parameters validation in the core a bit. * The Cadence NAND controller driver gets NV-DDR interface support. SPI NAND changes: * Support for FudanMicro FM25S01BI3 and ESMT F50L1G41LC is added. Aside from these main changes, there is the usual load of fixes and API updates. commit de95c587981a9870a81e8e74c273aa72397d97ad Merge: 2158890a1af19e ed26bd40df11ee Author: Miquel Raynal Date: Sat Nov 29 14:06:31 2025 +0100 Merge tag 'spi-nor/for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux into mtd/next SPI NOR changes for 6.19 Notable changes: - Fix SMPT parsing for S25FS-S flash family. They report variable dummy cycles for reads. This results in the default of 0 being used. This works for other Infineon chips, but not for the S25FS-S family. They need 8 dummy cycles. Add fixup hooks to specify that. Also add fixup hooks to fix incorrect map ID data in SFDP. - Add support for a bunch of Winbond flashes. Their block protection information is not discoverable, so they need to have an entry in the flash tables to describe that. - Some cleanups for Micron flash support. - Add support for Micron mt35xu01gbba. - Some SPI controllers like the Intel one on the PCI bus do not support the read CR opcode (0x35). Do not use the opcode if the controller does not support it. # -----BEGIN PGP SIGNATURE----- # # iHUEABYKAB0WIQQTlUWNzXGEo3bFmyIR4drqP028CQUCaSjP+QAKCRAR4drqP028 # CfGsAQC5Vj+FaeQHyY+yywqM5wxE+xj6mMCDNixd2FVYlf5b7wEA2/9bpiHjy3qi # 4MZmFJNcE+XsxReWDTBTZ6VbrjDlqg0= # =M+s4 # -----END PGP SIGNATURE----- # gpg: Signature made jeu. 27 nov. 2025 23:26:01 CET # gpg: using EDDSA key 1395458DCD7184A376C59B2211E1DAEA3F4DBC09 # gpg: Good signature from "Pratyush Yadav " [expired] # gpg: aka "Pratyush Yadav " [expired] # gpg: p.yadav@ti.com: Verified 5 signatures in the past 3 years. Encrypted 0 messages. # gpg: me@yadavpratyush.com: Verified 5 signatures in the past 3 years. Encrypted # 0 messages. # gpg: Note: This key has expired! # Primary key fingerprint: 805C 3923 2FBE 108C 49E1 663C F650 3556 C11B 1CCD # Subkey fingerprint: 1395 458D CD71 84A3 76C5 9B22 11E1 DAEA 3F4D BC09 commit 2158890a1af19e13ed222cda3623c8a11d3ec3b4 Author: Thorsten Blum Date: Mon Nov 24 13:31:25 2025 +0100 mtd: sm_ftl: Fix typo in comment in sm_read_lba s/is/if/ Signed-off-by: Thorsten Blum Signed-off-by: Miquel Raynal commit f3dc4d9898bc98e3cf569f038d90a5fec7bfc44a Author: Thorsten Blum Date: Sun Nov 23 19:21:02 2025 +0100 mtd: sm_ftl: Replace deprecated strncpy with sysfs_emit in sm_attr_show strncpy() is deprecated [1] for NUL-terminated destination buffers because it does not guarantee NUL termination. It also unnecessarily NUL-pads the destination buffer if the source is shorter. Replace it with sysfs_emit() using the "%.*s" format specifier and supply the length 'sm_attr->len' to improve sm_attr_show(). Return the number of characters actually written to 'buf' instead of 'sm_attr->len'. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Signed-off-by: Thorsten Blum Signed-off-by: Miquel Raynal commit c909fec69f84b39e63876c69b9df2c178c6b76ba Author: Ivan Stepchenko Date: Fri Nov 21 14:54:46 2025 +0300 mtd: lpddr_cmds: fix signed shifts in lpddr_cmds There are several places where a value of type 'int' is shifted by lpddr->chipshift. lpddr->chipshift is derived from QINFO geometry and might reach 31 when QINFO reports a 2 GiB size - the maximum supported by LPDDR(1) compliant chips. This may cause unexpected sign-extensions when casting the integer value to the type of 'unsigned long'. Use '1UL << lpddr->chipshift' and cast 'j' to unsigned long before shifting so the computation is performed at the destination width. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c68264711ca6 ("[MTD] LPDDR Command set driver") Signed-off-by: Ivan Stepchenko Signed-off-by: Miquel Raynal commit 1cce5a5ecafeb8a79aa9165cf134c97da7bbc7db Author: Randy Dunlap Date: Mon Nov 17 11:30:45 2025 -0800 mtd: docg3: fix kernel-doc warnings Fix kernel-doc warnings in docg3.h to avoid build warnings: Warning: ../drivers/mtd/devices/docg3.h:276 bad line: Warning: drivers/mtd/devices/docg3.h:299 struct member 'max_block' not described in 'docg3' Signed-off-by: Randy Dunlap Signed-off-by: Miquel Raynal commit f6dffe2a9ed1bdcee1879e2728310fb1e08602cf Author: Mikhail Zhilkin Date: Thu Nov 27 22:59:00 2025 +0300 mtd: spinand: add support for FudanMicro FM25S01BI3 Add support for FudanMicro FM25S01BI3 SPI NAND. Link: https://www.fmsh.com/nvm/FM25S01BI3_ds_eng.pdf Signed-off-by: Mikhail Zhilkin Signed-off-by: Miquel Raynal commit 414690746d2da0dc9a931f8c02d83e5834141251 Author: Randy Dunlap Date: Mon Nov 24 18:28:08 2025 -0800 i2c: i2c.h: fix a bad kernel-doc line Change an empty line into a blank kernel-doc line to prevent a kernel-doc warning: Warning: ../include/uapi/linux/i2c.h:38 bad line: Fixes: bfb3939c51d5 ("i2c: refactor documentation of struct i2c_msg") Signed-off-by: Randy Dunlap Signed-off-by: Wolfram Sang commit 621e57c37ea698e7ba69434ce610de97cd5367a6 Author: Magnus Lindholm Date: Sat Nov 22 14:45:01 2025 +0100 i2c: i2c-elektor: Allow building on SMP kernels In the past, the i2c-elektor driver was broken on SMP. Since then, there appear to have been some fixes and cleanup work (as pointed out by Wolfram Sang) to get rid of cli/sti usage and rely on spinlocks instead. Therefore, let's allow building the driver on SMP kernels again. I've tested this driver on an SMP kernel on an Alpha UP2000+ for a few days without any problems. Signed-off-by: Magnus Lindholm Signed-off-by: Wolfram Sang commit cb2dc6d2869a4fb7ef8d792a81a74bc6f0958a72 Author: Oliver Hartkopp Date: Sat Nov 29 10:05:00 2025 +0100 can: Kconfig: select CAN driver infrastructure by default The CAN bus support enabled with CONFIG_CAN provides a socket-based access to CAN interfaces. With the introduction of the latest CAN protocol CAN XL additional configuration status information needs to be exposed to the network layer than formerly provided by standard Linux network drivers. This requires the CAN driver infrastructure to be selected by default. As the CAN network layer can only operate on CAN interfaces anyway all distributions and common default configs enable at least one CAN driver. So selecting CONFIG_CAN_DEV when CONFIG_CAN is selected by the user has no effect on established configurations but solves potential build issues when CONFIG_CAN[_XXX]=y is set together with CANFIG_CAN_DEV=m Fixes: 1a620a723853 ("can: raw: instantly reject unsupported CAN frames") Reported-by: Vincent Mailhol Closes: https://lore.kernel.org/all/CAMZ6RqL_nGszwoLPXn1Li8op-ox4k3Hs6p=Hw6+w0W=DTtobPw@mail.gmail.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511280531.YnWW2Rxc-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511280842.djCQ0N0O-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511282325.uVQFRTkA-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511291520.guIE1QHj-lkp@intel.com/ Suggested-by: Marc Kleine-Budde Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251129090500.17484-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 2df3bf91d14d05d2d83cb332d0a7248e16577466 Merge: e9a6fb0bcdd760 aef72ebe9c86b5 Author: Wolfram Sang Date: Sat Nov 29 21:09:00 2025 +0900 Merge tag 'at24-updates-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-mergewindow at24 updates for v6.19-rc1 - add new compatible for Belling BL24S64 commit 324f3e03e8a85931ce0880654e3c3eb38b0f0bba Author: Junrui Luo Date: Fri Nov 28 12:06:31 2025 +0800 ALSA: dice: fix buffer overflow in detect_stream_formats() The function detect_stream_formats() reads the stream_count value directly from a FireWire device without validating it. This can lead to out-of-bounds writes when a malicious device provides a stream_count value greater than MAX_STREAMS. Fix by applying the same validation to both TX and RX stream counts in detect_stream_formats(). Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 58579c056c1c ("ALSA: dice: use extended protocol to detect available stream formats") Cc: stable@vger.kernel.org Reviewed-by: Takashi Sakamoto Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB7881B043FC68B4C0DA40B73DAFDCA@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Takashi Iwai commit ff736a286116d462a4067ba258fa351bc0b4ed80 Author: Thorsten Blum Date: Wed Nov 26 23:08:05 2025 +0100 net: ipconfig: Replace strncpy with strscpy in ic_proto_name strncpy() is deprecated [1] for NUL-terminated destination buffers because it does not guarantee NUL termination. Replace it with strscpy() to ensure the destination buffer is always NUL-terminated and to avoid any additional NUL padding. Although the identifier buffer has 252 usable bytes, strncpy() copied only up to 251 bytes to the zero-initialized buffer, relying on the last byte to act as an implicit NUL terminator. Switching to strscpy() avoids this implicit behavior and does not use magic numbers. The source string is also NUL-terminated and satisfies the __must_be_cstr() requirement of strscpy(). Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings [1] Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251126220804.102160-2-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit e5235eb6cfe02a51256013a78f7b28779a7740d5 Author: Breno Leitao Date: Thu Nov 27 07:30:15 2025 -0800 net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails on devices with IFF_DISABLE_NETPOLL flag. The warning (at kernel/workqueue.c:4242 in __flush_work) occurs because the cleanup path tries to cancel an uninitialized work queue. When __netpoll_setup() encounters a device with IFF_DISABLE_NETPOLL, it fails early and calls skb_pool_flush() for cleanup. This function calls cancel_work_sync(&np->refill_wq), but refill_wq hasn't been initialized yet, triggering the warning. Move INIT_WORK() to the beginning of __netpoll_setup(), ensuring the work queue is properly initialized before any potential failure points. This allows the cleanup path to safely cancel the work queue regardless of where the setup fails. Fixes: 248f6571fd4c5 ("netpoll: Optimize skb refilling on critical path") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251127-netpoll_fix_init_work-v1-1-65c07806d736@debian.org Signed-off-by: Jakub Kicinski commit 2c28ee720ad14f58eb88a97ec3efe7c5c315ea5d Author: Hangbin Liu Date: Thu Nov 27 14:33:10 2025 +0000 selftests: bonding: add delay before each xvlan_over_bond connectivity check Jakub reported increased flakiness in bond_macvlan_ipvlan.sh on regular kernel, while the tests consistently pass on a debug kernel. This suggests a timing-sensitive issue. To mitigate this, introduce a short sleep before each xvlan_over_bond connectivity check. The delay helps ensure neighbor and route cache have fully converged before verifying connectivity. The sleep interval is kept minimal since check_connection() is invoked nearly 100 times during the test. Fixes: 246af950b940 ("selftests: bonding: add macvlan over bond testing") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20251114082014.750edfad@kernel.org Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251127143310.47740-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 840a64710e6d26589d4bdcc99c765037a7c5c95f Merge: 8aa1053f9dafb8 d3a439e55c193b Author: Jakub Kicinski Date: Fri Nov 28 20:08:39 2025 -0800 Merge tag 'nf-next-25-11-28' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following batch contains Netfilter updates for net-next: 0) Add sanity check for maximum encapsulations in bridge vlan, reported by the new AI robot. 1) Move the flowtable path discovery code to its own file, the nft_flow_offload.c mixes the nf_tables evaluation with the path discovery logic, just split this in two for clarity. 2) Consolidate flowtable xmit path by using dev_queue_xmit() and the real device behind the layer 2 vlan/pppoe device. This allows to inline encapsulation. After this update, hw_ifidx can be removed since both ifidx and hw_ifidx now point to the same device. 3) Support for IPIP encapsulation in the flowtable, extend selftest to cover for this new layer 3 offload, from Lorenzo Bianconi. 4) Push down the skb into the conncount API to fix duplicates in the conncount list for packets with non-confirmed conntrack entries, this is due to an optimization introduced in d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC"). From Fernando Fernandez Mancera. 5) In conncount, disable BH when performing garbage collection to consolidate existing behaviour in the conncount API, also from Fernando. 6) A matching packet with a confirmed conntrack invokes GC if conncount reaches the limit in an attempt to release slots. This allows the existing extensions to be used for real conntrack counting, not just limiting new connections, from Fernando. 7) Support for updating ct count objects in nf_tables, from Fernando. 8) Extend nft_flowtables.sh selftest to send IPv6 TCP traffic, from Lorenzo Bianconi. 9) Fixes for UAPI kernel-doc documentation, from Randy Dunlap. * tag 'nf-next-25-11-28' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables: improve UAPI kernel-doc comments netfilter: ip6t_srh: fix UAPI kernel-doc comments format selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic netfilter: nft_connlimit: add support to object update operation netfilter: nft_connlimit: update the count if add was skipped netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH netfilter: nf_conncount: rework API to use sk_buff directly selftests: netfilter: nft_flowtable.sh: Add IPIP flowtable selftest netfilter: flowtable: Add IPIP tx sw acceleration netfilter: flowtable: Add IPIP rx sw acceleration netfilter: flowtable: use tuple address to calculate next hop netfilter: flowtable: remove hw_ifidx netfilter: flowtable: inline pppoe encapsulation in xmit path netfilter: flowtable: inline vlan encapsulation in xmit path netfilter: flowtable: consolidate xmit path netfilter: flowtable: move path discovery infrastructure to its own file netfilter: flowtable: check for maximum number of encapsulations in bridge vlan ==================== Link: https://patch.msgid.link/20251128002345.29378-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 8aa1053f9dafb866c069232d457b7b87b88ecba1 Merge: e48766e66b4d5b 64b0d2edb61aba Author: Jakub Kicinski Date: Fri Nov 28 20:03:43 2025 -0800 Merge branch 'introduce-the-dsa_xmit_port_mask-tagging-protocol-helper' Vladimir Oltean says: ==================== Introduce the dsa_xmit_port_mask() tagging protocol helper What ---- Some DSA tags have just the port number in the TX header format, others have a bit field where in theory, multiple bits can be set, even though DSA only sets one. The latter kind is now making use of a dsa_xmit_port_mask() helper, which will decide when to set more than 1 bit in that mask. Why --- David Yang has pointed out in a recently posted patch that HSR packet duplication on transmission can be offloaded even on HSR-unaware switches. This should be made generally available to all DSA switches. How to test ----------- These patches just lay the groundwork, and there should be no functional change - so for this set, regression testing is all that's necessary. For testing the HSR packet duplication idea, I've put together a branch: https://github.com/vladimiroltean/linux/commits/dsa-simple-hsr-offload/ where most drivers are patched to call dsa_port_simple_hsr_join() and dsa_port_simple_hsr_leave(). Assuming there are volunteers to also test the latter, one can enable CONFIG_HSR and create a HSR device using: $ ip link add name hsr0 type hsr slave1 swp0 slave2 swp1 supervision 45 version 1 This needs to be connected using 2 cables to another system where the same command was run. Then, one should be able to ping the other board through the hsr0 interface. Without the Github branch, a ping over HSR should increase the DSA conduit interface's TX counters by 2 packets. With the Github branch, the TX counters should increase by only 1 packet. Why so many patches ------------------- To avoid the situation where a patch has to be backported, conflicts with the work done here, pulls this in as a dependency, and that pulls in 13 other unrelated drivers. These don't have any dependencies between each other and can be cherry-picked at will (except they all depend on patch 1/15). ==================== Link: https://patch.msgid.link/20251127120902.292555-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 64b0d2edb61aba9009a1c957568ad674059841a0 Author: Vladimir Oltean Date: Thu Nov 27 14:09:02 2025 +0200 net: dsa: tag_yt921x: use the dsa_xmit_port_mask() helper The "yt921x" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: David Yang Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-16-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 24099389a63fb9a3cf79d04f38c7892a9957858b Author: Vladimir Oltean Date: Thu Nov 27 14:09:01 2025 +0200 net: dsa: tag_xrs700x: use the dsa_xmit_port_mask() helper The "xrs700x" is the original DSA tagging protocol with HSR TX replication support, we now essentially move that logic to the dsa_xmit_port_mask() helper. The end result is something akin to hellcreek_xmit() (but reminds me I should also take care of skb_checksum_help() for tail taggers in the core). The implementation differences to dsa_xmit_port_mask() are immaterial. Cc: George McCollister Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-15-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 3c1975bbdf92c952c8c17ed67aa652adc6b64962 Author: Vladimir Oltean Date: Thu Nov 27 14:09:00 2025 +0200 net: dsa: tag_trailer: use the dsa_xmit_port_mask() helper The "trailer" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-14-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b33aa90e68b42fd2c6125c1173449eb8c1c97d2c Author: Vladimir Oltean Date: Thu Nov 27 14:08:59 2025 +0200 net: dsa: tag_rzn1_a5psw: use the dsa_xmit_port_mask() helper The "a5psw" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: "Clément Léger" Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-13-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5afe4ccc33f47ab84efab01d8f159542fd945b95 Author: Vladimir Oltean Date: Thu Nov 27 14:08:58 2025 +0200 net: dsa: tag_rtl8_4: use the dsa_xmit_port_mask() helper The "rtl8_4" and "rtl8_4t" tagging protocols populate a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: Linus Walleij Cc: "Alvin Šipraga" Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-12-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4abf39c8aef5a0d4ec83f82164f69a3fcf8c8491 Author: Vladimir Oltean Date: Thu Nov 27 14:08:57 2025 +0200 net: dsa: tag_rtl4_a: use the dsa_xmit_port_mask() helper The "rtl4a" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: Linus Walleij Cc: "Alvin Šipraga" Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-11-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 48afabaf4aaa2991df94cdfd554687b8c74b58be Author: Vladimir Oltean Date: Thu Nov 27 14:08:56 2025 +0200 net: dsa: tag_qca: use the dsa_xmit_port_mask() helper The "qca" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-10-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5733fe2a7ad11a2d1ef8aaa0e6693923b2cbbdc2 Author: Vladimir Oltean Date: Thu Nov 27 14:08:55 2025 +0200 net: dsa: tag_ocelot: use the dsa_xmit_port_mask() helper The "ocelot" and "seville" tagging protocols populate a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. This protocol used BIT_ULL() rather than simple BIT() to silence Smatch, as explained in commit 1f778d500df3 ("net: mscc: ocelot: avoid type promotion when calling ocelot_ifh_set_dest"). I would expect that this tool no longer complains now, when the BIT(dp->index) is hidden inside the dsa_xmit_port_mask() function, the return value of which is promoted to u64. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-9-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit a4a00d9e365a99188e40153b5672d184649eb14e Author: Vladimir Oltean Date: Thu Nov 27 14:08:54 2025 +0200 net: dsa: tag_mxl_gsw1xx: use the dsa_xmit_port_mask() helper The "gsw1xx" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: Hauke Mehrtens Cc: Daniel Golle Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-8-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 84a60bbec50341ec49f9b4d56ca8dab9d99807f6 Author: Vladimir Oltean Date: Thu Nov 27 14:08:53 2025 +0200 net: dsa: tag_mtk: use the dsa_xmit_port_mask() helper The "mtk" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: Chester A. Unal" Cc: Daniel Golle Cc: DENG Qingfang Cc: Sean Wang Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-7-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit ea659a9292b1df91abb80e56198d34f8c6697e84 Author: Vladimir Oltean Date: Thu Nov 27 14:08:52 2025 +0200 net: dsa: tag_ksz: use the dsa_xmit_port_mask() helper The "ksz8795", "ksz9893", "ksz9477" and "lan937x" tagging protocols populate a bit mask for the TX ports. Unlike the others, "ksz9477" also accelerates HSR packet duplication. Make the HSR duplication logic available generically to all 4 taggers by using the dsa_xmit_port_mask() function to set the TX port mask. Cc: Woojung Huh Cc: UNGLinuxDriver@microchip.com Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit f59e44cc0d6c586d32732377d748045eeacc8cee Author: Vladimir Oltean Date: Thu Nov 27 14:08:51 2025 +0200 net: dsa: tag_hellcreek: use the dsa_xmit_port_mask() helper The "hellcreek" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: Kurt Kanzenbach Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e094428fb40c1b2cc98d97bc93db935aa65daa63 Author: Vladimir Oltean Date: Thu Nov 27 14:08:50 2025 +0200 net: dsa: tag_gswip: use the dsa_xmit_port_mask() helper The "gswip" tagging protocol populates a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. Cc: Hauke Mehrtens Cc: Daniel Golle Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 621d06a40e4719fa76b8572046663d54e16425a5 Author: Vladimir Oltean Date: Thu Nov 27 14:08:49 2025 +0200 net: dsa: tag_brcm: use the dsa_xmit_port_mask() helper The "brcm" and "brcm-prepend" tagging protocols populate a bit mask for the TX ports, so we can use dsa_xmit_port_mask() to centralize the decision of how to set that field. The port mask is written u8 by u8, first the high octet and then the low octet. Cc: Florian Fainelli Cc: Jonas Gorski Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 6f2e1c75bc5eb2237e03c134c32a2a352484881e Author: Vladimir Oltean Date: Thu Nov 27 14:08:48 2025 +0200 net: dsa: introduce the dsa_xmit_port_mask() tagging protocol helper Many tagging protocols deal with the transmit port mask being a bit mask, and set it to BIT(dp->index). Not a big deal. Also, some tagging protocols are written for switches which support HSR offload (including packet duplication offload), there we see a walk using dsa_hsr_foreach_port() to find the other port in the same switch that's member of the HSR, and set that bit in the port mask too. That isn't sufficiently interesting either, until you come to realize that there isn't anything special in the second case that switches just in the first one can't do too. It just becomes a matter of "is it wise to do it? are sufficient people using HSR/PRP with generic off-the-shelf switches to justify add an extra test in the data path?" - the answer to which is probably "it depends". It isn't _much_ worse to not have HSR offload at all, so as to make it impractical, esp. with a rich OS like Linux. But the HSR users are rather specialized in industrial networking. Anyway, the change acts on the premise that we're going to have support for this, it should be uniformly implemented for everyone, and that if we find some sort of balance, we can keep everyone relatively happy. So I've disabled that logic if CONFIG_HSR isn't enabled, and I've tilted the branch predictor to say it's unlikely we're transmitting through a port with this capability currently active. On branch miss, we're still going to save the transmission of one packet, so there's some remaining benefit there too. I don't _think_ we need to jump to static keys yet. The helper returns a 32-bit zero-based unsigned number, that callers have to transpose using FIELD_PREP(). It is not the first time we assume DSA switches won't be larger than 32 ports - dsa_user_ports() has that assumption baked into it too. One last development note about why pass the "skb" argument when this isn't used. Looking at the compiled code on arm64, which is identical both with and without it, the answer is "why not?" - who knows what other features dependent on the skb may be handled in the future. Link: https://lore.kernel.org/netdev/20251126093240.2853294-4-mmyangfl@gmail.com/ Cc: "Alvin Šipraga" Cc: Chester A. Unal" Cc: "Clément Léger" Cc: Daniel Golle Cc: David Yang Cc: DENG Qingfang Cc: Florian Fainelli Cc: George McCollister Cc: Hauke Mehrtens Cc: Jonas Gorski Cc: Kurt Kanzenbach Cc: Linus Walleij Cc: Sean Wang Cc: UNGLinuxDriver@microchip.com Cc: Woojung Huh Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251127120902.292555-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e48766e66b4d5b5f215adb600ff85bef0ee64800 Merge: 2ce992a1a400b2 335d78c6161b18 Author: Jakub Kicinski Date: Fri Nov 28 19:56:26 2025 -0800 Merge branch 'net-broadcom-migrate-to-get_rx_ring_count-ethtool-callback' Breno Leitao says: ==================== net: broadcom: migrate to .get_rx_ring_count() ethtool callback This series migrates Broadcom ethernet drivers to use the new .get_rx_ring_count() ethtool callback introduced in commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries"). This change simplifies the .get_rxnfc() implementation by extracting the ETHTOOL_GRXRINGS case handling into a dedicated callback, making the code cleaner and aligning these drivers with the updated ethtool API. The series covers two Broadcom drivers: bnxt and bcmgenet. Each patch removes the ETHTOOL_GRXRINGS case from the driver's .get_rxnfc() switch statement and implements the new .get_rx_ring_count() callback that returns the number of RX rings. ==================== Link: https://patch.msgid.link/20251127-grxrings_broadcom-v1-0-b0b182864950@debian.org Signed-off-by: Jakub Kicinski commit 335d78c6161b18e95f72404ee3e210e64b5f5adc Author: Breno Leitao Date: Thu Nov 27 02:17:16 2025 -0800 net: bcmgenet: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns bcmgenet with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251127-grxrings_broadcom-v1-2-b0b182864950@debian.org Signed-off-by: Jakub Kicinski commit bba18f3ba7cc1ca47428bc563fcc34e9e2ce0bf8 Author: Breno Leitao Date: Thu Nov 27 02:17:15 2025 -0800 net: bnxt: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns bnxt with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251127-grxrings_broadcom-v1-1-b0b182864950@debian.org Signed-off-by: Jakub Kicinski commit 2ce992a1a400b28fd52f5ee77fb5ab836bb861a8 Merge: 2c80116b503296 1adc241f3940c1 Author: Jakub Kicinski Date: Fri Nov 28 19:53:22 2025 -0800 Merge branch 'tools-ynl-add-schema-checking' Donald Hunter says: ==================== tools: ynl: add schema checking Add schema checking and yaml linting for the YNL specs. Patch 1 adds a schema_check make target using a pyynl --validate option Patch 2 adds a lint make target using yamllint Patches 3,4 fix issues reported by make -C tools/net/ynl lint schema_check ==================== Link: https://patch.msgid.link/20251127123502.89142-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 1adc241f3940c172c8c674a62004d3c34b360ab3 Author: Donald Hunter Date: Thu Nov 27 12:35:02 2025 +0000 ynl: fix schema check errors Fix two schema check errors that have lurked since the attribute name validation was made more strict: not ok 2 conntrack.yaml schema validation 'labels mask' does not match '^[0-9a-z-]+$' not ok 13 nftables.yaml schema validation 'set id' does not match '^[0-9a-z-]+$' Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20251127123502.89142-5-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit acce9d7200e23de310c2cf8cd5439e86cd9ddc41 Author: Donald Hunter Date: Thu Nov 27 12:35:01 2025 +0000 ynl: fix a yamllint warning in ethtool spec Fix warning reported by yamllint: ../../../Documentation/netlink/specs/ethtool.yaml 1272:21 warning truthy value should be one of [false, true] (truthy) Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20251127123502.89142-4-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 129dc6075a150f82926ed10942f02f941985d51f Author: Donald Hunter Date: Thu Nov 27 12:35:00 2025 +0000 tools: ynl: add a lint makefile target Add a lint target to run yamllint on the YNL specs. make -C tools/net/ynl lint make: Entering directory '/home/donaldh/net-next/tools/net/ynl' yamllint ../../../Documentation/netlink/specs/*.yaml ../../../Documentation/netlink/specs/ethtool.yaml 1272:21 warning truthy value should be one of [false, true] (truthy) make: Leaving directory '/home/donaldh/net-next/tools/net/ynl' Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20251127123502.89142-3-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 362d051c90b6e27b01dceed8c47ddfc86e60db2c Author: Donald Hunter Date: Thu Nov 27 12:34:59 2025 +0000 tools: ynl: add schema checking Add a --validate flag to pyynl for explicit schema check with error reporting and add a schema_check make target to check all YNL specs. make -C tools/net/ynl schema_check make: Entering directory '/home/donaldh/net-next/tools/net/ynl' ok 1 binder.yaml schema validation not ok 2 conntrack.yaml schema validation 'labels mask' does not match '^[0-9a-z-]+$' Failed validating 'pattern' in schema['properties']['attribute-sets']['items']['properties']['attributes']['items']['properties']['name']: {'type': 'string', 'pattern': '^[0-9a-z-]+$'} On instance['attribute-sets'][14]['attributes'][22]['name']: 'labels mask' ok 3 devlink.yaml schema validation [...] Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20251127123502.89142-2-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit a6c121a2432eee2c4ebceb1483ccd4a50a52983d Author: Robert Marko Date: Thu Nov 27 12:44:35 2025 +0100 net: phy: aquantia: check for NVMEM deferral Currently, if NVMEM provider is probed later than Aquantia, loading the firmware will fail with -EINVAL. To fix this, simply check for -EPROBE_DEFER when NVMEM is attempted and return it. Fixes: e93984ebc1c8 ("net: phy: aquantia: add firmware load support") Signed-off-by: Robert Marko Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251127114514.460924-1-robimarko@gmail.com Signed-off-by: Jakub Kicinski commit 91ef18b567dae84c0cea9b996d933c856e366f52 Author: Jan Kara Date: Tue Nov 25 11:13:41 2025 +0100 ext4: mark inodes without acls in __ext4_iget() Mark inodes without acls with cache_no_acl() in __ext4_iget() so that path lookup can run in RCU mode from the start. This is interesting in particular for the case where the file owner does the lookup because in that case end up constantly hitting the slow path otherwise. We drop out from the fast path (because ACL state is unknown) but never end up calling check_acl() to cache ACL state. The problem was originally analyzed by Linus and fix tested by Matheusz, I'm just putting it into mergeable form :). Link: https://lore.kernel.org/all/CAHk-=whSzc75TLLPWskV0xuaHR4tpWBr=LduqhcCFr4kCmme_w@mail.gmail.com Reported-by: Mateusz Guzik Reported-by: Linus Torvalds Signed-off-by: Jan Kara Reviewed-by: Baokun Li Message-ID: <20251125101340.24276-2-jack@suse.cz> Signed-off-by: Theodore Ts'o commit cab8cbcb923a89cb583c9088fa50431eb2feded5 Author: Baokun Li Date: Fri Nov 21 17:06:54 2025 +0800 ext4: enable block size larger than page size Since block device (See commit 3c20917120ce ("block/bdev: enable large folio support for large logical block sizes")) and page cache (See commit ab95d23bab220ef8 ("filemap: allocate mapping_min_order folios in the page cache")) has the ability to have a minimum order when allocating folio, and ext4 has supported large folio in commit 7ac67301e82f ("ext4: enable large folio for regular file"), now add support for block_size > PAGE_SIZE in ext4. set_blocksize() -> bdev_validate_blocksize() already validates the block size, so ext4_load_super() does not need to perform additional checks. Here we only need to add the FS_LBS bit to fs_flags. In addition, block sizes larger than the page size are currently supported only when CONFIG_TRANSPARENT_HUGEPAGE is enabled. To make this explicit, a blocksize_gt_pagesize entry has been added under /sys/fs/ext4/feature/, indicating whether bs > ps is supported. This allows mke2fs to check the interface and determine whether a warning should be issued when formatting a filesystem with block size larger than the page size. Suggested-by: Theodore Ts'o Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Pankaj Raghav Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-25-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 709f0f1f1bf5ca62a000084e5446ca6b57c8678c Author: Baokun Li Date: Fri Nov 21 17:06:53 2025 +0800 ext4: add checks for large folio incompatibilities when BS > PS Supporting a block size greater than the page size (BS > PS) requires support for large folios. However, several features (e.g., encrypt) do not yet support large folios. To prevent conflicts, this patch adds checks at mount time to prohibit these features from being used when BS > PS. Since these features cannot be changed on remount, there is no need to check on remount. This patch adds s_max_folio_order, initialized during mount according to filesystem features and mount options. If s_max_folio_order is 0, large folios are disabled. With this in place, ext4_set_inode_mapping_order() can be simplified by checking s_max_folio_order, avoiding redundant checks. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-24-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 1a3e9e8aa4f72440b00ef6171b4198f82822d679 Author: Baokun Li Date: Fri Nov 21 17:06:52 2025 +0800 ext4: support verifying data from large folios with fs-verity Eric Biggers already added support for verifying data from large folios several years ago in commit 5d0f0e57ed90 ("fsverity: support verifying data from large folios"). With ext4 now supporting large block sizes, the fs-verity tests `kvm-xfstests -c ext4/64k -g verity -x encrypt` pass without issues. Therefore, remove the restriction and allow large folios to be enabled together with fs-verity. Cc: Eric Biggers Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-23-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 58fd191f99f3791c6687e98041c89a6477d9f64d Author: Baokun Li Date: Fri Nov 21 17:06:51 2025 +0800 ext4: make data=journal support large block size Currently, ext4_set_inode_mapping_order() does not set max folio order for files with the data journalling flag. For files that already have large folios enabled, ext4_inode_journal_mode() ignores the data journalling flag once max folio order is set. This is not because data journalling cannot work with large folios, but because credit estimates will go through the roof if there are too many blocks per folio. Since the real constraint is blocks-per-folio, to support data=journal under LBS, we now set max folio order to be equal to min folio order for files with the journalling flag. When LBS is disabled, the max folio order remains unset as before. Therefore, before ext4_change_inode_journal_flag() switches the journalling mode, we call truncate_pagecache() to drop all page cache for that inode, and filemap_write_and_wait() is called unconditionally. After that, once the journalling mode has been switched, we can safely reset the inode mapping order, and the mapping_large_folio_support() check in ext4_inode_journal_mode() can be removed. Suggested-by: Jan Kara Suggested-by: Dan Carpenter Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-22-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit c00a6292d0616c304cb712d823370f1a82f899b2 Author: Zhihao Cheng Date: Fri Nov 21 17:06:50 2025 +0800 ext4: support large block size in __ext4_block_zero_page_range() Use the EXT4_PG_TO_LBLK() macro to convert folio indexes to blocks to avoid negative left shifts after supporting blocksize greater than PAGE_SIZE. Signed-off-by: Zhihao Cheng Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-21-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 8e50e23b769ace4885fc132e6fca2b4343c27fb1 Author: Baokun Li Date: Fri Nov 21 17:06:49 2025 +0800 ext4: support large block size in mpage_prepare_extent_to_map() Use the EXT4_PG_TO_LBLK/EXT4_LBLK_TO_PG macros to complete the conversion between folio indexes and blocks to avoid negative left/right shifts after supporting blocksize greater than PAGE_SIZE. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-20-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit b967ab748765bf2cf9512efaa8aa987ab4482c7d Author: Baokun Li Date: Fri Nov 21 17:06:48 2025 +0800 ext4: support large block size in mpage_map_and_submit_buffers() Use the EXT4_PG_TO_LBLK/EXT4_LBLK_TO_PG macros to complete the conversion between folio indexes and blocks to avoid negative left/right shifts after supporting blocksize greater than PAGE_SIZE. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-19-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit bff6235d623a022260b8af5559ced3534fb7fc2e Author: Baokun Li Date: Fri Nov 21 17:06:47 2025 +0800 ext4: support large block size in ext4_block_write_begin() Use the EXT4_PG_TO_LBLK() macro to convert folio indexes to blocks to avoid negative left shifts after supporting blocksize greater than PAGE_SIZE. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-18-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit a6d73242b8b5caa9f9a529eab49cc1e85ace9890 Author: Baokun Li Date: Fri Nov 21 17:06:46 2025 +0800 ext4: support large block size in ext4_mpage_readpages() Use the EXT4_PG_TO_LBLK() macro to convert folio indexes to blocks to avoid negative left shifts after supporting blocksize greater than PAGE_SIZE. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-17-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 65c39954bb92b3f2ab5fb179225b8c8788c79afd Author: Zhihao Cheng Date: Fri Nov 21 17:06:45 2025 +0800 ext4: rename 'page' references to 'folio' in multi-block allocator The ext4 multi-block allocator now fully supports folio objects. Update all variable names, function names, and comments to replace legacy 'page' terminology with 'folio', improving clarity and consistency. No functional changes. Signed-off-by: Zhihao Cheng Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-16-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 31daa8261c54404513cf7ac81d1f79ff1cdbc36e Author: Baokun Li Date: Fri Nov 21 17:06:44 2025 +0800 ext4: prepare buddy cache inode for BS > PS with large folios We use EXT4_BAD_INO for the buddy cache inode number. This inode is not accessed via __ext4_new_inode() or __ext4_iget(), meaning ext4_set_inode_mapping_order() is not called to set its folio order range. However, future block size greater than page size support requires this inode to support large folios, and the buddy cache code already handles BS > PS. Therefore, ext4_set_inode_mapping_order() is now explicitly called for this specific inode to set its folio order range. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-15-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 0ad55fa104a2aa5980c12f88546fab328d34644b Author: Baokun Li Date: Fri Nov 21 17:06:43 2025 +0800 ext4: support large block size in ext4_mb_init_cache() Currently, ext4_mb_init_cache() uses blocks_per_page to calculate the folio index and offset. However, when blocksize is larger than PAGE_SIZE, blocks_per_page becomes zero, leading to a potential division-by-zero bug. Since we now have the folio, we know its exact size. This allows us to convert {blocks, groups}_per_page to {blocks, groups}_per_folio, thus supporting block sizes greater than page size. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-14-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 3938fc29f89fff132929b2fea2fe00b0f43617ca Author: Baokun Li Date: Fri Nov 21 17:06:42 2025 +0800 ext4: support large block size in ext4_mb_get_buddy_page_lock() Currently, ext4_mb_get_buddy_page_lock() uses blocks_per_page to calculate folio index and offset. However, when blocksize is larger than PAGE_SIZE, blocks_per_page becomes zero, leading to a potential division-by-zero bug. To support BS > PS, use bytes to compute folio index and offset within folio to get rid of blocks_per_page. Also, since ext4_mb_get_buddy_page_lock() already fully supports folio, rename it to ext4_mb_get_buddy_folio_lock(). Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-13-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 6117f1806a7328e8d316eeeac66b2ba4e4539ba5 Author: Baokun Li Date: Fri Nov 21 17:06:41 2025 +0800 ext4: support large block size in ext4_mb_load_buddy_gfp() Currently, ext4_mb_load_buddy_gfp() uses blocks_per_page to calculate the folio index and offset. However, when blocksize is larger than PAGE_SIZE, blocks_per_page becomes zero, leading to a potential division-by-zero bug. To support BS > PS, use bytes to compute folio index and offset within folio to get rid of blocks_per_page. Also, if buddy and bitmap land in the same folio, we get that folio’s ref instead of looking it up again before updating the buddy. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-12-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 2a8de76b2b0f84333a2778db04ce51811c260d9d Author: Baokun Li Date: Fri Nov 21 17:06:40 2025 +0800 ext4: add EXT4_LBLK_TO_PG and EXT4_PG_TO_LBLK for block/page conversion As BS > PS support is coming, all block number to page index (and vice-versa) conversions must now go via bytes. Added EXT4_LBLK_TO_PG() and EXT4_PG_TO_LBLK() macros to simplify these conversions and handle both BS <= PS and BS > PS scenarios cleanly. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-11-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 125d1f6a5a77ed6a1af3eb0957240f54e4124af2 Author: Baokun Li Date: Fri Nov 21 17:06:39 2025 +0800 ext4: add EXT4_LBLK_TO_B macro for logical block to bytes conversion No functional changes. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-10-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 609c5e0081b432caaa557ffcf1318aefe1187c4e Author: Baokun Li Date: Fri Nov 21 17:06:38 2025 +0800 ext4: support large block size in ext4_readdir() In ext4_readdir(), page_cache_sync_readahead() is used to readahead mapped physical blocks. With LBS support, this can lead to a negative right shift. To fix this, the page index is now calculated by first converting the physical block number (pblk) to a file position (pos) before converting it to a page index. Also, the correct number of pages to readahead is now passed. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Pankaj Raghav Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-9-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 6a28b5c9908d6e7ea13eae7a5872e8e081a397c4 Author: Baokun Li Date: Fri Nov 21 17:06:37 2025 +0800 ext4: support large block size in ext4_calculate_overhead() ext4_calculate_overhead() used a single page for its bitmap buffer, which worked fine when PAGE_SIZE >= block size. However, with block size greater than page size (BS > PS) support, the bitmap can exceed a single page. To address this, we now use kvmalloc() to allocate memory of the filesystem block size, to properly support BS > PS. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-8-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 8611e608a8fa01e8b82c9008b4dac9f24531ae0f Author: Baokun Li Date: Fri Nov 21 17:06:36 2025 +0800 ext4: introduce s_min_folio_order for future BS > PS support This commit introduces the s_min_folio_order field to the ext4_sb_info structure. This field will store the minimum folio order required by the current filesystem, laying groundwork for future support of block sizes greater than PAGE_SIZE. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Pankaj Raghav Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-7-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 58297412edf077870eedce2481db5755b4e98474 Author: Baokun Li Date: Fri Nov 21 17:06:35 2025 +0800 ext4: enable DIOREAD_NOLOCK by default for BS > PS as well The dioread_nolock related processes already support large folio, so dioread_nolock is enabled by default regardless of whether the blocksize is less than, equal to, or greater than PAGE_SIZE. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-6-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit d37a7ddd3a384bd34f985273d6e776d3d50b0edd Author: Baokun Li Date: Fri Nov 21 17:06:34 2025 +0800 ext4: make ext4_punch_hole() support large block size When preparing for bs > ps support, clean up unnecessary PAGE_SIZE references in ext4_punch_hole(). Previously, when a hole extended beyond i_size, we aligned the hole end upwards to PAGE_SIZE to handle partial folio invalidation. Now that truncate_inode_pages_range() already handles partial folio invalidation correctly, this alignment is no longer required. However, to save pointless tail block zeroing, we still keep rounding up to the block size here. In addition, as Honza pointed out, when the hole end equals i_size, it should also be rounded up to the block size. This patch fixes that as well. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-5-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit afa6d5a16bf2e354e183a4fcbcdb8578798e9942 Author: Baokun Li Date: Fri Nov 21 17:06:33 2025 +0800 ext4: remove PAGE_SIZE checks for rec_len conversion Previously, ext4_rec_len_(to|from)_disk only performed complex rec_len conversions when PAGE_SIZE >= 65536 to reduce complexity. However, we are soon to support file system block sizes greater than page size, which makes these conditional checks unnecessary. Thus, these checks are now removed. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-4-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit b73f45a32420a8393e92fb2dec3b7d109e565127 Author: Baokun Li Date: Fri Nov 21 17:06:32 2025 +0800 ext4: remove page offset calculation in ext4_block_truncate_page() For bs <= ps scenarios, calculating the offset within the block is sufficient. For bs > ps, an initial page offset calculation can lead to incorrect behavior. Thus this redundant calculation has been removed. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-3-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 5835b1339e33549d9e7342fae56243b4fcd758c9 Author: Zhihao Cheng Date: Fri Nov 21 17:06:31 2025 +0800 ext4: remove page offset calculation in ext4_block_zero_page_range() For bs <= ps scenarios, calculating the offset within the block is sufficient. For bs > ps, an initial page offset calculation can lead to incorrect behavior. Thus this redundant calculation has been removed. Signed-off-by: Zhihao Cheng Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Message-ID: <20251121090654.631996-2-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 2c80116b503296dd050c8b92bef34e300bc2b1d4 Merge: c940be4c7c7568 f9e788c5fd3a23 Author: Jakub Kicinski Date: Fri Nov 28 19:34:20 2025 -0800 Merge tag 'wireless-next-2025-11-27' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Apart from the usual small things just driver updates: - mt76: - WED support for >32-bit DMA - airoha NPU support - regdomain improvements - continued WiFi7/MLO work - rtw89 - support USB devices RTL8852AU and RTL8852CU - initial work for RTL8922DE - improved injection support - rtl8xxxu: 40 MHz connection fixes/support - brcmfmac: Acer A1 840 tablet quirk * tag 'wireless-next-2025-11-27' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (152 commits) wifi: mac80211: allow sharing identical chanctx for S1G interfaces wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning wifi: cfg80211: include s1g_primary_2mhz when comparing chandefs wifi: cfg80211: include s1g_primary_2mhz when sending chandef wifi: ieee80211: correct FILS status codes mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load wifi: mt76: Strip whitespace from build ddate wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove wifi: mt76: mt7996: skip deflink accounting for offchannel links wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() wifi: mt76: mt7996: move mt7996_update_beacons under mt76 mutex wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() wifi: mt76: mt7925: ensure the 6GHz A-MPDU density cap from the hardware. wifi: mt76: mt7996: fix EMI rings for RRO wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() wifi: mt76: mt7996: fix MLO set key and group key issues wifi: mt76: mt7996: fix MLD group index assignment wifi: mt76: mt7996: use correct link_id when filling TXD and TXP ... ==================== Link: https://patch.msgid.link/20251127103806.17776-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit c940be4c7c75684799d5bff495ac9c48ca19f183 Author: Heiko Carstens Date: Wed Nov 26 15:07:05 2025 +0100 net: Remove KMSG_COMPONENT macro The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" from 2008 [1] which never made it upstream. The macro was added to s390 code to allow for an out-of-tree patch which used this to generate unique message ids. Also this out-of-tree patch doesn't exist anymore. The pattern of how the KMSG_COMPONENT macro is used can also be found at some non s390 specific code, for whatever reasons. Besides adding an indirection it is unused. Remove the macro in order to get rid of a pointless indirection. Replace all users with the string it defines. In all cases this leads to a simple replacement like this: - #define KMSG_COMPONENT "af_iucv" - #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt + #define pr_fmt(fmt) "af_iucv: " fmt [1] https://lwn.net/Articles/292650/ Signed-off-by: Heiko Carstens Acked-by: Alexandra Winter Acked-by: Julian Anastasov Acked-by: Sidraya Jayagond Link: https://patch.msgid.link/20251126140705.1944278-1-hca@linux.ibm.com Signed-off-by: Jakub Kicinski commit c5fae31f60a91dbe884ef2789fb3440bb4cddf05 Merge: 47857dae1e6710 ef1a7e02fdb752 Author: Mark Brown Date: Sat Nov 29 00:59:00 2025 +0000 ASoC: fsl_micfil: Set default quality and channel Merge series from Chancel Liu : Add default quality for different platforms. Set channel range control. commit 47857dae1e6710443b8fdf59146f7e3632b591fa Merge: fd16593d456053 479b1f8d416501 Author: Mark Brown Date: Sat Nov 29 00:48:15 2025 +0000 firmware: cs_dsp: Remove need for clients to supply Merge series from Richard Fitzgerald : Clients of cs_dsp can provide optional callback function pointers, in a struct cs_dsp_client_ops. The client had to provide a pointer to a struct even if it didn't implement any of the callbacks. commit 4e7263b87ca362825beeac669dcbe24aae2c6257 Author: Frank Li Date: Thu Nov 6 12:36:03 2025 -0500 i3c: master: svc: Add basic HDR mode support Add basic HDR mode support for the svs I3C master driver. Only support for private transfers and does not support sending CCC commands in HDR mode. Key differences: - HDR uses commands (0x00-0x7F for write, 0x80-0xFF for read) to distinguish transfer direction. - HDR read/write commands must be written to FIFO before issuing the I3C address command. The hardware automatically sends the standard CCC command to enter HDR mode. - HDR exit pattern must be sent instead of send a stop after transfer completion. - Read/write data size must be an even number. Co-developed-by: Carlos Song Signed-off-by: Carlos Song Signed-off-by: Frank Li Link: https://patch.msgid.link/20251106-i3c_ddr-v11-4-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni commit 108420fe2100b0c9cfb2d3598681eab3724247b9 Author: Frank Li Date: Thu Nov 6 12:36:02 2025 -0500 i3c: master: svc: Replace bool rnw with union for HDR support Replace the bool rnw field with a union in preparation for adding HDR support. HDR uses a cmd field instead of the rnw bit to indicate read or write direction. Add helper function svc_cmd_is_read() to check transfer direction. Add a local variable 'rnw' in svc_i3c_master_priv_xfers() to avoid repeatedly accessing xfers[i].rnw. No functional change. Signed-off-by: Frank Li Link: https://patch.msgid.link/20251106-i3c_ddr-v11-3-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni commit 9280b6ebbf08e53734d34f3bb325c37cddc1422d Author: Frank Li Date: Thu Nov 6 12:36:01 2025 -0500 i3c: Switch to use new i3c_xfer from i3c_priv_xfer Switch to use i3c_xfer instead of i3c_priv_xfer because framework update to support HDR mode. i3c_priv_xfer is now an alias of i3c_xfer. Signed-off-by: Frank Li Link: https://patch.msgid.link/20251106-i3c_ddr-v11-2-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni commit 256a21743d911f94ce92fe28f793cd586f3860b2 Author: Frank Li Date: Thu Nov 6 12:36:00 2025 -0500 i3c: Add HDR API support Rename struct i3c_priv_xfer to struct i3c_xfer, since private xfer in the I3C spec refers only to SDR transfers. Ref: i3c spec ver1.2, section 3, Technical Overview. i3c_xfer will be used for both SDR and HDR. Rename enum i3c_hdr_mode to i3c_xfer_mode. Previous definition need match CCC GET_CAP1 bit position. Use 31 as SDR transfer mode. Add i3c_device_do_xfers() with an xfer mode argument, while keeping i3c_device_do_priv_xfers() as a wrapper that calls i3c_device_do_xfers() with I3C_SDR for backward compatibility. Introduce a 'cmd' field in struct i3c_xfer as an anonymous union with 'rnw', since HDR mode uses read/write commands instead of the SDR address bit. Add .i3c_xfers() callback for master controllers. If not implemented, fall back to SDR with .priv_xfers(). The .priv_xfers() API can be removed once all controllers switch to .i3c_xfers(). Add 'mode_mask' bitmask to advertise controller capability. Signed-off-by: Frank Li Link: https://patch.msgid.link/20251106-i3c_ddr-v11-1-33a6a66ed095@nxp.com Signed-off-by: Alexandre Belloni commit de53ad6ca49e5d73bba72d24b49ec5d40f33ee01 Author: Marco Crivellari Date: Fri Nov 7 14:29:49 2025 +0100 i3c: master: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107132949.184944-1-marco.crivellari@suse.com Signed-off-by: Alexandre Belloni commit 5b9481a4157198b93cd6a5e7ad2603682202149d Author: Jorge Marques Date: Wed Nov 12 22:30:00 2025 +0100 i3c: master: Remove i3c_device_free_ibi from i3c_device_remove i3c_device_disable_ibi should be called before i3c_device_free_ibi, however, a driver using devm actions cannot yield the call before the bus_type.remove(), requiring to use a .remove method that is usually discouraged for drivers that uses resources already manage. Since the only consumer mctp-i3c.c of this method calls both i3c_device_disable_ibi then i3c_device_free_ibi, remove the call from the i3c_device_remove (bus_type.remove()). Signed-off-by: Jorge Marques Link: https://patch.msgid.link/20251112-ibi-unsafe-v1-1-d8454db22613@analog.com Signed-off-by: Alexandre Belloni commit bd5bdd200c9e981cd5e2495966968cb26010573c Author: Hoyeon Lee Date: Wed Nov 26 18:38:11 2025 +0900 bpf: Remove runqslower tool runqslower was added in commit 9c01546d26d2 "tools/bpf: Add runqslower tool to tools/bpf" as a BCC port to showcase early BPF CO-RE + libbpf workflows. runqslower continues to live in BCC (libbpf-tools), so there is no need to keep building and maintaining it. Drop tools/bpf/runqslower and remove all build hooks in tools/bpf and selftests accordingly. Signed-off-by: Hoyeon Lee Link: https://lore.kernel.org/r/20251126093821.373291-1-hoyeon.lee@suse.com Signed-off-by: Alexei Starovoitov commit a3a60cc120d68d95a1cef3dccdc8932c63c16560 Author: Amery Hung Date: Wed Nov 26 12:29:27 2025 -0800 selftests/bpf: Remove usage of lsm/file_alloc_security in selftest file_alloc_security hook is disabled. Use other LSM hooks in selftests instead. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20251126202927.2584874-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit b4bf1d23dc1da236c92a9d9be68cc63358d1f750 Author: Amery Hung Date: Wed Nov 26 12:29:26 2025 -0800 bpf: Disable file_alloc_security hook A use-after-free bug may be triggered by calling bpf_inode_storage_get() in a BPF LSM program hooked to file_alloc_security. Disable the hook to prevent this from happening. The cause of the bug is shown in the trace below. In alloc_file(), a file struct is first allocated through kmem_cache_alloc(). Then, file_alloc_security hook is invoked. Since the zero initialization or assignment of f->f_inode happen after this LSM hook, a BPF program may get a dangeld inode pointer by walking the file struct. alloc_file() -> alloc_empty_file() -> f = kmem_cache_alloc() -> init_file() -> security_file_alloc() // f->f_inode not init-ed yet! -> f->f_inode = NULL; -> file_init_path() -> f->f_inode = path->dentry->d_inode Reported-by: Kaiyan Mei Reported-by: Yinhao Hu Reported-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/1d2d1968.47cd3.19ab9528e94.Coremail.kaiyanm@hust.edu.cn/ Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20251126202927.2584874-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 19f4091bf2679759da877eb23a37863dc4368441 Merge: 688b745401ab16 e3ea26add687ec Author: Alexei Starovoitov Date: Fri Nov 28 15:15:43 2025 -0800 Merge branch 'a-pair-of-follow-ups-for-indirect-jumps' Anton Protopopov says: ==================== A pair of follow ups for indirect jumps Two fixes suggested by Alexei in [1]. Resending as a series, as the second patch depends on the first. [1] https://lore.kernel.org/bpf/CAADnVQK3piReoo1ja=9hgz7aJ60Y_Jjur_JMOaYV8-Mn_VyE4A@mail.gmail.com/#R ==================== Link: https://patch.msgid.link/20251128063224.1305482-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit e3ea26add687ec6829fd8e7161b17667fdb88ec1 Author: Anton Protopopov Date: Fri Nov 28 06:32:24 2025 +0000 bpf: check for insn arrays in check_ptr_alignment Do not abuse the strict_alignment_once flag, and check if the map is an instruction array inside the check_ptr_alignment() function. Suggested-by: Alexei Starovoitov Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251128063224.1305482-3-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 7feff23cdf2ecd30909872f3be1da820df839ab0 Author: Anton Protopopov Date: Fri Nov 28 06:32:23 2025 +0000 bpf: force BPF_F_RDONLY_PROG on insn array creation The original implementation added a hack to check_mem_access() to prevent programs from writing into insn arrays. To get rid of this hack, enforce BPF_F_RDONLY_PROG on map creation. Also fix the corresponding selftest, as the error message changes with this patch. Suggested-by: Alexei Starovoitov Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251128063224.1305482-2-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit a54b1aeb61de63250ee608040a89bed8d1aa1e20 Author: Adrian Hunter Date: Fri Nov 28 08:40:38 2025 +0200 i3c: mipi-i3c-hci-pci: Set d3cold_delay to 0 for Intel controllers Set d3cold_delay to 0 for Intel controllers because a delay is not needed. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-13-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 884a33131f2a7c398daadcffae92384ed7f84b15 Author: Adrian Hunter Date: Fri Nov 28 08:40:37 2025 +0200 i3c: mipi-i3c-hci-pci: Add LTR support for Intel controllers Add support for Latency Tolerance Reporting (LTR) for Intel controllers. Implement PM ->set_latency_tolerance() callback to set LTR register values. Also expose LTR register values via debugfs. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-12-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 040dcd762d60ddc5307e5a9f0cf5d269a0af0814 Author: Adrian Hunter Date: Fri Nov 28 08:40:36 2025 +0200 i3c: mipi-i3c-hci-pci: Add exit callback Prepare to add device-specific features that require cleanup upon driver removal. Add ->exit() callback as a counterpart to ->init(). Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-11-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 0f9ef14b3fb853815aa88f264f7924e1e0ee80c7 Author: Adrian Hunter Date: Fri Nov 28 08:40:35 2025 +0200 i3c: mipi-i3c-hci-pci: Change callback parameter Prepare to add more callbacks in mipi_i3c_hci_pci_info. Change ->init() callback parameter from PCI device pointer to mipi_i3c_hci_pci_info device pointer. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-10-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit da8116a9be9bdc0412ac3aa7931b16ab7335261e Author: Adrian Hunter Date: Fri Nov 28 08:40:34 2025 +0200 i3c: mipi-i3c-hci-pci: Allocate a structure for mipi_i3c_hci_pci device information Allocate a structure for mipi_i3c_hci_pci device information, in preparation for additional changes that need to store mipi_i3c_hci_pci device-specific information. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-9-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 6f6efdd15c67bd262a6e9c795fd54d47e4cb6857 Author: Adrian Hunter Date: Fri Nov 28 08:40:33 2025 +0200 i3c: mipi-i3c-hci-pci: Factor out intel_reset() For neatness, factor out intel_reset(). Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-8-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 9dfa23c41510570a6d7f405ab6bacdb215bf9d8f Author: Adrian Hunter Date: Fri Nov 28 08:40:32 2025 +0200 i3c: mipi-i3c-hci-pci: Factor out private registers ioremapping For neatness, factor out private registers ioremapping. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-7-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit fc6152dc777d16db61c5f3b279007ed9944a130f Author: Adrian Hunter Date: Fri Nov 28 08:40:31 2025 +0200 i3c: mipi-i3c-hci-pci: Constify driver data Add const qualifier to driver data because it is constant. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-6-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 36f18ae15cfd1babf8b10c91468d084802d64a4c Author: Adrian Hunter Date: Fri Nov 28 08:40:30 2025 +0200 i3c: mipi-i3c-hci-pci: Use readl_poll_timeout() Use readl_poll_timeout() instead of open-coding the polling loop. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 58a9ae637112a66d385cf93e7125a2cb7ea8f143 Author: Adrian Hunter Date: Fri Nov 28 08:40:29 2025 +0200 i3c: mipi-i3c-hci-pci: Rename some Intel-related identifiers Rename some Intel-related identifiers to ensure Intel-related identifiers begin "intel_" or INTEL_, and for brevity removing purposeless "PRIV" in preparation to add more register definitions. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit f4fe6e7084952b919d3401745850a229cba0c8cf Author: Adrian Hunter Date: Fri Nov 28 08:40:28 2025 +0200 i3c: mipi-i3c-hci-pci: Move all Intel-related definitions together Move all Intel-related definitions together, to tidy the code slightly. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-3-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit 8c0522993925b8843e3d3e3769d8ea09454a611a Author: Adrian Hunter Date: Fri Nov 28 08:40:27 2025 +0200 i3c: mipi-i3c-hci-pci: Set 64-bit DMA mask for Intel controllers All Intel controllers support 64-bit DMA. Set the DMA mask accordingly. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251128064038.55158-2-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit a50413848f1cf66fa7cb464271f9f81f78808121 Merge: 6fcc739a04b220 204ab51445a72e Author: Frederic Weisbecker Date: Fri Nov 28 23:30:38 2025 +0100 Merge branch 'rcu/refscale' into next Add performance testing for common context synchronizations (Preemption, IRQ, Softirq) and per-cpu increments. Those are relevant comparisons against SRCU-fast read side APIs, especially as they are planned to synchronize further tracing fast-path code. commit 6fcc739a04b220206b8f68267f3c885f031bed94 Merge: 3a8660878839fa bfad33230a5db7 Author: Frederic Weisbecker Date: Fri Nov 28 23:25:02 2025 +0100 Merge branch 'rcu/srcu' into next _ Properly handle SRCU readers within IRQ disabled sections in tiny SRCU - Preparation to reimplement RCU Tasks Trace on top of SRCU fast: - Introduce API to expedite a grace period and test it through rcutorture. - Split srcu-fast in two flavours: SRCU-fast and SRCU-fast-updown. Both are still targeted toward faster readers (without full barriers on LOCK and UNLOCK) at the expense of heavier write side (using full RCU grace period ordering instead of simply full ordering) as compared to "traditional" non-fast SRCU. But those srcu-fast flavours are going to be optimized in two different ways: - SRCU-fast will become the reimplementation basis for RCU-TASK-TRACE for consolidation. Since RCU-TASK-TRACE must be NMI safe, SRCU-fast must be as well. - SRCU-fast-updown will be needed for uretprobes code in order to get rid of the read-side memory barriers while still allowing entering the reader at task level while exiting it in a timer handler. It is considered semaphore-like in that it can have different owners between LOCK and UNLOCK. However it is not NMI-safe. The actual optimizations are work in progress for the next cycle. Only the new interfaces are added for now, along with related torture and scalability test code. - Create/document/debug/torture new proper initializers for RCU fast: DEFINE_SRCU_FAST() and init_srcu_struct_fast() This allows for using right away the proper ordering on the write side (either full ordering or full RCU grace period ordering) without waiting for the read side to tell which to use. Also this optimizes the read side altogether with moving flavour debug checks to debug config and with removing a costly RmW operation on their first call. - Make some diagnostic functions tracing safe. commit fd16593d456053d110c6e7bd141a7f381a1b10f7 Author: Weidong Wang Date: Fri Nov 28 21:03:22 2025 +0800 ASoC: codecs: Modify awinic amplifier dsp read and write functions Modify the dsp read and write functions of the chip and normalize the dsp read and write functions of all awinic amplifier Signed-off-by: Weidong Wang Link: https://patch.msgid.link/20251128130323.628091-1-wangweidong.a@awinic.com Signed-off-by: Mark Brown commit 0695aef23d674815c352293c49d944a2375ee9c9 Author: Qianfeng Rong Date: Sun Aug 17 16:12:38 2025 +0800 ubifs: vmalloc(array_size()) -> vmalloc_array() Remove array_size() calls and replace vmalloc() with vmalloc_array() in ubifs_create_dflt_lpt()/lpt_init_rd()/lpt_init_wr(). vmalloc_array() is optimized better, resulting in less instructions being used [1]. [1]: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/ Signed-off-by: Qianfeng Rong Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit d133e30aabc7c8eb8206827f8fbe0f3679adb911 Author: Liyuan Pang Date: Fri Nov 7 18:00:57 2025 +0800 ubi: fastmap: fix ubi->fm memory leak The problem is that scan_fast() allocate memory for ubi->fm and ubi->fm->e[x], but if the following attach process fails in ubi_wl_init or ubi_read_volume_table, the whole attach process will fail without executing ubi_wl_close to free the memory under ubi->fm. Fix this by add a new ubi_free_fastmap function in fastmap.c to free the memory allocated for fm. If SLUB_DEBUG and KUNIT are enabled, the following warning messages will show: ubi0: detaching mtd0 ubi0: mtd0 is detached ubi0: default fastmap pool size: 200 ubi0: default fastmap WL pool size: 100 ubi0: attaching mtd0 ubi0: attached by fastmap ubi0: fastmap pool size: 200 ubi0: fastmap WL pool size: 100 ubi0 error: ubi_wl_init [ubi]: no enough physical eraseblocks (4, need 203) ubi0 error: ubi_attach_mtd_dev [ubi]: failed to attach mtd0, error -28 UBI error: cannot attach mtd0 ================================================================= BUG ubi_wl_entry_slab (Tainted: G B O L ): Objects remaining in ubi_wl_entry_slab on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Slab 0xffff2fd23a40cd00 objects=22 used=1 fp=0xffff2fd1d0334fd8 flags=0x883fffc010200(slab|head|section=34|node=0|zone=1|lastcpupid=0x7fff) CPU: 0 PID: 5884 Comm: insmod Tainted: G B O L 5.10.0 #1 Hardware name: LS1043A RDB Board (DT) Call trace: dump_backtrace+0x0/0x198 show_stack+0x18/0x28 dump_stack+0xe8/0x15c slab_err+0x94/0xc0 __kmem_cache_shutdown+0x1fc/0x39c kmem_cache_destroy+0x48/0x138 ubi_init+0x1d4/0xf34 [ubi] do_one_initcall+0xb4/0x24c do_init_module+0x4c/0x1dc load_module+0x212c/0x2260 __se_sys_finit_module+0xb4/0xd8 __arm64_sys_finit_module+0x18/0x28 el0_svc_common.constprop.0+0x78/0x1a0 do_el0_svc+0x78/0x90 el0_svc+0x20/0x38 el0_sync_handler+0xf0/0x140 normal+0x3d8/0x400 Object 0xffff2fd1d0334e68 @offset=3688 Allocated in ubi_scan_fastmap+0xf04/0xf40 [ubi] age=80 cpu=0 pid=5884 __slab_alloc.isra.21+0x6c/0xb4 kmem_cache_alloc+0x1e4/0x80c ubi_scan_fastmap+0xf04/0xf40 [ubi] ubi_attach+0x1f0/0x3a8 [ubi] ubi_attach_mtd_dev+0x810/0xbc8 [ubi] ubi_init+0x238/0xf34 [ubi] do_one_initcall+0xb4/0x24c do_init_module+0x4c/0x1dc load_module+0x212c/0x2260 __se_sys_finit_module+0xb4/0xd8 __arm64_sys_finit_module+0x18/0x28 el0_svc_common.constprop.0+0x78/0x1a0 do_el0_svc+0x78/0x90 el0_svc+0x20/0x38 el0_sync_handler+0xf0/0x140 normal+0x3d8/0x400 Link: https://bugzilla.kernel.org/show_bug.cgi?id=220744 Signed-off-by: Liyuan Pang Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 77530d1a78ca5c274e37d6494a965223672630b2 Author: Cheng Ming Lin Date: Fri Nov 14 10:44:52 2025 +0800 mtd: ubi: skip programming unused bits in ubi headers This patch prevents unnecessary programming of bits in ec_hdr and vid_hdr that are not used or read during normal UBI operation. These unused bits are typcially already set to 1 in erased flash and do not need to be explicitly programmed to 0 if they are not used. Programming such unused areas offers no functional benefit and may result in unnecessary flash wear, reducing the overall lifetime of the device. By skipping these writes, we preserve the flash state as much as possible and minimize wear caused by redundant operations. This change ensures that only necessary fields are written when preparing UBI headers, improving flash efficiency without affecting functionality. Additionally, the Kioxia TC58NVG1S3HTA00 datasheet (page 63) also notes that continuous program/erase cycling with a high percentage of '0' bits in the data pattern can accelerate block endurance degradation. This further supports avoiding large 0x00 patterns. Link: https://europe.kioxia.com/content/dam/kioxia/newidr/productinfo/datasheet/201910/DST_TC58NVG1S3HTA00-TDE_EN_31442.pdf Signed-off-by: Cheng Ming Lin Reviewed-by: Miquel Raynal Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit c0d612b391b219f0119201d6a30514bf00f79066 Author: Xichao Zhao Date: Mon Aug 11 18:09:49 2025 +0800 ubifs: Remove unnecessary variable assignments When an error occurs, ubifs_err is used to directly print the error, and different errors have different formats for printing. Therefore, it's not necessary to use 'err' to locate the error occurrence. Thus, remove the relevant assignments to 'err'. Signed-off-by: Xichao Zhao Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 0288d5fe25a286641f0fc259d5de32d0e319db6d Author: Xichao Zhao Date: Tue Aug 12 10:10:08 2025 +0800 ubifs: Simplify the code using ubifs_crc_node Replace part of the code using ubifs_crc_node. Signed-off-by: Xichao Zhao Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit e35770610730af372659ef8d41199b556411c756 Author: Xichao Zhao Date: Tue Aug 12 10:10:07 2025 +0800 ubifs: Remove unnecessary parameters '*c' Because the variable *c is not used within the function, remove it from the ubifs_crc_node function. Signed-off-by: Xichao Zhao Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit d911fe6e942e60900577314dc1f1529b90e4da07 Author: Harry Fellowes Date: Mon Aug 25 20:28:34 2025 +0100 x86/boot: Clean up whitespace in a20.c Remove trailing whitespace on empty lines. No functional changes. [ bp: Massage commit message. ] Signed-off-by: Harry Fellowes Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20250825192832.6444-3-harryfellowes1@gmail.com commit 81d431130ae1af4e64030f6a956ee9137e6fc1b0 Author: Colin Ian King Date: Fri Nov 28 17:33:29 2025 +0000 regulator: fp9931: Fix spelling mistake "failid" -> "failed" There is a spelling mistake in a dev_err_probe message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20251128173330.318309-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit cb5c2eb459f4c98d584eaf3d3ea7c3612385d081 Author: Andy Shevchenko Date: Thu Nov 27 19:58:59 2025 +0100 spi: microchip-core: Refactor FIFO read and write handlers Make both handlers to be shorter and easier to understand. While at it, unify their style. Signed-off-by: Andy Shevchenko Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/20251127190031.2998705-3-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit d721f52e31553a848e0e9947ca15a49c5674aef3 Author: David Matlack Date: Wed Nov 26 23:17:33 2025 +0000 vfio: selftests: Add vfio_pci_device_init_perf_test Add a new VFIO selftest for measuring the time it takes to run vfio_pci_device_init() in parallel for one or more devices. This test serves as manual regression test for the performance improvement of commit e908f58b6beb ("vfio/pci: Separate SR-IOV VF dev_set"). For example, when running this test with 64 VFs under the same PF: Before: $ ./vfio_pci_device_init_perf_test -r vfio_pci_device_init_perf_test.iommufd.init 0000:1a:00.0 0000:1a:00.1 ... ... Wall time: 6.653234463s Min init time (per device): 0.101215344s Max init time (per device): 6.652755941s Avg init time (per device): 3.377609608s After: $ ./vfio_pci_device_init_perf_test -r vfio_pci_device_init_perf_test.iommufd.init 0000:1a:00.0 0000:1a:00.1 ... ... Wall time: 0.122978332s Min init time (per device): 0.108121915s Max init time (per device): 0.122762761s Avg init time (per device): 0.113816748s This test does not make any assertions about performance, since any such assertion is likely to be flaky due to system differences and random noise. However this test can be fed into automation to detect regressions, and can be used by developers in the future to measure performance optimizations. Suggested-by: Aaron Lewis Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-19-dmatlack@google.com Signed-off-by: Alex Williamson commit b8e96c8805ec25878ac971cad34732a6aabe34f6 Author: David Matlack Date: Wed Nov 26 23:17:32 2025 +0000 vfio: selftests: Eliminate INVALID_IOVA Eliminate INVALID_IOVA as there are platforms where UINT64_MAX is a valid iova. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-18-dmatlack@google.com Signed-off-by: Alex Williamson commit 5fabc49abf7ac630babfb1525e242848d54038c1 Author: David Matlack Date: Wed Nov 26 23:17:31 2025 +0000 vfio: selftests: Split libvfio.h into separate header files Split out the contents of libvfio.h into separate header files, but keep libvfio.h as the top-level include that all tests can use. Put all new header files into a libvfio/ subdirectory to avoid future name conflicts in include paths when libvfio is used by other selftests like KVM. No functional change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-17-dmatlack@google.com Signed-off-by: Alex Williamson commit 19cf492c1bddc93b8a0144aac5295b7cf2bd24b8 Author: David Matlack Date: Wed Nov 26 23:17:30 2025 +0000 vfio: selftests: Move vfio_selftests_*() helpers into libvfio.c Move the vfio_selftests_*() helpers into their own file libvfio.c. These helpers have nothing to do with struct vfio_pci_device, so they don't make sense in vfio_pci_device.c. No functional change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-16-dmatlack@google.com Signed-off-by: Alex Williamson commit 657d241e695fa7afa091c77d54ff2df703ece35d Author: David Matlack Date: Wed Nov 26 23:17:29 2025 +0000 vfio: selftests: Rename vfio_util.h to libvfio.h Rename vfio_util.h to libvfio.h to match the name of libvfio.mk. No functional change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-15-dmatlack@google.com Signed-off-by: Alex Williamson commit 831c37a5bf046bbdf65c042b53fd2e8cac0b1a5a Author: David Matlack Date: Wed Nov 26 23:17:28 2025 +0000 vfio: selftests: Stop passing device for IOMMU operations Drop the struct vfio_pci_device wrappers for IOMMU map/unmap functions and require tests to directly call iommu_map(), iommu_unmap(), etc. This results in more concise code, and also makes it clear the map operations are happening on a struct iommu, not necessarily on a specific device, especially when multi-device tests are introduced. Do the same for iova_allocator_init() as that function only needs the struct iommu, not struct vfio_pci_device. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-14-dmatlack@google.com Signed-off-by: Alex Williamson commit 2607a4361312bf407931597423fe23db406ca8d3 Author: David Matlack Date: Wed Nov 26 23:17:27 2025 +0000 vfio: selftests: Move IOVA allocator into iova_allocator.c Move the IOVA allocator into its own file, to provide better separation between the allocator and the struct vfio_pci_device helper code. The allocator could go into iommu.c, but it is standalone enough that a separate file seems cleaner. This also continues the trend of having a .c for every major object in VFIO selftests (vfio_pci_device.c, vfio_pci_driver.c, iommu.c, and now iova_allocator.c). No functional change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-13-dmatlack@google.com Signed-off-by: Alex Williamson commit 2aca571089b2cc333ed5ad0ada4902aa6f7c0d3c Author: David Matlack Date: Wed Nov 26 23:17:26 2025 +0000 vfio: selftests: Move IOMMU library code into iommu.c Move all the IOMMU related library code into their own file iommu.c. This provides a better separation between the vfio_pci_device helper code and the iommu code. No function change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-12-dmatlack@google.com Signed-off-by: Alex Williamson commit 9a659d74f2a455cbc595c6cb4dfefc16b09f86ed Author: David Matlack Date: Wed Nov 26 23:17:25 2025 +0000 vfio: selftests: Rename struct vfio_dma_region to dma_region Rename struct vfio_dma_region to dma_region. This is in preparation for separating the VFIO PCI device library code from the IOMMU library code. This name change also better reflects the fact that DMA mappings can be managed by either VFIO or IOMMUFD. i.e. the "vfio_" prefix is misleading. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-11-dmatlack@google.com Signed-off-by: Alex Williamson commit 28a84da744dd647d07b784623ddd671c00371297 Author: David Matlack Date: Wed Nov 26 23:17:24 2025 +0000 vfio: selftests: Upgrade driver logging to dev_err() Upgrade various logging in the VFIO selftests drivers from dev_info() to dev_err(). All of these logs indicate scenarios that may be unexpected. For example, the logging during probing indicates matching devices but that aren't supported by the driver. And the memcpy errors can indicate a problem if the caller was not trying to do something like exercise I/O fault handling. Exercising I/O fault handling is certainly a valid thing to do, but the driver can't infer the caller's expectations, so better to just log with dev_err(). Suggested-by: Raghavendra Rao Ananta Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-10-dmatlack@google.com Signed-off-by: Alex Williamson commit c48545442e18219cca7f658ecdf7562ef58cfac6 Author: David Matlack Date: Wed Nov 26 23:17:23 2025 +0000 vfio: selftests: Prefix logs with device BDF where relevant Prefix log messages with the device's BDF where relevant. This will help understanding VFIO selftests logs when tests are run with multiple devices. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-9-dmatlack@google.com Signed-off-by: Alex Williamson commit 6c74d9830d8b10d51ce3c55d38e8babf23899c89 Author: David Matlack Date: Wed Nov 26 23:17:22 2025 +0000 vfio: selftests: Eliminate overly chatty logging Eliminate overly chatty logs that are printed during almost every test. These logs are adding more noise than value. If a test cares about this information it can log it itself. This is especially true as the VFIO selftests gains support for multiple devices in a single test (which multiplies all these logs). Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-8-dmatlack@google.com Signed-off-by: Alex Williamson commit d8470a775ccd7e2c709482193cba0ae18d17c717 Author: David Matlack Date: Wed Nov 26 23:17:21 2025 +0000 vfio: selftests: Support multiple devices in the same container/iommufd Support tests that want to add multiple devices to the same container/iommufd by decoupling struct vfio_pci_device from struct iommu. Multi-devices tests can now put multiple devices in the same container/iommufd like so: iommu = iommu_init(iommu_mode); device1 = vfio_pci_device_init(bdf1, iommu); device2 = vfio_pci_device_init(bdf2, iommu); device3 = vfio_pci_device_init(bdf3, iommu); ... vfio_pci_device_cleanup(device3); vfio_pci_device_cleanup(device2); vfio_pci_device_cleanup(device1); iommu_cleanup(iommu); To account for the new separation of vfio_pci_device and iommu, update existing tests to initialize and cleanup a struct iommu. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-7-dmatlack@google.com Signed-off-by: Alex Williamson commit c9756b4d2702cc33748eed5916ddc159d349cba6 Author: David Matlack Date: Wed Nov 26 23:17:20 2025 +0000 vfio: selftests: Introduce struct iommu Introduce struct iommu, which logically represents either a VFIO container or an iommufd IOAS, depending on which IOMMU mode is used by the test. This will be used in a subsequent commit to allow devices to be added to the same container/iommufd. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-6-dmatlack@google.com Signed-off-by: Alex Williamson commit dd56ef239d832d9782f5ed204533824bea4548f7 Author: David Matlack Date: Wed Nov 26 23:17:19 2025 +0000 vfio: selftests: Rename struct vfio_iommu_mode to iommu_mode Rename struct vfio_iommu_mode to struct iommu_mode since the mode can include iommufd. This also prepares for splitting out all the IOMMU code into its own structs/helpers/files which are independent from the vfio_pci_device code. No function change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-5-dmatlack@google.com Signed-off-by: Alex Williamson commit 6282ca8585010bfb4ab658243a1665428bcfa9de Author: David Matlack Date: Wed Nov 26 23:17:18 2025 +0000 vfio: selftests: Allow passing multiple BDFs on the command line Add support for passing multiple device BDFs to a test via the command line. This is a prerequisite for multi-device tests. Single-device tests can continue using vfio_selftests_get_bdf(), which will continue to return argv[argc - 1] (if it is a BDF string), or the environment variable $VFIO_SELFTESTS_BDF otherwise. For multi-device tests, a new helper called vfio_selftests_get_bdfs() is introduced which will return an array of all BDFs found at the end of argv[], as well as the number of BDFs found (passed back to the caller via argument). The array of BDFs returned does not need to be freed by the caller. The environment variable VFIO_SELFTESTS_BDF continues to support only a single BDF for the time being. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-4-dmatlack@google.com Signed-off-by: Alex Williamson commit fa246a1d06d74219b79d3e78b0cf47851a60d117 Author: David Matlack Date: Wed Nov 26 23:17:17 2025 +0000 vfio: selftests: Split run.sh into separate scripts Split run.sh into separate scripts (setup.sh, run.sh, cleanup.sh) to enable multi-device testing, and prepare for VFIO selftests automatically detecting which devices to use for testing by storing device metadata on the filesystem. - setup.sh takes one or more BDFs as arguments and sets up each device. Metadata about each device is stored on the filesystem in the directory: ${TMPDIR:-/tmp}/vfio-selftests-devices Within this directory is a directory for each BDF, and then files in those directories that cleanup.sh uses to cleanup the device. - run.sh runs a selftest by passing it the BDFs of all set up devices. - cleanup.sh takes zero or more BDFs as arguments and cleans up each device. If no BDFs are provided, it cleans up all devices. This split enables multi-device testing by allowing multiple BDFs to be set up and passed into tests: For example: $ tools/testing/selftests/vfio/scripts/setup.sh $ tools/testing/selftests/vfio/scripts/setup.sh $ tools/testing/selftests/vfio/scripts/run.sh echo $ tools/testing/selftests/vfio/scripts/cleanup.sh In the future, VFIO selftests can automatically detect set up devices by inspecting ${TMPDIR:-/tmp}/vfio-selftests-devices. This will avoid the need for the run.sh script. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-3-dmatlack@google.com Signed-off-by: Alex Williamson commit 2d5dbd3156799db2b7d25addb45c289b0aa7ff11 Author: David Matlack Date: Wed Nov 26 23:17:16 2025 +0000 vfio: selftests: Move run.sh into scripts directory Move run.sh in a new sub-directory scripts/. This directory will be used to house various helper scripts to be used by humans and automation for running VFIO selftests. Opportunistically also switch run.sh from TEST_PROGS_EXTENDED to TEST_FILES. The former is for actual test executables that are just not run by default. TEST_FILES is a better fit for helper scripts. No functional change intended. Reviewed-by: Alex Mastro Tested-by: Alex Mastro Reviewed-by: Raghavendra Rao Ananta Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20251126231733.3302983-2-dmatlack@google.com Signed-off-by: Alex Williamson commit a63a03afd857e5ef968b01ec99b186087979a348 Merge: a23b10608d4203 d323ad73966676 Author: Alex Williamson Date: Fri Nov 28 10:54:22 2025 -0700 Merge tag 'vfio-v6.18-rc6' into v6.19/vfio/next Merge mainline vfio-selftest updates for ongoing v6.19 work. Signed-off-by: Alex Williamson commit 54f9baf537b0a091adad860ec92e3e18e0a0754c Author: Mickaël Salaün Date: Fri Nov 28 18:21:59 2025 +0100 selftests/landlock: Add disconnected leafs and branch test suites Test disconnected directories with two test suites (layout4_disconnected_leafs and layout5_disconnected_branch) and 43 variants to cover the main corner cases. These tests are complementary to the previous commit. Add test_renameat() and test_exchangeat() helpers. Test coverage for security/landlock is 92.1% of 1927 lines according to LLVM 20. Cc: Günther Noack Cc: Song Liu Cc: Tingmao Wang Link: https://lore.kernel.org/r/20251128172200.760753-5-mic@digikod.net Signed-off-by: Mickaël Salaün commit a18ee3f31fd714173a62515d049d77e76ab55649 Author: Tingmao Wang Date: Fri Nov 28 18:21:58 2025 +0100 selftests/landlock: Add tests for access through disconnected paths This adds tests for the edge case discussed in [1], with specific ones for rename and link operations when the operands are through disconnected paths, as that go through a separate code path in Landlock. This has resulted in a warning, due to collect_domain_accesses() not expecting to reach a different root from path->mnt: # RUN layout1_bind.path_disconnected ... # OK layout1_bind.path_disconnected ok 96 layout1_bind.path_disconnected # RUN layout1_bind.path_disconnected_rename ... [..] ------------[ cut here ]------------ [..] WARNING: CPU: 3 PID: 385 at security/landlock/fs.c:1065 collect_domain_accesses [..] ... [..] RIP: 0010:collect_domain_accesses (security/landlock/fs.c:1065 (discriminator 2) security/landlock/fs.c:1031 (discriminator 2)) [..] current_check_refer_path (security/landlock/fs.c:1205) [..] ... [..] hook_path_rename (security/landlock/fs.c:1526) [..] security_path_rename (security/security.c:2026 (discriminator 1)) [..] do_renameat2 (fs/namei.c:5264) # OK layout1_bind.path_disconnected_rename ok 97 layout1_bind.path_disconnected_rename Move the const char definitions a bit above so that we can use the path for s4d1 in cleanup code. Cc: Günther Noack Cc: Song Liu Link: https://lore.kernel.org/r/027d5190-b37a-40a8-84e9-4ccbc352bcdf@maowtm.org [1] Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/20251128172200.760753-4-mic@digikod.net Signed-off-by: Mickaël Salaün commit f7ef7de6b9bcec1314af2cdcfd0c952eadd6a779 Author: Mickaël Salaün Date: Fri Nov 28 18:21:57 2025 +0100 landlock: Improve variable scope This is now possible thanks to the disconnected directory fix. Cc: Günther Noack Cc: Song Liu Cc: Tingmao Wang Link: https://lore.kernel.org/r/20251128172200.760753-3-mic@digikod.net Signed-off-by: Mickaël Salaün commit 49c9e09d961025b22e61ef9ad56aa1c21b6ce2f1 Author: Mickaël Salaün Date: Fri Nov 28 18:21:56 2025 +0100 landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they are visible and opened from a bind mount, but have been renamed or moved from the source of the bind mount in a way that makes them inaccessible from the mount point (i.e. out of scope). Previously, access rights tied to files or directories opened through a disconnected directory were collected by walking the related hierarchy down to the root of the filesystem, without taking into account the mount point because it couldn't be found. This could lead to inconsistent access results, potential access right widening, and hard-to-debug renames, especially since such paths cannot be printed. For a sandboxed task to create a disconnected directory, it needs to have write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to the underlying source of the bind mount, and read access to the related mount point. Because a sandboxed task cannot acquire more access rights than those defined by its Landlock domain, this could lead to inconsistent access rights due to missing permissions that should be inherited from the mount point hierarchy, while inheriting permissions from the filesystem hierarchy hidden by this mount point instead. Landlock now handles files and directories opened from disconnected directories by taking into account the filesystem hierarchy when the mount point is not found in the hierarchy walk, and also always taking into account the mount point from which these disconnected directories were opened. This ensures that a rename is not allowed if it would widen access rights [1]. The rationale is that, even if disconnected hierarchies might not be visible or accessible to a sandboxed task, relying on the collected access rights from them improves the guarantee that access rights will not be widened during a rename because of the access right comparison between the source and the destination (see LANDLOCK_ACCESS_FS_REFER). It may look like this would grant more access on disconnected files and directories, but the security policies are always enforced for all the evaluated hierarchies. This new behavior should be less surprising to users and safer from an access control perspective. Remove a wrong WARN_ON_ONCE() canary in collect_domain_accesses() and fix the related comment. Because opened files have their access rights stored in the related file security properties, there is no impact for disconnected or unlinked files. Cc: Christian Brauner Cc: Günther Noack Cc: Song Liu Reported-by: Tingmao Wang Closes: https://lore.kernel.org/r/027d5190-b37a-40a8-84e9-4ccbc352bcdf@maowtm.org Closes: https://lore.kernel.org/r/09b24128f86973a6022e6aa8338945fcfb9a33e4.1749925391.git.m@maowtm.org Fixes: b91c3e4ea756 ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER") Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control") Link: https://lore.kernel.org/r/b0f46246-f2c5-42ca-93ce-0d629702a987@maowtm.org [1] Reviewed-by: Tingmao Wang Link: https://lore.kernel.org/r/20251128172200.760753-2-mic@digikod.net Signed-off-by: Mickaël Salaün commit a23b10608d420346e5af7eda6c46726a61572469 Author: Ankit Agrawal Date: Thu Nov 27 17:06:32 2025 +0000 vfio/nvgrace-gpu: wait for the GPU mem to be ready Speculative prefetches from CPU to GPU memory until the GPU is ready after reset can cause harmless corrected RAS events to be logged on Grace systems. It is thus preferred that the mapping not be re-established until the GPU is ready post reset. The GPU readiness can be checked through BAR0 registers similar to the checking at the time of device probe. It can take several seconds for the GPU to be ready. So it is desirable that the time overlaps as much of the VM startup as possible to reduce impact on the VM bootup time. The GPU readiness state is thus checked on the first fault/huge_fault request or read/write access which amortizes the GPU readiness time. The first fault and read/write checks the GPU state when the reset_done flag - which denotes whether the GPU has just been reset. The memory_lock is taken across map/access to avoid races with GPU reset. Also check if the memory is enabled, before waiting for GPU to be ready. Otherwise the readiness check would block for 30s. Lastly added PM handling wrapping on read/write access. Cc: Shameer Kolothum Cc: Alex Williamson Cc: Jason Gunthorpe Cc: Vikram Sethi Reviewed-by: Shameer Kolothum Suggested-by: Alex Williamson Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251127170632.3477-7-ankita@nvidia.com Signed-off-by: Alex Williamson commit dfe765499abfbdb9df0f2e70ebb1199c7d2fc65e Author: Ankit Agrawal Date: Thu Nov 27 17:06:31 2025 +0000 vfio/nvgrace-gpu: Inform devmem unmapped after reset Introduce a new flag reset_done to notify that the GPU has just been reset and the mapping to the GPU memory is zapped. Implement the reset_done handler to set this new variable. It will be used later in the patches to wait for the GPU memory to be ready before doing any mapping or access. Cc: Jason Gunthorpe Reviewed-by: Shameer Kolothum Suggested-by: Alex Williamson Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251127170632.3477-6-ankita@nvidia.com Signed-off-by: Alex Williamson commit 7d055071d73bac7acc3a0b441f0632f564f048fe Author: Ankit Agrawal Date: Thu Nov 27 17:06:30 2025 +0000 vfio/nvgrace-gpu: split the code to wait for GPU ready Split the function that check for the GPU device being ready on the probe. Move the code to wait for the GPU to be ready through BAR0 register reads to a separate function. This would help reuse the code. This also fixes a bug where the return status in case of timeout gets overridden by return from pci_enable_device. With the fix, a timeout generate an error as initially intended. Fixes: d85f69d520e6 ("vfio/nvgrace-gpu: Check the HBM training and C2C link status") Reviewed-by: Zhi Wang Reviewed-by: Shameer Kolothum Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251127170632.3477-5-ankita@nvidia.com Signed-off-by: Alex Williamson commit 7f5764e179c66f4d3776b4fcb78b383ebcd99fb3 Author: Ankit Agrawal Date: Thu Nov 27 17:06:29 2025 +0000 vfio: use vfio_pci_core_setup_barmap to map bar in mmap Remove code duplication in vfio_pci_core_mmap by calling vfio_pci_core_setup_barmap to perform the bar mapping. No functional change is intended. Cc: Donald Dutile Reviewed-by: Shameer Kolothum Reviewed-by: Zhi Wang Suggested-by: Alex Williamson Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251127170632.3477-4-ankita@nvidia.com Signed-off-by: Alex Williamson commit 9db65489b87298f20baef683e70143c108959793 Author: Ankit Agrawal Date: Thu Nov 27 17:06:28 2025 +0000 vfio/nvgrace-gpu: Add support for huge pfnmap NVIDIA's Grace based systems have large device memory. The device memory is mapped as VM_PFNMAP in the VMM VMA. The nvgrace-gpu module could make use of the huge PFNMAP support added in mm [1]. To make use of the huge pfnmap support, fault/huge_fault ops based mapping mechanism needs to be implemented. Currently nvgrace-gpu module relies on remap_pfn_range to do the mapping during VM bootup. Replace it to instead rely on fault and use vfio_pci_vmf_insert_pfn to setup the mapping. Moreover to enable huge pfnmap, nvgrace-gpu module is updated by adding huge_fault ops implementation. The implementation establishes mapping according to the order request. Note that if the PFN or the VMA address is unaligned to the order, the mapping fallbacks to the PTE level. Link: https://lore.kernel.org/all/20240826204353.2228736-1-peterx@redhat.com/ [1] Cc: Shameer Kolothum Cc: Alex Williamson Cc: Jason Gunthorpe Cc: Vikram Sethi Reviewed-by: Zhi Wang Reviewed-by: Shameer Kolothum Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251127170632.3477-3-ankita@nvidia.com Signed-off-by: Alex Williamson commit 9b92bc7554b543dc00a0a0b62904a9ef2ad5c4b0 Author: Ankit Agrawal Date: Thu Nov 27 17:06:27 2025 +0000 vfio: refactor vfio_pci_mmap_huge_fault function Refactor vfio_pci_mmap_huge_fault to take out the implementation to map the VMA to the PTE/PMD/PUD as a separate function. Export the new function to be used by nvgrace-gpu module. Move the alignment check code to verify that pfn and VMA VA is aligned to the page order to the header file and make it inline. No functional change is intended. Cc: Shameer Kolothum Cc: Alex Williamson Cc: Jason Gunthorpe Reviewed-by: Shameer Kolothum Signed-off-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251127170632.3477-2-ankita@nvidia.com Signed-off-by: Alex Williamson commit 590d745680309f8d956c3f0a97270fe65013b272 Author: Alex Mastro Date: Tue Nov 25 17:11:18 2025 -0800 dma-buf: fix integer overflow in fill_sg_entry() for buffers >= 8GiB fill_sg_entry() splits large DMA buffers into multiple scatter-gather entries, each holding up to UINT_MAX bytes. When calculating the DMA address for entries beyond the second one, the expression (i * UINT_MAX) causes integer overflow due to 32-bit arithmetic. This manifests when the input arg length >= 8 GiB results in looping for i >= 2. Fix by casting i to dma_addr_t before multiplication. Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Signed-off-by: Alex Mastro Reviewed-by: Jason Gunthorpe Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20251125-dma-buf-overflow-v1-1-b70ea1e6c4ba@fb.com Signed-off-by: Alex Williamson commit 98693e0897f754e3f51ce6626ed5f785f625ba2b Author: Alex Williamson Date: Mon Nov 24 15:36:22 2025 -0700 vfio/pci: Use RCU for error/request triggers to avoid circular locking Thanks to a device generating an ACS violation during bus reset, lockdep reported the following circular locking issue: CPU0: SET_IRQS (MSI/X): holds igate, acquires memory_lock CPU1: HOT_RESET: holds memory_lock, acquires pci_bus_sem CPU2: AER: holds pci_bus_sem, acquires igate This results in a potential 3-way deadlock. Remove the pci_bus_sem->igate leg of the triangle by using RCU to peek at the eventfd rather than locking it with igate. Fixes: 3be3a074cf5b ("vfio-pci: Don't use device_lock around AER interrupt setup") Signed-off-by: Alex Williamson Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20251124223623.2770706-1-alex@shazbot.org Signed-off-by: Alex Williamson commit b8d5acdcf525f44e521ca4ef51dce4dac403dab4 Author: Gui-Dong Han Date: Fri Nov 28 20:47:09 2025 +0800 hwmon: (max16065) Use local variable to avoid TOCTOU In max16065_current_show, data->curr_sense is read twice: once for the error check and again for the calculation. Since i2c_smbus_read_byte_data returns negative error codes on failure, if the data changes to an error code between the check and the use, ADC_TO_CURR results in an incorrect calculation. Read data->curr_sense into a local variable to ensure consistency. Note that data->curr_gain is constant and safe to access directly. This aligns max16065_current_show with max16065_input_show, which already uses a local variable for the same reason. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251128124709.3876-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 07272e883fc61574b8367d44de48917f622cdd83 Author: Gui-Dong Han Date: Fri Nov 28 20:38:16 2025 +0800 hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU The macros FAN_FROM_REG and TEMP_FROM_REG evaluate their arguments multiple times. When used in lockless contexts involving shared driver data, this causes Time-of-Check to Time-of-Use (TOCTOU) race conditions. Convert the macros to static functions. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Fixes: 85f03bccd6e0 ("hwmon: Add support for Winbond W83L786NG/NR") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251128123816.3670-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 418de94e7593081c29066555bf9059f1f7dd9d79 Author: Randy Dunlap Date: Thu Nov 27 22:57:54 2025 -0800 sbitmap: fix all kernel-doc warnings Modify kernel-doc comments in sbitmap.h to prevent warnings: Warning: include/linux/sbitmap.h:84 struct member 'alloc_hint' not described in 'sbitmap' Warning: include/linux/sbitmap.h:151 struct member 'ws_active' not described in 'sbitmap_queue' Warning: include/linux/sbitmap.h:552 No description found for return value of 'sbq_wait_ptr' Signed-off-by: Randy Dunlap Signed-off-by: Jens Axboe commit 28d7a371f021419cb6c3a243f5cf167f88eb51b9 Author: Ming Lei Date: Fri Nov 21 09:58:28 2025 +0800 ublk: add helper of __ublk_fetch() Add helper __ublk_fetch() for refactoring ublk_fetch(). Meantime move ublk_config_io_buf() out of __ublk_fetch() to make the code structure cleaner. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3443bab2f8e44e00adaf76ba677d4219416376f2 Author: Ming Lei Date: Fri Nov 21 09:58:27 2025 +0800 ublk: pass const pointer to ublk_queue_is_zoned() Pass const pointer to ublk_queue_is_zoned() because it is readonly. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 0a9beafa7c633e6ff66b05b81eea78231b7e6520 Author: Ming Lei Date: Fri Nov 21 09:58:26 2025 +0800 ublk: refactor auto buffer register in ublk_dispatch_req() Refactor auto buffer register code and prepare for supporting batch IO feature, and the main motivation is to put 'ublk_io' operation code together, so that per-io lock can be applied for the code block. The key changes are: - Rename ublk_auto_buf_reg() as ublk_do_auto_buf_reg() - Introduce an enum `auto_buf_reg_res` to represent the result of the buffer registration attempt (FAIL, FALLBACK, OK). - Split the existing `ublk_do_auto_buf_reg` function into two: - `__ublk_do_auto_buf_reg`: Performs the actual buffer registration and returns the `auto_buf_reg_res` status. - `ublk_do_auto_buf_reg`: A wrapper that calls the internal function and handles the I/O preparation based on the result. - Introduce `ublk_prep_auto_buf_reg_io` to encapsulate the logic for preparing the I/O for completion after buffer registration. - Pass the `tag` directly to `ublk_auto_buf_reg_fallback` to avoid recalculating it. This refactoring makes the control flow clearer and isolates the different stages of the auto buffer registration process. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 8d61ece156bd4f2b9e7d3b2a374a26d42c7a4a06 Author: Ming Lei Date: Fri Nov 21 09:58:25 2025 +0800 ublk: add `union ublk_io_buf` with improved naming Add `union ublk_io_buf` for naming the anonymous union of struct ublk_io's addr and buf fields, meantime apply it to `struct ublk_io` for storing either ublk auto buffer register data or ublk server io buffer address. The union uses clear field names: - `addr`: for regular ublk server io buffer addresses - `auto_reg`: for ublk auto buffer registration data This eliminates confusing access patterns and improves code readability. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 3035b9b46b0611898babc0b96ede65790d3566f7 Author: Ming Lei Date: Fri Nov 21 09:58:24 2025 +0800 ublk: add parameter `struct io_uring_cmd *` to ublk_prep_auto_buf_reg() Add parameter `struct io_uring_cmd *` to ublk_prep_auto_buf_reg() and prepare for reusing this helper for the coming UBLK_BATCH_IO feature, which can fetch & commit one batch of io commands via single uring_cmd. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 9574b21e952256d4fa3c8797c94482a240992d18 Author: Ming Lei Date: Fri Nov 21 09:58:23 2025 +0800 kfifo: add kfifo_alloc_node() helper for NUMA awareness Add __kfifo_alloc_node() by refactoring and reusing __kfifo_alloc(), and define kfifo_alloc_node() macro to support NUMA-aware memory allocation. The new __kfifo_alloc_node() function accepts a NUMA node parameter and uses kmalloc_array_node() instead of kmalloc_array() for node-specific allocation. The existing __kfifo_alloc() now calls __kfifo_alloc_node() with NUMA_NO_NODE to maintain backward compatibility. This enables users to allocate kfifo buffers on specific NUMA nodes, which is important for performance in NUMA systems where the kfifo will be primarily accessed by threads running on specific nodes. Cc: Stefani Seibold Cc: Andrew Morton Cc: linux-kernel@vger.kernel.org Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 82d12088c297fa1cef670e1718b3d24f414c23f7 Author: Tianchu Chen Date: Fri Nov 28 15:53:23 2025 +0800 char: applicom: fix NULL pointer dereference in ac_ioctl Discovered by Atuin - Automated Vulnerability Discovery Engine. In ac_ioctl, the validation of IndexCard and the check for a valid RamIO pointer are skipped when cmd is 6. However, the function unconditionally executes readb(apbs[IndexCard].RamIO + VERS) at the end. If cmd is 6, IndexCard may reference a board that does not exist (where RamIO is NULL), leading to a NULL pointer dereference. Fix this by skipping the readb access when cmd is 6, as this command is a global information query and does not target a specific board context. Signed-off-by: Tianchu Chen Acked-by: Arnd Bergmann Cc: stable Link: https://patch.msgid.link/20251128155323.a786fde92ebb926cbe96fcb1@linux.dev Signed-off-by: Greg Kroah-Hartman commit 89e1fb7ceffd898505ad7fa57acec0585bfaa2cc Author: Fengnan Chang Date: Fri Nov 28 16:53:14 2025 +0800 blk-mq: fix potential uaf for 'queue_hw_ctx' This is just apply Kuai's patch in [1] with mirror changes. blk_mq_realloc_hw_ctxs() will free the 'queue_hw_ctx'(e.g. undate submit_queues through configfs for null_blk), while it might still be used from other context(e.g. switch elevator to none): t1 t2 elevator_switch blk_mq_unquiesce_queue blk_mq_run_hw_queues queue_for_each_hw_ctx // assembly code for hctx = (q)->queue_hw_ctx[i] mov 0x48(%rbp),%rdx -> read old queue_hw_ctx __blk_mq_update_nr_hw_queues blk_mq_realloc_hw_ctxs hctxs = q->queue_hw_ctx q->queue_hw_ctx = new_hctxs kfree(hctxs) movslq %ebx,%rax mov (%rdx,%rax,8),%rdi ->uaf This problem was found by code review, and I comfirmed that the concurrent scenario do exist(specifically 'q->queue_hw_ctx' can be changed during blk_mq_run_hw_queues()), however, the uaf problem hasn't been repoduced yet without hacking the kernel. Sicne the queue is freezed in __blk_mq_update_nr_hw_queues(), fix the problem by protecting 'queue_hw_ctx' through rcu where it can be accessed without grabbing 'q_usage_counter'. [1] https://lore.kernel.org/all/20220225072053.2472431-1-yukuai3@huawei.com/ Signed-off-by: Yu Kuai Signed-off-by: Fengnan Chang Signed-off-by: Jens Axboe commit d0c98769ee7d5db8d699a270690639cde1766cd4 Author: Fengnan Chang Date: Fri Nov 28 16:53:13 2025 +0800 blk-mq: use array manage hctx map instead of xarray After commit 4e5cc99e1e48 ("blk-mq: manage hctx map via xarray"), we use an xarray instead of array to store hctx, but in poll mode, each time in blk_mq_poll, we need use xa_load to find corresponding hctx, this introduce some costs. In my test, xa_load may cost 3.8% cpu. This patch revert previous change, eliminates the overhead of xa_load and can result in a 3% performance improvement. Signed-off-by: Fengnan Chang Signed-off-by: Jens Axboe commit 7cede21e9f04f16a456d3c3c8a9a8899c8d84757 Merge: 638757c9c9e5a8 c19dfb267c2803 30a8e0a32e7c52 Author: Rafael J. Wysocki Date: Fri Nov 28 16:50:45 2025 +0100 Merge branches 'pm-qos' and 'pm-tools' Merge PM QoS updates and a cpupower utility update for 6.19-rc1: - Introduce and document a QoS limit on CPU exit latency during wakeup from suspend-to-idle (Ulf Hansson) - Add support for building libcpupower statically (Zuo An) * pm-qos: Documentation: power/cpuidle: Document the CPU system wakeup latency QoS cpuidle: Respect the CPU system wakeup QoS limit for cpuidle sched: idle: Respect the CPU system wakeup QoS limit for s2idle pmdomain: Respect the CPU system wakeup QoS limit for cpuidle pmdomain: Respect the CPU system wakeup QoS limit for s2idle PM: QoS: Introduce a CPU system wakeup QoS limit * pm-tools: tools/power/cpupower: Support building libcpupower statically commit edde060637b92607f3522252c03d64ad06369933 Merge: 52c4d1d62424c5 0c2988aaa4d3ed Author: Catalin Marinas Date: Fri Nov 28 15:48:03 2025 +0000 Merge branch 'for-next/set_memory' into for-next/core * for-next/set_memory: : Fix + documentation for the arm64 change_memory_common() arm64/mm: Document why linear map split failure upon vm_reset_perms is not problematic arm64/pageattr: Propagate return value from __change_memory_common commit 52c4d1d62424c574fa048235598ce37bd4ed1e32 Merge: 17c05cb0ef212d 27abb1ee5a4e02 Author: Catalin Marinas Date: Fri Nov 28 15:47:53 2025 +0000 Merge branch 'for-next/sysreg' into for-next/core * for-next/sysreg: : arm64 sysreg updates/cleanups arm64/sysreg: Remove unused define ARM64_FEATURE_FIELD_BITS KVM: arm64: selftests: Consider all 7 possible levels of cache KVM: arm64: selftests: Remove ARM64_FEATURE_FIELD_BITS and its last user arm64/sysreg: Add ICH_VMCR_EL2 arm64/sysreg: Move generation of RES0/RES1/UNKN to function arm64/sysreg: Support feature-specific fields with 'Prefix' descriptor arm64/sysreg: Fix checks for incomplete sysreg definitions arm64/sysreg: Replace TCR_EL1 field macros commit 17c05cb0ef212d1a3c1bbbb67693a89cd9f0fb44 Merge: e6a27290d80015 c86d9f8764ba2f a7717cad615f2b a5baf582f4c026 287d163322b743 337f7e3a4b4d60 a0245b42f881be cb1fa2e999558f ce1e1421f8d8cd 155f8d4ef0b78a 4b7a59fa700f42 Author: Catalin Marinas Date: Fri Nov 28 15:47:12 2025 +0000 Merge branches 'for-next/misc', 'for-next/kselftest', 'for-next/efi-preempt', 'for-next/assembler-macro', 'for-next/typos', 'for-next/sme-ptrace-disable', 'for-next/local-tlbi-page-reused', 'for-next/mpam', 'for-next/acpi' and 'for-next/documentation', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: perf: arm_spe: Add support for filtering on data source perf: Add perf_event_attr::config4 perf/imx_ddr: Add support for PMU in DB (system interconnects) perf/imx_ddr: Get and enable optional clks perf/imx_ddr: Move ida_alloc() from ddr_perf_init() to ddr_perf_probe() dt-bindings: perf: fsl-imx-ddr: Add compatible string for i.MX8QM, i.MX8QXP and i.MX8DXL arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY perf/arm-ni: Fix and optimise register offset calculation perf: arm_pmuv3: Add new Cortex and C1 CPU PMUs perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() perf/arm-ni: Add NoC S3 support perf/arm_cspmu: nvidia: Add pmevfiltr2 support perf/arm_cspmu: nvidia: Add revision id matching perf/arm_cspmu: Add pmpidr support perf/arm_cspmu: Add callback to reset filter config perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores * for-next/misc: : Miscellaneous patches arm64: atomics: lse: Remove unused parameters from ATOMIC_FETCH_OP_AND macros arm64: remove duplicate ARCH_HAS_MEM_ENCRYPT arm64: mm: use untagged address to calculate page index arm64: mm: make linear mapping permission update more robust for patial range arm64/mm: Elide TLB flush in certain pte protection transitions arm64/mm: Rename try_pgd_pgtable_alloc_init_mm arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors arm64: add unlikely hint to MTE async fault check in el0_svc_common arm64: acpi: add newline to deferred APEI warning arm64: entry: Clean out some indirection arm64/mm: Ensure PGD_SIZE is aligned to 64 bytes when PA_BITS = 52 arm64/mm: Drop cpu_set_[default|idmap]_tcr_t0sz() arm64: remove unused ARCH_PFN_OFFSET arm64: use SOFTIRQ_ON_OWN_STACK for enabling softirq stack arm64: Remove assertion on CONFIG_VMAP_STACK * for-next/kselftest: : arm64 kselftest patches kselftest/arm64: Align zt-test register dumps * for-next/efi-preempt: : arm64: Make EFI calls preemptible arm64/efi: Call EFI runtime services without disabling preemption arm64/efi: Move uaccess en/disable out of efi_set_pgd() arm64/efi: Drop efi_rt_lock spinlock from EFI arch wrapper arm64/fpsimd: Permit kernel mode NEON with IRQs off arm64/fpsimd: Don't warn when EFI execution context is preemptible efi/runtime-wrappers: Keep track of the efi_runtime_lock owner efi: Add missing static initializer for efi_mm::cpus_allowed_lock * for-next/assembler-macro: : arm64: Replace __ASSEMBLY__ with __ASSEMBLER__ in headers arm64: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers arm64: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers * for-next/typos: : Random typo/spelling fixes arm64: Fix double word in comments arm64: Fix typos and spelling errors in comments * for-next/sme-ptrace-disable: : Support disabling streaming mode via ptrace on SME only systems kselftest/arm64: Cover disabling streaming mode without SVE in fp-ptrace kselftst/arm64: Test NT_ARM_SVE FPSIMD format writes on non-SVE systems arm64/sme: Support disabling streaming mode via ptrace on SME only systems * for-next/local-tlbi-page-reused: : arm64, mm: avoid TLBI broadcast if page reused in write fault arm64, tlbflush: don't TLBI broadcast if page reused in write fault mm: add spurious fault fixing support for huge pmd * for-next/mpam: (34 commits) : Basic Arm MPAM driver (more to follow) MAINTAINERS: new entry for MPAM Driver arm_mpam: Add kunit tests for props_mismatch() arm_mpam: Add kunit test for bitmap reset arm_mpam: Add helper to reset saved mbwu state arm_mpam: Use long MBWU counters if supported arm_mpam: Probe for long/lwd mbwu counters arm_mpam: Consider overflow in bandwidth counter state arm_mpam: Track bandwidth counter state for power management arm_mpam: Add mpam_msmon_read() to read monitor value arm_mpam: Add helpers to allocate monitors arm_mpam: Probe and reset the rest of the features arm_mpam: Allow configuration to be applied and restored during cpu online arm_mpam: Use a static key to indicate when mpam is enabled arm_mpam: Register and enable IRQs arm_mpam: Extend reset logic to allow devices to be reset any time arm_mpam: Add a helper to touch an MSC from any CPU arm_mpam: Reset MSC controls from cpuhp callbacks arm_mpam: Merge supported features during mpam_enable() into mpam_class arm_mpam: Probe the hardware features resctrl supports arm_mpam: Add helpers for managing the locking around the mon_sel registers ... * for-next/acpi: : arm64 acpi updates ACPI: GTDT: Get rid of acpi_arch_timer_mem_init() * for-next/documentation: : arm64 Documentation updates Documentation/arm64: Fix the typo of register names commit 638757c9c9e5a823671367150a9f48e93d115b48 Merge: bf7ae1773ea794 65df3a9629c10d 8dfa8bb6525453 Author: Rafael J. Wysocki Date: Fri Nov 28 16:44:00 2025 +0100 Merge branches 'pm-em' and 'pm-opp' Merge energy model management updates and operating performance points (OPP) library changes for 6.19-rc1: - Add support for sending netlink notifications to user space on energy model updates (Changwoo Mini, Peng Fan) - Minor improvements to the Rust OPP interface (Tamir Duberstein) - Fixes to scope-based pointers in the OPP library (Viresh Kumar) * pm-em: PM: EM: Add to em_pd_list only when no failure PM: EM: Notify an event when the performance domain changes PM: EM: Implement em_notify_pd_created/updated() PM: EM: Implement em_notify_pd_deleted() PM: EM: Implement em_nl_get_pd_table_doit() PM: EM: Implement em_nl_get_pds_doit() PM: EM: Add an iterator and accessor for the performance domain PM: EM: Add a skeleton code for netlink notification PM: EM: Add em.yaml and autogen files PM: EM: Expose the ID of a performance domain via debugfs PM: EM: Assign a unique ID when creating a performance domain * pm-opp: rust: opp: simplify callers of `to_c_str_array` OPP: Initialize scope-based pointers inline rust: opp: fix broken rustdoc link commit 0c2988aaa4d3eda94b738d5a7acae7838d52fe4d Author: Dev Jain Date: Wed Nov 12 11:57:16 2025 +0530 arm64/mm: Document why linear map split failure upon vm_reset_perms is not problematic Consider the following code path: (1) vmalloc -> (2) set_vm_flush_reset_perms -> (3) set_memory_ro/set_memory_rox -> .... (4) use the mapping .... -> (5) vfree -> (6) vm_reset_perms -> (7) set_area_direct_map. Or, it may happen that we encounter failure at (3) and directly jump to (5). In both cases, (7) may fail due to linear map split failure. But, we care about its success *only* for the region which got successfully changed by (3). Such a region is guaranteed to be pte-mapped. The TLDR is that (7) will surely succeed for the regions we care about. Signed-off-by: Dev Jain Reviewed-by: Ryan Roberts Signed-off-by: Catalin Marinas commit e5efd56fa157d2e7d789949d1d64eccbac18a897 Author: Dev Jain Date: Wed Nov 12 11:57:15 2025 +0530 arm64/pageattr: Propagate return value from __change_memory_common The rodata=on security measure requires that any code path which does vmalloc -> set_memory_ro/set_memory_rox must protect the linear map alias too. Therefore, if such a call fails, we must abort set_memory_* and caller must take appropriate action; currently we are suppressing the error, and there is a real chance of such an error arising post commit a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full"). Therefore, propagate any error to the caller. Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full") Signed-off-by: Dev Jain Reviewed-by: Ryan Roberts Signed-off-by: Catalin Marinas commit bf7ae1773ea79417d430a2d216abdb9857db8ec1 Merge: 1fe25237137c13 4bf944f3fcb6c1 748d6ba43afde7 Author: Rafael J. Wysocki Date: Fri Nov 28 16:29:41 2025 +0100 Merge branches 'pm-cpuidle' and 'pm-powercap' Merge cpuidle and power capping updates for 6.19-rc1: - Use residency threshold in polling state override decisions in the menu cpuidle governor (Aboorva Devarajan) - Add sanity check for exit latency and target residency in the cpufreq core (Rafael Wysocki) - Use this_cpu_ptr() where possible in the teo governor (Christian Loehle) - Rework the handling of tick wakeups in the teo cpuidle governor to increase the likelihood of stopping the scheduler tick in the cases when tick wakeups can be counted as non-timer ones (Rafael Wysocki) - Fix a reverse condition in the teo cpuidle governor and drop a misguided target residency check from it (Rafael Wysocki) - Clean up muliple minor defects in the teo cpuidle governor (Rafael Wysocki) - Update header inclusion to make it follow the Include What You Use principle (Andy Shevchenko) - Enable MSR-based RAPL PMU support in the intel_rapl power capping driver and arrange for using it on the Panther Lake and Wildcat Lake processors (Kuppuswamy Sathyanarayanan) - Add support for Nova Lake and Wildcat Lake processors to the intel_rapl power capping driver (Kaushlendra Kumar, Srinivas Pandruvada) * pm-cpuidle: cpuidle: Warn instead of bailing out if target residency check fails cpuidle: Update header inclusion cpuidle: governors: teo: Add missing space to the description cpuidle: governors: teo: Simplify intercepts-based state lookup cpuidle: governors: teo: Fix tick_intercepts handling in teo_update() cpuidle: governors: teo: Rework the handling of tick wakeups cpuidle: governors: teo: Decay metrics below DECAY_SHIFT threshold cpuidle: governors: teo: Use s64 consistently in teo_update() cpuidle: governors: teo: Drop redundant function parameter cpuidle: governors: teo: Drop misguided target residency check cpuidle: teo: Use this_cpu_ptr() where possible cpuidle: Add sanity check for exit latency and target residency cpuidle: menu: Use residency threshold in polling state override decisions * pm-powercap: powercap: intel_rapl: Enable MSR-based RAPL PMU support powercap: intel_rapl: Prepare read_raw() interface for atomic-context callers powercap: intel_rapl: Add support for Nova Lake processors powercap: intel_rapl: Add support for Wildcat Lake platform commit 1fe25237137c13aeb1a1bd17c0aa6fed6787e444 Merge: f086594adb34c9 ded4feb14d222f Author: Rafael J. Wysocki Date: Fri Nov 28 16:15:38 2025 +0100 Merge branch 'pm-cpufreq' Merge cpufreq updates for 6.19-rc1: - Add OPP and bandwidth support for Tegra186 (Aaron Kling) - Optimizations for parameter array handling in the amd-pstate cpufreq driver (Mario Limonciello) - Fix for mode changes with offline CPUs in the amd-pstate cpufreq driver (Gautham Shenoy) - Preserve freq_table_sorted across suspend/hibernate in the cpufreq core (Zihuan Zhang) - Adjust energy model rules for Intel hybrid platforms in the intel_pstate cpufreq driver and improve printing of debug messages in it (Rafael Wysocki) - Replace deprecated strcpy() in cpufreq_unregister_governor() (Thorsten Blum) - Fix duplicate hyperlink target errors in the intel_pstate cpufreq driver documentation and use :ref: directive for internal linking in it (Swaraj Gaikwad, Bagas Sanjaya) - Add Diamond Rapids OOB mode support to the intel_pstate cpufreq driver (Kuppuswamy Sathyanarayanan) - Use mutex guard for driver locking in the intel_pstate driver and eliminate some code duplication from it (Rafael Wysocki) - Replace udelay() with usleep_range() in ACPI cpufreq (Kaushlendra Kumar) - Minor improvements to various cpufreq drivers (Christian Marangi, Hal Feng, Jie Zhan, Marco Crivellari, Miaoqian Lin, and Shuhao Fu) * pm-cpufreq: (27 commits) cpufreq: qcom-nvmem: fix compilation warning for qcom_cpufreq_ipq806x_match_list cpufreq: ACPI: Replace udelay() with usleep_range() cpufreq: intel_pstate: Eliminate some code duplication cpufreq: intel_pstate: Use mutex guard for driver locking cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs cpufreq/amd-pstate: Add static asserts for EPP indices cpufreq/amd-pstate: Fix some whitespace issues cpufreq/amd-pstate: Adjust return values in amd_pstate_update_status() cpufreq/amd-pstate: Make amd_pstate_get_mode_string() never return NULL cpufreq/amd-pstate: Drop NULL value from amd_pstate_mode_string cpufreq/amd-pstate: Use sysfs_match_string() for epp cpufreq: tegra194: add WQ_PERCPU to alloc_workqueue users cpufreq: qcom-nvmem: add compatible fallback for ipq806x for no SMEM Documentation: intel-pstate: Use :ref: directive for internal linking cpufreq: intel_pstate: Add Diamond Rapids OOB mode support Documentation: intel_pstate: fix duplicate hyperlink target errors cpufreq: CPPC: Don't warn if FIE init fails to read counters cpufreq: nforce2: fix reference count leak in nforce2 cpufreq: tegra186: add OPP support and set bandwidth cpufreq: dt-platdev: Add JH7110S SOC to the allowlist ... commit f086594adb34c9db31d764efc6471570ec6a5f1c Merge: 60d69a7ed1e5ff c03aef8833597f Author: Rafael J. Wysocki Date: Fri Nov 28 16:01:13 2025 +0100 Merge branch 'pm-sleep' Merge updates related to system suspend and hibernation for 6.19-rc1: - Replace snprintf() with scnprintf() in show_trace_dev_match() (Kaushlendra Kumar) - Fix memory allocation error handling in pm_vt_switch_required() (Malaya Kumar Rout) - Introduce CALL_PM_OP() macro and use it to simplify code in generic PM operations (Kaushlendra Kumar) - Add module param to backtrace all CPUs in the device power management watchdog (Sergey Senozhatsky) - Rework message printing in swsusp_save() (Rafael Wysocki) - Make it possible to change the number of hibernation compression threads (Xueqin Luo) - Clarify that only cgroup1 freezer uses PM freezer (Tejun Heo) - Add document on debugging shutdown hangs to PM documentation and correct a mistaken configuration option in it (Mario Limonciello) - Shut down wakeup source timer before removing the wakeup source from the list (Kaushlendra Kumar, Rafael Wysocki) - Introduce new PMSG_POWEROFF event for system shutdown handling with the help of PM device callbacks (Mario Limonciello) - Make pm_test delay interruptible by wakeup events (Riwen Lu) - Clean up kernel-doc comment style usage in the core hibernation code and remove unuseful comments from it (Sunday Adelodun, Rafael Wysocki) - Add support for handling wakeup events and aborting the suspend process while it is syncing file systems (Samuel Wu, Rafael Wysocki) * pm-sleep: (21 commits) PM: hibernate: Extra cleanup of comments in swap handling code PM: sleep: Call pm_sleep_fs_sync() instead of ksys_sync_helper() PM: sleep: Add support for wakeup during filesystem sync PM: hibernate: Clean up kernel-doc comment style usage PM: suspend: Make pm_test delay interruptible by wakeup events usb: sl811-hcd: Add PM_EVENT_POWEROFF into suspend callbacks scsi: Add PM_EVENT_POWEROFF into suspend callbacks PM: Introduce new PMSG_POWEROFF event PM: wakeup: Update after recent wakeup source removal ordering change PM: wakeup: Delete timer before removing wakeup source from list Documentation: power: Correct a mistaken configuration option Documentation: power: Add document on debugging shutdown hangs freezer: Clarify that only cgroup1 freezer uses PM freezer PM: hibernate: add sysfs interface for hibernate_compression_threads PM: hibernate: make compression threads configurable PM: hibernate: dynamically allocate crc->unc_len/unc for configurable threads PM: hibernate: Rework message printing in swsusp_save() PM: dpm_watchdog: add module param to backtrace all CPUs PM: sleep: Introduce CALL_PM_OP() macro to simplify code PM: console: Fix memory allocation error handling in pm_vt_switch_required() ... commit 60d69a7ed1e5ffa94f788e35b2ca86c6a750f2f2 Merge: 5e8b7b58b205da c9ff3637386c6e 07f42f8290e927 Author: Rafael J. Wysocki Date: Fri Nov 28 15:56:09 2025 +0100 Merge branches 'pm-core' and 'pm-runtime' Merge a core power management update and runtime PM framework updates for 6.19-rc1: - Add WQ_UNBOUND to pm_wq workqueue (Marco Crivellari) - Add runtime PM wrapper macros for ACQUIRE()/ACQUIRE_ERR() and use them in the PCI core and the ACPI TAD driver (Rafael Wysocki) - Improve runtime PM in the ACPI TAD driver (Rafael Wysocki) - Update pm_runtime_allow/forbid() documentation (Rafael Wysocki) - Fix typos in runtime.c comments (Malaya Kumar Rout) * pm-core: PM: WQ_UNBOUND added to pm_wq workqueue * pm-runtime: PCI/sysfs: Use PM_RUNTIME_ACQUIRE()/PM_RUNTIME_ACQUIRE_ERR() ACPI: TAD: Use PM_RUNTIME_ACQUIRE()/PM_RUNTIME_ACQUIRE_ERR() PM: runtime: Wrapper macros for ACQUIRE()/ACQUIRE_ERR() PM: runtime: fix typos in runtime.c comments ACPI: TAD: Improve runtime PM using guard macros ACPI: TAD: Rearrange runtime PM operations in acpi_tad_remove() PM: runtime: docs: Update pm_runtime_allow/forbid() documentation commit bfad33230a5db723d703ea9448591659bda402b0 Author: Paul E. McKenney Date: Sun Nov 2 14:49:48 2025 -0800 refscale: Add SRCU-fast-updown readers This commit adds refscale readers based on srcu_read_lock_fast_updown() and srcu_read_unlock_fast_updown() ("refscale.scale_type=srcu-fast-updown"). On my x86 laptop, these are about 2.2ns per pair. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit af47d98064e900f279c98bb3bb57445a1e7a8f6b Merge: ba9aeba05321e2 a508939e15356d e96190da17a2b2 Author: Rafael J. Wysocki Date: Fri Nov 28 15:08:38 2025 +0100 Merge branches 'acpi-misc' and 'pnp' Merge miscellaneous ACPI support updates and a PNP update for 6.19-rc1: - Replace `core::mem::zeroed` with `pin_init::zeroed` in the ACPI Rust code (Siyuan Huang) - Update the ACPI code to use the new style of allocating workqueues and new global workqueues (Marco Crivellari) - Fix two spelling mistakes in the ACPI code (Chu Guangqing) - Fix ISAPNP to generate uevents to auto-load modules (René Rebe) * acpi-misc: ACPI: PM: Fix a spelling mistake ACPI: LPSS: Fix a spelling mistake ACPI: thermal: Add WQ_PERCPU to alloc_workqueue() users ACPI: OSL: Add WQ_PERCPU to alloc_workqueue() users ACPI: EC: Add WQ_PERCPU to alloc_workqueue() users ACPI: OSL: replace use of system_wq with system_percpu_wq ACPI: scan: replace use of system_unbound_wq with system_dfl_wq rust: acpi: replace `core::mem::zeroed` with `pin_init::zeroed` * pnp: PNP: Fix ISAPNP to generate uevents to auto-load modules commit ba9aeba05321e2d4b7fd2ee022dd1ba896432f43 Merge: 24d268add6d9b4 58ca21d591994c a5c2fcd82e04a6 2f58be82fc2f17 8974573ba45493 Author: Rafael J. Wysocki Date: Fri Nov 28 15:01:07 2025 +0100 Merge branches 'acpi-tad', 'acpi-fan', 'acpi-dptf' and 'acpi-tools' Merge updates of the ACPI time and alarm device (TAD) driver, ACPI fan driver, ACPI DPTF code and an ACPI utility update for 6.19-rc1: - Improve runtime PM in the ACPI time and alarm device (TAD) driver using guard macros and rearrange code related to runtime PM in acpi_tad_remove() (Rafael Wysocki) - Add support for Microsoft fan extensions to the ACPI fan driver along with notification support and work around a 64-bit firmware bug in that driver (Armin Wolf) - Use ACPI_FREE() to free ACPI buffer in the ACPI DPTF code (Kaushlendra Kumar) - Fix a memory leak and a resource leak in the ACPI pfrut utility (Malaya Kumar Rout) * acpi-tad: ACPI: TAD: Improve runtime PM using guard macros ACPI: TAD: Rearrange runtime PM operations in acpi_tad_remove() * acpi-fan: ACPI: fan: Add support for Microsoft fan extensions ACPI: fan: Add hwmon notification support ACPI: fan: Add basic notification support ACPI: fan: Workaround for 64-bit firmware bug * acpi-dptf: ACPI: DPTF: Use ACPI_FREE() for ACPI buffer deallocation * acpi-tools: ACPI: tools: pfrut: fix memory leak and resource leak in pfrut.c commit 3a991f784c167de08466efe81768ff64c63a8d09 Author: Gao Xiang Date: Thu Nov 27 15:31:21 2025 +0800 erofs: enable error reporting for z_erofs_stream_switch_bufs() Enable propagation of detailed errors to callers. Signed-off-by: Gao Xiang commit 83564b06b275be083b1a7f707e1951dd506d7627 Author: Gao Xiang Date: Thu Nov 27 15:31:20 2025 +0800 erofs: improve Zstd, LZMA and DEFLATE error strings Enable better, more detailed, and unique error reporting. Signed-off-by: Gao Xiang commit 831faabed8129246c9802af9ad9581a2c1e9eeb9 Author: Gao Xiang Date: Thu Nov 27 15:31:19 2025 +0800 erofs: improve decompression error reporting Change the return type of decompress() from `int` to `const char *` to provide more informative error diagnostics: - A NULL return indicates successful decompression; - If IS_ERR(ptr) is true, the return value encodes a standard negative errno (e.g., -ENOMEM, -EOPNOTSUPP) identifying the specific error; - Otherwise, a non-NULL return points to a human-readable error string, and the corresponding error code should be treated as -EFSCORRUPTED. Signed-off-by: Gao Xiang commit 9ae77198d4815c63fc8ebacc659c71d150d1e51b Author: Gao Xiang Date: Wed Nov 26 01:01:02 2025 +0800 erofs: tidy up z_erofs_lz4_handle_overlap() - Add some useful comments to explain inplace I/Os and decompression; - Rearrange the code to get rid of one unnecessary goto. Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 24d268add6d9b48c28f4bd8779cdf6322ae4e994 Merge: 9fac2a114b8a41 9d6c58dae8f659 c964081d602f96 32ece31db4df79 86bfd21a0baf01 Author: Rafael J. Wysocki Date: Fri Nov 28 14:44:36 2025 +0100 Merge branches 'acpica', 'acpi-property', 'acpi-pm' and 'acpi-battery' Merge an ACPICA change, device ACPI properties handling update, ACPI power management updates, and an ACPI battery driver update for 6.19-rc1: - Avoid walking the ACPI namespace in the AML interpreter if the starting node cannot be determined (Cryolitia PukNgae) - Use min() instead of min_t() in the ACPI device properties handling code to avoid discarding significant bits (David Laight) - Fix potential fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() that may prevent the parent fwnode from being released (Haotian Zhang) - Rework acpi_graph_get_next_endpoint() to use ACPI functions only, remove unnecessary contitionals from it to make it easier to follow, and make acpi_get_next_subnode() static (Sakari Ailus) - Drop unused function acpi_get_lps0_constraint(), make some Low-Power S0 callback functions for suspend-to-idle static, and rearrange the code retrieving Low-Power S0 constraits so it only runs when the constraits are actually used (Rafael Wysocki) - Drop redundant locking from the ACPI battery driver (Rafael Wysocki) * acpica: ACPICA: Avoid walking the Namespace if start_node is NULL * acpi-property: ACPI: property: use min() instead of min_t() ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() ACPI: property: Rework acpi_graph_get_next_endpoint() ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only ACPI: property: Make acpi_get_next_subnode() static * acpi-pm: ACPI: PM: s2idle: Only retrieve constraints when needed ACPI: PM: s2idle: Staticise LPS0 callback functions ACPI: PM: s2idle: Drop acpi_get_lps0_constraint() * acpi-battery: ACPI: battery: Drop redundant locking commit 63d26c3811421ceeb5b82a85489b88bf545e33c7 Merge: 8538e7ee09e209 c411d8bf06992d Author: Rafael J. Wysocki Date: Fri Nov 28 13:02:50 2025 +0100 Merge tag 'thermal-v6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Pull thermal control changes for 6.19-rc1 from Daniel Lezcano: "- Document the RZ/V2H TSU DT bindings (Ovidiu Panait) - Document the Kaanapali Temperature Sensor (Manaf Meethalavalappu Pallikunhi) - Document R-Car Gen4 and RZ/G2 support in driver comment (Marek Vasut) - Convert to DEFINE_SIMPLE_DEV_PM_OPS in the R-Car [Gen3] (Geert Uytterhoeven) - Fix format string bug in thermal-engine (Malaya Kumar Rout) - Make ipq5018 tsens standalone compatible (George Moussalem) - Add the QCS8300 compatible for the QCom Tsens (Gaurav Kohli) - Add the support for the NXP i.MX91 thermal module, including the DT bindings (Pengfei Li) * tag 'thermal-v6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/drivers/imx91: Add support for i.MX91 thermal monitoring unit dt-bindings: thermal: fsl,imx91-tmu: add bindings for NXP i.MX91 thermal module dt-bindings: thermal: tsens: Add QCS8300 compatible dt-bindings: thermal: qcom-tsens: make ipq5018 tsens standalone compatible tools/thermal/thermal-engine: Fix format string bug in thermal-engine thermal/drivers/rcar_gen3: Convert to DEFINE_SIMPLE_DEV_PM_OPS() thermal/drivers/rcar: Convert to DEFINE_SIMPLE_DEV_PM_OPS() thermal/drivers/rcar_gen3: Document R-Car Gen4 and RZ/G2 support in driver comment dt-bindings: thermal: qcom-tsens: document the Kaanapali Temperature Sensor dt-bindings: thermal: r9a09g047-tsu: Document RZ/V2H TSU commit 9fac2a114b8a41d3fd843ac7b83a38dc063500ed Merge: fbf04215d9966d 17e7972979e147 Author: Rafael J. Wysocki Date: Fri Nov 28 12:59:01 2025 +0100 Merge back ACPI processor driver changes for 6.19 commit dae9750105cf93ac1e156ef91f4beeb53bd64777 Author: Xi Ruoyao Date: Fri Nov 28 15:50:32 2025 +0800 gpio: loongson: Switch 2K2000/3000 GPIO to BYTE_CTRL_MODE The manuals of 2K2000 says both BIT_CTRL_MODE and BYTE_CTRL_MODE are supported but the latter is recommended. Also on 2K3000, per the ACPI DSDT the GPIO controller is compatible with 2K2000, but it fails to operate GPIOs 62 and 63 (and maybe others) using BIT_CTRL_MODE. Using BYTE_CTRL_MODE also makes those 2K3000 GPIOs work. Fixes: 3feb70a61740 ("gpio: loongson: add more gpio chip support") Cc: stable@vger.kernel.org Signed-off-by: Xi Ruoyao Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20251128075033.255821-1-xry111@xry111.site Signed-off-by: Bartosz Golaszewski commit f01c0f7ee59fce16e5bae92a2d388a8a6fdf3f0f Author: Randy Dunlap Date: Thu Nov 27 22:27:39 2025 -0800 gpio: regmap: fix kernel-doc notation Add a ':' to the end of struct member names to prevent kernel-doc warnings: Warning: include/linux/gpio/regmap.h:108 struct member 'regmap_irq_line' not described in 'gpio_regmap_config' Warning: include/linux/gpio/regmap.h:108 struct member 'regmap_irq_flags' not described in 'gpio_regmap_config' Fixes: 553b75d4bfe9 ("gpio: regmap: Allow to allocate regmap-irq device") Signed-off-by: Randy Dunlap Reviewed-by: Michael Walle Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251128062739.845403-1-rdunlap@infradead.org Signed-off-by: Bartosz Golaszewski commit b169e1733cadb614e87f69d7a5ae1b186c50d313 Author: Chia-Lin Kao (AceLan) Date: Thu Nov 27 15:04:07 2025 +0800 platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks Dell Pro Rugged 10/12 tablets has a reliable VGBS method. If VGBS is not called on boot, the on-screen keyboard won't appear if the device is booted without a keyboard. Call VGBS on boot on thess devices to get the initial state of SW_TABLET_MODE in a reliable way. Signed-off-by: Chia-Lin Kao (AceLan) Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 545d1287e40a55242f6ab68bcc1ba3b74088b1bc Author: Tianchu Chen Date: Fri Nov 28 16:06:30 2025 +0800 spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes. Fixes: 8846739f52af ("spi: add ch341a usb2spi driver") Signed-off-by: Tianchu Chen Link: https://patch.msgid.link/20251128160630.0f922c45ec6084a46fb57099@linux.dev Signed-off-by: Mark Brown commit b025f01ee952593d583716505764f116a9d578e0 Author: Charles Keepax Date: Fri Nov 28 10:28:41 2025 +0000 ASoC: SDCA: Fixup some more Kconfig issues As the class driver is manually selectable, it needs to depend on SOUNDWIRE, which is obviously necessary. Also the depends on in SND_SOC_SDCA_HID needs to be pulled into SND_SOC_SDCA_CLASS as well, since HID is selected by the class driver. Fixes: 2d877d0659cb ("ASoC: SDCA: Add basic SDCA class driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511281223.DDs12LiC-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511280822.i2fveMpR-lkp@intel.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251128102841.2930808-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 816c9cac35185aff33da1eb73cc974349623eb3a Author: Richard Fitzgerald Date: Fri Nov 28 11:25:20 2025 +0000 ASoC: cs35l56: Log a message if firmware is missing If the amp is still reporting FIRMWARE_MISSING after cs35l56_patch() has completed it is helpful to log a warning. After a complete firmware download the FIRMWARE_MISSING flag will be clear. If this isn't the case, the driver should log a message to report this. The amp can produce basic audio output without firmware, as a fallback, so this wasn't originally logged as a warning condition because the amp is still in an operational state - just not with full functionality. However, it was not at all obvious to an end user that anything is unusual. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251128112520.40067-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit feab2875893510ea1bde4d3361431cd7ac53e555 Author: Dan Carpenter Date: Fri Nov 28 10:20:27 2025 +0300 ASoC: nau8325: Delete a stray tab This line is indented too far. Delete a tab. Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSlNO0sqQr2A4vzG@stanley.mountain Signed-off-by: Mark Brown commit 479b1f8d416501cc3c18b743b1cf63776934ada9 Author: Richard Fitzgerald Date: Fri Nov 28 10:21:32 2025 +0000 firmware: cs_dsp: Add test cases for client_ops == NULL Add test cases for the client not providing a pointer to a struct cs_dsp_client_ops. This proves that it is safe for the client to leave the client_ops pointer at NULL if it does not need to implement any of the callbacks. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251128102132.1575177-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit af37511305c0da1d151cc9a1ee6077c2cbde4f1d Author: Richard Fitzgerald Date: Fri Nov 28 10:21:31 2025 +0000 firmware: cs_dsp: Don't require client to provide a struct cs_dsp_client_ops A client of cs_dsp does not necessarily need to implement any of the optional callbacks in struct cs_dsp_client_ops, so allow the client_ops pointer to be NULL. This has been done by pointing client_ops at a default empty cs_dsp_client_ops. It keeps the code cleaner by avoiding having to add double nested NULL checks everywhere one of these callbacks is called. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251128102132.1575177-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ef1a7e02fdb7526e8d7c75e744f1f5b2acd7100b Author: Chancel Liu Date: Thu Nov 27 11:26:52 2025 +0900 ASoC: fsl_micfil: Set channel range control The range control register can't directly adjust volume gain according to specification. It's the dynamic range of the CIC filter. The range value should meet some conditions otherwise the channel data is not reliable. Add an array in soc data to store const value in formula with which range with all quality on different platforms can be calculated. If the value set to range control exceeds the max range there'll be warning logs. Signed-off-by: Chancel Liu Acked-by: Shengjiu Wang Link: https://patch.msgid.link/20251127022652.674574-3-chancel.liu@nxp.com Signed-off-by: Mark Brown commit e04aab96b3776634ab37ddce6d50a431126edec3 Author: Chancel Liu Date: Thu Nov 27 11:26:51 2025 +0900 ASoC: fsl_micfil: Add default quality for different platforms Add a default quality flag in soc data. For i.MX8MP/93/943 platforms on which range control is constrained, set medium quality by default to achieve better audio performance and wider adjustable range control. Signed-off-by: Chancel Liu Acked-by: Shengjiu Wang Link: https://patch.msgid.link/20251127022652.674574-2-chancel.liu@nxp.com Signed-off-by: Mark Brown commit 0512bf9701f339c8fee2cc82b6fc35f0a8f6be7a Merge: 3a8660878839fa 6fb102291873c6 Author: Christian Brauner Date: Mon Nov 24 13:11:21 2025 +0100 Merge patch series "file: FD_{ADD,PREPARE}()" Christian Brauner says: This now removes roughly double the code that it adds. I've been playing with this to allow for moderately flexible usage of the get_unused_fd_flags() + create file + fd_install() pattern that's used quite extensively and requires cumbersome cleanup paths. How callers allocate files is really heterogenous so it's not really convenient to fold them into a single class. It's possibe to split them into subclasses like for anon inodes. I think that's not necessarily nice as well. This adds two primitives: (1) FD_ADD() the simple cases a file is installed: fd = FD_ADD(O_CLOEXEC, vfio_device_open_file(device)); if (fd < 0) vfio_device_put_registration(device); return fd; (2) FD_PREPARE() that captures all the cases where access to fd or file or additional work before publishing the fd is needed: FD_PREPARE(fdf, O_CLOEXEC, sync_file->file); if (fdf.err) { fput(sync_file->file); return fdf.err; } data.fence = fd_prepare_fd(fdf); if (copy_to_user((void __user *)arg, &data, sizeof(data))) return -EFAULT; return fd_publish(fdf); I've converted all of the easy cases over to it and it gets rid of an aweful lot of convoluted cleanup logic. There are a bunch of other cases that can also be converted after a bit of massaging. It's centered around a simple struct. FD_PREPARE() encapsulates all of allocation and cleanup logic and must be followed by a call to fd_publish() which associates the fd with the file and installs it into the callers fdtable. If fd_publish() isn't called both are deallocated. FD_ADD() is a shorthand that does the fd_publish() and never exposes the struct to the caller. That's often the case when they don't need access to anything after installing the fd. It mandates a specific order namely that first we allocate the fd and then instantiate the file. But that shouldn't be a problem. Nearly everyone I've converted used this order anyway. There's a bunch of additional cases where it would be easy to convert them to this pattern. For example, the whole sync file stuff in dma currently returns the containing structure of the file instead of the file itself even though it's only used to allocate files. Changing that would make it fall into the FD_PREPARE() pattern easily. I've not done that work yet. There's room for extending this in a way that wed'd have subclasses for some particularly often use patterns but as I said I'm not even sure that's worth it. * patches from https://patch.msgid.link/20251123-work-fd-prepare-v4-0-b6efa1706cfd@kernel.org: (47 commits) kvm: convert kvm_vcpu_ioctl_get_stats_fd() to FD_PREPARE() kvm: convert kvm_arch_supports_gmem_init_shared() to FD_PREPARE() io_uring: convert io_create_mock_file() to FD_PREPARE() file: convert replace_fd() to FD_PREPARE() vfio: convert vfio_group_ioctl_get_device_fd() to FD_PREPARE() tty: convert ptm_open_peer() to FD_PREPARE() ntsync: convert ntsync_obj_get_fd() to FD_PREPARE() media: convert media_request_alloc() to FD_PREPARE() hv: convert mshv_ioctl_create_partition() to FD_PREPARE() gpio: convert linehandle_create() to FD_PREPARE() dma: port sw_sync_ioctl_create_fence() to FD_PREPARE() pseries: port papr_rtas_setup_file_interface() to FD_PREPARE() pseries: convert papr_platform_dump_create_handle() to FD_PREPARE() spufs: convert spufs_gang_open() to FD_PREPARE() papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() spufs: convert spufs_context_open() to FD_PREPARE() net/socket: convert __sys_accept4_file() to FD_PREPARE() net/socket: convert sock_map_fd() to FD_PREPARE() net/sctp: convert sctp_getsockopt_peeloff_common() to FD_PREPARE() net/kcm: convert kcm_ioctl() to FD_PREPARE() ... Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-0-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 6fb102291873c6d88b221c476589e65558e3f30c Author: Christian Brauner Date: Sun Nov 23 17:34:03 2025 +0100 io_uring: convert io_create_mock_file() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-45-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 99d4f12f174be8a55320b5097b5a09b7801c4e92 Author: Christian Brauner Date: Sun Nov 23 17:34:02 2025 +0100 file: convert replace_fd() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-44-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 5f3ea1c201088290f66445b601a21fd89a398f88 Author: Christian Brauner Date: Sun Nov 23 17:34:01 2025 +0100 vfio: convert vfio_group_ioctl_get_device_fd() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-43-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 3fd5edfe1d6fcc67410be753dcb704d8a1d0bfd7 Author: Christian Brauner Date: Sun Nov 23 17:34:00 2025 +0100 tty: convert ptm_open_peer() to FD_ADD() Christian Brauner says: The fix sent in [1] was squashed into this commit. Fixes: https://lore.kernel.org/37ac7af5-584f-4768-a462-4d1071c43eaf@sirena.org.uk [1] Reported-by: Mark Brown [1] Suggested-by: Linus Torvalds [1] Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-42-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit af66279a012b2d9a175486a6292d41513ae7b74f Author: Christian Brauner Date: Sun Nov 23 17:33:59 2025 +0100 ntsync: convert ntsync_obj_get_fd() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-41-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 6f504cbf108a8e5a1e6e830b2de901fdb4930fdf Author: Christian Brauner Date: Sun Nov 23 17:33:58 2025 +0100 media: convert media_request_alloc() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-40-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit c99dc44562728a568ebbfc3249d6b7d0e9f27165 Author: Christian Brauner Date: Sun Nov 23 17:33:57 2025 +0100 hv: convert mshv_ioctl_create_partition() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-39-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit da7e394bf58f94e9783379fef7c7fb4411b03208 Author: Christian Brauner Date: Mon Nov 24 13:55:02 2025 +0100 gpio: convert linehandle_create() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-38-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 6ae8da4846526e8af1d5132847716de9e6706f37 Author: Christian Brauner Date: Sun Nov 23 17:33:54 2025 +0100 pseries: port papr_rtas_setup_file_interface() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-36-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 274d937006a2f1258f513cca3f8d56fc23466b0e Author: Christian Brauner Date: Sun Nov 23 17:33:53 2025 +0100 pseries: convert papr_platform_dump_create_handle() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-35-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 0b9d4a6b51d75ca3e9806bf660e147328d645378 Author: Christian Brauner Date: Sun Nov 23 17:33:52 2025 +0100 spufs: convert spufs_gang_open() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-34-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 6d3789d347a7af5c4b0b2da3af47b8d9da607ab2 Author: Christian Brauner Date: Sun Nov 23 17:33:51 2025 +0100 papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Fixes a UAF for src_info as well. Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-33-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 843e7b5c293c112dedeeced1a7088668933d3308 Author: Christian Brauner Date: Sun Nov 23 17:33:50 2025 +0100 spufs: convert spufs_context_open() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-32-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 4667d638726cfd78e599c3ad5237cf4d1bf82c74 Author: Christian Brauner Date: Sun Nov 23 17:33:49 2025 +0100 net/socket: convert __sys_accept4_file() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-31-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 245f0d1c622b0183ce4f44b3e39aeacf78fae594 Author: Christian Brauner Date: Sun Nov 23 17:33:48 2025 +0100 net/socket: convert sock_map_fd() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-30-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 0d52d06a199f5b95a66a3ff0a303a48532e3461f Author: Christian Brauner Date: Sun Nov 23 17:33:46 2025 +0100 net/kcm: convert kcm_ioctl() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-28-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit fe67b063f687d8f32c466778aad57508bc1c618a Author: Christian Brauner Date: Sun Nov 23 17:33:45 2025 +0100 net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-27-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 910c361f9a1f41397b82d679802c1806cdd960fe Author: Christian Brauner Date: Sun Nov 23 17:33:44 2025 +0100 secretmem: convert memfd_secret() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-26-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 1afcbbe5d65617a3f2f6338effa9e0f21082912b Author: Christian Brauner Date: Sun Nov 23 17:33:43 2025 +0100 memfd: convert memfd_create() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-25-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 981bec8f698ba19a4d983016c6ccdde30502d07e Author: Christian Brauner Date: Sun Nov 23 17:33:42 2025 +0100 bpf: convert bpf_token_create() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-24-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 798c2da4906cf969daf422e5d9bde243c452deff Author: Christian Brauner Date: Sun Nov 23 17:33:41 2025 +0100 bpf: convert bpf_iter_new_fd() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-23-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit f2573685bd0ccb79cb6b6234461b7f750311b8e7 Author: Christian Brauner Date: Sun Nov 23 17:33:40 2025 +0100 ipc: convert do_mq_open() to FD_ADD() Christian Brauner says: The fix sent in [1] was squashed into this commit. Fixes: https://lore.kernel.org/c41de645-8234-465f-a3be-f0385e3a163c@sirena.org.uk [1] Reported-by: Mark Brown [1] Suggested-by: Linus Torvalds [1] Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-22-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 1ad7810c6ddae66b2fcd541672bca10fc3b9bbc0 Author: Christian Brauner Date: Sun Nov 23 17:33:39 2025 +0100 exec: convert begin_new_exec() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-21-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 7352c6fce34c2e3d902a9bb0af1684c535805e08 Author: Christian Brauner Date: Sun Nov 23 17:33:37 2025 +0100 af_unix: convert unix_file_open() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-19-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 34dfce523c907d932d8ea2f849e40203a6368047 Author: Christian Brauner Date: Sun Nov 23 17:33:36 2025 +0100 dma: convert dma_buf_fd() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-18-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 993f30468ea1c5f62758dd1ecc561fa7e156d479 Author: Christian Brauner Date: Sun Nov 23 17:33:35 2025 +0100 xfs: convert xfs_open_by_handle() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-17-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 39f6e7581ac56ada39aa823d8112642a57ca10b0 Author: Christian Brauner Date: Sun Nov 23 17:33:34 2025 +0100 userfaultfd: convert new_userfaultfd() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-16-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 14010faa1badae0a8a59b1134490c7aaab49e7a9 Author: Christian Brauner Date: Sun Nov 23 17:33:33 2025 +0100 timerfd: convert timerfd_create() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-15-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 5b755da105e22d9cabfd90edd310e46ecc7fa721 Author: Christian Brauner Date: Sun Nov 23 17:33:32 2025 +0100 signalfd: convert do_signalfd4() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-14-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 360fbf808a9a0827f44c46b45391c494760737f1 Author: Christian Brauner Date: Sun Nov 23 17:33:31 2025 +0100 open: convert do_sys_openat2() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-13-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 13dce771bbad42da6ecf086446d8ddfd1fce3a1b Author: Christian Brauner Date: Sun Nov 23 17:33:30 2025 +0100 eventpoll: convert do_epoll_create() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-12-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 0f4288410cef8676d745c776ea9f1cdd710d50ef Author: Christian Brauner Date: Sun Nov 23 17:33:29 2025 +0100 autofs: convert autofs_dev_ioctl_open_mountpoint() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-11-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 3d8aefd49aed34d2a3acfdcb10a0af0d0fe94a7c Author: Christian Brauner Date: Sun Nov 23 17:33:28 2025 +0100 nsfs: convert ns_ioctl() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-10-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 00de6e244807aa8e9c00cb6ad2976c429058d4ac Author: Christian Brauner Date: Sun Nov 23 17:33:27 2025 +0100 nsfs: convert open_namespace() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-9-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 7129098f4f7b848ead33ce10214b90716e3fd400 Author: Christian Brauner Date: Sun Nov 23 17:33:26 2025 +0100 fanotify: convert fanotify_init() to FD_PREPARE() Christian Brauner says: The fix sent in [1] was squashed into this commit. Link: https://lore.kernel.org/20251127201618.2115275-1-kuniyu@google.com [1] Reported-by: syzbot+321168dfa622eda99689@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6928b121.a70a0220.d98e3.0110.GAE@google.com Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-8-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 05885f41658ce953d22066913414d56aaad36157 Author: Christian Brauner Date: Sun Nov 23 17:33:25 2025 +0100 namespace: convert fsmount() to FD_PREPARE() Christian Brauner says: A variant of the fix sent in [1] was squashed into this commit. Link: https://lore.kernel.org/20251128035149.392402-1-kartikey406@gmail.com [1] Reported-by: Deepanshu Kartikey Reported-by: syzbot+94048264da5715c251f9@syzkaller.appspotmail.com Tested-by: syzbot+94048264da5715c251f9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=94048264da5715c251f9 Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-7-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 416b0d16590b1b79d18990e62f5a95f96ec554b7 Author: Christian Brauner Date: Sun Nov 23 17:33:24 2025 +0100 namespace: convert open_tree_attr() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-6-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 542a40654342ecefe75e2786c086ac5950d96fa3 Author: Christian Brauner Date: Sun Nov 23 17:33:23 2025 +0100 namespace: convert open_tree() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-5-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit fbe58faa6934812851b50996ce0e9db0eafdd91c Author: Christian Brauner Date: Sun Nov 23 17:33:22 2025 +0100 fhandle: convert do_handle_open() to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-4-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit a5fa9ab846b4ebd68302aca32497616c078f34bf Author: Christian Brauner Date: Sun Nov 23 17:33:21 2025 +0100 eventfd: convert do_eventfd() to FD_PREPARE() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-3-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 8797dd560018818464a6a16920ee732bd7e9ab18 Author: Christian Brauner Date: Sun Nov 23 17:33:20 2025 +0100 anon_inodes: convert to FD_ADD() Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-2-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit 011703a9acd76edc7c85d80dbccb6e50dba53aad Author: Christian Brauner Date: Sun Nov 23 17:33:19 2025 +0100 file: add FD_{ADD,PREPARE}() I've been playing with this to allow for moderately flexible usage of the get_unused_fd_flags() + create file + fd_install() pattern that's used quite extensively. How callers allocate files is really heterogenous so it's not really convenient to fold them into a single class. It's possibe to split them into subclasses like for anon inodes. I think that's not necessarily nice as well. My take is to add two primites: (1) FD_ADD() the simple cases a file is installed: fd = FD_ADD(O_CLOEXEC, open_file(some, args))); if (fd >= 0) kvm_get_kvm(vcpu->kvm); return fd; (2) FD_PREPARE() that captures all the cases where access to fd or file or additional work before publishing the fd is needed: FD_PREPARE(fdf, open_flag, file_open_handle(&path, open_flag)); if (fdf.err) return fdf.err; if (copy_to_user(/* something something */)) return -EFAULT; return fd_publish(fdf); I've converted all of the easy cases over to it and it gets rid of an aweful lot of convoluted cleanup logic. It's centered around struct fd_prepare. FD_PREPARE() encapsulates all of allocation and cleanup logic and must be followed by a call to fd_publish() which associates the fd with the file and installs it into the callers fdtable. If fd_publish() isn't called both are deallocated. It mandates a specific order namely that first we allocate the fd and then instantiate the file. But that shouldn't be a problem nearly everyone I've converted uses this exact pattern anyway. There's a bunch of additional cases where it would be easy to convert them to this pattern. For example, the whole sync file stuff in dma currently retains the containing structure of the file instead of the file itself even though it's only used to allocate files. Changing that would make it fall into the FD_PREPARE() pattern easily. I've not done that work yet. There's room for extending this in a way that wed'd have subclasses for some particularly often use patterns but as I said I'm not even sure that's worth it. Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-1-b6efa1706cfd@kernel.org Signed-off-by: Christian Brauner commit f720239ca39d72657e1bbf9c4c6270c78f548e43 Author: Marco Crivellari Date: Thu Nov 27 15:41:25 2025 +0100 platform: surface: replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251127144125.233728-4-marco.crivellari@suse.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit db4399501c58ad1225105224e7c9f03bc3d4fe39 Author: Marco Crivellari Date: Thu Nov 27 15:41:24 2025 +0100 platform: x86: replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> system_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251127144125.233728-3-marco.crivellari@suse.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f03dd5dd736d6aea94406a273be2a10f84bc60e1 Author: Marco Crivellari Date: Thu Nov 27 15:41:23 2025 +0100 platform/surface: acpi-notify: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below. In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251127144125.233728-2-marco.crivellari@suse.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2579e21be532457742d4100bbda1c2a5b81cbdef Author: Chen Ni Date: Tue Nov 18 10:48:00 2025 +0800 ovl: remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Fixed: 7ab96df840e60 ("VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating()") Signed-off-by: Amir Goldstein Signed-off-by: Christian Brauner commit 55715d7ad5e772d621c3201da3895f250591bce8 Author: Derek J. Clark Date: Thu Nov 27 07:16:05 2025 -0800 platform/x86: wmi-gamezone: Add Legion Go 2 Quirks Add Legion Go 2 SKU's to the Extreme Mode quirks table. Signed-off-by: Derek J. Clark Reviewed-by: Armin Wolf Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20251127151605.1018026-4-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8d0aef2b3a17e5ed3afc8c9a2e71f22ac41a799f Author: Derek J. Clark Date: Thu Nov 27 07:16:04 2025 -0800 platform/x86: lenovo-wmi-gamezone Use max-power rather than balanced-performance When developing the gamezone WMI drivers, "extreme mode" was matched to the performance platform profile and "performance" was matched to the balanced-performance platform profile, but only if extreme mode was fully supported; otherwise performance was matched to the "performance" platform profile. This has led to quite a bit of confusion with users not understanding why the LED color indicating the platform profile doesn't match their expectations. To solve this, replace the confusing convention by using the new max-power profile to represent "extreme mode". While add it, update the documentation to reflect the expected LED colors in each operating mode. Signed-off-by: Derek J. Clark Reviewed-by: Armin Wolf Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20251127151605.1018026-3-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5aefbf5b68794870ccec126cd68bbfd1ee09283a Author: Derek J. Clark Date: Thu Nov 27 07:16:03 2025 -0800 acpi: platform_profile - Add max-power profile option Some devices, namely Lenovo Legion devices, have an "extreme" mode where power draw is at the maximum limit of the cooling hardware. Add a new "max-power" platform profile to properly reflect this operating mode. Reviewed-by: Mario Limonciello (AMD) Acked-by: Rafael J. Wysocki (Intel) Signed-off-by: Derek J. Clark Reviewed-by: Armin Wolf Reviewed-by: Mark Pearson Link: https://patch.msgid.link/20251127151605.1018026-2-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 4be9e04ebf75a5c4478c1c6295e2122e5dc98f5f Author: Jeff Layton Date: Fri Nov 28 10:55:09 2025 +0100 vfs: add needed headers for new struct delegation definition The definition of struct delegation uses stdint.h integer types. Add the necessary headers to ensure that always works. Fixes: 1602bad16d7d ("vfs: expose delegation support to userland") Signed-off-by: Jeff Layton Signed-off-by: Christian Brauner commit ca0d620b0afae20a7bcd5182606eba6860b2dbf2 Author: Mateusz Guzik Date: Thu Nov 27 14:15:26 2025 +0100 dcache: touch up predicts in __d_lookup_rcu() Rationale is that if the parent dentry is the same and the length is the same, then you have to be unlucky for the name to not match. At the same time the dentry was literally just found on the hash, so you have to be even more unlucky to determine it is unhashed. While here add commentary while d_unhashed() is necessary. It was already removed once and brought back in: 2e321806b681b192 ("Revert "vfs: remove unnecessary d_unhashed() check from __d_lookup_rcu"") Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251127131526.4137768-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 01c9c30aae317adc3ae7246f545b2c83b16ff314 Author: Randy Dunlap Date: Thu Nov 27 16:08:26 2025 -0800 filelock: __fcntl_getlease: fix kernel-doc warnings Use the correct function name and add description for the @flavor parameter to avoid these kernel-doc warnings: Warning: fs/locks.c:1706 function parameter 'flavor' not described in '__fcntl_getlease' WARNING: fs/locks.c:1706 expecting prototype for fcntl_getlease(). Prototype was for __fcntl_getlease() instead Fixes: 1602bad16d7d ("vfs: expose delegation support to userland") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251128000826.457120-1-rdunlap@infradead.org Signed-off-by: Christian Brauner commit 2bd1337a1295e012e60008ee21a64375e5234e12 Author: Andrew Donnellan Date: Wed Nov 26 16:33:12 2025 +1100 KVM: s390: Use generic VIRT_XFER_TO_GUEST_WORK functions Switch to using the generic infrastructure to check for and handle pending work before transitioning into guest mode. xfer_to_guest_mode_handle_work() does a few more things than the current code does when deciding whether or not to exit the __vcpu_run() loop. The exittime tests from kvm-unit-tests, in my tests, were within a few percent compared to before this series, which is within noise tolerance. Co-developed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Andrew Donnellan Acked-by: Janosch Frank [frankja@linux.ibm.com: Removed semicolon] Signed-off-by: Janosch Frank commit eec7e23d848d2194dd8791fcd0f4a54d4378eecd Author: Akash Goel Date: Thu Nov 27 16:49:12 2025 +0000 drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is accessed in that ioctl function after storing it in the Xarray. A malicious userspace can second guess the handle of a group and try to call GROUP_DESTROY ioctl from another thread around the same time as GROUP_CREATE ioctl. To prevent the use after free exploit, this commit uses a mark on an entry of group pool Xarray which is added just before returning from the GROUP_CREATE ioctl function. The mark is checked for all ioctls that specify the group handle and so userspace won't be abe to delete a group that isn't marked yet. v2: Add R-bs and fixes tags Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block") Co-developed-by: Boris Brezillon Signed-off-by: Boris Brezillon Signed-off-by: Akash Goel Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Link: https://patch.msgid.link/20251127164912.3788155-1-akash.goel@arm.com commit eeec741ee0df36e79a847bb5423f9eef4ed96071 Author: Neil Brown Date: Thu Nov 27 11:48:56 2025 +0100 nfsd: fix end_creating() conversion Avoid a double-unlock as nfs_create_locked() will have unlocked the parent and do the dput() manually. Christian Brauner says: I've taken Neil's proposed fix from [1] and added a commit message. Fixes: https://lore.kernel.org/202511252132.2c621407-lkp@intel.com [1] Fixes: bd6ede8a06e8 ("VFS/nfsd/cachefiles/ovl: introduce start_removing() and end_removing()") Signed-off-by: Neil Brown Signed-off-by: Christian Brauner commit 54a2df5afa2382d6fd1168a3caf151f50c68dfea Author: Bartosz Golaszewski Date: Fri Nov 28 09:40:11 2025 +0100 gpio: shared: fix a deadlock It's possible that the auxiliary proxy device we add when setting up the GPIO controller exposing shared pins, will get matched and probed immediately. The gpio-proxy-driver will then retrieve the shared descriptor structure. That will cause a recursive mutex locking and a deadlock because we're already holding the gpio_shared_lock in gpio_device_setup_shared() and try to take it again in devm_gpiod_shared_get() like this: [ 4.298346] gpiolib_shared: GPIO 130 owned by f100000.pinctrl is shared by multiple consumers [ 4.307157] gpiolib_shared: Setting up a shared GPIO entry for speaker@0,3 [ 4.314604] [ 4.316146] ============================================ [ 4.321600] WARNING: possible recursive locking detected [ 4.327054] 6.18.0-rc7-next-20251125-g3f300d0674f6-dirty #3887 Not tainted [ 4.334115] -------------------------------------------- [ 4.339566] kworker/u32:3/71 is trying to acquire lock: [ 4.344931] ffffda019ba71850 (gpio_shared_lock){+.+.}-{4:4}, at: devm_gpiod_shared_get+0x34/0x2e0 [ 4.354057] [ 4.354057] but task is already holding lock: [ 4.360041] ffffda019ba71850 (gpio_shared_lock){+.+.}-{4:4}, at: gpio_device_setup_shared+0x30/0x268 [ 4.369421] [ 4.369421] other info that might help us debug this: [ 4.376126] Possible unsafe locking scenario: [ 4.376126] [ 4.382198] CPU0 [ 4.384711] ---- [ 4.387223] lock(gpio_shared_lock); [ 4.390992] lock(gpio_shared_lock); [ 4.394761] [ 4.394761] *** DEADLOCK *** [ 4.394761] [ 4.400832] May be due to missing lock nesting notation [ 4.400832] [ 4.407802] 5 locks held by kworker/u32:3/71: [ 4.412279] #0: ffff000080020948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x194/0x64c [ 4.422650] #1: ffff800080963d60 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x1bc/0x64c [ 4.432117] #2: ffff00008165c8f8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x3c/0x198 [ 4.440700] #3: ffffda019ba71850 (gpio_shared_lock){+.+.}-{4:4}, at: gpio_device_setup_shared+0x30/0x268 [ 4.450523] #4: ffff0000810fe918 (&dev->mutex){....}-{4:4}, at: __device_attach+0x3c/0x198 [ 4.459103] [ 4.459103] stack backtrace: [ 4.463581] CPU: 6 UID: 0 PID: 71 Comm: kworker/u32:3 Not tainted 6.18.0-rc7-next-20251125-g3f300d0674f6-dirty #3887 PREEMPT [ 4.463589] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) [ 4.463593] Workqueue: events_unbound deferred_probe_work_func [ 4.463602] Call trace: [ 4.463604] show_stack+0x18/0x24 (C) [ 4.463617] dump_stack_lvl+0x70/0x98 [ 4.463627] dump_stack+0x18/0x24 [ 4.463636] print_deadlock_bug+0x224/0x238 [ 4.463643] __lock_acquire+0xe4c/0x15f0 [ 4.463648] lock_acquire+0x1cc/0x344 [ 4.463653] __mutex_lock+0xb8/0x840 [ 4.463661] mutex_lock_nested+0x24/0x30 [ 4.463667] devm_gpiod_shared_get+0x34/0x2e0 [ 4.463674] gpio_shared_proxy_probe+0x18/0x138 [ 4.463682] auxiliary_bus_probe+0x40/0x78 [ 4.463688] really_probe+0xbc/0x2c0 [ 4.463694] __driver_probe_device+0x78/0x120 [ 4.463701] driver_probe_device+0x3c/0x160 [ 4.463708] __device_attach_driver+0xb8/0x140 [ 4.463716] bus_for_each_drv+0x88/0xe8 [ 4.463723] __device_attach+0xa0/0x198 [ 4.463729] device_initial_probe+0x14/0x20 [ 4.463737] bus_probe_device+0xb4/0xc0 [ 4.463743] device_add+0x578/0x76c [ 4.463747] __auxiliary_device_add+0x40/0xac [ 4.463752] gpio_device_setup_shared+0x1f8/0x268 [ 4.463758] gpiochip_add_data_with_key+0xdac/0x10ac [ 4.463763] devm_gpiochip_add_data_with_key+0x30/0x80 [ 4.463768] msm_pinctrl_probe+0x4b0/0x5e0 [ 4.463779] sm8250_pinctrl_probe+0x18/0x40 [ 4.463784] platform_probe+0x5c/0xa4 [ 4.463793] really_probe+0xbc/0x2c0 [ 4.463800] __driver_probe_device+0x78/0x120 [ 4.463807] driver_probe_device+0x3c/0x160 [ 4.463814] __device_attach_driver+0xb8/0x140 [ 4.463821] bus_for_each_drv+0x88/0xe8 [ 4.463827] __device_attach+0xa0/0x198 [ 4.463834] device_initial_probe+0x14/0x20 [ 4.463841] bus_probe_device+0xb4/0xc0 [ 4.463847] deferred_probe_work_func+0x90/0xcc [ 4.463854] process_one_work+0x214/0x64c [ 4.463860] worker_thread+0x1bc/0x360 [ 4.463866] kthread+0x14c/0x220 [ 4.463871] ret_from_fork+0x10/0x20 [ 77.265041] random: crng init done Fortunately, at the time of creating of the auxiliary device, we already know the correct entry so let's store it as the device's platform data. We don't need to hold gpio_shared_lock in devm_gpiod_shared_get() as we're not removing the entry or traversing the list anymore but we still need to protect it from concurrent modification of its fields so add a more fine-grained mutex. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Dmitry Baryshkov Closes: https://lore.kernel.org/all/fimuvblfy2cmn7o4wzcxjzrux5mwhvlvyxfsgeqs6ore2xg75i@ax46d3sfmdux/ Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251128-gpio-shared-deadlock-v2-1-9f3ae8ddcb09@linaro.org Signed-off-by: Bartosz Golaszewski commit 64309e40e357bead3a872db89512df6c071addc5 Author: Bartosz Golaszewski Date: Wed Nov 26 20:17:30 2025 +0100 gpio: shared-proxy: set suppress_bind_attrs User-space must not fiddle with shared-proxy auxiliary devices. Disable bind/unbind attributes in sysfs. Link: https://lore.kernel.org/r/20251126191730.66277-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 114e594e6cb791ce7c839ccfbe153ecfa3e7abce Author: Bartosz Golaszewski Date: Wed Nov 26 17:49:06 2025 +0100 gpio: shared: ignore GPIO hogs when traversing the device tree GPIO hogs have a "gpios" property but it's not a phandle to a remote node - it references the parent GPIO controller. We must not try to parse it as a phandle. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Cosmin Tanislav Closes: https://lore.kernel.org/all/2d96e464-e17c-4ff5-9a08-b215b77da04f@gmail.com/ Link: https://lore.kernel.org/r/20251126-gpio-shared-fixes-v1-2-18309c0e87b5@linaro.org Signed-off-by: Bartosz Golaszewski commit cfab6dc0700c3b9120dab726fc184c3b4500cc5b Author: Bartosz Golaszewski Date: Wed Nov 26 17:49:05 2025 +0100 gpio: shared: ignore special __symbols__ node when traversing device tree The __symbols__ node is a special, internal node and its properties must not be considered when scanning the device-tree for shared GPIOs. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Jon Hunter Closes: https://lore.kernel.org/all/0829a21c-f97d-41b6-90bc-2acaec42caab@nvidia.com/ Tested-by: Jon Hunter Acked-by: Jon Hunter Link: https://lore.kernel.org/r/20251126-gpio-shared-fixes-v1-1-18309c0e87b5@linaro.org Signed-off-by: Bartosz Golaszewski commit a3623e1ae1ed6be4d49b2ccb9996a9d2b65c1828 Author: Haotian Zhang Date: Mon Nov 24 00:35:51 2025 +0800 mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors devm_pm_runtime_enable() can fail due to memory allocation failures. The current code ignores its return value and proceeds with pm_runtime_resume_and_get(), which may operate on incorrectly initialized runtime PM state. Check the return value of devm_pm_runtime_enable() and return the error code if it fails. Fixes: 6a2277a0ebe7 ("mtd: rawnand: renesas: Use runtime PM instead of the raw clock API") Signed-off-by: Haotian Zhang Reviewed-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit 0d081b16946ef449fcb35b6edc1ef6f9fea6f0a0 Merge: ac3fd01e4c1efc 5583a55e074b33 fe6262910cd3fe 5a70826910c371 fbcf539840350f 6b38a108eeb393 2381a1b40be4b2 1eb0ae6fbd5446 Author: Joerg Roedel Date: Fri Nov 28 08:44:21 2025 +0100 Merge branches 'arm/smmu/updates', 'arm/smmu/bindings', 'mediatek', 'nvidia/tegra', 'intel/vt-d', 'amd/amd-vi' and 'core' into next commit 1eb0ae6fbd544619c50b4a4d96ccb4676cac03cb Author: Jason Gunthorpe Date: Thu Nov 27 19:54:08 2025 -0400 iommupt/vtd: Support mgaw's less than a 4 level walk for first stage If the IOVA is limited to less than 48 the page table will be constructed with a 3 level configuration which is unsupported by hardware. Like the second stage the caller needs to pass in both the top_level an the vasz to specify a table that has more levels than required to hold the IOVA range. Fixes: 6cbc09b7719e ("iommu/vt-d: Restore previous domain::aperture_end calculation") Reported-by: Calvin Owens Closes: https://lore.kernel.org/r/8f257d2651eb8a4358fcbd47b0145002e5f1d638.1764237717.git.calvin@wbinvd.org Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Tested-by: Calvin Owens Signed-off-by: Joerg Roedel commit d856f9d27885c499d96ab7fe506083346ccf145d Author: Jason Gunthorpe Date: Thu Nov 27 19:54:07 2025 -0400 iommupt/vtd: Allow VT-d to have a larger table top than the vasz requires VT-d second stage HW specifies both the maximum IOVA and the supported table walk starting points. Weirdly there is HW that only supports a 4 level walk but has a maximum IOVA that only needs 3. The current code miscalculates this and creates a wrongly sized page table which ultimately fails the compatibility check for number of levels. This is fixed by allowing the page table to be created with both a vasz and top_level input. The vasz will set the aperture for the domain while the top_level will set the page table geometry. Add top_level to vtdss and correct the logic in VT-d to generate the right top_level and vasz from mgaw and sagaw. Fixes: d373449d8e97 ("iommu/vt-d: Use the generic iommu page table") Reported-by: Calvin Owens Closes: https://lore.kernel.org/r/8f257d2651eb8a4358fcbd47b0145002e5f1d638.1764237717.git.calvin@wbinvd.org Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Tested-by: Calvin Owens Signed-off-by: Joerg Roedel commit 416d9a220e678d6b1c5fc206226cfb7fa7efa80e Author: Jason Gunthorpe Date: Thu Nov 20 11:06:46 2025 -0400 powerpc/pseries/svm: Make mem_encrypt.h self contained Add the missing forward declarations and includes so it does not have implicit dependencies. mem_encrypt.h is a public header imported by drivers. Users should not have to guess what include files are needed. Resolves a kbuild splat: In file included from drivers/iommu/generic_pt/fmt/iommu_amdv1.c:15: In file included from drivers/iommu/generic_pt/fmt/iommu_template.h:36: In file included from drivers/iommu/generic_pt/fmt/amdv1.h:23: In file included from include/linux/mem_encrypt.h:17: >> arch/powerpc/include/asm/mem_encrypt.h:13:49: warning: declaration of 'struct device' will not be visible outside of this function [-Wvisibility] 13 | static inline bool force_dma_unencrypted(struct device *dev) Fixes: 879ced2bab1b ("iommupt: Add the AMD IOMMU v1 page table format") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511161358.rS5pSb3U-lkp@intel.com/ Signed-off-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Reviewed-by: Christophe Leroy Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit 01569c216ddeda94d3d8ffb8a5241ba3b2d72a5a Author: Geert Uytterhoeven Date: Wed Nov 12 15:08:05 2025 +0100 genpt: Make GENERIC_PT invisible There is no point in asking the user about the Generic Radix Page Table API: - All IOMMU drivers that use this API already select GENERIC_PT when needed, - Most users probably do not know what to answer anyway. Fixes: 7c5b184db7145fd4 ("genpt: Generic Page Table base API") Signed-off-by: Geert Uytterhoeven Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 0f90fa6e2e9d98349492d9968c11ceaf2f958c98 Author: Bibo Mao Date: Fri Nov 28 14:49:48 2025 +0800 KVM: LoongArch: selftests: Add time counter test case With time counter test, it is to verify that time count starts from 0 and always grows up then. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 4e8824094069b04e3b3583d855c975ccb6a9bec5 Author: Bibo Mao Date: Fri Nov 28 14:49:47 2025 +0800 KVM: LoongArch: selftests: Add SW emulated timer test case This test case setup one-shot timer and execute idle instruction immediately to indicate giving up CPU, hypervisor will emulate SW hrtimer and wakeup vCPU when SW hrtimer is fired. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit df41742343fad11fde06e085096003d64599785f Author: Bibo Mao Date: Fri Nov 28 14:49:44 2025 +0800 KVM: LoongArch: selftests: Add timer interrupt test case Add timer test case based on common arch_timer code, timer interrupt with one-shot and period mode is tested. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 6ce0dd9f54ea9773c0aedfaab7b858fc68a848ba Author: Niklas Cassel Date: Mon Nov 24 17:34:34 2025 +0100 ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC According to a user report, the Silicon Motion MD619HXCLDE3TC SSD and the Silicon Motion MD619GXCLDE3TC SSD have problems with LPM. Reported-by: Yihang Li Closes: https://lore.kernel.org/linux-ide/20251121073502.3388239-1-liyihang9@h-partners.com/ Signed-off-by: Niklas Cassel commit ed01d2069e8b40eb283050b7119c25a67542a585 Merge: 61dbc61a34c912 72405298e92b59 Author: Jakub Kicinski Date: Thu Nov 27 18:59:34 2025 -0800 Merge branch 'bnxt_en-updates-for-net-next' Michael Chan says: ==================== bnxt_en: Updates for net-next (part) This series includes an enhnacement to the priority TX counters, an enhancement to a PHY module error extack message, cleanup of unneeded MSIX logic in bnxt_ulp.c, adding CQ dump during TX timeout, LRO/HW_GRO performance improvement by enabling Relaxed Ordering, and improved SRIOV admin link state support. ==================== Link: https://patch.msgid.link/20251126215648.1885936-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 72405298e92b590160ea21558b8105d18c107f3c Author: Rob Miller Date: Wed Nov 26 13:56:47 2025 -0800 bnxt_en: Add Virtual Admin Link State Support for VFs The firmware can now cache the virtual link admin state (auto/on/off) of all VFs and as such, the PF driver no longer has to intercept the VF driver's port_phy_qcfg() call and then provide the link admin state. If the FW does not have this capability, fall back to the existing interception method. The initial default link admin state (auto) is also set initially when the VFs are created. Reviewed-by: Pavan Chebbi Reviewed-by: Kalesh AP Reviewed-by: Mohammad Shuab Siddique Signed-off-by: Rob Miller Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251126215648.1885936-7-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 30f253f8d9a01d532fdb7ec6c8a9d4c15fe29241 Author: Michael Chan Date: Wed Nov 26 13:56:46 2025 -0800 bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips With End-of-Packet padding (EOP) set, the chip will disable Relaxed Ordering (RO) of TPA data packets. A TPA segment with EOP set will be padded to the next cache boundary and can potentially overwrite the beginning bytes of the next TPA segment when RO is enabled on 5760X. To prevent that, the chip disables RO for TPA when EOP is set. To take advantge of RO and higher performance, do not set EOP on 5760X chips when TPA is enabled. Define a proper RX_BD_FLAGS_AGG_EOP constant to make it clear that we are setting EOP. Reviewed-by: Andy Gospodarek Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251126215648.1885936-6-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit b1e7f9566f322b53e81f7bfb6b4361e52e44b287 Author: Michael Chan Date: Wed Nov 26 13:56:45 2025 -0800 bnxt_en: Add CQ ring dump to bnxt_dump_cp_sw_state() On newer chips that use NQs and CQs, add the CQ ring dump to bnxt_dump_cp_sw_state() to make it more complete. Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251126215648.1885936-5-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit bba2a0577e3c20a5393f9906fe066d500657f1c6 Author: Kalesh AP Date: Wed Nov 26 13:56:44 2025 -0800 bnxt_en: Remove the redundant BNXT_EN_FLAG_MSIX_REQUESTED flag MSIX is always requested when the RoCE driver calls bnxt_register_dev(). We already check bnxt_ulp_registered(), so checking the flag is redundant. It was a left-over flag after converting to auxbus, so remove it. Reviewed-by: Pavan Chebbi Reviewed-by: Somnath Kotur Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251126215648.1885936-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit f3d88fe6354fcbc38d872029564e2b71f533ca9e Author: Gautam R A Date: Wed Nov 26 13:56:43 2025 -0800 bnxt_en: Enhance log message in bnxt_get_module_status() Rturn early with -EOPNOTSUPP and an extack message if the PHY type is BaseT since module status is not available for BaseT. Reviewed-by: Somnath Kotur Signed-off-by: Gautam R A Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251126215648.1885936-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit caa343e9a4a171db045c8e734d68cb10ad0dd65c Author: Michael Chan Date: Wed Nov 26 13:56:42 2025 -0800 bnxt_en: Enhance TX pri counters The priority packet and byte counters in ethtool -S are returned by the driver based on the pri2cos mapping. The assumption is that each priority is mapped to one and only one hardware CoS queue. In a special RoCE configuration, the FW uses combined CoS queue 0 and CoS queue 1 for the priority mapped to CoS queue 0. In this special case, we need to add the CoS queue 0 and CoS queue 1 counters for the priority packet and byte counters. Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Link: https://patch.msgid.link/20251126215648.1885936-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 61dbc61a34c912e4a5559cfc3bb966d9a32caf33 Merge: 4636b4e797f71a 57bb13d7eb5051 Author: Jakub Kicinski Date: Thu Nov 27 18:34:21 2025 -0800 Merge branch 'intel-wired-lan-driver-updates-2025-11-25-ice-idpf-iavf-ixgbe-ixgbevf-e1000e' Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-11-25 (ice, idpf, iavf, ixgbe, ixgbevf, e1000e) Natalia cleans up ixgbevf_q_vector struct removing an unused field. Emil converts vport state tracking from enum to bitmap and removes unneeded states for idpf. Tony removes an unneeded check from e1000e. Alok Tiwari removes an unnecessary second call to ixgbe_non_sfp_link_config() and adjusts the checked member, in idpf, to reflect the member that is later used. He also fixes various typos and messages for better clarity misc Intel drivers. ==================== Link: https://patch.msgid.link/20251125223632.1857532-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 57bb13d7eb5051563d1e29f930a72079d95ea28c Author: Alok Tiwari Date: Tue Nov 25 14:36:30 2025 -0800 iavf: clarify VLAN add/delete log messages and lower log level The current dev_warn messages for too many VLAN changes are confusing and one place incorrectly references "add" instead of "delete" VLANs due to copy-paste errors. - Use dev_info instead of dev_warn to lower the log level. - Rephrase the message to: "virtchnl: Too many VLAN [add|delete] ([v1|v2]) requests; splitting into multiple messages to PF\n". Suggested-by: Przemek Kitszel Signed-off-by: Alok Tiwari Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-12-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1105a7a12051c24e942b382b6e4d895d267dda1e Author: Alok Tiwari Date: Tue Nov 25 14:36:29 2025 -0800 ice: fix comment typo and correct module format string - Fix a typo in the ice_fdir_has_frag() kernel-doc comment ("is" -> "if") - Correct the NVM erase error message format string from "0x02%x" to "0x%02x" so the module value is printed correctly. Signed-off-by: Alok Tiwari Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-11-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 79bb84758f2c6dda7133c5ac391acd61ae4326fd Author: Alok Tiwari Date: Tue Nov 25 14:36:28 2025 -0800 idpf: correct queue index in Rx allocation error messages The error messages in idpf_rx_desc_alloc_all() used the group index i when reporting memory allocation failures for individual Rx and Rx buffer queues. This is incorrect. Update the messages to use the correct queue index j and include the queue group index i for clearer identification of the affected Rx and Rx buffer queues. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-10-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d89a5c27e4f395a0d93652f01c959ce4b1ed42b7 Author: Alok Tiwari Date: Tue Nov 25 14:36:27 2025 -0800 idpf: use desc_ring when checking completion queue DMA allocation idpf_compl_queue uses a union for comp, comp_4b, and desc_ring. The release path should check complq->desc_ring to determine whether the DMA descriptor ring is allocated. The current check against comp works but is leftover from a previous commit and is misleading in this context. Switching the check to desc_ring improves readability and more directly reflects the intended meaning, since desc_ring is the field representing the allocated DMA-backed descriptor ring. No functional change. Signed-off-by: Alok Tiwari Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-9-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 5849b56addbfc060a012c7326d3bac279c303f43 Author: Alok Tiwari Date: Tue Nov 25 14:36:26 2025 -0800 ixgbe: avoid redundant call to ixgbe_non_sfp_link_config() ixgbe_non_sfp_link_config() is called twice in ixgbe_open() once to assign its return value to err and again in the conditional check. This patch uses the stored err value instead of calling the function a second time. This avoids redundant work and ensures consistent error reporting. Also fix a small typo in the ixgbe_remove() comment: "The could be caused" -> "This could be caused". Signed-off-by: Alok Tiwari Reviewed-by: Jedrzej Jagielski Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-8-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 954ba97cca1614bdc6d5dbd37fa357da9febb59d Author: Tony Nguyen Date: Tue Nov 25 14:36:25 2025 -0800 e1000e: Remove unneeded checks The caller, ethtool_set_eeprom(), already performs the same checks so these are unnecessary in the driver. This reverts commit 90fb7db49c6d ("e1000e: fix heap overflow in e1000_set_eeprom"), however, corrections for RCT have been kept. Link: https://lore.kernel.org/all/db92fcc8-114d-4e85-9d15-7860545bc65e@suse.de/ Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-7-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 8dd72ebc73f37b216410db17340f15e6fb2cdb7b Author: Emil Tantilov Date: Tue Nov 25 14:36:24 2025 -0800 idpf: convert vport state to bitmap Convert vport state to a bitmap and remove the DOWN state which is redundant in the existing logic. There are no functional changes aside from the use of bitwise operations when setting and checking the states. Removed the double underscore to be consistent with the naming of other bitmaps in the header and renamed current_state to vport_is_up to match the meaning of the new variable. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Chittim Madhu Signed-off-by: Emil Tantilov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-6-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1645759a0405aaeaa9fa5d0a4167a3cb626808bb Author: Natalia Wochtman Date: Tue Nov 25 14:36:23 2025 -0800 ixgbevf: ixgbevf_q_vector clean up Flex array should be at the end of the structure and use [] syntax Remove unused fields of ixgbevf_q_vector. They aren't used since busy poll was moved to core code in commit 508aac6dee02 ("ixgbevf: get rid of custom busy polling code"). Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Natalia Wochtman Reviewed-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251125223632.1857532-5-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4636b4e797f71ad68332e174d8b50a65e7d5cf8a Author: Heiko Carstens Date: Wed Nov 26 15:22:42 2025 +0100 dibs: Remove KMSG_COMPONENT macro The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" from 2008 [1] which never made it upstream. The macro was added to s390 code to allow for an out-of-tree patch which used this to generate unique message ids. Also this out-of-tree doesn't exist anymore. The pattern of how the KMSG_COMPONENT is used was partially also used for non s390 specific code, for whatever reasons. Remove the macro in order to get rid of a pointless indirection. [1] https://lwn.net/Articles/292650/ Signed-off-by: Heiko Carstens Acked-by: Alexandra Winter Link: https://patch.msgid.link/20251126142242.2124317-1-hca@linux.ibm.com Signed-off-by: Jakub Kicinski commit 73880e66b79a6c950c0388559e2d425da2c37bd6 Author: Breno Leitao Date: Wed Nov 26 02:54:40 2025 -0800 net: thunder: convert to use .get_rx_ring_count Convert the Cavium Thunder NIC VF driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc solely for handling ETHTOOL_GRXRINGS command. This simplifies the code by removing the switch statement and replacing it with a direct return of the queue count. The new callback provides the same functionality in a more direct way, following the ongoing ethtool API modernization. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251126-gxring_cavium-v1-1-a066c0c9e0c6@debian.org Signed-off-by: Jakub Kicinski commit 8048168df56e225c94e50b04cb7b0514135d7a1c Author: Alexey Kodanev Date: Wed Nov 26 10:43:27 2025 +0000 net: stmmac: fix rx limit check in stmmac_rx_zc() The extra "count >= limit" check in stmmac_rx_zc() is redundant and has no effect because the value of "count" doesn't change after the while condition at this point. However, it can change after "read_again:" label: while (count < limit) { ... if (count >= limit) break; read_again: ... /* XSK pool expects RX frame 1:1 mapped to XSK buffer */ if (likely(status & rx_not_ls)) { xsk_buff_free(buf->xdp); buf->xdp = NULL; dirty++; count++; goto read_again; } ... This patch addresses the same issue previously resolved in stmmac_rx() by commit fa02de9e7588 ("net: stmmac: fix rx budget limit check"). The fix is the same: move the check after the label to ensure that it bounds the goto loop. Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") Signed-off-by: Alexey Kodanev Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251126104327.175590-1-aleksei.kodanev@bell-sw.com Signed-off-by: Jakub Kicinski commit ebb2eaeb05d0ee6bd46e98313f72eac2b0dbd9d7 Merge: 17e9f841dd227a fbce7b36c8c64b Author: Jakub Kicinski Date: Thu Nov 27 17:55:58 2025 -0800 Merge branch 'net-dsa-yt921x-fix-parsing-mib-attributes' David Yang says: ==================== net: dsa: yt921x: Fix parsing MIB attributes ==================== Link: https://patch.msgid.link/20251126084024.2843851-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit fbce7b36c8c64b2bab68f2ec878b5aa48b6f0d75 Author: David Yang Date: Wed Nov 26 16:40:20 2025 +0800 net: dsa: yt921x: Use macros for MIB locations Extract MIB constants into the header file to improve code style. This patch will not change the behavior of the function. Signed-off-by: David Yang Link: https://patch.msgid.link/20251126084024.2843851-3-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 510026a39849ae7066dce17343caba4550e2a977 Author: David Yang Date: Wed Nov 26 16:40:19 2025 +0800 net: dsa: yt921x: Fix parsing MIB attributes There are hard-to-find unused fields in the MIB table I didn't notice in the example driver code, causing wrong interpretation of the MIB data. For some 64-bit attributes, the current (wrong) implementation took the correct lower 32 bits, but messed up the upper 32 bits, so it would work accidentally until 32-bit overflows happen. Fix that too. Fixes: 186623f4aa72 ("net: dsa: yt921x: Add support for Motorcomm YT921x") Signed-off-by: David Yang Link: https://patch.msgid.link/20251126084024.2843851-2-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski commit 17e9f841dd227a4dc976b22d000d5f669bc14493 Author: Javen Xu Date: Wed Nov 26 13:59:50 2025 +0800 r8169: add DASH support for RTL8127AP This adds DASH support for chip RTL8127AP. Its mac version is RTL_GIGA_MAC_VER_80. DASH is a standard for remote management of network device, allowing out-of-band control. Signed-off-by: Javen Xu Link: https://patch.msgid.link/20251126055950.2050-1-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski commit 1f73a56f986005f0bc64ed23873930e2ee4f5911 Author: Antoine Tenart Date: Wed Nov 26 11:26:25 2025 +0100 net: vxlan: prevent NULL deref in vxlan_xmit_one Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the following NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:vxlan_xmit_one+0xbb3/0x1580 Call Trace: vxlan_xmit+0x429/0x610 dev_hard_start_xmit+0x55/0xa0 __dev_queue_xmit+0x6d0/0x7f0 ip_finish_output2+0x24b/0x590 ip_output+0x63/0x110 Mentioned commits changed the code path in vxlan_xmit_one and as a side effect the sock4/6 pointer validity checks in vxlan(6)_get_route were lost. Fix this by adding back checks. Since both commits being fixed were released in the same version (v6.7) and are strongly related, bundle the fixes in a single commit. Reported-by: Liang Li Fixes: 6f19b2c136d9 ("vxlan: use generic function for tunnel IPv4 route lookup") Fixes: 2aceb896ee18 ("vxlan: use generic function for tunnel IPv6 route lookup") Cc: Beniamino Galvani Signed-off-by: Antoine Tenart Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Link: https://patch.msgid.link/20251126102627.74223-1-atenart@kernel.org Signed-off-by: Jakub Kicinski commit 1e43ebcd5152b3e681a334cc6542fb21770c3a2e Author: Michal Schmidt Date: Wed Nov 26 10:48:49 2025 +0100 iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference. The fix is similar to commit 329d050bbe63 ("gve: Implement settime64 with -EOPNOTSUPP"). Fixes: d734223b2f0d ("iavf: add initial framework for registering PTP clock") Signed-off-by: Michal Schmidt Reviewed-by: Aleksandr Loktionov Reviewed-by: Tim Hostetler Link: https://patch.msgid.link/20251126094850.2842557-1-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 6557cae0a2a1952645e5df50e1d6eb7267ea2131 Author: Peter Enderborg Date: Wed Nov 26 14:54:06 2025 +0100 if_ether.h: Clarify ethertype validity for gsw1xx dsa This 0x88C3 is registered to Infineon Technologies Corporate Research ST and are used by MaxLinear. Infineon made a spin off called Lantiq. Lantiq was acquired by Intel MaxLinear acquired Intels Connected Home division. The product FAQ from MaxLinear describes it's history from the F24S. The driver for the gsw1xx is based on Lantiq showing it's similarities. Ref https://standards-oui.ieee.org/ethertype/eth.txt Signed-off-by: Peter Enderborg Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski commit eeecf5d3a3a484cedfa3f2f87e6d51a7390ed960 Author: Gustavo A. R. Silva Date: Thu Nov 27 12:12:03 2025 +0900 net: wwan: mhi_wwan_mbim: Avoid -Wflex-array-member-not-at-end warning Use DEFINE_RAW_FLEX() to avoid a -Wflex-array-member-not-at-end warning. Remove fixed-size array struct usb_cdc_ncm_dpe16 dpe16[2]; from struct mbim_tx_hdr, so that flex-array member struct mbim_tx_hdr::ndp16.dpe16[] ends last in this structure. Compensate for this by using the DEFINE_RAW_FLEX() helper to declare the on-stack struct instance that contains struct usb_cdc_ncm_ndp16 as a member. Adjust the rest of the code, accordingly. So, with these changes fix the following warning: drivers/net/wwan/mhi_wwan_mbim.c:81:34: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Reviewed-by: Loic Poulain Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jakub Kicinski commit 858b1d07e49106a302cc7c7fbeee4fb2698573c9 Author: Max Yuan Date: Thu Nov 27 00:07:51 2025 +0000 gve: Fix race condition on tx->dropped_pkt update The tx->dropped_pkt counter is a 64-bit integer that is incremented directly. On 32-bit architectures, this operation is not atomic and can lead to read/write tearing if a reader accesses the counter during the update. This can result in incorrect values being reported for dropped packets. To prevent this potential data corruption, wrap the increment operation with u64_stats_update_begin() and u64_stats_update_end(). This ensures that updates to the 64-bit counter are atomic, even on 32-bit systems, by using a sequence lock. The u64_stats_sync API requires the writer to have exclusive access, which is already provided in this context by the network stack's serialization of the transmit path (net_device_ops::ndo_start_xmit [1]) for a given queue. [1]: https://www.kernel.org/doc/Documentation/networking/netdevices.txt Signed-off-by: Max Yuan Reviewed-by: Jordan Rhee Signed-off-by: Harshitha Ramamurthy Signed-off-by: Jakub Kicinski commit 4c03592689bc19df9deda7a33d56c6ac0cec8651 Author: Jakub Kicinski Date: Wed Nov 26 17:43:11 2025 -0800 net: restore napi_consume_skb()'s NULL-handling Commit e20dfbad8aab ("net: fix napi_consume_skb() with alien skbs") added a skb->cpu check to napi_consume_skb(), before the point where napi_consume_skb() validated skb is not NULL. Add an explicit check to the early exit condition. Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 362a161b2582f8d6a34b3b0940f8323adc2f292f Author: Jakub Kicinski Date: Tue Nov 25 19:48:19 2025 -0800 eth: bnxt: make use of napi_consume_skb() As those following recent changes from Eric know very well using NAPI skb cache is crucial to achieve good perf, at least on recent AMD platforms. Make sure bnxt feeds the skb cache with Tx skbs. Reviewed-by: Michael Chan Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit df59bb5b9af3fc24d957261e9f80f0c0dec151a4 Author: Byungchul Park Date: Wed Nov 26 13:36:46 2025 +0900 netmem, devmem, tcp: access pp fields through @desc in net_iov Convert all the legacy code directly accessing the pp fields in net_iov to access them through @desc in net_iov. Signed-off-by: Byungchul Park Signed-off-by: Jakub Kicinski commit f6ed9c5d3190cf18382ee75e0420602101f53586 Author: Steven Rostedt Date: Wed Nov 26 14:52:49 2025 -0500 overflow: Introduce struct_offset() to get offset of member The trace_marker_raw file in tracefs takes a buffer from user space that contains an id as well as a raw data string which is usually a binary structure. The structure used has the following: struct raw_data_entry { struct trace_entry ent; unsigned int id; char buf[]; }; Since the passed in "cnt" variable is both the size of buf as well as the size of id, the code to allocate the location on the ring buffer had: size = struct_size(entry, buf, cnt - sizeof(entry->id)); Which is quite ugly and hard to understand. Instead, add a helper macro called struct_offset() which then changes the above to a simple and easy to understand: size = struct_offset(entry, id) + cnt; This will likely come in handy for other use cases too. Link: https://lore.kernel.org/all/CAHk-=whYZVoEdfO1PmtbirPdBMTV9Nxt9f09CK0k6S+HJD3Zmg@mail.gmail.com/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: "Gustavo A. R. Silva" Link: https://patch.msgid.link/20251126145249.05b1770a@gandalf.local.home Suggested-by: Linus Torvalds Reviewed-by: Kees Cook Signed-off-by: Steven Rostedt (Google) commit d3a439e55c193b930e0007967cf8d7a29890449b Author: Randy Dunlap Date: Sat Nov 1 12:20:38 2025 -0700 netfilter: nf_tables: improve UAPI kernel-doc comments In include/uapi/linux/netfilter/nf_tables.h, correct the kernel-doc comments for mistyped enum names and enum values to avoid these kernel-doc warnings and improve the documentation: nf_tables.h:896: warning: Enum value 'NFT_EXTHDR_OP_TCPOPT' not described in enum 'nft_exthdr_op' nf_tables.h:896: warning: Excess enum value 'NFT_EXTHDR_OP_TCP' description in 'nft_exthdr_op' nf_tables.h:1210: warning: expecting prototype for enum nft_flow_attributes. Prototype was for enum nft_offload_attributes instead nf_tables.h:1428: warning: expecting prototype for enum nft_reject_code. Prototype was for enum nft_reject_inet_code instead (add beginning '@' to each enum value description:) nf_tables.h:1493: warning: Enum value 'NFTA_TPROXY_FAMILY' not described in enum 'nft_tproxy_attributes' nf_tables.h:1493: warning: Enum value 'NFTA_TPROXY_REG_ADDR' not described in enum 'nft_tproxy_attributes' nf_tables.h:1493: warning: Enum value 'NFTA_TPROXY_REG_PORT' not described in enum 'nft_tproxy_attributes' nf_tables.h:1796: warning: expecting prototype for enum nft_device_attributes. Prototype was for enum nft_devices_attributes instead Signed-off-by: Randy Dunlap Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c4f0ab06e1e0c1331e6febd03538a7f621f15134 Author: Randy Dunlap Date: Sat Nov 1 12:20:50 2025 -0700 netfilter: ip6t_srh: fix UAPI kernel-doc comments format Fix the kernel-doc format for struct members to be "@member" instead of "@ member" to avoid kernel-doc warnings. Warning: ip6t_srh.h:60 struct member 'next_hdr' not described in 'ip6t_srh' Warning: ip6t_srh.h:60 struct member 'hdr_len' not described in 'ip6t_srh' Warning: ip6t_srh.h:60 struct member 'segs_left' not described in 'ip6t_srh' Warning: ip6t_srh.h:60 struct member 'last_entry' not described in 'ip6t_srh' Warning: ip6t_srh.h:60 struct member 'tag' not described in 'ip6t_srh' Warning: ip6t_srh.h:60 struct member 'mt_flags' not described in 'ip6t_srh' Warning: ip6t_srh.h:60 struct member 'mt_invflags' not described in 'ip6t_srh' Warning: ip6t_srh.h:93 struct member 'next_hdr' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'hdr_len' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'segs_left' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'last_entry' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'tag' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'psid_addr' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'nsid_addr' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'lsid_addr' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'psid_msk' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'nsid_msk' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'lsid_msk' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'mt_flags' not described in 'ip6t_srh1' Warning: ip6t_srh.h:93 struct member 'mt_invflags' not described in 'ip6t_srh1' Signed-off-by: Randy Dunlap Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit c0bd21682aedeb5d1367ee8026f71dc32624091a Author: Lorenzo Bianconi Date: Thu Nov 27 23:21:43 2025 +0100 selftests: netfilter: nft_flowtable.sh: Add the capability to send IPv6 TCP traffic Introduce the capability to send TCP traffic over IPv6 to nft_flowtable netfilter selftest. Reviewed-by: Simon Horman Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso commit c4cbe4a4df39a2cf80593f87d129cd4b04ea568d Author: Fernando Fernandez Mancera Date: Mon Nov 24 17:36:58 2025 +0100 netfilter: nft_connlimit: add support to object update operation This is useful to update the limit or flags without clearing the connections tracked. Use READ_ONCE() on packetpath as it can be modified on controlplane. Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e Author: Fernando Fernandez Mancera Date: Fri Nov 21 01:14:32 2025 +0100 netfilter: nft_connlimit: update the count if add was skipped Connlimit expression can be used for all kind of packets and not only for packets with connection state new. See this ruleset as example: table ip filter { chain input { type filter hook input priority filter; policy accept; tcp dport 22 ct count over 4 counter } } Currently, if the connection count goes over the limit the counter will count the packets. When a connection is closed, the connection count won't decrement as it should because it is only updated for new connections due to an optimization on __nf_conncount_add() that prevents updating the list if the connection is duplicated. To solve this problem, check whether the connection was skipped and if so, update the list. Adjust count_tree() too so the same fix is applied for xt_connlimit. Fixes: 976afca1ceba ("netfilter: nf_conncount: Early exit in nf_conncount_lookup() and cleanup") Closes: https://lore.kernel.org/netfilter/trinity-85c72a88-d762-46c3-be97-36f10e5d9796-1761173693813@3c-app-mailcom-bs12/ Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit c0362b5748282e22fa1592a8d3474f726ad964c2 Author: Fernando Fernandez Mancera Date: Fri Nov 21 01:14:31 2025 +0100 netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH For convenience when performing GC over the connection list, make nf_conncount_gc_list() to disable BH. This unifies the behavior with nf_conncount_add() and nf_conncount_count(). Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit be102eb6a0e7c03db00e50540622f4e43b2d2844 Author: Fernando Fernandez Mancera Date: Fri Nov 21 01:14:30 2025 +0100 netfilter: nf_conncount: rework API to use sk_buff directly When using nf_conncount infrastructure for non-confirmed connections a duplicated track is possible due to an optimization introduced since commit d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC"). In order to fix this introduce a new conncount API that receives directly an sk_buff struct. It fetches the tuple and zone and the corresponding ct from it. It comes with both existing conncount variants nf_conncount_count_skb() and nf_conncount_add_skb(). In addition remove the old API and adjust all the users to use the new one. This way, for each sk_buff struct it is possible to check if there is a ct present and already confirmed. If so, skip the add operation. Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso commit fe8313316eaf0f3b052d5a9464ca6aa630229400 Author: Lorenzo Bianconi Date: Fri Nov 7 12:14:48 2025 +0100 selftests: netfilter: nft_flowtable.sh: Add IPIP flowtable selftest Introduce specific selftest for IPIP flowtable SW acceleration in nft_flowtable.sh Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso commit d30301ba4b07ac92eb38353a111833b009003170 Author: Lorenzo Bianconi Date: Fri Nov 7 12:14:47 2025 +0100 netfilter: flowtable: Add IPIP tx sw acceleration Introduce sw acceleration for tx path of IPIP tunnels relying on the netfilter flowtable infrastructure. This patch introduces basic infrastructure to accelerate other tunnel types (e.g. IP6IP6). IPIP sw tx acceleration can be tested running the following scenario where the traffic is forwarded between two NICs (eth0 and eth1) and an IPIP tunnel is used to access a remote site (using eth1 as the underlay device): ETH0 -- TUN0 <==> ETH1 -- [IP network] -- TUN1 (192.168.100.2) $ip addr show 6: eth0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:00:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet 192.168.0.2/24 scope global eth0 valid_lft forever preferred_lft forever 7: eth1: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:11:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet 192.168.1.1/24 scope global eth1 valid_lft forever preferred_lft forever 8: tun0@NONE: mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000 link/ipip 192.168.1.1 peer 192.168.1.2 inet 192.168.100.1/24 scope global tun0 valid_lft forever preferred_lft forever $ip route show default via 192.168.100.2 dev tun0 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.2 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1 192.168.100.0/24 dev tun0 proto kernel scope link src 192.168.100.1 $nft list ruleset table inet filter { flowtable ft { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; meta l4proto { tcp, udp } flow add @ft } } Reproducing the scenario described above using veths I got the following results: - TCP stream trasmitted into the IPIP tunnel: - net-next: (baseline) ~ 85Gbps - net-next + IPIP flowtable support: ~102Gbps Co-developed-by: Pablo Neira Ayuso Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso commit ab427db17885814069bae891834f20842f0ac3a4 Author: Lorenzo Bianconi Date: Fri Nov 7 12:14:46 2025 +0100 netfilter: flowtable: Add IPIP rx sw acceleration Introduce sw acceleration for rx path of IPIP tunnels relying on the netfilter flowtable infrastructure. Subsequent patches will add sw acceleration for IPIP tunnels tx path. This series introduces basic infrastructure to accelerate other tunnel types (e.g. IP6IP6). IPIP rx sw acceleration can be tested running the following scenario where the traffic is forwarded between two NICs (eth0 and eth1) and an IPIP tunnel is used to access a remote site (using eth1 as the underlay device): ETH0 -- TUN0 <==> ETH1 -- [IP network] -- TUN1 (192.168.100.2) $ip addr show 6: eth0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:00:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet 192.168.0.2/24 scope global eth0 valid_lft forever preferred_lft forever 7: eth1: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:11:22:33:11:55 brd ff:ff:ff:ff:ff:ff inet 192.168.1.1/24 scope global eth1 valid_lft forever preferred_lft forever 8: tun0@NONE: mtu 1480 qdisc noqueue state UNKNOWN group default qlen 1000 link/ipip 192.168.1.1 peer 192.168.1.2 inet 192.168.100.1/24 scope global tun0 valid_lft forever preferred_lft forever $ip route show default via 192.168.100.2 dev tun0 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.2 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1 192.168.100.0/24 dev tun0 proto kernel scope link src 192.168.100.1 $nft list ruleset table inet filter { flowtable ft { hook ingress priority filter devices = { eth0, eth1 } } chain forward { type filter hook forward priority filter; policy accept; meta l4proto { tcp, udp } flow add @ft } } Reproducing the scenario described above using veths I got the following results: - TCP stream received from the IPIP tunnel: - net-next: (baseline) ~ 71Gbps - net-next + IPIP flowtbale support: ~101Gbps Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso commit a0d98b641d676e9fc5c458b14aee8ee874dd7298 Author: Pablo Neira Ayuso Date: Wed Nov 12 22:54:24 2025 +0100 netfilter: flowtable: use tuple address to calculate next hop This simplifies IPIP tunnel support coming in follow up patches. No function changes are intended. Signed-off-by: Pablo Neira Ayuso commit 030feea3097c41ed268c81240e5c334d9977b1c4 Author: Pablo Neira Ayuso Date: Fri Oct 10 12:50:07 2025 +0200 netfilter: flowtable: remove hw_ifidx hw_ifidx was originally introduced to store the real netdevice as a requirement for the hardware offload support in: 73f97025a972 ("netfilter: nft_flow_offload: use direct xmit if hardware offload is enabled") Since ("netfilter: flowtable: consolidate xmit path"), ifidx and hw_ifidx points to the real device in the xmit path, remove it. Signed-off-by: Pablo Neira Ayuso commit 18d27bed0880b1ac8638a6f4f2edc2ecc6b5c6a1 Author: Pablo Neira Ayuso Date: Tue Nov 18 23:59:47 2025 +0100 netfilter: flowtable: inline pppoe encapsulation in xmit path Push the pppoe header from the flowtable xmit path, inlining is faster than the original xmit path because it can avoid some locking. This is based on a patch originally written by wenxu. Signed-off-by: Pablo Neira Ayuso commit c653d5a78f3463cfd4c80909425510fb930b0641 Author: Pablo Neira Ayuso Date: Fri Oct 10 12:39:15 2025 +0200 netfilter: flowtable: inline vlan encapsulation in xmit path Push the vlan header from the flowtable xmit path, instead of passing the packet to the vlan device. This is based on a patch originally written by wenxu. Signed-off-by: Pablo Neira Ayuso commit b5964aac51e0c286a50e68225e0dfcf11fb554cb Author: Pablo Neira Ayuso Date: Fri Oct 10 12:32:35 2025 +0200 netfilter: flowtable: consolidate xmit path Use dev_queue_xmit() for the XMIT_NEIGH case. Store the interface index of the real device behind the vlan/pppoe device, this introduces an extra lookup for the real device in the xmit path because rt->dst.dev provides the vlan/pppoe device. XMIT_NEIGH now looks more similar to XMIT_DIRECT but the check for stale dst and the neighbour lookup still remain in place which is convenient to deal with network topology changes. Note that nft_flow_route() needs to relax the check for _XMIT_NEIGH so the existing basic xfrm offload (which only works in one direction) does not break. Signed-off-by: Pablo Neira Ayuso commit 93d7a7ed07342f5e3da2d250cfd67f899d0b5318 Author: Pablo Neira Ayuso Date: Fri Oct 10 12:32:23 2025 +0200 netfilter: flowtable: move path discovery infrastructure to its own file This file contains the path discovery that is run from the forward chain for the packet offloading the flow into the flowtable. This consists of a series of calls to dev_fill_forward_path() for each device stack. More topologies may be supported in the future, so move this code to its own file to separate it from the nftables flow_offload expression. Signed-off-by: Pablo Neira Ayuso commit 634f3853cc98d73bdec8918010ee29b06981583e Author: Pablo Neira Ayuso Date: Thu Nov 27 23:26:22 2025 +0000 netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Add a sanity check to skip path discovery if the maximum number of encapsulation is reached. While at it, check for underflow too. Fixes: 26267bf9bb57 ("netfilter: flowtable: bridge vlan hardware offload and switchdev") Signed-off-by: Pablo Neira Ayuso commit 62433efe0b06042d8016ba0713d801165a939229 Merge: 1a22e175b31190 31d3354f42c0da Author: Dave Airlie Date: Fri Nov 28 08:40:47 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-11-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next-fixes for v6.19: - Restrict the pointer size of flush pages to prevent a regression. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/0090a4fc-9cc4-4c03-bfe5-d1b1f0cc7e05@linux.intel.com commit aa514a297a0c175239f24a2e582ebd37f0727494 Author: Andy Shevchenko Date: Tue Nov 25 00:06:06 2025 +0100 calibrate: update header inclusion While cleaning up some headers, I got a build error on this file: init/calibrate.c:20:9: error: call to undeclared function 'kstrtoul'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] Update header inclusions to follow IWYU (Include What You Use) principle. Link: https://lkml.kernel.org/r/20251124230607.1445421-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Signed-off-by: Andrew Morton commit 6fb3acdebf65a72df0a95f9fd2c901ff2bc9a3a2 Author: Ilias Stamatis Date: Mon Nov 24 16:53:49 2025 +0000 Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Commit 97523a4edb7b ("kernel/resource: remove first_lvl / siblings_only logic") removed an optimization introduced by commit 756398750e11 ("resource: avoid unnecessary lookups in find_next_iomem_res()"). That was not called out in the message of the first commit explicitly so it's not entirely clear whether removing the optimization happened inadvertently or not. As the original commit message of the optimization explains there is no point considering the children of a subtree in find_next_iomem_res() if the top level range does not match. Reinstating the optimization results in performance improvements in systems where /proc/iomem is ~5k lines long. Calling mmap() on /dev/mem in such platforms takes 700-1500μs without the optimisation and 10-50μs with the optimisation. Note that even though commit 97523a4edb7b removed the 'sibling_only' parameter from next_resource(), newer kernels have basically reinstated it under the name 'skip_children'. Link: https://lore.kernel.org/all/20251124165349.3377826-1-ilstam@amazon.com/T/#u Fixes: 97523a4edb7b ("kernel/resource: remove first_lvl / siblings_only logic") Signed-off-by: Ilias Stamatis Acked-by: David Hildenbrand (Red Hat) Cc: Andriy Shevchenko Cc: Baoquan He Cc: "Huang, Ying" Cc: Nadav Amit Signed-off-by: Andrew Morton commit 3fa805c37dd4d3e72ae5c58800f3f46ab3ca1f70 Author: Breno Leitao Date: Fri Oct 10 03:36:50 2025 -0700 vmcoreinfo: track and log recoverable hardware errors Introduce a generic infrastructure for tracking recoverable hardware errors (HW errors that are visible to the OS but does not cause a panic) and record them for vmcore consumption. This aids post-mortem crash analysis tools by preserving a count and timestamp for the last occurrence of such errors. On the other side, correctable errors, which the OS typically remains unaware of because the underlying hardware handles them transparently, are less relevant for crash dump and therefore are NOT tracked in this infrastructure. Add centralized logging for sources of recoverable hardware errors based on the subsystem it has been notified. hwerror_data is write-only at kernel runtime, and it is meant to be read from vmcore using tools like crash/drgn. For example, this is how it looks like when opening the crashdump from drgn. >>> prog['hwerror_data'] (struct hwerror_info[1]){ { .count = (int)844, .timestamp = (time64_t)1752852018, }, ... This helps fleet operators quickly triage whether a crash may be influenced by hardware recoverable errors (which executes a uncommon code path in the kernel), especially when recoverable errors occurred shortly before a panic, such as the bug fixed by commit ee62ce7a1d90 ("page_pool: Track DMA-mapped pages and unmap them when destroying the pool") This is not intended to replace full hardware diagnostics but provides a fast way to correlate hardware events with kernel panics quickly. Rare machine check exceptions—like those indicated by mce_flags.p5 or mce_flags.winchip—are not accounted for in this method, as they fall outside the intended usage scope for this feature's user base. [leitao@debian.org: add hw-recoverable-errors to toctree] Link: https://lkml.kernel.org/r/20251127-vmcoreinfo_fix-v1-1-26f5b1c43da9@debian.org Link: https://lkml.kernel.org/r/20251010-vmcore_hw_error-v5-1-636ede3efe44@debian.org Signed-off-by: Breno Leitao Suggested-by: Tony Luck Suggested-by: Shuai Xue Reviewed-by: Shuai Xue Reviewed-by: Hanjun Guo [APEI] Cc: Bjorn Helgaas Cc: Bob Moore Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Morse Cc: Konrad Rzessutek Wilk Cc: Len Brown Cc: Mahesh Salgaonkar Cc: Mauro Carvalho Chehab Cc: "Oliver O'Halloran" Cc: Omar Sandoval Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 7b71205ae1120e90c7f6d41d282e26c00e9ee6a7 Author: Mike Rapoport (Microsoft) Date: Tue Nov 25 13:09:17 2025 +0200 kho: fix restoring of contiguous ranges of order-0 pages When contiguous ranges of order-0 pages are restored, kho_restore_page() calls prep_compound_page() with the first page in the range and order as parameters and then kho_restore_pages() calls split_page() to make sure all pages in the range are order-0. However, since split_page() is not intended to split compound pages and with VM_DEBUG enabled it will trigger a VM_BUG_ON_PAGE(). Update kho_restore_page() so that it will use prep_compound_page() when it restores a folio and make sure it properly sets page count for both large folios and ranges of order-0 pages. Link: https://lkml.kernel.org/r/20251125110917.843744-3-rppt@kernel.org Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Mike Rapoport (Microsoft) Reported-by: Pratyush Yadav Cc: Alexander Graf Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 4bc84cd539dff1a6346ffeb5f174bb79e238fa78 Author: Mike Rapoport (Microsoft) Date: Tue Nov 25 13:09:16 2025 +0200 kho: kho_restore_vmalloc: fix initialization of pages array Patch series "kho: fixes for vmalloc restoration". Pratyush reported off-list that when kho_restore_vmalloc() is used to restore a vmalloc_huge() allocation it hits VM_BUG_ON() when we reconstruct the struct pages in kho_restore_pages(). These patches fix the issue. This patch (of 2): In case a preserved vmalloc allocation was using huge pages, all pages in the array of pages added to vm_struct during kho_restore_vmalloc() are wrongly set to the same page. Fix the indexing when assigning pages to that array. Link: https://lkml.kernel.org/r/20251125110917.843744-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20251125110917.843744-2-rppt@kernel.org Fixes: a667300bd53f ("kho: add support for preserving vmalloc allocations") Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit c39eab75a57dbd6b4618fae88d36446e1cdffdde Author: Jarkko Sakkinen Date: Tue Nov 25 18:03:53 2025 +0200 MAINTAINERS: TPM DEVICE DRIVER: update the W-tag I migrated test suite to git.kernel.org so that all my kernel stuff is consolidated to one single place: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd-test.git/about/ Link: https://lkml.kernel.org/r/20251125160353.2300402-1-jarkko@kernel.org Signed-off-by: Jarkko Sakkinen Signed-off-by: Andrew Morton commit af06a40474793ad9677d1771c0624ae8191f0892 Author: Thorsten Blum Date: Sat Nov 22 12:45:37 2025 +0100 init: replace simple_strtoul with kstrtoul to improve lpj_setup Replace simple_strtoul() with the recommended kstrtoul() for parsing the 'lpj=' boot parameter. Check the return value of kstrtoul() and reject invalid values. This adds error handling while preserving existing behavior for valid values, and removes use of the deprecated simple_strtoul() helper. Link: https://lkml.kernel.org/r/20251122114539.446937-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Cc: Christian Brauner Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit 40cd0e8dd283b11aff9628fe7fd810ea7cc53e32 Author: Ran Xiaokai Date: Sat Nov 22 18:29:29 2025 +0000 KHO: fix boot failure due to kmemleak access to non-PRESENT pages When booting with debug_pagealloc=on while having: CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT=y CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=n the system fails to boot due to page faults during kmemleak scanning. This occurs because: With debug_pagealloc is enabled, __free_pages() invokes debug_pagealloc_unmap_pages(), clearing the _PAGE_PRESENT bit for freed pages in the kernel page table. KHO scratch areas are allocated from memblock and noted by kmemleak. But these areas don't remain reserved but released later to the page allocator using init_cma_reserved_pageblock(). This causes subsequent kmemleak scans access non-PRESENT pages, leading to fatal page faults. Mark scratch areas with kmemleak_ignore_phys() after they are allocated from memblock to exclude them from kmemleak scanning before they are released to buddy allocator to fix this. [ran.xiaokai@zte.com.cn: add comment] Link: https://lkml.kernel.org/r/20251127122700.103927-1-ranxiaokai627@163.com Link: https://lkml.kernel.org/r/20251122182929.92634-1-ranxiaokai627@163.com Signed-off-by: Ran Xiaokai Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Catalin Marinas Cc: Changyuan Lyu Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit fb5c3644278c169c0d03b904b2bdedcaea897df7 Author: Sourabh Jain Date: Tue Nov 18 17:15:07 2025 +0530 Documentation/ABI: new kexec and kdump sysfs interface Add an ABI document for following kexec and kdump sysfs interface: - /sys/kernel/kexec/loaded - /sys/kernel/kexec/crash_loaded - /sys/kernel/kexec/crash_size - /sys/kernel/kexec/crash_elfcorehdr_size - /sys/kernel/kexec/crash_cma_ranges Link: https://lkml.kernel.org/r/20251118114507.1769455-4-sourabhjain@linux.ibm.com Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Aditya Gupta Cc: Dave Young Cc: Hari Bathini Cc: Jiri Bohac Cc: Madhavan Srinivasan Cc: Mahesh J Salgaonkar Cc: Pingfan Liu Cc: Ritesh Harjani (IBM) Cc: Shivang Upadhyay Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 5c991b6d9b30895744085abb592c77338d65a40d Author: Sourabh Jain Date: Tue Nov 18 17:15:06 2025 +0530 Documentation/ABI: mark old kexec sysfs deprecated The previous commit ("kexec: move sysfs entries to /sys/kernel/kexec") moved all existing kexec sysfs entries to a new location. The ABI document is updated to include a note about the deprecation of the old kexec sysfs entries. The following kexec sysfs entries are deprecated: - /sys/kernel/kexec_loaded - /sys/kernel/kexec_crash_loaded - /sys/kernel/kexec_crash_size - /sys/kernel/crash_elfcorehdr_size - /sys/kernel/kexec_crash_cma_ranges Link: https://lkml.kernel.org/r/20251118114507.1769455-3-sourabhjain@linux.ibm.com Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Aditya Gupta Cc: Dave Young Cc: Hari Bathini Cc: Jiri Bohac Cc: Madhavan Srinivasan Cc: Mahesh J Salgaonkar Cc: Pingfan Liu Cc: Ritesh Harjani (IBM) Cc: Shivang Upadhyay Cc: Vivek Goyal Signed-off-by: Andrew Morton commit cf4340bdd967fe7f37b4361c85370515f11f4a37 Author: Sourabh Jain Date: Tue Nov 18 17:15:05 2025 +0530 kexec: move sysfs entries to /sys/kernel/kexec Patch series "kexec: reorganize kexec and kdump sysfs", v6. All existing kexec and kdump sysfs entries are moved to a new location, /sys/kernel/kexec, to keep /sys/kernel/ clean and better organized. Symlinks are created at the old locations for backward compatibility and can be removed in the future [01/03]. While doing this cleanup, the old kexec and kdump sysfs entries are marked as deprecated in the existing ABI documentation [02/03]. This makes it clear that these older interfaces should no longer be used. New ABI documentation is added to describe the reorganized interfaces [03/03], so users and tools can rely on the updated sysfs interfaces going forward. This patch (of 3): Several kexec and kdump sysfs entries are currently placed directly under /sys/kernel/, which clutters the directory and makes it harder to identify unrelated entries. To improve organization and readability, these entries are now moved under a dedicated directory, /sys/kernel/kexec. The following sysfs moved under new kexec sysfs node +------------------------------------+------------------+ | Old sysfs name | New sysfs name | | (under /sys/kernel) | (under /sys/kernel/kexec) | +---------------------------+---------------------------+ | kexec_loaded | loaded | +---------------------------+---------------------------+ | kexec_crash_loaded | crash_loaded | +---------------------------+---------------------------+ | kexec_crash_size | crash_size | +---------------------------+---------------------------+ | crash_elfcorehdr_size | crash_elfcorehdr_size | +---------------------------+---------------------------+ | kexec_crash_cma_ranges | crash_cma_ranges | +---------------------------+---------------------------+ For backward compatibility, symlinks are created at the old locations so that existing tools and scripts continue to work. These symlinks can be removed in the future once users have switched to the new path. While creating symlinks, entries are added in /sys/kernel/ that point to their new locations under /sys/kernel/kexec/. If an error occurs while adding a symlink, it is logged but does not stop initialization of the remaining kexec sysfs symlinks. The /sys/kernel/ entry is now controlled by CONFIG_CRASH_DUMP instead of CONFIG_VMCORE_INFO, as CONFIG_CRASH_DUMP also enables CONFIG_VMCORE_INFO. Link: https://lkml.kernel.org/r/20251118114507.1769455-1-sourabhjain@linux.ibm.com Link: https://lkml.kernel.org/r/20251118114507.1769455-2-sourabhjain@linux.ibm.com Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Aditya Gupta Cc: Dave Young Cc: Hari Bathini Cc: Jiri Bohac Cc: Madhavan Srinivasan Cc: Mahesh J Salgaonkar Cc: Pingfan Liu Cc: Ritesh Harjani (IBM) Cc: Shivang Upadhyay Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 11047466eff28cb3d3422622166931204ed7d502 Author: Pratyush Yadav Date: Tue Nov 18 19:10:45 2025 +0100 test_kho: always print restore status Currently the KHO test only prints a message on success, and remains silent on failure. This makes it difficult to notice a failing test. A failing test is usually more interesting than a successful one. Always print the test status after attempting restore. Link: https://lkml.kernel.org/r/20251118181046.23321-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Acked-by: SeongJae Park Cc: Alexander Graf Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit b15515155af735a86e5bcd67ed739162f0de27f5 Author: Pratyush Yadav Date: Tue Nov 18 19:22:16 2025 +0100 kho: free chunks using free_page() instead of kfree() Before commit fa759cd75bce5 ("kho: allocate metadata directly from the buddy allocator"), the chunks were allocated from the slab allocator using kzalloc(). Those were rightly freed using kfree(). When the commit switched to using the buddy allocator directly, it missed updating kho_mem_ser_free() to use free_page() instead of kfree(). Link: https://lkml.kernel.org/r/20251118182218.63044-1-pratyush@kernel.org Fixes: fa759cd75bce5 ("kho: allocate metadata directly from the buddy allocator") Signed-off-by: Pratyush Yadav Reviewed-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: David Matlack Signed-off-by: Andrew Morton commit 724bf8c5595a1219427f6e779563859d63948b5a Author: Pasha Tatashin Date: Tue Nov 25 11:58:48 2025 -0500 selftests/liveupdate: add kexec test for multiple and empty sessions Introduce a new kexec-based selftest, luo_kexec_multi_session, to validate the end-to-end lifecycle of a more complex LUO scenario. While the existing luo_kexec_simple test covers the basic end-to-end lifecycle, it is limited to a single session with one preserved file. This new test significantly expands coverage by verifying LUO's ability to handle a mixed workload involving multiple sessions, some of which are intentionally empty. This ensures that the LUO core correctly preserves and restores the state of all session types across a reboot. The test validates the following sequence: Stage 1 (Pre-kexec): - Creates two empty test sessions (multi-test-empty-1, multi-test-empty-2). - Creates a session with one preserved memfd (multi-test-files-1). - Creates another session with two preserved memfds (multi-test-files-2), each containing unique data. - Creates a state-tracking session to manage the transition to Stage 2. - Executes a kexec reboot via the helper script. Stage 2 (Post-kexec): - Retrieves the state-tracking session to confirm it is in the post-reboot stage. - Retrieves all four test sessions (both the empty and non-empty ones). - For the non-empty sessions, restores the preserved memfds and verifies their contents match the original data patterns. - Finalizes all test sessions and the state session to ensure a clean teardown and that all associated kernel resources are correctly released. This test provides greater confidence in the robustness of the LUO framework by validating its behavior in a more realistic, multi-faceted scenario. Link: https://lkml.kernel.org/r/20251125165850.3389713-19-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit a003bdb9ec4e12c869b9c8641dd9bebf90ac0389 Author: Pasha Tatashin Date: Tue Nov 25 11:58:47 2025 -0500 selftests/liveupdate: add simple kexec-based selftest for LUO Introduce a kexec-based selftest, luo_kexec_simple, to validate the end-to-end lifecycle of a Live Update Orchestrator session across a reboot. While existing tests verify the uAPI in a pre-reboot context, this test ensures that the core functionality—preserving state via Kexec Handover and restoring it in a new kernel—works as expected. The test operates in two stages, managing its state across the reboot by preserving a dedicated "state session" containing a memfd. This mechanism dogfoods the LUO feature itself for state tracking, making the test self-contained. The test validates the following sequence: Stage 1 (Pre-kexec): - Creates a test session (test-session). - Creates and preserves a memfd with a known data pattern into the test session. - Creates the state-tracking session to signal progression to Stage 2. - Executes a kexec reboot via a helper script. Stage 2 (Post-kexec): - Retrieves the state-tracking session to confirm it is in the post-reboot stage. - Retrieves the preserved test session. - Restores the memfd from the test session and verifies its contents match the original data pattern written in Stage 1. - Finalizes both the test and state sessions to ensure a clean teardown. The test relies on a helper script (do_kexec.sh) to perform the reboot and a shared utility library (luo_test_utils.c) for common LUO operations, keeping the main test logic clean and focused. Link: https://lkml.kernel.org/r/20251125165850.3389713-18-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Zhu Yanjun Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zijun Hu Signed-off-by: Andrew Morton commit 80bab43f6f235664fff2d3518b3901ba9c4ac5a3 Author: Pasha Tatashin Date: Tue Nov 25 11:58:46 2025 -0500 selftests/liveupdate: add userspace API selftests Introduce a selftest suite for LUO. These tests validate the core userspace-facing API provided by the /dev/liveupdate device and its associated ioctls. The suite covers fundamental device behavior, session management, and the file preservation mechanism using memfd as a test case. This provides regression testing for the LUO uAPI. The following functionality is verified: Device Access: Basic open and close operations on /dev/liveupdate. Enforcement of exclusive device access (verifying EBUSY on a second open). Session Management: Successful creation of sessions with unique names. Failure to create sessions with duplicate names. File Preservation: Preserving a single memfd and verifying its content remains intact post-preservation. Preserving multiple memfds within a single session, each with unique data. A complex scenario involving multiple sessions, each containing a mix of empty and data-filled memfds. Note: This test suite is limited to verifying the pre-kexec functionality of LUO (e.g., session creation, file preservation). The post-kexec restoration of resources is not covered, as the kselftest framework does not currently support orchestrating a reboot and continuing execution in the new kernel. Link: https://lkml.kernel.org/r/20251125165850.3389713-17-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 15fc11bb2cb649f2207bbb7140d5430d3937a8d5 Author: Pratyush Yadav Date: Tue Nov 25 11:58:45 2025 -0500 docs: add documentation for memfd preservation via LUO Add the documentation under the "Preserving file descriptors" section of LUO's documentation. Link: https://lkml.kernel.org/r/20251125165850.3389713-16-pasha.tatashin@soleen.com Signed-off-by: Pratyush Yadav Co-developed-by: Pasha Tatashin Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit b3749f174d686627f702234e64bad976dc432dbc Author: Pratyush Yadav Date: Tue Nov 25 11:58:44 2025 -0500 mm: memfd_luo: allow preserving memfd The ability to preserve a memfd allows userspace to use KHO and LUO to transfer its memory contents to the next kernel. This is useful in many ways. For one, it can be used with IOMMUFD as the backing store for IOMMU page tables. Preserving IOMMUFD is essential for performing a hypervisor live update with passthrough devices. memfd support provides the first building block for making that possible. For another, applications with a large amount of memory that takes time to reconstruct, reboots to consume kernel upgrades can be very expensive. memfd with LUO gives those applications reboot-persistent memory that they can use to quickly save and reconstruct that state. While memfd is backed by either hugetlbfs or shmem, currently only support on shmem is added. To be more precise, support for anonymous shmem files is added. The handover to the next kernel is not transparent. All the properties of the file are not preserved; only its memory contents, position, and size. The recreated file gets the UID and GID of the task doing the restore, and the task's cgroup gets charged with the memory. Once preserved, the file cannot grow or shrink, and all its pages are pinned to avoid migrations and swapping. The file can still be read from or written to. Use vmalloc to get the buffer to hold the folios, and preserve it using kho_preserve_vmalloc(). This doesn't have the size limit. Link: https://lkml.kernel.org/r/20251125165850.3389713-15-pasha.tatashin@soleen.com Signed-off-by: Pratyush Yadav Co-developed-by: Pasha Tatashin Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 8def18633e8df54a05cf7d323d0df24c21b320d6 Author: Pratyush Yadav Date: Tue Nov 25 11:58:43 2025 -0500 liveupdate: luo_file: add private argument to store runtime state Currently file handlers only get the serialized_data field to store their state. This field has a pointer to the serialized state of the file, and it becomes a part of LUO file's serialized state. File handlers can also need some runtime state to track information that shouldn't make it in the serialized data. One such example is a vmalloc pointer. While kho_preserve_vmalloc() preserves the memory backing a vmalloc allocation, it does not store the original vmap pointer, since that has no use being passed to the next kernel. The pointer is needed to free the memory in case the file is unpreserved. Provide a private field in struct luo_file and pass it to all the callbacks. The field's can be set by preserve, and must be freed by unpreserve. Link: https://lkml.kernel.org/r/20251125165850.3389713-14-pasha.tatashin@soleen.com Signed-off-by: Pratyush Yadav Co-developed-by: Pasha Tatashin Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit ed6f45f81bf99f3cef380ba0de8cad85007b5307 Author: Pratyush Yadav Date: Tue Nov 25 11:58:42 2025 -0500 mm: shmem: export some functions to internal.h shmem_inode_acct_blocks(), shmem_recalc_inode(), and shmem_add_to_page_cache() are used by shmem_alloc_and_add_folio(). This functionality will be used by memfd LUO integration. Link: https://lkml.kernel.org/r/20251125165850.3389713-13-pasha.tatashin@soleen.com Signed-off-by: Pratyush Yadav Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit e165e2a2577b048664be09c074a10304290055f0 Author: Pratyush Yadav Date: Tue Nov 25 11:58:41 2025 -0500 mm: shmem: allow freezing inode mapping To prepare a shmem inode for live update, its index -> folio mappings must be serialized. Once the mappings are serialized, they cannot change since it would cause the serialized data to become inconsistent. This can be done by pinning the folios to avoid migration, and by making sure no folios can be added to or removed from the inode. While mechanisms to pin folios already exist, the only way to stop folios being added or removed are the grow and shrink file seals. But file seals come with their own semantics, one of which is that they can't be removed. This doesn't work with liveupdate since it can be cancelled or error out, which would need the seals to be removed and the file's normal functionality to be restored. Introduce SHMEM_F_MAPPING_FROZEN to indicate this instead. It is internal to shmem and is not directly exposed to userspace. It functions similar to F_SEAL_GROW | F_SEAL_SHRINK, but additionally disallows hole punching, and can be removed. Link: https://lkml.kernel.org/r/20251125165850.3389713-12-pasha.tatashin@soleen.com Signed-off-by: Pratyush Yadav Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 6ff1610ced5689c9af4c28a1798e04b74128a703 Author: Pratyush Yadav Date: Tue Nov 25 11:58:40 2025 -0500 mm: shmem: use SHMEM_F_* flags instead of VM_* flags shmem_inode_info::flags can have the VM flags VM_NORESERVE and VM_LOCKED. These are used to suppress pre-accounting or to lock the pages in the inode respectively. Using the VM flags directly makes it difficult to add shmem-specific flags that are unrelated to VM behavior since one would need to find a VM flag not used by shmem and re-purpose it. Introduce SHMEM_F_NORESERVE and SHMEM_F_LOCKED which represent the same information, but their bits are independent of the VM flags. Callers can still pass VM_NORESERVE to shmem_get_inode(), but it gets transformed to the shmem-specific flag internally. No functional changes intended. Link: https://lkml.kernel.org/r/20251125165850.3389713-11-pasha.tatashin@soleen.com Signed-off-by: Pratyush Yadav Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 7a5afa7ea8235e6b786b425b8905b2a4ffed8f65 Author: Pasha Tatashin Date: Tue Nov 25 11:58:39 2025 -0500 MAINTAINERS: add liveupdate entry Add a MAINTAINERS file entry for the new Live Update Orchestrator introduced in previous patches. Link: https://lkml.kernel.org/r/20251125165850.3389713-10-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 906a3306245525f408129153d5dcb7ae7e6ded44 Author: Pasha Tatashin Date: Tue Nov 25 11:58:38 2025 -0500 docs: add luo documentation Add the documentation files for the Live Update Orchestrator Link: https://lkml.kernel.org/r/20251125165850.3389713-9-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 16cec0d265219f14a7fcebcc43aeb69205adba56 Author: Pasha Tatashin Date: Tue Nov 25 11:58:37 2025 -0500 liveupdate: luo_session: add ioctls for file preservation Introducing the userspace interface and internal logic required to manage the lifecycle of file descriptors within a session. Previously, a session was merely a container; this change makes it a functional management unit. The following capabilities are added: A new set of ioctl commands are added, which operate on the file descriptor returned by CREATE_SESSION. This allows userspace to: - LIVEUPDATE_SESSION_PRESERVE_FD: Add a file descriptor to a session to be preserved across the live update. - LIVEUPDATE_SESSION_RETRIEVE_FD: Retrieve a preserved file in the new kernel using its unique token. - LIVEUPDATE_SESSION_FINISH: finish session The session's .release handler is enhanced to be state-aware. When a session's file descriptor is closed, it correctly unpreserves the session based on its current state before freeing all associated file resources. Link: https://lkml.kernel.org/r/20251125165850.3389713-8-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 7c722a7f44e0c1f9714084152226bc7bd644b7e3 Author: Pasha Tatashin Date: Tue Nov 25 11:58:36 2025 -0500 liveupdate: luo_file: implement file systems callbacks This patch implements the core mechanism for managing preserved files throughout the live update lifecycle. It provides the logic to invoke the file handler callbacks (preserve, unpreserve, freeze, unfreeze, retrieve, and finish) at the appropriate stages. During the reboot phase, luo_file_freeze() serializes the final metadata for each file (handler compatible string, token, and data handle) into a memory region preserved by KHO. In the new kernel, luo_file_deserialize() reconstructs the in-memory file list from this data, preparing the session for retrieval. Link: https://lkml.kernel.org/r/20251125165850.3389713-7-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 81cd25d263a182b3dcdc8af3b92e4b8e4db336de Author: Pasha Tatashin Date: Tue Nov 25 11:58:35 2025 -0500 liveupdate: luo_core: add user interface Introduce the user-space interface for the Live Update Orchestrator via ioctl commands, enabling external control over the live update process and management of preserved resources. The idea is that there is going to be a single userspace agent driving the live update, therefore, only a single process can ever hold this device opened at a time. The following ioctl commands are introduced: LIVEUPDATE_IOCTL_CREATE_SESSION Provides a way for userspace to create a named session for grouping file descriptors that need to be preserved. It returns a new file descriptor representing the session. LIVEUPDATE_IOCTL_RETRIEVE_SESSION Allows the userspace agent in the new kernel to reclaim a preserved session by its name, receiving a new file descriptor to manage the restored resources. Link: https://lkml.kernel.org/r/20251125165850.3389713-6-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 0153094d03df5a2e834a19c59b255649a258ae46 Author: Pasha Tatashin Date: Tue Nov 25 11:58:34 2025 -0500 liveupdate: luo_session: add sessions support Introduce concept of "Live Update Sessions" within the LUO framework. LUO sessions provide a mechanism to group and manage `struct file *` instances (representing file descriptors) that need to be preserved across a kexec-based live update. Each session is identified by a unique name and acts as a container for file objects whose state is critical to a userspace workload, such as a virtual machine or a high-performance database, aiming to maintain their functionality across a kernel transition. This groundwork establishes the framework for preserving file-backed state across kernel updates, with the actual file data preservation mechanisms to be implemented in subsequent patches. [dan.carpenter@linaro.org: fix use after free in luo_session_deserialize()] Link: https://lkml.kernel.org/r/c5dd637d7eed3a3be48c5e9fedb881596a3b1f5a.1764163896.git.dan.carpenter@linaro.org Link: https://lkml.kernel.org/r/20251125165850.3389713-5-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Signed-off-by: Dan Carpenter Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit db8bed8082dc6185153cdef67cdd5aa7526e8126 Author: Pasha Tatashin Date: Tue Nov 25 11:58:33 2025 -0500 kexec: call liveupdate_reboot() before kexec Modify the kernel_kexec() to call liveupdate_reboot(). This ensures that the Live Update Orchestrator is notified just before the kernel executes the kexec jump. The liveupdate_reboot() function triggers the final freeze event, allowing participating FDs perform last-minute check or state saving within the blackout window. If liveupdate_reboot() returns an error (indicating a failure during LUO finalization), the kexec operation is aborted to prevent proceeding with an inconsistent state. An error is returned to user. Link: https://lkml.kernel.org/r/20251125165850.3389713-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 1aece821004f67f46ef4db7199bbeca87cf22bdd Author: Pasha Tatashin Date: Tue Nov 25 11:58:32 2025 -0500 liveupdate: luo_core: integrate with KHO Integrate the LUO with the KHO framework to enable passing LUO state across a kexec reboot. This patch implements the lifecycle integration with KHO: 1. Incoming State: During early boot (`early_initcall`), LUO checks if KHO is active. If so, it retrieves the "LUO" subtree, verifies the "luo-v1" compatibility string, and reads the `liveupdate-number` to track the update count. 2. Outgoing State: During late initialization (`late_initcall`), LUO allocates a new FDT for the next kernel, populates it with the basic header (compatible string and incremented update number), and registers it with KHO (`kho_add_subtree`). 3. Finalization: The `liveupdate_reboot()` notifier is updated to invoke `kho_finalize()`. This ensures that all memory segments marked for preservation are properly serialized before the kexec jump. Link: https://lkml.kernel.org/r/20251125165850.3389713-3-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Tested-by: David Matlack Reviewed-by: Mike Rapoport (Microsoft) Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zhu Yanjun Cc: Zijun Hu Signed-off-by: Andrew Morton commit 9e2fd062fa1713a33380cc97ef324d086dd45ba5 Author: Pasha Tatashin Date: Tue Nov 25 11:58:31 2025 -0500 liveupdate: luo_core: Live Update Orchestrator Patch series "Live Update Orchestrator", v8. This series introduces the Live Update Orchestrator, a kernel subsystem designed to facilitate live kernel updates using a kexec-based reboot. This capability is critical for cloud environments, allowing hypervisors to be updated with minimal downtime for running virtual machines. LUO achieves this by preserving the state of selected resources, such as memory, devices and their dependencies, across the kernel transition. As a key feature, this series includes support for preserving memfd file descriptors, which allows critical in-memory data, such as guest RAM or any other large memory region, to be maintained in RAM across the kexec reboot. The other series that use LUO, are VFIO [1], IOMMU [2], and PCI [3] preservations. Github repo of this series [4]. The core of LUO is a framework for managing the lifecycle of preserved resources through a userspace-driven interface. Key features include: - Session Management Userspace agent (i.e. luod [5]) creates named sessions, each represented by a file descriptor (via centralized agent that controls /dev/liveupdate). The lifecycle of all preserved resources within a session is tied to this FD, ensuring automatic kernel cleanup if the controlling userspace agent crashes or exits unexpectedly. - File Preservation A handler-based framework allows specific file types (demonstrated here with memfd) to be preserved. Handlers manage the serialization, restoration, and lifecycle of their specific file types. - File-Lifecycle-Bound State A new mechanism for managing shared global state whose lifecycle is tied to the preservation of one or more files. This is crucial for subsystems like IOMMU or HugeTLB, where multiple file descriptors may depend on a single, shared underlying resource that must be preserved only once. - KHO Integration LUO drives the Kexec Handover framework programmatically to pass its serialized metadata to the next kernel. The LUO state is finalized and added to the kexec image just before the reboot is triggered. In the future this step will also be removed once stateless KHO is merged [6]. - Userspace Interface Control is provided via ioctl commands on /dev/liveupdate for creating and retrieving sessions, as well as on session file descriptors for managing individual files. - Testing The series includes a set of selftests, including userspace API validation, kexec-based lifecycle tests for various session and file scenarios, and a new in-kernel test module to validate the FLB logic. Introduce LUO, a mechanism intended to facilitate kernel updates while keeping designated devices operational across the transition (e.g., via kexec). The primary use case is updating hypervisors with minimal disruption to running virtual machines. For userspace side of hypervisor update we have copyless migration. LUO is for updating the kernel. This initial patch lays the groundwork for the LUO subsystem. Further functionality, including the implementation of state transition logic, integration with KHO, and hooks for subsystems and file descriptors, will be added in subsequent patches. Create a character device at /dev/liveupdate. A new uAPI header, , will define the necessary structures. The magic number for IOCTL is registered in Documentation/userspace-api/ioctl/ioctl-number.rst. Link: https://lkml.kernel.org/r/20251125165850.3389713-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20251125165850.3389713-2-pasha.tatashin@soleen.com Link: https://lore.kernel.org/all/20251018000713.677779-1-vipinsh@google.com/ [1] Link: https://lore.kernel.org/linux-iommu/20250928190624.3735830-1-skhawaja@google.com [2] Link: https://lore.kernel.org/linux-pci/20250916-luo-pci-v2-0-c494053c3c08@kernel.org [3] Link: https://github.com/googleprodkernel/linux-liveupdate/tree/luo/v8 [4] Link: https://tinyurl.com/luoddesign [5] Link: https://lore.kernel.org/all/20251020100306.2709352-1-jasonmiu@google.com [6] Link: https://lore.kernel.org/all/20251115233409.768044-1-pasha.tatashin@soleen.com [7] Link: https://github.com/soleen/linux/blob/luo/v8b03/diff.v7.v8 [8] Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Tested-by: David Matlack Cc: Aleksander Lobakin Cc: Alexander Graf Cc: Alice Ryhl Cc: Andriy Shevchenko Cc: anish kumar Cc: Anna Schumaker Cc: Bartosz Golaszewski Cc: Bjorn Helgaas Cc: Borislav Betkov Cc: Chanwoo Choi Cc: Chen Ridong Cc: Chris Li Cc: Christian Brauner Cc: Daniel Wagner Cc: Danilo Krummrich Cc: Dan Williams Cc: David Hildenbrand Cc: David Jeffery Cc: David Rientjes Cc: Greg Kroah-Hartman Cc: Guixin Liu Cc: "H. Peter Anvin" Cc: Hugh Dickins Cc: Ilpo Järvinen Cc: Ingo Molnar Cc: Ira Weiny Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jens Axboe Cc: Joanthan Cameron Cc: Joel Granados Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Lennart Poettering Cc: Leon Romanovsky Cc: Leon Romanovsky Cc: Lukas Wunner Cc: Marc Rutland Cc: Masahiro Yamada Cc: Matthew Maurer Cc: Miguel Ojeda Cc: Myugnjoo Ham Cc: Parav Pandit Cc: Randy Dunlap Cc: Roman Gushchin Cc: Saeed Mahameed Cc: Samiullah Khawaja Cc: Song Liu Cc: Steven Rostedt Cc: Stuart Hayes Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Weißschuh Cc: Vincent Guittot Cc: William Tu Cc: Yoann Congal Cc: Zijun Hu Cc: Pratyush Yadav Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit 7bd3643f94a357863beef646b85cf10292398629 Author: Pasha Tatashin Date: Fri Nov 14 14:00:02 2025 -0500 kho: add Kconfig option to enable KHO by default Currently, Kexec Handover must be explicitly enabled via the kernel command line parameter `kho=on`. For workloads that rely on KHO as a foundational requirement (such as the upcoming Live Update Orchestrator), requiring an explicit boot parameter adds redundant configuration steps. Introduce CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT. When selected, KHO defaults to enabled. This is equivalent to passing kho=on at boot. The behavior can still be disabled at runtime by passing kho=off. Link: https://lkml.kernel.org/r/20251114190002.3311679-14-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit de51999e687c70a41997124b43291f84324c7924 Author: Pasha Tatashin Date: Fri Nov 14 14:00:01 2025 -0500 kho: allow memory preservation state updates after finalization Currently, kho_preserve_* and kho_unpreserve_* return -EBUSY if KHO is finalized. This enforces a rigid "freeze" on the KHO memory state. With the introduction of re-entrant finalization, this restriction is no longer necessary. Users should be allowed to modify the preservation set (e.g., adding new pages or freeing old ones) even after an initial finalization. The intended workflow for updates is now: 1. Modify state (preserve/unpreserve). 2. Call kho_finalize() again to refresh the serialized metadata. Remove the kho_out.finalized checks to enable this dynamic behavior. This also allows to convert kho_unpreserve_* functions to void, as they do not return any error anymore. Link: https://lkml.kernel.org/r/20251114190002.3311679-13-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit d7255959b69a4e727c61eb04231d11390d4f391e Author: Pasha Tatashin Date: Fri Nov 14 14:00:00 2025 -0500 kho: allow kexec load before KHO finalization Currently, kho_fill_kimage() checks kho_out.finalized and returns early if KHO is not yet finalized. This enforces a strict ordering where userspace must finalize KHO *before* loading the kexec image. This is restrictive, as standard workflows often involve loading the target kernel early in the lifecycle and finalizing the state (FDT) only immediately before the reboot. Since the KHO FDT resides at a physical address allocated during boot (kho_init), its location is stable. We can attach this stable address to the kimage regardless of whether the content has been finalized yet. Relax the check to only require kho_enable, allowing kexec_file_load to proceed at any time. Link: https://lkml.kernel.org/r/20251114190002.3311679-12-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 8e068a286aef7e772ec6e8bb4b82e8a5d4153b55 Author: Pasha Tatashin Date: Fri Nov 14 13:59:59 2025 -0500 kho: update FDT dynamically for subtree addition/removal Currently, sub-FDTs were tracked in a list (kho_out.sub_fdts) and the final FDT is constructed entirely from scratch during kho_finalize(). We can maintain the FDT dynamically: 1. Initialize a valid, empty FDT in kho_init(). 2. Use fdt_add_subnode and fdt_setprop in kho_add_subtree to update the FDT immediately when a subsystem registers. 3. Use fdt_del_node in kho_remove_subtree to remove entries. This removes the need for the intermediate sub_fdts list and the reconstruction logic in kho_finalize(). kho_finalize() now only needs to trigger memory map serialization. Link: https://lkml.kernel.org/r/20251114190002.3311679-11-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 9a4301f715c8c9a3aaab395b98ac1f3908015dcb Author: Pasha Tatashin Date: Fri Nov 14 13:59:58 2025 -0500 kho: remove abort functionality and support state refresh Previously, KHO required a dedicated kho_abort() function to clean up state before kho_finalize() could be called again. This was necessary to handle complex unwind paths when using notifiers. With the shift to direct memory preservation, the explicit abort step is no longer strictly necessary. Remove kho_abort() and refactor kho_finalize() to handle re-entry. If kho_finalize() is called while KHO is already finalized, it will now automatically clean up the previous memory map and state before generating a new one. This allows the KHO state to be updated/refreshed simply by triggering finalize again. Update debugfs to return -EINVAL if userspace attempts to write 0 to the finalize attribute, as explicit abort is no longer supported. Link: https://lkml.kernel.org/r/20251114190002.3311679-10-pasha.tatashin@soleen.com Suggested-by: Mike Rapoport (Microsoft) Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit efa3a9775ac2a869788ac61fccad1efd26cd2d33 Author: Pasha Tatashin Date: Fri Nov 14 13:59:57 2025 -0500 kho: remove global preserved_mem_map and store state in FDT Currently, the serialized memory map is tracked via kho_out.preserved_mem_map and copied to the FDT during finalization. This double tracking is redundant. Remove preserved_mem_map from kho_out. Instead, maintain the physical address of the head chunk directly in the preserved-memory-map FDT property. Introduce kho_update_memory_map() to manage this property. This function handles: 1. Retrieving and freeing any existing serialized map (handling the abort/retry case). 2. Updating the FDT property with the new chunk address. This establishes the FDT as the single source of truth for the handover state. Link: https://lkml.kernel.org/r/20251114190002.3311679-9-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 71960fe1344c432f8d67f6f9b379533496b89f8c Author: Pasha Tatashin Date: Fri Nov 14 13:59:56 2025 -0500 kho: simplify serialization and remove __kho_abort Currently, __kho_finalize() performs memory serialization in the middle of FDT construction. If FDT construction fails later, the function must manually clean up the serialized memory via __kho_abort(). Refactor __kho_finalize() to perform kho_mem_serialize() only after the FDT has been successfully constructed and finished. This reordering has two benefits: 1. It avoids expensive serialization work if FDT generation fails. 2. It removes the need for cleanup in the FDT error path. As a result, the internal helper __kho_abort() is no longer needed for internal error handling. Inline its remaining logic (cleanup of the preserved memory map) directly into kho_abort() and remove the helper. Link: https://lkml.kernel.org/r/20251114190002.3311679-8-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit e268689a528288d5629ee017630186327403cc51 Author: Pasha Tatashin Date: Fri Nov 14 13:59:55 2025 -0500 kho: always expose output FDT in debugfs Currently, the output FDT is added to debugfs only when KHO is finalized and removed when aborted. There is no need to hide the FDT based on the state. Always expose it starting from initialization. This aids the transition toward removing the explicit abort functionality and converting KHO to be fully stateless. Link: https://lkml.kernel.org/r/20251114190002.3311679-7-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 53f8f064eba344c074ef6755347bc4170538275f Author: Pasha Tatashin Date: Fri Nov 14 13:59:54 2025 -0500 kho: verify deserialization status and fix FDT alignment access During boot, kho_restore_folio() relies on the memory map having been successfully deserialized. If deserialization fails or no map is present, attempting to restore the FDT folio is unsafe. Update kho_mem_deserialize() to return a boolean indicating success. Use this return value in kho_memory_init() to disable KHO if deserialization fails. Also, the incoming FDT folio is never used, there is no reason to restore it. Additionally, use get_unaligned() to retrieve the memory map pointer from the FDT. FDT properties are not guaranteed to be naturally aligned, and accessing a 64-bit value via a pointer that is only 32-bit aligned can cause faults. Link: https://lkml.kernel.org/r/20251114190002.3311679-6-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 85de0090bd8256a94812f3be797b55bdbdcf78f5 Author: Pasha Tatashin Date: Fri Nov 14 13:59:53 2025 -0500 kho: preserve FDT folio only once during initialization Currently, the FDT folio is preserved inside __kho_finalize(). If the user performs multiple finalize/abort cycles, kho_preserve_folio() is called repeatedly for the same FDT folio. Since the FDT folio is allocated once during kho_init(), it should be marked for preservation at the same time. Move the preservation call to kho_init() to align the preservation state with the object's lifecycle and simplify the finalize path. Also, pre-zero the FDT tree so we do not expose random bits to the user and to the next kernel by using the new kho_alloc_preserve() api. Link: https://lkml.kernel.org/r/20251114190002.3311679-5-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 4c205677af2726bd3b51c02ab6a5a2b411efed09 Author: Pasha Tatashin Date: Fri Nov 14 13:59:52 2025 -0500 kho: introduce high-level memory allocation API Currently, clients of KHO must manually allocate memory (e.g., via alloc_pages), calculate the page order, and explicitly call kho_preserve_folio(). Similarly, cleanup requires separate calls to unpreserve and free the memory. Introduce a high-level API to streamline this common pattern: - kho_alloc_preserve(size): Allocates physically contiguous, zeroed memory and immediately marks it for preservation. - kho_unpreserve_free(ptr): Unpreserves and frees the memory in the current kernel. - kho_restore_free(ptr): Restores the struct page state of preserved memory in the new kernel and immediately frees it to the page allocator. [pasha.tatashin@soleen.com: build fixes] Link: https://lkml.kernel.org/r/CA+CK2bBgXDhrHwTVgxrw7YTQ-0=LgW0t66CwPCgG=C85ftz4zw@mail.gmail.com Link: https://lkml.kernel.org/r/20251114190002.3311679-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 8c3819f627b74d44f928977413cfe55292eb809b Author: Pasha Tatashin Date: Fri Nov 14 13:59:51 2025 -0500 kho: convert __kho_abort() to return void The internal helper __kho_abort() always returns 0 and has no failure paths. Its return value is ignored by __kho_finalize and checked needlessly by kho_abort. Change the return type to void to reflect that this function cannot fail, and simplify kho_abort by removing dead error handling code. Link: https://lkml.kernel.org/r/20251114190002.3311679-3-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 077a4851b0024e3025e57e428767ce0c7b0359bf Author: Pasha Tatashin Date: Fri Nov 14 13:59:50 2025 -0500 kho: fix misleading log message in kho_populate() Patch series "kho: simplify state machine and enable dynamic updates", v2. This patch series refactors the Kexec Handover subsystem to transition from a rigid, state-locked model to a dynamic, re-entrant architecture. It also introduces usability improvements. Motivation Currently, KHO relies on a strict state machine where memory preservation is locked upon finalization. If a change is required, the user must explicitly "abort" to reset the state. Additionally, the kexec image cannot be loaded until KHO is finalized, and the FDT is rebuilt from scratch on every finalization. This series simplifies this workflow to support "load early, finalize late" scenarios. Key Changes State Machine Simplification: - Removed kho_abort(). kho_finalize() is now re-entrant; calling it a second time automatically flushes the previous serialized state and generates a fresh one. - Removed kho_out.finalized checks from preservation APIs, allowing drivers to add/remove pages even after an initial finalization. - Decoupled kexec_file_load from KHO finalization. The KHO FDT physical address is now stable from boot, allowing the kexec image to be loaded before the handover metadata is finalized. FDT Management: - The FDT is now updated in-place dynamically when subtrees are added or removed, removing the need for complex reconstruction logic. - The output FDT is always exposed in debugfs (initialized and zeroed at boot), improving visibility and debugging capabilities throughout the system lifecycle. - Removed the redundant global preserved_mem_map pointer, establishing the FDT property as the single source of truth. New Features & API Enhancements: - High-Level Allocators: Introduced kho_alloc_preserve() and friends to reduce boilerplate for drivers that need to allocate, preserve, and eventually restore simple memory buffers. - Configuration: Added CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT to allow KHO to be active by default without requiring the kho=on command line parameter. Fixes: - Fixed potential alignment faults when accessing 64-bit FDT properties. - Fixed the lifecycle of the FDT folio preservation (now preserved once at init). This patch (of 13): The log message in kho_populate() currently states "Will skip init for some devices". This implies that Kexec Handover always involves skipping device initialization. However, KHO is a generic mechanism used to preserve kernel memory across reboot for various purposes, such as memfd, telemetry, or reserve_mem. Skipping device initialization is a specific property of live update drivers using KHO, not a property of the mechanism itself. Remove the misleading suffix to accurately reflect the generic nature of KHO discovery. Link: https://lkml.kernel.org/r/20251114190002.3311679-2-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Signed-off-by: Andrew Morton commit 8db839caeed9efc1b80f20db2a128a3dc093426f Author: Zhu Yanjun Date: Sat Nov 1 10:23:25 2025 -0400 liveupdate: kho: use %pe format specifier for error pointer printing Make pr_xxx() call to use the %pe format specifier instead of %d. The %pe specifier prints a symbolic error string (e.g., -ENOMEM, -EINVAL) when given an error pointer created with ERR_PTR(err). This change enhances the clarity and diagnostic value of the error message by showing a descriptive error name rather than a numeric error code. Note, that some err are still printed by value, as those errors might come from libfdt and not regular errnos. Link: https://lkml.kernel.org/r/20251101142325.1326536-10-pasha.tatashin@soleen.com Signed-off-by: Zhu Yanjun Co-developed-by: Pasha Tatashin Signed-off-by: Pasha Tatashin Reviewed-by: Simon Horman Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: "Mike Rapoport (Microsoft)" Cc: Randy Dunlap Cc: Tejun Heo Signed-off-by: Andrew Morton commit c332ebd9c0c4d409599b6d4a49705d449393c77b Author: Pasha Tatashin Date: Sat Nov 1 10:23:24 2025 -0400 MAINTAINERS: update KHO maintainers Changyuan does not have cycles to commit to the upstream work of KHO. Remove from KHO maintainers. Link: https://lkml.kernel.org/r/20251101142325.1326536-9-pasha.tatashin@soleen.com Signed-off-by: Changyuan Lyu Signed-off-by: Pasha Tatashin Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit 48a1b2321d763b5edeaf20bd4576d8c4b5df772b Author: Pasha Tatashin Date: Sat Nov 1 10:23:23 2025 -0400 liveupdate: kho: move to kernel/liveupdate Move KHO to kernel/liveupdate/ in preparation of placing all Live Update core kernel related files to the same place. [pasha.tatashin@soleen.com: disable the menu when DEFERRED_STRUCT_PAGE_INIT] Link: https://lkml.kernel.org/r/CA+CK2bAvh9Oa2SLfsbJ8zztpEjrgr_hr-uGgF1coy8yoibT39A@mail.gmail.com Link: https://lkml.kernel.org/r/20251101142325.1326536-8-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Jason Gunthorpe Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit 99cd2ffac697be7f027344d77beee0dc04dcfdbd Author: Pasha Tatashin Date: Sat Nov 1 10:23:22 2025 -0400 kho: don't unpreserve memory during abort KHO allows clients to preserve memory regions at any point before the KHO state is finalized. The finalization process itself involves KHO performing its own actions, such as serializing the overall preserved memory map. If this finalization process is aborted, the current implementation destroys KHO's internal memory tracking structures (`kho_out.ser.track.orders`). This behavior effectively unpreserves all memory from KHO's perspective, regardless of whether those preservations were made by clients before the finalization attempt or by KHO itself during finalization. This premature unpreservation is incorrect. An abort of the finalization process should only undo actions taken by KHO as part of that specific finalization attempt. Individual memory regions preserved by clients prior to finalization should remain preserved, as their lifecycle is managed by the clients themselves. These clients might still need to call kho_unpreserve_folio() or kho_unpreserve_phys() based on their own logic, even after a KHO finalization attempt is aborted. Link: https://lkml.kernel.org/r/20251101142325.1326536-7-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: "Mike Rapoport (Microsoft)" Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit ce405ed5102018946f20b69c1e7ae49697dcf616 Author: Pasha Tatashin Date: Sat Nov 1 10:23:21 2025 -0400 test_kho: unpreserve memory in case of error If there is an error half way through KHO memory preservation, we should rollback and unpreserve everything that is partially preserved. Link: https://lkml.kernel.org/r/20251101142325.1326536-6-pasha.tatashin@soleen.com Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Pasha Tatashin Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit f5bfd4793a933c7074b0d3748068b255d232bfa0 Author: Pasha Tatashin Date: Sat Nov 1 10:23:20 2025 -0400 memblock: unpreserve memory in case of error If there is an error half way through KHO memory preservation, we should rollback and unpreserve everything that is partially preserved. [akpm@linux-foundation.org: s/err_no_fdt_page/err_report/ in prepare_kho_fdt(), per Mike] Link: https://lkml.kernel.org/r/20251101142325.1326536-5-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Suggested-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit 36f8f7ef7fd2f238922e9d217e86c69838319d8c Author: Pasha Tatashin Date: Sat Nov 1 10:23:19 2025 -0400 kho: add interfaces to unpreserve folios, page ranges, and vmalloc Allow users of KHO to cancel the previous preservation by adding the necessary interfaces to unpreserve folio, pages, and vmallocs. Link: https://lkml.kernel.org/r/20251101142325.1326536-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit 70f9133096c833922c3b63461480248cefa7bb0f Author: Mike Rapoport (Microsoft) Date: Sat Nov 1 10:23:18 2025 -0400 kho: drop notifiers The KHO framework uses a notifier chain as the mechanism for clients to participate in the finalization process. While this works for a single, central state machine, it is too restrictive for kernel-internal components like pstore/reserve_mem or IMA. These components need a simpler, direct way to register their state for preservation (e.g., during their initcall) without being part of a complex, shutdown-time notifier sequence. The notifier model forces all participants into a single finalization flow and makes direct preservation from an arbitrary context difficult. This patch refactors the client participation model by removing the notifier chain and introducing a direct API for managing FDT subtrees. The core kho_finalize() and kho_abort() state machine remains, but clients now register their data with KHO beforehand. Link: https://lkml.kernel.org/r/20251101142325.1326536-3-pasha.tatashin@soleen.com Signed-off-by: Mike Rapoport (Microsoft) Co-developed-by: Pasha Tatashin Signed-off-by: Pasha Tatashin Cc: Alexander Graf Cc: Changyuan Lyu Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Pratyush Yadav Cc: Randy Dunlap Cc: Simon Horman Cc: Tejun Heo Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit 03d3963464a43654703938a66503cd686c5fc54e Author: Pasha Tatashin Date: Sat Nov 1 10:23:17 2025 -0400 kho: make debugfs interface optional Patch series "liveupdate: Rework KHO for in-kernel users", v9. This series refactors the KHO framework to better support in-kernel users like the upcoming LUO. The current design, which relies on a notifier chain and debugfs for control, is too restrictive for direct programmatic use. The core of this rework is the removal of the notifier chain in favor of a direct registration API. This decouples clients from the shutdown-time finalization sequence, allowing them to manage their preserved state more flexibly and at any time. In support of this new model, this series also: - Makes the debugfs interface optional. - Introduces APIs to unpreserve memory and fixes a bug in the abort path where client state was being incorrectly discarded. Note that this is an interim step, as a more comprehensive fix is planned as part of the stateless KHO work [1]. - Moves all KHO code into a new kernel/liveupdate/ directory to consolidate live update components. This patch (of 9): Currently, KHO is controlled via debugfs interface, but once LUO is introduced, it can control KHO, and the debug interface becomes optional. Add a separate config CONFIG_KEXEC_HANDOVER_DEBUGFS that enables the debugfs interface, and allows to inspect the tree. Move all debugfs related code to a new file to keep the .c files clear of ifdefs. Link: https://lkml.kernel.org/r/20251101142325.1326536-1-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20251101142325.1326536-2-pasha.tatashin@soleen.com Link: https://lore.kernel.org/all/20251020100306.2709352-1-jasonmiu@google.com [1] Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Cc: Alexander Graf Cc: Christian Brauner Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Miguel Ojeda Cc: Randy Dunlap Cc: Tejun Heo Cc: Changyuan Lyu Cc: Jason Gunthorpe Cc: Simon Horman Cc: Zhu Yanjun Signed-off-by: Andrew Morton commit e6fbd1759c9ece5044d3470f30a5e2166dc9de89 Author: Bala-Vignesh-Reddy Date: Thu Oct 16 16:14:09 2025 +0530 selftests: complete kselftest include centralization This follow-up patch completes centralization of kselftest.h and ksefltest_harness.h includes in remaining seltests files, replacing all relative paths with a non-relative paths using shared -I include path in lib.mk Tested with gcc-13.3 and clang-18.1, and cross-compiled successfully on riscv, arm64, x86_64 and powerpc arch. [reddybalavignesh9979@gmail.com: add selftests include path for kselftest.h] Link: https://lkml.kernel.org/r/20251017090201.317521-1-reddybalavignesh9979@gmail.com Link: https://lkml.kernel.org/r/20251016104409.68985-1-reddybalavignesh9979@gmail.com Signed-off-by: Bala-Vignesh-Reddy Suggested-by: Andrew Morton Link: https://lore.kernel.org/lkml/20250820143954.33d95635e504e94df01930d0@linux-foundation.org/ Reviewed-by: Wei Yang Cc: David Hildenbrand Cc: David S. Miller Cc: Eric Dumazet Cc: Günther Noack Cc: Jakub Kacinski Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mickael Salaun Cc: Ming Lei Cc: Paolo Abeni Cc: Shuah Khan Cc: Simon Horman Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 262ef8e55b7ccd435619c1946249131d0f5b72db Author: Mateusz Guzik Date: Thu Nov 20 06:40:15 2025 +0100 fork: stop ignoring NUMA while handling cached thread stacks 1. the numa parameter was straight up ignored. 2. nothing was done to check if the to-be-cached/allocated stack matches the local node The id remains ignored on free in case of memoryless nodes. Note the current caching is already bad as the cache keeps overflowing and a different solution is needed for the long run, to be worked out(tm). Stats collected over a kernel build with the patch with the following topology: NUMA node(s): 2 NUMA node0 CPU(s): 0-11 NUMA node1 CPU(s): 12-23 caller's node vs stack backing pages on free: matching: 50083 (70%) mismatched: 21492 (30%) caching efficiency: cached: 32651 (65.2%) dropped: 17432 (34.8%) Link: https://lkml.kernel.org/r/20251120054015.3019419-1-mjguzik@gmail.com Signed-off-by: Mateusz Guzik Reviewed-by: Linus Walleij Cc: Liam Howlett Cc: Linus Waleij Cc: Lorenzo Stoakes Cc: Pasha Tatashin Cc: Kees Cook Cc: Oleg Nesterov Signed-off-by: Andrew Morton commit 94984bfed58ca129f7e259ce09973ed0b3f540a8 Author: Eric Dumazet Date: Fri Nov 14 14:06:46 2025 +0000 rbtree: inline rb_last() This is a very small function, inlining it saves cpu cycles in TCP by reducing register pressure and removing call/ret overhead. It also reduces vmlinux text size by 122 bytes on a typical x86_64 build. Before: size vmlinux text data bss dec hex filename 34811781 22177365 5685248 62674394 3bc55da vmlinux After: size vmlinux text data bss dec hex filename 34811659 22177365 5685248 62674272 3bc5560 vmlinux [ojeda@kernel.org: fix rust build] Link: https://lkml.kernel.org/r/20251120085518.1463498-1-ojeda@kernel.org Link: https://lkml.kernel.org/r/20251114140646.3817319-3-edumazet@google.com Signed-off-by: Eric Dumazet Signed-off-by: Miguel Ojeda Reviewed-by: Kuan-Wei Chiu Cc: Jakub Kacinski Cc: Neal Cardwell Cc: Paolo Abeni Cc: Alice Ryhl Cc: Stehen Rothwell Signed-off-by: Andrew Morton commit c2d2dad24503d7e2eb7cba354fcc73f95fa78d7a Author: Eric Dumazet Date: Fri Nov 14 14:06:45 2025 +0000 rbtree: inline rb_first() Patch series "rbree: inline rb_first() and rb_last()". Inline these two small helpers, heavily used in TCP and FQ packet scheduler, and in many other places. This reduces kernel text size, and brings an 1.5 % improvement on network TCP stress test. This patch (of 2): This is a very small function, inlining it saves cpu cycles by reducing register pressure and removing call/ret overhead. It also reduces vmlinux text size by 744 bytes on a typical x86_64 build. Before: size vmlinux text data bss dec hex filename 34812525 22177365 5685248 62675138 3bc58c2 vmlinux After: size vmlinux text data bss dec hex filename 34811781 22177365 5685248 62674394 3bc55da vmlinux [ojeda@kernel.org: fix rust build] Link: https://lkml.kernel.org/r/20251120085518.1463498-1-ojeda@kernel.org Link: https://lkml.kernel.org/r/20251114140646.3817319-1-edumazet@google.com Link: https://lkml.kernel.org/r/20251114140646.3817319-2-edumazet@google.com Signed-off-by: Eric Dumazet Signed-off-by: Miguel Ojeda Reviewed-by: Kuan-Wei Chiu Cc: Jakub Kacinski Cc: Neal Cardwell Cc: Paolo Abeni Cc: Alice Ryhl Cc: Stehen Rothwell Signed-off-by: Andrew Morton commit bc947af67759c2d229e31af9bf232f9ade6145d8 Merge: 58b6fcd2ab3439 7c9580f44f90f7 Author: Andrew Morton Date: Thu Nov 27 14:17:02 2025 -0800 Merge branch 'mm-hotfixes-stable' into mm-nonmm-stable in order to be able to merge "kho: make debugfs interface optional" into mm-nonmm-stable. commit 00de4ef9d3abc0b195988c23aea2fefe5f76d3c4 Merge: 1a263d3a70b9c8 3187e25eb2705d Author: Arnd Bergmann Date: Thu Nov 27 23:03:33 2025 +0100 Merge tag 'riscv-config-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/defconfig RISC-V config for v6.19 Spacemit: The Spacemit k1 wants the freescale qspi driver enabled as a module as they appear to be rather similar IPs. Signed-off-by: Conor Dooley * tag 'riscv-config-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: defconfig: enable SPI_FSL_QUADSPI as a module Signed-off-by: Arnd Bergmann commit 8e2baac0f2bb5ceff5858ac89eff04a67c98b789 Merge: 909752d392bb5e 055bcc552b5181 Author: Arnd Bergmann Date: Thu Nov 27 23:00:45 2025 +0100 Merge tag 'cache-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers-late standalone cache drivers for v6.19 ccache: Add a compatible for the pic64gx SoC. No driver change needed, as it falls back to the PolarFire SoC. hisi hha/generic cpu cache maintenance: Add support for a non-architectural mechanism for invalidating memory regions, needed for some cxl implementations on arm64 (and probably elsewhere in the future). The HiSilicon Hydra Home Agent is the first driver to provide this support. Signed-off-by: Conor Dooley * tag 'cache-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: MAINTAINERS: refer to intended file in STANDALONE CACHE CONTROLLER DRIVERS cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent cache: Make top level Kconfig menu a boolean dependent on RISCV MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header arm64: Select GENERIC_CPU_CACHE_MAINTENANCE lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() dt-bindings: cache: sifive,ccache0: add a pic64gx compatible Signed-off-by: Arnd Bergmann commit 909752d392bb5ed018df622ce0ae6ad6fca2b233 Merge: aa3294ff417bd6 66c6ceb41ed375 Author: Arnd Bergmann Date: Thu Nov 27 22:59:40 2025 +0100 Merge tag 'soc-drivers-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers-late RISC-V soc-drivers for v6.19 Microchip: Add bindings and mfd drivers for two syscon regions on PolarFire SoC, needed as part of a rework of the devicetree to permit supporting, among other things, pinctrl sanely and avoiding the "new" pic64gx SoC ever using the original incorrect clock nodes. Fiddle with the Microchip RISC-V MAINTAINERS entry to add these drivers and avoid branding it FPGA only. Signed-off-by: Conor Dooley * tag 'soc-drivers-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: MAINTAINERS: rename Microchip RISC-V entry MAINTAINERS: add new soc drivers to Microchip RISC-V entry soc: microchip: add mfd drivers for two syscon regions on PolarFire SoC dt-bindings: soc: microchip: document the simple-mfd syscon on PolarFire SoC Signed-off-by: Arnd Bergmann commit aa3294ff417bd6503f46353c3e378c3fbbed827d Merge: 16cc3988cc36b9 f95f3bceade259 Author: Arnd Bergmann Date: Thu Nov 27 22:58:57 2025 +0100 Merge tag 'apple-soc-drivers-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/drivers-late Apple SoC driver updates for 6.18 Two small fixes: - mailbox: Stop leaking a reference to the mbox platform device during lookup - sart: drop device reference after lookup since it's no longer used afterwards Signed-off-by: Sven Peter * tag 'apple-soc-drivers-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: soc: apple: sart: drop device reference after lookup soc: apple: mailbox: fix device leak on lookup Signed-off-by: Arnd Bergmann commit 16cc3988cc36b9fc5312970bfa230e1f89d6818e Merge: e9191aa446f0d3 760b8eec2cf861 Author: Arnd Bergmann Date: Thu Nov 27 22:57:51 2025 +0100 Merge tag 'soc_fsl-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into soc/drivers-late FSL SOC Changes for 6.19 - A couple misc changes to fsl/qbman - Update email address for Christophe Leroy in MAINTAINERS * tag 'soc_fsl-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux: soc: fsl: qbman: use kmalloc_array() instead of kmalloc() soc: fsl: qbman: add WQ_PERCPU to alloc_workqueue users MAINTAINERS: Update email address for Christophe Leroy Signed-off-by: Arnd Bergmann commit e9191aa446f0d37f48dfd825e9cd33f85ef57479 Merge: 3d892259d12789 ba8abbdfd09e64 Author: Arnd Bergmann Date: Thu Nov 27 22:57:07 2025 +0100 Merge tag 'amlogic-drivers-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers-late Amlogic Drivers for v6.19: - Canvas device leak fix and error handling simplification - Add more SoCs definitions - Suport more SoCs for meson-gx-ao-secure * tag 'amlogic-drivers-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: soc: amlogic: meson-gx-socinfo: add new SoCs id dt-bindings: arm: amlogic: meson-gx-ao-secure: support more SoCs soc: amlogic: canvas: simplify lookup error handling soc: amlogic: canvas: fix device leak on lookup Signed-off-by: Arnd Bergmann commit 8c8e3df3d2f51e9a3f6f1a1112adf250f7652d42 Author: Thorsten Blum Date: Mon Oct 27 23:33:00 2025 +0100 keys: Fix grammar and formatting in 'struct key_type' comments s/it/if/ and s/revokation/revocation/, capitalize "clear", and add a period after the sentence. Fix the comment formatting. Signed-off-by: Thorsten Blum Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 3d892259d127896cb92f9f9b5953ac3bc82a0b23 Merge: dc567f36f9adcb 527250cd909246 Author: Arnd Bergmann Date: Thu Nov 27 22:54:36 2025 +0100 Merge tag 'reset-gpio-for-v6.19-2' of https://git.pengutronix.de/git/pza/linux into soc/drivers-late Reset/GPIO/swnode changes for v6.19 (v2) * Fix chtwc_int33fe build issue since commit d7cdbbc93c56 ("software node: allow referencing firmware nodes"). * tag 'reset-gpio-for-v6.19-2' of https://git.pengutronix.de/git/pza/linux: platform/x86: intel: chtwc_int33fe: don't dereference swnode args Signed-off-by: Arnd Bergmann commit dc567f36f9adcb63b75c045a26b9dbb77c812472 Merge: 6a23ae0a96a600 5fc4e4cf7a2268 Author: Arnd Bergmann Date: Thu Nov 27 22:53:01 2025 +0100 Merge tag 'reset-gpio-for-v6.19' of https://git.pengutronix.de/git/pza/linux into soc/drivers-late Reset/GPIO/swnode changes for v6.19 * Extend software node implementation, allowing its properties to reference existing firmware nodes. * Update the GPIO property interface to use reworked swnode macros. * Rework reset-gpio code to use GPIO lookup via swnode. * Fix spi-cs42l43 driver to work with swnode changes. * tag 'reset-gpio-for-v6.19' of https://git.pengutronix.de/git/pza/linux: reset: gpio: use software nodes to setup the GPIO lookup reset: gpio: convert the driver to using the auxiliary bus reset: make the provider of reset-gpios the parent of the reset device reset: order includes alphabetically in reset/core.c gpio: swnode: allow referencing GPIO chips by firmware nodes spi: cs42l43: Use actual ACPI firmware node for chip selects software node: allow referencing firmware nodes software node: increase the reference of the swnode by its fwnode software node: read the reference args via the fwnode API Signed-off-by: Arnd Bergmann commit d7ad87d47eaf82c4204a567f863cdf7eedb2d120 Merge: a9277a860a1635 f458fc9b1946bc Author: Mark Brown Date: Thu Nov 27 21:50:51 2025 +0000 spi: microchip-core: Code improvements Merge series from Andy Shevchenko : While reading some other stuff, I noticed that this driver may be improved. Here is the set of refactoring and cleaning it up. commit a76e1d951f530385ef8e62ed904a496d3203045d Merge: f2b4592300d0ff 56736543b570a1 Author: Mark Brown Date: Thu Nov 27 21:50:47 2025 +0000 ASoC: Intel: catpt: Round of fixes and PM changes Merge series from Cezary Rojewski : Set of changes addressing gaps in DRAM offset checks, error paths and PM. The first three patches are straight-forward, the last three relate to the power management. The standing out PM change is removal of the catpt-driver as a system-suspend (S3) blocker. This is a suggestion from Andy as indeed, audio is not a critical component that should prevent the system from going into S3. Whatever happens, the driver can recover on a follow up resume (S3 -> S0). commit f2b4592300d0ff9a9ac7bc547119e47dbae5dd29 Merge: 86dc090f737953 1e645bca9d1e4c Author: Mark Brown Date: Thu Nov 27 21:50:42 2025 +0000 Add support for cs42l45 into the Intel machine driver Merge series from Charles Keepax : Now that the full class driver is in place we can add support to the Intel machine driver for Cirrus's new SDCA audio CODEC the cs42l45. This makes some minor tweaks to the machine driver itself to support SDCA devices, and then adds the necessary tables etc. to define the device. Note, this series shouldn't have any dependencies on the other series of improvements to the class driver that is already on the list. So either can be merged first. commit a0a76e3f8d9a0da679ea721decd26f8951eb2110 Author: Thorsten Blum Date: Mon Oct 13 17:26:28 2025 +0200 keys: Replace deprecated strncpy in ecryptfs_fill_auth_tok strncpy() is deprecated for NUL-terminated destination buffers; use strscpy_pad() instead to retain the NUL-padding behavior of strncpy(). The destination buffer is initialized using kzalloc() with a 'signature' size of ECRYPTFS_PASSWORD_SIG_SIZE + 1. strncpy() then copies up to ECRYPTFS_PASSWORD_SIG_SIZE bytes from 'key_desc', NUL-padding any remaining bytes if needed, but expects the last byte to be zero. strscpy_pad() also copies the source string to 'signature', and NUL-pads the destination buffer if needed, but ensures it's always NUL-terminated without relying on it being zero-initialized. strscpy_pad() automatically determines the size of the fixed-length destination buffer via sizeof() when the optional size argument is omitted, making an explicit size unnecessary. In encrypted_init(), the source string 'key_desc' is validated by valid_ecryptfs_desc() before calling ecryptfs_fill_auth_tok(), and is therefore NUL-terminated and satisfies the __must_be_cstr() requirement of strscpy_pad(). Link: https://github.com/KSPP/linux/issues/90 Signed-off-by: Thorsten Blum Reviewed-by: Kees Cook Reviewed-by: Jarkko Sakkinen Reviewed-by: Paul Menzel Signed-off-by: Jarkko Sakkinen commit 58b46219bfcf1906b795307372b0d50d65115026 Author: Thorsten Blum Date: Sat Oct 11 16:48:24 2025 +0200 keys: Remove redundant less-than-zero checks The local variables 'size_t datalen' are unsigned and cannot be less than zero. Remove the redundant conditions. Signed-off-by: Thorsten Blum Reviewed-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen commit 3aa9940035a17edd4dba87da90a23c4b13cff121 Merge: ce48af13e63817 5b70764e10190d Author: Arnd Bergmann Date: Thu Nov 27 22:49:31 2025 +0100 Merge tag 'riscv-dt-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Devicetrees for v6.19 MAINTAINERS: There's some re-jigging of things to reduce duplication, by moving me into the StarFive entry and my tree into the Microchip one. The other platforms that I look after (SiFive and Canaan) are marked as Odd Fixes to better represent their status. Nothing functionally changes. Microchip: Add adc and mmc nodes for the Beagle-V Fire. SiFive: Add pwm fans to the unmatched board. StarFive: Add the Orange PI RV board, another VisionFive 2 derived SBC. This required moving a mmc related nodes out of the common file, into .dts. Yet more things moved out of the common file when the VisionFive 2 Lite boards were added, which use the JH7110S SoC instead of the JH7110. The difference here between SoCs is just temperature and frequency ranges, but the boards differ enough that the pool of common nodes decreases a little further. There's an eMMC and an SD variant here, that are different SKUs, bringing the total new StarFive boards to three. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: starfive: add Orange Pi RV dt-bindings: riscv: starfive: add xunlong,orangepi-rv riscv: dts: starfive: Add VisionFive 2 Lite eMMC board device tree riscv: dts: starfive: Add VisionFive 2 Lite board device tree riscv: dts: starfive: Add common board dtsi for VisionFive 2 Lite variants riscv: dts: starfive: jh7110-common: Move out some nodes to the board dts dt-bindings: riscv: Add StarFive JH7110S SoC and VisionFive 2 Lite board MAINTAINERS: degrade RISC-V MISC SOC SUPPORT to Odd Fixes MAINTAINERS: add tree to RISC-V Microchip entry MAINTAINERS: remove patchwork from RISC-V MISC SOC SUPPORT MAINTAINERS: add Conor to StarFive entry riscv: dts: sifive: unmatched: Add PWM controlled fans riscv: dts: microchip: enable qspi adc/mmc-spi-slot on BeagleV Fire dts: starfive: jh7110-common: split out mmc0 reset pins from common into boards Signed-off-by: Arnd Bergmann commit ce48af13e6381772cc27676be63a6d9176c14a49 Author: Chen-Yu Tsai Date: Thu Nov 27 18:00:42 2025 +0800 arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 The base address of JPEG decoder core 1 should start at 0x10000, and have a size of 0x10000, i.e. it is right after core 0. Instead the core has the same base address as core 0, and with a crazy large size. This looks like a mixup of address and size cells when the ranges were converted. This causes the kernel to fail to register the second core due to sysfs name conflicts: sysfs: cannot create duplicate filename '/devices/platform/soc/soc:jpeg-decoder@1a040000/1a040000.jpgdec' Fix up the address range. Fixes: a9eac43d039f ("arm64: dts: mediatek: mt8195: Fix ranges for jpeg enc/decoder nodes") Signed-off-by: Chen-Yu Tsai Acked-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20251127100044.612825-1-wenst@chromium.org Signed-off-by: Arnd Bergmann commit 6038f30aa8984916b889786f39c503bc0666966f Merge: feae664d3afb9e a7ab6f946683e0 Author: Arnd Bergmann Date: Thu Nov 27 22:46:41 2025 +0100 Merge tag 'amlogic-arm64-dt-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT Changes for v6.19: - Fix the PCIe DBI memory region name - Add ISP nodes for Amlogic C3 - Add power controller nodes for Amlogic S6/S7/S7D - Add Pinctrl node for Amlogic A4 - Add AO Secure node for Amlogic S6/S7/S7D - Add GPIO Interrupt node for Amlogic S6/S7/S7D - Fix S922X cache layout - New Boards: - Tanix TX9 Pro * tag 'amlogic-arm64-dt-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs arm64: dts: Add gpio_intc node for Amlogic S7D SoCs arm64: dts: Add gpio_intc node for Amlogic S7 SoCs arm64: dts: Add gpio_intc node for Amlogic S6 SoCs arm64: dts: amlogic: s7d: add ao secure node arm64: dts: amlogic: s7: add ao secure node arm64: dts: amlogic: s6: add ao secure node arm64: dts: amlogic: Fix the register name of the 'DBI' region dts: arm64: amlogic: add a5 pinctrl node arm64: dts: amlogic: s7d: add power domain controller node arm64: dts: amlogic: s7: add power domain controller node arm64: dts: amlogic: s6: add power domain controller node dts: arm64: amlogic: Add ISP related nodes for C3 arm64: dts: meson: add initial device-tree for Tanix TX9 Pro dt-bindings: arm: amlogic: add support for Tanix TX9 Pro Signed-off-by: Arnd Bergmann commit 1a22e175b311900691e27c8ebae9ebb3387b98bf Merge: 578d6aab14899e 57dc2ea0b7bdb8 Author: Dave Airlie Date: Fri Nov 28 06:49:40 2025 +1000 Merge tag 'drm-rust-next-2025-11-21' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next Core Changes: - Fix warning in documentation builds on older rustc versions. Signed-off-by: Dave Airlie From: Alice Ryhl Link: https://patch.msgid.link/aSA5pshsJ7TeJIbu@google.com commit 578d6aab14899ef782e1605b31707219ee710048 Merge: 611d4d160616a8 dcb171931954c5 Author: Dave Airlie Date: Fri Nov 28 06:46:35 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - A couple of SR-IOV fixes (Michal Winiarski) - Fix a potential UAF (Sanjay) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aSA08EW9JMU3LkIu@fedora commit db4029859d6fd03f0622d394f4cdb1be86d7ec62 Merge: 73f784b2c938e1 1f5e808aa63af6 Author: Jakub Kicinski Date: Thu Nov 27 12:16:40 2025 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Conflicts: net/xdp/xsk.c 0ebc27a4c67d ("xsk: avoid data corruption on cq descriptor number") 8da7bea7db69 ("xsk: add indirect call for xsk_destruct_skb") 30ed05adca4a ("xsk: use a smaller new lock for shared pool case") https://lore.kernel.org/20251127105450.4a1665ec@canb.auug.org.au https://lore.kernel.org/eb4eee14-7e24-4d1b-b312-e9ea738fefee@kernel.org Signed-off-by: Jakub Kicinski commit 1e645bca9d1e4c5970778114d2d9fc247fe12e7b Author: Charles Keepax Date: Thu Nov 27 16:34:26 2025 +0000 ASoC: intel: sof_sdw: Add codec_info for cs42l45 Add support for the Cirrus Logic CS42L45 standalone using SoundWire. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-8-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 3f6b562f2107ab2467908fa1543e1a6ea8442bd1 Author: Charles Keepax Date: Thu Nov 27 16:34:25 2025 +0000 ASoC: sdw_utils: Add cs42l45 support functions Add the helper functions into the machine driver for the cs42l45, this will register a jack for jack detection and add things into to the components string if they are needed. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit c66297d09e1a5813eb743bae8cda4e115b8a5c56 Author: Charles Keepax Date: Thu Nov 27 16:34:24 2025 +0000 ASoC: intel: sof_sdw: Add ability to have auxiliary devices Currently the sof_sdw machine driver assumes that all devices involved in the sound card are connected through a DAI link. However for SDCA devices we still want the HID (Human Interface Device, used for jack buttons) to be part of the sound card, but it contains no DAI links. Add support into the machine driver to specify a list of auxiliary devices to merged into the card. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 2ae4659533d8e2b5e06e8f570e2b4b7b88ae0716 Author: Charles Keepax Date: Thu Nov 27 16:34:23 2025 +0000 ASoC: sdw_utils: Move codec_name to dai info As SDCA devices will support each DAI link on a different child device, move the codec name from codec_info to each dai_info. To allow the appropriate function device to be bound to each DAI link. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 26ee34d2f5c7fba968fcc2f1fd94110e1c1660db Author: Charles Keepax Date: Thu Nov 27 16:34:22 2025 +0000 ASoC: sdw_utils: Add codec_conf for every DAI The assumption so far is that all the DAI links for a given audio part would be on the same device. However, as SDCA implements each audio function on a separate auxiliary driver this will no longer be true. This means it is necessary to add additional codec_conf structures to get the prefix for an audio part to apply to all the auxiliary drivers that make up that part. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 48fa77af2f4a55ab961520f2a0e50560dc0baca8 Author: Charles Keepax Date: Thu Nov 27 16:34:21 2025 +0000 ASoC: SDCA: Add terminal type into input/output widget name There have been some complaints around the UCM files for SDCA devices that the control system is quite hard to follow. This is definitely true without the specification handy the naming can be a little cryptic. However, as most of the information is parsed from DisCo there are some limits to what the driver can safely do to improve this. However, one area that can be improved is the non-streaming input/output terminals. These have a field (enum sdca_terminal_type) that describes the usage of that terminal. These types can be appended to the entity name to give the users a better clue as to the purpose. For example "OT 43", would now become "OT 43 Headphone". This would follow through into the jack controls which would change from "OT 43 Jack" to "OT 43 Headphone Jack", making the purpose much more obvious to the user. This provides slightly more readable controls without relying on implicit knowledge that individual parts might not conform to. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 5fee9edf791a50182382fae23f30690c93e16cec Author: Charles Keepax Date: Thu Nov 27 16:34:20 2025 +0000 ASoC: SDCA: Align mute controls to ALSA expectations Currently mute controls will be called "FU xx Mute Switch" (note the switch is added programmatically outside the coverage of this patch) and the accompanying volume control would be called "FU xx Channel Volume". These names are taken from the SDCA specification, however, this does not mesh well with the ALSA naming system. ALSA generally expects enables rather than mutes and expects that mutes and volumes have matching names. Update the names and invert the mute controls to make them more standard "FU XX Channel Switch", this does slightly deviate from the SDCA specification but it makes the rest of the Linux ecosystem a lot happier. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251127163426.2500633-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 0cc15a10c3b4ab14cd71b779fd5c9ca0cb2bc30d Author: sparkhuang Date: Thu Nov 27 10:57:16 2025 +0800 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex regulator_supply_alias_list was accessed without any locking in regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias(). Concurrent registration, unregistration and lookups can race, leading to: 1 use-after-free if an alias entry is removed while being read, 2 duplicate entries when two threads register the same alias, 3 inconsistent alias mappings observed by consumers. Protect all traversals, insertions and deletions on regulator_supply_alias_list with the existing regulator_list_mutex. Fixes: a06ccd9c3785f ("regulator: core: Add ability to create a lookup alias for supply") Signed-off-by: sparkhuang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251127025716.5440-1-huangshaobo3@xiaomi.com Signed-off-by: Mark Brown commit 27abb1ee5a4e02a5314423371dafaf41499314a5 Author: Ben Horgan Date: Tue Nov 25 10:27:32 2025 +0000 arm64/sysreg: Remove unused define ARM64_FEATURE_FIELD_BITS The define ARM64_FEATURE_FIELD_BITS is now unused and feature id fields don't always have 4 bits. Remove it. Signed-off-by: Ben Horgan Acked-by: Marc Zyngier Signed-off-by: Catalin Marinas commit 4138cc63d3efdd77de799aafb0bd183e1d655a0f Author: Ben Horgan Date: Tue Nov 25 10:12:07 2025 +0000 KVM: arm64: selftests: Consider all 7 possible levels of cache In test_clidr() if an empty cache level is not found then the TEST_ASSERT will not fire. Fix this by considering all 7 possible levels when iterating through the hierarchy. Found by inspection. Signed-off-by: Ben Horgan Acked-by: Marc Zyngier Acked-by: Oliver Upton Signed-off-by: Catalin Marinas commit bf09ee918053edec7efeb2f9977b53b02e029553 Author: Ben Horgan Date: Tue Nov 25 10:12:06 2025 +0000 KVM: arm64: selftests: Remove ARM64_FEATURE_FIELD_BITS and its last user ARM64_FEATURE_FIELD_BITS is set to 4 but not all ID register fields are 4 bits. See for instance ID_AA64SMFR0_EL1. The last user of this define, ARM64_FEATURE_FIELD_BITS, is the set_id_regs selftest. Its logic assumes the fields aren't a single bits; assert that's the case and stop using the define. As there are no more users, ARM64_FEATURE_FIELD_BITS is removed from the arm64 tools sysreg.h header. A separate commit removes this from the kernel version of the header. Signed-off-by: Ben Horgan Acked-by: Marc Zyngier Acked-by: Oliver Upton Signed-off-by: Catalin Marinas commit c86d9f8764ba2ffa4e19cca40918c12ccc3ad909 Author: Seongsu Park Date: Wed Nov 26 11:10:25 2025 +0900 arm64: atomics: lse: Remove unused parameters from ATOMIC_FETCH_OP_AND macros The ATOMIC_FETCH_OP_AND and ATOMIC64_FETCH_OP_AND macros accept 'mb' and 'cl' parameters but never use them in their implementation. These macros simply delegate to the corresponding andnot functions, which handle the actual atomic operations and memory barriers. Signed-off-by: Seongsu Park Acked-by: Mark Rutland Signed-off-by: Catalin Marinas commit 41bdec133dc0b79e152f8dda0bf2f71a5abb5838 Author: Miquel Raynal Date: Wed Nov 19 20:33:57 2025 +0100 mtd: nand: realtek-ecc: Fix Kconfig dependencies The driver uses DMA but does not mark it as a prerequisite in Kconfig. As it is also defined with COMPILE_TEST, autobuilders complain about certain symbols not being available when linking on architectures without DMA support (?) like sh. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511071114.8WeW2GZK-lkp@intel.com Cc: Markus Stockhausen Signed-off-by: Miquel Raynal commit c67c7ee7d5a522d7d38cbc0102315f07322c7c82 Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:59 2025 +0100 mtd: rawnand: sunxi: #undef field_{get,prep}() before local definition Prepare for the advent of globally available common field_get() and field_prep() macros by undefining the symbols before defining local variants. This prevents redefinition warnings from the C preprocessor when introducing the common macros later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven commit a9277a860a1635b91fc2cc314ac1d04d7d3971c5 Merge: 625f43be3f5096 de59a8a3a1aab3 Author: Mark Brown Date: Thu Nov 27 17:08:58 2025 +0000 spi: airoha: add support of en7523 SoC (for 6.19) Merge series from Mikhail Kshevetskiy : Airoha EN7523 snfi controller almost identical to AN7581 one, so the same driver can be used. The only known difference appears in the very specific boot conditions, when attached serial console force EN7523 SoC boots in undocumented (reserved) mode. In this mode dma reading of the flash works incorrectly. This patch series: * add support of EN7523 SoC * add spinand node to en7523 dts (so spinand flash finally becomes usable) * updates dt-bindings to mark driver as compatible with en7523 * disable dma usage to prevent possible data damage if booting in reserved mode was detected. commit 86dc090f737953f16f8dc60c546ae7854690d4f6 Author: Johan Hovold Date: Thu Nov 27 14:50:57 2025 +0100 ASoC: codecs: wcd939x: fix regmap leak on probe failure The soundwire regmap that may be allocated during probe is not freed on late probe failures. Add the missing error handling. Fixes: be2af391cea0 ("ASoC: codecs: Add WCD939x Soundwire devices driver") Cc: stable@vger.kernel.org # 6.9 Cc: Neil Armstrong Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251127135057.2216-1-johan@kernel.org Signed-off-by: Mark Brown commit 6797540c8b76dd847466b9a8d6e635e6a2ac95d3 Author: Richard Fitzgerald Date: Thu Nov 27 15:58:17 2025 +0000 ASoC: cs-amp-lib: Use __free(kfree) instead of manual freeing Use the __free(kfree) cleanup to replace instances of manually calling kfree(). Also make some code path simplifications that this allows. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251127155817.1374079-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 02f0ad8e8de8cf5344f8f0fa26d9529b8339da47 Author: Johan Hovold Date: Thu Nov 27 14:43:51 2025 +0100 hwmon: (max6697) fix regmap leak on probe failure The i2c regmap allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind. Fixes: 3a2a8cc3fe24 ("hwmon: (max6697) Convert to use regmap") Cc: stable@vger.kernel.org # 6.12 Cc: Guenter Roeck Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20251127134351.1585-1-johan@kernel.org Signed-off-by: Guenter Roeck commit f458fc9b1946bc882a217d65bfe5ba50787f253f Author: Andy Shevchenko Date: Wed Nov 26 08:54:44 2025 +0100 spi: microchip-core: Remove unneeded PM related macro Static declaration by default are 0 or NULL, no need to initialise them explicitly. Remove unneeded PM related macro. Signed-off-by: Andy Shevchenko Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/20251126075558.2035012-7-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 4db5a0705b1e03abb6ff4e7d7789b32c31384429 Author: Andy Shevchenko Date: Wed Nov 26 08:54:43 2025 +0100 spi: microchip-core: Use SPI_MODE_X_MASK Use SPI_MODE_X_MASK instead of open coded variant. Signed-off-by: Andy Shevchenko Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/20251126075558.2035012-6-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 06b010d3c778075108041074a8fb785074231ac4 Author: Andy Shevchenko Date: Wed Nov 26 08:54:42 2025 +0100 spi: microchip-core: Utilise temporary variable for struct device Add a temporary variable to keep a pointer to struct device. Utilise it where it makes sense. Signed-off-by: Andy Shevchenko Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/20251126075558.2035012-5-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 274b3458af1f9c665faae70b560852461c30acef Author: Andy Shevchenko Date: Wed Nov 26 08:54:41 2025 +0100 spi: microchip-core: Replace dead code (-ENOMEM error message) First of all, the convention in the kernel that we do not issue error messages for -ENOMEM. Second, it's ignored by dev_err_probe(). Replace dead code by a simple return statement. Signed-off-by: Andy Shevchenko Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/20251126075558.2035012-4-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit e29aca7038f3c292c18048922c5f4436a034da99 Author: Andy Shevchenko Date: Wed Nov 26 08:54:39 2025 +0100 spi: microchip-core: use min() instead of min_t() min_t(int, a, b) casts an 'unsigned int' to 'int'. This might lead to the cases when big number is wrongly chosen. On the other hand, the SPI transfer length is unsigned and driver uses signed type for an unknown reason. Change the type of the transfer length to be unsigned and convert use min() instead of min_t(). Signed-off-by: Andy Shevchenko Reviewed-by: David Laight Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/20251126075558.2035012-2-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 990eb9a8eb4540ab90c7b34bb07b87ff13881cad Author: Johan Hovold Date: Fri Nov 21 13:18:52 2025 +0100 soc: samsung: exynos-pmu: fix device leak on regmap lookup Make sure to drop the reference taken when looking up the PMU device and its regmap. Note that holding a reference to a device does not prevent its regmap from going away so there is no point in keeping the reference. Fixes: 0b7c6075022c ("soc: samsung: exynos-pmu: Add regmap support for SoCs that protect PMU regs") Cc: stable@vger.kernel.org # 6.9 Cc: Peter Griffin Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251121121852.16825-1-johan@kernel.org Signed-off-by: Krzysztof Kozlowski commit 37de2dbc318ee10577c1c2704de5a803e75e55a2 Author: Sebastian Andrzej Siewior Date: Thu Nov 27 16:36:52 2025 +0100 debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP fill_pool_map is used to suppress nesting violations caused by acquiring a spinlock_t (from within the memory allocator) while holding a raw_spinlock_t. The used annotation is wrong. LD_WAIT_SLEEP is for always sleeping lock types such as mutex_t. LD_WAIT_CONFIG is for lock type which are sleeping while spinning on PREEMPT_RT such as spinlock_t. Use LD_WAIT_CONFIG as override. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251127153652.291697-3-bigeasy@linutronix.de commit 06e0ae988f6e3499785c407429953ade19c1096b Author: Sebastian Andrzej Siewior Date: Thu Nov 27 16:36:51 2025 +0100 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING The pool of free objects is refilled on several occasions such as object initialisation. On PREEMPT_RT refilling is limited to preemptible sections due to sleeping locks used by the memory allocator. The system boots with disabled interrupts so the pool can not be refilled. If too many objects are initialized and the pool gets empty then debugobjects disables itself. Refiling can also happen early in the boot with disabled interrupts as long as the scheduler is not operational. If the scheduler can not preempt a task then a sleeping lock can not be contended. Allow to additionally refill the pool if the scheduler is not operational. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251127153652.291697-2-bigeasy@linutronix.de commit 099a60cca1b84e60fdaefcd5d93736de9dba9cf9 Author: Dan Carpenter Date: Thu Nov 27 10:14:01 2025 +0300 remoteproc: imx_dsp_rproc: Fix NULL vs IS_ERR() bug in imx_dsp_rproc_add_carveout() The devm_ioremap_resource_wc() function never returns NULL, it returns error pointers. Update the error checking to match. Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Dan Carpenter Reviewed-by: Iuliana Prodan Link: https://lore.kernel.org/r/aSf6OerBbPcxBUVt@stanley.mountain Signed-off-by: Mathieu Poirier commit ac82dbc539c4c167f351e2e91c93508de73a5cd1 Author: Bjorn Andersson Date: Wed Nov 26 12:17:59 2025 -0600 remoteproc: st: Fix indexing of memory-regions The recent transition to use of_reserved_mem_region_to_resource() changes the while loop to a for loop, but the increment of the "index" variable was left behind at the end of the loop, as highlighted by the following error/warning: error: variable 'index' is incremented both in the loop header and in the loop body [-Werror,-Wfor-loop-analysis] Drop the extra increment to avoid skipping over every other memory-region in the loop. Fixes: 67a7bc7f0358 ("remoteproc: Use of_reserved_mem_region_* functions for "memory-region"") Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20251126-st-remoteproc-double-index-v1-1-3b0a8b21ac18@oss.qualcomm.com Signed-off-by: Mathieu Poirier commit 5e8b7b58b205da3c6c41f1e9bc66db999ed95595 Merge: ac3fd01e4c1efc d9600d57668c49 Author: Rafael J. Wysocki Date: Thu Nov 27 16:28:16 2025 +0100 Merge tag 'devfreq-next-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Pull devfreq changes for v6.19 from Chanwoo Choi: "- Move governor.h under include/linux/ and rename to devfreq-governor.h in order to allow devfreq governor definitions in out of drivers/devfreq/. - Fix potential use-after-free issue of OPP handling on hisi_uncore_freq.c - Use min() to improve the readability on tegra30-devfreq.c - Fix typo in DFSO_DOWNDIFFERENTIAL macro name on governor_simpleondemand.c" * tag 'devfreq-next-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: Fix typo in DFSO_DOWNDIFFERENTIAL macro name PM / devfreq: tegra30: use min to simplify actmon_cpu_to_emc_rate PM / devfreq: hisi: Fix potential UAF in OPP handling PM / devfreq: Move governor.h to a public header location commit 69ceb8a2d6665625d816fcf8ccd01965cddb233e Author: Darrick J. Wong Date: Tue Nov 4 16:48:40 2025 -0800 docs: remove obsolete links in the xfs online repair documentation Online repair is now merged in upstream, no need to point to patchset links anymore. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 2ff147fdfa99b8cbb8c2833e685fde7c42580ae6 Author: Marek Szyprowski Date: Wed Nov 26 11:26:18 2025 +0100 ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board requires it") changed default behavior of the BRCMFMAC driver, which now keeps SDIO card powered during system suspend to enable optional support for WOWL. This feature is not supported by the legacy Exynos4 based boards and leads to WLAN disfunction after system suspend/resume cycle. Fix this by annotating SDIO host used by WLAN chip with 'cap-power-off-card' property, which should have been there from the beginning. Fixes: f77cbb9a3e5d ("ARM: dts: exynos: Add bcm4334 device node to Trats2") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251126102618.3103517-5-m.szyprowski@samsung.com Signed-off-by: Krzysztof Kozlowski commit 97cc9c346b2c9cde075b9420fc172137d2427711 Author: Marek Szyprowski Date: Wed Nov 26 11:26:17 2025 +0100 ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board requires it") changed default behavior of the BRCMFMAC driver, which now keeps SDIO card powered during system suspend to enable optional support for WOWL. This feature is not supported by the legacy Exynos4 based boards and leads to WLAN disfunction after system suspend/resume cycle. Fix this by annotating SDIO host used by WLAN chip with 'cap-power-off-card' property, which should have been there from the beginning. Fixes: a19f6efc01df ("ARM: dts: exynos: Enable WLAN support for the Trats board") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251126102618.3103517-4-m.szyprowski@samsung.com Signed-off-by: Krzysztof Kozlowski commit 863d69923bdb6f414d0a3f504f1dfaeacbc00b09 Author: Marek Szyprowski Date: Wed Nov 26 11:26:16 2025 +0100 ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board requires it") changed default behavior of the BRCMFMAC driver, which now keeps SDIO card powered during system suspend to enable optional support for WOWL. This feature is not supported by the legacy Exynos4 based boards and leads to WLAN disfunction after system suspend/resume cycle. Fix this by annotating SDIO host used by WLAN chip with 'cap-power-off-card' property, which should have been there from the beginning. Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251126102618.3103517-3-m.szyprowski@samsung.com Signed-off-by: Krzysztof Kozlowski commit 97aee67e2406ea381408915e606c5f86448f3949 Author: Marek Szyprowski Date: Wed Nov 26 11:26:15 2025 +0100 ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board requires it") changed default behavior of the BRCMFMAC driver, which now keeps SDIO card powered during system suspend to enable optional support for WOWL. This feature is not supported by the legacy Exynos4 based boards and leads to WLAN disfunction after system suspend/resume cycle. Fix this by annotating SDIO host used by WLAN chip with 'cap-power-off-card' property, which should have been there from the beginning. Fixes: f1b0ffaa686f ("ARM: dts: exynos: Enable WLAN support for the UniversalC210 board") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251126102618.3103517-2-m.szyprowski@samsung.com Signed-off-by: Krzysztof Kozlowski commit 2224ea67c75d0a0b9eaf803d0dfdab8d0c601c35 Author: Marek Szyprowski Date: Wed Nov 26 12:00:38 2025 +0100 soc: samsung: exynos-pmu: Fix structure initialization Commit 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101") added system wide suspend/resume callbacks to Exynos PMU driver, but some items used by these callbacks are initialized only on GS101-compatible boards. Move that initialization to exynos_pmu_probe() to avoid potential lockdep warnings like below observed during system suspend/resume cycle: INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 UID: 0 PID: 2134 Comm: rtcwake Not tainted 6.18.0-rc7-next-20251126-00039-g1d656a1af243 #11794 PREEMPT Hardware name: Samsung Exynos (Flattened Device Tree) Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x68/0x88 dump_stack_lvl from register_lock_class+0x970/0x988 register_lock_class from __lock_acquire+0xc8/0x29ec __lock_acquire from lock_acquire+0x134/0x39c lock_acquire from _raw_spin_lock+0x38/0x48 _raw_spin_lock from exynos_cpupm_suspend_noirq+0x18/0x34 exynos_cpupm_suspend_noirq from dpm_run_callback+0x98/0x2b8 dpm_run_callback from device_suspend_noirq+0x8c/0x310 Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101") Signed-off-by: Marek Szyprowski Link: https://patch.msgid.link/20251126110038.3326768-1-m.szyprowski@samsung.com [krzk: include calltrace into commit msg] Signed-off-by: Krzysztof Kozlowski commit 466348abb0c364cfaf01c6a1142e32cb0d704980 Author: Marcos Paulo de Souza Date: Fri Nov 21 15:50:35 2025 -0300 printk: Use console_is_usable on console_unblank The macro for_each_console_srcu iterates over all registered consoles. It's implied that all registered consoles have CON_ENABLED flag set, making the check for the flag unnecessary. Call console_is_usable function to fully verify if the given console is usable before calling the ->unblank callback. Signed-off-by: Marcos Paulo de Souza Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20251121-printk-cleanup-part2-v2-3-57b8b78647f4@suse.com Signed-off-by: Petr Mladek commit 4c70ab110bdd6513f3cac6b9eb01ac3b7f0d23a2 Author: Marcos Paulo de Souza Date: Fri Nov 21 15:50:34 2025 -0300 arch: um: kmsg_dump: Use console_is_usable All consoles found on for_each_console are registered, meaning that all of them have the CON_ENABLED flag set. Since NBCON was introduced it's important to check if a given console also implements the NBCON callbacks. The function console_is_usable does exactly that. Signed-off-by: Marcos Paulo de Souza Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20251121-printk-cleanup-part2-v2-2-57b8b78647f4@suse.com Signed-off-by: Petr Mladek commit 822e2bb0d6dd792b95da2d4f420eb3dac5af95a7 Author: Marcos Paulo de Souza Date: Fri Nov 21 15:50:33 2025 -0300 drivers: serial: kgdboc: Drop checks for CON_ENABLED and CON_BOOT The original code tried to find a console that has CON_BOOT _or_ CON_ENABLED flag set. The flag CON_ENABLED is set to all registered consoles, so in this case this check is always true, even for the CON_BOOT consoles. The initial intent of the kgdboc_earlycon_init was to get a console early (CON_BOOT) or later on in the process (CON_ENABLED). The code was using for_each_console macro, meaning that all console structs were previously registered on the printk() machinery. At this point, any console found on for_each_console is safe for kgdboc_earlycon_init to use. Dropping the check makes the code cleaner, and avoids further confusion by future readers of the code. Signed-off-by: Marcos Paulo de Souza Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20251121-printk-cleanup-part2-v2-1-57b8b78647f4@suse.com Signed-off-by: Petr Mladek commit 564195c1a33c8fc631cd3d306e350b0e3d3e9555 Author: Joel Granados Date: Thu Oct 16 11:04:23 2025 +0200 sysctl: Wrap do_proc_douintvec with the public function proc_douintvec_conv Make do_proc_douintvec static and export proc_douintvec_conv wrapper function for external use. This is to keep with the design in sysctl.c. Update fs/pipe.c to use the new public API. Signed-off-by: Joel Granados commit 30baaeb685bce0b7dfd3c5a55f22b1076c21f7b2 Author: Joel Granados Date: Tue Oct 14 14:21:03 2025 +0200 sysctl: Create pipe-max-size converter using sysctl UINT macros Create a converter for the pipe-max-size proc_handler using the SYSCTL_UINT_CONV_CUSTOM. Move SYSCTL_CONV_IDENTITY macro to the sysctl header to make it available for pipe size validation. Keep returning -EINVAL when (val == 0) by using a range checking converter and setting the minimal valid value (extern1) to SYSCTL_ONE. Keep round_pipe_size by passing it as the operation for SYSCTL_USER_TO_KERN_INT_CONV. Signed-off-by: Joel Granados commit 4639faaa607f3bed85f2cdde686a88453c99ef06 Author: Joel Granados Date: Tue Oct 14 13:35:42 2025 +0200 sysctl: Move proc_doulongvec_ms_jiffies_minmax to kernel/time/jiffies.c Move proc_doulongvec_ms_jiffies_minmax to kernel/time/jiffies.c. Create a non static wrapper function proc_doulongvec_minmax_conv that forwards the custom convmul and convdiv argument values to the internal do_proc_doulongvec_minmax. Remove unused linux/times.h include from kernel/sysctl.c. Signed-off-by: Joel Granados commit 54932988c4230925d2bf0023509ac2fee59a089a Author: Joel Granados Date: Tue Oct 14 13:04:16 2025 +0200 sysctl: Move jiffies converters to kernel/time/jiffies.c Move integer jiffies converters (proc_dointvec{_,_ms_,_userhz_}jiffies and proc_dointvec_ms_jiffies_minmax) to kernel/time/jiffies.c. Error stubs for when CONFIG_PRCO_SYSCTL is not defined are not reproduced because all the jiffies converters go through proc_dointvec_conv which is already stubbed. This is part of the greater effort to move sysctl logic out of kernel/sysctl.c thereby reducing merge conflicts in kernel/sysctl.c. Signed-off-by: Joel Granados commit 24a08eefddb33c7a259975e932c434b85f70d684 Author: Joel Granados Date: Thu Oct 16 10:38:45 2025 +0200 sysctl: Move UINT converter macros to sysctl header Move SYSCTL_USER_TO_KERN_UINT_CONV and SYSCTL_UINT_CONV_CUSTOM macros to include/linux/sysctl.h. No need to embed sysctl_kern_to_user_uint_conv in a macro as it will not need a custom kernel pointer operation. This is a preparation commit to enable jiffies converter creation outside kernel/sysctl.c. Signed-off-by: Joel Granados commit e2e5dac304fdf991fb974510db4565db04ef1335 Author: Joel Granados Date: Tue Oct 14 12:42:01 2025 +0200 sysctl: Move INT converter macros to sysctl header Move direction macros (SYSCTL_{USER_TO_KERN,KERN_TO_USER}) and the integer converter macros (SYSCTL_{USER_TO_KERN,KERN_TO_USER}_INT_CONV, SYSCTL_INT_CONV_CUSTOM) into include/linux/sysctl.h. This is a preparation commit to enable jiffies converter creation outside kernel/sysctl.c. Signed-off-by: Joel Granados commit c5b4c183f7aeb46cd27ddea9dab776655b8d7034 Author: Joel Granados Date: Wed Oct 8 16:12:37 2025 +0200 sysctl: Allow custom converters from outside sysctl The new non-static proc_dointvec_conv forwards a custom converter function to do_proc_dointvec from outside the sysctl scope. Rename the do_proc_dointvec call points so any future changes to proc_dointvec_conv are propagated in sysctl.c This is a preparation commit that allows the integer jiffie converter functions to move out of kernel/sysctl.c. Signed-off-by: Joel Granados commit 73f784b2c938e17e4af90aff4cdcaafe4ca06a5f Merge: 45d100ee0d6e8b 9aea35eb98a656 Author: Paolo Abeni Date: Thu Nov 27 15:45:17 2025 +0100 Merge tag 'linux-can-next-for-6.19-20251126' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-11-26 this is a pull request of 27 patches for net-next/main. The first 17 patches are by Vincent Mailhol and Oliver Hartkopp and add CAN XL support to the CAN netlink interface. Geert Uytterhoeven and Biju Das provide 7 patches for the rcar_canfd driver to add suspend/resume support. The next 2 patches are by Markus Schneider-Pargmann and add them as the m_can maintainer. Conor Dooley's patch updates the mpfs-can DT bindungs. linux-can-next-for-6.19-20251126 * tag 'linux-can-next-for-6.19-20251126' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: (27 commits) dt-bindings: can: mpfs: document resets MAINTAINERS: Simplify m_can section MAINTAINERS: Add myself as m_can maintainer can: rcar_canfd: Add suspend/resume support can: rcar_canfd: Convert to DEFINE_SIMPLE_DEV_PM_OPS() can: rcar_canfd: Invert CAN clock and close_candev() order can: rcar_canfd: Extract rcar_canfd_global_{,de}init() can: rcar_canfd: Use devm_clk_get_optional() for RAM clk can: rcar_canfd: Invert global vs. channel teardown can: rcar_canfd: Invert reset assert order can: dev: print bitrate error with two decimal digits can: raw: instantly reject unsupported CAN frames can: add dummy_can driver can: calc_bittiming: add can_calc_sample_point_pwm() can: calc_bittiming: add can_calc_sample_point_nrz() can: calc_bittiming: replace misleading "nominal" by "reference" can: netlink: add PWM netlink interface can: calc_bittiming: add PWM calculation can: bittiming: add PWM validation can: bittiming: add PWM parameters ... ==================== Link: https://patch.msgid.link/20251126120106.154635-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit 1aa53326e1df68f8e7191053a3fd712449d444cb Author: Joel Granados Date: Mon Oct 27 11:24:17 2025 +0100 sysctl: remove __user qualifier from stack_erasing_sysctl buffer argument The buffer arg in proc handler functions have been void* (no __user qualifier) since commit 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler"). The __user qualifier was erroneously brought back in commit 0df8bdd5e3b3 ("stackleak: move stack_erasing sysctl to stackleak.c"). This fixes the error by removing the __user qualifier. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510221719.3ggn070M-lkp@intel.com/ Signed-off-by: Joel Granados commit c3102febf43ba8a9ce5512a49103f42661659a16 Author: Joel Granados Date: Thu Oct 16 10:22:16 2025 +0200 sysctl: Create macro for user-to-kernel uint converter Replace sysctl_user_to_kern_uint_conv function with SYSCTL_USER_TO_KERN_UINT_CONV macro that accepts u_ptr_op parameter for value transformation. Replacing sysctl_kern_to_user_uint_conv is not needed as it will only be used from within sysctl.c. This is a preparation commit for creating a custom converter in fs/pipe.c. No Functional changes are intended. Signed-off-by: Joel Granados commit 0c1d2dc7cce78445f723d32b57f430c42316cab0 Author: Joel Granados Date: Thu Oct 16 09:46:14 2025 +0200 sysctl: Add optional range checking to SYSCTL_UINT_CONV_CUSTOM Add k_ptr_range_check parameter to SYSCTL_UINT_CONV_CUSTOM macro to enable range validation using table->extra1/extra2. Replace do_proc_douintvec_minmax_conv with do_proc_uint_conv_minmax generated by the updated macro. Signed-off-by: Joel Granados commit 49d3288c1d83178d25e2a8cc6c978de35a616d42 Author: Joel Granados Date: Thu Oct 16 09:06:21 2025 +0200 sysctl: Create unsigned int converter using new macro Pass sysctl_{user_to_kern,kern_to_user}_uint_conv (unsigned integer uni-directional converters) to the new SYSCTL_UINT_CONV_CUSTOM macro to create do_proc_douintvec_conv's replacement (do_proc_uint_conv). This is a preparation commit to use the unsigned integer converter from outside sysctl. No functional change is intended. Signed-off-by: Joel Granados commit 54e77495a7c5f64bc2d35583a4f59c8dbee579ab Author: Joel Granados Date: Sun Oct 12 11:24:41 2025 +0200 sysctl: Add optional range checking to SYSCTL_INT_CONV_CUSTOM Extend the SYSCTL_INT_CONV_CUSTOM macro with a k_ptr_range_check parameter to conditionally generate range validation code. When enabled, validation is done against table->extra1 (min) and table->extra2 (max) bounds before assignment. Add base minmax and ms_jiffies_minmax converter instances that utilize the range checking functionality. Signed-off-by: Joel Granados commit 796c481a4b7026a93e4800bff8d99923630014e7 Author: Joel Granados Date: Wed Oct 8 09:58:46 2025 +0200 sysctl: Create integer converters with one macro New SYSCTL_INT_CONV_CUSTOM macro creates "bi-directional" converters from a user-to-kernel and a kernel-to-user functions. Replace integer versions of do_proc_*_conv functions with the ones from the new macro. Rename "_dointvec_" to just "_int_" as these converters are not applied to vectors and the "do" is already in the name. Move the USER_HZ validation directly into proc_dointvec_userhz_jiffies() Signed-off-by: Joel Granados commit 2dc164a48e6fdb03066614e2b82464b9b7c790ca Author: Joel Granados Date: Mon Oct 6 14:40:01 2025 +0200 sysctl: Create converter functions with two new macros Eight converter functions are created using two new macros (SYSCTL_USER_TO_KERN_INT_CONV & SYSCTL_KERN_TO_USER_INT_CONV); they are called from four pre-existing converter functions: do_proc_dointvec_conv and do_proc_dointvec{,_userhz,_ms}_jiffies_conv. The function names generated by the macros are differentiated by a string suffix passed as the first macro argument. The SYSCTL_USER_TO_KERN_INT_CONV macro first executes the u_ptr_op operation, then checks for overflow, assigns sign (-, +) and finally writes to the kernel var with WRITE_ONCE; it always returns an -EINVAL when an overflow is detected. The SYSCTL_KERN_TO_USER_INT_CONV uses READ_ONCE, casts to unsigned long, then executes the k_ptr_op before assigning the value to the user space buffer. The overflow check is always done against MAX_INT after applying {k,u}_ptr_op. This approach avoids rounding or precision errors that might occur when using the inverse operations. Signed-off-by: Joel Granados commit 551bf1845027650ff6c9da598fb270ba362e9218 Author: Joel Granados Date: Fri Oct 3 21:36:34 2025 +0200 sysctl: Discriminate between kernel and user converter params Rename converter parameter to indicate data flow direction: "lvalp" to "u_ptr" indicating a user space parsed value pointer. "valp" to "k_ptr" indicating a kernel storage value pointer. This facilitates the identification of discrepancies between direction (copy to kernel or copy to user space) and the modified variable. This is a preparation commit for when the converter functions are exposed to the rest of the kernel. Signed-off-by: Joel Granados commit 5412f5b13d290d22cf910a0e8227737aaa2cc44e Author: Joel Granados Date: Fri Oct 3 14:07:18 2025 +0200 sysctl: Indicate the direction of operation with macro names Replace the "write" integer parameter with SYSCTL_USER_TO_KERN() and SYSCTL_KERN_TO_USER() that clearly indicate data flow direction in sysctl operations. "write" originates in proc_sysctl.c (proc_sys_{read,write}) and can take one of two values: "0" or "1" when called from proc_sys_read and proc_sys_write respectively. When write has a value of zero, data is "written" to a user space buffer from a kernel variable (usually ctl_table->data). Whereas when write has a value greater than zero, data is "written" to an internal kernel variable from a user space buffer. Remove this ambiguity by introducing macros that clearly indicate the direction of the "write". The write mode names in sysctl_writes_mode are left unchanged as these directly relate to the sysctl_write_strict file in /proc/sys where the word "write" unambiguously refers to writing to a file. Signed-off-by: Joel Granados commit 610c9b6efb701e559f5b5d449e69e76e91ea4401 Author: Joel Granados Date: Thu Oct 2 10:50:03 2025 +0200 sysctl: Remove superfluous __do_proc_* indirection Remove "__" from __do_proc_do{intvec,uintvec,ulongvec_minmax} internal functions and delete their corresponding do_proc_do* wrappers. These indirections are unnecessary as they do not add extra logic nor do they indicate a layer separation. Signed-off-by: Joel Granados commit ee581c0e3acd6b59e36c1d990090c699c5ba6735 Author: Joel Granados Date: Thu Oct 2 09:03:31 2025 +0200 sysctl: Remove superfluous tbl_data param from "dovec" functions Remove superfluous tbl_data param from do_proc_douintvec{,_r,_w} and __do_proc_do{intvec,uintvec,ulongvec_minmax}. There is no need to pass it as it is always contained within the ctl_table struct. Signed-off-by: Joel Granados commit 6ca07a9b63ff4ac24931a21086542cd7092ad74f Author: Joel Granados Date: Wed Oct 1 15:46:36 2025 +0200 sysctl: Replace void pointer with const pointer to ctl_table * Replace void* data in the converter functions with a const struct ctl_table* table as it was only getting forwarding values from ctl_table->extra{1,2}. * Remove the void* data in the do_proc_* functions as they already had a pointer to the ctl_table. * Remove min/max structures do_proc_do{uint,int}vec_minmax_conv_param; the min/max values get passed directly in ctl_table. * Keep min/max initialization in extra{1,2} in proc_dou8vec_minmax. * The do_proc_douintvec was adjusted outside sysctl.c as it is exported to fs/pipe.c. Signed-off-by: Joel Granados commit d0139059e31acd5fea49737558297d801c406638 Author: Heiko Carstens Date: Wed Nov 26 16:33:11 2025 +1100 KVM: s390: Enable and disable interrupts in entry code Move enabling and disabling of interrupts around the SIE instruction to entry code. Enabling interrupts only after the __TI_sie flag has been set guarantees that the SIE instruction is not executed if an interrupt happens between enabling interrupts and the execution of the SIE instruction. Interrupt handlers and machine check handler forward the PSW to the sie_exit label in such cases. This is a prerequisite for VIRT_XFER_TO_GUEST_WORK to prevent that guest context is entered when e.g. a scheduler IPI, indicating that a reschedule is required, happens right before the SIE instruction, which could lead to long delays. Signed-off-by: Heiko Carstens Tested-by: Andrew Donnellan Signed-off-by: Andrew Donnellan Reviewed-by: Janosch Frank Signed-off-by: Janosch Frank commit c067847c52e26eceed9f8a938c04456880c486fa Author: Andrew Donnellan Date: Wed Nov 26 16:33:10 2025 +1100 KVM: s390: Add signal_exits counter Add a signal_exits counter for s390, as exists on arm64, loongarch, mips, powerpc, riscv and x86. This is used by kvm_handle_signal_exit(), which we will use when we later enable CONFIG_VIRT_XFER_TO_GUEST_WORK. Signed-off-by: Andrew Donnellan Reviewed-by: Janosch Frank Signed-off-by: Janosch Frank commit 502ddcc405b69fa92e0add6c1714d654504f6fd7 Author: Navaneeth K Date: Thu Nov 20 16:35:20 2025 +0000 staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic. Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them. This prevents OOB reads caused by malformed beacon frames. Signed-off-by: Navaneeth K Cc: stable Signed-off-by: Greg Kroah-Hartman commit 6ef0e1c10455927867cac8f0ed6b49f328f8cf95 Author: Navaneeth K Date: Thu Nov 20 16:33:08 2025 +0000 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow. Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow. This prevents kernel stack corruption triggered by malformed association requests. Signed-off-by: Navaneeth K Cc: stable Signed-off-by: Greg Kroah-Hartman commit 154828bf9559b9c8421fc2f0d7f7f76b3683aaed Author: Navaneeth K Date: Thu Nov 20 16:23:52 2025 +0000 staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop. Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element. This prevents OOB reads and ensures the parser terminates safely on malformed frames. Signed-off-by: Navaneeth K Cc: stable Signed-off-by: Greg Kroah-Hartman commit 3d1f1088455d9a9bce51f0c1e6a81f518a5cb468 Author: Brendan Jackman Date: Fri Oct 3 16:56:41 2025 +0000 x86/mm: Delete disabled debug code This code doesn't run. Since 2008: 4f9c11dd49fb ("x86, 64-bit: adjust mapping of physical pagetables to work with Xen") the kernel has gained more flexible logging and tracing capabilities; presumably if anyone wanted to take advantage of this log message they would have got rid of the "if (0)" so they could use these capabilities. Since they haven't, just delete it. Signed-off-by: Brendan Jackman Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251003-x86-init-cleanup-v1-1-f2b7994c2ad6@google.com commit 81f00c462e2746037153b442f521b5d611de2fce Author: Paul E. McKenney Date: Sun Nov 2 14:49:41 2025 -0800 refscale: Exercise DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast() This commit updates the initialization for the "srcu-fast" scale type to use DEFINE_STATIC_SRCU_FAST() when reader_flavor is equal to SRCU_READ_FLAVOR_FAST. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit 609460a6db2016d9098b4bf50b3871302f5cc6ef Author: Paul E. McKenney Date: Wed Nov 5 12:32:16 2025 -0800 rcutorture: Make srcu{,d}_torture_init() announce the SRCU type This commit causes rcutorture's srcu_torture_init() and srcud_torture_init() functions to announce on the console log which variant of SRCU is being tortured, for example: "torture: srcud_torture_init fast SRCU". [ paulmck: Apply feedback from kernel test robot. ] Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit d3f52f53a56278ce5ffeafa3cc6cfb3ecef770fe Author: Paul E. McKenney Date: Wed Nov 5 12:32:14 2025 -0800 srcu: Create an SRCU-fast-updown API This commit creates an SRCU-fast-updown API, including DEFINE_SRCU_FAST_UPDOWN(), DEFINE_STATIC_SRCU_FAST_UPDOWN(), __init_srcu_struct_fast_updown(), init_srcu_struct_fast_updown(), srcu_read_lock_fast_updown(), srcu_read_unlock_fast_updown(), __srcu_read_lock_fast_updown(), and __srcu_read_unlock_fast_updown(). These are initially identical to their SRCU-fast counterparts, but both SRCU-fast and SRCU-fast-updown will be optimized in different directions by later commits. SRCU-fast will lack any sort of srcu_down_read() and srcu_up_read() APIs, which will enable extremely efficient NMI safety. For its part, SRCU-fast-updown will not be NMI safe, which will enable reasonably efficient implementations of srcu_down_read_fast() and srcu_up_read_fast(). This API fork happens to meet two different future use cases. * SRCU-fast will become the reimplementation basis for RCU-TASK-TRACE for consolidation. Since RCU-TASK-TRACE must be NMI safe, SRCU-fast must be as well. * SRCU-fast-updown will be needed for uretprobes code in order to get rid of the read-side memory barriers while still allowing entering the reader at task level while exiting it in a timer handler. This commit also adds rcutorture tests for the new APIs. This (annoyingly) needs to be in the same commit for bisectability. With this commit, the 0x8 value tests SRCU-fast-updown. However, most SRCU-fast testing will be via the RCU Tasks Trace wrappers. [ paulmck: Apply s/0x8/0x4/ missing change per Boqun Feng feedback. ] [ paulmck: Apply Akira Yokosawa feedback. ] Signed-off-by: Paul E. McKenney Cc: Andrii Nakryiko Cc: Alexei Starovoitov Cc: Peter Zijlstra Cc: Signed-off-by: Frederic Weisbecker commit a508939e15356d80369ea881c05526a168fcfd6c Author: Chu Guangqing Date: Tue Nov 25 10:24:03 2025 +0800 ACPI: PM: Fix a spelling mistake Fix spelling by replacing "interrups" with "interrupts". Signed-off-by: Chu Guangqing [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251125022403.2614-1-chuguangqing@inspur.com Signed-off-by: Rafael J. Wysocki commit 037dada8bbb14e42b6596e30557b08ee051f7b1b Author: Chu Guangqing Date: Tue Nov 25 10:14:31 2025 +0800 ACPI: LPSS: Fix a spelling mistake Fix spelling by replacing "successfull" with "successful". Signed-off-by: Chu Guangqing [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251125021431.2243-1-chuguangqing@inspur.com Signed-off-by: Rafael J. Wysocki commit 80a85a771deb113cfe2e295fb9e84467a43ebfe4 Author: Stefan Metzmacher Date: Thu Nov 27 11:56:14 2025 +0100 RDMA/rxe: reclassify sockets in order to avoid false positives from lockdep While developing IPPROTO_SMBDIRECT support for the code under fs/smb/common/smbdirect [1], I noticed false positives like this: [+0,003927] ============================================ [+0,000532] WARNING: possible recursive locking detected [+0,000611] 6.18.0-rc5-metze-kasan-lockdep.02+ #1 Tainted: G OE [+0,000835] -------------------------------------------- [+0,000729] ksmbd:r5445/3609 is trying to acquire lock: [+0,000709] ffff88800b9570f8 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x52/0x360 [+0,000831] but task is already holding lock: [+0,000684] ffff88800654af78 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: smbdirect_sk_close+0x122/0x790 [smbdirect] [+0,000928] other info that might help us debug this: [+0,005552] Possible unsafe locking scenario: [+0,000723] CPU0 [+0,000359] ---- [+0,000377] lock(k-sk_lock-AF_INET); [+0,000478] lock(k-sk_lock-AF_INET); [+0,000498] *** DEADLOCK *** [+0,001012] May be due to missing lock nesting notation [+0,000831] 3 locks held by ksmbd:r5445/3609: [+0,000484] #0: ffff88800654af78 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: smbdirect_sk_close+0x122/0x790 [smbdirect] [+0,001000] #1: ffff888020a40458 (&id_priv->handler_mutex){+.+.}-{4:4}, at: rdma_lock_handler+0x17/0x30 [rdma_cm] [+0,000982] #2: ffff888020a40350 (&id_priv->qp_mutex){+.+.}-{4:4}, at: rdma_destroy_qp+0x5d/0x1f0 [rdma_cm] [+0,000934] stack backtrace: [+0,000589] CPU: 0 UID: 0 PID: 3609 Comm: ksmbd:r5445 Kdump: loaded Tainted: G OE 6.18.0-rc5-metze-kasan-lockdep.02+ #1 PREEMPT(voluntary) [+0,000023] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [+0,000004] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 ... [+0,000010] print_deadlock_bug+0x245/0x330 [+0,000014] validate_chain+0x32a/0x590 [+0,000012] __lock_acquire+0x535/0xc30 [+0,000013] lock_acquire.part.0+0xb3/0x240 [+0,000017] ? inet_shutdown+0x52/0x360 [+0,000013] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000007] ? mark_held_locks+0x46/0x90 [+0,000012] lock_acquire+0x60/0x140 [+0,000006] ? inet_shutdown+0x52/0x360 [+0,000028] lock_sock_nested+0x3b/0xf0 [+0,000009] ? inet_shutdown+0x52/0x360 [+0,000008] inet_shutdown+0x52/0x360 [+0,000010] kernel_sock_shutdown+0x5b/0x90 [+0,000011] rxe_qp_do_cleanup+0x4ef/0x810 [rdma_rxe] [+0,000043] ? __pfx_rxe_qp_do_cleanup+0x10/0x10 [rdma_rxe] [+0,000030] execute_in_process_context+0x2b/0x170 [+0,000013] rxe_qp_cleanup+0x1c/0x30 [rdma_rxe] [+0,000021] __rxe_cleanup+0x1cf/0x2e0 [rdma_rxe] [+0,000036] ? __pfx___rxe_cleanup+0x10/0x10 [rdma_rxe] [+0,000020] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000006] ? __kasan_check_read+0x11/0x20 [+0,000012] rxe_destroy_qp+0xe1/0x230 [rdma_rxe] [+0,000035] ib_destroy_qp_user+0x217/0x450 [ib_core] [+0,000074] rdma_destroy_qp+0x83/0x1f0 [rdma_cm] [+0,000034] smbdirect_connection_destroy_qp+0x98/0x2e0 [smbdirect] [+0,000017] ? __pfx_smb_direct_logging_needed+0x10/0x10 [ksmbd] [+0,000044] smbdirect_connection_destroy+0x698/0xed0 [smbdirect] [+0,000023] ? __pfx_smbdirect_connection_destroy+0x10/0x10 [smbdirect] [+0,000033] ? __pfx_smb_direct_logging_needed+0x10/0x10 [ksmbd] [+0,000031] smbdirect_connection_destroy_sync+0x42b/0x9f0 [smbdirect] [+0,000029] ? mark_held_locks+0x46/0x90 [+0,000012] ? __pfx_smbdirect_connection_destroy_sync+0x10/0x10 [smbdirect] [+0,000019] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000007] ? trace_hardirqs_on+0x64/0x70 [+0,000029] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000010] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000006] ? __smbdirect_connection_schedule_disconnect+0x339/0x4b0 [+0,000021] smbdirect_sk_destroy+0xb0/0x680 [smbdirect] [+0,000024] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000006] ? trace_hardirqs_on+0x64/0x70 [+0,000006] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000005] ? __local_bh_enable_ip+0xba/0x150 [+0,000011] sk_common_release+0x66/0x340 [+0,000010] smbdirect_sk_close+0x12a/0x790 [smbdirect] [+0,000023] ? ip_mc_drop_socket+0x1e/0x240 [+0,000013] inet_release+0x10a/0x240 [+0,000011] smbdirect_sock_release+0x502/0xe80 [smbdirect] [+0,000015] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000024] sock_release+0x91/0x1c0 [+0,000010] smb_direct_free_transport+0x31/0x50 [ksmbd] [+0,000025] ksmbd_conn_free+0x1d0/0x240 [ksmbd] [+0,000040] smb_direct_disconnect+0xb2/0x120 [ksmbd] [+0,000023] ? srso_alias_return_thunk+0x5/0xfbef5 [+0,000018] ksmbd_conn_handler_loop+0x94e/0xf10 [ksmbd] ... I'll also add reclassify to the smbdirect socket code [1], but I think it's better to have it in both direction (below and above the RDMA layer). [1] https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/master-ipproto-smbdirect Cc: Zhu Yanjun Reviewed-by: Zhu Yanjun Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: linux-rdma@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/20251127105614.2040922-1-metze@samba.org Signed-off-by: Leon Romanovsky commit 45d100ee0d6e8b4b4ba6c48f54decd62f875cf70 Author: Rohan G Thomas Date: Wed Nov 26 00:37:12 2025 +0800 net: stmmac: dwmac: Disable flushing frames on Rx Buffer Unavailable In Store and Forward mode, flushing frames when the receive buffer is unavailable, can cause the MTL Rx FIFO to go out of sync. This results in buffering of a few frames in the FIFO without triggering Rx DMA from transferring the data to the system memory until another packet is received. Once the issue happens, for a ping request, the packet is forwarded to the system memory only after we receive another packet and hece we observe a latency equivalent to the ping interval. 64 bytes from 192.168.2.100: seq=1 ttl=64 time=1000.344 ms Also, we can observe constant gmacgrp_debug register value of 0x00000120, which indicates "Reading frame data". The issue is not reproducible after disabling frame flushing when Rx buffer is unavailable. But in that case, the Rx DMA enters a suspend state due to buffer unavailability. To resume operation, software must write to the receive_poll_demand register after adding new descriptors, which reactivates the Rx DMA. This issue is observed in the socfpga platforms which has dwmac1000 IP like Arria 10, Cyclone V and Agilex 7. Issue is reproducible after running iperf3 server at the DUT for UDP lower packet sizes. Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Tested-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251126-a10_ext_fix-v1-1-d163507f646f@altera.com Signed-off-by: Paolo Abeni commit 0b39ce8f71c92c72681d9a678298a9a59ff9b5d3 Author: Shyam Sundar S K Date: Wed Nov 19 14:28:12 2025 +0530 platform/x86/amd/pmf: Use devm_mutex_init() for mutex initialization Replace mutex_init() with the devm_mutex_init(), to ensure proper mutex cleanup during probe failure and driver removal. Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20251119085813.546813-2-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2bd038de12e6e5168b64a0063ac8e6bd0a047133 Author: Shyam Sundar S K Date: Wed Nov 19 14:28:11 2025 +0530 platform/x86/amd/pmf: Add BIOS_INPUTS_MAX macro to replace hardcoded array size Define a new macro BIOS_INPUTS_MAX, to represent the maximum number of BIOS input values. Replace hardcoded array sizes in relevant structures with this macro to improve readability and maintainability. Reviewed-by: Mario Limonciello (AMD) Tested-by: Yijun Shen Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251119085813.546813-1-Shyam-sundar.S-k@amd.com Signed-off-by: Ilpo Järvinen commit 5de863efbf88d995fe96931c5e8f1325b1745b1d Author: Jason Gunthorpe Date: Wed Nov 26 15:21:27 2025 -0400 iommupt: Avoid a compiler bug with sw_bit gcc 13, in some cases, gets confused if the __builtin_constant_p() is inside the switch. It thinks that bitnr can have the value max+1 and fails. Lift the check outside the switch to avoid it. Fixes: ef7bfe5bbffd ("iommupt/x86: Support SW bits and permit PT_FEAT_DMA_INCOHERENT") Fixes: 5448c1558f60 ("iommupt: Add the Intel VT-d second stage page table format") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511242012.I7g504Ab-lkp@intel.com/ Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 5c9c1e78de1e41b5321583139851797580c077c3 Author: Sunday Adelodun Date: Tue Nov 25 12:36:48 2025 +0100 selftests: af_unix: remove unused stdlib.h include The unix_connreset.c test included , but no symbol from that header is used. This causes a fatal build error under certain linux-next configurations where stdlib.h is not available. Remove the unused include to fix the build. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202511221800.hcgCKvVa-lkp@intel.com/ Signed-off-by: Sunday Adelodun Link: https://patch.msgid.link/20251125113648.25903-1-adelodunolaoluwa@yahoo.com Signed-off-by: Paolo Abeni commit de59a8a3a1aab3a6608777f62fa098b5abb2704a Author: Mikhail Kshevetskiy Date: Wed Nov 26 02:40:46 2025 +0300 spi: dt-bindings: airoha: add compatible for EN7523 Add dt-bindings documentation of SPI NAND controller for Airoha EN7523 SoC platform. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251125234047.1101985-3-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit 061795b345aff371df8f71d54ae7c7dc8ae630d0 Author: Mikhail Kshevetskiy Date: Wed Nov 26 02:40:45 2025 +0300 spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Airoha EN7523 specific bug -------------------------- We found that some serial console may pull TX line to GROUND during board boot time. Airoha uses TX line as one of its bootstrap pins. On the EN7523 SoC this may lead to booting in RESERVED boot mode. It was found that some flashes operates incorrectly in RESERVED mode. Micron and Skyhigh flashes are definitely affected by the issue, Winbond flashes are not affected. Details: -------- DMA reading of odd pages on affected flashes operates incorrectly. Page reading offset (start of the page) on hardware level is replaced by 0x10. Thus results in incorrect data reading. As result OS loading becomes impossible. Usage of UBI make things even worse. On attaching, UBI will detects corruptions (because of wrong reading of odd pages) and will try to recover. For recovering UBI will erase and write 'damaged' blocks with a valid information. This will destroy all UBI data. Non-DMA reading is OK. This patch detects booting in reserved mode, turn off DMA and print big fat warning. It's worth noting that the boot configuration is preserved across reboots. Therefore, to boot normally, you should do the following: - disconnect the serial console from the board, - power cycle the board. Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver") Signed-off-by: Mikhail Kshevetskiy Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251125234047.1101985-2-mikhail.kshevetskiy@iopsys.eu Signed-off-by: Mark Brown commit c45d5d9803a4fb7d3e7f590094b7a2abcfe74ef6 Author: Richard Fitzgerald Date: Thu Nov 27 10:39:47 2025 +0000 firmware: cs_dsp: Use kvzalloc() to allocate control caches Use kvzalloc() instead of kzalloc() to allocate memory to cache the content of a firmware control. Most firmware controls are only small, typically a few bytes. But on some firmware there can be much larger controls for coefficient or model data. The overhead of kvzalloc() is negligible because most control allocs can be satisfied by the normal kmalloc() that kvzalloc() will try first. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251127103947.1094934-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ed6e90cb9fe53aba4750be50c1a355d676b7d69c Author: Richard Fitzgerald Date: Thu Nov 27 11:32:38 2025 +0000 firmware: cs_dsp: Take pwr_lock around reading controls debugfs In cs_dsp_debugfs_read_controls_show() take the pwr_lock mutex around the list walk. This protects against debugfs returning a partial set of new controls if those controls are being added to the list while it is being walked. Controls are never deleted from this list, and are only added to the end of the list. So there was never a danger of following a stale pointer to garbage. The worst case was that the printed list is truncated if it saw an entry that was the list end just before a new entry was appended to the list. With the original code, the truncated list from the debugfs could show only _some_ of the new entries. This could be confusing because it appears that some new entries are missing. Adding the mutex means that the debugfs read provides an atomic view. Either it shows the old content before any of the new controls were added; or it shows the new content after all the new controls are added. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251127113238.1251352-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 56736543b570a1a16fbc4e3be1776a476c9ca14a Author: Cezary Rojewski Date: Wed Nov 26 10:55:23 2025 +0100 ASoC: Intel: catpt: Do not block the system from suspending Even if something goes wrong when performing suspend on DSP, from the system perspective the component is not critical enough to block the suspend operation entirely. Leaving recovery to next resume() suffices. Suggested-by: Andy Shevchenko Acked-by: Andy Shevchenko Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251126095523.3925364-7-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 8a342b2be1c84ac205ccd8eb9cc5d8eb5871af47 Author: Cezary Rojewski Date: Wed Nov 26 10:55:22 2025 +0100 ASoC: Intel: catpt: Do not ignore errors on runtime resume If pm_runtime_resume_and_get() fails, follow up pm_runtime_xxx() operate on device in erroneous state. Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251126095523.3925364-6-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 16e17736282fea02c1a156b242c2dbf35d94e9a2 Author: Cezary Rojewski Date: Wed Nov 26 10:55:21 2025 +0100 ASoC: Intel: catpt: Fix probing order of driver components catpt_dai_pcm_new() is called during the bring up sequence of the machine board device which is a different device to the parent (DSP) device yet utilizes pm_runtime_xxx() against it in order to send IPCs. If the parent's pm_runtime is not configured before that happens, errors will occur. Signed-off-by: Cezary Rojewski Acked-by: Andy Shevchenko Link: https://patch.msgid.link/20251126095523.3925364-5-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 86a5b621be658fc8fe594ca6db317d64de30cce1 Author: Cezary Rojewski Date: Wed Nov 26 10:55:20 2025 +0100 ASoC: Intel: catpt: Fix error path in hw_params() Do not leave any resources hanging on the DSP side if applying user settings fails. Fixes: 768a3a3b327d ("ASoC: Intel: catpt: Optimize applying user settings") Signed-off-by: Cezary Rojewski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251126095523.3925364-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit ea38b262a2df7c6f29753565fbe2db8492740f28 Author: Cezary Rojewski Date: Wed Nov 26 10:55:19 2025 +0100 ASoC: Intel: catpt: Switch to resource_xxx() API There is a number of interfaces available for manipulating instances of struct resource. To improve readability, move away from manual editing in favor of the common interface. While at it, adjust spacing so that both code blocks, while found in separate functions, looks cohesive. Suggested-by: Andy Shevchenko Signed-off-by: Cezary Rojewski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251126095523.3925364-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 1a0ce0a1e6d2e6e03469eb5233e2a571511b1ae1 Author: Cezary Rojewski Date: Wed Nov 26 10:55:18 2025 +0100 ASoC: Intel: catpt: Fix offset checks Verify if the entire block is found within DRAM, not just the start of it. Signed-off-by: Cezary Rojewski Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251126095523.3925364-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit f7f78098690d60a03b47942ac7d73ea17b42239e Author: Christophe JAILLET Date: Sat Oct 25 13:15:38 2025 +0200 configfs: Constify ct_item_ops in struct config_item_type Make 'ct_item_ops' const in struct config_item_type. This allows constification of many structures which hold some function pointers. Signed-off-by: Christophe JAILLET Reviewed-by: Breno Leitao Link: https://lore.kernel.org/r/f43cb57418a7f59e883be8eedc7d6abe802a2094.1761390472.git.christophe.jaillet@wanadoo.fr Signed-off-by: Andreas Hindborg commit f2f36500a63b73a8be90127322ad740253cf89c0 Author: Christophe JAILLET Date: Sat Oct 25 13:15:37 2025 +0200 configfs: Constify ct_group_ops in struct config_item_type Make 'ct_group_ops' const in struct config_item_type. This allows constification of many structures which hold some function pointers. Signed-off-by: Christophe JAILLET Reviewed-by: Breno Leitao Link: https://lore.kernel.org/r/6b720cf407e8a6d30f35beb72e031b2553d1ab7e.1761390472.git.christophe.jaillet@wanadoo.fr Signed-off-by: Andreas Hindborg commit 3a2c32d357db8d8d78f59359374d95633313d9de Author: Stefan Metzmacher Date: Wed Nov 26 16:08:42 2025 +0100 RDMA/siw: reclassify sockets in order to avoid false positives from lockdep While developing IPPROTO_SMBDIRECT support for the code under fs/smb/common/smbdirect [1], I noticed false positives like this: [T79] ====================================================== [T79] WARNING: possible circular locking dependency detected [T79] 6.18.0-rc4-metze-kasan-lockdep.01+ #1 Tainted: G OE [T79] ------------------------------------------------------ [T79] kworker/2:0/79 is trying to acquire lock: [T79] ffff88801f968278 (sk_lock-AF_INET){+.+.}-{0:0}, at: sock_set_reuseaddr+0x14/0x70 [T79] but task is already holding lock: [T79] ffffffffc10f7230 (lock#9){+.+.}-{4:4}, at: rdma_listen+0x3d2/0x740 [rdma_cm] [T79] which lock already depends on the new lock. [T79] the existing dependency chain (in reverse order) is: [T79] -> #1 (lock#9){+.+.}-{4:4}: [T79] __lock_acquire+0x535/0xc30 [T79] lock_acquire.part.0+0xb3/0x240 [T79] lock_acquire+0x60/0x140 [T79] __mutex_lock+0x1af/0x1c10 [T79] mutex_lock_nested+0x1b/0x30 [T79] cma_get_port+0xba/0x7d0 [rdma_cm] [T79] rdma_bind_addr_dst+0x598/0x9a0 [rdma_cm] [T79] cma_bind_addr+0x107/0x320 [rdma_cm] [T79] rdma_resolve_addr+0xa3/0x830 [rdma_cm] [T79] destroy_lease_table+0x12b/0x420 [ksmbd] [T79] ksmbd_NTtimeToUnix+0x3e/0x80 [ksmbd] [T79] ndr_encode_posix_acl+0x6e9/0xab0 [ksmbd] [T79] ndr_encode_v4_ntacl+0x53/0x870 [ksmbd] [T79] __sys_connect_file+0x131/0x1c0 [T79] __sys_connect+0x111/0x140 [T79] __x64_sys_connect+0x72/0xc0 [T79] x64_sys_call+0xe7d/0x26a0 [T79] do_syscall_64+0x93/0xff0 [T79] entry_SYSCALL_64_after_hwframe+0x76/0x7e [T79] -> #0 (sk_lock-AF_INET){+.+.}-{0:0}: [T79] check_prev_add+0xf3/0xcd0 [T79] validate_chain+0x466/0x590 [T79] __lock_acquire+0x535/0xc30 [T79] lock_acquire.part.0+0xb3/0x240 [T79] lock_acquire+0x60/0x140 [T79] lock_sock_nested+0x3b/0xf0 [T79] sock_set_reuseaddr+0x14/0x70 [T79] siw_create_listen+0x145/0x1540 [siw] [T79] iw_cm_listen+0x313/0x5b0 [iw_cm] [T79] cma_iw_listen+0x271/0x3c0 [rdma_cm] [T79] rdma_listen+0x3b1/0x740 [rdma_cm] [T79] cma_listen_on_dev+0x46a/0x750 [rdma_cm] [T79] rdma_listen+0x4b0/0x740 [rdma_cm] [T79] ksmbd_rdma_init+0x12b/0x270 [ksmbd] [T79] ksmbd_conn_transport_init+0x26/0x70 [ksmbd] [T79] server_ctrl_handle_work+0x1e5/0x280 [ksmbd] [T79] process_one_work+0x86c/0x1930 [T79] worker_thread+0x6f0/0x11f0 [T79] kthread+0x3ec/0x8b0 [T79] ret_from_fork+0x314/0x400 [T79] ret_from_fork_asm+0x1a/0x30 [T79] other info that might help us debug this: [T79] Possible unsafe locking scenario: [T79] CPU0 CPU1 [T79] ---- ---- [T79] lock(lock#9); [T79] lock(sk_lock-AF_INET); [T79] lock(lock#9); [T79] lock(sk_lock-AF_INET); [T79] *** DEADLOCK *** [T79] 5 locks held by kworker/2:0/79: [T79] #0: ffff88800120b158 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0xfca/0x1930 [T79] #1: ffffc9000474fd00 ((work_completion)(&ctrl->ctrl_work)) {+.+.}-{0:0}, at: process_one_work+0x804/0x1930 [T79] #2: ffffffffc11307d0 (ctrl_lock){+.+.}-{4:4}, at: server_ctrl_handle_work+0x21/0x280 [ksmbd] [T79] #3: ffffffffc11347b0 (init_lock){+.+.}-{4:4}, at: ksmbd_conn_transport_init+0x18/0x70 [ksmbd] [T79] #4: ffffffffc10f7230 (lock#9){+.+.}-{4:4}, at: rdma_listen+0x3d2/0x740 [rdma_cm] [T79] stack backtrace: [T79] CPU: 2 UID: 0 PID: 79 Comm: kworker/2:0 Kdump: loaded Tainted: G OE 6.18.0-rc4-metze-kasan-lockdep.01+ #1 PREEMPT(voluntary) [T79] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [T79] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [T79] Workqueue: events_long server_ctrl_handle_work [ksmbd] ... [T79] print_circular_bug+0xfd/0x130 [T79] check_noncircular+0x150/0x170 [T79] check_prev_add+0xf3/0xcd0 [T79] validate_chain+0x466/0x590 [T79] __lock_acquire+0x535/0xc30 [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] lock_acquire.part.0+0xb3/0x240 [T79] ? sock_set_reuseaddr+0x14/0x70 [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? __kasan_check_write+0x14/0x30 [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? apparmor_socket_post_create+0x180/0x700 [T79] lock_acquire+0x60/0x140 [T79] ? sock_set_reuseaddr+0x14/0x70 [T79] lock_sock_nested+0x3b/0xf0 [T79] ? sock_set_reuseaddr+0x14/0x70 [T79] sock_set_reuseaddr+0x14/0x70 [T79] siw_create_listen+0x145/0x1540 [siw] [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? local_clock_noinstr+0xe/0xd0 [T79] ? __pfx_siw_create_listen+0x10/0x10 [siw] [T79] ? trace_preempt_on+0x4c/0x130 [T79] ? __raw_spin_unlock_irqrestore+0x4a/0x90 [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? preempt_count_sub+0x52/0x80 [T79] iw_cm_listen+0x313/0x5b0 [iw_cm] [T79] cma_iw_listen+0x271/0x3c0 [rdma_cm] [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] rdma_listen+0x3b1/0x740 [rdma_cm] [T79] ? _raw_spin_unlock+0x2c/0x60 [T79] ? __pfx_rdma_listen+0x10/0x10 [rdma_cm] [T79] ? rdma_restrack_add+0x12c/0x630 [ib_core] [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] cma_listen_on_dev+0x46a/0x750 [rdma_cm] [T79] rdma_listen+0x4b0/0x740 [rdma_cm] [T79] ? __pfx_rdma_listen+0x10/0x10 [rdma_cm] [T79] ? cma_get_port+0x30d/0x7d0 [rdma_cm] [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? rdma_bind_addr_dst+0x598/0x9a0 [rdma_cm] [T79] ksmbd_rdma_init+0x12b/0x270 [ksmbd] [T79] ? __pfx_ksmbd_rdma_init+0x10/0x10 [ksmbd] [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? register_netdevice_notifier+0x1dc/0x240 [T79] ksmbd_conn_transport_init+0x26/0x70 [ksmbd] [T79] server_ctrl_handle_work+0x1e5/0x280 [ksmbd] [T79] process_one_work+0x86c/0x1930 [T79] ? __pfx_process_one_work+0x10/0x10 [T79] ? srso_alias_return_thunk+0x5/0xfbef5 [T79] ? assign_work+0x16f/0x280 [T79] worker_thread+0x6f0/0x11f0 I was not able to reproduce this as I was testing with various runs switching siw and rxe as well as IPPROTO_SMBDIRECT sockets, while the above stack used siw with the non IPPROTO_SMBDIRECT patches [1]. Even if this patch doesn't solve the above I think it's a good idea to reclassify the sockets used by siw, I also send patches for rxe to reclassify, as well as my IPPROTO_SMBDIRECT socket patches [1] will do it, this should minimize potential false positives. [1] https://git.samba.org/?p=metze/linux/wip.git;a=shortlog;h=refs/heads/master-ipproto-smbdirect Cc: Bernard Metzler Cc: Jason Gunthorpe Cc: Leon Romanovsky Cc: linux-rdma@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-cifs@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/20251126150842.1837072-1-metze@samba.org Acked-by: Bernard Metzler Signed-off-by: Leon Romanovsky commit 1d1b8b0734af5149946e687415bf6be05ae55bd6 Author: Baojun Xu Date: Wed Nov 26 22:14:33 2025 +0800 platform/x86: serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects The tas2781-hda supports multi-projects. In some projects, GpioInt() was dropped due to no IRQ connection. See the example code below: Device (SPKR) { Name (_ADR, One) Name (_HID, "TXNW2781") Method (_CRS, 0, NotSerialized) { Name (RBUF, ResourceTemplate () { I2cSerialBusV2 (0x0038, ...) I2cSerialBusV2 (0x0039, ...) // GpioInt (Edge, ...) { 0x0000 } //"GpioInt (...) {}" was commented out due to no IRQ connection. }) Return (RBUF) } } But in smi_i2c_probe(), smi_spi_probe() (serial-multi-instantiate.c), if looking for IRQ by smi_get_irq() fails, it will return an error, will not add new device, and cause smi_probe() to fail: [ 2.356546] Serial bus multi instantiate pseudo device driver TXNW2781:00: error -ENXIO: IRQ index 0 not found [ 2.356561] Serial bus multi instantiate pseudo device driver TXNW2781:00: error -ENXIO: Error requesting irq at index 0 So, we need to add an exception case for these situations. BTW, this patch will take effect on both I2C and SPI devices. Signed-off-by: Baojun Xu Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251126141434.11110-1-baojun.xu@ti.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit f278809475f6835b56de78b28dc2cc0c7e2c20a4 Author: Aaron Thompson Date: Thu Nov 20 10:26:33 2025 +0000 debugfs: Remove broken no-mount mode debugfs access modes were added in Linux 5.10 (Dec 2020) [1], but the no-mount mode has behaved effectively the same as the off mode since Linux 5.12 (Apr 2021) [2]. The only difference is the specific error code returned by the debugfs_create_* functions, which is -ENOENT in no-mount mode and -EPERM in off mode. Given that no-mount hasn't worked for several years with no complaints, just remove it. [1] a24c6f7bc923 ("debugfs: Add access restriction option") [2] bc6de804d36b ("debugfs: be more robust at handling improper input in debugfs_lookup()") 56348560d495 ("debugfs: do not attempt to create a new file before the filesystem is initalized") Signed-off-by: Aaron Thompson Link: https://patch.msgid.link/20251120102222.18371-3-dev@null.aaront.org Signed-off-by: Greg Kroah-Hartman commit 3ae94a55d047d133fad1e6c811befe4347b75791 Author: Aaron Thompson Date: Thu Nov 20 10:26:32 2025 +0000 debugfs: Remove redundant access mode checks debugfs_get_tree() can only be called if debugfs itself calls simple_pin_fs() or register_filesystem(), and those call paths also check the access mode. debugfs_start_creating() checks the access mode so the checks in the debugfs_create_* functions are unnecessary. An upcoming change will affect debugfs_allow, so doing this cleanup first will make that change simpler. Signed-off-by: Aaron Thompson Link: https://patch.msgid.link/20251120102222.18371-2-dev@null.aaront.org Signed-off-by: Greg Kroah-Hartman commit ed245fe9c1bf5471cf0193a08ddab367f9ca0385 Merge: f93505f3574563 d0fe7104c79569 Author: Paolo Abeni Date: Thu Nov 27 10:41:51 2025 +0100 Merge branch 'net-phy-add-support-for-fbnic-phy-w-25g-50g-and-100g-support' Alexander Duyck says: ==================== net: phy: Add support for fbnic PHY w/ 25G, 50G, and 100G support To transition the fbnic driver to using the XPCS driver we need to address the fact that we need a representation for the FW managed PMD that is actually a SerDes PHY to handle link bouncing during link training. This patch set introduces the necessary bits to the XPCS driver code to enable it to read 25G, 50G, and 100G speeds from the PCS ctrl1 register, and adds support for the approriate interfaces. The rest of this patch set enables the changes to fbnic to make use of these interfaces and expose a PMD that can provide a necessary link delay to avoid link flapping in the event that a cable is disconnected and reconnected, and to correctly expose the count for the link down events. With this we have the basic groundwork laid as with this all the bits and pieces are in place in terms of reading the configuration. The general plan for follow-on patch sets is to start looking at enabling changing the configuration in environments where that is supported. ==================== Link: https://patch.msgid.link/176374310349.959489.838154632023183753.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit d0fe7104c79569ebd66d3dcefb9f0acd831d4413 Author: Alexander Duyck Date: Fri Nov 21 08:40:52 2025 -0800 fbnic: Replace use of internal PCS w/ Designware XPCS As we have exposed the PCS registers via the SWMII we can now start looking at connecting the XPCS driver to those registers and let it mange the PCS instead of us doing it directly from the fbnic driver. For now this just gets us the ability to detect link. The hope is in the future to add some of the vendor specific registers to begin enabling XPCS configuration of the interface. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374325295.959489.14521115864034905277.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit d0ce9fd7eae048fbf4004fb4632b878807b18c57 Author: Alexander Duyck Date: Fri Nov 21 08:40:45 2025 -0800 fbnic: Add SW shim for MDIO interface to PMD and PCS In order for us to support a PCS device we need to add an MDIO bus to allow the drivers to have access to the registers for the device. This change adds such an interface. The interface will consist of 2 PHY addrs, the first one consisting of a PMD and PCS, and the second just being a PCS. There is a need for 2 PHYs addrs due to the fact that in order to support the 50GBase-CR2 mode we will need to access and configure the PCS vendor registers and RSFEC registers from the second lane identical to the first. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374324532.959489.15389723111560978054.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 1fe7978329d736e90600b16b34c7656073dc7a5a Author: Alexander Duyck Date: Fri Nov 21 08:40:38 2025 -0800 fbnic: Add handler for reporting link down event statistics We were previously not displaying the number of link_down_events tracked by the device. With this change we should now be able to display the value. The value itself tracks the calls from the phylink interface to the mac_link_down call. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374323824.959489.6915296616773178954.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 9963117a2b9b29074763ccb62fe8ee4d78ca46f2 Author: Alexander Duyck Date: Fri Nov 21 08:40:31 2025 -0800 fbnic: Add logic to track PMD state via MAC/PCS signals One complication with the design of our part is that the PMD doesn't provide a direct signal to the host. Instead we have visibility to signals that the PCS provides to the MAC that allow us to check the link state through that. We will need to account for several things in the PMD and firmware when managing the link. Specifically when the link first starts to come up the PMD will cause the link to flap. This is due to the firmware starting a training cycle when the link is first detected. This will cause link flapping if we were to immediately report link up when the PCS first detects it. To address that we are adding a pmd_state variable that is meant to be a countdown of sorts indicating the state of the PMD. If the link is down or has been reconfigured the PMD will start out in the initialize state. By default the link is assumed to be in the SEND_DATA state if it is available on initial link inspection. If link is detected while in the initialize state the PMD state will switch to training, and if after 4 seconds the link is still stable we will transition to link_ready, and finally the send_data state. With this we can avoid link flapping when a cable is first connected to the NIC. One side effect of this is that we need to pull the link state away from the PCS. For now we use a union of the PCS link state register value and the pmd_state. The plan is to add a PMD register to report the pmd_state to the phylink interface. With that we can then look at switching over to the use of the XPCS driver for fbnic instead of having an internal one. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374323107.959489.14951134213387615059.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit f18dd1b15f7a0bea5743fcbf3a62b7d2940e2dd5 Author: Alexander Duyck Date: Fri Nov 21 08:40:23 2025 -0800 fbnic: Rename PCS IRQ to MAC IRQ as it is actually a MAC interrupt Throughout several spots in the code I had called out the IRQ as being related to the PCS. However the actual IRQ is a part of the MAC and it is just exposing PCS data. To more accurately reflect the owner of the calls this change makes it so that we rename the functions and values that are taking in the interrupt value and processing it to reflect that it is a MAC call and not a PCS one. This change is mostly motivated by the fact that we will be moving the handling of this interrupt from being PCS focused to being more PMA/PMD focused as this will drive the phydev driver that I am adding instead of driving the PCS directly. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374322373.959489.12018231545479053860.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 3f29dd34f75a09ee7f8333305618edb44617d835 Author: Alexander Duyck Date: Fri Nov 21 08:40:16 2025 -0800 net: pcs: xpcs: Add support for FBNIC 25G, 50G, 100G PMD The fbnic driver is planning to make use of the XPCS driver to enable support for PCS and better integration with phylink. To do this though we will need to enable several workarounds since the PMD interface for fbnic is likely to be unique since it is a mix of two different vendor products with a unique wrapper around the IP. I have generated a PHY identifier based on IEEE 802.3-2022 22.2.4.3.1 using an OUI belonging to Meta Platforms and used with our NICs. Using this we will provide it as the PMD ID via the SW based MDIO interface so that the fbnic device can be identified and necessary workarounds enabled in the XPCS driver. As an initial workaround this change adds an exception so that soft_reset is not set when the driver is initially bound to the PCS. In addition I have added logic to integrate the PMD Rx signal detect state into the link state for the PCS. With this we can avoid the link coming up too soon on the FBNIC PMD and as a result of it being in the training state so we can avoid link flaps. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374321695.959489.6648161125012056619.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 39e138173ae7641e952b456d2de7ad2ac03e8d88 Author: Alexander Duyck Date: Fri Nov 21 08:40:09 2025 -0800 net: pcs: xpcs: Fix PMA identifier handling in XPCS The XPCS driver was mangling the PMA identifier as the original code appears to have been focused on just capturing the OUI. Rather than store a mangled ID it is better to work with the actual PMA ID and instead just mask out the values that don't apply rather than shifting them and reordering them as you still don't get the original OUI for the NIC without having to bitswap the values as per the definition of the layout in IEEE 802.3-2022 22.2.4.3.1. By laying it out as it was in the hardware it is also less likely for us to have an unintentional collision as the enum values will occupy the revision number area while the OUI occupies the upper 22 bits. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374320920.959489.17267159479370601070.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 7622d55276932bfeb947b7b6cbf7ea0aa41feeb8 Author: Alexander Duyck Date: Fri Nov 21 08:40:02 2025 -0800 net: pcs: xpcs: Add support for 25G, 50G, and 100G interfaces With this change we are adding support for 25G, 50G, and 100G interface types to the XPCS driver. This had supposedly been enabled with the addition of XLGMII but I don't see any capability for configuration there so I suspect it may need to be refactored in the future. With this change we can enable the XPCS driver with the selected interface and it should be able to detect link, speed, and report the link status to the phylink interface. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374320248.959489.11649590675011158859.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit e6c43c95009035a63091cd49736886f883127510 Author: Alexander Duyck Date: Fri Nov 21 08:39:55 2025 -0800 net: phy: Add MDIO_PMA_CTRL1_SPEED for 2.5G and 5G to reflect PMA values The 2.5G and 5G values are not consistent between the PCS CTRL1 and PMA CTRL1 values. In order to avoid confusion between the two I am updating the values to include "PMA" in the name similar to values used in similar places. To avoid breaking UAPI I have retained the original macros and just defined them as the new PMA based defines. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/176374319569.959489.6610469879021800710.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 278ff7048466349e32d85afd62a4fcaf398ac23e Author: Shyam Sundar S K Date: Thu Nov 27 14:40:38 2025 +0530 platform/x86/amd/pmf: Refactor repetitive BIOS output handling Replace repetitive switch-case statements for PMF_POLICY_BIOS_OUTPUT_* with a helper function and consolidated case handling. This reduces code duplication and improves maintainability. The 10 BIOS output policies (PMF_POLICY_BIOS_OUTPUT_1 through PMF_POLICY_BIOS_OUTPUT_10) previously each had individual case statements with identical logic. This patch introduces amd_pmf_get_bios_output_idx() to map policy values to array indices, consolidating the handling into a single case block with fallthrough. Also, add a new function amd_pmf_update_bios_output() to simplify the code handling. This approach handles non-sequential policy enum values gracefully and makes future additions easier to implement. No functional changes. Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20251127091038.2088387-1-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2585973c7f9ee31d21e5848c996fab2521fd383d Author: Haotien Hsu Date: Thu Nov 27 11:35:40 2025 +0800 usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt The driver previously skipped handling ClearFeature(ENDPOINT_HALT) when the endpoint was already not halted. This prevented the controller from resetting the data sequence number and reinitializing the endpoint state. According to USB 3.2 specification Rev. 1.1, section 9.4.5, ClearFeature(ENDPOINT_HALT) must always reset the data sequence and set the stream state machine to Disabled, regardless of whether the endpoint was halted. Remove the early return so that ClearFeature(ENDPOINT_HALT) always resets the endpoint sequence state as required by the specification. Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller") Cc: stable Signed-off-by: Haotien Hsu Signed-off-by: Wayne Chang Link: https://patch.msgid.link/20251127033540.2287517-1-waynec@nvidia.com Signed-off-by: Greg Kroah-Hartman commit c7bbc43a17697edb463ee57cff44fc00c107c72a Merge: 2b7a0f47aaf243 072f2c49572547 Author: Greg Kroah-Hartman Date: Thu Nov 27 10:09:18 2025 +0100 Merge tag 'usb-serial-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial updates for 6.19-rc1 Here are the USB serial updates for 6.19-rc1: - fix belkin_sa and kobil_sct TIOCMBIS and TIOCMBIC ioctls - match on interface number for dual-port ftdi devices with reserved jtag port - do not log reserved ftdi jtag ports on probe - apply ftdi_sio NDI quirk remapping 19200 bps consistently - drop ftdi_sio NDI quirk module parameter - clean up ftdi_sio quirk implementations - add more modem device ids Included are also various clean ups. All have been in linux-next with no reported issues. * tag 'usb-serial-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: move Telit 0x10c7 composition in the right place USB: serial: option: add Telit Cinterion FE910C04 new compositions USB: serial: option: add Foxconn T99W760 USB: serial: ftdi_sio: drop NDI quirk module parameter USB: serial: ftdi_sio: clean up NDI speed hack USB: serial: ftdi_sio: enable NDI speed hack consistently USB: serial: ftdi_sio: rename quirk symbols USB: serial: ftdi_sio: clean up quirk comments USB: serial: ftdi_sio: rewrite 8u2232c quirk USB: serial: ftdi_sio: silence jtag probe USB: serial: ftdi_sio: match on interface number for jtag USB: serial: kobil_sct: drop unnecessary initialisations USB: serial: kobil_sct: clean up set_termios() USB: serial: kobil_sct: add control request helpers USB: serial: kobil_sct: clean up device type checks USB: serial: kobil_sct: clean up tiocmset() USB: serial: belkin_sa: clean up tiocmset() USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC commit ebf8538979101ef879742dcfaf04b684f5461e12 Author: Stefan Hajnoczi Date: Wed Nov 26 16:15:48 2025 -0500 MAINTAINERS: add German Maglione as virtiofs co-maintainer German Maglione is a co-maintainer of the virtiofsd userspace device implementation (https://gitlab.com/virtio-fs/virtiofsd) and is currently one of the most active virtiofs developers outside the kernel. I have not worked on virtiofs except to review kernel patches for a few years now and would like German to take over from me gradually. It is healthier to have a kernel maintainer who is actively involved. I expect to remove myself in a few months. Signed-off-by: Stefan Hajnoczi Link: https://patch.msgid.link/20251126211548.598469-1-stefanha@redhat.com Signed-off-by: Christian Brauner commit fae00ea9f00367771003ace78f29549dead58fc7 Author: Biju Das Date: Wed Nov 26 10:42:48 2025 +0000 pwm: rzg2l-gpt: Allow checking period_tick cache value only if sibling channel is enabled The rzg2l_gpt_config() tests the rzg2l_gpt->period_tick variable when both channels of a hardware channel are in use. This check is not valid if rzg2l_gpt_config() is called after disabling all the channels, as it tests against the cached value. Hence, allow checking and setting the cached value only if the sibling channel is enabled. While at it, drop else after return statement to fix the check patch warning. Cc: stable@kernel.org Fixes: 061f087f5d0b ("pwm: Add support for RZ/G2L GPT") Signed-off-by: Biju Das Link: https://patch.msgid.link/20251126104308.142302-1-biju.das.jz@bp.renesas.com Signed-off-by: Uwe Kleine-König commit 155c9971fa88a6655431476f024566fcd9ddcdb6 Author: Leon Romanovsky Date: Wed Nov 26 09:57:37 2025 +0200 RDMA/bng_re: Remove prefetch instruction The prefetch instruction is meant to speed up access to memory referenced by its address argument. In the bng_re code path, it has no effect, because the pointer refers to a function that is executed immediately afterward. The issue was identified due to the following kbuild compilation error: drivers/infiniband/hw/bng_re/bng_fw.c: In function 'bng_re_creq_irq': drivers/infiniband/hw/bng_re/bng_fw.c:278:9: error: implicit declaration of function 'prefetch' [-Wimplicit-function-declaration] 278 | prefetch(bng_re_get_qe(hwq, sw_cons, NULL)); | ^~~~~~~~ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511260607.Kuxn4NnN-lkp@intel.com/ Fixes: 4f830cd8d7fe ("RDMA/bng_re: Add infrastructure for enabling Firmware channel") Link: https://patch.msgid.link/20251126-remove-prefetch-v1-1-fcac22007ea7@nvidia.com Signed-off-by: Leon Romanovsky commit d3cc7cd7bc46af587747399e956cf4508221476f Author: Nathan Chancellor Date: Thu Nov 20 13:22:46 2025 -0700 backlight: aw99706: Fix unused function warnings from suspend/resume ops When building for a platform without CONFIG_PM_SLEEP, such as s390, there are two unused function warnings: drivers/video/backlight/aw99706.c:436:12: error: 'aw99706_resume' defined but not used [-Werror=unused-function] 436 | static int aw99706_resume(struct device *dev) | ^~~~~~~~~~~~~~ drivers/video/backlight/aw99706.c:429:12: error: 'aw99706_suspend' defined but not used [-Werror=unused-function] 429 | static int aw99706_suspend(struct device *dev) | ^~~~~~~~~~~~~~~ SET_SYSTEM_SLEEP_PM_OPS, used within SIMPLE_DEV_PM_OPS, expands to nothing when CONFIG_PM_SLEEP is not set, so these functions are completely unused in this configuration. SIMPLE_DEV_PM_OPS is deprecated in favor of DEFINE_SIMPLE_DEV_PM_OPS, which avoids this issue by using pm_sleep_ptr to make these callbacks NULL when CONFIG_PM_SLEEP is unset while making the callback functions always appear used to the compiler regardless of configuration. Switch to DEFINE_SIMPLE_DEV_PM_OPS for aw99706_pm_ops to clear up the warning. Additionally, wrap the pointer to aw99706_pm_ops in pm_ptr() in aw99706_i2c_driver to ensure that the structure is completely eliminated in configurations without CONFIG_PM. Fixes: 88a8e9b49ee8 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251120-backlight-aw99706-fix-unused-pm-functions-v1-1-8b9c17c4e783@kernel.org Signed-off-by: Lee Jones commit b0a848f4a47a91a6b4d9a9fd739d047254df5a91 Author: Peter Zijlstra Date: Wed Nov 26 11:57:06 2025 +0100 x86/bugs: Make i386 use GENERIC_BUG_RELATIVE_POINTERS Linus figured less #ifdef is more better and making x86-32 use GENERIC_BUG_RELATIVE_POINTERS removes one layer of macro magic from the bug.h bits. Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) commit d62e4f2b9542d25d183f068033558e87e81a00a8 Author: Peter Zijlstra Date: Wed Nov 26 10:55:17 2025 +0100 x86/bug: Fix BUG_FORMAT vs KASLR Encoding a relative NULL pointer doesn't work for KASLR, when the whole kernel image gets shifted, the __bug_table and the target string get shifted by the same amount and the relative offset is preserved. However when the target is an absolute 0 value and the __bug_table gets moved about, the end result in a pointer equivalent to kaslr_offset(), not NULL. Notably, this will generate SHN_UNDEF relocations, and Ard would really like to not have those at all. Use the empty string to denote no-string. Suggested-by: Linus Torvalds Cc: Ard Biesheuvel Signed-off-by: Peter Zijlstra (Intel) commit 59bfa6408214b6533d8691715cf5459e89b45b89 Author: Alexandre Chartre Date: Wed Nov 26 14:45:19 2025 +0100 objtool: Build with disassembly can fail when including bdf.h Building objtool with disassembly support can fail when including the bdf.h file: In file included from tools/objtool/include/objtool/arch.h:108, from check.c:14: /usr/include/bfd.h:35:2: error: #error config.h must be included before this header 35 | #error config.h must be included before this header | ^~~~~ This check is present in the bfd.h file generated from the binutils source code, but it is not necessarily present in the bfd.h file provided in a binutil package (for example, it is not present in the binutil RPM). The solution to this issue is to define the PACKAGE macro before including bfd.h. This is the solution suggested by the binutil developer in bug 14243, and it is used by other kernel tools which also use bfd.h (perf and bpf). Fixes: 59953303827ec ("objtool: Disassemble code with libopcodes instead of running objdump") Closes: https://lore.kernel.org/all/3fa261fd-3b46-4cbe-b48d-7503aabc96cb@oracle.com/ Reported-by: Nathan Chancellor Suggested-by: Nathan Chancellor Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Link: https://sourceware.org/bugzilla/show_bug.cgi?id=14243 Link: https://patch.msgid.link/20251126134519.1760889-1-alexandre.chartre@oracle.com commit 7b78b26757e0d997b31635d76eaa46d5ef5e1431 Author: Bartosz Golaszewski Date: Tue Nov 25 11:19:09 2025 +0100 gpio: shared: handle the reset-gpios corner case There's an unexpected interaction between the reset-gpio driver and the shared GPIO support. The reset-gpio device is an auxiliary device that's created dynamically and fulfills a similar role to the gpio-shared-proxy driver but is limited in scope to just supporting the "reset-gpios" property. The shared GPIO core code does not take into account that the machine lookup entry we create when scanning the device-tree must connect the reset-gpio device - that is the actual consumer of the GPIO and not the consumer defined on the device tree, which in turn consumes the shared reset control exposed by the reset-gpio device - to the GPIO controller. We also must not skip the gpio-shared-proxy driver as it's possible that a shared GPIO may be used by one consumer as a reset-gpios going through the reset-gpio device and another that uses GPIOLIB. We need to make it a special case handled in gpiolib-shared.c. Add a new function - gpio_shared_dev_is_reset_gpio() - whose role it is to verify if a non-matching consumer of a shared pin is a reset-gpio device and make sure it's the right one for this pin. To that end make sure that its parent is the GPIO controller in question and that the fwnode we identified as sharing the pin references that controller via the "reset-gpios" property. Only include that code if the reset-gpio driver is enabled. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Val Packett Closes: https://lore.kernel.org/all/3b5d9df5-934d-4591-8827-6c9573a6f7ba@packett.cool/ Tested-by: Val Packett Tested-by: Abel Vesa Link: https://lore.kernel.org/r/20251125-gpiolib-shared-reset-gpio-fix-v2-1-4eb6fa41f1dd@linaro.org Signed-off-by: Bartosz Golaszewski commit 350a840110286a9ce5b33923bffd4a48e69fe65b Author: Michael S. Tsirkin Date: Wed Nov 19 07:36:33 2025 -0500 vhost/test: add test specific macro for features test just uses vhost features with no change, but people tend to copy/paste code, so let's add our own define. Message-ID: <23ca04512a800ee8b3594482492e536020931340.1764225384.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin commit 9513f25056b22100ddffe24898c587873b0d022c Author: Michael S. Tsirkin Date: Tue Oct 21 10:56:57 2025 -0400 virtio: clean up features qword/dword terms virtio pci uses word to mean "16 bits". mmio uses it to mean "32 bits". To avoid confusion, let's avoid the term in core virtio altogether. Just say U64 to mean "64 bit". Fixes: e7d4c1c5a546 ("virtio: introduce extended features") Cc: Paolo Abeni Acked-by: Jason Wang Message-ID: Signed-off-by: Michael S. Tsirkin commit 2828c60b24375a1ddb987a9fa8bff3cf65528a19 Author: Marco Crivellari Date: Fri Nov 7 16:49:17 2025 +0100 vduse: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Michael S. Tsirkin Message-Id: <20251107154917.313090-3-marco.crivellari@suse.com> commit a8980af1bf3e5bb7bbefa25db43b2ef4c00c229a Author: Marco Crivellari Date: Fri Nov 7 16:49:16 2025 +0100 virtio_balloon: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Michael S. Tsirkin Message-Id: <20251107154917.313090-2-marco.crivellari@suse.com> commit 731ca4a4cc52fd5c5ae309edcfd2d7e54ece3321 Author: Alok Tiwari Date: Sat Oct 18 10:46:46 2025 -0700 vdpa/pds: use %pe for ERR_PTR() in event handler registration Use %pe instead of %ps when printing ERR_PTR() values. %ps is intended for string pointers, while %pe correctly prints symbolic error names for error pointers returned via ERR_PTR(). This shows the returned error value more clearly. Fixes: 67f27b8b3a34 ("pds_vdpa: subscribe to the pds_core events") Signed-off-by: Alok Tiwari Reviewed-by: Brett Creeley Signed-off-by: Michael S. Tsirkin Message-Id: <20251018174705.1511982-1-alok.a.tiwari@oracle.com> commit f3f64c2eaffbc3169bbe1e5d1e897e6dacc839d1 Author: Mike Christie Date: Sat Nov 1 14:43:58 2025 -0500 vhost: Fix kthread worker cgroup failure handling If we fail to attach to a cgroup we are leaking the id. This adds a new goto to free the id. Fixes: 7d9896e9f6d0 ("vhost: Reintroduce kthread API and add mode selection") Signed-off-by: Mike Christie Acked-by: Jason Wang Reviewed-by: Chaitanya Kulkarni Signed-off-by: Michael S. Tsirkin Message-Id: <20251101194358.13605-1-michael.christie@oracle.com> commit b41ca62c0019de1321d75f2b2f274a28784a41ed Author: Miaoqian Lin Date: Mon Oct 27 14:07:35 2025 +0800 virtio: vdpa: Fix reference count leak in octep_sriov_enable() pci_get_device() will increase the reference count for the returned pci_dev, and also decrease the reference count for the input parameter from if it is not NULL. If we break the loop in with 'vf_pdev' not NULL. We need to call pci_dev_put() to decrease the reference count. Found via static anlaysis and this is similar to commit c508eb042d97 ("perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology()") Fixes: 8b6c724cdab8 ("virtio: vdpa: vDPA driver for Marvell OCTEON DPU devices") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Signed-off-by: Michael S. Tsirkin Message-Id: <20251027060737.33815-1-linmq006@gmail.com> commit f0ea2e91093ac979d07ebd033e0f45869b1d2608 Author: Alok Tiwari Date: Mon Sep 29 06:42:53 2025 -0700 vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues When query_virtqueues() fails, the error log prints the variable err instead of cmd->err. Since err may still be zero at this point, the log message can misleadingly report a success value 0 even though the command actually failed. Even worse, once err is set to the first failure, subsequent logs print that same stale value. This makes the error reporting appear one step behind the actual failing queue index, which is confusing and misleading. Fix the log to report cmd->err, which reflects the real failure code returned by the firmware. Fixes: 1fcdf43ea69e ("vdpa/mlx5: Use async API for vq query command") Signed-off-by: Alok Tiwari Acked-by: Jason Wang Reviewed-by: Dragos Tatulea Signed-off-by: Michael S. Tsirkin Message-Id: <20250929134258.80956-1-alok.a.tiwari@oracle.com> commit deb55fc994e3dc38f139c0147c15fc2a9db27086 Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:49 2025 -0500 virtio: fix map ops comment @free will free the map handle not sync it. Fix the doc to match. Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core") Message-Id: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 43236d8bbafff94b423afecc4a692dd90602d426 Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:43 2025 -0500 virtio: fix virtqueue_set_affinity() docs Rewrite the comment for better grammar and clarity. Fixes: 75a0a52be3c2 ("virtio: introduce an API to set affinity for a virtqueue") Message-Id: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 5e88a5a97d113619b674ebfdd1d2065f2edd10eb Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:41 2025 -0500 virtio: standardize Returns documentation style Remove colons after "Returns" in virtio_map_ops function documentation - both to avoid triggering an htmldoc warning and for consistency with virtio_config_ops. This affects map_page, alloc, need_sync, and max_mapping_size. Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core") Message-Id: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit c15f42e09178d2849744ccf064200f5e7f71e688 Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:38 2025 -0500 virtio: fix grammar in virtio_map_ops docs Fix grammar issues in the virtio_map_ops docs: - missing article before "transport" - "implements" -> "implement" to match subject Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core") Message-Id: <3f7bcae5a984f14b72e67e82572b110acb06fa7e.1763026134.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 63598fba55ab9d384818fed48dc04006cecf7be4 Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:36 2025 -0500 virtio: fix grammar in virtio_queue_info docs Fix grammar in the description of @ctx Fixes: c502eb85c34e ("virtio: introduce virtio_queue_info struct and find_vqs_info() config op") Message-Id: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 7831791e77a1cd29528d4dc336ce14466aef5ba6 Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:34 2025 -0500 virtio: fix whitespace in virtio_config_ops The finalize_features documentation uses a tab between words. Use space instead. Fixes: d16c0cd27331 ("docs: driver-api: virtio: virtio on Linux") Message-Id: <39d7685c82848dc6a876d175e33a1407f6ab3fc1.1763026134.git.mst@redhat.com> Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 361173f95ae4b726ebbbf0bd594274f5576c4abc Author: Michael S. Tsirkin Date: Thu Nov 13 04:34:31 2025 -0500 virtio: fix typo in virtio_device_ready() comment "coherenct" -> "coherent" Fixes: 8b4ec69d7e09 ("virtio: harden vring IRQ") Message-Id: Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit f8113000855a8cc2c6d8e19b97a390f1c082285d Author: Kriish Sharma Date: Mon Nov 10 20:29:20 2025 +0000 virtio: fix kernel-doc for mapping/free_coherent functions Documentation build reported: WARNING: ./drivers/virtio/virtio_ring.c:3174 function parameter 'vaddr' not described in 'virtqueue_map_free_coherent' WARNING: ./drivers/virtio/virtio_ring.c:3308 expecting prototype for virtqueue_mapping_error(). Prototype was for virtqueue_map_mapping_error() instead The kernel-doc block for virtqueue_map_free_coherent() omitted the @vaddr parameter, and the kernel-doc header for virtqueue_map_mapping_error() used the wrong function name (virtqueue_mapping_error) instead of the actual function name. This change updates: - the function name in the comment to virtqueue_map_mapping_error() - adds the missing @vaddr description in the comment for virtqueue_map_free_coherent() Fixes: b41cb3bcf67f ("virtio: rename dma helpers") Signed-off-by: Kriish Sharma Reviewed-by: Chaitanya Kulkarni Signed-off-by: Michael S. Tsirkin Message-Id: <20251110202920.2250244-1-kriish.sharma2006@gmail.com> commit e40b6abe0b1247d43bc61942aa7534fca7209e44 Author: Alok Tiwari Date: Wed Oct 1 12:16:50 2025 -0700 virtio_vdpa: fix misleading return in void function virtio_vdpa_set_status() is declared as returning void, but it used "return vdpa_set_status()" Since vdpa_set_status() also returns void, the return statement is unnecessary and misleading. Remove it. Fixes: c043b4a8cf3b ("virtio: introduce a vDPA based transport") Signed-off-by: Alok Tiwari Message-Id: <20251001191653.1713923-1-alok.a.tiwari@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit b72a6ddf6af225957d4b36f858d2a67b2e31fab6 Author: Dirk Su Date: Thu Nov 27 10:56:39 2025 +0800 ALSA: hda/realtek: fix mute/micmute LEDs don't work for HP 200 G2i HP 200 G2i needs quirk to make mic-mute/audio-mute working. Signed-off-by: Dirk Su Link: https://patch.msgid.link/20251127025651.13627-1-dirk.su@canonical.com Signed-off-by: Takashi Iwai commit d01a3aad7f2c183152dec02202aa1d23ee02556c Merge: d041e5e748f926 73b97d46dde64f Author: Takashi Iwai Date: Thu Nov 27 07:19:59 2025 +0100 Merge tag 'asoc-fix-v6.18-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.18 A small pile of driver specific fixes that came in during the past few weeks, none of them especially major. commit d84fe2f30b0a0cbe08260c00a84ffe42161c95ce Author: Bibo Mao Date: Thu Nov 27 11:00:18 2025 +0800 KVM: LoongArch: selftests: Add exception handler register interface Add interrupt and exception handler register interface. When exception happens, execute registered exception handler if exists, else report an error. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 1c5d3a1eab32db1ebb0d5d30736e9236e8a7014f Author: Bibo Mao Date: Thu Nov 27 11:00:18 2025 +0800 KVM: LoongArch: selftests: Add basic interfaces Add some basic function interfaces such as CSR register access, local irq enable or disable APIs. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 985a96983bedf04fa61315e68806f3468450c8a1 Author: Bibo Mao Date: Thu Nov 27 11:00:18 2025 +0800 KVM: LoongArch: selftests: Add system registers save/restore on exception When system returns from exception with ertn instruction, PC comes from LOONGARCH_CSR_ERA, and CSR.CRMD comes LOONGARCH_CSR_PRMD. Here save CSR register CSR.ERA and CSR.PRMD into stack, and then restore them from stack. So it can be modified by exception handlers in future. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit d3e43a1f34acbb9a814337fc5624765538e5a274 Author: Bibo Mao Date: Thu Nov 27 11:00:18 2025 +0800 LoongArch: KVM: Use 64-bit register definition for EIOINTC With in-kernel emulated eiointc driver, hardware register can be accessed by different size, there is reg_u8/reg_u16/reg_u32/reg_u64 union type with EIOINTC register. Here use 64-bit type with register definition and remove union type since most registers are accessed with 64-bit method. And this makes EIOINTC emulated driver simpler. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 7bcd8d0b2237fd0f698bcd0c90badf7c46270d9b Author: Song Gao Date: Thu Nov 27 11:00:18 2025 +0800 LoongArch: KVM: Add AVEC basic support Check whether the host CPU supported AVEC, and save/restore CSR_MSGIS0- CSR_MSGIS3 when necessary. Reviewed-by: Bibo Mao Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit 74087611f0ba7b336dcdde855ffca7d15b2ebe0f Author: Bibo Mao Date: Thu Nov 27 11:00:18 2025 +0800 LoongArch: KVM: Get VM PMU capability from HW GCFG register Now VM PMU capability comes from host PMU capability directly, instead bit 23 of HW GCFG CSR register also show PMU capability for VM. It will be better if it comes from HW GCFG CSR register rather than just host PMU capability, especially when LVZ feature is emulated in TCG mode, in which case without PMU capability. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit f93505f35745637b6d94efe8effa97ef26819784 Author: Raju Rangoju Date: Sun Nov 23 22:07:21 2025 +0530 amd-xgbe: let the MAC manage PHY PM Use the MAC managed PM flag to indicate that MAC driver takes care of suspending/resuming the PHY, and reset it when the device is brought up. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20251123163721.442162-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit ce69978ae8b760a98e459ad7f6a788c2f01b5166 Merge: 37a96c2009f75d c305959175856b Author: Jakub Kicinski Date: Wed Nov 26 18:22:43 2025 -0800 Merge branch 'net-hibmcge-add-support-for-tracepoint-and-pagepool-on-hibmcge-driver' Jijie Shao says: ==================== net: hibmcge: Add support for tracepoint and pagepool on hibmcge driver In this patch set: 1: add support for tracepoint for rx descriptor 2: double the rx queue depth to reduce packet drop 3: add support for pagepool on rx ==================== Link: https://patch.msgid.link/20251122034657.3373143-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit c305959175856b40dea4d9ec10bb2c72add22910 Author: Jijie Shao Date: Sat Nov 22 11:46:57 2025 +0800 net: hibmcge: add support for pagepool on rx add support for pagepool on rx, and remove the legacy path Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251122034657.3373143-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 2e68bb2e0f7712239711cabc22ceeb56c011c69d Author: Jijie Shao Date: Sat Nov 22 11:46:56 2025 +0800 net: hibmcge: reduce packet drop under stress testing Under stress test scenarios, hibmcge driver may not receive packets in a timely manner, which can lead to the buffer of the hardware queue being exhausted, resulting in packet drop. This patch doubles the software queue depth and uses half of the buffer to fill the hardware queue before receiving packets, thus preventing packet loss caused by the hardware queue buffer being exhausted. Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251122034657.3373143-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 91f3305b97fc41b42b67b9ff58441aa4d72cde2e Author: Tao Lan Date: Sat Nov 22 11:46:55 2025 +0800 net: hibmcge: add support for tracepoint to dump some fields of rx_desc add support for tracepoint to dump some fields of rx_desc Signed-off-by: Tao Lan Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20251122034657.3373143-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 37a96c2009f75d25c33b81edcb016a48e1342846 Author: Vladimir Oltean Date: Sat Nov 22 13:59:31 2025 +0200 net: fman_memac: report structured ethtool counters The FMan driver has support for 2 MACs: mEMAC (newer, present on Layerscape and PowerPC T series) and dTSEC/TGEC (older, present on PowerPC P series). I only have handy access to the mEMAC, and this adds support for MAC counters for those platforms. MAC counters are necessary for any kind of low-level debugging, and currently there is no mechanism to dump them. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251122115931.151719-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7241d80e77066dacc2fd7ad5ce29e524548a4940 Author: Vladimir Oltean Date: Sat Nov 22 13:55:23 2025 +0200 net: dpaa: fman_memac: complete phylink support with 2500base-x The DPAA phylink conversion in the following commits partially developed code for handling the 2500base-x host interface mode (called "2.5G SGMII" in LS1043A/LS1046A reference manuals). - 0fc83bd79589 ("net: fman: memac: Add serdes support") - 5d93cfcf7360 ("net: dpaa: Convert to phylink") In principle, having phy-interface-mode = "2500base-x" and a pcsphy-handle (unnamed or with pcs-handle-names = "sgmii") in the MAC device tree node results in PHY_INTERFACE_MODE_2500BASEX being set in phylink_config :: supported_interfaces, but this isn't sufficient. Because memac_select_pcs() returns no PCS for PHY_INTERFACE_MODE_2500BASEX, the Lynx PCS code never engages. There's a chance the PCS driver doesn't have any configuration to change for 2500base-x fixed-link (based on bootloader pre-initialization), but there's an even higher chance that this is not the case, and the PCS remains misconfigured. More importantly, memac_if_mode() does not handle PHY_INTERFACE_MODE_2500BASEX, and it should be telling the mEMAC to configure itself in GMII mode (which is upclocked by the PCS). Currently it prints a WARN_ON() and returns zero, aka IF_MODE_10G (incorrect). The additional case statement in memac_prepare() for calling phy_set_mode_ext() does not make any difference, because there is no generic PHY driver for the Lynx 10G SerDes from LS1043A/LS1046A. But we add it nonetheless, for consistency. Regarding the question "did 2500base-x ever work with the FMan mEMAC mainline code prior to the phylink conversion?" - the answer is more nuanced. For context, the previous phylib-based implementation was unable to describe the fixed-link speed as 2500, because the software PHY implementation is limited to 1G. However, improperly describing the link as an sgmii fixed-link with speed = <1000> would have resulted in a functional 2.5G speed, because there is no other difference than the SerDes lane clock net frequency (3.125 GHz for 2500base-x) - all the other higher-level settings are the same, and the SerDes lane frequency is currently handled by the RCW. But this hack cannot be extended towards a phylib PHY such as Aquantia operating in OCSGMII, because the latter requires phy-mode = "2500base-x", which the mEMAC driver did not support prior to the phylink conversion. So I do not really consider this a regression, just completing support for a missing feature. The FMan mEMAC driver sets phylink's "default_an_inband" property to true, making it as if the device tree node had the managed = "in-band-status" property anyway. This default made sense for SGMII, where it was added to avoid regressions, but for 2500base-x we learned only recently how to enable in-band autoneg: https://lore.kernel.org/netdev/20251122113433.141930-1-vladimir.oltean@nxp.com/ so the driver needs to opt out of this default in-band enabled behaviour, and only enable in-band based on the device tree property. Suggested-by: Russell King (Oracle) Link: https://lore.kernel.org/netdev/aIyx0OLWGw5zKarX@shell.armlinux.org.uk/#t Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251122115523.150260-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 002373a8b01df23be072bb91741c2e8b2b70ccc1 Author: Vladimir Oltean Date: Sat Nov 22 13:04:27 2025 +0200 net: phy: dp83867: implement configurability for SGMII in-band auto-negotiation Implement the inband_caps() and config_inband() PHY driver methods, to allow working with PCS devices that do not support or want in-band to be used. There is a complication due to existing logic from commit c76acfb7e19d ("net: phy: dp83867: retrigger SGMII AN when link change") which might re-enable what dp83867_config_inband() has disabled. So we need to modify dp83867_link_change_notify() to use phy_modify_changed() when temporarily disabling in-band autoneg. If the return code is 0, it means the original in-band was disabled and we need to keep it disabled. If the return code is 1, the original was enabled and we need to re-enable it. If negative, there was an error, which was silent before, and remains silent now. dp83867_config_inband() and dp83867_link_change_notify() are serialized by the phydev->lock. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251122110427.133035-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 308b7dee3e5c767e88bbecceff3883c8b17c55b6 Author: Hangbin Liu Date: Mon Nov 24 02:20:55 2025 +0000 tools: ynl: add YNL test framework Add a test framework for YAML Netlink (YNL) tools, covering both CLI and ethtool functionality. The framework includes: 1) cli: family listing, netdev, ethtool, rt-* families, and nlctrl operations 2) ethtool: device info, statistics, ring/coalesce/pause parameters, and feature gettings The current YNL syntax is a bit obscure, and end users may not always know how to use it. This test framework provides usage examples and also serves as a regression test to catch potential breakages caused by future changes. Reviewed-by: Donald Hunter Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251124022055.33389-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 546dbb0223102813ffb5bbcb9443a47c3183f195 Author: Guenter Roeck Date: Thu Oct 23 09:04:14 2025 -0700 of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node Starting with commit 69a8b62a7aa1 ("riscv: acpi: avoid errors caused by probing DT devices when ACPI is used"), riscv images no longer populate devicetree if ACPI is enabled. This causes unit tests to fail which require the root node to be set. # Subtest: of_dtb # module: of_test 1..2 # of_dtb_root_node_found_by_path: EXPECTATION FAILED at drivers/of/of_test.c:21 Expected np is not null, but is # of_dtb_root_node_found_by_path: pass:0 fail:1 skip:0 total:1 not ok 1 of_dtb_root_node_found_by_path # of_dtb_root_node_populates_of_root: EXPECTATION FAILED at drivers/of/of_test.c:31 Expected of_root is not null, but is # of_dtb_root_node_populates_of_root: pass:0 fail:1 skip:0 total:1 not ok 2 of_dtb_root_node_populates_of_root Skip those tests for RISCV if the root node is not populated. Fixes: 69a8b62a7aa1 ("riscv: acpi: avoid errors caused by probing DT devices when ACPI is used") Cc: Han Gao Cc: Paul Walmsley Signed-off-by: Guenter Roeck Reviewed-by: Paul Walmsley # arch/riscv Link: https://patch.msgid.link/20251023160415.705294-1-linux@roeck-us.net Signed-off-by: Rob Herring (Arm) commit d08989276a4ba82478613787e96791b234e953ba Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:56 2025 +0100 soc: tegra: Simplify with of_machine_device_match() Replace open-coded getting root OF node and matching against it with new of_machine_device_match() helper. Reviewed-by: Jon Hunter Signed-off-by: Krzysztof Kozlowski Acked-by: Thierry Reding Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-11-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 57f77cb75b74b11dc57ad28a8554dcaec295a0b6 Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:55 2025 +0100 soc: qcom: ubwc: Simplify with of_machine_get_match_data() Replace open-coded getting root OF node, matching against it and getting the match data with new of_machine_get_match_data() helper. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-10-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 599ff56eece8592555a07db03663bc830836b5aa Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:54 2025 +0100 powercap: dtpm: Simplify with of_machine_get_match_data() Replace open-coded getting root OF node, matching against it and getting the match data with new of_machine_get_match_data() helper. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Lukasz Luba Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-9-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit fa622c9e9ba7ed0f95c66fd246b1ed14316cbb0e Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:53 2025 +0100 platform: surface: Simplify with of_machine_get_match_data() Replace open-coded getting root OF node, matching against it and getting the match data with new of_machine_get_match_data() helper. Acked-by: Ilpo Järvinen Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-8-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 430446975142c73e1dabfee22307999ec1c4e6ce Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:52 2025 +0100 irqchip/atmel-aic: Simplify with of_machine_get_match_data() Replace open-coded getting root OF node, matching against it and getting the match data with new of_machine_get_match_data() helper. Acked-by: Nicolas Ferre Acked-by: Thomas Gleixner Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alexandre Belloni Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-7-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit f83b42705782c781bf10789f044e8a3bb5cc477a Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:51 2025 +0100 firmware: qcom: scm: Simplify with of_machine_device_match() Replace open-coded getting root OF node and matching against it with new of_machine_device_match() helper. Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-6-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 4b94d21fac33527ad79e0f2ee9bd212c058efaf2 Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:50 2025 +0100 cpuidle: big_little: Simplify with of_machine_device_match() Replace open-coded getting root OF node and matching against it with new of_machine_device_match() helper. Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-5-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 1ead1349fb5856fa406857528baf80337faff7a2 Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:49 2025 +0100 cpufreq: sun50i: Simplify with of_machine_device_match() Replace open-coded getting root OF node and matching against it with new of_machine_device_match() helper. Acked-by: Chen-Yu Tsai Acked-by: Viresh Kumar Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-4-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 83121ec1870930c6d8c759423b27060d179b6125 Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:48 2025 +0100 cpufreq: mediatek: Simplify with of_machine_get_match_data() Replace open-coded getting root OF node, matching against it and getting the match data with new of_machine_get_match_data() helper. Acked-by: Viresh Kumar Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-3-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 6ea891a6dd370ab2600b160c13d95db95976a5c7 Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:47 2025 +0100 cpufreq: dt-platdev: Simplify with of_machine_get_match_data() Replace open-coded getting root OF node, matching against it and getting the match data with two new helpers: of_machine_get_match_data() and of_machine_device_match(). Acked-by: Viresh Kumar Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-2-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 4a93adcbd201aad5ba607810cfe1b19d44e5d171 Author: Krzysztof Kozlowski Date: Wed Nov 12 11:28:46 2025 +0100 of: Add wrappers to match root node with OF device ID tables Several drivers duplicate same code for getting reference to the root node, matching it against 'struct of_device_id' table and getting out the match data from the table entry. There is a of_machine_compatible_match() wrapper but it takes array of strings, which is not suitable for many drivers since they want the driver data associated with each compatible. Add two wrappers, similar to existing of_device_get_match_data(): 1. of_machine_device_match() doing only matching against 'struct of_device_id' and returning bool. 2. of_machine_get_match_data() doing the matching and returning associated driver data for found compatible. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Krzysztof Kozlowski Reviewed-by: Lukasz Luba Tested-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251112-b4-of-match-matchine-data-v2-1-d46b72003fd6@linaro.org Signed-off-by: Rob Herring (Arm) commit 651765e8d527427e1d91fb7f606c5506f437f622 Author: Hangbin Liu Date: Tue Nov 25 11:20:48 2025 +0000 netlink: specs: add big-endian byte-order for u32 IPv4 addresses The fix commit converted several IPv4 address attributes from binary to u32, but forgot to specify byte-order: big-endian. Without this, YNL tools display IPv4 addresses incorrectly due to host-endian interpretation. Add the missing byte-order: big-endian to all affected u32 IPv4 address fields to ensure correct parsing and display. Fixes: 1064d521d177 ("netlink: specs: support ipv4-or-v6 for dual-stack fields") Reported-by: Paolo Abeni Signed-off-by: Hangbin Liu Reviewed-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20251125112048.37631-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit a8080c2f0e50f7d209fe95edaaec516b3db586f2 Merge: 4585847fddfc9c 73d834cd177418 Author: Jakub Kicinski Date: Wed Nov 26 17:09:12 2025 -0800 Merge branch 'net-intel-migrate-to-get_rx_ring_count-ethtool-callback' Breno Leitao says: ==================== net: intel: migrate to .get_rx_ring_count() ethtool callback This series migrates Intel network drivers to use the new .get_rx_ring_count() ethtool callback introduced in commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries"). The new callback simplifies the .get_rxnfc() implementation by removing ETHTOOL_GRXRINGS handling and moving it to a dedicated callback. This provides a cleaner separation of concerns and aligns these drivers with the modern ethtool API. The series updates the following Intel drivers: - idpf - igb - igc - ixgbevf - fm10k ==================== Link: https://patch.msgid.link/20251125-gxring_intel-v2-0-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit 73d834cd17741839a3bb2a753cc83dfd3fdda13a Author: Breno Leitao Date: Tue Nov 25 02:19:51 2025 -0800 fm10k: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns fm10k with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-8-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit 3399fd519dd4f8fd8451cf18eb7f2eef0b47e39a Author: Breno Leitao Date: Tue Nov 25 02:19:50 2025 -0800 ixgbevf: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns ixgbevf with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-7-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit 768ce58dddb26c591a2b77a659f779e730f1796c Author: Breno Leitao Date: Tue Nov 25 02:19:49 2025 -0800 igc: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns igc with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-6-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit d6c744f46816994d9e8b7e9f37065caba6664e86 Author: Breno Leitao Date: Tue Nov 25 02:19:48 2025 -0800 igb: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns igb with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-5-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit 873a1942fbc622694ef21b43eb567bdcd163ab86 Author: Breno Leitao Date: Tue Nov 25 02:19:47 2025 -0800 idpf: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns idpf with the new ethtool API for querying RX ring parameters. I was not totally convinced I needed to have the lock, but, I decided to be on the safe side and get the exact same behaviour it was before. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-4-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit 8e8c00e1d2130c7d174b799cd5ebc4b41f325aa8 Author: Breno Leitao Date: Tue Nov 25 02:19:46 2025 -0800 ice: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns ice with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-3-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit fe0a3d7d1dca4b8d37710becf10ffd7fcfe2741e Author: Breno Leitao Date: Tue Nov 25 02:19:45 2025 -0800 iavf: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns iavf with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-2-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit a8acbcbaf6d0c33555cc043ce3f006aaec0ccb3f Author: Breno Leitao Date: Tue Nov 25 02:19:44 2025 -0800 i40e: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns i40e with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Signed-off-by: Aleksandr Loktionov Link: https://patch.msgid.link/20251125-gxring_intel-v2-1-f55cd022d28b@debian.org Signed-off-by: Jakub Kicinski commit 4585847fddfc9c8d5fe9f8c3318aa88e3629eede Merge: fdaf715b1acb5c b35e94edf2290e Author: Jakub Kicinski Date: Wed Nov 26 17:05:44 2025 -0800 Merge branch 'unify-platform-suspend-resume-routines-for-pci-dwmac-glue' Yao Zi says: ==================== Unify platform suspend/resume routines for PCI DWMAC glue There are currently three PCI-based DWMAC glue drivers in tree, stmmac_pci.c, dwmac-intel.c, and dwmac-loongson.c. Both stmmac_pci.c and dwmac-intel.c implements the same and duplicated platform suspend/resume routines. This series introduces a new PCI helper library, stmmac_libpci.c, providing a pair of helpers, stmmac_pci_plat_{suspend,resume}, and replaces the driver-specific implementation with the helpers to reduce code duplication. The helper will also simplify the Motorcomm DWMAC glue driver which I'm working on. The glue driver for Intel controllers isn't covered by the series, since its suspend routine doesn't call pci_disable_device() and thus is a little different from the new generic helpers. I only have Loongson hardware on hand, thus the series is only tested on Loongson 3A5000 machine. I could confirm the controller works after resume, and WoL works as expected. This shouldn't break stmmac_pci.c, either, since the new helpers have the exactly same code as the old driver-specific suspend/resume hooks. ==================== Link: https://patch.msgid.link/20251124160417.51514-1-ziyao@disroot.org Signed-off-by: Jakub Kicinski commit b35e94edf2290ee72ddbbacc29adc2b7eab7d7f3 Author: Yao Zi Date: Mon Nov 24 16:04:17 2025 +0000 net: stmmac: pci: Use generic PCI suspend/resume routines Convert STMMAC PCI glue driver to use the generic platform suspend/resume routines for PCI controllers, instead of implementing its own one. Signed-off-by: Yao Zi Reviewed-by: Russell King (Oracle) Reviewed-by: Yanteng Si Link: https://patch.msgid.link/20251124160417.51514-4-ziyao@disroot.org Signed-off-by: Jakub Kicinski commit c4064af1c7e37d81d9556057e8d0295f0be9eef4 Author: Yao Zi Date: Mon Nov 24 16:04:16 2025 +0000 net: stmmac: loongson: Use generic PCI suspend/resume routines Convert glue driver for Loongson DWMAC controller to use the generic platform suspend/resume routines for PCI controllers, instead of implementing its own one. Signed-off-by: Yao Zi Reviewed-by: Russell King (Oracle) Acked-by: Yanteng Si Link: https://patch.msgid.link/20251124160417.51514-3-ziyao@disroot.org Signed-off-by: Jakub Kicinski commit 4440bf5f2e75a6ed5d451569e317c24e6e222e09 Author: Yao Zi Date: Mon Nov 24 16:04:15 2025 +0000 net: stmmac: Add generic suspend/resume helper for PCI-based controllers Most glue driver for PCI-based DWMAC controllers utilize similar platform suspend/resume routines. Add a generic implementation to reduce duplicated code. Signed-off-by: Yao Zi Reviewed-by: Russell King (Oracle) Reviewed-by: Yanteng Si Link: https://patch.msgid.link/20251124160417.51514-2-ziyao@disroot.org Signed-off-by: Jakub Kicinski commit fdaf715b1acb5c765379489d6e71ec3f302975df Merge: c01a6e5b2e4f21 dadc51871d7682 Author: Jakub Kicinski Date: Wed Nov 26 16:56:36 2025 -0800 Merge branch 'add-hwtstamp_get-callback-to-phy-drivers' Vadim Fedorenko says: ==================== add hwtstamp_get callback to phy drivers PHY drivers are able to configure HW time stamping and are not able to report configuration back to user space. Add callback to report configuration like it's done for net_device and add implementation to the drivers. ==================== Link: https://patch.msgid.link/20251124181151.277256-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit dadc51871d768268ee29580fcdf21ac51b306c21 Author: Vadim Fedorenko Date: Mon Nov 24 18:11:51 2025 +0000 ptp: ptp_ines: add HW timestamp configuration reporting The driver partially stores HW timestamping configuration, but missing pieces can be read from HW. Add callback to report configuration. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251124181151.277256-8-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit d51de60b8edb8f333bdf84677ae273b6731ee52c Author: Vadim Fedorenko Date: Mon Nov 24 18:11:50 2025 +0000 net: phy: nxp-c45-tja11xx: add HW timestamp configuration reporting The driver stores HW timestamping configuration and can technically report it. Add callback to do it. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251124181151.277256-7-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit ab95392ab5d3000d68806d77e6d7ae32a8d7edec Author: Vadim Fedorenko Date: Mon Nov 24 18:11:49 2025 +0000 phy: mscc: add HW timestamp configuration reporting The driver stores HW configuration and can technically report it. Add callback to do it. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251124181151.277256-6-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 036bb4a5372ee13543d3c67959a8f071e8a4308f Author: Vadim Fedorenko Date: Mon Nov 24 18:11:48 2025 +0000 net: phy: dp83640: add HW timestamp configuration reporting The driver stores configuration of TX timestamping and can technically report it. Patch RX timestamp configuration storage to be more precise on reporting and add callback to actually report it. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251124181151.277256-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 1cff8392df0cb43716204948cc82633af14e67fd Author: Vadim Fedorenko Date: Mon Nov 24 18:11:47 2025 +0000 net: phy: broadcom: add HW timestamp configuration reporting The driver stores configuration information and can technically report it. Implement hwtstamp_get callback to report the configuration. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251124181151.277256-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit f467777efbfb8034d813b601b961b25f777b3d37 Author: Vadim Fedorenko Date: Mon Nov 24 18:11:46 2025 +0000 phy: add hwtstamp_get callback to phy drivers PHY devices had lack of hwtstamp_get callback even though most of them are tracking configuration info. Introduce new call back to mii_timestamper. Reviewed-by: Russell King (Oracle) Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251124181151.277256-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 6aac2aa2dfae38b60f22c3dfe4103ceefbe2d761 Author: Vadim Fedorenko Date: Mon Nov 24 18:11:45 2025 +0000 phy: rename hwtstamp callback to hwtstamp_set PHY devices has hwtstamp callback which actually performs set operation. Rename it to better reflect the action. Reviewed-by: Russell King (Oracle) Reviewed-by: Kory Maincent Reviewed-by: Andrew Lunn Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251124181151.277256-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit c01a6e5b2e4f21d31cf725b9f3803cb0280b1b8d Author: Willem de Bruijn Date: Tue Nov 25 18:35:05 2025 -0500 selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests The --send_omit_free flag is needed for TCP zero copy tests, to ensure that packetdrill doesn't free the send() buffer after the send() call. Fixes: 1e42f73fd3c2 ("selftests/net: packetdrill: import tcp/zerocopy") Closes: https://lore.kernel.org/netdev/20251124071831.4cbbf412@kernel.org/ Suggested-by: Neal Cardwell Signed-off-by: Willem de Bruijn Link: https://patch.msgid.link/20251125234029.1320984-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 83348905e4137742c93bfd8104ce71c637121d38 Author: Andreas Gruenbacher Date: Wed Oct 29 21:00:18 2025 +0000 gfs2: Clean up SDF_JOURNAL_LIVE flag handling Change do_withdraw() to clear the SDF_JOURNAL_LIVE flag under the log flush lock. In addition, change __gfs2_trans_begin() to check if the filesystem is already known to be withdrawn using gfs2_withdrawn(). Then, once we are holding the log flush lock, check if the SDF_JOURNAL_LIVE flag is still set. This second check ensures that the filesystem will remain live until the transaction is submitted. With these changes, it is no longer useful to clear SDF_JOURNAL_LIVE in gfs2_end_log_write() after calling gfs2_withdraw(). Signed-off-by: Andreas Gruenbacher commit 16c31979840399e6e5542f861c6fb18f9086f3c9 Author: Andreas Gruenbacher Date: Tue Oct 28 21:38:54 2025 +0000 gfs2: No longer thaw filesystems during a withdraw Previously, when a withdraw occurred, we would wait for another node to recover our journal. This also meant that frozen filesystem needed to be thawed because otherwise, other nodes wouldn't be able to recover the filesystem. With the reversal of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"), we are no longer waiting for journal recovery during a withdraw, so we no longer need to thaw frozen filesystems, either. This also fixes a potential deadlock reported by lockdep when running xfstest generic/108. In addition, there is nothing left in do_withdraw() that would require taking sd_freeze_mutex, so don't bother taking that lock there anymore. Signed-off-by: Andreas Gruenbacher commit 3a88edc1657da9a847041ea994e66e26db9578d2 Author: Andreas Gruenbacher Date: Thu Aug 21 22:46:39 2025 +0200 gfs2: Withdraw immediately in gfs2_trans_add_meta We can now withdraw while the log is locked. Signed-off-by: Andreas Gruenbacher commit bbbf1529ea9b85072e58c164a9a5d82554ffa941 Author: Andreas Gruenbacher Date: Sat Aug 2 12:56:37 2025 +0200 gfs2: New gfs2_withdraw_helper Currently, when a gfs2 filesystem is withdrawn, an "offline" uevent is triggered that invokes gfs2-util's gfs2_withdraw_helper script. The purpose of this script is to deactivate the filesystem's block device so that it can be withdrawn immediately, even before all the filesystem's caches have been discarded. The script provided by gfs2-utils never did anything useful, and there was no way for it to report back its status to the kernel. To fix that, extend the gfs2_withdraw_helper mechanism so that the script can report one of the following results by writing the corresponding value into "/sys$DEVPATH/lock_module/withdraw": 0 - The shared block device has been marked inactive. Future write operations will fail. 1 - The shared block device may still be active and carry out write operations. If the "offline" uevent isn't reacted upon within the timeout configured in /sys$DEVPATH/tune/withdraw_helper_timeout (default 5 seconds), the event handler is assumed to have failed. In addition, add an additional "errors=deactivate" mount option. With these changes, if fatal errors are detected on a gfs2 filesystem and the filesystem is mounted with the "errors=panic" option, the kernel will panic immediately. Otherwise, an attempt will be made to deactivate the underlying block device. If successful, the kernel will release all cluster-wide locks immediately so that the rest of the cluster can continue. If unsuccessful, the kernel will either panic ("errors=deactivate"), or it will purge all filesystem I/O before releasing all cluster-wide locks ("errors=withdraw"). Note that the gfs2_withdraw_helper script still needs to be fixed to take advantage of these improvements. It could be changed to use a mechanism like LVM Persistent Reservations. "dmsetup suspend" is not a suitable mechanism as it infinitely postpones I/O operations, which may prevent withdraw from completing. Signed-off-by: Andreas Gruenbacher commit 0e10da69d1671109b2ae5ed3eed6aa44b5ee64bc Author: Andreas Gruenbacher Date: Tue Aug 5 00:07:02 2025 +0200 gfs2: Clean up properly during a withdraw During a withdraw, we don't want to write out any more data than we have to, so in do_xmote(), skip the ->go_sync() glock operation. We still want to keep calling ->go_inval() to discard any cached data or metadata, whether clean or dirty. We do still allow glocks to transition into state LM_ST_UNLOCKED. This has the desired side effect of calling ->go_inval() and invalidating the glock caches. Function gfs2_withdraw_glocks() is already used for dequeuing any left-over waiters. We still want that to happen, but additionally, we want all glocks to be unlocked. Finally, we change function do_promote() to refuse any further promotions. This commit cleans up the leftovers of commit 86934198eefa ("gfs2: Clear flags when withdraw prevents xmote"). Signed-off-by: Andreas Gruenbacher commit 473678ccb97dabeebc802d01a7f5c80e3a82b04c Author: Andreas Gruenbacher Date: Tue Aug 12 14:48:28 2025 +0200 gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} Rename function gfs2_gl_dq_holders() to gfs2_withdraw_glocks(). This function will soon be used for more than just dequeuing holders. Signed-off-by: Andreas Gruenbacher commit 655531c95be333cb979fb58f6825ddae40455c13 Author: Andreas Gruenbacher Date: Sat Aug 9 22:04:00 2025 +0200 Revert "gfs2: fix infinite loop when checking ail item count before go_inval" The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts commit 33dbd1e41a1d ("gfs2: fix infinite loop when checking ail item count before go_inval"). Signed-off-by: Andreas Gruenbacher commit af572efef10a5fcfe686a413e53ad6a2bdd24603 Author: Andreas Gruenbacher Date: Tue Aug 5 01:26:25 2025 +0200 Revert "gfs2: Allow some glocks to be used during withdraw" The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts commit a72d2401f54b ("gfs2: Allow some glocks to be used during withdraw"). Signed-off-by: Andreas Gruenbacher commit 41ad1f7c8b0a63c782a844fd31c54f37e3438a80 Author: Andreas Gruenbacher Date: Wed Aug 6 12:14:55 2025 +0200 Revert "gfs2: Check for log write errors before telling dlm to unlock" The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts the rest of d93ae386ef3d ("gfs2: Check for log write errors before telling dlm to unlock"). Signed-off-by: Andreas Gruenbacher commit 6bb7c1bf5a622818e00480448ff661c72969bcdc Author: Andreas Gruenbacher Date: Mon Aug 4 19:49:30 2025 +0200 Revert "gfs2: fix a deadlock on withdraw-during-mount" The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount"). Signed-off-by: Andreas Gruenbacher commit dcc42d554176b4b1f767693db74a35e38fb4f6aa Author: Andreas Gruenbacher Date: Thu Jul 31 23:49:37 2025 +0200 Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts parts of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"). Signed-off-by: Andreas Gruenbacher commit 406058184c593857d4512a5c58cc51b42d8eb87f Author: Andreas Gruenbacher Date: Tue Jul 29 15:22:35 2025 +0200 Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts parts of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"). Signed-off-by: Andreas Gruenbacher commit a07a1e46d27a75338be93ba8d4e366733ada8e9b Author: Andreas Gruenbacher Date: Sat Jul 26 15:09:27 2025 +0200 Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts parts of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"). Signed-off-by: Andreas Gruenbacher commit 4cee5b0f7a82776dfcb33bc28b236a289d0e6b4c Author: Andreas Gruenbacher Date: Fri Jul 25 21:40:45 2025 +0200 Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts parts of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"). Signed-off-by: Andreas Gruenbacher commit 2aae092dc40f1ad16d3a47951b9d60c398e80129 Author: Andreas Gruenbacher Date: Fri Jul 25 19:01:17 2025 +0200 Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts parts of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"). Signed-off-by: Andreas Gruenbacher commit 20b44ddbbb0712db15c6946eb94a9e240c1ba271 Author: Andreas Gruenbacher Date: Tue Aug 5 23:43:12 2025 +0200 Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. Reverts parts of commit 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish"). Signed-off-by: Andreas Gruenbacher commit 833c93caea00b0aef3e22a08fd20acacf212b6fc Author: Andreas Gruenbacher Date: Fri Jul 25 22:06:56 2025 +0200 Revert "gfs2: don't stop reads while withdraw in progress" The current withdraw code duplicates the journal recovery code gfs2 already has for dealing with node failures, and it does so poorly. That code was added because when releasing a lockspace, we didn't have a way to indicate that the lockspace needs recovery. We now do have this feature, so the current withdraw code can be removed almost entirely. This is one of several steps towards that. The withdrawing node has no role in recovering from the withdraw anymore, so it also no longer needs to read metadata blocks after a withdraw. We now only need to set a single bit in gfs2_withdraw(), so switch from try_cmpxchg() to test_and_set_bit(). Reverts commit 8cc67f704f4b ("gfs2: don't stop reads while withdraw in progress"). Signed-off-by: Andreas Gruenbacher commit 1714e8543dbe21bbd33e62df926552f943f8f5cd Author: Andreas Gruenbacher Date: Wed Jul 16 15:18:09 2025 +0200 gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} GFS sets the LM_FLAG_NOEXP flag on locking requests it makes during journal recovery, so rename the flag to LM_FLAG_RECOVER for improved code readability. Signed-off-by: Andreas Gruenbacher commit fab27b49305c8cabe9c5bf91a66f8ca4884c1aec Author: Andreas Gruenbacher Date: Wed Aug 6 00:08:42 2025 +0200 gfs2: Kill gfs2_io_error_bh_wd All callers of gfs2_io_error_bh() call gfs2_withdraw() as well, so change gfs2_io_error_bh() to call gfs2_withdraw() directly. This also brings it in line with other similar error reporting functions. With that, gfs2_io_error_bh() is the same as gfs2_io_error_bh_wd(), so remove the latter. Signed-off-by: Andreas Gruenbacher commit 0e2038a90cad0f88806bf9ccc65a9309e920611a Author: Andreas Gruenbacher Date: Tue Aug 5 23:52:51 2025 +0200 gfs2: Withdraw immediately on log write errors Now that gfs2_withdraw() is asynchronous, immediately withdraw when a log write error is detected. Signed-off-by: Andreas Gruenbacher commit 1b7d498dcab489c4bcbc46870264fbeaf81c16e7 Author: Andreas Gruenbacher Date: Wed Aug 6 17:30:40 2025 +0200 gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn With delayed withdraws and the SDF_WITHDRAWING flag gone, we can now rename gfs2_withdrawing_or_withdrawn() back to gfs2_withdrawn(). Signed-off-by: Andreas Gruenbacher commit 8daf6c2b3d8ceea5559cceb8ed7e1275ee72a7be Author: Andreas Gruenbacher Date: Tue Aug 5 23:32:39 2025 +0200 gfs2: Get rid of delayed withdraws Now that gfs2_withdraw() is asynchronous, is can be called in any context and there is no more need for gfs2_withdraw_delayed() or for turning delayed withdraws into actual withdraws. Remove the now-obsolete code. Signed-off-by: Andreas Gruenbacher commit 9c4a3de6cd5b46aa743c460b86eb58fe5f93daec Author: Andreas Gruenbacher Date: Tue Aug 5 23:12:06 2025 +0200 gfs2: Asynchronous withdraw So far, withdraws are carried out in the context of the calling task. When another task tries to withdraw while a withdraw is already underway, that task blocks as well. Change that to carry out withdraws asynchronously in workqueue context and don't block the task triggering the withdraw anymore. Fixes: syzbot+6b156e132970e550194c@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher commit 9334c73fb16b183a6d4af09ce1d445f7f89b8d49 Author: Andreas Gruenbacher Date: Thu Jul 17 02:03:28 2025 +0200 gfs2: Add clean argument to lm_unmount hook Add a 'clean' argument to ->lm_unmount() that indicates whether the filesystem is clean or needs recovery. Set clean to true for normal unmounts, and to false for withdraws. Signed-off-by: Andreas Gruenbacher commit 94f56488c7e47579aae8f20323c43d27b7b5f4ef Author: Andreas Gruenbacher Date: Wed Nov 26 23:32:33 2025 +0000 gfs2: Clean up quotad timeout handling Instead of tracking the remaining time, track the deadline of each of the timeouts. Signed-off-by: Andreas Gruenbacher commit dff1fb6d8b7abe5b1119fa060f5d6b3370bf10ac Author: Andreas Gruenbacher Date: Wed Nov 26 23:27:14 2025 +0000 gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" Commit e4a8b5481c59a ("gfs2: Switch to wait_event in gfs2_quotad") broke cyclic statfs syncing, so the numbers reported by "df" could easily get completely out of sync with reality. Fix this by reverting part of commit e4a8b5481c59a for now. A follow-up commit will clean this code up later. Signed-off-by: Andreas Gruenbacher commit 5b351583a327f59438bb87832b8eedfa972e2c3d Author: Andreas Gruenbacher Date: Tue Nov 25 19:15:22 2025 +0000 gfs2: Minor cosmetic remote delete cleanups Rename gfs2_try_evict() to gfs2_try_to_evict(). The GIF_DEFER_DELETE flag has been superceded by the GLF_DEFER_DELETE flag, so fix a left-over comment. Add a clarifying comment to delete_work_func(). Signed-off-by: Andreas Gruenbacher commit 64c10ed9274bc46416f502afea48b4ae11279669 Author: Andreas Gruenbacher Date: Wed Nov 19 12:14:24 2025 +0000 gfs2: fix remote evict for read-only filesystems When a node tries to delete an inode, it first requests exclusive access to the iopen glock. This triggers demote requests on all remote nodes currently holding the iopen glock. To satisfy those requests, the remote nodes evict the inode in question, or they poke the corresponding inode glock to signal that the inode is still in active use. This behavior doesn't depend on whether or not a filesystem is read-only, so remove the incorrect read-only check. Signed-off-by: Andreas Gruenbacher commit af7273cc7ae01f5b3e34e62f59588ce79fe50f79 Author: Ankit Khushwaha Date: Tue Nov 25 22:23:02 2025 +0530 selftests/net: initialize char variable to null char variable in 'so_txtime.c' & 'txtimestamp.c' were left uninitilized when switch default case taken. which raises following warning. txtimestamp.c:240:2: warning: variable 'tsname' is used uninitialized whenever switch default is taken [-Wsometimes-uninitialized] so_txtime.c:210:3: warning: variable 'reason' is used uninitialized whenever switch default is taken [-Wsometimes-uninitialized] initializing these variables to NULL to fix this. Signed-off-by: Ankit Khushwaha Link: https://patch.msgid.link/20251125165302.20079-1-ankitkhushwaha.linux@gmail.com Signed-off-by: Jakub Kicinski commit 625f43be3f50966bce1337d744f1bd78dd42ef64 Author: Lad Prabhakar Date: Wed Nov 26 13:16:19 2025 +0000 spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/V2N SoC support Document the RSPI controller on the Renesas RZ/V2N SoC. The block is compatible with the RSPI implementation found on the RZ/V2H(P) family. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251126131619.136605-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Mark Brown commit 5d0cad409099798462d8a46756be537730bd8a22 Merge: 994a0b2eb60514 3a03de36297539 Author: Mark Brown Date: Wed Nov 26 22:56:01 2025 +0000 ASoC: stm32: sai: fix device and OF node leaks on Merge series from Johan Hovold : This series fixes device and OF node reference leaks during probe and a clock prepare imbalance on probe failures. Included is a related cleanup of an error path. commit 7c11c56eb32eae96893eebafdbe3decadefe88ad Author: Baokun Li Date: Thu Nov 20 21:42:33 2025 +0800 ext4: align max orphan file size with e2fsprogs limit Kernel commit 0a6ce20c1564 ("ext4: verify orphan file size is not too big") limits the maximum supported orphan file size to 8 << 20. However, in e2fsprogs, the orphan file size is set to 32–512 filesystem blocks when creating a filesystem. With 64k block size, formatting an ext4 fs >32G gives an orphan file bigger than the kernel allows, so mount prints an error and fails: EXT4-fs (vdb): orphan file too big: 8650752 EXT4-fs (vdb): mount failed To prevent this issue and allow previously created 64KB filesystems to mount, we updates the maximum allowed orphan file size in the kernel to 512 filesystem blocks. Fixes: 0a6ce20c1564 ("ext4: verify orphan file size is not too big") Signed-off-by: Baokun Li Reviewed-by: Jan Kara Message-ID: <20251120134233.2994147-1-libaokun@huaweicloud.com> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 39fc6d4d3527d790f090dcb10bdb82fd1a1d925a Author: Daniel Tang Date: Wed Nov 19 09:32:13 2025 -0500 Documentation: ext4: Document casefold and encrypt flags Based on ext4(5) and fs/ext4/ext4.h. For INCOMPAT_ENCRYPT, it's possible to create a new filesystem with that flag without creating any encrypted inodes. ext4(5) says it adds "support" but doesn't say whether anything's actually present like COMPAT_RESIZE_INODE does. Signed-off-by: Daniel Tang Message-ID: <4506189.9SDvczpPoe@daniel-desktop3> Signed-off-by: Theodore Ts'o commit 4ada1e4f8937f1ae6b620e7b1c76e02b9b3a15be Author: Haodong Tian Date: Wed Nov 12 23:59:16 2025 +0800 fs/ext4: fix typo in comment Correct 'metdata' -> 'metadata' in comment. Signed-off-by: Haodong Tian Reviewed-by: Darrick J. Wong Message-ID: <20251112155916.3007639-1-tianhd25@mails.tsinghua.edu.cn> Signed-off-by: Theodore Ts'o commit cc742fd1d184bb2a11bacf50587d2c85290622e4 Author: Yang Erkun Date: Wed Nov 12 16:45:38 2025 +0800 ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT Move the comments just before we set EXT4_EXT_MAY_ZEROOUT in ext4_split_convert_extents. Signed-off-by: Yang Erkun Message-ID: <20251112084538.1658232-4-yangerkun@huawei.com> Signed-off-by: Theodore Ts'o commit a9272422316f6c0ddbdfd03e695079e2b3655995 Author: Yang Erkun Date: Wed Nov 12 16:45:37 2025 +0800 ext4: cleanup for ext4_map_blocks Retval from ext4_map_create_blocks means we really create some blocks, cannot happened with m_flags without EXT4_MAP_UNWRITTEN and EXT4_MAP_MAPPED. Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Signed-off-by: Yang Erkun Message-ID: <20251112084538.1658232-3-yangerkun@huawei.com> Signed-off-by: Theodore Ts'o commit dac092195b6a35bc7c9f11e2884cfecb1b25e20c Author: Yang Erkun Date: Wed Nov 12 16:45:36 2025 +0800 ext4: rename EXT4_GET_BLOCKS_PRE_IO This flag has been generalized to split an unwritten extent when we do dio or dioread_nolock writeback, or to avoid merge new extents which was created by extents split. Update some related comments too. Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Signed-off-by: Yang Erkun Message-ID: <20251112084538.1658232-2-yangerkun@huawei.com> Signed-off-by: Theodore Ts'o commit d9ee3ff810f1cc0e253c9f2b17b668b973cb0e06 Author: Yongjian Sun Date: Thu Nov 6 14:06:14 2025 +0800 ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation When the MB_CHECK_ASSERT macro is enabled, we found that the current validation logic in __mb_check_buddy has a gap in detecting certain invalid buddy states, particularly related to order-0 (bitmap) bits. The original logic consists of three steps: 1. Validates higher-order buddies: if a higher-order bit is set, at most one of the two corresponding lower-order bits may be free; if a higher-order bit is clear, both lower-order bits must be allocated (and their bitmap bits must be 0). 2. For any set bit in order-0, ensures all corresponding higher-order bits are not free. 3. Verifies that all preallocated blocks (pa) in the group have pa_pstart within bounds and their bitmap bits marked as allocated. However, this approach fails to properly validate cases where order-0 bits are incorrectly cleared (0), allowing some invalid configurations to pass: corrupt integral order 3 1 1 order 2 1 1 1 1 order 1 1 1 1 1 1 1 1 1 order 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 Here we get two adjacent free blocks at order-0 with inconsistent higher-order state, and the right one shows the correct scenario. The root cause is insufficient validation of order-0 zero bits. To fix this and improve completeness without significant performance cost, we refine the logic: 1. Maintain the top-down higher-order validation, but we no longer check the cases where the higher-order bit is 0, as this case will be covered in step 2. 2. Enhance order-0 checking by examining pairs of bits: - If either bit in a pair is set (1), all corresponding higher-order bits must not be free. - If both bits are clear (0), then exactly one of the corresponding higher-order bits must be free 3. Keep the preallocation (pa) validation unchanged. This change closes the validation gap, ensuring illegal buddy states involving order-0 are correctly detected, while removing redundant checks and maintaining efficiency. Fixes: c9de560ded61f ("ext4: Add multi block allocator for ext4") Suggested-by: Jan Kara Signed-off-by: Yongjian Sun Reviewed-by: Baokun Li Reviewed-by: Jan Kara Message-ID: <20251106060614.631382-3-sunyongjian@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 3f7a79d05c692c7cfec70bf104b1b3c3d0ce6247 Author: Yongjian Sun Date: Thu Nov 6 14:06:13 2025 +0800 ext4: fix incorrect group number assertion in mb_check_buddy When the MB_CHECK_ASSERT macro is enabled, an assertion failure can occur in __mb_check_buddy when checking preallocated blocks (pa) in a block group: Assertion failure in mb_free_blocks() : "groupnr == e4b->bd_group" This happens when a pa at the very end of a block group (e.g., pa_pstart=32765, pa_len=3 in a group of 32768 blocks) becomes exhausted - its pa_pstart is advanced by pa_len to 32768, which lies in the next block group. If this exhausted pa (with pa_len == 0) is still in the bb_prealloc_list during the buddy check, the assertion incorrectly flags it as belonging to the wrong group. A possible sequence is as follows: ext4_mb_new_blocks ext4_mb_release_context pa->pa_pstart += EXT4_C2B(sbi, ac->ac_b_ex.fe_len) pa->pa_len -= ac->ac_b_ex.fe_len __mb_check_buddy for each pa in group ext4_get_group_no_and_offset MB_CHECK_ASSERT(groupnr == e4b->bd_group) To fix this, we modify the check to skip block group validation for exhausted preallocations (where pa_len == 0). Such entries are in a transitional state and will be removed from the list soon, so they should not trigger an assertion. This change prevents the false positive while maintaining the integrity of the checks for active allocations. Fixes: c9de560ded61f ("ext4: Add multi block allocator for ext4") Signed-off-by: Yongjian Sun Reviewed-by: Baokun Li Reviewed-by: Jan Kara Message-ID: <20251106060614.631382-2-sunyongjian@huaweicloud.com> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit db2bad93fe206c95808b7a164a29424791728752 Author: Alex Hung Date: Fri Nov 14 17:02:16 2025 -0700 drm/amd/display: Enable support for Gamma 2.2 This patchset enables support for the Gamma 2.2. With this patch the following IGT subtests pass: kms_colorop --run plane-XR30-XR30-gamma_2_2 kms_colorop --run plane-XR30-XR30-gamma_2_2_inv-gamma_2_2 kms_colorop --run plane-XR30-XR30-gamma_2_2_inv-gamma_2_2-gamma_2_2_inv Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-52-alex.hung@amd.com commit 8e304a45116a567a33cfbd9f104356622c6aefbc Author: Alex Hung Date: Fri Nov 14 17:02:15 2025 -0700 drm/colorop: Add DRM_COLOROP_1D_CURVE_GAMMA22 to 1D Curve Add "DRM_COLOROP_1D_CURVE_GAMMA22" and DRM_COLOROP_1D_CURVE_GAMMA22_INV subtypes to drm_colorop of DRM_COLOROP_1D_CURVE. Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-51-alex.hung@amd.com commit 18a4127e9315645d30c6b93a820efa0cba299c20 Author: Alex Hung Date: Fri Nov 14 17:02:14 2025 -0700 drm/amd/display: Disable CRTC degamma when color pipeline is enabled The degamma is to be handled by Color pipeline API. Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-50-alex.hung@amd.com commit 0c8025e6aeb3ccebee9c65f157423e03c588edd9 Author: Alex Hung Date: Fri Nov 14 17:02:13 2025 -0700 drm/amd/display: Ensure 3D LUT for color pipeline Check dpp.hw_3d_lut before creating shaper tf/lut and 3dlut colorops in colorpipeline and handling these colorops. Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-49-alex.hung@amd.com commit d1aa2a269678946437648011171522f577470e4a Author: Harry Wentland Date: Fri Nov 14 17:02:12 2025 -0700 drm/amd/display: Add AMD color pipeline doc Add kernel doc for AMD color pipeline. Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-48-alex.hung@amd.com commit 0de2b1afea8dbdda29467557ed21ff4a6614486b Author: Alex Hung Date: Fri Nov 14 17:02:11 2025 -0700 drm/amd/display: add 3D LUT colorop This adds support for a 3D LUT. The color pipeline now consists of the following colorops: 1. 1D curve colorop 2. Multiplier 3. 3x4 CTM 4. 1D curve colorop 5. 1D LUT 6. 3D LUT 7. 1D curve colorop 8. 1D LUT Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-47-alex.hung@amd.com commit db971856bbe0263d0ba78d641ea66d4fcdfc8fc3 Author: Alex Hung Date: Fri Nov 14 17:02:10 2025 -0700 drm/colorop: Add 3D LUT support to color pipeline It is to be used to enable HDR by allowing userpace to create and pass 3D LUTs to kernel and hardware. new drm_colorop_type: DRM_COLOROP_3D_LUT. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-46-alex.hung@amd.com commit 2468963482d844f0657a52f791f15ceb953e5880 Author: Harry Wentland Date: Fri Nov 14 17:02:09 2025 -0700 drm/colorop: allow non-bypass colorops Not all HW will be able to do bypass on all color operations. Introduce an 32 bits 'flags' for all colorop init functions and DRM_COLOROP_FLAG_ALLOW_BYPASS for creating the BYPASS property when it's true. Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Simon Ser Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-45-alex.hung@amd.com commit 7fa3ee8c0a79b7a8b5fae422ca29da2fde6821ba Author: Harry Wentland Date: Fri Nov 14 17:02:08 2025 -0700 drm/colorop: Define LUT_1D interpolation We want to make sure userspace is aware of the 1D LUT interpolation. While linear interpolation is common it might not be supported on all HW. Give driver implementers a way to specify their interpolation. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-44-alex.hung@amd.com commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 Author: Alexey Nepomnyashih Date: Tue Nov 4 09:33:25 2025 +0000 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() Fix a race between inline data destruction and block mapping. The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks(). Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert. kernel BUG at fs/ext4/indirect.c:546! EXT4-fs (loop2): unmounting filesystem. invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fixes: c755e251357a ("ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()") Cc: stable@vger.kernel.org # v4.11+ Signed-off-by: Alexey Nepomnyashih Message-ID: <20251104093326.697381-1-sdl@nppct.ru> Signed-off-by: Theodore Ts'o commit 4091c8206cfd2e3bb529ef260887296b90d9b6a2 Author: Haibo Chen Date: Tue Nov 4 16:12:24 2025 +0800 ext4: clear i_state_flags when alloc inode i_state_flags used on 32-bit archs, need to clear this flag when alloc inode. Find this issue when umount ext4, sometimes track the inode as orphan accidently, cause ext4 mesg dump. Fixes: acf943e9768e ("ext4: fix checks for orphan inodes") Signed-off-by: Haibo Chen Reviewed-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251104-ext4-v1-1-73691a0800f9@nxp.com> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 6abfe107894af7e8ce3a2e120c619d81ee764ad5 Author: Ye Bin Date: Mon Nov 3 09:01:23 2025 +0800 jbd2: fix the inconsistency between checksum and data in memory for journal sb Copying the file system while it is mounted as read-only results in a mount failure: [~]# mkfs.ext4 -F /dev/sdc [~]# mount /dev/sdc -o ro /mnt/test [~]# dd if=/dev/sdc of=/dev/sda bs=1M [~]# mount /dev/sda /mnt/test1 [ 1094.849826] JBD2: journal checksum error [ 1094.850927] EXT4-fs (sda): Could not load journal inode mount: mount /dev/sda on /mnt/test1 failed: Bad message The process described above is just an abstracted way I came up with to reproduce the issue. In the actual scenario, the file system was mounted read-only and then copied while it was still mounted. It was found that the mount operation failed. The user intended to verify the data or use it as a backup, and this action was performed during a version upgrade. Above issue may happen as follows: ext4_fill_super set_journal_csum_feature_set(sb) if (ext4_has_metadata_csum(sb)) incompat = JBD2_FEATURE_INCOMPAT_CSUM_V3; if (test_opt(sb, JOURNAL_CHECKSUM) jbd2_journal_set_features(sbi->s_journal, compat, 0, incompat); lock_buffer(journal->j_sb_buffer); sb->s_feature_incompat |= cpu_to_be32(incompat); //The data in the journal sb was modified, but the checksum was not updated, so the data remaining in memory has a mismatch between the data and the checksum. unlock_buffer(journal->j_sb_buffer); In this case, the journal sb copied over is in a state where the checksum and data are inconsistent, so mounting fails. To solve the above issue, update the checksum in memory after modifying the journal sb. Fixes: 4fd5ea43bc11 ("jbd2: checksum journal superblock") Signed-off-by: Ye Bin Reviewed-by: Baokun Li Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Message-ID: <20251103010123.3753631-1-yebin@huaweicloud.com> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 3db63d2c2d1d1e78615dd742568c5a2d55291ad1 Author: Fedor Pchelkin Date: Sat Nov 1 19:04:29 2025 +0300 ext4: check if mount_opts is NUL-terminated in ext4_ioctl_set_tune_sb() params.mount_opts may come as potentially non-NUL-term string. Userspace is expected to pass a NUL-term string. Add an extra check to ensure this holds true. Note that further code utilizes strscpy_pad() so this is just for proper informing the user of incorrect data being provided. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Reviewed-by: Baokun Li Reviewed-by: Jan Kara Message-ID: <20251101160430.222297-2-pchelkin@ispras.ru> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit ee5a977b4e771cc181f39d504426dbd31ed701cc Author: Fedor Pchelkin Date: Sat Nov 1 19:04:28 2025 +0300 ext4: fix string copying in parse_apply_sb_mount_options() strscpy_pad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") provides additional information in that regard. So if this happens, the following warning is observed: strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: __fortify_panic+0x1f/0x30 lib/string_helpers.c:1039 strnlen include/linux/fortify-string.h:235 [inline] sized_strscpy include/linux/fortify-string.h:309 [inline] parse_apply_sb_mount_options fs/ext4/super.c:2504 [inline] __ext4_fill_super fs/ext4/super.c:5261 [inline] ext4_fill_super+0x3c35/0xad00 fs/ext4/super.c:5706 get_tree_bdev_flags+0x387/0x620 fs/super.c:1636 vfs_get_tree+0x93/0x380 fs/super.c:1814 do_new_mount fs/namespace.c:3553 [inline] path_mount+0x6ae/0x1f70 fs/namespace.c:3880 do_mount fs/namespace.c:3893 [inline] __do_sys_mount fs/namespace.c:4103 [inline] __se_sys_mount fs/namespace.c:4080 [inline] __x64_sys_mount+0x280/0x300 fs/namespace.c:4080 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e Since userspace is expected to provide s_mount_opts field to be at most 63 characters long with the ending byte being NUL-term, use a 64-byte buffer which matches the size of s_mount_opts, so that strscpy_pad() does its job properly. Return with error if the user still managed to provide a non-NUL-term string here. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 8ecb790ea8c3 ("ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Reviewed-by: Baokun Li Reviewed-by: Jan Kara Message-ID: <20251101160430.222297-1-pchelkin@ispras.ru> Signed-off-by: Theodore Ts'o commit 80d05f640a51f94b88640db7f1551f8e8fee44b9 Author: Wengang Wang Date: Fri Oct 31 14:05:01 2025 -0700 jbd2: store more accurate errno in superblock when possible When jbd2_journal_abort() is called, the provided error code is stored in the journal superblock. Some existing calls hard-code -EIO even when the actual failure is not I/O related. This patch updates those calls to pass more accurate error codes, allowing the superblock to record the true cause of failure. This helps improve diagnostics and debugging clarity when analyzing journal aborts. Signed-off-by: Wengang Wang Reviewed-by: Zhang Yi Message-ID: <20251031210501.7337-1-wen.gang.wang@oracle.com> Signed-off-by: Theodore Ts'o commit 986835bf4d11032bba4ab8414d18fce038c61bb4 Author: Ye Bin Date: Sat Oct 25 15:26:57 2025 +0800 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data. In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue. Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON. Fixes: 470decc613ab ("[PATCH] jbd2: initial copy of files from jbd") Signed-off-by: Ye Bin Reviewed-by: Jan Kara Message-ID: <20251025072657.307851-1-yebin@huaweicloud.com> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit 68186c7375ace5597383115cd3781ac8465dac99 Author: Alex Hung Date: Fri Nov 14 17:02:07 2025 -0700 drm/amd/display: Swap matrix and multiplier Swap the order of matrix and multiplier as designed in hardware. Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-43-alex.hung@amd.com commit de0b0eb2e04500797636a94436ac367d4a40d951 Author: Alex Hung Date: Fri Nov 14 17:02:06 2025 -0700 drm/amd/display: add multiplier colorop This adds support for a multiplier. This multiplier is programmed via the HDR Multiplier in DCN. With this change the following IGT tests pass: kms_colorop --run plane-XR30-XR30-multiply_125 kms_colorop --run plane-XR30-XR30-multiply_inv_125 The color pipeline now consists of the following colorops: 1. 1D curve colorop 2. 3x4 CTM 3. Multiplier 4. 1D curve colorop 5. 1D LUT 6. 1D curve colorop 7. 1D LUT Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-42-alex.hung@amd.com commit 3410108037d5b01fb35d2e4e92c17c3abdf89186 Author: Alex Hung Date: Fri Nov 14 17:02:05 2025 -0700 drm/colorop: Add multiplier type This introduces a new drm_colorop_type: DRM_COLOROP_MULTIPLIER. It's a simple multiplier to all pixel values. The value is specified via a S31.32 fixed point provided via the "MULTIPLIER" property. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-41-alex.hung@amd.com commit 16e0f785b87fec137937787c77363b136b9a6cf9 Author: Alex Hung Date: Fri Nov 14 17:02:04 2025 -0700 drm/amd/display: add 3x4 matrix colorop This adds support for a 3x4 color transformation matrix. With this change the following IGT tests pass: kms_colorop --run plane-XR30-XR30-ctm_3x4_50_desat kms_colorop --run plane-XR30-XR30-ctm_3x4_overdrive kms_colorop --run plane-XR30-XR30-ctm_3x4_oversaturate kms_colorop --run plane-XR30-XR30-ctm_3x4_bt709_enc kms_colorop --run plane-XR30-XR30-ctm_3x4_bt709_dec The color pipeline now consists of the following colorops: 1. 1D curve colorop 2. 3x4 CTM 3. 1D curve colorop 4. 1D LUT 5. 1D curve colorop 6. 1D LUT Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-40-alex.hung@amd.com commit 5ed78b44e4e6918a8a743b5afa845c2697ab46ad Author: Alex Hung Date: Fri Nov 14 17:02:03 2025 -0700 drm/amd/display: add shaper and blend colorops for 1D Curve Custom LUT This patch adds colorops for custom 1D LUTs in the SHAPER and BLND HW blocks. With this change the following IGT tests pass: kms_colorop --run plane-XR30-XR30-srgb_inv_eotf_lut kms_colorop --run plane-XR30-XR30-srgb_inv_eotf_lut-srgb_eotf_lut The color pipeline now consists of the following colorops: 1. 1D curve colorop 2. 1D curve colorop 3. 1D LUT 4. 1D curve colorop 5. 1D LUT The 1D curve colorops support sRGB, BT2020, and PQ scaled to 125.0. Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-39-alex.hung@amd.com commit 99a4e4f08abe253a7812e4872882a75cecd87703 Author: Alex Hung Date: Fri Nov 14 17:02:02 2025 -0700 drm/colorop: Add 1D Curve Custom LUT type We've previously introduced DRM_COLOROP_1D_CURVE for pre-defined 1D curves. But we also have HW that supports custom curves and userspace needs the ability to pass custom curves, aka LUTs. This patch introduces a new colorop type, called DRM_COLOROP_1D_LUT that provides a SIZE property which is used by a driver to advertise the supported SIZE of the LUT, as well as a DATA property which userspace uses to set the LUT. DATA and size function in the same way as current drm_crtc GAMMA and DEGAMMA LUTs. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Co-developed-by: Harry Wentland Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-38-alex.hung@amd.com commit 94529775135c301efff78373310102f47f3c8671 Author: Chaitanya Kumar Borah Date: Fri Nov 14 17:02:01 2025 -0700 drm: Add helper to extract lut from struct drm_color_lut32 Add helper to extract lut values in 32-bit precision needed by hardware. Signed-off-by: Alex Hung Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-37-alex.hung@amd.com commit 621c45ca12ed9bd5a8ef434925fe51c319c6e28d Author: Uma Shankar Date: Fri Nov 14 17:02:00 2025 -0700 drm: Add Enhanced LUT precision structure Existing LUT precision structure drm_color_lut has only 16 bit precision. This is not enough for upcoming enhanced hardwares and advance usecases like HDR processing. Hence added a new structure with 32 bit precision values. Signed-off-by: Alex Hung Signed-off-by: Uma Shankar Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-36-alex.hung@amd.com commit ec891d8bffa8e364854ab3a9943d7070d53e4c56 Author: Harry Wentland Date: Fri Nov 14 17:01:59 2025 -0700 drm/amd/display: Add support for BT.709 and BT.2020 TFs This adds support for the BT.709/BT.2020 transfer functions on all current 1D curve plane colorops, i.e., on DEGAM, SHAPER, and BLND blocks. With this change the following IGT subtests pass: kms_colorop --run plane-XR30-XR30-bt2020_inv_oetf kms_colorop --run plane-XR30-XR30-bt2020_oetf Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-35-alex.hung@amd.com commit a355b3d6a46e42b05fafa587cebe76039ed388c6 Author: Harry Wentland Date: Fri Nov 14 17:01:58 2025 -0700 drm/colorop: add BT2020/BT709 OETF and Inverse OETF The BT.709 and BT.2020 OETFs are the same, the only difference being that the BT.2020 variant is defined with more precision for 10 and 12-bit per color encodings. Both are used as encoding functions for video content, and are therefore defined as OETF (opto-electronic transfer function) instead of as EOTF (electro-optical transfer function). Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Simon Ser Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-34-alex.hung@amd.com commit ef3d703f64915ec38da5e2737f5234bbb5b89266 Author: Harry Wentland Date: Fri Nov 14 17:01:57 2025 -0700 drm/amd/display: Enable support for PQ 125 EOTF and Inverse This patchset enables support for the PQ_125 EOTF and its inverse on all existing plane 1D curve colorops, i.e., on DEGAM, SHAPER, and BLND blocks. With this patchset the following IGT subtests are passing: kms_colorop --run plane-XR30-XR30-pq_125_eotf kms_colorop --run plane-XR30-XR30-pq_125_inv_eotf kms_colorop --run plane-XR30-XR30-pq_125_eotf-pq_125_inv_eotf kms_colorop --run plane-XR30-XR30-pq_125_eotf-pq_125_inv_eotf-pq_125_eotf Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-33-alex.hung@amd.com commit 1b75447412d6e29948c9b687a60352748945c917 Author: Harry Wentland Date: Fri Nov 14 17:01:56 2025 -0700 drm/colorop: Add PQ 125 EOTF and its inverse The PQ function defines a mapping of code values to nits (cd/m^2). The max code value maps to 10,000 nits. Windows DWM's canonical composition color space (CCCS) defaults to composing SDR contents to 80 nits and uses a float value of 1.0 to represent this. For this reason AMD HW hard-codes a PQ function that is scaled by 125, yielding 80 nit PQ values for 1.0 and 10,000 nits at 125.0. This patch introduces this scaled PQ EOTF and its inverse as 1D curve types. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-32-alex.hung@amd.com commit 52da8325996b940bb2b8f79e1c6c908a14c9688d Author: Alex Hung Date: Fri Nov 14 17:01:55 2025 -0700 drm/amd/display: Add support for sRGB EOTF in BLND block Expose a 3rd 1D curve colorop, with support for DRM_COLOROP_1D_CURVE_SRGB_EOTF and program the BLND block to perform the sRGB transform when the colorop is not in bypass With this change the following IGT test passes: kms_colorop --run plane-XR30-XR30-srgb_eotf-srgb_inv_eotf-srgb_eotf The color pipeline now consists of the following colorops: 1. 1D curve colorop w/ sRGB EOTF support 2. 1D curve colorop w/ sRGB Inverse EOTF support 3. 1D curve colorop w/ sRGB EOTF support Signed-off-by: Alex Hung Co-developed-by: Harry Wentland Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-31-alex.hung@amd.com commit 167c3a6f01bfc6e584762bd39109e6e81a4c9993 Author: Alex Hung Date: Fri Nov 14 17:01:54 2025 -0700 drm/amd/display: Add support for sRGB Inverse EOTF in SHAPER block Expose a 2nd curve colorop with support for DRM_COLOROP_1D_CURVE_SRGB_INV_EOTF and program HW to perform the sRGB Inverse EOTF on the shaper block when the colorop is not in bypass. With this change the follow IGT tests pass: kms_colorop --run plane-XR30-XR30-srgb_inv_eotf kms_colorop --run plane-XR30-XR30-srgb_eotf-srgb_inv_eotf The color pipeline now consists of the following colorops: 1. 1D curve colorop w/ sRGB EOTF support 2. 1D curve colorop w/ sRGB Inverse EOTF support Signed-off-by: Alex Hung Co-developed-by: Harry Wentland Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-30-alex.hung@amd.com commit 9ba25915efbaafc8a0794cc332aa517c76875178 Author: Alex Hung Date: Fri Nov 14 17:01:53 2025 -0700 drm/amd/display: Add support for sRGB EOTF in DEGAM block Expose one 1D curve colorop with support for DRM_COLOROP_1D_CURVE_SRGB_EOTF and program HW to perform the sRGB transform when the colorop is not in bypass. With this change the following IGT test passes: kms_colorop --run plane-XR30-XR30-srgb_eotf The color pipeline now consists of a single colorop: 1. 1D curve colorop w/ sRGB EOTF Signed-off-by: Alex Hung Co-developed-by: Harry Wentland Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-29-alex.hung@amd.com commit af755a7978d5e8b64d763f8705d7649ddc0c4349 Author: Alex Hung Date: Fri Nov 14 17:01:52 2025 -0700 drm/amd/display: Skip color pipeline initialization for cursor plane cursor plane does not need to have color pipeline. Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-28-alex.hung@amd.com commit 71bcae3e7a8c4dfc7b9f87c7a5bf78632d551bda Author: Harry Wentland Date: Fri Nov 14 17:01:51 2025 -0700 drm/amd/display: Add bypass COLOR PIPELINE Add the default Bypass pipeline and ensure it passes the kms_colorop test plane-XR30-XR30-bypass. Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-27-alex.hung@amd.com commit e0edb5809f1ec477b7b969200dc89bc171944ad4 Author: Harry Wentland Date: Fri Nov 14 17:01:50 2025 -0700 drm/amd/display: Ignore deprecated props when plane_color_pipeline set When the plane_color_pipeline bit is set we should ignore deprecated properties, such as COLOR_RANGE and COLOR_ENCODING. Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-26-alex.hung@amd.com commit e341cc6e85df7ab413471f8c1a3a10f076b2dfcc Author: Alex Hung Date: Fri Nov 14 17:01:49 2025 -0700 drm/colorop: define a new macro for_each_new_colorop_in_state Create a new macro for_each_new_colorop_in_state to access new drm_colorop_state updated from uapi. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-25-alex.hung@amd.com commit dabeebae4ab7b4372e17310aa7a2168d32268833 Author: Harry Wentland Date: Fri Nov 14 17:01:48 2025 -0700 drm/colorop: pass plane_color_pipeline client cap to atomic check Drivers will need to know whether an atomic check/commit originated from a client with DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE so they can ignore deprecated properties, like COLOR_ENCODING and COLOR_RANGE. Pass the plane_color_pipeline bit to drm_atomic_state. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-24-alex.hung@amd.com commit f03bf05c2061e66fe156d5cf80765bd863dcb122 Author: Harry Wentland Date: Fri Nov 14 17:01:47 2025 -0700 drm/vkms: Add tests for CTM handling A whole slew of tests for CTM handling that greatly helped in debugging the CTM code. The extent of tests might seem a bit silly but they're fast and might someday help save someone else's day when debugging this. Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-23-alex.hung@amd.com commit b7f513803bdff4d509093b9bfad881ff57ede321 Author: Harry Wentland Date: Fri Nov 14 17:01:46 2025 -0700 drm/tests: Add a few tests around drm_fixed.h While working on the CTM implementation of VKMS I had to ascertain myself of a few assumptions. One of those is whether drm_fixed.h treats its numbers using signed-magnitude or twos-complement. It is twos-complement. In order to make someone else's day easier I am adding the drm_test_int2fixp test that validates the above assumption. I am also adding a test for the new sm2fixp function that converts from a signed-magnitude fixed point to the twos-complement fixed point. Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-22-alex.hung@amd.com commit ea3f6baf3196c35b1a26dfd96f0578bb15ed07c1 Author: Harry Wentland Date: Fri Nov 14 17:01:45 2025 -0700 drm/vkms: add 3x4 matrix in color pipeline We add two 3x4 matrices into the VKMS color pipeline. The reason we're adding matrices is so that we can test that application of a matrix and its inverse yields an output equal to the input image. One complication with the matrix implementation has to do with the fact that the matrix entries are in signed-magnitude fixed point, whereas the drm_fixed.h implementation uses 2s-complement. The latter one is the one that we want for easy addition and subtraction, so we convert all entries to 2s-complement. Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-21-alex.hung@amd.com commit bff4d3cd3c9fcdd75a3d7fa0907de05526f74cf6 Author: Harry Wentland Date: Fri Nov 14 17:01:44 2025 -0700 drm/vkms: Use s32 for internal color pipeline precision Certain operations require us to preserve values below 0.0 and above 1.0 (0x0 and 0xffff respectively in 16 bpc unorm). One such operation is a BT709 encoding operation followed by its decoding operation, or the reverse. We'll use s32 values as intermediate in and outputs of our color operations, for the operations where it matters. For now this won't apply to LUT operations. We might want to update those to work on s32 as well, but it's unclear how that should work for unorm LUT definitions. We'll revisit that once we add LUT + CTM tests. Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-20-alex.hung@amd.com commit e5719e7f19009d4fbedf685fc22eec9cd8de154f Author: Harry Wentland Date: Fri Nov 14 17:01:43 2025 -0700 drm/colorop: Add 3x4 CTM type This type is used to support a 3x4 matrix in colorops. A 3x4 matrix uses the last column as a "bias" column. Some HW exposes support for 3x4. The calculation looks like: out matrix in |R| |0 1 2 3 | | R | |G| = |4 5 6 7 | x | G | |B| |8 9 10 11| | B | |1.0| This is also the first colorop where we need a blob property to program the property. For that we'll introduce a new DATA property that can be used by all colorop TYPEs requiring a blob. The way a DATA blob is read depends on the TYPE of the colorop. We only create the DATA property for property types that need it. Reviewed-by: Simon Ser Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-19-alex.hung@amd.com commit cb500b4c2459a10cec21e0eda841c46bf1fd7a8a Author: Harry Wentland Date: Fri Nov 14 17:01:42 2025 -0700 drm/vkms: Add kunit tests for linear and sRGB LUTs Two tests are added to VKMS LUT handling: - linear - inv_srgb Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-18-alex.hung@amd.com commit 9b5c7e8b452398ee29dd42b21df73fa71dfc648e Author: Louis Chauvet Date: Fri Nov 14 17:01:41 2025 -0700 drm/vkms: Add config for default plane pipeline With the introduction of color pipeline in VKMS, the default device may have planes with color pipelines. To avoid breaking existing uAPI, create a kernel argument to disable them by default and a vkms_config field to configure the plane. This field is not definitive and will be replaced once the uAPI will be able to configure color pipelines. For now devices created with ConfigFS will not have any color pipeline so we can decide later how the uAPI will look like. Reviewed-by: Alex Hung Signed-off-by: Louis Chauvet Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-17-alex.hung@amd.com commit c1e578bd08da79f3bd877faa82e9197ccd3ecd57 Author: Harry Wentland Date: Fri Nov 14 17:01:40 2025 -0700 drm/vkms: Add enumerated 1D curve colorop This patch introduces a VKMS color pipeline that includes two drm_colorops for named transfer functions. For now the only ones supported are sRGB EOTF, sRGB Inverse EOTF, and a Linear TF. We will expand this in the future but I don't want to do so without accompanying IGT tests. We introduce a new vkms_luts.c file that hard-codes sRGB EOTF, sRGB Inverse EOTF, and a linear EOTF LUT. These have been generated with 256 entries each as IGT is currently testing only 8 bpc surfaces. We will likely need higher precision but I'm reluctant to make that change without clear indication that we need it. We'll revisit and, if necessary, regenerate the LUTs when we have IGT tests for higher precision buffers. Signed-off-by: Harry Wentland Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Louis Chauvet Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-16-alex.hung@amd.com commit 08b651cad289a789256167a96fe637ab08e0955c Author: Louis Chauvet Date: Fri Nov 14 17:01:39 2025 -0700 drm/vkms: Pass plane_cfg to plane initialization As plane can have many parameters, directly pass the plane configuration to the init function. Reviewed-by: Alex Hung Signed-off-by: Louis Chauvet Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-15-alex.hung@amd.com commit 9cf87f864d8328b06060ce11c4f6d04a12c3047f Author: Alex Hung Date: Fri Nov 14 17:01:38 2025 -0700 drm/colorop: Add destroy functions for color pipeline The functions are to clean up color pipeline when a device driver fails to create its color pipeline. Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Simon Ser Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-14-alex.hung@amd.com commit ae7c1e4b0af7cb0f61b37820dfe5c8b2bb0e8019 Author: Harry Wentland Date: Fri Nov 14 17:01:37 2025 -0700 Documentation/gpu: document drm_colorop Add kernel doc for drm_colorop objects. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-13-alex.hung@amd.com commit 179ab8e7d7b378f1cd3ff10113458133b73dc52e Author: Harry Wentland Date: Fri Nov 14 17:01:36 2025 -0700 drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE With the introduction of the pre-blending color pipeline we can no longer have color operations that don't have a clear position in the color pipeline. We deprecate all existing plane properties. For upstream drivers those are: - COLOR_ENCODING - COLOR_RANGE Drivers are expected to ignore these properties when programming the HW. DRM clients that register with DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE will not be allowed to set the COLOR_ENCODING and COLOR_RANGE properties. Setting of the COLOR_PIPELINE plane property or drm_colorop properties is only allowed for userspace that sets this client cap. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-12-alex.hung@amd.com commit 2afc3184f3b3f05de05ee1d8fede76d3c20802be Author: Harry Wentland Date: Fri Nov 14 17:01:35 2025 -0700 drm/plane: Add COLOR PIPELINE property We're adding a new enum COLOR PIPELINE property. This property will have entries for each COLOR PIPELINE by referencing the DRM object ID of the first drm_colorop of the pipeline. 0 disables the entire COLOR PIPELINE. Userspace can use this to discover the available color pipelines, as well as set the desired one. The color pipelines are programmed via properties on the actual drm_colorop objects. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-11-alex.hung@amd.com commit 2190c14498e92131ca4593ca41461657e689cc8e Author: Harry Wentland Date: Fri Nov 14 17:01:34 2025 -0700 drm/colorop: Add atomic state print for drm_colorop Print atomic state for drm_colorop in debugfs Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-10-alex.hung@amd.com commit 78a5add824186da775be4a10ac0a95cca239718c Author: Harry Wentland Date: Fri Nov 14 17:01:33 2025 -0700 drm/colorop: Add NEXT property We'll construct color pipelines out of drm_colorop by chaining them via the NEXT pointer. NEXT will point to the next drm_colorop in the pipeline, or by 0 if we're at the end of the pipeline. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-9-alex.hung@amd.com commit 8c5ea1745f4c89576bc6d213ea7f9a7068ada4ad Author: Harry Wentland Date: Fri Nov 14 17:01:32 2025 -0700 drm/colorop: Add BYPASS property We want to be able to bypass each colorop at all times. Introduce a new BYPASS boolean property for this. Reviewed-by: Simon Ser Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-8-alex.hung@amd.com commit 41651f9d42eb24186a38a11be0a75dbc148d2991 Author: Harry Wentland Date: Fri Nov 14 17:01:31 2025 -0700 drm/colorop: Add 1D Curve subtype Add a new drm_colorop with DRM_COLOROP_1D_CURVE with two subtypes: DRM_COLOROP_1D_CURVE_SRGB_EOTF and DRM_COLOROP_1D_CURVE_SRGB_INV_EOTF. Reviewed-by: Simon Ser Reviewed-by: Louis Chauvet Signed-off-by: Harry Wentland Co-developed-by: Alex Hung Signed-off-by: Alex Hung Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-7-alex.hung@amd.com commit 84423e561208054f872b3ca66e3e99a10d06c0ac Author: Harry Wentland Date: Fri Nov 14 17:01:30 2025 -0700 drm/colorop: Add TYPE property Add a read-only TYPE property. The TYPE specifies the colorop type, such as enumerated curve, 1D LUT, CTM, 3D LUT, PWL LUT, etc. For now we're only introducing an enumerated 1D LUT type to illustrate the concept. Reviewed-by: Simon Ser Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-6-alex.hung@amd.com commit cfc27680ee208cdf7a61cda817b4158c4142595f Author: Harry Wentland Date: Fri Nov 14 17:01:29 2025 -0700 drm/colorop: Introduce new drm_colorop mode object This patches introduces a new drm_colorop mode object. This object represents color transformations and can be used to define color pipelines. We also introduce the drm_colorop_state here, as well as various helpers and state tracking bits. Reviewed-by: Simon Ser Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-5-alex.hung@amd.com commit c67bb84434b024fa2ae83f91bbd02457f2d2c8a6 Merge: fba27fe5aaf14e 6341646f722534 Author: Mark Brown Date: Wed Nov 26 21:21:57 2025 +0000 regulator: Use container_of_const() when all types are Merge series from Krzysztof Kozlowski : Use container_of_const(), which is preferred over container_of(), when the argument 'ptr' and returned pointer are already const, for better code safety and readability. Some drivers already have const everywhere, so container_of_const can be directly used. In few other drivers, the final pointer can be constified that way. commit bcaefdaaeb397e4f17b6f500f1c09e5e965420b7 Author: Harry Wentland Date: Fri Nov 14 17:01:28 2025 -0700 drm/doc/rfc: Describe why prescriptive color pipeline is needed Add documentation for color pipeline API. Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Simon Ser Reviewed-by: Melissa Wen Reviewed-by: Sebastian Wick Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-4-alex.hung@amd.com commit 303e9bf147b3a1b48a6d7079f2924b7d43662805 Author: Harry Wentland Date: Fri Nov 14 17:01:27 2025 -0700 drm/vkms: Add kunit tests for VKMS LUT handling Debugging LUT math is much easier when we can unit test it. Add kunit functionality to VKMS and add tests for - get_lut_index - lerp_u16 Reviewed-by: Louis Chauvet Signed-off-by: Alex Hung Signed-off-by: Harry Wentland Cc: Arthur Grillo Reviewed-by: Daniel Stone Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-3-alex.hung@amd.com commit 4fc183828b050c1d7d94347c876c04a5b680b4fc Author: Harry Wentland Date: Fri Nov 14 17:01:26 2025 -0700 drm: Add helper for conversion from signed-magnitude CTM values are defined as signed-magnitude values. Add a helper that converts from CTM signed-magnitude fixed point value to the twos-complement value used by drm_fixed. Reviewed-by: Sebastian Wick Reviewed-by: Louis Chauvet Signed-off-by: Harry Wentland Reviewed-by: Daniel Stone Reviewed-by: Melissa Wen Signed-off-by: Simon Ser Link: https://patch.msgid.link/20251115000237.3561250-2-alex.hung@amd.com commit 2a9c8c0b59d366acabb8f891e84569376f3e2709 Author: Sascha Hauer Date: Tue Nov 25 14:18:20 2025 +0100 kbuild: add target to build a cpio containing modules Add a new package target to build a cpio archive containing the kernel modules. This is particularly useful to supplement an existing initramfs with the kernel modules so that the root filesystem can be started with all needed kernel modules without modifying it. Signed-off-by: Sascha Hauer Reviewed-by: Simon Glass Tested-by: Simon Glass Co-developed-by: Ahmad Fatoum Signed-off-by: Ahmad Fatoum Reviewed-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Tested-by: Nicolas Schier Link: https://patch.msgid.link/20251125-cpio-modules-pkg-v2-2-aa8277d89682@pengutronix.de Signed-off-by: Nicolas Schier commit c83c9564cd1c0f17008dbe6974fef90225f19d16 Author: Ahmad Fatoum Date: Tue Nov 25 14:18:19 2025 +0100 initramfs: add gen_init_cpio to hostprogs unconditionally gen_init_cpio is currently only needed when an initramfs cpio archive is to be created out of CONFIG_INITRAMFS_SOURCE's contents. In other cases, it's not added to hostprogs and no make target is available. In preparation to use the host program from Makefile.package, define it unconditionally. The program will still only be built as needed. Signed-off-by: Ahmad Fatoum Reviewed-by: Simon Glass Reviewed-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Tested-by: Nathan Chancellor Tested-by: Nicolas Schier Link: https://patch.msgid.link/20251125-cpio-modules-pkg-v2-1-aa8277d89682@pengutronix.de Signed-off-by: Nicolas Schier commit 5d24321e4c159088604512d7a5c5cf634d23e01a Author: Gabriel Krisman Bertazi Date: Tue Nov 25 16:18:01 2025 -0500 io_uring: Introduce getsockname io_uring cmd Introduce a socket-specific io_uring_cmd to support getsockname/getpeername via io_uring. I made this an io_uring_cmd instead of a new operation to avoid polluting the command namespace with what is exclusively a socket operation. In addition, since we don't need to conform to existing interfaces, this merges the getsockname/getpeername in a single operation, since the implementation is pretty much the same. This has been frequently requested, for instance at [1] and more recently in the project Discord channel. The main use-case is to support fixed socket file descriptors. [1] https://github.com/axboe/liburing/issues/1356 Signed-off-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit d73c1677087391379441c0bb444c7fb4238fc6e7 Author: Gabriel Krisman Bertazi Date: Tue Nov 25 16:18:00 2025 -0500 socket: Split out a getsockname helper for io_uring Similar to getsockopt, split out a helper to check security and issue the operation from the main handler that can be used by io_uring. Signed-off-by: Gabriel Krisman Bertazi Reviewed-by: Kuniyuki Iwashima Signed-off-by: Jens Axboe commit 4677e78800bbde62a9edce0eb3b40c775ec55e0d Author: Gabriel Krisman Bertazi Date: Tue Nov 25 16:17:59 2025 -0500 socket: Unify getsockname and getpeername implementation They are already implemented by the same get_name hook in the protocol level. Bring the unification one level up to reduce code duplication in preparation to supporting these as io_uring operations. Reviewed-by: Kuniyuki Iwashima Signed-off-by: Gabriel Krisman Bertazi Signed-off-by: Jens Axboe commit c264534c394a291495168dbf70094a89717e9023 Author: Shengming Hu Date: Wed Nov 26 17:35:52 2025 +0800 fgraph: Remove coarse PID filtering from graph_entry() With PID filtering working via ftrace_pids_enabled() and fgraph_pid_func, the coarse-grained ftrace_trace_task() check in graph_entry() is obsolete. It was only a fallback for uninitialized op->private (now fixed), and its removal ensures consistent PID filtering with standard function tracing. Also remove unused ftrace_trace_task() definition from trace.h. Cc: Cc: Cc: Cc: Cc: Cc: Link: https://patch.msgid.link/20251126173552333XoJZN20143fWbsdTEtWoU@zte.com.cn Signed-off-by: Shengming Hu Signed-off-by: Steven Rostedt (Google) commit 1650a1b6cb1ae6cb99bb4fce21b30ebdf9fc238e Author: Shengming Hu Date: Wed Nov 26 17:33:31 2025 +0800 fgraph: Check ftrace_pids_enabled on registration for early filtering When registering ftrace_graph, check if ftrace_pids_enabled is active. If enabled, assign entryfunc to fgraph_pid_func to ensure filtering is performed before executing the saved original entry function. Cc: stable@vger.kernel.org Cc: Cc: Cc: Cc: Cc: Cc: Link: https://patch.msgid.link/20251126173331679XGVF98NLhyLJRdtNkVZ6w@zte.com.cn Fixes: df3ec5da6a1e7 ("function_graph: Add pid tracing back to function graph tracer") Signed-off-by: Shengming Hu Signed-off-by: Steven Rostedt (Google) commit b5d6d3f73d0bac4a7e3a061372f6da166fc6ee5c Author: Shengming Hu Date: Wed Nov 26 17:29:26 2025 +0800 fgraph: Initialize ftrace_ops->private for function graph ops The ftrace_pids_enabled(op) check relies on op->private being properly initialized, but fgraph_ops's underlying ftrace_ops->private was left uninitialized. This caused ftrace_pids_enabled() to always return false, effectively disabling PID filtering for function graph tracing. Fix this by copying src_ops->private to dst_ops->private in fgraph_init_ops(), ensuring PID filter state is correctly propagated. Cc: stable@vger.kernel.org Cc: Cc: Cc: Cc: Cc: Cc: Fixes: c132be2c4fcc1 ("function_graph: Have the instances use their own ftrace_ops for filtering") Link: https://patch.msgid.link/20251126172926004y3hC8QyU4WFOjBkU_UxLC@zte.com.cn Signed-off-by: Shengming Hu Signed-off-by: Steven Rostedt (Google) commit f83ac7544fbf7ba3f77c122e16ab5319f75bbdfd Author: pengdonglin Date: Tue Nov 25 17:34:25 2025 +0800 function_graph: Enable funcgraph-args and funcgraph-retaddr to work simultaneously Currently, the funcgraph-args and funcgraph-retaddr features are mutually exclusive. This patch resolves this limitation by allowing funcgraph-retaddr to have an args array. To verify the change, use perf to trace vfs_write with both options enabled: Before: # perf ftrace -G vfs_write --graph-opts args,retaddr ...... down_read() { /* <-n_tty_write+0xa3/0x540 */ __cond_resched(); /* <-down_read+0x12/0x160 */ preempt_count_add(); /* <-down_read+0x3b/0x160 */ preempt_count_sub(); /* <-down_read+0x8b/0x160 */ } After: # perf ftrace -G vfs_write --graph-opts args,retaddr ...... down_read(sem=0xffff8880100bea78) { /* <-n_tty_write+0xa3/0x540 */ __cond_resched(); /* <-down_read+0x12/0x160 */ preempt_count_add(val=1); /* <-down_read+0x3b/0x160 */ preempt_count_sub(val=1); /* <-down_read+0x8b/0x160 */ } Cc: Steven Rostedt (Google) Cc: Sven Schnelle Cc: Masami Hiramatsu Cc: Xiaoqin Zhang Link: https://patch.msgid.link/20251125093425.2563849-1-dolinux.peng@gmail.com Signed-off-by: pengdonglin Signed-off-by: Steven Rostedt (Google) commit 20e7168326f5ccab0fc5c322af31ae6200012137 Author: Masami Hiramatsu (Google) Date: Sat Nov 22 09:31:40 2025 +0900 tracing: Add boot-time backup of persistent ring buffer Currently, the persistent ring buffer instance needs to be read before using it. This means we have to wait for boot up user space and dump the persistent ring buffer. However, in that case we can not start tracing on it from the kernel cmdline. To solve this limitation, this adds an option which allows to create a trace instance as a backup of the persistent ring buffer at boot. If user specifies trace_instance== then the instance is made as a copy of the instance. For example, the below kernel cmdline records all syscalls, scheduler and interrupt events on the persistent ring buffer `boot_map` but before starting the tracing, it makes a `backup` instance from the `boot_map`. Thus, the `backup` instance has the previous boot events. 'reserve_mem=12M:4M:trace trace_instance=boot_map@trace,syscalls:*,sched:*,irq:* trace_instance=backup=boot_map' As you can see, this just make a copy of entire reserved area and make a backup instance on it. So you can release (or shrink) the backup instance after use it to save the memory usage. /sys/kernel/tracing/instances # free total used free shared buff/cache available Mem: 1999284 55704 1930520 10132 13060 1914628 Swap: 0 0 0 /sys/kernel/tracing/instances # rmdir backup/ /sys/kernel/tracing/instances # free total used free shared buff/cache available Mem: 1999284 40640 1945584 10132 13060 1929692 Swap: 0 0 0 Note: since there is no reason to make a copy of empty buffer, this backup only accepts a persistent ring buffer as the original instance. Also, since this backup is based on vmalloc(), it does not support user-space mmap(). Cc: Mathieu Desnoyers Link: https://patch.msgid.link/176377150002.219692.9425536150438129267.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f93a7d0caccd6ab76dacfd620013cfc41f49fb8d Author: Steven Rostedt Date: Thu Nov 20 18:15:14 2025 -0500 ftrace: Allow tracing of some of the tracing code There is times when tracing the tracing infrastructure can be useful for debugging the tracing code. Currently all files in the tracing directory are set to "notrace" the functions. Add a new config option FUNCTION_SELF_TRACING that will allow some of the files in the tracing infrastructure to be traced. It requires a config to enable because it will add noise to the function tracer if events and other tracing features are enabled. Tracing functions and events together is quite common, so not tracing the event code should be the default. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Mark Rutland Cc: Tom Zanussi Link: https://patch.msgid.link/20251120181514.736f2d5f@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 400ddf1dbe70429b5fc6cef74d987829e6c25893 Author: Steven Rostedt Date: Tue Nov 25 16:40:07 2025 -0500 tracing: Use strim() in trigger_process_regex() instead of skip_spaces() The function trigger_process_regex() is called by a few functions, where only one calls strim() on the buffer passed to it. That leaves the other functions not trimming the end of the buffer passed in and making it a little inconsistent. Remove the strim() from event_trigger_regex_write() and have trigger_process_regex() use strim() instead of skip_spaces(). The buff variable is not passed in as const, so it can be modified. Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Tom Zanussi Link: https://patch.msgid.link/20251125214032.323747707@kernel.org Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 61d445af0a7c70018111919e47beaaee15653f2f Author: Steven Rostedt Date: Tue Nov 25 16:40:06 2025 -0500 tracing: Add bulk garbage collection of freeing event_trigger_data The event trigger data requires a full tracepoint_synchronize_unregister() call before freeing. That call can take 100s of milliseconds to complete. In order to allow for bulk freeing of the trigger data, it can not call the tracepoint_synchronize_unregister() for every individual trigger data being free. Create a kthread that gets created the first time a trigger data is freed, and have it use the lockless llist to get the list of data to free, run the tracepoint_synchronize_unregister() then free everything in the list. By freeing hundreds of event_trigger_data elements together, it only requires two runs of the synchronization function, and not hundreds of runs. This speeds up the operation by orders of magnitude (milliseconds instead of several seconds). Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Tom Zanussi Link: https://patch.msgid.link/20251125214032.151674992@kernel.org Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 78c7051394945bb2a26993f289e935c922070872 Author: Steven Rostedt Date: Tue Nov 25 16:40:05 2025 -0500 tracing: Remove unneeded event_mutex lock in event_trigger_regex_release() In event_trigger_regex_release(), the only code is: mutex_lock(&event_mutex); if (file->f_mode & FMODE_READ) seq_release(inode, file); mutex_unlock(&event_mutex); return 0; There's nothing special about the file->f_mode or the seq_release() that requires any locking. Remove the unnecessary locks. Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Tom Zanussi Link: https://patch.msgid.link/20251125214031.975879283@kernel.org Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit b052d70f7c9c156409a70e65c10d83b5650e7e78 Author: Steven Rostedt Date: Tue Nov 25 15:08:59 2025 -0500 tracing: Merge struct event_trigger_ops into struct event_command Now that there's pretty much a one to one mapping between the struct event_trigger_ops and struct event_command, there's no reason to have two different structures. Merge the function pointers of event_trigger_ops into event_command. There's one exception in trace_events_hist.c for the event_hist_trigger_named_ops. This has special logic for the init and free function pointers for "named histograms". In this case, allocate the cmd_ops of the event_trigger_data and set it to the proper init and free functions, which are used to initialize and free the event_trigger_data respectively. Have the free function and the init function (on failure) free the cmd_ops of the data element. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251125200932.446322765@kernel.org Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit bdafb4d4cb3bb18b29517eaae09fb49d25f854f0 Author: Steven Rostedt Date: Tue Nov 25 15:08:58 2025 -0500 tracing: Remove get_trigger_ops() and add count_func() from trigger ops The struct event_command has a callback function called get_trigger_ops(). This callback returns the "trigger_ops" to use for the trigger. These ops define the trigger function, how to init the trigger, how to print the trigger and how to free it. The only reason there's a callback function to get these ops is because some triggers have two types of operations. One is an "always on" operation, and the other is a "count down" operation. If a user passes in a parameter to say how many times the trigger should execute. For example: echo stacktrace:5 > events/kmem/kmem_cache_alloc/trigger It will trigger the stacktrace for the first 5 times the kmem_cache_alloc event is hit. Instead of having two different trigger_ops since the only difference between them is the tigger itself (the print, init and free functions are all the same), just use a single ops that the event_command points to and add a function field to the trigger_ops to have a count_func. When a trigger is added to an event, if there's a count attached to it and the trigger ops has the count_func field, the data allocated to represent this trigger will have a new flag set called COUNT. Then when the trigger executes, it will check if the COUNT data flag is set, and if so, it will call the ops count_func(). If that returns false, it returns without executing the trigger. This removes the need for duplicate event_trigger_ops structures. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251125200932.274566147@kernel.org Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit 23c0e9cc76bf39c10a1c1927345dfdbc54947a97 Author: Masami Hiramatsu (Google) Date: Wed Nov 19 17:32:05 2025 +0900 tracing: Show the tracer options in boot-time created instance Since tracer_init_tracefs_work_func() only updates the tracer options for the global_trace, the instances created by the kernel cmdline do not have those options. Fix to update tracer options for those boot-time created instances to show those options. Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/176354112555.2356172.3989277078358802353.stgit@mhiramat.tok.corp.google.com Fixes: 428add559b69 ("tracing: Have tracer option be instance specific") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 7a6735cc9b4c0b5cd6fa00c32217db8929a8c18f Author: Menglong Dong Date: Mon Nov 10 20:18:08 2025 +0800 ftrace: Avoid redundant initialization in register_ftrace_direct The FTRACE_OPS_FL_INITIALIZED flag is cleared in register_ftrace_direct, which can make it initialized by ftrace_ops_init() even if it is already initialized. It seems that there is no big deal here, but let's still fix it. Link: https://patch.msgid.link/20251110121808.1559240-1-dongml2@chinatelecom.cn Fixes: f64dd4627ec6 ("ftrace: Add multi direct register/unregister interface") Acked-by: Jiri Olsa Signed-off-by: Menglong Dong Signed-off-by: Steven Rostedt (Google) commit 49c1364c7ca3577037e5ded23c30e3248434c561 Author: Steven Rostedt Date: Mon Nov 17 12:06:37 2025 -0500 tracing: Remove unused variable in tracing_trace_options_show() The flags and opts used in tracing_trace_options_show() now come directly from the trace array "current_trace_flags" and not the current_trace. The variable "trace" was still being assigned to tr->current_trace but never used. This caused a warning in clang. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251117120637.43ef995d@gandalf.local.home Reported-by: Andy Shevchenko Tested-by: Andy Shevchenko Closes: https://lore.kernel.org/all/aRtHWXzYa8ijUIDa@black.igk.intel.com/ Fixes: 428add559b692 ("tracing: Have tracer option be instance specific") Signed-off-by: Steven Rostedt (Google) commit ac87b220a6e9530d752ab5718acc7776f9924702 Author: Steven Rostedt Date: Tue Nov 25 10:47:51 2025 -0500 fgraph: Make fgraph_no_sleep_time signed The variable fgraph_no_sleep_time changed from being a boolean to being a counter. A check is made to make sure that it never goes below zero. But the variable being unsigned makes the check always fail even if it does go below zero. Make the variable a signed int so that checking it going below zero still works. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251125104751.4c9c7f28@gandalf.local.home Fixes: 5abb6ccb58f0 ("tracing: Have function graph tracer option sleep-time be per instance") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aR1yRQxDmlfLZzoo@stanley.mountain/ Signed-off-by: Steven Rostedt (Google) commit 688b745401ab16e2e1a3b504863f0a45fd345638 Author: Edward Adam Davis Date: Sun Nov 16 22:58:13 2025 +0800 bpf: Fix exclusive map memory leak When excl_prog_hash is 0 and excl_prog_hash_size is non-zero, the map also needs to be freed. Otherwise, the map memory will not be reclaimed, just like the memory leak problem reported by syzbot [1]. syzbot reported: BUG: memory leak backtrace (crc 7b9fb9b4): map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512 __sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131 Fixes: baefdbdf6812 ("bpf: Implement exclusive map creation") Reported-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cf08c551fecea9fd1320 Tested-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Acked-by: Yonghong Song Link: https://lore.kernel.org/r/tencent_3F226F882CE56DCC94ACE90EED1ECCFC780A@qq.com Signed-off-by: Alexei Starovoitov commit e61462232a58bddd818fa6a913a9a2e76fd3634f Author: Matthieu Buffet Date: Mon Oct 27 02:14:40 2025 +0100 selftests/landlock: Fix makefile header list Make all headers part of make's dependencies computations. Otherwise, updating audit.h, common.h, scoped_base_variants.h, scoped_common.h, scoped_multiple_domain_variants.h, or wrappers.h, re-running make and running selftests could lead to testing stale headers. Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") Fixes: fefcf0f7cf47 ("selftests/landlock: Test abstract UNIX socket scoping") Fixes: 5147779d5e1b ("selftests/landlock: Add wrappers.h") Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251027011440.1838514-1-matthieu@buffet.re Signed-off-by: Mickaël Salaün commit 335ef80e4a9eeed6cf52b3de6d0bad6787991e20 Author: Tingmao Wang Date: Mon Sep 29 00:49:49 2025 +0100 landlock: Make docs in cred.h and domain.h visible Currently even though the structures in these files have documentation, they are not shown in the "Landlock LSM: kernel documentation" page. Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/6050e764c2679cba01715653e5f1f4f17091d8f8.1759103277.git.m@maowtm.org [mic: Synchronize date] Signed-off-by: Mickaël Salaün commit f4d3ef2dd0e3900693805cec3e4cbf8da4928b3d Author: Tingmao Wang Date: Tue May 27 21:54:48 2025 +0100 landlock: Minor comments improvements This patch contains some small comment changes. The first three comments for ruleset.c, I sort of made along the way while working on / trying to understand Landlock, and the one from ruleset.h was from the hashtable patch but extracted here. In fs.c, one comment which I found would have been helpful to me when reading this. Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/20250602134150.67189-1-m@maowtm.org Link: https://lore.kernel.org/r/20297185fd71ffbb5ce4fec14b38e5444c719c96.1748379182.git.m@maowtm.org [mic: Squash patches with updated description, cosmetic fixes] Signed-off-by: Mickaël Salaün commit 994a0b2eb605144871a85fac29a2c4bdbac07131 Merge: 9d3fcd0ebe91c2 cd41d3420ef658 Author: Mark Brown Date: Wed Nov 26 19:13:03 2025 +0000 nau8325 build fixes Merge series from Jaroslav Kysela : Add missing build configuration and fix the i2c probe function to follow latest i2c core interface. Jaroslav Kysela (2): ASoC: nau8325: use simple i2c probe function ASoC: nau8325: add missing build config sound/soc/codecs/Kconfig | 5 +++++ sound/soc/codecs/Makefile | 2 ++ sound/soc/codecs/nau8325.c | 3 +-- 3 files changed, 8 insertions(+), 2 deletions(-) -- 2.51.1 commit 6341646f7225343f57c8cbcb6a4d25b3270f4111 Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:51 2025 +0100 regulator: pf9453: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-8-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit 03c3bdebaad23d6698a3cb8a11a915d8bdebf28f Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:50 2025 +0100 regulator: pca9450: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-7-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit 438e90a287c86253dbb47e7fa43c4474f91ee7eb Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:49 2025 +0100 regulator: mt6358: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-6-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit 50011cacaeb9556d65067ec8e757e3987ecf0f2b Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:48 2025 +0100 regulator: bd96801: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-5-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit 7a7e1ed307de6cc68639f602f3fa247ec0903354 Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:47 2025 +0100 regulator: bd718x7: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-4-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit d02ea816cccae6c02c7c026b5a74bf99a784c9c8 Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:46 2025 +0100 regulator: bd71828: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-3-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit 788915a22bdfde0925c074056056e7d408c242d0 Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:45 2025 +0100 regulator: bd71815: Constify pointers to 'regulator_desc' wrap struct Pointer to 'struct regulator_desc' is a pointer to const and the wrapping structure (container) is not being modified, thus entire syntax can be replaced to preferred and safer container_of_const(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-2-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit ac1530cdea9846c6bff31827c0c4dffcbc186e6a Author: Krzysztof Kozlowski Date: Wed Nov 26 17:58:44 2025 +0100 regulator: Use container_of_const() when all types are const Use container_of_const(), which is preferred over container_of(), when the argument 'ptr' and returned pointer are already const, for better code safety and readability. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126-container-of-const-regulator-v1-1-eeec378144d4@oss.qualcomm.com Signed-off-by: Mark Brown commit 834ebb5678d75d844f5d4f44ede78724d8c96630 Author: James Clark Date: Mon Nov 24 10:59:08 2025 +0000 perf tools: Don't read build-ids from non-regular files Simplify the build ID reading code by removing the non-blocking option. Having to pass the correct option to this function was fragile and a mistake would result in a hang, see the linked fix. Furthermore, compressed files are always opened blocking anyway, ignoring the non-blocking option. We also don't expect to read build IDs from non-regular files. The only hits to this function that are non-regular are devices that won't be elf files with build IDs, for example "/dev/dri/renderD129". Now instead of opening these as non-blocking and failing to read, we skip them. Even if something like a pipe or character device did have a build ID, I don't think it would have worked because you need to call read() in a loop, check for -EAGAIN and handle timeouts to make non-blocking reads work. Link: https://lore.kernel.org/linux-perf-users/20251022-james-perf-fix-dso-block-v1-1-c4faab150546@linaro.org/ Signed-off-by: James Clark Signed-off-by: Namhyung Kim commit 5185c4d8a56b34f33cec574793047fcd2dba2055 Merge: 81c45c62dc3eef d2041f1f11dd99 Author: Jason Gunthorpe Date: Tue Nov 25 12:46:52 2025 -0400 Merge branch 'iommufd_dmabuf' into k.o-iommufd/for-next Jason Gunthorpe says: ==================== This series is the start of adding full DMABUF support to iommufd. Currently it is limited to only work with VFIO's DMABUF exporter. It sits on top of Leon's series to add a DMABUF exporter to VFIO: https://lore.kernel.org/all/20251120-dmabuf-vfio-v9-0-d7f71607f371@nvidia.com/ The existing IOMMU_IOAS_MAP_FILE is enhanced to detect DMABUF fd's, but otherwise works the same as it does today for a memfd. The user can select a slice of the FD to map into the ioas and if the underliyng alignment requirements are met it will be placed in the iommu_domain. Though limited, it is enough to allow a VMM like QEMU to connect MMIO BAR memory from VFIO to an iommu_domain controlled by iommufd. This is used for PCI Peer to Peer support in VMs, and is the last feature that the VFIO type 1 container has that iommufd couldn't do. The VFIO type1 version extracts raw PFNs from VMAs, which has no lifetime control and is a use-after-free security problem. Instead iommufd relies on revokable DMABUFs. Whenever VFIO thinks there should be no access to the MMIO it can shoot down the mapping in iommufd which will unmap it from the iommu_domain. There is no automatic remap, this is a safety protocol so the kernel doesn't get stuck. Userspace is expected to know it is doing something that will revoke the dmabuf and map/unmap it around the activity. Eg when QEMU goes to issue FLR it should do the map/unmap to iommufd. Since DMABUF is missing some key general features for this use case it relies on a "private interconnect" between VFIO and iommufd via the vfio_pci_dma_buf_iommufd_map() call. The call confirms the DMABUF has revoke semantics and delivers a phys_addr for the memory suitable for use with iommu_map(). Medium term there is a desire to expand the supported DMABUFs to include GPU drivers to support DPDK/SPDK type use cases so future series will work to add a general concept of revoke and a general negotiation of interconnect to remove vfio_pci_dma_buf_iommufd_map(). I also plan another series to modify iommufd's vfio_compat to transparently pull a dmabuf out of a VFIO VMA to emulate more of the uAPI of type1. The latest series for interconnect negotation to exchange a phys_addr is: https://lore.kernel.org/r/20251027044712.1676175-1-vivek.kasireddy@intel.com And the discussion for design of revoke is here: https://lore.kernel.org/dri-devel/20250114173103.GE5556@nvidia.com/ ==================== Based on a shared branch with vfio. * iommufd_dmabuf: iommufd/selftest: Add some tests for the dmabuf flow iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE iommufd: Have iopt_map_file_pages convert the fd to a file iommufd: Have pfn_reader process DMABUF iopt_pages iommufd: Allow MMIO pages in a batch iommufd: Allow a DMABUF to be revoked iommufd: Do not map/unmap revoked DMABUFs iommufd: Add DMABUF to iopt_pages vfio/pci: Add vfio_pci_dma_buf_iommufd_map() vfio/nvgrace: Support get_dmabuf_phys vfio/pci: Add dma-buf export support for MMIO regions vfio/pci: Enable peer-to-peer DMA transactions by default vfio/pci: Share the core device pointer while invoking feature functions vfio: Export vfio device get and put registration helpers dma-buf: provide phys_vec to scatter-gather mapping routine PCI/P2PDMA: Document DMABUF model PCI/P2PDMA: Provide an access to pci_p2pdma_map_type() function PCI/P2PDMA: Refactor to separate core P2P functionality from memory allocation PCI/P2PDMA: Simplify bus address mapping API PCI/P2PDMA: Separate the mmap() support from the core logic Signed-off-by: Jason Gunthorpe commit 81c45c62dc3eefd83af8eb8df10e45705e8e3a47 Author: Nicolin Chen Date: Mon Nov 3 09:27:55 2025 -0800 iommu/arm-smmu-v3-iommufd: Allow attaching nested domain for GBPA cases A vDEVICE has been a hard requirement for attaching a nested domain to the device. This makes sense when installing a guest STE, since a vSID must be present and given to the kernel during the vDEVICE allocation. But, when CR0.SMMUEN is disabled, VM doesn't really need a vSID to program the vSMMU behavior as GBPA will take effect, in which case the vSTE in the nested domain could have carried the bypass or abort configuration in GBPA register. Thus, having such a hard requirement doesn't work well for GBPA. Skip vmaster allocation in arm_smmu_attach_prepare_vmaster() for an abort or bypass vSTE. Note that device on this attachment won't report vevents. Update the uAPI doc accordingly. Link: https://patch.msgid.link/r/20251103172755.2026145-1-nicolinc@nvidia.com Tested-by: Shameer Kolothum Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit c9573287729bc5ed3d2adbc028fe33d265917ae5 Author: Inochi Amaoto Date: Tue Oct 14 09:48:29 2025 +0800 perf vendor events riscv: add T-HEAD C920V2 JSON support T-HEAD C920 has a V2 iteration, which supports Sscompmf. The V2 iteration supports the same perf events as V1. Reuse T-HEAD c900-legacy JSON file for T-HEAD C920V2. Signed-off-by: Inochi Amaoto Acked-by: Paul Walmsley Signed-off-by: Namhyung Kim commit c6a45ee7607de3a350008630f4369b1b5ac80884 Author: Kevin Brodsky Date: Wed Nov 26 12:48:35 2025 +0000 ublk: prevent invalid access with DEBUG ublk_ch_uring_cmd_local() may jump to the out label before initialising the io pointer. This will cause trouble if DEBUG is defined, because the pr_devel() call dereferences io. Clang reports: drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] 2403 | if (tag >= ub->dev_info.queue_depth) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here 2492 | __func__, cmd_op, tag, ret, io->flags); | Fix this by initialising io to NULL and checking it before dereferencing it. Signed-off-by: Kevin Brodsky Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 87c75fa75559f5501b5a03caf442f18899e388be Author: Anubhav Shelat Date: Tue Nov 25 11:41:18 2025 +0000 perf pmu: fix duplicate conditional statement Remove duplicate check for PERF_PMU_TYPE_DRM_END in perf_pmu__kind. Fixes: f0feb21e0a10 ("perf pmu: Add PMU kind to simplify differentiating") Signed-off-by: Anubhav Shelat Reviewed-by: Ian Rogers Closes: https://lore.kernel.org/linux-perf-users/CA+G8Dh+wLx+FvjjoEkypqvXhbzWEQVpykovzrsHi2_eQjHkzQA@mail.gmail.com/ Signed-off-by: Namhyung Kim commit 9d3fcd0ebe91c2079b4aeaffc7493a0bb2ad45f2 Author: Dan Carpenter Date: Wed Nov 26 17:52:26 2025 +0300 ASoC: mediatek: mt8189: remove unnecessary NULL check Smatch complains that the call to snd_soc_component_get_drvdata(component) will dereference "component" so this NULL check is too late. The probe() function will never be called with a NULL component pointer so just delete the check. Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aScUKqCEhSIZoOmg@stanley.mountain Signed-off-by: Mark Brown commit 900baa6e7bb08ab3d24388cf945c7be063ac1b89 Author: Richard Fitzgerald Date: Wed Nov 26 13:15:01 2025 +0000 firmware: cs_dsp: Remove redundant download buffer allocator Now that cs_dsp uses regmap_raw_write() instead of regmap_raw_write_async() it doesn't need to keep multiple DMA-safe buffers of every chunk of data it wrote. See commit fe08b7d5085a ("firmware: cs_dsp: Remove async regmap writes") Only one write can be in progress at a time, so one DMA-safe buffer can be re-used. The single DMA-safe buffer is reallocated if the next write chunk is larger. Reallocation size is rounded up to reduce the amount of churn. PAGE_SIZE is used as a convenient size multiple. Typically for .wmfw files the first chunk is the largest. A DMA-safe intermediate buffer is used because we can't assume that the bus underlying regmap can accept non-DMA-safe buffers. Note that a chunk from the firmware file cannot simply be split into arbitrarily-sized chunks to avoid buffer reallocation. The data in the firmware file is preformatted to be written directly to the device as one block. It already takes account of alignment, write-bursts and write length requirements of the target hardware, so that the cs_dsp driver can treat it as an opaque blob. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251126131501.884188-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 950c74fd6cd80ae6773aa3bf4cb4321b83f194d2 Author: Nickolay Goppen Date: Mon Nov 10 21:29:45 2025 +0300 remoteproc: qcom: pas: Add support for SDM660 CDSP Compute DSP in SDM660 is compatible with generic cdsp_resource_init descriptor. Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # ifc6560 Signed-off-by: Nickolay Goppen Link: https://lore.kernel.org/r/20251110-qcom-sdm660-cdsp-v3-3-cc3c37287e72@mainlining.org Signed-off-by: Bjorn Andersson commit acd6c28a2503f1e53ef06fb3dc1b6cbf9cc6cec3 Author: Nickolay Goppen Date: Mon Nov 10 21:29:44 2025 +0300 dt-bindings: remoteproc: qcom: adsp: Add SDM660 CDSP compatible Add compatible for the compute DSP remoteproc found in SDM660. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Nickolay Goppen Link: https://lore.kernel.org/r/20251110-qcom-sdm660-cdsp-v3-2-cc3c37287e72@mainlining.org Signed-off-by: Bjorn Andersson commit db03780e43781d48effef75c9b1960987f6751d4 Author: Nickolay Goppen Date: Mon Nov 10 21:29:43 2025 +0300 dt-bindings: remoteproc: qcom: adsp: Add missing constrains for SDM660 ADSP Since SDM660 ADSP node uses "xo" clock, interrupts and "cx" power domain properties add corresponding constrains for SDM660 ADSP. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Nickolay Goppen Link: https://lore.kernel.org/r/20251110-qcom-sdm660-cdsp-v3-1-cc3c37287e72@mainlining.org Signed-off-by: Bjorn Andersson commit ca079ec3ebed19a12c1bf080496dacbc6fdfbb39 Author: Konrad Dybcio Date: Tue Nov 4 20:31:07 2025 +0100 dt-bindings: remoteproc: qcom,sc8280xp-pas: Fix CDSP power desc The power requirements for the CDSP instances on SC8280XP aren't fully described, with only one of the three present. Fix that. Fixes: ee651cd1e944 ("dt-bindings: remoteproc: qcom: pas: Add sc8280xp adsp and nsp pair") Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251104-topic-8280_mxc-v1-2-df545af0ef94@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 7f07a5c3e2f5f50f354dab622c1b9cc46ee89f67 Author: Sakari Ailus Date: Fri Jul 4 10:54:45 2025 +0300 remoteproc: omap: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075445.3221481-1-sakari.ailus@linux.intel.com Signed-off-by: Bjorn Andersson commit a857d99201cc4eb3cb78b9dcb6f1d027ef3ae699 Author: Jan Höppner Date: Wed Nov 26 17:06:34 2025 +0100 s390/dasd: Use scnprintf() instead of sprintf() Use scnprintf() instead of sprintf() for those cases where the destination is an array and the size of the array is known at compile time. This prevents theoretical buffer overflows, but also avoids that people again and again spend time to figure out if the code is actually safe. Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 43198756ee8cade0acc17a89f959764cd17776bb Author: Jan Höppner Date: Wed Nov 26 17:06:33 2025 +0100 s390/dasd: Move device name formatting into separate function The device name formatting can be generalized and made more readable compared to the current state. SCSI already provides a generalized way to format many devices in the same naming scheme as DASD does, which was introduced with commit 3e1a7ff8a0a7 ("block: allow disk to have extended device number"). Use this much cleaner code from drivers/scsi/sd.c to handle the legacy naming scheme in DASD as a replacement for the current implementation. For easier error handling for the new function, move the gendisk free portion of dasd_gendisk_free() out into a new function dasd_gd_free(). Signed-off-by: Jan Höppner Reviewed-by: Stefan Haberland Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 764def9e8eaf1b1ccdcd89b8c16db4194ade775f Author: Stefan Haberland Date: Wed Nov 26 17:06:32 2025 +0100 s390/dasd: Remove unnecessary debugfs_create() return checks The DASD driver only uses the dentry pointers when removing debugfs entries, and debugfs_remove() can safely handle both NULL and ERR_PTR. There is therefore no need to check debugfs_create() return values. This simplifies the debugfs setup code without changing functionality. Suggested-by: Heiko Carstens Reviewed-by: Heiko Carstens Reviewed-by: Jan Hoeppner Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit c943bfc6afb8d0e781b9b7406f36caa8bbf95cb9 Author: Stefan Haberland Date: Wed Nov 26 17:06:31 2025 +0100 s390/dasd: Fix gendisk parent after copy pair swap After a copy pair swap the block device's "device" symlink points to the secondary CCW device, but the gendisk's parent remained the primary, leaving /sys/block/ under the wrong parent. Move the gendisk to the secondary's device with device_move(), keeping the sysfs topology consistent after the swap. Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") Cc: stable@vger.kernel.org #6.1 Reviewed-by: Jan Hoeppner Signed-off-by: Stefan Haberland Signed-off-by: Jens Axboe commit 17e7972979e147cc51d4a165e6b6b0f93273ca68 Author: René Rebe Date: Wed Nov 26 16:55:13 2025 +0100 ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 On all AMD AM4 systems I have seen, e.g ASUS X470-i, Pro WS X570 Ace and equivalent Gigabyte, amd-pstate does not initialize when the x2apic is enabled in the BIOS. Kernel debug messages include: [ 0.315438] acpi LNXCPU:00: Failed to get CPU physical ID. [ 0.354756] ACPI CPPC: No CPC descriptor for CPU:0 [ 0.714951] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled I tracked this down to map_x2apic_id() checking device_declaration passed in via the type argument of acpi_get_phys_id() via map_madt_entry() while map_lapic_id() does not. It appears these BIOSes use Processor statements for declaring the CPUs in the ACPI namespace instead of processor device objects (which should have been used). CPU declarations via Processor statements were deprecated in ACPI 6.0 that was released 10 years ago. They should not be used any more in any contemporary platform firmware. I tried to contact Asus support multiple times, but never received a reply nor did any BIOS update ever change this. Fix amd-pstate w/ x2apic on am4 by allowing map_x2apic_id() to work with CPUs declared via Processor statements for IDs less than 255, which is consistent with ACPI 5.0 that still allowed Processor statements to be used for declaring CPUs. Fixes: 7237d3de78ff ("x86, ACPI: add support for x2apic ACPI extensions") Signed-off-by: René Rebe [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251126.165513.1373131139292726554.rene@exactco.de Signed-off-by: Rafael J. Wysocki commit 72e5c0d70d32fa3c6e86bf22e03d4318b4023978 Author: Juergen Gross Date: Wed Nov 26 17:20:16 2025 +0100 hwmon/w83781d: Drop REALLY_SLOW_IO setting In w83781d_isa_found() there is REALLY_SLOW_IO defined around some port accesses, probably in order to wait between multiple accesses. Unfortunately this isn't making any difference compared to not having this define since more than a decade, as REALLY_SLOW_IO needs to be defined while "#include " is called to have an effect. As there seem not to be any outstanding issues in spite of this having no effect, just drop the "#define" and add a remark to the related comment. Signed-off-by: Juergen Gross Link: https://lore.kernel.org/r/20251126162018.5676-4-jgross@suse.com Signed-off-by: Guenter Roeck commit 8ac2a19d7063231348da8d485fb7564ca120ddcc Author: Juergen Gross Date: Wed Nov 26 17:20:15 2025 +0100 hwmon/lm78: Drop REALLY_SLOW_IO setting In lm78_isa_found() there is REALLY_SLOW_IO defined around some port accesses, probably in order to wait between multiple accesses. Unfortunately this isn't making any difference compared to not having this define since more than a decade, as REALLY_SLOW_IO needs to be defined while "#include " is called to have an effect. As there seem not to be any outstanding issues in spite of this having no effect, just drop the "#define" and add a remark to the related comment. Signed-off-by: Juergen Gross Link: https://lore.kernel.org/r/20251126162018.5676-3-jgross@suse.com Signed-off-by: Guenter Roeck commit 2f88425ef590b7fcc2324334b342e048edc144a9 Author: Haotian Zhang Date: Thu Nov 27 00:26:02 2025 +0800 hwmon: sy7636a: Fix regulator_enable resource leak on error path In sy7636a_sensor_probe(), regulator_enable() is called but if devm_hwmon_device_register_with_info() fails, the function returns without calling regulator_disable(), leaving the regulator enabled and leaking the reference count. Switch to devm_regulator_get_enable() to automatically manage the regulator resource. Fixes: de34a4053250 ("hwmon: sy7636a: Add temperature driver for sy7636a") Suggested-by: Guenter Roeck Signed-off-by: Haotian Zhang Link: https://lore.kernel.org/r/20251126162602.2086-1-vulab@iscas.ac.cn Signed-off-by: Guenter Roeck commit 30065e73d7c018cf2e1bec68e2d6ffafc17b3c25 Author: Dan Carpenter Date: Wed Nov 26 15:11:53 2025 +0300 nvdimm: Prevent integer overflow in ramdax_get_config_data() The "cmd->in_offset" variable comes from the user via the __nd_ioctl() function. The problem is that the "cmd->in_offset + cmd->in_length" addition could have an integer wrapping issue if cmd->in_offset is close to UINT_MAX . Both "cmd->in_offset" and "cmd->in_length" are u32 variables. Fixes: 43bc0aa19a21 ("nvdimm: allow exposing RAM carveouts as NVDIMM DIMM devices") Signed-off-by: Dan Carpenter Acked-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/aSbuiYCznEIZDa02@stanley.mountain Signed-off-by: Ira Weiny commit 5427e32fa3a0ba9a016db83877851ed277b065fb Author: Alex Deucher Date: Wed Nov 26 09:40:31 2025 -0500 drm/amdgpu: fix cyan_skillfish2 gpu info fw handling If the board supports IP discovery, we don't need to parse the gpu info firmware. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4721 Fixes: fa819e3a7c1e ("drm/amdgpu: add support for cyan skillfish gpu_info") Signed-off-by: Alex Deucher commit 93c19634f72fb32284e5775b44e4076c059d8e67 Author: Srinivasan Shanmugam Date: Fri Nov 21 16:28:20 2025 +0530 drm/amdgpu: Fix CPER ring debugfs read buffer overflow risk The CPER ring debugfs read code always writes a 12-byte header when the file is read for the first time (*offset == 0): copy_to_user(buf, ring_header, 12); But the code never checks whether the user buffer (@size) is at least 12 bytes long. After writing the 12-byte header, the code then gives the full original @size to the CPER payload handler: record_req->buf_size = size; This means the function can write: 12 bytes (header) + payload bytes (up to @size) into a buffer that is only @size bytes big. In other words, the kernel may write more data than the user asked for. This can overflow the user buffer. The fix is: - If the user buffer is smaller than 12 bytes on the first read, return -EINVAL instead of copying the header. - After writing the 12-byte header, subtract 12 from @size and pass the reduced size to record_req->buf_size. This ensures the CPER payload only uses the remaining free space in the buffer. Reads after the first one (*offset != 0) do not write the header, so their behavior stays exactly the same. The only user-visible change is that tiny buffers now fail safely instead of risking an overflow. Fixes: drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c:523 amdgpu_ras_cper_debugfs_read() warn: userbuf overflow? is 'ring_header_size' <= 'size' Fixes: 527e3d40339b ("drm/amd/ras: Add CPER ring read for uniras") Reported by: Dan Carpenter Cc: Xiang Liu Cc: Tao Zhou Cc: Yang Wang Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit f3854e04b708d73276c4488231a8bd66d30b4671 Author: Prike Liang Date: Fri Oct 31 17:02:51 2025 +0800 drm/amdgpu: attach tlb fence to the PTs update Ensure the userq TLB flush is emitted only after the VM update finishes and the PT BOs have been annotated with bookkeeping fences. Suggested-by: Christian König Signed-off-by: Prike Liang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1e93de9205b4d5c0f06507e9e1c398574a07fb80 Author: Caleb Sander Mateos Date: Tue Nov 25 17:59:34 2025 -0700 io_uring/query: drop unused io_handle_query_entry() ctx arg io_handle_query_entry() doesn't use its struct io_ring_ctx *ctx argument. So remove it from the function and its callers. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 089702632f1dd38fadc9af13816485d6aa518dbb Author: Eric Huang Date: Wed Nov 19 15:07:10 2025 -0500 drm/amdkfd: assign AID to uuid in topology for SPX mode XCD id is assigned to uuid, which causes some performance drop in SPX mode, assigning AID back will resolve the issue. Fixes: 3a75edf93aae ("drm/amdkfd: set uuid for each partition in topology") Signed-off-by: Eric Huang Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 83d161194c1b7c0f75ca89d5f986cb37d9956982 Author: Ivan Lipski Date: Thu Nov 13 16:51:32 2025 -0500 drm/amd/display: Check ATOM_DEVICE_CRT2_SUPPORT in dc_load_detection [WHY & HOW] Fix the typo of the else-if condition from ATOM_DEVICE_CRT1_SUPPORT to ATOM_DEVICE_CRT2_SUPPORT. Reviewed-by: Harry Wentland Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 283f90b50de077970c429e5b9b2745d5e94a5a45 Author: Heiko Carstens Date: Wed Nov 26 15:43:12 2025 +0100 watchdog: diag288_wdt: Remove KMSG_COMPONENT macro The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" from 2008 [1] which never made it upstream. The macro was added to s390 code to allow for an out-of-tree patch which used this to generate unique message ids. Also this out-of-tree doesn't exist anymore. Remove the macro in order to get rid of a pointless indirection. [1] https://lwn.net/Articles/292650/ Reviewed-by: Guenter Roeck Signed-off-by: Heiko Carstens commit f7352d10f851353516ac670b22fcf2272cdc8c45 Author: Nicholas Kazlauskas Date: Tue Nov 11 13:39:52 2025 -0500 drm/amd/display: Add cursor offload abort to the new HWSS path [HOW] If cursor attributes or position are passed into DC via a stream update and we take the newer HWSS paths then it's possible that the update races with cursor offloading if it's enabled. This can cause the cursor to remain on the screen if no further updates come in if it results in HW cursor support being disabled. [HOW] Add the abort into the HWSS path so that cursor offloading doesn't attempt to reprogram the cursor with outdated params. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Dillon Varone Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a76d6f2c76c3abac519ba753e2723e6ffe8e461c Author: Mario Limonciello (AMD) Date: Wed Nov 5 23:04:54 2025 -0600 drm/amd/display: Increase EDID read retries [WHY] When monitor is still booting EDID read can fail while DPCD read is successful. In this case no EDID data will be returned, and this could happen for a while. [HOW] Increase number of attempts to read EDID in dm_helpers_read_local_edid() to 25. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0563d172b687c60513e144d3458b9eb8982eb39b Author: Srinivasan Shanmugam Date: Fri Nov 21 20:23:29 2025 +0530 drm/amd/display: Fix dereference-before-check for dc_link The function dereferences amdgpu_dm_connector->dc_link early to initialize verified_link_cap and dc, but later still checks amdgpu_dm_connector->dc_link for NULL in the analog path. This late NULL check is redundant, introduce a local dc_link pointer, use it consistently, and drop the superfluous NULL check while using dc_link->link_id.id instead. The function uses dc_link at the very beginning without checking if it is NULL. But later in the code, it suddenly checks if dc_link is NULL. This check is too late to be useful, because the code has already used dc_link earlier. So this NULL check does nothing. We simplify the code by storing amdgpu_dm_connector->dc_link in a local dc_link variable and using it throughout the function. Since dc_link is already dereferenced early, the later NULL check is unnecessary and is removed. Fixes the below: amdgpu_dm_connector_get_modes(): variable dereferenced before check 'amdgpu_dm_connector->dc_link' drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c 8845 &amdgpu_dm_connector->dc_link->verified_link_cap; 8846 const struct dc *dc = amdgpu_dm_connector->dc_link->dc; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Dereference ... 8856 8857 if (amdgpu_dm_connector->dc_sink && 8858 amdgpu_dm_connector->dc_link && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Checked too late. Presumably this NULL check could be removed? ... Fixes: d46e422f65ae ("drm/amd/display: Cleanup uses of the analog flag") Reported by: Dan Carpenter Cc: Timur Kristóf Cc: Aurabindo Pillai Cc: Roman Li Cc: Harry Wentland Cc: Tom Chung Cc: Alex Hung Cc: Ivan Lipski Signed-off-by: Srinivasan Shanmugam Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit f6eeab30323d1174a4cc022e769d248fe8241304 Author: Mario Limonciello (AMD) Date: Mon Nov 3 16:02:11 2025 -0600 drm/amd/display: Don't change brightness for disabled connectors [WHY] When a laptop lid is closed the connector is disabled but userspace can still try to change brightness. This doesn't work because the panel is turned off. It will eventually time out, but there is a lot of stutter along the way. [How] Iterate all connectors to check whether the matching one for the backlight index is enabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4675 Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Ray Wu Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit 1a79482699b4d1e43948d14f0c7193dc1dcad858 Author: Dan Carpenter Date: Fri Oct 31 16:02:25 2025 +0300 drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() The .H_SYNC_POLARITY and .V_SYNC_POLARITY variables are 1 bit bitfields of a u32. The ATOM_HSYNC_POLARITY define is 0x2 and the ATOM_VSYNC_POLARITY is 0x4. When we do a bitwise negate of 0, 2, or 4 then the last bit is always 1 so this code always sets .H_SYNC_POLARITY and .V_SYNC_POLARITY to true. This code is instead intended to check if the ATOM_HSYNC_POLARITY or ATOM_VSYNC_POLARITY flags are set and reverse the result. In other words, it's supposed to be a logical negate instead of a bitwise negate. Fixes: ae79c310b1a6 ("drm/amd/display: Add DCE12 bios parser support") Signed-off-by: Dan Carpenter Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 621e55f1919640acab25383362b96e65f2baea3c Author: Alex Hung Date: Fri Nov 7 15:35:58 2025 -0700 drm/amd/display: Check NULL before accessing [WHAT] IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic fails with NULL pointer dereference. This can be reproduced with both an eDP panel and a DP monitors connected. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted 6.16.0-99-custom #8 PREEMPT(voluntary) Hardware name: AMD ........ RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu] Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30 c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02 RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668 RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000 RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760 R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000 R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu] amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu] ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu] amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu] drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400 drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30 drm_crtc_get_last_vbltimestamp+0x55/0x90 drm_crtc_next_vblank_start+0x45/0xa0 drm_atomic_helper_wait_for_fences+0x81/0x1f0 ... Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Alex Deucher commit d0e9de7a81503cdde37fb2d37f1d102f9e0f38fb Author: Alex Deucher Date: Tue Nov 25 09:08:45 2025 -0500 Revert "drm/amd/display: Move setup_stream_attribute" This reverts commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414. This results in a blank screen on the HDMI port on some systems. Revert for now so as not to regress 6.18, can be addressed in 6.19 once the issue is root caused. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4652 Cc: Sunpeng.Li@amd.com Cc: ivan.lipski@amd.com Signed-off-by: Alex Deucher commit c70b9d5fdcd707ddac29284ea425fd433f374696 Author: Rob Herring (Arm) Date: Mon Nov 24 12:27:48 2025 -0600 remoteproc: qcom: Use of_reserved_mem_region_* functions for "memory-region" Use the newly added of_reserved_mem_region_to_resource() and of_reserved_mem_region_count() functions to handle "memory-region" properties. The error handling is a bit different in some cases. Often "memory-region" is optional, so failed lookup is not an error. But then an error in of_reserved_mem_lookup() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251124182751.507624-2-robh@kernel.org Signed-off-by: Bjorn Andersson commit e60573b5980219ad09bb78a014d2fa8664337cf1 Author: Pierre-Eric Pelloux-Prayer Date: Mon Nov 24 15:42:50 2025 +0100 drm/amdgpu: free job fences on failure in amdgpu_job_alloc_with_ib Otherwise we're leaking memory. Fixes: db36632ea51e ("drm/amdgpu: clean up and unify hw fence handling") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 6297fb3863d81b0970fd435476b837739c0ea4e7 Author: Alice Ryhl Date: Tue Nov 25 13:59:39 2025 +0000 rust: id_pool: rename IdPool::new() to with_capacity() We want to change ::new() to take no parameters and produce a pool that is as large as possible while also being inline because that is the constructor that Rust Binder actually needs. However, to avoid complications in examples, we still need the current constructor. So rename it to with_capacity(), which is the idiomatic Rust name for this kind constructor. Reviewed-by: Burak Emir Signed-off-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit d0cf6512bbcf77afb6102f886fcd7fd48b7ae043 Author: Alice Ryhl Date: Tue Nov 25 13:59:38 2025 +0000 rust: bitmap: add BitmapVec::new_inline() This constructor is useful when you just want to create a BitmapVec without allocating but don't care how large it is. Acked-by: Yury Norov (NVIDIA) Reviewed-by: Burak Emir Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Signed-off-by: Yury Norov (NVIDIA) commit f5535d78e12600deb30a9fb3c628c425f0caec21 Author: Alice Ryhl Date: Tue Nov 25 13:59:37 2025 +0000 rust: bitmap: add MAX_LEN and MAX_INLINE_LEN constants To avoid hard-coding these values in drivers, define constants for them that drivers can reference. Also, update all instances in bitmap.rs and id_pool.rs that use these values to use the new constants. Signed-off-by: Alice Ryhl Reviewed-by: Burak Emir Signed-off-by: Yury Norov (NVIDIA) commit 723c1dd3629d2d6eb319247d4eaba9f7b78319fa Author: Pierre-Eric Pelloux-Prayer Date: Mon Nov 24 15:33:41 2025 +0100 drm/amdgpu: clear job on failure in amdgpu_job_alloc(_with_ib) If memory is freed we need to nullify the pointer or the caller might call kfree again (eg: amdgpu_cs_parser_fini calls kfree on all non-null job pointers). Fixes: db36632ea51e ("drm/amdgpu: clean up and unify hw fence handling") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d6f4941f1b4f3e701e422dfbfee024264294f91f Author: Benedek Kupper Date: Tue Oct 7 22:35:44 2025 +0200 drivers: hid: renegotiate resolution multipliers with device after reset The scroll resolution multipliers are set in the context of hidinput_connect(), which is only called at probe time: when the host changes the value on the device with a SET_REPORT(FEATURE), and the device accepts it, these multipliers are stored on the host side, and used to calculate the final scroll event values sent to userspace. After a USB suspend, the resume operation on many hubs and chipsets involve a USB reset signal as well. A reset on the device side clears all previous state information, including the value of the multiplier report. This reset is not handled by the multiplier handling logic, so what ends up happening is the host is still expecting high-resolution scroll events, but the device is reset to default resolution, making the effective, user-perceived scroll speed incredibly slow. The solution is to renegotiate the multiplier selection after each reset. This is not the only bug related to the high-resolution scrolling implementation in the kernel (the other one is https://bugzilla.kernel.org/show_bug.cgi?id=220144), but for this one, there is no device side workaround for, leading to poor user experience with our product: https://github.com/UltimateHackingKeyboard/firmware/issues/1155 https://github.com/UltimateHackingKeyboard/firmware/issues/1261 https://github.com/UltimateHackingKeyboard/firmware/pull/1355 This patch was tested by an affected user and has been reported to fix the issue (see discussion in 1355). Signed-off-by: Benedek Kupper Signed-off-by: Jiri Kosina commit baa120439ac0c803a9962df838eeda28846bc93a Author: Terry Junge Date: Wed Nov 19 17:49:27 2025 -0800 HID: evision: Fix Report Descriptor for Evision Wireless Receiver 320f:226f The mouse portion of the device's Report Descriptor declares 5 buttons but only declares 3 usages (Button 1 through Button 3). As a result events for the 2 side buttons are not generated. Detect and repair the Report Descriptor if necessary by changing the Usage Maximum value from Button 3 to Button 5. [jkosina@suse.com: standardize changelog a little bit] Reported-by: Artem Closes: https://lore.kernel.org/all/CADYkRmrfhRf6VmQjc+su+mepyv=TsHc+aMcL6ryRZ5HTZ8pyFg@mail.gmail.com/ Signed-off-by: Terry Junge Tested-by: Artem Signed-off-by: Jiri Kosina commit 112766cdf2e5ea0a0f72b0304d57a6f74c066670 Author: Srinivas Kandagatla Date: Fri Aug 22 11:00:43 2025 +0100 rpmsg: glink: remove duplicate code for rpmsg device remove rpmsg device remove code is duplicated in at-least 2-3 places, add a helper function to remove this duplicated code. Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250822100043.2604794-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a53e356df548f6b0e82529ef3cc6070f42622189 Author: Srinivas Kandagatla Date: Fri Aug 22 11:00:42 2025 +0100 rpmsg: glink: fix rpmsg device leak While testing rpmsg-char interface it was noticed that duplicate sysfs entries are getting created and below warning is noticed. Reason for this is that we are leaking rpmsg device pointer, setting it null without actually unregistering device. Any further attempts to unregister fail because rpdev is NULL, resulting in a leak. Fix this by unregistering rpmsg device before removing its reference from rpmsg channel. sysfs: cannot create duplicate filename '/devices/platform/soc@0/3700000.remot eproc/remoteproc/remoteproc1/3700000.remoteproc:glink-edge/3700000.remoteproc: glink-edge.adsp_apps.-1.-1' [ 114.115347] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.16.0-rc4 #7 PREEMPT [ 114.115355] Hardware name: Qualcomm Technologies, Inc. Robotics RB3gen2 (DT) [ 114.115358] Workqueue: events qcom_glink_work [ 114.115371] Call trace:8 [ 114.115374] show_stack+0x18/0x24 (C) [ 114.115382] dump_stack_lvl+0x60/0x80 [ 114.115388] dump_stack+0x18/0x24 [ 114.115393] sysfs_warn_dup+0x64/0x80 [ 114.115402] sysfs_create_dir_ns+0xf4/0x120 [ 114.115409] kobject_add_internal+0x98/0x260 [ 114.115416] kobject_add+0x9c/0x108 [ 114.115421] device_add+0xc4/0x7a0 [ 114.115429] rpmsg_register_device+0x5c/0xb0 [ 114.115434] qcom_glink_work+0x4bc/0x820 [ 114.115438] process_one_work+0x148/0x284 [ 114.115446] worker_thread+0x2c4/0x3e0 [ 114.115452] kthread+0x12c/0x204 [ 114.115457] ret_from_fork+0x10/0x20 [ 114.115464] kobject: kobject_add_internal failed for 3700000.remoteproc: glink-edge.adsp_apps.-1.-1 with -EEXIST, don't try to register things with the same name in the same directory. [ 114.250045] rpmsg 3700000.remoteproc:glink-edge.adsp_apps.-1.-1: device_add failed: -17 Fixes: 835764ddd9af ("rpmsg: glink: Move the common glink protocol implementation to glink_native.c") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250822100043.2604794-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a1f2c2d55a81c38d63c251ebb7e73e00be37c229 Author: Luca Weiss Date: Sat Jun 21 15:19:57 2025 +0200 remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8974 MSM8974 requires the CX power domain, so use the msm8996_adsp_resource which has cx under proxy_pd_names and is otherwise equivalent. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250621-msm8974-rpmpd-switch-v1-2-0a2cb303c446@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 3d447dcdae53b13b5d7df32c4d1d35971d460008 Author: Luca Weiss Date: Sat Jun 21 15:19:56 2025 +0200 dt-bindings: remoteproc: qcom,adsp: Make msm8974 use CX as power domain Using CX as a regulator is an artifact of earlier times. Instead use CX power rail as power domain from rpmpd. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250621-msm8974-rpmpd-switch-v1-1-0a2cb303c446@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 Author: Fabio Porcedda Date: Wed Nov 26 15:26:40 2025 +0100 USB: serial: option: move Telit 0x10c7 composition in the right place Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition. Signed-off-by: Fabio Porcedda Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit c908039a29aa70870871f4848125b3d743f929bf Author: Fabio Porcedda Date: Wed Nov 26 15:26:39 2025 +0100 USB: serial: option: add Telit Cinterion FE910C04 new compositions Add the following Telit Cinterion new compositions: 0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c5 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10cb Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit a4d01f3b02d0afb5e4497a1ec5d48da2a326d468 Author: Gui-Dong Han Date: Wed Nov 26 19:38:28 2025 +0800 hwmon: (adm1026) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this causes Time-of-Check to Time-of-Use (TOCTOU) race conditions. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251126113828.10003-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit c884ee70b15a8d63184d7c1e02eba99676a6fcf7 Author: Pierre-Eric Pelloux-Prayer Date: Fri Nov 21 11:12:12 2025 +0100 drm/amdgpu: use ttm_resource_manager_cleanup Rather than open-coding it. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Link: https://lore.kernel.org/r/20251121101315.3585-3-pierre-eric.pelloux-prayer@amd.com Signed-off-by: Christian König commit 9eb4fb93069a889aae955c2fbf78f9eb34ac4562 Author: Gui-Dong Han Date: Wed Nov 26 19:40:46 2025 +0800 hwmon: (adm1029) Add locking to avoid TOCTOU The function fan_show checks shared data for zero or invalid values before using it as a divisor. These accesses are currently lockless. If the data changes to zero between the check and the division, it causes a divide-by-zero error. Explicitly acquire the update lock around these checks and calculations to ensure the data remains stable, preventing Time-of-Check to Time-of-Use (TOCTOU) race conditions. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251126114047.10039-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit be89cf786d36f44d7765c572296fc9299afa428c Author: Gui-Dong Han Date: Wed Nov 26 19:35:42 2025 +0800 hwmon: (lm87) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this causes Time-of-Check to Time-of-Use (TOCTOU) race conditions. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251126113542.9968-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 36dcfa468525336fc33cfa88f2a5514fc9cc0666 Author: Hans de Goede Date: Sat Nov 8 22:03:19 2025 +0100 HID: logitech-dj: Fix probe failure when used with KVM Since commit 6f20d3261265 ("HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()") logi_dj_recv_switch_to_dj_mode() will return an error when the hid_hw_raw_request() call to enable [dis]connect events fails. This can happen when used with a KVM like the Aten CS1784a and the PC does not have the KVM focus when probe() runs, which causes probe() to fail after which the receiver will simply not work. The logi_dj_recv_query_paired_devices() call done at the end of probe() already ignores any errors for the KVM without focus case. When focus is restored and an input report is received this will trigger logi_dj_recv_queue_unknown_work() which retries the query_paired_devices() call from a workqueue. To fix the probe() failure let it ignore logi_dj_recv_switch_to_dj_mode() errors too, track if a successful logi_dj_recv_switch_to_dj_mode() was done and retry if necessary from logi_dj_recv_queue_unknown_work(). Queurying paired devices while not in dj-mode is not useful and this will be redone after the unknown work has retried setting dj-mode, so skip queurying paired devices when not in dj-mode yet. The new bool to track successful setting of the dj-mode will also cause setting dj-mode to be retried from the unknown work, if setting dj-mode failed after a reset_resume. Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina commit ca389a55d8b2d86a817433bf82e0602b68c4d541 Author: Hans de Goede Date: Sat Nov 8 22:03:18 2025 +0100 HID: logitech-dj: Remove duplicate error logging logi_dj_recv_query_paired_devices() and logi_dj_recv_switch_to_dj_mode() both have 2 callers which all log an error if the function fails. Move the error logging to inside these 2 functions to remove the duplicated error logging in the callers. While at it also move the logi_dj_recv_send_report() call error handling in logi_dj_recv_switch_to_dj_mode() to directly after the call. That call only fails if the report cannot be found and in that case it does nothing, so the msleep() is not necessary on failures. Fixes: 6f20d3261265 ("HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina commit ae9416f1f4adcc226dc7faa50a587ef338aed410 Author: Nathan Rossi Date: Sat Nov 8 14:13:00 2025 +0000 HID: logitech-dj: Add support for G Pro X Superlight 2 receiver The Logitech G Pro X Superlight 2 has a lightspeed receiver with a product id of 0xc54d, this receiver behaves like the receiver used in the original Logitech G Pro X Superlight (id 0xc547) including the 13 byte mouse reports. This change adds a definition for this receiver id, and a mapping for the recvr_type_gaming_hidpp_ls_1_3 type. With this change in place the receiver now reports the battery status of the connected mouse over wireless as well as exposing the HID interface needed for userspace to perform additional configuration with libratbag/Piper. Signed-off-by: Nathan Rossi Signed-off-by: Jiri Kosina commit c411d8bf06992dade7abb88690dc2d467a868cc4 Author: Pengfei Li Date: Mon Oct 20 15:00:41 2025 -0400 thermal/drivers/imx91: Add support for i.MX91 thermal monitoring unit Introduce support for the i.MX91 thermal monitoring unit, which features a single sensor for the CPU. The register layout differs from other chips, necessitating the creation of a dedicated file for this. This sensor provides a resolution of 1/64°C (6-bit fraction). For actual accuracy, refer to the datasheet, as it varies depending on the chip grade. Provide an interrupt for end of measurement and threshold violation and Contain temperature threshold comparators, in normal and secure address space, with direction and threshold programmability. Datasheet Link: https://www.nxp.com/docs/en/data-sheet/IMX91CEC.pdf Signed-off-by: Pengfei Li Signed-off-by: Peng Fan Signed-off-by: Frank Li Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251020-imx91tmu-v7-2-48d7d9f25055@nxp.com commit f32aedc5753e9045f8697ddbad6e83a4017385a0 Author: Pengfei Li Date: Mon Oct 20 15:00:40 2025 -0400 dt-bindings: thermal: fsl,imx91-tmu: add bindings for NXP i.MX91 thermal module Add bindings documentation for i.MX91 thermal modules. Signed-off-by: Pengfei Li Signed-off-by: Frank Li Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251020-imx91tmu-v7-1-48d7d9f25055@nxp.com commit 1ee90870ce797f314168fb08a5cbb0fba8d4dd65 Author: Gaurav Kohli Date: Fri Aug 22 09:53:15 2025 +0530 dt-bindings: thermal: tsens: Add QCS8300 compatible Add compatibility string for the thermal sensors on QCS8300 platform. Signed-off-by: Gaurav Kohli Signed-off-by: Daniel Lezcano Acked-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Reviewed-by: Akhil P Oommen Link: https://patch.msgid.link/20250822042316.1762153-2-quic_gkohli@quicinc.com commit 2437f798809d4420350b0118e4723024ce8d203b Merge: dcb6fa37fd7bc9 d1780dce957507 Author: Thomas Gleixner Date: Wed Nov 26 15:36:52 2025 +0100 Merge tag 'timers-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource Pull clocksource/event changes from Daniel Lezcano: - Use 64-bits for timer compensation for IoT usage where the suspend time is much longer than what 32-bits can provide (Enlin Mu) - Add delay support on sp804 for ARM32 platforms (Stephen Eta Zhou) - Fix missing resource release on error in the probe path of in the ralink driver (Haotian Zhang) - Fix double deregistration on probe failure in the NXP STM driver (Johan Hovold) - Disable runtime PM for the Renesas SH CMT timer because it is incompatible with PREEMPT_RT=y (Niklas Söderlund) - Fix section mismatches in the NXP STM driver (Johan Hovold) - Preventing unbinding the NXP PIT, STM and MMIO ARM Arch timers as the code does not suppport bind/unbind (Johan Hovold) - Use the clocksource instead of ticks on the RDA8810PL platform (Enlin Mu) - Drop the unused module alias for the STM32-LP (Johan Hovold) - Add Realtek system timer driver (Hao-Wen Ting) Link: https://lore.kernel.org/all/9303b790-28d4-4bd9-b01d-28fb05493596@linaro.org commit ea34511aaf755349999a1067b2984a541bee1492 Author: Vincent Liu Date: Wed Oct 22 13:07:40 2025 +0100 driver core: Check drivers_autoprobe for all added devices When a device is hot-plugged, the drivers_autoprobe sysfs attribute is not checked (at least for PCI devices). This means that drivers_autoprobe is not working as intended, e.g. hot-plugged PCI devices will still be autoprobed and bound to drivers even with drivers_autoprobe disabled. The problem likely started when device_add() was removed from pci_bus_add_device() in commit 4f535093cf8f ("PCI: Put pci_dev in device tree as early as possible") which means that the check for drivers_autoprobe which used to happen in bus_probe_device() is no longer present (previously bus_add_device() calls bus_probe_device()). Conveniently, in commit 91703041697c ("PCI: Allow built-in drivers to use async initial probing") device_attach() was replaced with device_initial_probe() which faciliates this change to push the check for drivers_autoprobe into device_initial_probe(). Make sure all devices check drivers_autoprobe by pushing the drivers_autoprobe check into device_initial_probe(). This will only affect devices on the PCI bus for now as device_initial_probe() is only called by pci_bus_add_device() and bus_probe_device(), but bus_probe_device() already checks for autoprobe, so callers of bus_probe_device() should not observe changes on autoprobing. Note also that pushing this check into device_initial_probe() rather than device_attach() makes it only affect automatic probing of drivers (e.g. when a device is hot-plugged), userspace can still choose to manually bind a driver by writing to drivers_probe sysfs attribute, even with autoprobe disabled. Any future callers of device_initial_probe() will respect the drivers_autoprobe sysfs attribute, which is the intended purpose of drivers_autoprobe. Signed-off-by: Vincent Liu Link: https://patch.msgid.link/20251022120740.2476482-1-vincent.liu@nutanix.com Signed-off-by: Greg Kroah-Hartman commit ac1ab906d7a98e34be95ef63b81ff828cc432346 Author: Marco Crivellari Date: Fri Nov 14 15:16:18 2025 +0100 driver core: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251114141618.172154-3-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit e40ad215cea21464d516790f263dc3df69174efe Author: Marco Crivellari Date: Fri Nov 14 15:16:17 2025 +0100 driver core: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Switch to using system_dfl_wq because system_unbound_wq is going away as part of a workqueue restructuring. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251114141618.172154-2-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit cd22926af45400093738c758b6749de8035ed5a8 Author: Aaron Tomlin Date: Fri Oct 10 21:28:53 2025 -0400 tick/nohz: Expose housekeeping CPUs in sysfs Expose the current system-defined list of housekeeping CPUs in a new sysfs file: /sys/devices/system/cpu/housekeeping. This provides userspace performance tuning tools and resource managers with a canonical, reliable method to accurately identify the cores responsible for essential kernel maintenance workloads (RCU, timer callbacks, and unbound workqueues). Currently, tooling must manually calculate the housekeeping set by parsing complex kernel boot parameters (like isolcpus= and nohz_full=) and system topology, which is prone to error. This dedicated file simplifies the configuration of low-latency workloads. Signed-off-by: Aaron Tomlin Link: https://patch.msgid.link/20251011012853.7539-2-atomlin@atomlin.com Signed-off-by: Greg Kroah-Hartman commit f10c23fa159c5481dfe0025e619dc5ef844f6ce1 Author: Aaron Tomlin Date: Fri Oct 10 21:18:30 2025 -0400 tick/nohz: avoid showing '(null)' if nohz_full= not set In the context of CONFIG_NO_HZ_FULL=y, tick_nohz_full_mask (of type cpumask_var_t) is initialised to 0. Memory is only allocated to the cpumask data structure, in tick_nohz_full_setup(), when Linux kernel boot-time parameter "nohz_full=" is correctly specified (see housekeeping_setup()). If "nohz_full=" is not set and an attempt is made to read /sys/devices/system/cpu/nohz_full, '(null)' can be displayed: ❯ cat /sys/devices/system/cpu/nohz_full (null) This patch changes the output to print a newline (or 0x0A) instead of '(null)', making it consistent with print_cpus_isolated() behaviour. Signed-off-by: Aaron Tomlin Link: https://patch.msgid.link/20251011011830.6670-3-atomlin@atomlin.com Signed-off-by: Greg Kroah-Hartman commit 76987bac71d5349a62f312ca1cd92de73778a652 Author: Aaron Tomlin Date: Fri Oct 10 21:18:29 2025 -0400 sysfs/cpu: Use DEVICE_ATTR_RO for nohz_full attribute The /sys/devices/system/cpu/nohz_full file is a read-only attribute that reports the CPUs configured for tickless operation (CONFIG_NO_HZ_FULL=y). The current definition uses the generic DEVICE_ATTR macro, which unnecessarily requires specifying the file mode (0444) and a NULL store operation pointer. This patch converts the definition to use the dedicated DEVICE_ATTR_RO macro. This correctly expresses the read-only nature of the attribute, removes the redundant mode field, and simplifies the code. As a related cleanup, rename the show function from print_cpus_nohz_full() to the standard nohz_full_show() for consistency with common sysfs attribute naming conventions. Signed-off-by: Aaron Tomlin Link: https://patch.msgid.link/20251011011830.6670-2-atomlin@atomlin.com Signed-off-by: Greg Kroah-Hartman commit 382b1e8f30f779af8d6d33268e53df7de579ef3c Author: Will Rosenberg Date: Tue Nov 25 08:13:32 2025 -0700 kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node There exists a memory leak of kernfs_iattrs contained as an element of kernfs_node allocated in __kernfs_new_node(). __kernfs_setattr() allocates kernfs_iattrs as a sub-object, and the LSM security check incorrectly errors out and does not free the kernfs_iattrs sub-object. Make an additional error out case that properly frees kernfs_iattrs if security_kernfs_init_security() fails. Fixes: e19dfdc83b60 ("kernfs: initialize security of newly created nodes") Co-developed-by: Oliver Rosenberg Signed-off-by: Oliver Rosenberg Signed-off-by: Will Rosenberg Link: https://patch.msgid.link/20251125151332.2010687-1-whrosenb@asu.edu Signed-off-by: Greg Kroah-Hartman commit 2467f9928c9824e52718f977009ed3a0cee83dc5 Author: Jane Chu Date: Tue Nov 11 13:26:06 2025 -0700 fs/kernfs: raise sb->maxbytes to MAX_LFS_FILESIZE On an ARM64 A1 system, it's possible to have physical memory span up to the 64T boundary, like below $ lsmem -b -r -n -o range,size 0x0000000080000000-0x00000000bfffffff 1073741824 0x0000080000000000-0x000008007fffffff 2147483648 0x00000800c0000000-0x0000087fffffffff 546534588416 0x0000400000000000-0x00004000bfffffff 3221225472 0x0000400100000000-0x0000407fffffffff 545460846592 So it's time to extend /sys/kernel/mm/page_idle/bitmap to be able to account for >2G number of pages, by raising the kernfs file size limit. Signed-off-by: Jane Chu Link: https://patch.msgid.link/20251111202606.1505437-1-jane.chu@oracle.com Signed-off-by: Greg Kroah-Hartman commit d3d25f430cadc59d42965f54f54a8c0050931860 Author: Raag Jadav Date: Thu Nov 6 10:58:38 2025 +0530 mod_devicetable: Bump auxiliary_device_id name size We have an upcoming driver named "intel_ehl_pse_io". This creates an auxiliary child device for it's GPIO sub-functionality, which matches against "intel_ehl_pse_io.gpio-elkhartlake" and overshoots the current maximum limit of 32 bytes for auxiliary device id string. Bump the size to 40 bytes to satisfy such cases. Suggested-by: Andy Shevchenko Signed-off-by: Raag Jadav Link: https://patch.msgid.link/20251106052838.433673-1-raag.jadav@intel.com Signed-off-by: Greg Kroah-Hartman commit 71464949b1f5f8b8599d057fea525a2a520f84d8 Author: Thomas Weißschuh Date: Wed Oct 29 09:12:16 2025 +0100 sysfs: simplify attribute definition macros Define the macros in terms of each other. This makes them easier to understand and also will make it easier to implement the transition machinery for 'const struct attribute'. __ATTR_RO_MODE() can't be implemented in terms of __ATTR() as not all attributes have a .store callback. The same issue theoretically exists for __ATTR_WO(), but practically that does not occur today. Reorder __ATTR_RO() below __ATTR_RO_MODE() to keep the order of the macro definition consistent with respect to each other. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-7-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 2d76fdc1c91a95c23cd3e47a4fd4315f1633019b Author: Thomas Weißschuh Date: Wed Oct 29 09:12:15 2025 +0100 samples/kobject: constify 'struct foo_attribute' Showcase and test the new 'struct attribute' constification facilities. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-6-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit c301a2e2d78c2c20d466c7e38568406471ede17d Author: Thomas Weißschuh Date: Wed Oct 29 09:12:14 2025 +0100 samples/kobject: add is_visible() callback to attribute group There was no example for the is_visible() callback so far. It will also become an example and test for the constification of 'struct attribute' later. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-5-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 7dd9fdb4939b972c1d0523e94fb3f70789653f0c Author: Thomas Weißschuh Date: Wed Oct 29 09:12:13 2025 +0100 sysfs: attribute_group: enable const variants of is_visible() When constifying instances of struct attribute, for consistency the corresponding .is_visible() callback should be adapted, too. Introduce a temporary transition mechanism until all callbacks are converted. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-4-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 02ac5335a55111d87a7a618355261b4407ed0f7f Author: Thomas Weißschuh Date: Wed Oct 29 09:12:12 2025 +0100 sysfs: introduce __SYSFS_FUNCTION_ALTERNATIVE() For the constification phase of 'struct attribute' various callback struct members will need to exist in both const and non-const variants. Keeping both members in a union avoids memory and CPU overhead but will be detected and trapped by Control Flow Integrity (CFI). By deciding between a struct and a union depending whether CFI is enabled, most configurations can avoid this overhead. Code using these callbacks will still need to be updated to handle both members explicitly. In the union case the compiler will recognize that testing for one union member is enough and optimize away the code for the other one. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-3-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 964c93b1eef37e3bbe0edb37346c076217d71fe7 Author: Thomas Weißschuh Date: Wed Oct 29 09:12:11 2025 +0100 sysfs: transparently handle const pointers in ATTRIBUTE_GROUPS() To ease the constification process of 'struct attribute', transparently handle the const pointers in ATTRIBUTE_GROUPS(). A cast is used instead of assigning to .attrs_new as it keeps the macro smaller. As both members are aliased to each other the result is identical. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-2-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit f85d90dd8d0efbc75e79698e147c6e682df22e1a Author: Thomas Weißschuh Date: Wed Oct 29 09:12:10 2025 +0100 sysfs: attribute_group: allow registration of const attribute To be able to constify instances of struct attribute it has to be possible to add them to struct attribute_group. The current type of the attrs member however is not compatible with that. Introduce a union that allows registration of both const and non-const attributes to enable a piecewise transition. As both union member types are compatible no logic needs to be adapted. Technically it is now possible register a const struct attribute and receive it as mutable pointer in the callbacks. This is a soundness issue. But this same soundness issue already exists today in sysfs_create_file(). Also the struct definition and callback implementation are always closely linked and are meant to be moved to const in lockstep. Similar to commit 906c508afdca ("sysfs: attribute_group: allow registration of const bin_attribute") Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251029-sysfs-const-attr-prep-v5-1-ea7d745acff4@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit cbe1d77ed84ae9ab3355d61aca0c30d561a61d5a Author: Clint George Date: Tue Nov 11 20:43:40 2025 +0530 hangcheck-timer: fix coding style spacing Fix minor styling issues for proper compliance to the kernel coding style. Signed-off-by: Clint George Link: https://patch.msgid.link/20251111151340.9162-4-clintbgeorge@gmail.com Signed-off-by: Greg Kroah-Hartman commit e03a2f7df72e8b7b56cdd0e19c295bf7633ed4ea Author: Clint George Date: Tue Nov 11 20:43:39 2025 +0530 hangcheck-timer: Replace %Ld with %lld Replace non-standard %Ld with %lld to ensure compliance with the kernel coding style and potential formatting issues. Signed-off-by: Clint George Link: https://patch.msgid.link/20251111151340.9162-3-clintbgeorge@gmail.com Signed-off-by: Greg Kroah-Hartman commit 75d19e368640f69a3c8532001ec99685d0e2ce89 Author: Clint George Date: Tue Nov 11 20:43:38 2025 +0530 hangcheck-timer: replace printk(KERN_CRIT) with pr_crit Replace printk(KERN_CRIT ...) with pr_crit(...) and printk() with pr_debug(). The change aims to make logging more consistent and readable. Signed-off-by: Clint George Link: https://patch.msgid.link/20251111151340.9162-2-clintbgeorge@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3397c3cd859a2c51962ad032dcf97961d42f9db2 Author: Yaxing Guo Date: Fri Sep 26 17:58:28 2025 +0800 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c This patch introduces a new UIO driver, uio_pci_generic_sva, which extends the functionality of uio_pci_generic by adding support for Shared Virtual Addressing (SVA) when IOMMU is enabled in the system. The key enhancement allows PCI devices to directly use user-space virtual addresses for DMA operations, eliminating the need for bounce buffers or explicit IOVA mapping. This is achieved by leveraging the kernel's IOMMU-SVA subsystem, including process address space attachment, page fault handling, and shared context management between CPU and device. With this driver, userspace applications can perform zero-copy DMA using native pointers: void *addr = malloc(N); set_dma_addr((uint64_t)addr); // Passing user VA directly start_dma(); The device can now access 'addr' through the IOMMU's PASID-based translation, provided that the underlying IOMMU hardware (e.g., Intel VT-d 3.1+, AMD-Vi, ARM SMMU, RISCV IOMMU) and platform support SVA. Dependencies: - CONFIG_IOMMU_SVA must be enabled. - The platform must support PRI (Page Request Interface) and PASID. - Device drivers/userspace must handle page faults if demand-paging is used. The implementation reuses core logic from uio_pci_generic.c while adding PASID setting, and integration with the IOMMU SVA APIs. Also, add a read-only sysfs attribute 'pasid' to expose the Process Address Space ID assigned by IOMMU driver when binding an SVA-enabled device. For details, refer to the ABI documentation for uio_pci_sva driver sysfs attribute (Documentation/ABI/testing/sysfs-driver-uio_pci_sva-pasid). Signed-off-by: Yaxing Guo Link: https://patch.msgid.link/20250926095828.506-1-guoyaxing@bosc.ac.cn Signed-off-by: Greg Kroah-Hartman commit 4d4e746aa9f0f07261dcb41e4f51edb98723dcaa Author: Srinivas Kandagatla Date: Fri Nov 14 11:05:05 2025 +0000 dt-bindings: slimbus: fix warning from example Fix below warnings generated dt_bindings_check for examples in the bindings. Documentation/devicetree/bindings/slimbus/slimbus.example.dtb: slim@28080000 (qcom,slim-ngd-v1.5.0): 'audio-codec@1,0' does not match any of the regexes: '^pinctrl-[0-9]+$', '^slim@[0-9a-f]+$' from schema $id: http://devicetree.org/schemas/slimbus/qcom,slim-ngd.yaml# Documentation/devicetree/bindings/slimbus/slimbus.example.dtb: slim@28080000 (qcom,slim-ngd-v1.5.0): #address-cells: 1 was expected from schema $id: http://devicetree.org/schemas/slimbus/qcom,slim-ngd.yaml# Documentation/devicetree/bindings/slimbus/slimbus.example.dtb: slim@28080000 (qcom,slim-ngd-v1.5.0): 'dmas' is a required property from schema $id: http://devicetree.org/schemas/slimbus/qcom,slim-ngd.yaml# Documentation/devicetree/bindings/slimbus/slimbus.example.dtb: slim@28080000 (qcom,slim-ngd-v1.5.0): 'dma-names' is a required property from schema $id: http://devicetree.org/schemas/slimbus/qcom,slim-ngd.yaml# Fixes: 7cbba32a2d62 ("slimbus: qcom: remove unused qcom controller driver") Cc: stable Reported-by: Rob Herring Signed-off-by: Srinivas Kandagatla Acked-by: Rob Herring (Arm) Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110505.143105-1-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6d5925b667e4ed9e77c8278cc215191d29454a3f Author: Ma Ke Date: Wed Nov 12 17:17:23 2025 +0800 intel_th: Fix error handling in intel_th_output_open intel_th_output_open() calls bus_find_device_by_devt() which internally increments the device reference count via get_device(), but this reference is not properly released in several error paths. When device driver is unavailable, file operations cannot be obtained, or the driver's open method fails, the function returns without calling put_device(), leading to a permanent device reference count leak. This prevents the device from being properly released and could cause resource exhaustion over time. Found by code review. Cc: stable Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices") Signed-off-by: Ma Ke Link: https://patch.msgid.link/20251112091723.35963-1-make24@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 43cd4b634ef90c4e2ff75eaeb361786fa04c8874 Author: Christophe JAILLET Date: Sat Nov 8 08:14:04 2025 +0100 misc: rp1: Fix an error handling path in rp1_probe() When DT is used to get the reference of 'rp1_node', it should be released when not needed anymore, otherwise it is leaking. In such a case, add the missing of_node_put() call at the end of the probe, as already done in the error handling path. Fixes: 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver") Signed-off-by: Christophe JAILLET Reviewed-by: Andrea della Porta Link: https://patch.msgid.link/9bc1206de787fa86384f3e5ba0a8027947bc00ff.1762585959.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit 85e83789582ff478888b9c9f904a9203660544af Author: Marco Crivellari Date: Fri Nov 7 17:37:55 2025 +0100 char: xillybus: add WQ_UNBOUND to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds the WQ_UNBOUND flag to explicitly request alloc_workqueue() to be unbound, because this specific workload has no benefit being per-cpu. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Eli Billauer Link: https://patch.msgid.link/20251107163755.356187-1-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit ef48f0f19ec9d77888a23ab62fd2c9e409d81a3e Author: Vivek BalachandharTN Date: Thu Oct 30 12:00:22 2025 +0000 misc: bh1770glc: use pm_runtime_resume_and_get() in power_state_store pm_runtime_get_sync() may increment the runtime PM usage count even if the resume fails, which requires an explicit pm_runtime_put_noidle() to balance it. This driver ignored the return value, risking a usage-count leak on resume failure. Replace it with pm_runtime_resume_and_get(), which returns 0 on success and a negative errno on failure, and only increments the usage count on success. This simplifies the error path and avoids possible leaks. Also check for errors explicitly with `if (ret < 0)`. Signed-off-by: Vivek BalachandharTN Link: https://patch.msgid.link/20251030120022.239951-1-vivek.balachandhar@gmail.com Signed-off-by: Greg Kroah-Hartman commit 05d36a5931d92310819e64fdee0cc1a35e14944c Author: Dan Carpenter Date: Wed Oct 29 16:13:56 2025 +0300 misc: cb710: Fix a NULL vs IS_ERR() check in probe() The pcim_iomap_region() function never returns NULL, it returns error pointers. Update the checking to match. Fixes: b91c13534a63 ("misc: cb710: Replace deprecated PCI functions") Signed-off-by: Dan Carpenter Acked-by: Arnd Bergmann Link: https://patch.msgid.link/aQITFDPyuzjNN4GN@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit 4863cb2b0f505c77f7b4632246d4de4859b86ed2 Author: Thomas Richard (TI.com) Date: Mon Oct 13 15:04:44 2025 +0200 mux: mmio: Add suspend and resume support The status of each mux is read during suspend and stored in the private memory of the mux_chip. Then the state is restored during the resume. Reviewed-by: Andrew Davis Signed-off-by: Thomas Richard (TI.com) Link: https://patch.msgid.link/20251013-mux-mmio-resume-support-v5-1-de9467ceb2b2@bootlin.com Signed-off-by: Greg Kroah-Hartman commit f0fdaa4ad55b7c6e46a5ccb9102bc9a96cad360f Author: Randy Dunlap Date: Mon Oct 27 21:04:09 2025 -0700 virt: acrn: split acrn_mmio_dev_res out of acrn_mmiodev Add struct acrn_mmio_dev_res before struct acrn_mmio_dev. The former is used in the latter and breaking them up provides better kernel-doc documentation for the struct members. Suggested-by: Fei Li Signed-off-by: Randy Dunlap Acked-by: Fei Li Link: https://patch.msgid.link/20251028040409.868254-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit f403e1206b70e6790b2e2409747dd95ce5aa39c5 Merge: 1ed45a4ddc15cf 177fdbae39eccc Author: Christian Brauner Date: Wed Nov 26 14:52:07 2025 +0100 Merge patch series "fs: tidy up step_into() & friends before inlining" Cleanup step_into() and walk_component() and inline them both. * patches from https://patch.msgid.link/20251120003803.2979978-1-mjguzik@gmail.com: fs: inline step_into() and walk_component() fs: tidy up step_into() & friends before inlining Link: https://patch.msgid.link/20251120003803.2979978-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 177fdbae39ecccb441d45e5e5ab146ea35b03d49 Author: Mateusz Guzik Date: Thu Nov 20 01:38:03 2025 +0100 fs: inline step_into() and walk_component() The primary consumer is link_path_walk(), calling walk_component() every time which in turn calls step_into(). Inlining these saves overhead of 2 function calls per path component, along with allowing the compiler to do better job optimizing them in place. step_into() had absolutely atrocious assembly to facilitate the slowpath. In order to lessen the burden at the callsite all the hard work is moved into step_into_slowpath() and instead an inline-able fastpath is implemented for rcu-walk. The new fastpath is a stripped down step_into() RCU handling with a d_managed() check from handle_mounts(). Benchmarked as follows on Sapphire Rapids: 1. the "before" was a kernel with not-yet-merged optimizations (notably elision of calls to security_inode_permission() and marking ext4 inodes as not having acls as applicable) 2. "after" is the same + the prep patch + this patch 3. benchmark consists of issuing 205 calls to access(2) in a loop with pathnames lifted out of gcc and the linker building real code, most of which have several path components and 118 of which fail with -ENOENT. Result in terms of ops/s: before: 21619 after: 22536 (+4%) profile before: 20.25% [kernel] [k] __d_lookup_rcu 10.54% [kernel] [k] link_path_walk 10.22% [kernel] [k] entry_SYSCALL_64 6.50% libc.so.6 [.] __GI___access 6.35% [kernel] [k] strncpy_from_user 4.87% [kernel] [k] step_into 3.68% [kernel] [k] kmem_cache_alloc_noprof 2.88% [kernel] [k] walk_component 2.86% [kernel] [k] kmem_cache_free 2.14% [kernel] [k] set_root 2.08% [kernel] [k] lookup_fast after: 23.38% [kernel] [k] __d_lookup_rcu 11.27% [kernel] [k] entry_SYSCALL_64 10.89% [kernel] [k] link_path_walk 7.00% libc.so.6 [.] __GI___access 6.88% [kernel] [k] strncpy_from_user 3.50% [kernel] [k] kmem_cache_alloc_noprof 2.01% [kernel] [k] kmem_cache_free 2.00% [kernel] [k] set_root 1.99% [kernel] [k] lookup_fast 1.81% [kernel] [k] do_syscall_64 1.69% [kernel] [k] entry_SYSCALL_64_safe_stack While walk_component() and step_into() of course disappear from the profile, the link_path_walk() barely gets more overhead despite the inlining thanks to the fast path added and while completing more walks per second. I did not investigate why overhead grew a lot on __d_lookup_rcu(). Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251120003803.2979978-2-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 9d2a6211a7b972563d20edebccaae42994c429fb Author: Mateusz Guzik Date: Thu Nov 20 01:38:02 2025 +0100 fs: tidy up step_into() & friends before inlining Symlink handling is already marked as unlikely and pushing out some of it into pick_link() reduces register spillage on entry to step_into() with gcc 14.2. The compiler needed additional convincing that handle_mounts() is unlikely to fail. At the same time neither clang nor gcc could be convinced to tail-call into pick_link(). While pick_link() takes an address of stack-based object as an argument (which definitely prevents the optimization), splitting it into separate tuple did not help. The issue persists even when compiled without stack protector. As such nothing was done about this for the time being to not grow the diff. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251120003803.2979978-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 1ed45a4ddc15cfb04a27303cfbd381d9e95a01da Merge: 54ca9e913e22e3 eff094a58d00ac Author: Christian Brauner Date: Wed Nov 26 14:50:17 2025 +0100 Merge patch series "re-enable IOCB_NOWAIT writes to files v2" Christoph Hellwig says: [Fix] the layering bypass in btrfs when updating timestamps on device files for devices removed from btrfs usage, and FMODE_NOCMTIME handling in the VFS now that nfsd started using it. Note that I'm still not sure that nfsd usage is fully correct for all file systems, as only XFS explicitly supports FMODE_NOCMTIME, but at least the generic code does the right thing now. * patches from https://patch.msgid.link/20251120064859.2911749-1-hch@lst.de: orangefs: use inode_update_timestamps directly btrfs: fix the comment on btrfs_update_time btrfs: use vfs_utimes to update file timestamps fs: export vfs_utimes fs: lift the FMODE_NOCMTIME check into file_update_time_flags fs: refactor file timestamp update logic Link: https://patch.msgid.link/20251120064859.2911749-1-hch@lst.de Signed-off-by: Christian Brauner commit eff094a58d00acf1c84f729c3715fc4cf7fddcee Author: Christoph Hellwig Date: Thu Nov 20 07:47:27 2025 +0100 orangefs: use inode_update_timestamps directly Orangefs has no i_version handling and __orangefs_setattr already explicitly marks the inode dirty. So instead of the using the flags return value from generic_update_time, just call the lower level inode_update_timestamps helper directly. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251120064859.2911749-7-hch@lst.de Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f981264ae75e1fee75b7e3f87f4942142e590d01 Author: Christoph Hellwig Date: Thu Nov 20 07:47:26 2025 +0100 btrfs: fix the comment on btrfs_update_time Since commit e41f941a2311 ("Btrfs: move over to use ->update_time") this is not a copy of the high-level file_update_time helper. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251120064859.2911749-6-hch@lst.de Signed-off-by: Christian Brauner commit ded99587047c7db44837cbbc56448dcdfdae04ae Author: Christoph Hellwig Date: Thu Nov 20 07:47:25 2025 +0100 btrfs: use vfs_utimes to update file timestamps Btrfs updates the device node timestamps for block device special files when it stop using the device. Commit 8f96a5bfa150 ("btrfs: update the bdev time directly when closing") switch that update from the correct layering to directly call the low-level helper on the bdev inode. This is wrong and got fixed in commit 54fde91f52f5 ("btrfs: update device path inode time instead of bd_inode") by updating the file system inode instead of the bdev inode, but this kept the incorrect bypassing of the VFS interfaces and file system ->update_times method. Fix this by using the propet vfs_utimes interface. Fixes: 8f96a5bfa150 ("btrfs: update the bdev time directly when closing") Fixes: 54fde91f52f5 ("btrfs: update device path inode time instead of bd_inode") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251120064859.2911749-5-hch@lst.de Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 013983665227b16d0ec2c4fec19b43c3e265ebc5 Author: Christoph Hellwig Date: Thu Nov 20 07:47:24 2025 +0100 fs: export vfs_utimes This will be used to replace an incorrect direct call into generic_update_time in btrfs. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251120064859.2911749-4-hch@lst.de Reviewed-by: Chaitanya Kulkarni Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 7f30e7a42371af4bba53f9a875a0d320cead9f4b Author: Christoph Hellwig Date: Thu Nov 20 07:47:23 2025 +0100 fs: lift the FMODE_NOCMTIME check into file_update_time_flags FMODE_NOCMTIME used to be just a hack for the legacy XFS handle-based "invisible I/O", but commit e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") started using it from generic callers. I'm not sure other file systems are actually read for this in general, so the above commit should get a closer look, but for it to make any sense, file_update_time needs to respect the flag. Lift the check from file_modified_flags to file_update_time so that users of file_update_time inherit the behavior and so that all the checks are done in one place. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251120064859.2911749-3-hch@lst.de Reviewed-by: Chaitanya Kulkarni Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3cd9a42f1b5e34d3972237cbf8541af60844cbd4 Author: Christoph Hellwig Date: Thu Nov 20 07:47:22 2025 +0100 fs: refactor file timestamp update logic Currently the two high-level APIs use two helper functions to implement almost all of the logic. Refactor the two helpers and the common logic into a new file_update_time_flags routine that gets the iocb flags or 0 in case of file_update_time passed so that the entire logic is contained in a single function and can be easily understood and modified. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251120064859.2911749-2-hch@lst.de Reviewed-by: Chaitanya Kulkarni Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit e6df0f649cff08da7a2feb6d963b39076ca129f9 Author: Haotian Zhang Date: Fri Nov 21 14:40:27 2025 +0800 greybus: gb-beagleplay: Fix timeout handling in bootloader functions wait_for_completion_timeout() returns the remaining jiffies (at least 1) on success or 0 on timeout, but never negative error codes. The current code incorrectly checks for negative values, causing timeouts to be ignored and treated as success. Check for a zero return value to correctly identify and handle timeout events. Fixes: 0cf7befa3ea2 ("greybus: gb-beagleplay: Add firmware upload API") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251121064027.571-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 8c5d9488b9c0e07dc648d9dfceeed6ad068daba2 Author: Marco Crivellari Date: Wed Nov 12 16:27:10 2025 +0100 greybus: add WQ_PERCPU to alloc_workqueue users This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Johan Hovold Link: https://patch.msgid.link/20251112152710.207577-1-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit 00a925eee854e41bb6654e40246b8e7cf183ea0f Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:19:49 2025 +0100 char/mwave: drop typedefs typedefs are unnecessary here. They rather obfuscate the code than help. So drop them and use the types directly. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251119091949.825958-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 1c7e15b0e5b411589c6c5e3935f19f60bb52dd6c Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:19:48 2025 +0100 char/mwave: drop printk wrapper PRINTK_ERROR() + KERN_ERR_MWAVE are just wrappers around printk() with a prefix. Instead, pr_fmt() can be used. Drop the former and use the latter. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251119091949.825958-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 53688a9f3735588a57603f0edee58f6bd7b07b92 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:19:47 2025 +0100 char/mwave: remove printk tracing The printk tracing makes the code hard to follow for no good benefit. Everyone can use dynamic tracing and/or kprobes. Drop this unreadable bloatware too. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251119091949.825958-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3b4df2320ef66a8762f5a283fdf9c0e09e6ca6b2 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:19:46 2025 +0100 char/mwave: remove unneeded fops file_operations::{read/write/open/release} need not be defined. The core code return proper values already (the same as the being removed ones). So there is no need to preserve these just for tracing via printk. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251119091949.825958-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 48e77862a73b7a24dbe96335e8f7790adf8e48be Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:19:45 2025 +0100 char/mwave: remove MWAVE_FUTZ_WITH_OTHER_DEVICES ifdeffery In mwave, a lot of code depends on the MWAVE_FUTZ_WITH_OTHER_DEVICES macro. That can be defined in Makefile to compile this in. 1) The code is completely unreadable. 2) Recompiling the kernel to have this untested code compiled in is not a good idea. Drop all this. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251119091949.825958-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3b4d1b226dc5f065bfb685263eb27312287752f9 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:19:44 2025 +0100 char/mwave: remove dead code In mwave, there is a lot of commented code for a long time. Drop it. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251119091949.825958-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 043cc033451530f81d7fe791dcc29874f6a147fd Author: Lad Prabhakar Date: Wed Nov 26 13:16:19 2025 +0000 spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/V2N SoC support Document the RSPI controller on the Renesas RZ/V2N SoC. The block is compatible with the RSPI implementation found on the RZ/V2H(P) family. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251126131619.136605-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Mark Brown commit 9906efa545d1d2cf25a614eeb219d3f8d5a302cd Author: Alexandre Courbot Date: Thu Nov 6 11:40:54 2025 +0900 firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER The use of firmware_loader is an implementation detail of drivers rather than a dependency. FW_LOADER is typically selected rather than depended on; the Rust abstractions should do the same thing. Fixes: de6582833db0 ("rust: add firmware abstractions") Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251106-b4-select-rust-fw-v3-1-771172257755@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 1520007aa361cd97067364d8c6fc1bbc14e93f08 Author: Adam Quandour Date: Mon Nov 24 22:20:48 2025 +0300 staging: gpib: Clean-up commented-out code Remove unused code. Signed-off-by: Adam Quandour Link: https://patch.msgid.link/20251124192048.290425-1-adam.quandour@gmail.com Signed-off-by: Greg Kroah-Hartman commit 73b97d46dde64fa184d47865d4a532d818c3a007 Author: Shengjiu Wang Date: Wed Nov 26 14:45:09 2025 +0800 ASoC: fsl_xcvr: clear the channel status control memory memset_io() writes memory byte by byte with __raw_writeb() on the arm platform if the size is word. but XCVR data RAM memory can't be accessed with byte address, so with memset_io() the channel status control memory is not really cleared, use writel_relaxed() instead. Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20251126064509.1900974-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit ea39cd0e42a2475fe273ac34579c98db732eefa4 Author: Navaneeth K Date: Tue Nov 25 11:20:59 2025 +0000 staging: rtl8723bs: remove custom FIELD_OFFSET macro The custom FIELD_OFFSET macro is no longer used in the driver (replaced by standard offsetof). Remove the definition. Signed-off-by: Navaneeth K Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251125112059.16913-6-knavaneeth786@gmail.com Signed-off-by: Greg Kroah-Hartman commit d82c5681dfe6392a26719b6a7bb53bd86f6db063 Author: Navaneeth K Date: Tue Nov 25 11:20:58 2025 +0000 staging: rtl8723bs: replace FIELD_OFFSET usage with offsetof in rtw_mlme_ext.c Replace usage of the custom FIELD_OFFSET macro with the standard offsetof() macro in rtw_mlme_ext.c. This improves code readability and uses the kernel's standard mechanism. Signed-off-by: Navaneeth K Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251125112059.16913-5-knavaneeth786@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2cbcfd3fce6f80374bfab1288d1f77eabb0bf48f Author: Navaneeth K Date: Tue Nov 25 11:20:57 2025 +0000 staging: rtl8723bs: remove dead commented code from odm.c Remove obsolete commented-out code that references unsupported chip variants (ODM_RTL8723A, ODM_RTL8188E). This code has been dead since the driver was added to staging. Also fix the resulting formatting by removing the unnecessary outer parentheses and moving the inline comment to its own line. Signed-off-by: Navaneeth K Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251125112059.16913-4-knavaneeth786@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6ddb173fcf34f4b9351a20f29e31aa2bc3f90574 Author: Navaneeth K Date: Tue Nov 25 11:20:56 2025 +0000 staging: rtl8723bs: use standard offsetof in cfg80211 operations Replace usage of the custom FIELD_OFFSET macro with the standard offsetof() macro in ioctl_cfg80211.c. This improves code readability and uses the kernel's standard mechanism. Also include in basic_types.h to ensure offsetof() is available for this and future conversions. Signed-off-by: Navaneeth K Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251125112059.16913-3-knavaneeth786@gmail.com Signed-off-by: Greg Kroah-Hartman commit e09748f874422f71b21cc1c0628743d445b2b2c6 Author: Navaneeth K Date: Tue Nov 25 11:20:55 2025 +0000 staging: rtl8723bs: remove unused registry and BSSID offset macros The RGTRY_OFT, RGTRY_SZ, BSSID_OFT, and BSSID_SZ macros are defined but never used anywhere in the driver. Remove these dead macro definitions to clean up the code. Signed-off-by: Navaneeth K Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251125112059.16913-2-knavaneeth786@gmail.com Signed-off-by: Greg Kroah-Hartman commit 98d86d87aafb01e7c60b46d327a0a32619a167ff Author: Ian Abbott Date: Tue Oct 28 11:28:33 2025 +0000 comedi: 8255: Fail to attach if fail to request I/O port region The COMEDI standalone 8255 driver can be used to configure a COMEDI device consisting of one of more subdevices, each using an 8255 digital I/O chip mapped to a range of port I/O addresses. The base port I/O address of each chip is specified in an array of integer option values by the `COMEDI_DEVCONFIG` ioctl. When support for multiple 8255 subdevices per device was added in the out-of-tree comedi 0.7.27 back in 1999, if any port I/O region could not be requested, then the corresponding subdevice was set to be an "unused" subdevice, and the COMEDI device would still be set-up OK as long as those were the only types of errors. That has persisted until the present day, but seems a bit odd in retrospect. All the other COMEDI drivers that use port I/O or memory regions will fail to set up the device if any region cannot be requested. It seems unlikely that the sys admin would deliberately choose a port that cannot be requested just to leave a gap in the device's usable subdevice numbers, and failing to set-up the device will provide a more noticeable indication that something hasn't been set-up correctly, so change the driver to fail to set up the device if any of the port I/O regions cannot be requested. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251028112833.15033-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 2402f958cf3b2e96975ad5fd14784a108b7defe3 Author: Ian Abbott Date: Mon Oct 27 15:25:03 2025 +0000 comedi: comedi_bond: Check for loops when bonding devices The "comedi_bond" driver allows a composite COMEDI device to be built up from the subdevices of other COMEDI devices, although it currently only supports digital I/O subdevices. Although it checks that it is not trying to bind to itself, it is possible to end up with a cycle of "comedi_bond" devices bound to each other. For example: 1. Configure /dev/comedi0 to use some COMEDI hardware device with digital I/O subdevices, but not a "comedi_bond" device. 2. Configure /dev/comedi1 as a "comedi_bond" device bound to /dev/comedi0. 3. Unconfigure /dev/comedi0 and reconfigure it as a "comedi_bond" device bound to /dev/comedi1. Now we have /dev/comedi0 and /dev/comedi1 bound in a cycle. When an operation is performed on the digital I/O subdevice of /dev/comedi0 for example, it will try and perform the operation on /dev/comedi1, which will try and perform the operation on /dev/comedi0. The task will end up deadlocked trying to lock /dev/comedi0's mutex which it has already locked. I discovered that possibility while investigating fix sysbot crash https://syzkaller.appspot.com/bug?extid=4a6138c17a47937dcea1 ("possible deadlock in comedi_do_insn"), but I think that report may be a false positive. To avoid that, replace the calls to `comedi_open()` and `comedi_close()` in "kcomedilib" with calls to `comedi_open_from()` and `comedi_close_from()`. These take an extra parameter that indicates the COMEDI minor device number from which the open or close is being performed. `comedi_open_from()` will refuse to open the device if doing so would result in a cycle. The cycle detection depends on the extra parameter having the correct value for this device and also for existing devices in the chain. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251027153748.4569-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit d1b3b9c70e11cb4f40b4e41a4dc1503b9a3c0109 Author: Ian Abbott Date: Mon Oct 27 15:25:02 2025 +0000 comedi: kcomedilib: Add loop checking variants of open and close Add `comedi_open_from(path, from)` and `comedi_close_from(dev, from)` as variants of the existing `comedi_from(path)` and `comedi_close(dev)`. The additional `from` parameter is a minor device number that tells the function that the COMEDI device is being opened or closed from another COMEDI device if the value is in the range [0, `COMEDI_NUM_BOARD_MINORS`-1]. In that case the function will refuse to open the device if it would lead to a chain of devices opening each other. (It will also impose a limit on the number of simultaneous opens from one device to another because we need to count those.) The new functions are intended to be used by the "comedi_bond" driver, which is the only driver that uses the existing `comedi_open()` and `comedi_close()` functions. The new functions will be used to avoid some possible deadlock situations. Replace the existing, exported `comedi_open()` and `comedi_close()` functions with inline wrapper functions that call the newly exported `comedi_open_from()` and `comedi_close_from()` functions. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251027153748.4569-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 51495254fda43cf1027fe052a77bea742ca23a05 Author: Ian Abbott Date: Thu Oct 23 14:28:19 2025 +0100 comedi: Use reference count for asynchronous command functions For interrupts from badly behaved hardware (as emulated by Syzbot), it is possible for the Comedi core functions that manage the progress of asynchronous data acquisition to be called from driver ISRs while no asynchronous command has been set up, which can cause problems such as invalid pointer dereferencing or dividing by zero. Change those functions in the Comedi core to use this pattern: if `comedi_get_is_subdevice_running(s)` returns `true` then call a safe version of the function with the same name prefixed with an underscore, followed by a call to `comedi_put_is_subdevice_running(s)`, otherwise take some default action. `comedi_get_is_subdevice_running(s)` returning `true` ensures that the details of the asynchronous command will not be destroyed before the matching call to `comedi_put_is_subdevice_running(s)`. Replace calls to those functions from elsewhere in the Comedi core with calls to the safe versions of the functions. The modified functions are: `comedi_buf_read_alloc()`, `comedi_buf_read_free()`, `comedi_buf_read_n_available()`, `comedi_buf_read_samples()`, `comedi_buf_write_alloc()`, `comedi_buf_write_free()`, `comedi_buf_write_samples()`, `comedi_bytes_per_scan()`, `comedi_event()`, `comedi_handle_events()`, `comedi_inc_scan_progress()`, `comedi_nsamples_left()`, `comedi_nscans_left()`. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251023133001.8439-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 4e1da516debbe6a573ffa0392e2809d180d0575c Author: Ian Abbott Date: Thu Oct 23 14:28:18 2025 +0100 comedi: Add reference counting for Comedi command handling For interrupts from badly behaved hardware (as emulated by Syzbot), it is possible for the Comedi core functions that manage the progress of asynchronous data acquisition to be called from driver ISRs while no asynchronous command has been set up, which can cause problems such as invalid pointer dereferencing or dividing by zero. To help protect against that, introduce new functions to maintain a reference counter for asynchronous commands that are being set up. `comedi_get_is_subdevice_running(s)` will check if a command has been set up on a subdevice and is still marked as running, and if so will increment the reference counter and return `true`, otherwise it will return `false` without modifying the reference counter. `comedi_put_is_subdevice_running(s)` will decrement the reference counter and set a completion event when decremented to 0. Change the `do_cmd_ioctl()` function (responsible for setting up the asynchronous command) to reinitialize the completion event and set the reference counter to 1 before it marks the subdevice as running. Change the `do_become_nonbusy()` function (responsible for destroying a completed command) to call `comedi_put_is_subdevice_running(s)` and wait for the completion event after marking the subdevice as not running. Because the subdevice normally gets marked as not running before the call to `do_become_nonbusy()` (and may also be called when the Comedi device is being detached from the low-level driver), add a new flag `COMEDI_SRF_BUSY` to the set of subdevice run-flags that indicates that an asynchronous command was set up and will need to be destroyed. This flag is set by `do_cmd_ioctl()` and cleared and checked by `do_become_nonbusy()`. Subsequent patches will change the Comedi core functions that are called from low-level drivers for asynchrous command handling to make use of the `comedi_get_is_subdevice_running()` and `comedi_put_is_subdevice_running()` functions, and will modify the ISRs of some of these low-level drivers if they dereference the subdevice's `async` pointer directly. Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251023133001.8439-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit a51f025b5038abd3d22eed2ede4cd46793d89565 Author: Nikita Zhandarovich Date: Thu Oct 23 17:14:56 2025 +0300 comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash. Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either. [1] Syzbot crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762 ... Call Trace: pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline] comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] ... Reported-by: syzbot+fce5d9d5bd067d6fbe9b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fce5d9d5bd067d6fbe9b Fixes: 00aba6e7b565 ("staging: comedi: pcl818: remove 'neverending_ai' from private data") Cc: stable Signed-off-by: Nikita Zhandarovich Reviewed-by: Ian Abbott Link: https://patch.msgid.link/20251023141457.398685-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman commit f24c6e3a39fa355dabfb684c9ca82db579534e72 Author: Nikita Zhandarovich Date: Thu Oct 23 16:22:04 2025 +0300 comedi: multiq3: sanitize config options in multiq3_attach() Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well. While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting. [1] Syzbot crash: INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097 ... Reported-by: syzbot+7811bb68a317954a0347@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7811bb68a317954a0347 Fixes: 77e01cdbad51 ("Staging: comedi: add multiq3 driver") Cc: stable Signed-off-by: Nikita Zhandarovich Reviewed-by: Ian Abbott Link: https://patch.msgid.link/20251023132205.395753-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman commit bcf016aa87fb448cea24fa25e02ccebce06b5a56 Author: Francesco Lavra Date: Wed Nov 26 12:29:26 2025 +0100 ASoC: tegra: remove Kconfig dependency on TEGRA20_APB_DMA The ALSA SoC driver for Tegra runs also on SoCs without the Tegra20 APB DMA controller (e.g. Tegra234). Signed-off-by: Francesco Lavra Link: https://patch.msgid.link/20251126112926.4126757-1-flavra@baylibre.com Signed-off-by: Mark Brown commit 4cfc7d5a4a01d2133b278cdbb1371fba1b419174 Author: Alexey Velichayshiy Date: Mon Nov 17 12:05:18 2025 +0300 gfs2: fix freeze error handling After commit b77b4a4815a9 ("gfs2: Rework freeze / thaw logic"), the freeze error handling is broken because gfs2_do_thaw() overwrites the 'error' variable, causing incorrect processing of the original freeze error. Fix this by calling gfs2_do_thaw() when gfs2_lock_fs_check_clean() fails but ignoring its return value to preserve the original freeze error for proper reporting. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b77b4a4815a9 ("gfs2: Rework freeze / thaw logic") Cc: stable@vger.kernel.org # v6.5+ Signed-off-by: Alexey Velichayshiy Signed-off-by: Andreas Gruenbacher commit 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee Author: Nikita Zhandarovich Date: Thu Oct 23 16:22:32 2025 +0300 comedi: check device's attached status in compat ioctls Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig(). As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG. Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback. Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions. [1] Syzbot report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] ... Reported-by: syzbot+ab8008c24e84adee93ff@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab8008c24e84adee93ff Fixes: 3fbfd2223a27 ("comedi: get rid of compat_alloc_user_space() mess in COMEDI_CHANINFO compat") Cc: stable Reviewed-by: Ian Abbott Signed-off-by: Nikita Zhandarovich Link: https://patch.msgid.link/20251023132234.395794-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman commit 72262330f7b3ad2130e800cecf02adcce3c32c77 Author: Ian Abbott Date: Thu Oct 23 13:31:41 2025 +0100 comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler `c6xdigio_attach()` to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with `pnp_register_driver()`, but ignores the return value. (The `struct pnp_driver` it uses has only the `name` and `id_table` members filled in.) The driver's Comedi "detach" handler `c6xdigio_detach()` unconditionally unregisters the PNP driver with `pnp_unregister_driver()`. It is possible for `c6xdigio_attach()` to return an error before it calls `pnp_register_driver()` and it is possible for the call to `pnp_register_driver()` to return an error (that is ignored). In both cases, the driver should not be calling `pnp_unregister_driver()` as it does in `c6xdigio_detach()`. (Note that `c6xdigio_detach()` will be called by the Comedi core if `c6xdigio_attach()` returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.) The unconditional call to `pnp_unregister_driver()` without a previous successful call to `pnp_register_driver()` will cause `driver_unregister()` to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1]. Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.) Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since `c6xdigio_detach()` now only calls `comedi_legacy_detach()`, remove the function and change the Comedi driver "detach" handler to `comedi_legacy_detach`. ------------------------------------------- [1] Syzbot sample crash report: Unexpected driver unregister! WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 ------------------------------------------- Reported-by: syzbot+6616bba359cec7a1def1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6616bba359cec7a1def1 Fixes: 2c89e159cd2f ("Staging: comedi: add c6xdigio driver") Cc: stable Signed-off-by: Ian Abbott Link: https://patch.msgid.link/20251023123141.6537-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 2c5f4a53476e3cab70adc77b38942c066bd2c17c Author: Andreas Gruenbacher Date: Thu Nov 13 12:05:37 2025 +0000 gfs2: Prevent recursive memory reclaim Function new_inode() returns a new inode with inode->i_mapping->gfp_mask set to GFP_HIGHUSER_MOVABLE. This value includes the __GFP_FS flag, so allocations in that address space can recurse into filesystem memory reclaim. We don't want that to happen because it can consume a significant amount of stack memory. Worse than that is that it can also deadlock: for example, in several places, gfs2_unstuff_dinode() is called inside filesystem transactions. This calls filemap_grab_folio(), which can allocate a new folio, which can trigger memory reclaim. If memory reclaim recurses into the filesystem and starts another transaction, a deadlock will ensue. To fix these kinds of problems, prevent memory reclaim from recursing into filesystem code by making sure that the gfp_mask of inode address spaces doesn't include __GFP_FS. The "meta" and resource group address spaces were already using GFP_NOFS as their gfp_mask (which doesn't include __GFP_FS). The default value of GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though. To avoid being overly limiting, use the default value and only knock off the __GFP_FS flag. I'm not sure if this will actually make a difference, but it also shouldn't hurt. This patch is loosely based on commit ad22c7a043c2 ("xfs: prevent stack overflows from page cache allocation"). Fixes xfstest generic/273. Fixes: dc0b9435238c ("gfs: Don't use GFP_NOFS in gfs2_unstuff_dinode") Reviewed-by: Andrew Price Signed-off-by: Andreas Gruenbacher commit 6e757fd548e61dadbd62c5732c0ed3a741ae4e41 Merge: 43ff36c4a5a574 77ca1612b80154 Author: Rafael J. Wysocki Date: Wed Nov 26 13:56:30 2025 +0100 Merge back ACPI processor driver changes for 6.19 commit f0a40fe2fc2c07827dfcee5ab070f3fe30413ed5 Author: Andrew Donnellan Date: Thu Nov 20 14:16:26 2025 +1100 MAINTAINERS: Downgrade ocxl to Odd Fixes There hasn't been any substantive work on the ocxl driver since 2020, and all patches since then have been minor fixes or part of treewide or arch-wide changes. Frederic and I are no longer spending much time on this driver. Downgrade the status of the ocxl driver to Odd Fixes, to reflect the current reality. Signed-off-by: Andrew Donnellan Acked-by: Frederic Barrat Link: https://patch.msgid.link/20251120-ocxl-odd-fixes-v1-1-8b766f114621@linux.ibm.com Signed-off-by: Greg Kroah-Hartman commit a6dab2f61d23c1eb32f1d08fa7b4919a2478950b Author: Ma Ke Date: Tue Nov 4 10:01:33 2025 +0800 mei: Fix error handling in mei_register mei_register() fails to release the device reference in error paths after device_initialize(). During normal device registration, the reference is properly handled through mei_deregister() which calls device_destroy(). However, in error handling paths (such as cdev_alloc failure, cdev_add failure, etc.), missing put_device() calls cause reference count leaks, preventing the device's release function (mei_device_release) from being called and resulting in memory leaks of mei_device. Found by code review. Cc: stable Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device") Signed-off-by: Ma Ke Acked-by: Alexander Usyskin Link: https://patch.msgid.link/20251104020133.5017-1-make24@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 5d92c3b41f0bddfa416130c6e1b424414f3d2acf Author: Junxiao Chang Date: Sun Nov 9 17:35:33 2025 +0200 mei: gsc: add dependency on Xe driver INTEL_MEI_GSC depends on either i915 or Xe and can be present when either of above is present. Cc: stable Fixes: 87a4c85d3a3e ("drm/xe/gsc: add gsc device support") Tested-by: Baoli Zhang Signed-off-by: Junxiao Chang Signed-off-by: Alexander Usyskin Link: https://patch.msgid.link/20251109153533.3179787-1-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 58796560642a6e3148661a4df9da342a9a301748 Author: Sakari Ailus Date: Mon Oct 27 13:41:18 2025 +0200 mei: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Alexander Usyskin Link: https://patch.msgid.link/20251027114118.390775-1-sakari.ailus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit cd41d3420ef658b2ca902d7677536ec8e25b610a Author: Jaroslav Kysela Date: Wed Nov 26 10:16:35 2025 +0100 ASoC: nau8325: add missing build config This configuration was missing from the initial commit. Found by Jiri Benc Fixes: c0a3873b9938 ("ASoC: nau8325: new driver") Cc: Seven Lee Signed-off-by: Jaroslav Kysela Link: https://patch.msgid.link/20251126091759.2490019-3-perex@perex.cz Signed-off-by: Mark Brown commit b4d072c98e47c562834f2a050ca98a1c709ef4f9 Author: Jaroslav Kysela Date: Wed Nov 26 10:16:34 2025 +0100 ASoC: nau8325: use simple i2c probe function The i2c probe functions here don't use the id information provided in their second argument, so the single-parameter i2c probe function ("probe_new") can be used instead. This avoids scanning the identifier tables during probes. Signed-off-by: Jaroslav Kysela Link: https://patch.msgid.link/20251126091759.2490019-2-perex@perex.cz Signed-off-by: Mark Brown commit 2c8ad5cfc22dba7d0b3b3ddfec0a75d8ea4169c3 Author: Alice Ryhl Date: Tue Nov 11 14:23:34 2025 +0000 rust: list: add warning to List::remove docs about mem::take The previous patches in this series illustrate why the List::remove method is really dangerous. I think the real takeaway here is to replace the linked lists with a different data structure without this unsafe footgun, but for now we fix the bugs and add a warning to the docs. Signed-off-by: Alice Ryhl Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-3-8ed14a0da63d@google.com Signed-off-by: Greg Kroah-Hartman commit 6c37bebd8c926ad01ef157c0d123633a203e5c0d Author: Alice Ryhl Date: Tue Nov 11 14:23:33 2025 +0000 rust_binder: avoid mem::take on delivered_deaths Similar to the previous commit, List::remove is used on delivered_deaths, so do not use mem::take on it as that may result in violations of the List::remove safety requirements. I don't think this particular case can be triggered because it requires fd close to run in parallel with an ioctl on the same fd. But let's not tempt fate. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Alice Ryhl Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-2-8ed14a0da63d@google.com Signed-off-by: Greg Kroah-Hartman commit 3e0ae02ba831da2b707905f4e602e43f8507b8cc Author: Alice Ryhl Date: Tue Nov 11 14:23:32 2025 +0000 rust_binder: fix race condition on death_list Rust Binder contains the following unsafe operation: // SAFETY: A `NodeDeath` is never inserted into the death list // of any node other than its owner, so it is either in this // death list or in no death list. unsafe { node_inner.death_list.remove(self) }; This operation is unsafe because when touching the prev/next pointers of a list element, we have to ensure that no other thread is also touching them in parallel. If the node is present in the list that `remove` is called on, then that is fine because we have exclusive access to that list. If the node is not in any list, then it's also ok. But if it's present in a different list that may be accessed in parallel, then that may be a data race on the prev/next pointers. And unfortunately that is exactly what is happening here. In Node::release, we: 1. Take the lock. 2. Move all items to a local list on the stack. 3. Drop the lock. 4. Iterate the local list on the stack. Combined with threads using the unsafe remove method on the original list, this leads to memory corruption of the prev/next pointers. This leads to crashes like this one: Unable to handle kernel paging request at virtual address 000bb9841bcac70e Mem abort info: ESR = 0x0000000096000044 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [000bb9841bcac70e] address between user and kernel address ranges Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP google-cdd 538c004.gcdd: context saved(CPU:1) item - log_kevents is disabled Modules linked in: ... rust_binder CPU: 1 UID: 0 PID: 2092 Comm: kworker/1:178 Tainted: G S W OE 6.12.52-android16-5-g98debd5df505-4k #1 f94a6367396c5488d635708e43ee0c888d230b0b Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: MUSTANG PVT 1.0 based on LGA (DT) Workqueue: events _RNvXs6_NtCsdfZWD8DztAw_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCs8QPsHWIn21X_16rust_binder_main7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ [rust_binder] pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : _RNvXs3_NtCs8QPsHWIn21X_16rust_binder_main7processNtB5_7ProcessNtNtCsdfZWD8DztAw_6kernel9workqueue8WorkItem3run+0x450/0x11f8 [rust_binder] lr : _RNvXs3_NtCs8QPsHWIn21X_16rust_binder_main7processNtB5_7ProcessNtNtCsdfZWD8DztAw_6kernel9workqueue8WorkItem3run+0x464/0x11f8 [rust_binder] sp : ffffffc09b433ac0 x29: ffffffc09b433d30 x28: ffffff8821690000 x27: ffffffd40cbaa448 x26: ffffff8821690000 x25: 00000000ffffffff x24: ffffff88d0376578 x23: 0000000000000001 x22: ffffffc09b433c78 x21: ffffff88e8f9bf40 x20: ffffff88e8f9bf40 x19: ffffff882692b000 x18: ffffffd40f10bf00 x17: 00000000c006287d x16: 00000000c006287d x15: 00000000000003b0 x14: 0000000000000100 x13: 000000201cb79ae0 x12: fffffffffffffff0 x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000000 x8 : b80bb9841bcac706 x7 : 0000000000000001 x6 : fffffffebee63f30 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000004c31 x1 : ffffff88216900c0 x0 : ffffff88e8f9bf00 Call trace: _RNvXs3_NtCs8QPsHWIn21X_16rust_binder_main7processNtB5_7ProcessNtNtCsdfZWD8DztAw_6kernel9workqueue8WorkItem3run+0x450/0x11f8 [rust_binder bbc172b53665bbc815363b22e97e3f7e3fe971fc] process_scheduled_works+0x1c4/0x45c worker_thread+0x32c/0x3e8 kthread+0x11c/0x1c8 ret_from_fork+0x10/0x20 Code: 94218d85 b4000155 a94026a8 d10102a0 (f9000509) ---[ end trace 0000000000000000 ]--- Thus, modify Node::release to pop items directly off the original list. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Alice Ryhl Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-1-8ed14a0da63d@google.com Signed-off-by: Greg Kroah-Hartman commit 1e9a37d35a0ea658df7b5d64889ec2bd529f46d6 Author: Sunday Adelodun Date: Fri Nov 21 12:12:03 2025 +0100 android: binder: add missing return value documentation for binder_apply_fd_fixups() The kernel-doc for binder_apply_fd_fixups() was missing a description of its return value, which triggers a kernel-doc warning. Add the missing "Return:" entry to doc that the function returns 0 on success or a negative errno on failure. Signed-off-by: Sunday Adelodun Link: https://patch.msgid.link/20251121111203.21800-2-adelodunolaoluwa@yahoo.com Signed-off-by: Greg Kroah-Hartman commit 77198581e0d05aae08a06f471e21a19ab0edaea2 Author: Sunday Adelodun Date: Fri Nov 21 12:12:02 2025 +0100 android: binderfs: add missing parameters in binder_ctl_ioctl()'s doc The kernel-doc comment for binder_ctl_ioctl() lacks descriptions for the @file, @cmd, and @arg parameters, which triggers warnings during documentation builds. Add the missing parameter descriptions to keep the kernel-doc consistent and free of warnings. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511201725.ni2HZ2PP-lkp@intel.com/ Signed-off-by: Sunday Adelodun Link: https://patch.msgid.link/20251121111203.21800-1-adelodunolaoluwa@yahoo.com Signed-off-by: Greg Kroah-Hartman commit c938fdd82fac65dfb64cf92e3825f125af7ab315 Author: Carlos Llamas Date: Fri Nov 7 22:48:22 2025 +0000 MAINTAINERS: add Alice as a Binder maintainer Alice has been reviewing binder patches for years now and has a strong understanding of the driver, so this patch is well overdue. While here also clean up the list from folks who haven't been active for a while. Signed-off-by: Carlos Llamas Acked-by: Joel Fernandes Acked-by: Alice Ryhl Link: https://patch.msgid.link/20251107224824.644832-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit c1437332e4d351e86049c275d879110f4dabe7b7 Author: Alice Ryhl Date: Wed Oct 29 11:50:58 2025 +0000 rust_binder: move BC_FREE_BUFFER drop inside if statement When looking at flamegraphs, there is a pretty large entry for the function call drop_in_place::> which in turn calls drop_in_place::. Combined with the looper_need_return condition, this means that the generated code looks like this: if let Some(buffer) = buffer { if buffer.looper_need_return_on_free() { self.inner.lock().looper_need_return = true; } } drop_in_place::>() { // not inlined if let Some(buffer) = buffer { drop_in_place::(buffer); } } This kind of situation where you check X and then check X again is normally optimized into a single condition, but in this case due to the non-inlined function call to drop_in_place::>, that optimization does not happen. Furthermore, the drop_in_place:: call is only two-thirds of the drop_in_place::> call in the flamegraph. This indicates that this double condition is not performing well. Also, last time I looked at Binder perf, I remember finding that the destructor of Allocation was involved with many branch mispredictions. Thus, change this code to look like this: if let Some(buffer) = buffer { if buffer.looper_need_return_on_free() { self.inner.lock().looper_need_return = true; } drop_in_place::(buffer); } by dropping the Allocation directly. Flamegraphs confirm that the drop_in_place::> call disappears from this change. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20251029-binder-bcfreebuf-option-v1-1-4d282be0439f@google.com Signed-off-by: Greg Kroah-Hartman commit d4b83ba11cf227705986265fab0744060c02608b Author: Alice Ryhl Date: Fri Oct 31 08:48:18 2025 +0000 rust_binder: use compat_ptr_ioctl Binder always treats the ioctl argument as a pointer. In this scenario, the idiomatic way to implement compat_ioctl is to use compat_ptr_ioctl. Thus update Rust Binder to do that. Signed-off-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://patch.msgid.link/20251031-binder-compatptrioctl-v2-1-3d05b5cc058e@google.com Signed-off-by: Greg Kroah-Hartman commit a1fb84ab7b92e8e9df448a79e8c02b57c98b5141 Author: Carlos Llamas Date: Fri Oct 24 16:15:02 2025 +0000 binder: mark binder_alloc_exhaustive_test as slow The binder_alloc_exhaustive_test kunit test takes over 30s to complete and the kunit framework reports: # binder_alloc_exhaustive_test: Test should be marked slow (runtime: 33.842881934s) Mark the test as suggested to silence the warning. Cc: Tiffany Yang Signed-off-by: Carlos Llamas Reviewed-by: Tiffany Yang Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251024161525.1732874-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 75a9f4c54770f062f4b3813a83667452b326dda3 Author: Biju Das Date: Fri Nov 14 10:13:47 2025 +0000 serial: sh-sci: Fix deadlock during RSCI FIFO overrun error On RSCI IP, a deadlock occurs during a FIFO overrun error, as it uses a different register to clear the FIFO overrun error status. Cc: stable@kernel.org Fixes: 0666e3fe95ab ("serial: sh-sci: Add support for RZ/T2H SCI") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251114101350.106699-3-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit a6cdfd69ad38997108b862f9aafc547891506701 Author: Biju Das Date: Fri Nov 14 10:13:46 2025 +0000 dt-bindings: serial: rsci: Drop "uart-has-rtscts: false" Drop "uart-has-rtscts: false" from binding as the IP supports hardware flow control on all SoCs. Cc: stable@kernel.org Fixes: 25422e8f46c1 ("dt-bindings: serial: Add compatible for Renesas RZ/T2H SoC in sci") Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20251114101350.106699-2-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 13532b5186a7aa4dfd9885355c6af7562b75dd7f Author: Binbin Zhou Date: Sat Oct 11 15:16:49 2025 +0800 LoongArch: dts: Add uart new compatible string Add loongson,ls2k*-uart compatible string on uarts. Co-developed-by: Haowei Zheng Signed-off-by: Haowei Zheng Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/8e0c08459fa5bddefd898648fea28a9f2fde701a.1760166651.git.zhoubinbin@loongson.cn Signed-off-by: Greg Kroah-Hartman commit 25e95d763176854e961aaf0f8a76f435f2dab974 Author: Binbin Zhou Date: Sat Oct 11 15:16:48 2025 +0800 serial: 8250: Add Loongson uart driver support Add the driver for on-chip UART used on Loongson family chips. The hardware is similar to NS16550A, but there are the following differences: - Some chips (such as Loongson-2K2000) have added a fractional division register to obtain the required baud rate accurately, so the {get,set}_divisor callback is overridden. - Due to hardware defects, quirk handling is required for UART_MCR/UART_MSR. Co-developed-by: Haowei Zheng Signed-off-by: Haowei Zheng Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/2c2a01a276b9250efea0c7aa190efecdfd6fdf5a.1760166651.git.zhoubinbin@loongson.cn Signed-off-by: Greg Kroah-Hartman commit 7cf86b66e5628c55899e7b00ce5015b3f2750f35 Author: Binbin Zhou Date: Sat Oct 11 15:16:47 2025 +0800 dt-bindings: serial: 8250: Add Loongson uart compatible The Loongson family have a mostly NS16550A-compatible UART and High-Speed UART hardware with the exception of custom frequency divider latch settings register. Co-developed-by: Haowei Zheng Signed-off-by: Haowei Zheng Acked-by: Conor Dooley Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://patch.msgid.link/2d858e9303d95a3e4909aa9c1379d4abbdc52cc2.1760166651.git.zhoubinbin@loongson.cn Signed-off-by: Greg Kroah-Hartman commit ab9a30d6febf768c057fcde74a46597862db443e Author: Gerhard Engleder Date: Thu Oct 23 17:12:29 2025 +0200 serial: 8250: add driver for KEBA UART The KEBA UART is found in the system FPGA of KEBA PLC devices. It is mostly 8250 compatible with extension for some UART modes. 3 different variants exist. The simpliest variant supports only RS-232 and is used for debug interfaces. The next variant supports only RS-485 and is used mostly for communication with KEBA panel devices. The third variant is able to support RS-232, RS-485 and RS-422. For this variant not only the mode of the UART is configured, also the physics and transceivers are switched according to the mode. Signed-off-by: Gerhard Engleder Tested-by: Daniel Gierlinger Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251023151229.11774-3-gerhard@engleder-embedded.com Signed-off-by: Greg Kroah-Hartman commit 6974711cf770557e3b56b97999724618d72a48a0 Author: Gerhard Engleder Date: Thu Oct 23 17:12:28 2025 +0200 serial: Keep rs485 settings for devices without firmware node Commit fe7f0fa43cef ("serial: 8250: Support rs485 devicetree properties") retrieves rs485 properties for 8250 drivers. These properties are read from the firmware node of the device within uart_get_rs485_mode(). If the firmware node does not exist, then the rs485 flags are still reset. Thus, 8250 driver cannot set rs485 flags to enable a defined rs485 mode during driver loading. This is no problem so far, as no 8250 driver sets the rs485 flags. The default rs485 mode can also be set by firmware nodes. But for some devices a firmware node does not exist. E.g., for a PCIe based serial interface on x86 no device tree is available and the ACPI information of the BIOS often cannot by modified. In this case it shall be possible, that a driver works out of the box by setting a reasonable default rs485 mode. If no firmware node exists, then it should be possible for the driver to set a reasonable default rs485 mode. Therefore, reset rs485 flags only if a firmware node exists. Signed-off-by: Gerhard Engleder Cc: Lukas Wunner Reviewed-by: Lukas Wunner Link: https://patch.msgid.link/20251023151229.11774-2-gerhard@engleder-embedded.com Signed-off-by: Greg Kroah-Hartman commit abffd1e6c4f1c9746ffd3fb5c659668efc221714 Author: Praveen Talari Date: Mon Nov 10 15:40:43 2025 +0530 serial: qcom-geni: Enable Serial on SA8255p Qualcomm platforms The Qualcomm automotive SA8255p SoC relies on firmware to configure platform resources, including clocks, interconnects and TLMM. The driver requests resources operations over SCMI using power and performance protocols. The SCMI power protocol enables or disables resources like clocks, interconnect paths, and TLMM (GPIOs) using runtime PM framework APIs, such as resume/suspend, to control power states(on/off). The SCMI performance protocol manages UART baud rates, with each baud rate represented by a performance level. The driver uses the dev_pm_opp_set_level() API to request the desired baud rate by specifying the performance level. Signed-off-by: Praveen Talari Link: https://patch.msgid.link/20251110101043.2108414-5-praveen.talari@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 10904d725f6e382376266a679ff425af488fcbcd Author: Praveen Talari Date: Mon Nov 10 15:40:42 2025 +0530 serial: qcom-geni: Enable PM runtime for serial driver The GENI serial driver currently handles power resource management through calls to the statically defined geni_serial_resources_on() and geni_serial_resources_off() functions. This approach reduces modularity and limits support for platforms with diverse power management mechanisms, including resource managed by firmware. Improve modularity and enable better integration with platform-specific power management, introduce support for runtime PM. Use pm_runtime_resume_and_get() and pm_runtime_put_sync() within the qcom_geni_serial_pm() callback to control resource power state transitions based on UART power state changes. Signed-off-by: Praveen Talari Link: https://patch.msgid.link/20251110101043.2108414-4-praveen.talari@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit ddf055b80a544d6f36f77be5f0c6d3c80177d57c Author: Pierre-Eric Pelloux-Prayer Date: Fri Nov 21 11:12:29 2025 +0100 drm/ttm: rework pipelined eviction fence handling Until now ttm stored a single pipelined eviction fence which means drivers had to use a single entity for these evictions. To lift this requirement, this commit allows up to 8 entities to be used. Ideally a dma_resv object would have been used as a container of the eviction fences, but the locking rules makes it complex. dma_resv all have the same ww_class, which means "Attempting to lock more mutexes after ww_acquire_done." is an error. One alternative considered was to introduced a 2nd ww_class for specific resv to hold a single "transient" lock (= the resv lock would only be held for a short period, without taking any other locks). The other option, is to statically reserve a fence array, and extend the existing code to deal with N fences, instead of 1. The driver is still responsible to reserve the correct number of fence slots. Signed-off-by: Pierre-Eric Pelloux-Prayer Link: https://lore.kernel.org/r/20251121101315.3585-20-pierre-eric.pelloux-prayer@amd.com Reviewed-by: Christian König Signed-off-by: Christian König commit 29e8a0c587e328ed458380a45d6028adf64d7487 Author: Wenhua Lin Date: Wed Oct 22 11:08:40 2025 +0800 serial: sprd: Return -EPROBE_DEFER when uart clock is not ready In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER for either uart or source clock, we should propagate the error instead of just warning and continuing with NULL clocks. Currently the driver only emits a warning when clock acquisition fails and proceeds with NULL clock pointers. This can lead to issues later when the clocks are actually needed. More importantly, when the clock provider is not ready yet and returns -EPROBE_DEFER, we should return this error to allow deferred probing. This change adds explicit checks for -EPROBE_DEFER after both: 1. devm_clk_get(uport->dev, uart) 2. devm_clk_get(uport->dev, source) When -EPROBE_DEFER is encountered, the function now returns -EPROBE_DEFER to let the driver framework retry probing later when the clock dependencies are resolved. Signed-off-by: Wenhua Lin Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com Reviewed-by: Cixi Geng Signed-off-by: Greg Kroah-Hartman commit f0a6e936eb9ca1cfb1c58239ef22e50e761a7a06 Author: Sam Protsenko Date: Mon Nov 17 20:48:22 2025 -0600 tty: serial: samsung: Declare earlycon for Exynos850 It makes it possible to use just "earlycon" param in kernel cmdline on Exynos850 based boards instead of "earlycon=exynos4210,0x13820000", as described in [1]: When used with no options, the early console is determined by stdout-path property in device tree's chosen node [1] Documentation/admin-guide/kernel-parameters.txt Signed-off-by: Sam Protsenko Link: https://patch.msgid.link/20251118024822.28148-1-semen.protsenko@linaro.org Signed-off-by: Greg Kroah-Hartman commit 57c8794693368a5df8014e4bbb7ef4016be119ed Author: Haotian Zhang Date: Mon Nov 17 12:07:10 2025 +0800 serial: icom: Convert PCIBIOS_* return codes to errnos icom_probe() uses pci_read_config_dword() that returns PCIBIOS_* codes. The return code is returned from the probe function as is but probe functions should return normal errnos. A proper implementation can be found in drivers/leds/leds-ss4200.c Convert PCIBIOS_* return codes using pcibios_err_to_errno() into normal errno before returning them. Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251117040710.1544-1-vulab@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit d3210c8e88ee4132a5bb316ee96b09472db90572 Author: jempty.liang Date: Mon Nov 17 03:41:17 2025 +0000 serial: 8250-of: Fix style issues in 8250_of.c This patch resolves the warning "sizeof *port should be sizeof(*port)" detected by checkpatch.pl. Signed-off-by: jempty.liang Link: https://patch.msgid.link/20251117034117.55588-1-imntjempty@163.com Signed-off-by: Greg Kroah-Hartman commit 0e5a99e0e5f50353b86939ff6e424800d769c818 Author: Magne Bruno Date: Mon Nov 10 17:24:56 2025 +0100 serial: add support of CPCI cards Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver. Signed-off-by: Magne Bruno Link: https://patch.msgid.link/20251110162456.341029-1-magne.bruno@addi-data.com Cc: stable Signed-off-by: Greg Kroah-Hartman commit ae333a91006c7f13a921688546a09afa9bf05236 Author: Andy Shevchenko Date: Thu Nov 6 12:38:15 2025 +0100 serial: mux: Fix kernel doc for mux_poll() The validator is not happy: Warning: drivers/tty/serial/mux.c:351 expecting prototype for mux_drv_poll(). Prototype was for mux_poll() instead Update the kernel-doc accordingly. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251106113815.2302539-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1879c2e44651d0854d3615590a638a88c5e292ad Author: Marco Crivellari Date: Tue Nov 4 11:54:46 2025 +0100 tty: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_dfl_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251104105446.110884-1-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit 2b7a0f47aaf2439d517ba0a6b29c66a535302154 Author: Duoming Zhou Date: Tue Nov 25 18:36:27 2025 +0800 usb: typec: ucsi: fix use-after-free caused by uec->work The delayed work uec->work is scheduled in gaokun_ucsi_probe() but never properly canceled in gaokun_ucsi_remove(). This creates use-after-free scenarios where the ucsi and gaokun_ucsi structure are freed after ucsi_destroy() completes execution, while the gaokun_ucsi_register_worker() might be either currently executing or still pending in the work queue. The already-freed gaokun_ucsi or ucsi structure may then be accessed. Furthermore, the race window is 3 seconds, which is sufficiently long to make this bug easily reproducible. The following is the trace captured by KASAN: ================================================================== BUG: KASAN: slab-use-after-free in __run_timers+0x5ec/0x630 Write of size 8 at addr ffff00000ec28cc8 by task swapper/0/0 ... Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x78/0x90 print_report+0x114/0x580 kasan_report+0xa4/0xf0 __asan_report_store8_noabort+0x20/0x2c __run_timers+0x5ec/0x630 run_timer_softirq+0xe8/0x1cc handle_softirqs+0x294/0x720 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x30/0x48 do_softirq_own_stack+0x1c/0x28 __irq_exit_rcu+0x27c/0x364 irq_exit_rcu+0x10/0x1c el1_interrupt+0x40/0x60 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x6c/0x70 arch_local_irq_enable+0x4/0x8 (P) do_idle+0x334/0x458 cpu_startup_entry+0x60/0x70 rest_init+0x158/0x174 start_kernel+0x2f8/0x394 __primary_switched+0x8c/0x94 Allocated by task 72 on cpu 0 at 27.510341s: kasan_save_stack+0x2c/0x54 kasan_save_track+0x24/0x5c kasan_save_alloc_info+0x40/0x54 __kasan_kmalloc+0xa0/0xb8 __kmalloc_node_track_caller_noprof+0x1c0/0x588 devm_kmalloc+0x7c/0x1c8 gaokun_ucsi_probe+0xa0/0x840 auxiliary_bus_probe+0x94/0xf8 really_probe+0x17c/0x5b8 __driver_probe_device+0x158/0x2c4 driver_probe_device+0x10c/0x264 __device_attach_driver+0x168/0x2d0 bus_for_each_drv+0x100/0x188 __device_attach+0x174/0x368 device_initial_probe+0x14/0x20 bus_probe_device+0x120/0x150 device_add+0xb3c/0x10fc __auxiliary_device_add+0x88/0x130 ... Freed by task 73 on cpu 1 at 28.910627s: kasan_save_stack+0x2c/0x54 kasan_save_track+0x24/0x5c __kasan_save_free_info+0x4c/0x74 __kasan_slab_free+0x60/0x8c kfree+0xd4/0x410 devres_release_all+0x140/0x1f0 device_unbind_cleanup+0x20/0x190 device_release_driver_internal+0x344/0x460 device_release_driver+0x18/0x24 bus_remove_device+0x198/0x274 device_del+0x310/0xa84 ... The buggy address belongs to the object at ffff00000ec28c00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 200 bytes inside of freed 512-byte region The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ec28 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff) page_type: f5(slab) raw: 03fffe0000000040 ffff000008801c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 03fffe0000000040 ffff000008801c80 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 head: 03fffe0000000002 fffffdffc03b0a01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff00000ec28b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff00000ec28c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff00000ec28c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff00000ec28d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff00000ec28d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Add disable_delayed_work_sync() in gaokun_ucsi_remove() to ensure that uec->work is properly canceled and prevented from executing after the ucsi and gaokun_ucsi structure have been deallocated. Fixes: 00327d7f2c8c ("usb: typec: ucsi: add Huawei Matebook E Go ucsi driver") Cc: stable Signed-off-by: Duoming Zhou Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/cc31e12ef9ffbf86676585b02233165fd33f0d8e.1764065838.git.duoming@zju.edu.cn Signed-off-by: Greg Kroah-Hartman commit 6b120ef99fbcba9e413783561f8cc160719db589 Author: Duoming Zhou Date: Tue Nov 25 18:36:26 2025 +0800 usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() The gaokun_ucsi_probe() uses ucsi_create() to allocate a UCSI instance. The ucsi_create() validates whether ops->poll_cci is defined, and if not, it directly returns -EINVAL. However, the gaokun_ucsi_ops structure does not define the poll_cci, causing ucsi_create() always fail with -EINVAL. This issue can be observed in the kernel log with the following error: ucsi_huawei_gaokun.ucsi huawei_gaokun_ec.ucsi.0: probe with driver ucsi_huawei_gaokun.ucsi failed with error -22 Fix the issue by adding the missing poll_cci callback to gaokun_ucsi_ops. Fixes: 00327d7f2c8c ("usb: typec: ucsi: add Huawei Matebook E Go ucsi driver") Cc: stable Signed-off-by: Duoming Zhou Reviewed-by: Heikki Krogerus Reviewed-by: Pengyu Luo Link: https://patch.msgid.link/4d077d6439d728be68646bb8c8678436a3a0885e.1764065838.git.duoming@zju.edu.cn Signed-off-by: Greg Kroah-Hartman commit 6d935ce213bd9d3760947e0743f30bfa63c8404f Author: Krishna Kurapati Date: Sun Nov 16 18:00:33 2025 +0530 usb: dwc3: core: Remove redundant comment in core init Remove redundant comment which was put in to address LLUCTL register modifications for all applicable ports of multiport controller. Although the support was added, the todo comment wasn't removed then. Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251116123033.131004-1-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit c69ff68b097b0f53333114f1b2c3dc128f389596 Author: Diogo Ivo Date: Fri Nov 21 18:16:36 2025 +0000 usb: phy: Initialize struct usb_phy list_head As part of the registration of a new 'struct usb_phy' with the USB PHY core via either usb_add_phy(struct usb_phy *x, ...) or usb_add_phy_dev(struct usb_phy *x) these functions call list_add_tail(&x->head, phy_list) in order for the new instance x to be stored in phy_list, a static list kept internally by the core. After 7d21114dc6a2 ("usb: phy: Introduce one extcon device into usb phy") when executing either of the registration functions above it is possible that usb_add_extcon() fails, leading to either function returning before the call to list_add_tail(), leaving x->head uninitialized. Then, when a driver tries to undo the failed registration by calling usb_remove_phy(struct usb_phy *x) there will be an unconditional call to list_del(&x->head) acting on an uninitialized variable, and thus a possible NULL pointer dereference. Fix this by initializing x->head before usb_add_extcon() has a chance to fail. Note that this was not needed before 7d21114dc6a2 since list_add_phy() was executed unconditionally and it guaranteed that x->head was initialized. Fixes: 7d21114dc6a2 ("usb: phy: Introduce one extcon device into usb phy") Cc: stable Signed-off-by: Diogo Ivo Link: https://patch.msgid.link/20251121-diogo-smaug_typec-v2-1-5c37c1169d57@tecnico.ulisboa.pt Signed-off-by: Greg Kroah-Hartman commit 6f53bcb4fe66967fd4a82547062e2ae98058eea6 Author: Ashley Smith Date: Thu Nov 13 11:57:34 2025 +0100 drm/panthor: Reset queue slots if termination fails Make sure the queue slot is reset even if we failed termination so we don't have garbage in the CS input interface after a reset. In practice that's not a problem because we zero out all RW sections when a hangs occurs, but it's safer to reset things manually, in case we decide to not conditionally reload RW sections based on the type of hang. v4: - Split the changes in two separate patches v5: - No changes v6: - Adjust the explanation in the commit message - Drop the Fixes tag - Put after the timeout changes and make the two patches independent so one can be backported, and the other not v7: - Use the local group variable instead of dereferencing csg_slot->group - Add Steve's R-b v8: - No changes Signed-off-by: Ashley Smith Reviewed-by: Steven Price Link: https://patch.msgid.link/20251113105734.1520338-3-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon commit 345c5b7cc0f85cc20e166f97ac2ff219add55707 Author: Ashley Smith Date: Thu Nov 13 11:57:33 2025 +0100 drm/panthor: Make the timeout per-queue instead of per-job The timeout logic provided by drm_sched leads to races when we try to suspend it while the drm_sched workqueue queues more jobs. Let's overhaul the timeout handling in panthor to have our own delayed work that's resumed/suspended when a group is resumed/suspended. When an actual timeout occurs, we call drm_sched_fault() to report it through drm_sched, still. But otherwise, the drm_sched timeout is disabled (set to MAX_SCHEDULE_TIMEOUT), which leaves us in control of how we protect modifications on the timer. One issue seems to be when we call drm_sched_suspend_timeout() from both queue_run_job() and tick_work() which could lead to races due to drm_sched_suspend_timeout() not having a lock. Another issue seems to be in queue_run_job() if the group is not scheduled, we suspend the timeout again which undoes what drm_sched_job_begin() did when calling drm_sched_start_timeout(). So the timeout does not reset when a job is finished. v2: - Fix syntax error v3: - Split the changes in two commits v4: - No changes v5: - No changes v6: - Fix a NULL deref in group_can_run(), and narrow the group variable scope to avoid such mistakes in the future - Add an queue_timeout_is_suspended() helper to clarify things v7: - No changes v8: - Don't touch drm_gpu_scheduler::timeout in queue_timedout_job() Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Reviewed-by: Adrián Larumbe Signed-off-by: Ashley Smith Co-developed-by: Boris Brezillon Signed-off-by: Boris Brezillon Link: https://patch.msgid.link/20251113105734.1520338-2-boris.brezillon@collabora.com commit 8da059f2a497a2427150faae5adc3bb78e73b3e2 Author: Dan Carpenter Date: Mon Nov 24 09:04:56 2025 +0300 fuse: Uninitialized variable in fuse_epoch_work() The fuse_ilookup() function only sets *fm on the success path so this "if (fm) {" NULL check doesn't work. The "fm" pointer is either uninitialized or valid. Check the "inode" pointer instead. Also, while it's not necessary, it is cleaner to move the iput(inode) under the NULL check as well. Fixes: 64becd224ff9 ("fuse: new work queue to invalidate dentries from old epochs") Signed-off-by: Dan Carpenter Reviewed-by: Luis Henriques Signed-off-by: Miklos Szeredi commit c77a6544d8a2364e4bee1b52890f577be27b7296 Merge: 955a48a5353f4f 479d186fc946b1 Author: Greg Kroah-Hartman Date: Wed Nov 26 12:43:14 2025 +0100 Merge tag 'thunderbolt-for-v6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-nextx Mika writes: thunderbolt: Changes for v6.19 merge window This includes following USB4/Thunderbolt changes for the v6.19 merge window: - Documentation fixes - Fixes for various typos found in the driver - Replace use of system_wq with system_percpu_wq. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix typos in xdomain.c thunderbolt: Fix typos in usb4.c thunderbolt: Fix typos in tunnel.c thunderbolt: Fix typos in tmu.c thunderbolt: Fix typos in tb_regs.h thunderbolt: Fix typos in tb.h thunderbolt: Fix typos in tb.c thunderbolt: Fix typos in switch.c thunderbolt: Fix typos in retimer.c thunderbolt: Fix typos in nhi.c thunderbolt: Fix typos in lc.c thunderbolt: Fix typos in icm.c thunderbolt: Fix typos in domain.c thunderbolt: Fix typos in debugfs.c thunderbolt: Fix typos in ctl.c thunderbolt: Replace use of system_wq with system_percpu_wq thunderbolt: Update deprecated firmware update site in icm.c thunderbolt: Update NVM firmware upgrade documentation thunderbolt: Fix typo in tb_eeprom_ctl_read documentation commit 95c39eef7c2b666026c69ab5b30471da94ea2874 Author: Joanne Koong Date: Tue Nov 25 10:13:47 2025 -0800 fuse: fix io-uring list corruption for terminated non-committed requests When a request is terminated before it has been committed, the request is not removed from the queue's list. This leaves a dangling list entry that leads to list corruption and use-after-free issues. Remove the request from the queue's list for terminated non-committed requests. Signed-off-by: Joanne Koong Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support") Cc: stable@vger.kernel.org Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 39781cc3d54bd493c53c0f0244a116f2faa39037 Author: Artur Stupa Date: Fri Nov 21 14:41:35 2025 -0800 staging: rtl8723bs: core: delete commented-out code Delete dead commented-out code. No functional changes. Signed-off-by: Artur Stupa Link: https://patch.msgid.link/20251121224143.33701-2-arthur.stupa@gmail.com Signed-off-by: Greg Kroah-Hartman commit 18ac97e9de0f3198045a8230b9e9ce594eb368b8 Author: Artur Stupa Date: Fri Nov 21 14:41:34 2025 -0800 staging: rtl8723bs: core: fix block comment style issues Fix the following checkpatch warnings for block comments: * Block comments should align the * on each line * Block comments use * on subsequent lines * Block comments use a trailing */ on a separate line No functional changes. Signed-off-by: Artur Stupa Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20251121224143.33701-1-arthur.stupa@gmail.com Signed-off-by: Greg Kroah-Hartman commit 760b8eec2cf861c5b013f62c4af8ee06c959853e Author: Gongwei Li Date: Fri Nov 21 14:10:22 2025 +0800 soc: fsl: qbman: use kmalloc_array() instead of kmalloc() Replace kmalloc() with kmalloc_array() to prevent potential overflow, as recommended in Documentation/process/deprecated.rst. Signed-off-by: Gongwei Li Reviewed-by: Fushuai Wang Link: https://lore.kernel.org/r/20251121061022.114609-1-13875017792@163.com Signed-off-by: Christophe Leroy (CS GROUP) commit c181703a290a13c088ca2ac7b984ec8e676acb2b Author: Marco Crivellari Date: Fri Nov 7 16:29:50 2025 +0100 soc: fsl: qbman: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20251107152950.293899-1-marco.crivellari@suse.com Signed-off-by: Christophe Leroy (CS GROUP) commit 3fca89b7756c5bb885e3a41df1443aa39f35951b Author: Christophe Leroy (CS GROUP) Date: Wed Nov 26 12:26:57 2025 +0100 MAINTAINERS: Update email address for Christophe Leroy My address at csgroup.eu is redirected to the new one at cs-soprasteria.com which is a Professionnal Microsoft account without SMTP gateway. We still have the SMTP gateway for csgroup.eu but it is not maintained anymore and might stop working at anytime. In addition the DKIM signature is not performed allthough the domain has DMARC set up. Switch to kernel.org email address and add entries in mailmap. Link: https://lore.kernel.org/r/d9b6758297d7dcddf79feb4459ceaedd7d6f1f2e.1764155757.git.chleroy@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) commit 1c93edfd506ccaf9e9982dfdafc91cd2d444ad63 Author: Heiko Carstens Date: Wed Nov 26 11:19:10 2025 +0100 s390/entry: Use lay instead of aghik Use the lay instruction instead of aghik. aghik is only available since z196, therefore compiling the kernel for z10 results in this error: arch/s390/kernel/entry.S: Assembler messages: arch/s390/kernel/entry.S:165: Error: Unrecognized opcode: `aghik' Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511261518.nBbQN5h7-lkp@intel.com/ Fixes: f5730d44e05e ("s390: Add stackprotector support") Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 922682d48d628c6c5540da2eb5481f7f7694ce48 Author: Steven Price Date: Mon Nov 24 11:20:38 2025 +0000 drm/gem: Correct error condition in drm_gem_objects_lookup When vmemdup_array_user() fails, 'handles' is set to a negative error code and no memory is allocated. So the call to kvfree() should not happen. Instead just return early with the error code. Fixes: cb77b79abf5f ("drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup") Signed-off-by: Steven Price Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20251124112039.117748-1-steven.price@arm.com commit 79cf71c0b177c0e23d411e2469435e2c2f83f563 Author: Shawn Lin Date: Wed Nov 26 07:26:40 2025 +0800 mmc: sdhci-of-dwcmshc: reduce CIT for better performance CQHCI_SSC1.CIT indicates to the CQE the polling period to use for periodic SEND_QUEUE_STATUS (CMD13) polling. Some eMMCs have only one hardware queue, and CMD13 can only query one slot at a time for data transmission, which cannot be processed in parallel. Modifying the CMD13 query interval can increase the query frequency and improve random write performance. Signed-off-by: Shawn Lin Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit c7ce6453b769c45006ed4983762f81e130878171 Author: Shawn Lin Date: Wed Nov 26 07:26:39 2025 +0800 mmc: sdhci-of-dwcmshc: Disable internal clock auto gate for Rockchip SOCs Enabling CMDQ support can lead to random occurrences of the error log when there are RPMB access and data flush executed: "mmc2: Timeout waiting for hardware interrupt." Enabling CMDQ and then issuing a DCMD as the final command before disabling it causes the eMMC controller to auto-gate its internal clock. Chip simulation shows this results in a state machine mismatch after CMDQ mode exit, triggering data-timeout errors for all subsequent read and write operations. Therefore, the auto-clock-gate function must be disabled whenever CMDQ is enabled. Signed-off-by: Shawn Lin Acked-by: Adrian Hunter Fixes: fda1e0af7c28 ("mmc: sdhci-of-dwcmshc: Add command queue support for rockchip SOCs") Signed-off-by: Ulf Hansson commit 9aea35eb98a6560daf85a2ae9cbd482a66e4d076 Author: Conor Dooley Date: Fri Nov 21 13:42:30 2025 +0000 dt-bindings: can: mpfs: document resets The CAN cores on Polarfire SoC both have a reset. The platform firmware brings both cores out of reset, but the linux driver must use them during normal operation. The resets should have been made required, but this is one of the things that can happen when the binding is written without driver support. Fixes: c878d518d7b6 ("dt-bindings: can: mpfs: document the mpfs CAN controller") Signed-off-by: Conor Dooley Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251121-sample-footsore-743d81772efc@spud Signed-off-by: Marc Kleine-Budde commit d1780dce9575072303b9c574614b72b5c8c5c44c Author: Hao-Wen Ting Date: Wed Nov 26 14:01:10 2025 +0800 clocksource/drivers: Add Realtek system timer driver Add a system timer driver for Realtek SoCs. This driver registers the 1 MHz global hardware counter on Realtek platforms as a clock event device. Since this hardware counter starts counting automatically after SoC power-on, no clock initialization is required. Because the counter does not stop or get affected by CPU power down, and it supports oneshot mode, it is typically used as a tick broadcast timer. Signed-off-by: Hao-Wen Ting Signed-off-by: Daniel Lezcano Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20251126060110.198330-3-haowen.ting@realtek.com commit 40caba2bd027ab57c196b690e4e7f3c1746acb96 Author: Hao-Wen Ting Date: Wed Nov 26 14:01:09 2025 +0800 dt-bindings: timer: Add Realtek SYSTIMER The Realtek SYSTIMER (System Timer) is a 64-bit global hardware counter operating at a fixed 1MHz frequency. Thanks to its compare match interrupt capability, the timer natively supports oneshot mode for tick broadcast functionality. Signed-off-by: Hao-Wen Ting Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251126060110.198330-2-haowen.ting@realtek.com commit ed92a968a967042a7c7eb4c938e640b4deb79fe2 Author: Johan Hovold Date: Tue Nov 11 16:45:16 2025 +0100 clocksource/drivers/stm32-lp: Drop unused module alias The driver cannot be built as a module so drop the unused platform module alias. Note that platform aliases are not needed for OF probing should it ever become possible to build the driver as a module. Signed-off-by: Johan Hovold Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251111154516.1698-1-johan@kernel.org commit 627f3f3716a3591f5e6a6bd124c95eef85444080 Author: Enlin Mu Date: Fri Nov 7 14:33:47 2025 +0800 clocksource/drivers/rda: Add sched_clock_register for RDA8810PL SoC The current system log timestamp accuracy is tick based, which can not meet the usage requirements and needs to reach nanoseconds. Therefore, the sched_clock_register function needs to be added. [ dlezcano: Fixed typos ] Signed-off-by: Enlin Mu Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251107063347.3692-1-enlin.mu@linux.dev commit 6a2416892e8942f5e2bfe9b85c0164f410a53a2d Author: Johan Hovold Date: Tue Nov 11 16:32:26 2025 +0100 clocksource/drivers/nxp-stm: Prevent driver unbind Clockevents cannot be deregistered so suppress the bind attributes to prevent the driver from being unbound and releasing the underlying resources after registration. Even if the driver can currently only be built-in, also switch to builtin_platform_driver() to prevent it from being unloaded should modular builds ever be enabled. Fixes: cec32ac75827 ("clocksource/drivers/nxp-timer: Add the System Timer Module for the s32gx platforms") Signed-off-by: Johan Hovold Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251111153226.579-4-johan@kernel.org commit 4715d930f37f1c63ca4f5782fdd57fa7792aa989 Merge: 4718d39e72c008 d20103d8f880b0 Author: Marc Kleine-Budde Date: Wed Nov 26 11:24:59 2025 +0100 Merge patch series "MAINTAINERS: Add myself as m_can maintainer" Markus Schneider-Pargmann says: these two patches are updating the m_can maintainer entry, replacing the current maintainer and simplifying the files mentioned. Link: https://patch.msgid.link/20251119-topic-mcan-reviewer-v6-18-v2-0-f842c3094b18@baylibre.com Signed-off-by: Marc Kleine-Budde commit d20103d8f880b0d716ae83dba6d1d150f5790a9c Author: Markus Schneider-Pargmann Date: Wed Nov 19 14:50:03 2025 +0100 MAINTAINERS: Simplify m_can section Simplify the section by using the whole m_can directory. This includes a few new files, e.g. Kconfig, Makefile, m_can_pci.c and tcan4x5x* which are all closely coupled to the m_can driver core. Signed-off-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20251119-topic-mcan-reviewer-v6-18-v2-2-f842c3094b18@baylibre.com Signed-off-by: Marc Kleine-Budde commit 07688a882f8ee6228e63774f23dccab6977f1bdf Author: Markus Schneider-Pargmann Date: Wed Nov 19 14:50:02 2025 +0100 MAINTAINERS: Add myself as m_can maintainer As I have contributed to the m_can driver over the past years, I would like to continue maintaining the driver. As Chandrasekar is currently not responsive, I will replace him as the maintainer of the driver. Signed-off-by: Markus Schneider-Pargmann Link: https://patch.msgid.link/20251119-topic-mcan-reviewer-v6-18-v2-1-f842c3094b18@baylibre.com Signed-off-by: Marc Kleine-Budde commit e25f964cf414dafa6bee5c9c2c0b1d1fb041dc92 Author: Johan Hovold Date: Tue Nov 11 16:32:25 2025 +0100 clocksource/drivers/nxp-pit: Prevent driver unbind The driver does not support unbinding (e.g. as clockevents cannot be deregistered) so suppress the bind attributes to prevent the driver from being unbound and rebound after registration (and disabling the timer when reprobing fails). Even if the driver can currently only be built-in, also switch to builtin_platform_driver() to prevent it from being unloaded should modular builds ever be enabled. Fixes: bee33f22d7c3 ("clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support") Signed-off-by: Johan Hovold Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251111153226.579-3-johan@kernel.org commit 6aa10f0e2ef9eba1955be6a9d0a8eaecf6bdb7ae Author: Johan Hovold Date: Tue Nov 11 16:32:24 2025 +0100 clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind Clockevents cannot be deregistered so suppress the bind attributes to prevent the driver from being unbound and releasing the underlying resources after registration. Fixes: 4891f01527bb ("clocksource/drivers/arm_arch_timer: Add standalone MMIO driver") Signed-off-by: Johan Hovold Signed-off-by: Daniel Lezcano Acked-by: Marc Zyngier Link: https://patch.msgid.link/20251111153226.579-2-johan@kernel.org commit b452d2c97eeccbf9c7ac5b3d2d9e80bf6d8a23db Author: Johan Hovold Date: Fri Oct 17 07:49:43 2025 +0200 clocksource/drivers/nxp-stm: Fix section mismatches Platform drivers can be probed after their init sections have been discarded (e.g. on probe deferral or manual rebind through sysfs) so the probe function must not live in init. Device managed resource actions similarly cannot be discarded. The "_probe" suffix of the driver structure name prevents modpost from warning about this so replace it to catch any similar future issues. Fixes: cec32ac75827 ("clocksource/drivers/nxp-timer: Add the System Timer Module for the s32gx platforms") Signed-off-by: Johan Hovold Signed-off-by: Daniel Lezcano Cc: stable@vger.kernel.org # 6.16 Cc: Daniel Lezcano Link: https://patch.msgid.link/20251017054943.7195-1-johan@kernel.org commit 62524f285c11d6e6168ad31b586143755b27b2e5 Author: Niklas Söderlund Date: Thu Oct 16 20:20:22 2025 +0200 clocksource/drivers/sh_cmt: Always leave device running after probe The CMT device can be used as both a clocksource and a clockevent provider. The driver tries to be smart and power itself on and off, as well as enabling and disabling its clock when it's not in operation. This behavior is slightly altered if the CMT is used as an early platform device in which case the device is left powered on after probe, but the clock is still enabled and disabled at runtime. This has worked for a long time, but recent improvements in PREEMPT_RT and PROVE_LOCKING have highlighted an issue. As the CMT registers itself as a clockevent provider, clockevents_register_device(), it needs to use raw spinlocks internally as this is the context of which the clockevent framework interacts with the CMT driver. However in the context of holding a raw spinlock the CMT driver can't really manage its power state or clock with calls to pm_runtime_*() and clk_*() as these calls end up in other platform drivers using regular spinlocks to control power and clocks. This mix of spinlock contexts trips a lockdep warning. ============================= [ BUG: Invalid wait context ] 6.17.0-rc3-arm64-renesas-03071-gb3c4f4122b28-dirty #21 Not tainted ----------------------------- swapper/1/0 is trying to lock: ffff00000898d180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 other info that might help us debug this: ccree e6601000.crypto: ARM ccree device initialized context-{5:5} 2 locks held by swapper/1/0: #0: ffff80008173c298 (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 #1: ffff0000089a5858 (&ch->lock){....}-{2:2} usbcore: registered new interface driver usbhid , at: sh_cmt_start+0x30/0x364 stack backtrace: CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.17.0-rc3-arm64-renesas-03071-gb3c4f4122b28-dirty #21 PREEMPT Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) Call trace: show_stack+0x14/0x1c (C) dump_stack_lvl+0x6c/0x90 dump_stack+0x14/0x1c __lock_acquire+0x904/0x1584 lock_acquire+0x220/0x34c _raw_spin_lock_irqsave+0x58/0x80 __pm_runtime_resume+0x38/0x88 sh_cmt_start+0x54/0x364 sh_cmt_clock_event_set_oneshot+0x64/0xb8 clockevents_switch_state+0xfc/0x13c tick_broadcast_set_event+0x30/0xa4 __tick_broadcast_oneshot_control+0x1e0/0x3a8 tick_broadcast_oneshot_control+0x30/0x40 cpuidle_enter_state+0x40c/0x680 cpuidle_enter+0x30/0x40 do_idle+0x1f4/0x26c cpu_startup_entry+0x34/0x40 secondary_start_kernel+0x11c/0x13c __secondary_switched+0x74/0x78 For non-PREEMPT_RT builds this is not really an issue, but for PREEMPT_RT builds where normal spinlocks can sleep this might be an issue. Be cautious and always leave the power and clock running after probe. Signed-off-by: Niklas Söderlund Signed-off-by: Daniel Lezcano Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251016182022.1837417-1-niklas.soderlund+renesas@ragnatech.se commit 6b38a8b31e2c5c2c3fd5f9848850788c190f216d Author: Johan Hovold Date: Fri Oct 17 07:50:39 2025 +0200 clocksource/drivers/stm: Fix double deregistration on probe failure The purpose of the devm_add_action_or_reset() helper is to call the action function in case adding an action ever fails so drop the clock source deregistration from the error path to avoid deregistering twice. Fixes: cec32ac75827 ("clocksource/drivers/nxp-timer: Add the System Timer Module for the s32gx platforms") Signed-off-by: Johan Hovold Signed-off-by: Daniel Lezcano Cc: Daniel Lezcano Link: https://patch.msgid.link/20251017055039.7307-1-johan@kernel.org commit 2ba8e2aae1324704565a7d4d66f199d056c9e3c6 Author: Haotian Zhang Date: Thu Oct 30 17:07:10 2025 +0800 clocksource/drivers/ralink: Fix resource leaks in init error path The ralink_systick_init() function does not release all acquired resources on its error paths. If irq_of_parse_and_map() or a subsequent call fails, the previously created I/O memory mapping and IRQ mapping are leaked. Add goto-based error handling labels to ensure that all allocated resources are correctly freed. Fixes: 1f2acc5a8a0a ("MIPS: ralink: Add support for systick timer found on newer ralink SoC") Signed-off-by: Haotian Zhang Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251030090710.1603-1-vulab@iscas.ac.cn commit 640594a04f119338019b0aeed70c7301216595b3 Author: Stephen Eta Zhou Date: Sun May 25 16:43:28 2025 +0800 clocksource/drivers/timer-sp804: Fix read_current_timer() issue when clock source is not registered Register a valid read_current_timer() function for the SP804 timer on ARM32. On ARM32 platforms, when the SP804 timer is selected as the clocksource, the driver does not register a valid read_current_timer() function. As a result, features that rely on this API—such as rdseed—consistently return incorrect values. To fix this, a delay_timer structure is registered during the SP804 driver's initialization. The read_current_timer() function is implemented using the existing sp804_read() logic, and the timer frequency is reused from the already-initialized clocksource. Signed-off-by: Stephen Eta Zhou Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20250525-sp804-fix-read_current_timer-v4-1-87a9201fa4ec@gmail.com commit 576c564ec3bb60e571c705a71907d7c0c039e6c0 Author: Enlin Mu Date: Thu Nov 6 10:18:30 2025 +0800 clocksource/drivers/sprd: Enable register for timer counter from 32 bit to 64 bit Using 32 bit for suspend compensation, the max compensation time is 36 hours(working clock is 32k).In some IOT devices, the suspend time may be long, even exceeding 36 hours. Therefore, a 64 bit timer counter is needed for counting. Signed-off-by: Enlin Mu Signed-off-by: Daniel Lezcano Reviewed-by: Baolin Wang Link: https://patch.msgid.link/20251106021830.34846-1-enlin.mu@linux.dev commit 4718d39e72c008b1c96a8673719ad8f894ca4488 Merge: 113aa9101a9107 3a34330f633964 Author: Marc Kleine-Budde Date: Wed Nov 26 11:21:57 2025 +0100 Merge patch series "Add R-Car CAN-FD suspend/resume support" Biju says: From: Biju Das This patch series adds proper suspend/resume support to the Renesas R-Car CAN-FD controller driver, after the customary cleanups and fixes. It aims to fix CAN-FD operation after resume from s2ram on systems where PSCI powers down the SoC. This patch series has been tested on RZ/G3E SMARC EVK and RZ/G2L SMARC EVK. This patch series depend upon [1] [1] https://lore.kernel.org/all/20251123112326.128448-1-biju.das.jz@bp.renesas.com/ v2->v3: * Updated commit header and description for patch#3 * Collected tags. v1->v2: * Added logs from RZ/G3E * Collected tags. * Moved enabling of RAM clk from probe(). * Added RAM clk handling in rcar_canfd_global_{,de}init(). * Fixed the typo in error path of rcar_canfd_resume(). Logs from RZ/G3E: root@smarc-rzg3e:~# /canfd_t_003_all.sh [INFO] Testing can0<->can1 with bitrate 1000000 and dbitrate 4000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [ 541.705921] can: controller area network core [ 541.710369] NET: Registered PF_CAN protocol family [ 541.753974] can: raw protocol [INFO] Testing can0 as producer and can1 as consumer [INFO] Testing can0<->can1 with bitrate 500000 and dbitrate 2000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer [INFO] Testing can0<->can1 with bitrate 250000 and dbitrate 1000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer EXIT|PASS|canfd_t_003.sh|[00:00:25] || bind/unbind ---------- [ 566.821475] rcar_canfd 12440000.can: can_clk rate is 80000000 [ 566.828076] rcar_canfd 12440000.can: device registered (channel 1) [ 566.834361] rcar_canfd 12440000.can: can_clk rate is 80000000 [ 566.841842] rcar_canfd 12440000.can: device registered (channel 4) [ 566.848093] rcar_canfd 12440000.can: global operational state (canfd clk, fd mode) [INFO] Testing can0<->can1 with bitrate 1000000 and dbitrate 4000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer [INFO] Testing can0<->can1 with bitrate 500000 and dbitrate 2000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer [INFO] Testing can0<->can1 with bitrate 250000 and dbitrate 1000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer EXIT|PASS|canfd_t_003.sh|[00:00:25] || s2idle ----- [ 592.182479] PM: suspend entry (s2idle) [ 592.187031] Filesystems sync: 0.000 seconds [ 592.193221] Freezing user space processes [ 592.199425] Freezing user space processes completed (elapsed 0.002 seconds) [ 592.206450] OOM killer disabled. [ 592.209843] Freezing remaining freezable tasks [ 592.215775] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 592.223247] printk: Suspending console(s) (use no_console_suspend to debug) [ 592.260524] sd 0:0:0:0: [sda] Synchronizing SCSI cache [ 592.322759] renesas-gbeth 15c30000.ethernet end0: Link is Down [ 596.070955] dwmac4: Master AXI performs any burst length [ 596.072307] renesas-gbeth 15c30000.ethernet end0: No Safety Features support found [ 596.072376] renesas-gbeth 15c30000.ethernet end0: IEEE 1588-2008 Advanced Timestamp supported [ 596.077470] renesas-gbeth 15c30000.ethernet end0: configuring for phy/rgmii-id link mode [ 596.087503] dwmac4: Master AXI performs any burst length [ 596.088817] renesas-gbeth 15c40000.ethernet end1: No Safety Features support found [ 596.088881] renesas-gbeth 15c40000.ethernet end1: IEEE 1588-2008 Advanced Timestamp supported [ 596.093997] renesas-gbeth 15c40000.ethernet end1: configuring for phy/rgmii-id link mode [ 596.141986] usb usb1: root hub lost power or was reset [ 596.142031] usb usb2: root hub lost power or was reset [ 598.304525] usb 2-1: reset SuperSpeed Plus Gen 2x1 USB device number 2 using xhci-renesas-hcd [ 598.414846] OOM killer enabled. [ 598.418002] Restarting tasks: Starting [ 598.422518] Restarting tasks: Done [ 598.425999] random: crng reseeded on system resumption [ 598.431248] PM: suspend exit [ 598.661875] renesas-gbeth 15c30000.ethernet end0: Link is Up - 1Gbps/Full - flow control rx/tx [INFO] Testing can0<->can1 with bitrate 1000000 and dbitrate 4000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer [INFO] Testing can0<->can1 with bitrate 500000 and dbitrate 2000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer [INFO] Testing can0<->can1 with bitrate 250000 and dbitrate 1000000 [INFO] Bringing down can0 can1 [INFO] Bringing up can0 can1 [INFO] Testing can1 as producer and can0 as consumer [INFO] Testing can0 as producer and can1 as consumer EXIT|PASS|canfd_t_003.sh|[00:00:25] || Link: https://patch.msgid.link/20251124102837.106973-1-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 3a34330f6339641b7f5b76b066385f56c114490f Author: Geert Uytterhoeven Date: Mon Nov 24 10:28:32 2025 +0000 can: rcar_canfd: Add suspend/resume support On R-Car Gen3 using PSCI, s2ram powers down the SoC. After resume, the CAN-FD interface no longer works. Trying to bring it up again fails: # ip link set can0 up RTNETLINK answers: Connection timed out # dmesg ... channel 0 communication state failed Fix this by populating the (currently empty) suspend and resume callbacks, to stop/start the individual CAN-FD channels, and (de)initialize the CAN-FD controller. Signed-off-by: Geert Uytterhoeven Tested-by: Biju Das Signed-off-by: Biju Das Link: https://patch.msgid.link/20251124102837.106973-8-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 161266c754e71d979be994967984c9fdcab74090 Author: Geert Uytterhoeven Date: Mon Nov 24 10:28:31 2025 +0000 can: rcar_canfd: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas R-Car CAN-FD driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://patch.msgid.link/20251124102837.106973-7-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit ddf9bbf22b70d6b1a10e7d45de8ec3b94de7c54c Author: Geert Uytterhoeven Date: Mon Nov 24 10:28:30 2025 +0000 can: rcar_canfd: Invert CAN clock and close_candev() order The CAN clock is enabled before calling open_candev(), and disabled before calling close_candev(). Invert the order of the latter, to restore symmetry. Signed-off-by: Geert Uytterhoeven Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://patch.msgid.link/20251124102837.106973-6-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit fa5f4ec8fff8bc587a2cbf7101303306e045c11f Author: Geert Uytterhoeven Date: Mon Nov 24 10:28:29 2025 +0000 can: rcar_canfd: Extract rcar_canfd_global_{,de}init() Extract the code to (de)initialize global state into separate functions, for future reuse. Signed-off-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20251124102837.106973-5-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit eda3d6c8d784835cec86f42b3f8118c9eb0cc58c Author: Biju Das Date: Mon Nov 24 10:28:28 2025 +0000 can: rcar_canfd: Use devm_clk_get_optional() for RAM clk Replace devm_clk_get_optional_enabled()->devm_clk_get_optional() as the RAM clk needs to be enabled in resume for proper operation in STR mode for RZ/G3E SoC. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251124102837.106973-4-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 790ec4c453890f1221ea595674a1206bbee41dc4 Author: Geert Uytterhoeven Date: Mon Nov 24 10:28:27 2025 +0000 can: rcar_canfd: Invert global vs. channel teardown Global state is initialized and torn down before per-channel state. Invert the order to restore symmetry. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://patch.msgid.link/20251124102837.106973-3-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 41c13eaf39932fc79aa1ac245a9b97090fe23d5e Author: Geert Uytterhoeven Date: Mon Nov 24 10:28:26 2025 +0000 can: rcar_canfd: Invert reset assert order The two resets are asserted during cleanup in the same order as they were deasserted during probe. Invert the order to restore symmetry. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://patch.msgid.link/20251124102837.106973-2-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit 113aa9101a9107c52fe263258ed272828b216fe0 Merge: ab084f0b8d6d2e b360a13d44db14 Author: Marc Kleine-Budde Date: Wed Nov 26 11:20:45 2025 +0100 Merge patch series "can: netlink: add CAN XL support" Marc Kleine-Budde says: Similarly to how CAN FD reuses the bittiming logic of Classical CAN, CAN XL also reuses the entirety of CAN FD features, and, on top of that, adds new features which are specific to CAN XL. A so-called 'mixed-mode' is intended to have (XL-tolerant) CAN FD nodes and CAN XL nodes on one CAN segment, where the FD-controllers can talk CC/FD and the XL-controllers can talk CC/FD/XL. This mixed-mode utilizes the known error-signalling (ES) for sending CC/FD/XL frames. For CAN FD and CAN XL the tranceiver delay compensation (TDC) is supported to use common CAN and CAN-SIG transceivers. The CANXL-only mode disables the error-signalling in the CAN XL controller. This mode does not allow CC/FD frames to be sent but additionally offers a CAN XL transceiver mode switching (TMS) to send CAN XL frames with up to 20Mbit/s data rate. The TMS utilizes a PWM configuration which is added to the netlink interface. Configured with CAN_CTRLMODE_FD and CAN_CTRLMODE_XL this leads to: FD=0 XL=0 CC-only mode (ES=1) FD=1 XL=0 FD/CC mixed-mode (ES=1) FD=1 XL=1 XL/FD/CC mixed-mode (ES=1) FD=0 XL=1 XL-only mode (ES=0, TMS optional) Patch #1 print defined ctrlmode strings capitalized to increase the readability and to be in line with the 'ip' tool (iproute2). Patch #2 is a small clean-up which makes can_calc_bittiming() use NL_SET_ERR_MSG() instead of netdev_err(). Patch #3 adds a check in can_dev_dropped_skb() to drop CAN FD frames when CAN FD is turned off. Patch #4 adds CAN_CTRLMODE_RESTRICTED. Note that contrary to the other CAN_CTRL_MODE_XL_* that are introduced in the later patches, this control mode is not specific to CAN XL. The nuance is that because this restricted mode was only added in ISO 11898-1:2024, it is made mandatory for CAN XL devices but optional for other protocols. This is why this patch is added as a preparation before introducing the core CAN XL logic. Patch #5 adds all the CAN XL features which are inherited from CAN FD: the nominal bittiming, the data bittiming and the TDC. Patch #6 add a new CAN_CTRLMODE_XL_TMS control mode which is specific to CAN XL to enable the transceiver mode switching (TMS) in XL-only mode. Patch #7 adds a check in can_dev_dropped_skb() to drop CAN CC/FD frames when the CAN XL controller is in CAN XL-only mode. The introduced can_dev_in_xl_only_mode() function also determines the error-signalling configuration for the CAN XL controllers. Patch #8 to #11 add the PWM logic for the CAN XL TMS mode. Patch #12 to #14 add different default sample-points for standard CAN and CAN SIG transceivers (with TDC) and CAN XL transceivers using PWM in the CAN XL TMS mode. Patch #15 add a dummy_can driver for netlink testing and debugging. Patch #16 check CAN frame type (CC/FD/XL) when writing those frames to the CAN_RAW socket and reject them if it's not supported by the CAN interface. Patch #17 increase the resolution when printing the bitrate error and round-up the value to 0.01% in the case the resolution would still provide values which would lead to 0.00%. Link: https://patch.msgid.link/20251126-canxl-v8-0-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit b360a13d44db148f6d72fe4f73356726c0663f6a Author: Oliver Hartkopp Date: Wed Nov 26 11:16:18 2025 +0100 can: dev: print bitrate error with two decimal digits Increase the resolution when printing the bitrate error and round-up the value to 0.01% in the case the resolution would still provide values which would lead to 0.00%. Suggested-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-17-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 1a620a723853a0f49703c317d52dc6b9602cbaa8 Author: Oliver Hartkopp Date: Wed Nov 26 11:16:17 2025 +0100 can: raw: instantly reject unsupported CAN frames For real CAN interfaces the CAN_CTRLMODE_FD and CAN_CTRLMODE_XL control modes indicate whether an interface can handle those CAN FD/XL frames. In the case a CAN XL interface is configured in CANXL-only mode with disabled error-signalling neither CAN CC nor CAN FD frames can be sent. The checks are performed on CAN_RAW sockets to give an instant feedback to the user when writing unsupported CAN frames to the interface. Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-16-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 816cf430e84b4628dba665491e78ce081a468fcb Author: Vincent Mailhol Date: Wed Nov 26 11:16:16 2025 +0100 can: add dummy_can driver During the development of CAN XL, we found the need of creating a dummy CAN XL driver in order to test the new netlink interface. While this code was initially intended to be some throwaway, it received some positive feedback. Add the dummy_can driver. This driver acts similarly to the vcan interface in the sense that it will echo back any packet it receives. The difference is that it exposes a set on bittiming parameters as a real device would and thus must be configured as if it was a real physical interface. The driver comes with a debug mode. If debug message are enabled (for example by enabling CONFIG_CAN_DEBUG_DEVICES), it will print in the kernel log all the bittiming values, similar to what a: ip --details link show can0 would do. This driver is mostly intended for debugging and testing, but some developers also may want to look at it as a simple reference implementation. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-15-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit f5de373ae455f1db6cf15033d660ac0046bcb0ff Author: Vincent Mailhol Date: Wed Nov 26 11:16:15 2025 +0100 can: calc_bittiming: add can_calc_sample_point_pwm() The optimum sample point value depends on the bit symmetry. The more asymmetric the bit is, the more the sample point would be located towards the end of the bit. On the contrary, if the transceiver only has a small asymmetry, the optimal sample point would be slightly after the centre of the bit. For NRZ encoding (used by Classical CAN, CAN FD and CAN XL with TMS off), the optimum sample points values are above 70% as implemented in can_calc_sample_point_nrz(). When TMS is on, CAN XL optimum sample points are near to 50% or 60% [1]. Add can_calc_sample_point_pwm() which returns a sample point which is suitable for PWM encoding. We crafted the formula to make it return the same values as below table (source: table 3 of [1]). Bit rate (Mbits/s) Sample point ------------------------------------- 2.0 51.3% 5.0 53.1% 8.0 55.0% 10.0 56.3% 12.3 53.8% 13.3 58.3% 14.5 54.5% 16.0 60.0% 17.7 55.6% 20.0 62.5% The calculation simply consists of setting a slightly too high sample point and then letting can_update_sample_point() correct the values. For now, it is just a formula up our sleeves which matches the empirical observations of [1]. Once CiA recommendations become available, can_calc_sample_point_pwm() should be updated accordingly. [1] CAN XL system design: Clock tolerances and edge deviations edge deviations Link: https://www.can-cia.org/fileadmin/cia/documents/publications/cnlm/december_2024/cnlm_24-4_p18_can_xl_system_design_clock_tolerances_and_edge_deviations_dr_arthur_mutter_bosch.pdf Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-14-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit a6ddf91a4f9718cec712785904c57b7117f61d6c Author: Vincent Mailhol Date: Wed Nov 26 11:16:14 2025 +0100 can: calc_bittiming: add can_calc_sample_point_nrz() CAN XL optimal sample point for PWM encoding (when TMS is on) differs from the NRZ optimal one. There is thus a need to calculate a different sample point depending whether TMS is on or off. This is a preparation change: move the sample point calculation from can_calc_bittiming() into the new can_calc_sample_point_nrz() function. In an upcoming change, a function will be added to calculate the sample point for PWM encoding. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-13-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 1d147cb7c51d6e994ba740709072adf270d7b878 Author: Vincent Mailhol Date: Wed Nov 26 11:16:13 2025 +0100 can: calc_bittiming: replace misleading "nominal" by "reference" The functions can_update_sample_point() and can_calc_bittiming() are generic and meant to be used for both the nominal and the data bittiming calculation. However, those functions use misleading terminologies such as "bitrate nominal" or "sample point nominal". Replace all places where the word "nominal" appears with "reference" in order to better distinguish it from the calculated values. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-12-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 46552323fa6779beb1ea558254dfd56021174c93 Author: Vincent Mailhol Date: Wed Nov 26 11:16:12 2025 +0100 can: netlink: add PWM netlink interface When the TMS is switched on, the node uses PWM (Pulse Width Modulation) during the data phase instead of the classic NRZ (Non Return to Zero) encoding. PWM is configured by three parameters: - PWMS: Pulse Width Modulation Short phase - PWML: Pulse Width Modulation Long phase - PWMO: Pulse Width Modulation Offset time For each of these parameters, define three IFLA symbols: - IFLA_CAN_PWM_PWM*_MIN: the minimum allowed value. - IFLA_CAN_PWM_PWM*_MAX: the maximum allowed value. - IFLA_CAN_PWM_PWM*: the runtime value. This results in a total of nine IFLA symbols which are all nested in a parent IFLA_CAN_XL_PWM symbol. IFLA_CAN_PWM_PWM*_MIN and IFLA_CAN_PWM_PWM*_MAX define the range of allowed values and will match the value statically configured by the device in struct can_pwm_const. IFLA_CAN_PWM_PWM* match the runtime values stored in struct can_pwm. Those parameters may only be configured when the tms mode is on. If the PWMS, PWML and PWMO parameters are provided, check that all the needed parameters are present using can_validate_pwm(), then check their value using can_validate_pwm_bittiming(). PWMO defaults to zero if omitted. Otherwise, if CAN_CTRLMODE_XL_TMS is true but none of the PWM parameters are provided, calculate them using can_calc_pwm(). Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-11-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 9892339cf0348730e82383d4de9d9387b9d63925 Author: Vincent Mailhol Date: Wed Nov 26 11:16:11 2025 +0100 can: calc_bittiming: add PWM calculation Perform the PWM calculation according to CiA recommendations. Note that for databitrates greater than 5 MBPS, tqmin is less than CAN_PWM_NS_MAX (which is defined to 200 nano seconds), consequently, the result of the division: DIV_ROUND_UP(xl_ns, CAN_PWM_NS_MAX) is one and thus the for loop automatically stops on the first iteration giving a single PWM symbol per bit as expected. Because of that, there is no actual need for a separate conditional branch for when the databitrate is greater than 5 MBPS. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-10-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 8e2a2885a2a6217190065d1aae98fe88a670cc28 Author: Vincent Mailhol Date: Wed Nov 26 11:16:10 2025 +0100 can: bittiming: add PWM validation Add can_validate_pwm() to validate the values pwms, pwml and pwml. Error messages are added to each of the checks to inform the user on what went wrong. Refer to those error messages to understand the validation logic. The boundary values CAN_PWM_DECODE_NS (the transceiver minimum decoding margin) and CAN_PWM_NS_MAX (the maximum PWM symbol duration) are hardcoded for the moment. Note that a transceiver capable of bitrates higher than 20 Mbps may be able to handle a CAN_PWM_DECODE_NS below 5 ns. If such transceivers become commercially available, this code could be revisited to make this parameter configurable. For now, leave it static. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-9-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit f6ccc2b293ba27e9171c63e456d9cba664fa2337 Author: Vincent Mailhol Date: Wed Nov 26 11:16:09 2025 +0100 can: bittiming: add PWM parameters In CAN XL, higher data bit rates require the CAN transceiver to switch its operation mode to use Pulse-Width Modulation (PWM) transmission mode instead of the classic dominant/recessive transmission mode. The PWM parameters are: - PWMS: pulse width modulation short phase - PWML: pulse width modulation long phase - PWMO: pulse width modulation offset CiA 612-2 specifies PWMS and PWML to be at least 1 (arguably, PWML shall be at least 2 to respect the PWMS < PWML rule). PWMO's minimum is expected to always be zero. It is added more for consistency than anything else. Add struct can_pwm_const so that the different devices can provide their minimum and maximum values. When TMS is on, the runtime PWMS, PWML and PWMO are needed (either calculated or provided by the user): add struct can_pwm to store these. TDC and PWM can not be used at the same time (TDC can only be used when TMS is off and PWM only when TMS is on). struct can_pwm is thus put together with struct can_tdc inside a union to save some space. The netlink logic will be added in an upcoming change. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-8-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 6df01533e535d21cac779ff35cc25c43304035c3 Author: Oliver Hartkopp Date: Wed Nov 26 11:16:08 2025 +0100 can: dev: can_dev_dropped_skb: drop CC/FD frames in CANXL-only mode The error-signalling (ES) is a mandatory functionality for CAN CC and CAN FD to report CAN frame format violations by sending an error-frame signal on the bus. A so-called 'mixed-mode' is intended to have (XL-tolerant) CAN FD nodes and CAN XL nodes on one CAN segment, where the FD-controllers can talk CC/FD and the XL-controllers can talk CC/FD/XL. This mixed-mode utilizes the error-signalling for sending CC/FD/XL frames. The CANXL-only mode disables the error-signalling in the CAN XL controller. This mode does not allow CC/FD frames to be sent but additionally offers a CAN XL transceiver mode switching (TMS). Configured with CAN_CTRLMODE_FD and CAN_CTRLMODE_XL this leads to: FD=0 XL=0 CC-only mode (ES=1) FD=1 XL=0 FD/CC mixed-mode (ES=1) FD=1 XL=1 XL/FD/CC mixed-mode (ES=1) FD=0 XL=1 XL-only mode (ES=0, TMS optional) The helper function can_dev_in_xl_only_mode() determines the required value to disable error signalling in the CAN XL controller. Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-7-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 233134af208689c2d5d40896f5740473a74e3cb2 Author: Vincent Mailhol Date: Wed Nov 26 11:16:07 2025 +0100 can: netlink: add CAN_CTRLMODE_XL_TMS flag The Transceiver Mode Switching (TMS) indicates whether the CAN XL controller shall use the PWM or NRZ encoding during the data phase. The term "transceiver mode switching" is used in both ISO 11898-1 and CiA 612-2 (although only the latter one uses the abbreviation TMS). We adopt the same naming convention here for consistency. Add the CAN_CTRLMODE_XL_TMS flag to the list of the CAN control modes. Add can_validate_xl_flags() to check the coherency of the TMS flag. That function will be reused in upcoming changes to validate the other CAN XL flags. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-6-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit e63281614747c73f25b708c75bc696c4e76f5588 Author: Vincent Mailhol Date: Wed Nov 26 11:16:06 2025 +0100 can: netlink: add initial CAN XL support CAN XL uses bittiming parameters different from Classical CAN and CAN FD. Thus, all the data bittiming parameters, including TDC, need to be duplicated for CAN XL. Add the CAN XL netlink interface for all the features which are common with CAN FD. Any new CAN XL specific features are added later on. The first time CAN XL is activated, the MTU is set by default to CANXL_MAX_MTU. The user may then configure a custom MTU within the CANXL_MIN_MTU to CANXL_MAX_MTU range, in which case, the custom MTU value will be kept as long as CAN XL remains active. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-5-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 60f511f443e552ef5b5cd79ec2b881f4323e19c9 Author: Vincent Mailhol Date: Wed Nov 26 11:16:05 2025 +0100 can: netlink: add CAN_CTRLMODE_RESTRICTED ISO 11898-1:2024 adds a new restricted operation mode. This mode is added as a mandatory feature for nodes which support CAN XL and is retrofitted as optional for legacy nodes (i.e. the ones which only support Classical CAN and CAN FD). The restricted operation mode is nearly the same as the listen only mode: the node can not send data frames or remote frames and can not send dominant bits if an error occurs. The only exception is that the node shall still send the acknowledgment bit. A second niche exception is that the node may still send a data frame containing a time reference message if the node is a primary time provider, but because the time provider feature is not yet implemented in the kernel, this second exception is not relevant to us at the moment. Add the CAN_CTRLMODE_RESTRICTED control mode flag and update the can_dev_dropped_skb() helper function accordingly. Finally, bail out if both CAN_CTRLMODE_LISTENONLY and CAN_CTRLMODE_RESTRICTED are provided. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-4-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit d037d05c2e32792a6fa572b0aa3c92a8ac78589d Author: Vincent Mailhol Date: Wed Nov 26 11:16:04 2025 +0100 can: dev: can_dev_dropped_skb: drop CAN FD skbs if FD is off Currently, the CAN FD skb validation logic is based on the MTU: the interface is deemed FD capable if and only if its MTU is greater or equal to CANFD_MTU. This logic is showing its limit with the introduction of CAN XL. For example, consider the two scenarios below: 1. An interface configured with CAN FD on and CAN XL on 2. An interface configured with CAN FD off and CAN XL on In those two scenarios, the interfaces would have the same MTU: CANXL_MTU making it impossible to differentiate which one has CAN FD turned on and which one has it off. Because of the limitation, the only non-UAPI-breaking workaround is to do the check at the device level using the can_priv->ctrlmode flags. Unfortunately, the virtual interfaces (vcan, vxcan), which do not have a can_priv, are left behind. Add a check on the CAN_CTRLMODE_FD flag in can_dev_dropped_skb() and drop FD frames whenever the feature is turned off. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-3-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 585a4f22c4f9d85e32d42be65e67c232e82e5b3a Author: Vincent Mailhol Date: Wed Nov 26 11:16:03 2025 +0100 can: bittiming: apply NL_SET_ERR_MSG() to can_calc_bittiming() When CONFIG_CAN_CALC_BITTIMING is disabled, the can_calc_bittiming() functions can not be used and the user needs to provide all the bittiming parameters. Currently, can_calc_bittiming() prints an error message to the kernel log. Instead use NL_SET_ERR_MSG() to make it return the error message through the netlink interface so that the user can directly see it. Signed-off-by: Vincent Mailhol Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-2-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 66e75b2758d69dce908fe98da72c345fa18a46f4 Author: Oliver Hartkopp Date: Wed Nov 26 11:16:02 2025 +0100 can: dev: can_get_ctrlmode_str: use capitalized ctrlmode strings Unify the ctrlmode related strings to the command line options of the 'ip' tool from the iproute2 package. The capitalized strings are also shown when the detailed interface configuration is printed by 'ip'. Suggested-by: Stephane Grosjean Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20251126-canxl-v8-1-e7e3eb74f889@pengutronix.de Signed-off-by: Marc Kleine-Budde commit e20c6260474c45f66c636a50d5b8801759ffe09e Author: Loïc Molinari Date: Fri Nov 14 18:03:00 2025 +0100 drm/panthor: Improve IOMMU map/unmap debugging logs Log the number of pages and their sizes actually mapped/unmapped by the IOMMU page table driver. Since a map/unmap op is often split in several ops depending on the underlying scatter/gather table, add the start address and the total size to the debugging logs in order to help understand which batch an op is part of. Signed-off-by: Loïc Molinari Reviewed-by: Boris Brezillon Link: https://patch.msgid.link/20251114170303.2800-10-loic.molinari@collabora.com Signed-off-by: Boris Brezillon commit ab3490493c73374862e47ccc00d3dbb89228f86e Author: Karunika Choo Date: Tue Nov 25 12:55:48 2025 +0000 drm/panthor: Add support for Mali-G1 GPUs Add support for Mali-G1 GPUs (CSF architecture v14), introducing a new panthor_hw_arch_v14 entry with reset and L2 power management operations via the PWR_CONTROL block. Mali-G1 introduces a dedicated PWR_CONTROL block for managing resets and power domains. panthor_gpu_info_init() is updated to use this block for L2, tiler, and shader domain present register reads. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-9-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit 2008f49a633eee412b33f01b51b3ebc91105ccd8 Author: Karunika Choo Date: Tue Nov 25 12:55:47 2025 +0000 drm/panthor: Support 64-bit endpoint_req register for Mali-G1 Add support for the 64-bit endpoint_req register introduced in CSF v4.0+ GPUs. Unlike a simple register widening, the 64-bit variant occupies the next 64 bits after the original 32-bit field, requiring version-dependent access. This change introduces helper functions to read, write, and update the endpoint_req register, ensuring correct handling on both pre-v4.0 and v4.0+ firmwares. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-8-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit 51407254986501b19681d55531963f1ea58e89cd Author: Karunika Choo Date: Tue Nov 25 12:55:46 2025 +0000 drm/panthor: Support GLB_REQ.STATE field for Mali-G1 GPUs Add support for the GLB_REQ.STATE field introduced in CSF v4.1+, which replaces the HALT bit to provide finer control over the MCU state. This change implements basic handling for transitioning the MCU between ACTIVE and HALT states on Mali-G1 GPUs. The update introduces new helpers to issue the state change requests, poll for MCU halt completion, and restore the MCU to an active state after halting. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-7-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit 9ee52f5cdc45e397fddad2a9ed879c72a8fcfa65 Author: Karunika Choo Date: Tue Nov 25 12:55:45 2025 +0000 drm/panthor: Implement soft reset via PWR_CONTROL Add helpers to issue reset commands through the PWR_CONTROL interface and wait for reset completion using IRQ signaling. This enables support for RESET_SOFT operations with timeout handling and status verification. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-6-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit ee4f9af07933648f2f9337d7b24da5562a594399 Author: Karunika Choo Date: Tue Nov 25 12:55:44 2025 +0000 drm/panthor: Implement L2 power on/off via PWR_CONTROL This patch adds common helpers to issue power commands, poll transitions, and validate domain state, then wires them into the L2 on/off paths. The L2 power-on sequence now delegates control of the SHADER and TILER domains to the MCU when allowed, while the L2 itself is never delegated. On power-off, dependent domains beneath the L2 are checked, and if necessary, retracted and powered down to maintain proper domain ordering. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-5-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit c27787f2b77f88b8e2f7b72856dbde601ba17412 Author: Karunika Choo Date: Tue Nov 25 12:55:43 2025 +0000 drm/panthor: Introduce panthor_pwr API and power control framework Add the new panthor_pwr module, which provides basic power control management for Mali-G1 GPUs. The initial implementation includes infrastructure for initializing the PWR_CONTROL block, requesting and handling its IRQ, and checking for PWR_CONTROL support based on GPU architecture. The patch also integrates panthor_pwr with the device lifecycle (init, suspend, resume, and unplug) through the new API functions. It also registers the IRQ handler under the 'gpu' IRQ as the PWR_CONTROL block is located within the GPU_CONTROL block. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-4-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit 7d334f5c0b720cda7b517961689997c5f72003a5 Author: Karunika Choo Date: Tue Nov 25 12:55:42 2025 +0000 drm/panthor: Add architecture-specific function operations Introduce architecture-specific function pointers to support architecture-dependent behaviours. This patch adds the following function pointers and updates their usage accordingly: - soft_reset - l2_power_on - l2_power_off Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-3-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit b1075ae1a3b56fd0b1275caf51bcc633f665bb19 Author: Karunika Choo Date: Tue Nov 25 12:55:41 2025 +0000 drm/panthor: Add arch-specific panthor_hw binding This patch adds the framework for binding to a specific panthor_hw structure based on the architecture major value parsed from the GPU_ID register. This is in preparation of enabling architecture-specific behaviours based on GPU_ID. As such, it also splits the GPU_ID register read operation into its own helper function. This framework allows a single panthor_hw structure to be shared across multiple architectures should there be minimal changes between them via the arch_min and arch_max field of the panthor_hw_entry structure, instead of duplicating the structure across multiple architectures. Reviewed-by: Steven Price Signed-off-by: Karunika Choo Link: https://patch.msgid.link/20251125125548.3282320-2-karunika.choo@arm.com Signed-off-by: Boris Brezillon commit ce04ec03a9c2c4f3e60e26f21311b25d5a478208 Author: Akash Goel Date: Thu Nov 20 17:21:18 2025 +0000 drm/panthor: Avoid adding of kernel BOs to extobj list The kernel BOs unnecessarily got added to the external objects list of drm_gpuvm, when mapping to GPU, which would have resulted in few extra CPU cycles being spent at the time of job submission as drm_exec_until_all_locked() loop iterates over all external objects. Kernel BOs are private to a VM and so they share the dma_resv object of the dummy GEM object created for a VM. Use of DRM_EXEC_IGNORE_DUPLICATES flag ensured the recursive locking of the dummy GEM object was ignored. Also no extra space got allocated to add fences to the dma_resv object of dummy GEM object. So no other impact apart from few extra CPU cycles. This commit sets the pointer to dma_resv object of GEM object of kernel BOs before they are mapped to GPU, to prevent them from being added to external objects list. v2: Add R-bs and fixes tags Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block") Signed-off-by: Akash Goel Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Link: https://patch.msgid.link/20251120172118.2741724-1-akash.goel@arm.com Signed-off-by: Boris Brezillon commit f9e788c5fd3a23edecd808ebb354e2cb1aef87c3 Author: Lachlan Hodges Date: Wed Nov 26 12:57:58 2025 +1100 wifi: mac80211: allow sharing identical chanctx for S1G interfaces Introduce support for sharing identical channel contexts for S1G interfaces. Additionally, do not downgrade channel requests for S1G interfaces. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20251126015758.149034-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 679fcce0028bf101146127c730f447396891852d Merge: d1e7b4613e2fce 275d6d1189e6d5 Author: Paolo Bonzini Date: Wed Nov 26 09:46:45 2025 +0100 Merge tag 'kvm-x86-svm-6.19' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.19: - Fix a few missing "VMCB dirty" bugs. - Fix the worst of KVM's lack of EFER.LMSLE emulation. - Add AVIC support for addressing 4k vCPUs in x2AVIC mode. - Fix incorrect handling of selective CR0 writes when checking intercepts during emulation of L2 instructions. - Fix a currently-benign bug where KVM would clobber SPEC_CTRL[63:32] on VMRUN and #VMEXIT. - Fix a bug where KVM corrupt the guest code stream when re-injecting a soft interrupt if the guest patched the underlying code after the VM-Exit, e.g. when Linux patches code with a temporary INT3. - Add KVM_X86_SNP_POLICY_BITS to advertise supported SNP policy bits to userspace, and extend KVM "support" to all policy bits that don't require any actual support from KVM. commit d1e7b4613e2fce06f7a7e3cf4285fbaa547656ba Merge: de8e8ebb1a7c5e dfd1572a64c907 Author: Paolo Bonzini Date: Wed Nov 26 09:44:52 2025 +0100 Merge tag 'kvm-x86-vmx-6.19' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.19: - Use the root role from kvm_mmu_page to construct EPTPs instead of the current vCPU state, partly as worthwhile cleanup, but mostly to pave the way for tracking per-root TLB flushes so that KVM can elide EPT flushes on pCPU migration if KVM has flushed the root at least once. - Add a few missing nested consistency checks. - Rip out support for doing "early" consistency checks via hardware as the functionality hasn't been used in years and is no longer useful in general, and replace it with an off-by-default module param to detected missed consistency checks (i.e. WARN if hardware finds a check that KVM does not). - Fix a currently-benign bug where KVM would drop the guest's SPEC_CTRL[63:32] on VM-Enter. - Misc cleanups. commit de8e8ebb1a7c5e2243fdb0409418484501e3b9b2 Merge: adc99a6cfcf76d 398180f93cf3c7 Author: Paolo Bonzini Date: Wed Nov 26 09:36:37 2025 +0100 Merge tag 'kvm-x86-tdx-6.19' of https://github.com/kvm-x86/linux into HEAD KVM TDX changes for 6.19: - Overhaul the TDX code to address systemic races where KVM (acting on behalf of userspace) could inadvertantly trigger lock contention in the TDX-Module, which KVM was either working around in weird, ugly ways, or was simply oblivious to (as proven by Yan tripping several KVM_BUG_ON()s with clever selftests). - Fix a bug where KVM could corrupt a vCPU's cpu_list when freeing a vCPU if creating said vCPU failed partway through. - Fix a few sparse warnings (bad annotation, 0 != NULL). - Use struct_size() to simplify copying capabilities to userspace. commit adc99a6cfcf76d670272dea64bbc2d43ecd12a2f Merge: b0bf3d67a7f051 6422060aa9c7bb Author: Paolo Bonzini Date: Wed Nov 26 09:36:01 2025 +0100 Merge tag 'kvm-x86-mmu-6.19' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.19: - Skip the costly "zap all SPTEs" on an MMIO generation wrap if MMIO SPTE caching is disabled, as there can't be any relevant SPTEs to zap. - Relocate a misplace export. commit a7ab6f946683e065fa22db1cc2f2748d4584178a Author: Guillaume La Roque Date: Sun Nov 23 18:14:10 2025 +0100 arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs The original addition of cache information for the Amlogic S922X SoC used the wrong next-level cache node for CPU cores 100 and 101, incorrectly referencing `l2_cache_l`. These cores actually belong to the big cluster and should reference `l2_cache_b`. Update the device tree accordingly. Fixes: e7f85e6c155a ("arm64: dts: amlogic: Add cache information to the Amlogic S922X SoC") Signed-off-by: Guillaume La Roque Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251123-fixkhadas-v1-1-045348f0a4c2@baylibre.com Signed-off-by: Neil Armstrong commit e1c246c6410f631b867b98301a0b17f30aea29a8 Author: Xianwei Zhao Date: Wed Nov 5 17:45:36 2025 +0800 arm64: dts: Add gpio_intc node for Amlogic S7D SoCs Add GPIO interrupt controller device. Signed-off-by: Xianwei Zhao Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251105-irqchip-gpio-s6-s7-s7d-v1-5-b4d1fe4781c1@amlogic.com [narmstrong: fixed applying on top as secure node] Signed-off-by: Neil Armstrong commit 303dad7af6f5eb9be79302978a8af3c2bb3d3fc2 Author: Xianwei Zhao Date: Wed Nov 5 17:45:35 2025 +0800 arm64: dts: Add gpio_intc node for Amlogic S7 SoCs Add GPIO interrupt controller device. Signed-off-by: Xianwei Zhao Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251105-irqchip-gpio-s6-s7-s7d-v1-4-b4d1fe4781c1@amlogic.com [narmstrong: fixed applying on top of ao secure node] Signed-off-by: Neil Armstrong commit 3ac37d522a94601679e311b8ab0ccbb0b0fa2b51 Author: Xianwei Zhao Date: Wed Nov 5 17:45:34 2025 +0800 arm64: dts: Add gpio_intc node for Amlogic S6 SoCs Add GPIO interrupt controller device. Signed-off-by: Xianwei Zhao Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251105-irqchip-gpio-s6-s7-s7d-v1-3-b4d1fe4781c1@amlogic.com [narmstrong: fixed applying on top of ao secure node] Signed-off-by: Neil Armstrong commit 2cab15a781d06717c47eb546c79ffaa5bec0bf06 Author: Xianwei Zhao Date: Wed Nov 19 10:52:26 2025 +0800 arm64: dts: amlogic: s7d: add ao secure node Add node for board info registers, which allows getting SoC family and board revision. Reviewed-by: Neil Armstrong Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251119-soc-info-s6-s7-s7d-v3-5-1764c1995c04@amlogic.com Signed-off-by: Neil Armstrong commit 35e41e2a399b27f2a3624eb7ebb46e962c4c1466 Author: Xianwei Zhao Date: Wed Nov 19 10:52:25 2025 +0800 arm64: dts: amlogic: s7: add ao secure node Add node for board info registers, which allows getting SoC family and board revision. Reviewed-by: Neil Armstrong Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251119-soc-info-s6-s7-s7d-v3-4-1764c1995c04@amlogic.com Signed-off-by: Neil Armstrong commit 6a46754317d3cb7d3018d5646fb8e2b8bee2d727 Author: Xianwei Zhao Date: Wed Nov 19 10:52:24 2025 +0800 arm64: dts: amlogic: s6: add ao secure node Add node for board info registers, which allows getting SoC family and board revision. Reviewed-by: Neil Armstrong Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251119-soc-info-s6-s7-s7d-v3-3-1764c1995c04@amlogic.com Signed-off-by: Neil Armstrong commit 032f2b83a6cf9e82721553401012062e9a18884d Author: Manivannan Sadhasivam Date: Sat Nov 1 09:59:41 2025 +0530 arm64: dts: amlogic: Fix the register name of the 'DBI' region DT incorrectly specifies the 'DBI' region as 'ELBI'. DBI is a must have region for DWC controllers as it has the Root Port and controller specific registers, while ELBI has optional registers. Hence, fix the DT for both Meson platforms. Cc: stable+noautosel@kernel.org # Driver dependency Fixes: 5b3a9c20926e ("arm64: dts: meson-axg: add PCIe nodes") Fixes: 1f8607d59763 ("arm64: dts: meson-g12a: Add PCIe node") Signed-off-by: Manivannan Sadhasivam Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251101-pci-meson-fix-v1-2-c50dcc56ed6a@oss.qualcomm.com Signed-off-by: Neil Armstrong commit dbb559cfda8706ee0988186855744674bb5e4ee5 Author: Xianwei Zhao Date: Wed Oct 22 13:04:48 2025 +0800 dts: arm64: amlogic: add a5 pinctrl node Add pinctrl device to support Amlogic A5. Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251022-a5-pinctrl-node-v4-1-a71911852c4b@amlogic.com Signed-off-by: Neil Armstrong commit 7ee8fc4163a7c7148d82ee702f93afd6ac9ebb4d Author: hongyu.chen1 Date: Fri Aug 22 13:39:59 2025 +0800 arm64: dts: amlogic: s7d: add power domain controller node Add power domain controller node for Amlogic S7D SoC. Signed-off-by: hongyu.chen1 Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250822-pm-s6-s7-s7d-v1-5-82e3f3aff327@amlogic.com Signed-off-by: Neil Armstrong commit f46ac577522af9c834513d5070de039262a29f02 Author: hongyu.chen1 Date: Fri Aug 22 13:39:58 2025 +0800 arm64: dts: amlogic: s7: add power domain controller node Add power domain controller node for Amlogic S7 SoC. Signed-off-by: hongyu.chen1 Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250822-pm-s6-s7-s7d-v1-4-82e3f3aff327@amlogic.com Signed-off-by: Neil Armstrong commit e5dde6ff48fcda78f22a7e40d0686372f5219041 Author: hongyu.chen1 Date: Fri Aug 22 13:39:57 2025 +0800 arm64: dts: amlogic: s6: add power domain controller node Add power domain controller node for Amlogic S6 SoC. Signed-off-by: hongyu.chen1 Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250822-pm-s6-s7-s7d-v1-3-82e3f3aff327@amlogic.com Signed-off-by: Neil Armstrong commit 3f738dc33ff76c9d1a6ad5cd49829957d8bd9c7a Author: Keke Li Date: Thu Sep 18 16:35:09 2025 +0800 dts: arm64: amlogic: Add ISP related nodes for C3 Add the IMX290 sensor node description to the device tree file, which will be controlled via I2C bus with image data transmission through MIPI CSI-2 interface. Add CSI-2, adapter and ISP nodes for C3 family. Signed-off-by: Keke Li Link: https://patch.msgid.link/20250918-b4-c3isp-v1-1-5f48db6516c9@amlogic.com Signed-off-by: Neil Armstrong commit af94dc5610371cd02a20ac53f5ed290eef0d7ffe Author: Christian Hewitt Date: Sat Sep 27 12:50:06 2025 +0000 arm64: dts: meson: add initial device-tree for Tanix TX9 Pro Oranth Tanix TX9 Pro is based on the Amlogic Q200 reference design with an S912 chip and the following specs: - 3GB DDR3 RAM - 32GB eMMC - 10/100/1000 Base-T Ethernet - AP6356 Wireless (802.11 b/g/n/ac, BT 5.0) - HDMI 2.0a video - VFD for clock/status - 2x USB 2.0 ports - IR receiver - 1x Power LED (white) - 1x Update/Reset button (underside) - 1x micro SD card slot Signed-off-by: Christian Hewitt Reviewed-by: Martin Blumenstingl Link: https://patch.msgid.link/20250927125006.824293-2-christianshewitt@gmail.com Signed-off-by: Neil Armstrong commit ea1156e840324d80fac8829af72d78e2eeb8b020 Author: Christian Hewitt Date: Sat Sep 27 12:50:05 2025 +0000 dt-bindings: arm: amlogic: add support for Tanix TX9 Pro The Oranth Tanix TX9 Pro is an Android STB using the Amlogic S912 chip Signed-off-by: Christian Hewitt Reviewed-by: Martin Blumenstingl Acked-by: Conor Dooley Link: https://patch.msgid.link/20250927125006.824293-1-christianshewitt@gmail.com Signed-off-by: Neil Armstrong commit b0bf3d67a7f05169edb254f826c9f6052b883f2e Merge: e64dcfab57ac41 d2e50389ab44ac Author: Paolo Bonzini Date: Wed Nov 26 09:35:40 2025 +0100 Merge tag 'kvm-x86-selftests-6.19' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.19: - Fix a math goof in mmu_stress_test when running on a single-CPU system/VM. - Forcefully override ARCH from x86_64 to x86 to play nice with specifying ARCH=x86_64 on the command line. - Extend a bunch of nested VMX to validate nested SVM as well. - Add support for LA57 in the core VM_MODE_xxx macro, and add a test to verify KVM can save/restore nested VMX state when L1 is using 5-level paging, but L2 is not. - Clean up the guest paging code in anticipation of sharing the core logic for nested EPT and nested NPT. commit e64dcfab57ac41b19e7433511ba0fa5be4f99e83 Merge: 236831743ced91 c09816f2afce0f Author: Paolo Bonzini Date: Wed Nov 26 09:34:21 2025 +0100 Merge tag 'kvm-x86-misc-6.19' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 6.19: - Fix an async #PF bug where KVM would clear the completion queue when the guest transitioned in and out of paging mode, e.g. when handling an SMI and then returning to paged mode via RSM. - Fix a bug where TDX would effectively corrupt user-return MSR values if the TDX Module rejects VP.ENTER and thus doesn't clobber host MSRs as expected. - Leave the user-return notifier used to restore MSRs registered when disabling virtualization, and instead pin kvm.ko. Restoring host MSRs via IPI callback is either pointless (clean reboot) or dangerous (forced reboot) since KVM has no idea what code it's interrupting. - Use the checked version of {get,put}_user(), as Linus wants to kill them off, and they're measurably faster on modern CPUs due to the unchecked versions containing an LFENCE. - Fix a long-lurking bug where KVM's lack of catch-up logic for periodic APIC timers can result in a hard lockup in the host. - Revert the periodic kvmclock sync logic now that KVM doesn't use a clocksource that's subject to NPT corrections. - Clean up KVM's handling of MMIO Stale Data and L1TF, and bury the latter behind CONFIG_CPU_MITIGATIONS. - Context switch XCR0, XSS, and PKRU outside of the entry/exit fastpath as the only reason they were handled in the faspath was to paper of a bug in the core #MC code that has long since been fixed. - Add emulator support for AVX MOV instructions to play nice with emulated devices whose PCI BARs guest drivers like to access with large multi-byte instructions. commit 92099de8460a6bd0a4bdc5695b54451dbe3a458f Author: Tasos Sahanidis Date: Wed Nov 26 02:29:57 2025 +0200 ALSA: usb-audio: Implement jack detection for HP Thunderbolt Dock G2 The HP Thunderbolt Dock G2 includes a headset jack with support for jack detection. However, this being a UAC1 device, detection is implemented via vendor-defined URB Controls. Implement it in a similar way to the Dell WD15/19 docks, but with different commands. Signed-off-by: Tasos Sahanidis Link: https://patch.msgid.link/20251126003805.2705503-3-tasos@tasossah.com Signed-off-by: Takashi Iwai commit fba274760d29a8346f335d0fbddf7d18e611e947 Author: Tasos Sahanidis Date: Wed Nov 26 02:29:56 2025 +0200 ALSA: usb-audio: Modularize realtek_add_jack in mixer_quirks Modify the realtek_add_jack function used for the jack detection quirk to allow passing the mixer unit id and an snd_kcontrol_new. This allows adding additional devices that require the same quirk, but implement jack detection with different commands. Signed-off-by: Tasos Sahanidis Link: https://patch.msgid.link/20251126003805.2705503-2-tasos@tasossah.com Signed-off-by: Takashi Iwai commit 236831743ced9162a8953aa281b73c65bd68b822 Merge: 9aca52b5523aab 83e0e12219a402 Author: Paolo Bonzini Date: Wed Nov 26 09:32:44 2025 +0100 Merge tag 'kvm-x86-gmem-6.19' of https://github.com/kvm-x86/linux into HEAD KVM guest_memfd changes for 6.19: - Add NUMA mempolicy support for guest_memfd, and clean up a variety of rough edges in guest_memfd along the way. - Define a CLASS to automatically handle get+put when grabbing a guest_memfd from a memslot to make it harder to leak references. - Enhance KVM selftests to make it easer to develop and debug selftests like those added for guest_memfd NUMA support, e.g. where test and/or KVM bugs often result in hard-to-debug SIGBUS errors. - Misc cleanups. commit 9aca52b5523aab9c9a777a591c0b27acbede9881 Merge: 32bd348be3fa07 04fd067b770d19 Author: Paolo Bonzini Date: Wed Nov 26 09:22:45 2025 +0100 Merge tag 'kvm-x86-generic-6.19' of https://github.com/kvm-x86/linux into HEAD KVM generic changes for 6.19: - Use the recently-added WQ_PERCPU when creating the per-CPU workqueue for irqfd cleanup. - Fix a goof in the dirty ring documentation. commit f37e2868792335f2e8bbdcc02ebbb4830453f83c Author: Li RongQing Date: Wed Nov 26 10:51:47 2025 +0800 RDMA/core: Reduce cond_resched() frequency in __ib_umem_release The current implementation calls cond_resched() for every SG entry in __ib_umem_release(), which can increase needless overhead. This patch introduces RESCHED_LOOP_CNT_THRESHOLD (0x1000) to limit how often cond_resched() is called. The function now yields the CPU once every 4096 iterations, and yield at the very first iteration for lots of small umem case, to reduce scheduling overhead. Fixes: d056bc45b62b ("RDMA/core: Prevent soft lockup during large user memory region cleanup") Signed-off-by: Li RongQing Link: https://patch.msgid.link/20251126025147.2627-1-lirongqing@baidu.com Signed-off-by: Leon Romanovsky commit 01dad9ca37c60d08f71e2ef639875ae895deede6 Author: Jijun Wang Date: Mon Nov 24 20:53:50 2025 -0600 RDMA/irdma: Fix SRQ shadow area address initialization Fix SRQ shadow area address initialization. Fixes: 563e1feb5f6e ("RDMA/irdma: Add SRQ support") Signed-off-by: Jijun Wang Signed-off-by: Jay Bhat Link: https://patch.msgid.link/20251125025350.180-10-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 62356fccb195f83d2ceafc787c5ba87ebbe5edfe Author: Jacob Moroni Date: Mon Nov 24 20:53:49 2025 -0600 RDMA/irdma: Remove doorbell elision logic In some cases, this logic can result in doorbell writes being skipped when they should not have been (at least on GEN3 HW), so remove it. This also means that the mb() can be safely downgraded to dma_wmb(). Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries") Signed-off-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-9-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit eef3ad030b08c0f100cb18de7f604442a1adb8c7 Author: Jacob Moroni Date: Mon Nov 24 20:53:48 2025 -0600 RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ The GEN3 hardware does not appear to support IBK_LOCAL_DMA_LKEY. Attempts to use it will result in an AE. Fixes: eb31dfc2b41a ("RDMA/irdma: Restrict Memory Window and CQE Timestamping to GEN3") Signed-off-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-8-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 71d3bdae5eab21cf8991a6f3cd914caa31d5a51f Author: Jacob Moroni Date: Mon Nov 24 20:53:47 2025 -0600 RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY The HW disables bounds checking for MRs with a length of zero, so the driver will only allow a zero length MR if the "all_memory" flag is set, and this flag is only set if IB_PD_UNSAFE_GLOBAL_RKEY is set for the PD. This means that the "get_dma_mr" method will currently fail unless the IB_PD_UNSAFE_GLOBAL_RKEY flag is set. This has not been an issue because the "get_dma_mr" method is only ever invoked if the device does not support the local DMA key or if IB_PD_UNSAFE_GLOBAL_RKEY is set, and so far, all IRDMA HW supports the local DMA lkey. However, some new HW does not support the local DMA lkey, so the "get_dma_mr" method needs to work without IB_PD_UNSAFE_GLOBAL_RKEY being set. To support HW that does not allow the local DMA lkey, the logic has been changed to pass an explicit flag to indicate when a dma_mr is being created so that the zero length will be allowed. Also, the "all_memory" flag has been forced to false for normal MR allocation since these MRs are never supposed to provide global unsafe rkey semantics anyway; only the MR created with "get_dma_mr" should support this. Fixes: bb6d73d9add6 ("RDMA/irdma: Prevent zero-length STAG registration") Signed-off-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-7-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 35bd787babd1f5a42641d0b1513edbed5d4e1624 Author: Anil Samal Date: Mon Nov 24 20:53:46 2025 -0600 RDMA/irdma: Add missing mutex destroy Add missing destroy of ah_tbl_lock and vchnl_mutex. Fixes: d5edd33364a5 ("RDMA/irdma: RDMA/irdma: Add GEN3 core driver support") Signed-off-by: Anil Samal Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-6-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 5eff1ecce30143c3f8924d91770d81d44bd5abe5 Author: Krzysztof Czurylo Date: Mon Nov 24 20:53:45 2025 -0600 RDMA/irdma: Fix SIGBUS in AEQ destroy Removes write to IRDMA_PFINT_AEQCTL register prior to destroying AEQ, as this register does not exist in GEN3+ hardware and this kind of IRQ configuration is no longer required. Fixes: b800e82feba7 ("RDMA/irdma: Add GEN3 support for AEQ and CEQ") Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-5-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 9e13d880ebae5da9b39ef2ed83a89737e927173f Author: Tatyana Nikolova Date: Mon Nov 24 20:53:44 2025 -0600 RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 During a refactor of the irdma GEN2 code, the kfree of the irdma_pci_f struct in icrdma_remove(), which was originally introduced upstream as part of commit 80f2ab46c2ee ("irdma: free iwdev->rf after removing MSI-X") was accidentally removed. Fixes: 0c2b80cac96e ("RDMA/irdma: Refactor GEN2 auxiliary driver") Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-4-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit 81f44409fb4f027d1e6d54edbeba5156ad94b214 Author: Krzysztof Czurylo Date: Mon Nov 24 20:53:43 2025 -0600 RDMA/irdma: Fix data race in irdma_free_pble Protects pble_rsrc counters with mutex to prevent data race. Fixes the following data race in irdma_free_pble reported by KCSAN: BUG: KCSAN: data-race in irdma_free_pble [irdma] / irdma_free_pble [irdma] write to 0xffff91430baa0078 of 8 bytes by task 16956 on cpu 5: irdma_free_pble+0x3b/0xb0 [irdma] irdma_dereg_mr+0x108/0x110 [irdma] ib_dereg_mr_user+0x74/0x160 [ib_core] uverbs_free_mr+0x26/0x30 [ib_uverbs] destroy_hw_idr_uobject+0x4a/0x90 [ib_uverbs] uverbs_destroy_uobject+0x7b/0x330 [ib_uverbs] uobj_destroy+0x61/0xb0 [ib_uverbs] ib_uverbs_run_method+0x1f2/0x380 [ib_uverbs] ib_uverbs_cmd_verbs+0x365/0x440 [ib_uverbs] ib_uverbs_ioctl+0x111/0x190 [ib_uverbs] __x64_sys_ioctl+0xc9/0x100 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 read to 0xffff91430baa0078 of 8 bytes by task 16953 on cpu 2: irdma_free_pble+0x23/0xb0 [irdma] irdma_dereg_mr+0x108/0x110 [irdma] ib_dereg_mr_user+0x74/0x160 [ib_core] uverbs_free_mr+0x26/0x30 [ib_uverbs] destroy_hw_idr_uobject+0x4a/0x90 [ib_uverbs] uverbs_destroy_uobject+0x7b/0x330 [ib_uverbs] uobj_destroy+0x61/0xb0 [ib_uverbs] ib_uverbs_run_method+0x1f2/0x380 [ib_uverbs] ib_uverbs_cmd_verbs+0x365/0x440 [ib_uverbs] ib_uverbs_ioctl+0x111/0x190 [ib_uverbs] __x64_sys_ioctl+0xc9/0x100 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 value changed: 0x0000000000005a62 -> 0x0000000000005a68 Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager") Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-3-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit a521928164433de44fed5aaf5f49aeb3f1fb96f5 Author: Krzysztof Czurylo Date: Mon Nov 24 20:53:42 2025 -0600 RDMA/irdma: Fix data race in irdma_sc_ccq_arm Adds a lock around irdma_sc_ccq_arm body to prevent inter-thread data race. Fixes data race in irdma_sc_ccq_arm() reported by KCSAN: BUG: KCSAN: data-race in irdma_sc_ccq_arm [irdma] / irdma_sc_ccq_arm [irdma] read to 0xffff9d51b4034220 of 8 bytes by task 255 on cpu 11: irdma_sc_ccq_arm+0x36/0xd0 [irdma] irdma_cqp_ce_handler+0x300/0x310 [irdma] cqp_compl_worker+0x2a/0x40 [irdma] process_one_work+0x402/0x7e0 worker_thread+0xb3/0x6d0 kthread+0x178/0x1a0 ret_from_fork+0x2c/0x50 write to 0xffff9d51b4034220 of 8 bytes by task 89 on cpu 3: irdma_sc_ccq_arm+0x7e/0xd0 [irdma] irdma_cqp_ce_handler+0x300/0x310 [irdma] irdma_wait_event+0xd4/0x3e0 [irdma] irdma_handle_cqp_op+0xa5/0x220 [irdma] irdma_hw_flush_wqes+0xb1/0x300 [irdma] irdma_flush_wqes+0x22e/0x3a0 [irdma] irdma_cm_disconn_true+0x4c7/0x5d0 [irdma] irdma_disconnect_worker+0x35/0x50 [irdma] process_one_work+0x402/0x7e0 worker_thread+0xb3/0x6d0 kthread+0x178/0x1a0 ret_from_fork+0x2c/0x50 value changed: 0x0000000000024000 -> 0x0000000000034000 Fixes: 3f49d6842569 ("RDMA/irdma: Implement HW Admin Queue OPs") Signed-off-by: Krzysztof Czurylo Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251125025350.180-2-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit f12ae9ba4d234732dc091cb0565d52b286de7572 Author: Yujie Zhang Date: Mon Nov 24 14:28:40 2025 +0800 docs/zh_CN: Add wd719x.rst translation Translate .../scsi/wd719x.rst into Chinese. Add wd719x into .../scsi/index.rst. Update the translation through commit 40ee63091a40 ("scsi: docs: convert wd719x.txt to ReST") Signed-off-by: Yujie Zhang Signed-off-by: Alex Shi commit 56a248e7bc21a2f51fcc706121e1f8fa89fda413 Author: Yujie Zhang Date: Mon Nov 24 14:28:39 2025 +0800 docs/zh_CN: Add libsas.rst translation Translate .../scsi/libsas.rst into Chinese. Add libsas into .../scsi/index.rst. Update the translation through commit 25882c82f850 ("scsi: libsas: Delete lldd_clear_aca callback") Signed-off-by: Yujie Zhang Signed-off-by: Alex Shi commit 500372aeb556afe65019f6a7f4ac817889653755 Author: Kailang Yang Date: Wed Nov 26 13:41:01 2025 +0800 ALSA: hda/realtek - Enable Mute LED for HP ZBook X G2i platform Enable SPK Mute Led and Mic Mute Led for HP ZBook X G2i platform. Signed-off-by: Kailang Yang Link: https://patch.msgid.link/ab5d4498f7454b25b245a3bad8fb95b3@realtek.com Signed-off-by: Takashi Iwai commit 64d67e7add109bfc54eac454558a4355af879ba7 Author: Marc Zyngier Date: Tue Nov 25 16:01:44 2025 +0000 KVM: arm64: Convert ICH_HCR_EL2_TDIR cap to EARLY_LOCAL_CPU_FEATURE Suzuki notices that making the ICH_HCR_EL2_TDIR capability a system one isn't a very good idea, should we end-up with CPUs that have asymmetric TDIR support (somehow unlikely, but you never know what level of stupidity vendors are up to). For this hypothetical setup, making this an "EARLY_LOCAL_CPU_FEATURE" is a much better option. This is actually consistent with what we already do with GICv5 legacy interface, so flip the capability over. Reported-by: Suzuki K Poulose Signed-off-by: Marc Zyngier Fixes: 2a28810cbb8b2 ("KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping") Link: https://lore.kernel.org/r/5df713d4-8b79-4456-8fd1-707ca89a61b6@arm.com Reviewed-by: Suzuki K Poulose Link: https://msgid.link/20251125160144.1086511-1-maz@kernel.org Signed-off-by: Oliver Upton commit d9600d57668c49308f705a660c5ad17fa3a53f73 Author: Riwen Lu Date: Tue Nov 18 11:23:38 2025 +0800 PM / devfreq: Fix typo in DFSO_DOWNDIFFERENTIAL macro name Correct the spelling error in the DFSO_DOWNDIFFERENTIAL macro definition and update the corresponding variable assignment. The macro was previously misspelled as DFSO_DOWNDIFFERENCTIAL. This change ensures consistent and correct spelling throughout the simpleondemand governor implementation. Signed-off-by: Riwen Lu Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20251118032339.2799230-1-luriwen@kylinos.cn/ commit ab084f0b8d6d2ee4b1c6a28f39a2a7430bdfa7f0 Author: Dimitri Daskalakis Date: Mon Nov 24 12:05:18 2025 -0800 drivers: net: fbnic: Return the true error in fbnic_alloc_napi_vectors. The error case in fbnic_alloc_napi_vectors defaulted to returning ENOMEM. This can mask the true error case, causing confusion. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20251124200518.1848029-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 7a57b325235e9ed3d5f8905993a87c20fd22a95c Merge: cfeb7cd80f40db ebe2f0b3cfe380 Author: Jakub Kicinski Date: Tue Nov 25 19:52:30 2025 -0800 Merge branch 'selftest-af_unix-misc-updates' Kuniyuki Iwashima says: ==================== selftest: af_unix: Misc updates. Patch 1 add .gitignore under tools/testing/selftests/net/af_unix/. Patch 2 make so_peek_off.c less flaky. ==================== Link: https://patch.msgid.link/20251124212805.486235-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ebe2f0b3cfe380120adec59264d58d5b26b931ed Author: Kuniyuki Iwashima Date: Mon Nov 24 21:26:40 2025 +0000 selftest: af_unix: Extend recv() timeout in so_peek_off.c. so_peek_off.c is reported to be flaky on NIPA: # # so_peek_off.c:149:two_chunks_overlap_blocking:Expected -1 (-1) != bytes (-1) # # two_chunks_overlap_blocking: Test terminated by assertion # # FAIL so_peek_off.stream.two_chunks_overlap_blocking The test fork()s a child process to send() data after 1ms to wake up the parent process being blocked (up to 3ms) on recv(). But, from the log, the parent woke up after 3ms timeout, so it could be too short when the host is overloaded. Let's extend it to 5s. Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20251124070722.1e828c53@kernel.org/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251124212805.486235-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit adb6b68c50604f3113d62758e839cc0186b94ce8 Author: Kuniyuki Iwashima Date: Mon Nov 24 21:26:39 2025 +0000 selftest: af_unix: Create its own .gitignore. Somehow AF_UNIX tests have reused ../.gitignore, but now NIPA warns about it. Let's create .gitignore under af_unix/. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251124212805.486235-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit cfeb7cd80f40dbe02ee95cd175dec341c42abae1 Author: Liming Wu Date: Thu Nov 20 09:53:20 2025 +0800 virtio_net: enhance wake/stop tx queue statistics accounting This patch refines and strengthens the statistics collection of TX queue wake/stop events introduced by commit c39add9b2423 ("virtio_net: Add TX stopped and wake counters"). Previously, the driver only recorded partial wake/stop statistics for TX queues. Some wake events triggered by 'skb_xmit_done()' or resume operations were not counted, which made the per-queue metrics incomplete. Signed-off-by: Liming Wu Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251120015320.1418-1-liming.wu@jaguarmicro.com Signed-off-by: Jakub Kicinski commit 8ccd11601659e6822cb7890e418979c65b4cd6fe Merge: 436fa8e7d1a119 9a5e5334adc039 Author: Jakub Kicinski Date: Tue Nov 25 19:28:32 2025 -0800 Merge branch 'tcp-provide-better-locality-for-retransmit-timer' Eric Dumazet says: ==================== tcp: provide better locality for retransmit timer TCP stack uses three timers per flow, currently spread this way: - sk->sk_timer : keepalive timer - icsk->icsk_retransmit_timer : retransmit timer - icsk->icsk_delack_timer : delayed ack timer This series moves the retransmit timer to sk->sk_timer location, to increase data locality in TX paths. keepalive timers are not often used, this change should be neutral for them. After the series we have following fields: - sk->tcp_retransmit_timer : retransmit timer, in sock_write_tx group - icsk->icsk_delack_timer : delayed ack timer - icsk->icsk_keepalive_timer : keepalive timer Moving icsk_delack_timer in a beter location would also be welcomed. ==================== Link: https://patch.msgid.link/20251124175013.1473655-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9a5e5334adc039fa652aa071ea95b18db0bc1f43 Author: Eric Dumazet Date: Mon Nov 24 17:50:13 2025 +0000 tcp: remove icsk->icsk_retransmit_timer Now sk->sk_timer is no longer used by TCP keepalive, we can use its storage for TCP and MPTCP retransmit timers for better cache locality. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251124175013.1473655-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 08dfe370239e53494453cee1e2ded2cdaa1efd12 Author: Eric Dumazet Date: Mon Nov 24 17:50:12 2025 +0000 tcp: introduce icsk->icsk_keepalive_timer sk->sk_timer has been used for TCP keepalives. Keepalive timers are not in fast path, we want to use sk->sk_timer storage for retransmit timers, for better cache locality. Create icsk->icsk_keepalive_timer and change keepalive code to no longer use sk->sk_timer. Added space is reclaimed in the following patch. This includes changes to MPTCP, which was also using sk_timer. Alias icsk->mptcp_tout_timer and icsk->icsk_keepalive_timer for inet_sk_diag_fill() sake. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251124175013.1473655-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 27e8257a86516682e2ec5d7543a8909c37ae8b00 Author: Eric Dumazet Date: Mon Nov 24 17:50:11 2025 +0000 net: move sk_dst_pending_confirm and sk_pacing_status to sock_read_tx group These two fields are mostly read in TCP tx path, move them in an more appropriate group for better cache locality. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251124175013.1473655-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3a6e8fd0bf4042c572dc52e634878b9aca02970d Author: Eric Dumazet Date: Mon Nov 24 17:50:10 2025 +0000 tcp: rename icsk_timeout() to tcp_timeout_expires() In preparation of sk->tcp_timeout_timer introduction, rename icsk_timeout() helper and change its argument to plain 'const struct sock *sk'. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251124175013.1473655-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 436fa8e7d1a119ec90f39e7c2ce0f3a146652899 Author: Alexander Lobakin Date: Mon Nov 24 18:07:35 2025 +0100 ice: fix broken Rx on VFs Since the tagged commit, ice stopped respecting Rx buffer length passed from VFs. At that point, the buffer length was hardcoded in ice, so VFs still worked up to some point (until, for example, a VF wanted an MTU larger than its PF). The next commit 93f53db9f9dc ("ice: switch to Page Pool"), broke Rx on VFs completely since ice started accounting per-queue buffer lengths again, but now VF queues always had their length zeroed, as ice was already ignoring what iavf was passing to it. Restore the line that initializes the buffer length on VF queues basing on the virtchnl messages. Fixes: 3a4f419f7509 ("ice: drop page splitting and recycling") Reported-by: Jakub Slepecki Reviewed-by: Tony Nguyen Signed-off-by: Alexander Lobakin Reviewed-by: Aleksandr Loktionov Tested-by: Jakub Slepecki Link: https://patch.msgid.link/20251124170735.3077425-1-aleksander.lobakin@intel.com Signed-off-by: Jakub Kicinski commit d696c73716147cb3158f1da1b89d7e75af3aa285 Author: Gustavo A. R. Silva Date: Mon Nov 24 18:42:08 2025 +0900 chtls: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the `DEFINE_RAW_FLEX()` helper for on-stack definitions of a flexible structure where the size of the flexible-array member is known at compile-time, and refactor the rest of the code, accordingly. So, with these changes, fix the following warning: drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_io.c:163:36: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Link: https://patch.msgid.link/aSQocKoJGkN0wzEj@kspp Signed-off-by: Jakub Kicinski commit 864f3eda0034a2a7421cb5daf045e9d2ca8b6aae Merge: 97a88d9e2ad28a 68e83f3472667a Author: Jakub Kicinski Date: Tue Nov 25 19:20:46 2025 -0800 Merge branch 'tools-ynl-gen-regeneration-comment-function-prefix' Asbjørn Sloth Tønnesen says: ==================== tools: ynl-gen: regeneration comment + function prefix It looks like these two patches are the last ones needed for YNL, before the WireGuard patches can go in. These patches was both requested by Jason, during review of the WireGuard YNL conversion patchset[1]. ==================== Link: https://patch.msgid.link/20251120174429.390574-1-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 68e83f3472667aac18d577587102f4bf77d0bd06 Author: Asbjørn Sloth Tønnesen Date: Thu Nov 20 17:44:27 2025 +0000 tools: ynl-gen: add regeneration comment Add a comment on regeneration to the generated files. The comment is placed after the YNL-GEN line[1], as to not interfere with ynl-regen.sh's detection logic. [1] and after the optional YNL-ARG line. Link: https://lore.kernel.org/r/aR5m174O7pklKrMR@zx2c4.com/ Suggested-by: Jason A. Donenfeld Signed-off-by: Asbjørn Sloth Tønnesen Acked-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251120174429.390574-3-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 17fa6ee35bd4b78752a2d33b92614a1c230a1ced Author: Asbjørn Sloth Tønnesen Date: Thu Nov 20 17:44:26 2025 +0000 tools: ynl-gen: add function prefix argument This patch adds a new CLI argument for overriding the default function prefix, as used for naming the doit/dumpit functions in the generated kernel code. When not specified the default "$(FAMILY)-nl" is used. This can also be specified persistently in generated files: /* YNL-ARG --function-prefix wg */ In the above example it causes the following changes: wireguard_nl_get_device_dumpit() -> wg_get_device_dumpit() wireguard_nl_get_device_doit() -> wg_get_device_doit() The variable name fn_prefix, was chosen as it relates to op_prefix which is used to prefix the UAPI commands enum entries. Link: https://lore.kernel.org/r/aRvWzC8qz3iXDAb3@zx2c4.com/ Suggested-by: Jason A. Donenfeld Signed-off-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20251120174429.390574-2-ast@fiberby.net Signed-off-by: Jakub Kicinski commit 97a88d9e2ad28ad1d5e5e8f1dc7122b4fe38d630 Merge: b796632fc83c8f 648282e2d1e550 Author: Jakub Kicinski Date: Tue Nov 25 19:17:23 2025 -0800 Merge branch 'ptp-ocp-a-fix-and-refactoring' Andy Shevchenko says: ==================== ptp: ocp: A fix and refactoring Here is the fix for incorrect use of %ptT with the associated refactoring and additional cleanups. Note, %ptS, which is introduced in another series that is already applied to PRINTK tree, doesn't fit here, that's why this fix is separated from that series. ==================== Link: https://patch.msgid.link/20251124084816.205035-1-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit 648282e2d1e5508de3662e8d2680f64e8586fc58 Author: Andy Shevchenko Date: Mon Nov 24 09:45:48 2025 +0100 ptp: ocp: Reuse META's PCI vendor ID The META's PCI vendor ID is listed already in the pci_ids.h. Reuse it here. Reviewed-by: Vadim Fedorenko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251124084816.205035-5-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit 4c84a5c7b095ea52e65ace483177fce23e55fa8f Author: Andy Shevchenko Date: Mon Nov 24 09:45:47 2025 +0100 ptp: ocp: Apply standard pattern for cleaning up loop The while (i--) is a standard pattern for the cleaning up loops. Apply this pattern where it makes sense in the driver. Reviewed-by: Vadim Fedorenko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251124084816.205035-4-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit 590f5d1fa6ee22b1ec07283d5fa870326f47b2f6 Author: Andy Shevchenko Date: Mon Nov 24 09:45:46 2025 +0100 ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware It's a common practice to make resource release functions be NULL-aware. Make ptp_ocp_unregister_ext() NULL-aware. Reviewed-by: Vadim Fedorenko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251124084816.205035-3-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit 622cc66ed72c2da2294de21da5976a087bcc5748 Author: Andy Shevchenko Date: Mon Nov 24 09:45:45 2025 +0100 ptp: ocp: Refactor signal_show() and fix %ptT misuse Refactor signal_show() to avoid sequential calls to sysfs_emit*() and use the same pattern to get the index of a signal as it's done in signal_store(). While at it, fix wrong use of %ptT against struct timespec64. It's kinda lucky that it worked just because the first member there 64-bit and it's of time64_t type. Now with %ptS it may be used correctly. Reviewed-by: Vadim Fedorenko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251124084816.205035-2-andriy.shevchenko@linux.intel.com Signed-off-by: Jakub Kicinski commit b796632fc83c8f9e0d97443f4f389ef9dddadb11 Author: Michal Luczaj Date: Sun Nov 23 22:43:59 2025 +0100 vsock/test: Extend transport change null-ptr-deref test syzkaller reported a lockdep lock order inversion warning[1] due to commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU"). This was fixed in commit f7c877e75352 ("vsock: fix lock inversion in vsock_assign_transport()"). Redo syzkaller's repro by piggybacking on a somewhat related test implemented in commit 3a764d93385c ("vsock/test: Add test for null ptr deref when transport changes"). [1]: https://lore.kernel.org/netdev/68f6cdb0.a70a0220.205af.0039.GAE@google.com/ Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251123-vsock_test-linger-lockdep-warn-v1-1-4b1edf9d8cdc@rbox.co Signed-off-by: Jakub Kicinski commit 87ad869feaedb0ebd61b2d254f6952f7e4ceb624 Author: Heiner Kallweit Date: Mon Nov 24 08:37:53 2025 +0100 r8169: improve MAC EEE handling Let phydev->enable_tx_lpi control whether MAC enables TX LPI, instead of enabling it unconditionally. This way TX LPI is disabled if e.g. link partner doesn't support EEE. This helps to avoid potential issues like link flaps. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/91bcb837-3fab-4b4e-b495-038df0932e44@gmail.com Signed-off-by: Jakub Kicinski commit de1e5c9333f426348571f7a3b034f99490d3f926 Author: Daniel Golle Date: Sat Nov 22 13:33:47 2025 +0000 net: phy: mxl-gpy: add support for MxL86252 and MxL86282 Add PHY driver support for Maxlinear MxL86252 and MxL86282 switches. The PHYs built-into those switches are just like any other GPY 2.5G PHYs with the exception of the temperature sensor data being encoded in a different way. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/a6cd7fe461b011cec2b59dffaf34e9c8b0819059.1763818120.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 9d844da693d6d0813714d9b5b7a58ac05c4cf7f0 Author: Chad Monroe Date: Sat Nov 22 13:32:15 2025 +0000 net: phy: mxl-gpy: add support for MxL86211C MxL86211C is a smaller and more efficient version of the GPY211C. Add the PHY ID and phy_driver instance to the mxl-gpy driver. Signed-off-by: Chad Monroe Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/cabf3559d6511bed6b8a925f540e3162efc20f6b.1763818120.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit ce28e333d6286cd10a27c8f22d3ac2b758f5fa0c Author: Buday Csaba Date: Mon Nov 24 15:50:44 2025 +0100 net: mdio: remove redundant fwnode cleanup Remove redundant fwnode cleanup in of_mdiobus_register_device() and xpcs_plat_init_dev(). mdio_device_free() eventually calls mdio_device_release(), which already performs fwnode_handle_put(), making the manual cleanup unnecessary. Combine fwnode_handle_get() with device_set_node() in of_mdiobus_register_device() for clarity. Signed-off-by: Buday Csaba Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/00847693daa8f7c8ff5dfa19dd35fc712fa4e2b5.1763995734.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit a11e0d467da2dcbe3f199a0f94769ed333b88288 Author: Buday Csaba Date: Mon Nov 24 08:19:15 2025 +0100 net: mdio: eliminate kdoc warnings in mdio_device.c and mdio_bus.c Fix all warnings reported by scripts/kernel-doc in mdio_device.c and mdio_bus.c Signed-off-by: Buday Csaba Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/7ef7b80669da2b899d38afdb6c45e122229c3d8c.1763968667.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit 652eb5afcecc757a24c91364752203a74935d996 Merge: f0054f7bb9cd33 10ba23a7f6cc4a Author: Jakub Kicinski Date: Tue Nov 25 17:44:50 2025 -0800 Merge branch 'net-enetc-add-port-mdio-support-for-both-i-mx94-and-i-mx95' Wei Fang says: ==================== net: enetc: add port MDIO support for both i.MX94 and i.MX95 The NETC IP has one external master MDIO interface (eMDIO) for managing external PHYs, all ENETC ports share this eMDIO. The EMDIO function and the ENETC port MDIO are the virtual ports of this eMDIO, ENETC can use these virtual ports to access their PHYs. The difference is that EMDIO function is a 'global port', it can access all the PHYs on the eMDIO, so it provides a means for different software modules to share a single set of MDIO signals to access their PHYs. The ENETC port MDIO can only access its own external PHY. Furthermore, its PHY address must be set to its corresponding LaBCR register in IERB module, which is is a 64 KB size page containing registers that are used for pre-boot initialization for all NETC PCIe functions. And this IERB is owned by the host OS and it will be locked after the initialization, so it cannot be configured at running time any more. The port MDIO can only work properly when the PHY address accessed by it matches the value of its corresponding LaBCR[MDIO_PHYAD_PRTAD]. Otherwise, the MDIO access by the port MDIO will not take effect. Note that the same PHY is either controlled by port MDIO or by the EMDIO function. The netc-blk-ctrl driver will only set the PHY address in the LaBCR register corresponding to the ENETC when the ENETC node contains an mdio child node, and the ENETC driver will only create the port MDIO bus then. An example in DTS is as follows, the EMDIO function will not\ access this PHY. enetc_port0 { phy-handle = <ðphy0>; phy-mode = "rgmii-id"; mdio { #address-cells = <1>; #size-cells = <0>; ethphy0: ethernet-phy@1 { reg = <1>; }; }; }; If users want to use EMDIO funtion to manage the PHY, they only need to place the PHY node in the emdio node. The same PHY must not be placed simultaneously within the ENETC node. An example in DTS to use EMDIO is as below. netc_emdio { ethphy0: ethernet-phy@1 { reg = <1>; }; ethphy2: ethernet-phy@8 { reg = <8>; }; }; In the host OS, when there are multiple ENETCs, they can all access their PHYs using their own port MDIO, or they can all access their PHYs using the EMDIO function, or they can partially use port MDIO and partially use the EMDIO function. Another typical use case of port MDIO is the Jailhouse usage. An ENETC is assigned to a guest OS. The EMDIO function will be unavailable in the guest OS because EMDIO is controlled by the host OS. Therefore, the ENETC can use its port MDIO to manage its external PHY in this situation. In this use case, the host OS's root dtb will disable the ENETC node, so the host OS's ENETC driver will not probe the ENETC and its PHY. In addition, this series also adds the internal MDIO bus support, each ENETC has an internal MDIO interface for managing on-die PHY (PCS) if it has PCS layer. ==================== Link: https://patch.msgid.link/20251119102557.1041881-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 10ba23a7f6cc4afbe7f1740b12b1ceb55fc57c00 Author: Wei Fang Date: Wed Nov 19 18:25:57 2025 +0800 net: enetc: update the base address of port MDIO registers for ENETC v4 Each ENETC has a set of external MDIO registers to access its external PHY based on its port EMDIO bus, these registers are used for MDIO bus access, such as setting the PHY address, PHY register address and value, read or write operations, C22 or C45 format, etc. The base address of this set of registers has been modified in ENETC v4 and is different from that in ENETC v1. So the base address needs to be updated so that ENETC v4 can use port MDIO to manage its own external PHY. Additionally, if ENETC has the PCS layer, it also has a set of internal MDIO registers for managing its on-die PHY (PCS/Serdes). The base address of this set of registers is also different from that of ENETC v1, so the base address also needs to be updated so that ENETC v4 can support the management of on-die PHY through the internal MDIO bus. Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20251119102557.1041881-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 50bfd9c06f0ff80e3ab6cfe6169d5ae2fe1afaa2 Author: Wei Fang Date: Wed Nov 19 18:25:56 2025 +0800 net: enetc: set external PHY address in IERB for i.MX94 ENETC NETC IP has only one external master MDIO interface (eMDIO) for managing the external PHYs. ENETC can use the interfaces provided by the EMDIO function or its port MDIO to access and manage its external PHY. Both the EMDIO function and the port MDIO are all virtual ports of the eMDIO. The difference is that the EMDIO function is a 'global port', it can access all the PHYs on the eMDIO, but port MDIO can only access its own PHY. To ensure that ENETC can only access its own PHY through port MDIO, LaBCR[MDIO_PHYAD_PRTAD] needs to be set, which represents the address of the external PHY connected to ENETC. If the accessed PHY address is not consistent with LaBCR[MDIO_PHYAD_PRTAD], then the MDIO access initiated by port MDIO will be invalid. Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20251119102557.1041881-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 6633df05f3ade81474d55acd712431b63182d858 Author: Wei Fang Date: Wed Nov 19 18:25:55 2025 +0800 net: enetc: set the external PHY address in IERB for port MDIO usage The ENETC supports managing its own external PHY through its port MDIO functionality. To use this function, the PHY address needs be set in the corresponding LaBCR register in the Integrated Endpoint Register Block (IERB), which is used for pre-boot initialization of NETC PCIe functions. The port MDIO can only work properly when the PHY address accessed by the port MDIO matches the corresponding LaBCR[MDIO_PHYAD_PRTAD] value. Because the ENETC driver only registers the MDIO bus (port MDIO bus) when it detects an MDIO child node in its node, similarly, the netc-blk-ctrl driver only resolves the PHY address and sets it in the corresponding LaBCR when it detects an MDIO child node in the ENETC node. Co-developed-by: Aziz Sellami Signed-off-by: Aziz Sellami Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Link: https://patch.msgid.link/20251119102557.1041881-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit f0054f7bb9cd334c4d56ad6a56b9c3845cd65b9b Merge: 380d19db6e6c08 f647ed2ca78ec4 Author: Jakub Kicinski Date: Tue Nov 25 17:34:01 2025 -0800 Merge branch 'improvements-over-dsa-conduit-ethtool-ops' Vladimir Oltean says: ==================== Improvements over DSA conduit ethtool ops DSA interceps 'ethtool -S eth0', where eth0 is the host port of the switch (called 'conduit'). It does this because otherwise there is no way to report port counters for the CPU port, which is a MAC like any other of that switch, except Linux exposes no net_device for it, thus no ethtool hook. Having understood all downsides of this debugging interface, when we need it we needed, so the proposed changes here are to make it more useful by dumping more counters in it: not just the switch CPU port, but all other switch ports in the tree which lack a net_device. Not reinventing any wheel, just putting more output in an existing command. That is patch 3/3. The other 2 are cleanup. ==================== Link: https://patch.msgid.link/20251122112311.138784-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit f647ed2ca78ec4efcc436915b441da9de0974926 Author: Vladimir Oltean Date: Sat Nov 22 13:23:11 2025 +0200 net: dsa: append ethtool counters of all hidden ports to conduit Currently there is no way to see packet counters on cascade ports, and no clarity on how the API for that would look like. Because it's something that is currently needed, just extend the hack where ethtool -S on the conduit interface dumps CPU port counters, and also use it to dump counters of cascade ports. Note that the "pXX_" naming convention changes to "sXX_pYY", to distinguish between ports having the same index but belonging to different switches. This has a slight chance of causing regressions to existing tooling: - grepping for "p04_counter_name" still works, but might return more than one string now - grepping for " p04_counter_name" no longer works Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251122112311.138784-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 8afabd27fe46ebf991b4aea20b74e08196c15c0c Author: Vladimir Oltean Date: Sat Nov 22 13:23:10 2025 +0200 net: dsa: use kernel data types for ethtool ops on conduit Suppress some checkpatch 'CHECK' messages about u8 being preferable over uint8_t, etc. No functional change. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251122112311.138784-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit eba81b0a6de39e2466d37e410003642282b4e546 Author: Vladimir Oltean Date: Sat Nov 22 13:23:09 2025 +0200 net: dsa: cpu_dp->orig_ethtool_ops might be NULL In theory this would have been seen by now, but it seems that all drivers used as DSA conduit interfaces thus far have had ethtool_ops set, and it's hard to even find modern Ethernet drivers (and not VF ones) which don't use ethtool. Here is the unfiltered list of drivers which register any sort of net_device but don't set its ethtool_ops pointer. I don't think any of them 'risks' being used as a DSA conduit, maybe except for moxart, rnpbge and icssm, I'm not sure. - drivers/net/can/dev/dev.c - drivers/net/wwan/qcom_bam_dmux.c - drivers/net/wwan/t7xx/t7xx_netdev.c - drivers/net/arcnet/arcnet.c - drivers/net/hamradio/ - drivers/net/slip/slip.c - drivers/net/ethernet/ezchip/nps_enet.c - drivers/net/ethernet/moxa/moxart_ether.c - drivers/net/ethernet/wangxun/txgbevf/txgbevf_main.c - drivers/net/ethernet/wangxun/ngbevf/ngbevf_main.c - drivers/net/ethernet/huawei/hinic3/hinic3_main.c - drivers/net/ethernet/i825xx/ - drivers/net/ethernet/ti/icssm/icssm_prueth.c - drivers/net/ethernet/seeq/ - drivers/net/ethernet/litex/litex_liteeth.c - drivers/net/ethernet/sunplus/spl2sw_driver.c - drivers/net/ethernet/mucse/rnpgbe/rnpgbe_main.c - drivers/net/ipa/ - drivers/net/wireless/microchip/wilc1000/ - drivers/net/wireless/mediatek/mt76/dma.c - drivers/net/wireless/ath/ath12k/ - drivers/net/wireless/ath/ath11k/ - drivers/net/wireless/ath/ath6kl/ - drivers/net/wireless/ath/ath10k/ - drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans.c - drivers/net/wireless/virtual/mac80211_hwsim.c - drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c - drivers/net/wireless/realtek/rtw89/core.c - drivers/net/wireless/realtek/rtw88/pci.c - drivers/net/caif/ - drivers/net/plip/ - drivers/net/wan/ - drivers/net/mctp/ - drivers/net/ppp/ - drivers/net/thunderbolt/ Nonetheless, it's good for the framework not to make such assumptions, and not panic when coming across such kind of host device in the future. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251122112311.138784-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 380d19db6e6c089c7d2902e02a85fd2bde3e519b Author: Alan Maguire Date: Fri Nov 21 18:12:31 2025 +0000 cxgb4: Rename sched_class to avoid type clash drivers/net/ethernet/chelsio/cxgb4/sched.h declares a sched_class struct which has a type name clash with struct sched_class in kernel/sched/sched.h (a type used in a field in task_struct). When cxgb4 is a builtin we end up with both sched_class types, and as a result of this we wind up with DWARF (and derived from that BTF) with a duplicate incorrect task_struct representation. When cxgb4 is built-in this type clash can cause kernel builds to fail as resolve_btfids will fail when confused which task_struct to use. See [1] for more details. As such, renaming sched_class to ch_sched_class (in line with other structs like ch_sched_flowc) makes sense. [1] https://lore.kernel.org/bpf/2412725b-916c-47bd-91c3-c2d57e3e6c7b@acm.org/ Reported-by: Bart Van Assche Reviewed-by: Bart Van Assche Signed-off-by: Alan Maguire Acked-by: Potnuri Bharat Teja Link: https://patch.msgid.link/20251121181231.64337-1-alan.maguire@oracle.com Signed-off-by: Jakub Kicinski commit d6eea0048bc38c259fa4121646e54e2c3bd08121 Author: Javen Xu Date: Fri Nov 21 17:01:04 2025 +0800 r8169: add support for RTL9151A This adds support for chip RTL9151A. Its XID is 0x68b. It is bascially basd on the one with XID 0x688, but with different firmware file. Signed-off-by: Javen Xu Reviewed-by: Heiner Kallweit Link: https://patch.msgid.link/20251121090104.3753-1-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski commit 5262cb23393f7e86a64d1a45eeaa8a6f99f03d10 Merge: 8f6ddc0587606c 88337b587b8b1f Author: Alexei Starovoitov Date: Tue Nov 25 15:30:14 2025 -0800 Merge branch 'general-enhancements-to-rqspinlock-stress-test' Kumar Kartikeya Dwivedi says: ==================== General enhancements to rqspinlock stress test Three enchancements, details in commit messages. First, the CPU requirements are 2 for AA, 3 for ABBA, and 4 for ABBCCA, hence relax the check during module initialization. Second, add a per-CPU histogram to capture lock acquisition times to record which buckets these acquisitions fall into for the normal task context and NMI context. Anything below 10ms is not printed in detail, but above that displays the full breakdown for each context. Finally, make the delay of the NMI and task contexts configurable, set to 10 and 20 ms respectively by default. ==================== Link: https://patch.msgid.link/20251125020749.2421610-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 88337b587b8b1f4b418638546a85d3295500dcc2 Author: Kumar Kartikeya Dwivedi Date: Tue Nov 25 02:07:49 2025 +0000 selftests/bpf: Make CS length configurable for rqspinlock stress test Allow users to configure the critical section delay for both task/normal and NMI contexts, and set to 20ms and 10ms as before by default. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251125020749.2421610-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 6173c1d6208c146af134e4a1d46f103507d60534 Author: Kumar Kartikeya Dwivedi Date: Tue Nov 25 02:07:48 2025 +0000 selftests/bpf: Add lock wait time stats to rqspinlock stress test Add statistics per-CPU broken down by context and various timing windows for the time taken to acquire an rqspinlock. Cases where all acquisitions fit into the 10ms window are skipped from printing, otherwise the full breakdown is displayed when printing the summary. This allows capturing precisely the number of times outlier attempts happened for a given lock in a given context. A critical detail is that time is captured regardless of success or failure, which is important to capture events for failed but long waiting timeout attempts. Output: [ 64.279459] rqspinlock acquisition latency histogram (ms): [ 64.279472] cpu1: total 528426 (normal 526559, nmi 1867) [ 64.279477] 0-1ms: total 524697 (normal 524697, nmi 0) [ 64.279480] 2-2ms: total 3652 (normal 1811, nmi 1841) [ 64.279482] 3-3ms: total 66 (normal 47, nmi 19) [ 64.279485] 4-4ms: total 2 (normal 1, nmi 1) [ 64.279487] 5-5ms: total 1 (normal 1, nmi 0) [ 64.279489] 6-6ms: total 1 (normal 0, nmi 1) [ 64.279490] 101-150ms: total 1 (normal 0, nmi 1) [ 64.279492] >= 251ms: total 6 (normal 2, nmi 4) ... Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251125020749.2421610-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 224de8d5a30e25570660306aeeeb738ed758ef0a Author: Kumar Kartikeya Dwivedi Date: Tue Nov 25 02:07:47 2025 +0000 selftests/bpf: Relax CPU requirements for rqspinlock stress test Only require 2 CPUs for AA, 3 for ABBA, 4 for ABBCCA, which is calculated nicely by adding to the mode enum. Enables running single CPU AA tests. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20251125020749.2421610-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 8f6ddc0587606c4be7ffcbdb20a4a99647e0c362 Author: Leon Hwang Date: Tue Nov 25 22:58:50 2025 +0800 bpf: Introduce internal bpf_map_check_op_flags helper function It is to unify map flags checking for lookup_elem, update_elem, lookup_batch and update_batch APIs. Acked-by: Andrii Nakryiko Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20251125145857.98134-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit ec95cd103c3a1e2567927014e4a710416cde3e52 Author: Viacheslav Dubeyko Date: Tue Nov 25 15:13:27 2025 -0800 hfs/hfsplus: move on-disk layout declarations into hfs_common.h Currently, HFS declares on-disk layout's metadata structures in fs/hfs/hfs.h and HFS+ declares it in fs/hfsplus/hfsplus_raw.h. However, HFS and HFS+ on-disk layouts have some similarity and overlapping in declarations. As a result, fs/hfs/hfs.h and fs/hfsplus/hfsplus_raw.h contain multiple duplicated declarations. Moreover, both HFS and HFS+ drivers contain completely similar implemented functionality in multiple places. This patch is moving the on-disk layout declarations from fs/hfs/hfs.h and fs/hfsplus/hfsplus_raw.h into include/linux/hfs_common.h with the goal to exclude the duplication in declarations. Also, this patch prepares the basis for creating a hfslib that can aggregate common functionality without necessity to duplicate the same code in HFS and HFS+ drivers. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko commit 8c868a34ea851713eca6bb90db111c7bf091b34b Author: Jianyun Gao Date: Tue Nov 18 11:30:24 2025 +0800 libbpf: Fix some incorrect @param descriptions in the comment of libbpf.h Fix up some of missing or incorrect @param descriptions for libbpf public APIs in libbpf.h. Signed-off-by: Jianyun Gao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251118033025.11804-1-jianyungao89@gmail.com commit f2cb0660ac99b093d833ddff46a0d046396d3d4c Author: Menglong Dong Date: Sun Nov 16 09:42:42 2025 +0800 selftests/bpf: Call bpf_get_numa_node_id() in trigger_count() The bench test "trig-kernel-count" can be used as a baseline comparison for fentry and other benchmarks, and the calling to bpf_get_numa_node_id() should be considered as composition of the baseline. So, let's call it in trigger_count(). Meanwhile, rename trigger_count() to trigger_kernel_count() to make it easier understand. Signed-off-by: Menglong Dong Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251116014242.151110-1-dongml2@chinatelecom.cn commit 44bf4611827b7477db188ec932b827e1fabd3ee1 Author: Alex Tran Date: Fri Nov 14 22:35:31 2025 -0800 docs: bpf: map_array: Specify BPF_MAP_TYPE_PERCPU_ARRAY value size limit Specify value size limit for BPF_MAP_TYPE_PERCPU_ARRAY which is PCPU_MIN_UNIT_SIZE (32 kb). In percpu allocator (mm: percpu), any request with a size greater than PCPU_MIN_UNIT_SIZE is rejected. Signed-off-by: Alex Tran Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251115063531.2302903-1-alex.t.tran@gmail.com commit 5b70764e10190d57e6cd3287d3a3b06f8c89f69c Author: Icenowy Zheng Date: Sun Nov 23 14:50:45 2025 -0800 riscv: dts: starfive: add Orange Pi RV Orange Pi RV is a SBC based on the StarFive VisionFive 2 board. Orange Pi RV features: - StarFive JH7110 SoC - GbE port connected to JH7110 GMAC0 via YT8531 PHY - 4x USB ports via VL805 PCIe USB controller connected to JH7110 pcie0 - M.2 M-key slot connected to JH7110 pcie1 - HDMI video output - 3.5mm audio output - Ampak AP6256 SDIO Wi-Fi/Bluetooth module on mmc0 - microSD slot on mmc1 - SPI NOR flash memory - 24c02 EEPROM (read only by default) Signed-off-by: Icenowy Zheng Signed-off-by: E Shattow [conor: amend comment to say what's missing] Signed-off-by: Conor Dooley commit d94ebab404b0ce6498770888e25102e32b2b13da Author: Icenowy Zheng Date: Sun Nov 23 14:50:44 2025 -0800 dt-bindings: riscv: starfive: add xunlong,orangepi-rv Add "xunlong,orangepi-rv" as a StarFive JH7110 SoC-based board. Signed-off-by: Icenowy Zheng Signed-off-by: E Shattow Acked-by: Conor Dooley Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit ae264ae12442a638b04db872234e3c8f0abd0f60 Author: Hal Feng Date: Tue Nov 25 15:56:04 2025 +0800 riscv: dts: starfive: Add VisionFive 2 Lite eMMC board device tree VisionFive 2 Lite eMMC board uses a non-removable onboard 64GiB eMMC instead of the MicroSD slot. Acked-by: Emil Renner Berthing Tested-by: Matthias Brugger Signed-off-by: Hal Feng Signed-off-by: Conor Dooley commit 900b32fd601b898fd569f806c87276a3a44c790b Author: Hal Feng Date: Tue Nov 25 15:56:03 2025 +0800 riscv: dts: starfive: Add VisionFive 2 Lite board device tree VisionFive 2 Lite is a mini SBC based on the StarFive JH7110S SoC. Board features: - JH7110S SoC - 4/8 GiB LPDDR4 DRAM - AXP15060 PMIC - 40 pin GPIO header - 1x USB 3.0 host port - 3x USB 2.0 host port - 1x M.2 M-Key (size: 2242) - 1x MicroSD slot (optional non-removable 64GiB eMMC) - 1x QSPI Flash - 1x I2C EEPROM - 1x 1Gbps Ethernet port - SDIO-based Wi-Fi & UART-based Bluetooth - 1x HDMI port - 1x 2-lane DSI - 1x 2-lane CSI VisionFive 2 Lite schematics: https://doc-en.rvspace.org/VisionFive2Lite/PDF/VF2_LITE_V1.10_TF_20250818_SCH.pdf VisionFive 2 Lite Quick Start Guide: https://doc-en.rvspace.org/VisionFive2Lite/VisionFive2LiteQSG/index.html More documents: https://doc-en.rvspace.org/Doc_Center/visionfive_2_lite.html Acked-by: Emil Renner Berthing Tested-by: Matthias Brugger Signed-off-by: Hal Feng Signed-off-by: Conor Dooley commit 2ad6d71a0de8b44e6803f11936398b55643c81aa Author: Hal Feng Date: Tue Nov 25 15:56:02 2025 +0800 riscv: dts: starfive: Add common board dtsi for VisionFive 2 Lite variants Add a common board dtsi for use by VisionFive 2 Lite and VisionFive 2 Lite eMMC. Acked-by: Emil Renner Berthing Tested-by: Matthias Brugger Signed-off-by: Hal Feng Signed-off-by: Conor Dooley commit 84853940a7337cdb76a397d167eeabbb2252af23 Author: Hal Feng Date: Tue Nov 25 15:56:01 2025 +0800 riscv: dts: starfive: jh7110-common: Move out some nodes to the board dts Some node in this file are not used by the upcoming VisionFive 2 Lite board. Move them to the board dts to prepare for adding the new VisionFive 2 Lite device tree. Tested-by: Matthias Brugger Signed-off-by: Hal Feng Signed-off-by: Conor Dooley commit 7a1e15b248d69a5399c41e65731573d63b12f345 Author: Hal Feng Date: Tue Nov 25 15:56:00 2025 +0800 dt-bindings: riscv: Add StarFive JH7110S SoC and VisionFive 2 Lite board Add device tree bindings for the StarFive JH7110S SoC and the VisionFive 2 Lite board equipped with it. JH7110S SoC is an industrial SoC which can run at -40~85 degrees centigrade and up to 1.25GHz. Its CPU cores and peripherals are the same as those of the JH7110 SoC. VisionFive 2 Lite boards have MicroSD card version (default) and eMMC version, which are called "VisionFive 2 Lite" and "VisionFive 2 Lite eMMC" respectively. Acked-by: Rob Herring (Arm) Tested-by: Matthias Brugger Reviewed-by: Heinrich Schuchardt Signed-off-by: Hal Feng Signed-off-by: Conor Dooley commit 56dfdf2da1cf6261eaeb4259dee27201f2800691 Author: Conor Dooley Date: Sun Nov 23 18:53:43 2025 +0000 MAINTAINERS: degrade RISC-V MISC SOC SUPPORT to Odd Fixes The SiFive and Canaan platforms are not being actively looked after at this point, but fixes for them would be applied if/when the patches appeared. Since they're now the only things in the RISC-V MISC SOC SUPPORT, mark them as Odd Fixes. I don't believe this is a functional change, it just represents what's actually happening - particularly since the Canaan k230 never built up enough steam to get merged and the new SiFive demo chips have been done in partnership with with other companies, e.g. Eswin, and will reside in their directories instead. Reviewed-by: Paul Walmsley Signed-off-by: Conor Dooley commit 76cc0ba2af91c88d36adb4d0a3d5529726353051 Author: Conor Dooley Date: Sun Nov 23 18:53:42 2025 +0000 MAINTAINERS: add tree to RISC-V Microchip entry In fairness to my own employer, lumping it in as "misc" is not quite accurate when they do pay me to look after the platform. Move the tree link for it to its entry, rather than having the RISC-V MISC SOC SUPPORT entry cover it. Signed-off-by: Conor Dooley commit d794a761c77b8b611b44e3a6a7556e1050506c4a Author: Conor Dooley Date: Sun Nov 23 18:53:41 2025 +0000 MAINTAINERS: remove patchwork from RISC-V MISC SOC SUPPORT I don't use the main riscv patchwork for anything to do with SoCs, remove them from here to avoid confusion. Signed-off-by: Conor Dooley commit d15cd50d14446ceecd299be0c904c06b8b49a44b Author: Conor Dooley Date: Sun Nov 23 18:53:40 2025 +0000 MAINTAINERS: add Conor to StarFive entry I apply the patches for StarFive devicetrees, add me to the entry along with my tree location etc. This is not a functional change, as this info was in the "RISC-V MISC" entry but I'd rather not have the duplication of entries covering the StarFive directory. Acked-by: Emil Renner Berthing Signed-off-by: Conor Dooley commit 8ae28d04593a5fdddb16d3edcdabb8d1e4330d0b Author: Alexander Stein Date: Tue Nov 25 11:13:33 2025 +0100 ASoC: fsl_xcvr: use dev_err_probe() replacing dev_err() + return Use dev_err_probe() to simplify the code. This also silences -517 errors. Signed-off-by: Alexander Stein Link: https://patch.msgid.link/20251125101334.1596381-1-alexander.stein@ew.tq-group.com Signed-off-by: Mark Brown commit 9d6c58dae8f6590c746ac5d0012ffe14a77539f0 Author: Cryolitia PukNgae Date: Tue Nov 25 16:14:38 2025 +0800 ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("ACPICA: Avoid walking the ACPI Namespace if it is not there") fixed the situation when both start_node and acpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed on Honor Magicbook 14 Pro [1]. That happens due to the access to the member of parent_node in acpi_ns_get_next_node(). The NULL pointer dereference will always happen, no matter whether or not the start_node is equal to ACPI_ROOT_OBJECT, so move the check of start_node being NULL out of the if block. Unfortunately, all the attempts to contact Honor have failed, they refused to provide any technical support for Linux. The bad DSDT table's dump could be found on GitHub [2]. DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025 Link: https://github.com/acpica/acpica/commit/1c1b57b9eba4554cb132ee658dd942c0210ed20d Link: https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7 [1] Link: https://github.com/denis-bb/honor-fmb-p-dsdt [2] Signed-off-by: Cryolitia PukNgae Reviewed-by: WangYuli [ rjw: Subject adjustment, changelog edits ] Link: https://patch.msgid.link/20251125-acpica-v1-1-99e63b1b25f8@linux.dev Signed-off-by: Rafael J. Wysocki commit 3f04ee216bc1406cb6214ceaa7e544114108e0fa Author: Viacheslav Dubeyko Date: Wed Nov 19 14:32:20 2025 -0800 hfsplus: fix volume corruption issue for generic/101 The xfstests' test-case generic/101 leaves HFS+ volume in corrupted state: sudo ./check generic/101 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/101 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent (see XFSTESTS-2/xfstests-dev/results//generic/101.full for details) Ran: generic/101 Failures: generic/101 Failed 1 of 1 tests sudo fsck.hfsplus -d /dev/loop51 ** /dev/loop51 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. Invalid volume free block count (It should be 2614350 instead of 2614382) Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000 CBTStat = 0x0000 CatStat = 0x00000000 ** Repairing volume. ** Rechecking volume. ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled was repaired successfully. This test executes such steps: "Test that if we truncate a file to a smaller size, then truncate it to its original size or a larger size, then fsyncing it and a power failure happens, the file will have the range [first_truncate_size, last_size[ with all bytes having a value of 0x00 if we read it the next time the filesystem is mounted.". HFS+ keeps volume's free block count in the superblock. However, hfsplus_file_fsync() doesn't store superblock's content. As a result, superblock contains not correct value of free blocks if a power failure happens. This patch adds functionality of saving superblock's content during hfsplus_file_fsync() call. sudo ./check generic/101 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc3+ #96 SMP PREEMPT_DYNAMIC Wed Nov 19 12:47:37 PST 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/101 32s ... 30s Ran: generic/101 Passed all 1 tests sudo fsck.hfsplus -d /dev/loop51 ** /dev/loop51 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled appears to be OK. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20251119223219.1824434-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 7d09a8e25121a20214558d013b31e17ff84b004d Author: Chaitanya Kulkarni Date: Mon Nov 24 15:48:01 2025 -0800 block: ignore __blkdev_issue_discard() return value __blkdev_issue_discard() always returns 0, making the error check in blkdev_issue_discard() dead code. In function blkdev_issue_discard() initialize ret = 0, remove ret assignment from __blkdev_issue_discard(), rely on bio == NULL check to call submit_bio_wait(), preserve submit_bio_wait() error handling, and preserve -EOPNOTSUPP to 0 mapping. Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Martin K. Petersen Signed-off-by: Chaitanya Kulkarni Reviewed-by: Anuj Gupta Signed-off-by: Jens Axboe commit 653fda7ae73d8033dedb65537acac0c2c287dc3f Author: Thomas Gleixner Date: Wed Nov 19 18:27:22 2025 +0100 sched/mmcid: Switch over to the new mechanism Now that all pieces are in place, change the implementations of sched_mm_cid_fork() and sched_mm_cid_exit() to adhere to the new strict ownership scheme and switch context_switch() over to use the new mm_cid_schedin() functionality. The common case is that there is no mode change required, which makes fork() and exit() just update the user count and the constraints. In case that a new user would exceed the CID space limit the fork() context handles the transition to per CPU mode with mm::mm_cid::mutex held. exit() handles the transition back to per task mode when the user count drops below the switch back threshold. fork() might also be forced to handle a deferred switch back to per task mode, when a affinity change increased the number of allowed CPUs enough. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172550.280380631@linutronix.de commit 9da6ccbcea3de1fa704202e3346fe6c0226bfc18 Author: Thomas Gleixner Date: Wed Nov 19 18:27:20 2025 +0100 sched/mmcid: Implement deferred mode change When affinity changes cause an increase of the number of CPUs allowed for tasks which are related to a MM, that might results in a situation where the ownership mode can go back from per CPU mode to per task mode. As affinity changes happen with runqueue lock held there is no way to do the actual mode change and required fixup right there. Add the infrastructure to defer it to a workqueue. The scheduled work can race with a fork() or exit(). Whatever happens first takes care of it. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172550.216484739@linutronix.de commit c809f081fe400cb1b9898f4791c0d33146315161 Author: Thomas Gleixner Date: Wed Nov 19 18:27:18 2025 +0100 irqwork: Move data struct to a types header ... to avoid header recursion hell. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172550.152813625@linutronix.de commit fbd0e71dc370af73f6b316e4de9eed273dd90340 Author: Thomas Gleixner Date: Wed Nov 19 18:27:16 2025 +0100 sched/mmcid: Provide CID ownership mode fixup functions CIDs are either owned by tasks or by CPUs. The ownership mode depends on the number of tasks related to a MM and the number of CPUs on which these tasks are theoretically allowed to run on. Theoretically because that number is the superset of CPU affinities of all tasks which only grows and never shrinks. Switching to per CPU mode happens when the user count becomes greater than the maximum number of CIDs, which is calculated by: opt_cids = min(mm_cid::nr_cpus_allowed, mm_cid::users); max_cids = min(1.25 * opt_cids, nr_cpu_ids); The +25% allowance is useful for tight CPU masks in scenarios where only a few threads are created and destroyed to avoid frequent mode switches. Though this allowance shrinks, the closer opt_cids becomes to nr_cpu_ids, which is the (unfortunate) hard ABI limit. At the point of switching to per CPU mode the new user is not yet visible in the system, so the task which initiated the fork() runs the fixup function: mm_cid_fixup_tasks_to_cpu() walks the thread list and either transfers each tasks owned CID to the CPU the task runs on or drops it into the CID pool if a task is not on a CPU at that point in time. Tasks which schedule in before the task walk reaches them do the handover in mm_cid_schedin(). When mm_cid_fixup_tasks_to_cpus() completes it's guaranteed that no task related to that MM owns a CID anymore. Switching back to task mode happens when the user count goes below the threshold which was recorded on the per CPU mode switch: pcpu_thrs = min(opt_cids - (opt_cids / 4), nr_cpu_ids / 2); This threshold is updated when a affinity change increases the number of allowed CPUs for the MM, which might cause a switch back to per task mode. If the switch back was initiated by a exiting task, then that task runs the fixup function. If it was initiated by a affinity change, then it's run either in the deferred update function in context of a workqueue or by a task which forks a new one or by a task which exits. Whatever happens first. mm_cid_fixup_cpus_to_task() walks through the possible CPUs and either transfers the CPU owned CIDs to a related task which runs on the CPU or drops it into the pool. Tasks which schedule in on a CPU which the walk did not cover yet do the handover themselves. This transition from CPU to per task ownership happens in two phases: 1) mm:mm_cid.transit contains MM_CID_TRANSIT. This is OR'ed on the task CID and denotes that the CID is only temporarily owned by the task. When it schedules out the task drops the CID back into the pool if this bit is set. 2) The initiating context walks the per CPU space and after completion clears mm:mm_cid.transit. After that point the CIDs are strictly task owned again. This two phase transition is required to prevent CID space exhaustion during the transition as a direct transfer of ownership would fail if two tasks are scheduled in on the same CPU before the fixup freed per CPU CIDs. When mm_cid_fixup_cpus_to_tasks() completes it's guaranteed that no CID related to that MM is owned by a CPU anymore. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172550.088189028@linutronix.de commit 9a723ed7facff6955da8d64cc9de7066038036c1 Author: Thomas Gleixner Date: Wed Nov 19 18:27:14 2025 +0100 sched/mmcid: Provide new scheduler CID mechanism The MM CID management has two fundamental requirements: 1) It has to guarantee that at no given point in time the same CID is used by concurrent tasks in userspace. 2) The CID space must not exceed the number of possible CPUs in a system. While most allocators (glibc, tcmalloc, jemalloc) do not care about that, there seems to be at least some LTTng library depending on it. The CID space compaction itself is not a functional correctness requirement, it is only a useful optimization mechanism to reduce the memory foot print in unused user space pools. The optimal CID space is: min(nr_tasks, nr_cpus_allowed); Where @nr_tasks is the number of actual user space threads associated to the mm and @nr_cpus_allowed is the superset of all task affinities. It is growth only as it would be insane to take a racy snapshot of all task affinities when the affinity of one task changes just do redo it 2 milliseconds later when the next task changes it's affinity. That means that as long as the number of tasks is lower or equal than the number of CPUs allowed, each task owns a CID. If the number of tasks exceeds the number of CPUs allowed it switches to per CPU mode, where the CPUs own the CIDs and the tasks borrow them as long as they are scheduled in. For transition periods CIDs can go beyond the optimal space as long as they don't go beyond the number of possible CPUs. The current upstream implementation adds overhead into task migration to keep the CID with the task. It also has to do the CID space consolidation work from a task work in the exit to user space path. As that work is assigned to a random task related to a MM this can inflict unwanted exit latencies. Implement the context switch parts of a strict ownership mechanism to address this. This removes most of the work from the task which schedules out. Only during transitioning from per CPU to per task ownership it is required to drop the CID when leaving the CPU to prevent CID space exhaustion. Other than that scheduling out is just a single check and branch. The task which schedules in has to check whether: 1) The ownership mode changed 2) The CID is within the optimal CID space In stable situations this results in zero work. The only short disruption is when ownership mode changes or when the associated CID is not in the optimal CID space. The latter only happens when tasks exit and therefore the optimal CID space shrinks. That mechanism is strictly optimized for the common case where no change happens. The only case where it actually causes a temporary one time spike is on mode changes when and only when a lot of tasks related to a MM schedule exactly at the same time and have eventually to compete on allocating a CID from the bitmap. In the sysbench test case which triggered the spinlock contention in the initial CID code, __schedule() drops significantly in perf top on a 128 Core (256 threads) machine when running sysbench with 255 threads, which fits into the task mode limit of 256 together with the parent thread: Upstream rseq/perf branch +CID rework 0.42% 0.37% 0.32% [k] __schedule Increasing the number of threads to 256, which puts the test process into per CPU mode looks about the same. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172550.023984859@linutronix.de commit 23343b6b09acb4bf97f34ed60e135000ca57ede1 Author: Thomas Gleixner Date: Wed Nov 19 18:27:12 2025 +0100 sched/mmcid: Introduce per task/CPU ownership infrastructure The MM CID management has two fundamental requirements: 1) It has to guarantee that at no given point in time the same CID is used by concurrent tasks in userspace. 2) The CID space must not exceed the number of possible CPUs in a system. While most allocators (glibc, tcmalloc, jemalloc) do not care about that, there seems to be at least librseq depending on it. The CID space compaction itself is not a functional correctness requirement, it is only a useful optimization mechanism to reduce the memory foot print in unused user space pools. The optimal CID space is: min(nr_tasks, nr_cpus_allowed); Where @nr_tasks is the number of actual user space threads associated to the mm and @nr_cpus_allowed is the superset of all task affinities. It is growth only as it would be insane to take a racy snapshot of all task affinities when the affinity of one task changes just do redo it 2 milliseconds later when the next task changes its affinity. That means that as long as the number of tasks is lower or equal than the number of CPUs allowed, each task owns a CID. If the number of tasks exceeds the number of CPUs allowed it switches to per CPU mode, where the CPUs own the CIDs and the tasks borrow them as long as they are scheduled in. For transition periods CIDs can go beyond the optimal space as long as they don't go beyond the number of possible CPUs. The current upstream implementation adds overhead into task migration to keep the CID with the task. It also has to do the CID space consolidation work from a task work in the exit to user space path. As that work is assigned to a random task related to a MM this can inflict unwanted exit latencies. This can be done differently by implementing a strict CID ownership mechanism. Either the CIDs are owned by the tasks or by the CPUs. The latter provides less locality when tasks are heavily migrating, but there is no justification to optimize for overcommit scenarios and thereby penalizing everyone else. Provide the basic infrastructure to implement this: - Change the UNSET marker to BIT(31) from ~0U - Add the ONCPU marker as BIT(30) - Add the TRANSIT marker as BIT(29) That allows to check for ownership trivially and provides a simple check for UNSET as well. The TRANSIT marker is required to prevent CID space exhaustion when switching from per CPU to per task mode. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251119172549.960252358@linutronix.de commit 51dd92c71a38647803478fb81e1812286a8998b1 Author: Thomas Gleixner Date: Wed Nov 19 18:27:11 2025 +0100 sched/mmcid: Serialize sched_mm_cid_fork()/exit() with a mutex Prepare for the new CID management scheme which puts the CID ownership transition into the fork() and exit() slow path by serializing sched_mm_cid_fork()/exit() with it, so task list and cpu mask walks can be done in interruptible and preemptible code. The contention on it is not worse than on other concurrency controls in the fork()/exit() machinery. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.895826703@linutronix.de commit b0c3d51b54f8a4f4c809432d210c0c983d5cd97e Author: Thomas Gleixner Date: Wed Nov 19 18:27:09 2025 +0100 sched/mmcid: Provide precomputed maximal value Reading mm::mm_users and mm:::mm_cid::nr_cpus_allowed every time to compute the maximal CID value is just wasteful as that value is only changing on fork(), exit() and eventually when the affinity changes. So it can be easily precomputed at those points and provided in mm::mm_cid for consumption in the hot path. But there is an issue with using mm::mm_users for accounting because that does not necessarily reflect the number of user space tasks as other kernel code can take temporary references on the MM which skew the picture. Solve that by adding a users counter to struct mm_mm_cid, which is modified by fork() and exit() and used for precomputing under mm_mm_cid::lock. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.832764634@linutronix.de commit bf070520e398679cd582b3c3e44107bf22c143ba Author: Thomas Gleixner Date: Wed Nov 19 18:27:07 2025 +0100 sched/mmcid: Move initialization out of line It's getting bigger soon, so just move it out of line to the rest of the code. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.769636491@linutronix.de commit 2b1642b881088bbf73fcb1147c474a198ec46729 Author: Thomas Gleixner Date: Wed Nov 19 18:27:05 2025 +0100 signal: Move MMCID exit out of sighand lock There is no need anymore to keep this under sighand lock as the current code and the upcoming replacement are not depending on the exit state of a task anymore. That allows to use a mutex in the exit path. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.706439391@linutronix.de commit 539115f08cf850b9fdc6526b31da0839ff6c1631 Author: Thomas Gleixner Date: Wed Nov 19 18:27:03 2025 +0100 sched/mmcid: Convert mm CID mask to a bitmap This is truly a bitmap and just conveniently uses a cpumask because the maximum size of the bitmap is nr_cpu_ids. But that prevents to do searches for a zero bit in a limited range, which is helpful to provide an efficient mechanism to consolidate the CID space when the number of users decreases. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Mathieu Desnoyers Acked-by: Yury Norov (NVIDIA) Link: https://patch.msgid.link/20251119172549.642866767@linutronix.de commit 35a5c37cb9f1f947dff18e7cfc75a8cfcfd557ca Author: Thomas Gleixner Date: Wed Nov 19 18:27:01 2025 +0100 cpumask: Cache num_possible_cpus() Reevaluating num_possible_cpus() over and over does not make sense. That becomes a constant after init as cpu_possible_mask is marked ro_after_init. Cache the value during initialization and provide that for consumption. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Reviewed-by: Yury Norov Reviewed-by: Mathieu Desnoyers Reviewed-by: Shrikanth Hegde Link: https://patch.msgid.link/20251119172549.578653738@linutronix.de commit b442e7c4052fc7684350d1075e6e7655ef30bb57 Merge: 84b7344c05c5e4 3a03de36297539 Author: Mark Brown Date: Tue Nov 25 18:39:04 2025 +0000 ASoC: stm32: sai: fix device and OF node leaks on Merge series from Johan Hovold : This series fixes device and OF node reference leaks during probe and a clock prepare imbalance on probe failures. Included is a related cleanup of an error path. commit 7ef502fb35b283e0f85ed7b34e2d963343981a8c Author: Claudiu Beznea Date: Wed Nov 19 16:35:19 2025 +0200 PCI: Add Renesas RZ/G3S host controller driver The Renesas RZ/G3S features a PCIe IP that complies with the PCI Express Base Specification 4.0 and supports speeds of up to 5 GT/s. It functions only as a root complex, with a single-lane (x1) configuration. The controller includes Type 1 configuration registers, as well as IP specific registers (called AXI registers) required for various adjustments. Hardware manual can be downloaded from the address in the "Link" section. The following steps should be followed to access the manual: 1/ Click the "User Manual" button 2/ Click "Confirm"; this will start downloading an archive 3/ Open the downloaded archive 4/ Navigate to r01uh1014ej*-rzg3s-users-manual-hardware -> Deliverables 5/ Open the file r01uh1014ej*-rzg3s.pdf Signed-off-by: Claudiu Beznea Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Wolfram Sang Link: https://www.renesas.com/en/products/rz-g3s?queryID=695cc067c2d89e3f271d43656ede4d12 Link: https://patch.msgid.link/20251119143523.977085-3-claudiu.beznea.uj@bp.renesas.com commit 4bf944f3fcb6c192af1ea73e3d183b6364458b25 Author: Rafael J. Wysocki Date: Tue Nov 25 17:23:12 2025 +0100 cpuidle: Warn instead of bailing out if target residency check fails It turns out that the change in commit 76934e495cdc ("cpuidle: Add sanity check for exit latency and target residency") goes too far because there are systems in the field on which the check introduced by that commit does not pass. For this reason, change __cpuidle_driver_init() return type back to void and make it print a warning when the check mentioned above does not pass. Fixes: 76934e495cdc ("cpuidle: Add sanity check for exit latency and target residency") Reported-by: Val Packett Closes: https://lore.kernel.org/linux-pm/20251121010756.6687-1-val@packett.cool/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/2808566.mvXUDI8C0e@rafael.j.wysocki commit 6d96ceff9aeb7e7a1713faaccf472f363cc6d48f Author: Andy Shevchenko Date: Mon Nov 24 21:57:52 2025 +0100 cpuidle: Update header inclusion While cleaning up some headers, I got a build error on this file: drivers/cpuidle/poll_state.c:52:2: error: call to undeclared library function 'snprintf' with type 'int (char *restrict, unsigned long, const char *restrict, ...)'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251124205752.1328701-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit c19dfb267c28032293515a635eaefbf9194629ac Author: Ulf Hansson Date: Tue Nov 25 12:26:47 2025 +0100 Documentation: power/cpuidle: Document the CPU system wakeup latency QoS Let's document how the new CPU system wakeup latency QoS limit can be used from user space, along with how the constraint is taken into account for s2idle and cpuidle. Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman (TI) Tested-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20251125112650.329269-7-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit 2b8d594742398cdbf40012c0b3c8b71ca160e22d Author: Ulf Hansson Date: Tue Nov 25 12:26:46 2025 +0100 cpuidle: Respect the CPU system wakeup QoS limit for cpuidle The CPU system wakeup QoS limit must be respected for the regular cpuidle state selection. Therefore, let's extend the common governor helper cpuidle_governor_latency_req(), to take the constraint into account. Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman (TI) Tested-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20251125112650.329269-6-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit 99b42445f4a4aaff75eca24dfc9e6e376292dd48 Author: Ulf Hansson Date: Tue Nov 25 12:26:45 2025 +0100 sched: idle: Respect the CPU system wakeup QoS limit for s2idle A CPU system wakeup QoS limit may have been requested by user space. To avoid breaking this constraint when entering a low power state during s2idle, let's start to take into account the QoS limit. Acked-by: Peter Zijlstra (Intel) Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman (TI) Tested-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20251125112650.329269-5-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit e2e4695f015eacbe11178540524438f631ba9413 Author: Ulf Hansson Date: Tue Nov 25 12:26:44 2025 +0100 pmdomain: Respect the CPU system wakeup QoS limit for cpuidle The CPU system wakeup QoS limit must be respected for the regular cpuidle state selection. Therefore, let's extend the genpd governor for CPUs to take the constraint into account when it selects a domain idle state for the corresponding PM domain. Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman (TI) Tested-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20251125112650.329269-4-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit 8e7de6dc420979f4e4443807b71dcc8b72d8c4a9 Author: Ulf Hansson Date: Tue Nov 25 12:26:43 2025 +0100 pmdomain: Respect the CPU system wakeup QoS limit for s2idle A CPU system wakeup QoS limit may have been requested by user space. To avoid breaking this constraint when entering a low power state during s2idle through genpd, let's extend the corresponding genpd governor for CPUs. More precisely, during s2idle let the genpd governor select a suitable domain idle state, by taking into account the QoS limit. Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman (TI) Tested-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20251125112650.329269-3-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit a4e6512a79d8486dccf3e8b066e5d6bd5ff95446 Author: Ulf Hansson Date: Tue Nov 25 12:26:42 2025 +0100 PM: QoS: Introduce a CPU system wakeup QoS limit Some platforms supports multiple low power states for CPUs that can be used when entering system-wide suspend. Currently we are always selecting the deepest possible state for the CPUs, which can break the system wakeup latency constraint that may be required for a use case. Let's take the first step towards addressing this problem, by introducing an interface for user space, that allows us to specify the CPU system wakeup QoS limit. Subsequent changes will start taking into account the new QoS limit. Reviewed-by: Dhruva Gole Reviewed-by: Kevin Hilman (TI) Tested-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20251125112650.329269-2-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit 3a64c46c40460386aeca6e8698076d1207aeaf44 Author: shechenglong Date: Mon Nov 24 10:02:58 2025 +0800 block: fix typos in comments and strings in blk-core This patch fixes multiple spelling mistakes in comments and documentation in the file block/blk-core.c. No functional changes intended. Suggested-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: shechenglong Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit a74de0c3663cf5cf568025e964524a5f875e4bfc Author: John Garry Date: Tue Nov 25 16:11:13 2025 +0000 block: Remove references to __device_add_disk() Since commit d1254a874971 ("block: remove support for delayed queue registrations"), function __device_add_disk() has been replaced with device_add_disk(), so fix up comments. Signed-off-by: John Garry Signed-off-by: Jens Axboe commit ed26bd40df11ee438d623adc9c6cc2a7bf9c5dd3 Author: Pratyush Yadav Date: Tue Nov 25 18:16:53 2025 +0100 mailmap: update Pratyush Yadav's email address I will stop having access to my Amazon email soon. Map it to my kernel email. Signed-off-by: Pratyush Yadav commit 3a03de362975398b39d4c6df7325ccb982026a8f Author: Johan Hovold Date: Mon Nov 24 11:49:08 2025 +0100 ASoC: stm32: sai: clean up probe error path Use an error label for deregistering also the PCM DMA for consistency. Signed-off-by: Johan Hovold Reviewed-by: olivier moysan Link: https://patch.msgid.link/20251124104908.15754-5-johan@kernel.org Signed-off-by: Mark Brown commit 23261f0de09427367e99f39f588e31e2856a690e Author: Johan Hovold Date: Mon Nov 24 11:49:07 2025 +0100 ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe. Make sure to drop the reference on platform probe failures (e.g. probe deferral) and on driver unbind. This also avoids a potential use-after-free in case the DAI is ever reprobed without first rebinding the platform driver. Fixes: 5914d285f6b7 ("ASoC: stm32: sai: Add synchronization support") Fixes: d4180b4c02e7 ("ASoC: stm32: sai: fix set_sync service") Cc: Olivier Moysan Cc: stable@vger.kernel.org # 4.16: d4180b4c02e7 Signed-off-by: Johan Hovold Reviewed-by: olivier moysan Link: https://patch.msgid.link/20251124104908.15754-4-johan@kernel.org Signed-off-by: Mark Brown commit 312ec2f0d9d1a5656f76d770bbf1d967e9289aa7 Author: Johan Hovold Date: Mon Nov 24 11:49:06 2025 +0100 ASoC: stm32: sai: fix clk prepare imbalance on probe failure Make sure to unprepare the parent clock also on probe failures (e.g. probe deferral). Fixes: a14bf98c045b ("ASoC: stm32: sai: fix possible circular locking") Cc: stable@vger.kernel.org # 5.5 Cc: Olivier Moysan Signed-off-by: Johan Hovold Reviewed-by: olivier moysan Link: https://patch.msgid.link/20251124104908.15754-3-johan@kernel.org Signed-off-by: Mark Brown commit e26ff429eaf10c4ef1bc3dabd9bf27eb54b7e1f4 Author: Johan Hovold Date: Mon Nov 24 11:49:05 2025 +0100 ASoC: stm32: sai: fix device leak on probe Make sure to drop the reference taken when looking up the sync provider device and its driver data during DAI probe on probe failures and on unbind. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: 7dd0d835582f ("ASoC: stm32: sai: simplify sync modes management") Fixes: 1c3816a19487 ("ASoC: stm32: sai: add missing put_device()") Cc: stable@vger.kernel.org # 4.16: 1c3816a19487 Cc: olivier moysan Cc: Wen Yang Signed-off-by: Johan Hovold Reviewed-by: olivier moysan Link: https://patch.msgid.link/20251124104908.15754-2-johan@kernel.org Signed-off-by: Mark Brown commit 5583a55e074b33ccd88ac0542fd7cd656a7e2c8c Author: Stephan Gerhold Date: Thu Aug 21 10:33:53 2025 +0200 iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Some platforms (e.g. SC8280XP and X1E) support more than 128 stream matching groups. This is more than what is defined as maximum by the ARM SMMU architecture specification. Commit 122611347326 ("iommu/arm-smmu-qcom: Limit the SMR groups to 128") disabled use of the additional groups because they don't exhibit the same behavior as the architecture supported ones. It seems like this is just another quirk of the hypervisor: When running bare-metal without the hypervisor, the additional groups appear to behave just like all others. The boot firmware uses some of the additional groups, so ignoring them in this situation leads to stream match conflicts whenever we allocate a new SMR group for the same SID. The workaround exists primarily because the bypass quirk detection fails when using a S2CR register from the additional matching groups, so let's perform the test with the last reliable S2CR (127) and then limit the number of SMR groups only if we detect that we are running below the hypervisor (because of the bypass quirk). Fixes: 122611347326 ("iommu/arm-smmu-qcom: Limit the SMR groups to 128") Signed-off-by: Stephan Gerhold Signed-off-by: Will Deacon commit 84b7344c05c5e48db4cf75cd3e91aef8d553d88e Author: Geert Uytterhoeven Date: Tue Nov 25 17:06:56 2025 +0100 spi: microchip: Enable compile-testing for FPGA SPI controllers The Microchip FPGA SPI controller driver builds fine on other platforms. While at it, drop a superfluous empty line. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/6f96848b026f9a343b80d48179149b30c6b76d1d.1764086805.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 30a8e0a32e7c52c75208aaf5243414b1a6930e6d Merge: ac3fd01e4c1efc 059835bbfa2829 Author: Rafael J. Wysocki Date: Tue Nov 25 17:11:45 2025 +0100 Merge tag 'linux-cpupower-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull a cpupower utility update for 6.19-rc1 from Shuah Khan: "Adds support for building libcpupower statically when STATIC=true is specified during build." * tag 'linux-cpupower-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: tools/power/cpupower: Support building libcpupower statically commit 8dfa8bb6525453f7b63379be54738440d7c908ea Merge: ac3fd01e4c1efc 33ffb0aa8ce8b1 Author: Rafael J. Wysocki Date: Tue Nov 25 17:08:06 2025 +0100 Merge tag 'opp-updates-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP updates for 6.19 from Viresh Kumar: "- Minor improvements to the Rust interface (Tamir Duberstein). - Fixes to scope-based pointers (Viresh Kumar)." * tag 'opp-updates-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: rust: opp: simplify callers of `to_c_str_array` OPP: Initialize scope-based pointers inline rust: opp: fix broken rustdoc link commit ded4feb14d222ff77b94c09629eae2882693247d Merge: 1b541e10eea6ec c3852d2ca46503 Author: Rafael J. Wysocki Date: Tue Nov 25 17:06:04 2025 +0100 Merge tag 'cpufreq-arm-updates-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull CPUFreq updates for 6.19 from Viresh Kumar: "- tegra186: Add OPP / bandwidth support for Tegra186 (Aaron Kling). - Minor improvements to various cpufreq drivers (Christian Marangi, Hal Feng, Jie Zhan, Marco Crivellari, Miaoqian Lin, and Shuhao Fu)." * tag 'cpufreq-arm-updates-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: cpufreq: qcom-nvmem: fix compilation warning for qcom_cpufreq_ipq806x_match_list cpufreq: tegra194: add WQ_PERCPU to alloc_workqueue users cpufreq: qcom-nvmem: add compatible fallback for ipq806x for no SMEM cpufreq: CPPC: Don't warn if FIE init fails to read counters cpufreq: nforce2: fix reference count leak in nforce2 cpufreq: tegra186: add OPP support and set bandwidth cpufreq: dt-platdev: Add JH7110S SOC to the allowlist cpufreq: s5pv210: fix refcount leak commit 67a7bc7f0358bf619d314b5b6c1f06b35931f12c Author: Rob Herring (Arm) Date: Mon Nov 24 12:27:47 2025 -0600 remoteproc: Use of_reserved_mem_region_* functions for "memory-region" Use the newly added of_reserved_mem_region_to_resource() and of_reserved_mem_region_count() functions to handle "memory-region" properties. The error handling is a bit different in some cases. Often "memory-region" is optional, so failed lookup is not an error. But then an error in of_reserved_mem_lookup() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Acked-by: Arnaud Pouliquen Tested-by: Peng Fan # i.MX93-11x11-EVK for imx_rproc.c Reviewed-by: Geert Uytterhoeven # rcar Tested-by: Beleswar Padhi # TI Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251124182751.507624-1-robh@kernel.org Signed-off-by: Mathieu Poirier commit d2041f1f11dd99076010841a86c4d02d04650814 Author: Jason Gunthorpe Date: Fri Nov 21 11:51:06 2025 -0400 iommufd/selftest: Add some tests for the dmabuf flow Basic tests of establishing a dmabuf and revoking it. The selftest kernel side provides a basic small dmabuf for this testing. Link: https://patch.msgid.link/r/9-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 44ebaa1744fd79cd86d10f5453c90b8c4e22b7f4 Author: Jason Gunthorpe Date: Fri Nov 21 11:51:05 2025 -0400 iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE Finally call iopt_alloc_dmabuf_pages() if the user passed in a DMABUF through IOMMU_IOAS_MAP_FILE. This makes the feature visible to userspace. Link: https://patch.msgid.link/r/8-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit 217725f0b2c31d8328fe92b35ae4b38c102a846f Author: Jason Gunthorpe Date: Fri Nov 21 11:51:04 2025 -0400 iommufd: Have iopt_map_file_pages convert the fd to a file Since dmabuf only has APIs that work on an int fd and not a struct file *, pass the fd deeper into the call chain so we can use the dmabuf APIs as is. Link: https://patch.msgid.link/r/7-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit 74014a4b55f5df935977368efe09d650e22495f0 Author: Jason Gunthorpe Date: Fri Nov 21 11:51:03 2025 -0400 iommufd: Have pfn_reader process DMABUF iopt_pages Make another sub implementation of pfn_reader for DMABUF. This version will fill the batch using the struct phys_vec recorded during the attachment. Link: https://patch.msgid.link/r/6-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit 3114c674401e81b6b56da2f9f0762eb99ae8ceba Author: Jason Gunthorpe Date: Fri Nov 21 11:51:02 2025 -0400 iommufd: Allow MMIO pages in a batch Addresses intended for MMIO should be propagated through to the iommu with the IOMMU_MMIO flag set. Keep track in the batch if all the pfns are cachable or mmio and flush the batch out of it ever needs to be changed. Switch to IOMMU_MMIO if the batch is MMIO when mapping the iommu. Link: https://patch.msgid.link/r/5-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit fc7063abd98e8477c47b792324785ef60c071b9e Author: Jason Gunthorpe Date: Fri Nov 21 11:51:01 2025 -0400 iommufd: Allow a DMABUF to be revoked When connected to VFIO, the only DMABUF exporter that is accepted, the move_notify callback will be made when VFIO wants to remove access to the MMIO. This is being called revoke. Wire up revoke to go through all the iommu_domain's that have mapped the DMABUF and unmap them. The locking here is unpleasant, since the existing locking scheme was designed to come from the iopt through the area to the pages we cannot use pages as starting point for the locking. There is no way to obtain the domains_rwsem before obtaining the pages mutex to reliably use the existing domains_itree. Solve this problem by adding a new tracking structure just for DMABUF revoke. Record a linked list of areas and domains inside the pages mutex. Clean the entries on the list during revoke. The map/unmaps are now all done under a pages mutex while updating the tracking linked list so nothing can get out of sync. Only one lock is required for revoke processing. Link: https://patch.msgid.link/r/4-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit 71e2409a0c85c3875ca0dec2515ccceb21a4785b Author: Jason Gunthorpe Date: Fri Nov 21 11:51:00 2025 -0400 iommufd: Do not map/unmap revoked DMABUFs Once a DMABUF is revoked the domain will be unmapped under the pages mutex. Double unmapping will trigger a WARN, and mapping while revoked will fail. Check for revoked DMABUFs along all the map and unmap paths to resolve this. Ensure that map/unmap is always done under the pages mutex so it is synchronized with the revoke notifier. If a revoke happens between allocating the iopt_pages and the population to a domain then the population will succeed, and leave things unmapped as though revoke had happened immediately after. Currently there is no way to repopulate the domains. Userspace is expected to know if it is going to do something that would trigger revoke (eg if it is about to do a FLR) then it should go and remove the DMABUF mappings before and put the back after. The revoke is only to protect the kernel from mis-behaving userspace. Link: https://patch.msgid.link/r/3-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit 71db84a092c399f434976d0522e848e9803cd51a Author: Jason Gunthorpe Date: Fri Nov 21 11:50:59 2025 -0400 iommufd: Add DMABUF to iopt_pages Add IOPT_ADDRESS_DMABUF to the iopt_pages and the basic infrastructure to create an iopt_pages from a struct dma_buf *. DMABUF pages are not supported for accesses, and for now can only be used with the VFIO DMABUF exporter. The overall flow will be similar to memfd where the user can pass in a DMABUF file descriptor to IOMMU_IOAS_MAP_FILE and create an area and pages. Like other areas it can be copied and otherwise manipulated, though there is little point in doing so. There is no pinned page accounting done for DMABUF maps. The DMABUF attachment exists so long as the dmabuf is mapped into an IOAS, even if the IOAS is not mapped to any domains. Link: https://patch.msgid.link/r/2-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Signed-off-by: Jason Gunthorpe commit 96ce2aeb15bd8672ab47abe547e2a1f8ba3886ff Author: Jason Gunthorpe Date: Fri Nov 21 11:50:58 2025 -0400 vfio/pci: Add vfio_pci_dma_buf_iommufd_map() This function is used to establish the "private interconnect" between the VFIO DMABUF exporter and the iommufd DMABUF importer. This is intended to be a temporary API until the core DMABUF interface is improved to natively support a private interconnect and revocable negotiation. This function should only be called by iommufd when trying to map a DMABUF. For now iommufd will only support VFIO DMABUFs. The following improvements are needed in the DMABUF API to generically support more exporters with iommufd/kvm type importers that cannot use the DMA API: 1) Revoke semantics. VFIO needs to be able to prevent access to the MMIO during FLR, and so it will use dma_buf_move_notify() to prevent access. iommmufd does not support fault handling so it cannot implement the full move_notify. Instead if revoke is negotiated the exporter promises not to use move_notify() unless the importer can experiance failures. iommufd will unmap the dmabuf from the iommu page tables while it is revoked. 2) Private interconnect negotiation. iommufd will only be able to map a "private interconnect" that provides a phys_addr_t and a struct p2pdma_provider * to describe the memory. It cannot use a DMA mapped scatterlist since it is directly calling iommu_map(). 3) NULL device during dma_buf_dynamic_attach(). Since iommufd doesn't use the DMA API it doesn't have a DMAable struct device to pass here. Link: https://patch.msgid.link/r/1-v2-b2c110338e3f+5c2-iommufd_dmabuf_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Tested-by: Shuai Xue Acked-by: Alex Williamson Signed-off-by: Jason Gunthorpe commit 80339b3823bb76d383c82186b55ac836fed3f586 Author: Dan Carpenter Date: Tue Nov 25 16:55:28 2025 +0300 ASoC: SDCA: Fix NULL vs IS_ERR() bug in sdca_dev_register_functions() The sdca_dev_register() function never returns NULL, it returns error pointers on error. Fix the error checking to match. Fixes: 4496d1c65bad ("ASoC: SDCA: add function devices") Signed-off-by: Dan Carpenter Reviewed-by: Charles Keepax Link: https://patch.msgid.link/aSW1UOgMCiQIaZG8@stanley.mountain Signed-off-by: Mark Brown commit 61e628023d79386e93d2d64f8b7af439d27617a6 Merge: e3daf0e7fe9758 a6efc273ab8245 Author: Paolo Abeni Date: Tue Nov 25 16:10:34 2025 +0100 Merge branch 'net_sched-speedup-qdisc-dequeue' Eric Dumazet says: ==================== net_sched: speedup qdisc dequeue Avoid up to two cache line misses in qdisc dequeue() to fetch skb_shinfo(skb)->gso_segs/gso_size while qdisc spinlock is held. Idea is to cache gso_segs at enqueue time before spinlock is acquired, in the first skb cache line, where we already have qdisc_skb_cb(skb)->pkt_len. This series gives a 8 % improvement in a TX intensive workload. (120 Mpps -> 130 Mpps on a Turin host, IDPF with 32 TX queues) v2: https://lore.kernel.org/netdev/20251111093204.1432437-1-edumazet@google.com/ v1: https://lore.kernel.org/netdev/20251110094505.3335073-1-edumazet@google.com/T/#m8f562ed148f807c02fd02c6cd243604d449615b9 ==================== Link: https://patch.msgid.link/20251121083256.674562-1-edumazet@google.com Signed-off-by: Paolo Abeni commit a6efc273ab8245722eee2150fa12cf75781dc410 Author: Eric Dumazet Date: Fri Nov 21 08:32:56 2025 +0000 net_sched: use qdisc_dequeue_drop() in cake, codel, fq_codel cake, codel and fq_codel can drop many packets from dequeue(). Use qdisc_dequeue_drop() so that the freeing can happen outside of the qdisc spinlock scope. Add TCQ_F_DEQUEUE_DROPS to sch->flags. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-15-edumazet@google.com Signed-off-by: Paolo Abeni commit 191ff13e42a7b7824fec5b2ed84fd6481356754d Author: Eric Dumazet Date: Fri Nov 21 08:32:55 2025 +0000 net_sched: add qdisc_dequeue_drop() helper Some qdisc like cake, codel, fq_codel might drop packets in their dequeue() method. This is currently problematic because dequeue() runs with the qdisc spinlock held. Freeing skbs can be extremely expensive. Add qdisc_dequeue_drop() method and a new TCQ_F_DEQUEUE_DROPS so that these qdiscs can opt-in to defer the skb frees after the socket spinlock is released. TCQ_F_DEQUEUE_DROPS is an attempt to not penalize other qdiscs with an extra cache line miss. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-14-edumazet@google.com Signed-off-by: Paolo Abeni commit 0170d7f47c8bb0311bc802bad52245c045f151fe Author: Eric Dumazet Date: Fri Nov 21 08:32:54 2025 +0000 net_sched: add tcf_kfree_skb_list() helper Using kfree_skb_list_reason() to free list of skbs from qdisc operations seems wrong as each skb might have a different drop reason. Cleanup __dev_xmit_skb() to call tcf_kfree_skb_list() once in preparation of the following patch. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-13-edumazet@google.com Signed-off-by: Paolo Abeni commit 4792c3a4c1470202b0d5bf44b6058cb0fb050ba8 Author: Eric Dumazet Date: Fri Nov 21 08:32:53 2025 +0000 net: annotate a data-race in __dev_xmit_skb() q->limit is read locklessly, add a READ_ONCE(). Fixes: 100dfa74cad9 ("net: dev_queue_xmit() llist adoption") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-12-edumazet@google.com Signed-off-by: Paolo Abeni commit b2e9821cff6c3c9ac107fce5327070f4462bf8a7 Author: Eric Dumazet Date: Fri Nov 21 08:32:52 2025 +0000 net: prefech skb->priority in __dev_xmit_skb() Most qdiscs need to read skb->priority at enqueue time(). In commit 100dfa74cad9 ("net: dev_queue_xmit() llist adoption") I added a prefetch(next), lets add another one for the second half of skb. Note that skb->priority and skb->hash share a common cache line, so this patch helps qdiscs needing both fields. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-11-edumazet@google.com Signed-off-by: Paolo Abeni commit 2f9babc04d74cbf984f0cb5b6e20bd78fdf32997 Author: Eric Dumazet Date: Fri Nov 21 08:32:51 2025 +0000 net_sched: sch_fq: prefetch one skb ahead in dequeue() prefetch the skb that we are likely to dequeue at the next dequeue(). Also call fq_dequeue_skb() a bit sooner in fq_dequeue(). This reduces the window between read of q.qlen and changes of fields in the cache line that could be dirtied by another cpu trying to queue a packet. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-10-edumazet@google.com Signed-off-by: Paolo Abeni commit 3c1100f042c006cae6c241028cc4c69e1a70483f Author: Eric Dumazet Date: Fri Nov 21 08:32:50 2025 +0000 net_sched: sch_fq: move qdisc_bstats_update() to fq_dequeue_skb() Group together changes to qdisc fields to reduce chances of false sharing if another cpu attempts to acquire the qdisc spinlock. qdisc_qstats_backlog_dec(sch, skb); sch->q.qlen--; qdisc_bstats_update(sch, skb); Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-9-edumazet@google.com Signed-off-by: Paolo Abeni commit ad50d5a3fc20327e133e2db849c6e67fc49650e6 Author: Eric Dumazet Date: Fri Nov 21 08:32:49 2025 +0000 net_sched: add Qdisc_read_mostly and Qdisc_write groups It is possible to reorg Qdisc to avoid always dirtying 2 cache lines in fast path by reducing this to a single dirtied cache line. In current layout, we change only four/six fields in the first cache line: - q.spinlock - q.qlen - bstats.bytes - bstats.packets - some Qdisc also change q.next/q.prev In the second cache line we change in the fast path: - running - state - qstats.backlog /* --- cacheline 2 boundary (128 bytes) --- */ struct sk_buff_head gso_skb __attribute__((__aligned__(64))); /* 0x80 0x18 */ struct qdisc_skb_head q; /* 0x98 0x18 */ struct gnet_stats_basic_sync bstats __attribute__((__aligned__(16))); /* 0xb0 0x10 */ /* --- cacheline 3 boundary (192 bytes) --- */ struct gnet_stats_queue qstats; /* 0xc0 0x14 */ bool running; /* 0xd4 0x1 */ /* XXX 3 bytes hole, try to pack */ unsigned long state; /* 0xd8 0x8 */ struct Qdisc * next_sched; /* 0xe0 0x8 */ struct sk_buff_head skb_bad_txq; /* 0xe8 0x18 */ /* --- cacheline 4 boundary (256 bytes) --- */ Reorganize things to have a first cache line mostly read, then a mostly written one. This gives a ~3% increase of performance under tx stress. Note that there is an additional hole because @qstats now spans over a third cache line. /* --- cacheline 2 boundary (128 bytes) --- */ __u8 __cacheline_group_begin__Qdisc_read_mostly[0] __attribute__((__aligned__(64))); /* 0x80 0 */ struct sk_buff_head gso_skb; /* 0x80 0x18 */ struct Qdisc * next_sched; /* 0x98 0x8 */ struct sk_buff_head skb_bad_txq; /* 0xa0 0x18 */ __u8 __cacheline_group_end__Qdisc_read_mostly[0]; /* 0xb8 0 */ /* XXX 8 bytes hole, try to pack */ /* --- cacheline 3 boundary (192 bytes) --- */ __u8 __cacheline_group_begin__Qdisc_write[0] __attribute__((__aligned__(64))); /* 0xc0 0 */ struct qdisc_skb_head q; /* 0xc0 0x18 */ unsigned long state; /* 0xd8 0x8 */ struct gnet_stats_basic_sync bstats __attribute__((__aligned__(16))); /* 0xe0 0x10 */ bool running; /* 0xf0 0x1 */ /* XXX 3 bytes hole, try to pack */ struct gnet_stats_queue qstats; /* 0xf4 0x14 */ /* --- cacheline 4 boundary (256 bytes) was 8 bytes ago --- */ __u8 __cacheline_group_end__Qdisc_write[0]; /* 0x108 0 */ /* XXX 56 bytes hole, try to pack */ Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-8-edumazet@google.com Signed-off-by: Paolo Abeni commit c5d34f4583ea883b8d3441ded83e3a7207e0182d Author: Eric Dumazet Date: Fri Nov 21 08:32:48 2025 +0000 net_sched: cake: use qdisc_pkt_segs() Use new qdisc_pkt_segs() to avoid a cache line miss in cake_enqueue() for non GSO packets. cake_overhead() does not have to recompute it. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-7-edumazet@google.com Signed-off-by: Paolo Abeni commit 2773cb0b3120eb5c4b66d949eb99853d5bae1221 Author: Eric Dumazet Date: Fri Nov 21 08:32:47 2025 +0000 net_sched: use qdisc_skb_cb(skb)->pkt_segs in bstats_update() Avoid up to two cache line misses in qdisc dequeue() to fetch skb_shinfo(skb)->gso_segs/gso_size while qdisc spinlock is held. This gives a 5 % improvement in a TX intensive workload. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-6-edumazet@google.com Signed-off-by: Paolo Abeni commit f9e00e51e391d08de31ca98d9f8609a1bceec2d2 Author: Eric Dumazet Date: Fri Nov 21 08:32:46 2025 +0000 net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() sch_handle_ingress() sets qdisc_skb_cb(skb)->pkt_len. We also need to initialize qdisc_skb_cb(skb)->pkt_segs. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-5-edumazet@google.com Signed-off-by: Paolo Abeni commit 874c1928d37297a02452a404c8b496aad9fee146 Author: Eric Dumazet Date: Fri Nov 21 08:32:45 2025 +0000 net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() qdisc_pkt_len_init() is currently initalizing qdisc_skb_cb(skb)->pkt_len. Add qdisc_skb_cb(skb)->pkt_segs initialization and rename this function to qdisc_pkt_len_segs_init(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-4-edumazet@google.com Signed-off-by: Paolo Abeni commit be1b70ab21cbe8f8bb8ecf39eb34880882252773 Author: Eric Dumazet Date: Fri Nov 21 08:32:44 2025 +0000 net: init shinfo->gso_segs from qdisc_pkt_len_init() Qdisc use shinfo->gso_segs for their pkts stats in bstats_update(), but this field needs to be initialized for SKB_GSO_DODGY users. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-3-edumazet@google.com Signed-off-by: Paolo Abeni commit b2a38f6df9dab0b05858746edcbe2403f8f4e4ec Author: Eric Dumazet Date: Fri Nov 21 08:32:43 2025 +0000 net_sched: make room for (struct qdisc_skb_cb)->pkt_segs Add a new u16 field, next to pkt_len : pkt_segs This will cache shinfo->gso_segs to speed up qdisc deqeue(). Move slave_dev_queue_mapping at the end of qdisc_skb_cb, and move three bits from tc_skb_cb : - post_ct - post_ct_snat - post_ct_dnat Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251121083256.674562-2-edumazet@google.com Signed-off-by: Paolo Abeni commit 8d6f8d5c585f02a90a7b0ae4bab83801c1f21262 Author: George Moussalem Date: Mon Aug 18 15:33:46 2025 +0400 dt-bindings: thermal: qcom-tsens: make ipq5018 tsens standalone compatible The tsens IP found in the IPQ5018 SoC should not use qcom,tsens-v1 as fallback since it has no RPM and, as such, must deviate from the standard v1 init routine as this version of tsens needs to be explicitly reset and enabled in the driver. So let's make qcom,ipq5018-tsens a standalone compatible in the bindings. Fixes: 77c6d28192ef ("dt-bindings: thermal: qcom-tsens: Add ipq5018 compatible") Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Signed-off-by: George Moussalem Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20250818-ipq5018-tsens-fix-v1-1-0f08cf09182d@outlook.com commit 509c34924d5a89a73c1470e9265be86baffd1286 Author: Heiko Carstens Date: Tue Nov 25 12:36:26 2025 +0100 s390/vdso: Get rid of -m64 flag handling The compiler/assembler flag -m64 is added and removed at two locations. This pointless exercise is a leftover to keep the 31 and 64 bit vdso Makefiles as symmetrical as possible. Given that the 31 bit vdso code does not exist anymore, remove the -m64 flag handling. Suggested-by: Jens Remus Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit c0087d807ae86cc82cc356e366d2dccf0e3bb225 Author: Heiko Carstens Date: Mon Nov 24 16:04:29 2025 +0100 s390/vdso: Rename vdso64 to vdso Since compat is gone there is only a 64 bit vdso left. Remove the superfluous "64" suffix everywhere. Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit b3bdfdf1f93c38ea54b93421efc413e91e61f6b3 Author: Heiko Carstens Date: Mon Nov 24 16:04:28 2025 +0100 s390: Rename head64.S to head.S All the code is 64 bit, therefore remove the superfluous suffix. Reviewed-by: Jens Remus Signed-off-by: Heiko Carstens commit 5e811b922ec91cef7b6b2647e93b0c64e626251b Author: Jens Remus Date: Mon Nov 24 15:12:42 2025 +0100 s390/vdso: Use common STABS_DEBUG and DWARF_DEBUG macros This simplifies the vDSO linker script. The ELF_DETAILS macro was not used in addition, as done on arm64 and powerpc, as that would introduce an empty .modinfo section. Note that this rearranges the .comment section to follow after all of the debug sections. Signed-off-by: Jens Remus Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit dca7da244349eef4d78527cafc0bf80816b261f5 Author: Helge Deller Date: Tue Nov 25 15:23:02 2025 +0100 parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GSP chip and is used e.g. in HP 730 workstations. When trying to reprogram the affinity it will crash with a HPMC as the relevant registers don't seem to be at the usual location. Let's avoid the crash by checking the sversion. Also note, that reprogramming isn't necessary either, as the HP730 is a just a single-CPU machine. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit 152c862c172162d1bed85bfb9ecdf62fec9e86ae Author: Jason Gunthorpe Date: Thu Nov 20 14:47:42 2025 -0400 iommupt: Fix unlikely flows in increase_top() Since increase_top() does it's own READ_ONCE() on top_of_table, the caller's prior READ_ONCE() could be inconsistent and the first time through the loop we may actually already have the right level if two threads are racing map. In this case new_level will be left uninitialized. Further all the exits from the loop have to either commit to the new top or free any memory allocated so the early return must be a goto err_free. Make it so the only break from the loop always sets new_level to the right value and all other exits go to err_free. Use pts.level (the pts represents the top we are stacking) within the loop instead of new_level. Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aRwgNW9PiW2j-Qwo@stanley.mountain Signed-off-by: Jason Gunthorpe Reviewed-by: Alejandro Jimenez Reviewed-by: Vasant Hegde Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit 2381a1b40be4b286062fb3cf67dd7f005692aa2a Author: Jinhui Guo Date: Thu Nov 20 23:47:25 2025 +0800 iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() The return type of __modify_irte_ga() is int, but modify_irte_ga() treats it as a bool. Casting the int to bool discards the error code. To fix the issue, change the type of ret to int in modify_irte_ga(). Fixes: 57cdb720eaa5 ("iommu/amd: Do not flush IRTE when only updating isRun and destination fields") Cc: stable@vger.kernel.org Signed-off-by: Jinhui Guo Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit b1e24e05e1408602d3414b95031242bbaa72226a Author: Marc Zyngier Date: Tue Nov 25 10:27:26 2025 +0000 PCI: host-generic: Move bridge allocation outside of pci_host_common_init() Having the host bridge allocation inside pci_host_common_init() results in a lot of complexity in the pcie-apple driver (the only direct user of this function outside of core PCI code). It forces the allocation of driver-specific tracking structures outside of the bridge allocation, which in turn requires it to use inefficient data structures to match the bridge and the private structure as needed. Instead, let the bridge structure be passed to pci_host_common_init(), allowing the driver to allocate it together with the private data, as it is usually intended. The driver can then retrieve the bridge via the owning device attached to the PCI config window structure. This allows the pcie-apple driver to be significantly simplified. Both core and driver code are changed in one go to avoid going via a transitional interface. Signed-off-by: Marc Zyngier Signed-off-by: Manivannan Sadhasivam Reviewed-by: Radu Rendec Cc: Bjorn Helgaas Cc: Manivannan Sadhasivam Cc: Rob Herring Cc: Krzysztof Wilczyński Cc: Lorenzo Pieralisi Link: https://lore.kernel.org/r/86jyzms036.wl-maz@kernel.org Link: https://patch.msgid.link/20251125102726.865617-1-maz@kernel.org commit 99f5aa14f03e364c43a3d1b5459a021b0201f5c5 Author: Dai Ngo Date: Wed Nov 5 12:45:55 2025 -0800 NFSD: Add trace point for SCSI fencing operation. Add trace point to print client IP address, net namespace number, device name and status of SCSI pr_preempt command. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever commit 6f52063db9aabdaabea929b1e998af98c2e8d917 Author: Dai Ngo Date: Wed Nov 5 12:45:54 2025 -0800 NFSD: use correct reservation type in nfsd4_scsi_fence_client The reservation type argument for the pr_preempt call should match the one used in nfsd4_block_get_device_info_scsi. Fixes: f99d4fbdae67 ("nfsd: add SCSI layout support") Cc: stable@vger.kernel.org Signed-off-by: Dai Ngo Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 1c873a2fd1109302a7687524d541ed815c13c026 Author: Chuck Lever Date: Wed Nov 5 10:26:07 2025 -0500 xdrgen: Don't generate unnecessary semicolon The Jinja2 templates add a semicolon at the end of every function. The C language does not require this punctuation. Signed-off-by: Chuck Lever commit f7cb94fad4e6cec354a3ea779f91fe5560fb72b6 Author: Chuck Lever Date: Wed Nov 5 10:26:06 2025 -0500 xdrgen: Fix union declarations Add a missing template file. This file is used when a union is defined as a public API (ie, "pragma public ;"). Signed-off-by: Chuck Lever commit 14282cc3cfa25b7c137fb2f63ea0db61311d45e3 Author: Olga Kornievskaia Date: Mon Nov 3 12:57:34 2025 -0500 NFSD: don't start nfsd if sv_permsocks is empty Previously, while trying to create a server instance, if no listening sockets were present then default parameter udp and tcp listeners were created. It's unclear what purpose was of starting these listeners were and how this could have been triggered by the userland setup. This patch proposed to ensure the reverse that we never end in a situation where no listener sockets are created and we are trying to create nfsd threads. The problem it solves is: when nfs.conf only has tcp=n (and nothing else for the choice of transports), nfsdctl would still start the server and create udp and tcp listeners. Signed-off-by: Olga Kornievskaia Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b0f8e1f1f5e8427ea1d955c48bddb6408f354421 Author: Khushal Chitturi Date: Wed Oct 29 11:42:36 2025 +0530 xdrgen: handle _XdrString in union encoder/decoder Running xdrgen on xdrgen/tests/test.x fails when generating encoder or decoder functions for union members of type _XdrString. It was because _XdrString does not have a spec attribute like _XdrBasic, leading to AttributeError. This patch updates emit_union_case_spec_definition and emit_union_case_spec_decoder/encoder to handle _XdrString by assigning type_name = "char *" and avoiding referencing to spec. Testing: Fixed xdrgen tool was run on originally failing test file (tools/net/sunrpc/xdrgen/tests/test.x) and now completes without AttributeError. Modified xdrgen tool was also run against nfs4_1.x (Documentation/sunrpc/xdr/nfs4_1.x). The output header file matches with nfs4_1.h (include/linux/sunrpc/xdrgen/nfs4_1.h). This validates the patch for all XDR input files currently within the kernel. Changes since v2: - Moved the shebang to the first line - Removed SPDX header to match style of current xdrgen files Changes since v1: - Corrected email address in Signed-off-by. - Wrapped patch description lines to 72 characters. Signed-off-by: Khushal Chitturi Signed-off-by: Chuck Lever commit 42ba5bd2e28b1f9e86303e4d176ae0809a53f0b6 Author: Chuck Lever Date: Mon Oct 27 09:56:33 2025 -0400 xdrgen: Fix the variable-length opaque field decoder template Ensure that variable-length opaques are decoded into the named field, and do not overwrite the structure itself. Signed-off-by: Chuck Lever commit 3bd937b49a2e0d45450c9326e288c8d1612e8ecd Author: Chuck Lever Date: Mon Oct 27 09:56:32 2025 -0400 xdrgen: Make the xdrgen script location-independent The @pythondir@ placeholder is meant for build-time substitution, such as with autoconf. autoconf is not used in the kernel. Let's replace that mechanism with one that better enables the xdrgen script to be run from any directory. Signed-off-by: Chuck Lever commit 75a9b40f3b14d1cc3771c463d32b71cf4e558246 Author: Chuck Lever Date: Mon Oct 27 09:56:31 2025 -0400 xdrgen: Generalize/harden pathname construction Use Python's built-in Path constructor to find the Jinja templates. This provides better error checking, proper use of path component separators, and more reliable location of the template files. Signed-off-by: Chuck Lever commit 1e8b6eb1418ca2fcd10282409c0e18f73a51280f Author: Jean-Philippe Brucker Date: Thu Nov 20 13:46:22 2025 +0000 MAINTAINERS: Update my email address Use jpb@kernel.org as my main address. Signed-off-by: Jean-Philippe Brucker Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit 4b1e81570144f03521482f7659fee060d8f63481 Merge: af058d5f32f5d8 4459d667a3d700 Author: Arnd Bergmann Date: Tue Nov 25 14:52:06 2025 +0100 Merge tag 'mtk-soc-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers MediaTek soc driver updates This adds socinfo entries for MT8189 Kompanio 540, an extra entry for a variant of MT8391 (AV/AZA) Genio 720 SoC, and support for the PMIC Wrapper (by adding a compatible string) in MT8189. * tag 'mtk-soc-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: dt-bindings: soc: mediatek: pwrap: Add compatible for MT8189 SoC soc: mediatek: mtk-socinfo: Add entry for MT8391AV/AZA Genio 720 soc: mediatek: mtk-socinfo: Add extra entry for MT8189 Signed-off-by: Arnd Bergmann commit 44c603f35cad3f3b0f58fece99502d81620da9b2 Author: André Draszik Date: Mon Nov 24 06:47:18 2025 +0000 mfd: sec: Drop a stray semicolon A stray and unneeded semicolon was added here by accident, just drop it. Fixes: ee19b52c31b3 ("mfd: sec: Use chained IRQs for s2mpg10") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511230909.zk7EkTnb-lkp@intel.com/ Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251124-s2mpg10-chained-irq-semicolon-v1-1-578ba2d7adca@linaro.org Signed-off-by: Lee Jones commit a8ec08bf32595ea4b109e3c7f679d4457d1c58c0 Merge: ed80cc758b784a 48233291461b05 Author: Vlastimil Babka Date: Tue Nov 25 14:38:41 2025 +0100 Merge branch 'slab/for-6.19/mempool_alloc_bulk' into slab/for-next Merges series "mempool_alloc_bulk and various mempool improvements v3" from Christoph Hellwig. From the cover letter [1]: This series adds a bulk version of mempool_alloc that makes allocating multiple objects deadlock safe. The initial users is the blk-crypto-fallback code: https://lore.kernel.org/linux-block/20251031093517.1603379-1-hch@lst.de/ with which v1 was posted, but I also have a few other users in mind. Link: https://lore.kernel.org/all/20251113084022.1255121-1-hch@lst.de/ [1] commit ed80cc758b784a1ed297f9130625de217a904ba5 Merge: e5d7764e137292 c33196c9429a1d Author: Vlastimil Babka Date: Tue Nov 25 14:35:33 2025 +0100 Merge branch 'slab/for-6.19/freelist_aba_t_cleanups' into slab/for-next Merge series "slab: cmpxchg cleanups enabled by -fms-extensions" From the cover letter [1]: After learning about -fms-extensions being enabled for 6.19, I realized there is some cleanup potential in slub code by extending the definition and usage of freelist_aba_t, as it can now become an unnamed member of struct slab. This series performs the cleanup, with no functional changes intended. Additionally we turn freelist_aba_t to struct freelist_counters as it doesn't meet any criteria for being a typedef, per Documentation/process/coding-style.rst Based on the tag kbuild-ms-extensions-6.19 from git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linuxV Link: https://lore.kernel.org/all/20251107-slab-fms-cleanup-v1-0-650b1491ac9e@suse.cz/#t [1] commit e5d7764e1372925c27fc574c4552122a8c3c9272 Merge: 3065c20d5dc81b b55590558ff7c6 Author: Vlastimil Babka Date: Tue Nov 25 14:33:14 2025 +0100 Merge branch 'slab/for-6.19/memdesc_prep' into slab/for-next Merge series "Prepare slab for memdescs" by Matthew Wilcox. From the cover letter [1]: When we separate struct folio, struct page and struct slab from each other, converting to folios then to slabs will be nonsense. It made sense under the 'folio is just a head page' interpretation, but with full separation, page_folio() will return NULL for a page which belongs to a slab. This patch series removes almost all mentions of folio from slab. There are a few folio_test_slab() invocations left around the tree that I haven't decided how to handle yet. We're not yet quite at the point of separately allocating struct slab, but that's what I'll be working on next. Link: https://lore.kernel.org/all/20251113000932.1589073-1-willy@infradead.org/ [1] commit 6156424a7d001cceeafe59b52209d6f36719b51d Merge: ebd61482ffab49 8daf70e6aa4118 Author: Linus Walleij Date: Tue Nov 25 14:29:03 2025 +0100 Merge tag 'intel-pinctrl-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v6.19-1 * Add and use common macro INTEL_GPP() to avoid duplication * Export intel_gpio_add_pin_ranges() and reuse it instead of custom copies * Unify error messages with help of dev_err_probe() Signed-off-by: Linus Walleij commit 3065c20d5dc81b3485184f5687036ad4f1141c90 Merge: 8ad018dbd344c0 6adf4b11fa50a3 Author: Vlastimil Babka Date: Tue Nov 25 14:27:34 2025 +0100 Merge branch 'slab/for-6.19/sheaves_cleanups' into slab/for-next Merge series "slab: preparatory cleanups before adding sheaves to all caches" [1] Cleanups that were written as part of the full sheaves conversion, which is not fully ready yet, but they are useful on their own. Link: https://lore.kernel.org/all/20251105-sheaves-cleanups-v1-0-b8218e1ac7ef@suse.cz/ [1] commit ebd61482ffab499208f06b8d3fa183cbe2dd5fa7 Author: Linus Walleij Date: Mon Nov 24 15:35:16 2025 +0100 pinctrl: cix: Fix obscure dependency When compile-testing for UM-Linux the build fails because we don't have IOMEM. Add an explicit dependency. Fixes: 920500c5fe66 ("pinctrl: cix: Add pin-controller support for sky1") Reviewed-by: Peter Chen Signed-off-by: Linus Walleij commit b55590558ff7c66c4a494af8ea08999c27594bc8 Author: Matthew Wilcox (Oracle) Date: Mon Nov 24 14:23:27 2025 +0000 slab: Remove unnecessary call to compound_head() in alloc_from_pcs() Each page knows which node it belongs to, so there's no need to convert to a folio. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251124142329.1691780-1-willy@infradead.org Signed-off-by: Vlastimil Babka commit af058d5f32f5d86c677ee43d9d91309d8c3e79fe Merge: 73147be308317f 1387cb78f10155 Author: Arnd Bergmann Date: Tue Nov 25 14:11:21 2025 +0100 Merge tag 'reset-for-v6.19' of https://git.pengutronix.de/git/pza/linux into soc/drivers Reset controller updates for v6.19 * Add support for LAN969x, eic770 and RZ/G3S reset controllers, for the RZ/G3S USB-PHY reset controller, and for the remaining TH1520 reset controllers. * Drop legacy reset control lookup code. * Include linux/bits.h from linux/reset.h to make it self-contained. * tag 'reset-for-v6.19' of https://git.pengutronix.de/git/pza/linux: Documentation: reset: Remove reset_controller_add_lookup() reset: fix BIT macro reference reset: rzg2l-usbphy-ctrl: Fix a NULL vs IS_ERR() bug in probe reset: th1520: Support reset controllers in more subsystems reset: th1520: Prepare for supporting multiple controllers dt-bindings: reset: thead,th1520-reset: Add controllers for more subsys dt-bindings: reset: thead,th1520-reset: Remove non-VO-subsystem resets reset: remove legacy reset lookup code clk: davinci: psc: drop unused reset lookup reset: rzg2l-usbphy-ctrl: Add support for RZ/G3S SoC reset: rzg2l-usbphy-ctrl: Add support for USB PWRRDY dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G3S support reset: eswin: Add eic7700 reset driver dt-bindings: reset: eswin: Documentation for eic7700 SoC reset: sparx5: add LAN969x support dt-bindings: reset: microchip: Add LAN969x support Signed-off-by: Arnd Bergmann commit 23ac52a4a2dceb704d8dc1674abb8beefd93bf1a Author: Jisheng Zhang Date: Mon Nov 24 08:21:05 2025 +0800 gpio: zynq: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-15-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit dbedf93d1082b4e755eb62338e5f6566f4e31fb8 Author: Jisheng Zhang Date: Mon Nov 24 08:21:04 2025 +0800 gpio: xilinx: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-14-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 353fdaebdc6991f1cf03ae3aaec266ad0516859b Author: Jisheng Zhang Date: Mon Nov 24 08:21:03 2025 +0800 gpio: xgene: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-13-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 46e90d3924cb58b161c2dd57ba05f3a706c1c0e2 Author: Jisheng Zhang Date: Mon Nov 24 08:21:02 2025 +0800 gpio: uniphier: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-12-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 75ff16234bf3af747b9c77b81d7ce3df5c09df8c Author: Jisheng Zhang Date: Mon Nov 24 08:21:01 2025 +0800 gpio: tqmx86: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251124002105.25429-11-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 0ed358a87d6ef9782dca161ef3f1311d21f257d2 Author: Jisheng Zhang Date: Mon Nov 24 08:21:00 2025 +0800 gpio: pch: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Andy Shevchenko Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-10-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 2b3c8bd8e13bd101fe8833b1f02ef5e5a6e9920b Author: Jisheng Zhang Date: Mon Nov 24 08:20:59 2025 +0800 gpio: omap: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-9-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 07a251bfe3b690ebfaef7c46f6ce25ea9ccba8da Author: Jisheng Zhang Date: Mon Nov 24 08:20:58 2025 +0800 gpio: msc313: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-8-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit a92f492a1473eb2255be9b7b767d0720c5c3b2a9 Author: Jisheng Zhang Date: Mon Nov 24 08:20:57 2025 +0800 gpio: mlxbf2: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-7-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 1f37a9f7d1fa582833cc8e226d77e5b2397df9fa Author: Jisheng Zhang Date: Mon Nov 24 08:20:56 2025 +0800 gpio: ml-ioh: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use __maybe_unused Signed-off-by: Jisheng Zhang Acked-by: Andy Shevchenko Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-6-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit b40c4dacf48a42ddcd701552575945e90f5c8060 Author: Jisheng Zhang Date: Mon Nov 24 08:20:55 2025 +0800 gpio: pl061: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. The pl061_context_save_regs structure is always embedded into struct pl061 to simplify code, so this brings a tiny 8 bytes memory overhead for !CONFIG_PM_SLEEP. Signed-off-by: Jisheng Zhang Reviewed-by: Linus Walleij Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-5-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 2557b1f4f21a75650a03c74a56ea30bd4214866e Author: Jisheng Zhang Date: Mon Nov 24 08:20:54 2025 +0800 gpio: htc-egpio: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Reviewed-by: Florian Fainelli Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-4-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 56f3a6d7538d2e0dfb8d9df7871d2a9aec3115ac Author: Jisheng Zhang Date: Mon Nov 24 08:20:53 2025 +0800 gpio: brcmstb: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Acked-by: Doug Berger Reviewed-by: Florian Fainelli Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251124002105.25429-3-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 3f19e57cbfb55d743d60aeebf5d5c48cc7fd5d4e Author: Jisheng Zhang Date: Mon Nov 24 08:20:52 2025 +0800 gpio: dwapb: Use modern PM macros Use the modern PM macros for the suspend and resume functions to be automatically dropped by the compiler when CONFIG_PM or CONFIG_PM_SLEEP are disabled, without having to use #ifdef guards. This has the advantage of always compiling these functions in, independently of any Kconfig option. Thanks to that, bugs and other regressions are subsequently easier to catch. Signed-off-by: Jisheng Zhang Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251124002105.25429-2-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 73147be308317fdce93a4e3d838f8436913c0f40 Merge: c0401dcbcacd3d 3bae4748c1cdd5 Author: Arnd Bergmann Date: Tue Nov 25 14:04:50 2025 +0100 Merge tag 'stm32-bus-firewall-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/drivers STM32 Firewall bus for v6.19, round 1 Highlights: ---------- The STM32MP21x platforms have a slightly different RIFSC. Add support for these platforms. Also, the RIF is a complex firewall framework which can be tricky to debug. To facilitate the latter, add a debugfs entry that can be used to display the whole RIFSC firewall configuration at runtime. * tag 'stm32-bus-firewall-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: bus: rifsc: add debugfs entry to dump the firewall configuration dt-bindings: bus: add stm32mp21 RIFSC compatible Signed-off-by: Arnd Bergmann commit 4cfe6cdba5f8a05ef87e50dac264255f1520c47b Merge: 194832dcb13b0d b2a186cced1199 Author: Bartosz Golaszewski Date: Tue Nov 25 14:04:05 2025 +0100 Merge tag 'intel-gpio-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-next intel-gpio for v6.19-1 * Replace min_t() by min() to avoid cutting upper bits and do type checking gpiolib: acpi: use min() instead of min_t() commit c0401dcbcacd3d3d057480e66bcf1d264328df4f Merge: 3d497bf8efb539 048213a38e7ac1 Author: Arnd Bergmann Date: Tue Nov 25 14:02:26 2025 +0100 Merge tag 'v6.19-rockchip-drivers1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/drivers Some additional sane defaults for the oldish rk3368 soc. * tag 'v6.19-rockchip-drivers1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: grf: Add select correct PWM implementation on RK3368 soc: rockchip: grf: Set pwm2/xin32k pad default to xin32k for rk3368 Signed-off-by: Arnd Bergmann commit 3d497bf8efb539faa355d2714b52437fe0c118cf Merge: a677d87689e311 186b8f8fcc8694 Author: Arnd Bergmann Date: Tue Nov 25 14:00:48 2025 +0100 Merge tag 'qcom-drivers-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.19 Support for hardware-keymanager v1 support for wrapped keys is introduce in the ICE driver. Support for the new Kaanapali mobile platform is added to last-level cache controller, pd-mapper, and UBWC drivers. UBWC driver gains support for the Monaco and Glymur platforms. The PMIC GLINK driver is extended to handle the differences found in targets where the related firmware runs on the SoCCP. Support for running on targets without initialized SMEM is provided, by reworking the SMEM driver to differentiate between "not yet probed" and "probed but there was no SMEM". An unwanted WARN_ON() that triggered if clients asked for a SMEM item beyond the currently running system's limit, was removed, to allow new use cases to gracefully fail on old targets. The Qualcomm socinfo driver is extended with support for version 20 through 23 and support for providing version information about more than 32 remote processors. Identifiers for QCS6490 and SM8850 are also added. Additionally, a number of smaller bug fixes and cleanups in PBS, OCMEM, GSBI, TZMEM, and MDT-loader are included. * tag 'qcom-drivers-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (31 commits) soc: qcom: mdt_loader: rename 'firmware' parameter of qcom_mdt_load() soc: qcom: mdt_loader: merge __qcom_mdt_load() and qcom_mdt_load_no_init() soc: qcom: socinfo: Add reserve field to support future extension soc: qcom: socinfo: Add support for new fields in revision 20 dt-bindings: firmware: qcom,scm: Document SCM on Kaanapali SOC soc: qcom: socinfo: add support to extract more than 32 image versions soc: qcom: smem: drop the WARN_ON() on SMEM item validation soc: qcom: ubwc: Add config for Kaanapali soc: qcom: socinfo: Add SoC ID for QCS6490 dt-bindings: arm: qcom,ids: Add SoC ID for QCS6490 soc: qcom: ice: Add HWKM v1 support for wrapped keys soc: qcom: smem: better track SMEM uninitialized state err.h: add INIT_ERR_PTR() macro soc: qcom: smem: fix hwspinlock resource leak in probe error paths dt-bindings: soc: qcom,aoss-qmp: Document the Glymur AOSS side channel dt-bindings: soc: qcom,aoss-qmp: Document the Kaanapali AOSS channel soc: qcom: ubwc: Add QCS8300 UBWC cfg dt-bindings: firmware: qcom,scm: Document Glymur scm soc: qcom: socinfo: Add SM8850 SoC ID dt-bindings: arm: qcom,ids: Add SoC ID for SM8850 ... Signed-off-by: Arnd Bergmann commit a677d87689e311fe0f67c6562a73ba60207997ab Merge: 0363169ac78a71 3f61783920504b Author: Arnd Bergmann Date: Tue Nov 25 13:59:03 2025 +0100 Merge tag 'omap-for-v6.19/drivers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/drivers ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx * tag 'omap-for-v6.19/drivers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx Signed-off-by: Arnd Bergmann commit e2bbd950eb726c29e3214a6b91a828de2cb770d9 Merge: b1f856b1727c2e 747528729c9b67 Author: Ulf Hansson Date: Tue Nov 25 13:58:46 2025 +0100 mmc: Merge branch fixes into next Merge the mmc fixes for v6.18-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.19. Signed-off-by: Ulf Hansson commit 2d45db63260c6ae3cf007361e04a1c41bd265084 Author: Randy Dunlap Date: Mon Nov 10 22:09:16 2025 -0800 backlight: lp855x: Fix lp855x.h kernel-doc warnings Add a missing struct short description and a missing leading " *" to lp855x.h to avoid kernel-doc warnings: Warning: include/linux/platform_data/lp855x.h:126 missing initial short description on line: * struct lp855x_platform_data Warning: include/linux/platform_data/lp855x.h:131 bad line: Only valid when mode is PWM_BASED. Fixes: 7be865ab8634 ("backlight: new backlight driver for LP855x devices") Signed-off-by: Randy Dunlap Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20251111060916.1995920-1-rdunlap@infradead.org Signed-off-by: Lee Jones commit 25c2b404cd3fe00f3a1c61b6dffd6c98a0a70170 Author: Junjie Cao Date: Sun Nov 9 11:22:39 2025 +0800 dt-bindings: leds: backlight: Add Awinic AW99706 backlight Add Awinic AW99706 backlight binding documentation. Signed-off-by: Junjie Cao Reviewed-by: Daniel Thompson (RISCstar) Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251109032240.3422503-2-caojunjie650@gmail.com Signed-off-by: Lee Jones commit 147b38a5ad068c43d601addc668937af6b4fe533 Author: Junjie Cao Date: Sun Nov 9 11:22:40 2025 +0800 backlight: aw99706: Add support for Awinic AW99706 backlight Add support for Awinic AW99706 backlight, which can be found in tablet and notebook backlight, one case is the Lenovo Legion Y700 Gen4. This driver refers to the official datasheets and android driver, they can be found in [1]. [1] https://www.awinic.com/en/productDetail/AW99706QNR Signed-off-by: Junjie Cao Tested-by: Pengyu Luo Signed-off-by: Pengyu Luo Reviewed-by: Daniel Thompson (RISCstar) Link: https://patch.msgid.link/20251109032240.3422503-3-caojunjie650@gmail.com Signed-off-by: Lee Jones commit 9341d6698f4cfdfc374fb6944158d111ebe16a9d Author: Luca Ceresoli Date: Mon May 19 22:19:11 2025 +0200 backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device. It creates instead a link where the supplier is the parent of the expected device. One consequence is that removal order is not correctly enforced. Issues happen for example with the following sections in a device tree overlay: // An LED driver chip pca9632@62 { compatible = "nxp,pca9632"; reg = <0x62>; // ... addon_led_pwm: led-pwm@3 { reg = <3>; label = "addon:led:pwm"; }; }; backlight-addon { compatible = "led-backlight"; leds = <&addon_led_pwm>; brightness-levels = <255>; default-brightness-level = <255>; }; In this example, the devlink should be created between the backlight-addon (consumer) and the pca9632@62 (supplier). Instead it is created between the backlight-addon (consumer) and the parent of the pca9632@62, which is typically the I2C bus adapter. On removal of the above overlay, the LED driver can be removed before the backlight device, resulting in: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: led_put+0xe0/0x140 devm_led_release+0x6c/0x98 Another way to reproduce the bug without any device tree overlays is unbinding the LED class device (pca9632@62) before unbinding the consumer (backlight-addon): echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind echo ...backlight-dock >/sys/bus/platform/drivers/led-backlight/unbind Fix by adding a devlink between the consuming led-backlight device and the supplying LED device, as other drivers and subsystems do as well. Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Signed-off-by: Luca Ceresoli Reviewed-by: Daniel Thompson (RISCstar) Reviewed-by: Herve Codina Tested-by: Alexander Sverdlin Link: https://patch.msgid.link/20250519-led-backlight-add-devlink-to-supplier-class-device-v6-1-845224aeb2ce@bootlin.com Signed-off-by: Lee Jones commit b1f856b1727c2eaa4be2c6d7cd7a8ed052bbeb87 Author: Sarthak Garg Date: Fri Nov 14 13:58:24 2025 +0530 mmc: sdhci-msm: Avoid early clock doubling during HS400 transition According to the hardware programming guide, the clock frequency must remain below 52MHz during the transition to HS400 mode. However,in the current implementation, the timing is set to HS400 (a DDR mode) before adjusting the clock. This causes the clock to double prematurely to 104MHz during the transition phase, violating the specification and potentially resulting in CRC errors or CMD timeouts. This change ensures that clock doubling is avoided during intermediate transitions and is applied only when the card requires a 200MHz clock for HS400 operation. Signed-off-by: Sarthak Garg Reviewed-by: Bjorn Andersson Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 8a4a16f86edc10e162f0e305bdfa8f1f9c522551 Author: Ulf Hansson Date: Thu Nov 20 15:29:02 2025 +0100 MAINTAINERS: Add Shawn Lin as co-maintainer for dw_mmc drivers Shawn offered to help with the Synposys Designware MMC/SD/SDIO drivers, let's add him as a co-maintainer. Signed-off-by: Ulf Hansson Acked-by: Shawn Lin > Signed-off-by: Ulf commit 69cc9d4075855661268327c38c9b0e71ac37eb1c Author: Sebastian Reichel Date: Fri Nov 21 17:26:59 2025 +0100 mmc: sdhci-of-dwcmshc: Fix command queue support for RK3576 When I added command queue engine (CQE) support for the Rockchip eMMC controller, I missed that RK3576 has a separate platform data struct. While things are working fine on RK3588 (I tested the ROCK 5B) and the suspend issue is fixed on the RK3576 (I tested the Sige5), this results in stability issues. By also adding the necessary hooks for the RK3576 platform the following problems can be avoided: [ 15.606895] mmc0: running CQE recovery [ 15.616189] mmc0: running CQE recovery [...] [ 25.911484] mmc0: running CQE recovery [ 25.926305] mmc0: running CQE recovery [ 25.927468] mmc0: running CQE recovery [...] [ 26.255719] mmc0: running CQE recovery [ 26.257162] ------------[ cut here ]------------ [ 26.257581] mmc0: cqhci: spurious TCN for tag 31 [ 26.258034] WARNING: CPU: 0 PID: 0 at drivers/mmc/host/cqhci-core.c:796 cqhci_irq+0x440/0x68c [ 26.263786] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-rc6-gd984ebbf0d15 #1 PREEMPT [ 26.264561] Hardware name: ArmSoM Sige5 (DT) [...] [ 26.272748] Call trace: [ 26.272964] cqhci_irq+0x440/0x68c (P) [ 26.273296] dwcmshc_cqe_irq_handler+0x54/0x88 [ 26.273689] sdhci_irq+0xbc/0x1200 [ 26.273991] __handle_irq_event_percpu+0x54/0x1d0 [...] Note that the above problems do not necessarily happen with every boot. Reported-by: Adrian Hunter Closes: https://lore.kernel.org/linux-rockchip/01949bc9-4873-498b-ac7d-f008393ccc4c@intel.com/ Fixes: fda1e0af7c28f ("mmc: sdhci-of-dwcmshc: Add command queue support for rockchip SOCs") Signed-off-by: Sebastian Reichel Reviewed-by: Shawn Lin Signed-off-by: Ulf Hansson commit 4b7a59fa700f422217d83a7212ccc6074ebe9cbc Author: Zenon Xiu Date: Tue Nov 11 17:35:39 2025 +0800 Documentation/arm64: Fix the typo of register names The register name 'HWFGWTR_EL2' and 'HWFGRTR_EL2' is wrong, should be 'HFGWTR_EL2' and 'HFGRTR_EL2'. Find the register description on arm website here, https://developer.arm.com/documentation/ddi0601/2025-09/AArch64-Registers/HFGWTR-EL2--Hypervisor-Fine-Grained-Write-Trap-Register https://developer.arm.com/documentation/ddi0601/2025-09/AArch64-Registers/HFGRTR-EL2--Hypervisor-Fine-Grained-Read-Trap-Register?lang=en Signed-off-by: Zenon Xiu Signed-off-by: Catalin Marinas commit 155f8d4ef0b78afbf25b1449bbd654fd1327cc7a Author: Marc Zyngier Date: Thu Oct 30 11:01:37 2025 +0000 ACPI: GTDT: Get rid of acpi_arch_timer_mem_init() Since 0f67b56d84b4c ("clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver"), acpi_arch_timer_mem_init() is unused. Remove it. Signed-off-by: Marc Zyngier Cc: Hanjun Guo Cc: Sudeep Holla Cc: Rafael J. Wysocki Cc: Daniel Lezcano Cc: Thomas Gleixner Cc: Mark Rutland Acked-by: Hanjun Guo Signed-off-by: Catalin Marinas commit e3daf0e7fe9758613bec324fd606ed9caa187f74 Author: Jacky Chou Date: Thu Nov 20 11:52:03 2025 +0800 dt-bindings: net: aspeed: add AST2700 MDIO compatible Add "aspeed,ast2700-mdio" compatible to the binding schema with a fallback to "aspeed,ast2600-mdio". Although the MDIO controller on AST2700 is functionally the same as the one on AST2600, it's good practice to add a SoC-specific compatible for new silicon. This allows future driver updates to handle any 2700-specific integration issues without requiring devicetree changes or complex runtime detection logic. For now, the driver continues to bind via the existing "aspeed,ast2600-mdio" compatible, so no driver changes are needed. Acked-by: Conor Dooley Signed-off-by: Jacky Chou Link: https://patch.msgid.link/20251120-aspeed_mdio_ast2700-v2-1-0d722bfb2c54@aspeedtech.com Signed-off-by: Paolo Abeni commit 0363169ac78a71c02211fbf600d046aff7f5a66d Merge: 16e8af6c037e2b e0431ff998bd32 Author: Arnd Bergmann Date: Tue Nov 25 11:33:10 2025 +0100 Merge tag 'ti-driver-soc-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v6.19 - ti_sci: Add Partial-IO poweroff support and sys_off handler integration - ti_sci: Gate IO isolation programming on firmware capability flag - ti_sci: cleanup by replacing ifdeffery in PM ops with pm_sleep_ptr() macro * tag 'ti-driver-soc-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: firmware: ti_sci: Partial-IO support firmware: ti_sci: Support transfers without response firmware: ti_sci: Set IO Isolation only if the firmware is capable firmware: ti_sci: Replace ifdeffery by pm_sleep_ptr() macro Signed-off-by: Arnd Bergmann commit 16e8af6c037e2b9549338cecbbbf004bf958c7ba Merge: e7ec4df2226a04 97a07dd2b559d1 Author: Arnd Bergmann Date: Tue Nov 25 11:32:26 2025 +0100 Merge tag 'imx-drivers-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/drivers i.MX drivers update for 6.19: - A series from Peng Fan to to improve i.MX SCU firmware drivers * tag 'imx-drivers-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: firmware: imx: scu: Use devm_mutex_init firmware: imx: scu: Suppress bind attrs firmware: imx: scu: Update error code firmware: imx: scu-irq: Remove unused export of imx_scu_enable_general_irq_channel firmware: imx: scu-irq: Set mu_resource_id before get handle firmware: imx: scu-irq: Init workqueue before request mbox channel firmware: imx: scu-irq: Free mailbox client on failure at imx_scu_enable_general_irq_channel() firmware: imx: scu-irq: fix OF node leak in Signed-off-by: Arnd Bergmann commit e7ec4df2226a0429908953699a4fe216e76e0126 Merge: aee7ea4681043b 122df8416e7f4c Author: Arnd Bergmann Date: Tue Nov 25 11:25:49 2025 +0100 Merge tag 'sunxi-drivers-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers Allwinner driver changes for 6.19 Just one cleanup change that is part of tree wide cleanup of redundant pm_runtime_mark_last_busy() calls. * tag 'sunxi-drivers-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: bus: sunxi-rsb: Remove redundant pm_runtime_mark_last_busy() calls Signed-off-by: Arnd Bergmann commit 194832dcb13b0d02fce0df887235b7e6d1ef0121 Author: Bartosz Golaszewski Date: Tue Nov 18 11:04:04 2025 +0100 string: use __attribute__((nonnull())) in strends() The arguments of strends() must not be NULL so annotate the function with the nonnull attribute. Suggested-by: Kees Cook Link: https://lore.kernel.org/r/20251118-strends-follow-up-v1-2-d3f8ef750f59@linaro.org Signed-off-by: Bartosz Golaszewski commit 63c971af40365ee706c7e24f6a7900d693518f09 Author: Thomas Zimmermann Date: Mon Oct 27 09:12:17 2025 +0100 drm/fb-helper: Allocate and release fb_info in single place Move the calls to drm_fb_helper_alloc_info() from drivers into a single place in fbdev helpers. Allocates struct fb_info for a new framebuffer device. Then call drm_fb_helper_single_fb_probe() to create an fbdev screen buffer. Also release the instance on errors by calling drm_fb_helper_release_info(). Simplifies the code and fixes the error cleanup for some of the drivers. Regular release of the struct fb_info instance still happens in drm_fb_helper_fini() as before. v2: - remove error rollback in driver implementations (kernel test robot) - initialize info in TTM implementation (kernel test robot) Signed-off-by: Thomas Zimmermann Acked-by: Christian König # radeon Acked-by: Dmitry Baryshkov # msm Acked-by: Javier Martinez Canillas Link: https://patch.msgid.link/20251027081245.80262-1-tzimmermann@suse.de commit 16e802667ed5c97a668b5eb3efb7615cb5f02832 Author: Malaya Kumar Rout Date: Mon Nov 24 16:13:58 2025 +0530 tools/thermal/thermal-engine: Fix format string bug in thermal-engine The error message in the daemon() failure path uses %p format specifier without providing a corresponding pointer argument, resulting in undefined behavior and printing garbage values. Replace %p with %m to properly print the errno error message, which is the intended behavior when daemon() fails. This fix ensures proper error reporting when daemonization fails. Signed-off-by: Malaya Kumar Rout Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20251124104401.374856-1-mrout@redhat.com commit aee7ea4681043b68abeecf11db478a2593c9e239 Merge: d34a71ba21735b dd03d34d6d8e7a Author: Arnd Bergmann Date: Tue Nov 25 10:49:03 2025 +0100 Merge tag 'tegra-for-6.19-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Changes for v6.19-rc1 A couple of small fixes across the board: ACPI support on FUSE no longer exposes duplicate SoC information, speedo IDs for Tegra210 are updated, some comments see typo fixes or kerneldoc additions. Finally, support for USB wake events is added on Tegra234, which allow these systems to resume from suspend on USB activity. * tag 'tegra-for-6.19-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: Add USB wake events for Tegra234 soc/tegra: pmc: Document tegra_pmc.syscore field soc/tegra: pmc: Don't fail if "aotag" is not present soc/tegra: fuse: speedo-tegra210: Add SoC speedo 2 soc/tegra: fuse: speedo-tegra210: Update speedo IDs soc/tegra: Resolve a spelling error in the tegra194-cbb.c soc/tegra: fuse: Do not register SoC device on ACPI boot Signed-off-by: Arnd Bergmann commit ac364014fd812c8a2babe8f9dff8c909271a653e Author: Christian König Date: Fri Oct 10 14:22:06 2025 +0200 dma-buf: cleanup dma_fence_describe v3 The driver and timeline name are meaningless for signaled fences. Drop them and also print the context number. v2: avoid the calls when the BO is already signaled. v3: use same format as trace points for context and seqno. Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251113145332.16805-2-christian.koenig@amd.com commit 1c6a92a5a5de7ebf94526dee7068926e6d5b1b01 Author: Randy Dunlap Date: Mon Nov 24 18:28:34 2025 -0800 wifi: nl80211: vendor-cmd: intel: fix a blank kernel-doc line warning Delete an empty line prevent a kernel-doc warning: Warning: ../include/uapi/linux/nl80211-vnd-intel.h:86 bad line: Fixes: 3d2a2544eae9 ("nl80211: vendor-cmd: add Intel vendor commands for iwlmei usage") Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251125022834.3171742-1-rdunlap@infradead.org Signed-off-by: Johannes Berg commit 003a6607304dddb314acc475883064feeefbe2e7 Author: Mateusz Guzik Date: Tue Nov 4 00:09:11 2025 +0100 fs: push list presence check into inode_io_list_del() For consistency with sb routines. ext4 is the only consumer outside of evict(). Damage-controlling it is outside of the scope of this cleanup. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251103230911.516866-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4c6b40877b4dc83f61a762a3a35a09dcf744b585 Author: Mateusz Guzik Date: Wed Oct 29 14:14:28 2025 +0100 fs: cosmetic fixes to lru handling 1. inode_bit_waitqueue() was somehow placed between __inode_add_lru() and inode_add_lru(). move it up 2. assert ->i_lock is held in __inode_add_lru instead of just claiming it is needed 3. s/__inode_add_lru/__inode_lru_list_add/ for consistency with itself (inode_lru_list_del()) and similar routines for sb and io list management 4. push list presence check into inode_lru_list_del(), just like sb and io list Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251029131428.654761-2-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit a27628f4363435beac84b55c749c41a005054d30 Author: Mateusz Guzik Date: Sat Oct 11 00:17:36 2025 +0200 fs: rework I_NEW handling to operate without fences In the inode hash code grab the state while ->i_lock is held. If found to be set, synchronize the sleep once more with the lock held. In the real world the flag is not set most of the time. Apart from being simpler to reason about, it comes with a minor speed up as now clearing the flag does not require the smp_mb() fence. While here rename wait_on_inode() to wait_on_new_inode() to line it up with __wait_on_freeing_inode(). Christian Brauner says: As per the discussion in [1] I folded in the diff sent in [2]. Link: https://lore.kernel.org/69238e4d.a70a0220.d98e3.006e.GAE@google.com [1] Link: https://lore.kernel.org/c2kpawomkbvtahjm7y5mposbhckb7wxthi3iqy5yr22ggpucrm@ufvxwy233qxo [2] Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251010221737.1403539-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit cba1ba11c1bae87de9c2e13d342bfbd6a3c1cf63 Author: Lachlan Hodges Date: Tue Nov 25 13:59:26 2025 +1100 wifi: cfg80211: include s1g_primary_2mhz when comparing chandefs When comparing chandefs, ensure we include s1g_primary_2mhz. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20251125025927.245280-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 3fc830cd8c9d0e5efae64da38a1a5eac01584b2f Author: Lachlan Hodges Date: Tue Nov 25 13:59:25 2025 +1100 wifi: cfg80211: include s1g_primary_2mhz when sending chandef The chandef now includes a flag denoting the use of a 2MHz primary channel for S1G interfaces, include this when sending the chandef. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20251125025927.245280-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 24d4da5c2565313c2ad3c43449937a9351a64407 Author: Ria Thomas Date: Mon Nov 24 18:26:37 2025 +0530 wifi: ieee80211: correct FILS status codes The FILS status codes are set to 108/109, but the IEEE 802.11-2020 spec defines them as 112/113. Update the enum so it matches the specification and keeps the kernel consistent with standard values. Fixes: a3caf7440ded ("cfg80211: Add support for FILS shared key authentication offload") Signed-off-by: Ria Thomas Reviewed-by: Jeff Johnson Link: https://patch.msgid.link/20251124125637.3936154-1-ria.thomas@morsemicro.com Signed-off-by: Johannes Berg commit cf1d7dc28cb7d8da7e0d70ecc2626d1edd5ee474 Merge: a8e5a110c0c38e 53d1548612670a Author: Johannes Berg Date: Tue Nov 25 10:26:46 2025 +0100 Merge tag 'mt76-next-2025-11-24' of https://github.com/nbd168/wireless Felix Fietkau says: =================== mt76 patches for 6.19 - relicense to BSD-3-Clause-Clear - fixes - support WED on devices which exceed 32-bit DMA - airoha NPU support - mt7925 regd improvements - more mt7996 MLO work =================== Link: https://patch.msgid.link/6b6d1033-dddf-4cc9-b240-93da7f8b8773@nbd.name Signed-off-by: Johannes Berg commit d34a71ba21735b6aae34cc8127e70724073f103b Merge: 5d5b056ba35257 a97fbc3ee3e2a5 Author: Arnd Bergmann Date: Tue Nov 25 10:25:55 2025 +0100 Merge tag 'tegra-for-6.19-syscore' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers syscore: Changes for v6.19-rc1 Add a parameter to syscore operations to allow passing contextual data, which in turn enables refactoring of drivers to make them independent of global data. This initially only contains the API changes along with the updates for existing drivers. Subsequent work will make use of this to improve drivers. * tag 'tegra-for-6.19-syscore' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: syscore: Pass context data to callbacks Signed-off-by: Arnd Bergmann commit 5d5b056ba35257586afda128eafa05780e3d9b63 Merge: 9b26d16d790ecc 500e1368e46928 Author: Arnd Bergmann Date: Tue Nov 25 10:24:21 2025 +0100 Merge tag 'tegra-for-6.19-core' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers amba: Fixes for v6.19-rc1 Fix a device leak. Could go into v6.18 as a fix, but since this problem has existed for a long time and nobody has reported it before it doesn't seem critical enough and sufficient to get it into 6.19 and then backported. * tag 'tegra-for-6.19-core' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: amba: tegra-ahb: Fix device leak on SMMU enable Signed-off-by: Arnd Bergmann commit 9b26d16d790ecce982e0f52fdf28ee348014b6b7 Merge: babf4c8841d9ea c432180a7d9508 Author: Arnd Bergmann Date: Tue Nov 25 10:23:26 2025 +0100 Merge tag 'renesas-drivers-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.19 (take two) - Fix accessing forbidden registers from regmap debugfs on RZ/G3E, RZ/G3S, RZ/V2H, and RZ/V2N. * tag 'renesas-drivers-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config soc: renesas: r9a09g056-sys: Populate max_register Signed-off-by: Arnd Bergmann commit 7fd8720dff2d9c70cf5a1a13b7513af01952ec02 Author: Christoph Hellwig Date: Mon Nov 24 15:00:13 2025 +0100 iomap: allocate s_dio_done_wq for async reads as well Since commit 222f2c7c6d14 ("iomap: always run error completions in user context"), read error completions are deferred to s_dio_done_wq. This means the workqueue also needs to be allocated for async reads. Fixes: 222f2c7c6d14 ("iomap: always run error completions in user context") Reported-by: syzbot+a2b9a4ed0d61b1efb3f5@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251124140013.902853-1-hch@lst.de Tested-by: syzbot+a2b9a4ed0d61b1efb3f5@syzkaller.appspotmail.com Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit d7ff85d4b899e02b4b8a8ca9f44f54a06aee1b4d Author: Joanne Koong Date: Tue Nov 18 13:11:11 2025 -0800 iomap: fix iomap_read_end() for already uptodate folios There are some cases where when iomap_read_end() is called, the folio may already have been marked uptodate. For example, if the iomap block needed zeroing, then the folio may have been marked uptodate after the zeroing. iomap_read_end() should unlock the folio instead of calling folio_end_read(), which is how these cases were handled prior to commit f8eaf79406fe ("iomap: simplify ->read_folio_range() error handling for reads"). Calling folio_end_read() on an uptodate folio leads to buggy behavior where marking an already uptodate folio as uptodate will XOR it to be marked nonuptodate. Fixes: f8eaf79406fe ("iomap: simplify ->read_folio_range() error handling for reads") Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251118211111.1027272-2-joannelkoong@gmail.com Tested-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Reported-by: Matthew Wilcox (Oracle) Signed-off-by: Christian Brauner commit 5ec58e6acdecb0c2b1707002123883fe1da29a98 Merge: f53d302ee8f59c 76192a42c210cd Author: Christian Brauner Date: Fri Nov 14 12:47:01 2025 +0100 Merge patch series "enable iomap dio write completions from interrupt context v2" Christoph Hellwig says: Currently iomap defers all write completions to interrupt context. This was based on my assumption that no one cares about the latency of those to simplify the code vs the old direct-io.c. It turns out someone cared, as Avi reported a lot of context switches with ScyllaDB, which at least in older kernels with workqueue scheduling issues caused really high tail latencies. Fortunately allowing the direct completions is pretty easy with all the other iomap changes we had since. While doing this I've also found dead code which gets removed (patch 1) and an incorrect assumption in zonefs that read completions are called in user context, which it assumes for it's error handling. Fix this by always calling error completions from user context (patch 2). Against the vfs-6.19.iomap branch. * patches from https://patch.msgid.link/20251113170633.1453259-1-hch@lst.de: iomap: invert the polarity of IOMAP_DIO_INLINE_COMP iomap: support write completions from interrupt context iomap: rework REQ_FUA selection iomap: always run error completions in user context fs, iomap: remove IOCB_DIO_CALLER_COMP Link: https://patch.msgid.link/20251113170633.1453259-1-hch@lst.de Signed-off-by: Christian Brauner commit 76192a42c210cd6f85d9556a0ca87263b66680d6 Author: Christoph Hellwig Date: Thu Nov 13 18:06:30 2025 +0100 iomap: invert the polarity of IOMAP_DIO_INLINE_COMP Replace IOMAP_DIO_INLINE_COMP with a flag to indicate that the completion should be offloaded. This removes a tiny bit of boilerplate code, but more importantly just makes the code easier to follow as this new flag gets set most of the time and only cleared in one place, while it was the inverse for the old version. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113170633.1453259-6-hch@lst.de Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit eca9dc20891de4ce6b7f012ac157ca6f8fa12ce4 Author: Christoph Hellwig Date: Thu Nov 13 18:06:29 2025 +0100 iomap: support write completions from interrupt context Completions for pure overwrites don't need to be deferred to a workqueue as there is no work to be done, or at least no work that needs a user context. Set the IOMAP_DIO_INLINE_COMP by default for writes like we already do for reads, and the clear it for all the cases that actually do need a user context for completions to update the inode size or record updates to the logical to physical mapping. I've audited all users of the ->end_io callback, and they only require user context for I/O that involves unwritten extents, COW, size extensions, or error handling and all those are still run from workqueue context. This restores the behavior of the old pre-iomap direct I/O code. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113170633.1453259-5-hch@lst.de Signed-off-by: Christian Brauner commit 29086a31b3abc662d0571ed6a938937ec1e1ec0a Author: Christoph Hellwig Date: Thu Nov 13 18:06:28 2025 +0100 iomap: rework REQ_FUA selection The way how iomap_dio_can_use_fua and the caller is structured is a bit confusing, as the main guarding condition is hidden in the helper, and the secondary conditions are split between caller and callee. Refactor the code, so that iomap_dio_bio_iter itself tracks if a write might need metadata updates based on the iomap type and flags, and then have a condition based on that to use the FUA flag. Note that this also moves the REQ_OP_WRITE assignment to the end of the branch to improve readability a bit. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113170633.1453259-4-hch@lst.de Signed-off-by: Christian Brauner commit ddb4873286e03e193c5a3bebb5fc6fa820e9ee3a Author: Christoph Hellwig Date: Thu Nov 13 18:06:27 2025 +0100 iomap: always run error completions in user context At least zonefs expects error completions to be able to sleep. Because error completions aren't performance critical, just defer them to workqueue context unconditionally. Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system") Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113170633.1453259-3-hch@lst.de Reviewed-by: Jan Kara Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christian Brauner commit f9f85149994dbb9db43202ae8fabf68940c0ac0f Author: Christoph Hellwig Date: Thu Nov 13 18:06:26 2025 +0100 fs, iomap: remove IOCB_DIO_CALLER_COMP This was added by commit 099ada2c8726 ("io_uring/rw: add write support for IOCB_DIO_CALLER_COMP") and disabled a little later by commit 838b35bb6a89 ("io_uring/rw: disable IOCB_DIO_CALLER_COMP") because it didn't work. Remove all the related code that sat unused for 2 years. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113170633.1453259-2-hch@lst.de Reviewed-by: Jan Kara Reviewed-by: Chaitanya Kulkarni Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit f53d302ee8f59c8bd32b967100de4cb0045a4ed4 Merge: ca3557a6868478 b56c1c54f225ca Author: Christian Brauner Date: Wed Nov 12 10:50:38 2025 +0100 Merge patch series "iomap: buffered io changes" This series contains several fixes and cleanups: * Renaming bytes_pending/bytes_accounted to bytes_submitted/bytes_not_submitted for improved code clarity * Accounting for unaligned end offsets when truncating read ranges * Adding documentation for iomap_finish_folio_write() requirements * Optimizing pending async writeback accounting logic * Simplifying error handling in ->read_folio_range() for read operations * Streamlining logic for skipping reads during write operations * Replacing manual bitmap scanning with find_next_bit() for both dirty and uptodate bitmaps, improving performance * patches from https://patch.msgid.link/20251111193658.3495942-1-joannelkoong@gmail.com: iomap: use find_next_bit() for uptodate bitmap scanning iomap: use find_next_bit() for dirty bitmap scanning iomap: simplify when reads can be skipped for writes iomap: simplify ->read_folio_range() error handling for reads iomap: optimize pending async writeback accounting docs: document iomap writeback's iomap_finish_folio_write() requirement iomap: account for unaligned end offsets when truncating read range iomap: rename bytes_pending/bytes_accounted to bytes_submitted/bytes_not_submitted Link: https://patch.msgid.link/20251111193658.3495942-1-joannelkoong@gmail.com Signed-off-by: Christian Brauner commit b56c1c54f225ca02d88ec562f017be23429bf5b2 Author: Joanne Koong Date: Tue Nov 11 11:36:58 2025 -0800 iomap: use find_next_bit() for uptodate bitmap scanning Use find_next_bit()/find_next_zero_bit() for iomap uptodate bitmap scanning. This uses __ffs() internally and is more efficient for finding the next uptodate or non-uptodate bit than iterating through the the bitmap range testing every bit. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-10-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Suggested-by: Christoph Hellwig Signed-off-by: Christian Brauner commit fed9c62d28b726dad70cc03fd28ffd700b59c741 Author: Joanne Koong Date: Tue Nov 11 11:36:57 2025 -0800 iomap: use find_next_bit() for dirty bitmap scanning Use find_next_bit()/find_next_zero_bit() for iomap dirty bitmap scanning. This uses __ffs() internally and is more efficient for finding the next dirty or clean bit than iterating through the bitmap range testing every bit. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-9-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Suggested-by: Christoph Hellwig Signed-off-by: Christian Brauner commit babf4c8841d9eaf656f0c819a964a0fed6e3554b Merge: bcae4697695c11 81280d39a2f9e7 Author: Arnd Bergmann Date: Tue Nov 25 10:21:51 2025 +0100 Merge tag 'samsung-drivers-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers Samsung SoC drivers for v6.19 1. ChipID driver: Add support for identifying Exynos8890 and Exynos9610. 2. PMU driver: Allow specifying list of valid registers for the custom regmap used on Google GS101 SoC. The PMU (Power Management Unit) on that SoC uses more complex access to registers than simple MMIO and invalid registers trigger aborts halting the system. 3. Few minor cleanups. 4. Several new bindings for compatible devices. * tag 'samsung-drivers-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: dt-bindings: soc: samsung: exynos-pmu: allow mipi-phy subnode for Exynos7870 PMU soc: samsung: exynos-chipid: use a local dev variable dt-bindings: soc: samsung: exynos-sysreg: add gs101 hsi0 and misc compatibles dt-bindings: soc: samsung: exynos-sysreg: add power-domains soc: samsung: gs101-pmu: implement access tables for read and write soc: samsung: exynos-pmu: move some gs101 related code into new file soc: samsung: exynos-pmu: allow specifying read & write access tables for secure regmap dt-bindings: samsung: exynos-sysreg: add exynos7870 sysregs soc: samsung: exynos-chipid: add exynos8890 SoC support dt-bindings: hwinfo: samsung,exynos-chipid: add exynos8890-chipid compatible dt-bindings: soc: samsung: exynos-pmu: add exynos8890 compatible soc: samsung: exynos-pmu: Annotate online/offline functions with __must_hold soc: samsung: exynos-chipid: Add exynos9610 SoC support dt-bindings: hwinfo: samsung,exynos-chipid: add exynos9610 compatible dt-bindings: soc: samsung: exynos-sysreg: Add Exynos990 PERIC0/1 compatibles Signed-off-by: Arnd Bergmann commit a74b6c0e53a6df8e8a096b50c06c4f872906368a Author: David Gow Date: Sat Nov 22 16:32:12 2025 +0800 um: Don't rename vmap to kernel_vmap In order to work around the existence of a vmap symbol in libpcap, the UML makefile unconditionally redefines vmap to kernel_vmap. However, this not only affects the actual vmap symbol, but also anything else named vmap, including a number of struct members in DRM. This would not be too much of a problem, since all uses are also updated, except we now have Rust DRM bindings, which expect the corresponding Rust structs to have 'vmap' names. Since the redefinition applies in bindgen, but not to Rust code, we end up with errors such as: error[E0560]: struct `drm_gem_object_funcs` has no fields named `vmap` --> rust/kernel/drm/gem/mod.rs:210:9 Since libpcap support was removed in commit 12b8e7e69aa7 ("um: Remove obsolete pcap driver"), remove the, now unnecessary, define as well. We also take this opportunity to update the comment. Signed-off-by: David Gow Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20251122083213.3996586-1-davidgow@google.com Fixes: 12b8e7e69aa7 ("um: Remove obsolete pcap driver") [adjust commmit message a bit] Signed-off-by: Johannes Berg commit 54ca9e913e22e364292a484783efc4fcdb6fdc51 Author: Askar Safin Date: Thu Nov 20 19:51:40 2025 +0000 include/linux/fs.h: trivial fix: regualr -> regular Trivial fix. Signed-off-by: Askar Safin Link: https://patch.msgid.link/20251120195140.571608-1-safinaskar@gmail.com Signed-off-by: Christian Brauner commit bef0202fb77b9b733054838df1d3111406bd21d4 Author: Askar Safin Date: Thu Nov 20 21:13:16 2025 +0000 fs/splice.c: trivial fix: pipes -> pipe's Trivial fix. Signed-off-by: Askar Safin Link: https://patch.msgid.link/20251120211316.706725-1-safinaskar@gmail.com Signed-off-by: Christian Brauner commit 37d369fa97cc0774ea4eab726d16bcb5fbe3a104 Author: Matthew Wilcox (Oracle) Date: Sun Nov 23 22:05:15 2025 +0000 fs: Add uoff_t In a recent commit, I inadvertently changed a comparison from being an unsigned comparison (on 64-bit systems) to being a signed comparison (which it had always been on 32-bit systems). This led to a sporadic fstests failure. To make sure this comparison is always unsigned, introduce a new type, uoff_t which is the unsigned version of loff_t. Generally file sizes are restricted to being a signed integer, but in these two places it is convenient to pass -1 to indicate "up to the end of the file". Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251123220518.1447261-1-willy@infradead.org Signed-off-by: Christian Brauner commit 17331d0f339fc6ec00a118e72ca28cb39d18e960 Author: Christian König Date: Thu Nov 20 15:41:08 2025 +0100 dma-buf/sw-sync: always taint the kernel when sw-sync is used The SW-sync functionality should only be used for testing and debugging since it is inherently unsave. Signed-off-by: Christian König Acked-by: Sumit Semwal Link: https://lore.kernel.org/r/20251120150018.27385-3-christian.koenig@amd.com commit 8d79ec9e7f634e10c6cdc7f3999023bd988df1ad Author: Mateusz Guzik Date: Wed Nov 19 15:49:30 2025 +0100 fs: mark lookup_slow() as noinline Otherwise it gets inlined notably in walk_component(), which convinces the compiler to push/pop additional registers in the fast path to accomodate existence of the inlined version. Shortens the fast path of that routine from 87 to 71 bytes. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251119144930.2911698-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 7c179096e77eca210caf43abfcf3e556030fea3b Author: Mateusz Guzik Date: Wed Nov 19 15:29:54 2025 +0100 fs: add predicts based on nd->depth Stats from nd->depth usage during the venerable kernel build collected like so: bpftrace -e 'kprobe:terminate_walk,kprobe:walk_component,kprobe:legitimize_links { @[probe] = lhist(((struct nameidata *)arg0)->depth, 0, 8, 1); }' @[kprobe:legitimize_links]: [0, 1) 6554906 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [1, 2) 3534 | | @[kprobe:terminate_walk]: [0, 1) 12153664 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| @[kprobe:walk_component]: [0, 1) 53075749 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [1, 2) 971421 | | [2, 3) 84946 | | Additionally a custom probe was added for depth within link_path_walk(): bpftrace -e 'kprobe:link_path_walk_probe { @[probe] = lhist(arg0, 0, 8, 1); }' @[kprobe:link_path_walk_probe]: [0, 1) 7528231 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [1, 2) 407905 |@@ | Given these results: 1. terminate_walk() is called towards the end of the lookup and in this test it never had any links to clean up. 2. legitimize_links() is also called towards the end of lookup and most of the time there s 0 depth. Patch consumers to avoid calling into it in that case. 3. walk_component() is typically called with WALK_MORE and zero depth, checked in that order. Check depth first and predict it is 0. 4. link_path_walk() also does not deal with a symlink most of the time when !*name Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251119142954.2909394-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit bcae4697695c11e76c49eeec64209651b06ecf2e Merge: d30c7cf491e445 1463299a227d02 Author: Arnd Bergmann Date: Tue Nov 25 09:24:27 2025 +0100 Merge tag 'memory-controller-drv-6.19-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.19 1. Tegra drivers: Several cleanups (dev_err_probe(), error messages). 2. Renesas RPC IF: Add system suspend support. * tag 'memory-controller-drv-6.19-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra186-emc: Fix missing put_bpmp memory: renesas-rpc-if: Add suspend/resume support memory: tegra30-emc: Add the SoC model prefix to functions memory: tegra20-emc: Add the SoC model prefix to functions memory: tegra186-emc: Add the SoC model prefix to functions memory: tegra124-emc: Add the SoC model prefix to functions memory: tegra124-emc: Simplify and handle deferred probe with dev_err_probe() memory: tegra186-emc: Simplify and handle deferred probe with dev_err_probe() memory: tegra20-emc: Simplify and handle deferred probe with dev_err_probe() memory: tegra30-emc: Simplify and handle deferred probe with dev_err_probe() memory: tegra30-emc: Do not print error on icc_node_create() failure memory: tegra20-emc: Do not print error on icc_node_create() failure memory: tegra186-emc: Do not print error on icc_node_create() failure memory: tegra124-emc: Do not print error on icc_node_create() failure memory: tegra124-emc: Simplify return of emc_init() Signed-off-by: Arnd Bergmann commit d30c7cf491e445095090ae2d1d8946b06bbe754a Merge: 18caf68d2d1f03 4765d59fcf8679 Author: Arnd Bergmann Date: Tue Nov 25 09:23:02 2025 +0100 Merge tag 'renesas-drivers-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.19 - Keep the WDTRSTCR.RESBAR2S bit in the default state on R-Car Gen4. * tag 'renesas-drivers-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: rcar-rst: Keep RESBAR2S in default state Signed-off-by: Arnd Bergmann commit 73029e73ccd07b64905f441d4f474a9bb91e7027 Author: Randy Dunlap Date: Mon Nov 24 18:27:30 2025 -0800 x86/cc: Fix enum spelling to fix kernel-doc warnings Make the enum name in kernel-doc match the code to prevent kernel-doc warnings: Warning: include/linux/cc_platform.h:106 Enum value 'CC_ATTR_GUEST_SEV_SNP' not described in enum 'cc_attr' Warning: include/linux/cc_platform.h:106 Excess enum value '%CC_ATTR_SEV_SNP' description in 'cc_attr' Fixes: f742b90e61bb ("x86/mm: Extend cc_attr to include AMD SEV-SNP") Signed-off-by: Randy Dunlap Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251125022730.3163679-1-rdunlap@infradead.org commit 32bd348be3fa07b26c5ea6b818a161c142dcc2f2 Author: Wanpeng Li Date: Mon Nov 10 11:32:27 2025 +0800 KVM: Fix last_boosted_vcpu index assignment bug In kvm_vcpu_on_spin(), the loop counter 'i' is incorrectly written to last_boosted_vcpu instead of the actual vCPU index 'idx'. This causes last_boosted_vcpu to store the loop iteration count rather than the vCPU index, leading to incorrect round-robin behavior in subsequent directed yield operations. Fix this by using 'idx' instead of 'i' in the assignment. Signed-off-by: Wanpeng Li Reviewed-by: Sean Christopherson Message-ID: <20251110033232.12538-7-kernellwp@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit feae664d3afb9ed75f1c4d3082a9f36b0d8e2dfc Merge: d86a4e64585944 e34003dd2fb05d Author: Arnd Bergmann Date: Tue Nov 25 09:13:43 2025 +0100 Merge tag 'v6.19-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: QNAP TS233 (2-bay variant of the RK3568 NAS series) and Asus Tinkerboard 3 + 3S. Additional peripherals enabled on 100ASK DshanPi A1, Orange Pi 3B, Indiedroid Nova, QNAP-TSx33 series + LED states on Radxa boards, power-domains for the previously added RK3368 display components. * tag 'v6.19-rockchip-dts64-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (22 commits) arm64: dts: rockchip: enable RTC for 100ASK DshanPi A1 arm64: dts: rockchip: enable USB for 100ASK DshanPi A1 arm64: dts: rockchip: enable button for 100ASK DshanPi A1 arm64: dts: rockchip: add mmc aliases for 100ASK DshanPi A1 arm64: dts: rockchip: remove mmc max-frequency for 100ASK DshanPi A1 arm64: dts: rockchip: Enable i2c2 on Orange Pi 3B arm64: dts: rockchip: Use default-state for power LED for Radxa boards arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on 9Tripod X3568 v4 arm64: dts: rockchip: Add power-domain to RK3368 VOP controller arm64: dts: rockchip: Add power-domain to RK3368 DSI controller arm64: dts: rockchip: Add host wake pin for wifi on Indiedroid Nova arm64: dts: rockchip: Correct pinctrl for pcie for Indiedroid Nova arm64: dts: rockchip: Define regulator for pcie2x1l2 on Indiedroid Nova arm64: dts: rockchip: Add clk32k_in for Indiedroid Nova arm64: dts: rockchip: Add Asus Tinker Board 3 and 3S device tree dt-bindings: arm: rockchip: Add Asus Tinker Board 3/3S dt-bindings: arm: rockchip: merge Asus Tinker and Tinker S arm64: dts: rockchip: add QNAP TS233 devicetree dt-bindings: arm: rockchip: add TS233 to RK3568-based QNAP NAS devices arm64: dts: rockchip: move common qnap tsx33 parts to dtsi ... Signed-off-by: Arnd Bergmann commit d86a4e64585944c570b5310d3a643aa92146d373 Author: Rob Herring (Arm) Date: Mon Nov 24 15:00:31 2025 -0600 arm64: dts: sprd: sc9860: Simplify clock nodes The various "syscon" nodes in SC9860 are only referenced by clock provider nodes in a 1:1 relationship, and nothing else references the "syscon" nodes. There's no apparent reason for this split. The 2 nodes can simply be merged into 1 node. The clock driver has supported using either "reg" or "sprd,syscon" to access registers from the start, so there shouldn't be any compatibility issues. With this, DT schema warnings for missing a specific compatible with "syscon" and non-MMIO devices on "simple-bus" are fixed. Reviewed-by: Chunyan Zhang Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251124210031.767382-2-robh@kernel.org Signed-off-by: Arnd Bergmann commit 0a8bc1d03e3eefb5d160fd51add3a016f29292e8 Author: Thomas Zimmermann Date: Mon Nov 10 16:44:23 2025 +0100 drm/client: log: Implement struct drm_client_funcs.restore Restore the log client's output when the DRM core invokes the restore callback. Follow the existing behavior of fbdev emulation wrt. the value of the force parameter. If force is false, acquire the DRM master lock and reprogram the display. This is the case when the user-space compositor exits and the DRM core transfers the display back to the in-kernel client. This also enables drm_log output during reboot and shutdown. If force is true, reprogram without considering the master lock. This overrides the current compositor and prints the log to the screen. In case of system malfunction, users can enter SysRq+v to invoke the emergency error reporting. See Documentation/admin-guide/sysrq.rst for more information. v2: - s/exists/exits/ in second paragraph of commit description - fix grammar in commit description Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://patch.msgid.link/20251110154616.539328-4-tzimmermann@suse.de commit 6915190a50e8f7cf13dcbe534b02845be533b60a Author: Thomas Zimmermann Date: Mon Nov 10 16:44:22 2025 +0100 drm/client: Support emergency restore via sysrq for all clients Move the sysrq functionality from DRM fbdev helpers to the DRM device and in-kernel clients, so that it becomes available on all clients. DRM fbdev helpers support emergency restoration of the console output via a special key combination. Press SysRq+v to replace the current compositor with the kernel's output on the framebuffer console. This allows users to see the log messages during system emergencies. By moving the functionality from fbdev helpers to the DRM device, any in-kernel client can serve as emergency output. This can be used to bring up drm_log, for example. Each DRM device registers itself to the list of possible sysrq handlers. On receiving SysRq+v, the DRM core goes over all registered devices and restores an in-kernel DRM client for each of them. See Documentation/admin-guide/sysrq.rst on how to invoke SysRq. Switch VTs to bring back the user-space compositor. v2: - declare placeholders as 'static inline' (kernel test robot) - fix grammar in commit description Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://patch.msgid.link/20251110154616.539328-3-tzimmermann@suse.de commit 943240d342f148896733eb6c7b223a08aa1f520a Author: Thomas Zimmermann Date: Mon Nov 10 16:44:21 2025 +0100 drm/client: Pass force parameter to client restore Add force parameter to client restore and pass value through the layers. The only currently used value is false. If force is true, the client should restore its display even if it does not hold the DRM master lock. This is be required for emergency output, such as sysrq. While at it, inline drm_fb_helper_lastclose(), which is a trivial wrapper around drm_fb_helper_restore_fbdev_mode_unlocked(). Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://patch.msgid.link/20251110154616.539328-2-tzimmermann@suse.de commit c58f520e6acfa36cee466d2cf6f665bbc8b09733 Author: Harin Lee Date: Tue Nov 25 03:05:01 2025 +0900 ALSA: ctxfi: Add support for Onkyo SE-300PCIE (OK0010) Add support for the Onkyo SE-300PCIE, a Creative X-Fi CA20K2-based sound card with a custom hardware implementation that differs significantly from other CA20K2-based variants. Changes: - PCI quirk entry for OK0010 - Port 0x3 is utilized for dedicated RCA output (configured as I2S) - Modified GPIO pin mappings and states - 4-channel simultaneous ADC input support for line and microphone capture without input switching (similar to SB1270) - Simplified ADC initialization (no manual setup required) Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251124180501.2760421-7-me@harin.net commit 9b4a22733c1562929d4259021c023b3a06386529 Author: Harin Lee Date: Tue Nov 25 03:05:00 2025 +0900 ALSA: ctxfi: Add support for dedicated RCA switching Add feature to support switching between the dedicated RCA output and the 7.1ch Front output. This is required for hardware that utilizes separate DAC circuits for RCA and 7.1ch channels. Changes: - Add dedicated_rca capability flag - Add "Analog Playback Route" mixer control - Implement logic to swap DAO inputs between RCA and Front ports Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251124180501.2760421-6-me@harin.net commit a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16 Author: Harin Lee Date: Tue Nov 25 03:04:59 2025 +0900 ALSA: ctxfi: Refactor resource alloc for sparse mappings Refactor atc_get_resources(), atc_connect_resources(), and atc_release_resources() to allocate resources based on maximum type definitions. This allows specific resources to be conditionally skipped based on capabilities. This is necessary for hardware variants where resource allocations do not follow a sequential order. Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251124180501.2760421-5-me@harin.net commit 9bb003a1f98b11b80238d522778115ad07355149 Author: Harin Lee Date: Tue Nov 25 03:04:58 2025 +0900 ALSA: ctxfi: Use explicit output flag for DAIO resources Replace the index-based type check with an explicit output flag in struct daio and struct daio_desc. This allows handling DAIO resource types correctly regardless of their index. This is necessary for hardware variants where resource types do not follow a sequential order. Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251124180501.2760421-4-me@harin.net commit 4b490e0d103cbd353bb136d67a6cdb0e94558a85 Author: Harin Lee Date: Tue Nov 25 03:04:57 2025 +0900 ALSA: ctxfi: Add ADC helper functions for GPIO Add helper functions hw_adc_stop(), hw_adc_start(), and hw_adc_reset() to encapsulate ADC reset sequence operations. These functions reduce duplication by centralizing the GPIO-based ADC control logic. Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251124180501.2760421-3-me@harin.net commit 5ebd054272718334c543998a6d0b77a9846c16d9 Author: Harin Lee Date: Tue Nov 25 03:04:56 2025 +0900 ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init() Add a hw parameter to the daio_mgr_dao_init() function to provide access to model-specific information. This is necessary for proper configuration of S/PDIF and I2S output ports on different hardware variants. Signed-off-by: Harin Lee Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251124180501.2760421-2-me@harin.net commit a748e1dbb2df11fb55ee32a56270341195260b15 Author: Dylan Robinson Date: Mon Nov 24 16:05:18 2025 -0500 ALSA: usb-audio: Fix max bytes-per-interval calculation The maxpacksize field in struct audioformat represents the maximum number of bytes per isochronous interval. The current implementation only special-cases high-speed endpoints and does not account for the different computations required for SuperSpeed, SuperSpeedPlus, or eUSB2. As a result, USB audio class devices operating at these speeds may fail to stream correctly. The issue was observed on a MOTU 16A (2025) interface, which requires more than 1024 bytes per interval at SuperSpeed. This patch replaces the existing logic with a helper that computes the correct maximum bytes-per-interval for all USB speeds, borrowing the logic used in drivers/usb/core/urb.c. Signed-off-by: Dylan Robinson Link: https://patch.msgid.link/20251124210518.90054-1-dylan_robinson@motu.com Signed-off-by: Takashi Iwai commit e7534e790557e9ee18a2c497dc89a6b31e435e48 Author: Claudiu Beznea Date: Wed Nov 19 16:35:18 2025 +0200 dt-bindings: PCI: Add Renesas RZ/G3S PCIe controller binding The PCIe IP available on the Renesas RZ/G3S complies with the PCI Express Base Specification 4.0. It is designed for root complex applications and features a single-lane (x1) implementation. Add binding documentation for it. Signed-off-by: Claudiu Beznea Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251119143523.977085-2-claudiu.beznea.uj@bp.renesas.com commit cc1b62512abf19c635fe304e253953ca3b33ffa2 Merge: f296b73d17a486 6228efe0cc01d1 Author: Jakub Kicinski Date: Mon Nov 24 20:23:42 2025 -0800 Merge branch 'mptcp-memcg-accounting-for-passive-sockets-backlog-processing' Matthieu Baerts says: ==================== mptcp: memcg accounting for passive sockets & backlog processing This series is split in two: the 4 first patches are linked to memcg accounting for passive sockets, and the rest introduce the backlog processing. They are sent together, because the first one appeared to be needed to get the second one fully working. The second part includes RX path improvement built around backlog processing. The main goals are improving the RX performances _and_ increase the long term maintainability. - Patches 1-3: preparation work to ease the introduction of the next patch. - Patch 4: fix memcg accounting for passive sockets. Note that this is a (non-urgent) fix, but it depends on material that is currently only in net-next, e.g. commit 4a997d49d92a ("tcp: Save lock_sock() for memcg in inet_csk_accept()."). - Patches 5-6: preparation of the stack for backlog processing, removing assumptions that will not hold true any more after the backlog introduction. - Patches 7,8,10,11,12 are more cleanups that will make the backlog patch a little less huge. - Patch 9: somewhat an unrelated cleanup, included here not to forget about it. - Patches 13-14: The real work is done by them. Patch 13 introduces the helpers needed to manipulate the msk-level backlog, and the data struct itself, without any actual functional change. Patch 14 finally uses the backlog for RX skb processing. Note that MPTCP can't use the sk_backlog, as the MPTCP release callback can also release and re-acquire the msk-level spinlock and core backlog processing works under the assumption that such event is not possible. A relevant point is memory accounts for skbs in the backlog. It's somewhat "original" due to MPTCP constraints. Such skbs use space from the incoming subflow receive buffer, do not use explicitly any forward allocated memory, as we can't update the msk fwd mem while enqueuing, nor we want to acquire again the ssk socket lock while processing the skbs. Instead the msk borrows memory from the subflow and reserve it for the backlog, see patch 5 and 14 for the gory details. ==================== Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-0-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit fe5dbe3110c559a2e6d13f114238621d89cb24f8 Author: 小太 Date: Tue Nov 25 05:01:26 2025 +0100 hwmon: (asus-ec-sensors) correct Pro WS TRX50-SAGE WIFI entry Add missing temperature and fan sensors to Pro WS TRX50-SAGE WIFI Also: - Format VRM names to match the BIOS - Fix swapped VRM_E and VRM_W entries Signed-off-by: 小太 Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20251125040140.277756-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 96f03c8cb29f2ec5ffe8e24fbec2c64f3c3bf4e5 Author: Jens Axboe Date: Mon Nov 24 20:53:19 2025 -0700 Revert "Merge branch 'loop-aio-nowait' into for-6.19/block" This reverts commit f43fdeb9a368a5ff56b088b46edc245bd4b52cde, reversing changes made to 2c6d792d4b7676e2b340df05425330452fee1f40. There are concerns that doing inline submits can cause excessive stack usage, particularly when going back into the filesystem. Revert the loop dio nowait change for now. Link: https://lore.kernel.org/linux-block/aSP3SG_KaROJTBHx@infradead.org/ Signed-off-by: Jens Axboe commit 6228efe0cc01d155a99fdb95891b0e20d14e7a85 Author: Paolo Abeni Date: Fri Nov 21 18:02:13 2025 +0100 mptcp: leverage the backlog for RX packet processing When the msk socket is owned or the msk receive buffer is full, move the incoming skbs in a msk level backlog list. This avoid traversing the joined subflows and acquiring the subflow level socket lock at reception time, improving the RX performances. When processing the backlog, use the fwd alloc memory borrowed from the incoming subflow. skbs exceeding the msk receive space are not dropped; instead they are kept into the backlog until the receive buffer is freed. Dropping packets already acked at the TCP level is explicitly discouraged by the RFC and would corrupt the data stream for fallback sockets. Special care is needed to avoid adding skbs to the backlog of a closed msk and to avoid leaving dangling references into the backlog at subflow closing time. Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-14-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit ee458a3f314e9c669ddd227bf5ab08354d9e75cc Author: Paolo Abeni Date: Fri Nov 21 18:02:12 2025 +0100 mptcp: introduce mptcp-level backlog We are soon using it for incoming data processing. MPTCP can't leverage the sk_backlog, as the latter is processed before the release callback, and such callback for MPTCP releases and re-acquire the socket spinlock, breaking the sk_backlog processing assumption. Add a skb backlog list inside the mptcp sock struct, and implement basic helper to transfer packet to and purge such list. Packets in the backlog are memory accounted and still use the incoming subflow receive memory, to allow back-pressure. The backlog size is implicitly bounded to the sum of subflows rcvbuf. When a subflow is closed, references from the backlog to such sock are removed. No packet is currently added to the backlog, so no functional changes intended here. Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-13-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 9db5b3cec4ec1c0cd3239689f5c8653d691a1754 Author: Paolo Abeni Date: Fri Nov 21 18:02:11 2025 +0100 mptcp: borrow forward memory from subflow In the MPTCP receive path, we release the subflow allocated fwd memory just to allocate it again shortly after for the msk. That could increases the failures chances, especially when we will add backlog processing, with other actions could consume the just released memory before the msk socket has a chance to do the rcv allocation. Replace the skb_orphan() call with an open-coded variant that explicitly borrows, the fwd memory from the subflow socket instead of releasing it. The borrowed memory does not have PAGE_SIZE granularity; rounding to the page size will make the fwd allocated memory higher than what is strictly required and could make the incoming subflow fwd mem consistently negative. Instead, keep track of the accumulated frag and borrow the full page at subflow close time. This allow removing the last drop in the TCP to MPTCP transition and the associated, now unused, MIB. Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-12-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 0eeb372deebce6c25b9afc09e35d6c75a744299a Author: Paolo Abeni Date: Fri Nov 21 18:02:10 2025 +0100 mptcp: handle first subflow closing consistently Currently, as soon as the PM closes a subflow, the msk stops accepting data from it, even if the TCP socket could be still formally open in the incoming direction, with the notable exception of the first subflow. The root cause of such behavior is that code currently piggy back two separate semantic on the subflow->disposable bit: the subflow context must be released and that the subflow must stop accepting incoming data. The first subflow is never disposed, so it also never stop accepting incoming data. Use a separate bit to mark the latter status and set such bit in __mptcp_close_ssk() for all subflows. Beyond making per subflow behaviour more consistent this will also simplify the next patch. Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-11-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 38a4a469c850fc007d6fe2429b1f7f492e50e7ad Author: Paolo Abeni Date: Fri Nov 21 18:02:09 2025 +0100 mptcp: drop the __mptcp_data_ready() helper It adds little clarity and there is a single user of such helper, just inline it in the caller. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-10-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 9d8295960300788b64d7027ff07ad8c15503121a Author: Paolo Abeni Date: Fri Nov 21 18:02:08 2025 +0100 mptcp: make mptcp_destroy_common() static Such function is only used inside protocol.c, there is no need to expose it to the whole stack. Note that the function definition most be moved earlier to avoid forward declaration. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-9-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 48a395605e088e1365bcc0b94e53746537c21969 Author: Paolo Abeni Date: Fri Nov 21 18:02:07 2025 +0100 mptcp: do not miss early first subflow close event notification The MPTCP protocol is not currently emitting the NL event when the first subflow is closed before msk accept() time. By replacing the in use close helper is such scenario, implicitly introduce the missing notification. Note that in such scenario we want to be sure that mptcp_close_ssk() will not trigger any PM work, move the msk state change update earlier, so that the previous patch will offer such guarantee. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-8-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 2ca1b8926fda1468513bb3b8731422d5b2aa0ab1 Author: Paolo Abeni Date: Fri Nov 21 18:02:06 2025 +0100 mptcp: ensure the kernel PM does not take action too late The PM hooks can currently take place when the msk is already shutting down. Subflow creation will fail, thanks to the existing check at join time, but we can entirely avoid starting the to be failed operations. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-7-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 2834f8edd74d5dda368087a654c0e52b141e9893 Author: Paolo Abeni Date: Fri Nov 21 18:02:05 2025 +0100 mptcp: cleanup fallback dummy mapping generation MPTCP currently access ack_seq outside the msk socket log scope to generate the dummy mapping for fallback socket. Soon we are going to introduce backlog usage and even for fallback socket the ack_seq value will be significantly off outside of the msk socket lock scope. Avoid relying on ack_seq for dummy mapping generation, using instead the subflow sequence number. Note that in case of disconnect() and (re)connect() we must ensure that any previous state is re-set. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Tested-by: Geliang Tang Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-6-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 85f22b8e1e9db00a7003bf3c0e0a60d19718e083 Author: Paolo Abeni Date: Fri Nov 21 18:02:04 2025 +0100 mptcp: cleanup fallback data fin reception MPTCP currently generate a dummy data_fin for fallback socket when the fallback subflow has completed data reception using the current ack_seq. We are going to introduce backlog usage for the msk soon, even for fallback sockets: the ack_seq value will not match the most recent sequence number seen by the fallback subflow socket, as it will ignore data_seq sitting in the backlog. Instead use the last map sequence number to set the data_fin, as fallback (dummy) map sequences are always in sequence. Reviewed-by: Geliang Tang Tested-by: Geliang Tang Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-5-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 68c7c386714512219e3517ec1097d164aee102fb Author: Paolo Abeni Date: Fri Nov 21 18:02:03 2025 +0100 mptcp: fix memcg accounting for passive sockets The passive sockets never got proper memcg accounting: the msk socket is associated with the memcg at accept time, but the passive subflows never got it right. At accept time, traverse the subflows list and associate each of them with the msk memcg, and try to do the same at join completion time, if the msk has been already accepted. Fixes: cf7da0d66cc1 ("mptcp: Create SUBFLOW socket for incoming connections") Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/298 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/597 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-4-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit e777a7fb06b17cd62f6935313eef0206174ed71d Author: Paolo Abeni Date: Fri Nov 21 18:02:02 2025 +0100 mptcp: grafting MPJ subflow earlier Later patches need to ensure that all MPJ subflows are grafted to the msk socket before accept() completion. Currently the grafting happens under the msk socket lock: potentially at msk release_cb time which make satisfying the above condition a bit tricky. Move the MPJ subflow grafting earlier, under the msk data lock, so that we can use such lock as a synchronization point. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-3-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit bd92dd8e03d98a499c8525e3748f046aaca2090d Author: Paolo Abeni Date: Fri Nov 21 18:02:01 2025 +0100 mptcp: factor-out cgroup data inherit helper MPTCP will soon need the same functionality for passive sockets, factor them out in a common helper. No functional change intended. Signed-off-by: Paolo Abeni Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-2-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit 075b19c211dfeea5f27075293ddf8795b78c9bd9 Author: Paolo Abeni Date: Fri Nov 21 18:02:00 2025 +0100 net: factor-out _sk_charge() helper Move out of __inet_accept() the code dealing charging newly accepted socket to memcg. MPTCP will soon use it to on a per subflow basis, in different contexts. No functional changes intended. Signed-off-by: Paolo Abeni Acked-by: Geliang Tang Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251121-net-next-mptcp-memcg-backlog-imp-v1-1-1f34b6c1e0b1@kernel.org Signed-off-by: Jakub Kicinski commit f296b73d17a486fb547caa9c7718401735c8c99c Author: Dmitry Skorodumov Date: Fri Nov 21 18:51:08 2025 +0300 ipvlan: fix sparse warning about __be32 -> u32 Fixed a sparse warning: ipvlan_core.c:56: warning: incorrect type in argument 1 (different base types) expected unsigned int [usertype] a got restricted __be32 const [usertype] s_addr Force cast the s_addr to u32 Signed-off-by: Dmitry Skorodumov Link: https://patch.msgid.link/20251121155112.4182007-1-skorodumov.dmitry@huawei.com Signed-off-by: Jakub Kicinski commit 20c20f05cf50719a667f1a1747a0267fa09addc4 Author: Breno Leitao Date: Fri Nov 21 09:02:36 2025 -0800 net: mvpp2: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count() for the mvpp2 driver. This simplifies the RX ring count retrieval and aligns mvpp2 with the new ethtool API for querying RX ring parameters, while keeping the other rxnfc handlers (GRXCLSRLCNT, GRXCLSRULE, GRXCLSRLALL) intact. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251121-marvell-v1-2-8338f3e55a4c@debian.org Signed-off-by: Jakub Kicinski commit 737e14c5dce3764125bb56de1b343f0e4d21492d Author: Breno Leitao Date: Fri Nov 21 09:02:35 2025 -0800 net: mvneta: convert to use .get_rx_ring_count Convert the mvneta driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc solely for handling ETHTOOL_GRXRINGS command. This simplifies the code by removing the switch statement and replacing it with a direct return of the queue count. The new callback provides the same functionality in a more direct way, following the ongoing ethtool API modernization. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251121-marvell-v1-1-8338f3e55a4c@debian.org Signed-off-by: Jakub Kicinski commit a8ff4842da50b5f4ea03d5d38a2ee93b701fe8e6 Author: Breno Leitao Date: Fri Nov 21 01:59:23 2025 -0800 net: hyperv: convert to use .get_rx_ring_count Convert the hyperv netvsc driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc solely for handling ETHTOOL_GRXRINGS command. This simplifies the code by replacing the switch statement with a direct return of the queue count. The new callback provides the same functionality in a more direct way, following the ongoing ethtool API modernization. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251121-hyperv_gxrings-v1-1-31293104953b@debian.org Signed-off-by: Jakub Kicinski commit ec1e48e97febbf7f87fc150793af2eda7223815c Author: Eric Dumazet Date: Fri Nov 21 06:17:25 2025 +0000 net: optimize eth_type_trans() vs CONFIG_STACKPROTECTOR_STRONG=y Some platforms exhibit very high costs with CONFIG_STACKPROTECTOR_STRONG=y when a function needs to pass the address of a local variable to external functions. eth_type_trans() (and its callers) is showing this anomaly on AMD EPYC 7B12 platforms (and maybe others). We could : 1) inline eth_type_trans() This would help if its callers also has the same issue, and the canary cost would be paid by the callers already. This is a bit cumbersome because netdev_uses_dsa() is pulling whole definitions. 2) Compile net/ethernet/eth.c with -fno-stack-protector This would weaken security. 3) Hack eth_type_trans() to temporarily use skb->dev as a place holder if skb_header_pointer() needs to pull 2 bytes not present in skb->head. This patch implements 3), and brings a 5% improvement on TX/RX intensive workload (tcp_rr 10,000 flows) on AMD EPYC 7B12. Removing CONFIG_STACKPROTECTOR_STRONG on this platform can improve performance by 25 %. This means eth_type_trans() issue is not an isolated artifact. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251121061725.206675-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e254c212cd9cabb9469a1282c4c91ccc6180bf51 Author: Jakub Kicinski Date: Sat Nov 22 18:16:01 2025 -0800 selftests: af_unix: don't use SKIP for expected failures netdev CI reserves SKIP in selftests for cases which can't be executed due to setup issues, like missing or old commands. Tests which are expected to fail must use XFAIL. Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251123021601.158709-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 00f3b3251814bebe17e1f52da09d0da165be07e8 Author: Andre Carvalho Date: Fri Nov 21 15:00:22 2025 +0000 selftests: netconsole: ensure required log level is set on netcons_basic This commit ensures that the required log level is set at the start of the test iteration. Part of the cleanup performed at the end of each test iteration resets the log level (do_cleanup in lib_netcons.sh) to the values defined at the time test script started. This may cause further test iterations to fail if the default values are not sufficient. Signed-off-by: Andre Carvalho Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20251121-netcons-basic-loglevel-v1-1-577f8586159c@gmail.com Signed-off-by: Jakub Kicinski commit d350d2835033bfa6833ff03bb2a7dc99a237d1c2 Merge: ef0b78b5b6cb13 5aadc155849eb8 Author: Jakub Kicinski Date: Mon Nov 24 18:51:44 2025 -0800 Merge branch 'selftests-hw-net-toeplitz-read-config-from-the-nic-directly' Jakub Kicinski says: ==================== selftests: hw-net: toeplitz: read config from the NIC directly First patch here tries to auto-disable building the iouring sample. Our CI will still run the iouring test(s), of course, but it looks like the liburing updates aren't very quick in distroes and having to hack around it when developing unrelated tests is a bit annoying. Remaining 4 patches iron out running the Toeplitz hash test against real NICs. I tested mlx5, bnxt and fbnic, they all pass now. I switched to using YNL directly in the C code, can't see a reason to get the info in Python and pass it to C via argv. The old code likely did this because it predates YNL. ==================== Link: https://patch.msgid.link/20251121040259.3647749-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5aadc155849eb85d799604939fd9e9024b7392a3 Author: Jakub Kicinski Date: Thu Nov 20 20:02:59 2025 -0800 selftests: hw-net: toeplitz: give the test up to 4 seconds Increase the receiver timeout. When running between machines in different geographic regions the test needs more than a second to SSH across and send the frames. The bkg() command that runs the receiver defaults to 5 sec timeout, so using 4 sec sounds like a reasonable value for the receiver itself. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251121040259.3647749-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c0105ffc5056852b16824bea9e8e0cd9a598d715 Author: Jakub Kicinski Date: Thu Nov 20 20:02:58 2025 -0800 selftests: hw-net: toeplitz: read indirection table from the device Replace the simple modulo math with the real indirection table read from the device. This makes the tests pass for mlx5 and bnxt NICs. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251121040259.3647749-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit aa91dbf3eda2977e3046d4838eadf7af4dbd47ec Author: Jakub Kicinski Date: Thu Nov 20 20:02:57 2025 -0800 selftests: hw-net: toeplitz: read the RSS key directly from C Now that we have YNL support for RSS accessing the RSS info from C is very easy. Instead of passing the RSS key from Python do it directly in the C code. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251121040259.3647749-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 27c512af190e037a6f330e9461fc4741fb77da45 Author: Jakub Kicinski Date: Thu Nov 20 20:02:56 2025 -0800 selftests: hw-net: toeplitz: make sure NICs have pure Toeplitz configured Make sure that the NIC under test is configured for pure Toeplitz hashing, and no input key transform (no symmetric hashing). Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251121040259.3647749-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f81171fecd0c33f442fe3aa94cff650d0069152a Author: Jakub Kicinski Date: Thu Nov 20 20:02:55 2025 -0800 selftests: hw-net: auto-disable building the iouring C code Looks like the liburing is not updated by distros very aggressively. Presumably because a lot of packages depend on it. I just updated to Fedora 43 and it's still on liburing 2.9. The test is 9mo old, at this stage I think this warrants handling the build failure more gracefully. Detect if iouring is recent enough and if not print a warning and exclude the C prog from build. The Python test will just fail since the binary won't exist. But it removes the major annoyance of having to update liburing from sources when developing other tests. Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251121040259.3647749-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ef0b78b5b6cb139af1273fc5f2720201556b2650 Author: Dan Carpenter Date: Fri Nov 21 16:35:10 2025 +0300 i40e: delete a stray tab This return statement is indented one tab too far. Delete a tab. Signed-off-by: Dan Carpenter Reviewed-by: Tony Nguyen Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/aSBqjtA8oF25G1OG@stanley.mountain Signed-off-by: Jakub Kicinski commit 90fb9b98fcf5e668a13676d6e8cd546b6990d002 Author: Jason A. Donenfeld Date: Tue Nov 25 02:54:37 2025 +0100 random: complete sentence of comment Complete the sentence by adding "is set", rather than having it dangle as a sentence fragment. Signed-off-by: Jason A. Donenfeld commit 9e0e6577b3e5e5cf7c1acd178eb648e8f830ba17 Author: Filipe Manana Date: Fri Nov 21 16:56:46 2025 +0000 btrfs: remove unnecessary inode key in btrfs_log_all_parents() We are setting up an inode key to lookup parent directory inode but all we need is the inode's objectid. The use of the key was necessary in the past but since commit 0202e83fdab0 ("btrfs: simplify iget helpers") we only need the objectid. So remove the key variable in the stack and use instead a simple u64 for the inode's objectid. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c3e03b34042c2dff15d7f262b768908e4b02537 Author: Filipe Manana Date: Fri Nov 21 15:56:14 2025 +0000 btrfs: remove redundant zero/NULL initializations in btrfs_alloc_root() We have allocated the root with kzalloc() so all the memory is already zero initialized, therefore it's redundant to assign 0 and NULL to several of the root members. Remove all of them except the atomic initializations since atomic_t is an opaque type and it's not a good practice to assume its internals. This slightly reduces the binary size. With gcc 14.2.0-19 from Debian on x86_64, before this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939404 162963 15592 2117959 205147 fs/btrfs/btrfs.ko After this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1939212 162963 15592 2117767 205087 fs/btrfs/btrfs.ko Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 10934c131f9bcfb616dd8be9456f11efd6b240ec Author: David Sterba Date: Tue Nov 18 17:06:46 2025 +0100 btrfs: remaining BTRFS_PATH_AUTO_FREE conversions Do the remaining btrfs_path conversion to the auto cleaning, this seems to be the last one. Most of the conversions are trivial, only adding the declaration and removing the freeing, or changing the goto patterns to return. There are some functions with many changes, like __btrfs_free_extent(), btrfs_remove_from_free_space_tree() or btrfs_add_to_free_space_tree() but it still follows the same pattern. Signed-off-by: David Sterba commit 5c9cac55b7a2c203cc135560fce053beea173c0f Author: Filipe Manana Date: Wed Nov 19 17:59:52 2025 +0000 btrfs: send: do not allocate memory for xattr data when checking it exists When checking if xattrs were deleted we don't care about their data, but we are allocating memory for the data and copying it, which only wastes time and can result in an unnecessary error in case the allocation fails. So stop allocating memory and copying data by making find_xattr() and __find_xattr() skip those steps if the given data buffer is NULL. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7c3acdb998dd723ac791cd4a47f13599d76a1f58 Author: Filipe Manana Date: Wed Nov 19 16:43:11 2025 +0000 btrfs: send: add unlikely to all unexpected overflow checks There are several checks for unexpected overflows of buffers and path lengths that makes us fail the send operation with an error if for some highly unexpected reason they happen. So add the unlikely tag to those checks to hint the compiler to generate better code, while also making it more explicit in the source that it's highly unexpected. With gcc 14.2.0-19 from Debian on x86_64, I also got a small reduction the text size of the btrfs module. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1936917 162723 15592 2115232 2046a0 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1936789 162723 15592 2115104 204620 fs/btrfs/btrfs.ko Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 139e3167d81143f9cd719fde420a825dae7b711d Author: Filipe Manana Date: Wed Nov 19 13:06:55 2025 +0000 btrfs: reduce arguments to btrfs_del_inode_ref_in_log() Instead of passing a root and the objectid of the parent directory, just pass the directory inode, as like that we can extract both the root and the objectid, reducing the number of arguments by one. It also makes the function more consistent with other log tree functions in the sense that we pass the inode and not only its objectid. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1361f7d8da3eb5a63ce520754d3e8c2db5790e7c Author: Filipe Manana Date: Wed Nov 19 13:01:20 2025 +0000 btrfs: remove root argument from btrfs_del_dir_entries_in_log() There's no need to pass the root as we can extract it from the directory inode, so remove it. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9c78fe4a85fd968e1202b6c8cd9306746039ce2b Author: Filipe Manana Date: Wed Nov 19 12:35:10 2025 +0000 btrfs: use test_and_set_bit() in btrfs_delayed_delete_inode_ref() Instead of testing and setting the BTRFS_DELAYED_NODE_DEL_IREF bit in the delayed node's flags, use test_and_set_bit() which makes the code shorter without compromising readability and getting rid of the label and goto. Reviewed-by: Johannes Thumshirn Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 70085399b1a1623ef488d96b4c2d0c67be1d0607 Author: Josef Bacik Date: Tue Nov 18 17:08:43 2025 +0100 btrfs: don't search back for dir inode item in INO_LOOKUP_USER We don't need to search back to the inode item, the directory inode number is in key.offset, so simply use that. If we can't find the directory we'll get an ENOENT at the iget(). Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Signed-off-by: Daniel Vacek Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba commit 0185c2292c600993199bc6b1f342ad47a9e8c678 Author: Josef Bacik Date: Tue Nov 18 17:08:41 2025 +0100 btrfs: don't rewrite ret from inode_permission In our user safe ino resolve ioctl we'll just turn any ret into -EACCES from inode_permission(). This is redundant, and could potentially be wrong if we had an ENOMEM in the security layer or some such other error, so simply return the actual return value. Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Fixes: 23d0b79dfaed ("btrfs: Add unprivileged version of ino_lookup ioctl") CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Signed-off-by: Daniel Vacek Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba commit bd45e9e3f6232f76fa9bd0e40c1e3409e4449f5e Author: Josef Bacik Date: Tue Nov 18 17:08:40 2025 +0100 btrfs: add orig_logical to btrfs_bio for encryption When checksumming the encrypted bio on writes we need to know which logical address this checksum is for. At the point where we get the encrypted bio the bi_sector is the physical location on the target disk, so we need to save the original logical offset in the btrfs_bio. Then we can use this when checksumming the bio instead of the bio->iter.bi_sector. Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Signed-off-by: Josef Bacik Signed-off-by: Daniel Vacek Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba commit 45d99129b64b2311cc067b38221d475942166118 Author: Sweet Tea Dorminy Date: Tue Nov 18 17:08:39 2025 +0100 btrfs: disable verity on encrypted inodes Right now there isn't a way to encrypt things that aren't either filenames in directories or data on blocks on disk with extent encryption, so for now, disable verity usage with encryption on btrfs. fscrypt with fsverity should be possible and it can be implemented in the future. Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Reviewed-by: Boris Burkov Signed-off-by: Sweet Tea Dorminy Signed-off-by: Daniel Vacek Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba commit f96834005386a1e44571e4077eaa7a43d9ca2318 Author: Omar Sandoval Date: Tue Nov 18 17:08:38 2025 +0100 btrfs: disable various operations on encrypted inodes Initially, only normal data extents will be encrypted. This change forbids various other bits: - allows reflinking only if both inodes have the same encryption status - disable inline data on encrypted inodes Note: The patch was taken from v5 of fscrypt patchset (https://lore.kernel.org/linux-btrfs/cover.1706116485.git.josef@toxicpanda.com/) which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik. Signed-off-by: Omar Sandoval Signed-off-by: Daniel Vacek Reviewed-by: David Sterba [ add note ] Signed-off-by: David Sterba commit 4357dd76f558f03fe22f28c360f7798ee3a0d238 Author: Sun YangKai Date: Fri Nov 14 15:24:48 2025 +0800 btrfs: remove redundant level reset in btrfs_del_items() When btrfs_del_items() empties a leaf, it deletes the leaf unless it's the root node. For the root leaf case, the code used to reset its level to 0 via btrfs_set_header_level(). This is redundant as leaf nodes always have level == 0. Remove the unnecessary level assignment and invert the conditional to handle only the non-root leaf deletion. The root leaf is correctly left as-is. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 139f75a3b1677c76bd845228ec49e50d69ce556e Author: Sun YangKai Date: Fri Nov 14 15:24:47 2025 +0800 btrfs: simplify leaf traversal after path release in btrfs_next_old_leaf() After releasing the path in btrfs_next_old_leaf(), we need to re-check the leaf because a balance operation may have added items or removed the last item. The original code handled this with two separate conditional blocks, the second marked with a lengthy comment explaining a "missed case". Merge these two blocks into a single logical structure that handles both scenarios more clearly. Also update the comment to be more concise and accurate, incorporating the explanation directly into the main block rather than a separate annotation. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3afa17bf243cf384e8caa64e1e3fad8b543c7c83 Author: Sun YangKai Date: Fri Nov 14 15:24:46 2025 +0800 btrfs: optimize balance_level() path reference handling Instead of incrementing refcount on 'left' node when it's referenced by path, simply transfer ownership to path and set left to NULL. This eliminates: - Unnecessary refcount increment/decrement operations - Redundant conditional checks for left node cleanup The path now consistently owns the left node reference when used. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 31b37b766753682ec1434bb591c5edee94649597 Author: Sun YangKai Date: Fri Nov 14 15:24:45 2025 +0800 btrfs: factor out root promotion logic into promote_child_to_root() The balance_level() function is overly long and contains a cold code path that handles promoting a child node to root when the root has only one item. This code has distinct logic that is clearer and more maintainable when isolated in its own function. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1a332a6d70475d87067038ab0cbda8292da955e1 Author: Qu Wenruo Date: Sun Nov 16 10:32:50 2025 +1030 btrfs: raid56: remove the "_step" infix The following functions are introduced as a middle step for bs > ps support: - rbio_streip_step_paddr() - rbio_pstripe_step_paddr() - rbio_qstripe_step_paddr() - sector_step_paddr_in_rbio() As there is already an existing function without the infix, and has a different parameter list. But the existing functions have been cleaned up, there is no need to keep the "_step" infix, just remove it completely. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 8870dbeedcf9576fbc5147654e272acad3d84089 Author: Qu Wenruo Date: Fri Nov 14 19:15:28 2025 +1030 btrfs: raid56: enable bs > ps support The support code for bs > ps is complete, enable it and update assertions. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 590699d85823f38b74d52a0811ef22ebb61afddc Author: Saket Kumar Bhaskar Date: Mon Nov 17 11:37:52 2025 +0530 selftests/bpf: Fix htab_update/reenter_update selftest failure Since commit 31158ad02ddb ("rqspinlock: Add deadlock detection and recovery") the updated path on re-entrancy now reports deadlock via -EDEADLK instead of the previous -EBUSY. Also, the way reentrancy was exercised (via fentry/lookup_elem_raw) has been fragile because lookup_elem_raw may be inlined (find_kernel_btf_id() will return -ESRCH). To fix this fentry is attached to bpf_obj_free_fields() instead of lookup_elem_raw() and: - The htab map is made to use a BTF-described struct val with a struct bpf_timer so that check_and_free_fields() reliably calls bpf_obj_free_fields() on element replacement. - The selftest is updated to do two updates to the same key (insert + replace) in prog_test. - The selftest is updated to align with expected errno with the kernel’s current behavior. Signed-off-by: Saket Kumar Bhaskar Tested-by: Venkat Rao Bagalkote Link: https://lore.kernel.org/r/20251117060752.129648-1-skb99@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 89ca1a403e541236e56d184634b0e4e5175c0054 Author: Qu Wenruo Date: Fri Nov 14 15:29:46 2025 +1030 btrfs: raid56: prepare finish_parity_scrub() to support bs > ps cases The function finish_parity_scrub() assume each fs block can be mapped by one page, blocking bs > ps support for raid56. Prepare it for bs > ps cases by: - Introduce a helper, verify_one_parity_step() Since the P/Q generation is always done in a vertical stripe, we have to handle the range step by step. - Only clear the rbio->dbitmap if all steps of an fs block match - Remove rbio_stripe_paddr() and sector_paddr_in_rbio() helpers Now we either use the paddrs version for checksum, or the step version for P/Q generation/recovery. - Make alloc_rbio_essential_pages() to handle bs > ps cases Since for bs > ps cases, one fs block needs multiple pages, the existing simple check against rbio->stripe_pages[] is not enough. Extract a dedicated helper, alloc_rbio_sector_pages(), for the existing alloc_rbio_essential_pages(), which is still based on sector number. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit ba88278c69982b2c4007cd1912961fbb60693950 Author: Qu Wenruo Date: Fri Nov 14 14:39:09 2025 +1030 btrfs: raid56: prepare rbio_bio_add_io_paddr() to support bs > ps cases The function rbio_bio_add_io_paddr() assume each fs block can be mapped by one page, blocking bs > ps support for raid56. Prepare it for bs > ps cases by: - Introduce a helper bio_add_paddrs() Previously we only need to add a single page to a bio for a fs block, but now we need to add multiple pages, this means we can fail halfway. In that case we need to properly revert the bio (only for its size though) for halfway failed cases. - Rename rbio_add_io_paddr() to rbio_add_io_paddrs() And change the @paddr parameter to @paddrs[]. - Change all callers to use the updated rbio_add_io_paddrs() For the @paddrs pointer used for the new function, it can be grabbed using sector_paddrs_in_rbio() and rbio_stripe_paddrs() helpers. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 53474a2ae17401821ce83c3b11f3d159f6b3583a Author: Qu Wenruo Date: Mon Nov 17 14:39:51 2025 +1030 btrfs: raid56: prepare steal_rbio() to support bs > ps cases The function steal_rbio() assume each fs block can be mapped by one page, blocking bs > ps support for raid56. Prepare it for bs > ps cases by: - Introduce two helpers to calculate the sector number Previously we assume one page will contain at least one fs block, thus can use something like "sectors_per_page = PAGE_SIZE / sectorsize;", but with bs > ps support that above number will be 0. Instead introduce two helpers: * page_nr_to_sector_nr() Returns the sector number of the first sector covered by the page. * page_nr_to_num_sectors() Return how many sectors are covered by the page. And use the returned values for bitmap operations other than open-coded "PAGE_SIZE / sectorsize". Those helpers also have extra ASSERT()s to catch weird numbers. - Use above helpers The involved functions are: * steal_rbio_page() * is_data_stripe_page() * full_page_sectors_uptodate() Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 05ddf35a5d3d8d58323d6353f2bad026e9838af8 Author: Qu Wenruo Date: Mon Nov 17 13:57:55 2025 +1030 btrfs: raid56: prepare set_bio_pages_uptodate() to support bs > ps cases The function set_bio_pages_uptodate() assume each fs block can be mapped by one page, blocking bs > ps support for raid56. Prepare it for bs > ps cases by: - Update find_stripe_sector_nr() to check only the first step paddr We don't need to check each paddr, as the bios are still aligned to fs block size, thus checking the first step is enough. - Use step size to iterate the bio This means we only need to find the sector number for the first step of each fs block, and skip the remaining part. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 64e7b8c7c5873ad03e108d775fa1c0063a320070 Author: Qu Wenruo Date: Fri Nov 14 14:30:25 2025 +1030 btrfs: raid56: prepare verify_bio_data_sectors() to support bs > ps cases The function verify_bio_data_sectors() assume each fs block can be mapped by one page, blocking bs > ps support for raid56. Prepare it for bs > ps cases by: - Make get_bio_sector_nr() to consider bs > ps cases The function is utilized to calculate the sector number of a device bio submitted by btrfs raid56 layer. - Assemble a local paddrs[] for checksum calculation - Open code btrfs_check_block_csum() btrfs_check_block_csum() only supports fs blocks backed by large folios. But for raid56 we can have fs blocks backed by multiple non-contiguous pages, e.g. direct IO, encoded read/write/send. So instead of using btrfs_check_block_csum(), open code it to use btrfs_calculate_block_csum_pages(). Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit e0eadfcc959d282baafb3ba0c0c1bc4461669523 Author: Qu Wenruo Date: Fri Nov 14 14:01:15 2025 +1030 btrfs: raid56: prepare verify_one_sector() to support bs > ps cases The function verify_one_sector() assume each fs block can be mapped by one page, blocking bs > ps support for raid56. Prepare it for bs > ps cases by: - Introduce helpers to get a paddrs pointer Thankfully all the higher layer bio should still be aligned to fs block size, thus a fs block should still be fully covered by the bio. Introduce sector_paddrs_in_rbio() and rbio_stripe_paddrs(), which will return a paddrs pointer inside btrfs_raid_bio::bio_paddrs[] or stripe_paddrs[]. The pointer can be directly passed to btrfs_calculate_block_csum_pages() to verify the checksum. - Open code btrfs_check_block_csum() btrfs_check_block_csum() only supports fs blocks backed by large folios. But for raid56 we can have fs blocks backed by multiple non-contiguous pages, e.g. direct IO, encoded read/write/send. So instead of using btrfs_check_block_csum(), open code it to use btrfs_calculate_block_csum_pages(). Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 9ba67fd616d6cfbf8b90c336195819e7494645bb Author: Qu Wenruo Date: Fri Nov 14 13:49:33 2025 +1030 btrfs: raid56: prepare recover_vertical() to support bs > ps cases Currently recover_vertical() assumes that every fs block can be mapped by one page, this is blocking bs > ps support for raid56. Prepare recover_vertical() to support bs > ps cases by: - Introduce recover_vertical_step() helper Which will recover a full step (min(PAGE_SIZE, sectorsize)). Now recover_vertical() will do the error check for the specified sector, do the recover step by step, then do the sector verification. - Fix a spelling error of get_rbio_vertical_errors() The old name has a typo: "veritical". Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 826325b6d091fdf93cc04fb5e8e462409635a469 Author: Qu Wenruo Date: Thu Nov 13 20:10:38 2025 +1030 btrfs: raid56: prepare generate_pq_vertical() for bs > ps cases Unlike btrfs_calculate_block_csum_pages(), we cannot handle multiple pages at the same time for P/Q generation. So here we introduce a new @step_nr, and various helpers to grab the sub-block page from the rbio, and generate the P/Q stripe page by page. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 91cd1b586578017e20103771615db75dd8df5727 Author: Qu Wenruo Date: Thu Nov 13 19:11:36 2025 +1030 btrfs: raid56: introduce a new parameter to locate a sector Since we cannot ensure that all bios from the higher layer are backed by large folios (e.g. direct IO, encoded read/write/send), we need the ability to locate sub-block (aka, a page) inside a full stripe. So the existing @stripe_nr + @sector_nr combination is not enough to locate such page for bs > ps cases. Introduce a new parameter, @step_nr, to locate the page of a larger fs block. The naming is following the conventions used inside btrfs elsewhere, where one step is min(sectorsize, PAGE_SIZE). It's still a preparation, only touching the following aspects: - btrfs_dump_rbio() To show the new @sector_nsteps member. - btrfs_raid_bio::sector_nsteps Recording how many steps there are inside a fs block. - Enlarge btrfs_raid_bio::*_paddrs[] size To take @sector_nsteps into consideration. - index_one_bio() - index_stripe_sectors() - memcpy_from_bio_to_stripe() - cache_rbio_pages() - need_read_stripe_sectors() Those functions are iterating *_paddrs[], which needs to take sector_nsteps into consideration. - Rename rbio_stripe_sector_index() to rbio_sector_index() The "stripe" part is not that helpful. And an extra ASSERT() before returning the result. - Add a new rbio_paddr_index() helper This will take the extra @step_nr into consideration. - The comments of btrfs_raid_bio Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 9042dc00023f6d8e8e52cf3df78ef3ba3e212ece Author: Qu Wenruo Date: Thu Nov 13 18:54:25 2025 +1030 btrfs: raid56: add an overview for the btrfs_raid_bio structure The structure needs to track both the pages from higher layer bio and internal pages, thus it can be a little complex to grasp. Add an overview of the structure, especially how we track different pages from higher layer bios and internal ones, to save some time for future developers. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6f84ceb98538523f49d544aa7c671c87cc23d1b1 Author: Viacheslav Dubeyko Date: Mon Nov 24 16:04:29 2025 -0800 hfsplus: introduce KUnit tests for HFS+ string operations This patch implements the Kunit based set of unit tests for HFS+ string operations. It checks functionality of hfsplus_strcasecmp(), hfsplus_strcmp(), hfsplus_uni2asc(), hfsplus_asc2uni(), hfsplus_hash_dentry(), and hfsplus_compare_dentry(). ./tools/testing/kunit/kunit.py run --kunitconfig ./fs/hfsplus/.kunitconfig [14:38:05] Configuring KUnit Kernel ... [14:38:05] Building KUnit Kernel ... Populating config with: $ make ARCH=um O=.kunit olddefconfig Building with: $ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=22 [14:38:09] Starting KUnit Kernel (1/1)... [14:38:09] ============================================================ Running tests with: $ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt [14:38:09] ============== hfsplus_unicode (27 subtests) =============== [14:38:09] [PASSED] hfsplus_strcasecmp_test [14:38:09] [PASSED] hfsplus_strcmp_test [14:38:09] [PASSED] hfsplus_unicode_edge_cases_test [14:38:09] [PASSED] hfsplus_unicode_boundary_test [14:38:09] [PASSED] hfsplus_uni2asc_basic_test [14:38:09] [PASSED] hfsplus_uni2asc_special_chars_test [14:38:09] [PASSED] hfsplus_uni2asc_buffer_test [14:38:09] [PASSED] hfsplus_uni2asc_corrupted_test [14:38:09] [PASSED] hfsplus_uni2asc_edge_cases_test [14:38:09] [PASSED] hfsplus_asc2uni_basic_test [14:38:09] [PASSED] hfsplus_asc2uni_special_chars_test [14:38:09] [PASSED] hfsplus_asc2uni_buffer_limits_test [14:38:09] [PASSED] hfsplus_asc2uni_edge_cases_test [14:38:09] [PASSED] hfsplus_asc2uni_decompose_test [14:38:09] [PASSED] hfsplus_hash_dentry_basic_test [14:38:09] [PASSED] hfsplus_hash_dentry_casefold_test [14:38:09] [PASSED] hfsplus_hash_dentry_special_chars_test [14:38:09] [PASSED] hfsplus_hash_dentry_decompose_test [14:38:09] [PASSED] hfsplus_hash_dentry_consistency_test [14:38:09] [PASSED] hfsplus_hash_dentry_edge_cases_test [14:38:09] [PASSED] hfsplus_compare_dentry_basic_test [14:38:09] [PASSED] hfsplus_compare_dentry_casefold_test [14:38:09] [PASSED] hfsplus_compare_dentry_special_chars_test [14:38:09] [PASSED] hfsplus_compare_dentry_length_test [14:38:09] [PASSED] hfsplus_compare_dentry_decompose_test [14:38:09] [PASSED] hfsplus_compare_dentry_edge_cases_test [14:38:09] [PASSED] hfsplus_compare_dentry_combined_flags_test [14:38:09] ================= [PASSED] hfsplus_unicode ================= [14:38:09] ============================================================ [14:38:09] Testing complete. Ran 27 tests: passed: 27 [14:38:09] Elapsed time: 3.875s total, 0.001s configuring, 3.707s building, 0.115s running v2 Rework memory management model. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Signed-off-by: Viacheslav Dubeyko commit 48f014356698a3525959a9eb343dc67b5a5c6842 Author: Ilpo Järvinen Date: Mon Nov 24 17:37:40 2025 +0200 PCI: Validate pci_rebar_size_supported() input According to Dan Carpenter, smatch detects issue with size parameter given to pci_rebar_size_supported(): drivers/pci/rebar.c:142 pci_rebar_size_supported() error: undefined (user controlled) shift '(((1))) << size' The problem is this call tree, which uses the 'size' from the user to shift in BIT() without validating it: __resource_resize_store # takes 'buf' from user sysfs write kstrtoul(buf, 0, &size) # converts to unsigned long pci_resize_resource # truncates to int pci_rebar_size_supported # BIT(size) without validation There could be similar problems also with pci_resize_resource() parameter values coming from drivers. Add 'size' validation to pci_rebar_size_supported(). There seems to be no SZ_128T prior to this so add one to be able to specify the largest size supported by the kernel (PCIe r7.0 spec already defines sizes even beyond 128TB but kernel does not yet support them). The issue looks older than the introduction of pci_rebar_size_supported() by bb1fabd0d94e ("PCI: Add pci_rebar_size_supported() helper"). It would be also nice to convert 'size' unsigned too everywhere, maybe even u8 but that is left as further work. Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aSA1WiRG3RuhqZMY@stanley.mountain/ Signed-off-by: Ilpo Järvinen [bhelgaas: commit log, add report URL] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251124153740.2995-1-ilpo.jarvinen@linux.intel.com commit 84a8d467cc426eb3c9eb34092423dcc54493dd7e Author: Richard Weinberger Date: Sat Nov 22 22:19:20 2025 +0100 pagemap: update BUDDY flag documentation Since v4.6 the BUDDY flag is set for _all_ pages in the block and no longer just for the first one. This change was introduced by: commit 832fc1de01ae ("/proc/kpageflags: return KPF_BUDDY for "tail" buddy pages") Strictly speaking, this was an ABI change, but as nobody has noticed since 2016, let's just update the documentation. Link: https://lkml.kernel.org/r/20251122211920.3410371-1-richard@nod.at Signed-off-by: Richard Weinberger Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Mike Rapoport (Microsoft) Cc: Vladimir Davydov > Cc: Konstantin Khlebnikov Cc: Naoya Horiguchi Signed-off-by: Andrew Morton commit b7dd80f8f92848fa26518119f2c378dad8b7c0da Author: Youngjun Park Date: Fri Oct 31 15:50:11 2025 +0900 mm: swap: remove scan_swap_map_slots() references from comments The scan_swap_map_slots() helper has been removed, but several comments still referred to it in swap allocation and reclaim paths. This patch cleans up those outdated references and reflows the affected comment blocks to match kernel coding style. Link: https://lkml.kernel.org/r/20251031065011.40863-6-youngjun.park@lge.com Signed-off-by: Youngjun Park Reviewed-by: Baoquan He Acked-by: Chris Li Cc: Barry Song Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit 4c239d5f594e81f05a78d7a6c8b80a039e393970 Author: Youngjun Park Date: Fri Oct 31 15:50:10 2025 +0900 mm: swap: change swap_alloc_slow() to void swap_alloc_slow() does not need to return a bool, as all callers handle allocation results via the entry parameter. Update the function signature and remove return statements accordingly. Link: https://lkml.kernel.org/r/20251031065011.40863-5-youngjun.park@lge.com Signed-off-by: Youngjun Park Reviewed-by: Kairui Song Reviewed-by: Baoquan He Acked-by: Chris Li Cc: Barry Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit f1bae15c6ad59870eca7824c66e40ee7469ee0fd Author: Youngjun Park Date: Fri Oct 31 15:50:09 2025 +0900 mm, swap: remove redundant comment for read_swap_cache_async The function now manages get/put_swap_device() internally, making the comment explaining this behavior to callers unnecessary. Link: https://lkml.kernel.org/r/20251031065011.40863-4-youngjun.park@lge.com Signed-off-by: Youngjun Park Reviewed-by: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit 68f78bf55b2407947be2be7f854d1310cff607d9 Author: Youngjun Park Date: Fri Oct 31 15:50:08 2025 +0900 mm, swap: use SWP_SOLIDSTATE to determine if swap is rotational The current non rotational check is unreliable as the device's rotational status can be changed by a user via sysfs. Use the more reliable SWP_SOLIDSTATE flag which is set at swapon time, to ensure the nr_rotate_swap count remains consistent. Plus, it is easy to read and simple. Link: https://lkml.kernel.org/r/20251031065011.40863-3-youngjun.park@lge.com Fixes: 81a0298bdfab ("mm, swap: don't use VMA based swap readahead if HDD is used as swap") Signed-off-by: Youngjun Park Reviewed-by: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit cb65082a0ab44ccdd574d61feb59a857f2b1c914 Author: Youngjun Park Date: Fri Oct 31 15:50:07 2025 +0900 mm, swap: fix memory leak in setup_clusters() error path Patch series "mm: swap: small fixes and comment cleanups", v2. This series provides a few small fixes and cleanups for the swap code. The first patch fixes a memory leak in an error path that was recently introduced. The subsequent patches include minor logic adjustments and the removal of redundant comments. This patch (of 5): setup_clusters() could leak 'cluster_info' memory if an error occurred on a path that did not jump to the 'err_free' label. This patch simplifies the error handling by removing the goto label and instead calling free_cluster_info() on all error exit paths. The new logic is safe, as free_cluster_info() already handles NULL pointer inputs. Link: https://lkml.kernel.org/r/20251031065011.40863-1-youngjun.park@lge.com Link: https://lkml.kernel.org/r/20251031065011.40863-2-youngjun.park@lge.com Fixes: 07adc4cf1ecd ("mm, swap: implement dynamic allocation of swap table") Signed-off-by: Youngjun Park Reviewed-by: Kairui Song Reviewed-by: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit c23071952394eaef4f06d1b71a90392d2650af0d Author: Youngjun Park Date: Wed Nov 19 20:41:36 2025 +0900 mm/swap: fix wrong plist empty check in swap_alloc_slow() swap_alloc_slow() was checking `si->avail_list` instead of `next->avail_list` when verifying if the next swap device is still in the list, which could cause unnecessary restarts during allocation. Link: https://lkml.kernel.org/r/20251119114136.594108-1-youngjun.park@lge.com Fixes: 8e689f8ea45f ("mm/swap: do not choose swap device according to numa node") Signed-off-by: Youngjun Park Acked-by: Kairui Song Reviewed-by: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kemeng Shi Cc: Nhat Pham Signed-off-by: Andrew Morton commit a9ce09b15761e0f3a413a4a79097d17e19bd3ec1 Author: Dan Carpenter Date: Fri Nov 21 16:36:38 2025 +0300 mm/damon/tests/sysfs-kunit: fix use after free on error path Re-order these frees to avoid dereferencing "sysfs_target" after it has been freed. Link: https://lkml.kernel.org/r/aSBq5uSPIqsqH8zO@stanley.mountain Fixes: ee131696794c ("mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets()") Signed-off-by: Dan Carpenter Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 348ced3da52b3161f5ceec8868e81973ce48e11d Author: Gregory Price Date: Fri Nov 21 14:48:59 2025 -0500 hugetlb: add __read_mostly to sysctl_hugetlb_shm_group sysctl bits are mostly-read values. Link: https://lkml.kernel.org/r/20251121194859.265259-2-gourry@gourry.net Signed-off-by: Gregory Price Suggested-by: Andrew Morton Acked-by: Oscar Salvador Signed-off-by: Andrew Morton commit ccf9eb326b4aabcd61e71d87469cafd6c5f01308 Author: Lorenzo Stoakes Date: Fri Nov 21 17:25:18 2025 +0000 tools/testing/vma: add missing stub vm_flags_reset() is not available in the userland VMA tests, so add a stub which const-casts vma->vm_flags and avoids the upcoming removal of the vma->__vm_flags field. Link: https://lkml.kernel.org/r/4aff8bf7-d367-4ba3-90ad-13eef7a063fa@lucifer.local Fixes: c5c67c1de357 ("tools/testing/vma: eliminate dependency on vma->__vm_flags") Signed-off-by: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 04d31610a7221cca624646241b1f6b3edd6c99fd Author: Yuwen Chen Date: Wed Nov 19 12:13:45 2025 +0800 zram: fix the issue that the write - back limits might overflow When the page size exceeds 4KB, if bd_wb_limit is set to a value that is not aligned with the page size, it will cause a numerical wrap-around issue for bd_wb_limit. For example, when the page size is set to 16KB and bd_wb_limit is set to 3, after one write-back operation, the value of bd_wb_limit will become -1. More seriously, since bd_wb_limit is an unsigned number, its value may become as large as 2^64 - 1. The core reason for this problem is that the unit of bd_wb_limit is 4KB. For example, when a write-back occurs on a system with a page size of 16KB, 4 needs to be subtracted from bd_wb_limit. This operation takes place in the zram_account_writeback_submit function. This patch fixes the issue by limiting bd_wb_limit to be an integer multiple of PAGE_SIZE / 4096. Link: https://lkml.kernel.org/r/tencent_5936CFE72BAB2BA76887BB69DCC1B5E67C05@qq.com Fixes: 1d69a3f8ae77 ("zram: idle writeback fixes and cleanup") Signed-off-by: Yuwen Chen Acked-by: Sergey Senozhatsky Cc: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Signed-off-by: Andrew Morton commit ecf371b2cabee6a2bfb61f87d71c9f02a9ff34d7 Author: Matthew Wilcox (Oracle) Date: Wed Nov 19 04:26:35 2025 +0000 mm: tweak __vma_enter_locked() Move the commentary on how __vma_enter_locked() behaves from the body of __vma_start_write() to the head of __vma_enter_locked() and merge it with the existing documentation. Also add a call to mmap_assert_write_locked(). Link: https://lkml.kernel.org/r/20251119042639.3937024-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Lorenzo Stoakes Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 31807483d3952059d395c2a73b1fa9625db9b366 Author: Xie Yuanbin Date: Wed Nov 19 17:59:43 2025 +0800 mm/memory-failure: remove the selection of RAS commit 97f0b13452198290799f ("tracing: add trace event for memory-failure") introduces the selection of RAS in memory-failure. This commit is just a tracing feature; in reality, there is no dependency between memory-failure and RAS. RAS increases the size of the bzImage image by 8k, which is very valuable for embedded devices. Move the memory-failure traceing code from ras_event.h to memory-failure.h and remove the selection of RAS. Link: https://lkml.kernel.org/r/20251119095943.67125-1-xieyuanbin1@huawei.com Signed-off-by: Xie Yuanbin Acked-by: David Hildenbrand (Red Hat) Acked-by: Miaohe Lin Cc: Borislav Petkov Signed-off-by: Andrew Morton commit 519912bdaee8ae8529241d4763326e6120489459 Author: Chunyan Zhang Date: Thu Nov 13 15:28:06 2025 +0800 dt-bindings: riscv: Add Svrsw60t59b extension description Add description for the Svrsw60t59b extension (PTE Reserved for SW bits 60:59) extension which was ratified recently in riscv-non-isa/riscv-iommu. Link: https://lkml.kernel.org/r/20251113072806.795029-7-zhangchunyan@iscas.ac.cn Acked-by: Conor Dooley Signed-off-by: Chunyan Zhang Cc: Albert Ou Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Al Viro Cc: Andrew Jones Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Christian Brauner Cc: Conor Dooley Cc: David Hildenbrand Cc: Deepak Gupta Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Xu Cc: Rob Herring Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit c64da3950cf45d5fd87d7754ab4698b8cec01cae Author: Chunyan Zhang Date: Thu Nov 13 15:28:05 2025 +0800 riscv: mm: add userfaultfd write-protect support The Svrsw60t59b extension allows to free the PTE reserved bits 60 and 59 for software, this patch uses bit 60 for uffd-wp tracking Additionally for tracking the uffd-wp state as a PTE swap bit, we borrow bit 4 which is not involved into swap entry computation. Link: https://lkml.kernel.org/r/20251113072806.795029-6-zhangchunyan@iscas.ac.cn Signed-off-by: Chunyan Zhang Cc: Albert Ou Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Al Viro Cc: Andrew Jones Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Christian Brauner Cc: Conor Dooley Cc: Conor Dooley Cc: David Hildenbrand Cc: Deepak Gupta Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Xu Cc: Rob Herring Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 2a3ebad4db63e86a9443d6bff4a5977320dc09f6 Author: Chunyan Zhang Date: Thu Nov 13 15:28:04 2025 +0800 riscv: mm: add soft-dirty page tracking support The Svrsw60t59b extension allows to free the PTE reserved bits 60 and 59 for software, this patch uses bit 59 for soft-dirty. To add swap PTE soft-dirty tracking, we borrow bit 3 which is available for swap PTEs on RISC-V systems. Link: https://lkml.kernel.org/r/20251113072806.795029-5-zhangchunyan@iscas.ac.cn Signed-off-by: Chunyan Zhang Reviewed-by: Deepak Gupta Cc: Albert Ou Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Al Viro Cc: Andrew Jones Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Christian Brauner Cc: Conor Dooley Cc: Conor Dooley Cc: David Hildenbrand Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Xu Cc: Rob Herring Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 59f6acb4be0209b1451ac186c6d7d4175889c949 Author: Chunyan Zhang Date: Thu Nov 13 15:28:03 2025 +0800 riscv: add RISC-V Svrsw60t59b extension support The Svrsw60t59b extension allows to free the PTE reserved bits 60 and 59 for software to use. Link: https://lkml.kernel.org/r/20251113072806.795029-4-zhangchunyan@iscas.ac.cn Signed-off-by: Chunyan Zhang Reviewed-by: Alexandre Ghiti Reviewed-by: Andrew Jones Reviewed-by: Deepak Gupta Cc: Albert Ou Cc: Alexandre Ghiti Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Christian Brauner Cc: Conor Dooley Cc: Conor Dooley Cc: David Hildenbrand Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Xu Cc: Rob Herring Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit f59c0924d61aa2a2bb85936a593140f327112787 Author: Chunyan Zhang Date: Thu Nov 13 15:28:02 2025 +0800 mm: userfaultfd: add pgtable_supports_uffd_wp() Some platforms can customize the PTE/PMD entry uffd-wp bit making it unavailable even if the architecture provides the resource. This patch adds a macro API pgtable_supports_uffd_wp() that allows architectures to define their specific implementations to check if the uffd-wp bit is available on which device the kernel is running. Also this patch is removing "ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP" and "ifdef CONFIG_PTE_MARKER_UFFD_WP" in favor of pgtable_supports_uffd_wp() and uffd_supports_wp_marker() checks respectively that default to IS_ENABLED(CONFIG_HAVE_ARCH_USERFAULTFD_WP) and "IS_ENABLED(CONFIG_HAVE_ARCH_USERFAULTFD_WP) && IS_ENABLED(CONFIG_PTE_MARKER_UFFD_WP)" if not overridden by the architecture, no change in behavior is expected. Link: https://lkml.kernel.org/r/20251113072806.795029-3-zhangchunyan@iscas.ac.cn Signed-off-by: Chunyan Zhang Acked-by: David Hildenbrand Cc: Albert Ou Cc: Alexandre Ghiti Cc: Alexandre Ghiti Cc: Al Viro Cc: Andrew Jones Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Christian Brauner Cc: Conor Dooley Cc: Conor Dooley Cc: Deepak Gupta Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Xu Cc: Rob Herring Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 277a1ae3879a82a15a2e2d6741e38e31ea6487ee Author: Chunyan Zhang Date: Thu Nov 13 15:28:01 2025 +0800 mm: softdirty: add pgtable_supports_soft_dirty() Patch series "mm: Add soft-dirty and uffd-wp support for RISC-V", v15. This patchset adds support for Svrsw60t59b [1] extension which is ratified now, also add soft dirty and userfaultfd write protect tracking for RISC-V. The patches 1 and 2 add macros to allow architectures to define their own checks if the soft-dirty / uffd_wp PTE bits are available, in other words for RISC-V, the Svrsw60t59b extension is supported on which device the kernel is running. Also patch1-2 are removing "ifdef CONFIG_MEM_SOFT_DIRTY" "ifdef CONFIG_HAVE_ARCH_USERFAULTFD_WP" and "ifdef CONFIG_PTE_MARKER_UFFD_WP" in favor of checks which if not overridden by the architecture, no change in behavior is expected. This patchset has been tested with kselftest mm suite in which soft-dirty, madv_populate, test_unmerge_uffd_wp, and uffd-unit-tests run and pass, and no regressions are observed in any of the other tests. This patch (of 6): Some platforms can customize the PTE PMD entry soft-dirty bit making it unavailable even if the architecture provides the resource. Add an API which architectures can define their specific implementations to detect if soft-dirty bit is available on which device the kernel is running. This patch is removing "ifdef CONFIG_MEM_SOFT_DIRTY" in favor of pgtable_supports_soft_dirty() checks that defaults to IS_ENABLED(CONFIG_MEM_SOFT_DIRTY), if not overridden by the architecture, no change in behavior is expected. We make sure to never set VM_SOFTDIRTY if !pgtable_supports_soft_dirty(), so we will never run into VM_SOFTDIRTY checks. [lorenzo.stoakes@oracle.com: fix VMA selftests] Link: https://lkml.kernel.org/r/dac6ddfe-773a-43d5-8f69-021b9ca4d24b@lucifer.local Link: https://lkml.kernel.org/r/20251113072806.795029-1-zhangchunyan@iscas.ac.cn Link: https://lkml.kernel.org/r/20251113072806.795029-2-zhangchunyan@iscas.ac.cn Link: https://github.com/riscv-non-isa/riscv-iommu/pull/543 [1] Signed-off-by: Chunyan Zhang Acked-by: David Hildenbrand Cc: Albert Ou Cc: Alexandre Ghiti Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Christian Brauner Cc: Conor Dooley Cc: Deepak Gupta Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Xu Cc: Rob Herring Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yuanchu Xie Cc: Alexandre Ghiti Cc: Andrew Jones Cc: Conor Dooley Signed-off-by: Andrew Morton commit d85b653f2c469285b760558bccbee4a45e47f3e2 Author: Vishal Moola (Oracle) Date: Fri Nov 21 01:44:05 2025 -0800 mm/vmalloc: cleanup gfp flag use in new_vmap_block() The only caller, vb_alloc(), passes GFP_KERNEL into new_vmap_block() which is a subset of GFP_RECLAIM_MASK. Since there's no reason to use this mask here, remove it. Link: https://lkml.kernel.org/r/20251121094405.40628-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: "Uladzislau Rezki (Sony)" Acked-by: SeongJae Park Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit 75f20b17440fdaee33a6de2efe3c162e6b19e18e Author: Vishal Moola (Oracle) Date: Fri Nov 21 01:44:04 2025 -0800 mm/vmalloc: cleanup large_gfp in vm_area_alloc_pages() Now that we have already checked for unsupported flags, we can use the helper function to set the necessary gfp flags for the large order allocation optimization. Link: https://lkml.kernel.org/r/20251121094405.40628-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: "Uladzislau Rezki (Sony)" Acked-by: SeongJae Park Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit bb4d3c76860d555aa4cd4b2da44111057066402d Author: Vishal Moola (Oracle) Date: Fri Nov 21 01:44:03 2025 -0800 mm/vmalloc: add a helper to optimize vmalloc allocation gfps vm_area_alloc_pages() attempts to use different gfp flags as a way to optimize allocations. This has been done inline which makes things harder to read. Add a helper function to make the code more readable. Link: https://lkml.kernel.org/r/20251121094405.40628-3-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: "Uladzislau Rezki (Sony)" Acked-by: SeongJae Park Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit 07003531e03c864b0711757c8009c7f14c95d1d1 Author: Vishal Moola (Oracle) Date: Fri Nov 21 01:44:02 2025 -0800 mm/vmalloc: warn on invalid vmalloc gfp flags Patch series "make vmalloc gfp flags usage more apparent", v4. We should do a better job at enforcing gfp flags for vmalloc. Right now, we have a kernel-doc for __vmalloc_node_range(), and hope callers pass in supported flags. If a caller were to pass in an unsupported flag, we may BUG, silently clear it, or completely ignore it. If we are more proactive about enforcing gfp flags, we can making sure callers know when they may be asking for unsupported behavior. This patchset lets vmalloc control the incoming gfp flags, and cleans up some hard to read gfp code. This patch (of 4): Vmalloc explicitly supports a list of flags, but we never enforce them. vmalloc has been trying to handle unsupported flags by clearing and setting flags wherever necessary. This is messy and makes the code harder to understand, when we could simply check for a supported input immediately instead. Define a helper mask and function telling callers they have passed in invalid flags, and clear those unsupported vmalloc flags. Link: https://lkml.kernel.org/r/20251121094405.40628-1-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20251121094405.40628-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Reviewed-by: "Uladzislau Rezki (Sony)" Acked-by: SeongJae Park Signed-off-by: Andrew Morton commit c1bd09994c4d5b897571671bed16581335e93242 Author: Shakeel Butt Date: Mon Nov 10 15:20:08 2025 -0800 memcg: remove __lruvec_stat_mod_folio __lruvec_stat_mod_folio() is already safe against irqs, so there is no need to have a separate interface (i.e. lruvec_stat_mod_folio) which wraps calls to it with irq disabling and reenabling. Let's rename __lruvec_stat_mod_folio() to lruvec_stat_mod_folio(). Link: https://lkml.kernel.org/r/20251110232008.1352063-5-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Reviewed-by: Harry Yoo Acked-by: Roman Gushchin Acked-by: Vlastimil Babka Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Qi Zheng Signed-off-by: Andrew Morton commit 5b3eb779a20cf30d74bb346d2a1e525bc9072685 Author: Shakeel Butt Date: Mon Nov 10 15:20:07 2025 -0800 memcg: remove __mod_lruvec_state __mod_lruvec_state() is already safe against irqs, so there is no need to have a separate interface (i.e. mod_lruvec_state) which wraps calls to it with irq disabling and reenabling. Let's rename __mod_lruvec_state() to mod_lruvec_state(). Link: https://lkml.kernel.org/r/20251110232008.1352063-4-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Reviewed-by: Harry Yoo Acked-by: Roman Gushchin Acked-by: Vlastimil Babka Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Qi Zheng Signed-off-by: Andrew Morton commit 469241fe7657dbec9e2948287ab7412955d8b73a Author: Shakeel Butt Date: Mon Nov 10 15:20:06 2025 -0800 memcg: remove __mod_lruvec_kmem_state __mod_lruvec_kmem_state() is already safe against irqs, so there is no need to have a separate interface (i.e. mod_lruvec_kmem_state) which wraps calls to it with irq disabling and reenabling. Let's rename __mod_lruvec_kmem_state() to mod_lruvec_kmem_state(). Link: https://lkml.kernel.org/r/20251110232008.1352063-3-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Reviewed-by: Harry Yoo Reviewed-by: Qi Zheng Acked-by: Vlastimil Babka Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 7e44d00a13ca5691caf4f7c46541ee60bf75b208 Author: Shakeel Butt Date: Mon Nov 10 15:20:05 2025 -0800 memcg: use mod_node_page_state to update stats Patch series "memcg: cleanup the memcg stats interfaces". The memcg stats are safe against irq (and nmi) context and thus does not require disabling irqs. However for some stats which are also maintained at node level, it is using irq unsafe interface and thus requiring the users to still disables irqs or use interfaces which explicitly disables irqs. Let's move memcg code to use irq safe node level stats function which is already optimized for architectures with HAVE_CMPXCHG_LOCAL (all major ones), so there will not be any performance penalty for its usage. This patch (of 4): The memcg stats are safe against irq (and nmi) context and thus does not require disabling irqs. However some code paths for memcg stats also update the node level stats and use irq unsafe interface and thus require the users to disable irqs. However node level stats, on architectures with HAVE_CMPXCHG_LOCAL (all major ones), has interface which does not require irq disabling. Let's move memcg stats code to start using that interface for node level stats. Link: https://lkml.kernel.org/r/20251110232008.1352063-1-shakeel.butt@linux.dev Link: https://lkml.kernel.org/r/20251110232008.1352063-2-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Reviewed-by: Harry Yoo Acked-by: Roman Gushchin Acked-by: Vlastimil Babka Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Qi Zheng Signed-off-by: Andrew Morton commit 3e700b715e1cef66371027cefd3761eb8fa6e0d8 Author: Peng Li Date: Mon Nov 17 23:40:12 2025 +0800 selftests/mm: gup_test: fix comment regarding origin of FOLL_WRITE The 'FOLL_WRITE' of the copied source is located in mm_types.h of mm, not mm.h, so fix it. Link: https://lkml.kernel.org/r/20251117154012.197499-2-peng8420.li@gmail.com Signed-off-by: Peng Li Reviewed-by: John Hubbard Reviewed-by: David Hildenbrand (Red Hat) Cc: Dan Williams Cc: Jason Gunthorpe Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton commit 218fbfad16341ae60b7d540ca65af016b9f83500 Author: Peng Li Date: Mon Nov 17 23:40:11 2025 +0800 selftests/mm: gup_test: stop testing FOLL_TOUCH commit 0f20bba1688b ("mm/gup: explicitly define and check internal GUP flags, disallow FOLL_TOUCH") marked FOLL_TOUCH as a GUP-internal flag. This causes a warning to fire when running gup_test, for example: $ ./gup_test -L -r 100 -z dmesg: WARNING: CPU: 1 PID: 117 at mm/gup.c:2512 is_valid_gup_args+0x66/0x8c Therefore, remove the "FOLL_TOUCH" test code from gup_test.c. Link: https://lkml.kernel.org/r/20251117154012.197499-1-peng8420.li@gmail.com Signed-off-by: Peng Li Reviewed-by: John Hubbard Reviewed-by: David Hildenbrand (Red Hat) Cc: Dan Williams Cc: Jason Gunthorpe Cc: Oscar Salvador Cc: Peter Xu Signed-off-by: Andrew Morton commit cab812d9c9642ec11b8961b7ea994f4bd0826159 Author: Balbir Singh Date: Fri Nov 14 12:22:28 2025 +1100 mm/huge_memory.c: introduce folio_split_unmapped Unmapped was added as a parameter to __folio_split() and related call sites to support splitting of folios already in the midst of a migration. This special case arose for device private folio migration since during migration there could be a disconnect between source and destination on the folio size. Introduce folio_split_unmapped() to handle this special case. Also refactor code and add __folio_freeze_and_split_unmapped() helper that is common to both __folio_split() and folio_split_unmapped(). This in turn removes the special casing introduced by the unmapped parameter in __folio_split(). [balbirs@nvidia.com: v2] Link: https://lkml.kernel.org/r/20251115084041.3914728-1-balbirs@nvidia.com [balbirs@nvidia.com: fix clang-20 build] Link: https://lkml.kernel.org/r/20251120134232.3588203-1-balbirs@nvidia.com [akpm@linux-foundation.org: add `inline' to shmem_uncharge() stub, per Balbir] Link: https://lkml.kernel.org/r/20251114012228.2634882-1-balbirs@nvidia.com Signed-off-by: Balbir Singh Suggested-by: Zi Yan Acked-by: Zi Yan Cc: David Hildenbrand Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 8826f09616b475361774588c3e07260bba548f84 Author: Baolin Wang Date: Fri Nov 14 08:46:32 2025 +0800 mm: shmem: allow fallback to smaller large orders for tmpfs mmap() access After commit 69e0a3b49003 ("mm: shmem: fix the strategy for the tmpfs 'huge=' options"), we have fixed the large order allocation strategy for tmpfs, which always tries PMD-sized large folios first, and if that fails, falls back to smaller large folios. For tmpfs large folio allocation via mmap(), we should maintain the same strategy as well. Let's unify the large order allocation strategy for tmpfs. There is no functional change for large folio allocation of anonymous shmem. Link: https://lkml.kernel.org/r/283a0bdfd6ac7aa334a491422bcae70919c572bd.1763008453.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Cc: David Hildenbrand Cc: Hugh Dickins Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1b1a4e4d6797a57fefa40569fc920ce573bbf75b Author: Sergey Senozhatsky Date: Sat Nov 22 16:40:29 2025 +0900 zram: read slot block idx under slot lock Read slot's block id under slot-lock. We release the slot-lock for bdev read so, technically, slot still can get freed in the meantime, but at least we will read bdev block (page) that holds previous know slot data, not from slot->handle bdev block, which can be anything at that point. Link: https://lkml.kernel.org/r/20251122074029.3948921-7-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Cc: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Cc: Yuwen Chen Signed-off-by: Andrew Morton commit e87ddea34567dd4e5cb1f2c9e02778485b3c9757 Author: Sergey Senozhatsky Date: Sat Nov 22 16:40:28 2025 +0900 zram: rework bdev block allocation First, writeback bdev ->bitmap bits are set only from one context, as we can have only one single task performing writeback, so we cannot race with anything else. Remove retry path. Second, we always check ZRAM_WB flag to distinguish writtenback slots, so we should not confuse 0 bdev block index and 0 handle. We can use first bdev block (0 bit) for writeback as well. While at it, give functions slightly more accurate names, as we don't alloc/free anything there, we reserve a block for async writeback or release the block. Link: https://lkml.kernel.org/r/20251122074029.3948921-6-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Cc: Yuwen Chen Signed-off-by: Andrew Morton commit a4f506c569e1320c2db4a32955e47961fcf02b05 Author: Sergey Senozhatsky Date: Sat Nov 22 16:40:27 2025 +0900 zram: drop wb_limit_lock We don't need wb_limit_lock. Writeback limit setters take an exclusive write zram init_lock, while wb_limit modifications happen only from a single task and under zram read init_lock. No concurrent wb_limit modifications are possible (we permit only one post-processing task at a time). Add lockdep assertions to wb_limit mutators. While at it, fixup coding styles. Link: https://lkml.kernel.org/r/20251122074029.3948921-5-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Cc: Yuwen Chen Signed-off-by: Andrew Morton commit 7c929664fddfdaaa4afe5ae833d0f3044709d95c Author: Sergey Senozhatsky Date: Sat Nov 22 16:40:26 2025 +0900 zram: take write lock in wb limit store handlers Write device attrs handlers should take write zram init_lock. While at it, fixup coding styles. Link: https://lkml.kernel.org/r/20251122074029.3948921-4-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Cc: Yuwen Chen Signed-off-by: Andrew Morton commit e828cccb72ed8661b5d778baae9442cd06da4e0e Author: Sergey Senozhatsky Date: Sat Nov 22 16:40:25 2025 +0900 zram: add writeback batch size device attr Introduce writeback_batch_size device attribute so that the maximum number of in-flight writeback bio requests can be configured at run-time per-device. This essentially enables batched bio writeback. Link: https://lkml.kernel.org/r/20251122074029.3948921-3-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Reviewed-by: Brian Geffon Cc: Minchan Kim Cc: Richard Chang Cc: Yuwen Chen Signed-off-by: Andrew Morton commit f405066a1f0db818270f49a5e96be329bcabde1e Author: Sergey Senozhatsky Date: Sat Nov 22 16:40:24 2025 +0900 zram: introduce writeback bio batching Patch series "zram: introduce writeback bio batching", v6. As writeback is becoming more and more common the longstanding limitations of zram writeback throughput are becoming more visible. Introduce writeback bio batching so that multiple writeback bios can be processed simultaneously. This patch (of 6): As was stated in a comment [1] a single page writeback IO is not efficient, but it works. It's time to address this throughput limitation as writeback becomes used more often. Introduce batched (multiple) bio writeback support to take advantage of parallel requests processing and better requests scheduling. Approach used in this patch doesn't use a dedicated kthread like in [2], or blk-plug like in [3]. Dedicated kthread adds complexity, which can be avoided. Apart from that not all zram setups use writeback, so having numerous per-device kthreads (on systems that create multiple zram devices) hanging around is not the most optimal thing to do. blk-plug, on the other hand, works best when request are sequential, which doesn't particularly fit zram writebck IO patterns: zram writeback IO patterns are expected to be random, due to how bdev block reservation/release are handled. blk-plug approach also works in cycles: idle IO, when zram sets up requests in a batch, is followed by bursts of IO, when zram submits the entire batch. Instead we use a batch of requests and submit new bio as soon as one of the in-flight requests completes. For the time being the writeback batch size (maximum number of in-flight bio requests) is set to 32 for all devices. A follow up patch adds a writeback_batch_size device attribute, so the batch size becomes run-time configurable. Link: https://lkml.kernel.org/r/20251122074029.3948921-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20251122074029.3948921-2-senozhatsky@chromium.org Link: https://lore.kernel.org/all/20181203024045.153534-6-minchan@kernel.org/ [1] Link: https://lore.kernel.org/all/20250731064949.1690732-1-richardycc@google.com/ [2] Link: https://lore.kernel.org/all/tencent_78FC2C4FE16BA1EBAF0897DB60FCD675ED05@qq.com/ [3] Signed-off-by: Sergey Senozhatsky Co-developed-by: Yuwen Chen Co-developed-by: Richard Chang Suggested-by: Minchan Kim Cc: Brian Geffon Cc: Richard Chang Signed-off-by: Andrew Morton commit 9e014077083753461938312d565e4ac7119570d1 Author: Wei Yang Date: Fri Nov 14 03:00:28 2025 +0000 mm/khugepaged: unify SCAN_PMD_NONE and SCAN_PMD_NULL into SCAN_NO_PTE_TABLE The current hugepage collapse scan results include two separate values, SCAN_PMD_NONE and SCAN_PMD_NULL, which are handled identically by the consuming code. To reduce confusion and improve long-term maintenance, this commit merges these two functionally equivalent states into a single, clearer identifier: SCAN_NO_PTE_TABLE Link: https://lkml.kernel.org/r/20251114030028.7035-4-richard.weiyang@gmail.com Suggested-by: "David Hildenbrand (Red Hat)" Signed-off-by: Wei Yang Reviewed-by: Dev Jain Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Baolin Wang Reviewed-by: Nico Pache Cc: Barry Song Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit f1040f889882dda62b50ae948409f21afc7d894d Author: Wei Yang Date: Fri Nov 14 03:00:27 2025 +0000 mm/khugepaged: continue to collapse on SCAN_PMD_NONE SCAN_PMD_NONE means current pmd is empty, but we can still continue collapse next pmd range. Link: https://lkml.kernel.org/r/20251114030028.7035-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Lance Yang Reviewed-by: Dev Jain Reviewed-by: Baolin Wang Acked-by: David Hildenbrand (Red Hat) Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit eaa4c8063f7c3b78617c3f5af14d35a782c88144 Author: Wei Yang Date: Fri Nov 14 03:00:26 2025 +0000 mm/khugepaged: remove redundant clearing of struct collapse_control Patch series "unify PMD scan results and remove redundant cleanup", v2. This small series addresses two minor cleanup opportunities in the hugepage collapse logic. The initial motivation arose during a code review of madvise_collapse(), where it was noted that the function was missing a handler for SCAN_PMD_NONE. This oversight exposed the inconsistent handling of SCAN_PMD_NULL and SCAN_PMD_NONE. Since both scan results are functionally identical (they indicate the absence of a PTE table), the primary patch unifies them into a single, clearer identifier, SCAN_NO_PTE_TABLE. The series also takes the opportunity to remove a redundant clearing of the struct collapse_control. This patch (of 3): The structure struct collapse_control is being unnecessarily cleared twice during the huge page collapse process. Both hpage_collapse_scan_file() and hpage_collapse_scan_pmd() currently perform a clear operation on this structure. Remove the redundant clear operation. Link: https://lkml.kernel.org/r/20251114030028.7035-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251114030028.7035-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Dev Jain Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Baolin Wang Reviewed-by: Nico Pache Cc: Barry Song Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Ryan Roberts Cc: Steven Rostedt Cc: Zi Yan Signed-off-by: Andrew Morton commit 46156dba32cb68537d36877a97d672227f3e8134 Author: Qi Zheng Date: Mon Nov 10 16:17:58 2025 +0800 mm: thp: reparent the split queue during memcg offline Similar to list_lru, the split queue is relatively independent and does not need to be reparented along with objcg and LRU folios (holding objcg lock and lru lock). So let's apply the similar mechanism as list_lru to reparent the split queue separately when memcg is offine. This is also a preparation for reparenting LRU folios. Link: https://lkml.kernel.org/r/8703f907c4d1f7e8a2ef2bfed3036a84fa53028b.1762762324.git.zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Acked-by: Zi Yan Reviewed-by: Muchun Song Acked-by: David Hildenbrand Acked-by: Shakeel Butt Reviewed-by: Harry Yoo Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Hugh Dickins Cc: Johannes Weiner Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Nico Pache Cc: Roman Gushchin Cc: Ryan Roberts Cc: Wei Yang Signed-off-by: Andrew Morton commit 776bde7caf80f6af72b087cafe7d9f607b14716d Author: Muchun Song Date: Mon Nov 10 16:17:57 2025 +0800 mm: thp: use folio_batch to handle THP splitting in deferred_split_scan() The maintenance of the folio->_deferred_list is intricate because it's reused in a local list. Here are some peculiarities: 1) When a folio is removed from its split queue and added to a local on-stack list in deferred_split_scan(), the ->split_queue_len isn't updated, leading to an inconsistency between it and the actual number of folios in the split queue. 2) When the folio is split via split_folio() later, it's removed from the local list while holding the split queue lock. At this time, the lock is not needed as it is not protecting anything. 3) To handle the race condition with a third-party freeing or migrating the preceding folio, we must ensure there's always one safe (with raised refcount) folio before by delaying its folio_put(). More details can be found in commit e66f3185fa04 ("mm/thp: fix deferred split queue not partially_mapped"). It's rather tricky. We can use the folio_batch infrastructure to handle this clearly. In this case, ->split_queue_len will be consistent with the real number of folios in the split queue. If list_empty(&folio->_deferred_list) returns false, it's clear the folio must be in its split queue (not in a local list anymore). In the future, we will reparent LRU folios during memcg offline to eliminate dying memory cgroups, which requires reparenting the split queue to its parent first. So this patch prepares for using folio_split_queue_lock_irqsave() as the memcg may change then. Link: https://lkml.kernel.org/r/59cb6b6fb5ffcff9d23b81890b252960139ad8e7.1762762324.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Reviewed-by: Zi Yan Acked-by: David Hildenbrand Acked-by: Shakeel Butt Reviewed-by: Wei Yang Reviewed-by: Harry Yoo Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Hugh Dickins Cc: Johannes Weiner Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Nico Pache Cc: Roman Gushchin Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ad7c7f4576a5977b4ec4ac5dd090ab3f81ca7c6f Author: Muchun Song Date: Mon Nov 10 16:17:56 2025 +0800 mm: thp: introduce folio_split_queue_lock and its variants In future memcg removal, the binding between a folio and a memcg may change, making the split lock within the memcg unstable when held. A new approach is required to reparent the split queue to its parent. This patch starts introducing a unified way to acquire the split lock for future work. It's a code-only refactoring with no functional changes. Link: https://lkml.kernel.org/r/a31a90bcac04dc754f775e87ae3205be3170b571.1762762324.git.zhengqi.arch@bytedance.com Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Reviewed-by: Zi Yan Acked-by: Shakeel Butt Acked-by: David Hildenbrand Reviewed-by: Harry Yoo Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Hugh Dickins Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Nico Pache Cc: Roman Gushchin Cc: Ryan Roberts Cc: Wei Yang Signed-off-by: Andrew Morton commit fd603ae11e72fcaeec9266522f416c37b43bd1c4 Author: Muchun Song Date: Mon Nov 10 16:17:55 2025 +0800 mm: thp: replace folio_memcg() with folio_memcg_charged() Patch series "reparent the THP split queue", v6. In the future, we will reparent LRU folios during memcg offline to eliminate dying memory cgroups, which requires reparenting the THP split queue to its parent memcg. Similar to list_lru, the split queue is relatively independent and does not need to be reparented along with objcg and LRU folios (holding objcg lock and lru lock). Therefore, we can apply the same mechanism as list_lru to reparent the split queue first when memcg is offine. The first three patches in this series are separated from the series "Eliminate Dying Memory Cgroup" [1], mainly to do some cleanup and preparatory work. The last patch reparents the THP split queue to its parent memcg during memcg offline. This patch (of 4): folio_memcg_charged() is intended for use when the user is unconcerned about the returned memcg pointer. It is more efficient than folio_memcg(). Therefore, replace folio_memcg() with folio_memcg_charged(). Link: https://lkml.kernel.org/r/56624d537520e33e5a6b3755238b3dfb959a52ee.1762762324.git.zhengqi.arch@bytedance.com Link: https://lore.kernel.org/all/20250415024532.26632-1-songmuchun@bytedance.com/ [1] Signed-off-by: Muchun Song Signed-off-by: Qi Zheng Acked-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: David Hildenbrand Reviewed-by: Roman Gushchin Reviewed-by: Harry Yoo Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Hugh Dickins Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Nico Pache Cc: Ryan Roberts Cc: Wei Yang Cc: Zi Yan Cc: Muchun Song Signed-off-by: Andrew Morton commit a3a3e215c9c140c08760d4d96ba4e8bc485d0f14 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:34 2025 +0000 mm: replace remaining pte_to_swp_entry() with softleaf_from_pte() There are straggler invocations of pte_to_swp_entry() lying around, replace all of these with the software leaf entry equivalent - softleaf_from_pte(). With those removed, eliminate pte_to_swp_entry() altogether. No functional change intended. Link: https://lkml.kernel.org/r/d8ee5ccefe4c42d7c4fe1a2e46f285ac40421cd3.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 93976a20345b4aff1ac7598ec1223d65ca33d49c Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:33 2025 +0000 mm: eliminate further swapops predicates Having converted so much of the code base to software leaf entries, we can mop up some remaining cases. We replace is_pfn_swap_entry(), pfn_swap_entry_to_page(), is_writable_device_private_entry(), is_device_exclusive_entry(), is_migration_entry(), is_writable_migration_entry(), is_readable_migration_entry(), swp_offset_pfn() and pfn_swap_entry_folio() with softleaf equivalents. No functional change intended. Link: https://lkml.kernel.org/r/956bc9c031604811c0070d2f4bf2f1373f230213.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 03bfbc3ad6e496fb576ca9ace08211943232fdf9 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:32 2025 +0000 mm: remove is_hugetlb_entry_[migration, hwpoisoned]() We do not need to have explicit helper functions for these, it adds a level of confusion and indirection when we can simply use software leaf entry logic here instead and spell out the special huge_pte_none() case we must consider. No functional change intended. Link: https://lkml.kernel.org/r/0e92d6924d3de88cd014ce1c53e20edc08fc152e.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 9ff30bb9ab40b34908eefd661f12f99aa00d04c3 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:31 2025 +0000 mm: remove non_swap_entry() and use softleaf helpers instead There is simply no need for the hugely confusing concept of 'non-swap' swap entries now we have the concept of softleaf entries and relevant softleaf_xxx() helpers. Adjust all callers to use these instead and remove non_swap_entry() altogether. No functional change intended. Link: https://lkml.kernel.org/r/2562093f37f4a9cffea0447058014485eb50aaaf.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit c0a80c2ce68d3a04daa52497fbf524ffb3a376e0 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:30 2025 +0000 mm: remove remaining is_swap_pmd() users and is_swap_pmd() Update copy_huge_pmd() and change_huge_pmd() to use pmd_is_valid_softleaf() - as this checks for the only valid non-present huge PMD states. Also update mm/debug_vm_pgtable.c to explicitly test for a valid leaf PMD entry (which it was not before, which was incorrect), and have it test against pmd_is_huge() and pmd_is_valid_softleaf() rather than is_swap_pmd(). With these changes done there are no further users of is_swap_pmd(), so remove it. Link: https://lkml.kernel.org/r/1628b00b00c8498bbd2c20b82117ee87845fb738.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 15eabc898dc58c9e97eb9ddd56dc6b893e7d0d0e Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:29 2025 +0000 mm: introduce pmd_is_huge() and use where appropriate The leaf entry PMD case is confusing as only migration entries and device private entries are valid at PMD level, not true swap entries. We repeatedly perform checks of the form is_swap_pmd() || pmd_trans_huge() which is itself confusing - it implies that leaf entries at PMD level exist and are different from huge entries. Address this confusion by introduced pmd_is_huge() which checks for either case. Sadly due to header dependency issues (huge_mm.h is included very early on in headers and cannot really rely on much else) we cannot use pmd_is_valid_softleaf() here. However since these are the only valid, handled cases the function is still achieving what it intends to do. We then replace all instances of is_swap_pmd() || pmd_trans_huge() with pmd_is_huge() invocations and adjust logic accordingly to accommodate this. No functional change intended. Link: https://lkml.kernel.org/r/00f79db3b15293cac8f7040a48d69c52d00117e4.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 0ac881efe16468503e8c1e7d8a7210b75f027ce3 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:28 2025 +0000 mm: replace pmd_to_swp_entry() with softleaf_from_pmd() Introduce softleaf_from_pmd() to do the equivalent operation for PMDs that softleaf_from_pte() fulfils, and cascade changes through code base accordingly, introducing helpers as necessary. We are then able to eliminate pmd_to_swp_entry(), is_pmd_migration_entry(), is_pmd_device_private_entry() and is_pmd_non_present_folio_entry(). This further establishes the use of leaf operations throughout the code base and further establishes the foundations for eliminating is_swap_pmd(). No functional change intended. [lorenzo.stoakes@oracle.com: check writable, not readable/writable, per Vlastimil] Link: https://lkml.kernel.org/r/cd97b6ec-00f9-45a4-9ae0-8f009c212a94@lucifer.local Link: https://lkml.kernel.org/r/3fb431699639ded8fdc63d2210aa77a38c8891f1.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: SeongJae Park \ Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 5dfa7916050558b744c81c5d824649ff4e66e7e3 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:27 2025 +0000 mm/huge_memory: refactor change_huge_pmd() non-present logic Similar to copy_huge_pmd(), there is a large mass of open-coded logic for the CONFIG_ARCH_ENABLE_THP_MIGRATION non-present entry case that does not use thp_migration_supported() consistently. Resolve this by separating out this logic and introduce change_non_present_huge_pmd(). No functional change intended. Link: https://lkml.kernel.org/r/451b85636ad711e307fdfbff19af699fdab4d05f.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit e244d82d0290340d5ba062f46eff2ede0bd50abe Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:26 2025 +0000 mm/huge_memory: refactor copy_huge_pmd() non-present logic Right now we are inconsistent in our use of thp_migration_supported(): static inline bool thp_migration_supported(void) { return IS_ENABLED(CONFIG_ARCH_ENABLE_THP_MIGRATION); } And simply having arbitrary and ugly #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION blocks in code. This is exhibited in copy_huge_pmd(), which inserts a large #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION block and an if-branch which is difficult to follow It's difficult to follow the logic of such a large function and the non-present PMD logic is clearly separate as it sits in a giant if-branch. Therefore this patch both separates out the logic and utilises thp_migration_supported(). No functional change intended. Link: https://lkml.kernel.org/r/6eaadc23ed512d370ede65561e34e96241c54b9d.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit aa62204cb680d8ff32497181fc9e0dac4956f7e5 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:25 2025 +0000 mm: avoid unnecessary use of is_swap_pmd() PMD 'non-swap' swap entries are currently used for PMD-level migration entries and device private entries. To add to the confusion in this terminology we use is_swap_pmd() in an inconsistent way similar to how is_swap_pte() was being used - sometimes adopting the convention that !pmd_none(), !pmd_present() implies PMD 'swap' entry, sometimes not. This patch handles the low-hanging fruit of cases where we can simply substitute other predicates for is_swap_pmd(). No functional change intended. Link: https://lkml.kernel.org/r/8a1704b36a009c18032d5bea4cb68e71448fbbe5.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit de4d6c94914f3659f0b51725e23e637d4e9f78cc Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:24 2025 +0000 fs/proc/task_mmu: refactor pagemap_pmd_range() Separate out THP logic so we can drop an indentation level and reduce the amount of noise in this function. We add pagemap_pmd_range_thp() for this purpose. While we're here, convert the VM_BUG_ON() to a VM_WARN_ON_ONCE() at the same time. No functional change intended. Link: https://lkml.kernel.org/r/f9ce7f3bb57e3627288225e23f2498cc5315f5ab.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit fb410d8b89e89ef61b18326f07c477f563b631f6 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:23 2025 +0000 mm: use leaf entries in debug pgtable + remove is_swap_pte() Remove invocations of is_swap_pte() in mm/debug_vm_pgtable.c and use softleaf_from_pte() and softleaf_is_swap() as necessary to replace this usage. We update the test code to use a 'true' swap entry throughout so we are guaranteed this is not a non-swap entry, so all asserts continue to operate correctly. With this change in place, we no longer use is_swap_pte() anywhere, so remove it. Link: https://lkml.kernel.org/r/222f352e7a99191b4bdfa77e835f2fc0dd83fa72.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 06fb61462bdea3288e391487beca07cb52d6881a Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:22 2025 +0000 mm: eliminate is_swap_pte() when softleaf_from_pte() suffices In cases where we can simply utilise the fact that softleaf_from_pte() treats present entries as if they were none entries and thus eliminate spurious uses of is_swap_pte(), do so. No functional change intended. Link: https://lkml.kernel.org/r/92ebab9567978155116804c67babc3c64636c403.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit fb888710e26a8a8a37dc0f8ed09a3c908c63eb71 Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:21 2025 +0000 mm: avoid unnecessary uses of is_swap_pte() There's an established convention in the kernel that we treat PTEs as containing swap entries (and the unfortunately named non-swap swap entries) should they be neither empty (i.e. pte_none() evaluating true) nor present (i.e. pte_present() evaluating true). However, there is some inconsistency in how this is applied, as we also have the is_swap_pte() helper which explicitly performs this check: /* check whether a pte points to a swap entry */ static inline int is_swap_pte(pte_t pte) { return !pte_none(pte) && !pte_present(pte); } As this represents a predicate, and it's logical to assume that in order to establish that a PTE entry can correctly be manipulated as a swap/non-swap entry, this predicate seems as if it must first be checked. But we instead, we far more often utilise the established convention of checking pte_none() / pte_present() before operating on entries as if they were swap/non-swap. This patch works towards correcting this inconsistency by removing all uses of is_swap_pte() where we are already in a position where we perform pte_none()/pte_present() checks anyway or otherwise it is clearly logical to do so. We also take advantage of the fact that pte_swp_uffd_wp() is only set on swap entries. Additionally, update comments referencing to is_swap_pte() and non_swap_entry(). No functional change intended. Link: https://lkml.kernel.org/r/17fd6d7f46a846517fd455fadd640af47fcd7c55.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Zi Yan Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 68aa2fdbf57f769e552f472ddb762aba028a207e Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:20 2025 +0000 mm: introduce leaf entry type and use to simplify leaf entry logic The kernel maintains leaf page table entries which contain either: The kernel maintains leaf page table entries which contain either: - Nothing ('none' entries) - Present entries* - Everything else that will cause a fault which the kernel handles * Present entries are either entries the hardware can navigate without page fault or special cases like NUMA hint protnone or PMD with cleared present bit which contain hardware-valid entries modulo the present bit. In the 'everything else' group we include swap entries, but we also include a number of other things such as migration entries, device private entries and marker entries. Unfortunately this 'everything else' group expresses everything through a swp_entry_t type, and these entries are referred to swap entries even though they may well not contain a... swap entry. This is compounded by the rather mind-boggling concept of a non-swap swap entry (checked via non_swap_entry()) and the means by which we twist and turn to satisfy this. This patch lays the foundation for reducing this confusion. We refer to 'everything else' as a 'software-define leaf entry' or 'softleaf'. for short And in fact we scoop up the 'none' entries into this concept also so we are left with: - Present entries. - Softleaf entries (which may be empty). This allows for radical simplification across the board - one can simply convert any leaf page table entry to a leaf entry via softleaf_from_pte(). If the entry is present, we return an empty leaf entry, so it is assumed the caller is aware that they must differentiate between the two categories of page table entries, checking for the former via pte_present(). As a result, we can eliminate a number of places where we would otherwise need to use predicates to see if we can proceed with leaf page table entry conversion and instead just go ahead and do it unconditionally. We do so where we can, adjusting surrounding logic as necessary to integrate the new softleaf_t logic as far as seems reasonable at this stage. We typedef swp_entry_t to softleaf_t for the time being until the conversion can be complete, meaning everything remains compatible regardless of which type is used. We will eventually remove swp_entry_t when the conversion is complete. We introduce a new header file to keep things clear - leafops.h - this imports swapops.h so can direct replace swapops imports without issue, and we do so in all the files that require it. Additionally, add new leafops.h file to core mm maintainers entry. Link: https://lkml.kernel.org/r/c879383aac77d96a03e4d38f7daba893cd35fc76.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Zi Yan Reviewed-by: Vlastimil Babka Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit c093cf451094a9a03c4d4929bc30122a53038b7b Author: Lorenzo Stoakes Date: Mon Nov 10 22:21:19 2025 +0000 mm: correctly handle UFFD PTE markers Patch series "mm: remove is_swap_[pte, pmd]() + non-swap entries, introduce leaf entries", v3. There's an established convention in the kernel that we treat leaf page tables (so far at the PTE, PMD level) as containing 'swap entries' should they be neither empty (i.e. p**_none() evaluating true) nor present (i.e. p**_present() evaluating true). However, at the same time we also have helper predicates - is_swap_pte(), is_swap_pmd() - which are inconsistently used. This is problematic, as it is logical to assume that should somebody wish to operate upon a page table swap entry they should first check to see if it is in fact one. It also implies that perhaps, in future, we might introduce a non-present, none page table entry that is not a swap entry. This series resolves this issue by systematically eliminating all use of the is_swap_pte() and is swap_pmd() predicates so we retain only the convention that should a leaf page table entry be neither none nor present it is a swap entry. We also have the further issue that 'swap entry' is unfortunately a really rather overloaded term and in fact refers to both entries for swap and for other information such as migration entries, page table markers, and device private entries. We therefore have the rather 'unique' concept of a 'non-swap' swap entry. This series therefore introduces the concept of 'software leaf entries', of type softleaf_t, to eliminate this confusion. A software leaf entry in this sense is any page table entry which is non-present, and represented by the softleaf_t type. That is - page table leaf entries which are software-controlled by the kernel. This includes 'none' or empty entries, which are simply represented by an zero leaf entry value. In order to maintain compatibility as we transition the kernel to this new type, we simply typedef swp_entry_t to softleaf_t. We introduce a number of predicates and helpers to interact with software leaf entries in include/linux/leafops.h which, as it imports swapops.h, can be treated as a drop-in replacement for swapops.h wherever leaf entry helpers are used. Since softleaf_from_[pte, pmd]() treats present entries as they were empty/none leaf entries, this allows for a great deal of simplification of code throughout the code base, which this series utilises a great deal. We additionally change from swap entry to software leaf entry handling where it makes sense to and eliminate functions from swapops.h where software leaf entries obviate the need for the functions. This patch (of 16): PTE markers were previously only concerned with UFFD-specific logic - that is, PTE entries with the UFFD WP marker set or those marked via UFFDIO_POISON. However since the introduction of guard markers in commit 7c53dfbdb024 ("mm: add PTE_MARKER_GUARD PTE marker"), this has no longer been the case. Issues have been avoided as guard regions are not permitted in conjunction with UFFD, but it still leaves very confusing logic in place, most notably the misleading and poorly named pte_none_mostly() and huge_pte_none_mostly(). This predicate returns true for PTE entries that ought to be treated as none, but only in certain circumstances, and on the assumption we are dealing with H/W poison markers or UFFD WP markers. This patch removes these functions and makes each invocation of these functions instead explicitly check what it needs to check. As part of this effort it introduces is_uffd_pte_marker() to explicitly determine if a marker in fact is used as part of UFFD or not. In the HMM logic we note that the only time we would need to check for a fault is in the case of a UFFD WP marker, otherwise we simply encounter a fault error (VM_FAULT_HWPOISON for H/W poisoned marker, VM_FAULT_SIGSEGV for a guard marker), so only check for the UFFD WP case. While we're here we also refactor code to make it easier to understand. [akpm@linux-foundation.org: fix comment typo, per Mike] Link: https://lkml.kernel.org/r/cover.1762812360.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/c38625fd9a1c1f1cf64ae8a248858e45b3dcdf11.1762812360.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Axel Rasmussen Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Byungchul Park Cc: Chengming Zhou Cc: Chris Li Cc: Christian Borntraeger Cc: Christian Brauner Cc: Claudio Imbrenda Cc: David Hildenbrand Cc: Dev Jain Cc: Gerald Schaefer Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Janosch Frank Cc: Jason Gunthorpe Cc: Joshua Hahn Cc: Kairui Song Cc: Kemeng Shi Cc: Lance Yang Cc: Leon Romanovsky Cc: Liam Howlett Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michal Hocko Cc: Muchun Song Cc: Naoya Horiguchi Cc: Nhat Pham Cc: Nico Pache Cc: Oscar Salvador Cc: Pasha Tatashin Cc: Peter Xu Cc: Rakie Kim Cc: Rik van Riel Cc: Ryan Roberts Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Wei Xu Cc: xu xin Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton commit 8a0e4bdddd1c998b894d879a1d22f1e745606215 Author: Wei Yang Date: Thu Nov 6 03:41:55 2025 +0000 mm/huge_memory: merge uniform_split_supported() and non_uniform_split_supported() uniform_split_supported() and non_uniform_split_supported() share significantly similar logic. The only functional difference is that uniform_split_supported() includes an additional check on the requested @new_order. The reason for this check comes from the following two aspects: * some file system or swap cache just supports order-0 folio * the behavioral difference between uniform/non-uniform split The behavioral difference between uniform split and non-uniform: * uniform split splits folio directly to @new_order * non-uniform split creates after-split folios with orders from folio_order(folio) - 1 to new_order. This means for non-uniform split or !new_order split we should check the file system and swap cache respectively. This commit unifies the logic and merge the two functions into a single combined helper, removing redundant code and simplifying the split support checking mechanism. Link: https://lkml.kernel.org/r/20251106034155.21398-3-richard.weiyang@gmail.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Wei Yang Reviewed-by: Zi Yan Cc: Zi Yan Cc: "David Hildenbrand (Red Hat)" Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Nico Pache Cc: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit c467061fbb6eb483d59f546c145b2ff2249455e4 Author: Wei Yang Date: Thu Nov 6 03:41:54 2025 +0000 mm/huge_memory: introduce enum split_type for clarity Patch series "mm/huge_memory: Define split_type and consolidate split support checks", v3. This two-patch series focuses on improving code clarity and removing redundancy in the huge memory handling logic related to folio splitting. The series is based on an original proposal to merge two significantly identical functions that check folio split support[1]. During this process, we found an opportunity to improve readability by explicitly defining the split types. Patch 1: define split_type and use it Patch 2: merge uniform_split_supported() and non_uniform_split_supported() This patch (of 2): We currently handle two distinct types of large folio splitting: * uniform split * non-uniform split Differentiating between these types using a simple boolean variable is not obvious and can harm code readability. This commit introduces enum split_type to explicitly define these two types. Replacing the existing boolean variable with this enumeration significantly improves code clarity and expressiveness when dealing with folio splitting logic. No functional change is expected. [akpm@linux-foundation.org: tweak layout, per David] Link: https://lkml.kernel.org/r/20251106034155.21398-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251106034155.21398-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Zi Yan Cc: "David Hildenbrand (Red Hat)" Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit fe9d31fd1ab6cb53e45d9d6b0bb7a62d8365fe2b Author: Ma Ke Date: Sat Nov 8 19:53:46 2025 +0800 mm/hmm/test: fix error handling in dmirror_device_init dmirror_device_init() calls device_initialize() which sets the device reference count to 1, but fails to call put_device() when error occurs after dev_set_name() or cdev_device_add() failures. This results in memory leaks of struct device objects. Additionally, dmirror_device_remove() lacks the final put_device() call to properly release the device reference. Found by code review. Link: https://lkml.kernel.org/r/20251108115346.6368-1-make24@iscas.ac.cn Fixes: 6a760f58c792 ("mm/hmm/test: use char dev with struct device to get device node") Signed-off-by: Ma Ke Cc: Haoxiang Li Cc: Jason Gunthorpe Cc: John Hubbard Cc: Leon Romanovsky Cc: Mika Penttilä Signed-off-by: Andrew Morton commit 50d0598cf2c9d33e1f08c3b1a357752ea8a9b94a Author: Zi Yan Date: Fri Oct 31 12:20:01 2025 -0400 mm/huge_memory: fix kernel-doc comments for folio_split() and related try_folio_split_to_order(), folio_split, __folio_split(), and __split_unmapped_folio() do not have correct kernel-doc comment format. Fix them. [ziy@nvidia.com: kernel-doc fixup] Link: https://lkml.kernel.org/r/BE7AC5F3-9E64-4923-861D-C2C4E0CB91EB@nvidia.com [ziy@nvidia.com: add newline to fix an error and a warning from docutils] Link: https://lkml.kernel.org/r/040B38C0-23C6-4AEA-B069-69AE6DAA828B@nvidia.com Link: https://lkml.kernel.org/r/20251031162001.670503-4-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Lance Yang Reviewed-by: Barry Song Reviewed-by: Miaohe Lin Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Wei Yang Cc: Baolin Wang Cc: Dev Jain Cc: Jane Chu Cc: Liam Howlett Cc: Luis Chamberalin Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Nico Pache Cc: Pankaj Raghav Cc: Ryan Roberts Cc: Yang Shi Signed-off-by: Andrew Morton commit 689b8986776c823161fb4955cc7dc303f78a1962 Author: Zi Yan Date: Fri Oct 31 12:20:00 2025 -0400 mm/memory-failure: improve large block size folio handling Large block size (LBS) folios cannot be split to order-0 folios but min_order_for_folio(). Current split fails directly, but that is not optimal. Split the folio to min_order_for_folio(), so that, after split, only the folio containing the poisoned page becomes unusable instead. For soft offline, do not split the large folio if its min_order_for_folio() is not 0. Since the folio is still accessible from userspace and premature split might lead to potential performance loss. Link: https://lkml.kernel.org/r/20251031162001.670503-3-ziy@nvidia.com Signed-off-by: Zi Yan Suggested-by: Jane Chu Reviewed-by: Luis Chamberlain Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Wei Yang Reviewed-by: Miaohe Lin Reviewed-by: Barry Song Reviewed-by: Lance Yang Cc: Baolin Wang Cc: Dev Jain Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Nico Pache Cc: Pankaj Raghav Cc: Ryan Roberts Cc: Yang Shi Signed-off-by: Andrew Morton commit a7ef12c64fd991c0f42b2e1bf0c4f09068575864 Author: Zi Yan Date: Fri Oct 31 12:19:59 2025 -0400 mm/huge_memory: add split_huge_page_to_order() Patch series "Optimize folio split in memory failure", v5. This patchset optimizes folio split operations in memory failure code by always splitting a folio to min_order_for_split() to minimize unusable pages, even if min_order_for_split() is non zero and memory failure code would take the failed path eventually for a successfully split folio. This means instead of making the entire original folio unusable memory failure code would only make its after-split folio, which has order of min_order_for_split() and contains HWPoison page, unusable. For soft offline case, since the original folio is still accessible, no split is performed if the folio cannot be split to order-0 to prevent potential performance loss. In addition, add split_huge_page_to_order() to improve code readability and fix kernel-doc comment format for folio_split() and other related functions. Background ========== This patchset is a follow-up of "[PATCH v3] mm/huge_memory: do not change split_huge_page*() target order silently."[1] and [PATCH v4] mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order[2], since both are separated out as hotfixes. It improves how memory failure code handles large block size(LBS) folios with min_order_for_split() > 0. By splitting a large folio containing HW poisoned pages to min_order_for_split(), the after-split folios without HW poisoned pages could be freed for reuse. To achieve this, folio split code needs to set has_hwpoisoned on after-split folios containing HW poisoned pages and it is done in the hotfix in [2]. This patchset includes: 1. A patch adds split_huge_page_to_order(), 2. Patch 2 and Patch 3 of "[PATCH v2 0/3] Do not change split folio target order"[3], This patch (of 3): When the caller does not supply a list to split_huge_page_to_list_to_order(), use split_huge_page_to_order() instead. Link: https://lkml.kernel.org/r/20251031162001.670503-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20251031162001.670503-2-ziy@nvidia.com Link: https://lore.kernel.org/all/20251017013630.139907-1-ziy@nvidia.com/ [1] Link: https://lore.kernel.org/all/20251023030521.473097-1-ziy@nvidia.com/ [2] Link: https://lore.kernel.org/all/20251016033452.125479-1-ziy@nvidia.com/ [3] Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Wei Yang Reviewed-by: Miaohe Lin Reviewed-by: Barry Song Reviewed-by: Lance Yang Cc: Baolin Wang Cc: Dev Jain Cc: Jane Chu Cc: Liam Howlett Cc: Luis Chamberalin Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Nico Pache Cc: Pankaj Raghav Cc: Ryan Roberts Cc: Yang Shi Signed-off-by: Andrew Morton commit d87f4a8f19668cdc5b8afd0d751e9d9c6a1b7595 Author: Wei Yang Date: Fri Oct 10 14:11:42 2025 +0000 mm/huge_memory: only get folio_order() once during __folio_split() Before splitting folio, its order keeps the same. It is only necessary to get folio_order() once. Also rename order to old_order to represent the original folio order. Link: https://lkml.kernel.org/r/20251010141142.1349-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Lance Yang Acked-by: David Hildenbrand Cc: Zi Yan Cc: Dev Jain Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Barry Song Signed-off-by: Andrew Morton commit ac7756771a34f19c9a757eb86efe028e51f57b23 Author: Wei Yang Date: Wed Oct 8 09:54:53 2025 +0000 mm/khugepaged: unify pmd folio installation with map_anon_folio_pmd() Currently we install pmd folio with map_anon_folio_pmd() in __do_huge_pmd_anonymous_page() and do_huge_zero_wp_pmd(). While in collapse_huge_page(), it is done with identical code except statistics adjustment. Unify the process with map_anon_folio_pmd() to install pmd folio. Split it to map_anon_folio_pmd_pf() and map_anon_folio_pmd_nopf() to be used in page fault or not respectively. No functional change is intended. [akpm@linux-foundation.org: remove unneeded map_anon_folio_pmd_nopf() stub, per Wei & David] Link: https://lkml.kernel.org/r/20251008095453.18772-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Zi Yan Acked-by: Lance Yang Cc: David Hildenbrand Cc: Lance Yang Cc: Dev Jain Cc: Zi Yan Cc: Usama Arif Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 2a1351cd4176ee1809b0900d386919d03b7652f8 Author: Wei Yang Date: Wed Oct 8 09:54:52 2025 +0000 mm/huge_memory: add pmd folio to ds_queue in do_huge_zero_wp_pmd() We add pmd folio into ds_queue on the first page fault in __do_huge_pmd_anonymous_page(), so that we can split it in case of memory pressure. This should be the same for a pmd folio during wp page fault. Commit 1ced09e0331f ("mm: allocate THP on hugezeropage wp-fault") miss to add it to ds_queue, which means system may not reclaim enough memory in case of memory pressure even the pmd folio is under used. Move deferred_split_folio() into map_anon_folio_pmd() to make the pmd folio installation consistent. Link: https://lkml.kernel.org/r/20251008095453.18772-2-richard.weiyang@gmail.com Fixes: 1ced09e0331f ("mm: allocate THP on hugezeropage wp-fault") Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Lance Yang Reviewed-by: Dev Jain Acked-by: Usama Arif Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton commit c3228747107705d47c7e9a03598a434a0380cb73 Author: Balbir Singh Date: Wed Oct 1 16:57:07 2025 +1000 gpu/drm/nouveau: enable THP support for GPU memory migration Enable MIGRATE_VMA_SELECT_COMPOUND support in nouveau driver to take advantage of THP zone device migration capabilities. Update migration and eviction code paths to handle compound page sizes appropriately, improving memory bandwidth utilization and reducing migration overhead for large GPU memory allocations. [balbirs@nvidia.com: fix sparse error] Link: https://lkml.kernel.org/r/20251115003333.3516870-1-balbirs@nvidia.com Link: https://lkml.kernel.org/r/20251001065707.920170-17-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 271a7b2e3c1370d36fde867bfee201bd74b53704 Author: Balbir Singh Date: Wed Oct 1 16:57:06 2025 +1000 selftests/mm/hmm-tests: new throughput tests including THP Add new benchmark style support to test transfer bandwidth for zone device memory operations. Link: https://lkml.kernel.org/r/20251001065707.920170-16-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 24c2c5b8ffbd50d5dcd340c553c717948ca99aac Author: Matthew Brost Date: Wed Oct 1 16:57:05 2025 +1000 selftests/mm/hmm-tests: partial unmap, mremap and anon_write tests Add partial unmap test case which munmaps memory while in the device. Add tests exercising mremap on faulted-in memory (CPU and GPU) at various offsets and verify correctness. Update anon_write_child to read device memory after fork verifying this flow works in the kernel. Both THP and non-THP cases are updated. Link: https://lkml.kernel.org/r/20251001065707.920170-15-balbirs@nvidia.com Signed-off-by: Balbir Singh Signed-off-by: Matthew Brost Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 519071529d2ad8a041e2e9d75ead5f9e6fe60026 Author: Balbir Singh Date: Wed Oct 1 16:57:04 2025 +1000 selftests/mm/hmm-tests: new tests for zone device THP migration Add new tests for migrating anon THP pages, including anon_huge, anon_huge_zero and error cases involving forced splitting of pages during migration. Link: https://lkml.kernel.org/r/20251001065707.920170-14-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit aa3ade429543a01eb04d27e1fb877b7ac2f8add7 Author: Balbir Singh Date: Wed Oct 1 16:57:03 2025 +1000 lib/test_hmm: add large page allocation failure testing Add HMM_DMIRROR_FLAG_FAIL_ALLOC flag to simulate large page allocation failures, enabling testing of split migration code paths. This test flag allows validation of the fallback behavior when destination device cannot allocate compound pages. This is useful for testing the split migration functionality. Link: https://lkml.kernel.org/r/20251001065707.920170-13-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 4265d67e405a41562634279ca1ededf79fdadcd7 Author: Balbir Singh Date: Wed Oct 1 16:57:02 2025 +1000 mm/migrate_device: add THP splitting during migration Implement migrate_vma_split_pages() to handle THP splitting during the migration process when destination cannot allocate compound pages. This addresses the common scenario where migrate_vma_setup() succeeds with MIGRATE_PFN_COMPOUND pages, but the destination device cannot allocate large pages during the migration phase. Key changes: - migrate_vma_split_pages(): Split already-isolated pages during migration - Enhanced folio_split() and __split_unmapped_folio() with isolated parameter to avoid redundant unmap/remap operations This provides a fallback mechansim to ensure migration succeeds even when large page allocation fails at the destination. [matthew.brost@intel.com: add THP splitting during migration] Link: https://lkml.kernel.org/r/20251120230825.181072-2-matthew.brost@intel.com Link: https://lkml.kernel.org/r/20251001065707.920170-12-balbirs@nvidia.com Signed-off-by: Balbir Singh Signed-off-by: Matthew Brost Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Francois Dugast Signed-off-by: Andrew Morton commit 56ef398996435a0021569b86293d376649f12540 Author: Balbir Singh Date: Wed Oct 1 16:57:01 2025 +1000 mm/memremap: add driver callback support for folio splitting When a zone device page is split (via huge pmd folio split). The driver callback for folio_split is invoked to let the device driver know that the folio size has been split into a smaller order. Provide a default implementation for drivers that do not provide this callback that copies the pgmap and mapping fields for the split folios. Update the HMM test driver to handle the split. Link: https://lkml.kernel.org/r/20251001065707.920170-11-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 775465fd26a325359887f9c3129444fcc76c6298 Author: Balbir Singh Date: Wed Oct 1 16:57:00 2025 +1000 lib/test_hmm: add zone device private THP test infrastructure Enhance the hmm test driver (lib/test_hmm) with support for THP pages. A new pool of free_folios() has now been added to the dmirror device, which can be allocated when a request for a THP zone device private page is made. Add compound page awareness to the allocation function during normal migration and fault based migration. These routines also copy folio_nr_pages() when moving data between system memory and device memory. args.src and args.dst used to hold migration entries are now dynamically allocated (as they need to hold HPAGE_PMD_NR entries or more). Split and migrate support will be added in future patches in this series. Link: https://lkml.kernel.org/r/20251001065707.920170-10-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 4964099163d0524a769d039ffa886bb4515136d0 Author: Balbir Singh Date: Wed Oct 1 16:56:59 2025 +1000 mm/memory/fault: add THP fault handling for zone device private pages Implement CPU fault handling for zone device THP entries through do_huge_pmd_device_private(), enabling transparent migration of device-private large pages back to system memory on CPU access. When the CPU accesses a zone device THP entry, the fault handler calls the device driver's migrate_to_ram() callback to migrate the entire large page back to system memory. Link: https://lkml.kernel.org/r/20251001065707.920170-9-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit a30b48bf1b244f11bf9b6d20cdccfe0c2264130c Author: Balbir Singh Date: Wed Oct 1 16:56:58 2025 +1000 mm/migrate_device: implement THP migration of zone device pages MIGRATE_VMA_SELECT_COMPOUND will be used to select THP pages during migrate_vma_setup() and MIGRATE_PFN_COMPOUND will make migrating device pages as compound pages during device pfn migration. migrate_device code paths go through the collect, setup and finalize phases of migration. The entries in src and dst arrays passed to these functions still remain at a PAGE_SIZE granularity. When a compound page is passed, the first entry has the PFN along with MIGRATE_PFN_COMPOUND and other flags set (MIGRATE_PFN_MIGRATE, MIGRATE_PFN_VALID), the remaining entries (HPAGE_PMD_NR - 1) are filled with 0's. This representation allows for the compound page to be split into smaller page sizes. migrate_vma_collect_hole(), migrate_vma_collect_pmd() are now THP page aware. Two new helper functions migrate_vma_collect_huge_pmd() and migrate_vma_insert_huge_pmd_page() have been added. migrate_vma_collect_huge_pmd() can collect THP pages, but if for some reason this fails, there is fallback support to split the folio and migrate it. migrate_vma_insert_huge_pmd_page() closely follows the logic of migrate_vma_insert_page() Support for splitting pages as needed for migration will follow in later patches in this series. Link: https://lkml.kernel.org/r/20251001065707.920170-8-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 022a12deda53c983755c08e073a3c028a6850a23 Author: Balbir Singh Date: Wed Oct 1 16:56:57 2025 +1000 mm/migrate_device: handle partially mapped folios during collection Extend migrate_vma_collect_pmd() to handle partially mapped large folios that require splitting before migration can proceed. During PTE walk in the collection phase, if a large folio is only partially mapped in the migration range, it must be split to ensure the folio is correctly migrated. [matthew.brost@intel.com: handle partially mapped folios during split] Link: https://lkml.kernel.org/r/20251120230825.181072-1-matthew.brost@intel.com Link: https://lkml.kernel.org/r/20251001065707.920170-7-balbirs@nvidia.com Signed-off-by: Balbir Singh Signed-off-by: Matthew Brost Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Francois Dugast Signed-off-by: Andrew Morton commit 1462872900233e58fb2f9fc8babc24a0d5c03fd9 Author: Balbir Singh Date: Wed Oct 1 16:56:56 2025 +1000 mm/huge_memory: implement device-private THP splitting Add support for splitting device-private THP folios, enabling fallback to smaller page sizes when large page allocation or migration fails. Key changes: - split_huge_pmd(): Handle device-private PMD entries during splitting - Preserve RMAP_EXCLUSIVE semantics for anonymous exclusive folios - Skip RMP_USE_SHARED_ZEROPAGE for device-private entries as they don't support shared zero page semantics Link: https://lkml.kernel.org/r/20251001065707.920170-6-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 65edfda6f3f2e58f757485a056e4f1775a1404a8 Author: Balbir Singh Date: Wed Oct 1 16:56:55 2025 +1000 mm/rmap: extend rmap and migration support device-private entries Add device-private THP support to reverse mapping infrastructure, enabling proper handling during migration and walk operations. The key changes are: - add_migration_pmd()/remove_migration_pmd(): Handle device-private entries during folio migration and splitting - page_vma_mapped_walk(): Recognize device-private THP entries during VMA traversal operations This change supports folio splitting and migration operations on device-private entries. [balbirs@nvidia.com: fix override of entry in remove_migration_pmd] Link: https://lkml.kernel.org/r/20251114012153.2634497-2-balbirs@nvidia.com [balbirs@nvidia.com: follow pattern used in remove_migration_pte()] Link: https://lkml.kernel.org/r/20251115002835.3515194-1-balbirs@nvidia.com Link: https://lkml.kernel.org/r/20251001065707.920170-5-balbirs@nvidia.com Signed-off-by: Balbir Singh Reviewed-by: SeongJae Park Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Signed-off-by: Andrew Morton commit 368076f52ebeecd33e10a9f80905d7508b6b6149 Author: Balbir Singh Date: Wed Oct 1 16:56:54 2025 +1000 mm/huge_memory: add device-private THP support to PMD operations Extend core huge page management functions to handle device-private THP entries. This enables proper handling of large device-private folios in fundamental MM operations. The following functions have been updated: - copy_huge_pmd(): Handle device-private entries during fork/clone - zap_huge_pmd(): Properly free device-private THP during munmap - change_huge_pmd(): Support protection changes on device-private THP - __pte_offset_map(): Add device-private entry awareness Link: https://lkml.kernel.org/r/20251001065707.920170-4-balbirs@nvidia.com Signed-off-by: Matthew Brost Signed-off-by: Balbir Singh Acked-by: Zi Yan Cc: David Hildenbrand Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Francois Dugast Signed-off-by: Andrew Morton commit 3a5a06554566fcc9f7de7327cfc365ed384d396c Author: Balbir Singh Date: Wed Oct 1 16:56:53 2025 +1000 mm/zone_device: rename page_free callback to folio_free Change page_free to folio_free to make the folio support for zone device-private more consistent. The PCI P2PDMA callback has also been updated and changed to folio_free() as a result. For drivers that do not support folios (yet), the folio is converted back into page via &folio->page and the page is used as is, in the current callback implementation. Link: https://lkml.kernel.org/r/20251001065707.920170-3-balbirs@nvidia.com Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Cc: Madhavan Srinivasan Cc: Christophe Leroy Cc: Felix Kuehling Cc: Alex Deucher Cc: "Christian König" Signed-off-by: Andrew Morton commit d245f9b4ab806733a77e51a218ca7b8bc3135cd9 Author: Balbir Singh Date: Wed Oct 1 16:56:52 2025 +1000 mm/zone_device: support large zone device private folios Patch series "mm: support device-private THP", v7. This patch series introduces support for Transparent Huge Page (THP) migration in zone device-private memory. The implementation enables efficient migration of large folios between system memory and device-private memory Background Current zone device-private memory implementation only supports PAGE_SIZE granularity, leading to: - Increased TLB pressure - Inefficient migration between CPU and device memory This series extends the existing zone device-private infrastructure to support THP, leading to: - Reduced page table overhead - Improved memory bandwidth utilization - Seamless fallback to base pages when needed In my local testing (using lib/test_hmm) and a throughput test, the series shows a 350% improvement in data transfer throughput and a 80% improvement in latency These patches build on the earlier posts by Ralph Campbell [1] Two new flags are added in vma_migration to select and mark compound pages. migrate_vma_setup(), migrate_vma_pages() and migrate_vma_finalize() support migration of these pages when MIGRATE_VMA_SELECT_COMPOUND is passed in as arguments. The series also adds zone device awareness to (m)THP pages along with fault handling of large zone device private pages. page vma walk and the rmap code is also zone device aware. Support has also been added for folios that might need to be split in the middle of migration (when the src and dst do not agree on MIGRATE_PFN_COMPOUND), that occurs when src side of the migration can migrate large pages, but the destination has not been able to allocate large pages. The code supported and used folio_split() when migrating THP pages, this is used when MIGRATE_VMA_SELECT_COMPOUND is not passed as an argument to migrate_vma_setup(). The test infrastructure lib/test_hmm.c has been enhanced to support THP migration. A new ioctl to emulate failure of large page allocations has been added to test the folio split code path. hmm-tests.c has new test cases for huge page migration and to test the folio split path. A new throughput test has been added as well. The nouveau dmem code has been enhanced to use the new THP migration capability. mTHP support: The patches hard code, HPAGE_PMD_NR in a few places, but the code has been kept generic to support various order sizes. With additional refactoring of the code support of different order sizes should be possible. The future plan is to post enhancements to support mTHP with a rough design as follows: 1. Add the notion of allowable thp orders to the HMM based test driver 2. For non PMD based THP paths in migrate_device.c, check to see if a suitable order is found and supported by the driver 3. Iterate across orders to check the highest supported order for migration 4. Migrate and finalize The mTHP patches can be built on top of this series, the key design elements that need to be worked out are infrastructure and driver support for multiple ordered pages and their migration. HMM support for large folios was added in 10b9feee2d0d ("mm/hmm: populate PFNs from PMD swap entry"). This patch (of 16) Add routines to support allocation of large order zone device folios and helper functions for zone device folios, to check if a folio is device private and helpers for setting zone device data. When large folios are used, the existing page_free() callback in pgmap is called when the folio is freed, this is true for both PAGE_SIZE and higher order pages. Zone device private large folios do not support deferred split and scan like normal THP folios. Link: https://lkml.kernel.org/r/20251001065707.920170-1-balbirs@nvidia.com Link: https://lkml.kernel.org/r/20251001065707.920170-2-balbirs@nvidia.com Link: https://lore.kernel.org/linux-mm/20201106005147.20113-1-rcampbell@nvidia.com/ [1] Signed-off-by: Balbir Singh Cc: David Hildenbrand Cc: Zi Yan Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Oscar Salvador Cc: Lorenzo Stoakes Cc: Baolin Wang Cc: "Liam R. Howlett" Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Cc: Barry Song Cc: Lyude Paul Cc: Danilo Krummrich Cc: David Airlie Cc: Simona Vetter Cc: Ralph Campbell Cc: Mika Penttilä Cc: Matthew Brost Cc: Francois Dugast Cc: Madhavan Srinivasan Cc: Christophe Leroy Cc: Felix Kuehling Cc: Alex Deucher Cc: "Christian König" Signed-off-by: Andrew Morton commit 1452468447da77e846bda51c3a298ce843395d9c Author: Claudio Imbrenda Date: Tue Oct 28 14:01:50 2025 +0100 KVM: s390: fix missing present bit for gmap puds For hugetlbs, gmap puds have the present bit set. For normal puds (which point to ptes), the bit is not set. This is in contrast to the normal userspace puds, which always have the bit set for present pmds. This causes issues when ___pte_offset_map() is modified to only check for the present bit. The solution to the problem is simply to always set the present bit for present gmap pmds. Link: https://lkml.kernel.org/r/20251028130150.57379-2-imbrenda@linux.ibm.com Signed-off-by: Claudio Imbrenda Link: https://lore.kernel.org/lkml/20251017144924.10034-1-borntraeger@linux.ibm.com/ Tested-by: Christian Borntraeger Acked-by: Christian Borntraeger Acked-by: Balbir Singh Cc: Alexander Gordeev Cc: Alistair Popple Cc: Baolin Wang Cc: Barry Song Cc: Byungchul Park Cc: Danilo Krummrich Cc: Dave Airlie Cc: David Hildenbrand Cc: Dev Jain Cc: Francois Dugast Cc: Gregory Price Cc: Heiko Carstens Cc: "Huang, Ying" Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Lyude Cc: Mathew Brost Cc: Mika Penttilä Cc: Nico Pache Cc: Oscar Salvador Cc: Rakie Kim Cc: Ralph Campbell Cc: Ryan Roberts Cc: Vasily Gorbik Cc: Zi Yan Signed-off-by: Andrew Morton commit 87fcafc4e2b47da41300a0db558afc74d2e418b7 Merge: c7ba92bcfea34f 7c9580f44f90f7 Author: Andrew Morton Date: Mon Nov 24 15:07:34 2025 -0800 Merge branch 'mm-hotfixes-stable' into mm-stable in order to merge "mm/huge_memory: only get folio_order() once during __folio_split()" into mm-stable. commit 5e09895b4063e9f57c6fc416cf30cd0c6ca7ec74 Author: Lukas Wunner Date: Fri Nov 21 18:31:17 2025 +0100 Documentation: PCI: Amend error recovery doc with pci_save_state() rules After recovering from a PCI error through reset, affected devices are in D0_uninitialized state and need to be brought into D0_active state by re-initializing their Config Space registers (PCIe r7.0 sec 5.3.1.1). To facilitate that, the PCI core provides pci_restore_state() and pci_save_state() helpers. Document rules governing their usage. As Bjorn notes, so far no file in "Documentation/ includes anything about the idea of a driver using pci_save_state() to capture the state it wants to restore after an error", even though it is a common pattern in drivers. So that's obviously a gap that should be closed. Reported-by: Bjorn Helgaas Closes: https://lore.kernel.org/r/20251113161556.GA2284238@bhelgaas/ Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/077596ba70202be0e43fdad3bb9b93d356cbe4ec.1763746079.git.lukas@wunner.de commit 383d89699c5028de510a6667f674ed38585f77fc Author: Lukas Wunner Date: Sun Oct 12 15:25:02 2025 +0200 treewide: Drop pci_save_state() after pci_restore_state() In 2009, commit c82f63e411f1 ("PCI: check saved state before restore") changed the behavior of pci_restore_state() such that it became necessary to call pci_save_state() afterwards, lest recovery from subsequent PCI errors fails. The commit has just been reverted and so all the pci_save_state() after pci_restore_state() calls that have accumulated in the tree are now superfluous. Drop them. Two drivers chose a different approach to achieve the same result: drivers/scsi/ipr.c and drivers/net/ethernet/intel/e1000e/netdev.c set the pci_dev's "state_saved" flag to true before calling pci_restore_state(). Drop this as well. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Acked-by: Dave Jiang Acked-by: Giovanni Cabiddu # qat Link: https://patch.msgid.link/c2b28cc4defa1b743cf1dedee23c455be98b397a.1760274044.git.lukas@wunner.de commit a2f1e22390ac2ca7ac8d77aa0f78c068b6dd2208 Author: Lukas Wunner Date: Wed Nov 19 09:50:03 2025 +0100 PCI/ERR: Ensure error recoverability at all times When the PCI core gained power management support in 2002, it introduced pci_save_state() and pci_restore_state() helpers to restore Config Space after a D3hot or D3cold transition, which implies a Soft or Fundamental Reset (PCIe r7.0 sec 5.8): https://git.kernel.org/tglx/history/c/a5287abe398b In 2006, EEH and AER were introduced to recover from errors by performing a reset. Because errors can occur at any time, drivers began calling pci_save_state() on probe to ensure recoverability. In 2009, recoverability was foiled by commit c82f63e411f1 ("PCI: check saved state before restore"): It amended pci_restore_state() to bail out if the "state_saved" flag has been cleared. The flag is cleared by pci_restore_state() itself, hence a saved state is now allowed to be restored only once and is then invalidated. That doesn't seem to make sense because the saved state should be good enough to be reused. Soon after, drivers began to work around this behavior by calling pci_save_state() immediately after pci_restore_state(), see e.g. commit b94f2d775a71 ("igb: call pci_save_state after pci_restore_state"). Hilariously, two drivers even set the "saved_state" flag to true before invoking pci_restore_state(), see ipr_reset_restore_cfg_space() and e1000_io_slot_reset(). Despite these workarounds, recoverability at all times is not guaranteed: E.g. when a PCIe port goes through a runtime suspend and resume cycle, the "saved_state" flag is cleared by: pci_pm_runtime_resume() pci_pm_default_resume_early() pci_restore_state() ... and hence on a subsequent AER event, the port's Config Space cannot be restored. Riana reports a recovery failure of a GPU-integrated PCIe switch and has root-caused it to the behavior of pci_restore_state(). Another workaround would be necessary, namely calling pci_save_state() in pcie_port_device_runtime_resume(). The motivation of commit c82f63e411f1 was to prevent restoring state if pci_save_state() hasn't been called before. But that can be achieved by saving state already on device addition, after Config Space has been initialized. A desirable side effect is that devices become recoverable even if no driver gets bound. This renders the commit unnecessary, so revert it. Reported-by: Riana Tauro # off-list Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Tested-by: Riana Tauro Reviewed-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/9e34ce61c5404e99ffdd29205122c6fb334b38aa.1763483367.git.lukas@wunner.de commit be9edde43d85d301a9b9d9678f34b3c111b85ead Author: Lukas Wunner Date: Wed Nov 19 09:50:02 2025 +0100 PCI/PM: Stop needlessly clearing state_saved on enumeration and thaw The state_saved flag tells the PCI core whether a driver assumes responsibility to save Config Space and put the device into a low power state on suspend. The flag is currently initialized to false on enumeration, even though it already is false (because struct pci_dev is zeroed by kzalloc()) and even though it is set to false before commencing the suspend sequence (the only code path where it's relevant). The flag is also set to false in pci_pm_thaw(), i.e. on resume, when it's no longer relevant. Drop these two superfluous flag assignments for simplicity. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/fd167945bd7852e1ca08cd4b202130659eea2c2f.1763483367.git.lukas@wunner.de commit 894f475f88e06c0f352c829849560790dbdedbe5 Author: Lukas Wunner Date: Wed Nov 19 09:50:01 2025 +0100 PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths When a PCI device is suspended, it is normally the PCI core's job to save Config Space and put the device into a low power state. However drivers are allowed to assume these responsibilities. When they do, the PCI core can tell by looking at the state_saved flag in struct pci_dev: The flag is cleared before commencing the suspend sequence and it is set when pci_save_state() is called. If the PCI core finds the flag set late in the suspend sequence, it refrains from calling pci_save_state() itself. But there are two corner cases where the PCI core neglects to clear the flag before commencing the suspend sequence: * If a driver has legacy PCI PM callbacks, pci_legacy_suspend() neglects to clear the flag. The (stale) flag is subsequently queried by pci_legacy_suspend() itself and pci_legacy_suspend_late(). * If a device has no driver or its driver has no PCI PM callbacks, pci_pm_freeze() neglects to clear the flag. The (stale) flag is subsequently queried by pci_pm_freeze_noirq(). The flag may be set prior to suspend if the device went through error recovery: Drivers commonly invoke pci_restore_state() + pci_save_state() to restore Config Space after reset. The flag may also be set if drivers call pci_save_state() on probe to allow for recovery from subsequent errors. The result is that pci_legacy_suspend_late() and pci_pm_freeze_noirq() don't call pci_save_state() and so the state that will be restored on resume is the one recorded on last error recovery or on probe, not the one that the device had on suspend. If the two states happen to be identical, there's no problem. Reinstate clearing the flag in pci_legacy_suspend() and pci_pm_freeze(). The two functions used to do that until commit 4b77b0a2ba27 ("PCI: Clear saved_state after the state has been restored") deemed it unnecessary because it assumed that it's sufficient to clear the flag on resume in pci_restore_state(). The commit seemingly did not take into account that pci_save_state() and pci_restore_state() are not only used by power management code, but also for error recovery. Devices without driver or whose driver has no PCI PM callbacks may be in runtime suspend when pci_pm_freeze() is called. Their state has already been saved, so don't clear the flag to skip a pointless pci_save_state() in pci_pm_freeze_noirq(). None of the drivers with legacy PCI PM callbacks seem to use runtime PM, so clear the flag unconditionally in their case. Fixes: 4b77b0a2ba27 ("PCI: Clear saved_state after the state has been restored") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki (Intel) Cc: stable@vger.kernel.org # v2.6.32+ Link: https://patch.msgid.link/094f2aad64418710daf0940112abe5a0afdc6bce.1763483367.git.lukas@wunner.de commit 31d3354f42c0da34415164a1f621a195caa1f1bc Author: Timur Tabi Date: Thu Nov 13 17:03:23 2025 -0600 drm/nouveau: verify that hardware supports the flush page address Ensure that the DMA address of the framebuffer flush page is not larger than its hardware register. On GPUs older than Hopper, the register for the address can hold up to a 40-bit address (right-shifted by 8 so that it fits in the 32-bit register), and on Hopper and later it can be 52 bits (64-bit register where bits 52-63 must be zero). Recently it was discovered that under certain conditions, the flush page could be allocated outside this range. Although this bug was fixed, we can ensure that any future changes to this code don't accidentally generate an invalid page address. Signed-off-by: Timur Tabi Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251113230323.1271726-2-ttabi@nvidia.com commit 04d98b3452331fa53ec3b698b66273af6ef73288 Author: Timur Tabi Date: Thu Nov 13 17:03:22 2025 -0600 drm/nouveau: restrict the flush page to a 32-bit address The flush page DMA address is stored in a special register that is not associated with the GPU's standard DMA range. For example, on Turing, the GPU's MMU can handle 47-bit addresses, but the flush page address register is limited to 40 bits. At the point during device initialization when the flush page is allocated, the DMA mask is still at its default of 32 bits. So even though it's unlikely that the flush page could exist above a 40-bit address, the dma_map_page() call could fail, e.g. if IOMMU is disabled and the address is above 32 bits. The simplest way to achieve all constraints is to allocate the page in the DMA32 zone. Since the flush page is literally just a page, this is an acceptable limitation. The alternative is to temporarily set the DMA mask to 40 (or 52 for Hopper and later) bits, but that could have unforseen side effects. In situations where the flush page is allocated above 32 bits and IOMMU is disabled, you will get an error like this: nouveau 0000:65:00.0: DMA addr 0x0000000107c56000+4096 overflow (mask ffffffff, bus limit 0). Fixes: 5728d064190e ("drm/nouveau/fb: handle sysmem flush page from common code") Signed-off-by: Timur Tabi Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251113230323.1271726-1-ttabi@nvidia.com commit b5e719f26107f4a7f82946dc5be92dceb9b443cb Author: Shawn Lin Date: Tue Nov 18 15:42:17 2025 -0600 PCI: dw-rockchip: Configure L1SS support L1 PM Substates for RC mode require support in the dw-rockchip driver including proper handling of the CLKREQ# sideband signal. It is mostly handled by hardware, but software still needs to set the clkreq fields in the PCIE_CLIENT_POWER_CON register to match the hardware implementation. For more details, see section '18.6.6.4 L1 Substate' in the RK3568 TRM 1.1 Part 2, or section '11.6.6.4 L1 Substate' in the RK3588 TRM 1.0 Part2. [bhelgaas: set pci->l1ss_support so DWC core preserves L1SS Capability bits; drop corresponding code here, include updates from https://lore.kernel.org/r/aRRG8wv13HxOCqgA@ryzen] Signed-off-by: Shawn Lin Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1761187883-150120-1-git-send-email-shawn.lin@rock-chips.com Link: https://patch.msgid.link/20251118214312.2598220-4-helgaas@kernel.org commit 07c99eac0bc2c1fe962e56d8b5dc5b1152d421bf Author: Bjorn Helgaas Date: Tue Nov 18 15:42:16 2025 -0600 PCI: tegra194: Remove unnecessary L1SS disable code The DWC core clears the L1 Substates Supported bits unless the driver sets the "dw_pcie.l1ss_support" flag. The tegra194 init_host_aspm() sets "dw_pcie.l1ss_support" if the platform has the "supports-clkreq" DT property. If "supports-clkreq" is absent, "dw_pcie.l1ss_support" is not set, and the DWC core will clear the L1 Substates Supported bits. The tegra194 code to clear the L1 Substates Supported bits is unnecessary, so remove it. Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251118214312.2598220-3-helgaas@kernel.org commit a00bba406b5a682764ecb507e580ca8159196aa3 Author: Bjorn Helgaas Date: Tue Nov 18 15:42:15 2025 -0600 PCI: dwc: Advertise L1 PM Substates only if driver requests it L1 PM Substates require the CLKREQ# signal and may also require device-specific support. If CLKREQ# is not supported or driver support is lacking, enabling L1.1 or L1.2 may cause errors when accessing devices, e.g., nvme nvme0: controller is down; will reset: CSTS=0xffffffff, PCI_STATUS=0x10 If the kernel is built with CONFIG_PCIEASPM_POWER_SUPERSAVE=y or users enable L1.x via sysfs, users may trip over these errors even if L1 Substates haven't been enabled by firmware or the driver. To prevent such errors, disable advertising the L1 PM Substates unless the driver sets "dw_pcie.l1ss_support" to indicate that it knows CLKREQ# is present and any device-specific configuration has been done. Set "dw_pcie.l1ss_support" in tegra194 (if DT includes the "supports-clkreq' property) and qcom (for cfg_2_7_0, cfg_1_9_0, cfg_1_34_0, and cfg_sc8280xp controllers) so they can continue to use L1 Substates. Based on Niklas's patch: https://patch.msgid.link/20251017163252.598812-2-cassel@kernel.org [bhelgaas: drop hiding for endpoints] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251118214312.2598220-2-helgaas@kernel.org commit bcc9a4a0bca3aee4303fa4a20302e57b24ac8f68 Author: Shawn Lin Date: Fri Nov 14 20:09:00 2025 +0800 PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition As per DesignWare Cores PCI Express Controller Databook, section 5.50, SII: Debug Signals, cxpl_debug_info[63:0]: [5:0] smlh_ltssm_state: LTSSM current state. Encoding is same as the dedicated smlh_ltssm_state output. The mask should be 6 bits, from 0 to 5. Hence, fix the mask definition. Fixes: 23fe5bd4be90 ("PCI: keystone: Cleanup ks_pcie_link_up()") Signed-off-by: Shawn Lin [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/1763122140-203068-1-git-send-email-shawn.lin@rock-chips.com commit de8842327728d07b5d836688a66ae5fa56902527 Author: Marc Zyngier Date: Thu Nov 20 17:25:39 2025 +0000 KVM: arm64: selftests: vgic_irq: Add timer deactivation test Add a new test case that triggers the HW deactivation emulation path when trapping ICV_DIR_EL1. This is obviously tied to the way KVM works now, but the test follows the expected architectural behaviour. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-50-maz@kernel.org Signed-off-by: Oliver Upton commit 1c9c71ac1b9f86b3d1841c703e3e928b2ec224c7 Author: Marc Zyngier Date: Thu Nov 20 17:25:38 2025 +0000 KVM: arm64: selftests: vgic_irq: Add Group-0 enable test Add a new test case that inject a Group-0 interrupt together with a bunch of Group-1 interrupts, Ack/EOI the G1 interrupts, and only then enable G0, expecting to get the G0 interrupt. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-49-maz@kernel.org Signed-off-by: Oliver Upton commit d2dee2e849834564293ec9c33165df56dd441399 Author: Marc Zyngier Date: Thu Nov 20 17:25:37 2025 +0000 KVM: arm64: selftests: vgic_irq: Add asymmetric SPI deaectivation test Add a new test case that makes an interrupt pending on a vcpu, activates it, do the priority drop, and then get *another* vcpu to do the deactivation. Special care is taken not to trigger an exit in the process, so that we are sure that the active interrupt is in an LR. Joy. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-48-maz@kernel.org Signed-off-by: Oliver Upton commit b6c68612ab4171e07a7c2ba8864b967207fc3add Author: Marc Zyngier Date: Thu Nov 20 17:25:36 2025 +0000 KVM: arm64: selftests: vgic_irq: Perform EOImode==1 deactivation in ack order When EOImode==1, perform the deactivation in the order of activation, just to make things a bit worse for KVM. Yes, I'm nasty. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-47-maz@kernel.org Signed-off-by: Oliver Upton commit fd5fa1c8d09a77c0986158af5b522f6d35830329 Author: Marc Zyngier Date: Thu Nov 20 17:25:35 2025 +0000 KVM: arm64: selftests: vgic_irq: Remove LR-bound limitation Good news: our GIC emulation is not completely broken, and we can activate as many interrupts as we want. Bump the test to cover all the SGIs, all the allowed PPIs, and 31 SPIs. Yes, 31, because we have 31 available priorities, and the test is not happy with having two interrupts with the same priority. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-46-maz@kernel.org Signed-off-by: Oliver Upton commit 5053c2ab92a1e7cbfd3705be2f4371bf843aad2c Author: Marc Zyngier Date: Thu Nov 20 17:25:34 2025 +0000 KVM: arm64: selftests: vgic_irq: Exclude timer-controlled interrupts The PPI injection API is clear that you can't inject the timer PPIs from userspace, since they are controlled by the timers themselves. Add an exclusion list for this purpose. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-45-maz@kernel.org Signed-off-by: Oliver Upton commit 8b7888c5114d280b071f341c072775ee222178b1 Author: Marc Zyngier Date: Thu Nov 20 17:25:33 2025 +0000 KVM: arm64: selftests: vgic_irq: Change configuration before enabling interrupt The architecture is pretty clear that changing the configuration of an enable interrupt is not OK. It doesn't really matter here, but doing the right thing is not more expensive. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-44-maz@kernel.org Signed-off-by: Oliver Upton commit 27392612c8823f4b65240949eb0dc77de946285d Author: Marc Zyngier Date: Thu Nov 20 17:25:32 2025 +0000 KVM: arm64: selftests: vgic_irq: Fix GUEST_ASSERT_IAR_EMPTY() helper No, 0 is not a spurious INTID. Never been, never was. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-43-maz@kernel.org Signed-off-by: Oliver Upton commit 2366295c76c2e09b969b4a5a0829d750bb1ab062 Author: Marc Zyngier Date: Thu Nov 20 17:25:31 2025 +0000 KVM: arm64: selftests: gic_v3: Disable Group-0 interrupts by default Make sure G0 is disabled at the point of initialising the GIC. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-42-maz@kernel.org Signed-off-by: Oliver Upton commit a1650de7c160aace941d27d39b60c38f6f795aa1 Author: Marc Zyngier Date: Thu Nov 20 17:25:30 2025 +0000 KVM: arm64: selftests: gic_v3: Add irq group setting helper Being able to set the group of an interrupt is pretty useful. Add such a helper. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-41-maz@kernel.org Signed-off-by: Oliver Upton commit 07bb1c5622a54e2fd3f5c5a86969a2e7ad7f7376 Author: Marc Zyngier Date: Thu Nov 20 17:25:29 2025 +0000 KVM: arm64: GICv2: Always trap GICV_DIR register Since we can't decide to trap the DIR register on a per-vcpu basis, always trap the second page of the GIC CPU interface. Yes, this is costly. On the bright side, no sane SW should use EOImode==1 on GICv2... Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-40-maz@kernel.org Signed-off-by: Oliver Upton commit 255de897e7fb918a34845167c572b5bf8e1d9d79 Author: Marc Zyngier Date: Thu Nov 20 17:25:28 2025 +0000 KVM: arm64: GICv2: Handle deactivation via GICV_DIR traps Add the plumbing of GICv2 interrupt deactivation via GICV_DIR. This requires adding a new device so that we can easily decode the DIR address. The deactivation itself is very similar to the GICv3 version. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-39-maz@kernel.org Signed-off-by: Oliver Upton commit 281c6c06e2a7bc331cbe02ad21f1390820d28d59 Author: Marc Zyngier Date: Thu Nov 20 17:25:27 2025 +0000 KVM: arm64: GICv2: Handle LR overflow when EOImode==0 Similarly to the GICv3 version, handle the EOIcount-driven deactivation by walking the overflow list. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-38-maz@kernel.org Signed-off-by: Oliver Upton commit 78ffc28456f5981f0e54007fe124e20610abd0ea Author: Marc Zyngier Date: Thu Nov 20 17:25:26 2025 +0000 KVM: arm64: GICv3: Force exit to sync ICH_HCR_EL2.En FEAT_NV2 is pretty terrible for anything that tries to enforce immediate effects, and writing to ICH_HCR_EL2 in the hope to disable a maintenance interrupt is vain. This only hits memory, and the guest hasn't cleared anything -- the MI will fire. For example, running the vgic_irq test under NV results in about 800 maintenance interrupts being actually handled by the L1 guest, when none were expected. As a cheap workaround, read back ICH_MISR_EL2 after writing 0 to ICH_HCR_EL2. This is very cheap on real HW, and causes a trap to the host in NV, giving it the opportunity to retire the pending MI. With this, the above test runs to completion without any MI being actually handled. Yes, this is really poor... Tested-by: Fuad Tabba Reviewed-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-37-maz@kernel.org Signed-off-by: Oliver Upton commit 6dd333c8942b2e5bb5927af843b56ec2857db7c7 Author: Marc Zyngier Date: Thu Nov 20 17:25:25 2025 +0000 KVM: arm64: GICv3: nv: Plug L1 LR sync into deactivation primitive Pretty much like the rest of the LR handling, deactivation of an L2 interrupt gets reflected in the L1 LRs, and therefore must be propagated into the L1 shadow state if the interrupt is HW-bound. Instead of directly handling the active state (which looks a bit off as it ignores locking and L1->L0 HW propagation), use the new deactivation primitive to perform the deactivation and deal with the required maintenance. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-36-maz@kernel.org Signed-off-by: Oliver Upton commit eb33ffa2bd3f1842d2960aff7484869fc64aa2fb Author: Marc Zyngier Date: Thu Nov 20 17:25:24 2025 +0000 KVM: arm64: GICv3: nv: Resync LRs/VMCR/HCR early for better MI emulation The current approach to nested GICv3 support is to not do anything while L2 is running, wait a transition from L2 to L1 to resync LRs, VMCR and HCR, and only then evaluate the state to decide whether to generate a maintenance interrupt. This doesn't provide a good quality of emulation, and it would be far preferable to find out early that we need to perform a switch. Move the LRs/VMCR and HCR resync into vgic_v3_sync_nested(), so that we have most of the state available. As we turning the vgic off at this stage to avoid a screaming host MI, add a new helper vgic_v3_flush_nested() that switches the vgic on again. The MI can then be directly injected as required. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-35-maz@kernel.org Signed-off-by: Oliver Upton commit 84792050e0392fbc1f285f9d9a0266b8480f6f06 Author: Marc Zyngier Date: Thu Nov 20 17:25:23 2025 +0000 KVM: arm64: GICv3: Avoid broadcast kick on CPUs lacking TDIR CPUs lacking TDIR always trap ICV_DIR_EL1, no matter what, since we have ICH_HCR_EL2.TC set permanently. For these CPUs, it is useless to use a broadcast kick on SPI injection, as the sole purpose of this is to set TDIR. We can therefore skip this on these CPUs, which are challenged enough not to be burdened by extra IPIs. As a consequence, permanently set the TDIR bit in the shadow state to notify the fast-path emulation code of the exit reason. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-34-maz@kernel.org Signed-off-by: Oliver Upton commit ca3c34da3644a24daf248be5dba72783c338dad4 Author: Marc Zyngier Date: Thu Nov 20 17:25:22 2025 +0000 KVM: arm64: GICv3: Handle in-LR deactivation when possible Even when we have either an LR overflow or SPIs in flight, it is extremely likely that the interrupt being deactivated is still in the LRs, and that going all the way back to the the generic trap handling code is a waste of time. Instead, try and deactivate in place when possible, and only if this fails, perform a full exit. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-33-maz@kernel.org Signed-off-by: Oliver Upton commit 1c3b3cadcd69f7415e8b3b1b1e81459e0e8c9f33 Author: Marc Zyngier Date: Thu Nov 20 17:25:21 2025 +0000 KVM: arm64: GICv3: Add SPI tracking to handle asymmetric deactivation SPIs are specially annpying, as they can be activated on a CPU and deactivated on another. WHich means that when an SPI is in flight anywhere, all CPUs need to have their TDIR trap bit set. This translates into broadcasting an IPI across all CPUs to make sure they set their trap bit, The number of in-flight SPIs is kept in an atomic variable so that CPUs can turn the trap bit off as soon as possible. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-32-maz@kernel.org Signed-off-by: Oliver Upton commit 70fd60bdedc9ff4c4830a8b379fb65e6ba1e819f Author: Marc Zyngier Date: Thu Nov 20 17:25:20 2025 +0000 KVM: arm64: GICv3: Set ICH_HCR_EL2.TDIR when interrupts overflow LR capacity Now that we are ready to handle deactivation through ICV_DIR_EL1, set the trap bit if we have active interrupts outside of the LRs. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-31-maz@kernel.org Signed-off-by: Oliver Upton commit 295b69216558367e5e833eb6d92ab2b476a8ad64 Author: Marc Zyngier Date: Thu Nov 20 17:25:19 2025 +0000 KVM: arm64: GICv3: Add GICv2 SGI handling to deactivation primitive The GICv2 SGIs require additional handling for deactivation, as they are effectively multiple interrrupts muxed into one. Make sure we check for the source CPU when deactivating. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-30-maz@kernel.org Signed-off-by: Oliver Upton commit cd4f6ee99b28f10692c2444c8dc0bab77357a25e Author: Marc Zyngier Date: Thu Nov 20 17:25:18 2025 +0000 KVM: arm64: GICv3: Handle deactivation via ICV_DIR_EL1 traps Deactivation via ICV_DIR_EL1 is both relatively straightforward (we have the interrupt that needs deactivation) and really awkward. The main issue is that the interrupt may either be in an LR on another CPU, or ourside of any LR. In the former case, we process the deactivation is if ot was a write to GICD_CACTIVERn, which is already implemented as a big hammer IPI'ing all vcpus. In the latter case, we just perform a normal deactivation, similar to what we do for EOImode==0. Another annoying aspect is that we need to tell the CPU owning the interrupt that its ap_list needs laudering. We use a brand new vcpu request to that effect. Note that this doesn't address deactivation via the GICV MMIO view, which will be taken care of in a later change. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-29-maz@kernel.org Signed-off-by: Oliver Upton commit 3cfd59f81e0f3fbdf8a1b2f576bdc63ab6cc3277 Author: Marc Zyngier Date: Thu Nov 20 17:25:17 2025 +0000 KVM: arm64: GICv3: Handle LR overflow when EOImode==0 Now that we can identify interrupts that have not made it into the LRs, it becomes relatively easy to use EOIcount to walk the overflow list. What is a bit odd is that we compute a fake LR for the original state of the interrupt, clear the active bit, and feed into the existing logic for processing. In a way, this is what would have happened if the interrupt was in an LR. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-28-maz@kernel.org Signed-off-by: Oliver Upton commit a69e2d6f8934bdb9d08a6740ca6c7a44525e2e95 Author: Marc Zyngier Date: Thu Nov 20 17:25:16 2025 +0000 KVM: arm64: Use MI to detect groups being enabled/disabled Add the maintenance interrupt to force an exit when the guest enables/disables individual groups, so that we can resort the ap_list accordingly. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-27-maz@kernel.org Signed-off-by: Oliver Upton commit 33c1f60b3213c766f434f1be1988d8b211b106a9 Author: Marc Zyngier Date: Thu Nov 20 17:25:15 2025 +0000 KVM: arm64: Move undeliverable interrupts to the end of ap_list Interrupts in the ap_list that cannot be acted upon because they are not enabled, or that their group is not enabled, shouldn't make it into the LRs if we are space-constrained. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-26-maz@kernel.org Signed-off-by: Oliver Upton commit 05984ba67eb6fe554afb355368a037f9eec1dd43 Author: Marc Zyngier Date: Thu Nov 20 17:25:14 2025 +0000 KVM: arm64: Invert ap_list sorting to push active interrupts out Having established that pending interrupts should have priority to be moved into the LRs over the active interrupts, implement this in the ap_list sorting. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-25-maz@kernel.org Signed-off-by: Oliver Upton commit 76b2eda65cccb452a2d112809a2995ee7533f963 Author: Marc Zyngier Date: Thu Nov 20 17:25:13 2025 +0000 KVM: arm64: Make vgic_target_oracle() globally available Make the internal crystal ball global, so that implementation-specific code can use it. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-24-maz@kernel.org Signed-off-by: Oliver Upton commit f04b8a5a83dbaff310ff919190123db238d35952 Author: Marc Zyngier Date: Thu Nov 20 17:25:12 2025 +0000 KVM: arm64: Turn kvm_vgic_vcpu_enable() into kvm_vgic_vcpu_reset() Now that we always reconfigure the vgic HCR register on entry, the "enable" part of kvm_vgic_vcpu_enable() is pretty useless. Removing the enable bits from these functions makes it plain that they are just about computing the reset state. Just rename the functions accordingly. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-23-maz@kernel.org Signed-off-by: Oliver Upton commit 6780a756044c396f59e98befed537dbba4a085db Author: Marc Zyngier Date: Thu Nov 20 17:25:11 2025 +0000 KVM: arm64: Revamp vgic maintenance interrupt configuration We currently don't use the maintenance interrupt very much, apart from EOI on level interrupts, and for LR underflow in limited cases. However, as we are moving toward a setup where active interrupts can live outside of the LRs, we need to use the MIs in a more diverse set of cases. Add a new helper that produces a digest of the ap_list, and use that summary to set the various control bits as required. This slightly changes the way v2 SGIs are handled, as they used to count for more than one interrupt, but not anymore. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-22-maz@kernel.org Signed-off-by: Oliver Upton commit cf72ee63711916ad808f82eb054dd9d69727a5bf Author: Marc Zyngier Date: Thu Nov 20 17:25:10 2025 +0000 KVM: arm64: Eagerly save VMCR on exit We currently save/restore the VMCR register in a pretty lazy way (on load/put, consistently with what we do with the APRs). However, we are going to need the group-enable bits that are backed by VMCR on each entry (so that we can avoid injecting interrupts for disabled groups). Move the synchronisation from put to sync, which results in some minor churn in the nVHE hypercalls to simplify things. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-21-maz@kernel.org Signed-off-by: Oliver Upton commit dd598fc1139f7181118719574a4e270e51e0a0eb Author: Marc Zyngier Date: Thu Nov 20 17:25:09 2025 +0000 KVM: arm64: Compute vgic state irrespective of the number of interrupts As we are going to rely on the [G]ICH_HCR{,_EL2} register to be programmed with MI information at all times, slightly de-optimise the flush/sync code to always be called. This is rather lightweight when no interrupts are in flight. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-20-maz@kernel.org Signed-off-by: Oliver Upton commit 0660bc4a2b70e7158f63ea1777132d1c93188fe8 Author: Marc Zyngier Date: Thu Nov 20 17:25:08 2025 +0000 KVM: arm64: GICv2: Extract LR computing primitive Split vgic_v2_populate_lr() into two helpers, so that we have another primitive that computes the LR from a vgic_irq, but doesn't update anything in the shadow structure. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-19-maz@kernel.org Signed-off-by: Oliver Upton commit 3aa9a50c2007e4090b0b5b3c79aed6f63b5e6c49 Author: Marc Zyngier Date: Thu Nov 20 17:25:07 2025 +0000 KVM: arm64: GICv2: Extract LR folding primitive As we are going to need to handle deactivation for interrupts that are not in the LRs, split vgic_v2_fold_lr_state() into a helper that deals with a single interrupt, and the function that loops over the used LRs. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-18-maz@kernel.org Signed-off-by: Oliver Upton commit a00c88ac1f90992e618cf4737e2d1c551c13aed6 Author: Marc Zyngier Date: Thu Nov 20 17:25:06 2025 +0000 KVM: arm64: GICv2: Decouple GICH_HCR programming from LRs being loaded Not programming GICH_HCR while no LRs are populated is a bit of an issue, as we otherwise don't see any maintenance interrupt when the guest interacts with the LRs. Decouple the two and always program the control register, even when we don't have to touch the LRs. This is very similar to what we are already doing for GICv3. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-17-maz@kernel.org Signed-off-by: Oliver Upton commit 5ceb3dac80229684c8e57993f12106cbad23f7ac Author: Marc Zyngier Date: Thu Nov 20 17:25:05 2025 +0000 KVM: arm64: GICv2: Preserve EOIcount on exit EOIcount is how the virtual CPU interface signals that the guest is deactivating interrupts outside of the LRs when EOImode==0. We therefore need to preserve that information so that we can find out what actually needs deactivating, just like we already do on GICv3. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-16-maz@kernel.org Signed-off-by: Oliver Upton commit 1ae0448ca7976281e7ec1d2cd1c861fbc8f8631e Author: Marc Zyngier Date: Thu Nov 20 17:25:04 2025 +0000 KVM: arm64: GICv3: Extract LR computing primitive Split vgic_v3_populate_lr() into two, so that we have another primitive that computes the LR from a vgic_irq, but doesn't update anything in the shadow structure. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-15-maz@kernel.org Signed-off-by: Oliver Upton commit 438e47b697f7913bbb9f44e48b7b6e98389c9e0e Author: Marc Zyngier Date: Thu Nov 20 17:25:03 2025 +0000 KVM: arm64: GICv3: Extract LR folding primitive As we are going to need to handle deactivation for interrupts that are not in the LRs, split vgic_v3_fold_lr_state() into a helper that deals with a single interrupt, and the function that loops over the used LRs. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-14-maz@kernel.org Signed-off-by: Oliver Upton commit 00c6d0d4a80582a43578380f5283940c2e16eec8 Author: Marc Zyngier Date: Thu Nov 20 17:25:02 2025 +0000 KVM: arm64: GICv3: Decouple ICH_HCR_EL2 programming from LRs Not programming ICH_HCR_EL2 while no LRs are populated is a bit of an issue, as we otherwise don't see any maintenance interrupt when the guest interacts with the LRs. Decouple the two and always program the control register, even when we don't have to touch the LRs. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-13-maz@kernel.org Signed-off-by: Oliver Upton commit f4ded7b0848e6fcc9c882a1fdaa925d921c932f1 Author: Marc Zyngier Date: Thu Nov 20 17:25:01 2025 +0000 KVM: arm64: GICv3: Preserve EOIcount on exit EOIcount is how the virtual CPU interface signals that the guest is deactivating interrupts outside of the LRs when EOImode==0. We therefore need to preserve that information so that we can find out what actually needs deactivating. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-12-maz@kernel.org Signed-off-by: Oliver Upton commit 73c9726975af1c2bf8d062017c67bcf4fb8821d5 Author: Marc Zyngier Date: Thu Nov 20 17:25:00 2025 +0000 KVM: arm64: GICv3: Drop LPI active state when folding LRs Despite LPIs not having an active state, *virtual* LPIs do have one, which gets cleared on EOI. So far, so good. However, this leads to a small problem: when an active LPI is not in the LRs, that EOImode==0 and that the guest EOIs it, EOIcount doesn't get bumped up. Which means that in these condition, the LPI would stay active forever. Clearly, we can't have that. So if we spot an active LPI, we drop that state. It's pretty pointless anyway, and only serves as a way to trip SW over. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-11-maz@kernel.org Signed-off-by: Oliver Upton commit 0dc433e79ad031801842e3d8bc5d9729e14f5067 Author: Marc Zyngier Date: Thu Nov 20 17:24:59 2025 +0000 KVM: arm64: Add LR overflow handling documentation Add a bit of documentation describing how we are dealing with LR overflow. This is mostly a braindump of how things are expected to work. For now anyway. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-10-maz@kernel.org Signed-off-by: Oliver Upton commit 879a7fd4fd64656d953f887e6a18e13e0b9a9f8f Author: Marc Zyngier Date: Thu Nov 20 17:24:58 2025 +0000 KVM: arm64: Add tracking of vgic_irq being present in a LR We currently cannot identify whether an interrupt is queued into a LR. It wasn't needed until now, but that's about to change. Add yet another flag to track that state. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-9-maz@kernel.org Signed-off-by: Oliver Upton commit a4413a7c31cfca49d3f4830cf8a45edf4a713f63 Author: Marc Zyngier Date: Thu Nov 20 17:24:57 2025 +0000 KVM: arm64: Repack struct vgic_irq fields struct vgic_irq has grown over the years, in a rather bad way. Repack it using bitfields so that the individual flags, and move things around a bit so that it a bit smaller. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-8-maz@kernel.org Signed-off-by: Oliver Upton commit 2a28810cbb8b21a4016182617cc1fd72eddf4a36 Author: Marc Zyngier Date: Thu Nov 20 17:24:56 2025 +0000 KVM: arm64: GICv3: Detect and work around the lack of ICV_DIR_EL1 trapping A long time ago, an unsuspecting architect forgot to add a trap bit for ICV_DIR_EL1 in ICH_HCR_EL2. Which was unfortunate, but what's a bit of spec between friends? Thankfully, this was fixed in a later revision, and ARM "deprecates" the lack of trapping ability. Unfortuantely, a few (billion) CPUs went out with that defect, anything ARMv8.0 from ARM, give or take. And on these CPUs, you can't trap DIR on its own, full stop. As the next best thing, we can trap everything in the common group, which is a tad expensive, but hey ho, that's what you get. You can otherwise recycle the HW in the neaby bin. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-7-maz@kernel.org Signed-off-by: Oliver Upton commit 567ebfedb5bd204a8ce6a11695f02730f1bf57f4 Author: Marc Zyngier Date: Thu Nov 20 17:24:55 2025 +0000 KVM: arm64: vgic-v3: Fix GICv3 trapping in protected mode As we are about to start trapping a bunch of extra things, augment the pKVM trap description with all the registers trapped by ICH_HCR_EL2.TC, making them legal instead of resulting in a UNDEF injection in the guest. While we're at it, ensure that pKVM captures the vgic model so that it can be checked by the emulation code. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-6-maz@kernel.org Signed-off-by: Oliver Upton commit 8d3dfab1d305d61359454d9c09b736f077a9fce4 Author: Marc Zyngier Date: Thu Nov 20 17:24:54 2025 +0000 KVM: arm64: Turn vgic-v3 errata traps into a patched-in constant The trap bits are currently only set to manage CPU errata. However, we are about to make use of them for purposes beyond beating broken CPUs into submission. For this purpose, turn these errata-driven bits into a patched-in constant that is merged with the KVM-driven value at the point of programming the ICH_HCR_EL2 register, rather than being directly stored with with the shadow value.. This allows the KVM code to distinguish between a trap being handled for the purpose of an erratum workaround, or for KVM's own need. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-5-maz@kernel.org Signed-off-by: Oliver Upton commit 08f4f41c1e95ffb1ce525a07d25daa577110d748 Author: Marc Zyngier Date: Thu Nov 20 17:24:53 2025 +0000 irqchip/apple-aic: Spit out ICH_MISR_EL2 value on spurious vGIC MI It is all good and well to scream about spurious vGIC maintenance interrupts. It would be even better to output the reason why, which is already checked, but not printed out. The unsuspecting kernel tinkerer thanks you. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-4-maz@kernel.org Signed-off-by: Oliver Upton commit fa8f11e8e18383d234c77ba08d347aed7883d39a Author: Marc Zyngier Date: Thu Nov 20 17:24:52 2025 +0000 irqchip/gic: Expose CPU interface VA to KVM Future changes will require KVM to be able to perform deactivations by writing to the physical CPU interface. Add the corresponding VA to the kvm_info structure, and let KVM stash it. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-3-maz@kernel.org Signed-off-by: Oliver Upton commit 8cb4ecec5e366b7dbbf200629a22624ad2340af5 Author: Marc Zyngier Date: Thu Nov 20 17:24:51 2025 +0000 irqchip/gic: Add missing GICH_HCR control bits The GICH_HCR description is missing a bunch of control bits that control the maintenance interrupt. Add them. Tested-by: Fuad Tabba Signed-off-by: Marc Zyngier Tested-by: Mark Brown Link: https://msgid.link/20251120172540.2267180-2-maz@kernel.org Signed-off-by: Oliver Upton commit d93febe2ed2e0491af9d47f0ee6d4b01918877f4 Author: Oliver Upton Date: Mon Nov 24 11:01:45 2025 -0800 KVM: arm64: nv: Forward FEAT_XNX permissions to the shadow stage-2 Add support for FEAT_XNX to shadow stage-2 MMUs, being careful to only evaluate XN[0] when the feature is actually exposed to the VM. Restructure the layering of permissions in the fault handler to assume pX and uX then restricting based on the guest's stage-2 afterwards. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-4-oupton@kernel.org Signed-off-by: Oliver Upton commit 2608563b466b9192a9356b18463005da6e138bf9 Author: Oliver Upton Date: Mon Nov 24 11:01:44 2025 -0800 KVM: arm64: Add support for FEAT_XNX stage-2 permissions FEAT_XNX adds support for encoding separate execute permissions for EL0 and EL1 at stage-2. Add support for this to the page table library, hiding the unintuitive encoding scheme behind generic pX and uX permission flags. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-3-oupton@kernel.org Signed-off-by: Oliver Upton commit dc31124379b69a758af740bbd981e9e9f04a61d5 Author: Oliver Upton Date: Mon Nov 24 11:01:43 2025 -0800 arm64: Detect FEAT_XNX Detect the feature in anticipation of using it in KVM. Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier Link: https://msgid.link/20251124190158.177318-2-oupton@kernel.org Signed-off-by: Oliver Upton commit 54df8b80cc63aa0f22c4590cad11542731ed43ff Author: Qu Wenruo Date: Mon Nov 3 12:51:09 2025 +1030 btrfs: scrub: always update btrfs_scrub_progress::last_physical [BUG] When a scrub failed immediately without any byte scrubbed, the returned btrfs_scrub_progress::last_physical will always be 0, even if there is a non-zero @start passed into btrfs_scrub_dev() for resume cases. This will reset the progress and make later scrub resume start from the beginning. [CAUSE] The function btrfs_scrub_dev() accepts a @progress parameter to copy its updated progress to the caller, there are cases where we either don't touch progress::last_physical at all or copy 0 into last_physical: - last_physical not updated at all If some error happened before scrubbing any super block or chunk, we will not copy the progress, leaving the @last_physical untouched. E.g. failed to allocate @sctx, scrubbing a missing device or even there is already a running scrub and so on. All those cases won't touch @progress at all, resulting the last_physical untouched and will be left as 0 for most cases. - Error out before scrubbing any bytes In those case we allocated @sctx, and sctx->stat.last_physical is all zero (initialized by kvzalloc()). Unfortunately some critical errors happened during scrub_enumerate_chunks() or scrub_supers() before any stripe is really scrubbed. In that case although we will copy sctx->stat back to @progress, since no byte is really scrubbed, last_physical will be overwritten to 0. [FIX] Make sure the parameter @progress always has its @last_physical member updated to @start parameter inside btrfs_scrub_dev(). At the very beginning of the function, set @progress->last_physical to @start, so that even if we error out without doing progress copying, last_physical is still at @start. Then after we got @sctx allocated, set sctx->stat.last_physical to @start, this will make sure even if we didn't get any byte scrubbed, at the progress copying stage the @last_physical is not left as zero. This should resolve the resume progress reset problem. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7a832b870b8a7a6a16a51dcdd8adde47b27f0169 Author: Filipe Manana Date: Mon Nov 17 12:15:09 2025 +0000 btrfs: place all boolean fields together in struct find_free_extent_ctl Move the 'retry_uncached' and 'hint' fields close to the other boolean fields so that we remove a hole from the structure and reduce its size from 136 bytes down to 128 bytes. Currently this structure is only allocated in the stack of btrfs_reserve_extent(). Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e21756fc4aa78539b9cb9b45bfc8c4fd12322bc5 Author: Filipe Manana Date: Mon Nov 17 12:02:29 2025 +0000 btrfs: use booleans for delalloc arguments and struct find_free_extent_ctl The struct find_free_extent_ctl uses an int for the 'delalloc' field but it's always used as a boolean, and its value is used to be passed to several functions to signal if we are dealing with delalloc. The same goes for the 'is_data' argument from btrfs_reserve_extent(). So change the type from int to bool and move the field definition in the find_free_extent_ctl structure so that it's close to other bool fields and reduces the size of the structure from 144 down to 136 bytes (at the moment it's only declared in the stack of btrfs_reserve_extent(), never allocated otherwise). Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d7fe41044b3ac8f9b5965de499a13ac9ae947e79 Author: Filipe Manana Date: Fri Nov 14 16:00:04 2025 +0000 btrfs: use bool type for btrfs_path members used as booleans Many fields of struct btrfs_path are used as booleans but their type is an unsigned int (of one 1 bit width to save space). Change the type to bool keeping the :1 suffix so that they combine with the previous u8 fields in order to save space. This makes the code more clear by using explicit true/false and more in line with the preferred style, preserving the size of the structure. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c2b2504ece4089697bb7db115dc91e344dfed76f Author: Filipe Manana Date: Thu Nov 13 12:07:14 2025 +0000 btrfs: update check_skip variable after unlocking current node There's no need to update the local variable 'check_skip' to false inside the critical section delimited by the lock of the current node, so do it after unlocking the node. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5d8222a50ad37c98455da08b33ce49fe6b726c72 Author: Filipe Manana Date: Thu Nov 13 16:44:41 2025 +0000 btrfs: abort transaction on item count overflow in __push_leaf_left() If we try to push an item count from the right leaf that is greater than the number of items in the leaf, we just emit a warning. This should never happen but if it does we get an underflow in the new number of items in the right leaf and chaos follows from it. So replace the warning with proper error handling, by aborting the transaction and returning -EUCLEAN, and proper logging by using btrfs_crit() instead of WARN(), which gives us proper formatting and information about the filesystem. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 027358a0900913a395f99d911108375a7f1c50f4 Author: Filipe Manana Date: Thu Nov 13 11:52:34 2025 +0000 btrfs: always use right leaf variable in __push_leaf_left() The 'right' variable points to path->nodes[0] and path->nodes[0] is never changed, but some places use 'right' while others refer to path->nodes[0]. Update all sites to use 'right' as not only it's shorter it's also easier to reason since it means the right leaf and avoids any confusion with the sibling left leaf. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 29bb40ed56ab9a1418cbe3e62c97a27b48f896e2 Author: Filipe Manana Date: Thu Nov 13 11:46:34 2025 +0000 btrfs: remove duplicated leaf dirty status clearing in __push_leaf_right() We have already called btrfs_clear_buffer_dirty() against the left leaf in the code above: btrfs_set_header_nritems(left, left_nritems); if (left_nritems) btrfs_mark_buffer_dirty(trans, left); else btrfs_clear_buffer_dirty(trans, left); So remove the second check for a 0 number of items in the left leaf and calling again btrfs_clear_buffer_dirty() against the left leaf. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7447263d7da24097f17147ffe5d9c43c317deb44 Author: Filipe Manana Date: Thu Nov 13 11:32:44 2025 +0000 btrfs: always use left leaf variable in __push_leaf_right() The 'left' variable points to path->nodes[0] and path->nodes[0] is never changed, but some places use 'left' while others refer to path->nodes[0]. Update all sites to use 'left' as not only it's shorter it's also easier to reason since it means the left leaf and avoids any confusion with the sibling right leaf. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit fad159f69edabac046c725cdecf22275199b2dd0 Author: Filipe Manana Date: Thu Nov 13 13:04:13 2025 +0000 btrfs: add unlikely to critical error in btrfs_extend_item() It's not expected to get a data size less than the leaf's free space, which would lead to a leaf dump and BUG(), so tag the if statement's expression as unlikely, hinting the compiler to potentially generate better code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 86d3dc812f1e9aea58fabe8fcd42023f54abcad0 Author: Filipe Manana Date: Thu Nov 13 12:59:19 2025 +0000 btrfs: remove pointless return value update in btrfs_del_items() The call to btrfs_del_leaf() can only return an error (negative value) or zero (success). If we didn't get an error then 'ret' is zero, so it's pointless to set it to zero again. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e7dd1182fcedee7c6097c9f49eba8de94a4364e3 Author: Filipe Manana Date: Thu Nov 13 12:52:45 2025 +0000 btrfs: fix leaf leak in an error path in btrfs_del_items() If the call to btrfs_del_leaf() fails we return without decrementing the extra ref we took on the leaf, therefore leaking it. Fix this by ensuring we drop the ref count before returning the error. Fixes: 751a27615dda ("btrfs: do not BUG_ON() on tree mod log failures at btrfs_del_ptr()") Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 280dd7c106fd4c47756d19f6ae89862bb7bf7225 Author: Zhen Ni Date: Fri Nov 14 15:53:13 2025 +0800 btrfs: fix incomplete parameter rename in btrfs_decompress() Commit 2c25716dcc25 ("btrfs: zlib: fix and simplify the inline extent decompression") renamed the 'start_byte' parameter to 'dest_pgoff' in the btrfs_decompress(). The remaining 'start_byte' references are inconsistent with the actual implementation and may cause confusion for developers. Ensure consistency between function declaration and implementation. Signed-off-by: Zhen Ni Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c094e6ccead7a12ed41cfba9119974657ad8971 Author: David Sterba Date: Tue Nov 11 15:31:52 2025 +0100 btrfs: make a few more ASSERTs verbose We have support for optional string to be printed in ASSERT() (added in 19468a623a9109 ("btrfs: enhance ASSERT() to take optional format string")), it's not yet everywhere it could be so add a few more files. Signed-off-by: David Sterba commit ec20799064c881e373939ea3cea55b1c406c6b76 Author: Qu Wenruo Date: Tue Nov 11 09:12:01 2025 +1030 btrfs: enable encoded read/write/send for bs > ps cases Since the read verification and read repair are all supporting bs > ps without large folios now, we can enable encoded read/write/send. Now we can relax the alignment in assert_bbio_alignment() to min(blocksize, PAGE_SIZE). But also add the extra blocksize based alignment check for the logical and length of the bbio. There is a pitfall in btrfs_add_compress_bio_folios(), which relies on the folios passed in to meet the minimal folio order. But now we can pass regular page sized folios in, update it to check each folio's size instead of using the minimal folio size. This allows btrfs_add_compress_bio_folios() to even handle folios array with different sizes, thankfully we don't yet need to handle such crazy situation. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 052fd7a5cace152489cfc8abc212e0213154980f Author: Qu Wenruo Date: Tue Nov 11 09:12:00 2025 +1030 btrfs: make read verification handle bs > ps cases without large folios The current read verification is also relying on large folios to support bs > ps cases, but that introduced quite some limits. To enhance read-repair to support bs > ps without large folios: - Make btrfs_data_csum_ok() to accept an array of paddrs Which can pass the paddrs[] direct into btrfs_calculate_block_csum_pages(). - Make repair_one_sector() to accept an array of paddrs So that it can submit a repair bio backed by regular pages, not only large folios. This requires us to allocate more slots at bio allocation time though. Also since the caller may have only partially advanced the saved_iter for bs > ps cases, we can not directly trust the logical bytenr from saved_iter (can be unaligned), thus a manual round down is necessary for the logical bytenr. - Make btrfs_check_read_bio() to build an array of paddrs The tricky part is that we can only call btrfs_data_csum_ok() after all involved pages are assembled. This means at the call time of btrfs_check_read_bio(), our offset inside the bio is already at the end of the fs block. Thus we must re-calculate @bio_offset for btrfs_data_csum_ok() and repair_one_sector(). Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2574e9011018a1d6d3da8d03d0bfc4e2675dee2a Author: Qu Wenruo Date: Tue Nov 11 09:11:59 2025 +1030 btrfs: make btrfs_repair_io_failure() handle bs > ps cases without large folios Currently btrfs_repair_io_failure() only accept a single @paddr parameter, and for bs > ps cases it's required that @paddr is backed by a large folio. That assumption has quite some limitations, preventing us from utilizing true zero-copy direct-io and encoded read/writes. To address the problem, enhance btrfs_repair_io_failure() by: - Accept an array of paddrs, up to 64K / PAGE_SIZE entries This kind of acts like a bio_vec, but with very limited entries, as the function is only utilized to repair one fs data block, or a tree block. Both have an upper size limit (BTRFS_MAX_BLOCK_SIZE, i.e. 64K), so we don't need the full bio_vec thing to handle it. - Allocate a bio with multiple slots Previously even for bs > ps cases, we only passed in a contiguous physical address range, thus a single slot will be enough. But not anymore, so we have to allocate a bio structure, other than using the on-stack one. - Use on-stack memory to allocate @paddrs array It's at most 16 pages (4K page size, 64K block size), will take up at most 128 bytes. I think the on-stack cost is still acceptable. - Add one extra check to make sure the repair bio is exactly one block - Utilize btrfs_repair_io_failure() to submit a single bio for metadata This should improve the read-repair performance for metadata, as now we submit a node sized bio then wait, other than submit each block of the metadata and wait for each submitted block. - Add one extra parameter indicating the step This is due to the fact that metadata step can be as large as nodesize, instead of sectorsize. So we need a way to distinguish metadata and data repair. - Reduce the width of @length parameter of btrfs_repair_io_failure() Since we only call btrfs_repair_io_failure() on a single data or metadata block, u64 is overkilled. Use u32 instead and add one extra ASSERT()s to make sure the length never exceed BTRFS_MAX_BLOCK_SIZE. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 62bcbdca0ea9b1add9c22f400b51c56184902053 Author: Qu Wenruo Date: Tue Nov 11 09:11:58 2025 +1030 btrfs: make btrfs_csum_one_bio() handle bs > ps without large folios For bs > ps cases, all folios passed into btrfs_csum_one_bio() are ensured to be backed by large folios. But that requirement excludes features like direct IO and encoded writes. To support bs > ps without large folios, enhance btrfs_csum_one_bio() by: - Split btrfs_calculate_block_csum() into two versions * btrfs_calculate_block_csum_folio() For call sites where a fs block is always backed by a large folio. This will do extra checks on the folio size, build a paddrs[] array, and pass it into the newer btrfs_calculate_block_csum_pages() helper. For now btrfs_check_block_csum() is still using this version. * btrfs_calculate_block_csum_pages() For call sites that may hit a fs block backed by noncontiguous pages. The pages are represented by paddrs[] array, which includes the offset inside the page. This function will do the proper sub-block handling. - Make btrfs_csum_one_bio() to use btrfs_calculate_block_csum_pages() This means we will need to build a local paddrs[] array, and after filling a fs block, do the checksum calculation. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit fe1e50031feae74688e33fe4e0bdc7d9585c07ce Author: Filipe Manana Date: Tue Nov 11 15:40:47 2025 +0000 btrfs: move struct reserve_ticket definition to space-info.c It's not used anywhere outside space-info.c so move it from space-info.h into space-info.c. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4decf577fb7a5a252f6f67383d06111b3525505f Author: David Sterba Date: Wed Oct 15 18:48:37 2025 +0200 btrfs: move and rename CSUM_FMT definition Move the CSUM_FMT* definitions to fs.h where is be the BTRFS_KEY_FMT and add the prefix for consistency. Signed-off-by: David Sterba commit a320476ca8a3d2e63017fe8ec06ef8b6a09c65cd Author: Sun YangKai Date: Tue Oct 7 11:35:12 2025 +0800 btrfs: tests: do trivial BTRFS_PATH_AUTO_FREE conversions Trivial pattern for the auto freeing where there are no operations between btrfs_free_path() and the function returns. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5387bd958180bfd7ffe454c8d2e7ae2782ebd4cc Author: Qu Wenruo Date: Thu Oct 9 15:10:01 2025 +1030 btrfs: raid56: remove sector_ptr structure Since sector_ptr structure is now only containing a single paddr, there is no need to use that structure. Instead use phys_addr_t array for bio and stripe pointers. This means several helpers are also needed to accept a paddr instead of a sector_ptr pointer. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1810350b04ef38b375c64304e142de96d90404e1 Author: Qu Wenruo Date: Thu Oct 9 15:10:00 2025 +1030 btrfs: raid56: move sector_ptr::uptodate into a dedicated bitmap The uptodate boolean member can be extracted into a bitmap, which will save us some space (1 bit in a byte vs 8 bits in a byte). Furthermore we do not need to record the uptodate bitmap for bio sectors, as if bio_sectors[].paddr is valid it means there is a bio and will be uptodate. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 17d552ab9b2be6c2c28169fcf913114f63a71a22 Author: Qu Wenruo Date: Thu Oct 9 15:09:59 2025 +1030 btrfs: raid56: remove sector_ptr::has_paddr member We can use paddr -1 as an indicator for unset/uninitialized paddr. We can not use 0 paddr, unlike virtual address 0 which is never mapped thus will always trigger a page fault, physical address 0 may be a valid page. So here we follow swiotlb to use (paddr)-1 as a special indicator for invalid/unset physical address. Even if the PFN may still be valid, our usage of the physical address should always be aligned to fs block size (or page size for bs > ps cases), thus such -1 paddr should never be a valid one. With this special -1 paddr, we can get rid of has_paddr member and save 1 byte for sector_ptr structure. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9b3743a6760bedc783809b94aa87b9b8ef64f52b Author: Baolin Liu Date: Tue Nov 11 20:05:58 2025 +0800 btrfs: simplify list initialization in btrfs_compr_pool_scan() In btrfs_compr_pool_scan(), use LIST_HEAD() to declare and initialize the 'remove' list_head in one step instead of using INIT_LIST_HEAD() separately. Signed-off-by: Baolin Liu Reviewed-by: David Sterba Signed-off-by: David Sterba commit 07166122b58a7fb3c056247aa262e832f3f38d0f Author: Qu Wenruo Date: Thu Nov 6 20:02:15 2025 +1030 btrfs: scrub: factor out parity scrub code into a helper The function scrub_raid56_parity_stripe() is handling the parity stripe by the following steps: - Scrub each data stripes And make sure everything is fine in each data stripe - Cache the data stripe into the raid bio - Use the cached raid bio to scrub the target parity stripe Extract the last two steps into a new helper, scrub_raid56_cached_parity(), as a cleanup and make the error handling more straightforward. With the following minor cleanups: - Use on-stack bio structure The bio is always empty thus we do not need any bio vector nor the block device. Thus there is no need to allocate a bio, the on-stack one is more than enough to cut it. - Remove the unnecessary btrfs_put_bioc() call if btrfs_map_block() failed If btrfs_map_block() is failed, @bioc_ret will not be touched thus there is no need to call btrfs_put_bioc() in this case. - Use a proper out: tag to do the cleanup Now the error cleanup is much shorter and simpler, just btrfs_bio_counter_dec() and bio_uninit(). Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d435c513652e6a90a13c881986a2cc6420c99cab Author: Qu Wenruo Date: Wed Nov 5 20:28:12 2025 +1030 btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() Unlike queue_scrub_stripe() which uses the global sctx->extent_path and sctx->csum_path which are always released at the end of scrub_stripe(), scrub_raid56_parity_stripe() uses local extent_path and csum_path, as that function is going to handle the full stripe, whose bytenr may be smaller than the bytenr in the global sctx paths. However the cleanup of local extent/csum paths is only happening after we have successfully submitted an rbio. There are several error routes that we didn't release those two paths: - scrub_find_fill_first_stripe() errored out at csum tree search In that case extent_path is still valid, and that function itself will not release the extent_path passed in. And the function returns directly without releasing both paths. - The full stripe is empty - Some blocks failed to be recovered - btrfs_map_block() failed - raid56_parity_alloc_scrub_rbio() failed The function returns directly without releasing both paths. Fix it by covering btrfs_release_path() calls inside the out: tag. This is just a hot fix, in the long run we will go scoped based auto freeing for both local paths. Fixes: 1dc4888e725d ("btrfs: scrub: avoid unnecessary extent tree search preparing stripes") Fixes: 3c771c194402 ("btrfs: scrub: avoid unnecessary csum tree search preparing stripes") Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit cfc7fe2b0f18c54b571b4137156f944ff76057c8 Author: Qu Wenruo Date: Thu Nov 6 08:15:03 2025 +1030 btrfs: use kvcalloc for btrfs_bio::csum allocation [BUG] There is a report that memory allocation failed for btrfs_bio::csum during a large read: b2sum: page allocation failure: order:4, mode:0x40c40(GFP_NOFS|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 CPU: 0 UID: 0 PID: 416120 Comm: b2sum Tainted: G W 6.17.0 #1 NONE Tainted: [W]=WARN Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) Call trace: show_stack+0x18/0x30 (C) dump_stack_lvl+0x5c/0x7c dump_stack+0x18/0x24 warn_alloc+0xec/0x184 __alloc_pages_slowpath.constprop.0+0x21c/0x730 __alloc_frozen_pages_noprof+0x230/0x260 ___kmalloc_large_node+0xd4/0xf0 __kmalloc_noprof+0x1c8/0x260 btrfs_lookup_bio_sums+0x214/0x278 btrfs_submit_chunk+0xf0/0x3c0 btrfs_submit_bbio+0x2c/0x4c submit_one_bio+0x50/0xac submit_extent_folio+0x13c/0x340 btrfs_do_readpage+0x4b0/0x7a0 btrfs_readahead+0x184/0x254 read_pages+0x58/0x260 page_cache_ra_unbounded+0x170/0x24c page_cache_ra_order+0x360/0x3bc page_cache_async_ra+0x1a4/0x1d4 filemap_readahead.isra.0+0x44/0x74 filemap_get_pages+0x2b4/0x3b4 filemap_read+0xc4/0x3bc btrfs_file_read_iter+0x70/0x7c vfs_read+0x1ec/0x2c0 ksys_read+0x4c/0xe0 __arm64_sys_read+0x18/0x24 el0_svc_common.constprop.0+0x5c/0x130 do_el0_svc+0x1c/0x30 el0_svc+0x30/0xa0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c [CAUSE] Btrfs needs to allocate memory for btrfs_bio::csum for large reads, so that we can later verify the contents of the read. However nowadays a read bio can easily go beyond BIO_MAX_VECS * PAGE_SIZE (which is 1M for 4K page sizes), due to the multi-page bvec that one bvec can have more than one pages, as long as the pages are physically adjacent. This will become more common when the large folio support is moved out of experimental features. In the above case, a read larger than 4MiB with SHA256 checksum (32 bytes for each 4K block) will be able to trigger a order 4 allocation. The order 4 is larger than PAGE_ALLOC_COSTLY_ORDER (3), thus without extra flags such allocation will not retry. And if the system has very small amount of memory (e.g. RPI4 with low memory spec) or VMs with small vRAM, or the memory is heavily fragmented, such allocation will fail and cause the above warning. [FIX] Although btrfs is handling the memory allocation failure correctly, we do not really need the physically contiguous memory just to restore our checksum. In fact btrfs_csum_one_bio() is already using kvzalloc() to reduce the memory pressure. So follow the step to use kvcalloc() for btrfs_bio::csum. Reported-by: Calvin Owens Link: https://lore.kernel.org/linux-btrfs/20251105180054.511528-1-calvin@wbinvd.org/ Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1dac8db80cee66b7ba51d323025e47989278ee03 Author: Gladyshev Ilya Date: Sun Nov 2 10:38:52 2025 +0300 btrfs: don't generate any code from ASSERT() in release builds The current definition of ASSERT(cond) as (void)(cond) is redundant, since these checks have no side effects and don't affect code logic. However, some checks contain READ_ONCE() or other compiler-unfriendly constructs. For example, ASSERT(list_empty) in btrfs_add_dealloc_inode() was compiled to a redundant mov instruction due to this issue. Define ASSERT as BUILD_BUG_ON_INVALID for !CONFIG_BTRFS_ASSERT builds which uses sizeof(cond) trick. Also mark full_page_sectors_uptodate() as __maybe_unused to suppress "unneeded declaration" warning (it's needed in compile time) Signed-off-by: Gladyshev Ilya Reviewed-by: David Sterba Signed-off-by: David Sterba commit dd57c78aec398717a2fa6488d87b1a6cd43c7d0d Author: Qu Wenruo Date: Fri Oct 24 15:08:34 2025 +1030 btrfs: introduce btrfs_bio::async_csum [ENHANCEMENT] Btrfs currently calculates data checksums then submits the bio. But after commit 968f19c5b1b7 ("btrfs: always fallback to buffered write if the inode requires checksum"), any writes with data checksum will fallback to buffered IO, meaning the content will not change during writeback. This means we're safe to calculate the data checksum and submit the bio in parallel, and only need the following new behavior: - Wait the csum generation to finish before calling btrfs_bio::end_io() Or this can lead to use-after-free for the csum generation worker. - Save the current bi_iter for csum_one_bio() As the submission part can advance btrfs_bio::bio.bi_iter, if not saved csum_one_bio() may got an empty bi_iter and do not generate any checksum. Unfortunately this means we have to increase the size of btrfs_bio for 16 bytes, but this is still acceptable. As usual, such new feature is hidden behind the experimental flag. [THEORETIC ANALYZE] Consider the following theoretic hardware performance, which should be more or less close to modern mainstream hardware: Memory bandwidth: 50GiB/s CRC32C bandwidth: 45GiB/s SSD bandwidth: 8GiB/s Then write bandwidth with data checksum before the patch is: 1 / ( 1 / 50 + 1 / 45 + 1 / 8) = 5.98 GiB/s After the patch, the bandwidth is: 1 / ( 1 / 50 + max( 1 / 45 + 1 / 8)) = 6.90 GiB/s The difference is 15.32% improvement. [REAL WORLD BENCHMARK] I'm using a Zen5 (HX 370) as the host, the VM has 4GiB memory, 10 vCPUs, the storage is backed by a PCIe gen3 x4 NVMe. The test is a direct IO write, with 1MiB block size, write 7GiB data into a btrfs mount with data checksum. Thus the direct write will fallback to buffered one: Vanilla Datasum: 1619.97 GiB/s Patched Datasum: 1792.26 GiB/s Diff +10.6 % In my case, the bottleneck is the storage, thus the improvement is not reaching the theoretic one, but still some observable improvement. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 39bc80216a3656d54d65cdda994f406aeb27c3da Author: Qu Wenruo Date: Fri Oct 24 08:32:41 2025 +1030 btrfs: relax btrfs_inode::ordered_tree_lock IRQ locking context We used IRQ version of spinlock for ordered_tree_lock, as btrfs_finish_ordered_extent() can be called in end_bbio_data_write() which was in IRQ context. However since we're moving all the btrfs_bio::end_io() calls into task context, there is no more need to support IRQ context thus we can relax to regular spin_lock()/spin_unlock() for btrfs_inode::ordered_tree_lock. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4bbdce84175db7ff0dfaa82e960c7488c6cb0bcf Author: Qu Wenruo Date: Thu Oct 23 18:32:34 2025 +1030 btrfs: remove btrfs_fs_info::compressed_write_workers The reason why end_bbio_compressed_write() queues a work into compressed_write_workers wq is for end_compressed_writeback() call, as it will grab all the involved folios and clear the writeback flags, which may sleep. However now we always run btrfs_bio::end_io() in task context, there is no need to queue the work anymore. Just remove btrfs_fs_info::compressed_write_workers and compressed_bio::write_end_work. There is a comment about the works queued into compressed_write_workers, now change to flush endio wq instead, which is responsible to handle all data endio functions. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4591c3ef751d861d7dd95ff4d2aadb1b5e95854e Author: Qu Wenruo Date: Thu Oct 23 15:19:16 2025 +1030 btrfs: make sure all btrfs_bio::end_io are called in task context [BACKGROUND] Btrfs has a lot of different bi_end_io functions, to handle different raid profiles. But they introduced a lot of different contexts for btrfs_bio::end_io() calls: - Simple read bios Run in task context, backed by either endio_meta_workers or endio_workers. - Simple write bios Run in IRQ context. - RAID56 write or rebuild bios Run in task context, backed by rmw_workers. - Mirrored write bios Run in irq context. This is inconsistent, and contributes to the number of workqueues used in btrfs. [ENHANCEMENT] Make all the above bios call their btrfs_bio::end_io() in task context, backed by either endio_meta_workers for metadata, or endio_workers for data. For simple write bios, merge the handling into simple_end_io_work(). For mirrored write bios, it will be a little more complex, since both the original or the cloned bios can run the final btrfs_bio::end_io(). Here we make sure the cloned bios are using btrfs_bioset, to reuse the end_io_work, and run both original and cloned work inside the workqueue. Add extra ASSERT()s to make sure btrfs_bio_end_io() is running in task context. This not only unifies the context for btrfs_bio::end_io() functions, but also opens a new door for further btrfs_bio::end_io() related cleanups. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 81cea6cd7041ebd42281e0517f856d88527d3326 Author: Qu Wenruo Date: Wed Oct 29 08:35:33 2025 +1030 btrfs: remove btrfs_bio::fs_info by extracting it from btrfs_bio::inode Currently there is only one caller which doesn't populate btrfs_bio::inode, and that's scrub. The idea is scrub doesn't want any automatic csum verification nor read-repair, as everything will be handled by scrub itself. However that behavior is really no different than metadata inode, thus we can reuse btree_inode as btrfs_bio::inode for scrub. The only exception is in btrfs_submit_chunk() where if a bbio is from scrub or data reloc inode, we set rst_search_commit_root to true. This means we still need a way to distinguish scrub from metadata, but that can be done by a new flag inside btrfs_bio. Now btrfs_bio::inode is a mandatory parameter, we can extract fs_info from that inode thus can remove btrfs_bio::fs_info to save 8 bytes from btrfs_bio structure. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c5667f9c8eb90293dfa4e52c65eb89fe39f5652d Author: Qu Wenruo Date: Tue Oct 28 10:06:36 2025 +1030 btrfs: headers cleanup to remove unnecessary local includes [BUG] When I tried to remove btrfs_bio::fs_info and use btrfs_bio::inode to grab the fs_info, the header "btrfs_inode.h" is needed to access the full btrfs_inode structure. Then btrfs will fail to compile. [CAUSE] There is a recursive including chain: "bio.h" -> "btrfs_inode.h" -> "extent_map.h" -> "compression.h" -> "bio.h" That recursive including is causing problems for btrfs. [ENHANCEMENT] To reduce the risk of recursive including: - Remove unnecessary local includes from btrfs headers Either the included header is pulled in by other headers, or is completely unnecessary. - Remove btrfs local includes if the header only requires a pointer In that case let the implementing C file to pull the required header. This is especially important for headers like "btrfs_inode.h" which pulls in a lot of other btrfs headers, thus it's a mine field of recursive including. - Remove unnecessary temporary structure definition Either if we have included the header defining the structure, or completely unused. Now including "btrfs_inode.h" inside "bio.h" is completely fine, although "btrfs_inode.h" still includes "extent_map.h", but that header only includes "fs.h", no more chain back to "bio.h". Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit afc04c8b1bb5552e6f7e05b4fe02ebc451fe66ff Author: Qu Wenruo Date: Mon Oct 27 18:58:47 2025 +1030 btrfs: replace BTRFS_MAX_BIO_SECTORS with BIO_MAX_VECS It's impossible to have a btrfs bio with more than BIO_MAX_VECS vectors anyway. And there is only one location utilizing that macro, just replace it with BIO_MAX_VECS. Both have the same value. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit c913649c1b0260a8a992773aa6a49189059f65a5 Author: Andy Shevchenko Date: Fri Oct 31 08:55:09 2025 +0100 btrfs: replace const_ilog2() with ilog2() const_ilog2() was a workaround of some sparse issue, which has never appeared in the C functions. Replace it with ilog2(). Signed-off-by: Andy Shevchenko Reviewed-by: David Sterba Signed-off-by: David Sterba commit 51070655e7d5749f9515e7a6ca1d5f49d1a76d81 Author: Johannes Thumshirn Date: Wed Oct 22 11:19:59 2025 +0200 btrfs: zoned: show statistics for zoned filesystems Provide statistics for zoned filesystems. These statistics include, the number of active block-groups, how many of them are reclaimable or unused, if the filesystem needs to be reclaimed, the currently assigned relocation and treelog block-groups if they're present and a list of active zones. Example: active block-groups: 4   reclaimable: 0   unused: 2   need reclaim: false data relocation block-group: 4294967296 active zones:   start: 1610612736, wp: 344064 used: 16384, reserved: 0, unusable: 327680   start: 1879048192, wp: 34963456 used: 131072, reserved: 0, unusable: 34832384   start: 4026531840, wp: 0 used: 0, reserved: 0, unusable: 0   start: 4294967296, wp: 0 used: 0, reserved: 0, unusable: 0 Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 252877a8701530fde861a4f27710c1e718e97caa Author: Miquel Sabaté Solà Date: Fri Oct 24 12:21:43 2025 +0200 btrfs: add ASSERTs on prealloc in qgroup functions The prealloc variable in these functions is always initialized to NULL. Whenever we allocate memory for it, if it fails then NULL is preserved, otherwise we delegate the ownership of the pointer to add_qgroup_rb() and set it right after to NULL. Since in any case the pointer ends up being NULL at the end of its usage, we can safely remove calls to kfree() for it, while adding an ASSERT as an extra check. Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7ab5d01d58a766807e137cbe8c90cb2e591e2f7d Author: Miquel Sabaté Solà Date: Fri Oct 24 12:21:42 2025 +0200 btrfs: apply the AUTO_K(V)FREE macros throughout the code Apply the AUTO_KFREE and AUTO_KVFREE macros wherever it makes sense. Since this macro is expected to improve code readability, it has been avoided in places where the lifetime of objects wasn't easy to follow and a cleanup attribute would've made things worse; or when the cleanup section of a function involved many other things and thus there was no readability impact anyways. This change has also not been applied in extremely short functions where readability was clearly not an issue. Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit d00cbce0a7d5de5fc31bf60abd59b44d36806b6e Author: Miquel Sabaté Solà Date: Fri Oct 24 12:21:41 2025 +0200 btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros These are two simple macros which ensure that a pointer is initialized to NULL and with the proper cleanup attribute for it. Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit 285c3ab28eed282af70aba02d7708dea245bfc4b Author: Miquel Sabaté Solà Date: Fri Oct 24 12:21:40 2025 +0200 btrfs: declare free_ipath() via DEFINE_FREE() The free_ipath() function was being used as a cleanup function everywhere. Declare it via DEFINE_FREE() so we can use this function with the __free() helper. The name has also been adjusted so it's closer to the type's name. Signed-off-by: Miquel Sabaté Solà Reviewed-by: David Sterba Signed-off-by: David Sterba commit 937f99c736135e530895eff028503cb057eb75f6 Author: Qu Wenruo Date: Sun Oct 19 11:15:28 2025 +1030 btrfs: scrub: cancel the run if there is a pending signal Unlike relocation, scrub never checks pending signals, and even for relocation is only explicitly checking for fatal signal (SIGKILL), not for regular ones. Thankfully relocation can still be interrupted by regular signals by the usage of wait_on_bit(), which is called with TASK_INTERRUPTIBLE. Do the same for scrub/dev-replace, so that regular signals can also cancel the scrub/replace run, and more importantly handle v2 cgroup freezing which is based on signal handling code inside the kernel, and freezing() function will not return true for v2 cgroup freezing. This will address the problem that systemd slice freezing will timeout on long running scrub/dev-replace. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4c9c7be47310c1dbd7b6d37d45986123f5b133b4 Author: Krishna Chaitanya Chundru Date: Sat Nov 1 09:29:37 2025 +0530 PCI: pwrctrl: Add power control driver for TC9563 TC9563 is a PCIe switch that has one upstream and three downstream ports. One of the downstream ports is connected to an integrated ethernet MAC endpoint. The other two downstream ports are available to connect to external devices. One Host can connect to TC9563 by upstream port. The TC9563 switch needs to be configured after powering on and before the PCIe link is up. The PCIe controller driver already enables link training at the host side even before this driver probe happens. Due to this, when driver enables power to the switch, it participates in link training and the PCIe link may come up before configuring the switch through I2C. Once the link is up the configuration done through I2C will not have any effect. To prevent the host from participating in link training, disable link training on the host side to ensure the link does not come up before the switch is configured via I2C. Based on DT property and type of the port, TC9563 is configured through I2C. Signed-off-by: Krishna Chaitanya Chundru [bhelgaas: squash fixes from https://lore.kernel.org/r/20251120065116.13647-2-mani@kernel.org https://lore.kernel.org/r/20251120065116.13647-3-mani@kernel.org] Signed-off-by: Bjorn Helgaas Reviewed-by: Bjorn Andersson Reviewed-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251101-tc9563-v9-6-de3429f7787a@oss.qualcomm.com commit c7b478504b2e5a8e428eac4c16925d52c8deb6bd Author: Qu Wenruo Date: Sun Oct 19 11:15:27 2025 +1030 btrfs: scrub: cancel the run if the process or fs is being frozen It's a known bug that btrfs scrub/dev-replace can prevent the system from suspending. There are at least two factors involved: - Holding super_block::s_writers for the whole scrub/dev-replace duration We hold that percpu rw semaphore through mnt_want_write_file() for the whole scrub/dev-replace duration. That will prevent the fs being frozen, which can be initiated by either the user (e.g. fsfreeze) or power management suspend/hibernate. - Stuck in the kernel space for a long time During suspend all user processes (and some kernel threads) will be frozen. But if a user space progress has fallen into kernel (scrub ioctl) and do not return for a long time, it will make process freezing time out. Unfortunately scrub/dev-replace is a long running ioctl, and it will prevent the btrfs process from returning to the user space, thus make PM suspend/hibernate time out. Address them in one go: - Introduce a new helper should_cancel_scrub() Which includes the existing cancel request and new fs/process freezing checks. Here we have to check both fs and process freezing for PM suspend/hibernate. PM can be configured to freeze filesystems before processes. (The current default is not to freeze filesystems, but planned to freeze the filesystems as the new default.) Checking only fs freezing will fail PM without fs freezing, as the process freezing will time out. Checking only process freezing will fail PM with fs freezing since the fs freezing happens before process freezing. And the return value will indicate the reason, -ECANCLED for the explicitly canceled runs, and -EINTR for fs freeze or PM reasons. - Cancel the run if should_cancel_scrub() is true Unfortunately canceling is the only feasible solution here, pausing is not possible as we will still stay in the kernel space thus will still prevent the process from being frozen. This will cause a user impacting behavior change: Dev-replace can be interrupted by PM, and there is no way to resume but start from the beginning again. This means dev-replace may fail on newer kernels, and end users will need extra steps like using systemd-inhibit to prevent suspend/hibernate, to get back the old uninterrupted behavior. This behavior change will need extra documentation updates and communication with projects involving scrub/dev-replace including btrfs-progs. Reviewed-by: Filipe Manana Link: https://lore.kernel.org/linux-btrfs/d93b2a2d-6ad9-4c49-809f-11d769a6f30a@app.fastmail.com/ Reported-by: Chris Murphy Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 02a7e90797be89ff4f6bdf1d1fbab26964b0c13a Author: Qu Wenruo Date: Sun Oct 19 11:15:26 2025 +1030 btrfs: scrub: add cancel/pause/removed bg checks for raid56 parity stripes For raid56, data and parity stripes are handled differently. For data stripes they are handled just like regular RAID1/RAID10 stripes, going through the regular scrub_simple_mirror(). But for parity stripes we have to read out all involved data stripes and do any needed verification and repair, then scrub the parity stripe. This process will take a much longer time than a regular stripe, but unlike scrub_simple_mirror(), we do not check if we should cancel/pause or the block group is already removed. Aligned the behavior of scrub_raid56_parity_stripe() to scrub_simple_mirror(), by adding: - Cancel check - Pause check - Removed block group check Since those checks are the same from the scrub_simple_mirror(), also update the comments of scrub_simple_mirror() by: - Remove too obvious comments We do not need extra comments on what we're checking, it's really too obvious. - Remove a stale comment about pausing Now the scrub is always queuing all involved stripes, and submit them in one go, there is no more submission part during pausing. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 38e03b820e00196018a7ad2523a3c45653b4927d Author: Filipe Manana Date: Wed Oct 22 19:15:00 2025 +0100 btrfs: annotate as unlikely fs aborted checks in space flushing code It's not expected to have the fs in an aborted state, so surround the abortion checks with unlikely to make it clear it's unexpected and to hint the compiler to generate better code. Also at maybe_fail_all_tickets() untangle all repeated checks for the abortion into a single if-then-else. This makes things more readable and makes the compiler generate less code. On x86_64 with gcc 14.2.0-19 from Debian I got the following object size differences. Before this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 2021606 179704 25088 2226398 21f8de fs/btrfs/btrfs.ko After this change: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 2021458 179704 25088 2226250 21f84a fs/btrfs/btrfs.ko Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f912f0af13aebfd5634ba68c1a077e9a59fca47a Author: Filipe Manana Date: Tue Oct 21 16:35:19 2025 +0100 btrfs: avoid space_info locking when checking if tickets are served When checking if a ticket was served, we take the space_info's spinlock. If the ticket was served (its ->bytes is 0) or had an error (its ->error it not 0) then we just unlock the space_info and return. This however causes contention on the space_info's spinlock, which is heavily used (space reservation, space flushing, allocating and deallocating an extent from a block group (btrfs_update_block_group()), etc). Instead of using the space_info's spinlock to check if a ticket was served, use a per ticket spinlock which isn't used by anyone other than the task that created the ticket (stack allocated) and the task that serves the ticket (a reclaim task or any task deallocating space that ends up at btrfs_try_granting_tickets()). After applying this patch and all previous patches from the same patchset (many attempt to reduce space_info critical sections), lockstat showed some improvements for a fs_mark test regarding the space_info's spinlock 'lock'. The lockstat results: Before patchset: con-bounces: 13733858 contentions: 15902322 waittime-total: 264902529.72 acq-bounces: 28161791 acquisitions: 38679282 After patchset: con-bounces: 12032220 contentions: 13598034 waittime-total: 221806127.28 acq-bounces: 24717947 acquisitions: 34103281 Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 50a51b53782af2f9eabe77b1f0d5a3b339ee4531 Author: Filipe Manana Date: Mon Oct 20 22:59:03 2025 +0100 btrfs: move ticket wakeup and finalization to remove_ticket() Instead of repeating the wakeup and setup of the ->bytes or ->error field, move those steps to remove_ticket() to avoid duplication. This is also needed for the next patch in the series, so that we avoid duplicating more logic. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cdf8a566eeef0c28a082dcdfb5d91e964029d6c3 Author: Filipe Manana Date: Thu Oct 23 13:24:22 2025 +0100 btrfs: add data_race() in btrfs_account_ro_block_groups_free_space() Surround the intentional empty list check with the data_race() annotation so that tools like KCSAN don't report a data race. The race is intentional as it's harmless and we want to avoid lock contention of the space_info since its lock is heavily used (space reservation, space flushing, extent allocation and deallocation, etc). Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8b6e1f5dcef97c8336a011c52384c0eb39691a43 Author: Filipe Manana Date: Mon Oct 20 16:08:50 2025 +0100 btrfs: remove pointless label and goto from unpin_extent_range() There's no need to have an 'out' label and jump there in case we can not find a block group. We can simply return directly since there are no resources to release, removing the need for the label and the 'ret' variable. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 36574363b75c6adf4642dc5f33b2a33870c8da3c Author: Filipe Manana Date: Mon Oct 20 15:53:01 2025 +0100 btrfs: reduce block group critical section in unpin_extent_range() There's no need to update the bytes_pinned, bytes_readonly and max_extent_size fields of the space_info while inside the critical section delimited by the block group's lock. So move that out of the block group's critical section, but sill inside the space_info's critical section. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4cb0abc1cf4f46f9b910ce19e79f326c1f16cecb Author: Filipe Manana Date: Mon Oct 20 13:52:11 2025 +0100 btrfs: change 'reserved' argument from pin_down_extent() to bool It's used as a boolean, so convert it from int type to bool type. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8dcb8e4b110d86aaae2c485622423b6f63a65408 Author: Filipe Manana Date: Mon Oct 20 13:48:33 2025 +0100 btrfs: remove 'reserved' argument from btrfs_pin_extent() All callers pass a value of 1 (true) to it, so remove it. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ec8022cd2656935bdf0be13110c1a27dfe154aaf Author: Filipe Manana Date: Mon Oct 20 13:40:56 2025 +0100 btrfs: use local variable for space_info in pin_down_extent() Instead of dereferencing the block group multiple times to access its space_info, use a local variable to shorten the code horizontal wise and make it easier to read. Also, while at it, also rename the block group argument from 'cache' to 'bg', as the cache name is confusing and it's from the old days where the block group structure was named as 'btrfs_block_group_cache'. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 585416766d2711d0bcc328f54bff392f5e865ffa Author: Filipe Manana Date: Mon Oct 20 13:37:32 2025 +0100 btrfs: reduce block group critical section in pin_down_extent() There's no need to update the bytes_reserved and bytes_may_use fields of the space_info while holding the block group's spinlock. We are only making the critical section longer than necessary. So move the space_info updates outside of the block group's critical section. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit c0d0b13d27f8cf9d5bf5adae52df8ec781fbb983 Author: Filipe Manana Date: Mon Oct 20 13:17:23 2025 +0100 btrfs: reduce block group critical section in do_trimming() There's no need to update the bytes_reserved and bytes_readonly fields of the space_info while holding the block group's spinlock. We are only making the critical section longer than necessary. So move the space_info updates outside of the block group's critical section. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a270cb420c06ae7b52f385e139577209c705e5e0 Author: Filipe Manana Date: Mon Oct 20 12:57:34 2025 +0100 btrfs: reduce block group critical section in btrfs_add_reserved_bytes() We are doing some things inside the block group's critical section that are relevant only to the space_info: updating the space_info counters bytes_reserved and bytes_may_use as well as trying to grant tickets (calling btrfs_try_granting_tickets()), and this later can take some time. So move all those updates to outside the block group's critical section and still inside the space_info's critical section. Like this we keep the block group's critical section only for block group updates and can help reduce contention on a block group's lock. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8b6fa164ab59f9e3f24e627fe09a0234783e7a8b Author: Filipe Manana Date: Mon Oct 20 12:47:26 2025 +0100 btrfs: reduce block group critical section in btrfs_free_reserved_bytes() There's no need to update the space_info fields (bytes_reserved, max_extent_size, bytes_readonly, bytes_zone_unusable) while holding the block group's spinlock. So move those updates to happen after we unlock the block group (and while holding the space_info locked of course), so that all we do under the block group's critical section is to update the block group itself. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f7a32dd2a616c333cff2d6fb7e3d854ec8d3ae41 Author: Filipe Manana Date: Mon Oct 20 12:39:52 2025 +0100 btrfs: reduce space_info critical section in btrfs_chunk_alloc() There's no need to update local variables while holding the space_info's spinlock, since the update isn't using anything from the space_info. So move these updates outside the critical section to shorten it. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b70c32f10a049a6e7c7c718d6ce69554af1e9b3c Author: Filipe Manana Date: Fri Oct 17 17:58:23 2025 +0100 btrfs: remove double underscore prefix from __reserve_bytes() The use of a double underscore prefix is discouraged and we have no justification at all for it all since there's no reserved_bytes() counter part. So remove the prefix. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 189db2510569c0f1cc7eefb583c48a36d373cae3 Author: Filipe Manana Date: Fri Oct 17 17:34:36 2025 +0100 btrfs: process ticket outside global reserve critical section In steal_from_global_rsv() there's no need to process the ticket inside the critical section of the global reserve. Move the ticket processing to happen after the critical section. This helps reduce contention on the global reserve's spinlock. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5ca7725ddfc5b7a1e5b87ba3cb489b3cd052faab Author: Filipe Manana Date: Fri Oct 17 17:30:38 2025 +0100 btrfs: assign booleans to global reserve's full field We have a couple places that are assigning 0 and 1 to the full field of the global reserve. This is harmless since 0 is converted to false and 1 converted to true, but for better readability, replace these with true and false since the field is of type bool. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f18a203a1b316f4cb2a2bd38ed79fc9182a1ddab Author: Filipe Manana Date: Fri Oct 17 17:26:58 2025 +0100 btrfs: assert space_info is locked in steal_from_global_rsv() The caller is supposed to have locked the space_info, so assert that. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit afbc047ab0db1470c1d5ff82788a8a94431dc7e9 Author: Filipe Manana Date: Fri Oct 17 17:14:11 2025 +0100 btrfs: avoid unnecessary reclaim calculation in priority_reclaim_metadata_space() If the given ticket was already served (its ->bytes is 0), then we wasted time calculating the metadata reclaim size. So calculate it only after we checked the ticket was not yet served. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4ddb077378aa84d0872fdfce85e7a82fd805ee86 Author: Filipe Manana Date: Fri Oct 17 17:07:22 2025 +0100 btrfs: shorten critical section in btrfs_preempt_reclaim_metadata_space() We are doing a lot of small calculations and assignments while holding the space_info's spinlock, which is a heavily used lock for space reservation and flushing. There's no point in holding the lock for so long when all we want is to call need_preemptive_reclaim() and get a consistent value for a couple of counters from the space_info. Instead, grab the counters into local variables, release the lock and then use the local variables. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8ab2b8bdbecaaf1b01adc5cfc13534a04917515d Author: Filipe Manana Date: Fri Oct 17 16:54:12 2025 +0100 btrfs: increment loop count outside critical section during metadata reclaim In btrfs_preempt_reclaim_metadata_space() there's no need to increment the local variable that tracks the number of iterations of the while loop while inside the critical section delimited by the space_info's spinlock. That spinlock is heavily used by space reservation and flushing code, so it's desirable to have its critical sections as short as possible. So move the loop count incremented outside the critical section. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 49f204be223b8bae5dd3d99f86c1ea649ce58aab Author: Filipe Manana Date: Fri Oct 17 16:32:47 2025 +0100 btrfs: bail out earlier from need_preemptive_reclaim() if we have tickets Instead of doing some calculations and then return false if it turns out we have queued tickets, check first if we have tickets and return false immediately if we have tickets, without wasting time on doing those computations. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4bd68e475300bc97b33a7f1ef9bd112970018789 Author: Andy Shevchenko Date: Mon Nov 24 21:39:59 2025 +0100 cpumask: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov (NVIDIA) commit 6f4779faa0c19c3a6ed0d52cb0f068ae891d7bb9 Author: Filipe Manana Date: Thu Oct 23 13:01:34 2025 +0100 btrfs: inline btrfs_space_info_used() The function is simple enough to be inlined and in fact doing it even reduces the object code. In x86_64 with gcc 14.2.0-19 from Debian the results were the following: Before this change $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1919410 161703 15592 2096705 1ffe41 fs/btrfs/btrfs.ko After this change $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1918991 161675 15592 2096258 1ffc82 fs/btrfs/btrfs.ko Also remove the ASSERT() that checks the space_info argument is not NULL, as it's odd to be there since it can never be NULL and in case that ever happens during development, a stack trace from a NULL pointer dereference will be obvious. It was originally added when btrfs_space_info_used() was introduced in commit 4136135b080f ("Btrfs: use helper to get used bytes of space_info"). Also add a lockdep assertion to check the space_info's lock is being held by the calling task. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0ce6300feca082a866a58fa1f4f9af47a450c41c Author: Filipe Manana Date: Fri Oct 17 16:10:04 2025 +0100 btrfs: avoid used space computation when reserving space In __reserve_bytes() we have 3 repeated calls to btrfs_space_info_used(), one early on as soon as take the space_info's spinlock, another one when we call btrfs_can_overcommit(), which calls btrfs_space_info_used() again, and a final one when we are reserving for a flush emergency. During all these calls we are holding the space_info's spinlock, which is heavily used by the space reservation and flushing code, so it's desirable to make the critical sections as short as possible. So make this more efficient by: 1) Instead of calling btrfs_can_overcommit() call the new variant can_overcommit() which takes the space_info's used space as an argument and pass the value we already computed and have in the 'used' variable; 2) Instead of calling btrfs_space_info_used() with its second argument as false when we are doing a flush emergency, decrement the space_info's bytes_may_use counter from the 'used' variable, as the difference between passing true or false as the second argument to btrfs_space_info_used() is whether or not to include the space_info's bytes_may_use counter in the computation. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit a5f8f64aa3377b470945252f926e2cbb5a931c11 Author: Filipe Manana Date: Fri Oct 17 15:47:59 2025 +0100 btrfs: avoid used space computation when trying to grant tickets In btrfs_try_granting_tickets(), we call btrfs_can_overcommit() and that calls btrfs_space_info_used(). But we already keep track, in the 'used' local variable, of the used space in the space_info, so we are just repeating the same computation and doing an extra function call while we are holding the space_info's spinlock, which is heavily used by the space reservation and flushing code. So add a local variant of btrfs_can_overcommit() that takes in the used space as an argument and therefore does not call btrfs_space_info_used(), and use it in btrfs_try_granting_tickets(). Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 563ef2befb55a75ba13b66d9714d50b848de8aae Author: Filipe Manana Date: Fri Oct 17 15:12:55 2025 +0100 btrfs: make btrfs_can_overcommit() return bool instead of int It's a boolean function, so switch its return type to bool. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 60532c2136ea205c5db0a622e1a51420c8530d0f Author: Filipe Manana Date: Fri Oct 17 14:57:27 2025 +0100 btrfs: avoid recomputing used space in btrfs_try_granting_tickets() In every iteration of the loop we call btrfs_space_info_used() which sums a bunch of fields from a space_info object. This implies doing a function call besides the sum, and we are holding the space_info's spinlock while we do this, so we want to keep the critical section as short as possible since that spinlock is used in all the code for space reservation and flushing (therefore it's heavily used). So call btrfs_try_granting_tickets() only once, before entering the loop, and then update it as we remove tickets. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 063171a4f0fa25fe47331b4fee3f705484f1c690 Author: Filipe Manana Date: Fri Oct 17 16:41:05 2025 +0100 btrfs: return real error when failing tickets in maybe_fail_all_tickets() In case we had a transaction abort we set a ticket's error to -EIO, but we have the real error that caused the transaction to be aborted returned by the macro BTRFS_FS_ERROR(). So use that real error instead of -EIO. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 988f693a46d83dc832005a1403ae0471eb1f8964 Author: Qu Wenruo Date: Tue Oct 21 14:21:48 2025 +1030 btrfs: subpage: simplify the PAGECACHE_TAG_TOWRITE handling In function btrfs_subpage_set_writeback() we need to keep the PAGECACHE_TAG_TOWRITE tag if the folio is still dirty. This is a needed quirk for support async extents, as a subpage range can almost suddenly go writeback, without touching other subpage ranges in the same folio. However we can simplify the handling by replace the open-coded tag clearing by passing the @keep_write flag depending on if the folio is dirty. Since we're holding the subpage lock already, no one is able to change the dirty/writeback flag, thus it's safe to check the folio dirty before calling __folio_start_writeback(). Reviewed-by: Filipe Manana Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit ca428e9b49c77b0bfc6ebbc8536ed854463b26e2 Author: Filipe Manana Date: Thu Oct 16 11:22:57 2025 +0100 btrfs: remove pointless data_end assignment in btrfs_extent_item() There's no point in setting 'data_end' to 'old_data' as we don't use it afterwards. So remove the redundant assignment which was never needed and added when the function was first added in commit 6567e837df07 ("Btrfs: early work to file_write in big extents"). Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit af1e800c0244a04f5eb0993745c23d974f262628 Author: Filipe Manana Date: Wed Oct 15 13:16:26 2025 +0100 btrfs: use the key format macros when printing keys Change all locations that print a key to use the new macros to print them in order to ensure a consistent style and avoid repetitive code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 95de4b097e25225d4deb5a33a4bfc27bb441f2d8 Author: Filipe Manana Date: Wed Oct 15 12:40:06 2025 +0100 btrfs: add macros to facilitate printing of keys There's a lot of places where we need to print a key, and it's tiresome to type the format specifier, typically "(%llu %u %llu)", as well as passing 3 arguments to a prink family function (key->objectid, key->type, key->offset). So add a couple macros for this just like we have for csum values in btrfs_inode.h (CSUM_FMT and CSUM_FMT_VALUE). This also ensures that we consistently print a key in the same format, always as "(%llu %llu %llu)", which is the most common format we use, but we have a few variations such as "[%llu %llu %llu]" for no good reason. This patch introduces the macros while the next one makes use of it. This is to ease backports of future patches, since then we can backport this patch which is simple and short and then backport those future patches, as the next patch in the series that makes use of these new macros is quite large and may have some dependencies. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 225e747ea57781198b44cb65373d076865c51a7a Author: Xuanqiang Luo Date: Wed Oct 15 15:05:21 2025 +0800 btrfs: remove redundant refcount check in btrfs_put_transaction() Eric Dumazet removed the redundant refcount check for sk_refcnt, I noticed a similar issue in btrfs_put_transaction(). refcount_dec_and_test() already checks for a zero refcount and complains, making the preceding WARN_ON redundant. This is a leftover from the atomic_t times. Signed-off-by: Xuanqiang Luo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a232ff90d14657c8637c6e94b606bb5d700a2ecb Author: Filipe Manana Date: Tue Oct 14 19:20:31 2025 +0100 btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 771af6ff72e0ed0eb8bf97e5ae4fa5094e0c5d1d Author: Filipe Manana Date: Tue Oct 14 19:18:17 2025 +0100 btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7fc35cc559cb64221a7fb1d2cf48cda8fd31fc9e Author: Sun YangKai Date: Sat Oct 4 22:31:09 2025 +0800 btrfs: more trivial BTRFS_PATH_AUTO_FREE conversions Convert more of the trivial pattern for the auto freeing of btrfs_path with goto -> return conversions where applicable. Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit a1359d06d7878db4ac28d9c5134bc9771e56833d Author: Filipe Manana Date: Mon Oct 13 18:27:16 2025 +0100 btrfs: remove fs_info argument from btrfs_reserve_metadata_bytes() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 30b87a23196c18df70851ea5b021dd8b8fe1ab8e Author: Filipe Manana Date: Mon Oct 13 18:23:27 2025 +0100 btrfs: remove fs_info argument from __reserve_bytes() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 09d0f285310ab46457a31ab942e9a1157dd70c38 Author: Filipe Manana Date: Mon Oct 13 18:19:46 2025 +0100 btrfs: fix parameter documentation for btrfs_reserve_data_bytes() We don't have a fs_info argument anymore since commit 5d39fda880be ("btrfs: pass btrfs_space_info to btrfs_reserve_data_bytes()"), it was replaced by a space_info argument. So update the documentation. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5495cbe920abb53ff126345b919529a32fa3979a Author: Filipe Manana Date: Mon Oct 13 18:14:39 2025 +0100 btrfs: remove fs_info argument from maybe_clamp_preempt() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e182eca6ed2db481f058fc82f9b9977fac466d62 Author: Filipe Manana Date: Mon Oct 13 18:13:49 2025 +0100 btrfs: remove fs_info argument from handle_reserve_ticket() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ddeac2a12b114a5def0a4c23961d2c0938556472 Author: Filipe Manana Date: Mon Oct 13 18:10:02 2025 +0100 btrfs: remove fs_info argument from steal_from_global_rsv() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d77b22de56776103511a50f92443ba83a70b2b32 Author: Filipe Manana Date: Mon Oct 13 18:09:16 2025 +0100 btrfs: remove fs_info argument from need_preemptive_reclaim() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4199eb2761344dac7a600ce893967d9314842252 Author: Filipe Manana Date: Mon Oct 13 18:01:55 2025 +0100 btrfs: remove fs_info argument from btrfs_calc_reclaim_metadata_size() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3ee124653641785acdbaf5b14fa14e8c8810c621 Author: Filipe Manana Date: Mon Oct 13 17:58:07 2025 +0100 btrfs: remove fs_info argument from shrink_delalloc() and flush_space() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e96059c9d7feb36daa4d2062b5a137a0f5c7de9c Author: Filipe Manana Date: Mon Oct 13 17:53:20 2025 +0100 btrfs: remove fs_info argument from btrfs_dump_space_info() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 78a77f4da4ba2162ab7f82246ff0eef0236cfe36 Author: Filipe Manana Date: Mon Oct 13 17:44:34 2025 +0100 btrfs: remove fs_info argument from btrfs_can_overcommit() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 302b4b69c4eeb7be755ef8a712350c8aa5d6f072 Author: Filipe Manana Date: Mon Oct 13 17:39:21 2025 +0100 btrfs: remove fs_info argument from calc_available_free_space() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1b809e305574ea59c0fa414cb129d6625d280944 Author: Filipe Manana Date: Mon Oct 13 14:02:41 2025 +0100 btrfs: remove fs_info argument from maybe_fail_all_tickets() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cf3ae29caf1657a8921396163f69fa36d1c8edac Author: Filipe Manana Date: Mon Oct 13 14:01:18 2025 +0100 btrfs: remove fs_info argument from priority_reclaim_metadata_space() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f63b36686b721a21f83e170c247d3910d5a8b800 Author: Filipe Manana Date: Mon Oct 13 13:58:55 2025 +0100 btrfs: remove fs_info argument from priority_reclaim_data_space() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e3df6408b13a75cf73e543e53453f28261874c6f Author: Filipe Manana Date: Mon Oct 13 13:57:09 2025 +0100 btrfs: remove fs_info argument from btrfs_try_granting_tickets() We don't need it since we can grab fs_info from the given space_info. So remove the fs_info argument. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit f1ae05b8eaf5b2049ef0f6bfff4376f793adeb83 Author: Filipe Manana Date: Sun Oct 12 17:48:27 2025 +0100 btrfs: avoid repeated computations in btrfs_mark_ordered_io_finished() We're computing a few values several times: 1) The current ordered extent's end offset inside the while loop, we have computed it and stored it in the 'entry_end' variable but then we compute it again later as the first argument to the min() macro; 2) The end file offset, open coded 3 times; 3) The current length (stored in variable 'len') computed 2 times, one inside an assertion and the other when assigning to the 'len' variable. So use existing variables and add new ones to prevent repeating these expressions and reduce the source code. We were also subtracting one from the result of min() macro call and then adding 1 back in the next line, making both operations pointless. So just remove the decrement and increment by 1. This also reduces very slightly the object code. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1916576 161679 15592 2093847 1ff317 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1916556 161679 15592 2093827 1ff303 fs/btrfs/btrfs.ko Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3b7c0c20b72003238ea3e17e60e357513be8edaf Author: Filipe Manana Date: Sun Oct 12 10:39:08 2025 +0100 btrfs: avoid multiple i_size rounding in btrfs_truncate() We have the inode locked so no one can concurrently change its i_size and neither do we change it ourselves, so there's no point in keep rounding it in the while loop and setting it up in the control structure. That only causes confusion when reading the code. So move all the i_size setup and rounding out of the loop and assert the inode is locked. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b917a94a4c085a307069790a0527f9492fc70700 Author: Filipe Manana Date: Sun Oct 12 10:26:40 2025 +0100 btrfs: consistently round up or down i_size in btrfs_truncate() We're using different ways to round down the i_size by sector size, one with a bitwise and with a negated mask and another with ALIGN_DOWN(), and using ALIGN() to round up. Replace these uses with the round_down() and round_up() macros which have have names that make it clear the direction of the rounding (unlike the ALIGN() macro) and getting rid of the bitwise and, negated mask and local variable for the mask. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 28fe58ce6a20aa674076645bcfc1be126a12ed4b Author: Filipe Manana Date: Sun Oct 12 10:43:02 2025 +0100 btrfs: add unlikely to unexpected error case in extent_writepages() We don't expect to hit errors and log the error message, so add the unlikely annotation to make it clear and to hint the compiler that it may reorganize code to be more efficient. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 74ca34f79e53657760c3b09abe1bd593b849ca8c Author: Filipe Manana Date: Fri Oct 10 17:17:10 2025 +0100 btrfs: split assertion into two in extent_writepage_io() If the assertion fails we don't get to know which of the two expressions failed and neither the values used in each expression. So split the assertion into two, each for a single expression, so that if any is triggered we see a line number reported in a stack trace that points to which expression failed. Also make the assertions use the verbose mode to print the values involved in the computations. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 46a23908598f4b8e61483f04ea9f471b2affc58a Author: Filipe Manana Date: Fri Oct 10 17:04:03 2025 +0100 btrfs: use variable for end offset in extent_writepage_io() Instead of repeating the expression "start + len" multiple times, store it in a variable and use it where needed. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 18de34daa7c62c830be533aace6b7c271e8e95cf Author: Filipe Manana Date: Fri Oct 10 16:50:02 2025 +0100 btrfs: truncate ordered extent when skipping writeback past i_size While running test case btrfs/192 from fstests with support for large folios (needs CONFIG_BTRFS_EXPERIMENTAL=y) I ended up getting very sporadic btrfs check failures reporting that csum items were missing. Looking into the issue it turned out that btrfs check searches for csum items of a file extent item with a range that spans beyond the i_size of a file and we don't have any, because the kernel's writeback code skips submitting bios for ranges beyond eof. It's not expected however to find a file extent item that crosses the rounded up (by the sector size) i_size value, but there is a short time window where we can end up with a transaction commit leaving this small inconsistency between the i_size and the last file extent item. Example btrfs check output when this happens: $ btrfs check /dev/sdc Opening filesystem to check... Checking filesystem on /dev/sdc UUID: 69642c61-5efb-4367-aa31-cdfd4067f713 [1/8] checking log skipped (none written) [2/8] checking root items [3/8] checking extents [4/8] checking free space tree [5/8] checking fs roots root 5 inode 332 errors 1000, some csum missing ERROR: errors found in fs roots (...) Looking at a tree dump of the fs tree (root 5) for inode 332 we have: $ btrfs inspect-internal dump-tree -t 5 /dev/sdc (...) item 28 key (332 INODE_ITEM 0) itemoff 2006 itemsize 160 generation 17 transid 19 size 610969 nbytes 86016 block group 0 mode 100666 links 1 uid 0 gid 0 rdev 0 sequence 11 flags 0x0(none) atime 1759851068.391327881 (2025-10-07 16:31:08) ctime 1759851068.410098267 (2025-10-07 16:31:08) mtime 1759851068.410098267 (2025-10-07 16:31:08) otime 1759851068.391327881 (2025-10-07 16:31:08) item 29 key (332 INODE_REF 340) itemoff 1993 itemsize 13 index 2 namelen 3 name: f1f item 30 key (332 EXTENT_DATA 589824) itemoff 1940 itemsize 53 generation 19 type 1 (regular) extent data disk byte 21745664 nr 65536 extent data offset 0 nr 65536 ram 65536 extent compression 0 (none) (...) We can see that the file extent item for file offset 589824 has a length of 64K and its number of bytes is 64K. Looking at the inode item we see that its i_size is 610969 bytes which falls within the range of that file extent item [589824, 655360[. Looking into the csum tree: $ btrfs inspect-internal dump-tree /dev/sdc (...) item 15 key (EXTENT_CSUM EXTENT_CSUM 21565440) itemoff 991 itemsize 200 range start 21565440 end 21770240 length 204800 item 16 key (EXTENT_CSUM EXTENT_CSUM 1104576512) itemoff 983 itemsize 8 range start 1104576512 end 1104584704 length 8192 (..) We see that the csum item number 15 covers the first 24K of the file extent item - it ends at offset 21770240 and the extent's disk_bytenr is 21745664, so we have: 21770240 - 21745664 = 24K We see that the next csum item (number 16) is completely outside the range, so the remaining 40K of the extent doesn't have csum items in the tree. If we round up the i_size to the sector size, we get: round_up(610969, 4096) = 614400 If we subtract from that the file offset for the extent item we get: 614400 - 589824 = 24K So the missing 40K corresponds to the end of the file extent item's range minus the rounded up i_size: 655360 - 614400 = 40K Normally we don't expect a file extent item to span over the rounded up i_size of an inode, since when truncating, doing hole punching and other operations that trim a file extent item, the number of bytes is adjusted. There is however a short time window where the kernel can end up, temporarily,persisting an inode with an i_size that falls in the middle of the last file extent item and the file extent item was not yet trimmed (its number of bytes reduced so that it doesn't cross i_size rounded up by the sector size). The steps (in the kernel) that lead to such scenario are the following: 1) We have inode I as an empty file, no allocated extents, i_size is 0; 2) A buffered write is done for file range [589824, 655360[ (length of 64K) and the i_size is updated to 655360. Note that we got a single large folio for the range (64K); 3) A truncate operation starts that reduces the inode's i_size down to 610969 bytes. The truncate sets the inode's new i_size at btrfs_setsize() by calling truncate_setsize() and before calling btrfs_truncate(); 4) At btrfs_truncate() we trigger writeback for the range starting at 610304 (which is the new i_size rounded down to the sector size) and ending at (u64)-1; 5) During the writeback, at extent_write_cache_pages(), we get from the call to filemap_get_folios_tag(), the 64K folio that starts at file offset 589824 since it contains the start offset of the writeback range (610304); 6) At writepage_delalloc() we find the whole range of the folio is dirty and therefore we run delalloc for that 64K range ([589824, 655360[), reserving a 64K extent, creating an ordered extent, etc; 7) At extent_writepage_io() we submit IO only for subrange [589824, 614400[ because the inode's i_size is 610969 bytes (rounded up by sector size is 614400). There, in the while loop we intentionally skip IO beyond i_size to avoid any unnecessay work and just call btrfs_mark_ordered_io_finished() for the range [614400, 655360[ (which has a 40K length); 8) Once the IO finishes we finish the ordered extent by ending up at btrfs_finish_one_ordered(), join transaction N, insert a file extent item in the inode's subvolume tree for file offset 589824 with a number of bytes of 64K, and update the inode's delayed inode item or directly the inode item with a call to btrfs_update_inode_fallback(), which results in storing the new i_size of 610969 bytes; 9) Transaction N is committed either by the transaction kthread or some other task committed it (in response to a sync or fsync for example). At this point we have inode I persisted with an i_size of 610969 bytes and file extent item that starts at file offset 589824 and has a number of bytes of 64K, ending at an offset of 655360 which is beyond the i_size rounded up to the sector size (614400). --> So after a crash or power failure here, the btrfs check program reports that error about missing checksum items for this inode, as it tries to lookup for checksums covering the whole range of the extent; 10) Only after transaction N is committed that at btrfs_truncate() the call to btrfs_start_transaction() starts a new transaction, N + 1, instead of joining transaction N. And it's with transaction N + 1 that it calls btrfs_truncate_inode_items() which updates the file extent item at file offset 589824 to reduce its number of bytes from 64K down to 24K, so that the file extent item's range ends at the i_size rounded up to the sector size (614400 bytes). Fix this by truncating the ordered extent at extent_writepage_io() when we skip writeback because the current offset in the folio is beyond i_size. This ensures we don't ever persist a file extent item with a number of bytes beyond the rounded up (by sector size) value of the i_size. Reviewed-by: Qu Wenruo Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 803e115657dd145fcf2b6481c6d224ecc270ed0e Author: Qu Wenruo Date: Mon Oct 13 10:22:05 2025 +1030 btrfs: implement remove_bdev and shutdown super operation callbacks For the ->remove_bdev() callback, btrfs will: - Mark the target device as missing - Go degraded if the fs can afford it - Return error other wise Thus falls back to the shutdown callback For the ->shutdown callback, btrfs will: - Set the SHUTDOWN flag Which will reject all new incoming operations, and make all writeback to fail. The behavior is the same as the NOLOGFLUSH behavior. To support the lookup from bdev to a btrfs_device, btrfs_dev_lookup_args is enhanced to have a new @devt member. If set, we should be able to use that @devt member to uniquely locating a btrfs device. I know the shutdown can be a little overkilled, if one has a RAID1 metadata and RAID0 data, in that case one can still read data with 50% chance to got some good data. But a filesystem returning -EIO for half of the time is not really considered usable. Further it can also be as bad as the only device went missing for a single device btrfs. So here we go safe other than sorry when handling missing device. And the remove_bdev callback will be hidden behind experimental features for now, the reasons are: - There are not enough btrfs specific bdev removal test cases The existing test cases are all removing the only device, thus only exercises the ->shutdown() behavior. - Not yet determined what's the expected behavior Although the current auto-degrade behavior is no worse than the old behavior, it may not always be what the end users want. Before there is a concrete interface, better hide the new feature from end users. Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Tested-by: Anand Jain Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 6b1ac78dd0f29fe66421c460c12ec15e45af38c3 Author: Qu Wenruo Date: Mon Oct 13 10:22:04 2025 +1030 btrfs: implement shutdown ioctl The shutdown ioctl should follow the XFS one, which use magic number 'X', and ioctl number 125, with a uint32 as flags. For now btrfs don't distinguish DEFAULT and LOGFLUSH flags (just like f2fs), both will freeze the fs first (implies committing the current transaction), setting the SHUTDOWN flag and finally thaw the fs. For NOLOGFLUSH flag, the freeze/thaw part is skipped thus the current transaction is aborted. The new shutdown ioctl is hidden behind experimental features for more testing. Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Tested-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9b2839451dfc1eccd48972c675bb0e8e9d050d56 Author: Qu Wenruo Date: Mon Oct 13 10:22:03 2025 +1030 btrfs: introduce a new shutdown state A new fs state EMERGENCY_SHUTDOWN is introduced, which is btrfs' equivalent of XFS_IOC_GOINGDOWN or EXT4_IOC_SHUTDOWN, after entering emergency shutdown state, all operations will return errors (-EIO), and can not be bring back to normal state until unmouont. The new state will reject the following file operations: - read_iter() - write_iter() - mmap() - open() - remap_file_range() - uring_cmd() - splice_read() This requires a small wrapper to do the extra shutdown check, then call the regular filemap_splice_read() function This should reject most of the file operations on a shutdown btrfs. And for the existing dirty folios, extra shutdown checks are introduced to the following functions: - run_delalloc_nocow() - run_delalloc_compressed() - cow_file_range() So that dirty ranges will still be properly cleaned without being submitted. Finally the shutdown state will also set the fs error, so that no new transaction will be committed, protecting the metadata from any possible further corruption. And when the fs entered shutdown mode for the first time, a critical level kernel message will show up to indicate the incident. That message will be important for end users as rejected delalloc ranges will output error messages, hopefully that shutdown message and the fact that all fs operations are returning error will prevent end users from getting too confused about the delalloc error messages. Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Tested-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7454048db27d685a155aaf4ea03bb9ad0d086bb9 Author: Kees Cook Date: Fri Nov 21 10:43:48 2025 -0800 kbuild: Enable GCC diagnostic context for value-tracking warnings Enable GCC 16's coming "-fdiagnostics-show-context=N" option[1] to provide enhanced diagnostic information for value-tracking warnings, which displays the control flow chain leading to the diagnostic. This covers our existing use of -Wrestrict and -Wstringop-overread, and gets us closer to enabling -Warray-bounds, -Wstringop-overflow, and -Wstringop-truncation, so we can track the rationale for the warning, letting us more quickly identify actual issues vs what have looked in the past like false positives. Fixes based on this work have already been landing, e.g.: 4a6f18f28627 ("net/mlx4_core: Avoid impossible mlx4_db_alloc() order value") 8a39f1c870e9 ("ovl: Check for NULL d_inode() in ovl_dentry_upper()") e5f7e4e0a445 ("drm/amdgpu/atom: Work around vbios NULL offset false positive") The context depth ("=N") provides the immediate decision path that led to the problematic code location, showing conditional checks and branch decisions that caused the warning. This will help us understand why GCC's value-tracking analysis triggered the warning and makes it easier to determine whether warnings are legitimate issues or false positives. For example, an array bounds warning will now show the conditional statements (like "if (i >= 4)") that established the out-of-bounds access range, directly connecting the control flow to the warning location. This is particularly valuable when GCC's interprocedural analysis can generate warnings that are difficult to understand without seeing the inferred control flow. While my testing has shown that "=1" reports enough for finding the origin of most bounds issues, I have used "=2" here just to be conservative. Build time measurements with this option off, =1, and =2 are all with noise of each other, so there seems to be no harm in "turning it up". If we need to, we can make this value configurable in the future. Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=6faa3cfe60ff9769d1bebfffdd2c7325217d7389 [1] Reviewed-by: Miguel Ojeda Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251121184342.it.626-kees@kernel.org Signed-off-by: Kees Cook commit 645b9ad2dc6b2d6d31e2944bd7f680f3f9d827ea Author: Kriish Sharma Date: Tue Nov 18 18:48:28 2025 +0000 string: Add missing kernel-doc return descriptions While running kernel-doc validation on linux-next, warnings were emitted for functions in include/linux/string.h due to missing return value documentation: Warning: include/linux/string.h:375 No description found for return value of 'kbasename' Warning: include/linux/string.h:560 No description found for return value of 'strstarts' This patch adds the missing return value descriptions for both functions and clears the related kernel-doc warnings. Signed-off-by: Kriish Sharma Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251118184828.2621595-1-kriish.sharma2006@gmail.com Signed-off-by: Kees Cook commit fbcc2150aa40655451c28b1a8d750f8468f3b092 Author: Kees Cook Date: Fri Apr 25 23:15:27 2025 -0700 media: iris: Cast iris_hfi_gen2_get_instance() allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct iris_inst *", but the returned type is "struct iris_inst_hfi_gen2 *". The allocation is intentionally larger as the first member of struct iris_inst_hfi_gen2 is struct iris_inst, so this is by design. Cast the allocation type to match the assignment. Link: https://patch.msgid.link/20250426061526.work.106-kees@kernel.org Signed-off-by: Kees Cook commit 961c989c5fbbd9146d5cb134d3f663c20708b2be Author: Kees Cook Date: Fri Apr 25 23:13:26 2025 -0700 drm/plane: Remove const qualifier from plane->modifiers allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "uint64_t *", but the returned type, while matching, will be const qualified. As there is no general way to remove const qualifiers, adjust the allocation type to match the assignment. Link: https://patch.msgid.link/20250426061325.work.665-kees@kernel.org Signed-off-by: Kees Cook commit 5146f56deeab2d44c41007f20137345809dcf6d7 Author: Kees Cook Date: Fri Apr 25 23:10:16 2025 -0700 comedi: Adjust range_table_list allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The returned type is "struct comedi_lrange **", but the assigned type, while technically matching, is const qualified. Since there is no general way to remove const qualifiers, switch the returned type to match the assign type. No change in allocation size results. Link: https://patch.msgid.link/20250426061015.work.971-kees@kernel.org Signed-off-by: Kees Cook commit 892794c02532b78c18bab5647675a230362cab9a Author: Filipe Manana Date: Tue Oct 7 11:14:37 2025 +0100 btrfs: use end_pos variable where needed in btrfs_dirty_folio() We have a couple places doing the computation "pos + write_bytes" when we already have it in the local variable "end_pos". Change then to use the variable instead and make source code smaller. Also make the variable const since it's not supposed to change. This also has a very slight reduction in the module size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1915990 161647 15592 2093229 1ff0ad fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1915974 161647 15592 2093213 1ff09d fs/btrfs/btrfs.ko Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 38e818718c5e04961eea0fa8feff3f100ce40408 Author: Boris Burkov Date: Wed Oct 1 17:20:22 2025 -0700 btrfs: fix racy bitfield write in btrfs_clear_space_info_full() From the memory-barriers.txt document regarding memory barrier ordering guarantees: (*) These guarantees do not apply to bitfields, because compilers often generate code to modify these using non-atomic read-modify-write sequences. Do not attempt to use bitfields to synchronize parallel algorithms. (*) Even in cases where bitfields are protected by locks, all fields in a given bitfield must be protected by one lock. If two fields in a given bitfield are protected by different locks, the compiler's non-atomic read-modify-write sequences can cause an update to one field to corrupt the value of an adjacent field. btrfs_space_info has a bitfield sharing an underlying word consisting of the fields full, chunk_alloc, and flush: struct btrfs_space_info { struct btrfs_fs_info * fs_info; /* 0 8 */ struct btrfs_space_info * parent; /* 8 8 */ ... int clamp; /* 172 4 */ unsigned int full:1; /* 176: 0 4 */ unsigned int chunk_alloc:1; /* 176: 1 4 */ unsigned int flush:1; /* 176: 2 4 */ ... Therefore, to be safe from parallel read-modify-writes losing a write to one of the bitfield members protected by a lock, all writes to all the bitfields must use the lock. They almost universally do, except for btrfs_clear_space_info_full() which iterates over the space_infos and writes out found->full = 0 without a lock. Imagine that we have one thread completing a transaction in which we finished deleting a block_group and are thus calling btrfs_clear_space_info_full() while simultaneously the data reclaim ticket infrastructure is running do_async_reclaim_data_space(): T1 T2 btrfs_commit_transaction btrfs_clear_space_info_full data_sinfo->full = 0 READ: full:0, chunk_alloc:0, flush:1 do_async_reclaim_data_space(data_sinfo) spin_lock(&space_info->lock); if(list_empty(tickets)) space_info->flush = 0; READ: full: 0, chunk_alloc:0, flush:1 MOD/WRITE: full: 0, chunk_alloc:0, flush:0 spin_unlock(&space_info->lock); return; MOD/WRITE: full:0, chunk_alloc:0, flush:1 and now data_sinfo->flush is 1 but the reclaim worker has exited. This breaks the invariant that flush is 0 iff there is no work queued or running. Once this invariant is violated, future allocations that go into __reserve_bytes() will add tickets to space_info->tickets but will see space_info->flush is set to 1 and not queue the work. After this, they will block forever on the resulting ticket, as it is now impossible to kick the worker again. I also confirmed by looking at the assembly of the affected kernel that it is doing RMW operations. For example, to set the flush (3rd) bit to 0, the assembly is: andb $0xfb,0x60(%rbx) and similarly for setting the full (1st) bit to 0: andb $0xfe,-0x20(%rax) So I think this is really a bug on practical systems. I have observed a number of systems in this exact state, but am currently unable to reproduce it. Rather than leaving this footgun lying around for the future, take advantage of the fact that there is room in the struct anyway, and that it is already quite large and simply change the three bitfield members to bools. This avoids writes to space_info->full having any effect on writes to space_info->flush, regardless of locking. Fixes: 957780eb2788 ("Btrfs: introduce ticketed enospc infrastructure") Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 745483ea988b4abba63a881931675268d57b0f36 Author: Rajeev Tapadia Date: Fri Oct 3 19:00:02 2025 +0530 btrfs: fix comment in alloc_bitmap() and drop stale TODO All callers of alloc_bitmap() hold a transaction handle, so GFP_NOFS is needed to avoid deadlocks on recursion. Update the comment and drop the stale TODO. Reviewed-by: Filipe Manana Signed-off-by: Rajeev Tapadia Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 725e46298876a2cc1f1c3fb22ba69d29102c3ddf Author: Miquel Sabaté Solà Date: Wed Oct 1 20:05:03 2025 +0200 btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head(). This could happen if the record was reported to already exist in the btrfs_qgroup_trace_extent_nolock() call, but then there was an error later on add_delayed_ref_head(). In this case, since add_delayed_ref_head() returned an error, the caller went to free the record. Since add_delayed_ref_head() couldn't set this kfree'd pointer to NULL, then kfree() would have acted on a non-NULL 'record' object which was pointing to memory already freed by the callee. The problem comes from the fact that the responsibility to kfree the object is on both the caller and the callee at the same time. Hence, the fix for this is to shift the ownership of the 'qrecord' object out of the add_delayed_ref_head(). That is, we will never attempt to kfree() the given object inside of this function, and will expect the caller to act on the 'qrecord' object on its own. The only exception where the 'qrecord' object cannot be kfree'd is if it was inserted into the tracing logic, for which we already have the 'qrecord_inserted_ret' boolean to account for this. Hence, the caller has to kfree the object only if add_delayed_ref_head() reports not to have inserted it on the tracing logic. As a side-effect of the above, we must guarantee that 'qrecord_inserted_ret' is properly initialized at the start of the function, not at the end, and then set when an actual insert happens. This way we avoid 'qrecord_inserted_ret' having an invalid value on an early exit. The documentation from the add_delayed_ref_head() has also been updated to reflect on the exact ownership of the 'qrecord' object. Fixes: 6ef8fbce0104 ("btrfs: fix missing error handling when adding delayed ref with qgroups enabled") Reviewed-by: Filipe Manana Signed-off-by: Miquel Sabaté Solà Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 2215e6b4034a4a850b4f10ada09ac9ceac38817f Author: David Sterba Date: Mon Sep 29 14:41:15 2025 +0200 btrfs: subpage: rename macro variables to avoid shadowing When compiling with -Wshadow there are warnings in the subpage helper macros that are used in functions like btrfs_subpage_dump_bitmap() or btrfs_subpage_clear_and_test_dirty() that also use 'bfs' (for struct btrfs_folio_state) or blocks_per_folio. Add '__' to the macro variables and unify naming in all subpage macros. Signed-off-by: David Sterba commit 2346b966c66a7b9cfef948939ae0526bebb4bef7 Author: Mehdi Ben Hadj Khelifa Date: Tue Sep 30 11:03:44 2025 +0100 btrfs: refactor allocation size calculation in alloc_btrfs_io_context() Use struct_size() to replace the open-coded calculation, remove the comment as use of the helper is self explanatory. Reviewed-by: Qu Wenruo Signed-off-by: Mehdi Ben Hadj Khelifa Reviewed-by: David Sterba Signed-off-by: David Sterba commit aebe2bb0b861795cd832473b7257c6cc1cd086d0 Author: David Sterba Date: Fri Sep 26 11:47:30 2025 +0200 btrfs: fix trivial -Wshadow warnings When compiling with -Wshadow (also in 'make W=2' build) there are several reports of shadowed variables that seem to be harmless: - btrfs_do_encoded_write() - we can reuse 'ordered', there's no previous value that would need to be preserved - scrub_write_endio() - we need a standalone 'i' for bio iteration - scrub_stripe() - duplicate ret2 for errors that must not overwrite 'ret' - btrfs_subpage_set_writeback() - 'flags' is used for another irqsave lock but is not overwritten when reused for xarray due to scoping, but for clarity let's rename it - process_dir_items_leaf() - duplicate 'ret', used only for immediate checks Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 9594783e4b4901cbc28ff940eff7e2554a4f7801 Author: David Sterba Date: Fri Sep 26 08:32:56 2025 +0200 btrfs: print-tree: use string format for key names There's a warning when -Wformat=2 is used: fs/btrfs/print-tree.c: In function ‘key_type_string’: fs/btrfs/print-tree.c:424:17: warning: format not a string literal and no format arguments [-Wformat-nonliteral] 424 | scnprintf(buf, buf_size, key_to_str[key->type]); We're printing fixed strings from a table so there's no problem but let's fix the warning so we could enable the warning in fs/btrfs/. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 4e700ac62ac12ffe8579680e6987b27066339d71 Author: Qu Wenruo Date: Thu Sep 25 19:23:22 2025 +0930 btrfs: remove unnecessary NULL fs_info check from find_lock_delalloc_range() [STATIC CHECK REPORT] Smatch is reporting that find_lock_delalloc_range() used to do a null pointer check before accessing fs_info, but now we're accessing it for sectorsize unconditionally. [FALSE ALERT] This is a false alert, the existing null pointer check is introduced in commit f7b12a62f008 ("btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size"), but way before that, commit 7c0260ee098d ("btrfs: tests, require fs_info for root") is already forcing every btrfs_root to have a correct fs_info pointer. So there is no way that btrfs_root::fs_info is NULL. [FIX] Just remove the unnecessary NULL pointer checker. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: f7b12a62f008 ("btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size") Closes: https://lore.kernel.org/r/202509250925.4L4JQTtn-lkp@intel.com/ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 69e293d28a95ef2652014411038d91867e16e757 Author: Filipe Manana Date: Wed Sep 24 17:10:27 2025 +0100 btrfs: use single return value variable in btrfs_relocate_block_group() We are using 'ret' and 'err' variables to track return values and errors, which is pattern that is error prone and we had quite some bugs due to this pattern in the past. Simplify this and use a single variable, named 'ret', to track errors and the return value. Also rename the variable 'rw' to 'bg_is_ro' which is more meaningful name, and change its type from int to bool. Reviewed-by: Boris Burkov Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e2378e61153afd2afb671ec66a47f34280c20dad Author: David Laight Date: Wed Nov 19 22:41:21 2025 +0000 PCI: Use max() instead of max_t() to ease static analysis In this code: used_buses = max_t(unsigned int, available_buses, pci_hotplug_bus_size - 1); max_t() casts the 'unsigned long' pci_hotplug_bus_size (either 32 or 64 bits) to 'unsigned int' (32 bits) result type, so there's a potential of discarding significant bits. Instead, use max(a, b), which casts 'unsigned int' to 'unsigned long' and cannot discard significant bits. In this case, pci_hotplug_bus_size is constrained to <= 0xff by pci_setup() so this doesn't fix a bug, but it makes static analysis easier. Signed-off-by: David Laight [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251119224140.8616-26-david.laight.linux@gmail.com commit 5accdaec526ed8708ec64cf027a5e75aa83eb504 Author: James Clark Date: Tue Nov 11 11:37:59 2025 +0000 perf docs: arm-spe: Document new SPE filtering features FEAT_SPE_EFT and FEAT_SPE_FDS etc have new user facing format attributes so document them. Also document existing 'event_filter' bits that were missing from the doc and the fact that latency values are stored in the weight field. Reviewed-by: Leo Yan Tested-by: Leo Yan Reviewed-by: Ian Rogers Signed-off-by: James Clark Acked-by: Peter Zijlstra (Intel) Signed-off-by: Namhyung Kim commit 14a84c708efd75b3a2c107b1438354361c7dd75f Author: James Clark Date: Tue Nov 11 11:37:58 2025 +0000 perf tools: Add support for perf_event_attr::config4 perf_event_attr has gained a new field, config4, so add support for it extending the existing configN support. Reviewed-by: Leo Yan Reviewed-by: Ian Rogers Tested-by: Leo Yan Signed-off-by: James Clark Acked-by: Peter Zijlstra (Intel) Signed-off-by: Namhyung Kim commit 80cdf208117a36de82a30d210b3b8df0f193e75b Author: James Clark Date: Tue Nov 11 11:37:57 2025 +0000 tools headers UAPI: Sync linux/perf_event.h with the kernel sources To pickup config4 changes. Tested-by: Leo Yan Reviewed-by: Ian Rogers Signed-off-by: James Clark Acked-by: Peter Zijlstra (Intel) Signed-off-by: Namhyung Kim commit 8974573ba45493af6120093cdf88ce5511aff935 Author: Malaya Kumar Rout Date: Thu Nov 20 22:29:58 2025 +0530 ACPI: tools: pfrut: fix memory leak and resource leak in pfrut.c Static analysis found an issue in pfrut.c cppcheck output before this patch: tools/power/acpi/tools/pfrut/pfrut.c:225:3: error: Resource leak: fd_update [resourceLeak] tools/power/acpi/tools/pfrut/pfrut.c:269:3: error: Resource leak: fd_update [resourceLeak] tools/power/acpi/tools/pfrut/pfrut.c:269:3: error: Resource leak: fd_update_log [resourceLeak] tools/power/acpi/tools/pfrut/pfrut.c:365:4: error: Memory leak: addr_map_capsule [memleak] tools/power/acpi/tools/pfrut/pfrut.c:424:4: error: Memory leak: log_buf [memleak] cppcheck output after this patch: No resource leaks found Fix by closing file descriptors and freeing allocated memory. Signed-off-by: Malaya Kumar Rout Link: https://patch.msgid.link/20251120170001.251968-1-mrout@redhat.com Signed-off-by: Rafael J. Wysocki commit fe598ab37e472514e769d3eeb0456cddb3b8ba9f Author: Gui-Dong Han Date: Tue Nov 25 00:59:00 2025 +0800 hwmon: (vt8231) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used with shared driver data, this leads to Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially causing divide-by-zero errors. Convert the macro to a static function to ensure arguments are evaluated only once. Additionally, in fan_div_store, move the reading of the old register value and the calculation of the minimum limit inside the update lock. This ensures that the read-modify-write sequence operates on consistent data, preventing race conditions during fan divider updates. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251124165900.4713-1-hanguidong02@gmail.com [groeck: Dropped unnecessary line split] Signed-off-by: Guenter Roeck commit c964081d602f96f8811f99a938e5f8a164060bd7 Author: David Laight Date: Wed Nov 19 22:41:09 2025 +0000 ACPI: property: use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight [ rjw: Subject adjustment ] Link: https://patch.msgid.link/20251119224140.8616-14-david.laight.linux@gmail.com Signed-off-by: Rafael J. Wysocki commit 4faaa77d6b32347ea6af74d5fd2f34c3922aeee6 Author: Gui-Dong Han Date: Tue Nov 25 00:55:08 2025 +0800 hwmon: (emc2103) Add locking to avoid TOCTOU The functions fan1_input_show and fan1_target_show check shared data for zero before using it as a divisor. These accesses are currently lockless. If the data changes to zero between the check and the division, it causes a divide-by-zero error. Explicitly acquire the update lock around these checks and calculations to ensure the data remains stable, preventing Time-of-Check to Time-of-Use (TOCTOU) race conditions. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251124165508.4667-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 15bfdadd617ec5363802f7cb6a0385b6569f374e Author: Rafael J. Wysocki Date: Fri Nov 21 21:11:16 2025 +0100 cpuidle: governors: teo: Add missing space to the description There is a missing space in the governor description comment, so add it. No functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5059034.31r3eYUQgx@rafael.j.wysocki commit c03aef8833597f184cc3439d2d336596f63bd709 Author: Rafael J. Wysocki Date: Fri Nov 21 21:09:42 2025 +0100 PM: hibernate: Extra cleanup of comments in swap handling code Continue recent cleanups of comments in the swap handling code. Unify the use of white space in the comments, drop some unuseful comments outside function bodies, and move some other comments into function bodies. No functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5943864.DvuYhMxLoT@rafael.j.wysocki commit c0a67900dc129825c48d3638480297aa00f39c00 Author: Alexandre Chartre Date: Fri Nov 21 10:53:40 2025 +0100 objtool: Trim trailing NOPs in alternative When disassembling alternatives replace trailing NOPs with a single indication of the number of bytes covered with NOPs. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-31-alexandre.chartre@oracle.com commit aff95e0d4e277c53fa274f4a5b6854849f3fc84d Author: Alexandre Chartre Date: Fri Nov 21 10:53:39 2025 +0100 objtool: Add wide output for disassembly Add the --wide option to provide a wide output when disassembling. With this option, the disassembly of alternatives is displayed side-by-side instead of one above the other. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-30-alexandre.chartre@oracle.com commit 07d70b271a6fc4f546b153081f3685931561be7b Author: Alexandre Chartre Date: Fri Nov 21 10:53:38 2025 +0100 objtool: Compact output for alternatives with one instruction When disassembling, if an instruction has alternatives which are all made of a single instruction then print each alternative on a single line (instruction + description) so that the output is more compact. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-29-alexandre.chartre@oracle.com commit 56967b9a772298ad276858ddab5a655b1d167623 Author: Alexandre Chartre Date: Fri Nov 21 10:53:37 2025 +0100 objtool: Improve naming of group alternatives Improve the naming of group alternatives by showing the feature name and flags used by the alternative. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-28-alexandre.chartre@oracle.com commit 8308fd001927f5bdc37a9c9f9c413baec3fb7bbe Author: Alexandre Chartre Date: Fri Nov 21 10:53:36 2025 +0100 objtool: Add Function to get the name of a CPU feature Add a function to get the name of a CPU feature. The function is architecture dependent and currently only implemented for x86. The feature names are automatically generated from the cpufeatures.h include file. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-27-alexandre.chartre@oracle.com commit afbf83671e62768e1f183c3aef2a9f62e8b83684 Merge: cb99656b7c4185 0cc8cd824b9fb7 Author: Mark Brown Date: Mon Nov 24 19:25:58 2025 +0000 Add RSPI support for RZ/T2H and RZ/N2H Merge series from Cosmin Tanislav : Add support for RZ/T2H and RZ/N2H. commit 860238af7a3348225de228dc0f33a7d631638333 Author: Peter Zijlstra Date: Sat Jun 7 10:06:40 2025 +0200 x86_64/bug: Inline the UD1 (Ab)use the static_call infrastructure to convert all: call __WARN_trap instances into the desired: ud1 (%edx), %rdi eliminating the CALL/RET, but more importantly, fixing the fact that all WARNs will have: RIP: 0010:__WARN_trap+0 Basically, by making it a static_call trampoline call, objtool will collect the callsites, and then the inline rewrite will hit the special case and replace the code with the magic instruction. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115758.456717741@infradead.org commit 11bb4944f014d756f35261f5afcb346901ef1efa Author: Peter Zijlstra Date: Mon Jun 2 15:08:30 2025 +0200 x86/bug: Implement WARN_ONCE() Implement WARN_ONCE like WARN using BUGFLAG_ONCE. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115758.339309119@infradead.org commit 5b472b6e5bd951b208fbbe373892891398eb5ad1 Author: Peter Zijlstra Date: Mon Jun 2 15:08:32 2025 +0200 x86_64/bug: Implement __WARN_printf() The basic idea is to have __WARN_printf() be a vararg function such that the compiler can do the optimal calling convention for us. This function body will be a #UD and then set up a va_list in the exception from pt_regs. But because the trap will be in a called function, the bug_entry must be passed in. Have that be the first argument, with the format tucked away inside the bug_entry. The comments should clarify the real fun details. The big downside is that all WARNs will now show: RIP: 0010:__WARN_trap:+0 One possible solution is to simply discard the top frame when unwinding. A follow up patch takes care of this slightly differently by abusing the x86 static_call implementation. This changes (with the next patches): WARN_ONCE(preempt_count() != 2*PREEMPT_DISABLE_OFFSET, "corrupted preempt_count: %s/%d/0x%x\n", from: cmpl $2, %ecx #, _7 jne .L1472 ... .L1472: cmpb $0, __already_done.11(%rip) je .L1513 ... .L1513 movb $1, __already_done.11(%rip) movl 1424(%r14), %edx # _15->pid, _15->pid leaq 1912(%r14), %rsi #, _17 movq $.LC43, %rdi #, call __warn_printk # ud2 .pushsection __bug_table,"aw" 2: .long 1b - . # bug_entry::bug_addr .long .LC1 - . # bug_entry::file .word 5093 # bug_entry::line .word 2313 # bug_entry::flags .org 2b + 12 .popsection .pushsection .discard.annotate_insn,"M", @progbits, 8 .long 1b - . .long 8 # ANNOTYPE_REACHABLE .popsection into: cmpl $2, %ecx #, _7 jne .L1442 #, ... .L1442: lea (2f)(%rip), %rdi 1: .pushsection __bug_table,"aw" 2: .long 1b - . # bug_entry::bug_addr .long .LC43 - . # bug_entry::format .long .LC1 - . # bug_entry::file .word 5093 # bug_entry::line .word 2323 # bug_entry::flags .org 2b + 16 .popsection movl 1424(%r14), %edx # _19->pid, _19->pid leaq 1912(%r14), %rsi #, _13 ud1 (%edx), %rdi Notably, by pushing everything into the exception handler it can take care of the ONCE thing. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115758.213813530@infradead.org commit 4f1b701f24bea0900e349aa1c860db24ba0150aa Author: Peter Zijlstra Date: Mon Nov 10 10:24:09 2025 +0100 x86/bug: Use BUG_FORMAT for DEBUG_BUGVERBOSE_DETAILED Since we have an explicit format string, use it for the condition string instead of frobbing it in the file string. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115758.097401406@infradead.org commit 0a52d339d35df80d65706263dc55542dd795a115 Author: Peter Zijlstra Date: Mon Jun 2 15:08:34 2025 +0200 x86/bug: Add BUG_FORMAT basics Opt-in to BUG_FORMAT for x86_64, adjust the BUGTABLE helper and for now, just store NULL pointers. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.980264454@infradead.org commit c604cb5fdf0f569a9ce344a37a79958c3841396e Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:14 2025 +0100 soc: renesas: Use bitfield helpers Use the field_get() helper, instead of open-coding the same operation. Signed-off-by: Geert Uytterhoeven Signed-off-by: Yury Norov (NVIDIA) commit 3937b05bb78f3ad1e8887b91b9a97ea05ac0a4a8 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:13 2025 +0100 clk: renesas: Use bitfield helpers Use the FIELD_{GET,PREP}() and field_{get,prep}() helpers for const respective non-const bitfields, instead of open-coding the same operations. Signed-off-by: Geert Uytterhoeven Reviewed-by: Stephen Boyd Signed-off-by: Yury Norov (NVIDIA) commit b1cff2f4b2391a13bd3e9263502072df1ee5d035 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:10 2025 +0100 ALSA: usb-audio: Convert to common field_{get,prep}() helpers Drop the driver-specific field_get() and field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Acked-by: Takashi Iwai Signed-off-by: Yury Norov (NVIDIA) commit 610c4408a2f7a09a00f656459e762ee1e21bbd7b Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:09 2025 +0100 soc: renesas: rz-sysc: Convert to common field_get() helper Drop the driver-specific field_get() macro, in favor of the globally available variant from . Signed-off-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Signed-off-by: Yury Norov (NVIDIA) commit bb0e7fda87753a973cb4a86c22905b1177f00d4e Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:08 2025 +0100 pinctrl: ma35: Convert to common field_{get,prep}() helpers Drop the driver-specific field_get() and field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Reviewed-by: Linus Walleij Signed-off-by: Yury Norov (NVIDIA) commit 1fe1c28a108e4953f083c0106575ee0eccc296ae Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:07 2025 +0100 iio: mlx90614: Convert to common field_{get,prep}() helpers Drop the driver-specific field_get() and field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Acked-by: Jonathan Cameron Acked-by: Crt Mori Signed-off-by: Yury Norov (NVIDIA) commit 54bfd90ca3b41567cbfdac2f633ae329eb3a665a Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:06 2025 +0100 iio: dac: Convert to common field_prep() helper Drop the driver-specific field_prep() macro, in favor of the globally available variant from . Signed-off-by: Geert Uytterhoeven Acked-by: Jonathan Cameron Signed-off-by: Yury Norov (NVIDIA) commit 2ef26ba8192c6ef49dd9ed1a95f990c438085517 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:05 2025 +0100 gpio: aspeed: Convert to common field_{get,prep}() helpers Drop the driver-specific field_get() and field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Signed-off-by: Yury Norov (NVIDIA) commit 331a1457d8d5d233435633fcea116abeb775c4b4 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:04 2025 +0100 EDAC/ie31200: Convert to common field_get() helper Drop the driver-specific field_get() macro, in favor of the globally available variant from . Signed-off-by: Geert Uytterhoeven Reviewed-by: Qiuxu Zhuo Signed-off-by: Yury Norov (NVIDIA) commit 350f06c9e2c97aca009fa10e8636ecf297ccd330 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:03 2025 +0100 crypto: qat - convert to common field_get() helper Drop the driver-specific field_get() macro, in favor of the globally available variant from . Signed-off-by: Geert Uytterhoeven Acked-by: Giovanni Cabiddu Signed-off-by: Yury Norov (NVIDIA) commit 0f8407a1f1c795c417e4c7750654a6024a3ec68b Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:02 2025 +0100 clk: at91: Convert to common field_{get,prep}() helpers Drop the driver-specific field_get() and field_prep() macros, in favor of the globally available variants from . Signed-off-by: Geert Uytterhoeven Acked-by: Alexandre Belloni Acked-by: Stephen Boyd Acked-by: Claudiu Beznea Signed-off-by: Yury Norov (NVIDIA) commit c1c6ab80b25c8db1e2ef5ae3ac8075d2c242ae13 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:01 2025 +0100 bitfield: Add non-constant field_{prep,get}() helpers The existing FIELD_{GET,PREP}() macros are limited to compile-time constants. However, it is very common to prepare or extract bitfield elements where the bitfield mask is not a compile-time constant. To avoid this limitation, the AT91 clock driver and several other drivers already have their own non-const field_{prep,get}() macros. Make them available for general use by adding them to , and improve them slightly: 1. Avoid evaluating macro parameters more than once, 2. Replace "ffs() - 1" by "__ffs()", 3. Support 64-bit use on 32-bit architectures, 4. Wire field_{get,prep}() to FIELD_{GET,PREP}() when mask is actually constant. This is deliberately not merged into the existing FIELD_{GET,PREP}() macros, as people expressed the desire to keep stricter variants for increased safety, or for performance critical paths. Yury: use __mask withing new macros. Signed-off-by: Geert Uytterhoeven Acked-by: Alexandre Belloni Acked-by: Jonathan Cameron Acked-by: Crt Mori Acked-by: Nuno Sá Acked-by: Richard Genoud Reviewed-by: Andy Shevchenko Reviewed-by: Yury Norov (NVIDIA) Signed-off-by: Yury Norov (NVIDIA) commit 2a6c045640c38a407a39cd40c3c4d8dd2fd89aa8 Author: Geert Uytterhoeven Date: Thu Nov 6 14:34:00 2025 +0100 bitfield: Add less-checking __FIELD_{GET,PREP}() The BUILD_BUG_ON_MSG() check against "~0ull" works only with "unsigned (long) long" _mask types. For constant masks, that condition is usually met, as GENMASK() yields an UL value. The few places where the constant mask is stored in an intermediate variable were fixed by changing the variable type to u64 (see e.g. [1] and [2]). However, for non-constant masks, smaller unsigned types should be valid, too, but currently lead to "result of comparison of constant 18446744073709551615 with expression of type ... is always false"-warnings with clang and W=1. Hence refactor the __BF_FIELD_CHECK() helper, and factor out __FIELD_{GET,PREP}(). The later lack the single problematic check, but are otherwise identical to FIELD_{GET,PREP}(), and are intended to be used in the fully non-const variants later. [1] commit 5c667d5a5a3ec166 ("clk: sp7021: Adjust width of _m in HWM_FIELD_PREP()") [2] commit cfd6fb45cfaf46fa ("crypto: ccree - avoid out-of-range warnings from clang") Signed-off-by: Geert Uytterhoeven Link: https://git.kernel.org/torvalds/c/5c667d5a5a3ec166 [1] Signed-off-by: Yury Norov (NVIDIA) commit 85a8ff11853110e59396f97b3239db40cc89e08c Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:57 2025 +0100 ALSA: usb-audio: #undef field_{get,prep}() before local definition Prepare for the advent of globally available common field_get() and field_prep() macros by undefining the symbols before defining local variants. This prevents redefinition warnings from the C preprocessor when introducing the common macros later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Takashi Iwai Signed-off-by: Yury Norov (NVIDIA) commit 138ab44108fad96c22b381ebfb6936ab9787aedc Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:56 2025 +0100 soc: renesas: rz-sysc: #undef field_get() before local definition Prepare for the advent of a globally available common field_get() macro by undefining the symbol before defining a local variant. This prevents redefinition warnings from the C preprocessor when introducing the common macro later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Signed-off-by: Yury Norov (NVIDIA) commit 2fc00c008e9043ca66b711cc0df78a4d94da2e34 Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:55 2025 +0100 pinctrl: ma35: #undef field_{get,prep}() before local definition Prepare for the advent of globally available common field_get() and field_prep() macros by undefining the symbols before defining local variants. This prevents redefinition warnings from the C preprocessor when introducing the common macros later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Linus Walleij Signed-off-by: Yury Norov (NVIDIA) commit 8a838dabf145818e67b304997c21a055dd5943dc Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:54 2025 +0100 iio: mlx90614: #undef field_{get,prep}() before local definition Prepare for the advent of globally available common field_get() and field_prep() macros by undefining the symbols before defining local variants. This prevents redefinition warnings from the C preprocessor when introducing the common macros later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Jonathan Cameron Signed-off-by: Yury Norov (NVIDIA) commit 27856d2b2b0f259ba261a3e3e028cc75a70ae817 Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:53 2025 +0100 iio: dac: ad3530r: #undef field_prep() before local definition Prepare for the advent of a globally available common field_prep() macro by undefining the symbol before defining a local variant. This prevents redefinition warnings from the C preprocessor when introducing the common macro later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Jonathan Cameron Signed-off-by: Yury Norov (NVIDIA) commit d1e1a7271e97bf679d355777a10fa8c0dc259b86 Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:52 2025 +0100 gpio: aspeed: #undef field_{get,prep}() before local definition Prepare for the advent of globally available common field_get() and field_prep() macros by undefining the symbols before defining local variants. This prevents redefinition warnings from the C preprocessor when introducing the common macros later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Bartosz Golaszewski Signed-off-by: Yury Norov (NVIDIA) commit d51b09a0feb63029be64226502cbcf53adc434b0 Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:51 2025 +0100 EDAC/ie31200: #undef field_get() before local definition Prepare for the advent of a globally available common field_get() macro by undefining the symbol before defining a local variant. This prevents redefinition warnings from the C preprocessor when introducing the common macro later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Reviewed-by: Qiuxu Zhuo Signed-off-by: Yury Norov (NVIDIA) commit 7996cbdb3f8472bc4286c776d3fa39cf0c20237a Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:50 2025 +0100 crypto: qat - #undef field_get() before local definition Prepare for the advent of a globally available common field_get() macro by undefining the symbol before defining a local variant. This prevents redefinition warnings from the C preprocessor when introducing the common macro later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Giovanni Cabiddu Signed-off-by: Yury Norov (NVIDIA) commit dbfe51513aae6bace00cc390e11cb486a64a63d2 Author: Geert Uytterhoeven Date: Thu Nov 6 14:33:49 2025 +0100 clk: at91: pmc: #undef field_{get,prep}() before definition Prepare for the advent of globally available common field_get() and field_prep() macros by undefining the symbols before defining local variants. This prevents redefinition warnings from the C preprocessor when introducing the common macros later. Suggested-by: Yury Norov Signed-off-by: Geert Uytterhoeven Acked-by: Alexandre Belloni Acked-by: Stephen Boyd Acked-by: Claudiu Beznea Signed-off-by: Yury Norov (NVIDIA) commit a13744f628c61a450f650442a118405242ac0db0 Author: Richard Fitzgerald Date: Mon Nov 24 16:20:16 2025 +0000 ASoC: cs-amp-lib: Remove redundant calls to kunit_deactivate_static_stub() KUnit automatically deactivates stubs when a test case exits, so there is no need to explicitly call kunit_deactivate_static_stub() in every test function. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251124162016.30446-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 7584edf15892e29190b2145294cc1680aa142586 Author: Richard Fitzgerald Date: Mon Nov 24 17:15:35 2025 +0000 firmware: cs_dsp: Store control length as 32-bit The architectures supported by this driver have a maximum of 32-bits of address, so we don't need more than 32-bits to store the length of control data. Change the length in struct cs_dsp_coeff_ctl to an unsigned int instead of a size_t. Also make a corresponding trivial change to wm_adsp.c to prevent a compiler warning. Tested on x86_64 builds this saves at least 4 bytes per control (another 4 bytes might be saved if the compiler was inserting padding to align the size_t). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251124171536.78962-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 4617b3069af411ce64a0c876b1b4964a3ea2b3f4 Merge: acf8726466a625 ad93ba02678eda Author: Alexei Starovoitov Date: Mon Nov 24 10:00:16 2025 -0800 Merge branch 'ease-bpf-signing-build-requirements' Alan Maguire says: ==================== Ease BPF signing build requirements This series makes it easier to build bpftool and selftests with signing support, removing reliance on >= openssl v3 (supporting openssl v1) to build bpftool and not requiring latest xxd to build verification cert header in selftests. Changes since v1 [1]: - Updated patch 2 to add symlink test_progs_verification_cert to .gitignore, EXTRA_CLEANFILES (AI review bot) - Added acks to patch 1 (Song, Quentin) [1] https://lore.kernel.org/bpf/20251114222249.30122-1-alan.maguire@oracle.com/ ==================== Link: https://patch.msgid.link/20251120084754.640405-1-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit ad93ba02678eda5fc8e259cf4b52997e6fa570cf Author: Alan Maguire Date: Thu Nov 20 08:47:54 2025 +0000 selftests/bpf: Allow selftests to build with older xxd Currently selftests require xxd with the "-n " option which allows the user to specify a name not derived from the input object path. Instead of relying on this newer feature, older xxd can be used if we link our desired name ("test_progs_verification_cert") to the input object. Many distros ship xxd in vim-common package and do not have the latest xxd with -n support. Fixes: b720903e2b14d ("selftests/bpf: Enable signature verification for some lskel tests") Signed-off-by: Alan Maguire Link: https://lore.kernel.org/r/20251120084754.640405-3-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit 90ae54b4c7eca42d5ce006dd0a8cb0b5bfbf80d0 Author: Alan Maguire Date: Thu Nov 20 08:47:53 2025 +0000 bpftool: Allow bpftool to build with openssl < 3 ERR_get_error_all()[1] is a openssl v3 API, so to make code compatible with openssl v1 utilize ERR_get_err_line_data instead. Since openssl is already a build requirement for the kernel (minimum requirement openssl 1.0.0), this will allow bpftool to compile where opensslv3 is not available. Signing-related BPF selftests pass with openssl v1. [1] https://docs.openssl.org/3.4/man3/ERR_get_error/ Fixes: 40863f4d6ef2 ("bpftool: Add support for signing BPF programs") Signed-off-by: Alan Maguire Acked-by: Song Liu Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20251120084754.640405-2-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov commit dcfa98bb5f7816aec787e74871982b06607ba9cb Author: Christoph Hellwig Date: Mon Nov 24 14:54:14 2025 +0100 xfs: move some code out of xfs_iget_recycle Having a function drop locks, reacquire them and release them again seems to confuse the clang lock analysis even more than it confuses humans. Keep the humans and machines sanity by moving a chunk of code into the caller to simplify the lock tracking. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit acf8726466a6254617ade092bb3eded8c04947f7 Merge: fad804002ef3ca 402e44b31e9d8c Author: Alexei Starovoitov Date: Mon Nov 24 09:45:27 2025 -0800 Merge branch 'bpf-trampoline-support-jmp-mode' Menglong Dong says: ==================== bpf trampoline support "jmp" mode For now, the bpf trampoline is called by the "call" instruction. However, it break the RSB and introduce extra overhead in x86_64 arch. For example, we hook the function "foo" with fexit, the call and return logic will be like this: call foo -> call trampoline -> call foo-body -> return foo-body -> return foo As we can see above, there are 3 call, but 2 return, which break the RSB balance. We can pseudo a "return" here, but it's not the best choice, as it will still cause once RSB miss: call foo -> call trampoline -> call foo-body -> return foo-body -> return dummy -> return foo The "return dummy" doesn't pair the "call trampoline", which can also cause the RSB miss. Therefore, we introduce the "jmp" mode for bpf trampoline, as advised by Alexei in [1]. And the logic will become this: call foo -> jmp trampoline -> call foo-body -> return foo-body -> return foo As we can see above, the RSB is totally balanced after this series. In this series, we introduce the FTRACE_OPS_FL_JMP for ftrace to make it use the "jmp" instruction instead of "call". And we also do some adjustment to bpf_arch_text_poke() to allow us specify the old and new poke_type. For the BPF_TRAMP_F_SHARE_IPMODIFY case, we will fallback to the "call" mode, as it need to get the function address from the stack, which is not supported in "jmp" mode. Before this series, we have the following performance with the bpf benchmark: $ cd tools/testing/selftests/bpf $ ./benchs/run_bench_trigger.sh usermode-count : 890.171 ± 1.522M/s kernel-count : 409.184 ± 0.330M/s syscall-count : 26.792 ± 0.010M/s fentry : 171.242 ± 0.322M/s fexit : 80.544 ± 0.045M/s fmodret : 78.301 ± 0.065M/s rawtp : 192.906 ± 0.900M/s tp : 81.883 ± 0.209M/s kprobe : 52.029 ± 0.113M/s kprobe-multi : 62.237 ± 0.060M/s kprobe-multi-all: 4.761 ± 0.014M/s kretprobe : 23.779 ± 0.046M/s kretprobe-multi: 29.134 ± 0.012M/s kretprobe-multi-all: 3.822 ± 0.003M/ And after this series, we have the following performance: usermode-count : 890.443 ± 0.307M/s kernel-count : 416.139 ± 0.055M/s syscall-count : 31.037 ± 0.813M/s fentry : 169.549 ± 0.519M/s fexit : 136.540 ± 0.518M/s fmodret : 159.248 ± 0.188M/s rawtp : 194.475 ± 0.144M/s tp : 84.505 ± 0.041M/s kprobe : 59.951 ± 0.071M/s kprobe-multi : 63.153 ± 0.177M/s kprobe-multi-all: 4.699 ± 0.012M/s kretprobe : 23.740 ± 0.015M/s kretprobe-multi: 29.301 ± 0.022M/s kretprobe-multi-all: 3.869 ± 0.005M/s As we can see above, the performance of fexit increase from 80.544M/s to 136.540M/s, and the "fmodret" increase from 78.301M/s to 159.248M/s. Link: https://lore.kernel.org/bpf/20251117034906.32036-1-dongml2@chinatelecom.cn/ Changes since v2: * reject if the addr is already "jmp" in register_ftrace_direct() and __modify_ftrace_direct() in the 1st patch. * fix compile error in powerpc in the 5th patch. * changes in the 6th patch: - fix the compile error by wrapping the write to tr->fops->flags with CONFIG_DYNAMIC_FTRACE_WITH_JMP - reset BPF_TRAMP_F_SKIP_FRAME when the second try of modify_fentry in bpf_trampoline_update() Link: https://lore.kernel.org/bpf/20251114092450.172024-1-dongml2@chinatelecom.cn/ Changes since v1: * change the bool parameter that we add to save_args() to "u32 flags" * rename bpf_trampoline_need_jmp() to bpf_trampoline_use_jmp() * add new function parameter to bpf_arch_text_poke instead of introduce bpf_arch_text_poke_type() * rename bpf_text_poke to bpf_trampoline_update_fentry * remove the BPF_TRAMP_F_JMPED and check the current mode with the origin flags instead. Link: https://lore.kernel.org/bpf/CAADnVQLX54sVi1oaHrkSiLqjJaJdm3TQjoVrgU-LZimK6iDcSA@mail.gmail.com/[1] ==================== Acked-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20251118123639.688444-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 402e44b31e9d8cb082d85870ee0d0ad54f97c311 Author: Menglong Dong Date: Tue Nov 18 20:36:34 2025 +0800 bpf: implement "jmp" mode for trampoline Implement the "jmp" mode for the bpf trampoline. For the ftrace_managed case, we need only to set the FTRACE_OPS_FL_JMP on the tr->fops if "jmp" is needed. For the bpf poke case, we will check the origin poke type with the "origin_flags", and current poke type with "tr->flags". The function bpf_trampoline_update_fentry() is introduced to do the job. The "jmp" mode will only be enabled with CONFIG_DYNAMIC_FTRACE_WITH_JMP enabled and BPF_TRAMP_F_SHARE_IPMODIFY is not set. With BPF_TRAMP_F_SHARE_IPMODIFY, we need to get the origin call ip from the stack, so we can't use the "jmp" mode. Signed-off-by: Menglong Dong Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20251118123639.688444-7-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit ae4a3160d19cd16b874737ebc1798c7bc2fe3c9e Author: Menglong Dong Date: Tue Nov 18 20:36:33 2025 +0800 bpf: specify the old and new poke_type for bpf_arch_text_poke In the origin logic, the bpf_arch_text_poke() assume that the old and new instructions have the same opcode. However, they can have different opcode if we want to replace a "call" insn with a "jmp" insn. Therefore, add the new function parameter "old_t" along with the "new_t", which are used to indicate the old and new poke type. Meanwhile, adjust the implement of bpf_arch_text_poke() for all the archs. "BPF_MOD_NOP" is added to make the code more readable. In bpf_arch_text_poke(), we still check if the new and old address is NULL to determine if nop insn should be used, which I think is more safe. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20251118123639.688444-6-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 373f2f44c300815c5f170e89560ac361c0053dfe Author: Menglong Dong Date: Tue Nov 18 20:36:32 2025 +0800 bpf,x86: adjust the "jmp" mode for bpf trampoline In the origin call case, if BPF_TRAMP_F_SKIP_FRAME is not set, it means that the trampoline is not called, but "jmp". Introduce the function bpf_trampoline_use_jmp() to check if the trampoline is in "jmp" mode. Do some adjustment on the "jmp" mode for the x86_64. The main adjustment that we make is for the stack parameter passing case, as the stack alignment logic changes in the "jmp" mode without the "rip". What's more, the location of the parameters on the stack also changes. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20251118123639.688444-5-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 47c9214dcbea9043ac20441a285c7bb5486b8b2d Author: Menglong Dong Date: Tue Nov 18 20:36:31 2025 +0800 bpf: fix the usage of BPF_TRAMP_F_SKIP_FRAME Some places calculate the origin_call by checking if BPF_TRAMP_F_SKIP_FRAME is set. However, it should use BPF_TRAMP_F_ORIG_STACK for this propose. Just fix them. Signed-off-by: Menglong Dong Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/r/20251118123639.688444-4-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 0c3772a8db1f697c22dd6caef1fe938fbb0e0a5b Author: Menglong Dong Date: Tue Nov 18 20:36:30 2025 +0800 x86/ftrace: Implement DYNAMIC_FTRACE_WITH_JMP Implement the DYNAMIC_FTRACE_WITH_JMP for x86_64. In ftrace_call_replace, we will use JMP32_INSN_OPCODE instead of CALL_INSN_OPCODE if the address should use "jmp". Meanwhile, adjust the direct call in the ftrace_regs_caller. The RSB is balanced in the "jmp" mode. Take the function "foo" for example: original_caller: call foo -> foo: call fentry -> fentry: [do ftrace callbacks ] move tramp_addr to stack RET -> tramp_addr tramp_addr: [..] call foo_body -> foo_body: [..] RET -> back to tramp_addr [..] RET -> back to original_caller Signed-off-by: Menglong Dong Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20251118123639.688444-3-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 25e4e3565d45f567f78089f38822fa64abee5230 Author: Menglong Dong Date: Tue Nov 18 20:36:29 2025 +0800 ftrace: Introduce FTRACE_OPS_FL_JMP For now, the "nop" will be replaced with a "call" instruction when a function is hooked by the ftrace. However, sometimes the "call" can break the RSB and introduce extra overhead. Therefore, introduce the flag FTRACE_OPS_FL_JMP, which indicate that the ftrace_ops should be called with a "jmp" instead of "call". For now, it is only used by the direct call case. When a direct ftrace_ops is marked with FTRACE_OPS_FL_JMP, the last bit of the ops->direct_call will be set to 1. Therefore, we can tell if we should use "jmp" for the callback in ftrace_call_replace(). Signed-off-by: Menglong Dong Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20251118123639.688444-2-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit fad804002ef3cae8ca0509849d0d9539be069095 Author: Anton Protopopov Date: Mon Nov 24 15:15:15 2025 +0000 bpf: cleanup aux->used_maps after jit In commit b4ce5923e780 ("bpf, x86: add new map type: instructions array") env->used_map was copied to func[i]->aux->used_maps before jitting. Clear these fields out after jitting such that pointer to freed memory (env->used_maps is freed later) are not kept in a live data structure. The reason why the copies were initially added is explained in https://lore.kernel.org/bpf/20251105090410.1250500-1-a.s.protopopov@gmail.com Suggested-by: Alexei Starovoitov Fixes: b4ce5923e780 ("bpf, x86: add new map type: instructions array") Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251124151515.2543403-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 5de8ce0f3709ad93ca5a579aa45cf1b52d72bc90 Author: Yang Wang Date: Thu Oct 30 09:06:22 2025 +0800 drm/amd/pm: adjust the visibility of pp_table sysfs node v1: - make pp_table invisible on VF mode (only valid on BM) - make pp_table invisible on Mi* chips (Not supported) - make pp_table invisible if scpm feature is enabled. v2: move pp_table invisible code logic into amdgpu_dpm_get_pp_table() function. v3: add table buffer pointer check both on powerplay & swsmu. Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 66a50fa49db53cf2b1894d4cd7c1b5b522276706 Author: Rodrigo Siqueira Date: Fri Nov 21 06:55:29 2025 -0700 Revert "drm/amd: fix gfx hang on renoir in IGT reload test" The original patch introduced additional latency during boot time because it triggers a driver reload to avoid a CP hang when the driver is reloaded multiple times. This has been addressed with a more generic solution that triggers the GPU reset only during the unload phase, avoiding extra latency during boot time. For this reason, this commit reverts the original change. This reverts commit 72a98763b473890e6605604bfcaf71fc212b4720. This patch should only be applied if commit: 4355e61835e7 ("drm/amdgpu: Fix GFX hang on SteamDeck when amdgpu is reloaded") is present. Acked-by: Christian König Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 34355e61835e772abddb49ad819f88bf185f8d42 Author: Rodrigo Siqueira Date: Fri Nov 21 06:55:28 2025 -0700 drm/amdgpu: Fix GFX hang on SteamDeck when amdgpu is reloaded When trying to unload amdgpu in the SteamDeck (TTY mode), the following set of errors happens and the system gets unstable: [..] [drm] Initialized amdgpu 3.64.0 for 0000:04:00.0 on minor 0 amdgpu 0000:04:00.0: [drm:amdgpu_ib_ring_tests [amdgpu]] *ERROR* IB test failed on gfx_0.0.0 (-110). amdgpu 0000:04:00.0: amdgpu: ib ring test failed (-110). [..] amdgpu 0000:04:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x0000001E SMN_C2PMSG_82:0x00000000 amdgpu 0000:04:00.0: amdgpu: Failed to disable gfxoff! amdgpu 0000:04:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x0000001E SMN_C2PMSG_82:0x00000000 amdgpu 0000:04:00.0: amdgpu: Failed to disable gfxoff! [..] When the driver initializes the GPU, the PSP validates all the firmware loaded, and after that, it is not possible to load any other firmware unless the device is reset. What is happening in the load/unload situation is that PSP halts the GC engine because it suspects that something is amiss. To address this issue, this commit ensures that the GPU is reset (mode 2 reset) in the unload sequence. Acked-by: Christian König Reviewed-by: Mario Limonciello (AMD) Suggested-by: Alex Deucher Signed-off-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit e12603bf2c3d571476a21debfeab80bb70d8c0cc Author: Yang Wang Date: Wed Nov 19 10:46:23 2025 +0800 drm/amd/pm: fix amdgpu_irq enabled counter unbalanced on smu v11.0 v1: - fix amdgpu_irq enabled counter unbalanced issue on smu_v11_0_disable_thermal_alert. v2: - re-enable smu thermal alert to make amdgpu irq counter balance for smu v11.0 if in runpm state [75582.361561] ------------[ cut here ]------------ [75582.361565] WARNING: CPU: 42 PID: 533 at drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c:639 amdgpu_irq_put+0xd8/0xf0 [amdgpu] ... [75582.362211] Tainted: [E]=UNSIGNED_MODULE [75582.362214] Hardware name: GIGABYTE MZ01-CE0-00/MZ01-CE0-00, BIOS F14a 08/14/2020 [75582.362218] Workqueue: pm pm_runtime_work [75582.362225] RIP: 0010:amdgpu_irq_put+0xd8/0xf0 [amdgpu] [75582.362556] Code: 31 f6 31 ff e9 c9 bf cf c2 44 89 f2 4c 89 e6 4c 89 ef e8 db fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 a8 bf cf c2 <0f> 0b eb c3 b8 fe ff ff ff eb 97 e9 84 e8 8b 00 0f 1f 84 00 00 00 [75582.362560] RSP: 0018:ffffd50d51297b80 EFLAGS: 00010246 [75582.362564] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 [75582.362568] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [75582.362570] RBP: ffffd50d51297ba0 R08: 0000000000000000 R09: 0000000000000000 [75582.362573] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8e72091d2008 [75582.362576] R13: ffff8e720af80000 R14: 0000000000000000 R15: ffff8e720af80000 [75582.362579] FS: 0000000000000000(0000) GS:ffff8e9158262000(0000) knlGS:0000000000000000 [75582.362582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [75582.362585] CR2: 000074869d040c14 CR3: 0000001e37a3e000 CR4: 00000000003506f0 [75582.362588] Call Trace: [75582.362591] [75582.362597] smu_v11_0_disable_thermal_alert+0x17/0x30 [amdgpu] [75582.362983] smu_smc_hw_cleanup+0x79/0x4f0 [amdgpu] [75582.363375] smu_suspend+0x92/0x110 [amdgpu] [75582.363762] ? gfx_v10_0_hw_fini+0xd5/0x150 [amdgpu] [75582.364098] amdgpu_ip_block_suspend+0x27/0x80 [amdgpu] [75582.364377] ? timer_delete_sync+0x10/0x20 [75582.364384] amdgpu_device_ip_suspend_phase2+0x190/0x450 [amdgpu] [75582.364665] amdgpu_device_suspend+0x1ae/0x2f0 [amdgpu] [75582.364948] amdgpu_pmops_runtime_suspend+0xf3/0x1f0 [amdgpu] [75582.365230] pci_pm_runtime_suspend+0x6d/0x1f0 [75582.365237] ? __pfx_pci_pm_runtime_suspend+0x10/0x10 [75582.365242] __rpm_callback+0x4c/0x190 [75582.365246] ? srso_return_thunk+0x5/0x5f [75582.365252] ? srso_return_thunk+0x5/0x5f [75582.365256] ? ktime_get_mono_fast_ns+0x43/0xe0 [75582.365263] rpm_callback+0x6e/0x80 [75582.365267] rpm_suspend+0x124/0x5f0 [75582.365271] ? srso_return_thunk+0x5/0x5f [75582.365275] ? __schedule+0x439/0x15e0 [75582.365281] ? srso_return_thunk+0x5/0x5f [75582.365285] ? __queue_delayed_work+0xb8/0x180 [75582.365293] pm_runtime_work+0xc6/0xe0 [75582.365297] process_one_work+0x1a1/0x3f0 [75582.365303] worker_thread+0x2ba/0x3d0 [75582.365309] kthread+0x107/0x220 [75582.365313] ? __pfx_worker_thread+0x10/0x10 [75582.365318] ? __pfx_kthread+0x10/0x10 [75582.365323] ret_from_fork+0xa2/0x120 [75582.365328] ? __pfx_kthread+0x10/0x10 [75582.365332] ret_from_fork_asm+0x1a/0x30 [75582.365343] [75582.365345] ---[ end trace 0000000000000000 ]--- [75582.365350] amdgpu 0000:05:00.0: amdgpu: Fail to disable thermal alert! [75582.365379] amdgpu 0000:05:00.0: amdgpu: suspend of IP block failed -22 Signed-off-by: Yang Wang Reviewed-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 873373739b9b150720ea2c5390b4e904a4d21505 Author: Michael Chen Date: Thu Nov 13 12:56:43 2025 -0500 drm/amd/amdgpu: reserve vm invalidation engine for uni_mes Reserve vm invalidation engine 6 when uni_mes enabled. It is used in processing tlb flush request from host. Signed-off-by: Michael Chen Acked-by: Alex Deucher Reviewed-by: Shaoyun liu Signed-off-by: Alex Deucher commit 828ec765f7968c636c4c163c050ad13da959adef Author: Boris Burkov Date: Tue Sep 23 10:57:02 2025 -0700 btrfs: ignore ENOMEM from alloc_bitmap() btrfs_convert_free_space_to_bitmaps() and btrfs_convert_free_space_to_extents() both allocate a bitmap struct with: bitmap_size = free_space_bitmap_size(fs_info, block_group->length); bitmap = alloc_bitmap(bitmap_size); if (!bitmap) { ret = -ENOMEM; btrfs_abort_transaction(trans); return ret; } This conversion is done based on a heuristic and the check triggers each time we call update_free_space_extent_count() on a block group (each time we add/remove an extent or modify a bitmap). Furthermore, nothing relies on maintaining some invariant of bitmap density, it's just an optimization for space usage. Therefore, it is safe to simply ignore any memory allocation errors that occur, rather than aborting the transaction and leaving the fs read only. Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 94124ea5a741b82d3789a0df9231f0315819efa2 Author: Daniel Thompson Date: Fri Nov 21 17:23:54 2025 +0000 drm/edp-panel: Add touchscreen panel used by Lenovo X13s After (checks watch) a little over two years I finally investigated the boot warning on my Thinkpad X13s and it was caused by the conservative timings warning in panel-edp.c . The X13s was sold with a variety of different panel versions; I have the 300 nit multi-touch variant. I have been unable to secure panel documentation so the I copied the timings from NV133WUM-N63. The raw EDID is: 00 ff ff ff ff ff ff 00 09 e5 84 0a 00 00 00 00 1e 1f 01 04 a5 1d 12 78 03 5c 70 a6 51 4c 9c 26 0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 74 3c 80 a0 70 b0 28 40 30 20 36 00 1e b3 10 00 00 1a 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42 4f 45 20 48 46 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 56 31 33 33 57 55 4d 2d 54 30 31 0a 00 51 Signed-off-by: Daniel Thompson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251121-x13s-touchscreen-loopup-v2-1-75b03838e28f@riscstar.com commit 5c14bff570dc5a756d90f7a5bc665cbbe604db8b Author: Werner Sembach Date: Thu Nov 20 22:49:42 2025 +0100 platform/x86/uniwill: Add TUXEDO devices Add all TUXEDO devices that can make use of this driver. For the time being just the input part of the driver is used for these devies. Other features will follow once implemented and/or tested. Reviewed-by: Armin Wolf Reviewed-by: Ilpo Järvinen Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20251120215240.436835-3-wse@tuxedocomputers.com Signed-off-by: Ilpo Järvinen commit 3330367128f54142e5cfd568fc44c48da2036536 Author: Werner Sembach Date: Thu Nov 20 22:49:41 2025 +0100 platform/x86/uniwill: Handle more WMI events required for TUXEDO devices Handle more WMI events that are triggered on TUXEDO devices. Testing the TUXEDO InfinityBook Pro 15 Gen9 Intel, the Stellaris 16 Gen5 Intel, the Stellaris 16 Gen5 AMD and going through the out of tree tuxedo-drivers dkms package I identified more WMI events that are used by Uniwill. This patch binds them to their respective function, or marks them as KE_IGNORE when they are send in addition to other actions, to make clear that they don't need special handling. This also avoids warnings in dmesg. The events with descriptions from memory: UNIWILL_OSD_RADIOON and UNIWILL_OSD_RADIOOFF - Sent in addition to the already handled UNIWILL_OSD_RFKILL on some devices. UNIWILL_OSD_PERFORMANCE_MODE_TOGGLE - Physical button on some devices. Bind it to a button so userspace can receive the keypress and do stuff with it. UNIWILL_OSD_MUTE - Sent in addition to an already handled keypress. UNIWILL_OSD_KB_LED_LEVEL0 - UNIWILL_OSD_KB_LED_LEVEL4 - Some devices sent these instead of UNIWILL_OSD_KBDILLUMTOGGLE. UNIWILL_OSD_WEBCAM_TOGGLE - Sent in addition to deactivating the Webcam on firmware level. UNIWILL_OSD_DC_ADAPTER_CHANGED - No special handling required here atm, but will be for the charging priority feature. Signed-off-by: Werner Sembach Reviewed-by: Armin Wolf Link: https://patch.msgid.link/20251120215240.436835-2-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d54d5e294c9febba9389b03a12fbae2fab9c8f6b Author: Alice Guo Date: Fri Nov 14 11:06:36 2025 +0000 nvmem: imx-ocotp-ele: Add i.MX94 OCOTP support Add OCOTP device type for i.MX94, including register offset, total size, and fuse layout. This enables NVMEM access to the eFuse of i.MX94. Signed-off-by: Alice Guo Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit c7ea8eadd5d35311a2529f9f15095ac37dd9e2e3 Author: Alice Guo Date: Fri Nov 14 11:06:35 2025 +0000 dt-bindings: nvmem: imx-ocotp: Add support for i.MX94 Add the compatible string "fsl,imx94-ocotp" to the imx-ocotp device tree binding documentation to support the i.MX94. Signed-off-by: Alice Guo Acked-by: Conor Dooley Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-8-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit ee5c565163fddc570b52c8ee8b4683046e5295f0 Author: Wolfram Sang Date: Fri Nov 14 11:06:34 2025 +0000 dt-bindings: nvmem: don't check node names Node names are already and properly checked by the core schema. No need to do it again. Signed-off-by: Wolfram Sang Acked-by: Conor Dooley Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-7-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7dc63a2a8d965d4adb2e31fc30944474a069cf96 Author: Louis-Alexis Eyraud Date: Fri Nov 14 11:06:33 2025 +0000 dt-bindings: nvmem: mediatek: efuse: Add compatible for MT8189 SoC Add compatible string for the eFuse layout on MT8189 SoC, that is compatible with MT8186. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5b2f8c133d987ddc4a0e0ba7c58afb587ffeb96f Author: Jascha Sundaresan Date: Fri Nov 14 11:06:32 2025 +0000 nvmem: layouts: u-boot-env: add optional "env-size" property Some devices reserve a larger NVMEM region for the U-Boot environment than the actual environment data length used by U-Boot itself. The CRC32 in the U-Boot header is calculated over the smaller data length, causing CRC validation to fail when Linux reads the full partition. Allow an optional device tree property "env-size" to specify the environment data size to use for CRC computation. v2: add missing $ref line to DT binding Signed-off-by: Jascha Sundaresan Reviewed-by: Rob Herring (Arm) Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2f9fae509895fc8198f521f4ace1fb4dda42c9a6 Author: Heiko Stuebner Date: Fri Nov 14 11:06:31 2025 +0000 nvmem: Add driver for the eeprom in qnap-mcu controllers The qnap-mcu also has an eeprom connected to it, that contains some specific product-information like the mac addresses for the network interfaces. Add a nvmem driver for it. Signed-off-by: Heiko Stuebner Acked-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 47b7ea6528d51acc5e39dede6d28dac7fa38ea47 Author: Jack Hsu Date: Fri Nov 14 11:06:30 2025 +0000 dt-bindings: nvmem: Support MediaTek MT8189 evb board efuse add compatible string for mt8189 evb board dts node of efuse Signed-off-by: Jack Hsu Acked-by: Conor Dooley Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit e7ac47e20fd5dfaa3bf13029266c1af0316a4f6b Author: Akhil P Oommen Date: Fri Nov 14 11:06:29 2025 +0000 dt-bindings: nvmem: qfprom: Add sa8775p compatible Document compatible string for the QFPROM on Lemans platform. Acked-by: Krzysztof Kozlowski Acked-by: Srinivas Kandagatla Signed-off-by: Akhil P Oommen Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251114110636.143268-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3c79c2e28a24a86199fa83bb80dc1a1c33f996c5 Author: Sebastian Reichel Date: Wed Nov 19 01:41:43 2025 +0100 platform: arm64: thinkpad-t14s-ec: add suspend handler for keyboard backlight This ensures that the keyboard backlight state is restored after a suspend-resume cycle. Otherwise the keyboard is automatically disabled during suspend and then stays disabled after resume. Note, that this adopts the same behavior as the existing Thinkpad ACPI driver. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-4-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fc62cb6a3e118a7633ca2217203b6293bb742a23 Author: Sebastian Reichel Date: Wed Nov 19 01:41:42 2025 +0100 platform: arm64: thinkpad-t14s-ec: add system PM hooks Improve support for system suspend. The register information has been extracted from the ACPI DSDT code handling Windows Modern Standby. I took over the weird multi-write function from the ACPI DSDT code where it is called ECWS. In addition to writing to the 0xE0 register, the ACPI Windows Modern Standby code also does some changes to the thermal configuration. This part is not implemented. After this patch the laptop's power and LID LEDs will switch into the typical breathing animation when the system is suspended and enabled normally again after resuming. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-3-441219857c02@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5941f0e0c1e0be03ebc15b461f64208f5250d3d9 Author: Ryan Huang Date: Fri Nov 7 11:09:17 2025 -0800 iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables In arm_smmu_alloc_cd_tables(), the error check following the dma_alloc_coherent() for cd_table->l2.l1tab incorrectly tests cd_table->l2.l2ptrs. This means an allocation failure for l1tab goes undetected, causing the function to return 0 (success) erroneously. Correct the check to test cd_table->l2.l1tab. Fixes: e3b1be2e73db ("iommu/arm-smmu-v3: Reorganize struct arm_smmu_ctx_desc_cfg") Signed-off-by: Daniel Mentz Signed-off-by: Ryan Huang Reviewed-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon commit fe6262910cd3fefe8a23d5f59a701085f7adad6b Author: Konrad Dybcio Date: Tue Nov 4 15:47:26 2025 +0100 dt-bindings: iommu: qcom_iommu: Allow 'tbu' clock Some IOMMUs on some platforms (there doesn't seem to be a good denominator for this) require the presence of a third clock, specifically relating to the instance's Translation Buffer Unit (TBU). Stephan Gerhold noted [1] that according to Qualcomm Snapdragon 410E Processor (APQ8016E) Technical Reference Manual, SMMU chapter, section "8.8.3.1.2 Clock gating", which reads: For APPS TCU/TBU (TBU to TCU interface is asynchronous) Software should turn ON clock to APPS TCU - During APPS TCU register programming sequence For GPU TCU/TBU (TBU to TCU interface is synchronous) Software should turn ON clock to GPU TBU - During GPU TLB invalidation sequence <===================== Software should turn ON clock to GPU TCU - During GPU TCU register programming sequence - While GPU master clock is Active The clock should be turned on at least during TLB invalidation on the GPU SMMU instance. This is corroborated by Commit 5bc1cf1466f6 ("iommu/qcom: add optional 'tbu' clock for TLB invalidate"). This is also not to be confused with qcom,sdm845-tbu, which is a description of a debug interface, absent on the generation of hardware that this binding describes. Allow this clock. [1] https://lore.kernel.org/linux-arm-msm/aPX_cKtial56AgvU@linaro.org/ Reviewed-by: Rob Herring Signed-off-by: Konrad Dybcio Reviewed-by: Bjorn Andersson Signed-off-by: Will Deacon commit d525f967e7a40c08af3e752281ede72e9922b87f Author: Ettore Chimenti Date: Fri Nov 21 15:26:15 2025 +0100 drm/bridge: simple: add ASL CS5263 DP-to-HDMI bridge Add support for the transparent ASL CS5263 DP-to-HDMI bridge. Signed-off-by: Ettore Chimenti Signed-off-by: Georg Gottleuber Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251121142623.251118-4-ggo@tuxedocomputers.com commit 0eebd421ac09686f9646ea635ee8920d55ee5d26 Author: Ettore Chimenti Date: Fri Nov 21 15:26:14 2025 +0100 dt-bindings: display: bridge: simple: document the ASL CS5263 DP-to-HDMI bridge The ASL CS5263 is a high-performance DP1.4 to HDMI2.0b converter, designed to connect a DP1.4 source to an HDMI2.0b sink. The CS5263AN integrates a DP1.4 compliant receiver, and a HDMI2.0b compliant transmitter. Signed-off-by: Ettore Chimenti Signed-off-by: Georg Gottleuber Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251121142623.251118-3-ggo@tuxedocomputers.com commit ee4f232dd1ff8e11a18c6dab6f7a3a89eee62436 Author: Ettore Chimenti Date: Fri Nov 21 15:26:13 2025 +0100 dt-bindings: vendor-prefixes: Add ASL Xiamen Technology ASL Xiamen Technology Co. Ltd. is a Chinese high-speed interface and display system chip design company. Adding it to the vendor prefixes. Link: https://www.asl-tek.com/ Signed-off-by: Ettore Chimenti Signed-off-by: Georg Gottleuber Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251121142623.251118-2-ggo@tuxedocomputers.com commit 706cc5a93698195fea818ca056632a27a8e5515a Author: Nirbhay Sharma Date: Sat Nov 15 11:46:47 2025 +0530 staging: greybus: uart: check return values during probe Check the return values of send_control() and send_line_coding() during device initialization in gb_uart_probe(). If these operations fail, the device will be left in an inconsistent state, so propagate the error to properly fail the probe. Both functions call gb_operation_sync() which can fail with errors such as -ENOMEM, -ENODEV, or -ETIMEDOUT. Ignoring these errors means the TTY device would be registered despite incomplete initialization. Signed-off-by: Nirbhay Sharma Link: https://patch.msgid.link/20251115061646.160847-2-nirbhay.lkd@gmail.com Signed-off-by: Greg Kroah-Hartman commit 47d3949a9b04cbcb0e10abae30c2b53e98706e11 Author: Jianglei Nie Date: Wed Nov 12 20:22:07 2025 +0100 staging: fbtft: core: fix potential memory leak in fbtft_probe_common() fbtft_probe_common() allocates a memory chunk for "info" with fbtft_framebuffer_alloc(). When "display->buswidth == 0" is true, the function returns without releasing the "info", which will lead to a memory leak. Fix it by calling fbtft_framebuffer_release() when "display->buswidth == 0" is true. Fixes: c296d5f9957c ("staging: fbtft: core support") Signed-off-by: Jianglei Nie Signed-off-by: Andy Shevchenko Acked-by: Abdun Nihaal Link: https://patch.msgid.link/20251112192235.2088654-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e6ab504633e4c06e35377ecf3c8cbc304de79858 Author: Dave Penkler Date: Mon Nov 17 15:40:21 2025 +0100 staging: gpib: Destage gpib Move the gpib drivers out of staging and into the "real" part of the kernel. This entails: - Remove the gpib Kconfig menu and Makefile build rule from staging. - Remove gpib/uapi from the header file search path in subdir-ccflags of the gpib Makefile - move the gpib/uapi files to include/uapi/linux - Move the gpib tree out of staging to drivers. - Remove the word "Linux" from the gpib Kconfig file. - Add the gpib Kconfig menu and Makefile build rule to drivers Signed-off-by: Dave Penkler Link: https://patch.msgid.link/20251117144021.23569-5-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit a64ff10ca69bd3d6f056fdf5fcf80922fa9a4492 Author: Dave Penkler Date: Mon Nov 17 15:40:20 2025 +0100 staging: gpib: Fix SPDX license for gpib headers As part destaging the gpib drivers we need to add the WITH Linux-syscall-note to the SPDX license in the gpib common includes as these will be part of the kernel headers. Signed-off-by: Dave Penkler Link: https://patch.msgid.link/20251117144021.23569-4-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit 46e68568c18435795c7e6d74464c8096b752fc93 Author: Dave Penkler Date: Mon Nov 17 15:40:19 2025 +0100 staging: gpib: Update TODO file The comments have now been fixed so remove the item about comments from the TODO file. Signed-off-by: Dave Penkler Link: https://patch.msgid.link/20251117144021.23569-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit b6167146483eee3bf346d21f568879ad1a199e1b Author: Dave Penkler Date: Mon Nov 17 15:40:18 2025 +0100 staging: gpib: Change // comments in uapi header file A ppc64 randconfig build complained about the // comments in the uapi header file: error: // comments are not allowed in this language [-Werror,-Wcomment] Change the // comments to /* */ format. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511141203.sbp27oAR-lkp@intel.com/ Signed-off-by: Dave Penkler Link: https://patch.msgid.link/20251117144021.23569-2-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit 377441d53a2df61b105e823b335010cd4f1a6e56 Author: Dinh Nguyen Date: Fri Nov 14 12:58:13 2025 -0600 firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Fix this warning that was generated from "make htmldocs": WARNING: drivers/firmware/stratix10-svc.c:58 struct member 'intel_svc_fcs' not described in 'stratix10_svc' Fixes: e6281c26674e ("firmware: stratix10-svc: Add support for FCS") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251106145941.37920e97@canb.auug.org.au/ Signed-off-by: Dinh Nguyen Link: https://patch.msgid.link/20251114185815.358423-1-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman commit 935419b9fb74ab2643583fce750cb774c9b5faa6 Author: Dinh Nguyen Date: Fri Nov 14 12:58:15 2025 -0600 firmware: stratix10-svc: fix make htmldocs warning Stephen Rothwell reports htmldocs warnings when merging char-misc tree: WARNING: include/linux/firmware/intel/stratix10-svc-client.h:22 This comment starts with '/**', but isn't a kernel-doc comment. WARNING: include/linux/firmware/intel/stratix10-svc-client.h:184 Enum value 'COMMAND_HWMON_READTEMP' not described in enum 'stratix10_svc_command_code' WARNING: include/linux/firmware/intel/stratix10-svc-client.h:184 Enum value 'COMMAND_HWMON_READVOLT' not described in enum 'stratix10_svc_command_code' WARNING: include/linux/firmware/intel/stratix10-svc-client.h:307 function parameter 'cb_arg' not described in 'async_callback_t' Fixes: 4f49088c1625 ("firmware: stratix10-svc: Add definition for voltage and temperature sensor") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251114153920.1c5df700@canb.auug.org.au/ Signed-off-by: Dinh Nguyen Link: https://patch.msgid.link/20251114185815.358423-3-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman commit 36b1cb4f33e77eae456e33c72534b9c7917c4a07 Author: Dinh Nguyen Date: Fri Nov 14 12:58:14 2025 -0600 firmware: stratix-svc: fix make htmldocs warning Stephen Rothwell reports htmldocs warnings when merging char-misc tree: WARNING: drivers/firmware/stratix10-svc.c:58 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Total number of transaction IDs, which is a combination of WARNING: drivers/firmware/stratix10-svc.c:302 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * svc_mem_lock protects access to the svc_data_mem list for Fixes: bcb9f4f07061 ("firmware: stratix10-svc: Add support for async communication") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251114153347.16001109@canb.auug.org.au/ Signed-off-by: Dinh Nguyen Link: https://patch.msgid.link/20251114185815.358423-2-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman commit 54e3eae855629702c566bd2e130d9f40e7f35bde Merge: 7a0eae4d43d265 52ba807f1aa6ac Author: Miguel Ojeda Date: Mon Nov 24 17:16:04 2025 +0100 Merge patch series "`syn` support" This patch series introduces support for `syn` (and its dependencies): Syn is a parsing library for parsing a stream of Rust tokens into a syntax tree of Rust source code. Currently this library is geared toward use in Rust procedural macros, but contains some APIs that may be useful more generally. It is the most downloaded Rust crate (according to crates.io), and it is also used by the Rust compiler itself. Having such support allows to greatly simplify writing complex macros such as `pin-init`. We will use it in the `macros` crate too. Benno has already prepared the `pin-init` version based on this, and on top of that, we will be able to simplify the `macros` crate too. I think Jesung is working on updating the `TryFrom` and `Into` upcoming derive macros to use `syn` too. The series starts with a few preparation commits (two fixes were already merged in mainline that were discovered by this series), then each crate is added. Finally, support for using the new crates from our `macros` crate is introduced. This has been a long time coming, e.g. even before Rust for Linux was merged into the Linux kernel, Gary and Benno have wanted to use `syn`. The first iterations of this, from 2022 and 2023 (with `serde` too, another popular crate), are at: https://github.com/Rust-for-Linux/linux/pull/910 https://github.com/Rust-for-Linux/linux/pull/1007 After those, we considered picking these from the distributions where possible. However, after discussing it, it is not really worth the complexity: vendoring makes things less complex and is less fragile. In particular, we avoid having to support and test several versions, we avoid having to introduce Cargo just to properly fetch the right versions from the registry, we can easily customize the crates if needed (e.g. dropping the `unicode_idents` dependency like it is done in this series) and we simplify the configuration of the build for users for which the "default" paths/registries would not have worked. Moreover, nowadays, the ~57k lines introduced are not that much compared to years ago (it dwarfed the actual Rust kernel code). Moreover, back then it wasn't clear the Rust experiment would be a success, so it would have been a bit pointless/risky to add many lines for nothing. Our macro needs were also smaller in the early days. So, finally, in Kangrejos 2025 we discussed going with the original, simpler approach. Thus here it is the result. There should not be many updates needed for these, and even if there are, they should not be too big, e.g. +7k -3k lines across the 3 crates in the last year. Note that `syn` does not have all the features enabled, since we do not need them so far, but they can easily be enabled just adding them to the list. Link: https://patch.msgid.link/20251124151837.2184382-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 3e92fdae7fa4e88466dbb0c21dbb0a9660962da9 Merge: ac4b8282bba626 60b52af082b146 Author: Greg Kroah-Hartman Date: Mon Nov 24 17:35:12 2025 +0100 Merge tag 'icc-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.19 This pull request contains the interconnect changes for the 6.19-rc1 merge window. The core and driver changes are listed below. Core changes: - kbps_to_icc() macro optimization Driver changes: - Switch all Qualcomm RPMh interconnect drivers to use the dynamic node IDs and drop support for non-dynamic ID allocation - Add new driver and BWMON support for the Kaanapali SoC - Add QoS support for the SM6350 SoC - Add QoS support for the SA8775p SoC - Fix missing link from SNOC_PNOC to the USB 2 on MSM8996 SoC that includes also a dts change that has been acked by the maintainer - Drop the QPIC interconnect and BCM nodes for the SDX75 SoC, as these should be handled by the rpmh-clk driver - Other misc fixes Signed-off-by: Georgi Djakov * tag 'icc-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: (40 commits) interconnect: qcom: sm6350: enable QoS configuration interconnect: qcom: sm6350: Remove empty BCM arrays interconnect: qcom: icc-rpmh: Get parent's regmap for nested NoCs dt-bindings: interconnect: qcom,sm6350-rpmh: Add clocks for QoS dt-bindings: interconnect: qcom-bwmon: Document Kaanapali BWMONs interconnect: qcom: icc-rpmh: drop support for non-dynamic IDS interconnect: qcom: sm8750: convert to dynamic IDs interconnect: qcom: sm8650: convert to dynamic IDs interconnect: qcom: sm8550: convert to dynamic IDs interconnect: qcom: sm8450: convert to dynamic IDs interconnect: qcom: sm8350: convert to dynamic IDs interconnect: qcom: sm8150: convert to dynamic IDs interconnect: qcom: sm7150: convert to dynamic IDs interconnect: qcom: sm6350: convert to dynamic IDs interconnect: qcom: sdx75: convert to dynamic IDs interconnect: qcom: sdx65: convert to dynamic IDs interconnect: qcom: sdx55: convert to dynamic IDs interconnect: qcom: sdm670: convert to dynamic IDs interconnect: qcom: sc7180: convert to dynamic IDs interconnect: qcom: sar2130p: convert to dynamic IDs ... commit ac4b8282bba62616532f7cb8c36c8fef7bd3ab94 Merge: fb64bf48069136 9e9182cab5ebc3 Author: Greg Kroah-Hartman Date: Mon Nov 24 17:34:19 2025 +0100 Merge tag 'coresight-next-v6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for Linux v6.19 The changes for Linux v6.19 include : - Support for static TPDM - Fixes to TMC-ETR with CATU where buffer wasn't available to CATU in perf mode - Clean ups to the component operations to accept coresight_path - Fixes to the ETM4x/ETM3x driver Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/coresight/linux: coresight: etm4x: Remove the state_needs_restore flag coresight: etm4x: Remove the redundant DSB coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF coresight: etm4x: Add context synchronization before enabling trace coresight: etm4x: Correct polling IDLE bit coresight: etm3x: Always set tracer's device mode on target CPU coresight: etm4x: Always set tracer's device mode on target CPU coresight: Change device mode to atomic type coresight: change the sink_ops to accept coresight_path coresight: change helper_ops to accept coresight_path coresight: tmc: add the handle of the event to the path coresight: tpdm: remove redundant check for drvdata coresight: tpdm: add static tpdm support dt-bindings: arm: document the static TPDM compatible coresight: ETR: Fix ETR buffer use-after-free issue commit 52ba807f1aa6ac16289e9dc9e381475305afd685 Author: Miguel Ojeda Date: Mon Nov 24 16:18:32 2025 +0100 rust: macros: support `proc-macro2`, `quote` and `syn` One of the two main uses cases for adding `proc-macro2`, `quote` and `syn` is the `macros` crates (and the other `pin-init`). Thus add the support for the crates in `macros` already. Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-21-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 737401751ace2d806de6854aee52c176141d10e2 Author: Miguel Ojeda Date: Mon Nov 24 16:18:31 2025 +0100 rust: syn: enable support in kbuild With all the new files in place and ready from the new crate, enable the support for it in the build system. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-20-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 1112ba865526588007f2e415da96d0df335f5bf8 Author: Miguel Ojeda Date: Mon Nov 24 16:18:30 2025 +0100 rust: syn: add `README.md` Originally, when the Rust upstream `alloc` standard library crate was vendored in commit 057b8d257107 ("rust: adapt `alloc` crate to the kernel"), a `README.md` file was added to explain the provenance and licensing of the source files. Thus do the same for the `syn` crate. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-19-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit a3ee13024cab545b34a2a3a0bf5d5a763dba0979 Author: Miguel Ojeda Date: Mon Nov 24 16:18:29 2025 +0100 rust: syn: remove `unicode-ident` dependency The `syn` crate depends on the `unicode-ident` crate to determine whether characters have the XID_Start or XID_Continue properties according to Unicode Standard Annex #31. However, we only need ASCII identifiers in the kernel, thus we can simplify the check and remove completely that dependency. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-18-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 69942c0a8965f311ed7ddf842f160c9cfdcda73a Author: Miguel Ojeda Date: Mon Nov 24 16:18:28 2025 +0100 rust: syn: add SPDX License Identifiers Originally, when the Rust upstream `alloc` standard library crate was vendored in commit 057b8d257107 ("rust: adapt `alloc` crate to the kernel"), the SPDX License Identifiers were added to every file so that the license on those was clear. Thus do the same for the `syn` crate. This makes `scripts/spdxcheck.py` pass. Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-17-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 808c999fc9e7c366fd47da564e69d579c1dc8279 Author: Miguel Ojeda Date: Mon Nov 24 16:18:27 2025 +0100 rust: syn: import crate This is a subset of the Rust `syn` crate, version 2.0.106 (released 2025-08-16), licensed under "Apache-2.0 OR MIT", from: https://github.com/dtolnay/syn/raw/2.0.106/src The files are copied as-is, with no modifications whatsoever (not even adding the SPDX identifiers). For copyright details, please see: https://github.com/dtolnay/syn/blob/2.0.106/README.md#license https://github.com/dtolnay/syn/blob/2.0.106/LICENSE-APACHE https://github.com/dtolnay/syn/blob/2.0.106/LICENSE-MIT The next two patches modify these files as needed for use within the kernel. This patch split allows reviewers to double-check the import and to clearly see the differences introduced. The following script may be used to verify the contents: for path in $(cd rust/syn/ && find . -type f -name '*.rs'); do curl --silent --show-error --location \ https://github.com/dtolnay/syn/raw/2.0.106/src/$path \ | diff --unified rust/syn/$path - && echo $path: OK done Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-16-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 88de91cc1ce7b3069ccabc1a5fbe16d41c663093 Author: Miguel Ojeda Date: Mon Nov 24 16:18:26 2025 +0100 rust: quote: enable support in kbuild With all the new files in place and ready from the new crate, enable the support for it in the build system. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-15-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 51177f023ce82c6d7d59bc5c64d94eea317d445d Author: Miguel Ojeda Date: Mon Nov 24 16:18:25 2025 +0100 rust: quote: add `README.md` Originally, when the Rust upstream `alloc` standard library crate was vendored in commit 057b8d257107 ("rust: adapt `alloc` crate to the kernel"), a `README.md` file was added to explain the provenance and licensing of the source files. Thus do the same for the `quote` crate. Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-14-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit ddfa1b279d088edfb059b6936919faf2070fdd14 Author: Miguel Ojeda Date: Mon Nov 24 16:18:24 2025 +0100 rust: quote: add SPDX License Identifiers Originally, when the Rust upstream `alloc` standard library crate was vendored in commit 057b8d257107 ("rust: adapt `alloc` crate to the kernel"), the SPDX License Identifiers were added to every file so that the license on those was clear. Thus do the same for the `quote` crate. This makes `scripts/spdxcheck.py` pass. Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-13-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit a4851eeef3e7cbcd89b5fd0234c04ce408a9ae81 Author: Miguel Ojeda Date: Mon Nov 24 16:18:23 2025 +0100 rust: quote: import crate This is a subset of the Rust `quote` crate, version 1.0.40 (released 2025-03-12), licensed under "Apache-2.0 OR MIT", from: https://github.com/dtolnay/quote/raw/1.0.40/src The files are copied as-is, with no modifications whatsoever (not even adding the SPDX identifiers). For copyright details, please see: https://github.com/dtolnay/quote/blob/1.0.40/README.md#license https://github.com/dtolnay/quote/blob/1.0.40/LICENSE-APACHE https://github.com/dtolnay/quote/blob/1.0.40/LICENSE-MIT The next patch modifies these files as needed for use within the kernel. This patch split allows reviewers to double-check the import and to clearly see the differences introduced. The following script may be used to verify the contents: for path in $(cd rust/quote/ && find . -type f -name '*.rs'); do curl --silent --show-error --location \ https://github.com/dtolnay/quote/raw/1.0.40/src/$path \ | diff --unified rust/quote/$path - && echo $path: OK done Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-12-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 158a3b72118a4dab7e7bf2d89afbab9b96eddc1c Author: Miguel Ojeda Date: Mon Nov 24 16:18:22 2025 +0100 rust: proc-macro2: enable support in kbuild With all the new files in place and ready from the new crate, enable the support for it in the build system. `proc_macro_byte_character` and `proc_macro_c_str_literals` were stabilized in Rust 1.79.0 [1] and were implemented earlier than our minimum Rust version (1.78) [2][3]. Thus just enable them instead of using the `cfg` that `proc-macro2` uses to emulate them in older compilers. In addition, skip formatting for this vendored crate and take the chance to add a comment mentioning this. Link: https://github.com/rust-lang/rust/pull/123431 [1] Link: https://github.com/rust-lang/rust/pull/112711 [2] Link: https://github.com/rust-lang/rust/pull/119651 [3] Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-11-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit bc1565efc358553d7be23a09fe012560402b7151 Author: Miguel Ojeda Date: Mon Nov 24 16:18:21 2025 +0100 rust: proc-macro2: add `README.md` Originally, when the Rust upstream `alloc` standard library crate was vendored in commit 057b8d257107 ("rust: adapt `alloc` crate to the kernel"), a `README.md` file was added to explain the provenance and licensing of the source files. Thus do the same for the `proc-macro2` crate. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-10-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit c2af0e5f02b9aebfc53987c6e935d266101f0ce9 Author: Miguel Ojeda Date: Mon Nov 24 16:18:20 2025 +0100 rust: proc-macro2: remove `unicode_ident` dependency The `proc-macro2` crate depends on the `unicode-ident` crate to determine whether characters have the XID_Start or XID_Continue properties according to Unicode Standard Annex #31. However, we only need ASCII identifiers in the kernel, thus we can simplify the check and remove completely that dependency. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-9-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit a9acfceb9614f18d799c135bbb225bd0f55a81ab Author: Miguel Ojeda Date: Mon Nov 24 16:18:19 2025 +0100 rust: proc-macro2: add SPDX License Identifiers Originally, when the Rust upstream `alloc` standard library crate was vendored in commit 057b8d257107 ("rust: adapt `alloc` crate to the kernel"), the SPDX License Identifiers were added to every file so that the license on those was clear. Thus do the same for the `proc-macro2` crate. This makes `scripts/spdxcheck.py` pass. Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-8-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 3a8b546a2786e54fbfff4d368ae45e65e1e43d21 Author: Miguel Ojeda Date: Mon Nov 24 16:18:18 2025 +0100 rust: proc-macro2: import crate This is a subset of the Rust `proc-macro2` crate, version 1.0.101 (released 2025-08-16), licensed under "Apache-2.0 OR MIT", from: https://github.com/dtolnay/proc-macro2/raw/1.0.101/src The files are copied as-is, with no modifications whatsoever (not even adding the SPDX identifiers). For copyright details, please see: https://github.com/dtolnay/proc-macro2/blob/1.0.101/README.md#license https://github.com/dtolnay/proc-macro2/blob/1.0.101/LICENSE-APACHE https://github.com/dtolnay/proc-macro2/blob/1.0.101/LICENSE-MIT The next two patches modify these files as needed for use within the kernel. This patch split allows reviewers to double-check the import and to clearly see the differences introduced. The following script may be used to verify the contents: for path in $(cd rust/proc-macro2/ && find . -type f -name '*.rs'); do curl --silent --show-error --location \ https://github.com/dtolnay/proc-macro2/raw/1.0.101/src/$path \ | diff --unified rust/proc-macro2/$path - && echo $path: OK done Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-7-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit c46b34f1d484c11c2a0cbd663168c2213175ca5c Author: Miguel Ojeda Date: Mon Nov 24 16:18:17 2025 +0100 rust: kbuild: support using libraries in `rustc_procmacro` Proc macros such as `macros` and `pin-init` will need the ability to use libraries such as `syn` (added later) in the `rustc_procmacro` command. Thus add the support for it. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-6-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit d4e7307b1f3535c19ff6ca24d3e4aec32cebb120 Author: Miguel Ojeda Date: Mon Nov 24 16:18:16 2025 +0100 rust: kbuild: support skipping flags in `rustc_test_library` Crates like `quote` (added later) will need the ability to skip flags in the `rustc_test_library` command. Thus add the support for it. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-5-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 7dbe46c0b11dded16cf9c5f85c1a3f260422cee5 Author: Miguel Ojeda Date: Mon Nov 24 16:18:15 2025 +0100 rust: kbuild: add proc macro library support Add the proc macro library rule that produces `.rlib` files to be used by proc macros such as the `macros` crate. Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-4-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 1181c974421818ff7318e3a211c87b5dd437c13e Author: Miguel Ojeda Date: Mon Nov 24 16:18:14 2025 +0100 rust: kbuild: simplify `--cfg` handling We need to handle `cfg`s in both `rustc` and `rust-analyzer`, and in future commits some of those contain double quotes, which complicates things further. Thus, instead of removing the `--cfg ` part in the rust-analyzer generation script, have the `*-cfgs` variables contain just the actual `cfg`, and use that to generate the actual flags in `*-flags`. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-3-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 46e58a9637ec6493b142b788595eed627b4973b7 Author: Miguel Ojeda Date: Mon Nov 24 16:18:13 2025 +0100 rust: kbuild: introduce `core-flags` and `core-skip_flags` In the next commits we are introducing `*-{cfgs,skip_flags,flags}` variables for other crates. Thus do so here for `core`, which simplifies a bit the `Makefile` (including the next commit) and makes it more consistent. This means we stop passing `-Wrustdoc::unescaped_backticks` to `rustc` and `-Wunreachable_pub` to `rustdoc`, i.e. we skip more, which is fine since it shouldn't have an effect. In addition, use `:=` for `core-cfgs` to make it consistent with the upcoming additions. Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Tested-by: Gary Guo Tested-by: Jesung Yang Link: https://patch.msgid.link/20251124151837.2184382-2-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 69acbdbbefbda7b7b32faa706a8f68c399c9e47b Author: Nikolay Borisov Date: Mon Nov 24 16:25:17 2025 +0200 RAS/AMD/ATL: Replace bitwise_xor_bits() with hweight16() Doing hweight16() and checking whether the lsb is set is functionally equivalent to what bitwise_xor_bits() does. In addition, it results in better generated code as before gcc would inline the function 4 times. With hweight16(), the resulting code boils down to 2 instructions - POPCNT and AND, and all relevant CPUs support POPCNT. An alternative would have been to use the __builtin_parity() function provided by both Clang/GCC, however under some circumstances the compiler can choose not to inline it but generate a library call which is unsupported in the kernel. No functional changes. [ bp: Massage commit message. ] Signed-off-by: Nikolay Borisov Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251124142517.1708451-1-nik.borisov@suse.com commit e6a27290d8001538fec94e91ff8c7f956ee7e3e5 Author: James Clark Date: Tue Nov 11 11:37:56 2025 +0000 perf: arm_spe: Add support for filtering on data source SPE_FEAT_FDS adds the ability to filter on the data source of packets. Like the other existing filters, enable filtering with PMSFCR_EL1.FDS when any of the filter bits are set. Each bit position of the 64 bit filter maps to numerical data sources 0-63 described by bits[0:5] in the data source packet (although the full range of data source is 16 bits so higher value data sources can't be filtered on). The filter is an OR of all the filter bits, so for example clearing filter bits 0 and 3 only includes packets from data sources 0 OR 3. Invert the filter given by userspace so that the default value of 0 is equivalent to including all values (no filtering). This allows us to skip adding a new format bit to enable filtering and still support excluding all data sources which would have been a filter value of 0 if not for the inversion. Tested-by: Leo Yan Reviewed-by: Leo Yan Signed-off-by: James Clark Signed-off-by: Will Deacon commit cbbfba4847b8a5299d36e002bf864b21bb83295d Author: James Clark Date: Tue Nov 11 11:37:55 2025 +0000 perf: Add perf_event_attr::config4 Arm FEAT_SPE_FDS adds the ability to filter on the data source of a packet using another 64-bits of event filtering control. As the existing perf_event_attr::configN fields are all used up for SPE PMU, an additional field is needed. Add a new 'config4' field. Reviewed-by: Leo Yan Tested-by: Leo Yan Reviewed-by: Ian Rogers Acked-by: Peter Zijlstra (Intel) Signed-off-by: James Clark Signed-off-by: Will Deacon commit 7a0eae4d43d265c56e9d0b136ec08e35b83525b8 Author: Alex Gaynor Date: Sun Oct 26 10:29:52 2025 -0400 MAINTAINERS: Remove Alex Gaynor as Rust maintainer I've long since stopped having the time to contribute code or reviews, this acknowledges that. Geoffrey Thomas and I created the "linux-kernel-module-rust" project at PyCon in 2018, as an experiment to see if we could make it possible to write kernel modules in Rust. The Rust for Linux effort has far exceeded anything we could have expected at the time. I want to thank all the Rust for Linux contributors, past and present, who have helped make this a reality -- and in particularly Miguel, who really transformed this project from an interesting demo to something that could really land in mainline. Signed-off-by: Alex Gaynor Link: https://patch.msgid.link/CAFRnB2U1uvg1vyZe1kDi7L3P4kTFowfOo6Hfo9WJED4qve4ZZw@mail.gmail.com [ Reflowed. - Miguel ] Signed-off-by: Miguel Ojeda commit f3f9f42232dee596d15491ca3f611d02174db49c Author: Zheng Yejian Date: Fri Oct 11 22:38:53 2024 +0800 kallsyms: Fix wrong "big" kernel symbol type read from procfs Currently when the length of a symbol is longer than 0x7f characters, its type shown in /proc/kallsyms can be incorrect. I found this issue when reading the code, but it can be reproduced by following steps: 1. Define a function which symbol length is 130 characters: #define X13(x) x##x##x##x##x##x##x##x##x##x##x##x##x static noinline void X13(x123456789)(void) { printk("hello world\n"); } 2. The type in vmlinux is 't': $ nm vmlinux | grep x123456 ffffffff816290f0 t x123456789x123456789x123456789x12[...] 3. Then boot the kernel, the type shown in /proc/kallsyms becomes 'g' instead of the expected 't': # cat /proc/kallsyms | grep x123456 ffffffff816290f0 g x123456789x123456789x123456789x12[...] The root cause is that, after commit 73bbb94466fd ("kallsyms: support "big" kernel symbols"), ULEB128 was used to encode symbol name length. That is, for "big" kernel symbols of which name length is longer than 0x7f characters, the length info is encoded into 2 bytes. kallsyms_get_symbol_type() expects to read the first char of the symbol name which indicates the symbol type. However, due to the "big" symbol case not being handled, the symbol type read from /proc/kallsyms may be wrong, so handle it properly. Cc: stable@vger.kernel.org Fixes: 73bbb94466fd ("kallsyms: support "big" kernel symbols") Signed-off-by: Zheng Yejian Acked-by: Gary Guo Link: https://patch.msgid.link/20241011143853.3022643-1-zhengyejian@huaweicloud.com Signed-off-by: Miguel Ojeda commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 Author: Slark Xiao Date: Tue Nov 18 14:45:28 2025 +0800 USB: serial: option: add Foxconn T99W760 T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag. test evidence as below: T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXBAAGHA-IDP _SN:39A8D3E4 S: SerialNumber=39a8d3e4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms 0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag Signed-off-by: Slark Xiao Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 11abb4e87b0e6afd4e4c0876d1008ddd9256a33c Author: Joakim Zhang Date: Mon Nov 3 16:48:31 2025 -0500 perf/imx_ddr: Add support for PMU in DB (system interconnects) There is a PMU in DB, which has the same function with PMU in DDR subsystem, the difference is PMU in DB only supports cycles, axid-read, axid-write events. e.g. perf stat -a -e imx8_db0/axid-read,axi_mask=0xMMMM,axi_id=0xDDDD,axi_port=0xPP,axi_channel=0xH/ cmd perf stat -a -e imx8_db0/axid-write,axi_mask=0xMMMM,axi_id=0xDDDD,axi_port=0xPP,axi_channel=0xH/ cmd Signed-off-by: Joakim Zhang Signed-off-by: Frank Li Signed-off-by: Will Deacon commit 037e8cf671780426254fbacdca80d1d01c806844 Author: Frank Li Date: Mon Nov 3 16:48:30 2025 -0500 perf/imx_ddr: Get and enable optional clks Get and enable optional clks because fsl,imx8dxl-db-pmu have two clocks. Signed-off-by: Frank Li Signed-off-by: Will Deacon commit 66db99ffdfcb034d6fae212f2f473a82a842795f Author: Frank Li Date: Mon Nov 3 16:48:29 2025 -0500 perf/imx_ddr: Move ida_alloc() from ddr_perf_init() to ddr_perf_probe() Move ida_alloc() from helper ddr_perf_init() into ddr_perf_probe() to clarify why ida_free() must be called at the error path. Add return value check for ida_alloc(). Rename label 'cpuhp_state_err' to 'idr_free' to make the code clearer, since two error paths now jump to this label. Signed-off-by: Frank Li Signed-off-by: Will Deacon commit de8209e55408d8dbb1e14cc90da3f63b85ea4d36 Author: Frank Li Date: Mon Nov 3 16:48:28 2025 -0500 dt-bindings: perf: fsl-imx-ddr: Add compatible string for i.MX8QM, i.MX8QXP and i.MX8DXL Add compatible string fsl,imx8qm-ddr-pmu, fsl,imx8qxp-ddr-pmu, which fallback to fsl,imx8-ddr-pmu and fsl,imx8dxl-db-pmu (for data bus fabric). Add clocks, clock-names for fsl,imx8dxl-db-pmu and keep the same restriction for existing compatible strings. Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Signed-off-by: Will Deacon commit 841f31d298693e82aaa9e7ac09f5fa9c8dcfdbc3 Author: Alexandre Courbot Date: Mon Nov 24 22:50:02 2025 +0900 rust: num: bounded: rename `try_into_bitint` to `try_into_bounded` This is a remnant from when `Bounded` was called `BitInt` which I didn't rename. Fix this. Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type") Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251124-bounded_fix-v1-1-d8e34e1c727f@nvidia.com Signed-off-by: Miguel Ojeda commit cb99656b7c4185953c9d272bbdab63c8aa651e6e Author: Dan Carpenter Date: Mon Nov 24 10:56:01 2025 +0300 spi: Fix potential uninitialized variable in probe() If the device tree is messed up, then potentially the "protocol" string could potentially be uninitialized. The property is supposed to default to "motorola" so if the of_property_read_string() function returns -EINVAL then default to "motorola". Fixes: 059f545832be ("spi: add support for microchip "soft" spi controller") Signed-off-by: Dan Carpenter Reviewed-by: Prajna Rajendra Kumar Link: https://patch.msgid.link/aSQPkfkiJ0w-FJMW@stanley.mountain Signed-off-by: Mark Brown commit a9f349e3c0bebe7ae97750b32a72f452bdf707e2 Author: Andy Shevchenko Date: Thu Nov 20 09:31:40 2025 +0100 lib/vsprintf: Unify FORMAT_STATE_NUM handlers We have two almost identical pieces that handle FORMAT_STATE_NUM case. The differences are: - redundant {} for one-line if-else conditional - missing blank line after variable definitions - inverted conditional Unify the style of two. Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20251120083140.3478507-1-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 66e7c1e0ee08cfb6db64f8f3f6e5a3cc930145c8 Author: John Ogness Date: Fri Nov 21 11:26:00 2025 +0106 printk: Avoid irq_work for printk_deferred() on suspend With commit ("printk: Avoid scheduling irq_work on suspend") the implementation of printk_get_console_flush_type() was modified to avoid offloading when irq_work should be blocked during suspend. Since printk uses the returned flush type to determine what flushing methods are used, this was thought to be sufficient for avoiding irq_work usage during the suspend phase. However, vprintk_emit() implements a hack to support printk_deferred(). In this hack, the returned flush type is adjusted to make sure no legacy direct printing occurs when printk_deferred() was used. Because of this hack, the legacy offloading flushing method can still be used, causing irq_work to be queued when it should not be. Adjust the vprintk_emit() hack to also consider @console_irqwork_blocked so that legacy offloading will not be chosen when irq_work should be blocked. Link: https://lore.kernel.org/lkml/87fra90xv4.fsf@jogness.linutronix.de Signed-off-by: John Ogness Fixes: 26873e3e7f0c ("printk: Avoid scheduling irq_work on suspend") Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek commit 0cc8cd824b9fb7fb087a2ec6b0c80d812cc4fde7 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:32 2025 +0200 spi: rzv2h-rspi: add support for RZ/T2H and RZ/N2H Compared to the previously supported RZ/V2H, the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a smaller FIFO, no resets, and only two clocks: PCLKSPIn and PCLK. PCLKSPIn, being the clock from which the SPI transfer clock is generated, is the equivalent of the TCLK clock from RZ/V2H. They also support generating the SPI transfer clock from PCLK. PCLKSPIn supports multiple dividers, generating multiple possible frequencies from its parent. To handle this, do the following changes. Use the minimum frequency of SPI clock to calculate the SPI controller's min_speed_hz, and the maximum frequency to calculate max_speed_hz. Add a new function, rzv2h_rspi_find_rate_variable(), which is used for the .find_tclk_rate() callback, and which supports handling clocks with a variable rate, with the following overall logic. Iterate through all possible BRDV values. For each BRDV, calculate two different SPRs, one for the clock's minimum frequency, and one for the maxmimum, and iterate through each SPR between them. If the minimum SPR is higher than the upper SPR limit, the minimum rate is too high to achieve the requested SPI frequency, skip to the next BRDV. For each SPR, calculate a rate and let the clock framework round it to the closest supported rate of the clock. The rate and SPR that generate a transfer frequency closest to the requested SPI transfer frequency will be picked. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-12-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit e93d7b2d8b349f659fa9456048ee86e10eb422f9 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:31 2025 +0200 spi: dt-bindings: renesas,rzv2h-rspi: document RZ/T2H and RZ/N2H The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have four SPI peripherals. Compared to the previously supported RZ/V2H, these SoCs have a smaller FIFO, no resets, and only two clocks: PCLKSPIn and PCLK. PCLKSPIn, being the clock from which the SPI transfer clock is generated, is the equivalent of the TCLK from V2H. Document them, and use RZ/T2H as a fallback for RZ/N2H as the SPIs are entirely compatible. Signed-off-by: Cosmin Tanislav Acked-by: Conor Dooley Link: https://patch.msgid.link/20251119161434.595677-11-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit bc4f0b1e39035b9bb3d5d9692074702110f5e2b1 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:30 2025 +0200 spi: rzv2h-rspi: add support for loopback mode Add support for loopback mode for debugging purposes, allowing us to test the SPI controller at the maximum SPI transfer clock without being limited by external wiring. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-10-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 9c9bf4fdc5e5d09d5f4280ed2c582df6e1f837d9 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:29 2025 +0200 spi: rzv2h-rspi: add support for variable transfer clock The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a more complicated clocking setup for the SPI transfer clock than RZ/V2H, as the clock from which it is generated supports multiple dividers. To prepare for adding support for these SoCs, do the following changes. Use the minimum frequency of SPI clock to calculate the SPI controller's min_speed_hz, and the maximum frequency to calculate max_speed_hz. Apply the clock rate found by the .find_tclk_rate() to the found clock. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-9-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 1ce3e8adc7d0038e59a7c9f5c9e5f399ba0db5d6 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:28 2025 +0200 spi: rzv2h-rspi: add support for using PCLK for transfer clock The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs support generating the SPI transfer clock from PCLK, with the quirk that SPR 0 is not supported, causing the highest achievable SPI transfer frequency to be 31.25MHz. Add support for generating the SPI transfer clock from PCLK. Renesas RZ/V2H (R9A09G057) also has the BPEN bit used to enable this option in the datasheet, but it is not explicitly documented and there's no details about its limitations as there are on RZ/T2H. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-8-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 77d931584dd38916b66c65320c80a65cbef4b122 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:27 2025 +0200 spi: rzv2h-rspi: make transfer clock rate finding chip-specific The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a more complicated clocking setup for the SPI transfer clock than RZ/V2H, as the clock from which it is generated supports multiple dividers. To prepare for adding support for these SoCs, split out the logic for finding the SPR and BRDV for a fixed clock into rzv2h_rspi_find_rate_fixed(), and add and use a .find_tclk_rate() callback into the chip-specific structure. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-7-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 88782493204512fcf4e020e2385bca3e3c5bd4c0 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:26 2025 +0200 spi: rzv2h-rspi: avoid recomputing transfer frequency Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a more complicated algorithm for calculating the optimal SPI transfer frequency compared to RZ/V2H, as the clock from which the SPI frequency is generated supports multiple dividers. Cache the requested transfer frequency and skip calling rzv2h_rspi_setup_clock() if it matches the last used one to prepare for adding support for variable clock frequency handling. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-6-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 1b7ce968ab2579702ea9dbc2fb599e540bbd8c88 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:25 2025 +0200 spi: rzv2h-rspi: move register writes out of rzv2h_rspi_setup_clock() In preparation for caching the last requested transfer frequency, move register writes outside of rzv2h_rspi_setup_clock(). The transfer list is iterated to determine the speed of the transfer and the bits per word. The speed of the transfer is used to compute SPR and BRDV inside rzv2h_rspi_setup_clock(). BRDV and SPB are stored in the SPCMD register. Move the transfer iteration earlier, move the SPR and BRDV writing out of rzv2h_rspi_setup_clock(), consolidate writing BRDV and SPB into the initial write to the SPCMD register. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-5-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit ebd7d6ae0dc7d65e21460c928519f40ccf95f3b9 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:24 2025 +0200 spi: rzv2h-rspi: make clocks chip-specific The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have different clocks compared to RZ/V2H. Set the number of clocks and the name of the transfer clock in the chip-specific structure to prepare for adding support for them. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-4-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 8e89ee6cd2b928a8431bef61e8b851ce5df1ecb0 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:23 2025 +0200 spi: rzv2h-rspi: make FIFO size chip-specific The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have a different FIFO size compared to RZ/V2H. Add a chip-specific structure, and set the FIFO size inside it, to prepare for adding support for them. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-3-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit aead5ae91e4cbadac817d15737eca3b531237448 Author: Cosmin Tanislav Date: Wed Nov 19 18:14:22 2025 +0200 spi: rzv2h-rspi: make resets optional The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs don't have reset lines for the SPI peripheral, make them optional to prepare for adding support for them. Signed-off-by: Cosmin Tanislav Link: https://patch.msgid.link/20251119161434.595677-2-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Mark Brown commit 53d1548612670aa8b5d89745116cc33d9d172863 Author: Zilin Guan Date: Thu Nov 13 06:24:15 2025 +0000 mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error without freeing sskb, leading to a memory leak. Fix this by calling dev_kfree_skb() on sskb in the error handling path to ensure it is properly released. Fixes: 99c457d902cf9 ("mt76: mt7615: move mt7615_mcu_set_bmc to mt7615_mcu_ops") Signed-off-by: Zilin Guan Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251113062415.103611-1-zilin@seu.edu.cn Signed-off-by: Felix Fietkau commit 066f417be5fd8c7fe581c5550206364735dad7a3 Author: Quan Zhou Date: Tue Nov 18 19:54:54 2025 +0800 wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load Set the MT76_STATE_MCU_RUNNING bit only after mt7921_load_clc() has successfully completed. Previously, the MCU_RUNNING state was set before loading CLC, which could cause conflict between chip mcu_init retry and mac_reset flow, result in chip init fail and chip abnormal status. By moving the state set after CLC load, firmware initialization becomes robust and resolves init fail issue. Signed-off-by: Quan Zhou Reviewed-by: druth@chromium.org Link: https://patch.msgid.link/19ec8e4465142e774f17801025accd0ae2214092.1763465933.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau commit f804a5895ebad2b2d4fb8a3688d2115926e993d5 Author: Mario Limonciello (AMD) Date: Thu Nov 20 09:58:27 2025 -0600 wifi: mt76: Strip whitespace from build ddate On systems I have with mt7925 cards I've been noticing a blank line in my kernel logs. IE: ``` [ 17.294105] mt7925e 0000:c3:00.0: HW/SW Version: 0x8a108a10, Build Time: 20250721232852a [ 17.314233] r8169 0000:c4:00.0 enp196s0f0: Link is Down ``` This is because the build_date from the header has a newline character as does the dev_info() print. As the firmware isn't guaranteed to always have a newline but the print is, copy the firmware build date to a temporary variable and strip any whitespace from it before showing it in the logs. Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251120155829.3494747-1-superm1@kernel.org Signed-off-by: Felix Fietkau commit 7545551631fa63101f97974f49ac0b564814f703 Author: Lorenzo Bianconi Date: Tue Nov 18 10:30:26 2025 +0100 wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Grab the mt76 mutex running mt7996_mac_sta_rc_work() since it is required by mt7996_mcu_add_rate_ctrl routine. Fixes: 28d519d0d493a ("wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl_fixed()") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251118-mt7996-rc-work-missing-mtx-v1-1-0739c493a6cb@kernel.org Signed-off-by: Felix Fietkau commit 2a432a6d0066d4ce05a2d0eec1da9e061eb70c49 Author: Lorenzo Bianconi Date: Sat Nov 15 11:41:00 2025 +0100 wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove mt7996_vif_link_remove routine is executed by mt76_scan_complete() without holding the wiphy mutex triggering the following lockdep warning. WARNING: CPU: 0 PID: 72 at net/mac80211/key.c:1029 ieee80211_iter_keys+0xe4/0x1a0 [mac80211] CPU: 0 UID: 0 PID: 72 Comm: kworker/u32:2 Tainted: G S 6.18.0-rc5+ #27 PREEMPT(full) Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/15/2023 Workqueue: phy3 mt76_scan_work [mt76] RIP: 0010:ieee80211_iter_keys+0xe4/0x1a0 [mac80211] Code: 4c 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b 47 48 be ff ff ff ff 48 8d 78 68 e8 b4 eb 1e e1 85 c0 0f 85 49 ff ff ff 4c 8b ab 90 1a 00 00 48 8d 83 90 RSP: 0018:ffffc900002f7cb0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888127e00ee0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff888127e00788 RDI: ffff88811132b5c8 RBP: ffffffffa0ddf400 R08: 0000000000000001 R09: 000000009dcc1dac R10: 0000000000000001 R11: ffff88811132b5a0 R12: ffffc900002f7d00 R13: ffff8882581e6a80 R14: ffff888127e0afc8 R15: ffff888158832038 FS: 0000000000000000(0000) GS:ffff8884da486000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000030a0fd90 CR3: 0000000002c52004 CR4: 00000000003706f0 Call Trace: ? lock_acquire+0xc2/0x2c0 mt7996_vif_link_remove+0x64/0x2b0 [mt7996e] mt76_put_vif_phy_link+0x41/0x50 [mt76] mt76_scan_complete+0x77/0x100 [mt76] mt76_scan_work+0x2eb/0x3f0 [mt76] ? process_one_work+0x1e5/0x6d0 process_one_work+0x221/0x6d0 worker_thread+0x19a/0x340 ? rescuer_thread+0x450/0x450 kthread+0x108/0x220 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x1c6/0x220 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 irq event stamp: 45471 hardirqs last enabled at (45477): [] __up_console_sem+0x5e/0x70 hardirqs last disabled at (45482): [] __up_console_sem+0x43/0x70 softirqs last enabled at (44500): [] napi_pp_put_page+0xac/0xd0 softirqs last disabled at (44498): [] page_pool_put_unrefed_netmem+0x290/0x3d0 ---[ end trace 0000000000000000 ]--- Fix the issue skipping ieee80211_iter_keys() for scanning links in mt7996_vif_link_remove routine since we have not uploaded any hw keys for these links. Fixes: 04414d7bba78 ("wifi: mt76: mt7996: delete vif keys when requested") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20251115-mt7996-key-iter-link-remove-fix-v1-1-4f3f4e1eaa78@kernel.org Signed-off-by: Felix Fietkau commit 4fe823b9ee0317b04ddc6d9e00fea892498aa0f2 Author: Lorenzo Bianconi Date: Fri Nov 14 14:16:24 2025 +0100 wifi: mt76: mt7996: skip deflink accounting for offchannel links Do not take into account offchannel links for deflink accounting. Fixes: a3316d2fc669f ("wifi: mt76: mt7996: set vif default link_id adding/removing vif links") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-4-259ebf11f654@kernel.org Signed-off-by: Felix Fietkau commit 6aaaaeacf18b2dc2b0f78f241800e0ea680938c7 Author: Lorenzo Bianconi Date: Fri Nov 14 14:16:23 2025 +0100 wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() Move mt76_abort_scan routine out of mt76_reset_device() in order to avoid a possible deadlock since mt76_reset_device routine is running with mt76 mutex help and mt76_abort_scan_complete() can grab mt76 mutex in some cases. Fixes: b36d55610215a ("wifi: mt76: abort scan/roc on hw restart") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-3-259ebf11f654@kernel.org Signed-off-by: Felix Fietkau commit a84b172cca90a3a6b97afac9113daf3bf1b172b3 Author: Lorenzo Bianconi Date: Fri Nov 14 14:16:22 2025 +0100 wifi: mt76: mt7996: move mt7996_update_beacons under mt76 mutex Move mt7996_update_beacons routine inside mt76 mutex critical section in mt7996_mac_reset_work() in order to run mt7996_vif_conf_link() in mt7996_mcu_add_beacon routine. Fixes: f30906c55a400 ("wifi: mt76: mt7996: disable beacons when going offchannel") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-2-259ebf11f654@kernel.org Signed-off-by: Felix Fietkau commit 5a4bcba26e9fbea87507a81ad891e70bb525014f Author: Lorenzo Bianconi Date: Fri Nov 14 14:16:21 2025 +0100 wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() Grab mt76 mutex in mt7996_mac_sta_event routine in order to rely on mt76_dereference() utility macro. Fixes: ecd72f9695e7e ("wifi: mt76: mt7996: Support MLO in mt7996_mac_sta_event()") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-1-259ebf11f654@kernel.org Signed-off-by: Felix Fietkau commit 2ccbea08dddaacb1b9b5573ecce58c31eab3c967 Author: Michael Lo Date: Thu Nov 6 17:21:51 2025 +0800 wifi: mt76: mt7925: ensure the 6GHz A-MPDU density cap from the hardware. Set the 6GHz HE A-MPDU density from the hardware capability instead of a hardcoded value, ensuring accurate capability reporting. Signed-off-by: Michael Lo Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251106092151.1061648-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit a4031fec9d0d230224a7edcefa3368c06c317148 Author: Shayne Chen Date: Thu Nov 6 14:42:03 2025 +0800 wifi: mt76: mt7996: fix EMI rings for RRO The RRO EMI rings only need to be allocated when WED is not active. This patch fixes command timeout issue for the setting of WED off and RRO on. Fixes: 3a29164425e9 ("wifi: mt76: mt7996: Add SW path for HW-RRO v3.1") Co-developed-by: Rex Lu Signed-off-by: Rex Lu Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-12-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit f1e9f369ae42ee433836b24467e645192d046a51 Author: Shayne Chen Date: Thu Nov 6 14:42:02 2025 +0800 wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Pass the correct mt7996_phy to mt7996_run(). Fixes: 0a5df0ec47f7 ("wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during restart") Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-11-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit e11be918d91e7d33ac4bad41dbe666a9abf1cfaa Author: Shayne Chen Date: Thu Nov 6 14:42:01 2025 +0800 wifi: mt76: mt7996: fix MLO set key and group key issues This patch fixes the following key issues: - Pass correct link BSS to mt7996_mcu_add_key(), and use HW beacon protection mode for mt7990 chipset - Do not do group key deletion for GTK and IGTK due to FW design, the delete key command will delete all group keys of a link BSS - For deleting BIGTK, FW adds a new flow, but the "sec->add" field should be filled with "SET_KEY". Note that if BIGTK is not deleted, it will cause beacon decryption issue when switching from an AP interface to a station interface Fixes: 0c45d52276fd ("wifi: mt76: mt7996: fix setting beacon protection keys") Co-developed-by: Allen Ye Signed-off-by: Allen Ye Co-developed-by: Peter Chiu Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251106064203.1000505-10-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 4fb3b4e7d1ca5453c6167816230370afc15f26bf Author: Shayne Chen Date: Thu Nov 6 14:42:00 2025 +0800 wifi: mt76: mt7996: fix MLD group index assignment Fix extender mode and MBSS issues caused by incorrect assignment of the MLD group and remap indices. Fixes: ed01c310eca9 ("wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine") Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-9-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 85cd5534a3f2ec93e7d88713a77df5b4255520df Author: Shayne Chen Date: Thu Nov 6 14:41:59 2025 +0800 wifi: mt76: mt7996: use correct link_id when filling TXD and TXP Obtain the correct link ID and, if needed, switch to the corresponding wcid before populating the TX descriptor and TX payload. Rules for link id: - For QoS data of MLD peers (excluding EAPOL), select the primary or secondary wcid based on whether the TID is odd or even to meet FW/HW requirements - For other packets, use IEEE80211_TX_CTRL_MLO_LINK if specified (such as multicast and broadcast packets) Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-8-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 7eaea3a8ba1e9bb58f87e3030f6ce18537e57e1f Author: Shayne Chen Date: Thu Nov 6 14:41:58 2025 +0800 wifi: mt76: mt7996: set link_valid field when initializing wcid This ensures the upper layer uses the correct link ID during packet processing. Fixes: dd82a9e02c05 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-7-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit e077071e7ac48d5453072f615d51629891c5b90d Author: Shayne Chen Date: Thu Nov 6 14:41:57 2025 +0800 wifi: mt76: mt7996: fix teardown command for an MLD peer For an MLD peer, we only need to call the teardown command when removing the last link, and there's no need to call mt7996_mcu_add_sta() for the earlier links. Fixes: c1d6dd5d03eb ("wifi: mt76: mt7996: Add mt7996_mcu_teardown_mld_sta rouine") Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-6-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit bb705a606734e1ce0ff17a4f368a896757ba686d Author: Shayne Chen Date: Thu Nov 6 14:41:56 2025 +0800 wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() Fix several fields in mt7996_mcu_bss_basic_tlv() that were not obtained from the correct link. Without this patch, the MLD station interface does not function properly. Fixes: 34a41bfbcb71 ("wifi: mt76: mt7996: prepare mt7996_mcu_add_dev/bss_info for MLO support") Signed-off-by: Shayne Chen Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106064203.1000505-5-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit feb06d4556203cd27cf3fa31147d43f28f329653 Author: Shayne Chen Date: Thu Nov 6 14:41:55 2025 +0800 wifi: mt76: mt7996: support fixed rate for link station Introduce mt7996_link_sta_add_debugfs() to extend fixed rate support for MLO link station. Co-developed-by: Howard Hsu Signed-off-by: Howard Hsu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251106064203.1000505-4-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 5d86765828b47444908a8689f2625872e8dac48f Author: Howard Hsu Date: Thu Nov 6 14:41:54 2025 +0800 wifi: mt76: mt7996: fix implicit beamforming support for mt7992 Fix the ibf_timeout field for mt7996, mt7992 and mt7990 chipsets. For the mt7992, this value shall be set as 0xff, while the others shall be set as 0x18. Fixes: ad4c9a8a9803 ("wifi: mt76: mt7996: add implicit beamforming support for mt7992") Signed-off-by: Howard Hsu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251106064203.1000505-3-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit dab5b2025452f90673329dbc03513377b624ed3c Author: Peter Chiu Date: Thu Nov 6 14:41:53 2025 +0800 wifi: mt76: mt7996: no need to wait ACK event for SDO command For the SDO unified command, driver does not need to wait for ACK event so do not mark MCU_CMD_ACK in command header. Signed-off-by: Peter Chiu Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251106064203.1000505-2-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 361b59b6be7c33c43b619d5cada394efc0f3b398 Author: StanleyYP Wang Date: Thu Nov 6 14:41:52 2025 +0800 wifi: mt76: mt7996: fix max nss value when getting rx chainmask Since wiphy->available_antennas_tx now accumulates the chainmask of all the radios of a wiphy, use phy->orig_antenna_mask to get the original max nss for comparison. Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy") Signed-off-by: StanleyYP Wang Signed-off-by: Shayne Chen Link: https://patch.msgid.link/20251106064203.1000505-1-shayne.chen@mediatek.com Signed-off-by: Felix Fietkau commit 2a035ae2062f38dc5183002d1c5a64ca682170c1 Author: Jack Kao Date: Wed Oct 1 09:25:06 2025 +0800 wifi: mt76: mt7925: cqm rssi low/high event notify The implementation amounts to setting the driver flag IEEE80211_VIF_SUPPORTS_CQM_RSSI, and then providing mechanisms for continuously updating enough information to be able to provide notifications to userspace when RSSI drops below a certain threshold Signed-off-by: Jack Kao Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251001012506.2168037-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit ee518f914cd901c16fa08a6f228b266551f72a6a Author: Marco Crivellari Date: Mon Sep 22 11:32:43 2025 +0200 wifi: mt76: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. For more details see the Link tag below. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Switch to using system_percpu_wq because system_wq is going away as part of a workqueue restructuring. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20250922093243.140946-2-marco.crivellari@suse.com Signed-off-by: Felix Fietkau commit f72c8ab57927653199da6e35405eadffb40d7e54 Author: Denis Benato Date: Sun Nov 23 16:05:35 2025 +0100 platform/x86: asus-armoury: fix only DC tunables being available Module asus-armoury must use AC tunables to check availability of power-related firmware attributes: fix missing attributes by using AC attributes instead of DC. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251123150535.267339-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5ef6de7bad7255621f5f542d8d313b93662b7524 Author: Fedor Pchelkin Date: Mon Oct 27 14:18:40 2025 +0300 wifi: mt76: adjust BSS conf pointer handling Passing a BSS conf pointer to mt76_connac2_mac_tx_rate_val() currently has two inconsistencies. When called from mt76_connac2_mac_write_txwi(), BSS conf is got by dereferencing a vif pointer. A NULL vif isn't accounted for though the function itself supposes it to be NULL and tries to handle this case in previous checks. This looks like a cosmetic change since the drivers calling the function (namely, mt7915 and mt7921) set WANT_MONITOR_VIF flag so judging by info->control.vif initialization inside ieee80211_tx_*() routines it can't actually come as NULL here. The same holds for the BSS conf pointer handling inside mt76_connac2_mac_tx_rate_val(). It is dereferenced before being checked for NULL. The function supposes to handle the case so reorder the check and dereference of the pointer. Again, this looks like a syntax issue only. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Co-developed-by: Matvey Kovalev Signed-off-by: Matvey Kovalev Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20251027111843.38975-2-pchelkin@ispras.ru Signed-off-by: Felix Fietkau commit cdb2941a516cf06929293604e2e0f4c1d6f3541e Author: Fedor Pchelkin Date: Mon Oct 27 14:18:39 2025 +0300 Revert "wifi: mt76: mt792x: improve monitor interface handling" This reverts commit 55e95ce469d0c61041bae48b2ebb7fcbf6d1ba7f. mt792x drivers don't seem to support multi-radio devices yet. At least they don't mess with `struct wiphy_radio` at the moment. Packet capturing on monitor interface doesn't work after the blamed patch: tcpdump -i wls6mon -n -vvv Revert the NO_VIRTUAL_MONITOR feature for now to resolve the issue. Found by Linux Verification Center (linuxtesting.org). Fixes: 55e95ce469d0 ("wifi: mt76: mt792x: improve monitor interface handling") Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20251027111843.38975-1-pchelkin@ispras.ru Signed-off-by: Felix Fietkau commit 2df00805f7dbaa46b60c682aad0d76270b7ba266 Author: Caleb James DeLisle Date: Wed Oct 29 18:41:43 2025 +0000 wifi: mt76: mmio_*_copy fix byte order and alignment Update functions which copy to and from MMIO to load bytes as Little Endian, and also support unaligned buffers. PCI devices almost universally use Little Endian ordering for MMIO registers, mt76 is no exception. PCI hardware that is designed to work with Big Endian CPUs often (but not always) "helps" by transparently byte-swapping MMIO reads and writes on the wire. If this is enabled then it cannot be turned off for a single write. On hardware which does not support this, writel() does the swap in software. When we are transferring arbitrary bytes to MMIO space, we need them to arrive in the same order they were in memory, so when the hardware swaps them this is a problem. Rather than care about how our PCI host controller works, we instead load bytes as Little Endian - so on a Big Endian machine this will reverse them, then we use writel() which will put them back in the right order again. This way we do not make it our business whether the swapping is done in software or hardware. Furthermore, inspection of the code shows that these functions are often called with stack-allocated u8 arrays which have no alignment guarantees so we now use (get|put)_unaligned_le32(). Fixes this issue: mt76x2e 0000:02:00.0: ROM patch build: 20141115060606a mt76x2e 0000:02:00.0: Firmware Version: 0.0.00 mt76x2e 0000:02:00.0: Build: 1 mt76x2e 0000:02:00.0: Build Time: 201607111443____ mt76x2e 0000:02:00.0: Firmware failed to start mt76x2e 0000:02:00.0: probe with driver mt76x2e failed with error -145 Tested on: SmartFiber XP8421-B (Big Endian MIPS 34Kc) - MT7612 -> 5g / ap / psk2 - MT7603 -> 2g / sta / psk2 - MT7603 -> 2g / ap / psk2 TpLink Archer v1200v-v2 (Big Endian MIPS 34Kc) - MT7613 -> 5g / ap / psk2 - MT7603 -> 2g / sta / psk2 Signed-off-by: Caleb James DeLisle Link: https://patch.msgid.link/20251029184143.3991388-1-cjd@cjdns.fr Signed-off-by: Felix Fietkau commit 992c304112631498fd9bdc7d9bcf3840c12e304f Author: Ming Yen Hsieh Date: Fri Oct 31 17:03:52 2025 +0800 wifi: mt76: mt7925: disable auto regd changes after user set Add regd_user flag to block automatic regulatory domain updates if set by user. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251031090352.1400079-7-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 3bc62aa4484dcb9529fea70e756743769b1145e6 Author: Ming Yen Hsieh Date: Fri Oct 31 17:03:51 2025 +0800 wifi: mt76: mt7925: add auto regdomain switch support Implement 802.11d-based automatic regulatory domain switching to dynamically determine the regulatory domain at runtime. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251031090352.1400079-6-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 6338709a4f8636911b4eacfdd75cc12e28702285 Author: Ming Yen Hsieh Date: Fri Oct 31 17:03:50 2025 +0800 wifi: mt76: mt7925: improve EHT capability control in regulatory flow Move EHT flag handling into mt7925_regd_channel_update() to ensure correct channel capability reporting. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251031090352.1400079-5-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 330510085907a2f235b0ae3385b5b24c3a9c17ac Author: Ming Yen Hsieh Date: Fri Oct 31 17:03:49 2025 +0800 wifi: mt76: mt7925: refactor regulatory notifier flow Rename mt7925_regd_update() to mt7925_mcu_regd_update() to centralize regd updates with error handling. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251031090352.1400079-4-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit e323b841270a0cd17d95872035facc4c7fe03b44 Author: Ming Yen Hsieh Date: Fri Oct 31 17:03:48 2025 +0800 wifi: mt76: mt7925: refactor CLC support check flow Move the disable_clc module parameter to regd.c and introduce mt7925_regd_clc_supported() to centralize CLC support checks. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251031090352.1400079-3-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 87c394127049538d950422cdd23fd7aa2e71152a Author: Ming Yen Hsieh Date: Fri Oct 31 17:03:47 2025 +0800 wifi: mt76: mt7925: refactor regulatory domain handling to regd.[ch] Move regd logic to regd.c and regd.h files Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20251031090352.1400079-2-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit c1d8beea631ce0c30028c680075f8a0c9b65ad4a Author: Rob Herring (Arm) Date: Fri Oct 31 12:51:13 2025 -0500 wifi: mt76: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251031175113.1453100-1-robh@kernel.org Signed-off-by: Felix Fietkau commit 9ba77f1a634a89893022640c7d241c0781d48663 Author: Alok Tiwari Date: Mon Oct 20 23:48:09 2025 -0700 wifi: mt76: mt7996: fix typos in comments Fix two minor comment typos in the mt7996 driver: - "Tx/Tx" -> "Rx/Tx" - "tnterrupt" -> "interrupt" Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20251021064812.1778297-1-alok.a.tiwari@oracle.com Signed-off-by: Felix Fietkau commit 377aa17d2aedc98d1c3bbe7e49b22a0c76308b0e Author: Lorenzo Bianconi Date: Fri Oct 17 10:50:33 2025 +0200 wifi: mt76: mt7996: Add NPU offload support to MT7996 driver Introduce Airoha NPU support to MT7996 driver. NPU is used to enable traffic forward offloading between the MT76 NIC and the Airoha ethernet one available on the Airoha EN7581 SoC using Netfilter Flowtable APIs. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-5-ddaa90901723@kernel.org Signed-off-by: Felix Fietkau commit 7fb554b1b623c7da845521604bd05fa9570d07bc Author: Lorenzo Bianconi Date: Fri Oct 17 10:50:32 2025 +0200 wifi: mt76: Introduce the NPU generic layer Add the NPU generic layer in mt76 module. NPU will be used to enable traffic forward offloading between the MT76 NIC and the Airoha ethernet one available on the Airoha EN7581 SoC using Netfilter Flowtable APIs. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-4-ddaa90901723@kernel.org Signed-off-by: Felix Fietkau commit f7632a7fdda861e1215a6b284de738d7ab575837 Author: Lorenzo Bianconi Date: Fri Oct 17 10:50:31 2025 +0200 wifi: mt76: Add the capability to set TX token start ID This is a preliminary patch to enable traffic forward offloading via the Airoha NPU module available on the Airoha EN7581 SoC. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-3-ddaa90901723@kernel.org Signed-off-by: Felix Fietkau commit a7fb9aac3e65e8b3189d4b4088ad5e0d10628876 Author: Lorenzo Bianconi Date: Fri Oct 17 10:50:30 2025 +0200 wifi: mt76: Add mt76_dev pointer in mt76_queue struct. This is a preliminary patch to enable traffic forward offloading via the Airoha NPU module available on the Airoha EN7581 SoC. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-2-ddaa90901723@kernel.org Signed-off-by: Felix Fietkau commit e627439aecf358944261cf2ffb4449c61a7e5e9f Author: Lorenzo Bianconi Date: Fri Oct 17 10:50:29 2025 +0200 wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h This is a preliminary patch to enable traffic forward offloading between the MT76 NIC and the Airoha ethernet one via the Airoha NPU module available on the Airoha EN7581 SoC. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251017-mt76-npu-devel-v2-1-ddaa90901723@kernel.org Signed-off-by: Felix Fietkau commit 2157e49892c5eae210b8fa6ee8672bd9d0ffa4b5 Author: Lorenzo Bianconi Date: Tue Oct 14 15:28:53 2025 +0200 wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache() Get rid of useless null-pointer check in mt7996_msdu_page_get_from_cache since we have already verfied the list is not empty. Fixes: b1e58e137b616 ("wifi: mt76: mt7996: Introduce RRO MSDU callbacks") Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202510100155.MS0IXhzm-lkp@intel.com/ Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251014-mt7996_msdu_page_get_from_cache-remove-null-ptr-check-v1-1-fbeb7881e192@kernel.org Signed-off-by: Felix Fietkau commit a96fed2825d8dfb068bf640419c619b5f2df4218 Author: Felix Fietkau Date: Wed Oct 8 12:42:50 2025 +0200 wifi: mt76: relicense to BSD-3-Clause-Clear MediaTek has asked to switch from the ISC license to BSD-3-Clause-Clear, in order to improve clarity and the legal integrity of the code. The BSD-3-Clause license includes the "no endorsement" clause, which is important for protecting the reputation of the original authors and contributors by preventing unauthorized use of their names for endorsement purposes. This clause is absent in the BSD-2-Clause license, which is more permissive but lacks this specific protection. This change also cleans up the license of some Kconfig/Makefile files, which were accidentally marked as GPL. The GPL 2.0 remains in use on mt76x0, as well as two source files in mt7615 for which the license situation still needs to be clarified. Link: https://patch.msgid.link/20251008104250.46292-2-nbd@nbd.name Signed-off-by: Felix Fietkau commit 909675fd4344f73aad5f75f123bd271ada2ab9fb Author: Felix Fietkau Date: Wed Oct 8 12:42:49 2025 +0200 wifi: mt76: fix license/copyright of util.h The extra copyright line for Ivo van Doorn and GPL license was only there because of code that I had already removed before the initial upstream submission of mt76. Remove it and make this header file use ISC license like the rest of the source files. Link: https://patch.msgid.link/20251008104250.46292-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit a9730354ca26e16f80ddda3c88fd08075afe7078 Author: Peter Chiu Date: Wed Oct 8 12:41:49 2025 +0200 wifi: mt76: use GFP_DMA32 for page_pool buffer allocation Set GFP_DMA32 flag for page_pool buffers allocation since the hw relies on 32-bit DMA addresses for WED offloading. Tested-by: Daniel Pawlik Tested-by: Matteo Croce Signed-off-by: Peter Chiu Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251008-wed-fixes-v1-2-8f7678583385@kernel.org Signed-off-by: Felix Fietkau commit 385aab8fccd7a8746b9f1a17f3c1e38498a14bc7 Author: Lorenzo Bianconi Date: Wed Oct 8 12:41:48 2025 +0200 wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wed_hif2 (e.g. 6GHz link). [ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a [ 297.464928] Mem abort info: [ 297.467722] ESR = 0x0000000096000005 [ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits [ 297.476766] SET = 0, FnV = 0 [ 297.479809] EA = 0, S1PTW = 0 [ 297.482940] FSC = 0x05: level 1 translation fault [ 297.487809] Data abort info: [ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000 [ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000 [ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP [ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0 [ 297.723908] Tainted: [O]=OOT_MODULE [ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT) [ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table] [ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80 [ 297.757126] sp : ffffffc080fe3ae0 [ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7 [ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00 [ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018 [ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000 [ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 [ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da [ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200 [ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002 [ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000 [ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8 [ 297.831686] Call trace: [ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76] [ 297.839254] mtk_wed_flow_remove+0x58/0x80 [ 297.843342] mtk_flow_offload_cmd+0x434/0x574 [ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40 [ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table] [ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table] [ 297.864463] process_one_work+0x174/0x300 [ 297.868465] worker_thread+0x278/0x430 [ 297.872204] kthread+0xd8/0xdc [ 297.875251] ret_from_fork+0x10/0x20 [ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421) [ 297.884901] ---[ end trace 0000000000000000 ]--- Fix the issue detecting the proper wed reference to use running wed callabacks. Fixes: 83eafc9251d6 ("wifi: mt76: mt7996: add wed tx support") Tested-by: Daniel Pawlik Tested-by: Matteo Croce Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251008-wed-fixes-v1-1-8f7678583385@kernel.org Signed-off-by: Felix Fietkau commit b05ab4be9fd779115635144ebb0691a0c3dd3943 Author: Shayne Chen Date: Tue Oct 7 10:11:16 2025 +0200 wifi: mt76: mt7915: add bf backoff limit table support The commit 22b980badc0f ("mt76: add functions for parsing rate power limits from DT") introduced generic support for rates limits in the devicetree. But the mt7915 supports beamforming and has another table for configuring the backoff limits. These can be configured in the DT with the paths-* properties. The path-*-bf are the ones relevant for beamforming and the ones without -bf suffix for "traditional" path backoff. Signed-off-by: Shayne Chen Signed-off-by: Sven Eckelmann (Plasma Cloud) Link: https://patch.msgid.link/20251007-backoff-table-support-v3-3-fd6e2684988f@simonwunderlich.de Signed-off-by: Felix Fietkau commit 6b9833c611d2e149292cc1c542dccfda1ca98c1f Author: Sven Eckelmann (Plasma Cloud) Date: Tue Oct 7 10:11:15 2025 +0200 dt-bindings: net: wireless: mt76: introduce backoff limit properties Introduce path backoff limit properties in mt76 binding in order to specify beamforming and non-beamforming backoff limits for 802.11n/ac/ax. Reviewed-by: Rob Herring (Arm) Signed-off-by: Sven Eckelmann (Plasma Cloud) Link: https://patch.msgid.link/20251007-backoff-table-support-v3-2-fd6e2684988f@simonwunderlich.de Signed-off-by: Felix Fietkau commit 9a04a69b68ad10dee793c887b367760651777c42 Author: Sven Eckelmann (Plasma Cloud) Date: Tue Oct 7 10:11:14 2025 +0200 dt-bindings: net: wireless: mt76: Document power-limits country property The commit 22b980badc0f ("mt76: add functions for parsing rate power limits from DT") added filtering of the power limits based on two properties: * regdomain * country If either the country or the regdomain matches, the power limits are applied and the search is aborted. If none of the two is defined for the power limit, it is a global (or "fallback") power limit. The last "fallback" power limit in the list will be returned when not matching regdomain or country was found. The idea is here to allow to specify "overwriting" country limits in front of the list - just in case a regdomain is shared but a country has additional limitations. But this property was forgotten to be defined in commit 2de6ccebe0e7 ("dt-bindings:net:wireless:mediatek,mt76: introduce power-limits node"). Signed-off-by: Sven Eckelmann (Plasma Cloud) Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251007-backoff-table-support-v3-1-fd6e2684988f@simonwunderlich.de Signed-off-by: Felix Fietkau commit 38b845e1f9e810869b0a0b69f202b877b7b7fb12 Author: Sven Eckelmann (Plasma Cloud) Date: Fri Sep 26 11:32:54 2025 +0200 wifi: mt76: Fix DTS power-limits on little endian systems The power-limits for ru and mcs and stored in the devicetree as bytewise array (often with sizes which are not a multiple of 4). These arrays have a prefix which defines for how many modes a line is applied. This prefix is also only a byte - but the code still tried to fix the endianness of this byte with a be32 operation. As result, loading was mostly failing or was sending completely unexpected values to the firmware. Since the other rates are also stored in the devicetree as bytewise arrays, just drop the u32 access + be32_to_cpu conversion and directly access them as bytes arrays. Cc: stable@vger.kernel.org Fixes: 22b980badc0f ("mt76: add functions for parsing rate power limits from DT") Fixes: a9627d992b5e ("mt76: extend DT rate power limits to support 11ax devices") Signed-off-by: Sven Eckelmann (Plasma Cloud) Signed-off-by: Felix Fietkau commit 8c5b063061326b84192625c62e963f1e998193a8 Author: Thorsten Blum Date: Tue Sep 23 23:38:31 2025 +0200 wifi: mt76: connac: Replace memcpy + hard-coded size with strscpy Replace memcpy() and the hard-coded string length with strscpy() to safely copy the string and improve mt76_connac_mcu_chip_config(). No functional changes. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250923213831.1896823-2-thorsten.blum@linux.dev Signed-off-by: Felix Fietkau commit 084922069ceac4d594c06b76a80352139fd15f4d Author: Lorenzo Bianconi Date: Wed Sep 24 15:51:39 2025 +0200 wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx Remove unnecessary link_id checks in mt7996_tx routine since if the link identifier provided by mac80211 is unspecified the value will be overwritten at the beginning on the function. Fixes: f940c9b7aef6 ("wifi: mt76: mt7996: Set proper link destination address in mt7996_tx()") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250924-mt76_tx_unnecessary-check-v1-1-e595930a5662@kernel.org Signed-off-by: Felix Fietkau commit 79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52 Author: Felix Fietkau Date: Mon Sep 29 13:17:23 2025 +0200 wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings in that case, and apply them later. Move the location of the queue params to within struct mt7996_vif_link. Fixes: c0df2f0caa8d ("wifi: mt76: mt7996: prepare mt7996_mcu_set_tx for MLO support") Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250929111723.52486-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit 54618003a145aeadc2381159bde80f9761cce16c Author: Kuninori Morimoto Date: Thu Nov 13 02:25:26 2025 +0000 um: drivers: virtio: use string choices helper Remove hard-coded strings by using the string helper functions Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87h5uywtwp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Johannes Berg commit a8e5a110c0c38e08e5dd66356cd1156e91cf88e1 Author: Hans de Goede Date: Mon Nov 3 11:03:14 2025 +0100 wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet The Acer A1 840 tablet contains quite generic names in the sys_vendor and product_name DMI strings, without this patch brcmfmac will try to load: brcmfmac43340-sdio.Insyde-BayTrail.txt as nvram file which is a bit too generic. Add a DMI quirk so that a unique and clearly identifiable nvram file name is used on the Acer A1 840 tablet. Acked-by: Arend van Spriel Signed-off-by: Hans de Goede Link: https://patch.msgid.link/20251103100314.353826-1-hansg@kernel.org Signed-off-by: Johannes Berg commit 9f33477b9a31a1edfe2df9f1a0359cccb0e16b4c Author: Johannes Berg Date: Fri Nov 21 17:40:21 2025 +0100 wifi: cfg80211: stop radar detection in cfg80211_leave() If an interface is set down or, per the previous patch, changes type, radar detection for it should be cancelled. This is done for AP mode in mac80211 (somewhat needlessly, since cfg80211 can do it, but didn't until now), but wasn't handled for mesh, so if radar detection was started and then the interface set down or its type switched (the latter sometimes happning in the hwsim test 'mesh_peer_connected_dfs'), radar detection would be around with the interface unknown to the driver, later leading to some warnings around chanctx usage. Link: https://patch.msgid.link/20251121174021.290120e419e3.I2a5650c9062e29c988992dd8ce0d8eb570d23267@changeid Signed-off-by: Johannes Berg commit 7a27b73943a70ee226fa125327101fb18e94701d Author: Johannes Berg Date: Fri Nov 21 17:40:20 2025 +0100 wifi: cfg80211: use cfg80211_leave() in iftype change When changing the interface type, all activity on the interface has to be stopped first. This was done independent of existing code in cfg80211_leave(), so didn't handle e.g. background radar detection. Use cfg80211_leave() to handle it the same way. Note that cfg80211_leave() behaves slightly differently for IBSS in wireless extensions, it won't send an event in that case. We could handle that, but since nl80211 was used to change the type, IBSS is rare, and wext is already a corner case, it doesn't seem worth it. Link: https://patch.msgid.link/20251121174021.922ef48ce007.I970c8514252ef8a864a7fbdab9591b71031dee03@changeid Signed-off-by: Johannes Berg commit de3c5142349c6cd67fbd20afc5b3ae320df436b7 Author: Johannes Berg Date: Fri Nov 21 11:37:34 2025 +0100 wifi: mac80211: fix channel switching code My prior commit here introduced a bug due to copy/paste, it was iterating the links assigned to 'ctx->replace_ctx' and I replaced it by iterating links assigned to 'ctx' by accident, then modified it for the iteration later. Fix it to iterate the users of the correct chanctx, i.e. 'ctx->replace_ctx'. Ultimately, this issue led to a crash in a hwsim test (multi_ap_wps_shared_apdev_csa) because it would actually do the switch (rather than refuse here) and then later have a double-free of the original chanctx, because it was still in use by another interface yet freed as part of the switching. Fixes: a1dc648aa76d ("wifi: mac80211: remove chanctx to link back-references") Link: https://patch.msgid.link/20251121113733.7710a58d45eb.Ie9ec010b52b1baed93dbe44f968c2119b6b5d98d@changeid Signed-off-by: Johannes Berg commit 49a9feaf30f441755a52877863a8697a8c3138d0 Merge: b688a9447be360 dbf9b7bb0edfa1 Author: Johannes Berg Date: Mon Nov 24 13:01:02 2025 +0100 Merge tag 'rtw-next-2025-11-21-v2' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw-next patches for v6.19 Main changes are about rtw89 USB support, which two USB devices are added with proper TX status, and other notable items are listed below. rtl8xxxu: - fix 40MHz bandwidth connection rtw89: - support USB devices RTL8852AU and RTL8852CU - report TX status from air for USB devices - resolve racing between processes of TX and TX report - resolve racing of skb queue of C2H events - support injected packets with bandwidth and data rate - more materials for coming RTL8922DE ================== Link: https://patch.msgid.link/45eed1763a354460acba15a8e69f9e3e@realtek.com Signed-off-by: Johannes Berg commit 950167a99dfd27eeaf177092908c598a31c79a7e Author: Shenghao Ding Date: Sat Nov 22 07:44:27 2025 +0800 ASoC: tas2781: correct the wrong period A wrong preiod at the end of the sentence was reported by one of my customers. Their thorough code review is greatly appreciated. Fixes: 49e2e353fb0d ("ASoC: tas2781: Add Calibration Kcontrols for Chromebook") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20251121234427.402-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit 34b78ddd78428e66a7f08f71763258723eae2306 Author: Baojun Xu Date: Mon Nov 24 11:15:42 2025 +0800 ASoC: tas2781: Correct the wrong chip ID for reset variable check The new variable of reset was added for TAS58XX on TAS5825 first. And TAS5802/5815... was added later, so this reset variable check should be changed to lowest chip of TAS58XX. Fixes: 53a3c6e22283 ("ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251124031542.2793-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit f5730d44e05efb43a5cb64e5eb04e24994bbb50f Author: Heiko Carstens Date: Mon Nov 17 15:09:53 2025 +0100 s390: Add stackprotector support Stackprotector support was previously unavailable on s390 because by default compilers generate code which is not suitable for the kernel: the canary value is accessed via thread local storage, where the address of thread local storage is within access registers 0 and 1. Using those registers also for the kernel would come with a significant performance impact and more complicated kernel entry/exit code, since access registers contents would have to be exchanged on every kernel entry and exit. With the upcoming gcc 16 release new compiler options will become available which allow to generate code suitable for the kernel. [1] Compiler option -mstack-protector-guard=global instructs gcc to generate stackprotector code that refers to a global stackprotector canary value via symbol __stack_chk_guard. Access to this value is guaranteed to occur via larl and lgrl instructions. Furthermore, compiler option -mstack-protector-guard-record generates a section containing all code addresses that reference the canary value. To allow for per task canary values the instructions which load the address of __stack_chk_guard are patched so they access a lowcore field instead: a per task canary value is available within the task_struct of each task, and is written to the per-cpu lowcore location on each context switch. Also add sanity checks and debugging option to be consistent with other kernel code patching mechanisms. Full debugging output can be enabled with the following kernel command line options: debug_stackprotector bootdebug ignore_loglevel earlyprintk dyndbg="file stackprotector.c +p" Example debug output: stackprot: 0000021e402d4eda: c010005a9ae3 -> c01f00070240 where ": -> ". [1] gcc commit 0cd1f03939d5 ("s390: Support global stack protector") Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit 1d7764cfe33626f8487febbcb2ad2acc9bd14c2c Author: Heiko Carstens Date: Mon Nov 17 15:09:52 2025 +0100 s390/modules: Simplify module_finalize() slightly Preinitialize the return value, and break out the for loop in module_finalize() in case of an error to get rid of an ifdef. This makes it easier to add additional code, which may also depend on config options. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit c3d17464f0262c9e3c156d4c6306e32cf530fa47 Author: Heiko Carstens Date: Thu Nov 20 16:30:53 2025 +0100 s390: Remove KMSG_COMPONENT macro The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" which never made it upstream. Remove the macro in order to get rid of a pointless indirection. Replace all users with the string it defines. In almost all cases this leads to a simple replacement like this: - #define KMSG_COMPONENT "appldata" - #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt + #define pr_fmt(fmt) "appldata: " fmt Except for some special cases this is just mechanical/scripted work. Acked-by: Thomas Richter Signed-off-by: Heiko Carstens commit e950d1f84d3c16e86dd1b6066c3ac3958099fa79 Author: Heiko Carstens Date: Wed Nov 19 15:37:56 2025 +0100 s390/percpu: Get rid of ARCH_MODULE_NEEDS_WEAK_PER_CPU Since the rework of the kernel virtual address space [1] the module area and the kernel image are within the same 4GB area. Therefore there is no need for the weak per cpu workaround for modules anymore. Remove it. [1] commit c98d2ecae08f ("s390/mm: Uncouple physical vs virtual address spaces") Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit f555d885bfc4338dc0fad322b6ed21cc4c18416b Merge: 2a2153a2bac7d9 46030379f13c3f Author: Heiko Carstens Date: Mon Nov 24 11:43:19 2025 +0100 Merge branch 'ap-driver-override' into features Harald Freudenberger says: ==================== Support for driver override on AP queues. Add a new sysfs attribute driver_override the AP queue's directory. Writing in a string overrides the default driver determination and the drivers are matched against this string instead. This overrules the driver binding determined by the apmask/aqmask bitmask fields. With the write to the attribute a check is done if the queue is in use by an mdev device. If this is true, the write is aborted and EBUSY is returned. As there exists some tooling for this kind of driver_override (see package driverctl) the AP bus behavior for re-binding should be compatible to this. The steps for a driver_override are: 1) unbind the current driver from the device. For example echo "17.0005" > /sys/devices/ap/card17/17.0005/driver/unbind 2) set the new driver for this device in the sysfs driver_override attribute. For example echo "vfio_ap" > /sys//devices/ap/card17/17.0005/driver_override 3) trigger a bus reprobe of this device. For example echo "17.0005" > /sys/bus/ap/drivers_probe With the driverctl package this is more comfortable and the settings get persisted: driverctl -b ap set-override 17.0005 vfio_ap and unset with driverctl -b ap unset-override 17.0005 ==================== Signed-off-by: Heiko Carstens commit 46030379f13c3f07c699dcaf034a50f023f77925 Author: Harald Freudenberger Date: Wed Nov 19 16:27:38 2025 +0100 s390/ap: Restrict driver_override versus apmask and aqmask use Introduce a restriction for the driver_override feature versus apmask and aqmask: - driver_override is only allowed when the apmask and aqmask values both are default (=0xffff..ffff). - apmask and aqmask modifications are only allowed when there is no driver_override on any AP device active. So in the end the user is restricted to choose to either use apmask/apmask to divide the AP devices into host owned and vfio owned or use the driver_override feature but not mix these two approaches. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Heiko Carstens commit 8babcc2b6a75d1eced723a78cb67b3ff6abac8b0 Author: Harald Freudenberger Date: Wed Nov 19 16:27:37 2025 +0100 s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex The mutex ap_perms_mutex was already used not only for protection of the struct ap_perms ap_perms variable but also for an consistent update of the AP bus sysfs attributes apmask and aqmask. So rename this mutex to ap_attr_mutex which better reflects the current use. This is also a preparation for an upcoming patch which will use this mutex to lock updates on a new sysfs attribute. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Heiko Carstens commit d38a87d7c0643db61e7a3bfc3ebeea2dc2568f7e Author: Harald Freudenberger Date: Wed Nov 19 16:27:36 2025 +0100 s390/ap: Support driver_override for AP queue devices Add a new sysfs attribute driver_override the AP queue's directory. Writing in a string overrides the default driver determination and the drivers are matched against this string instead. This overrules the driver binding determined by the apmask/aqmask bitmask fields. According to the common understanding of how the driver_override behavior shall work, there is no further checking done. Neither about the string which is given as override driver nor if this device is currently in use by an mdev device. Another patch may limit this behavior to refuse a mixed usage of the driver_override and apmask/aqmask feature. As there exists some tooling for this kind of driver_override (see package driverctl) the AP bus behavior for re-binding should be compatible to this. The steps for a driver_override are: 1) unbind the current driver from the device. For example echo "17.0005" > /sys/devices/ap/card17/17.0005/driver/unbind 2) set the new driver for this device in the sysfs driver_override attribute. For example echo "vfio_ap" > /sys//devices/ap/card17/17.0005/driver_override 3) trigger a bus reprobe of this device. For example echo "17.0005" > /sys/bus/ap/drivers_probe With the driverctl package this is more comfortable and the settings get persisted: driverctl -b ap set-override 17.0005 vfio_ap and unset with driverctl -b ap unset-override 17.0005 Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Heiko Carstens commit 6917f434fda346323d1269780286e9ae915bdb5e Author: Harald Freudenberger Date: Wed Nov 19 16:27:35 2025 +0100 s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks For the in_use() check of an updated apmask the host's aqmask was provided to the vfio function. Similar on an update of the aqmask the host's apmask was provided to the vfio in_use() function. This led to false results on the check for apmask or aqmask updates. For example with only one APQN when exactly this card is tried to be re-assigned back to the host, the in_use() check did not complain. The correct behavior is achieved with providing a full mask for aqmask when an adapter is to be checked and similar a full mask for aqmask when a domain is to be checked for usage. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Heiko Carstens commit 1f67707fafa598e2338dba08e3de0db3e468afd1 Merge: 0346625cd7f125 c98c99d5dbdf9f Author: Ulf Hansson Date: Mon Nov 24 11:14:36 2025 +0100 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.18-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.19. Signed-off-by: Ulf Hansson commit aaf4e92341b081bac1230f22619b0a298e285dab Author: Geert Uytterhoeven Date: Mon Oct 13 14:59:22 2025 +0200 m68k: defconfig: Update defconfigs for v6.18-rc1 - Drop CONFIG_SCTP_COOKIE_HMAC_SHA1=y (removed in commit 2f3dd6ec901f29ae ("sctp: Convert cookie authentication to use HMAC-SHA256")), - Drop CONFIG_BATMAN_ADV_NC=y (removed in commit 87b95082db32ae1c ("batman-adv: remove network coding support")), - Enable modular build of the SHA-1 secure hash algorithm (no longer auto-enabled since commit 2f3dd6ec901f29ae ("sctp: Convert cookie authentication to use HMAC-SHA256")). Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/65e00bcb7b2980278bb087986ee405627aa32d8b.1760360254.git.geert@linux-m68k.org commit ebbdf6466b30e3b37f3b360826efd21f0633fb9e Author: Herbert Xu Date: Fri Nov 21 13:54:20 2025 +0800 crypto: ahash - Zero positive err value in ahash_update_finish The partial block length returned by a block-only driver should not be passed up to the caller since ahash itself deals with the partial block data. Set err to zero in ahash_update_finish if it was positive. Reported-by: T Pratham Tested-by: T Pratham Fixes: 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API") Signed-off-by: Herbert Xu commit b0356b75f42fde15d4be268c5891f2cee6eb65bf Author: Herbert Xu Date: Fri Nov 21 13:36:03 2025 +0800 crypto: ahash - Fix crypto_ahash_import with partial block data Restore the partial block buffer in crypto_ahash_import by copying it. Check whether the partial block buffer exceeds the maximum size and return -EOVERFLOW if it does. Zero the partial block buffer in crypto_ahash_import_core. Reported-by: T Pratham Tested-by: T Pratham Fixes: 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API") Signed-off-by: Herbert Xu commit 80b61046b6899c6e881ff191aa99256d8e43cd58 Author: David Laight Date: Wed Nov 19 22:41:33 2025 +0000 crypto: lib/mpi - use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Herbert Xu commit 14ca8ce1fcbbd4448c302e144052cfc2fe288232 Author: David Laight Date: Wed Nov 19 22:41:12 2025 +0000 crypto: ccp - use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Herbert Xu commit 0f8ead58b6dce9520fc3f9ff7f943bb0627a7a19 Author: David Laight Date: Wed Nov 19 22:41:10 2025 +0000 hwrng: core - use min3() instead of nested min_t() min_t(u16, a, b) is likely to discard significant bits. Replace: min_t(u16, min_t(u16, default_quality, 1024), rng->quality ?: 1024); with: min3(default_quality, 1024, rng->quality ?: 1024); Signed-off-by: David Laight Signed-off-by: Herbert Xu commit 6c5d5b6dc5eb966e86a92e6587ccca1ec1e392e1 Author: David Laight Date: Wed Nov 19 22:41:06 2025 +0000 crypto: aesni - ctr_crypt() use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Herbert Xu commit 680cd3e28c62b2d753840c78221357e5ac9c128b Author: Herbert Xu Date: Wed Nov 19 12:38:22 2025 +0800 crypto: drbg - Delete unused ctx from struct sdesc The ctx array in struct sdesc is never used. Delete it as it's bogus since the previous member ends with a flexible array. Reported-by: Gustavo A. R. Silva Signed-off-by: Herbert Xu commit c637f3e4a59d710ffd80da1c11d2ebed162d8ff0 Author: Thorsten Blum Date: Mon Nov 17 12:44:26 2025 +0100 crypto: testmgr - Add missing DES weak and semi-weak key tests Ever since commit da7f033ddc9f ("crypto: cryptomgr - Add test infrastructure"), the DES test suite has tested only one of the four weak keys and none of the twelve semi-weak keys. DES has four weak keys and twelve semi-weak keys, and the kernel's DES implementation correctly detects and rejects all of these keys when the CRYPTO_TFM_REQ_FORBID_WEAK_KEYS flag is set. However, only a single weak key was being tested. Add tests for all 16 weak and semi-weak keys. While DES is deprecated, it is still used in some legacy protocols, and weak/semi-weak key detection should be tested accordingly. Tested on arm64 with cryptographic self-tests. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 4022c7b6342a4d9a97e1e974e27efca95e79ed20 Author: Maher Sanalla Date: Thu Nov 20 17:15:16 2025 +0200 RDMA/mlx5: Add support for 1600_8x lane speed Add a check for 1600G_8X link speed when querying PTYS and report it back correctly when needed. While at it, adjust mlx5 function which maps the speed rate from IB spec values to internal driver values to be able to handle speeds up to 1600Gbps. Reviewed-by: Michael Guralnik Signed-off-by: Maher Sanalla Link: https://patch.msgid.link/20251120-speed-8-v1-2-e6a7efef8cb8@nvidia.com Reviewed-by: Kalesh AP Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 0f1f9b5e47cec229dc2127481807823b75e933b0 Author: Maher Sanalla Date: Thu Nov 20 17:15:15 2025 +0200 RDMA/core: Add new IB rate for XDR (8x) support Add the new rates as defined in the Infiniband spec for XDR and 8x link width support. Furthermore, modify the utility conversion methods accordingly. Reference: IB Spec Release 1.8 Reviewed-by: Michael Guralnik Signed-off-by: Maher Sanalla Link: https://patch.msgid.link/20251120-speed-8-v1-1-e6a7efef8cb8@nvidia.com Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit 6dbd547adad534c0daad13ca9e1f862278ca955b Author: Yishai Hadas Date: Thu Nov 20 16:49:28 2025 +0200 IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled Enabling 5-level paging (LA57) increases TASK_SIZE on x86_64 from 2^47 to 2^56. This affects implicit ODP, which uses TASK_SIZE to calculate the number of IMR KSM entries. As a result, the number of entries and the memory usage for KSM mkeys increase drastically: - With 2^47 TASK_SIZE: 0x20000 entries (~2MB) - With 2^56 TASK_SIZE: 0x4000000 entries (~1GB) This issue could happen previously on systems with LA57 manually enabled, but now commit 7212b58d6d71 ("x86/mm/64: Make 5-level paging support unconditional") enables LA57 by default on all supported systems. This makes the issue impact widespread. To mitigate this, increase the size each MTT entry maps from 1GB to 16GB when 5-level paging is enabled. This reduces the number of KSM entries and lowers the memory usage on LA57 systems from 1GB to 64MB per IMR. As now 'mlx5_imr_mtt_size' is larger than 32 bits, we move to use u64 instead of int as part of populate_klm() to prevent overflow of the 'step' variable. In addition, as populate_klm() actually handles KSM and not KLM, as it's used only by implicit ODP, we renamed its signature and the internal structures accordingly while dropping the byte_count handling which is not relevant in KSM. The page size in KSM is fixed for all the entries and come from the log_page_size of the mkey. Note: On platforms where the calculated value for 'mlx5_imr_ksm_page_shift' is higher than the max firmware cap to be changed over UMR, or that the calculated value for 'log_va_pages' is higher than what we may expect, the implicit ODP cap will be simply turned off. Co-developed-by: Or Har-Toov Signed-off-by: Or Har-Toov Signed-off-by: Yishai Hadas Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251120-reduce-ksm-v1-1-6864bfc814dc@kernel.org Signed-off-by: Leon Romanovsky commit a26c4c7cdb50247b8486f1caa1ea8ab5e5c37edf Author: Selvin Xavier Date: Wed Nov 19 23:36:55 2025 -0800 RDMA/bnxt_re: Pass correct flag for dma mr creation DMA MR doesn't use the unified MR model. So the lkey passed on to the reg_mr command to FW should contain the correct lkey. Driver is incorrectly over writing the lkey with pdid and firmware commands fails due to this. Avoid passing the wrong key for cases where the unified MR registration is not used. Fixes: f786eebbbefa ("RDMA/bnxt_re: Avoid an extra hwrm per MR creation") Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Link: https://patch.msgid.link/1763624215-10382-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Leon Romanovsky commit 6afe40ff484a1155b71158b911c65299496e35c3 Author: Selvin Xavier Date: Wed Nov 19 23:36:54 2025 -0800 RDMA/bnxt_re: Fix the inline size for GenP7 devices Inline size supported by the device is based on the number of SGEs supported by the adapter. Change the inline size calculation based on that. Fixes: de1d364c3815 ("RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters") Reviewed-by: Kashyap Desai Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Link: https://patch.msgid.link/1763624215-10382-1-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Leon Romanovsky commit d70f30cef2dfa65757d8146d6d0524b6872e9845 Author: Junxian Huang Date: Wed Nov 12 17:35:10 2025 +0800 RDMA/hns: Support reset recovery for bond Re-set bond configuration to HW after HW reset. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-9-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit e72d274f8f5b9912c8e6590004a470a1ad8f4983 Author: Junxian Huang Date: Wed Nov 12 17:35:09 2025 +0800 RDMA/hns: Support link state reporting for bond The link state of bond depends on the upper device. Adapt current link state querying flow and ib_event dispatching flow to report correct link state of bond. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-8-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 5d91677bbb6435761b51a7154f59dc70af333f4b Author: Junxian Huang Date: Wed Nov 12 17:35:08 2025 +0800 RDMA/hns: Add delayed work for bonding When conditions are met, schedule a delayed work in bond event handler to perform bonding operation according to the bond state. In the case of changing slave number or link state, re-set the netdev for the bond ibdev after the modification is complete, since these two operations may not call hns_roce_set_bond_netdev() in hns_roce_init(). The delayed work will be paused when there is a driver reset or exit to avoid concurrency. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-7-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit d9023e461b73e2918c689e09b2ecf72389632da3 Author: Junxian Huang Date: Wed Nov 12 17:35:07 2025 +0800 RDMA/hns: Implement bonding init/uninit process Implement hns_roce_slave_init() and hns_roce_slave_uninit() for device init/uninit in bonding cases. The former is used to initialize a slave ibdev (when the slave is unlinked from a bond) or a bond ibdev, while the latter does the opposite. Most of the process is the same as regular device init/uninit, while some bonding‑specific steps below are also added. In bond device init flow, choose one slave to re-initialize as the main_hr_dev of the bond, and it will be the only device presented for multiple slaves. During registration, set and active netdev to the ibdev based on the link state of the slaves. When this main_hr_dev slave is being unlinked while the bond is still valid, choose a new slave from the rest and initialize it as the new bond device. In uninit flow, add a bond cleanup process, restore all the other slaves and clean up bond resource. This is only for the case where the port of main_hr_dev is directly removed without unlinking it from bond. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-6-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 14f0455e4a61112583e61206a3d048cbecd7df86 Author: Junxian Huang Date: Wed Nov 12 17:35:06 2025 +0800 RDMA/hns: Add bonding cmds Add three bonding cmds to configure bonding settings to HW. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-5-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit d31d410b38e61f89b978d4e1364040537339f559 Author: Junxian Huang Date: Wed Nov 12 17:35:05 2025 +0800 RDMA/hns: Add bonding event handler Register netdev notifier for two bonding events NETDEV_CHANGEUPPER and NETDEV_CHANGELOWERSTATE. In NETDEV_CHANGEUPPER event handler, check some rules about the HW constraints when trying to link a new slave to the masteri, and store some bonding information from the notifier. In unlinking case, simply check the number of the rest slaves to decide whether the bond is still supported. In NETDEV_CHANGELOWERSTATE event handler, not much is done. It simply sets the bond state when the bond is ready, which will be used later. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-4-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit b37ad2e290fc52e575572b04803a4f93f584df6c Author: Junxian Huang Date: Wed Nov 12 17:35:04 2025 +0800 RDMA/hns: Initialize bonding resources Allocate bond_grp resources for each card when the first device in this card is registered. Block the initialization of VF when its PF is a bonded slave, as VF is not supported in this case due to HW constraints. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-3-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit cdb3a6f1833ae4ab729d07dceee59e0fba213c24 Author: Junxian Huang Date: Wed Nov 12 17:35:03 2025 +0800 RDMA/hns: Add helpers to obtain netdev and bus_num from hr_dev Add helpers to obtain netdev and bus_num from hr_dev. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20251112093510.3696363-2-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 04e031ff6e60fc2775f18f963ebfe00b2573d0fb Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:26 2025 +0000 RDMA/bng_re: Initialize the Firmware and Hardware Initialize the firmware and hardware with HWRM command. Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-9-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit 99e4e102833765483ae12027719be09c472f0ca9 Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:25 2025 +0000 RDMA/bng_re: Add basic debugfs infrastructure Add basic debugfs infrastructure for Broadcom next generation controller. Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-8-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit 53c6ee7d7f68a0679f8ddc703338aa2550d24a17 Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:24 2025 +0000 RDMA/bng_re: Enable Firmware channel and query device attributes Enable Firmware channel and query device attributes Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-7-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit 4f830cd8d7fe3e98fc12d25f347ed461e11fc1de Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:23 2025 +0000 RDMA/bng_re: Add infrastructure for enabling Firmware channel Add infrastructure for enabling Firmware channel. Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-6-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit 53310b698f3cf601dfdc6c3b2b60c7cb275b1199 Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:22 2025 +0000 RDMA/bng_re: Allocate required memory resources for Firmware channel Allocate required memory resources for Firmware channel. Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-5-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit 745065770c2dc9636f33ec5fb065ffb7d227f4ad Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:21 2025 +0000 RDMA/bng_re: Register and get the resources from bnge driver Register and get the basic required resources from bnge driver. Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-4-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit d0da769c19d0b2da5146cad226e16ab7f282adde Author: Siva Reddy Kallam Date: Mon Nov 17 17:11:20 2025 +0000 RDMA/bng_re: Add Auxiliary interface Add basic Auxiliary interface to the driver which supports the BCM5770X NIC family. Signed-off-by: Siva Reddy Kallam Link: https://patch.msgid.link/20251117171136.128193-3-siva.kallam@broadcom.com Reviewed-by: Usman Ansari Signed-off-by: Leon Romanovsky commit d53cd891f0e4311889349fff3a784dc552f814b9 Author: Gao Xiang Date: Sat Nov 22 14:23:32 2025 +0800 erofs: limit the level of fs stacking for file-backed mounts Otherwise, it could cause potential kernel stack overflow (e.g., EROFS mounting itself). Reviewed-by: Sheng Yong Fixes: fb176750266a ("erofs: add file-backed mount support") Reviewed-by: Chao Yu Reviewed-by: Hongbo Li Signed-off-by: Gao Xiang commit ebe4f3f6eb0c10f87c58e52a8912694c14fdeda6 Author: Gao Xiang Date: Mon Nov 17 19:57:29 2025 +0800 erofs: correct FSDAX detection The detection of the primary device is skipped incorrectly if the multiple or flattened feature is enabled. It also fixes the FSDAX misdetection for non-block extra blobs. Fixes: c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device") Reported-and-tested-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com Cc: Yuezhang Mo Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 3239c52fd21257c80579875e74c9956c2f9cd1f9 Author: Hui Min Mina Chou Date: Mon Nov 17 16:45:55 2025 +0800 RISC-V: KVM: Flush VS-stage TLB after VCPU migration for Andes cores Most implementations cache the combined result of two-stage translation, but some, like Andes cores, use split TLBs that store VS-stage and G-stage entries separately. On such systems, when a VCPU migrates to another CPU, an additional HFENCE.VVMA is required to avoid using stale VS-stage entries, which could otherwise cause guest faults. Introduce a static key to identify CPUs with split two-stage TLBs. When enabled, KVM issues an extra HFENCE.VVMA on VCPU migration to prevent stale VS-stage mappings. Signed-off-by: Hui Min Mina Chou Signed-off-by: Ben Zong-You Xie Reviewed-by: Radim Krčmář Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20251117084555.157642-1-minachou@andestech.com Signed-off-by: Anup Patel commit 974555d6e417974e63444266e495a06d06c23af5 Author: Fangyu Yu Date: Fri Nov 21 21:35:43 2025 +0800 RISC-V: KVM: Fix guest page fault within HLV* instructions When executing HLV* instructions at the HS mode, a guest page fault may occur when a g-stage page table migration between triggering the virtual instruction exception and executing the HLV* instruction. This may be a corner case, and one simpler way to handle this is to re-execute the instruction where the virtual instruction exception occurred, and the guest page fault will be automatically handled. Fixes: b91f0e4cb8a3 ("RISC-V: KVM: Factor-out instruction emulation into separate sources") Signed-off-by: Fangyu Yu Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251121133543.46822-1-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit df60cb2e67029e07e23c4fdf9e027aaf1f63cc1a Author: Dong Yang Date: Mon Nov 3 14:28:25 2025 +0800 KVM: riscv: Support enabling dirty log gradually in small chunks There is already support of enabling dirty log gradually in small chunks for x86 in commit 3c9bd4006bfc ("KVM: x86: enable dirty log gradually in small chunks") and c862626 ("KVM: arm64: Support enabling dirty log gradually in small chunks"). This adds support for riscv. x86 and arm64 writes protect both huge pages and normal pages now, so riscv protect also protects both huge pages and normal pages. On a nested virtualization setup (RISC-V KVM running inside a QEMU VM on an [Intel® Core™ i5-12500H] host), I did some tests with a 2G Linux VM using different backing page sizes. The time taken for memory_global_dirty_log_start in the L2 QEMU is listed below: Page Size Before After Optimization 4K 4490.23ms 31.94ms 2M 48.97ms 45.46ms 1G 28.40ms 30.93ms Signed-off-by: Quan Zhou Signed-off-by: Dong Yang Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251103062825.9084-1-dayss1224@gmail.com Signed-off-by: Anup Patel commit a2483d5d1ee9b399d8137691cb0d8dc99cfe7684 Author: BillXiang Date: Tue Sep 23 13:38:51 2025 +0800 RISC-V: KVM: Introduce KVM_EXIT_FAIL_ENTRY_NO_VSFILE Currently, we return CSR_HSTATUS as hardware_entry_failure_reason when kvm_riscv_aia_alloc_hgei failed in KVM_DEV_RISCV_AIA_MODE_HWACCEL mode, which is vague so it is better to return a well defined value KVM_EXIT_FAIL_ENTRY_NO_VSFILE provided via uapi/asm/kvm.h. Signed-off-by: BillXiang Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250923053851.32863-1-xiangwencheng@lanxincomputing.com Signed-off-by: Anup Patel commit d1c5620781d590b07543f8d31a5c87abf046c126 Author: Anup Patel Date: Fri Oct 17 21:29:25 2025 +0530 KVM: riscv: selftests: Add SBI MPXY extension to get-reg-list The KVM RISC-V allows SBI MPXY extensions for Guest/VM so add it to the get-reg-list test. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20251017155925.361560-5-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 7050f1d79f1cfaf0de577995df412855de23f752 Author: Anup Patel Date: Fri Oct 17 21:29:24 2025 +0530 RISC-V: KVM: Add SBI MPXY extension support for Guest The SBI MPXY extension is a platform-level functionality so KVM only needs to forward SBI MPXY calls to KVM user-space. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20251017155925.361560-4-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 12fd6c62e9f63af9498596d81aa11eb8396e6ae2 Author: Anup Patel Date: Fri Oct 17 21:29:23 2025 +0530 RISC-V: KVM: Add separate source for forwarded SBI extensions Add a separate source vcpu_sbi_forward.c for SBI extensions which are entirely forwarded to KVM user-space. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20251017155925.361560-3-apatel@ventanamicro.com Signed-off-by: Anup Patel commit e2f3e2d37b065ada3bfdb3b22b1a960eb295c686 Author: Anup Patel Date: Fri Oct 17 21:29:22 2025 +0530 RISC-V: KVM: Convert kvm_riscv_vcpu_sbi_forward() into extension handler All uses of kvm_riscv_vcpu_sbi_forward() also updates retdata->uexit so to further reduce code duplication move retdata->uexit assignment to kvm_riscv_vcpu_sbi_forward() and convert it into SBI extension handler. Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20251017155925.361560-2-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 18191dd750e6c9e17fabefd09ff418dd587bcdb9 Author: Elaine Zhang Date: Fri Nov 21 15:53:50 2025 +0800 clk: rockchip: Add clock and reset driver for RK3506 Add the clock and reset tree definitions for the new RK3506 SoC. Signed-off-by: Finley Xiao Signed-off-by: Elaine Zhang Link: https://patch.msgid.link/20251121075350.2564860-3-zhangqing@rock-chips.com Signed-off-by: Heiko Stuebner commit 84898f8e9cea06f8178fc5ca53f068180f7bfba0 Author: Finley Xiao Date: Fri Nov 21 15:53:49 2025 +0800 dt-bindings: clock: rockchip: Add RK3506 clock and reset unit Add device tree bindings for clock and reset unit on RK3506 SoC. Add clock and reset IDs for RK3506 SoC. Signed-off-by: Finley Xiao Signed-off-by: Elaine Zhang Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20251121075350.2564860-2-zhangqing@rock-chips.com Signed-off-by: Heiko Stuebner commit bc197e24a3acd13dd0b7b07c1448c5c225946546 Author: Alexandre Courbot Date: Sat Nov 22 13:00:49 2025 +0900 rust: num: bounded: Always inline fits_within and from_expr `from_expr` relies on `build_assert` to infer that the passed expression fits the type's boundaries at build time. That inference can only be successful its code (and that of `fits_within`, which performs the check) is inlined, as a dedicated function would need to work with a variable and cannot verify that property. While inlining happens as expected in most cases, it is not guaranteed. In particular, kernel options that optimize for size like `CONFIG_CC_OPTIMIZE_FOR_SIZE` can result in `from_expr` not being inlined. Add `#[inline(always)]` attributes to both `fits_within` and `from_expr` to make the compiler inline these functions more aggressively, as it does not make sense to use them non-inlined anyway. [ For reference, the errors look like: ld.lld: error: undefined symbol: rust_build_error >>> referenced by build_assert.rs:83 (rust/kernel/build_assert.rs:83) >>> rust/doctests_kernel_generated.o:(>::from_expr) in archive vmlinux.a - Miguel ] Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511210055.RUsFNku1-lkp@intel.com/ Suggested-by: Gary Guo Signed-off-by: Alexandre Courbot Link: https://patch.msgid.link/20251122-bounded_ints_fix-v1-1-1e07589d4955@nvidia.com Signed-off-by: Miguel Ojeda commit b6d2a520f4638c2e7d3f2f11946918946941be18 Author: Anna Schumaker Date: Tue Nov 4 10:06:45 2025 -0500 NFS: Add a module option to disable directory delegations When this option is disabled then the client will not request directory delegations or check if we have one during the revalidation paths. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 669c0580ac3757cad4dd16fd7dcb08cfc2abda56 Author: Anna Schumaker Date: Tue Nov 4 10:06:44 2025 -0500 NFS: Shortcut lookup revalidations if we have a directory delegation Holding a directory delegation means we know that nobody else has modified the directory on the server, so we can take a few revalidation shortcuts. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 2da211670782637fd2d4fbba06f91d1e7c70dc0c Author: Anna Schumaker Date: Tue Nov 4 10:06:43 2025 -0500 NFS: Request a directory delegation during RENAME If we notice that we're renaming a file within a directory then we take that as a sign that the user is working with the current directory and may want a delegation to avoid extra revalidations when possible. The nfs_request_directory_delegation() function exists within the NFS v4 module, so I add an extra flag to rename_setup() to indicate if a dentry is being renamed within the same parent directory. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 156b0948293362b036caf49e6e4d97cae30201de Author: Anna Schumaker Date: Tue Nov 4 10:06:42 2025 -0500 NFS: Request a directory delegation on ACCESS, CREATE, and UNLINK This patch adds a new flag: NFS_INO_REQ_DIR_DELEG to signal that a directory wants to request a directory delegation the next time it does a GETATTR. I have the client request a directory delegation when doing an access, create, or unlink call since these calls indicate that a user is working with a directory. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit 130ae65c01862e1ed30ef5ff2258990d7628f360 Author: Anna Schumaker Date: Tue Nov 4 10:06:41 2025 -0500 NFS: Add support for sending GDD_GETATTR I add this to the existing GETATTR compound as an option extra step that we can send if the "dir_deleg" flag is set to 'true'. Actually enabling this value will happen in a later patch. Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust commit e0f8058f2cb56de0b7572f51cd563ca5debce746 Author: Jonathan Curley Date: Wed Nov 12 18:02:42 2025 +0000 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout. Fixes: fe1cf9469d7bc ("pNFS: Clear all layout segment state in pnfs_mark_layout_stateid_invalid") Signed-off-by: Jonathan Curley Signed-off-by: Trond Myklebust commit 9e9fdd0ad0fba799dbae7ecfd167199885fb63a1 Author: Olga Kornievskaia Date: Tue Nov 4 17:29:27 2025 -0500 NFSv4.1: protect destroying and nullifying bc_serv structure When we are shutting down the client, we free the callback server structure and then at a later pointer we free the transport used by the client. Yet, it's possible that after the callback server is freed, the transport receives a backchannel request at which point we can dereferene freed memory. Instead, do the freeing the bc server and nullying bc_serv under the lock. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 6f8b26c90a4d645fd5c944c41a6f0fd61ec27c50 Author: Olga Kornievskaia Date: Tue Nov 4 17:29:26 2025 -0500 SUNRPC: new helper function for stopping backchannel server Create a new backchannel function to stop the backchannel server and clear the bc_serv in transport protected under the bc_pa_lock. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 441244d4273a8037b265fd254dfdaca5fa736ee2 Author: Olga Kornievskaia Date: Tue Nov 4 17:29:25 2025 -0500 SUNRPC: cleanup common code in backchannel request Create a helper function for common code between rdma and tcp backchannel handling of the backchannel request. Make sure that access is protected by the bc_pa_lock lock. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 8936ff47367e7ef659db6cfd70fb3dd060cc702a Author: Olga Kornievskaia Date: Tue Nov 4 17:29:24 2025 -0500 NFSv4.1: pass transport for callback shutdown When we are setting up the 4.1 callback server, we pass in the appropriate rpc_xprt transport pointer with which to associate the callback server structure. Similarly, pass in the rpc_xprt pointer for when we are shutting down the callback. This will be used to make sure that we free the server structure and then clear the rpc_xprt's bc_server pointer in a safe manner. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit 4f0382b0901b43552b600f8e5f806295778b0fb0 Author: Eric Biggers Date: Sat Nov 22 11:42:06 2025 -0800 lib/crypto: sha2: Add at_least decoration to fixed-size array params Add the at_least (i.e. 'static') decoration to the fixed-size array parameters of the sha2 library functions. This causes clang to warn when a too-small array of known size is passed. Acked-by: Ard Biesheuvel Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251122194206.31822-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d5cc4e731de7edb1a2b7940d0f0badf9956dddb7 Author: Eric Biggers Date: Sat Nov 22 11:42:05 2025 -0800 lib/crypto: sha1: Add at_least decoration to fixed-size array params Add the at_least (i.e. 'static') decoration to the fixed-size array parameters of the sha1 library functions. This causes clang to warn when a too-small array of known size is passed. Acked-by: Ard Biesheuvel Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251122194206.31822-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c2099fa61664e8fe8844cccdb7d1d18a5f0f94d1 Author: Eric Biggers Date: Sat Nov 22 11:42:04 2025 -0800 lib/crypto: poly1305: Add at_least decoration to fixed-size array params Add the at_least (i.e. 'static') decoration to the fixed-size array parameters of the poly1305 library functions. This causes clang to warn when a too-small array of known size is passed. Acked-by: Ard Biesheuvel Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251122194206.31822-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 580f1d31dff62b0f0034304bd75f169b8fec6f36 Author: Eric Biggers Date: Sat Nov 22 11:42:03 2025 -0800 lib/crypto: md5: Add at_least decoration to fixed-size array params Add the at_least (i.e. 'static') decoration to the fixed-size array parameters of the md5 library functions. This causes clang to warn when a too-small array of known size is passed. Acked-by: Ard Biesheuvel Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251122194206.31822-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2143d622cdf3bf93e61f2e0a728487bc871785e5 Author: Eric Biggers Date: Sat Nov 22 11:42:02 2025 -0800 lib/crypto: curve25519: Add at_least decoration to fixed-size array params Add the at_least (i.e. 'static') decoration to the fixed-size array parameters of the curve25519 library functions. This causes clang to warn when a too-small array of known size is passed. Acked-by: Ard Biesheuvel Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251122194206.31822-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1b31b43bf5c2b7ae8b0f9acac036354ea28b0397 Author: Eric Biggers Date: Sat Nov 22 11:42:01 2025 -0800 lib/crypto: chacha: Add at_least decoration to fixed-size array params Add the at_least (i.e. 'static') decoration to the fixed-size array parameters of the chacha library functions. This causes clang to warn when a too-small array of known size is passed. Acked-by: Ard Biesheuvel Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251122194206.31822-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ac653d57ad8bb873c1c68fe77a1dee81cc1e365d Author: Jason A. Donenfeld Date: Sun Nov 23 06:48:20 2025 +0100 lib/crypto: chacha20poly1305: Statically check fixed array lengths Several parameters of the chacha20poly1305 functions require arrays of an exact length. Use the new at_least keyword to instruct gcc and clang to statically check that the caller is passing an object of at least that length. Here it is in action, with this faulty patch to wireguard's cookie.h: struct cookie_checker { u8 secret[NOISE_HASH_LEN]; - u8 cookie_encryption_key[NOISE_SYMMETRIC_KEY_LEN]; + u8 cookie_encryption_key[NOISE_SYMMETRIC_KEY_LEN - 1]; u8 message_mac1_key[NOISE_SYMMETRIC_KEY_LEN]; If I try compiling this code, I get this helpful warning: CC drivers/net/wireguard/cookie.o drivers/net/wireguard/cookie.c: In function ‘wg_cookie_message_create’: drivers/net/wireguard/cookie.c:193:9: warning: ‘xchacha20poly1305_encrypt’ reading 32 bytes from a region of size 31 [-Wstringop-overread] 193 | xchacha20poly1305_encrypt(dst->encrypted_cookie, cookie, COOKIE_LEN, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 194 | macs->mac1, COOKIE_LEN, dst->nonce, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 195 | checker->cookie_encryption_key); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireguard/cookie.c:193:9: note: referencing argument 7 of type ‘const u8 *’ {aka ‘const unsigned char *’} In file included from drivers/net/wireguard/messages.h:10, from drivers/net/wireguard/cookie.h:9, from drivers/net/wireguard/cookie.c:6: include/crypto/chacha20poly1305.h:28:6: note: in a call to function ‘xchacha20poly1305_encrypt’ 28 | void xchacha20poly1305_encrypt(u8 *dst, const u8 *src, const size_t src_len, Acked-by: Ard Biesheuvel Signed-off-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251123054819.2371989-4-Jason@zx2c4.com Signed-off-by: Eric Biggers commit 074e16d58e6b78612c22ff611aa469ee929cc37f Author: Jason A. Donenfeld Date: Sun Nov 23 06:48:19 2025 +0100 compiler_types: introduce at_least parameter decoration pseudo keyword Clang and recent gcc support warning if they are able to prove that the user is passing to a function an array that is too short in size. For example: void blah(unsigned char herp[at_least 7]); static void schma(void) { unsigned char good[] = { 1, 2, 3, 4, 5, 6, 7 }; unsigned char bad[] = { 1, 2, 3, 4, 5, 6 }; blah(good); blah(bad); } The notation here, `static 7`, which this commit makes explicit by allowing us to write it as `at_least 7`, means that it's incorrect to pass anything less than 7 elements. This is section 6.7.5.3 of C99: If the keyword static also appears within the [ and ] of the array type derivation, then for each call to the function, the value of the corresponding actual argument shall provide access to the first element of an array with at least as many elements as specified by the size expression. Here is the output from gcc 15: zx2c4@thinkpad /tmp $ gcc -c a.c a.c: In function ‘schma’: a.c:9:9: warning: ‘blah’ accessing 7 bytes in a region of size 6 [-Wstringop-overflow=] 9 | blah(bad); | ^~~~~~~~~ a.c:9:9: note: referencing argument 1 of type ‘unsigned char[7]’ a.c:2:6: note: in a call to function ‘blah’ 2 | void blah(unsigned char herp[at_least 7]); | ^~~~ And from clang 21: zx2c4@thinkpad /tmp $ clang -c a.c a.c:9:2: warning: array argument is too small; contains 6 elements, callee requires at least 7 [-Warray-bounds] 9 | blah(bad); | ^ ~~~ a.c:2:25: note: callee declares array parameter as static here 2 | void blah(unsigned char herp[at_least 7]); | ^ ~~~~~~~~~~ 1 warning generated. So these are covered by, variously, -Wstringop-overflow and -Warray-bounds. Acked-by: Ard Biesheuvel Signed-off-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251123054819.2371989-3-Jason@zx2c4.com Signed-off-by: Eric Biggers commit d96f5620549809af95493ce9a93417d0ac9c5c8b Author: Jason A. Donenfeld Date: Sun Nov 23 06:48:17 2025 +0100 wifi: iwlwifi: trans: rename at_least variable to min_mode The subsequent commit is going to add a macro that redefines `at_least` to mean something else. Given that the usage here in iwlwifi is the only use of that identifier in the whole kernel, just rename it to a more fitting name, `min_mode`. Cc: Miri Korenblit Acked-by: Ard Biesheuvel Signed-off-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20251123054819.2371989-1-Jason@zx2c4.com Signed-off-by: Eric Biggers commit a762f883ecf6eed3c0c57e7afa97fba09287a40a Author: Miguel Ojeda Date: Sun Nov 23 17:35:36 2025 +0100 rust: i2c: prepare for `core::ffi::CStr` The rust-next tree contains commit: 3b83f5d5e78a ("rust: replace `CStr` with `core::ffi::CStr`") which, when merged together with commits: 57c5bd9aee94 ("rust: i2c: add basic I2C device and driver abstractions") f3cc26a417b7 ("rust: i2c: add manual I2C device creation abstractions") from this tree (driver-core), produces errors like the following: error[E0599]: no method named `len_with_nul` found for reference `&'static ffi::CStr` in the current scope --> rust/kernel/i2c.rs:48:16 | 48 | id.len_with_nul() <= Self::I2C_NAME_SIZE, | ^^^^^^^^^^^^ method not found in `&CStr` error[E0599]: no method named `as_bytes_with_nul` found for reference `&'static ffi::CStr` in the current scope --> rust/kernel/i2c.rs:51:22 | 51 | let src = id.as_bytes_with_nul(); | ^^^^^^^^^^^^^^^^^ | help: there is a method `to_bytes_with_nul` with a similar name | 51 | let src = id.to_bytes_with_nul(); | ~~~~~~~~~~~~~~~~~ which were detected in linux-next by Stephen [1]. The `i2c` code can be independently prepared to be ready for the change, thus do so. The change is similar to the one done by Tamir in commit 657403637f7d ("rust: acpi: use `core::ffi::CStr` method names"). Link: https://lore.kernel.org/all/20251120181111.65ce75a0@canb.auug.org.au/ [1] Signed-off-by: Miguel Ojeda Link: https://patch.msgid.link/20251123163536.1771801-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 Author: Scott Mayhew Date: Mon Nov 3 10:44:15 2025 -0500 NFSv4: ensure the open stateid seqid doesn't go backwards We have observed an NFSv4 client receiving a LOCK reply with a status of NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an earlier seqid value in the stateid. As this was for a new lockowner, that would imply that nfs_set_open_stateid_locked() had updated the open stateid seqid with an earlier value. Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out of sequence, the task will sleep on the state->waitq for up to 5 seconds. If the task waits for the full 5 seconds, then after finishing the wait it'll update the open stateid seqid with whatever value the incoming seqid has. If there are multiple waiters in this scenario, then the last one to perform said update may not be the one with the highest seqid. Add a check to ensure that the seqid can only be incremented, and add a tracepoint to indicate when old seqids are skipped. Signed-off-by: Scott Mayhew Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 123b5eb726fd1c93dbc0a7e7fca81680f81a790b Author: René Rebe Date: Sat Nov 22 13:19:40 2025 +0100 riscv: dts: sifive: unmatched: Add PWM controlled fans This adds the two PWM-controlled fans of the HiFive Unmatched board to the device tree. Signed-off-by: René Rebe Signed-off-by: Conor Dooley commit dc30fe7a0a850a88b930581d837e9a668dbcb206 Author: Thorsten Blum Date: Wed Nov 12 18:21:21 2025 +0100 PM / devfreq: tegra30: use min to simplify actmon_cpu_to_emc_rate Use min() to improve the readability of actmon_cpu_to_emc_rate() and remove any unnecessary curly braces. Reviewed-by: Dmitry Osipenko Signed-off-by: Thorsten Blum Acked-by: Thierry Reding Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20251112172121.3741-2-thorsten.blum@linux.dev/ commit 26dd44a40096468396b6438985d8e44e0743f64c Author: Pengjie Zhang Date: Mon Sep 15 14:21:35 2025 +0800 PM / devfreq: hisi: Fix potential UAF in OPP handling Ensure all required data is acquired before calling dev_pm_opp_put(opp) to maintain correct resource acquisition and release order. Fixes: 7da2fdaaa1e6 ("PM / devfreq: Add HiSilicon uncore frequency scaling driver") Signed-off-by: Pengjie Zhang Reviewed-by: Jie Zhan Acked-by: Chanwoo Choi Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20250915062135.748653-1-zhangpengjie2@huawei.com/ commit 447c4e8338dbfad517769d26b53d633b88d51184 Author: Dmitry Baryshkov Date: Thu Oct 30 20:26:28 2025 +0200 PM / devfreq: Move governor.h to a public header location Some device drivers (and out-of-tree modules) might want to define device-specific device governors. Rather than restricting all of them to be a part of drivers/devfreq/ (which is not possible for out-of-tree drivers anyway) move governor.h to include/linux/devfreq-governor.h and update all drivers to use it. The devfreq_cpu_data is only used internally, by the passive governor, so it is moved to the driver source rather than being a part of the public interface. Reported-by: Robie Basak Acked-by: Jon Hunter Signed-off-by: Dmitry Baryshkov Reviewed-by: Bjorn Andersson Acked-by: MyungJoo Ham Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20251030-governor-public-v2-1-432a11a9975a@oss.qualcomm.com/ commit 48233291461b0539d798d00aaacccf1b3b163102 Author: Thomas Weißschuh Date: Tue Oct 14 14:17:23 2025 +0200 mempool: clarify behavior of mempool_alloc_preallocated() The documentation of that function promises to never sleep. However on PREEMPT_RT a spinlock_t might in fact sleep. Reword the documentation so users can predict its behavior better. mempool could also replace spinlock_t with raw_spinlock_t which doesn't sleep even on PREEMPT_RT but that would take away the improved preemptibility of sleeping locks. Link: https://lkml.kernel.org/r/20251014-mempool-doc-v1-1-bc9ebf169700@linutronix.de Signed-off-by: Thomas Weißschuh Acked-by: Vlastimil Babka Cc: Christoph Lameter Cc: David Rientjes Cc: Roman Gushchin Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: "Vishal Moola (Oracle)" Signed-off-by: Andrew Morton Signed-off-by: Vlastimil Babka commit 07723a41eee9525a90d027f7ca49d33fcd47e775 Author: Christoph Hellwig Date: Thu Nov 13 09:39:52 2025 +0100 mempool: drop the file name in the top of file comment Mentioning the name of the file is redundant, so drop it. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-12-hch@lst.de Signed-off-by: Vlastimil Babka commit 0cab6873b7305abdd0acd95ee8cfa56b983500da Author: Christoph Hellwig Date: Thu Nov 13 09:39:51 2025 +0100 mempool: de-typedef Switch all uses of the deprecated mempool_t typedef in the core mempool code to use struct mempool instead. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-11-hch@lst.de Signed-off-by: Vlastimil Babka commit 8b41fb80a2cc023591f47d63b094e96af9c2c615 Author: Christoph Hellwig Date: Thu Nov 13 09:39:50 2025 +0100 mempool: remove mempool_{init,create}_kvmalloc_pool This was added for bcachefs and is unused now. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-10-hch@lst.de Signed-off-by: Vlastimil Babka commit 9c4391767f31d4114da577ab87437f28c1171d6d Author: Christoph Hellwig Date: Thu Nov 13 09:39:49 2025 +0100 mempool: legitimize the io_schedule_timeout in mempool_alloc_from_pool The timeout here is and old workaround with a Fixme comment. But thinking about it, it makes sense to keep it, so reword the comment. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-9-hch@lst.de Signed-off-by: Vlastimil Babka commit ac529d86ad26d632d3c70b7c5b839282a3294d2f Author: Christoph Hellwig Date: Thu Nov 13 09:39:48 2025 +0100 mempool: add mempool_{alloc,free}_bulk Add a version of the mempool allocator that works for batch allocations of multiple objects. Calling mempool_alloc in a loop is not safe because it could deadlock if multiple threads are performing such an allocation at the same time. As an extra benefit the interface is build so that the same array can be used for alloc_pages_bulk / release_pages so that at least for page backed mempools the fast path can use a nice batch optimization. Note that mempool_alloc_bulk does not take a gfp_mask argument as it must always be able to sleep and doesn't support any non-trivial modifiers. NOFO or NOIO constrainst must be set through the scoped API. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-8-hch@lst.de Signed-off-by: Vlastimil Babka commit 1742d97df628de55c0df1a0eb6eefb27136ee890 Author: Christoph Hellwig Date: Thu Nov 13 09:39:47 2025 +0100 mempool: factor out a mempool_alloc_from_pool helper Add a helper for the mempool_alloc slowpath to better separate it from the fast path, and also use it to implement mempool_alloc_preallocated which shares the same logic. [hughd@google.com: fix lack of retrying with __GFP_DIRECT_RECLAIM] [vbabka@suse.cz: really use limited flags for first mempool attempt] Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-7-hch@lst.de Signed-off-by: Vlastimil Babka commit e6a11a526ec63e456d725f67cebcf4f42b2ec2aa Author: Yue Haibing Date: Thu Nov 20 20:10:37 2025 +0800 x86/{boot,mtrr}: Remove unused function declarations Commits 28be1b454c2b ("x86/boot: Remove unused copy_*_gs() functions") 34d2819f2078 ("x86, mtrr: Remove unused mtrr/state.c") removed the functions but left the prototypes. Remove them. [ bp: Merge into a single patch. ] Signed-off-by: Yue Haibing Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251120121037.1479334-1-yuehaibing@huawei.com commit 9c1fbc56ca0a98113e75dcc5030103a02eff8897 Author: Lorenzo Pieralisi Date: Tue Oct 21 14:41:03 2025 +0200 irqchip/gic-its: Rework platform MSI deviceID detection Current code retrieving platform devices MSI devID in the GIC ITS MSI parent helpers suffers from some minor issues: - It leaks a struct device_node reference - It is duplicated between GICv3 and GICv5 for no good reason - It does not use the OF phandle iterator code that simplifies the msi-parent property parsing Consolidate GIC v3 and v5 deviceID retrieval in a function that addresses the full set of issues in one go by merging GIC v3 and v5 code and converting the msi-parent parsing loop to the more modern OF phandle iterator API, fixing the struct device_node reference leak in the process. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Frank Li Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20251021124103.198419-6-lpieralisi@kernel.org commit 4f32612f6a4e5a9b1344aebf856aa1a1581a426d Author: Lorenzo Pieralisi Date: Tue Oct 21 14:41:02 2025 +0200 PCI: iproc: Implement MSI controller node detection with of_msi_xlate() The functionality implemented in the iproc driver in order to detect an OF MSI controller node is now fully implemented in of_msi_xlate(). Replace the current msi-map/msi-parent parsing code with of_msi_xlate(). Since of_msi_xlate() is also a deviceID mapping API, pass in a fictitious 0 as deviceID - the driver only requires detecting the OF MSI controller node not the deviceID mapping per-se (of_msi_xlate() return value is ignored for the same reason). Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Frank Li Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20251021124103.198419-5-lpieralisi@kernel.org commit ebb922c920cefbeb2ce93775a66da0df479661cc Merge: ac646f44956edc dcb6fa37fd7bc9 Author: Thomas Gleixner Date: Sat Nov 22 17:07:57 2025 +0100 Merge tag 'v6.18-rc3' into irq/msi Pick up OF changes to resolve dependencies commit ac7de456a37f9b126eb53b89c2bb27d625dc5fd9 Author: Babu Moger Date: Wed Nov 12 18:57:36 2025 -0600 fs/resctrl: Update bit_usage to reflect io_alloc The "shareable_bits" and "bit_usage" resctrl files associated with cache resources give insight into how instances of a cache is used. Update the annotated capacity bitmasks displayed by "bit_usage" to include the cache portions allocated for I/O via the "io_alloc" feature. "shareable_bits" is a global bitmask of shareable cache with I/O and can thus not present the per-domain I/O allocations possible with the "io_alloc" feature. Revise the "shareable_bits" documentation to direct users to "bit_usage" for accurate cache usage information. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/e02a0d424129fd7f3e45822a559b1c614ae4652a.1762995456.git.babu.moger@amd.com commit 28fa2cce7a8388f09e457f1e24241ca6d5e985d8 Author: Babu Moger Date: Wed Nov 12 18:57:35 2025 -0600 fs/resctrl: Introduce interface to modify io_alloc capacity bitmasks The io_alloc feature in resctrl enables system software to configure the portion of the cache allocated for I/O traffic. When supported, the io_alloc_cbm file in resctrl provides access to capacity bitmasks (CBMs) allocated for I/O devices. Enable users to modify io_alloc CBMs by writing to the io_alloc_cbm resctrl file when the io_alloc feature is enabled. Mirror the CBMs between CDP_CODE and CDP_DATA when CDP is enabled to present consistent I/O allocation information to user space. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/67609641b03ccfba18a8ee0bf9dbd1f3dcbecda3.1762995456.git.babu.moger@amd.com commit 1463299a227d02b40c842a5d91d989cb26da5bbb Author: Jon Hunter Date: Thu Nov 6 19:05:50 2025 +0000 memory: tegra186-emc: Fix missing put_bpmp Commit a52ddb98a674 ("memory: tegra186-emc: Simplify and handle deferred probe with dev_err_probe()") accidently dropped a call to 'put_bpmp' to release a handle to the BPMP when getting the EMC clock fails. Fix this by restoring the 'goto put_bpmp' if devm_clk_get() fails. Fixes: a52ddb98a674 ("memory: tegra186-emc: Simplify and handle deferred probe with dev_err_probe()") Signed-off-by: Jon Hunter Link: https://patch.msgid.link/20251106190550.1776974-1-jonathanh@nvidia.com Signed-off-by: Krzysztof Kozlowski commit af1242eeca50b20076d1bc9a41653005634a8a4f Author: Babu Moger Date: Wed Nov 12 18:57:34 2025 -0600 fs/resctrl: Modify struct rdt_parse_data to pass mode and CLOSID parse_cbm() requires resource group mode and CLOSID to validate the capacity bitmask (CBM). It is passed via struct rdtgroup in struct rdt_parse_data. The io_alloc feature also uses CBMs to indicate which portions of cache are allocated for I/O traffic. The CBMs are provided by user space and need to be validated the same as CBMs provided for general (CPU) cache allocation. parse_cbm() cannot be used as-is since io_alloc does not have rdtgroup context. Pass the resource group mode and CLOSID directly to parse_cbm() via struct rdt_parse_data, instead of through the rdtgroup struct, to facilitate calling parse_cbm() to verify the CBM of the io_alloc feature. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/f8ec6ab5cf594d906a3fe75f56793d5fbd63f38f.1762995456.git.babu.moger@amd.com commit 1d573464749cfcdfee695c256bcf9ec9cffcbdce Author: Thomas Weißschuh Date: Sat Nov 22 12:01:58 2025 +0100 selftests/nolibc: error out on linker warnings If the linker emits warnings these should abort the build. Otherwise they will be swallowed by run-tests.sh and not shown. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit 682bf67529fd9d63a94af658b779f9cce549c6d1 Author: Thomas Weißschuh Date: Sat Nov 22 12:01:57 2025 +0100 selftests/nolibc: use lld to link loongarch binaries LLVM 21 switched to -mcmodel=medium for LoongArch64 compilations. This code model uses R_LARCH_ECALL36 relocations which might not be supported by GNU ld which to nolibc testsuite uses by default. ld will not resolve the relocation and all function calls will end up as busy loops. Use lld instead. We can not switch to lld for all LLVM builds, as it does not support all necessary architectures. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit 77b662326200135fe72cedc47fb1b0e5679d604d Author: Babu Moger Date: Wed Nov 12 18:57:33 2025 -0600 fs/resctrl: Introduce interface to display io_alloc CBMs Introduce the "io_alloc_cbm" resctrl file to display the capacity bitmasks (CBMs) that represent the portions of each cache instance allocated for I/O traffic on a cache resource that supports the "io_alloc" feature. io_alloc_cbm resides in the info directory of a cache resource, for example, /sys/fs/resctrl/info/L3/. Since the resource name is part of the path, it is not necessary to display the resource name as done in the schemata file. When CDP is enabled, io_alloc routes traffic using the highest CLOSID associated with the CDP_CODE resource and that CLOSID becomes unusable for the CDP_DATA resource. The highest CLOSID of CDP_CODE and CDP_DATA resources will be kept in sync to ensure consistent user interface. In preparation for this, access the CBMs for I/O traffic through highest CLOSID of either CDP_CODE or CDP_DATA resource. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/55a3ff66a70e7ce8239f022e62b334e9d64af604.1762995456.git.babu.moger@amd.com commit 3de5e46e50abc01a1cee7e12b657e083fc5ed638 Author: Frederic Weisbecker Date: Fri Nov 21 15:35:00 2025 +0100 genirq: Remove cpumask availability check on kthread affinity setting Failing to allocate the affinity mask of an interrupt descriptor fails the whole descriptor initialization. It is then guaranteed that the cpumask is always available whenever the related interrupt objects are alive, such as the kthread handler. Therefore remove the superfluous check since it is merely a historical leftover. Get rid also of the comments above it that are obsolete and useless. Suggested-by: Thomas Gleixner Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251121143500.42111-4-frederic@kernel.org commit 801afdfbfcd90ff62a4b2469bbda1d958f7a5353 Author: Frederic Weisbecker Date: Fri Nov 21 15:34:59 2025 +0100 genirq: Fix interrupt threads affinity vs. cpuset isolated partitions When a cpuset isolated partition is created / updated or destroyed, the interrupt threads are affined blindly to all the non-isolated CPUs. This happens without taking into account the interrupt threads initial affinity that becomes ignored. For example in a system with 8 CPUs, if an interrupt and its kthread are initially affine to CPU 5, creating an isolated partition with only CPU 2 inside will eventually end up affining the interrupt kthread to all CPUs but CPU 2 (that is CPUs 0,1,3-7), losing the kthread preference for CPU 5. Besides the blind re-affining, this doesn't take care of the actual low level interrupt which isn't migrated. As of today the only way to isolate non managed interrupts, along with their kthreads, is to overwrite their affinity separately, for example through /proc/irq/ To avoid doing that manually, future development should focus on updating the interrupt's affinity whenever cpuset isolated partitions are updated. In the meantime, cpuset shouldn't fiddle with interrupt threads directly. To prevent from that, set the PF_NO_SETAFFINITY flag to them. This is done through kthread_bind_mask() by affining them initially to all possible CPUs as at that point the interrupt is not started up which means the affinity of the hard interrupt is not known. The thread will adjust that once it reaches the handler, which is guaranteed to happen after the initial affinity of the hard interrupt is established. Suggested-by: Thomas Gleixner Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251121143500.42111-3-frederic@kernel.org commit 68775ca79af3b8d4c147598983ece012d7007bac Author: Frederic Weisbecker Date: Fri Nov 21 15:34:58 2025 +0100 genirq: Prevent early spurious wake-ups of interrupt threads During initialization, the interrupt thread is created before the interrupt is enabled. The interrupt enablement happens before the actual kthread wake up point. Once the interrupt is enabled the hardware can raise an interrupt and once setup_irq() drops the descriptor lock a interrupt wake-up can happen. Even when such an interrupt can be considered premature, this is not a problem in general because at the point where the descriptor lock is dropped and the wakeup can happen, the data which is used by the thread is fully initialized. Though from the perspective of least surprise, the initial wakeup really should be performed by the setup code and not randomly by a premature interrupt. Prevent this by performing a wake-up only if the target is in state TASK_INTERRUPTIBLE, which the thread uses in wait_for_interrupt(). If the thread is still in state TASK_UNINTERRUPTIBLE, the wake-up is not lost because after the setup code completed the initial wake-up the thread will observe the IRQTF_RUNTHREAD and proceed with the handling. [ tglx: Simplified the changes and extended the changelog. ] Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251121143500.42111-2-frederic@kernel.org commit c42732087341e3c1ae34b25cc318609cacd866ac Merge: 8f7cf305a15eec cf49ec5705a6fb Author: Alexei Starovoitov Date: Fri Nov 21 18:35:00 2025 -0800 Merge branch 'bpf-nested-rcu-critical-sections' Puranjay Mohan says: ==================== bpf: Nested rcu critical sections v1: https://lore.kernel.org/bpf/20250916113622.19540-1-puranjay@kernel.org/ Changes in v1->v2: - Move the addition of new tests to a separate patch (Alexei) - Avoid incrementing active_rcu_locks at two places (Eduard) Support nested rcu critical sections by making the boolean flag active_rcu_lock a counter and use it to manage rcu critical section state. bpf_rcu_read_lock() increments this counter and bpf_rcu_read_unlock() decrements it, MEM_RCU -> PTR_UNTRUSTED transition happens when active_rcu_locks drops to 0. ==================== Link: https://patch.msgid.link/20251117200411.25563-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit cf49ec5705a6fb635ac9c2626f9ac7a39344b1f5 Author: Puranjay Mohan Date: Mon Nov 17 20:04:10 2025 +0000 selftests: bpf: Add tests for unbalanced rcu_read_lock As verifier now supports nested rcu critical sections, add new test cases to make sure unbalanced usage of rcu_read_lock()/unlock() is rejected. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251117200411.25563-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 4167096cb964325ed88cd558f5b0c61fcaab44c1 Author: Puranjay Mohan Date: Mon Nov 17 20:04:09 2025 +0000 bpf: support nested rcu critical sections Currently, nested rcu critical sections are rejected by the verifier and rcu_lock state is managed by a boolean variable. Add support for nested rcu critical sections by make active_rcu_locks a counter similar to active_preempt_locks. bpf_rcu_read_lock() increments this counter and bpf_rcu_read_unlock() decrements it, MEM_RCU -> PTR_UNTRUSTED transition happens when active_rcu_locks drops to 0. Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251117200411.25563-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit e05021a829b834fecbd42b173e55382416571b2c Merge: 501253b61d8437 9b60ba512c7f82 Author: Jakub Kicinski Date: Fri Nov 21 18:13:46 2025 -0800 Merge branch 'net-stmmac-qcon-ethqos-rgmii-accessor-cleanups' Russell King says: ==================== net: stmmac: qcon-ethqos: "rgmii" accessor cleanups This series cleans up the "rgmii" accessors in qcom-ethqos. readl() and writel() return and take a u32 for the value. Rather than implicitly casting this to an int, keep it as a u32. Add set/clear functions to reduce the code and make it easier to read. Finally, convert the open-coded poll loops to use the iopoll helpers. Note that patch 1 has a checkpatch warning concerning "volatile" - I'm changing the type here, and the "volatile" is removed in patch 3. I do not feel it is appropriate to remove it in patch 1. ==================== Link: https://patch.msgid.link/aR76i0HjXitfl7xk@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9b60ba512c7f82739b705d94c41c38d4bf6b0235 Author: Russell King (Oracle) Date: Thu Nov 20 11:25:27 2025 +0000 net: stmmac: qcom-ethqos: use read_poll_timeout_atomic() Use read_poll_timeout_atomic() to poll the rgmii registers rather than open-coding the polling. Reviewed-by: Konrad Dybcio Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vM2n1-0000000FRTu-0js9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 819212185ae5460e63485ff42ef92a3d1b9ec0c7 Author: Russell King (Oracle) Date: Thu Nov 20 11:25:22 2025 +0000 net: stmmac: qcom-ethqos: add rgmii set/clear functions The driver has a lot of bit manipulation of the RGMII registers. Add a pair of helpers to set bits and clear bits, converting the various calls to rgmii_updatel() as appropriate. Most of the change was done via this sed script: /rgmii_updatel/ { N /,$/N /mask, / ! { s|rgmii_updatel\(([^,]*,\s+([^,]*),\s+)\2,\s+|rgmii_setmask(\1| s|rgmii_updatel\(([^,]*,\s+([^,]*),\s+)0,\s+|rgmii_clrmask(\1| s|^\s+$|| } } and then formatting tweaked where necessary. Signed-off-by: Russell King (Oracle) Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/E1vM2mw-0000000FRTo-0End@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f54bbd390f5fc038cf6ad75432c83b3cedf9bef4 Author: Russell King (Oracle) Date: Thu Nov 20 11:25:16 2025 +0000 net: stmmac: qcom-ethqos: use u32 for rgmii read/write/update readl() returns a u32, and writel() takes a "u32" for the value. These are used in rgmii_readl()() and rgmii_writel(), but the value and return are "int". As these are 32-bit register values which are not signed, use "u32". These changes do not cause generated code changes. Update rgmii_updatel() to use u32 for mask and val. Changing "mask" to "u32" also does not cause generated code changes. However, changing "val" causes the generated assembly to be re-ordered for aarch64. Update the temporary variables used with the rgmii functions to use u32. Signed-off-by: Russell King (Oracle) Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/E1vM2mq-0000000FRTi-3y5F@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 501253b61d843745e6e1f1fd3b39a49785ffcbf4 Author: Slark Xiao Date: Thu Nov 20 19:52:08 2025 +0800 net: wwan: t7xx: Make local function static This function was used in t7xx_hif_cldma.c only. Make it static as it should be. Signed-off-by: Slark Xiao Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20251120115208.345578-1-slark_xiao@163.com Signed-off-by: Jakub Kicinski commit 20d868a77f11ba050fe96e7b8efb8ec3b6f2737f Author: Eric Biggers Date: Sat Nov 15 15:08:17 2025 -0800 Revert "crypto: scatterwalk - Move skcipher walk and use it for memcpy_sglist" This reverts commit 0f8d42bf128d349ad490e87d5574d211245e40f1, with the memcpy_sglist() part dropped. Now that memcpy_sglist() no longer uses the skcipher_walk code, the skcipher_walk code can be moved back to where it belongs. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 4dffc9bbffb9ccfcda730d899c97c553599e7ca8 Author: Eric Biggers Date: Sat Nov 15 15:08:16 2025 -0800 crypto: scatterwalk - Fix memcpy_sglist() to always succeed The original implementation of memcpy_sglist() was broken because it didn't handle scatterlists that describe exactly the same memory, which is a case that many callers rely on. The current implementation is broken too because it calls the skcipher_walk functions which can fail. It ignores any errors from those functions. Fix it by replacing it with a new implementation written from scratch. It always succeeds. It's also a bit faster, since it avoids the overhead of skcipher_walk. skcipher_walk includes a lot of functionality (such as alignmask handling) that's irrelevant here. Reported-by: Colin Ian King Closes: https://lore.kernel.org/r/20251114122620.111623-1-coking@nvidia.com Fixes: 131bdceca1f0 ("crypto: scatterwalk - Add memcpy_sglist") Fixes: 0f8d42bf128d ("crypto: scatterwalk - Move skcipher walk and use it for memcpy_sglist") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 5727a844a3f79b835470aff44a39f6d970ec45dd Author: Kanchana P Sridhar Date: Fri Nov 14 10:27:13 2025 -0800 crypto: iaa - Request to add Kanchana P Sridhar to Maintainers. As suggested by Herbert, I would like to request to be added as a Maintainer for the iaa_crypto driver. Suggested-by: Herbert Xu Signed-off-by: Kanchana P Sridhar Signed-off-by: Herbert Xu commit bfc11a84e08c5945f0ddefbb8058402a7f32819d Author: Eric Biggers Date: Thu Nov 13 19:03:44 2025 -0800 crypto: tcrypt - Remove unused poly1305 support Since the crypto_shash support for poly1305 was removed, the tcrypt support for it is now unused as well. Support for benchmarking the kernel's Poly1305 code is now provided by the poly1305 kunit test. Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit c7dcb041ce7d32c0becd43e8f99f993365e6bd20 Author: Eric Biggers Date: Thu Nov 13 18:57:08 2025 -0800 crypto: ansi_cprng - Remove unused ansi_cprng algorithm Remove ansi_cprng, since it's obsolete and unused, as confirmed at https://lore.kernel.org/r/aQxpnckYMgAAOLpZ@gondor.apana.org.au/ This was originally added in 2008, apparently as a FIPS approved random number generator. Whether this has ever belonged upstream is questionable. Either way, ansi_cprng is no longer usable for this purpose, since it's been superseded by the more modern algorithms in crypto/drbg.c, and FIPS itself no longer allows it. (NIST SP 800-131A Rev 1 (2015) says that RNGs based on ANSI X9.31 will be disallowed after 2015. NIST SP 800-131A Rev 2 (2019) confirms they are now disallowed.) Therefore, there is no reason to keep it around. Suggested-by: Herbert Xu Cc: Haotian Zhang Cc: Neil Horman Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit 79492d5adf456051908878816f1682144962be75 Author: Ally Heev Date: Tue Nov 11 19:06:29 2025 +0530 crypto: asymmetric_keys - fix uninitialized pointers with free attribute Uninitialized pointers with `__free` attribute can cause undefined behavior as the memory assigned randomly to the pointer is freed automatically when the pointer goes out of scope. crypto/asymmetric_keys doesn't have any bugs related to this as of now, but, it is better to initialize and assign pointers with `__free` attribute in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev Reviewed-by: Ignat Korchagin Signed-off-by: Herbert Xu commit a26c23e0d679cbb0de91e96e6384daef2dcfd6c8 Author: Gustavo A. R. Silva Date: Mon Nov 10 19:46:45 2025 +0900 KEYS: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix the following warning: crypto/asymmetric_keys/restrict.c:20:34: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of MEMBERS that would otherwise follow it. This overlays the trailing MEMBER unsigned char data[10]; onto the FAM struct asymmetric_key_id::data[], while keeping the FAM and the start of MEMBER aligned. The static_assert() ensures this alignment remains, and it's intentionally placed inmediately after the corresponding structures --no blank line in between. Signed-off-by: Gustavo A. R. Silva Reviewed-by: Ignat Korchagin Signed-off-by: Herbert Xu commit 8700ce07c5c6bf27afa7b59a8d9cf58d783a7d5c Author: Haotian Zhang Date: Mon Nov 10 15:20:41 2025 +0800 crypto: ccree - Correctly handle return of sg_nents_for_len Fix error handling in cc_map_hash_request_update where sg_nents_for_len return value was assigned to u32, converting negative errors to large positive values before passing to sg_copy_to_buffer. Check sg_nents_for_len return value and propagate errors before assigning to areq_ctx->in_nents. Fixes: b7ec8530687a ("crypto: ccree - use std api when possible") Signed-off-by: Haotian Zhang Signed-off-by: Herbert Xu commit e9eb52037a529fbb307c290e9951a62dd728b03d Author: Haotian Zhang Date: Mon Nov 10 14:54:38 2025 +0800 crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers. Add error checking for sg_nents_for_len and return immediately on failure to prevent potential buffer overflows. Fixes: 7883d1b28a2b ("crypto: starfive - Add hash and HMAC support") Signed-off-by: Haotian Zhang Signed-off-by: Herbert Xu commit 8f7cf305a15eec663d5084e417f4773f1ef24e23 Author: Eduard Zingerman Date: Wed Nov 19 17:03:55 2025 +0100 bpf: test the correct stack liveness of tail calls A new test is added: caller_stack_write_tail_call tests that the live stack is correctly tracked for a tail call. Signed-off-by: Eduard Zingerman Signed-off-by: Martin Teichmann Link: https://lore.kernel.org/r/20251119160355.1160932-5-martin.teichmann@xfel.eu Signed-off-by: Alexei Starovoitov commit e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd Author: Eduard Zingerman Date: Wed Nov 19 17:03:54 2025 +0100 bpf: correct stack liveness for tail calls This updates bpf_insn_successors() reflecting that control flow might jump over the instructions between tail call and function exit, verifier might assume that some writes to parent stack always happen, which is not the case. Signed-off-by: Eduard Zingerman Signed-off-by: Martin Teichmann Link: https://lore.kernel.org/r/20251119160355.1160932-4-martin.teichmann@xfel.eu Signed-off-by: Alexei Starovoitov commit 978da762ea4517da1f4c270eb95bc289f81c176a Author: Martin Teichmann Date: Wed Nov 19 17:03:53 2025 +0100 bpf: test the proper verification of tail calls Three tests are added: - invalidate_pkt_pointers_by_tail_call checks that one can use the packet pointer after a tail call. This was originally possible and also poses not problems, but was made impossible by 1a4607ffba35. - invalidate_pkt_pointers_by_static_tail_call tests a corner case found by Eduard Zingerman during the discussion of the original fix, which was broken in that fix. - subprog_result_tail_call tests that precision propagation works correctly across tail calls. This did not work before. Signed-off-by: Martin Teichmann Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251119160355.1160932-3-martin.teichmann@xfel.eu Signed-off-by: Alexei Starovoitov commit e3245f8990431950d20631c72236d4e8cb2dcde8 Author: Martin Teichmann Date: Wed Nov 19 17:03:52 2025 +0100 bpf: properly verify tail call behavior A successful ebpf tail call does not return to the caller, but to the caller-of-the-caller, often just finishing the ebpf program altogether. Any restrictions that the verifier needs to take into account - notably the fact that the tail call might have modified packet pointers - are to be checked on the caller-of-the-caller. Checking it on the caller made the verifier refuse perfectly fine programs that would use the packet pointers after a tail call, which is no problem as this code is only executed if the tail call was unsuccessful, i.e. nothing happened. This patch simulates the behavior of a tail call in the verifier. A conditional jump to the code after the tail call is added for the case of an unsucessful tail call, and a return to the caller is simulated for a successful tail call. For the successful case we assume that the tail call returns an int, as tail calls are currently only allowed in functions that return and int. We always assume that the tail call modified the packet pointers, as we do not know what the tail call did. For the unsuccessful case we know nothing happened, so we do not need to add new constraints. This approach also allows to check other problems that may occur with tail calls, namely we are now able to check that precision is properly propagated into subprograms using tail calls, as well as checking the live slots in such a subprogram. Fixes: 1a4607ffba35 ("bpf: consider that tail calls invalidate packet pointers") Link: https://lore.kernel.org/bpf/20251029105828.1488347-1-martin.teichmann@xfel.eu/ Signed-off-by: Martin Teichmann Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251119160355.1160932-2-martin.teichmann@xfel.eu Signed-off-by: Alexei Starovoitov commit 4dd3a48d13a3bbe7a48e0ab3f7362be26f534de8 Author: Anton Protopopov Date: Wed Nov 19 11:25:17 2025 +0000 bpf: Add a check to make static analysers happy In [1] Dan Carpenter reported that the following code makes the Smatch static analyser unhappy: 17904 value = map->ops->map_lookup_elem(map, &i); 17905 if (!value) 17906 return -EINVAL; --> 17907 items[i - start] = value->xlated_off; The analyser assumes that the `value` variable may contain an error and thus it should be properly checked before the dereference. On practice this will never happen as array maps do not return error values in map_lookup_elem, but to make the Smatch and other possible analysers happy this patch adds a formal check. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/bpf/aR2BN1Ix--8tmVrN@stanley.mountain/ [1] Fixes: 493d9e0d6083 ("bpf, x86: add support for indirect jumps") Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251119112517.1091793-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit b7f7d76d6e354a5acc711da37cb2829ccf40558f Author: Xing Guo Date: Fri Nov 21 14:14:58 2025 +0800 selftests/bpf: Update test_tag to use sha256 commit 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use SHA256") changed digest of prog_tag to SHA256 but forgot to update tests correspondingly. Fix it. Fixes: 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use SHA256") Signed-off-by: Xing Guo Link: https://lore.kernel.org/r/20251121061458.3145167-1-higuoxing@gmail.com Signed-off-by: Alexei Starovoitov commit ae24fc8a16b0481ea8c5acbc66453c49ec0431c4 Author: Matt Bobrowski Date: Wed Nov 19 14:35:40 2025 +0000 selftests/bpf: Improve reliability of test_perf_branches_no_hw() Currently, test_perf_branches_no_hw() relies on the busy loop within test_perf_branches_common() being slow enough to allow at least one perf event sample tick to occur before starting to tear down the backing perf event BPF program. With a relatively small fixed iteration count of 1,000,000, this is not guaranteed on modern fast CPUs, resulting in the test run to subsequently fail with the following: bpf_testmod.ko is already unloaded. Loading bpf_testmod.ko... Successfully loaded bpf_testmod.ko. test_perf_branches_common:PASS:test_perf_branches_load 0 nsec test_perf_branches_common:PASS:attach_perf_event 0 nsec test_perf_branches_common:PASS:set_affinity 0 nsec check_good_sample:PASS:output not valid 0 nsec check_good_sample:PASS:read_branches_size 0 nsec check_good_sample:PASS:read_branches_stack 0 nsec check_good_sample:PASS:read_branches_stack 0 nsec check_good_sample:PASS:read_branches_global 0 nsec check_good_sample:PASS:read_branches_global 0 nsec check_good_sample:PASS:read_branches_size 0 nsec test_perf_branches_no_hw:PASS:perf_event_open 0 nsec test_perf_branches_common:PASS:test_perf_branches_load 0 nsec test_perf_branches_common:PASS:attach_perf_event 0 nsec test_perf_branches_common:PASS:set_affinity 0 nsec check_bad_sample:FAIL:output not valid no valid sample from prog Summary: 0/1 PASSED, 0 SKIPPED, 1 FAILED Successfully unloaded bpf_testmod.ko. On a modern CPU (i.e. one with a 3.5 GHz clock rate), executing 1 million increments of a volatile integer can take significantly less than 1 millisecond. If the spin loop and detachment of the perf event BPF program elapses before the first 1 ms sampling interval elapses, the perf event will never end up firing. Fix this by bumping the loop iteration counter a little within test_perf_branches_common(), along with ensuring adding another loop termination condition which is directly influenced by the backing perf event BPF program executing. Notably, a concious decision was made to not adjust the sample_freq value as that is just not a reliable way to go about fixing the problem. It effectively still leaves the race window open. Fixes: 67306f84ca78c ("selftests/bpf: Add bpf_read_branch_records() selftest") Signed-off-by: Matt Bobrowski Reviewed-by: Jiri Olsa Link: https://lore.kernel.org/r/20251119143540.2911424-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit 27746aaf1b20172f0859546c4a3e82eca459f680 Author: Matt Bobrowski Date: Thu Nov 20 14:20:59 2025 +0000 selftests/bpf: skip test_perf_branches_hw() on unsupported platforms Gracefully skip the test_perf_branches_hw subtest on platforms that do not support LBR or require specialized perf event attributes to enable branch sampling. For example, AMD's Milan (Zen 3) supports BRS rather than traditional LBR. This requires specific configurations (attr.type = PERF_TYPE_RAW, attr.config = RETIRED_TAKEN_BRANCH_INSTRUCTIONS) that differ from the generic setup used within this test. Notably, it also probably doesn't hold much value to special case perf event configurations for selected micro architectures. Fixes: 67306f84ca78c ("selftests/bpf: Add bpf_read_branch_records() selftest") Signed-off-by: Matt Bobrowski Acked-by: Song Liu Link: https://lore.kernel.org/r/20251120142059.2836181-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit 878ee3c325bbcfdfa648c5bdf8d81e095fd4b749 Merge: 792f258803bca1 d8774a36235e82 Author: Alexei Starovoitov Date: Fri Nov 21 16:40:22 2025 -0800 Merge branch 'bpf-arm64-indirect-jumps' Puranjay Mohan says: ==================== bpf: arm64: Indirect jumps Changes in v1->v2: v1: https://lore.kernel.org/all/20251117004656.33292-1-puranjay@kernel.org/ - Dropped patch 3 that was ignoring relocations for .jumptables. LLVM has been fixed to not emit relocations for .jumptables, so this patch is not needed. - Added Reviewed-by: Anton Protopopov This set adds the support of indirect jumps to the arm64 JIT. It involves calling bpf_prog_update_insn_ptrs() to support instructions array map. The second piece is supporting BPF_JMP|BPF_X|BPF_JA, SRC=0, DST=Rx, off=0, imm=0 instruction that is trivial to implement on arm64. The final patch enables selftests on arm64: [root@localhost bpf]# ./test_progs-cpuv4 -a "*gotox*" #20/1 bpf_gotox/one-switch:OK #20/2 bpf_gotox/one-switch-non-zero-sec-offset:OK #20/3 bpf_gotox/two-switches:OK #20/4 bpf_gotox/big-jump-table:OK #20/5 bpf_gotox/static-global:OK #20/6 bpf_gotox/nonstatic-global:OK #20/7 bpf_gotox/other-sec:OK #20/8 bpf_gotox/static-global-other-sec:OK #20/9 bpf_gotox/nonstatic-global-other-sec:OK #20/10 bpf_gotox/one-jump-two-maps:OK #20/11 bpf_gotox/one-map-two-jumps:OK #20 bpf_gotox:OK #537/1 verifier_gotox/jump_table_ok:OK #537/2 verifier_gotox/jump_table_reserved_field_src_reg:OK #537/3 verifier_gotox/jump_table_reserved_field_non_zero_off:OK #537/4 verifier_gotox/jump_table_reserved_field_non_zero_imm:OK #537/5 verifier_gotox/jump_table_no_jump_table:OK #537/6 verifier_gotox/jump_table_incorrect_dst_reg_type:OK #537/7 verifier_gotox/jump_table_invalid_read_size_u32:OK #537/8 verifier_gotox/jump_table_invalid_read_size_u16:OK #537/9 verifier_gotox/jump_table_invalid_read_size_u8:OK #537/10 verifier_gotox/jump_table_misaligned_access:OK #537/11 verifier_gotox/jump_table_invalid_mem_acceess_pos:OK #537/12 verifier_gotox/jump_table_invalid_mem_acceess_neg:OK #537/13 verifier_gotox/jump_table_add_sub_ok:OK #537/14 verifier_gotox/jump_table_no_writes:OK #537/15 verifier_gotox/jump_table_use_reg_r0:OK #537/16 verifier_gotox/jump_table_use_reg_r1:OK #537/17 verifier_gotox/jump_table_use_reg_r2:OK #537/18 verifier_gotox/jump_table_use_reg_r3:OK #537/19 verifier_gotox/jump_table_use_reg_r4:OK #537/20 verifier_gotox/jump_table_use_reg_r5:OK #537/21 verifier_gotox/jump_table_use_reg_r6:OK #537/22 verifier_gotox/jump_table_use_reg_r7:OK #537/23 verifier_gotox/jump_table_use_reg_r8:OK #537/24 verifier_gotox/jump_table_use_reg_r9:OK #537/25 verifier_gotox/jump_table_outside_subprog:OK #537/26 verifier_gotox/jump_table_contains_non_unique_values:OK #537 verifier_gotox:OK Summary: 2/37 PASSED, 0 SKIPPED, 0 FAILED ==================== Link: https://patch.msgid.link/20251117130732.11107-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit d8774a36235e8271865f74d0eeb2802414239060 Author: Puranjay Mohan Date: Mon Nov 17 13:07:31 2025 +0000 selftests: bpf: Enable gotox tests from arm64 arm64 JIT now supports gotox instruction and jumptables, so run tests in verifier_gotox.c for arm64. Signed-off-by: Puranjay Mohan Reviewed-by: Anton Protopopov Link: https://lore.kernel.org/r/20251117130732.11107-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit f4a66cf1cb141997be35465bcd44c45404146441 Author: Puranjay Mohan Date: Mon Nov 17 13:07:30 2025 +0000 bpf: arm64: Add support for indirect jumps Add support for a new instruction BPF_JMP|BPF_X|BPF_JA, SRC=0, DST=Rx, off=0, imm=0 which does an indirect jump to a location stored in Rx. The register Rx should have type PTR_TO_INSN. This new type assures that the Rx register contains a value (or a range of values) loaded from a correct jump table – map of type instruction array. ARM64 JIT supports indirect jumps to all registers through the A64_BR() macro, use it to implement this new instruction. Signed-off-by: Puranjay Mohan Reviewed-by: Anton Protopopov Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20251117130732.11107-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 84b1c40d5b4dae7493b4afb5b7e697dafeced8b2 Author: Puranjay Mohan Date: Mon Nov 17 13:07:29 2025 +0000 bpf: arm64: Add support for instructions array Add support for the instructions array map type in the arm64 JIT by calling bpf_prog_update_insn_ptrs() with the offsets that map xlated_offset to the jited_offset in the final image. arm64 JIT already has this offset array which was being used for bpf_prog_fill_jited_linfo() and can be used directly for bpf_prog_update_insn_ptrs. Signed-off-by: Puranjay Mohan Reviewed-by: Anton Protopopov Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20251117130732.11107-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 9445c7059c1c3b097ec8e924eb374df84770bee5 Author: Babu Moger Date: Wed Nov 12 18:57:32 2025 -0600 fs/resctrl: Add user interface to enable/disable io_alloc feature AMD's SDCIAE forces all SDCI lines to be placed into the L3 cache portions identified by the highest-supported L3_MASK_n register, where n is the maximum supported CLOSID. To support this, when io_alloc resctrl feature is enabled, reserve the highest CLOSID exclusively for I/O allocation traffic making it no longer available for general CPU cache allocation. Introduce user interface to enable/disable io_alloc feature and encourage users to enable io_alloc only when running workloads that can benefit from this functionality. On enable, initialize the io_alloc CLOSID with all usable CBMs across all the domains. Since CLOSIDs are managed by resctrl fs, it is least invasive to make "io_alloc is supported by maximum supported CLOSID" part of the initial resctrl fs support for io_alloc. Take care to minimally (only in error messages) expose this use of CLOSID for io_alloc to user space so that this is not required from other architectures that may support io_alloc differently in the future. When resctrl is mounted with "-o cdp" to enable code/data prioritization, there are two L3 resources that can support I/O allocation: L3CODE and L3DATA. From resctrl fs perspective the two resources share a CLOSID and the architecture's available CLOSID are halved to support this. The architecture's underlying CLOSID used by SDCIAE when CDP is enabled is the CLOSID associated with the CDP_CODE resource, but from resctrl's perspective there is only one CLOSID for both CDP_CODE and CDP_DATA. CDP_DATA is thus not usable for general (CPU) cache allocation nor I/O allocation. Keep the CDP_CODE and CDP_DATA I/O alloc status in sync to avoid any confusion to user space. That is, enabling io_alloc on CDP_CODE does so on CDP_DATA and vice-versa, and keep the I/O allocation CBMs of CDP_CODE and CDP_DATA in sync. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/c7d3037795e653e22b02d8fc73ca80d9b075031c.1762995456.git.babu.moger@amd.com commit 48068e565045ee0c77fdb34225ac6dedb5871fc2 Author: Babu Moger Date: Wed Nov 12 18:57:31 2025 -0600 fs/resctrl: Introduce interface to display "io_alloc" support Introduce the "io_alloc" resctrl file to the "info" area of a cache resource, for example /sys/fs/resctrl/info/L3/io_alloc. "io_alloc" indicates support for the "io_alloc" feature that allows direct insertion of data from I/O devices into the cache. Restrict exposing support for "io_alloc" to the L3 resource that is the only resource where this feature can be backed by AMD's L3 Smart Data Cache Injection Allocation Enforcement (SDCIAE). With that, the "io_alloc" file is only visible to user space if the L3 resource supports "io_alloc". Doing so makes the file visible for all cache resources though, for example also L2 cache (if it supports cache allocation). As a consequence, add capability for file to report expected "enabled" and "disabled", as well as "not supported". Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/e8b116a8f424128b227734bb1d433c14af478d90.1762995456.git.babu.moger@amd.com commit e34003dd2fb05da8f420bbd7b8ec62ab88242c45 Author: Chukun Pan Date: Thu Nov 20 20:00:11 2025 +0800 arm64: dts: rockchip: enable RTC for 100ASK DshanPi A1 Enable RTC support for the 100ASK DshanPi A1 board. Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251120120011.279104-6-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit d43935da2bfada9e83f5f7e46f7d72e5d4665bd6 Author: Chukun Pan Date: Thu Nov 20 20:00:10 2025 +0800 arm64: dts: rockchip: enable USB for 100ASK DshanPi A1 Enable USB support for the 100ASK DshanPi A1 board. Note that the HUSB311 Type-C chip is not supported. Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251120120011.279104-5-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 80ec14d1d2173cc3f225102a7db09a457541fe04 Author: Chukun Pan Date: Thu Nov 20 20:00:09 2025 +0800 arm64: dts: rockchip: enable button for 100ASK DshanPi A1 The 100ASK DshanPi A1 board has three ADC buttons and one GPIO button. Enable them. Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251120120011.279104-4-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 98461b5e3cdffd126aec610691078408c296d79f Author: Chukun Pan Date: Thu Nov 20 20:00:08 2025 +0800 arm64: dts: rockchip: add mmc aliases for 100ASK DshanPi A1 Add missing MMC aliases for 100ASK DshanPi A1 board. Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251120120011.279104-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit b120a9df264eab51952d0cf44c16f13f2606281d Author: Chukun Pan Date: Thu Nov 20 20:00:07 2025 +0800 arm64: dts: rockchip: remove mmc max-frequency for 100ASK DshanPi A1 The max-frequency property is already defined in the mmc node of rk3576.dtsi. Remove the redundant definition. Signed-off-by: Chukun Pan Reviewed-by: Shawn Lin Link: https://patch.msgid.link/20251120120011.279104-2-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit b92c4eae75468d5b7ad49fc0d1de76a7f0fa0bdb Author: Michael Opdenacker Date: Thu Nov 20 19:00:34 2025 +0000 arm64: dts: rockchip: Enable i2c2 on Orange Pi 3B Enable the "i2c2" bus on header pins 3 (I2C_SDA_M1) and 5 (I2C2_SCL_M1) of the Orange Pi 3B board. As documented on http://www.orangepi.org/img/pi3b/0719-pi3b-19.png, such pins are the only ones offering I2C functionality without conflicting with other SoC blocks. Signed-off-by: Michael Opdenacker Link: https://patch.msgid.link/20251120-orangepi3-enable-i2c2-v1-1-2e023a74012a@rootcommit.com Signed-off-by: Heiko Stuebner commit 556d2892aa715286d840a74216c8fff885559261 Author: Babu Moger Date: Wed Nov 12 18:57:30 2025 -0600 x86,fs/resctrl: Implement "io_alloc" enable/disable handlers "io_alloc" is the generic name of the new resctrl feature that enables system software to configure the portion of cache allocated for I/O traffic. On AMD systems, "io_alloc" resctrl feature is backed by AMD's L3 Smart Data Cache Injection Allocation Enforcement (SDCIAE). Introduce the architecture-specific functions that resctrl fs should call to enable, disable, or check status of the "io_alloc" feature. Change SDCIAE state by setting (to enable) or clearing (to disable) bit 1 of MSR_IA32_L3_QOS_EXT_CFG on all logical processors within the cache domain. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/9e9070100c320eab5368e088a3642443dee95ed7.1762995456.git.babu.moger@amd.com commit 172e22180212092b2aecac172ede3d07c013e22f Merge: d4a3411ca31337 33822d795ab930 Author: Mark Brown Date: Fri Nov 21 21:28:19 2025 +0000 ASoC: cs35l56: Set access permissions on volatile Merge series from Richard Fitzgerald : The CAL_SET_STATUS and CAL_DATA_RB controls are volatile and read-only, but the existing ASoC macros to define controls don't allow setting access permissions, so those controls were marked as non-volatile read/write. These four patches fix that. The first two patches add two new control macros to soc.h. I really don't like codec drivers open-coding a kcontrol_new content for a control that will be managed by the ASoC info/get/put handlers. If a new type of ASoC control definition is needed it's better to have it in soc.h so all the dependencies between ASoC and the kcontrol_new content are in one place. commit d4a3411ca31337f369e5600270138165e8eb57c0 Merge: df919994d323c7 3af1815a2f9cae Author: Mark Brown Date: Fri Nov 21 21:28:15 2025 +0000 Add SDCA class driver Merge series from Charles Keepax : This series adds an initial SDCA class driver, this consists of a primary driver attached to the SoundWire device, and auxiliary drivers representing each of the functions of the SDCA device. These drivers all use the APIs added over the past series's to provide the class functionality, as such these final drivers themselves are quite thin. Also a few fix ups at the start of the series that have gathered up whilst the last SDCA series was in review. commit ad2478e9fc6ba3bf1519f5dccf65d48b0dc8c656 Merge: d6ecfc55d4d55a ae18c465b3ae08 Author: Arnd Bergmann Date: Fri Nov 21 22:20:05 2025 +0100 Merge tag 'omap-for-v6.19/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm ARM: OMAP2+: Fix falg->flag typo in omap_smc2() * tag 'omap-for-v6.19/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: OMAP2+: Fix falg->flag typo in omap_smc2() Signed-off-by: Arnd Bergmann commit a60997452ac84e8360bb49909cf0f1d3771c9259 Merge: 4079b4700dc27c 5ffac985b5f427 Author: Arnd Bergmann Date: Fri Nov 21 22:18:34 2025 +0100 Merge tag 'imx-bindings-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX dt-bindings update for 6.19: - New board support: Protonic PRT8ML, Toradex SMARC iMX95, Skov Rev.C HDMI, i.MX 95 Verdin Evaluation KitPHYTEC phyBOARD-Segin-i.MX91 board, Skov i.MX8MP variant - One imx-iomuxc-gpr update from Fabio Estevam to document CSI mux - A couple of fpga-qixis bindings updates from Ioana Ciornei - One embedded-controller update from Mathew McBride to add Traverse Ten64 board controller * tag 'imx-bindings-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: dt-bindings: arm: fsl: add Toradex SMARC iMX95 dt-bindings: arm: fsl: add Skov Rev.C HDMI support dt-bindings: arm: fsl: Add PHYTEC phyBOARD-Segin-i.MX91 board dt-bindings: fsl,fpga-qixis: describe the gpio child node found on LS1046AQDS dt-bindings: fsl,fpga-qixis-i2c: add support for LX2160ARDB FPGA dt-bindings: arm: fsl: Add Protonic PRT8ML dt-bindings: arm: imx: document i.MX 95 Verdin Evaluation Kit (EVK) dt-bindings: embedded-controller: add Traverse Ten64 board controller dt-bindings: soc: imx-iomuxc-gpr: Document the CSI mux dt-bindings: arm: fsl: add compatible for Skov i.MX8MP variant Signed-off-by: Arnd Bergmann commit d6ecfc55d4d55aef083f6c11e3f4f933f42a94c2 Author: Julia Lawall Date: Thu Oct 23 22:47:37 2025 +0200 ARM: gemini: fix typos in comments Various spelling mistakes in comments. Detected with the help of Coccinelle. Signed-off-by: Julia Lawall Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20251023204737.2716443-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 7923ae7698cf9728501974d76d8ea712686281bc Author: Babu Moger Date: Wed Nov 12 18:57:29 2025 -0600 x86,fs/resctrl: Detect io_alloc feature AMD's SDCIAE (SDCI Allocation Enforcement) PQE feature enables system software to control the portions of L3 cache used for direct insertion of data from I/O devices into the L3 cache. Introduce a generic resctrl cache resource property "io_alloc_capable" as the first part of the new "io_alloc" resctrl feature that will support AMD's SDCIAE. Any architecture can set a cache resource as "io_alloc_capable" if a portion of the cache can be allocated for I/O traffic. Set the "io_alloc_capable" property for the L3 cache resource on x86 (AMD) systems that support SDCIAE. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/df85a9a6081674fd3ef6b4170920485512ce2ded.1762995456.git.babu.moger@amd.com commit 4d4840b1251acc194e4b59d9a5bfba23cd573ed3 Author: Babu Moger Date: Wed Nov 12 18:57:28 2025 -0600 x86/resctrl: Add SDCIAE feature in the command line options Add a kernel command-line parameter to enable or disable the exposure of the L3 Smart Data Cache Injection Allocation Enforcement (SDCIAE) hardware feature to resctrl. Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Link: https://patch.msgid.link/c623edf7cb369ba9da966de47d9f1b666778a40e.1762995456.git.babu.moger@amd.com commit 3767def18f4cc394dc98cb93e78c3cc9afc4c515 Author: Babu Moger Date: Wed Nov 12 18:57:27 2025 -0600 x86/cpufeatures: Add support for L3 Smart Data Cache Injection Allocation Enforcement Smart Data Cache Injection (SDCI) is a mechanism that enables direct insertion of data from I/O devices into the L3 cache. By directly caching data from I/O devices rather than first storing the I/O data in DRAM, SDCI reduces demands on DRAM bandwidth and reduces latency to the processor consuming the I/O data. The SDCIAE (SDCI Allocation Enforcement) PQE feature allows system software to control the portion of the L3 cache used for SDCI. When enabled, SDCIAE forces all SDCI lines to be placed into the L3 cache partitions identified by the highest-supported L3_MASK_n register, where n is the maximum supported CLOSID. Add CPUID feature bit that can be used to configure SDCIAE. The SDCIAE feature details are documented in: AMD64 Architecture Programmer's Manual Volume 2: System Programming Publication # 24593 Revision 3.41 section 19.4.7 L3 Smart Data Cache Injection Allocation Enforcement (SDCIAE). available at https://bugzilla.kernel.org/show_bug.cgi?id=206537 Signed-off-by: Babu Moger Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Acked-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/83ca10d981c48e86df2c3ad9658bb3ba3544c763.1762995456.git.babu.moger@amd.com commit 748d6ba43afde7e9ac27443233203995cc15d235 Author: Kuppuswamy Sathyanarayanan Date: Thu Nov 20 16:05:39 2025 -0800 powercap: intel_rapl: Enable MSR-based RAPL PMU support Currently, RAPL PMU support requires adding CPU model entries to arch/x86/events/rapl.c for each new generation. However, RAPL MSRs are not architectural and require platform-specific customization, making arch/x86 an inappropriate location for this functionality. The powercap subsystem already handles RAPL functionality and is the natural place to consolidate all RAPL features. The powercap RAPL driver already includes PMU support for TPMI-based RAPL interfaces, making it straightforward to extend this support to MSR-based RAPL interfaces as well. This consolidation eliminates the need to maintain RAPL support in multiple subsystems and provides a unified approach for both TPMI and MSR-based RAPL implementations. The MSR-based PMU support includes the following updates: 1. Register MSR-based PMU support for the supported platforms and unregister it when no online CPUs remain in the package. 2. Remove existing checks that restrict RAPL PMU support to TPMI-based interfaces and extend the logic to allow MSR-based RAPL interfaces. 3. Define a CPU model list to determine which processors should register RAPL PMU interface through the powercap driver for MSR-based RAPL, excluding those that support TPMI interface. This list prevents conflicts with existing arch/x86 PMU code that already registers RAPL PMU for some processors. Add Panther Lake & Wildcat Lake to the CPU models list. Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Srinivas Pandruvada [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251121000539.386069-3-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 1d6c915819f5b805c35487b6ce5923e31a28266b Author: Kuppuswamy Sathyanarayanan Date: Thu Nov 20 16:05:38 2025 -0800 powercap: intel_rapl: Prepare read_raw() interface for atomic-context callers The current read_raw() implementation of the TPMI, MMIO and MSR interfaces does not distinguish between atomic and non-atomic callers. rapl_msr_read_raw() uses rdmsrq_safe_on_cpu(), which can sleep and issue cross CPU calls. When MSR-based RAPL PMU support is enabled, PMU event handlers can invoke this function from atomic context where sleeping or rescheduling is not allowed. In atomic context, the caller is already executing on the target CPU, so a direct rdmsrq() is sufficient. To support such usage, introduce an atomic flag to the read_raw() interface to allow callers pass the context information. Modify the common RAPL code to propagate this flag, and set the flag to reflect the calling contexts. Utilize the atomic flag in rapl_msr_read_raw() to perform direct MSR read with rdmsrq() when running in atomic context, and a sanity check to ensure target CPU matches the current CPU for such use cases. The TPMI and MMIO implementations do not require special atomic handling, so the flag is ignored in those paths. This is a preparatory patch for adding MSR-based RAPL PMU support. Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Srinivas Pandruvada [ rjw: Subject tweak ] Link: https://patch.msgid.link/20251121000539.386069-2-sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 1a263d3a70b9c80ee9de80d8c39e3e39b9bfd17b Merge: 922ef7512dd04e 60705b039f9603 Author: Arnd Bergmann Date: Fri Nov 21 21:43:35 2025 +0100 Merge tag 'v6.19-rockchip-defconfig64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/defconfig Rockchip support for basic camera interface (CIF) and Synopsis DW-DP driver, as well as the CEC extension to the DW-HDMI-QP driver. * tag 'v6.19-rockchip-defconfig64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: defconfig: enable rockchip camera interface arm64: defconfig: Enable DW HDMI QP CEC support arm64: defconfig: Enable Rockchip extensions for Synopsys DW DP Signed-off-by: Arnd Bergmann commit 922ef7512dd04e5254c6ceafebb400486d733c36 Merge: f65372ea2f34fb fdc7da1733d9d5 Author: Arnd Bergmann Date: Fri Nov 21 21:42:44 2025 +0100 Merge tag 'qcom-arm64-defconfig-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig updates for v6.19 Enable config options for the hardare used across Fairphone 3, 4, and 5. Then enable Novatek display panels founds on Xiaomi Pocophone F1, and the SM8750 MTP, eUSB2 PHY found in SM8750, NSS clock controller found in IPQ5424, the SX150x gpio expander used in QCS615 reference device, and the support for UFS inline crypto. * tag 'qcom-arm64-defconfig-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable SX150x GPIO expander driver arm64: defconfig: Build NSS clock controller driver for IPQ5424 arm64: defconfig: Enable SCSI UFS Crypto and Block Inline encryption drivers arm64: defconfig: Add M31 eUSB2 PHY config arm64: defconfig: Enable configs for Fairphone 3, 4, 5 smartphones arm64: defconfig: Enable two Novatek display panels for MTP8750 and Tianma Signed-off-by: Arnd Bergmann commit f65372ea2f34fb46fd2cfe51dae5a9586d767814 Merge: 8283edc8baacf2 393f40ef96628f Author: Arnd Bergmann Date: Fri Nov 21 21:42:02 2025 +0100 Merge tag 'omap-for-v6.19/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/defconfig multi_v7_defconfig: Enable TI PRU Ethernet driver * tag 'omap-for-v6.19/defconfig-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: multi_v7_defconfig: Enable TI PRU Ethernet driver Signed-off-by: Arnd Bergmann commit 8283edc8baacf2c2c0348cbad040f057411defcf Merge: 68bdc95066ea37 c1c654b5daceea Author: Arnd Bergmann Date: Fri Nov 21 21:41:15 2025 +0100 Merge tag 'at91-defconfig-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig Microchip AT91 defconfig updates for v6.19 This update includes: - CONFIG_MMC_SPI is set to module for at91_dt_defconfig * tag 'at91-defconfig-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: at91: at91_dt_defconfig: set MMC_SPI to module Signed-off-by: Arnd Bergmann commit 68bdc95066ea378889b6c589606015b65799c611 Merge: 74620292be2372 910ab02fbbfe16 Author: Arnd Bergmann Date: Fri Nov 21 21:39:20 2025 +0100 Merge tag 'imx-defconfig-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/defconfig i.MX defconfig changes for 6.19: - Enable sound drivers for imx28-amarula-rmm in mxs_defconfig - Enable i.MX AIPSTZ driver, i.MX95 pinctrl driver, Ethernet and PCIe support in arm64 defconfig * tag 'imx-defconfig-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: defconfig: enable i.MX AIPSTZ driver ARM: mxs_defconfig: enable sound drivers for imx28-amarula-rmm arm64: defconfig: Enable i.MX95 drivers for pinctrl, Ethernet and PCIe Signed-off-by: Arnd Bergmann commit 74620292be2372f61d66fbd7fd5687d28211b69a Merge: 909d8d395f7056 145cde94a54359 Author: Arnd Bergmann Date: Fri Nov 21 21:37:53 2025 +0100 Merge tag 'tegra-for-6.19-arm64-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig arm64: tegra: Default configuration changes for v6.19-rc1 Enable the new driver for the VRS PSEQ RTC found on Tegra234 and later. * tag 'tegra-for-6.19-arm64-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: defconfig: Enable NVIDIA VRS PSEQ RTC Signed-off-by: Arnd Bergmann commit 909d8d395f7056182a617f56e9860fdf293d4f86 Merge: 0719a58aac9efb 23a29a81b44e3a Author: Arnd Bergmann Date: Fri Nov 21 21:36:57 2025 +0100 Merge tag 'tegra-for-6.19-arm-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig ARM: tegra: Default configuration changes for v6.19-rc1 Enable ext4 by default on Tegra to restore systems booting from MMC. * tag 'tegra-for-6.19-arm-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: Enable EXT4 for Tegra Signed-off-by: Arnd Bergmann commit 0719a58aac9efb2004d356528d2a3dac9fac4026 Merge: 38c8787f1b81d9 b59a508c1f5fdb Author: Arnd Bergmann Date: Fri Nov 21 21:35:44 2025 +0100 Merge tag 'mtk-defconfig-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/defconfig MediaTek defconfig updates As MediaTek boards with UFS appeared some time ago, this adds a single commit enabling the MediaTek UFS driver, allowing those boards to boot over UFS as primary storage. * tag 'mtk-defconfig-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: arm64: defconfig: Enable UFS support for MediaTek Genio 1200 EVK UFS board Signed-off-by: Arnd Bergmann commit 38c8787f1b81d9eddf33ecc2bb79dc1a5cc11176 Author: Tudor Ambarus Date: Mon Nov 10 13:13:39 2025 +0100 arm64: defconfig: enable Exynos ACPM clocks Enable the Exynos ACPM clocks driver. Samsung Exynos platforms implement ACPM to provide support for clock configuration, PMIC and temperature sensors. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Tested-by: Peter Griffin # on gs101-oriole Link: https://patch.msgid.link/20251010-acpm-clk-v6-5-321ee8826fd4@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251110121344.120785-5-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 24a979a1fec2600ea2868ed5aded52ba0950a0c1 Merge: 04392a1e814567 e7d34657744a3e Author: Arnd Bergmann Date: Fri Nov 21 21:33:05 2025 +0100 Merge tag 'renesas-arm-defconfig-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/defconfig Renesas ARM defconfig updates for v6.19 - Enable support for the Renesas RZ/G3S and RZ/G3E thermal drivers, and the RZ/T2H and RZ/N2H ADC drivers in the ARM64 defconfig, - Refresh the ARM SH-Mobile defconfig for v6.18-rc1. * tag 'renesas-arm-defconfig-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: defconfig: Enable RZ/T2H / RZ/N2H ADC driver ARM: shmobile: defconfig: Refresh for v6.18-rc1 arm64: defconfig: Enable the Renesas RZ/G3E thermal driver arm64: defconfig: Enable Renesas RZ/G3S thermal driver Signed-off-by: Arnd Bergmann commit 04392a1e8145677818390d537fc14baef2eb4b99 Author: Huang Shijie Date: Tue Oct 21 15:57:04 2025 +0800 arm64: defconfig: Remove the redundant SCHED_MC/SCHED_SMT The patch "7bd291abe2d sched: Unify the SCHED_{SMT,CLUSTER,MC} Kconfig" has enabled the SCHED_MC/SCHED_SMT by default for arm64. So remove the redundant code in defconfig. Reviewed-by: Zenghui Yu Reviewed-by: Krzysztof Kozlowski Signed-off-by: Huang Shijie Link: https://lore.kernel.org/r/20251021075704.527626-1-shijie@os.amperecomputing.com Signed-off-by: Arnd Bergmann commit 9b418a3bfdd421c01002424958fbd86a1001c2c2 Merge: c5dc31b2b43f54 d5c3f49b758325 Author: Arnd Bergmann Date: Fri Nov 21 21:29:57 2025 +0100 Merge tag 'anlogic-initial-6.19-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/newsoc Initial Anlogic Platform Support Add bindings for the serial and timer peripherals, and a basic soc dtsi for the Anlogic dr1v90 SoC. The Milianke MLKPAI FS01 is the first board for this SoC. Add myself as maintainer for this platform for the time being. Signed-off-by: Conor Dooley * tag 'anlogic-initial-6.19-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: MAINTAINERS: Setup support for Anlogic tree riscv: defconfig: Enable Anlogic SoC riscv: dts: anlogic: Add Milianke MLKPAI FS01 board riscv: dts: Add initial Anlogic DR1V90 SoC device tree riscv: Add Anlogic SoC famly Kconfig support dt-bindings: serial: snps-dw-apb-uart: Add Anlogic DR1V90 uart dt-bindings: timer: Add Anlogic DR1V90 ACLINT MTIMER dt-bindings: riscv: Add Anlogic DR1V90 dt-bindings: riscv: Add Nuclei UX900 compatibles dt-bindings: vendor-prefixes: Add Anlogic, Milianke and Nuclei commit 00465358f4228974d8e9d892b69e3fc0b475b492 Author: Shivam Chaudhary Date: Fri Oct 24 00:32:58 2025 +0200 ARM: versatile: Fix typo in versatile.c Corrected minor typo in versatile.c - Fixed "documentaton" to "documentation" Signed-off-by: Shivam Chaudhary Acked-by: Liviu Dudau Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20251023223258.3181274-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 9572838be3f585b99b308714bfd88e45bed525b2 Merge: dcb6fa37fd7bc9 7f637d718752f1 Author: Arnd Bergmann Date: Fri Nov 21 21:19:52 2025 +0100 Merge tag 'mtk-arm32-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/arm MediaTek mach ARM32 updates This adds support for the MT6582 SoC and its SMP bringup code. This SoC is found in old smartphones and tablets from various manufacturers. * tag 'mtk-arm32-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: ARM: mediatek: add MT6582 smp bring up code ARM: mediatek: add board_dt_compat entry for the MT6582 SoC Signed-off-by: Arnd Bergmann commit c5dc31b2b43f545f1f5f5870e058b4eb04020d96 Merge: 2bab99283d537a 92bcb8cc7b2440 Author: Arnd Bergmann Date: Fri Nov 21 21:14:07 2025 +0100 Merge branch 'bst/newsoc' into soc/newsoc This patch series introduces platform support for Black Sesame Technologies (BST) C1200 SoC and CDCU1.0 ADAS 4C2G board. BST is a leading automotive-grade computing SoC provider focusing on intelligent driving, computer vision, and AI capabilities for ADAS and autonomous driving applications. You can find more information about the SoC and related boards at: https://bst.ai This series provides the foundational platform enablement including device tree bindings, SoC and board device trees, platform configuration, and maintainer information. MMC/SDHCI driver support will be submitted in a separate patch series. * bst/newsoc: MAINTAINERS: add Black Sesame Technologies (BST) ARM SoC support arm64: defconfig: enable BST platform support arm64: dts: bst: add support for Black Sesame Technologies C1200 CDCU1.0 board arm64: Kconfig: add ARCH_BST for Black Sesame Technologies SoCs dt-bindings: arm: add Black Sesame Technologies (bst) SoC dt-bindings: vendor-prefixes: Add Black Sesame Technologies Co., Ltd. Link: https://lore.kernel.org/all/20251016120558.2390960-1-yangzh0906@thundersoft.com/ Signed-off-by: Arnd Bergmann commit 92bcb8cc7b2440cd9074736d14a2417fe0b396bc Author: Albert Yang Date: Thu Oct 16 20:05:58 2025 +0800 MAINTAINERS: add Black Sesame Technologies (BST) ARM SoC support Add a MAINTAINERS entry for Black Sesame Technologies (BST) ARM SoC support. This entry covers device tree bindings, drivers, and board files for BST SoCs, and platform support. Signed-off-by: Albert Yang Signed-off-by: Arnd Bergmann commit be64ae6fe2c076427d6bd3c6bbe05af0478046d2 Author: Albert Yang Date: Thu Oct 16 20:05:57 2025 +0800 arm64: defconfig: enable BST platform support Enable support for Black Sesame Technologies (BST) platform in the ARM64 defconfig: - CONFIG_ARCH_BST: Enable BST SoC platform support Signed-off-by: Albert Yang Signed-off-by: Arnd Bergmann commit c03a37773bf0eaf3b4aa08143e2faf7400f152ad Author: Albert Yang Date: Thu Oct 16 20:05:56 2025 +0800 arm64: dts: bst: add support for Black Sesame Technologies C1200 CDCU1.0 board Add device tree support for the Black Sesame Technologies (BST) C1200 CDCU1.0 ADAS 4C2G platform. This platform is based on the BST C1200 SoC family. The changes include: - Adding a new BST device tree directory - Adding Makefile entries to build the BST platform device trees - Adding the device tree for the BST C1200 CDCU1.0 ADAS 4C2G board This board features a quad-core Cortex-A78 CPU, and various peripherals including UART, and interrupt controller. Signed-off-by: Albert Yang Signed-off-by: Arnd Bergmann commit 154121941643395be89fc051628e83ad746330d5 Author: Albert Yang Date: Thu Oct 16 20:05:55 2025 +0800 arm64: Kconfig: add ARCH_BST for Black Sesame Technologies SoCs Add ARCH_BST configuration option to enable support for Black Sesame Technologies SoC family. BST produces automotive-grade system-on-chips for intelligent driving, focusing on computer vision and AI capabilities. The BST C1200 family includes SoCs for ADAS and autonomous driving applications. Signed-off-by: Albert Yang Signed-off-by: Arnd Bergmann commit fc77dc0620b70e533c506f120eb4afd5d6cadf3a Author: Albert Yang Date: Thu Oct 16 20:05:54 2025 +0800 dt-bindings: arm: add Black Sesame Technologies (bst) SoC Add device tree bindings for Black Sesame Technologies Arm SoC, it consists several SoC models like C1200, etc. Signed-off-by: Albert Yang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Arnd Bergmann commit 9371cd418346cee110e352c3b4bc9d583672d7e3 Author: Albert Yang Date: Thu Oct 16 20:05:53 2025 +0800 dt-bindings: vendor-prefixes: Add Black Sesame Technologies Co., Ltd. Black Sesame Technologies Co., Ltd.s a leading automotive-grade computing SoC and SoC-based intelligent vehicle solution provider. Link: https://bst.ai/. Signed-off-by: Albert Yang Acked-by: Rob Herring (Arm) Signed-off-by: Arnd Bergmann commit 4079b4700dc27c6fad3f6614ccf340abe1f1130c Merge: 887bc881634a34 56baa9190988f3 Author: Arnd Bergmann Date: Fri Nov 21 21:06:29 2025 +0100 Merge tag 'ti-k3-dt-for-v6.19-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.19 part2 Late fixes and cleanups: * Fix build warnings for unapplied overlays for PHYTEC, SA67 and certain TI EVM * Fix pinmux of SD regulator control line on J721e SK * Correct unit address of cbass_wakeup node for AM62L * tag 'ti-k3-dt-for-v6.19-part2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: dts: ti: k3-am62l: Fix unit address of cbass_wakeup arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator arm64: dts: ti: Add missing applied DT overlay targets arm64: dts: ti: sa67: add build time dtb for overlays arm64: dts: ti: Enable build testing of PHYTEC board overlays Signed-off-by: Arnd Bergmann commit 887bc881634a34a1e8230712018344758a3303dd Merge: 314bfe59ec2ac3 f0e6bc0c3ef4b4 Author: Arnd Bergmann Date: Fri Nov 21 21:05:33 2025 +0100 Merge tag 'mvebu-dt64-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt64 for 6.19 (part 1) pinctrl node names cleanup from Rob on Marvell device tree files Proper fix for pci errors on armada cp11x based platforms * tag 'mvebu-dt64-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 Revert "arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports" arm64/arm: dts: marvell: Rename "nand-rb" pinctrl node names Signed-off-by: Arnd Bergmann commit 314bfe59ec2ac32b9ab263b555399ff286d7b3a2 Merge: f0218293eef7ef af5eb17ff893bf Author: Arnd Bergmann Date: Fri Nov 21 21:04:31 2025 +0100 Merge tag 'riscv-sophgo-dt-for-v6.19' of https://github.com/sophgo/linux into soc/dt RISC-V Devicetrees for v6.19 Sophgo: For CV18xx serials: Add top syscon device related DTS change, the top system controller provides register access to configure some misc modules, such as usb2 phy and a dma multiplexer. For SG2042: There are two changes. The first one is to add DTS definition for PCIe controllers for SoC SG2042 and boards such as Pioneerbox/EVB_V1/EVB_V2 uses SG2042. The second one is to add DTS to support SPI-NOR flash controllers for this SoC and the same for related boards. Signed-off-by: Chen Wang * tag 'riscv-sophgo-dt-for-v6.19' of https://github.com/sophgo/linux: riscv: dts: sophgo: Enable SPI NOR node for SG2042_EVB_V2 riscv: dts: sophgo: Enable SPI NOR node for SG2042_EVB_V1 riscv: dts: sophgo: Enable SPI NOR node for PioneerBox riscv: dts: sophgo: Add SPI NOR node for SG2042 riscv: dts: sophgo: Add USB support for cv18xx riscv: dts: sophgo: Add syscon node for cv18xx dt-bindings: soc: sophgo: add TOP syscon for CV18XX/SG200X series SoC riscv: sophgo: dts: enable PCIe for SG2042_EVB_V2.0 riscv: sophgo: dts: enable PCIe for SG2042_EVB_V1.X riscv: sophgo: dts: enable PCIe for PioneerBox riscv: sophgo: dts: add PCIe controllers for SG2042 Signed-off-by: Arnd Bergmann commit f0218293eef7ef876ee0d82ad266f9f63fbee0d7 Merge: 5733ad88a50c5b 7dfe67ab5a8300 Author: Arnd Bergmann Date: Fri Nov 21 20:59:54 2025 +0100 Merge tag 'cix-dt-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt CIX device tree changes for v6.19-rc1, add below new components support: - PCIe - Pinctrl - SPI * tag 'cix-dt-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix: arm64: dts: cix: add a compatible string for the cix sky1 SoC arm64: dts: cix: Enable PCIe on the Orion O6 board arm64: dts: cix: Add PCIe Root Complex on sky1 arm64: dts: cix: Add pinctrl nodes for sky1 arm64: dts: cix: add DT nodes for SPI Signed-off-by: Arnd Bergmann commit 5733ad88a50c5bca25e0c4e5539a773b9695ed9e Merge: bb4553b1634b2b a6961e2ced5190 Author: Arnd Bergmann Date: Fri Nov 21 20:53:53 2025 +0100 Merge tag 'stm32-dt-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v6.19, round 1 Highlights: ----------- - MPU: - STM32MP13: - Add and enable the ARM SMC watchdog to use IWDG1 in the secure world. - STMP32MP15: - Phytec SOM: Fix STMPE811 touchscreen - LXA: drop unnecessary vusb_d/a-supply as already defined by "phy-supply" and "vdda1v8-supply". - STM32MP23: - Use the RIFSC as an access controler (firewall) as it is done for STM32MP25 and STM32MP23. - STM32MP25: - Add OSPI memory region name. - Add I/O synchronization properties to satisfy RGMII specification. * tag 'stm32-dt-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: arm64: dts: st: set RIFSC as an access controller on stm32mp21x platforms ARM: dts: stm32: add the IWDG2 interrupt line in stm32mp131.dtsi ARM: dts: stm32: enable the ARM SMC watchdog node in stm32mp135f-dk ARM: dts: stm32: add the ARM SMC watchdog in stm32mp131.dtsi ARM: dts: stm32: add iwdg1 node in stm32mp131.dtsi arm64: dts: st: Add I/O sync to eth pinctrl in stm32mp25-pinctrl.dtsi arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1 ARM: dts: stm32: lxa: drop unnecessary vusb_d/a-supply ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Signed-off-by: Arnd Bergmann commit bb4553b1634b2ba8b5ca6457214f72cf42f55ff4 Merge: d7eebe1098c410 78f316e90906d5 Author: Arnd Bergmann Date: Fri Nov 21 20:52:40 2025 +0100 Merge tag 'v6.19-rockchip-dts64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: 9Tripod X3568, 100ASK DShanPi A1, LinkEase EasePi R1, FriendlyElec NanoPi R76S Interesting archeological addition: RK3368 (2015) gets display output afterall. New peripherals: vicap on px30 and rk356x, PCIe Gen2x1 on RK3528, use actual clock-ids for SCMI clocks - not hardcoded numbers, CQE support for the eMMC on RK3588. As well as a number of enablements for individual boards. For example enablement for the now usable NPU. * tag 'v6.19-rockchip-dts64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (43 commits) arm64: dts: rockchip: add vicap node to rk356x arm64: dts: rockchip: add the vip node to px30 arm64: dts: rockchip: fixes audio for 100ASK DshanPi A1 arm64: dts: rockchip: fixes vcc3v3_s0 supply for 100ASK DshanPi A1 arm64: dts: rockchip: fixes ethernet for 100ASK DshanPi A1 arm64: dts: rockchip: fixes regulator for 100ASK DshanPi A1 arm64: dts: rockchip: correct assigned-clock-rates spelling on 2 boards arm64: dts: rockchip: clean up devicetree for 9Tripod X3568 v4 arm64: dts: rockchip: Enable USB-C DP Alt for Indiedroid Nova arm64: dts: rockchip: add eMMC CQE support for rk3588 arm64: dts: rockchip: enable HDMI audio on Rock 5 ITX arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A arm64: dts: rockchip: use SCMI clock id for gpu clock on rk356x arm64: dts: rockchip: Remove sdmmc max-frequency on RK3588S EVB1 board arm64: dts: rockchip: Remove sdmmc max-frequency for Radxa ROCK 5 ITX/5B/5B+/5T arm64: dts: rockchip: Switch microSD card detect to gpio on Radxa ROCK 5 ITX/5C arm64: dts: rockchip: Add devicetree for the 9Tripod X3568 v4 dt-bindings: arm: rockchip: Add 9Tripod X3568 series ... Signed-off-by: Arnd Bergmann commit d7eebe1098c41007a6e1303a955a7724f906c3e0 Merge: c1ce3348ae08c4 10712ce694a673 Author: Arnd Bergmann Date: Fri Nov 21 20:50:57 2025 +0100 Merge tag 'v6.19-rockchip-dts32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt A number of cleanups for older socs. * tag 'v6.19-rockchip-dts32-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: move edp assigned-clocks to edp node on rk3288 ARM: dts: rockchip: Add spi_flash label to rk3288-veyron ARM: dts: rockchip: Remove mshc aliases from RK3288 ARM: dts: rockchip: Adapt tps65910 nodes on RK3066 boards Signed-off-by: Arnd Bergmann commit 6d90215dc015f7630589b29fc2c771bce16a4c96 Author: Lai Jiangshan Date: Fri Nov 21 22:57:16 2025 +0800 workqueue: Don't rely on wq->rescuer to stop rescuer The commit1 def98c84b6cd ("workqueue: Fix spurious sanity check failures in destroy_workqueue()") tries to fix spurious sanity check failures by stopping send_mayday() via setting wq->rescuer to NULL. But it fails to stop the pwq->mayday_node requeuing in the rescuer, and the commit2 e66b39af00f4 ("workqueue: Fix pwq ref leak in rescuer_thread()") fixes it by checking wq->rescuer which is the result of commit1. Both commits together really fix spurious sanity check failures caused by the rescuer, but they both use a convoluted method by relying on wq->rescuer state rather than the real count of work items. Actually __WQ_DESTROYING and drain_workqueue() together already stop send_mayday() by draining all the work items and ensuring no new work item requeuing. And the more proper fix to stop the pwq->mayday_node requeuing in the rescuer is from commit3 4f3f4cf388f8 ("workqueue: avoid unneeded requeuing the pwq in rescuer thread") and renders the checking of wq->rescuer in commit2 unnecessary. So __WQ_DESTROYING, drain_workqueue() and commit3 together fix spurious sanity check failures introduced by the rescuer. Just remove the convoluted code of using wq->rescuer. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit 7b05c90b3302cf3d830dfa6f8961376bcaf43b94 Author: Lai Jiangshan Date: Fri Nov 21 22:57:15 2025 +0800 workqueue: Only assign rescuer work when really needed If the pwq does not need rescue (normal workers have been created or become available), the rescuer can immediately move on to other stalled pwqs. Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit 99ed6f62a46e91dc796b785618d646eeded1b230 Author: Lai Jiangshan Date: Fri Nov 21 22:57:14 2025 +0800 workqueue: Factor out assign_rescuer_work() Move the code to assign work to rescuer and assign_rescuer_work(). Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit 5c4663ed1eac01987a1421f059380db48ab7b1a3 Author: Smita Koralahalli Date: Fri Nov 21 19:04:05 2025 +0000 x86/mce: Handle AMD threshold interrupt storms Extend the logic of handling CMCI storms to AMD threshold interrupts. Rely on the similar approach as of Intel's CMCI to mitigate storms per CPU and per bank. But, unlike CMCI, do not set thresholds and reduce interrupt rate on a storm. Rather, disable the interrupt on the corresponding CPU and bank. Re-enable back the interrupts if enough consecutive polls of the bank show no corrected errors (30, as programmed by Intel). Turning off the threshold interrupts would be a better solution on AMD systems as other error severities will still be handled even if the threshold interrupts are disabled. [ Tony: Small tweak because mce_handle_storm() isn't a pointer now ] [ Yazen: Rebase and simplify ] [ Avadhut: Remove check to not clear bank's bit in mce_poll_banks and fix checkpatch warnings. ] Signed-off-by: Smita Koralahalli Signed-off-by: Tony Luck Signed-off-by: Yazen Ghannam Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251121190542.2447913-3-avadhut.naik@amd.com commit d7ac083f095d894a0b8ac0573516bfd035e6b25a Author: Avadhut Naik Date: Fri Nov 21 19:04:04 2025 +0000 x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems Currently, when a CMCI storm detected on a Machine Check bank, subsides, the bank's corresponding bit in the mce_poll_banks per-CPU variable is cleared unconditionally by cmci_storm_end(). On AMD SMCA systems, this essentially disables polling on that particular bank on that CPU. Consequently, any subsequent correctable errors or storms will not be logged. Since AMD SMCA systems allow banks to be managed by both polling and interrupts, the polling banks bitmap for a CPU, i.e., mce_poll_banks, should not be modified when a storm subsides. Fixes: 7eae17c4add5 ("x86/mce: Add per-bank CMCI storm mitigation") Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251121190542.2447913-2-avadhut.naik@amd.com commit 4635406417bb842862d6322c461743c9b128c444 Author: Peter Colberg Date: Thu Nov 20 11:06:09 2025 -0500 samples: rust: fix module name for Rust PCI driver sample Replace driver_pci -> rust_driver_pci in config SAMPLE_RUST_DRIVER_PCI. Signed-off-by: Peter Colberg Fixes: 685376d18e9a ("samples: rust: add Rust PCI sample driver") Link: https://patch.msgid.link/20251120-rust-driver-pci-fix-module-name-v1-1-430cee310dc0@redhat.com Signed-off-by: Danilo Krummrich commit edbce49ea6535a56aac3a5e211cf7af873d7221d Author: Billy Tsai Date: Thu Nov 20 19:12:32 2025 +0800 hwmon: (aspeed-g6-pwm-tach): Add AST2700 compatible string Extends device tree support to include the AST2700 chip variant by adding its compatible string to the device match table. The AST2700 PWM/TACH hardware is compatible with the existing driver implementation used for AST2600. Signed-off-by: Billy Tsai Link: https://lore.kernel.org/r/20251120-upstream_pwm_tach-v3-2-eaa2f9b300a2@aspeedtech.com Signed-off-by: Guenter Roeck commit cefb89592e3217884138d4450ad14bc3415e1d76 Author: Billy Tsai Date: Thu Nov 20 19:12:31 2025 +0800 dt-bindings: hwmon: Add AST2700 compatible Adds support for the AST2700 PWM/Tach controller by extending the compatible string enumeration in the device tree binding. The AST2700 PWM/Tach hardware is compatible with the existing binding schema and requires no additional properties or modifications beyond the new compatible string. Signed-off-by: Billy Tsai Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251120-upstream_pwm_tach-v3-1-eaa2f9b300a2@aspeedtech.com Signed-off-by: Guenter Roeck commit 48593957a016cf32274e935f4346d0580271a61f Author: René Rebe Date: Thu Nov 20 14:00:09 2025 +0100 hwmon: (asus-ec-sensors) add ROG STRIX X470-I GAMING Add support for ROG STRIX X470-I GAMING Signed-off-by: René Rebe Reviewed-by: Eugene Shalygin Link: https://lore.kernel.org/r/20251120.140009.210830394703243387.rene@exactco.de Signed-off-by: Guenter Roeck commit 792f258803bca17a7acc912705a2c5edf032a744 Merge: e0940c672ab422 db354a1577326b Author: Martin KaFai Lau Date: Fri Nov 21 09:54:50 2025 -0800 Merge branch 'selftests-bpf-networking-test-cleanups' Hoyeon Lee says: ==================== selftests/bpf: networking test cleanups This series finishes the sockaddr_storage migration in the networking selftests by removing the remaining open-coded IPv4/IPv6 wrappers (addr_port/tuple in cls_redirect, sa46 in select_reuseport). The tests now use sockaddr_storage directly. No other custom socket-address wrappers remain after this series, so the churn stops here and behavior is unchanged. ==================== Link: https://patch.msgid.link/20251121081332.2309838-1-hoyeon.lee@suse.com Signed-off-by: Martin KaFai Lau commit db354a1577326b24b82af0c328789181a329f111 Author: Hoyeon Lee Date: Fri Nov 21 17:13:32 2025 +0900 selftests/bpf: Use sockaddr_storage instead of sa46 in select_reuseport test The select_reuseport selftest uses a custom sa46 union to represent IPv4 and IPv6 addresses. This custom wrapper requires extra manual handling for address family and field extraction. Replace sa46 with sockaddr_storage and update the helper functions to operate on native socket structures. This simplifies the code and removes unnecessary custom address-handling logic. No functional changes intended. Reviewed-by: Amery Hung Signed-off-by: Hoyeon Lee Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251121081332.2309838-3-hoyeon.lee@suse.com commit fd6ed07a05dc107605c50c786f9705d717bc0b30 Author: Hoyeon Lee Date: Fri Nov 21 17:13:31 2025 +0900 selftests/bpf: Use sockaddr_storage directly in cls_redirect test The cls_redirect test uses a custom addr_port/tuple wrapper to represent IPv4/IPv6 addresses and ports. This custom wrapper requires extra conversion logic and specific helpers such as fill_addr_port(), which are no longer necessary when using standard socket address structures. This commit replaces addr_port/tuple with the standard sockaddr_storage so test handles address families and ports using native socket types. It removes the custom helper, eliminates redundant casts, and simplifies the setup helpers without functional changes. set_up_conn() and build_input() now take src/dst sockaddr_storage directly. Reviewed-by: Amery Hung Signed-off-by: Hoyeon Lee Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251121081332.2309838-2-hoyeon.lee@suse.com commit 055bcc552b5181da208038c1de9437e9cca69380 Author: Lukas Bulwahn Date: Mon Nov 17 11:53:11 2025 +0100 MAINTAINERS: refer to intended file in STANDALONE CACHE CONTROLLER DRIVERS Commit 23db6eed72bd ("MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header") intends to add a file entry pointing to the cache_coherency.h file, but messes up to name the right path. Update the entry to the intended file. Signed-off-by: Lukas Bulwahn Acked-by: Jonathan Cameron Signed-off-by: Conor Dooley commit 2ec3b54a6ff04046c07b7050d02321e406c4dcd1 Author: Yushan Wang Date: Mon Nov 17 10:48:00 2025 +0000 cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent Hydra Home Agent is a device used to maintain cache coherency. Add support for explicit cache maintenance operations using it. A system has multiple of these agents. Whilst only one agent is responsible for a given cache line, interleave means that for a range operation, responsibility for the cache lines making up the range will typically be spread across multiple instances. Put this driver on a new Kconfig menu under drivers/cache. The short description as memory hotplug like operations is intended to cover the somewhat complex set of cases where this unit applies and differentiate it clearly from typical non coherent DMA flows. Co-developed-by: Yicong Yang Signed-off-by: Yicong Yang Signed-off-by: Yushan Wang Signed-off-by: Jonathan Cameron Signed-off-by: Conor Dooley commit 4d1608d0ab3365d1ef9447bdbc0cb4c0962f1774 Author: Jonathan Cameron Date: Mon Nov 17 10:47:59 2025 +0000 cache: Make top level Kconfig menu a boolean dependent on RISCV The next patch will add a new type of cache maintenance driver responsible for flushing deeper than is necessary for non coherent DMA (current use case of drivers/cache drivers), as needed when performing operations such as memory hotplug and security unlocking of persistent memory. The two types of operation are similar enough to share a drivers/cache directory and MAINTAINERS but are otherwise currently unrelated. To avoid confusion have two separate menus. Each has dependencies that are implemented by making them boolean symbols, here CACHEMAINT_FOR_DMA which is dependent on RISCV as all driver are currently for platforms of that architecture. Set new symbol default to y to avoid breaking existing configs. This has no affect on actual code built, just visibility of the menu. Suggested-by: Arnd Bergmann Signed-off-by: Jonathan Cameron Signed-off-by: Conor Dooley commit 9b9de5a56a62c86472848ec7d48ca939411511e6 Author: Jonathan Cameron Date: Mon Nov 17 10:47:58 2025 +0000 MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header Seems unfair to inflict the cache-coherency drivers on Conor with out also stepping up as a second maintainer for drivers/cache. Include the library support for cache-coherency maintenance drivers to the existing entry. Signed-off-by: Jonathan Cameron Acked-by: Conor Dooley Signed-off-by: Conor Dooley commit 4d873c5dc3ed5a189a39fcbddad8bcd2bd2a1785 Author: Jonathan Cameron Date: Mon Nov 17 10:47:57 2025 +0000 arm64: Select GENERIC_CPU_CACHE_MAINTENANCE The generic CPU cache maintenance framework provides a way to register drivers for devices implementing the underlying support for cpu_cache_has_invalidate_memregion(). Enable it for arm64 by selecting GENERIC_CPU_CACHE_MAINTENANCE which provides the implementation for, and in turn selects, ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION. Signed-off-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Conor Dooley commit c460697d3472d4252917fba9bbc1d1a23eafc124 Author: Yicong Yang Date: Mon Nov 17 10:47:56 2025 +0000 lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION provides the mechanism for invalidating certain memory regions in a cache-incoherent manner. Currently this is used by NVDIMM and CXL memory drivers in cases where it is necessary to flush all data from caches by physical address range. The operations in question are effectively memory hotplug, where stale data might otherwise remain in the caches. This is separate from the invalidates done to enable use of non-coherent DMA masters, primarily in terms of when it is needed (not related to DMA mappings) and how deep the flush must push data. The flushes done for non-coherent DMA only need to reach the Point of Coherence of a single host (which is often nearer CPUs and DMA masters than the physical storage). This operation must push the data out of non architectural caches (memory-side caches, write buffers etc) and typically all the way to the memory device. In some architectures these operations are supported by system components that may become available only later in boot as they are either present on a discoverable bus, or via a firmware description of an MMIO interface (e.g. ACPI DSDT). Provide a framework to handle this case. Architectures can opt in for this support via CONFIG_GENERIC_CPU_CACHE_MAINTENANCE Add a registration framework. Each driver provides an ops structure and the first op is Write Back and Invalidate by PA Range. The driver may over invalidate. For systems that can perform this operation asynchronously an optional completion check operation is also provided. If present that must be called to ensure that the action has finished. This provides a considerable performance advantage if multiple agents are involved in the maintenance operation. When multiple agents are present in the system each should register with this framework and the core code will issue the invalidate to all of them before checking for completion on each. This is done to avoid need for filtering in the core code which can become complex when interleave, potentially across different cache coherency hardware is going on, so it is easier to tell everyone and let those who don't care do nothing. Signed-off-by: Yicong Yang Co-developed-by: Jonathan Cameron Signed-off-by: Jonathan Cameron Acked-by: Conor Dooley Signed-off-by: Conor Dooley commit ef1b6d904993d3a21baa7d4105e1a4e4ba9dd6de Author: Ma Ke Date: Wed Nov 5 17:02:44 2025 +0800 EDAC/igen6: Fix error handling in igen6_edac driver The igen6_edac driver calls device_initialize() for all memory controllers in igen6_register_mci(), but misses corresponding put_device() calls in error paths and during normal shutdown in igen6_unregister_mcis(). Adding the missing put_device() calls improves code readability and ensures proper reference counting for the device structure. Found by code review. Signed-off-by: Ma Ke Reviewed-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251105090244.23327-1-make24@iscas.ac.cn commit 5f40ea7f41773d996d92db8bde600199200adc11 Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/imh: Setup 'imh_test' debugfs testing node Setup the following debugfs testing node to enable fake memory error address decoding tests for the imh_edac driver. /sys/kernel/debug/edac/imh_test/addr Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-8-qiuxu.zhuo@intel.com commit f619613f3058dee38f50b116ec774c5295c8b08b Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/{skx_comm,imh}: Detect 2-level memory configuration Detect 2-level memory configurations and notify the 'skx_common' library to enable ADXL 2-level memory error decoding. Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-7-qiuxu.zhuo@intel.com commit 39abdcbdad597b1ac3dabd44a757de91b87c683a Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/skx_common: Extend the maximum number of DRAM chip row bits The allowed maximum number of row bits for DRAM chips in the Diamond Rapids server processor is up to 19. Extend the current maximum row bits from 18 to 19. Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-6-qiuxu.zhuo@intel.com commit 9fc67b11703fe9d8a5617ccacec2a452e455fa52 Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers Intel Diamond Rapids CPUs include Integrated Memory and I/O Hubs (IMH). The memory controllers within the IMHs provide memory stacks to the processor. Create a new driver for this IMH-based memory controllers rather than applying additional patches to the existing i10nm_edac.c for the following reasons: 1) The memory controllers are not presented as PCI devices; instead, the detection and all their registers have been transitioned to MMIO-based memory spaces. 2) Validation processes are costly. Modifications to i10nm_edac would require extensive validation checks against multiple platforms, including Ice Lake, Sapphire Rapids, Emerald Rapids, Granite Rapids, Sierra Forest, and Grand Ridge. 3) Future Intel CPUs will likely only need patches on top of this new EDAC driver. Validation can be limited to Diamond Rapids servers and future Intel CPU generations. [Tony: Fix kerneldoc for struct local_reg] [randconfig: Added dependencies on NFIT and DMI] Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-5-qiuxu.zhuo@intel.com commit d2e50389ab44acfa05e72604d701a70b234f9938 Author: Yosry Ahmed Date: Tue Oct 21 07:47:24 2025 +0000 KVM: selftests: Make sure vm->vpages_mapped is always up-to-date Call paths leading to __virt_pg_map() are currently: (a) virt_pg_map() -> virt_arch_pg_map() -> __virt_pg_map() (b) virt_map_level() -> __virt_pg_map() For (a), calls to virt_pg_map() from kvm_util.c make sure they update vm->vpages_mapped, but other callers do not. Move the sparsebit_set() call into virt_pg_map() to make sure all callers are captured. For (b), call sparsebit_set_num() from virt_map_level(). It's tempting to have a single the call inside __virt_pg_map(), however: - The call path in (a) is not x86-specific, while (b) is. Moving the call into __virt_pg_map() would require doing something similar for other archs implementing virt_pg_map(). - Future changes will reusue __virt_pg_map() for nested PTEs, which should not update vm->vpages_mapped, i.e. a triple underscore version that does not update vm->vpages_mapped would need to be provided. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-12-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 1de4dc15baa1917adb3a0b369d00d818be9d9bab Author: Yosry Ahmed Date: Tue Oct 21 07:47:23 2025 +0000 KVM: selftests: Stop using __virt_pg_map() directly in tests Replace __virt_pg_map() calls in tests by high-level equivalent functions, removing some loops in the process. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-11-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit d879c2e0195bd5fd4c48467b95b77e494099c96c Merge: 55fb2d572623c6 e6bfd693bdd7da Author: Jonathan Corbet Date: Fri Nov 21 10:45:32 2025 -0700 Merge branch 'mauro' into docs-mw Mauro says: That's the final series to complete the migration of documentation build: it converts get_feat from Perl to Python. V2 is technically identical to v1: the only difference is that it now uses tools/lib/python/feat to store the library logic. With that, no Sphinx in-kernel extensions use fork anymore to call ancillary scripts: everything is now importing Python methods directly from the libraries. There's nothing special on this conversion: it is a direct translation, almost bug-compatible with the original version (*). (*) I did solve two or three caveats on patch 1. Most of the complexity of the script relies at the logic to produce ReST tables. I do have here on my internal scripts a (somewhat) generic formatter for ReST tables in Python. I was tempted to convert the logic to use it, but, as this could cause regressions, I opted to not do it right now, mainly because the matrix table logic is complex. Also, I'm tempted to modify a little bit the output there, but extra tests are required to see if PDF output would work with complex tables (I remember I had a problem with that in the past). So, I'm postponing such extra cleanup. commit e6bfd693bdd7daa373f23fdc4e61a3f34cce1ee9 Author: Mauro Carvalho Chehab Date: Tue Nov 18 20:09:28 2025 +0100 get_feat.pl: remove it, as it got replaced by get_feat.py Now that this was rewritten in Python, we can remove the old tool. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <1f53e0fa48616af189ce98b45a65cc0c245e7aaf.1763492868.git.mchehab+huawei@kernel.org> commit b713807eab1ee6716c80bb318cb8580408d0137d Author: Mauro Carvalho Chehab Date: Tue Nov 18 20:09:27 2025 +0100 Documentation/sphinx/kernel_feat.py: use class directly Now that get_feat is in Python, we don't need to use subprocess to fork an executable file: we can use the feature classes directly. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit caa642bf3b767c4b33a62c6e2c2708fafb88ea6c Author: Mauro Carvalho Chehab Date: Tue Nov 18 20:09:26 2025 +0100 tools/docs/get_feat.py: convert get_feat.pl to Python As we want to call Python code directly at the Sphinx extension, convert get_feat.pl to Python. The code was made to be (almost) bug-compatible with the Perl version, with two exceptions: 1. Currently, Perl script outputs a wrong table if arch is set to a non-existing value; 2. the ReST table output when --feat is used without --arch has an invalid format, as the number of characters for the table delimiters are wrong. Those two bugs were fixed while testing the conversion. Additionally, another caveat was solved: the output when --feat is used without arch and the feature doesn't exist doesn't contain an empty table anymore. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <03c26cee1ec567804735a33047e625ef5ab7bfa8.1763492868.git.mchehab+huawei@kernel.org> commit da218406dd50e0ac96bb383de4edd208286efe70 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:24:57 2025 +0100 serial: 8250_platform: simplify IRQF_SHARED handling IRQF_SHARED is the only flag handled in __serial8250_isa_init_ports() and serial8250_probe_platform(). There is no need to precompute the flags. Instead, initialize port->irqflags directly in the for loop. Note the "if (bool)" is cheap and these are not hot paths anyway. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119092457.826789-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit f9066dac8ffe237817030d8505ed3dfdae7241ae Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:24:56 2025 +0100 serial: 8250: make share_irqs local to 8250_platform share_irqs is used solely in 8250_platform. Make it local to that file. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119092457.826789-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9b2259633bda9875c1305309e3fc9a984691cadd Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:24:55 2025 +0100 serial: 8250: move skip_txen_test to core 8250_core is the only place where skip_txen_test is used. And platform and core end up in 8250.ko, so there is no change in module name (param prefix). Therefore, move skip_txen_test there and make it local. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119092457.826789-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 37d55c92e9db3f7fd3772199ffdfe782fc753fc1 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:24:54 2025 +0100 serial: drop SERIAL_8250_DEPRECATED_OPTIONS In 3.7, 8250 was unintentionally renamed to 8250_core. This happened in the commit 835d844d1a28 (8250_pnp: do pnp probe before legacy probe). This made 8250. module options effectively defunct. Instead, 8250_core. worked. In 3.9, the commit f2b8dfd9e480 (serial: 8250: Keep 8250. module options functional after driver rename) made the original options work again by introducing a hack. Later in 3.9, the commit 9196d8acd7f9 (TTY: 8250, revert module name change) changed the module name back to 8250 (from 8250_core). Since then, the hack was there to support the transient 8250_core. options. Those were present only in the 3.7..3.9 range. These transient options were deprecated by 9326b047e4fd (TTY: 8250, deprecated 8250_core.* options) in v3.9 too. Now, after those 12 years, it is time to get rid of this hack completely. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119092457.826789-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6d4b55bf18c6dc74221f76770c8e4862f1a2b084 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:24:53 2025 +0100 serial: xilinx_uartps: drop cdns_uart::cdns_uart_driver Provided the uart driver is available globally, there is no need to store a pointer to it in struct cdns_uart. Instead, use the global cdns_uart_uart_driver in the code directly. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Michal Simek Link: https://patch.msgid.link/20251119092457.826789-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 80a3471f59ef6284f7ca78ffc36d90007536ee0a Author: Jiri Slaby (SUSE) Date: Wed Nov 19 10:24:52 2025 +0100 tty: vt: do not open code DIV_ROUND_UP() Use the designated DIV_ROUND_UP() macro instead of explicit addition with division. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119092457.826789-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit b844e63807ecc5dcfe80e9920e5d14c5a4011aa4 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:40 2025 +0100 serial: serial_core: use guard()s Use guards in the serial_core code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-11-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit f374a33e90e6cc17b05629636e68a012dc8347ed Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:39 2025 +0100 serial: serial_core: simplify uart_ioctl() returns Neither uart_do_autoconfig(), nor uart_wait_modem_status() can return -ENOIOCTLCMD. The ENOIOCTLCMD checks are there to check if 'cmd' matched against TIOCSERCONFIG, and TIOCMIWAIT respectively. (With 0 or error in 'ret', it does not matter.) Therefore, the code can simply return from the TIOCSERCONFIG and TIOCMIWAIT spots immediately. To be more explicit, use 'if' instead of switch-case for those single values. And return without jumping to the 'out' label -- it can be removed too. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-10-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit dee7e10498c76490bb3bd5039c7c12d54585c26d Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:38 2025 +0100 tty: vt/keyboard: use guard()s Use guards in the vt/keyboard code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-9-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit d139b31f86b9ca56ee2424e46f0c2b5d23f15eda Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:37 2025 +0100 tty: vt/keyboard: simplify returns from vt_do_kbkeycode_ioctl() Return immediately when something goes wrong in vt_do_kbkeycode_ioctl(). This makes the code flow more obvious. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-8-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit bfb24564b5fd8625ce5c007f274cabdc3b570969 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:36 2025 +0100 tty: vt/keyboard: use __free() The vt/keyboard code can use __free to ensure the temporary buffers are freed. Perform the switch. And even one non-temporary in kbd_connect(). There are fail paths, so ensure the buffer is freed in them and not when returning 0 -- by retain_and_null_ptr(). Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 1c7736dc68d7599e12e6b20c848dfbcbe0d04cdb Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:35 2025 +0100 tty: moxa: use guard()s Use guards in the moxa code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8c03bfcf6b2bbb1b936b6a5dec3bd7922460cb9d Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:34 2025 +0100 tty: n_hdlc: use guard()s Use guards in the n_hdlc code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3ae99599bf47eb99f6090c9502e32993fb331e0e Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:33 2025 +0100 tty: n_hdlc: simplify return from n_hdlc_tty_ioctl() The cases in the switch() of n_hdlc_tty_ioctl() can return immediately -- no need to store into error and return later. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2fc541e525178d6bd3c14c0d05a0e5889831da50 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:32 2025 +0100 tty: n_tty: use guard()s Use guards in the n_tty code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 977e75909db72e3ee70483a21aec7d745eef02b7 Author: Jiri Slaby (SUSE) Date: Wed Nov 19 11:01:31 2025 +0100 tty: pty: use guard()s Use guards in the pty code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. pty_set_pktmode() is handled specially -- the conditions are inverted and return called if conditions unmet. This avoid double nested 'if's. The variable is renamed to want_pktmode so it is not confused with the current state of pktmode. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 55fb2d572623c6ce81b3519c51309c9127dbd1c8 Author: Jiakai Xu Date: Wed Nov 19 14:57:27 2025 +0800 Documentation/admin-guide: fix typo and comment in cscope example This patch updates the Linux documentation for cscope, fixing two issues: 1. Corrects the typo in the command line: c"scope -d -p10 -> cscope -d -p10 2. Fixes the related documentation comment for clarity and correctness: cscope by default cscope.out database. -> cscope by default uses the cscope.out database. Signed-off-by: Jiakai Xu Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251119065727.3500015-1-jiakaiPeanut@gmail.com> commit 6c84a61ac023d581b4b9fcfa44532eaf15946f56 Author: David Laight Date: Wed Nov 19 22:41:23 2025 +0000 drivers/tty/vt: use umin() instead of min_t(u16, ...) for row/col limits The row/column bounds (for a screen window box) are changed from 'offset one' to 'offset zero' and bound to the screen size using: v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1); This has the side effect of converting zero to the limit. A check I'm adding to min_t() reports that (u16)(v->xs - 1) (etc) discards signiticant bits (because v->xs is promoted to 'int' before the addition). If v->xs is zero (it comes from userspace) it converts -1 to 0xffff. This is then bounded to 'vc->vc_cols - 1' which will be fine. Replace with: v->xs = umin(v->xs - 1, vc->vc_cols - 1); which again converts a -1 to unsigned - this time to 0xffffffff, with the same overall effect. Whether zero is meant to mean the 'maximum size' is unknown. I can't find any documentation for the ioctl and it pre-dates git. Detected by an extra check added to min_t(). Signed-off-by: David Laight Reviewed-by: Jiri Slaby Link: https://patch.msgid.link/20251119224140.8616-28-david.laight.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit fba27fe5aaf14e2aae1649a14309b77de2c9546c Merge: 670500b41e543c 12d821bd13d42e Author: Mark Brown Date: Fri Nov 21 16:57:50 2025 +0000 regulator: Add FP9931/JD9930 Merge series from Andreas Kemnade : Add a driver for the FP9931/JD9930 regulator which provides the comparatively high voltages needed for electronic paper displays. Datasheet for the FP9931 is at https://www.fitipower.com/dl/file/flXa6hIchVeu0W3K Although it is in English, it seems to be only downloadable from the Chinese part of that website. For the JD9930 there can be a datasheet found at https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/196/JD9930_2D00_0.7_2D00_JUN_2D00_2019.pdf To simplify things, include the hwmon part directly which is only one register read and there are not other functions besides regulators in this chip. commit fb64bf480691369b589f6811c967db98b5a5f5a9 Merge: e354cc78f7285a ac35e04f8000aa Author: Greg Kroah-Hartman Date: Fri Nov 21 17:42:47 2025 +0100 Merge tag 'mhi-for-v6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== - Add support for Telit FE990B40 and Foxconn T99W760 modems MHI Endpoint ============ - Make 'struct mhi_ep_bus_type' const as the driver core now handles the const bus_type. - Add WQ_PERCPU flag to alloc_workqueue() as a part of the workqueue refactoring * tag 'mhi-for-v6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: pci_generic: Add Foxconn T99W760 modem bus: mhi: ep: add WQ_PERCPU to alloc_workqueue users bus: mhi: host: pci_generic: Add Telit FE990B40 modem support bus: mhi: ep: Make mhi_ep_bus_type const commit df919994d323c7c86e32fa2745730136d58ada12 Author: HariKrishna Sagala Date: Thu Nov 13 19:56:38 2025 +0530 ASoC: Intel: avs: Replace snprintf() with scnprintf() snprintf() as defined by the C99 standard,returns the number of characters that *would have been* written if enough space were available.Use scnprintf() that returns the actual number of characters written. Link: https://github.com/KSPP/linux/issues/105 Signed-off-by: HariKrishna Sagala Link: https://patch.msgid.link/20251113142637.259737-2-hariconscious@gmail.com Signed-off-by: Mark Brown commit c1ce3348ae08c4260afc6d85e5afe7457f1f3fc7 Merge: c02dce25bc663e f481e772e014da Author: Arnd Bergmann Date: Fri Nov 21 17:24:41 2025 +0100 Merge tag 'qcom-arm64-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v6.19 Introduce support for the Redxa Dragon Q6A development board, the Huawei MateBoot E 2019, the Asus ZenFone 2 Laser/Selfie, the MSM8937 platform and the Xiaomo Redmi 3S device based on it. SoC dtsi files for Agatti, Hamoa, Kodiak, Monaco, Purwa, and Talos, are renamed in order to better facilitate the addition of new boards on the various SKUs of these. Cooling maps are introduced for the CPU cores in IPQ5424, and the network subsystem clock controller is added. On Lemans, RTC is enabled, the EVK fan controller is described and a camera mezzanine overlay is introduced. Touchscreen support is added to the BQ Aquaris M5, and the touchscreen from Samsung Galaxy Core Prime is moved to the common platform to benefit the other devices sharing common definitions. On Agatti two more UARTs are described, as well as APR and the related audio services, and the LPASS LPI pin controller. The RB1 board gets HDMI autio playback support. On Kodiak-based targets, Fairphone FP5 gains definitions of the UW camera actuator, regulator for the ToF sensor, and haptic module. The SHIFT SHIFTphone 8 gains RGB and flash LEDs, and Venus support. The Rb3Gen2 development board gets QUP firmware path defined, to support dynamic loading of the serial engine firmware. Kodiak also gains Coresight devices for AOSS and QDSS blocks. Display support is added for the Talos platform, and enabled on the Ride board. Talos also gains the definitions to scale DDR and L3 interconnects. On SC8280XP, the camera privacy indicator on Lenovo Thinkpad X13s is connected to the camera stack. Off-by-one GPI DMA channels are corrected. The SDM845-based LG and OnePlus custom defined rmtfs guard pages are replaced with the inline-support for guard pages. SDX75 DWC3 node is flattened and marked for USB role switching. On SM8550, the camera subsystem and the S5K3M5 camera sensor is introduced for the QRD, and an overlay for the "Rear Camera Card" for the Hardware Development Kit (HDK) is introduced. USB support is introduce for the SM8750 platform, and enabled in the MTP and QRD devices. On Hamoa, like on other devices the Asus Zenbook A14 definition of the eDP panel is reworked to support both LCD and OLED configurations. WiFi and Bluetooth is also enabled on the A14. The CRD gains support for controlling charge limits. The refgen regulator supplying DSI is defined and wired up on a variety of platforms. * tag 'qcom-arm64-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (138 commits) arm64: dts: qcom: sdx75: Add missing usb-role-switch property arm64: dts: qcom: sdx75: Flatten usb controller node arm64: dts: qcom: HAMOA-IOT-SOM: Unreserve GPIOs blocking SPI11 access arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Revert "arm64: dts: qcom: sc7280: Increase config size to 256MB for ECAM feature" arm64: dts: qcom: kodiak: add coresight nodes arm64: dts: qcom: sdm845-oneplus: Describe TE gpio arm64: dts: qcom: sdm845-oneplus: Implement panel sleep pinctrl arm64: dts: qcom: sdm845-oneplus: Group panel pinctrl arm64: dts: qcom: sdm845-oneplus: Update compatbible and add DDIC supplies arm64: dts: qcom: qcs6490-rb3gen2: Rename vph-pwr regulator node arm64: dts: qcom: qcm6490-fairphone-fp5: Add UW cam actuator arm64: dts: qcom: qcm6490-fairphone-fp5: Enable CCI pull-up arm64: dts: qcom: sm8750: Add USB support for SM8750 QRD platform arm64: dts: qcom: sm8750: Add USB support for SM8750 MTP platform arm64: dts: qcom: sm8750: Add USB support to SM8750 SoCs arm64: dts: qcom: rename x1p42100 to purwa arm64: dts: qcom: rename sc7280 to kodiak arm64: dts: qcom: rename qcm2290 to agatti arm64: dts: qcom: add gpu_zap_shader label ... Signed-off-by: Arnd Bergmann commit c02dce25bc663e8af5ec46c6269cda0fcc684950 Merge: 2ddb010a9e09e6 84df51667a196a Author: Arnd Bergmann Date: Fri Nov 21 17:21:11 2025 +0100 Merge tag 'qcom-arm32-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm32 DeviceTree updates for v6.19 In addition to a variety of cleanups and reordering of nodes, four GSBIs are added to the MSM8960 platform. On the MSM8226-based Samsung Galaxy Grand 2, a simple framebuffer is defined. * tag 'qcom-arm32-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: msm8226-samsung-ms013g: add simple-framebuffer ARM: dts: qcom: msm8960: rename msmgpio node to tlmm ARM: dts: qcom: msm8960: add I2C nodes for gsbi1 and gsbi8 ARM: dts: qcom: msm8960: add I2C nodes for gsbi10 and gsbi12 ARM: dts: qcom: msm8960: inline qcom-msm8960-pins.dtsi ARM: dts: qcom: msm8960: reorder nodes and properties Signed-off-by: Arnd Bergmann commit 2ddb010a9e09e61779f1e02ec5cb3903d06808a3 Merge: 4033cc098ca8b3 73f0769ebfc647 Author: Arnd Bergmann Date: Fri Nov 21 17:19:45 2025 +0100 Merge tag 'omap-for-v6.19/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt Misc. DT updates, mostly for AM3 platforms. * tag 'omap-for-v6.19/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: ti/omap: fix incorrect compatible string in internal eeprom node ARM: dts: omap: am335x-mba335x: Fix stray '/*' in comment ARM: dts: omap: am335x-tqma335x/mba335x: Fix MicIn routing dt-bindings: mmc: ti,omap2430-sdhci: convert to DT schema arm: dts: ti: omap: Drop unnecessary properties for SDHCI node arm: dts: ti: omap: am335x-pepper: Fix vmmc-supply property typo ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible ARM: dts: omap: Add support for TQMa335x/MBa335x ARM: dts: omap: AM33xx: add cpu label dt-bindings: omap: add AM335x-based TQMa335x SOM and MBa335x board ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels ARM: dts: ti: omap: am335x-baltos: add a regulator for the mPCIe slot ARM: dts: omap: rework Baltos LED nodes ARM: dts: am33xx: Add missing serial console speed Signed-off-by: Arnd Bergmann commit 4033cc098ca8b38d29698a5ec47cbcaf183199c6 Merge: 287df51938b2c8 7d5864dc5d5ea6 Author: Arnd Bergmann Date: Fri Nov 21 17:19:04 2025 +0100 Merge tag 'at91-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v6.19 This update includes: - FIFO size fixes for some Flexcom UARTs and SPIs * tag 'at91-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 ARM: dts: microchip: sama7g5: fix uart fifo size to 32 ARM: dts: microchip: sama7d65: fix uart fifo size to 32 Signed-off-by: Arnd Bergmann commit a3d8f733d453ed4d4eb1f0e894eec787777465a2 Author: Srinivas Kandagatla Date: Fri Nov 21 14:32:58 2025 +0000 ASoC: codecs: wcd934x: add explicit soundwire depenency WCD934x provides register read/write interface to soundwire controller via slimbus. Eventhough there was no direct compile time dependency for this so far, however after adding common wcd functions this dependency became explict. We can either move the soundwire specific bits from wcd-common to wcd-sdw.c or something on those lines or explicity add this dependency in Kconfig. Moving this wcd-sdw can fix reported compile issue but it does not make sense to select this codec without soundwire configs. Given the fact that WCD934x is very much providing soundwire functionality it is better to specify the soundwire dependency explicity in Kconfig which should also fix the below compile time error with combination of wcd934x a built-in and soundwire a module and also allow this codec selection only when soundwire is available. Error log: wcd-common.c:undefiined reference to `sdw_write' sound/soc/codecs/wcd-common.o: in function `wcd_bus_config': Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511210405.zd9wig5Z-lkp@intel.com/ Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251121143258.229138-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 287df51938b2c81e6cc325ab6787ae4b5045ed8a Merge: c7cdc91603eec1 00fb4c73b67d36 Author: Arnd Bergmann Date: Fri Nov 21 17:15:07 2025 +0100 Merge tag 'ti-k3-dt-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.19 Generic fixes and cleanups: * Multiple SoCs: Disable CPSW in SoC files and enable them in board files for better board-level control * Replace rgmii-rxid with rgmii-id for CPSW ports across multiple boards New Boards/SoM: * AM62L SoC and basic support for EVM * Toradex Aquila AM69 board support * Kontron SMARC-sAM67 module and ADS2 carrier board support Platform wide: * Define possible system states amd wakeup-source (AM62/AM62A/AM62P) SoC/EVM specific changes: AM62: * Add RNG node * Add OLDI support AM62P: * Move audio_refclk to common main dtsi (k3-am62p-j722s-common-main) * Fix memory ranges for GPU AM62D2: * Enable PMIC support on EVM * Misc fixes AM64: * Add DMA support for TSCADC on EVM AM69: * Add Aquila board support with Clover variant J722S: * Fix audio refclk source in main dtsi * Explicitly use PLL1_HSDIV6 audio refclk for EVM J784S4/J742S2: * Add bootph-all tag to support PCIe boot Variscite VAR-SOM-AM62P: * Add support for ADS7846 touchscreen * Add support for WM8904 audio codec * tag 'ti-k3-dt-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (42 commits) arm64: dts: ti: k3-am62l: add initial reference board file arm64: dts: ti: k3-am62l: add initial infrastructure dt-bindings: arm: ti: Add binding for AM62L SoCs arm64: dts: ti: am69-aquila: Add Clover arm64: dts: ti: Add Aquila AM69 Support dt-bindings: arm: ti: add Toradex Aquila AM69 arm64: dts: ti: k3-j721s2: disable "mcu_cpsw" in SoC file and enable in board files arm64: dts: ti: k3-j721e: disable "mcu_cpsw" in SoC file and enable it in board file arm64: dts: ti: k3-j7200: disable "mcu_cpsw" in SoC file and enable in board file arm64: dts: ti: k3-am65: disable "mcu_cpsw" in SoC file and enable in board file arm64: dts: ti: k3-am62: disable "cpsw3g" in SoC file and enable in board file arm64: dts: ti: k3-am62p5-sk: Set wakeup-source system-states arm64: dts: ti: k3-am62a7-sk: Set wakeup-source system-states arm64: dts: ti: k3-am62-lp-sk: Set wakeup-source system-states arm64: dts: ti: k3-am62p: Define possible system states arm64: dts: ti: k3-am62a: Define possible system states arm64: dts: ti: k3-am62: Define possible system states arm64: dts: ti: k3-am62p-j722s-common-main: move audio_refclk here arm64: dts: ti: k3-*: Replace rgmii-rxid with rgmii-id for CPSW ports arm64: dts: ti: k3-am642-tqma64xxl: add boot phase tags ... Signed-off-by: Arnd Bergmann commit c7cdc91603eec1ed3f889aa1b8ffe3dd317eae56 Merge: 976e33268c41bb 38eff72f2d3a83 Author: Arnd Bergmann Date: Fri Nov 21 17:13:50 2025 +0100 Merge tag 'socfpga_dts_updates_for_v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA DTS updates for v6.19 - Add 4-bit SPI bus width(n5x, stratix10, agilex and agilex5) - Agilex5 updates: - Add GMAC0 for NAND daughter card - Add SMMU support - Add VGIC maintenance interrupt - Add L2 and L3 cache - Add support for the 013b board - Add I3C support - Add support for the Enclustra Mercury+ SA1 SoM based on Cyclone5 - Add support for Agilex3 board(a variant of the Agilex5 board) - dt-bindings update: - Document iommu in cdns,hp-nfc, snps,dw-axi-dmac and Agilex5 - Document Enclustra Mercury SA1 and AA1 boards - Document Agilex5 013b board - Document Agilex3 board - Fix dtbs_check warnings: - stratix10-swvp - Agilex(NAND and Clock manager) - Move sdmmc-ecc to base DTSI file(Stratix10) * tag 'socfpga_dts_updates_for_v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: (35 commits) arm64: dts: socfpga: agilex5: update qspi partitions for 013b board arm64: dts: socfpga: add Agilex3 board dt-bindings: intel: Add Agilex3 SoCFPGA board arm64: dts: intel: agilex5: Add Altera compatible for I3C controllers arm64: dts: socfpga: Add Agilex5 SVC node with memory region dt-bindings: firmware: svc: Add IOMMU support for Agilex5 arm64: dts: socfpga: agilex5: Add SMMU-V3-PMCG nodes arm64: dts: socfpga: agilex5: Add L2 and L3 cache arm64: dts: socfpga: agilex5: fix CHECK_DTBS warning for NAND arm64: dts: socfpga: agilex5: add support for 013b board dt-bindings: intel: Add Agilex5 SoCFPGA 013b board arm64: dts: socfpga: agilex5: add VGIC maintenance interrupt arm64: dts: socfpga: agilex: fix dtbs_check warning for NAND arm64: dts: socfpga: agilex: fix dtbs_check warning for clock manager arm64: dts: socfpga: stratix10-swvp: fix dtbs_check warnings swvp arm64: dts: socfpga: move sdmmc-ecc to the base DTSI file ARM: dts: socfpga: add Enclustra SoM dts files dt-bindings: altera: removal of generic PE1 dts ARM: dts: socfpga: removal of generic PE1 dts dt-bindings: altera: add Mercury AA1 variants ... Signed-off-by: Arnd Bergmann commit 976e33268c41bb8aee9f39979834fee6876cb383 Merge: e5060380e0633d 90bbe88e0ea61b Author: Arnd Bergmann Date: Fri Nov 21 17:10:41 2025 +0100 Merge tag 'imx-dt64-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX arm64 device tree changes for 6.19: - New board support: Protonic PRT8ML, Toradex SMARC iMX95, Skov Rev.C HDMI, i.MX 95 Verdin Evaluation KitPHYTEC phyBOARD-Segin-i.MX91 board, Skov i.MX8MP variant - A series from Alexander Stein to clean up and improve imx95-tqma9596sa board support - Add MicIn routing support for mba8mx boards - A couple of patch sets from Frank Li to clean up dt-schema warnings and add more device support for imx8dxl and imx8qxp boards - A series from Ioana Ciornei to add FPGA based GPIO controller and SFP+ cages for layerscape boards - A change from Jan Petrous to add GMAC Ethernet for S32G2 EVB, RDB2 and S32G3 RDB3 boards - A series from Markus Niebel to improve imx95-tqma9596sa board support - A couple of changes from Martin Kepplinger-Novaković to enable cpuidle cooling device support for imx8mp - A series from Max Krummenacher to clean up todo and add thermal support for imx8-apalis board - A series from Primoz Fiser to add USB vbus regulators, jtag and pwm-fan overlay for imx93-phyboard - A couple of series from Richard Zhu to add supports-clkreq property and vpcie3v3aux regulator for PCIe M.2 device - A series from Stefano Radaelli to add WiFi, BT, PMIC, WM8904 audio, and ADS7846 touchscreen support for imx93-var-som - A series from Tim Harvey to make some cleanups for imx8mm-venice boards - A change from Xu Yang to add DDR Perf Monitor support for i.MX94 - Other small and random changes * tag 'imx-dt64-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (122 commits) arm64: dts: freescale: add Toradex SMARC iMX95 arm64: dts: freescale: tqma9352: Add vcc-supply for spi-nor arm64: dts: mb-smarc-2: Add MicIn routing arm64: dts: mba8xx: Add MicIn routing arm64: dts: mba8mx: Add MicIn routing arm64: dts: imx8mp: make 'dsp' node depend on 'aips5' arm64: dts: imx8mp: convert 'aips5' to 'aipstz5' arm64: dts: imx8mp-skov: add Rev.C HDMI support arm64: dts: imx8mp: Add missing LED enumerators for DH electronics i.MX8M Plus DHCOM on PDK2 arm64: dts: freescale: Add GMAC Ethernet for S32G2 EVB and RDB2 and S32G3 RDB3 arm64: dts: imx8qm-apalis: add pwm used by the backlight arm64: dts: imx95-tqma9596sa-mb-smarc-2: add aliases for SPI arm64: dts: imx95-tqma9596sa-mb-smarc-2: remove superfluous line arm64: dts: imx95-tqma9596sa-mb-smarc-2: mark LPUART1 as reserved arm64: dts: imx95-tqma9596sa-mb-smarc-2: Add MicIn routing arm64: dts: imx95-tqma9596sa: add EEPROM pagesize arm64: dts: imx95-tqma9596sa: whitespace fixes arm64: dts: imx95-tqma9596sa: add gpio bus recovery for i2c arm64: dts: imx95-tqma9596sa: remove superfluous pinmux for usdhci arm64: dts: imx95-tqma9596sa: remove superfluous pinmux for i2c ... Signed-off-by: Arnd Bergmann commit e5060380e0633d20db961996d4270c4a45b7306f Merge: e828dff381a430 6f813b7814d305 Author: Arnd Bergmann Date: Fri Nov 21 17:04:25 2025 +0100 Merge tag 'imx-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX ARM device tree changes for 6.19: - A bunch of dt-schema warning cleanup patches from Frank Li - A couple of imx6dl-yapp4 board update from Michal Vokáč to enable pwm-beeper and model the RGB LED as a single multi-led part - Enable PMIC RTC on imx53-qsrb board - Correct rtc compatible for imx6q-evi board - Add sy7636 support for e70k02 board - Replace license text comment with SPDX identifier for imx53-usbarmory board - Add I2S audio support for imx28-amarula-rmm board * tag 'imx-dt-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (29 commits) ARM: dts: imx6qdl: make VAR-SOM SoM SoC-agnostic ARM: dts: imx6dl-yapp4: Model the RGB LED as a single multi-led part ARM: dts: imx6dl-yapp43: Enable pwm-beeper on boards with speaker ARM: dts: imx: e70k02: add sy7636 ARM: dts: imx28-amarula-rmm: add I2S audio ARM: dts: imx: add vdd-supply and vddio-supply for fsl,mpl3115 ARM: dts: imx7ulp: remove bias-pull-up ARM: dts: remove undocumented clock-names for ov5642 ARM: dts: add device_type for memory node ARM: dts: Add bus type for parallel ov5640 ARM: dts: imx6q-cm-fx6.dts: add supplies for wm8731 ARM: dts: imx6qdl-skov-cpu fix typo interrupt ARM: dts: imx: remove redundant linux,phandle ARM: dts: imx6ull-dhcom-pdk2: rename power-supply to vcc-supply for touchscreen ARM: dts: imx: add power-supply for lcd panel ARM: dts: imx6qdl-nitrogen6_max: rename i2cmux to i2c ARM: dts: imx6ull-phytec-tauri: remove extra space before jedec,spi-nor ARM: dts: imx6q-utilite-pro: add missing required property for pci ARM: dts: imx6-tbs2910: rename ir_recv to ir-receiver ARM: dts: imx6: remove pinctrl-name if pinctrl-0 doesn't exist ... Signed-off-by: Arnd Bergmann commit e828dff381a430ff579870087f508cd68e694230 Merge: 252f83d5474cc9 ae0d3f1e6dd2c6 Author: Arnd Bergmann Date: Fri Nov 21 16:58:34 2025 +0100 Merge tag 'sunxi-dt-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 6.19 The A523 family gains support for I2S and SPDIF audio interfaces, as well as the GMAC200 Ethernet controller. The H616 gains support for the NAND controller. * tag 'sunxi-dt-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: a523: Add SPDIF TX pin on PB and PI pins arm64: dts: allwinner: a523: Add I2S2 pins on PI pin group arm64: dts: allwinner: a523: Add device nodes for I2S controllers arm64: dts: allwinner: a523: Add device node for SPDIF block arm64: dts: allwinner: a523: Add DMA controller device nodes dt-bindings: dma: allwinner,sun50i-a64-dma: Add compatibles for A523 arm64: dts: allwinner: h616: add NAND controller arm64: dts: allwinner: t527: orangepi-4a: Enable Ethernet port arm64: dts: allwinner: t527: avaota-a1: enable second Ethernet port arm64: dts: allwinner: a527: cubie-a5e: Enable second Ethernet port arm64: dts: allwinner: a523: Add GMAC200 ethernet controller Signed-off-by: Arnd Bergmann commit 252f83d5474cc911cb8523da8fd83ddc9393949e Merge: 17aaeb67e115d9 0936fa80150ef9 Author: Arnd Bergmann Date: Fri Nov 21 16:54:51 2025 +0100 Merge tag 'tegra-for-6.19-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v6.19-rc1 This contains a bunch of additions and improvements for older devices. Tegra210 devices now have empty reserved-memory nodes to improve inter- operability with certain bootloaders. These chips now also support more multimedia engines. A new variant of the Jetson Nano is also added. Jetson TX2 sees some improvements. PCI endpoint mode is improved for Tegra234 so that reset interrupts are properly routed. A new RTC device is added starting with Orin. Rounding things off is a flurry of small fixes for DT validation and USB OTG mode. * tag 'tegra-for-6.19-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (25 commits) arm64: tegra: Remove OTG ID GPIO from Jetson TX2 NX arm64: tegra: Set USB Micro-B port to OTG mode on P3450 arm64: tegra: Add NVJPG node for Tegra210 platforms arm64: tegra: Add Tegra210 NVJPG power-domain node arm64: tegra: Add interrupts for Tegra234 USB wake events arm64: tegra: Add reserved-memory node for P2180 arm64: tegra: Add reserved-memory node for P3450 arm64: tegra: Enable NVDEC and NVENC on Tegra210 arm64: tegra: Fix APB DMA controller node name arm64: tegra: Add default GIC address cells on Tegra210 arm64: tegra: Add default GIC address cells on Tegra194 arm64: tegra: Add default GIC address cells on Tegra186 arm64: tegra: Add default GIC address cells on Tegra132 arm64: tegra: Add OPP tables on Tegra210 arm64: tegra: Add interconnect properties for Tegra210 arm64: tegra: Add ACTMON on Tegra210 arm64: tegra: Add device-tree node for NVVRS RTC arm64: tegra: Move avdd-dsi-csi-supply into CSI node arm64: tegra: Drop redundant clock and reset names from TSEC node arm64: tegra: Move HDA into the correct bus ... Signed-off-by: Arnd Bergmann commit 17aaeb67e115d99f1046a45d7a68170820b97dec Merge: 5d5b665e3e1226 f224e936dad093 Author: Arnd Bergmann Date: Fri Nov 21 16:50:42 2025 +0100 Merge tag 'tegra-for-6.19-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt ARM: tegra: Device tree changes for v6.19-rc1 Add more host1x devices on Tegra114 and Tegra124, as well as CSI for Tegra20 and Tegra30. Support for the Xiaomi Mi Pad is also added. * tag 'tegra-for-6.19-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: Add device-tree for Xiaomi Mi Pad (A0101) ARM: tegra: add CSI nodes for Tegra20 and Tegra30 ARM: tegra: Add missing HOST1X device nodes on Tegra124 ARM: tegra: Add missing HOST1X device nodes on Tegra114 Signed-off-by: Arnd Bergmann commit 96710819d0ce6d1e42be751f6bbed18b6e9ea6d1 Author: Gui-Dong Han Date: Thu Nov 20 12:13:31 2025 +0800 hwmon: (vt1211) Convert macros to functions to avoid TOCTOU The macros IN_FROM_REG, TEMP_FROM_REG, and RPM_FROM_REG evaluate their arguments multiple times. These macros are used in lockless show functions involving shared driver data, leading to Time-of-Check to Time-of-Use race conditions. For example, RPM_FROM_REG checks if a value is 0 or 255, and then uses it in a division. If the value is modified by another thread to 0 after the check but before the division, it causes a divide-by-zero error. Convert these macros to static functions. This guarantees that arguments are evaluated only once (pass-by-value), fixing the race conditions. Adhere to the principle of minimal changes by only converting the specific macros involved in these lockless contexts. Link: https://lore.kernel.org/all/CALbr=LYJ_ehtp53HXEVkSpYoub+XYSTU8Rg=o1xxMJ8=5z8B-g@mail.gmail.com/ Signed-off-by: Gui-Dong Han Link: https://lore.kernel.org/r/20251120041331.1917570-1-hanguidong02@gmail.com Signed-off-by: Guenter Roeck commit 5d5b665e3e12263c52e0e577c01db4ca7a6ad738 Merge: 9481f1ce9b8f3d 905f0dcc38f807 Author: Arnd Bergmann Date: Fri Nov 21 16:49:08 2025 +0100 Merge tag 'tegra-for-6.19-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Changes for v6.19-rc1 Document various new IPs on older chips, as well as some existing developer kits that were missing compatible strings. Add power domain IDs on Tegra264 and wake-up support for the XUSB controller on Tegra234. * tag 'tegra-for-6.19-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: usb: Add wake-up support for Tegra234 XUSB host controller dt-bindings: devfreq: tegra30-actmon: Add Tegra124 fallback for Tegra210 dt-bindings: display: tegra: Document Tegra20 and Tegra30 CSI dt-bindings: display: tegra: document EPP, ISP, MPE and TSEC for Tegra114+ dt-bindings: arm: tegra: Document Jetson Nano Devkits dt-bindings: power: Add power domain IDs for Tegra264 Signed-off-by: Arnd Bergmann commit 9481f1ce9b8f3dc82a146954b4a50b0ea13a3afe Merge: 441bd1568064a5 b272b94fd22397 Author: Arnd Bergmann Date: Fri Nov 21 16:46:09 2025 +0100 Merge tag 'renesas-dts-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.19 (take two) - Add Imagination Technologies PowerVR Series 7XE GE7800 GPU support for the R-Car M3-N and V3U SoCs, - Add Ethernet support for the RZ/T2H and RZ/N2H SoCs and their evaluation boards, - Add ADC support for the RZ/N1D SoC, - Add thermal, NMI pushbutton, and RTC support for the RZ/V2H SoC and the RZ/V2H EVK development board, - Add USB2.0 support for the RZ/G3S SoC and the RZ/G3S SMARC Carrier II board. * tag 'renesas-dts-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: rzt2h-n2h-evk: Enable Ethernet support arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable RTC arm64: dts: renesas: r9a09g057: Add RTC node arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add NMI pushbutton support arm64: dts: renesas: rzg3s-smarc: Enable USB support arm64: dts: renesas: r9a08g045: Add USB support arm64: dts: renesas: r9a09g057: Add TSU nodes ARM: dts: renesas: r9a06g032: Add the ADC device arm64: dts: renesas: r9a09g087: Add GMAC nodes arm64: dts: renesas: r9a09g077: Add GMAC nodes arm64: dts: renesas: r9a09g087: Add ETHSS node arm64: dts: renesas: r9a09g077: Add ETHSS node arm64: dts: renesas: r8a779a0: Add GE7800 GPU node arm64: dts: renesas: r8a77965: Add GE7800 GPU node dt-bindings: clock: r8a779a0: Add ZG core clock Signed-off-by: Arnd Bergmann commit 441bd1568064a5f5614661439b2ce2a0a0934952 Merge: 3350e81c628681 5a97a38c22799a Author: Arnd Bergmann Date: Fri Nov 21 16:41:52 2025 +0100 Merge tag 'spacemit-dt-for-6.19-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 6.19 - Add Uart and I2C nodes - Add P1 PMIC nodes - Add MusePi Pro board support - Add OrangePi R2S board support - Enable eeprom for BPI-F3 - Enable QSPI on BPI-F3 - Enable Ethernet and PDMA on OrangePi RV2 * tag 'spacemit-dt-for-6.19-1' of https://github.com/spacemit-com/linux: riscv: dts: spacemit: define all missing I2C controller nodes riscv: dts: spacemit: reorder i2c2 node riscv: dts: spacemit: Add OrangePi R2S board device tree dt-bindings: riscv: spacemit: Add OrangePi R2S board riscv: dts: spacemit: enable K1 SoC QSPI on BPI-F3 riscv: dts: spacemit: add MusePi Pro board device tree dt-bindings: riscv: spacemit: add MusePi Pro board riscv: dts: spacemit: add Ethernet and PDMA to OrangePi RV2 riscv: dts: spacemit: add i2c aliases on BPI-F3 riscv: dts: spacemit: add 24c02 eeprom on BPI-F3 riscv: dts: spacemit: enable the i2c2 adapter on BPI-F3 riscv: dts: spacemit: define regulator constraints riscv: dts: spacemit: define fixed regulators riscv: dts: spacemit: enable the i2c8 adapter riscv: dts: spacemit: add UART pinctrl combinations Signed-off-by: Arnd Bergmann commit 3350e81c62868108f68273b880f00177cc01499f Merge: c4aee1ad4125c9 9b2d2beaefcfa1 Author: Arnd Bergmann Date: Fri Nov 21 16:39:35 2025 +0100 Merge tag 'mtk-dts64-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek ARM64 Device Tree updates This adds support for new boards and variants based on different already supported MediaTek SoCs, and improves support for current boards. In particular: - New machines: - MT7988 BananaPi R4 Pro eMMC and SD router board with support for both Key-M and Key-E M.2 slots through DTB Overlays - MT8370 Grinn GenioSBC-510 (GenioSOM-510 + GenioBoard Edge AI) - MT8390 Grinn GenioSBC-700 (GenioSOM-700 + GenioBoard Edge AI) - New variant: MT8395 MediaTek Genio 1200 EVK with UFS ...preparation for new SoCs (MT8196 Kompanio Ultra, a clone of the MT6991 Dimensity 9400, and MT6878 Dimensity 7300) with the addition of GCE/PIO definitions ...improvements for already supported SoCs and machines: - MT7622/7981b/7986a/7988a gain support for reading SoC UUID from eFuse, used to generate a persistent MAC address on boards that don't have any factory-assigned addresses. - MT7986 BananaPi R3 gets changes to its default fan PWM speed to improve compatibility with cheaper fans (usually coming with the heatsink+fan combos) - The MT7981b OpenWRT One router sees general support improvements with the enablement of its UART-0 console and correct pinmuxing for the same, addition of reserved memory for Trusted Firmware A, its SPI NOR Flash (for recovery system, WiFi eeprom data and ETH MAC address from factory), and board LEDs. - MT8365 gets support for its Mali G52 MC1 GPU, which gets enabled in the MediaTek Genio 350 EVK board ...and a dt-bindings warning fix for MT8183 machines through trivial changes to rename the audiosys and afe nodes to reflect bindings. * tag 'mtk-dts64-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: (27 commits) arm64: dts: mediatek: mt7981b-openwrt-one: Enable software leds arm64: dts: mediatek: mt7981b-openwrt-one: Enable SPI NOR arm64: dts: mediatek: mt7988a-bpi-r4pro: Add mmc overlays arm64: dts: mediatek: mt7988a-bpi-r4-pro: Add PCIe overlays arm64: dts: mediatek: mt7988: Add devicetree for BananaPi R4 Pro arm64: dts: mediatek: mt7988: Disable 2.5G phy and enable at board layer dt-bindings: arm: mediatek: add BPI-R4 Pro board arm64: dts: mediatek: Add GCE header for MT8196 arm64: dts: mediatek: mt7981b: Add reserved memory for TF-A arm64: dts: mediatek: mt7981b: Configure UART0 pinmux arm64: dts: mediatek: mt8365-evk: Enable GPU support arm64: dts: mediatek: mt8365: Add GPU support arm64: dts: mediatek: mt8395-genio-1200-evk: Describe CPU supplies arm64: dts: mediatek: Add MT6878 pinmux macro header file arm64: dts: mediatek: mt7986-bpi-r3: Change fan PWM value for mid speed arm64: dts: mediatek: mt8370-grinn-genio-510-sbc: Add Grinn GenioSBC-510 arm64: dts: mediatek: mt8390-genio-700-evk: Add Grinn GenioSBC-700 arm64: dts: mediatek: mt7988a: add 'soc-uuid' cell to efuse arm64: dts: mediatek: mt7981b: add 'soc-uuid' cell to efuse arm64: dts: mediatek: mt7986a: add 'soc-uuid' cell to efuse ... Signed-off-by: Arnd Bergmann commit c4aee1ad4125c91f6626c2774e961ad3010503da Merge: ab07edaab69e5c 5416aeee4ef761 Author: Arnd Bergmann Date: Fri Nov 21 16:38:23 2025 +0100 Merge tag 'mtk-dts32-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek ARM32 Device Tree updates This performs a cleanup of the MT6582 devicetrees and adds support for secondary cores bringup on this SoC. This also introduces basic support for a new machine, the MT6582 Alcatel "yarisxl" Pop C7 (OT-7041D) smartphone, with support for booting into a initramfs with UART console output. * tag 'mtk-dts32-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: ARM: dts: mediatek: drop wrong syscon hifsys compatible for MT2701/7623 ARM: dts: mediatek: add basic support for Alcatel yarisxl board dt-bindings: arm: mediatek: Add MT6582 yarisxl ARM: dts: mediatek: mt6582: add enable-method property to cpus ARM: dts: mediatek: mt6582: add clock-names property to uart nodes ARM: dts: mediatek: mt6582: add mt6582 compatible to timer ARM: dts: mediatek: mt6582: remove compatible property from root node ARM: dts: mediatek: mt6582: sort nodes and properties ARM: dts: mediatek: mt6582: move MMIO devices under soc node Signed-off-by: Arnd Bergmann commit ab07edaab69e5c6cac078afbdd498225e81c39bc Merge: 7e90eede6b9279 cad767a9af055c Author: Arnd Bergmann Date: Fri Nov 21 16:36:49 2025 +0100 Merge tag 'samsung-dt64-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.19 1. ExynosAutov920: - Add more clock controller nodes. 2. Google GS101: - PMIC clock - Mark ACPM (Alive Clock and Power Manager) firmware node as clock provider and use its clocks. Add also Devicetree binding headers with clock its clock indices used in DTS (kept as separate branch). - Add more SYSREG (syscon) regions. - Correct several blocks address space sizes and APM SYSREG's starting address. 3. Exynos7870: - Enable display over DSI and several display planels. - Few cleanups. * tag 'samsung-dt64-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos7870-j6lte: enable display panel support arm64: dts: exynos7870-a2corelte: enable display panel support arm64: dts: exynos7870-on7xelte: enable display panel support arm64: dts: exynos7870: add DSI support arm64: dts: exynos: gs101: fix sysreg_apm reg property arm64: dts: exynos: gs101: fix clock module unit reg sizes arm64: dts: exynos: gs101: add sysreg_misc and sysreg_hsi0 nodes arm64: dts: exynos: gs101: add OPPs arm64: dts: exynos: gs101: add CPU clocks arm64: dts: exynos: gs101: add #clock-cells to the ACPM protocol node dt-bindings: firmware: google,gs101-acpm-ipc: add ACPM clocks arm64: dts: exynos: gs101-pixel-common: add node for s2mpg10 / clock arm64: dts: exynos990: Add sysreg nodes for PERIC0 and PERIC1 arm64: dts: exynosautov920: add CMU_MFC clock DT nodes arm64: dts: exynosautov920: add CMU_M2M clock DT nodes arm64: dts: exynos7870-on7xelte: add bus-width to mmc0 node arm64: dts: exynos7870-j6lte: add bus-width to mmc0 node arm64: dts: exynos7870-a2corelte: add bus-width to mmc0 node Signed-off-by: Arnd Bergmann commit 2643187ccb8628144246ee9d44da5e3ac428f9c3 Author: Antheas Kapenekakis Date: Wed Nov 19 18:45:05 2025 +0100 platform/x86: ayaneo-ec: Add suspend hook The Ayaneo EC resets after hibernation, losing the charge control state. Add a small PM hook to restore this state on hibernation resume. The fan speed is also lost during hibernation, but since hibernation failures are common with this class of devices, setting a low fan speed when the userspace program controlling the fan will potentially not take over could cause the device to overheat, so it is not restored. Reviewed-by: Armin Wolf Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251119174505.597218-7-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 02c15e3ddcc5a50fbdf1e586d94f0372f5b40ed5 Author: Antheas Kapenekakis Date: Wed Nov 19 18:45:04 2025 +0100 platform/x86: ayaneo-ec: Move Ayaneo devices from oxpec to ayaneo-ec Currently, the oxpec driver contains Ayaneo devices. Move them to the new ayaneo-ec driver, which is dedicated to them. As this driver supports charge inhibition for Ayaneo, add support for it for the AIR, AIR 1S, AB05-Medoncino, AIR Pro, and Kun, referenced from the out-of-tree ayaneo-platform driver. In addition, update the readmes of oxpec to reflect this change. Link: https://github.com/ShadowBlip/ayaneo-platform Tested-by: Derek J. Clark Reviewed-by: Armin Wolf Reviewed-by: Ilpo Järvinen Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251119174505.597218-6-lkml@antheas.dev Signed-off-by: Ilpo Järvinen commit e921a8b4dea50b9c20f1ee9b2b69cedc00b7570a Author: Antheas Kapenekakis Date: Wed Nov 19 18:45:03 2025 +0100 platform/x86: ayaneo-ec: Add controller power and modules attributes The Ayaneo 3 features hot-swappable controller modules. The ejection and management is done through HID. However, after ejecting the modules, the controller needs to be power cycled via the EC to re-initialize. For this, the EC provides a variable that holds whether the left or right modules are connected, and a power control register to turn the controller on or off. After ejecting the modules, the controller should be turned off. Then, after both modules are reinserted, the controller may be powered on again to re-initialize. This patch introduces two new sysfs attributes: - `controller_modules`: a read-only attribute that indicates whether the left and right modules are connected (none, left, right, both). - `controller_power`: a read-write attribute that allows the user to turn the controller on or off (with '1'/'0'). Therefore, after ejection is complete, userspace can power off the controller, then wait until both modules have been reinserted (`controller_modules` will return 'both') to turn on the controller. Reviewed-by: Armin Wolf Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251119174505.597218-5-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6d710ec3584227a9c393c478b1cd4a70e74a3c88 Author: Antheas Kapenekakis Date: Wed Nov 19 18:45:02 2025 +0100 platform/x86: ayaneo-ec: Add charge control support Ayaneo devices support charge inhibition via the EC. This inhibition only works while the device is powered on, and resets between restarts. However, it is maintained across suspend/resume cycles. The EC does not support charge threshold control. Instead, userspace software on Windows manually toggles charge inhibition depending on battery level. Reviewed-by: Armin Wolf Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251119174505.597218-4-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 536522f0355cffe8478502ffbb041769e2f61bfe Author: Antheas Kapenekakis Date: Wed Nov 19 18:45:01 2025 +0100 platform/x86: ayaneo-ec: Add hwmon support Add hwmon single fan sensor reads and control for Ayaneo devices. The register and method of access is the same for all devices. Reviewed-by: Armin-Wolf Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251119174505.597218-3-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 70a4a815d9b74f17abd1ae46c6cb93b736e02d91 Author: Antheas Kapenekakis Date: Wed Nov 19 18:45:00 2025 +0100 platform/x86: ayaneo-ec: Add Ayaneo Embedded Controller platform driver Recent Ayaneo devices feature an ACPI mapped Embedded Controller (EC) with standard addresses across models that provides access to fan speed, fan control, battery charge limits, and controller power controls. Introduce a new driver stub that will handle these driver features. Reviewed-by: Armin Wolf Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20251119174505.597218-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7e90eede6b92796ba94fd1eed5fbc79bf817c5b3 Merge: 156c42c7fce922 d8a174babf6493 Author: Arnd Bergmann Date: Fri Nov 21 16:35:57 2025 +0100 Merge tag 'thead-dt-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt T-HEAD Devicetrees for v6.19 Add PWM controlled fan and it's associated thermal management for the Lichee Pi 4A board. Enable additional ISA extenstions supported by the T-Head C910 cores: Zfh, Ziccrse, XTheadvector. Add reset controllers of more TH1520 subsystems: AP, AO, DSP, MISC, VI. Signed-off-by: Drew Fustini * tag 'thead-dt-for-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: riscv: dts: thead: Add reset controllers of more subsystems for TH1520 riscv: dts: thead: Add PWM fan and thermal control riscv: dts: thead: Add PWM controller node riscv: dts: thead: add zfh for th1520 riscv: dts: thead: add ziccrse for th1520 riscv: dts: thead: add xtheadvector to the th1520 devicetree Signed-off-by: Arnd Bergmann commit 72eb5b1f5d7c0ab76e4db1b2d4eb8a880dbdbfad Merge: e6dc6eab80e6b5 527250cd909246 Author: Bartosz Golaszewski Date: Fri Nov 21 16:33:03 2025 +0100 Merge tag 'reset-gpio-for-v6.19-2' of https://git.pengutronix.de/git/pza/linux into gpio/for-next Reset/GPIO/swnode changes for v6.19 (v2) * Fix chtwc_int33fe build issue since commit d7cdbbc93c56 ("software node: allow referencing firmware nodes"). commit 156c42c7fce9224750cd5a827a8e6482366af193 Merge: 7ab4745858cfdd 9d22a34a016313 Author: Arnd Bergmann Date: Fri Nov 21 16:30:47 2025 +0100 Merge tag 'renesas-dts-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.19 - Add thermal support for the RZ/G3S and RZ/G3E SoCs, - Add DT overlay support for the Raspberry Pi Display 2 and Argon40 fan hats on the Retronix Sparrow Hawk board, - Add eMMC support for the Eagle Function expansion board, - Add initial support for the R-Car X5H (R8A78000) SoC and the Ironhide development board, - Move interrupt-parent properties to root nodes, - Add system watchdog timer support for R-Car Gen3 and Gen4 SoCs, which is reserved for secure firmware on R-Car Gen3 boards, - Add ADC support for the RZ/T2H and RZ/N2H SoCs and their evaluation boards, - Add watchdog timer support on the R-Car V3M Starter Kit board, - Add Cortex-A55 PMU support on the RZ/V2H, RZ/V2N, RZ/T2H, and RZ/N2H SoCs, - Add Imagination Technologies PowerVR Series 6XT GX6250 GPU support on the R-Car M3-W and M3-W+ SoCs, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (80 commits) arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels arm64: dts: renesas: r8a77961: Add GX6250 GPU node arm64: dts: renesas: r8a77960: Add GX6250 GPU node ARM: dts: renesas: kzm9g: Name interrupts for accelerometer arm64: dts: renesas: r9a09g087: Add Cortex-A55 PMU node arm64: dts: renesas: r9a09g077: Add Cortex-A55 PMU node arm64: dts: renesas: r9a09g056: Add Cortex-A55 PMU node arm64: dts: renesas: r9a09g057: Add Cortex-A55 PMU node ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties arm64: dts: renesas: v3msk: Enable watchdog timer arm64: dts: renesas: r8a779h0: Add SWDT node arm64: dts: renesas: r8a779g0: Add SWDT node arm64: dts: renesas: r8a779f0: Add SWDT node arm64: dts: renesas: r8a779a0: Add SWDT node arm64: dts: renesas: rzt2h/rzn2h-evk: Enable ADCs arm64: dts: renesas: r9a09g087: Add ADCs support arm64: dts: renesas: r9a09g077: Add ADCs support ARM: dts: renesas: koelsch: Update ADV7180 binding ARM: dts: renesas: r9a06g032: Move interrupt-parent to root node ARM: dts: renesas: r8a7794: Move interrupt-parent to root node ... Signed-off-by: Arnd Bergmann commit a9b0869720e1734e600563b62cd5e28d11e45622 Author: Denis Benato Date: Thu Nov 20 03:54:13 2025 +0100 platform/x86: asus-armoury: add support for FA507UV Add TDP data for laptop mode FA507UV. Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251120025413.1686540-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7ab4745858cfdd678c38d64f89def33348ecfd1b Merge: 6ef9a6fca74fb7 6953afcd81a2cc Author: Arnd Bergmann Date: Fri Nov 21 16:28:42 2025 +0100 Merge tag 'aspeed-6.19-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt First batch of ASPEED Arm devicetree changes for 6.19 Significant changes: - The IBM Power11 FSI DTSIs have been rearranged to accommodate new systems New platforms: - IBM Balcones The Balcones system is similar to Bonnell but with a POWER11 processor. Like POWER10, the POWER11 is a dual-chip module, so a dual chip FSI tree is needed. - Meta Yosemite5 The Yosemite5 platform provides monitoring of voltages, power, temperatures, and other critical parameters across the motherboard, CXL board, E1.S expansion board, and NIC components. Updated platforms: - clemente (Meta): LEDs, shunt resistor configuration - santabarbara (Meta): AMD APML, EEPROMs, LEDs, GPIO line names, MCTP for NICs There are a scattering of one-off changes and devicetree cleanups for other platforms as well. * tag 'aspeed-6.19-devicetree-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: ARM: dts: aspeed: santabarbara: Add eeprom device node for PRoT module ARM: dts: aspeed: santabarbara: Add AMD APML interface support ARM: dts: aspeed: santabarbara: Add gpio line name ARM: dts: aspeed: santabarbara: Add bmc_ready_noled Led ARM: dts: aspeed: santabarbara: Enable MCTP for frontend NIC ARM: dts: aspeed: santabarbara: Add sensor support for extension boards ARM: dts: aspeed: santabarbara: Add blank lines between nodes for readability ARM: dts: aspeed: yosemite5: Add Meta Yosemite5 BMC dt-bindings: arm: aspeed: add Meta Yosemite5 board ARM: dts: aspeed: clemente: Add HDD LED GPIO ARM: dts: aspeed: Fix max31785 fan properties ARM: dts: aspeed: Add Balcones system dt-bindings: arm: aspeed: add IBM Bonnell board dt-bindings: arm: aspeed: add IBM Balcones board ARM: dts: aspeed: harma: Add MCTP I2C controller node ARM: dts: aspeed: yosemite4: allocate ramoops for kernel panic ARM: dts: aspeed: clemente: add shunt-resistor-micro-ohms for LM5066i Signed-off-by: Arnd Bergmann commit 6b87f7ea741794d26d22ac40242ea5e1c57da7c9 Author: Denis Benato Date: Thu Nov 20 03:40:59 2025 +0100 platform/x86: asus-armoury: fix mini-led mode show Perform the actual check of the mini-led mode against supported modes and do not return the first one regardless of the WMI devstate. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aR1xbxEQyQPEvB9o@stanley.mountain/ Signed-off-by: Denis Benato Link: https://patch.msgid.link/20251120024059.1341326-1-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6ef9a6fca74fb7614255e93c53e16f71f927788d Merge: dcb6fa37fd7bc9 0e53b0bcad0010 Author: Arnd Bergmann Date: Fri Nov 21 16:26:17 2025 +0100 Merge tag 'pxa1908-dt-for-6.19' of https://gitlab.com/pxa1908-mainline/linux into soc/dt PXA1908 DT changes for 6.19 Rollup of hardware support which has accumulated since support for the SoC and coreprimevelte board was merged. This most notably includes eMMC, PMIC, backlight and touchscreen. A few QoL fixes are also included. * tag 'pxa1908-dt-for-6.19' of https://gitlab.com/pxa1908-mainline/linux: arm64: dts: marvell: pxa1908: Add power domains arm64: dts: marvell: samsung,coreprimevelte: Add USB connector arm64: dts: marvell: samsung,coreprimevelte: Fill in memory node arm64: dts: marvell: samsung,coreprimevelte: Drop some reserved memory arm64: dts: marvell: pxa1908: Move ramoops to SoC dtsi arm64: dts: marvell: samsung,coreprimevelte: Add vibrator arm64: dts: marvell: pxa1908: Add PWMs arm64: dts: marvell: samsung,coreprimevelte: Enable eMMC arm64: dts: marvell: samsung,coreprimevelte: Correct CD GPIO arm64: dts: marvell: samsung,coreprimevelte: Add backlight arm64: dts: samsung,coreprimevelte: add SDIO arm64: dts: samsung,coreprimevelte: add touchscreen arm64: dts: samsung,coreprimevelte: add PMIC Signed-off-by: Arnd Bergmann commit 0a69fe8f097f7410dc232259129d334518d4e8dc Author: Dan Carpenter Date: Fri Nov 21 16:33:56 2025 +0300 platform/x86: asus-armoury: Fix error code in mini_led_mode_current_value_store() There are two return statements in a row here. The first one is wrong so delete that one. This changes the return value to -ENODEV. Fixes: f99eb098090e ("platform/x86: asus-armoury: move existing tunings to asus-armoury module") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSBqRHs256Tz7EKr@stanley.mountain Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2bab99283d537a46e71d9e0c324d9ef27d17c88a Merge: dcb6fa37fd7bc9 a71e6e8eea8ae2 Author: Arnd Bergmann Date: Fri Nov 21 16:22:33 2025 +0100 Merge tag 'tenstorrent-dt-for-v6.19' of https://github.com/tenstorrent/linux into soc/newsoc Tenstorrent device tree for v6.19 Add Tenstorrent as a vendor and enable support for the Blackhole SoC in Blackhole P100 and P150 PCIe cards. The SoC contains four RISC-V CPU tiles consisting of 4x SiFive X280 cores. There is a virtual UART implemented in OpenSBI firmware that allows a console program on the PCIe host to communicate through shared memory with Linux running on the Blackhole card. Link: https://github.com/tenstorrent/tt-bh-linux Link: https://github.com/tenstorrent/opensbi/ Signed-off-by: Drew Fustini * tag 'tenstorrent-dt-for-v6.19' of https://github.com/tenstorrent/linux: riscv: defconfig: Enable Tenstorrent SoCs riscv: Kconfig.socs: Add ARCH_TENSTORRENT for Tenstorrent SoCs riscv: dts: Add Tenstorrent Blackhole SoC PCIe cards dt-bindings: interrupt-controller: Add Tenstorrent Blackhole compatible dt-bindings: timers: Add Tenstorrent Blackhole compatible dt-bindings: riscv: cpus: Add SiFive X280 compatible dt-bindings: riscv: Add Tenstorrent Blackhole compatible dt-bindings: vendor-prefixes: Add Tenstorrent AI ULC commit 7ec374c6b8597dd23d8c2de1e4045452348cf9cd Author: Shyam Sundar S K Date: Thu Nov 20 16:22:10 2025 +0530 platform/x86/amd/pmf: Replace magic table id with METRICS_TABLE_ID Add METRICS_TABLE_ID (7) and use it when requesting the metrics transfer table instead of the hard-coded literal. This clarifies the meaning of the argument to amd_pmf_send_cmd() and centralizes the table ID definition for easier maintenance. Reviewed-by: Mario Limonciello Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251120105210.3945710-4-Shyam-sundar.S-k@amd.com Signed-off-by: Ilpo Järvinen commit 83f0442a4012179c204d68c7f619755693ac5c2f Author: Shyam Sundar S K Date: Thu Nov 20 16:22:09 2025 +0530 platform/x86/amd/pmf: Use explicit SET_CMD/GET_CMD flags in amd_pmf_send_cmd() Add SET_CMD and GET_CMD constants and replace boolean values passed as the get/set argument to amd_pmf_send_cmd() with the new explicit flags. This improves readability, avoids ambiguity around true/false and 0/1 usage. There is no functional change. Reviewed-by: Mario Limonciello Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Link: https://patch.msgid.link/20251120105210.3945710-3-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bc3c0a3231b78589896f283d971a003761b100e5 Author: Shyam Sundar S K Date: Thu Nov 20 16:22:08 2025 +0530 platform/x86/amd/pmf: Rename IPU metrics fields to NPU for consistency Update smu_pmf_metrics_v2 to use NPU terminology instead of IPU. This aligns the driver with current firmware/hardware naming and fixes the mismatch. There is no functional change and no impact to the struct layout and only field names are updated. Reviewed-by: Mario Limonciello Signed-off-by: Shyam Sundar S K Reviewed-by: Ilpo Järvinen Reviewed-by: Link: https://patch.msgid.link/20251120105210.3945710-2-Shyam-sundar.S-k@amd.com Signed-off-by: Ilpo Järvinen commit 715cbb21c6fe2fe5760ea05e873f12473aa5884e Author: Nishanth Menon Date: Wed Oct 29 10:06:36 2025 -0500 drm/bridge: it66121: Add minimal it66122 support The IT66122 is a pin compatible replacement for the IT66122. Based on empirical testing, the new device looks to be compatible with IT66121. However due to a lack of public data sheet at this time beyond overall feature list[1] (which seems to add additional features vs ITT66121), it is hard to determine that additional register operations required to enable additional features. So, introduce the device as a new compatible that we will detect based on vid/pid match, with explicit id that can be used to extend the driver capability as information becomes available later on. [1] https://www.ite.com.tw/en/product/cate1/IT66122 Signed-off-by: Nishanth Menon Reviewed-by: Andrew Davis Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251029150636.3118628-6-nm@ti.com commit a8811c0bb79c60bf2464e939c8e040b5d6f532ef Author: Nishanth Menon Date: Wed Oct 29 10:06:35 2025 -0500 drm/bridge: it66121: Use vid/pid to detect the type of chip The driver knows exactly which version of the chip is present since the vid/pid is used to enforce a compatibility. Given that some devices like IT66121 has potentially been replaced with IT66122 mid production for many platforms, it makes no sense to use the vid/pid as an enforcement for compatibility. Instead, detect the ID of the actual chip in use by matching the corresponding vid/pid and drop the compatible specific lookup table. Signed-off-by: Nishanth Menon Reviewed-by: Andrew Davis Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251029150636.3118628-5-nm@ti.com commit a1df28b5f4d30467b8dabe861f1da324e00313fd Author: Nishanth Menon Date: Wed Oct 29 10:06:34 2025 -0500 drm/bridge: it66121: Sort the compatibles Keep the compatibles sorted alpha-numerically. Signed-off-by: Nishanth Menon Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251029150636.3118628-4-nm@ti.com commit 1ba36afa667bf14820a9862e18b5d55ee47a67e4 Author: Nishanth Menon Date: Wed Oct 29 10:06:33 2025 -0500 drm/bridge: it66121: Drop ftrace like dev_dbg() prints Drop the ftrace like dev_dbg() that checkpatch --strict complains about: WARNING: Unnecessary ftrace-like logging - prefer using ftrace + dev_dbg(dev, "%s\n", __func__); WARNING: Unnecessary ftrace-like logging - prefer using ftrace + dev_dbg(dev, "%s\n", __func__); WARNING: Unnecessary ftrace-like logging - prefer using ftrace + dev_dbg(dev, "%s\n", __func__); Signed-off-by: Nishanth Menon Reviewed-by: Andrew Davis Reviewed-by: Dmitry Baryshkov Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251029150636.3118628-3-nm@ti.com commit e902d2c38a2797aa78c1e08fc1419490bb8c63dd Author: Nishanth Menon Date: Wed Oct 29 10:06:32 2025 -0500 dt-bindings: display: bridge: it66121: Add compatible string for IT66122 Add a new ite,it66122 compatible string to the IT66121 binding documentation, since the two chips are practically same except for id register difference. Signed-off-by: Nishanth Menon Acked-by: Krzysztof Kozlowski Reviewed-by: Andrew Davis Reviewed-by: Tomi Valkeinen Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251029150636.3118628-2-nm@ti.com commit 670500b41e543c5cb09eb9f7f0e4e26c5b5fdf7e Author: Dan Carpenter Date: Fri Nov 21 16:35:24 2025 +0300 regulator: pca9450: Fix error code in probe() Return "PTR_ERR(pca9450->sd_vsel_gpio)" instead of "ret". The "ret" variable is success at this point. Fixes: 3ce6f4f943dd ("regulator: pca9450: Fix control register for LDO5") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aSBqnPoBrsNB1Ale@stanley.mountain Signed-off-by: Mark Brown commit 527250cd9092461f1beac3e4180a4481bffa01b5 Author: Bartosz Golaszewski Date: Fri Nov 21 11:04:50 2025 +0100 platform/x86: intel: chtwc_int33fe: don't dereference swnode args Members of struct software_node_ref_args should not be dereferenced directly but set using the provided macros. Commit d7cdbbc93c56 ("software node: allow referencing firmware nodes") changed the name of the software node member and caused a build failure. Remove all direct dereferences of the ref struct as a fix. However, this driver also seems to abuse the software node interface by waiting for a node with an arbitrary name "intel-xhci-usb-sw" to appear in the system before setting up the reference for the I2C device, while the actual software node already exists in the intel-xhci-usb-role-switch module and should be used to set up a static reference. Add a FIXME for a future improvement. Fixes: d7cdbbc93c56 ("software node: allow referencing firmware nodes") Fixes: 53c24c2932e5 ("platform/x86: intel_cht_int33fe: use inline reference properties") Cc: stable@vger.kernel.org Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20251121111534.7cdbfe5c@canb.auug.org.au/ Signed-off-by: Bartosz Golaszewski Reviewed-by: Hans de Goede Acked-by: Ilpo Järvinen Signed-off-by: Philipp Zabel commit be5ee60ac554c6189cda963e886c4b97d2cb978c Author: Alexandre Chartre Date: Fri Nov 21 10:53:35 2025 +0100 objtool: Provide access to feature and flags of group alternatives Each alternative of a group alternative depends on a specific feature and flags. Provide access to the feature/flags for each alternative as an attribute (feature) in struct alt_group. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-26-alexandre.chartre@oracle.com commit 4aae0d3f77b1104e55847870d15c3749ca575fcf Author: Alexandre Chartre Date: Fri Nov 21 10:53:34 2025 +0100 objtool: Fix address references in alternatives When using the --disas option, alternatives are disassembled but address references in non-default alternatives can be incorrect. The problem is that alternatives are shown as if they were replacing the original code of the alternative. So if an alternative is referencing an address inside the alternative then the reference has to be adjusted to the location of the original code. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-25-alexandre.chartre@oracle.com commit 7e017720aae87dc2ca2471ac295e34e2b240e5f5 Author: Alexandre Chartre Date: Fri Nov 21 10:53:33 2025 +0100 objtool: Disassemble jump table alternatives When using the --disas option, also disassemble jump tables. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-24-alexandre.chartre@oracle.com commit 78df4590c568731cfa12de9ecb888b3b0c141db2 Author: Alexandre Chartre Date: Fri Nov 21 10:53:32 2025 +0100 objtool: Disassemble exception table alternatives When using the --disas option, also disassemble exception tables (EX_TABLE). Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-23-alexandre.chartre@oracle.com commit 15e7ad8667b9d1fd4b6bdf06472812416453b7b2 Author: Alexandre Chartre Date: Fri Nov 21 10:53:31 2025 +0100 objtool: Print addresses with alternative instructions All alternatives are disassemble side-by-side when using the --disas option. However the address of each instruction is not printed because instructions from different alternatives are not necessarily aligned. Change this behavior to print the address of each instruction. Spaces will appear between instructions from the same alternative when instructions from different alternatives do not have the same alignment. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-22-alexandre.chartre@oracle.com commit a4f1599672e7bf494d79928a38fd6aa873e2e50c Author: Alexandre Chartre Date: Fri Nov 21 10:53:30 2025 +0100 objtool: Disassemble group alternatives When using the --disas option, disassemble all group alternatives. Jump tables and exception tables (which are handled as alternatives) are not disassembled at the moment. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-21-alexandre.chartre@oracle.com commit 87343e664252198d2735c9719f711d3e922f3be5 Author: Alexandre Chartre Date: Fri Nov 21 10:53:29 2025 +0100 objtool: Print headers for alternatives When using the --disas option, objtool doesn't currently disassemble any alternative. Print an header for each alternative. This identifies places where alternatives are present but alternative code is still not disassembled at the moment. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-20-alexandre.chartre@oracle.com commit 7ad7a4a72050a74f8927719272075d07d2f7777f Author: Alexandre Chartre Date: Fri Nov 21 10:53:28 2025 +0100 objtool: Preserve alternatives order Preserve the order in which alternatives are defined. Currently objtool stores alternatives in a list in reverse order. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-19-alexandre.chartre@oracle.com commit 5f326c88973691232c0e56ced83c199d53d86766 Author: Alexandre Chartre Date: Fri Nov 21 10:53:27 2025 +0100 objtool: Add the --disas= action Add the --disas= actions to disassemble the specified functions. The function pattern can be a single function name (e.g. --disas foo to disassemble the function with the name "foo"), or a shell wildcard pattern (e.g. --disas foo* to disassemble all functions with a name starting with "foo"). Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-18-alexandre.chartre@oracle.com commit c3b7d044fc5ac99a31ce9420431b90e21ed55503 Author: Alexandre Chartre Date: Fri Nov 21 10:53:26 2025 +0100 objtool: Do not validate IBT for .return_sites and .call_sites The .return_sites and .call_sites sections reference text addresses, but not with the intent to indirect branch to them, so they don't need to be validated for IBT. This is useful when running objtool on object files which already have .return_sites or .call_sites sections, for example to re-run objtool after it has reported an error or a warning. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-17-alexandre.chartre@oracle.com commit 350c7ab8577a32c101a097f4c072220d9ce64f3b Author: Alexandre Chartre Date: Fri Nov 21 10:53:25 2025 +0100 objtool: Improve tracing of alternative instructions When tracing function validation, improve the reporting of alternative instruction by more clearly showing the different alternatives beginning and end. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-16-alexandre.chartre@oracle.com commit 9b580accac003767a461bf52d738ad1ab4e8ccfa Author: Alexandre Chartre Date: Fri Nov 21 10:53:24 2025 +0100 objtool: Add functions to better name alternatives Add the disas_alt_name() and disas_alt_type_name() to provide a name and a type name for an alternative. This will be used to better name alternatives when tracing their execution. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-15-alexandre.chartre@oracle.com commit d490aa21973fe66ec35ad825c19f88ac7f7abb27 Author: Alexandre Chartre Date: Fri Nov 21 10:53:23 2025 +0100 objtool: Identify the different types of alternatives Alternative code, including jump table and exception table, is represented with the same struct alternative structure. But there is no obvious way to identify whether the struct represents alternative instructions, a jump table or an exception table. So add a type to struct alternative to clearly identify the type of alternative. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-14-alexandre.chartre@oracle.com commit 26a453fb5637907a538d6ea5ef23651142811e15 Author: Alexandre Chartre Date: Fri Nov 21 10:53:22 2025 +0100 objtool: Improve register reporting during function validation When tracing function validation, instruction state changes can report changes involving registers. These registers are reported with the name "r" (e.g. "r3"). Print the CPU specific register name instead of a generic name (e.g. print "rbx" instead of "r3" on x86). Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-13-alexandre.chartre@oracle.com commit fcb268b47a2f4a497fdb40ef24bb9e06488b7213 Author: Alexandre Chartre Date: Fri Nov 21 10:53:21 2025 +0100 objtool: Trace instruction state changes during function validation During function validation, objtool maintains a per-instruction state, in particular to track call frame information. When tracing validation, print any instruction state changes. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-12-alexandre.chartre@oracle.com commit 70589843b36fee0c6e73632469da4e5fd11f0968 Author: Alexandre Chartre Date: Fri Nov 21 10:53:20 2025 +0100 objtool: Add option to trace function validation Add an option to trace and have information during the validation of specified functions. Functions are specified with the --trace option which can be a single function name (e.g. --trace foo to trace the function with the name "foo"), or a shell wildcard pattern (e.g. --trace foo* to trace all functions with a name starting with "foo"). Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-11-alexandre.chartre@oracle.com commit de0248fbbf999d0fd3ca2aa5ba515ab78703d129 Author: Alexandre Chartre Date: Fri Nov 21 10:53:19 2025 +0100 objtool: Record symbol name max length Keep track of the maximum length of symbol names. This will help formatting the code flow between different functions. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-10-alexandre.chartre@oracle.com commit a0e5bf9fd6a048a8dc65f672e625674cd167d172 Author: Alexandre Chartre Date: Fri Nov 21 10:53:18 2025 +0100 objtool: Extract code to validate instruction from the validate branch loop The code to validate a branch loops through all instructions of the branch and validate each instruction. Move the code to validate an instruction to a separated function. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-9-alexandre.chartre@oracle.com commit 0bb080ba6469a573bc85122153d931334d10a173 Author: Alexandre Chartre Date: Fri Nov 21 10:53:17 2025 +0100 objtool: Disassemble instruction on warning or backtrace When an instruction warning (WARN_INSN) or backtrace (BT_INSN) is issued, disassemble the instruction to provide more context. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-8-alexandre.chartre@oracle.com commit d4e13c21497d0cde73694163908f89d7168c1243 Author: Alexandre Chartre Date: Fri Nov 21 10:53:16 2025 +0100 objtool: Store instruction disassembly result When disassembling an instruction store the result instead of directly printing it. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-7-alexandre.chartre@oracle.com commit 5d859dff266f7e57664dc6bcf80ef2c66547c58a Author: Alexandre Chartre Date: Fri Nov 21 10:53:15 2025 +0100 objtool: Print symbol during disassembly Print symbols referenced during disassembly instead of just printing raw addresses. Also handle address relocation. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-6-alexandre.chartre@oracle.com commit f348a44c103aac04fc9420d993afa4ab5cf5e3e2 Author: Alexandre Chartre Date: Fri Nov 21 10:53:14 2025 +0100 tool build: Remove annoying newline in build output Remove the newline which is printed during feature discovery when nothing else is printed. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-5-alexandre.chartre@oracle.com commit 59953303827eceb06d486ba66cc0d71f55ded8ec Author: Alexandre Chartre Date: Fri Nov 21 10:53:13 2025 +0100 objtool: Disassemble code with libopcodes instead of running objdump objtool executes the objdump command to disassemble code. Use libopcodes instead to have more control about the disassembly scope and output. If libopcodes is not present then objtool is built without disassembly support. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-4-alexandre.chartre@oracle.com commit 1013f2e37bec39b1df5679e1c1e2572ece87c088 Author: Alexandre Chartre Date: Fri Nov 21 10:53:12 2025 +0100 objtool: Create disassembly context Create a structure to store information for disassembling functions. For now, it is just a wrapper around an objtool file. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-3-alexandre.chartre@oracle.com commit 55d2a473f317ab028d78a5c5ca69473643657c3d Author: Alexandre Chartre Date: Fri Nov 21 10:53:11 2025 +0100 objtool: Move disassembly functions to a separated file objtool disassembles functions which have warnings. Move the code to do that to a dedicated file. The code is just moved, it is not changed. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://patch.msgid.link/20251121095340.464045-2-alexandre.chartre@oracle.com commit e354cc78f7285ae656f745813873b3fcfba20221 Merge: 623db9a1dd9131 f9e05791642810 Author: Greg Kroah-Hartman Date: Fri Nov 21 15:25:20 2025 +0100 Merge tag 'iio-for-6.19a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New device support, features and cleanup for 6.19 The usual bunch of new device support, but also quite a bit of cleanup of the core and older drivers which is always good to see. New device support ------------------ adi,ad4080 - Add support for AD4081, AD4083, AD4084, AD4086 and AD4087 ADCs with slightly different features to existing supported parts (max CNV clock count, resolution etc) adi,adxl380 - Add support for ADXL318 and ADXL319 which have reduced functionality compared to other supported parts, particularly around event detection. aosong,adp810 - New driver for this differential pressure and temperature sensor. aspeed,adc - Add support for the AST2700 SoC ADCs which differ in small ways from already supported parts. bosch,sm330 - New driver for this IMU (accelerometer + gyroscop) with I2C and SPI bus support. invensense,icm45600 - New driver for this family of IMUs with sub drivers for accelerometer and gyroscope elements. I2C, I3C and SPI busses all supported. * Supports ICM45605, ICM45606, ICM45608, ICM45634, ICM45686, ICM45687, ICM45688P, ICM45689. * Support basic features and FIFO. maxim,max14001 - New driver for the MAX14001 and MAX14002 ADCs. renesas,rzt2h - New driver supporting the RZ/T2H and RZ/N2H ADCs found in various SoCs. renesas,rznl - New driver supporting the RZ/NL ADC found in various SoCs. Features -------- adi,ad5446 - Add a DT binding doc for the 29 variants currently covered by the driver. - Add adi,ad5542 which is compatiable with the adi,ad5542a which was already supported. bosch,bma220 - I2C support including an I2C bus watchdog. - Power supply control - Data ready trigger. - Low pass filter control. - Debugfs register access. - Add Petre Rodan as a maintainer of this driver (thanks!) bosch,bmi270 - Add support for motion events. fsl,mpl3115 - Add a dataready trigger and related sampling frequency control. - Add threshold events. infineon,dps310 - Add a specific device tree binding. maxim,max30100 - Allow control of LED pulse-width in dt-binding. Optimum value depends on physical characteristics of the device which contains this sensor. mediatek,mt2701 - Add dt compatible for the mt8189. rockchip,saradc - Add rk3506 compatible which is functionally the same as the already supported rk3528 (which is therefore the fallback) st,lsm6dsx - Make sampling more flexible when both fifo and events are of interest by decoupling the FIFO fill rate from actual sampling. Cleanup and minor fixes ----------------------- core - Document and add might_sleep() to iio_push_to_buffers_with_ts_unaligned() as it allocates a buffer, typically just on 1st call. - Add documentation for iio_push_to_buffers_with_ts() which is being used to replace iio_push_to_buffers_with_timestamp() in new code as it validates the buffer size. Make the deprecation of the old function clear. - Document that the store_to() callback in struct iio_buffer_access_funcs may be called from contexts that cannot sleep. - Document that the cb() provided to a callback buffer may be called from contexts that cannot sleep. - Cleanup up industrialio-backend.c comments. - Call mutex_destroy() in cleanup of buffers. - Call device_initialize() later to avoid having to call device_put() before configuration is otherwise complete. - Use mutex_init_with_key() to replace opencoded version. - Use dma_buf_unmap_attachment_unlocked() to replace opencoded version. - Reorder Makefile for pressure sensors. various - Uses sysfs_emit() to replace sprintf() in read_label() and other callbacks that typically are used to write data to sysfs buffers. - Switch to REGCACHE_MAPLE in various drivers. adi,docs - Fix up formatting of cross references and other kernel-doc issues. adi,ad4080 - Fix wrong masking of product IDs. adi,ad5446 - Use DMA safe buffers as needed for SPI. - Drop a duplicate device chip specific data structure where two parts are functionally identical. - Fail probe if reference is not available. - Split up the massive array of chip type specific structures into separate structures as this tends to be easier to read and maintain. - Add explicit of_device_id entries for all supported parts. - Split I2C and SPI parts away from core to avoid ifdef complexity. - Switch to devm_mutex_init(). - Make use of guard() to simplify code. - Applying IWYU principles and reorder headers. - Various other minor cleanup. adi,ad7124 - Add debugfs to support single cycle mode, typically only used for cases such as validate performance of the ADC. - Various other minor cleanup including removing some layers of indirection that weren't necessary. - Add extended attributes to the temperature channel which follows the same signal path as other channels. - Replace the setup register allocation strategy with a simpler more predictable one (a fix for OOB from this code follows later in this pull request). adi,adxl345 - Ensure dt-binding allows for both interrupt wired at the same time. arm,scmi - Replace const_ilog2() with the resulting value which ends up simpler to read. bosch,bma220 - Add correct SPI mode specification to the device tree binding. - Fix up interrupt type in dt binding example to match that the driver expects. - Relax hard constraint on matching chip ID with a message only so as to enable fallback DT compatibles to work. - Use local struct device *dev to replaces lots of indirect look ups. - Improve includes on approximate IWYU basis. - Explicit of_match_table. - Reset some registers during probe. - Move to regmap. - Ensure a timestamp is available when filling the buffer by using a locally acquired one rather than relying on trigger top half running. - Add a utility function to search value pair tables for a match. - Various other minor improvements. - Move code to avoid a false dependency of the core code on the I2C module. bosch,bma400 - Improve register and field naming + organization. Use with FIELD_GET() and FIELD_PREP() to allow dropping of shift defines. - Use macros to define event related fields. - Switch to an address lookup based on an index variable to replace lots of very similar register macros. - Rename activity_event_en() to generic_event_en() to better reflect what it does. - Improve comments around interrupt register handling. fsl,mpl3115 - Factor out code for triggered buffer data collection. - Use more consistent register field naming style. - Use get_unaligned_be24() to get the pressure. invensense,mpu6050 - Drop false requirement in DT binding for the interrupt. The driver will be able to do less if one is not provided, but some features are still available. invensense,icm45600_i3c - Fix missing return on failure to match part. linear,ltc2688 - Use devm_mutex_init() so mutex_destroy() is called in tear down path. - Use guard() to simplify lock handling in error return paths. qcom,vadc - Fix up some kernel-doc related warnings. rohm,bd79112 and bd79124 - Use regmap_reg_range() helper to set the ranges. st,lsm6dsx - Fix units of ODR in structure documentation. ti,am335x - Add range checks to avoid a compiler warning. ti,pac1934 - Switch to system_percpu_wq. Various other minor typo fixes etc. * tag 'iio-for-6.19a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (150 commits) staging: iio: adt7316: replace sprintf() with sysfs_emit() iio: pressure: Arrange Makefile alphabetically iio: ABI: document pressure event attributes iio: mpl3115: add threshold events support iio: mpl3115: use get_unaligned_be24() to retrieve pressure data iio: buffer: use dma_buf_unmap_attachment_unlocked() helper iio: core: Replace lockdep_set_class() + mutex_init() by combined call iio: core: Clean up device correctly on iio_device_alloc() failure iio: core: add missing mutex_destroy in iio_dev_release() iio: accel: adxl380: add support for ADXL318 and ADXL319 dt-bindings: iio: accel: adxl380: add new supported parts iio: imu: inv_icm45600: Initializes inv_icm45600_buffer_postdisable() sleep iio: adc: pac1934: replace use of system_wq with system_percpu_wq iio: dac: ad5446: Add AD5542 to the spi id table iio: dac: ad5446: Fix coding style issues iio: dac: ad5446: Refactor header inclusion iio: dac: ad5446: Make use of the cleanup helpers iio: dac: ad5446: Make use of devm_mutex_init() iio: dac: ad5446: Separate I2C/SPI into different drivers iio: dac: ad5456: Add missing DT compatibles ... commit 623db9a1dd91317a05a7aca272a0dc19fa88b4b8 Merge: 5abeedad7273a5 a5d908e0ec05bd Author: Greg Kroah-Hartman Date: Fri Nov 21 15:23:46 2025 +0100 Merge tag 'w1-drv-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1 into char-misc-next Krzysztof writes: 1-Wire bus drivers for v6.19 Just a bunch of cleanups for few 1-Wire drivers: use sysfs_emit() in sysfs show, avoid strcpy() and strcat(), and drop unneeded pm_runtime_mark_last_busy() because core runtime PM handles it. * tag 'w1-drv-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/krzk/linux-w1: w1: omap-hdq: Remove redundant pm_runtime_mark_last_busy() calls w1: ds28e17: Replace deprecated strcpy + strcat in w1_f19_add_slave w1: use sysfs_emit() in sysfs show() callbacks commit 5abeedad7273a5a99de1aeb40e996b40f8e23811 Merge: 41289b4834c854 c9243d6df0d617 Author: Greg Kroah-Hartman Date: Fri Nov 21 15:22:48 2025 +0100 Merge tag 'fpga-for-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next Xu writes: FPGA Manager changes for 6.17-rc1 - Matthew hands over the maintainership of Intel MAX10 BMC secure update to Yilun. - Fabio adds missing spi_device_id table for xilinx-spi - Dihn updates link for Altera & AMD's dt-bindings. - Andy uses pci_find_vsec_capability() instead of open-codes for altera-cvp. All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-next branch). Signed-off-by: Xu Yilun * tag 'fpga-for-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: altera-cvp: Use pci_find_vsec_capability() when probing FPGA device dt-bindings: fpga: update link for Altera's and AMD partial recon fpga: xilinx-spi: Add missing spi_device_id table MAINTAINERS: change maintainer for Intel MAX10 BMC secure updates commit 955a48a5353f4fe009704a9a4272a3adf627cd35 Author: Chen Changcheng Date: Fri Nov 21 14:40:20 2025 +0800 usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. The optical drive of EL-R12 has the same vid and pid as INIC-3069, as follows: T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=13fd ProdID=3940 Rev= 3.10 S: Manufacturer=HL-DT-ST S: Product= DVD+-RW GT80N S: SerialNumber=423349524E4E38303338323439202020 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms This will result in the optical drive device also adding the quirks of US_FL_NO_ATA_1X. When performing an erase operation, it will fail, and the reason for the failure is as follows: [ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 [ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 [ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s [ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 [ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] [ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb [ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 [ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) [ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. For the EL-R12 standard optical drive, all operational commands and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, and no issues were encountered. It can be reasonably concluded that removing the IGNORE_RESIDUE quirks has no impact. Signed-off-by: Chen Changcheng Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit f8d2bf7c0c5d2e9eb1792587c3d29a4c5201634e Author: Krishna Kurapati Date: Tue Nov 11 12:50:25 2025 +0530 usb: typec: hd3ss3220: Enable VBUS based on ID pin state There is a ID pin present on HD3SS3220 controller that can be routed to SoC. As per the datasheet: "Upon detecting a UFP device, HD3SS3220 will keep ID pin high if VBUS is not at VSafe0V. Once VBUS is at VSafe0V, the HD3SS3220 will assert ID pin low. This is done to enforce Type-C requirement that VBUS must be at VSafe0V before re-enabling VBUS" Add support to read the ID pin state and enable VBUS accordingly. Signed-off-by: Krishna Kurapati Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20251111072025.2199142-3-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit d53bdaae894768eccff55327d379e8c033ce30d8 Author: Krishna Kurapati Date: Tue Nov 11 12:50:24 2025 +0530 dt-bindings: usb: ti,hd3ss3220: Add support for VBUS based on ID state Update the bindings to support reading ID state and VBUS, as per the HD3SS3220 data sheet. The ID pin is kept high if VBUS is not at VSafe0V and asserted low once VBUS is at VSafe0V, enforcing the Type-C requirement that VBUS must be at VSafe0V before re-enabling VBUS. Add id-gpios property to describe the input gpio for USB ID pin. Reviewed-by: Rob Herring (Arm) Signed-off-by: Krishna Kurapati Link: https://patch.msgid.link/20251111072025.2199142-2-krishna.kurapati@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 1052864d7d628f7c1f51cffea5ada554def31314 Author: Marco Crivellari Date: Fri Nov 7 16:37:31 2025 +0100 usb: typec: anx7411: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Cc: Heikki Krogerus Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20251107153737.301413-3-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit e91bbe082878c9e9bcfddd68c5f823cf1f757f15 Author: Marco Crivellari Date: Fri Nov 7 16:37:30 2025 +0100 USB: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107153737.301413-2-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit b43889fcae25c247f2ad8e4a304a04b22532767c Author: Radhey Shyam Pandey Date: Fri Nov 14 18:02:39 2025 +0530 dt-bindings: usb: dwc3-xilinx: Describe the reset constraint for the versal platform AMD Versal platform USB 2.0 IP controller receives one reset input from the SoC controlled by the CRL.RST_USB [RESET] register so accordingly describe reset constraints. Signed-off-by: Radhey Shyam Pandey Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251114123239.1929255-1-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman commit de7275cbc6171ce777fae7af444cf8efaf14258b Author: David Laight Date: Wed Nov 19 22:41:24 2025 +0000 drivers/usb/storage: use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Link: https://patch.msgid.link/20251119224140.8616-29-david.laight.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit a5160af78be7fcf3ade6caab0a14e349560c96d7 Author: Gopi Krishna Menon Date: Tue Oct 28 22:26:57 2025 +0530 usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE The previous commit removed the PAGE_SIZE limit on transfer length of raw_io buffer in order to avoid any problems with emulating USB devices whose full configuration descriptor exceeds PAGE_SIZE in length. However this also removes the upperbound on user supplied length, allowing very large values to be passed to the allocator. syzbot on fuzzing the transfer length with very large value (1.81GB) results in kmalloc() to fall back to the page allocator, which triggers a kernel warning as the page allocator cannot handle allocations more than MAX_PAGE_ORDER/KMALLOC_MAX_SIZE. Since there is no limit imposed on the size of buffer for both control and non control transfers, cap the raw_io transfer length to KMALLOC_MAX_SIZE and return -EINVAL for larger transfer length to prevent any warnings from the page allocator. Fixes: 37b9dd0d114a ("usb: raw-gadget: do not limit transfer length") Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68fc07a0.a70a0220.3bf6c6.01ab.GAE@google.com/ Signed-off-by: Gopi Krishna Menon Reviewed-by: Andrey Konovalov Link: https://patch.msgid.link/20251028165659.50962-1-krishnagopi487@gmail.com Signed-off-by: Greg Kroah-Hartman commit a75a5b148b4e1d7c0525359be455d5a54024b714 Author: Bartosz Golaszewski Date: Fri Nov 14 19:37:55 2025 +0100 usb: ohci-da8xx: remove unused platform data We no longer support any board files for DaVinci in mainline and so struct da8xx_ohci_root_hub is no longer used. Remove it together with all the code it's used for. Signed-off-by: Bartosz Golaszewski Acked-by: Alan Stern Link: https://patch.msgid.link/20251114-davinci-usb-v1-1-737380353a74@linaro.org Signed-off-by: Greg Kroah-Hartman commit 363eb9bfdea537c456cec62c0560ab7d386c555c Author: Liang Jie Date: Fri Nov 14 16:42:44 2025 +0800 usb: gadget: functionfs: use dma_buf_unmap_attachment_unlocked() helper Replace the open-coded dma_resv_lock()/dma_resv_unlock() around dma_buf_unmap_attachment() in ffs_dmabuf_release() with the dma_buf_unmap_attachment_unlocked() helper. This aligns FunctionFS DMABUF unmap handling with the standard DMA-BUF API, avoids duplicating locking logic and eases future maintenance. No functional change. Reviewed-by: fanggeng Signed-off-by: Liang Jie Link: https://patch.msgid.link/20251114084246.2064845-1-buaajxlj@163.com Signed-off-by: Greg Kroah-Hartman commit 24b040fe50308f7695f33da21c15a3019a1224f1 Author: Oliver Neukum Date: Wed Nov 12 14:55:05 2025 +0100 usb: uas: reduce time under spinlock Drop the lock before freeing memory. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20251112135543.31081-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit e05d28b759c28660c28a36bf0add178edcc3466e Author: Hang Cao Date: Wed Nov 12 13:53:45 2025 +0800 usb: dwc3: eic7700: Add EIC7700 USB driver The EIC7700 instantiates two USB 3.0 DWC3 IPs, each of which is backward compatible with USB interfaces. It supports Super-speed (5Gb/s), DRD mode, and compatible with xHCI 1.1, etc. Each of instances supports 16 endpoints in device's mode and max 64 devices in host's mode. This module needs to interact with the NOC via the AXI master bus, thus requiring some HSP configuration operations to achieve this. Ops include bus filter, pm signal or status to usb bus and so on. Acked-by: Thinh Nguyen Signed-off-by: Senchuan Zhang Signed-off-by: Hang Cao Link: https://patch.msgid.link/20251112055346.1655-1-caohang@eswincomputing.com Signed-off-by: Greg Kroah-Hartman commit c640a4239db53e077dd5fd20db52fbc8b64f290b Author: Hang Cao Date: Wed Nov 12 13:53:21 2025 +0800 dt-bindings: usb: Add ESWIN EIC7700 USB controller Add Device Tree binding documentation for the ESWIN EIC7700 usb controller module. Signed-off-by: Senchuan Zhang Signed-off-by: Hang Cao Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251112055321.1638-1-caohang@eswincomputing.com Signed-off-by: Greg Kroah-Hartman commit 1b474ee01fbb73b1365adbf9b3067f7375e471ee Author: Pooja Katiyar Date: Thu Oct 30 07:48:58 2025 -0700 usb: typec: ucsi: Add support for SET_PDOS command Add support for UCSI SET_PDOS command as per UCSI specification v2.1 and above to debugfs. Reviewed-by: Heikki Krogerus Signed-off-by: Pooja Katiyar Link: https://patch.msgid.link/b4ccc1e75746b04a8b48c8998b42b019afb934f1.1761773881.git.pooja.katiyar@intel.com Signed-off-by: Greg Kroah-Hartman commit 775fae520e6ae62c393a8daf42dc534f09692f3f Author: Pooja Katiyar Date: Thu Oct 30 07:48:57 2025 -0700 usb: typec: ucsi: Enable debugfs for message_out data structure Add debugfs entry for writing message_out data structure to handle UCSI 2.1 and 3.0 commands through debugfs interface. Users writing to the message_out debugfs file should ensure the input data adheres to the following format: 1. Input must be a non-empty valid hexadecimal string. 2. Input length of hexadecimal string must not exceed 256 bytes of length to be in alignment with the message out data structure size as per the UCSI specification v2.1. 3. If the input string length is odd, then user needs to prepend a '0' to the first character for proper hex conversion. Below are examples of valid hex strings. Note that these values are just examples. The exact values depend on specific command use case. #echo 1A2B3C4D > message_out #echo 01234567 > message_out Reviewed-by: Heikki Krogerus Signed-off-by: Pooja Katiyar Link: https://patch.msgid.link/0a81c2209eb299c1af191cd7ce758a92d5adf81b.1761773881.git.pooja.katiyar@intel.com Signed-off-by: Greg Kroah-Hartman commit db0028637cc832add6d87564fcc2ebb12781b046 Author: Pooja Katiyar Date: Thu Oct 30 07:48:56 2025 -0700 usb: typec: ucsi: Add support for message out data structure Add support for updating message out data structure for UCSI ACPI interface for UCSI 2.1 and UCSI 3.0 commands such as Set PDOs and LPM Firmware Update. Reviewed-by: Heikki Krogerus Signed-off-by: Pooja Katiyar Link: https://patch.msgid.link/5bb1f367e44c9fc5244c3e10e513f02d62fe8166.1761773881.git.pooja.katiyar@intel.com Signed-off-by: Greg Kroah-Hartman commit 3e082978c33151d576694deac8abde021ea669a8 Author: Pooja Katiyar Date: Thu Oct 30 07:48:55 2025 -0700 usb: typec: ucsi: Update UCSI structure to have message in and message out fields Update UCSI structure by adding fields for incoming and outgoing messages. Update .sync_control function and other related functions to use these new fields within the UCSI structure, instead of handling them as separate parameters. Reviewed-by: Heikki Krogerus Signed-off-by: Pooja Katiyar Link: https://patch.msgid.link/214b0a90c3220db33084ab714f4f33a004f70a41.1761773881.git.pooja.katiyar@intel.com Signed-off-by: Greg Kroah-Hartman commit a67df6d1b939ca98e1ad403f53e3ee57299b8c44 Author: Oliver Neukum Date: Tue Nov 11 14:46:10 2025 +0100 uapi: cdc.h: cleanly provide for more interfaces and countries The spec requires at least one interface respectively country. It allows multiple ones. This needs to be clearly said in the UAPI. This is subject to sanity checking in cdc_parse_cdc_header(), thus we can trust the length. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20251111134641.4118827-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 8d3c283ef80950532500f017a80a00a83e8cce0f Author: Sakari Ailus Date: Tue Nov 11 11:51:17 2025 +0200 usb: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Thierry Reding Reviewed-by: AngeloGioacchino Del Regno Acked-by: Peter Chen Link: https://patch.msgid.link/20251111095117.95023-1-sakari.ailus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 3578b1cde59496efc4625ba3fbd14eb2918807a2 Author: Claudiu Beznea Date: Thu Nov 6 16:36:25 2025 +0200 usb: renesas_usbhs: Assert/de-assert reset signals on suspend/resume The Renesas RZ/G3S SoC supports a power-saving mode in which power to most SoC components is turned off, including the USB subsystem. To properly restore from such a state, the reset signal needs to be asserted/de-asserted during suspend/resume. Add reset assert/de-assert on suspend/resume. The resume code has been moved into a separate function to allow reusing it in case reset_control_assert() from suspend fails. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251106143625.3050119-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit e4d9da32bf6059cb485caac4c9c0a2e36cdd5573 Author: Claudiu Beznea Date: Thu Nov 6 16:36:24 2025 +0200 usb: host: ohci-platform: Call reset assert/deassert on suspend/resume The Renesas RZ/G3S SoC supports a power-saving mode in which power to most of the SoC components is turned off, including the USB blocks. On the resume path, the reset signal must be de-asserted before applying any settings to the USB registers. To handle this properly, call reset_control_assert() and reset_control_deassert() during suspend and resume, respectively. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251106143625.3050119-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit c31a401fe7abedabb5c05b5cbf36e2fdb3e6be63 Author: Claudiu Beznea Date: Thu Nov 6 16:36:23 2025 +0200 usb: host: ehci-platform: Call reset assert/deassert on suspend/resume The Renesas RZ/G3S SoC supports a power-saving mode in which power to most of the SoC components is turned off, including the USB blocks. On the resume path, the reset signal must be de-asserted before applying any settings to the USB registers. To handle this properly, call reset_control_assert() and reset_control_deassert() during suspend and resume, respectively. Signed-off-by: Claudiu Beznea Acked-by: Alan Stern Link: https://patch.msgid.link/20251106143625.3050119-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit a7d5fe02059af66c9759cbf9199e7ed381cc592a Author: Claudiu Beznea Date: Thu Nov 6 16:36:22 2025 +0200 usb: host: Do not check priv->clks[clk] There is no need to check the entries in priv->clks[] array before passing it to clk_disable_unprepare() as the clk_disable_unprepare() already check if it receives a NULL or error pointer as argument. Remove this check. This makes the code simpler. Signed-off-by: Claudiu Beznea Acked-by: Alan Stern Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106143625.3050119-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 66371878dfe3376a55cb44bc0918a56232522590 Author: Peter Korsgaard Date: Fri Nov 7 16:13:10 2025 +0100 usb: typec: tipd: mark as orientation aware The driver contains orientation detection logic and correctly calls typec_set_orientation(), but forgets to set the orientation_aware capability, so the orientation value is not visible in sysfs - Fix that. Signed-off-by: Peter Korsgaard Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20251107151311.2089806-1-peter@korsgaard.com Signed-off-by: Greg Kroah-Hartman commit 71f91b401c334cd486b29798128aea315269de90 Author: Marco Crivellari Date: Fri Nov 7 16:42:36 2025 +0100 usb: uas: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107154236.306620-1-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit 12a8f543250cc3e84a29bf0f28a5aa28b6dfc707 Author: Marco Crivellari Date: Thu Nov 6 16:27:12 2025 +0100 usb: dwc3: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Switch to using system_percpu_wq because system_wq is going away as part of a workqueue restructuring. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Thinh Nguyen Link: https://patch.msgid.link/20251106152712.279042-1-marco.crivellari@suse.com Signed-off-by: Greg Kroah-Hartman commit 2b94b054ac4974ad2f89f7f7461840c851933adb Author: Jisheng Zhang Date: Tue Nov 4 08:25:03 2025 +0800 usb: dwc2: fix hang during suspend if set as peripheral dwc2 on most platforms needs phy controller, clock and power supply. All of them must be enabled/activated to properly operate. If dwc2 is configured as peripheral mode, then all the above three hardware resources are disabled at the end of the probe: /* Gadget code manages lowlevel hw on its own */ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) dwc2_lowlevel_hw_disable(hsotg); But the dwc2_suspend() tries to read the dwc2's reg to check whether is_device_mode or not, this would result in hang during suspend if dwc2 is configured as peripheral mode. Fix this hang by bypassing suspend/resume if lowlevel hw isn't enabled. Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c") Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20251104002503.17158-3-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit b6ebcfdcac40a27953f052e4269ce75a18825ffc Author: Jisheng Zhang Date: Tue Nov 4 08:25:02 2025 +0800 usb: dwc2: fix hang during shutdown if set as peripheral dwc2 on most platforms needs phy controller, clock and power supply. All of them must be enabled/activated to properly operate. If dwc2 is configured as peripheral mode, then all the above three hardware resources are disabled at the end of the probe: /* Gadget code manages lowlevel hw on its own */ if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) dwc2_lowlevel_hw_disable(hsotg); But dwc2_driver_shutdown() tries to disable the interrupts on HW IP level. This would result in hang during shutdown if dwc2 is configured as peripheral mode. Fix this hang by only disable and sync irq when lowlevel hw is enabled. Fixes: 4fdf228cdf69 ("usb: dwc2: Fix shutdown callback in platform") Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20251104002503.17158-2-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit 86a35865fefff806d2674982017a47ff082aee0b Author: Abel Vesa Date: Tue Oct 28 17:43:03 2025 +0200 usb: typec: ucsi: Set orientation_aware if UCSI version is 2.x and above For UCSI 2.0 and above, since the orientation is part of the paylad, set the orientation_aware by default and let the implementation specific update_connector op override if necessary. Signed-off-by: Abel Vesa Reviewed-by: Heikki Krogerus Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251028-b4-ucsi-set-orientation-aware-on-version-2-and-above-v1-1-d3425f5679af@linaro.org Signed-off-by: Greg Kroah-Hartman commit a2fa8a12e6bc9d89c0505b8dd7ae38ec173d25de Author: Oliver Neukum Date: Thu Oct 30 10:39:06 2025 +0100 usb: chaoskey: fix locking for O_NONBLOCK A failure to take a lock with O_NONBLOCK needs to result in -EAGAIN. Change it. Fixes: 66e3e591891da ("usb: Add driver for Altus Metrum ChaosKey device (v2)") Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20251030093918.2248104-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 7ebbd0a5a9e2e94e77fed3f324978e8bc4721f45 Author: Ronak Raheja Date: Wed Oct 29 01:39:17 2025 -0700 dt-bindings: usb: qcom,snps-dwc3: Add Kaanapali compatible Kaanapali uses a single-node USB controller architecture with the Synopsys DWC3 controller. Add this to the compatibles list to utilize the DWC3 QCOM and DWC3 core framework. Signed-off-by: Ronak Raheja Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jingyi Wang Link: https://patch.msgid.link/20251029-knp-usb-dwc3-v3-1-6d3a72783336@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 384c57ec720597f8104f69082cdd261abb998b80 Author: Rai, Amardeep Date: Wed Nov 19 16:24:17 2025 +0200 usb: xhci: Add debugfs support for xHCI Port Link Info (PORTLI) register. Each xHCI roothub port has a Port Link Info (PORTLI) register that is used by USB3 and eUSB2V2 ports. USB3 ports show link error count, rx lane count, and tx lane count. eUSB2V2 ports show Rx Data Rate (RDR) and Tx Data Rate (TDR). Rx/Tx Data Rate is a multiple of USB2 2.0 HS 480 Mb/s data rates, and is only valid if a eUSB2V2 device is connected (CCS=1). 0 = "USB 2.0 HS" normal HS 480 Mb/s, no eUSB2V2 in use 1 = "HS1" Assymetric eUSB2V2 where this direction runs normal 480Mb/s 2 = "HS2" 960Mb/s ... 10 = "HS10" 4.8 Gb/s, max eUSB2V2 rate PORTLI is Reserved and preserve "RsvdP" for normal USB2 ports Sample output of USB3 port PORTLI: cat /sys/kernel/debug/usb/xhci/0000:00:14.0/ports/port14/portli 0x00000000 LEC=0 RLC=0 TLC=0 Signed-off-by: Rai, Amardeep Co-developed-by: Mathias Nyman Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-24-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 757508d6d7714c4ffa7a3b6bc95b7cddb992b291 Author: Niklas Neronin Date: Wed Nov 19 16:24:16 2025 +0200 usb: xhci: standardize single bit-field macros Convert single bit-field macros to simple masks. The change makes the masks more universal. Multi bit-field macros are changed in the next commit. After both changes, all masks in xhci-caps.h will follow the same format. I plan to introduce this change to all xhci macros. Bit shift operations on a 32-bit signed can be problematic on some architectures. Instead use BIT() macro, which returns a 64-bit unsigned value. This ensures that the shift operation is performed on an unsigned type, which is safer and more portable across different architectures. Using unsigned integers for bit shifts avoids issues related to sign bits and ensures consistent behavior. Switch from 32-bit to 64-bit? As far as I am aware, this does not cause any issues. Performing bitwise operations between 32 and 64 bit values, the smaller operand is promoted to match the size of the larger one, resulting in a 64-bit operation. This promotion extends the 32-bit value to 64 bits, by zero-padding (for unsigned). Will the change to 64-bit slow down the xhci driver? On a 64-bit architecture - No. On a 32-bit architecture, yes? but in my opinion the performance decrease does not outweigh the readability and other benefits of using BIT() macro. Why not use FIELD_GET() and FIELD_PREP()? While they can be used for single bit macros, I prefer to use simple bitwise operation directly. Because, it takes less space, is less overhead and is as clear as if using FIELD_GET() and FIELD_PREP(). Why not use test_bit() macro? Same reason as with FIELD_GET() and FIELD_PREP(). Suggested-by: Sakari Ailus Reviewed-by: Sakari Ailus Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-23-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2282ab38d87e63010195be5569a751448724d14b Author: Niklas Neronin Date: Wed Nov 19 16:24:15 2025 +0200 usb: xhci: drop xhci-caps.h dependence on xhci-ext-caps.h Drop the dependency of xhci-caps.h on xhci-ext-caps.h by eliminating 2 instances where macros in xhci-caps.h were redefined from xhci-ext-caps.h. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-22-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9936909099cc13a50d7ed1a12370eb03d72ab492 Author: Niklas Neronin Date: Wed Nov 19 16:24:14 2025 +0200 usb: xhci: simplify Max Scratchpad buffer macros Max Scratchpad Buffers consist of two bit-fields: bits 25:21 - Max Scratchpad Buffers High, 5 Most significant bits bits 27:31 - Max Scratchpad Buffers Low, 5 Least significant bits Combined they create the Max Scratchpad Buffers value. Add two new macros, 'HCS_MAX_SP_HI' and 'HCS_MAX_SP_LO', to separately extract the high and low parts of the Max Scratchpad Buffers. These are then combined using 'HCS_MAX_SCRATCHPAD' macro. This change simplifies the code and makes it similar to other split value register macros in the xhci driver. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-21-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f724e34719f03133e6c1ebf7386070f0b9a3209f Author: Niklas Neronin Date: Wed Nov 19 16:24:13 2025 +0200 usb: xhci: simplify Isochronous Scheduling Threshold handling The IST is represented by bits 2:0, with bit 3 indicating the unit of measurement, Frames or Microframes. Introduce xhci_ist_microframes(), which returns the IST value in Microframes, simplifying the code and reducing duplication. Improve documentation in xhci-caps.h to clarify the IST register specifics, including the unit conversion details. These change removes the need to explain it each time the IST values is retrieved. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-20-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit edab00902be0001b65be934ce3e748fcc36cc220 Author: Niklas Neronin Date: Wed Nov 19 16:24:12 2025 +0200 usb: xhci: improve xhci-caps.h comments No functional changes. This patch updates comments in xhci-caps.h for better readability and consistency. Each Capability Register bit field now includes a brief description of its name and valid range, following a uniform comment format across the file. These updates are based on the xHCI specification, revision 1.2. Bit field comment format: /* - , */ Why print the bit range? The bit range aids in identifying missing macros and reserved bit ranges. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-19-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8e9a3a1ea1b6e95e4503b258e7d6b1c4790c2e82 Author: Niklas Neronin Date: Wed Nov 19 16:24:11 2025 +0200 usb: xhci: limit number of interrupts to 128 The xHCI driver defines only 128 interrupter register slots, yet allows up to 2047 interrupters. According to the xHCI specification, the maximum valid number of interrupters is 1024. These mismatches can lead to out-of-range accesses and excessive memory use. The Number of Interrupters (MaxIntrs) field occupies bits 18:8 of the HCSPARAMS1 register, which can yield a value up to 2047, although the specification limits it to 1024. Cap the value using the 'MAX_HC_INTRS' macro. Set 'xhci->max_intrs' to the minimum of the value reported by the HCSPARAMS1 register and 'MAX_HC_INTRS'. The interrupter register slot array is defined for 1024 entries, serving only as a structural template and not increasing memory usage. Although the xHCI specification allows up to 1024 interrupters, raising 'MAX_HC_INTRS' above 128 provides no practical benefit. The driver only uses the primary interrupter (0), and secondary interrupters (1+) are rarely, if ever, used in practice. No reports exist of usage beyond 128. Therefore, I have limited it to 128. Summary: * Interrupter allocations are now limited to 128 from 2047. * Interrupter Register template slots are set to 1024 from 128. * Macro 'MAX_HC_INTRS' can be modified to set the interrupter limit. ==== Detailed interrupter explanation ==== There are two relevant components: Interrupter array: This holds the software interrupter structures and is allocated by the xhci driver. The number of interrupters allocated is determined by the HCSPARAMS1 register field, which specifies the supported interrupter count. Interrupter register slots: This is a template struct used to access the hardware's runtime registers. It is not allocated by the driver, the hardware defines and owns this memory region, and the driver only maps it for MMIO access. Each entry in the interrupter array points to its corresponding interrupter register slot in the hardware region once that interrupter is enabled. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-18-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1668263a13ae08c812d6da70690ee61caea73bce Author: Niklas Neronin Date: Wed Nov 19 16:24:10 2025 +0200 usb: xhci: limit number of ports to 127 The xHCI driver allocates various port-related structures based on the maximum number of ports reported by the controller. The Number of Ports (MaxPorts) field occupies bits 31:24 of the HCSPARAMS1 register and can represent values up to 255. However, the 'HCS_MAX_PORTS()' macro currently reads bits 30:24, effectively limiting the maximum to 127. Fixing the macro increases the reported port limit to 255, which in turn increases memory usage regardless of how many ports are actually used. To maintain compatibility and control memory consumption, set 'xhci->max_ports' to the minimum of the value read from 'HCS_MAX_PORTS()' and 127 (MAX_HC_PORTS). This preserves the existing limit while making the restriction explicit and easier to adjust in the future. Summary: * Port allocations are now limited to 127. * HC max ports macro now correctly reads the MaxPorts value. * Macro 'MAX_HC_PORTS' can be modified to set the port limit. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-17-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit df08973556851b29bd78e79db696d992ed1b43f0 Author: Niklas Neronin Date: Wed Nov 19 16:24:09 2025 +0200 usb: xhci: simplify handling of Structural Parameters 1 values The 32-bit read-only HCSPARAMS1 register contains the following fields: Bits 7:0 - Number of Device Slots (MaxSlots) Bits 18:8 - Number of Interrupters (MaxIntrs) Bits 23:19 - Reserved Bits 31:24 - Number of Ports (MaxPorts) Since the register value is constant for the lifetime of the controller, it is cached in 'xhci->hcs_params1'. However, platform drivers may override the number of interrupters through a separate variable, 'xhci->max_interrupters', leaving only the maximum slots and ports values still derived from the cached register. To simplify the code and improve readability, replace 'xhci->hcs_params1' with two dedicated 'u8' fields: 'xhci->max_slots' and 'xhci->max_ports'. These values are initialized once and used directly instead of calling 'HCS_MAX_SLOTS()' and 'HCS_MAX_PORTS()' macros. This change reduces code clutter without increasing memory usage. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-16-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 70651cc3f5a4c7cec529f121e36ea3b45ea84778 Author: Niklas Neronin Date: Wed Nov 19 16:24:08 2025 +0200 usb: xhci: use cached HCSPARAMS1 value The Structural Parameters 1 (HCSPARAMS1) register is read and cached in 'xhci->hcs_params1' during host controller initialization. Since this register is read-only and its value remains constant for the lifetime of the controller, re-reading it later is unnecessary. Replace subsequent register reads with the cached 'xhci->hcs_params1' value to avoid redundant MMIO access. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-15-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2085fa6c0f337dc30bb869bceceb641a48f03f0a Author: Niklas Neronin Date: Wed Nov 19 16:24:07 2025 +0200 usb: xhci: remove unused trace operation and argument Remove endpoint number 'ep_num' argument and memory operation from xhci_log_ctx() trace function. These changes were added in commit 1d27fabec068 ("xhci: add xhci_address_ctx trace event") on Aug 14, 2013 and have never been used. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-14-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6c2689712177ec1ceb1bf40558c2a957e5c494c9 Author: Niklas Neronin Date: Wed Nov 19 16:24:06 2025 +0200 usb: xhci: remove deprecated TODO comment The Device Context Base Address Array (DCBAA) contains pointers to device contexts. These fields are 64-bit registers, capable of holding 64-bit addresses. When struct 'xhci_device_context_array' was introduced in commit [1], the entries were represented as pairs of 'u32', requiring a custom helper function to set 64-bit addresses. This was later made redundant by commit [2], which changed the representation to a single 'u64', allowing direct assignment. The associated TODO comment referencing the old 32-bit representation is no longer relevant and is removed. Link: https://git.kernel.org/torvalds/c/a74588f94655 [1] Link: https://git.kernel.org/torvalds/c/8e595a5d30a5 [2] Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-13-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1ebf363fcdf6b0394d0190468824bd55a0e96fc1 Author: Marco Crivellari Date: Wed Nov 19 16:24:05 2025 +0200 usb: xhci: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Switch to using system_percpu_wq because system_wq is going away as part of a workqueue restructuring. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-12-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit e6aec6d9f5794e85d2312497a5d81296d885090e Author: Michal Pecio Date: Wed Nov 19 16:24:04 2025 +0200 usb: xhci: Don't unchain link TRBs on quirky HCs Some old HCs ignore transfer ring link TRBs whose chain bit is unset. This breaks endpoint operation and sometimes makes it execute other ring's TDs, which may corrupt their buffers or cause unwanted device action. We avoid this by chaining all link TRBs on affected rings. Fix an omission which allows them to be unchained by cancelling TDs. The patch was tested by reproducing this condition on an isochronous endpoint (non-power-of-two TDs are sometimes split not to cross 64K) and printing link TRBs in trb_to_noop() on good and buggy HCs. Actual hardware malfunction is rare since it requires Missed Service Error shortly before the unchained link TRB, at least on NEC and AMD. I have never seen it after commit bb0ba4cb1065 ("usb: xhci: Apply the link chain quirk on NEC isoc endpoints"), but it's Russian roulette and I can't test all affected hosts and workloads. Fairly often MSEs happen after cancellation because the endpoint was stopped. Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-11-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f7812977456c3c1efc69ecf79ea88302bf472f4b Author: Michal Pecio Date: Wed Nov 19 16:24:03 2025 +0200 usb: xhci: Assume that endpoints halt as specified xHCI 4.8.3 recommends that software should simply assume endpoints to halt after certain events, without looking at the Endpoint Context for confirmation, because HCs may be slow to update that. While no cases of such "slowness" appear to be known, different problem exists on AMD Promontory chipsets: they may halt and generate a transfer event, but fail to ever update the Endpoint Context at all, at least not until some command is queued and fails with Context State Error. This is easily triggered by disconnecting D- of a full speed serial device. Possibly similar bug in non-AMD hardware has been reported to linux-usb. In such case, failed TD is given back without erasing from the ring and endpoint isn't reset. If some URB is unlinked later, Stop Endpoint fails and its handler resets the endpoint. On next submission it will restart on the stale TD. Outcome is UAF on success, or another halt on error and then Dequeue doesn't move and URBs are stuck. Unlinking and resubmitting the URBs causes unlimited ring expansion if the situation repeats. This can be solved by ignoring Endpoint Context State and trusting that endpoints halt when required, except one known case in ancient hardware. The check for "Already resolving halted ep" becomes redundant, because for these completion codes we now jump to xhci_handle_halted_endpoint() which deals with pending EP_HALTED internally. Link: https://lore.kernel.org/linux-usb/20250311234139.0e73e138@foxbook/ Link: https://lore.kernel.org/linux-usb/20250918055527.4157212-1-zhangjinpeng@kylinos.cn/ Signed-off-by: Michal Pecio Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-10-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit f2469d89a70cc6eb3d8141770995a3b251afa6ff Author: Niklas Neronin Date: Wed Nov 19 16:24:02 2025 +0200 usb: xhci: implement USB Port Register Set struct Previously, each port's 'addr' field pointed to the base of the Host Controller USB Port Register Set, and specific registers were accessed using macros such as (port->addr + PORTPMSC). This patch replaces the raw '__le32 __iomem *addr' pointer with a typed 'struct xhci_port_regs __iomem *port_reg' pointer. With this change, individual registers can be accessed directly through the structure fields: Before: port->addr port->addr + PORTPMSC port->addr + PORTLI port->addr + PORTHLPMC After: port->port_reg->portsc port->port_reg->portpmsc port->port_reg->portli port->port_reg->porthlpmc This improves code readability and makes register access more intuitive by using named struct members instead of pointer arithmetic and macros. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-9-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 377a91594e008848363641d07f51d2e48f4bdde5 Author: Niklas Neronin Date: Wed Nov 19 16:24:01 2025 +0200 usb: xhci: add USB Port Register Set struct Introduce a new struct for the Host Controller USB Port Register Set to enhance readability and maintainability. The Host Controller Operational Registers (struct 'xhci_op_regs') span from offset 0x0 to 0x3FF and consist of fixed fields. Following these fixed fields are the Host Controller USB Port Register Sets, which are dynamic and repeat from 1 to MaxPorts, as defined by HCSPARAMS1. Currently, the struct 'xhci_op_regs' includes: __le32 port_status_base; The first PORTSC __le32 port_power_base; The first PORTPMSC __le32 port_link_base; The first PORTLI __le32 reserved5; The first PORTHLPMC, not reserved __le32 reserved6[NUM_PORT_REGS*254]; Port registers 2 to MaxPorts Replace this with the simpler: struct xhci_port_regs port_regs[]; Port registers 1 to MaxPorts Host Controller USB Port Register Set: | Offset | Mnemonic | Register Name -------------------------------------------------------------------------- | 0x0 | PORTSC | Port Status and Control | 0x4 | PORTPMSC | Port Power Management Status and Control | 0x8 | PORTLI | Port Link Info | 0xC | PORTHLPMC | Port Hardware LPM Control Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-8-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 511afe80b82d2b21086e459906e6c97b4eaeed20 Author: Niklas Neronin Date: Wed Nov 19 16:24:00 2025 +0200 usb: xhci: add helper to read PORTSC register Add a dedicated helper function to read the USB Port Status and Control (PORTSC) register. This complements xhci_portsc_writel() and improves code clarity by providing a clear counterpart for reading the register. Suggested-by: Peter Chen Reviewed-by: Peter Chen Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-7-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 829738e59f1fad90ef7b63d6a1a4de9d5d22544a Author: Niklas Neronin Date: Wed Nov 19 16:23:59 2025 +0200 usb: xhci: add tracing for PORTSC register writes Introduce a dedicated write function for the USB Port Register Set (PORTSC) that includes tracing capabilities for values written to the PORTSC register. This enhancement minimizes code duplication and improves debugging. The PORTSC register is part of the Host Controller USB Port Register Set, comprising 4 x 32-bit registers. As the first register, PORTSC is accessed directly via 'port->addr'. Future commits will introduce a dedicated Port register struct to further streamline access. By adding the xhci_portsc_writel() function prior to these changes, we significantly reduce the number of same line modifications required. Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-6-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2f751709463b235ae0f0790210a70ff48b33493a Author: Niklas Neronin Date: Wed Nov 19 16:23:58 2025 +0200 usb: xhci: rework xhci_decode_portsc() Rework xhci_decode_portsc(), which is used for PORTSC tracing, to make the output more compact and general. The function now first prints the multi-bit fields (port speed and link state), followed by the abbreviated names of each individual bit as defined in the xHCI specification. This reduces message length and makes the output easier to read. This change prepares for upcoming patches that will trace all PORTSC writes, requiring the same decoding logic to handle both reads and writes. This is particularly important for Read-Write-1-to-Clear (RW1C) bits, where the semantics differ between read and write operations. For example, when reading the Port Enabled bit, a set bit means the port is enabled; when writing, a set bit indicates the port is being disabled. The decoder now also includes the following fields: Port Link State Write Strobe (LWS) Device Removable (DR) Warm Port Reset (WPR) ==== Examples Traces ==== Before: 0x00201201 Powered Connected Disabled Link:U0 PortSpeed:4 Change: PRC Wake: 0x0a0002a0 Powered Not-connected Disabled Link:RxDetect PortSpeed:0 \ Change: Wake: WCE WOE After: 0x00201201 Speed=4 Link=U0 CCS PP PRC 0x0a0002a0 Speed=0 Link=RxDetect PP WCE WOE Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-5-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 86dcf43be869fe683923f577ddc3d04ec37ff581 Author: Mathias Nyman Date: Wed Nov 19 16:23:57 2025 +0200 xhci: simplify and rework trb_in_td() The trb_in_td() checking is quite complex, especially when checking for TRBs in ranges that can span several segments. Simplify the search by creating a position index for each TRB on the ring, and just compare the position indexes. Add a more generic dma_in_range() helper that checks if a trb dma address is in the range between a start and end trb and call it from trb_in_td() Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit fad902d6709e349babe8fc79550552512facac30 Author: Mathias Nyman Date: Wed Nov 19 16:23:56 2025 +0200 xhci: Add helper to find trb from its dma address Add a xhci_dma_to_trb() helper, and use it to find the transfer TRB early in handle_tx_event() based on the dma address found in the event TRB. With this helper we can avoid using 'ep_seg' transfer TRB segment variable as both a a boolean to indicate if the transfer TRB is part of the next queued TD, and to actually find the transfer TRB based on ep_seg and ep_trb_dma. This is a first step in reworking and cleaning up trb_in_td() and handle_tx_event() Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8d34983720155b8f05de765f0183d9b0e1345cc0 Author: Hongyu Xie Date: Wed Nov 19 16:23:55 2025 +0200 usb: xhci: limit run_graceperiod for only usb 3.0 devices run_graceperiod blocks usb 2.0 devices from auto suspending after xhci_start for 500ms. Log shows: [ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 [ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend [ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 [ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event [ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume [ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. [ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 [ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend [ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume [ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 [ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend [ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 [ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event [ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume [ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 [ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 [ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 [ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 [ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume [ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 [ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend [ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 [ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event [ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume [ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. [ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 [ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event [ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. [ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume [ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 [ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 [ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend [ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 [ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event usb7 and other usb 2.0 root hub were rapidly toggling between suspend and resume states. More, "suspend raced with wakeup event" confuses people. So, limit run_graceperiod for only usb 3.0 devices Signed-off-by: Hongyu Xie Signed-off-by: Mathias Nyman Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 23bba7f33bb12d78110d53277feae8d063df61bf Author: Jack Hsu Date: Tue Nov 11 14:59:19 2025 +0800 dt-bindings: usb: Support MediaTek MT8189 xhci modify dt-binding for support mt8189 dts node of xhci Signed-off-by: Jack Hsu Acked-by: Conor Dooley Link: https://patch.msgid.link/20251111070031.305281-6-jh.hsu@mediatek.com Signed-off-by: Greg Kroah-Hartman commit e7ab90c8675f0de4572969b80160d97ed11d955b Author: Randy Dunlap Date: Mon Nov 3 23:02:16 2025 -0800 usb: xhci-mtk: correct most kernel-doc problems in xhci-mtk.h Correct the kernel-doc notation in xhck-mtk.h to avoid most kernel-doc warnings. Summary of changes: - don't use /** to begin comments that are not in kernel-doc format - add missing "struct mu3h_sch_tt" kernel-doc line - convert several "struct mu3h_...:" to using " - " to separate the struct name from its short description - add a missing @speed: struct member description Warning messages that are fixed: xhci-mtk.h:25: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * To simplify scheduler algorithm, set a upper limit for ESIT, xhci-mtk.h:25: warning: missing initial short description on line: * To simplify scheduler algorithm, set a upper limit for ESIT, Warning: drivers/usb/host/xhci-mtk.h:36 Cannot find identifier on line: * @fs_bus_bw_out: save bandwidth used by FS/LS OUT eps in each uframes Warning: drivers/usb/host/xhci-mtk.h:37 Cannot find identifier on line: * @fs_bus_bw_in: save bandwidth used by FS/LS IN eps in each uframes Warning: drivers/usb/host/xhci-mtk.h:38 Cannot find identifier on line: * @ls_bus_bw: save bandwidth used by LS eps in each uframes Warning: drivers/usb/host/xhci-mtk.h:39 Cannot find identifier on line: * @fs_frame_bw: save bandwidth used by FS/LS eps in each FS frames Warning: drivers/usb/host/xhci-mtk.h:40 Cannot find identifier on line: * @in_ss_cnt: the count of Start-Split for IN eps Warning: drivers/usb/host/xhci-mtk.h:41 Cannot find identifier on line: * @ep_list: Endpoints using this TT Warning: drivers/usb/host/xhci-mtk.h:42 Cannot find identifier on line: */ Warning: drivers/usb/host/xhci-mtk.h:43 Cannot find identifier on line: struct mu3h_sch_tt { Warning: drivers/usb/host/xhci-mtk.h:44 Cannot find identifier on line: u16 fs_bus_bw_out[XHCI_MTK_MAX_ESIT]; Warning: drivers/usb/host/xhci-mtk.h:45 Cannot find identifier on line: u16 fs_bus_bw_in[XHCI_MTK_MAX_ESIT]; Warning: drivers/usb/host/xhci-mtk.h:46 Cannot find identifier on line: u8 ls_bus_bw[XHCI_MTK_MAX_ESIT]; Warning: drivers/usb/host/xhci-mtk.h:47 Cannot find identifier on line: u16 fs_frame_bw[XHCI_MTK_FRAMES_CNT]; Warning: drivers/usb/host/xhci-mtk.h:48 Cannot find identifier on line: u8 in_ss_cnt[XHCI_MTK_MAX_ESIT]; Warning: drivers/usb/host/xhci-mtk.h:49 Cannot find identifier on line: struct list_head ep_list; Warning: drivers/usb/host/xhci-mtk.h:50 Cannot find identifier on line: }; Warning: drivers/usb/host/xhci-mtk.h:51 Cannot find identifier on line: Warning: drivers/usb/host/xhci-mtk.h:52 Cannot find identifier on line: /** Warning: drivers/usb/host/xhci-mtk.h:121 struct member 'speed' not described in 'mu3h_sch_ep_info' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251104070216.907540-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 2a06ffc3f192280c96df95953465cd0a5f777ee9 Author: Lad Prabhakar Date: Sat Nov 1 04:24:40 2025 +0000 dt-bindings: usb: renesas,rzg3e-xhci: Add RZ/V2H(P) and RZ/V2N support Add device tree binding support for the USB3.2 Gen2 controller on Renesas RZ/V2H(P) and RZ/V2N SoCs. The USB3.2 IP on these SoCs is identical to that found on the RZ/G3E SoC. Add new compatible strings "renesas,r9a09g056-xhci" for RZ/V2N and "renesas,r9a09g057-xhci" for RZ/V2H(P). Both variants use "renesas,r9a09g047-xhci" as a fallback compatible to indicate hardware compatibility with the RZ/G3E implementation. Update the title to be more generic as it now covers multiple SoC families beyond just RZ/G3E. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251101042440.648321-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 Author: Zhao Yipeng Date: Thu Nov 20 15:18:05 2025 +0800 ima: Handle error code returned by ima_filter_rule_match() In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if (!rc)' check and sets 'result = true'. The LSM rule is considered a match, causing extra files to be measured by IMA. This issue can be reproduced in the following scenario: After unloading the SELinux policy module via 'semodule -d', if an IMA measurement is triggered before ima_lsm_rules is updated, in ima_match_rules(), the first call to ima_filter_rule_match() returns -ESTALE. This causes the code to enter the 'if (rc == -ESTALE && !rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In ima_lsm_copy_rule(), since the SELinux module has been removed, the rule becomes NULL, and the second call to ima_filter_rule_match() returns -ENOENT. This bypasses the 'if (!rc)' check and results in a false match. Call trace: selinux_audit_rule_match+0x310/0x3b8 security_audit_rule_match+0x60/0xa0 ima_match_rules+0x2e4/0x4a0 ima_match_policy+0x9c/0x1e8 ima_get_action+0x48/0x60 process_measurement+0xf8/0xa98 ima_bprm_check+0x98/0xd8 security_bprm_check+0x5c/0x78 search_binary_handler+0x6c/0x318 exec_binprm+0x58/0x1b8 bprm_execve+0xb8/0x130 do_execveat_common.isra.0+0x1a8/0x258 __arm64_sys_execve+0x48/0x68 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x200 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error codes like -ENOENT do not bypass the check and accidentally result in a successful match. Fixes: 4af4662fa4a9d ("integrity: IMA policy") Signed-off-by: Zhao Yipeng Reviewed-by: Roberto Sassu Signed-off-by: Mimi Zohar commit 2b11e7403a8ed816fce38b57cb88e04d997aa7af Author: Krzysztof Kozlowski Date: Sat Nov 15 13:21:22 2025 +0100 dt-bindings: dma: xilinx: Simplify dma-coherent property Common boolean properties need to be only allowed in the binding (":true"), because their type is already defined by core DT schema. Simplify dma-coherent property to match common syntax. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Harini Katakam Link: https://patch.msgid.link/20251115122120.35315-5-krzk@kernel.org Signed-off-by: Vinod Koul commit 1ecd8b6016c07da162175c708666762e058a0b29 Author: Han Xu Date: Wed Nov 19 10:32:55 2025 -0600 dmaengine: fsl-edma: configure tcd attr with separate src and dst settings Set the edma tcd transfer attribution settings for the src and dst based on their respective dma_addr values, to remove the previous 32-byte alignment limitation in the EDMA memcpy function. Signed-off-by: Han Xu Reviewed-by: Frank Li Link: https://patch.msgid.link/20251119163255.502070-1-han.xu@nxp.com Signed-off-by: Vinod Koul commit cd3ba117688f7694f000293fd5c034f9f842dbb2 Author: Johan Hovold Date: Thu Nov 20 17:49:07 2025 +0100 dmaengine: st_fdma: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120164907.28007-1-johan@kernel.org Signed-off-by: Vinod Koul commit d3e1935fba8d71ef1889cbc2d6e2447cb829070f Author: Johan Hovold Date: Thu Nov 20 12:50:16 2025 +0100 dmaengine: bcm2835: enable compile testing There seems to be nothing preventing the driver from being compile tested so enable that for wider build coverage. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120115016.8967-1-johan@kernel.org Signed-off-by: Vinod Koul commit e0aef2a5c33680bbd332e5b5f64afc8dde8d46f6 Author: Johan Hovold Date: Thu Nov 20 12:45:24 2025 +0100 dmaengine: tegra210-adma: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20251120114524.8431-10-johan@kernel.org Signed-off-by: Vinod Koul commit 1911f507a54b42bd01ae30590c06d8140beee424 Author: Johan Hovold Date: Thu Nov 20 12:45:23 2025 +0100 dmaengine: sprd: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120114524.8431-9-johan@kernel.org Signed-off-by: Vinod Koul commit 3b7b0bbdcba984287225bb373e52845c23dadb93 Author: Johan Hovold Date: Thu Nov 20 12:45:22 2025 +0100 dmaengine: mmp_tdma: drop unnecessary OF node check in remove The driver does not support anything but OF probe since commit 3b0f4a54f247 ("dma:mmp_tdma: get sram pool through device tree"). Commit a67ba97dfb30 ("dmaengine: Use device_get_match_data()") later removed most remnants of platform probing except for an unnecessary OF node check in remove(). Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120114524.8431-8-johan@kernel.org Signed-off-by: Vinod Koul commit 73391fecf23860804bceb6670cef74a3626ecf92 Author: Johan Hovold Date: Thu Nov 20 12:45:21 2025 +0100 dmaengine: mmp_tdma: drop unused module alias The driver does not support anything but OF probe since commit 3b0f4a54f247 ("dma:mmp_tdma: get sram pool through device tree") so drop the unused platform module alias. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120114524.8431-7-johan@kernel.org Signed-off-by: Vinod Koul commit 73b77c3d80031b4636a24912962ffeb295438b0a Author: Johan Hovold Date: Thu Nov 20 12:45:20 2025 +0100 dmaengine: k3dma: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120114524.8431-6-johan@kernel.org Signed-off-by: Vinod Koul commit 9180a66fb43214ae02311176e43eec361ff80d67 Author: Johan Hovold Date: Thu Nov 20 12:45:19 2025 +0100 dmaengine: fsl-qdma: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Frank Li Link: https://patch.msgid.link/20251120114524.8431-5-johan@kernel.org Signed-off-by: Vinod Koul commit 03adb0eb0ed64a1e13e04c0fb57a073896efe6ca Author: Johan Hovold Date: Thu Nov 20 12:45:18 2025 +0100 dmaengine: fsl-edma: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Frank Li Link: https://patch.msgid.link/20251120114524.8431-4-johan@kernel.org Signed-off-by: Vinod Koul commit 660c40702d9073035c61a9573b299481b9c7f3cd Author: Johan Hovold Date: Thu Nov 20 12:45:17 2025 +0100 dmaengine: dw: drop unused module alias The driver does not support anything but OF and ACPI probe since commit b3757413b91e ("dmaengine: dw: platform: Use struct dw_dma_chip_pdata") so drop the unused platform module alias along with the now unnecessary driver name define. Signed-off-by: Johan Hovold Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20251120114524.8431-3-johan@kernel.org Signed-off-by: Vinod Koul commit bfab38bee5652f335c5d693d54eb61bc25850518 Author: Johan Hovold Date: Thu Nov 20 12:45:16 2025 +0100 dmaengine: bcm2835: drop unused module alias The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251120114524.8431-2-johan@kernel.org Signed-off-by: Vinod Koul commit 5d8c5bea0da97809813b5f702700019cfffb6085 Author: Rosen Penev Date: Wed Nov 5 18:24:05 2025 -0800 dmaengine: at_hdmac: add COMPILE_TEST support Allows the buildbot to detect potential issues with the code on various platforms. Signed-off-by: Rosen Penev Reviewed-by: Eugen Hristev Link: https://patch.msgid.link/20251106022405.85604-3-rosenp@gmail.com Signed-off-by: Vinod Koul commit 938eae912ac52f8e9e5f2463e2db30cfe6f895d5 Author: Rosen Penev Date: Wed Nov 5 18:24:04 2025 -0800 dmaengine: at_hdmac: fix formats under 64-bit size_t formats under 32-bit evaluate to the same thing and GCC does not warn against it. Not the case with 64-bit. Signed-off-by: Rosen Penev Reviewed-by: Eugen Hristev Link: https://patch.msgid.link/20251106022405.85604-2-rosenp@gmail.com Signed-off-by: Vinod Koul commit 0e056211b8c92b9a051915afbc0409bc1cadc341 Author: Heiko Stuebner Date: Tue Nov 4 00:29:42 2025 +0100 mfd: qnap-mcu: Hook up the EEPROM sub-device Add the qnap-mcu-eeprom platform-driver as sub-device for the MCU. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251103232942.410386-3-heiko@sntech.de Signed-off-by: Lee Jones commit b9b2c455f462b67954bee5f17c3d68355d37586f Author: Peter Zijlstra Date: Mon Jun 2 15:08:36 2025 +0200 bug: Allow architectures to provide __WARN_printf() In addition to providing __WARN_FLAGS(), allow an architecture to also provide __WARN_printf(). Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.807154591@infradead.org commit 3fd45b871fde00f4fac96318a136bd256ec0b90b Author: Peter Zijlstra Date: Mon Nov 10 11:58:37 2025 +0100 bug: Implement WARN_ON() using __WARN_FLAGS() This completes 3bc3c9c3ab6d ("bugs/core: Pass down the condition string of WARN_ON_ONCE(cond) warnings to __WARN_FLAGS()") and makes WARN_ON() and WARN_ON_ONCE() behaviour consistent. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.690999560@infradead.org commit 7d2c27a0ec5ecec980b623ded45758918c00b164 Author: Peter Zijlstra Date: Sat Jun 7 10:52:28 2025 +0200 bug: Add report_bug_entry() Add a report_bug() variant where the bug_entry is already known. This is useful when the exception instruction is not instantiated per-site. But instead has a single instance. In such a case the bug_entry address might be passed along in a known register or something. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.575795595@infradead.org commit 5c47b7f3d1a9d7589026a201abb8ad445f029246 Author: Peter Zijlstra Date: Sat Jun 7 10:51:24 2025 +0200 bug: Add BUG_FORMAT_ARGS infrastructure Add BUG_FORMAT_ARGS; when an architecture is able to provide a va_list given pt_regs, use this to print format arguments. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.457339417@infradead.org commit 30b82568b04e279d0d99482db036f1bdfecac522 Author: Peter Zijlstra Date: Mon Jun 2 15:01:38 2025 +0200 bug: Clean up CONFIG_GENERIC_BUG_RELATIVE_POINTERS Three repeated CONFIG_GENERIC_BUG_RELATIVE_POINTERS #ifdefs right after one another yields unreadable code. Add a helper. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.341703850@infradead.org commit d292dbb5640c5b73b5ad889ae31fe889a2bf3137 Author: Peter Zijlstra Date: Mon Jun 2 14:59:32 2025 +0200 bug: Add BUG_FORMAT infrastructure Add BUG_FORMAT; an architecture opt-in feature that allows adding the WARN_printf() format string to the bug_entry table. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.223371452@infradead.org commit 1be1fac648fe6184ef3d9a4b60a95eb53bffb0ee Author: Peter Zijlstra Date: Mon Oct 7 10:16:56 2024 +0200 x86: Rework __bug_table helpers Rework the __bug_table helpers such that extension becomes easier. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251110115757.111187573@infradead.org commit 2ace52718376fdb56aca863da2eebe70d7e2ddb1 Merge: a53d0cf7f1cb31 11991999a20145 Author: Peter Zijlstra Date: Fri Nov 21 11:21:20 2025 +0100 Merge branch 'objtool/core' Bring in the UDB and objtool data annotations to avoid conflicts while further extending the bug exceptions. Signed-off-by: Peter Zijlstra commit 9ef1203fc73570290e09be65b15df84815ca4089 Author: Umang Jain Date: Thu Nov 20 19:47:57 2025 +0530 ALSA: pcm: Harden the spk_alloc assumption check If the parsed ELD has spk_alloc=0, it currently assigns the parsed ELD spk_alloc to 0xffff. However, we should also check if there is at least one SAD (Short audio descriptor) to enforce the assumption, as ELD without any sad_count, is usually considered invalid for e.g. in commit ce9778b7a0272("ALSA: hda/hdmi: Consider ELD is invalid when no SAD is present"). Signed-off-by: Umang Jain Link: https://patch.msgid.link/20251120141757.901505-1-uajain@igalia.com Signed-off-by: Takashi Iwai commit 44acac00be5dbda58f337acda41148d39743075c Author: Eric Farman Date: Fri Nov 7 03:49:27 2025 +0100 KVM: s390: vsie: Check alignment of BSCA header The VSIE code currently checks that the BSCA struct fits within a page, and returns a validity exception 0x003b if it doesn't. The BSCA is pinned in memory rather than shadowed (see block comment at end of kvm_s390_cpu_feat_init()), so enforcing the CPU entries to be on the same pinned page makes sense. Except those entries aren't going to be used below the guest, and according to the definition of that validity exception only the header of the BSCA (everything but the CPU entries) needs to be within a page. Adjust the alignment check to account for that. Signed-off-by: Eric Farman Reviewed-by: Christian Borntraeger Reviewed-by: Christoph Schlameuss Signed-off-by: Janosch Frank commit 821f5fe4dbcb82357f0dfcfca3dd98f2b4097e53 Author: Avadhut Naik Date: Tue Nov 18 19:15:03 2025 +0000 x86/mce: Add support for physical address valid bit Starting with Zen6, AMD's Scalable MCA systems will incorporate two new bits in MCA_STATUS and MCA_CONFIG MSRs. These bits will indicate if a valid System Physical Address (SPA) is present in MCA_ADDR. PhysAddrValidSupported bit (MCA_CONFIG[11]) serves as the architectural indicator and states if PhysAddrV bit (MCA_STATUS[54]) is Reserved or if it indicates validity of SPA in MCA_ADDR. PhysAddrV bit (MCA_STATUS[54]) advertises if MCA_ADDR contains valid SPA or if it is implementation specific. Use and prefer MCA_STATUS[PhysAddrV] when checking for a usable address. Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251118191731.181269-1-avadhut.naik@amd.com commit eeb3f76d73baed4c8ecc883e1eaafba3cb8aae1d Author: Yazen Ghannam Date: Tue Nov 4 14:55:45 2025 +0000 x86/mce: Save and use APEI corrected threshold limit The MCA threshold limit generally is not something that needs to change during runtime. It is common for a system administrator to decide on a policy for their managed systems. If MCA thresholding is OS-managed, then the threshold limit must be set at every boot. However, many systems allow the user to set a value in their BIOS. And this is reported through an APEI HEST entry even if thresholding is not in FW-First mode. Use this value, if available, to set the OS-managed threshold limit. Users can still override it through sysfs if desired for testing or debug. APEI is parsed after MCE is initialized. So reset the thresholding blocks later to pick up the threshold limit. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit 3138df6f0cd04a75f8efa5b5270ba56d00a84ae6 Author: Crystal Wood Date: Wed Nov 12 09:25:28 2025 -0600 rtla/timerlat: Exit top main loop on any non-zero wait_retval Comparing to exactly 1 will fail if more than one ring buffer event was seen since the last call to timerlat_bpf_wait(), which can happen in some race scenarios. Signed-off-by: Crystal Wood Link: https://lore.kernel.org/r/20251112152529.956778-5-crwood@redhat.com Signed-off-by: Tomas Glozar commit 61f1fd5d69fde27cfc277d1f68a1e6e4f7265b4b Author: Crystal Wood Date: Wed Nov 12 09:25:25 2025 -0600 rtla/tests: Don't rely on matching ^1ALL The timerlat "top stop at failed action" test was relying on "ALL" being printed immediately after the "1" from the threshold action. Besides being fragile, this depends on stdbuf behavior, which is easy to miss when recreating the test outside of the framework for debugging purposes. Instead, use the expected/unexpected text mechanism from the corresponding osnoise test. Signed-off-by: Crystal Wood Link: https://lore.kernel.org/r/20251112152529.956778-2-crwood@redhat.com Signed-off-by: Tomas Glozar commit ddb6e42494e5c48c17e64f29b7674b9add486a19 Author: Ivan Pravdin Date: Mon Nov 3 11:19:08 2025 -0500 rtla: Fix -a overriding -t argument When running rtla as `rtla -t custom_file.txt -a 100` -a options override trace output filename specified by -t option. Running the command above will create _trace.txt file instead of custom_file.txt. Fix this by making sure that -a option does not override trace output filename even if it's passed after trace output filename is specified. Fixes: 173a3b014827 ("rtla/timerlat: Add the automatic trace option") Signed-off-by: Ivan Pravdin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/b6ae60424050b2c1c8709e18759adead6012b971.1762186418.git.ipravdin.official@gmail.com [ use capital letter in subject, as required by tracing subsystem ] Signed-off-by: Tomas Glozar commit 7b71f3a6986c93defbb72bb6c143e04122720cb1 Author: Ivan Pravdin Date: Mon Nov 3 11:19:06 2025 -0500 rtla: Fix -C/--cgroup interface Currently, user can only specify cgroup to the tracer's thread the following ways: `-C[cgroup]` `-C[=cgroup]` `--cgroup[=cgroup]` If user tries to specify cgroup as `-C [cgroup]` or `--cgroup [cgroup]`, the parser silently fails and rtla's cgroup is used for the tracer threads. To make interface more user-friendly, allow user to specify cgroup in the aforementioned way, i.e. `-C [cgroup]` and `--cgroup [cgroup]`. Refactor identical logic between -t/--trace and -C/--cgroup into a common function. Change documentation to reflect this user interface change. Fixes: a957cbc02531 ("rtla: Add -C cgroup support") Signed-off-by: Ivan Pravdin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/16132f1565cf5142b5fbd179975be370b529ced7.1762186418.git.ipravdin.official@gmail.com [ use capital letter in subject, as required by tracing subsystem ] Signed-off-by: Tomas Glozar commit 49c15794198ff03a4fa844f894f7e5d4bdbffcfc Author: Costa Shulyupin Date: Sat Oct 11 11:27:38 2025 +0300 tools/rtla: Replace osnoise_hist_usage("...") with fatal("...") A long time ago, when the usage help was short, it was a favor to the user to show it on error. Now that the usage help has become very long, it is too noisy to dump the complete help text for each typo after the error message itself. Replace osnoise_hist_usage("...") with fatal("...") on errors. Remove the already unused 'usage' argument from osnoise_hist_usage(). Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251011082738.173670-6-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 92b5b55e5e8eeed9094dc68cdbb1afe31dd0ff37 Author: Costa Shulyupin Date: Sat Oct 11 11:27:37 2025 +0300 tools/rtla: Replace osnoise_top_usage("...") with fatal("...") A long time ago, when the usage help was short, it was a favor to the user to show it on error. Now that the usage help has become very long, it is too noisy to dump the complete help text for each typo after the error message itself. Replace osnoise_top_usage("...") with fatal("...") on errors. Remove the already unused 'usage' argument from osnoise_top_usage(). Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251011082738.173670-5-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 8f4264e046ef75d35cfffeb7aadfc5d84717df3e Author: Costa Shulyupin Date: Sat Oct 11 11:27:36 2025 +0300 tools/rtla: Replace timerlat_hist_usage("...") with fatal("...") A long time ago, when the usage help was short, it was a favor to the user to show it on error. Now that the usage help has become very long, it is too noisy to dump the complete help text for each typo after the error message itself. Replace timerlat_hist_usage("...\n") with fatal("...") on errors. Remove the already unused 'usage' argument from timerlat_hist_usage(). Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251011082738.173670-4-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 4e5e7210f9721796a21a4b2d646fa043a7d88fef Author: Costa Shulyupin Date: Sat Oct 11 11:27:35 2025 +0300 tools/rtla: Replace timerlat_top_usage("...") with fatal("...") A long time ago, when the usage help was short, it was a favor to the user to show it on error. Now that the usage help has become very long, it is too noisy to dump the complete help text for each typo after the error message itself. Replace timerlat_top_usage("...\n") with fatal("...") on errors. Remove the already unused 'usage' argument from timerlat_top_usage(). Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251011082738.173670-3-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 8cbb25db81544f0bfc05c037ad61d3e70d031f88 Author: Costa Shulyupin Date: Sat Oct 11 11:27:34 2025 +0300 tools/rtla: Add fatal() and replace error handling pattern The code contains some technical debt in error handling, which complicates the consolidation of duplicated code. Introduce an fatal() function to replace the common pattern of err_msg() followed by exit(EXIT_FAILURE), reducing the length of an already long function. Further patches using fatal() follow. Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251011082738.173670-2-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 34c170ae5c3036ef879567a37409a2859e327342 Author: Tomas Glozar Date: Tue Oct 7 11:53:41 2025 +0200 rtla/tests: Fix osnoise test calling timerlat osnoise test "top stop at failed action" is calling timerlat instead of osnoise by mistake. Fix it so that it calls the correct RTLA subcommand. Fixes: 05b7e10687c6 ("tools/rtla: Add remaining support for osnoise actions") Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20251007095341.186923-3-tglozar@redhat.com Signed-off-by: Tomas Glozar commit d649e9f04cb0224817dac8190461ef1674e32b37 Author: Tomas Glozar Date: Tue Oct 7 11:53:40 2025 +0200 rtla/tests: Extend action tests to 5s In non-BPF mode, it takes up to 1 second for RTLA to notice that tracing has been stopped. That means that action tests cannot have a 1 second duration, as the SIGALRM will be racing with the threshold overflow. Previously, non-BPF mode actions were buggy and always executed the action, even when stopping on duration or SIGINT, preventing this issue from manifesting. Now that this has been fixed, the tests have become flaky, and this has to be adjusted. Fixes: 4e26f84abfbb ("rtla/tests: Add tests for actions") Fixes: 05b7e10687c6 ("tools/rtla: Add remaining support for osnoise actions") Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20251007095341.186923-2-tglozar@redhat.com Signed-off-by: Tomas Glozar commit 8e8678e740ecde2ae4a0404fd9b4ed2b726e236d Author: Janosch Frank Date: Tue Jul 8 12:57:57 2025 +0000 KVM: s390: Add capability that forwards operation exceptions Setting KVM_CAP_S390_USER_OPEREXEC will forward all operation exceptions to user space. This also includes the 0x0000 instructions managed by KVM_CAP_S390_USER_INSTR0. It's helpful if user space wants to emulate instructions which do not (yet) have an opcode. While we're at it refine the documentation for KVM_CAP_S390_USER_INSTR0. Signed-off-by: Janosch Frank Reviewed-by: Claudio Imbrenda Acked-by: Christian Borntraeger Signed-off-by: Janosch Frank commit 11991999a20145b7f8af21202d0cac6b1f90a6e4 Author: Josh Poimboeuf Date: Thu Nov 20 12:14:21 2025 -0800 Revert "objtool: Warn on functions with ambiguous -ffunction-sections section names" This reverts commit 9c7dc1dd897a1cdcade9566ea4664b03fbabf4a4. The check-function-names.sh script now provides the function name checking functionality for all architectures, making the objtool check redundant. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/c7d549d4de8bd1490d106b99630eea5efc69a4dd.1763669451.git.jpoimboe@kernel.org commit 93863f3f859a626347ce2ec18947b11357b4ca14 Author: Josh Poimboeuf Date: Thu Nov 20 12:14:20 2025 -0800 kbuild: Check for functions with ambiguous -ffunction-sections section names Commit 9c7dc1dd897a ("objtool: Warn on functions with ambiguous -ffunction-sections section names") only works for drivers which are compiled on architectures supported by objtool. Make a script to perform the same check for all architectures. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/a6a49644a34964f7e02f3a8ce43af03e72817180.1763669451.git.jpoimboe@kernel.org commit 31863337138a0482d614f1090727dac87c936959 Author: Josh Poimboeuf Date: Thu Nov 20 12:14:19 2025 -0800 tty: synclink_gt: Fix namespace collision and startup() section placement with -ffunction-sections When compiled with -ffunction-sections (e.g., for LTO, livepatch, dead code elimination, AutoFDO, or Propeller), the startup() function gets compiled into the .text.startup section (or in some cases .text.startup.constprop.0 or .text.startup.isra.0). However, the .text.startup and .text.startup.* sections are also used by the compiler for __attribute__((constructor)) code. This naming conflict causes the vmlinux linker script to wrongly place startup() function code in .init.text, which gets freed during boot. Some builds have a mix of objects, both with and without -ffunctions-sections, so it's not possible for the linker script to disambiguate with #ifdef CONFIG_FUNCTION_SECTIONS or similar. This means that "startup" unfortunately needs to be prohibited as a function name. Rename startup() to startup_hw(). For consistency, also rename its shutdown() counterpart to shutdown_hw(). Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/f0ee750f35c878172cc09916a0724b74e62eadc2.1763669451.git.jpoimboe@kernel.org commit 845c09e4744f111eae894ad3b67a369bb43d50fb Author: Josh Poimboeuf Date: Thu Nov 20 12:14:18 2025 -0800 tty: amiserial: Fix namespace collision and startup() section placement with -ffunction-sections When compiled with -ffunction-sections (e.g., for LTO, livepatch, dead code elimination, AutoFDO, or Propeller), the startup() function gets compiled into the .text.startup section (or in some cases .text.startup.constprop.0 or .text.startup.isra.0). However, the .text.startup and .text.startup.* sections are also used by the compiler for __attribute__((constructor)) code. This naming conflict causes the vmlinux linker script to wrongly place startup() function code in .init.text, which gets freed during boot. Some builds have a mix of objects, both with and without -ffunctions-sections, so it's not possible for the linker script to disambiguate with #ifdef CONFIG_FUNCTION_SECTIONS or similar. This means that "startup" unfortunately needs to be prohibited as a function name. Rename startup() to rs_startup(). For consistency, also rename its shutdown() counterpart to rs_shutdown(). Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/9e56afff5268b0b12b99a8aa9bf244d6ebdcdf47.1763669451.git.jpoimboe@kernel.org commit 2c715c9de293b6c05bcdff1c22a7626f3bb42492 Author: Josh Poimboeuf Date: Thu Nov 20 12:14:17 2025 -0800 media: atomisp: gc2235: Fix namespace collision and startup() section placement with -ffunction-sections When compiled with -ffunction-sections (e.g., for LTO, livepatch, dead code elimination, AutoFDO, or Propeller), the startup() function gets compiled into the .text.startup section (or in some cases .text.startup.constprop.0 or .text.startup.isra.0). However, the .text.startup and .text.startup.* sections are also used by the compiler for __attribute__((constructor)) code. This naming conflict causes the vmlinux linker script to wrongly place startup() function code in .init.text, which gets freed during boot. Some builds have a mix of objects, both with and without -ffunctions-sections, so it's not possible for the linker script to disambiguate with #ifdef CONFIG_FUNCTION_SECTIONS or similar. This means that "startup" unfortunately needs to be prohibited as a function name. Rename startup() to gc2235_startup(). Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/d28103a6edf7beceb5e3c6fa24e49dbad1350389.1763669451.git.jpoimboe@kernel.org commit da6202139aef11c3c5881176e6e3184d88d8a0d9 Author: Josh Poimboeuf Date: Thu Nov 20 12:14:16 2025 -0800 serial: icom: Fix namespace collision and startup() section placement with -ffunction-sections When compiled with -ffunction-sections (e.g., for LTO, livepatch, dead code elimination, AutoFDO, or Propeller), the startup() function gets compiled into the .text.startup section (or in some cases .text.startup.constprop.0 or .text.startup.isra.0). However, the .text.startup and .text.startup.* sections are also used by the compiler for __attribute__((constructor)) code. This naming conflict causes the vmlinux linker script to wrongly place startup() function code in .init.text, which gets freed during boot. Some builds have a mix of objects, both with and without -ffunctions-sections, so it's not possible for the linker script to disambiguate with #ifdef CONFIG_FUNCTION_SECTIONS or similar. This means that "startup" unfortunately needs to be prohibited as a function name. Rename startup() to icom_startup(). For consistency, also rename its shutdown() counterpart to icom_shutdown(). Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Acked-by: Greg Kroah-Hartman Link: https://patch.msgid.link/1aee9ef69f9d40405676712b34f0c397706e7023.1763669451.git.jpoimboe@kernel.org commit 106f11d43be53156187270d00c83ddf5ef3f6ac6 Author: Josh Poimboeuf Date: Thu Nov 20 12:52:20 2025 -0800 objtool: Remove second pass of .cold function correlation The .cold function parent/child correlation logic has two passes: one in read_symbols() and one in add_jump_destinations(). The second pass was added with commit cd77849a69cf ("objtool: Fix GCC 8 cold subfunction detection for aliased functions") to ensure that if the parent symbol had aliases then the canonical symbol was chosen as the parent. That solution was rather clunky, not to mention incomplete due to the existence of alternatives and switch tables. Now that we have sym->alias, the canonical alias fix can be done much simpler in the first pass, making the second pass obsolete. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/bdab245a38000a5407f663a031f39e14c67a43d4.1763671318.git.jpoimboe@kernel.org commit a91a61b290430ba0dd2c42378f744d6b21657f42 Author: Josh Poimboeuf Date: Thu Nov 20 12:52:19 2025 -0800 objtool: Skip non-canonical aliased symbols in add_jump_table_alts() If a symbol has aliases, make add_jump_table_alts() skip the non-canonical ones to avoid any surprises. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/169aa17564b9aadb74897945ea74ac2eb70c5b13.1763671318.git.jpoimboe@kernel.org commit 9205a322cf96f16a49e412dfa3f09431f3e02fc5 Author: Josh Poimboeuf Date: Thu Nov 20 12:52:18 2025 -0800 objtool: Return canonical symbol when aliases exist in symbol finding helpers When symbol alias ambiguity exists in the symbol finding helper functions, return the canonical sym->alias, as that's the one which gets used by validate_branch() and elsewhere. This doesn't fix any known issues, just makes the symbol alias behavior more robust. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/450470a4897706af77453ad333e18af5ebab653c.1763671318.git.jpoimboe@kernel.org commit 16f366c5a68839736d3616b466f1738811408ec7 Author: Josh Poimboeuf Date: Thu Nov 20 12:52:17 2025 -0800 objtool: Don't alias undefined symbols Objtool is mistakenly aliasing all undefined symbols. That's obviously wrong, though it has no consequence since objtool happens to only use sym->alias for defined symbols. Fix it regardless. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/bc401173a7717757eee672fc1ca5a20451d77b86.1763671318.git.jpoimboe@kernel.org commit 2c2acca2eabf53a954ed5aacef987bbf909b9f12 Author: Josh Poimboeuf Date: Thu Nov 20 12:52:16 2025 -0800 objtool: Fix .cold function detection for duplicate symbols The objtool .cold child/parent correlation is done in two phases: first in elf_add_symbol() and later in add_jump_destinations(). The first phase is rather crude and can pick the wrong parent if there are duplicates with the same name. The second phase usually fixes that, but only if the parent has a direct jump to the child. It does *not* work if the only branch from the parent to the child is an alternative or jump table entry. Make the first phase more robust by looking for the parent in the same STT_FILE as the child. Fixes the following objtool warnings in an AutoFDO build with a large CLANG_AUTOFDO_PROFILE profile: vmlinux.o: warning: objtool: rdev_add_key() falls through to next function rdev_add_key.cold() vmlinux.o: warning: objtool: rdev_set_default_key() falls through to next function rdev_set_default_key.cold() Fixes: 13810435b9a7 ("objtool: Support GCC 8's cold subfunctions") Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/82c7b52e40efa75dd10e1c550cc75c1ce10ac2c9.1763671318.git.jpoimboe@kernel.org commit 024020e2b6adb4e568fb80f624b5e20d8943f107 Author: Josh Poimboeuf Date: Thu Nov 20 12:52:15 2025 -0800 objtool: Support Clang AUTOFDO .cold functions AutoFDO enables -fsplit-machine-functions which can move the cold parts of a function to a .cold symbol in a .text.split. section. Unlike GCC, the Clang .cold symbols are not marked STT_FUNC. This confuses objtool in several ways, resulting in warnings like the following: vmlinux.o: warning: objtool: apply_retpolines.cold+0xfc: unsupported instruction in callable function vmlinux.o: warning: objtool: machine_check_poll.cold+0x2e: unsupported instruction in callable function vmlinux.o: warning: objtool: free_deferred_objects.cold+0x1f: relocation to !ENDBR: free_deferred_objects.cold+0x26 vmlinux.o: warning: objtool: rpm_idle.cold+0xe0: relocation to !ENDBR: rpm_idle.cold+0xe7 vmlinux.o: warning: objtool: tcp_rcv_state_process.cold+0x1c: relocation to !ENDBR: tcp_rcv_state_process.cold+0x23 Fix it by marking the .cold symbols as STT_FUNC. Fixes: 2fd65f7afd5a ("AutoFDO: Enable machine function split optimization for AutoFDO") Closes: https://lore.kernel.org/20251103215244.2080638-2-xur@google.com Reported-by: Rong Xu Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: xur@google.com Tested-by: xur@google.com Link: https://patch.msgid.link/20a67326f04b2a361c031b56d58e8a803b3c5893.1763671318.git.jpoimboe@kernel.org commit 611d4d160616a8f96959a3045ed01bc9afe0900f Merge: ee31621316cc20 a846505a193d74 Author: Dave Airlie Date: Fri Nov 21 18:48:20 2025 +1000 Merge tag 'mediatek-drm-next-20251120' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-next Mediatek DRM Next - 20251120 1. Fix probe resource leaks 2. Add support for MT8195/88 HDMIv2 and DDCv2 3. Fix CCORR mtk_ctm_s31_32_to_s1_n function issue 4. Fix device node reference leak in mtk_dp_dt_parse() Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://patch.msgid.link/20251119233202.10034-1-chunkuang.hu@kernel.org commit 7a2ff00c3b5e3ca1bbeb13cda52efe870be8501b Author: Mauro Carvalho Chehab Date: Thu Aug 14 09:52:56 2025 -0700 docs: efi: add CPER functions to driver-api There are two kernel-doc like descriptions at cper, which is used by other parts of cper and on ghes driver. They both have kernel-doc like descriptions. Change the tags for them to be actual kernel-doc tags and add them to the driver-api documentaion at the UEFI section. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jonathan Cameron Acked-by: Borislav Petkov (AMD) Signed-off-by: Ard Biesheuvel commit 96b010536ee020e716d28d9b359a4bcd18800aeb Author: Mauro Carvalho Chehab Date: Thu Aug 14 09:52:55 2025 -0700 efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Up to UEFI spec 2.9, the type byte of CPER struct for ARM processor was defined simply as: Type at byte offset 4: - Cache error - TLB Error - Bus Error - Micro-architectural Error All other values are reserved Yet, there was no information about how this would be encoded. Spec 2.9A errata corrected it by defining: - Bit 1 - Cache Error - Bit 2 - TLB Error - Bit 3 - Bus Error - Bit 4 - Micro-architectural Error All other values are reserved That actually aligns with the values already defined on older versions at N.2.4.1. Generic Processor Error Section. Spec 2.10 also preserve the same encoding as 2.9A. Adjust CPER and GHES handling code for both generic and ARM processors to properly handle UEFI 2.9A and 2.10 encoding. Link: https://uefi.org/specs/UEFI/2.10/Apx_N_Common_Platform_Error_Record.html#arm-processor-error-information Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jonathan Cameron Acked-by: Borislav Petkov (AMD) Signed-off-by: Ard Biesheuvel commit a976d790f49499ccaa0f991788ad8ebf92e7fd5c Author: Mauro Carvalho Chehab Date: Thu Aug 14 09:52:54 2025 -0700 efi/cper: Add a new helper function to print bitmasks Add a helper function to print a string with names associated to each bit field. A typical example is: const char * const bits[] = { "bit 3 name", "bit 4 name", "bit 5 name", }; char str[120]; unsigned int bitmask = BIT(3) | BIT(5); #define MASK GENMASK(5,3) cper_bits_to_str(str, sizeof(str), FIELD_GET(MASK, bitmask), bits, ARRAY_SIZE(bits)); The above code fills string "str" with "bit 3 name|bit 5 name". Reviewed-by: Jonathan Cameron Signed-off-by: Mauro Carvalho Chehab Acked-by: Borislav Petkov (AMD) Signed-off-by: Ard Biesheuvel commit 8ad2c72e21efb3dc76c5b14089fa7984cdd87898 Author: Mauro Carvalho Chehab Date: Thu Aug 14 09:52:53 2025 -0700 efi/cper: Adjust infopfx size to accept an extra space Compiling with W=1 with werror enabled produces an error: drivers/firmware/efi/cper-arm.c: In function ‘cper_print_proc_arm’: drivers/firmware/efi/cper-arm.c:298:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=] 298 | snprintf(infopfx, sizeof(infopfx), "%s ", newpfx); | ^ drivers/firmware/efi/cper-arm.c:298:25: note: ‘snprintf’ output between 2 and 65 bytes into a destination of size 64 298 | snprintf(infopfx, sizeof(infopfx), "%s ", newpfx); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ As the logic there adds an space at the end of infopx buffer. Add an extra space to avoid such warning. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jonathan Cameron Acked-by: Borislav Petkov (AMD) Signed-off-by: Ard Biesheuvel commit 05954511b73e748d0370549ad9dd9cd95297d97a Author: Jason Tian Date: Thu Aug 14 09:52:52 2025 -0700 RAS: Report all ARM processor CPER information to userspace The ARM processor CPER record was added in UEFI v2.6 and remained unchanged up to v2.10. Yet, the original arm_event trace code added by e9279e83ad1f ("trace, ras: add ARM processor error trace event") is incomplete, as it only traces some fields of UAPI 2.6 table N.16, not exporting any information from tables N.17 to N.29 of the record. This is not enough for the user to be able to figure out what has exactly happened or to take appropriate action. According to the UEFI v2.9 specification chapter N2.4.4, the ARM processor error section includes: - several (ERR_INFO_NUM) ARM processor error information structures (Tables N.17 to N.20); - several (CONTEXT_INFO_NUM) ARM processor context information structures (Tables N.21 to N.29); - several vendor specific error information structures. The size is given by Section Length minus the size of the other fields. In addition, it also exports two fields that are parsed by the GHES driver when firmware reports it, e.g.: - error severity - CPU logical index Report all of these information to userspace via a the ARM tracepoint so that userspace can properly record the error and take decisions related to CPU core isolation according to error severity and other info. The updated ARM trace event now contains the following fields: ====================================== ============================= UEFI field on table N.16 ARM Processor trace fields ====================================== ============================= Validation handled when filling data for affinity MPIDR and running state. ERR_INFO_NUM pei_len CONTEXT_INFO_NUM ctx_len Section Length indirectly reported by pei_len, ctx_len and oem_len Error affinity level affinity MPIDR_EL1 mpidr MIDR_EL1 midr Running State running_state PSCI State psci_state Processor Error Information Structure pei_err - count at pei_len Processor Context ctx_err- count at ctx_len Vendor Specific Error Info oem - count at oem_len ====================================== ============================= It should be noted that decoding of tables N.17 to N.29, if needed, will be handled in userspace. That gives more flexibility, as there won't be any need to flood the kernel with micro-architecture specific error decoding. Also, decoding the other fields require a complex logic, and should be done for each of the several values inside the record field. So, let userspace daemons like rasdaemon decode them, parsing such tables and having vendor-specific micro-architecture-specific decoders. [mchehab: modified description, solved merge conflicts and fixed coding style] Signed-off-by: Jason Tian Co-developed-by: Shengwei Luo Signed-off-by: Shengwei Luo Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Daniel Ferguson # rebased Reviewed-by: Jonathan Cameron Tested-by: Shiju Jose Acked-by: Borislav Petkov (AMD) Fixes: e9279e83ad1f ("trace, ras: add ARM processor error trace event") Link: https://uefi.org/specs/UEFI/2.10/Apx_N_Common_Platform_Error_Record.html#arm-processor-error-section Signed-off-by: Ard Biesheuvel commit cb77b79abf5ff8f4af07f7ebef196a003c826b7a Author: Tvrtko Ursulin Date: Wed Nov 12 09:27:32 2025 +0000 drm/gem: Use vmemdup_array_user in drm_gem_objects_lookup Use a helper to shrink the code and separate the user and kernel slabs for better security. While at it lets remove the useless debug message. Signed-off-by: Tvrtko Ursulin Reviewed-by: André Almeida Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251112092732.23584-1-tvrtko.ursulin@igalia.com commit dcb171931954c51a1a7250d558f02b8f36570783 Author: Sanjay Yadav Date: Tue Nov 18 17:19:00 2025 +0530 drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping metrics_lock. Since this lock protects the lifetime of oa_config, an attacker could guess the id and call xe_oa_remove_config_ioctl() with perfect timing, freeing oa_config before we dereference it, leading to a potential use-after-free. Fix this by caching the id in a local variable while holding the lock. v2: (Matt A) - Dropped mutex_unlock(&oa->metrics_lock) ordering change from xe_oa_remove_config_ioctl() Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6614 Fixes: cdf02fe1a94a7 ("drm/xe/oa/uapi: Add/remove OA config perf ops") Cc: # v6.11+ Suggested-by: Matthew Auld Signed-off-by: Sanjay Yadav Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20251118114859.3379952-2-sanjay.kumar.yadav@intel.com (cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31) Signed-off-by: Thomas Hellström commit 551801b5217ae1e7eb2b4e9d3ed2d045ebe24dc8 Author: Michał Winiarski Date: Fri Nov 14 13:23:39 2025 +0100 drm/xe/pf: Check for fence error on VRAM save/restore The code incorrectly assumes that the VRAM save/restore fence is valid. Fix it by checking for error. Fixes: 49cf1b9b609fe ("drm/xe/pf: Handle VRAM migration data as part of PF control") Suggested-by: Matthew Auld Reviewed-by: Matthew Auld Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251114122339.1791026-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 78ff838a8ab78b3cd438e382ff5204b93db3237e) Signed-off-by: Thomas Hellström commit 0fd2f9f39af97396dd6c4a24926ff41aa0e3ec75 Author: Michał Winiarski Date: Fri Nov 14 11:07:13 2025 +0100 drm/xe/pf: Drop the VF VRAM BO reference on successful restore The reference is only dropped on error. Fix it by adding the missing xe_bo_put(). Fixes: 49cf1b9b609fe ("drm/xe/pf: Handle VRAM migration data as part of PF control") Reported-by: Adam Miszczak Reviewed-by: Matthew Auld Link: https://patch.msgid.link/20251114100713.1776073-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit dab751b4240f0f0eadea81f93ff0b439379bc6ae) Signed-off-by: Thomas Hellström commit 4bb927139c4c6526bed6618cb4948bb029bc1575 Author: Michał Winiarski Date: Fri Nov 14 14:40:30 2025 +0100 drm/xe/pf: Fix kernel-doc warning in migration_save_consume The kernel-doc for xe_sriov_pf_migration_save_consume() contained multiple "Return:" sections, causing a warning. Fix it by removing the extra line. Fixes: 67df4a5cbc583 ("drm/xe/pf: Add data structures and handlers for migration rings") Signed-off-by: Michał Winiarski Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251114134030.1795947-1-michal.winiarski@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 562b0f254d8b1515a1c8d2a650f940d4f719300e) Signed-off-by: Thomas Hellström commit dbf9b7bb0edfa192d43ebb41dd0e1041f8a9c5b0 Author: Bitterblue Smith Date: Thu Nov 20 16:13:49 2025 +0200 wifi: rtl8xxxu: Enable 40 MHz width by default 40 MHz support is hidden behind the ht40_2g module parameter with this comment: /* * Some APs will negotiate HT20_40 in a noisy environment leading * to miserable performance. Rather than defaulting to this, only * enable it if explicitly requested at module load time. */ This parameter was added in commit 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)"). Back then rtl8xxxu only supported RTL8723AU and the RTL8192CU family. It's entirely possible the miserable performance was due to mistakes in the channel switching function, which were fixed in a previous patch. Delete the ht40_2g module parameter. If someone still needs to disable 40 MHz support, cfg80211 has the module parameter cfg80211_disable_40mhz_24ghz. That works too. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/4f053103-adfd-4ead-acb3-ef69127a4bab@gmail.com commit 41a21d0ff3a0b05de78f9cbeb29945d0eb18102a Author: Bitterblue Smith Date: Thu Nov 20 16:13:17 2025 +0200 wifi: rtl8xxxu: Fix RX channel width reported by RTL8192FU The other chips report the RX channel width in the RX descriptor, but this one doesn't. Get the RX channel width from the PHY status. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/1c6c1fd4-92f6-4327-a24e-f0747ab21819@gmail.com commit fc44314a377ace14c76b7502cf0d785eb35e5cc4 Author: Bitterblue Smith Date: Thu Nov 20 16:12:35 2025 +0200 wifi: rtl8xxxu: Fix the 40 MHz subchannel for RTL8192EU, RTL8723BU rtl8xxxu_gen2_config_channel() was missing the subchannel setting. This function is used by RTL8192EU and RTL8723BU. This change seems to make no difference in my testing on channel 13 with either chip. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/a5de8d39-45c1-4667-ab4c-7109de6eb13d@gmail.com commit bdb4c850c368d4009a0b109b6135042540aca749 Author: Bitterblue Smith Date: Thu Nov 20 16:11:58 2025 +0200 wifi: rtl8xxxu: Make RTL8192CU, RTL8723AU TX with 40 MHz width Set the required fields in the TX descriptor to allow these chips to transmit with 40 MHz channel width when the access point supports it. Tested only with RTL8192CU, but these settings are identical for RTL8723AU. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/30d95228-69b2-48f9-8854-c98d2408c4d3@gmail.com commit 5511ba3de434892e5ef3594d6eabbd12b1629356 Author: Bitterblue Smith Date: Thu Nov 20 16:10:01 2025 +0200 wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU Flip the response rate subchannel. It was backwards, causing low speeds when using 40 MHz channel width. "iw dev ... station dump" showed a low RX rate, 11M or less. Also fix the channel width field of RF6052_REG_MODE_AG. Tested only with RTL8192CU, but these settings are identical for RTL8723AU. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/1f46571d-855b-43e1-8bfc-abacceb96043@gmail.com commit 04c7adb5871ad04c9e3fd645570e21c93f1b2f54 Author: Barry Song Date: Tue Oct 21 17:20:22 2025 +1300 dma-buf: system_heap: use larger contiguous mappings instead of per-page mmap We can allocate high-order pages, but mapping them one by one is inefficient. This patch changes the code to map as large a chunk as possible. The code looks somewhat complicated mainly because supporting mmap with a non-zero offset is a bit tricky. Using the micro-benchmark below, we see that mmap becomes 35X faster: #include #include #include #include #include #include #include #include #define SIZE (512UL * 1024 * 1024) #define PAGE 4096 #define STRIDE (PAGE/sizeof(int)) #define PAGES (SIZE/PAGE) int main(void) { int heap = open("/dev/dma_heap/system", O_RDONLY); struct dma_heap_allocation_data d = { .len = SIZE, .fd_flags = O_RDWR|O_CLOEXEC }; ioctl(heap, DMA_HEAP_IOCTL_ALLOC, &d); struct timespec t0, t1; clock_gettime(CLOCK_MONOTONIC, &t0); int *p = mmap(NULL, SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, d.fd, 0); clock_gettime(CLOCK_MONOTONIC, &t1); for (int i = 0; i < PAGES; i++) p[i*STRIDE] = i; for (int i = 0; i < PAGES; i++) if (p[i*STRIDE] != i) { fprintf(stderr, "mismatch at page %d\n", i); exit(1); } long ns = (t1.tv_sec-t0.tv_sec)*1000000000L + (t1.tv_nsec-t0.tv_nsec); printf("mmap 512MB took %.3f us, verify OK\n", ns/1000.0); return 0; } W/ patch: ~ # ./a.out mmap 512MB took 200266.000 us, verify OK ~ # ./a.out mmap 512MB took 198151.000 us, verify OK ~ # ./a.out mmap 512MB took 197069.000 us, verify OK ~ # ./a.out mmap 512MB took 196781.000 us, verify OK ~ # ./a.out mmap 512MB took 198102.000 us, verify OK ~ # ./a.out mmap 512MB took 195552.000 us, verify OK W/o patch: ~ # ./a.out mmap 512MB took 6987470.000 us, verify OK ~ # ./a.out mmap 512MB took 6970739.000 us, verify OK ~ # ./a.out mmap 512MB took 6984383.000 us, verify OK ~ # ./a.out mmap 512MB took 6971311.000 us, verify OK ~ # ./a.out mmap 512MB took 6991680.000 us, verify OK Signed-off-by: Barry Song Acked-by: John Stultz Reviewed-by: Maxime Ripard Signed-off-by: Sumit Semwal [sumits: correct from 3.5x to 35x] Link: https://patch.msgid.link/20251021042022.47919-1-21cnbao@gmail.com commit c3852d2ca46503c00866d8eea5e18bb67d981f9b Author: Christian Marangi Date: Thu Nov 20 14:35:02 2025 +0100 cpufreq: qcom-nvmem: fix compilation warning for qcom_cpufreq_ipq806x_match_list If CONFIG_OF is not enabled, of_match_node() is set as NULL and qcom_cpufreq_ipq806x_match_list won't be used causing a compilation warning. Flag qcom_cpufreq_ipq806x_match_list as __maybe_unused to fix the compilation warning. While at it also flag as __initconst as it's used only in probe contest and can be freed after probe. This follows the pattern of the usual of_device_id variables. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511202119.6zvvFMup-lkp@intel.com/ Fixes: 58f5d39d5ed8 ("cpufreq: qcom-nvmem: add compatible fallback for ipq806x for no SMEM") Signed-off-by: Christian Marangi [ Viresh: Drop __initconst ] Signed-off-by: Viresh Kumar commit fa804aa4ac1b091ef2ec2981f08a1c28aaeba8e7 Merge: 56c069307dfd0a 5415d887db0e05 Author: Alex Williamson Date: Thu Nov 20 21:20:00 2025 -0700 Merge tag 'vfio-v6.19-dma-buf-v9+' into v6.19/vfio/next [v9] vfio/pci: Allow MMIO regions to be exported through dma-buf https://lore.kernel.org/all/20251120-dmabuf-vfio-v9-0-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 5415d887db0e059920cb5673a32cc4d66daa280f Author: Jason Gunthorpe Date: Thu Nov 20 11:28:30 2025 +0200 vfio/nvgrace: Support get_dmabuf_phys Call vfio_pci_core_fill_phys_vec() with the proper physical ranges for the synthetic BAR 2 and BAR 4 regions. Otherwise use the normal flow based on the PCI bar. This demonstrates a DMABUF that follows the region info report to only allow mapping parts of the region that are mmapable. Since the BAR is power of two sized and the "CXL" region is just page aligned the there can be a padding region at the end that is not mmaped or passed into the DMABUF. The "CXL" ranges that are remapped into BAR 2 and BAR 4 areas are not PCI MMIO, they actually run over the CXL-like coherent interconnect and for the purposes of DMA behave identically to DRAM. We don't try to model this distinction between true PCI BAR memory that takes a real PCI path and the "CXL" memory that takes a different path in the p2p framework for now. Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Reviewed-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-11-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 5d74781ebc86c5fa9e9d6934024c505412de9b52 Author: Leon Romanovsky Date: Thu Nov 20 11:28:29 2025 +0200 vfio/pci: Add dma-buf export support for MMIO regions Add support for exporting PCI device MMIO regions through dma-buf, enabling safe sharing of non-struct page memory with controlled lifetime management. This allows RDMA and other subsystems to import dma-buf FDs and build them into memory regions for PCI P2P operations. The implementation provides a revocable attachment mechanism using dma-buf move operations. MMIO regions are normally pinned as BARs don't change physical addresses, but access is revoked when the VFIO device is closed or a PCI reset is issued. This ensures kernel self-defense against potentially hostile userspace. Currently VFIO can take MMIO regions from the device's BAR and map them into a PFNMAP VMA with special PTEs. This mapping type ensures the memory cannot be used with things like pin_user_pages(), hmm, and so on. In practice only the user process CPU and KVM can safely make use of these VMA. When VFIO shuts down these VMAs are cleaned by unmap_mapping_range() to prevent any UAF of the MMIO beyond driver unbind. However, VFIO type 1 has an insecure behavior where it uses follow_pfnmap_*() to fish a MMIO PFN out of a VMA and program it back into the IOMMU. This has a long history of enabling P2P DMA inside VMs, but has serious lifetime problems by allowing a UAF of the MMIO after the VFIO driver has been unbound. Introduce DMABUF as a new safe way to export a FD based handle for the MMIO regions. This can be consumed by existing DMABUF importers like RDMA or DRM without opening an UAF. A following series will add an importer to iommufd to obsolete the type 1 code and allow safe UAF-free MMIO P2P in VM cases. DMABUF has a built in synchronous invalidation mechanism called move_notify. VFIO keeps track of all drivers importing its MMIO and can invoke a synchronous invalidation callback to tell the importing drivers to DMA unmap and forget about the MMIO pfns. This process is being called revoke. This synchronous invalidation fully prevents any lifecycle problems. VFIO will do this before unbinding its driver ensuring there is no UAF of the MMIO beyond the driver lifecycle. Further, VFIO has additional behavior to block access to the MMIO during things like Function Level Reset. This is because some poor platforms may experience a MCE type crash when touching MMIO of a PCI device that is undergoing a reset. Today this is done by using unmap_mapping_range() on the VMAs. Extend that into the DMABUF world and temporarily revoke the MMIO from the DMABUF importers during FLR as well. This will more robustly prevent an errant P2P from possibly upsetting the platform. A DMABUF FD is a preferred handle for MMIO compared to using something like a pgmap because: - VFIO is supported, including its P2P feature, on archs that don't support pgmap - PCI devices have all sorts of BAR sizes, including ones smaller than a section so a pgmap cannot always be created - It is undesirable to waste a lot of memory for struct pages, especially for a case like a GPU with ~100GB of BAR size - We want a synchronous revoke semantic to support FLR with light hardware requirements Use the P2P subsystem to help generate the DMA mapping. This is a significant upgrade over the abuse of dma_map_resource() that has historically been used by DMABUF exporters. Experience with an OOT version of this patch shows that real systems do need this. This approach deals with all the P2P scenarios: - Non-zero PCI bus_offset - ACS flags routing traffic to the IOMMU - ACS flags that bypass the IOMMU - though vfio noiommu is required to hit this. There will be further work to formalize the revoke semantic in DMABUF. For now this acts like a move_notify dynamic exporter where importer fault handling will get a failure when they attempt to map. This means that only fully restartable fault capable importers can import the VFIO DMABUFs. A future revoke semantic should open this up to more HW as the HW only needs to invalidate, not handle restartable faults. Signed-off-by: Jason Gunthorpe Signed-off-by: Vivek Kasireddy Reviewed-by: Kevin Tian Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-10-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 56baa9190988f35d53b1479a87c1bf44f6c979c6 Author: Vignesh Raghavendra Date: Thu Nov 20 20:04:19 2025 +0530 arm64: dts: ti: k3-am62l: Fix unit address of cbass_wakeup Fix the following warning with W=1: arch/arm64/boot/dts/ti/k3-am62l.dtsi:101.30-112.5: Warning (simple_bus_reg): /bus@f0000/bus@43000000: simple-bus unit address format error, expected "a80000" While at that, also remove extra space b/w label and node name. Fixes: 5f016758b0ab ("arm64: dts: ti: k3-am62l: add initial infrastructure") Link: https://patch.msgid.link/20251120143419.223238-1-vigneshr@ti.com Signed-off-by: Vignesh Raghavendra commit 51f89c488f2ecc020f82bfedd77482584ce8027a Author: Siddharth Vadapalli Date: Wed Nov 19 21:31:05 2025 +0530 arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator The SoC pin Y1 is incorrectly defined in the WKUP Pinmux device-tree node (pinctrl@4301c000) leading to the following silent failure: pinctrl-single 4301c000.pinctrl: mux offset out of range: 0x1dc (0x178) According to the datasheet for the J721E SoC [0], the pin Y1 belongs to the MAIN Pinmux device-tree node (pinctrl@11c000). This is confirmed by the address of the pinmux register for it on page 142 of the datasheet which is 0x00011C1DC. Hence fix it. [0]: https://www.ti.com/lit/ds/symlink/tda4vm.pdf Fixes: 97b67cc102dc ("arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators") Cc: stable@vger.kernel.org Signed-off-by: Siddharth Vadapalli Reviewed-by: Yemike Abhilash Chandra Link: https://patch.msgid.link/20251119160148.2752616-1-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 56ca5a3030143906d27a0ce3e999fdd633a6e91d Author: Rob Herring (Arm) Date: Thu Nov 20 19:49:36 2025 +0530 arm64: dts: ti: Add missing applied DT overlay targets It's a requirement that DT overlays be applied at build time in order to validate them as overlays are not validated on their own. Add the missing TI overlays. Some of the TI overlays have the first part needed (a "*-dtbs" variable), but not the second part adding the target to dtb-y/dtb- variable. Signed-off-by: Rob Herring (Arm) [vigneshr@ti.com: create new target for J721e GESI EVM] Link: https://patch.msgid.link/20251120141936.190796-1-vigneshr@ti.com Signed-off-by: Vignesh Raghavendra commit 2a2aae3655343b753dfef86b341be99f7273f2ba Author: Ping-Ke Shih Date: Thu Nov 20 11:10:43 2025 +0800 wifi: rtw89: 8852a: correct field mask of reset DAC/ADC FIFO The field mask should be bits 16-31, but suddenly use wrong bits 24-31, rarely causing a little performance degraded if DAC/DAC FIFO stays on an unexpected state. Found this by Geert who works on bit field functions. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-wireless/CAMuHMdVt+5yOA6tuasX4KQgZud5wtRwu0A15UkEfQJbcd_xvVw@mail.gmail.com/ Cc: Geert Uytterhoeven Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251120031044.12493-2-pkshih@realtek.com commit 9c194fe4625db18f93d5abcfb7f7997557a0b29d Author: Marco Crivellari Date: Tue Nov 18 11:20:32 2025 +0100 wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds the WQ_UNBOUND flag to explicitly request alloc_workqueue() to be unbound, because this specific workload has no benefit being per-cpu. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251118102032.54375-3-marco.crivellari@suse.com commit 7cbec00dc731e9ddb3cdb350d05cbc26d45b3273 Author: Marco Crivellari Date: Tue Nov 18 11:20:31 2025 +0100 wifi: rtlwifi: add WQ_UNBOUND to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds the WQ_UNBOUND flag to explicitly request alloc_workqueue() to be unbound, because this specific workload has no benefit being per-cpu. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251118102032.54375-2-marco.crivellari@suse.com commit d409f53d20933f8973d689568179a6c72fa78658 Merge: 3a8660878839fa fdc1dc7dd53b95 Author: Stephen Boyd Date: Thu Nov 20 19:40:09 2025 -0800 Merge tag 'clk-imx-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clk driver updates from Abel Vesa: - Add delay to the PCC enable/disable in i.MX7ULP composite, needed by some specific peripherals - Simplify the i.MX8MP auxiomix by using devm_auxiliary_device_create() - Add the i.MX8ULP SIM LPAV platform specific clock provider * tag 'clk-imx-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx: add driver for imx8ulp's sim lpav dt-bindings: clock: document 8ULP's SIM LPAV clk: imx: imx8mp-audiomix: use devm_auxiliary_device_create() to simple code clk: imx: Add some delay before deassert the reset commit b647d2574e4583c2e3b0ab35568f60c88e910840 Author: Seungjin Bae Date: Mon Nov 17 20:32:59 2025 -0500 wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() The rtl8187_rx_cb() calculates the rx descriptor header address by subtracting its size from the skb tail pointer. However, it does not validate if the received packet (skb->len from urb->actual_length) is large enough to contain this header. If a truncated packet is received, this will lead to a buffer underflow, reading memory before the start of the skb data area, and causing a kernel panic. Add length checks for both rtl8187 and rtl8187b descriptor headers before attempting to access them, dropping the packet cleanly if the check fails. Fixes: 6f7853f3cbe4 ("rtl8187: change rtl8187_dev.c to support RTL8187B (part 2)") Signed-off-by: Seungjin Bae Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251118013258.1789949-2-eeodqql09@gmail.com commit 1749001151d11b5296754a99f0e845cd2d904a87 Author: Adrian Barnaś Date: Tue Oct 28 15:20:11 2025 +0000 clk: actions: Fix discarding const qualifier by 'container_of' macro Remove const qualifier from functions parameter because it was discarded when container_of was called. Received pointer had mutable access to it through received container. Signed-off-by: Adrian Barnaś Signed-off-by: Stephen Boyd commit 23b2d2fb136959fd0a8e309c70be83d9b8841c7e Author: Charles Mirabile Date: Mon Nov 17 14:03:29 2025 -0500 clk: spacemit: Set clk_hw_onecell_data::num before using flex array When booting with KASAN enabled the following splat is encountered during probe of the k1 clock driver: UBSAN: array-index-out-of-bounds in drivers/clk/spacemit/ccu-k1.c:1044:16 index 0 is out of range for type 'clk_hw *[*]' CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc5+ #1 PREEMPT(lazy) Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2022.10spacemit 10/01/2022 Call Trace: [] dump_backtrace+0x28/0x38 [] show_stack+0x3a/0x50 [] dump_stack_lvl+0x5a/0x80 [] dump_stack+0x18/0x20 [] ubsan_epilogue+0x10/0x48 [] __ubsan_handle_out_of_bounds+0xa6/0xa8 [] k1_ccu_probe+0x37e/0x420 [] platform_probe+0x56/0x98 [] really_probe+0x9e/0x350 [] __driver_probe_device+0x80/0x138 [] driver_probe_device+0x3a/0xd0 [] __driver_attach+0xac/0x1b8 [] bus_for_each_dev+0x6c/0xc8 [] driver_attach+0x26/0x38 [] bus_add_driver+0x13e/0x268 [] driver_register+0x52/0x100 [] __platform_driver_register+0x28/0x38 [] k1_ccu_driver_init+0x22/0x38 [] do_one_initcall+0x62/0x2a0 [] do_initcalls+0x170/0x1a8 [] kernel_init_freeable+0x16a/0x1e0 [] kernel_init+0x2c/0x180 [] ret_from_fork_kernel+0x16/0x1d8 [] ret_from_fork_kernel_asm+0x16/0x18 ---[ end trace ]--- This is bogus and is simply a result of KASAN consulting the `.num` member of the struct for bounds information (as it should due to `__counted_by`) and finding 0 set by kzalloc() because it has not been initialized before the loop that fills in the array. The easy fix is to just move the line that sets `num` to before the loop that fills the array so that KASAN has the information it needs to accurately conclude that the access is valid. Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Tested-by: Yanko Kaneti Signed-off-by: Charles Mirabile Reviewed-by: Alex Elder Reviewed-by: Troy Mitchell Reviewed-by: Yixun Lan Signed-off-by: Stephen Boyd commit e2c20036a8879476c88002730d8a27f4e3c32d4b Merge: b8f2b678fcc3d7 8be656cfb931f7 Author: Jakub Kicinski Date: Thu Nov 20 19:01:24 2025 -0800 Merge branch 'devlink-net-mlx5-implement-swp_l4_csum_mode-via-devlink-params' Daniel Zahka says: ==================== devlink: net/mlx5: implement swp_l4_csum_mode via devlink params This series introduces a new devlink feature for querying param default values, and resetting params to their default values. This feature is then used to implement a new mlx5 driver param. The series starts with two pure refactor patches: one that passes through the extack to devlink_param::get() implementations. And a second small refactor that prepares the netlink tlv handling code in the devlink_param::get() path to better handle default parameter values. The third patch introduces the uapi and driver api for default parameter values. The driver api is opt-in, and both the uapi and driver api preserve existing behavior when not used by drivers or userspace. The fourth patch introduces a new mlx5 driver param, swp_l4_csum_mode, for controlling tx csum behavior. The "l4_only" value of this param is a dependency for PSP initialization on CX7 NICs. Lastly, the series introduces a new driver param with cmode runtime to netdevsim, and then uses this param in a new testcase for netdevsim devlink params. Here are some examples of using the default param uapi with the devlink cli. Note the devlink cli binary I am using has changes which I am posting in accompanying series targeting iproute2-next: # netdevsim ./devlink dev param show netdevsim/netdevsim0 netdevsim/netdevsim0: name max_macs type generic values: cmode driverinit value 32 default 32 name test1 type driver-specific values: cmode driverinit value true default true # set to false ./devlink dev param set netdevsim/netdevsim0 name test1 value false cmode driverinit ./devlink dev param show netdevsim/netdevsim0 netdevsim/netdevsim0: name max_macs type generic values: cmode driverinit value 32 default 32 name test1 type driver-specific values: cmode driverinit value false default true # set back to default ./devlink dev param set netdevsim/netdevsim0 name test1 default cmode driverinit ./devlink dev param show netdevsim/netdevsim0 netdevsim/netdevsim0: name max_macs type generic values: cmode driverinit value 32 default 32 name test1 type driver-specific values: cmode driverinit value true default true # mlx5 params on cx7 ./devlink dev param show pci/0000:01:00.0 pci/0000:01:00.0: name max_macs type generic values: cmode driverinit value 128 default 128 ... name swp_l4_csum_mode type driver-specific values: cmode permanent value default default default # set to l4_only ./devlink dev param set pci/0000:01:00.0 name swp_l4_csum_mode value l4_only cmode permanent ./devlink dev param show pci/0000:01:00.0 name swp_l4_csum_mode pci/0000:01:00.0: name swp_l4_csum_mode type driver-specific values: cmode permanent value l4_only default default # reset to default ./devlink dev param set pci/0000:01:00.0 name swp_l4_csum_mode default cmode permanent ./devlink dev param show pci/0000:01:00.0 name swp_l4_csum_mode pci/0000:01:00.0: name swp_l4_csum_mode type driver-specific values: cmode permanent value default default default ==================== Link: https://patch.msgid.link/20251119025038.651131-1-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 8be656cfb931f79b3971407622422c62575abf90 Author: Daniel Zahka Date: Tue Nov 18 18:50:36 2025 -0800 selftest: netdevsim: test devlink default params Test querying default values and resetting to default values for netdevsim devlink params. This should cover the basic paths of interest: driverinit and non-driverinit cmodes, as well as bool and non-bool value type. Default param values of type bool are encoded with u8 netlink type as opposed to flag type, so that userspace can distinguish "not-present" from false. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251119025038.651131-7-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 72924056ebacbfcdc8de7a1f7e8769ce2198a987 Author: Daniel Zahka Date: Tue Nov 18 18:50:35 2025 -0800 netdevsim: register a new devlink param with default value interface Create a new devlink param, test2, that supports default param actions via the devlink_param::get_default() and devlink_param::reset_default() functions. Reviewed-by: Aleksandr Loktionov Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251119025038.651131-6-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit b11d358bf8c306b18a86322d0d8d2549e971be97 Author: Daniel Zahka Date: Tue Nov 18 18:50:34 2025 -0800 net/mlx5: implement swp_l4_csum_mode via devlink params swp_l4_csum_mode controls how L4 transmit checksums are computed when using Software Parser (SWP) hints for header locations. Supported values: 1. default: device will choose between full_csum or l4_only. Driver will discover the device's choice during initialization. 2. full_csum: calculate L4 checksum with the pseudo-header. 3. l4_only: calculate L4 checksum without the pseudo-header. Only available when swp_l4_csum_mode_l4_only is set in mlx5_ifc_nv_sw_offload_cap_bits. Note that 'default' might be returned from the device and passed to userspace, and it might also be set during a devlink_param::reset_default() call, but attempts to set a value of default directly with param-set will be rejected. The l4_only setting is a dependency for PSP initialization in mlx5e_psp_init(). Reviewed-by: Aleksandr Loktionov Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251119025038.651131-5-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 2a367002ed321e884276c3d7232a362ddd1bf7d6 Author: Daniel Zahka Date: Tue Nov 18 18:50:33 2025 -0800 devlink: support default values for param-get and param-set Support querying and resetting to default param values. Introduce two new devlink netlink attrs: DEVLINK_ATTR_PARAM_VALUE_DEFAULT and DEVLINK_ATTR_PARAM_RESET_DEFAULT. The former is used to contain an optional parameter value inside of the param_value nested attribute. The latter is used in param-set requests from userspace to indicate that the driver should reset the param to its default value. To implement this, two new functions are added to the devlink driver api: devlink_param::get_default() and devlink_param::reset_default(). These callbacks allow drivers to implement default param actions for runtime and permanent cmodes. For driverinit params, the core latches the last value set by a driver via devl_param_driverinit_value_set(), and uses that as the default value for a param. Because default parameter values are optional, it would be impossible to discern whether or not a param of type bool has default value of false or not provided if the default value is encoded using a netlink flag type. For this reason, when a DEVLINK_PARAM_TYPE_BOOL has an associated default value, the default value is encoded using a u8 type. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251119025038.651131-4-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 17a42aa465c000fccdcf581950d2c6f4e0c343ca Author: Daniel Zahka Date: Tue Nov 18 18:50:32 2025 -0800 devlink: refactor devlink_nl_param_value_fill_one() Lift the param type demux and value attr placement into a separate function. This new function, devlink_nl_param_put(), can be used to place additional types values in the value array, e.g., default, current, next values. This commit has no functional change. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251119025038.651131-3-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 011d133bb988f80d597a9cbdab659414ba7ff72b Author: Daniel Zahka Date: Tue Nov 18 18:50:31 2025 -0800 devlink: pass extack through to devlink_param::get() Allow devlink_param::get() handlers to report error messages via extack. This function is called in a few different contexts, but not all of them will have an valid extack to use. When devlink_param::get() is called from param_get_doit or param_get_dumpit contexts, pass the extack through so that drivers can report errors when retrieving param values. devlink_param::get() is called from the context of devlink_param_notify(), pass NULL in for the extack. Reviewed-by: Saeed Mahameed Reviewed-by: Aleksandr Loktionov Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251119025038.651131-2-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit b65e179b986a4812ed38486050a438ce57a873b9 Author: Yuji Ishikawa Date: Fri Nov 14 16:05:12 2025 +0900 clk: visconti: Add VIIF clocks Add the control sequence of register bits to handle the clocks and the resets of Video Input Interface. Signed-off-by: Yuji Ishikawa Signed-off-by: Stephen Boyd commit beeff790c5679b3eacc8ee7021f775f447f47603 Author: Yuji Ishikawa Date: Fri Nov 14 16:05:11 2025 +0900 dt-bindings: clock: tmpv770x: Add VIIF clocks Add clock and reset identifiers for the Video Input Interface. These identifiers support two instances: VIIF0 and VIIF1. Signed-off-by: Yuji Ishikawa Acked-by: Conor Dooley Signed-off-by: Stephen Boyd commit d10f26a7abbd3dd5d59bac1acdca117385b54ea9 Author: Yuji Ishikawa Date: Fri Nov 14 15:53:58 2025 +0900 dt-bindings: clock: tmpv770x: Remove definition of number of clocks Remove the definitions of number of clocks from bindings because they prevent adding new clocks. Since the previous patch removed all refereces within the driver, they can now be deleted. The same for resets and plls. Signed-off-by: Yuji Ishikawa Acked-by: Conor Dooley Signed-off-by: Stephen Boyd commit 67e41dbc268a521a61acca25b6cbc70592488b19 Author: Yuji Ishikawa Date: Fri Nov 14 15:53:57 2025 +0900 clk: visconti: Do not define number of clocks in bindings Remove use of TMPV770X_NR_CLK. Instead, define number of clocks inside the driver directory. The same for TMPV770X_NR_RESET and TMPV770X_NR_PLL. Signed-off-by: Yuji Ishikawa Signed-off-by: Stephen Boyd commit b8f2b678fcc3d7fd2fcf1db5ddcbd67ef64a0234 Merge: 920fa394dcdaf4 5ad9945341725c Author: Jakub Kicinski Date: Thu Nov 20 18:47:20 2025 -0800 Merge branch 'netconsole-allow-userdata-buffer-to-grow-dynamically' Gustavo Luiz Duarte says: ==================== netconsole: Allow userdata buffer to grow dynamically The current netconsole implementation allocates a static buffer for extradata (userdata + sysdata) with a fixed size of MAX_EXTRADATA_ENTRY_LEN * MAX_EXTRADATA_ITEMS bytes for every target, regardless of whether userspace actually uses this feature. This forces us to keep MAX_EXTRADATA_ITEMS small (16), which is restrictive for users who need to attach more metadata to their log messages. This patch series enables dynamic allocation of the userdata buffer, allowing it to grow on-demand based on actual usage. The series: 1. Refactors send_fragmented_body() to simplify handling of separated userdata and sysdata (patch 1/4) 2. Splits userdata and sysdata into separate buffers (patch 2/4) 3. Implements dynamic allocation for the userdata buffer (patch 3/4) 4. Increases MAX_USERDATA_ITEMS from 16 to 256 now that we can do so without memory waste (patch 4/4) Benefits: - No memory waste when userdata is not used - Targets that use userdata only consume what they need - Users can attach significantly more metadata without impacting systems that don't use this feature ==================== Link: https://patch.msgid.link/20251119-netconsole_dynamic_extradata-v3-0-497ac3191707@meta.com Signed-off-by: Jakub Kicinski commit 5ad9945341725c575a58a35e154a08ea81b3439a Author: Gustavo Luiz Duarte Date: Wed Nov 19 16:14:52 2025 -0800 netconsole: Increase MAX_USERDATA_ITEMS Increase MAX_USERDATA_ITEMS from 16 to 256 entries now that the userdata buffer is allocated dynamically. The previous limit of 16 was necessary because the buffer was statically allocated for all targets. With dynamic allocation, we can support more entries without wasting memory on targets that don't use userdata. This allows users to attach more metadata to their netconsole messages, which is useful for complex debugging and logging scenarios. Also update the testcase accordingly. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20251119-netconsole_dynamic_extradata-v3-4-497ac3191707@meta.com Signed-off-by: Jakub Kicinski commit eb83801af2dcf60dc10d7c0f5d9cb8289b2af260 Author: Gustavo Luiz Duarte Date: Wed Nov 19 16:14:51 2025 -0800 netconsole: Dynamic allocation of userdata buffer The userdata buffer in struct netconsole_target is currently statically allocated with a size of MAX_USERDATA_ITEMS * MAX_EXTRADATA_ENTRY_LEN (16 * 256 = 4096 bytes). This wastes memory when userdata entries are not used or when only a few entries are configured, which is common in typical usage scenarios. It also forces us to keep MAX_USERDATA_ITEMS small to limit the memory wasted. Change the userdata buffer from a static array to a dynamically allocated pointer. The buffer is now allocated on-demand in update_userdata() whenever userdata entries are added, modified, or removed via configfs. The implementation calculates the exact size needed for all current userdata entries, allocates a new buffer of that size, formats the entries into it, and atomically swaps it with the old buffer. This approach provides several benefits: - Memory efficiency: Targets with no userdata use zero bytes instead of 4KB, and targets with userdata only allocate what they need; - Scalability: Makes it practical to increase MAX_USERDATA_ITEMS to a much larger value without imposing a fixed memory cost on every target; - No hot-path overhead: Allocation occurs during configuration (write to configfs), not during message transmission If memory allocation fails during userdata update, -ENOMEM is returned to userspace through the configfs attribute write operation. The sysdata buffer remains statically allocated since it has a smaller fixed size (MAX_SYSDATA_ITEMS * MAX_EXTRADATA_ENTRY_LEN = 4 * 256 = 1024 bytes) and its content length is less predictable. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20251119-netconsole_dynamic_extradata-v3-3-497ac3191707@meta.com Signed-off-by: Jakub Kicinski commit 9dc10f50c430d861d4f3d5d0b38efd675f6d76ae Author: Gustavo Luiz Duarte Date: Wed Nov 19 16:14:50 2025 -0800 netconsole: Split userdata and sysdata Separate userdata and sysdata into distinct buffers to enable independent management. Previously, both were stored in a single extradata_complete buffer with a fixed size that accommodated both types of data. This separation allows: - userdata to grow dynamically (in subsequent patch) - sysdata to remain in a small static buffer - removal of complex entry counting logic that tracked both types together The split also simplifies the code by eliminating the need to check total entry count across both userdata and sysdata when enabling features, which allows to drop holding su_mutex on sysdata_*_enabled_store(). No functional change in this patch, just structural preparation for dynamic userdata allocation. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20251119-netconsole_dynamic_extradata-v3-2-497ac3191707@meta.com Signed-off-by: Jakub Kicinski commit 7279b718b431701137f9943434229915222a70b8 Author: Gustavo Luiz Duarte Date: Wed Nov 19 16:14:49 2025 -0800 netconsole: Simplify send_fragmented_body() Refactor send_fragmented_body() to use separate offset tracking for msgbody, and extradata instead of complex conditional logic. The previous implementation used boolean flags and calculated offsets which made the code harder to follow. The new implementation maintains independent offset counters (msgbody_offset, extradata_offset) and processes each section sequentially, making the data flow more straightforward and the code easier to maintain. This is a preparatory refactoring with no functional changes, which will allow easily splitting extradata_complete into separate userdata and sysdata buffers in the next patch. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20251119-netconsole_dynamic_extradata-v3-1-497ac3191707@meta.com Signed-off-by: Jakub Kicinski commit 920fa394dcdaf4aa9c89433d07c3c17fd17dee25 Author: Byungchul Park Date: Thu Nov 20 10:11:18 2025 +0900 eth: fbnic: access @pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make fbnic access @pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20251120011118.73253-1-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 7043aa16f34dc758d115ffc8aed8350f42cd5dc9 Merge: a7687b292ef101 bd31490718b47d Author: Jakub Kicinski Date: Thu Nov 20 18:40:15 2025 -0800 Merge branch 'net-fec-do-some-cleanup-for-the-driver' Wei Fang says: ==================== net: fec: do some cleanup for the driver This patch set removes some unnecessary or invalid code from the FEC driver. See each patch for details. ==================== Link: https://patch.msgid.link/20251119025148.2817602-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit bd31490718b47d91b0926619635ba967505457e7 Author: Wei Fang Date: Wed Nov 19 10:51:48 2025 +0800 net: fec: remove duplicate macros of the BD status There are two sets of macros used to define the status bits of TX and RX BDs, one is the BD_SC_xx macros, the other one is the BD_ENET_xx macros. For the BD_SC_xx macros, only BD_SC_WRAP is used in the driver. But the BD_ENET_xx macros are more widely used in the driver, and they define more bits of the BD status. Therefore, remove the BD_SC_xx macros from now on. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20251119025148.2817602-6-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 3bb06c8a461b8c8714eef5094b1fadd2d066dd1a Author: Wei Fang Date: Wed Nov 19 10:51:47 2025 +0800 net: fec: remove rx_align from fec_enet_private The rx_align was introduced by the commit 41ef84ce4c72 ("net: fec: change FEC alignment according to i.mx6 sx requirement"). Because the i.MX6 SX requires RX buffer must be 64 bytes alignment. Since the commit 95698ff6177b ("net: fec: using page pool to manage RX buffers"), the address of the RX buffer is always the page address plus FEC_ENET_XDP_HEADROOM which is 256 bytes, so the RX buffer is always 64-byte aligned. Therefore, rx_align has no effect since that commit, and we can safely remove it. In addition, to prevent future modifications to FEC_ENET_XDP_HEADROOM, a BUILD_BUG_ON() test has been added to the driver, which ensures that FEC_ENET_XDP_HEADROOM provides the required alignment. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251119025148.2817602-5-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 63083d597adabffd12ecb879dbae3556e87ee277 Author: Wei Fang Date: Wed Nov 19 10:51:46 2025 +0800 net: fec: remove struct fec_enet_priv_txrx_info The struct fec_enet_priv_txrx_info has three members: offset, page and skb. The offset is only initialized in the driver and is not used, the skb is never initialized and used in the driver. The both will not be used in the future. Therefore, replace struct fec_enet_priv_txrx_info directly with struct page. Signed-off-by: Wei Fang Reviewed-by: Frank Li Link: https://patch.msgid.link/20251119025148.2817602-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit eef7b786bdab146047d0372eff9f6bd16cffe415 Author: Wei Fang Date: Wed Nov 19 10:51:45 2025 +0800 net: fec: simplify the conditional preprocessor directives From the Kconfig file, we can see CONFIG_FEC depends on the following platform-related options. ColdFire: M523x, M527x, M5272, M528x, M520x and M532x S32: ARCH_S32 (ARM64) i.MX: SOC_IMX28 and ARCH_MXC (ARM and ARM64) Based on the code of fec driver, only some macro definitions on the M5272 platform are different from those on other platforms. Therefore, we can simplify the following complex preprocessor directives to "if !defined(CONFIG_M5272)". "#if defined(CONFIG_M523x) || defined(CONFIG_M527x) || \ defined(CONFIG_M528x) || defined(CONFIG_M520x) || \ defined(CONFIG_M532x) || defined(CONFIG_ARM) || \ defined(CONFIG_ARM64)" Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251119025148.2817602-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 3eea593b5597e580def9658aa6397e1057f27acd Author: Wei Fang Date: Wed Nov 19 10:51:44 2025 +0800 net: fec: remove useless conditional preprocessor directives The conditional preprocessor directive was added to fix build errors on the MCF5272 platform, see commit d13919301d9a ("net: fec: Fix build for MCF5272"). The compilation errors were originally caused by some register macros not being defined on that platform. The driver now uses quirks to dynamically handle platform differences, and for MCF5272, its quirks is 0, so it does not support RACC and GBIT Ethernet. So these preprocessor directives are no longer required and can be safely removed without causing build or functional issue. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20251119025148.2817602-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 Author: Chen Ridong Date: Fri Nov 14 02:08:47 2025 +0000 cpuset: Treat cpusets in attaching as populated Currently, the check for whether a partition is populated does not account for tasks in the cpuset of attaching. This is a corner case that can leave a task stuck in a partition with no effective CPUs. The race condition occurs as follows: cpu0 cpu1 //cpuset A with cpu N migrate task p to A cpuset_can_attach // with effective cpus // check ok // cpuset_mutex is not held // clear cpuset.cpus.exclusive // making effective cpus empty update_exclusive_cpumask // tasks_nocpu_error check ok // empty effective cpus, partition valid cpuset_attach ... // task p stays in A, with non-effective cpus. To fix this issue, this patch introduces cs_is_populated, which considers tasks in the attaching cpuset. This new helper is used in validate_change and partition_is_populated. Fixes: e2d59900d936 ("cgroup/cpuset: Allow no-task partition to have empty cpuset.cpus.effective") Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit a7687b292ef101b8fb21571eac418c90fab6f304 Merge: 8b4e023d79b760 5fb9a0b89e2ab9 Author: Jakub Kicinski Date: Thu Nov 20 18:21:32 2025 -0800 Merge branch 'net-add-1600gbps-1-6t-link-mode-support' Tariq Toukan says: ==================== net: Add 1600Gbps (1.6T) link mode support This series by Yael adds 1600Gbps (1.6T) link mode support. See detailed description by Yael below. ==================== Link: https://patch.msgid.link/1763585297-1243980-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5fb9a0b89e2ab959547cd684f497bd31bcb3261f Author: Yael Chemla Date: Wed Nov 19 22:48:17 2025 +0200 bonding: 3ad: Add support for 1600G speed Add support for 1600Gbps speed to allow using 3ad mode with 1600G devices. Signed-off-by: Yael Chemla Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763585297-1243980-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit be3a435df74b3e84037fcc23ade68e01c4ed541f Author: Yael Chemla Date: Wed Nov 19 22:48:16 2025 +0200 net/mlx5e: Add 1600Gbps link modes Introduce support for a 1600Gbps link mode, utilizing 8 lanes at 200Gbps per lane. Signed-off-by: Yael Chemla Reviewed-by: Shahar Shitrit Reviewed-by: Leon Romanovsky Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763585297-1243980-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 491c5dc98b848c4781addd514caed95039e5366c Author: Yael Chemla Date: Wed Nov 19 22:48:15 2025 +0200 net: ethtool: Add support for 1600Gbps speed Add support for 1600Gbps link modes based on 200Gbps per lane [1]. This includes the adopted IEEE 802.3dj copper and optical PMDs that use 200G/lane signaling [2]. Add the following PMD types: - KR8 (backplane) - CR8 (copper cable) - DR8 (SMF 500m) - DR8-2 (SMF 2km) These modes are defined in the 802.3dj specifications. References: [1] https://www.ieee802.org/3/dj/public/23_03/opsasnick_3dj_01a_2303.pdf [2] https://www.ieee802.org/3/dj/projdoc/objectives_P802d3dj_240314.pdf Signed-off-by: Yael Chemla Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/1763585297-1243980-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 8b4e023d79b760d217dd1c462848c4a27fcc7677 Author: Zahari Doychev Date: Wed Nov 19 21:36:18 2025 +0100 ynl: samples: add tc filter example Add a sample tool demonstrating how to add, dump, and delete a flower filter with two VLAN push actions. The example can be invoked as: # samples/tc-filter-add p2 flower pref 1 proto: 0x8100 flower: vlan_id: 100 vlan_prio: 5 num_of_vlans: 3 action order: 1 vlan push id 200 protocol 0x8100 priority 0 action order: 2 vlan push id 300 protocol 0x8100 priority 0 This verifies correct handling of tc action attributes for multiple VLAN push actions. The tc action indexed arrays start from index 1, and the index defines the action order. This behavior differs from the YNL specification, which expects arrays to be zero-based. To accommodate this, the example adds a dummy action at index 0, which is ignored by the kernel. Signed-off-by: Zahari Doychev Link: https://patch.msgid.link/20251119203618.263780-2-zahari.doychev@linux.com Signed-off-by: Jakub Kicinski commit b64ea1c5f4b7a5a8fcd223255ac0b748492cdb9f Merge: d99b408ed8e5f7 bd28e5bddc1a75 Author: Jakub Kicinski Date: Thu Nov 20 18:19:33 2025 -0800 Merge branch 'selftests-drv-net-convert-gro-and-toeplitz-tests-to-work-for-drivers-in-nipa' Jakub Kicinski says: ==================== selftests: drv-net: convert GRO and Toeplitz tests to work for drivers in NIPA Main objective of this series is to convert the gro.sh and toeplitz.sh tests to be "NIPA-compatible" - meaning make use of the Python env, which lets us run the tests against either netdevsim or a real device. The tests seem to have been written with a different flow in mind. Namely they source different bash "setup" scripts depending on arguments passed to the test. While I have nothing against the use of bash and the overall architecture - the existing code needs quite a bit of work (don't assume MAC/IP addresses, support remote endpoint over SSH). If I'm the one fixing it, I'd rather convert them to our "simplistic" Python. This series rewrites the tests in Python while addressing their shortcomings. The functionality of running the test over loopback on a real device is retained but with a different method of invocation (see the last patch). Once again we are dealing with a script which run over a variety of protocols (combination of [ipv4, ipv6, ipip] x [tcp, udp]). The first 4 patches add support for test variants to our scripts. We use the term "variant" in the same sense as the C kselftest_harness.h - variant is just a set of static input arguments. Note that neither GRO nor the Toeplitz test fully passes for me on any HW I have access to. But this is unrelated to the conversion. This series is not making any real functional changes to the tests, it is limited to improving the "test harness" scripts. ==================== Link: https://patch.msgid.link/20251120021024.2944527-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit bd28e5bddc1a75089fd1c45bd58892d9399097c4 Author: Jakub Kicinski Date: Wed Nov 19 18:10:24 2025 -0800 selftests: net: remove old setup_* scripts gro.sh and toeplitz.sh used to source in one of two setup scripts depending on whether the test was expected to be run against veth or a real device. veth testing is replaced by netdevsim and existing "remote endpoint" support in our Python tests. Add a script which sets up loopback mode. The usage is a little bit more complicated than running the scripts used to be. Testing used to work like this: ./../gro.sh -i eth0 ... now the "setup script" has to be run explicitly: NETIF=eth0 ./../ksft_setup_loopback.sh ./../gro.sh But the functionality itself is retained. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-13-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 358008f41d9b893f0c843cb8b941954e0acbf8ec Author: Jakub Kicinski Date: Wed Nov 19 18:10:23 2025 -0800 netdevsim: add loopback support Support device loopback. Apparently this mode has been historically supported by the toeplitz test and I don't have any HW which lets me test the conversion.. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-12-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9cf9aa77a1f6339ac97ac4afe44939cf0974ef96 Author: Jakub Kicinski Date: Wed Nov 19 18:10:22 2025 -0800 selftests: drv-net: hw: convert the Toeplitz test to Python Rewrite the existing toeplitz.sh test in Python. The conversion is a lot less exact than the GRO one. We use Netlink APIs to get the device RSS and IRQ information. We expect that the device has neither RPS nor RFS configured, and set RPS up as part of the test. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fdb0267d565ab51b7b81d4c530135a5e77e34ff2 Author: Jakub Kicinski Date: Wed Nov 19 18:10:21 2025 -0800 selftests: drv-net: add a Python version of the GRO test Rewrite the existing gro.sh test in Python. The conversion not exact, the changes are related to integrating the test with our "remote endpoint" paradigm. The test now reads the IP addresses from the user config. It resolves the MAC address (including running over Layer 3 networks). Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 40dd789bc5a76066fe3dc40328b609f8302f6216 Author: Jakub Kicinski Date: Wed Nov 19 18:10:20 2025 -0800 netdevsim: pass packets thru GRO on Rx To replace veth in software GRO testing with netdevsim we need GRO support in netdevsim. Luckily we already have NAPI support so this change is trivial (compared to veth). Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 15011a57d0ec95d7ee7d5c1a4b108b9ee3c9ee31 Author: Jakub Kicinski Date: Wed Nov 19 18:10:19 2025 -0800 selftests: net: py: read ip link info about remote dev We're already saving the info about the local dev in env.dev for the tests, save remote dev as well. This is more symmetric, env generally provides the same info for local and remote end. While at it make sure that we reliably get the detailed info about the local dev. nsim used to read the dev info without -d. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e02b52ecef5ba468f55ed0dc38de6016424d9703 Author: Jakub Kicinski Date: Wed Nov 19 18:10:18 2025 -0800 selftests: net: py: support ksft ready without wait There's a common synchronization problem when a script (Python test) uses a C program to set up some state (usually start a receiving process for traffic). The script needs to know when the process has fully initialized. The inverse of the problem exists for shutting the process down - we need a reliable way to tell the process to exit. We added helpers to do this safely in commit 71477137994f ("selftests: drv-net: add a way to wait for a local process") unfortunately the two operations (wait for init, and shutdown) are controlled by a single parameter (ksft_wait). Add support for using ksft_ready without using the second fd for exit. This is useful for programs which wait for a specific number of packets to rx so exit_wait is a good match, but we still need to wait for init. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Reviewed-by: breno Leitao Link: https://patch.msgid.link/20251120021024.2944527-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 89268f7dbca1842cd38d3a4578ba7e3b6789c5ad Author: Jakub Kicinski Date: Wed Nov 19 18:10:17 2025 -0800 selftests: net: relocate gro and toeplitz tests to drivers/net The GRO test can run on a real device or a veth. The Toeplitz hash test can only run on a real device. Move them from net/ to drivers/net/ and drivers/net/hw/ respectively. There are two scripts which set up the environment for these tests setup_loopback.sh and setup_veth.sh. Move those scripts to net/lib. The paths to the setup files are a little ugly but they will be deleted shortly. toeplitz_client.sh is not a test in itself, but rather a helper to send traffic, so add it to TEST_FILES rather than TEST_PROGS. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 173227d7d6c4902a017ba9bbf3fb0d99f021f478 Author: Jakub Kicinski Date: Wed Nov 19 18:10:16 2025 -0800 selftests: drv-net: xdp: use variants for qstat tests Use just-added ksft variants for XDP qstat tests. While at it correct the number of packets, we're sending 1000 packets now. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6ae67f115986734bc24dfed5cee1daafb5351623 Author: Jakub Kicinski Date: Wed Nov 19 18:10:15 2025 -0800 selftests: net: py: add test variants There's a lot of cases where we try to re-run the same code with different parameters. We currently need to either use a generator method or create a "main" case implementation which then gets called by trivial case functions: def _test(x, y, z): ... def case_int(): _test(1, 2, 3) def case_str(): _test('a', 'b', 'c') Add support for variants, similar to kselftests_harness.h and a lot of other frameworks. Variants can be added as decorator to test functions: @ksft_variants([(1, 2, 3), ('a', 'b', 'c')]) def case(x, y, z): ... ksft_run() will auto-generate case names: case.1_2_3 case.a_b_c Because the names may not always be pretty (and to avoid forcing classes to implement case-friendly __str__()) add a wrapper class KsftNamedVariant which lets the user specify the name for the variant. Note that ksft_run's args are still supported. ksft_run splices args and variant params together. Reviewed-by: Willem de Bruijn Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251120021024.2944527-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 80970e0fc07ecb1fbaefeb2c912aa2b0c04ed557 Author: Jakub Kicinski Date: Wed Nov 19 18:10:14 2025 -0800 selftests: net: py: extract the case generation logic In preparation for adding test variants move the test case collection logic to a dedicated function. New helper returns (function, args, name, ) tuples. The main test loop can simply run them, not much logic or discernment needed. Reviewed-by: Petr Machata Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20251120021024.2944527-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5cb7b71b76f1235ee2064c30922864f24e31a076 Author: Jakub Kicinski Date: Wed Nov 19 18:10:13 2025 -0800 selftests: net: py: coding style improvements We're about to add more features here and finding new issues with old ones in place is hard. Address ruff checks: - bare exceptions - f-string with no params - unused import We need to use BaseException when handling defer(), as Petr points out. This retains the old behavior of ignoring SIGTERM while running cleanups. Reviewed-by: Willem de Bruijn Reviewed-by: Petr Machata Link: https://patch.msgid.link/20251120021024.2944527-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d99b408ed8e5f7c070274f4d6c73023b2aae22b3 Author: Heiner Kallweit Date: Wed Nov 19 07:55:47 2025 +0100 net: phy: fixed_phy: remove not needed initialization of phy_device members All these members are populated by the phylib state machine once the PHY has been started, based on the fixed autoneg results. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/bc666a53-5469-4e9c-85a1-dd285aadfe4f@gmail.com Signed-off-by: Jakub Kicinski commit bd048f8ce6ce8d5e16415fd6f7506e916cb3d418 Author: Heiner Kallweit Date: Wed Nov 19 08:05:45 2025 +0100 net: phy: fixed_phy: fix missing initialization of fixed phy link Original change remove the link initialization from the passed struct fixed_phy_status, but @status is also passed to __fixed_phy_add(), where it is saved. Make sure that copy also has link set to 1. Fixes: 9f07af1d2742 ("net: phy: fixed_phy: initialize the link status as up") Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/dab6c10e-725e-4648-9662-39cc821723d0@gmail.com Signed-off-by: Jakub Kicinski commit 862f670205f718bf54a8f3b54b5ca28de33ff33e Author: ke zijie Date: Thu Nov 20 10:27:28 2025 +0800 docs/zh_CN: Add data-integrity.rst translation Translate .../block/data-integrity.rst into Chinese. Add data-integrity into .../block/index.rst. Update the translation through commit c6e56cf6b2e7 ("block: move integrity information into queue_limits") Reviewed-by: Yanteng Si Reviewed-by: WangYuli Signed-off-by: ke zijie Signed-off-by: Alex Shi commit dcb7fefe5296f6673da1d9101169a45d1fdc31da Author: ke zijie Date: Thu Nov 20 10:27:27 2025 +0800 docs/zh_CN: Add blk-mq.rst translation Translate .../block/blk-mq.rst into Chinese. Add blk-mq into .../block/index.rst. Update the translation through commit 41bd33df4e18 ("docs: block: blk-mq.rst: correct places -> place") Reviewed-by: Yanteng Si Reviewed-by: WangYuli Signed-off-by: ke zijie Signed-off-by: Alex Shi commit a41b1f1521d5d1cfdd983d38a5e02a2bf9b06182 Author: ke zijie Date: Thu Nov 20 10:27:26 2025 +0800 docs/zh_CN: Add block/index.rst translation Translate .../block/index.rst into Chinese and update subsystem-apis.rst translation. Update the translation through commit 56cdea92ed91 ("Documentation/block: drop the request.rst file") Reviewed-by: Yanteng Si Reviewed-by: WangYuli Signed-off-by: ke zijie Signed-off-by: Alex Shi commit 6132026df02a6bb95dc3d909946234910f099b8a Author: Chenguang Zhao Date: Mon Nov 17 17:30:41 2025 +0800 docs/zh_CN: Update the Chinese translation of kbuild.rst Finish the translation of kbuild/kbuild.rst. Update to commit 5cbfb4da7e06 ("kbuild: doc: improve KBUILD_BUILD_TIMESTAMP documentation") Signed-off-by: Chenguang Zhao Reviewed-by: WangYuli Reviewed-by: Dongliang Mu Signed-off-by: Alex Shi commit 58673d10d5a9fe3f2a6babbfbf9d780e62e6b18b Merge: 22eaa206fcacc5 5894cab4e1b973 Author: Jakub Kicinski Date: Thu Nov 20 18:04:00 2025 -0800 Merge branch 'net-phy-adin1100-fix-powerdown-mode-setting' Alexander Dahl says: ==================== net: phy: adin1100: Fix powerdown mode setting while building a new device around the ADIN1100 I noticed some errors in kernel log when calling `ifdown` on the ethernet device. Series has a straight forward fix and an obvious follow-up code simplification. ==================== Link: https://patch.msgid.link/20251119124737.280939-1-ada@thorsis.com Signed-off-by: Jakub Kicinski commit 5894cab4e1b97365c0bb5ca2c29fe84e46b00d26 Author: Alexander Dahl Date: Wed Nov 19 13:47:37 2025 +0100 net: phy: adin1100: Simplify register value passing The additional use case for that variable is gone, the expression is simple enough to pass it inline now. Signed-off-by: Alexander Dahl Reviewed-by: Russell King (Oracle) Acked-by: Nuno Sá Link: https://patch.msgid.link/20251119124737.280939-3-ada@thorsis.com Signed-off-by: Jakub Kicinski commit bccaf1fe08f2c9f96f6bc38391d41e67f6bf38e3 Author: Alexander Dahl Date: Wed Nov 19 13:47:36 2025 +0100 net: phy: adin1100: Fix software power-down ready condition Value CRSM_SFT_PD written to Software Power-Down Control Register (CRSM_SFT_PD_CNTRL) is 0x01 and therefor different to value CRSM_SFT_PD_RDY (0x02) read from System Status Register (CRSM_STAT) for confirmation powerdown has been reached. The condition could have only worked when disabling powerdown (both 0x00), but never when enabling it (0x01 != 0x02). Result is a timeout, like so: $ ifdown eth0 macb f802c000.ethernet eth0: Link is Down ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110 ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110 Fixes: 7eaf9132996a ("net: phy: adin1100: Add initial support for ADIN1100 industrial PHY") Signed-off-by: Alexander Dahl Reviewed-by: Russell King (Oracle) Acked-by: Nuno Sá Link: https://patch.msgid.link/20251119124737.280939-2-ada@thorsis.com Signed-off-by: Jakub Kicinski commit 22eaa206fcacc54e8bc0487c7667883df9200e57 Merge: f15bcd071913df efd3c8cc52bb95 Author: Jakub Kicinski Date: Thu Nov 20 17:57:42 2025 -0800 Merge branch 'net-stmmac-simplify-axi_blen-handling' Russell King says: ==================== net: stmmac: simplify axi_blen handling stmmac's axi_blen (burst length) handling is very verbose and unnecessary. Firstly, the burst length register bitfield is the same across all dwmac cores, so we can use common definitions for these bits which platform glue can use. We end up with platform glue: - filling in the axi_blen[] array with the decimal burst lengths, e.g. dwmac-intel.c, etc - decoding a bitmap into burst lengths for this array, e.g. dwmac-dwc-qos-eth.c Other cases read the array from DT, placing it into the axi_blen array, and converting later to the register bitfield. This series removes all this complexity, ultimately ending up with platform glue providing the register value containing the burst length bitfield directly. Where necessary, platform glue calls stmmac_axi_blen_to_mask() to convert a decimal array (e.g. from DT) to the register value. This also means that stmmac_axi_blen_to_mask() can issue a diagnostic message at probe time if the burst length is incorrect. ==================== Link: https://patch.msgid.link/aR2aaDs6rqfu32B-@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit efd3c8cc52bb9583183ebb83c8c55b23bf97cb2f Author: Russell King (Oracle) Date: Wed Nov 19 10:23:40 2025 +0000 net: stmmac: remove axi_blen array Remove the axi_blen array from struct stmmac_axi as we set this array, and then immediately convert it ot the register value, never looking at the array again. Thus, the array can be function local rather than part of a run-time allocated long-lived struct. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLfLg-0000000FMbD-1vmh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e676cc8561c86799f9e12f8cea550c226130821a Author: Russell King (Oracle) Date: Wed Nov 19 10:23:35 2025 +0000 net: stmmac: move stmmac_axi_blen_to_mask() to axi_blen init sites Move stmmac_axi_blen_to_mask() to the axi->axi_blen array init sites to prepare for the removal of axi_blen. For sites which initialise axi->axi_blen with constant data, initialise axi->axi_blen_regval using the DMA_AXI_BLENx constants. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLfLb-0000000FMb7-1SgG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6ff3310ca28298e363c78143b6a2f20312421f4e Author: Russell King (Oracle) Date: Wed Nov 19 10:23:30 2025 +0000 net: stmmac: move stmmac_axi_blen_to_mask() to stmmac_main.c Move the call to stmmac_axi_blen_to_mask() out of the individual MAC version drivers into the main code in stmmac_init_dma_engine(), passing the resulting value through a new member, axi_blen_regval, in the struct stmmac_axi structure. There is now no need for stmmac_axi_blen_to_dma_mask() to use u32p_replace_bits(), so use FIELD_PREP() instead. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLfLW-0000000FMb1-0zKV@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2704af20c8e5e7f5f1cfb56003d246a7936458f6 Author: Russell King (Oracle) Date: Wed Nov 19 10:23:25 2025 +0000 net: stmmac: provide common stmmac_axi_blen_to_mask() Provide a common stmmac_axi_blen_to_mask() function to translate the burst length array to the value for the AXI bus mode register, and use it for dwmac, dwmac4 and dwxgmac2. Remove the now unnecessary XGMAC_BLEN* definitions. Note that stmmac_axi_blen_to_dma_mask() is coded to be more efficient than the original three implementations, and verifies the contents of the burst length array. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLfLR-0000000FMav-0VL6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8c696659f47aa4f4e5f35808b416664378930dd9 Author: Russell King (Oracle) Date: Wed Nov 19 10:23:19 2025 +0000 net: stmmac: move common DMA AXI register bits to common.h Move the common DMA AXI register bits to common.h so they can be shared and we can provide a common function to convert the axi->dma_blen[] array to the format needed for this register. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLfLL-0000000FMap-49gf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f7ac9a0bbe3f15d0164ac09688e336933cb54a03 Author: Russell King (Oracle) Date: Wed Nov 19 10:23:14 2025 +0000 net: stmmac: dwc-qos-eth: simplify switch() in dwc_eth_dwmac_config_dt() Simplify the switch() statement in dwc_eth_dwmac_config_dt(). Although this is not speed-critical, simplifying it can make it more readable. This also drastically improves the code emitted by the compiler. On aarch64, with the original code, the compiler loads registers with every possible value, and then has a tree of test-and-branch statements to work out which register to store. With the simplified code, the compiler can load a register with '4' and shift it appropriately. This shrinks the text size on aarch64 from 4289 bytes to 4153 bytes, a reduction of 3%. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLfLG-0000000FMai-3fKz@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f15bcd071913dfa754cabb85e9fff4eded4e35b2 Author: Russell King (Oracle) Date: Wed Nov 19 11:29:16 2025 +0000 net: stmmac: rk: use phylink's interface mode for set_clk_tx_rate() rk_set_clk_tx_rate() is passed the interface mode from phylink which will be the same as bsp_priv->phy_iface. Use the passed-in interface mode rather than bsp_priv->phy_iface. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLgNA-0000000FMjN-0DSS@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fdc38d34b37c8bfd24960b53fc65eae2ef575066 Merge: 4707191ca9d337 1a62894e040dad Author: Jakub Kicinski Date: Thu Nov 20 17:54:10 2025 -0800 Merge branch 'net-stmmac-pass-struct-device-to-init-exit' Russell King says: ==================== net: stmmac: pass struct device to init/exit Rather than passing the platform device to the ->init() and ->exit() methods, make these methods useful for other devices by passing the struct device instead. Update the implementations appropriately for this change. Move the calls for these methods into the core driver's probe and remove methods from the stmmac_platform layer. Convert dwmac-rk to use ->init() and ->exit(). ==================== Link: https://patch.msgid.link/aR2V0Kib7j0L4FNN@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1a62894e040dad73782e0c1a4b0e8a0d5480d29b Author: Russell King (Oracle) Date: Wed Nov 19 10:04:00 2025 +0000 net: stmmac: rk: convert to init()/exit() methods Convert rk to use the init() and exit() methods for powering up and down the device. This allows us to use the pltfr versions of probe() and remove(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vLf2e-0000000FMNN-1Xnh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 32da89a840e852b1c33df2b8e5b74ba4da468b62 Author: Russell King (Oracle) Date: Wed Nov 19 10:03:55 2025 +0000 net: stmmac: move probe/remove calling of init/exit Move the probe/remove time calling of the init()/exit() methods in the platform data to the main driver probe/remove functions. This allows them to be used by non-platform_device based drivers. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vLf2Z-0000000FMNH-0xPV@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 85081acc6b1188f2a6e5e605dc644225fcdf327f Author: Russell King (Oracle) Date: Wed Nov 19 10:03:50 2025 +0000 net: stmmac: pass struct device to init()/exit() methods As struct plat_stmmacenet_data is not platform_device specific, pass a struct device into the init() and exit() methods to allow them to become independent of the underlying device. Signed-off-by: Russell King (Oracle) Acked-by: Chen-Yu Tsai Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vLf2U-0000000FMN2-0SLg@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4707191ca9d337599cdcfd8b296344c28eef9d03 Merge: 738cd803b9d418 ecfea98b7d0d56 Author: Jakub Kicinski Date: Thu Nov 20 17:44:26 2025 -0800 Merge branch 'tcp-tcp_rcvbuf_grow-changes' Eric Dumazet says: ==================== tcp: tcp_rcvbuf_grow() changes First pach is minor and moves tcp_moderate_rcvbuf in appropriate group. Second patch is another attempt to keep small sk->sk_rcvbuf for DC (small RT) TCP flows for optimal performance. ==================== Link: https://patch.msgid.link/20251119084813.3684576-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ecfea98b7d0d56c5bf2df3fc02c5501afa5cef6f Author: Eric Dumazet Date: Wed Nov 19 08:48:13 2025 +0000 tcp: add net.ipv4.tcp_rcvbuf_low_rtt This is a follow up of commit aa251c84636c ("tcp: fix too slow tcp_rcvbuf_grow() action") which brought again the issue that I tried to fix in commit 65c5287892e9 ("tcp: fix sk_rcvbuf overshoot") We also recently increased tcp_rmem[2] to 32 MB in commit 572be9bf9d0d ("tcp: increase tcp_rmem[2] to 32 MB") Idea of this patch is to not let tcp_rcvbuf_grow() grow sk->sk_rcvbuf too fast for small RTT flows. If sk->sk_rcvbuf is too big, this can force NIC driver to not recycle pages from their page pool, and also can cause cache evictions for DDIO enabled cpus/NIC, as receivers are usually slower than senders. Add net.ipv4.tcp_rcvbuf_low_rtt sysctl, set by default to 1000 usec (1 ms) If RTT if smaller than the sysctl value, use the RTT/tcp_rcvbuf_low_rtt ratio to control sk_rcvbuf inflation. Tested: Pair of hosts with a 200Gbit IDPF NIC. Using netperf/netserver Client initiates 8 TCP bulk flows, asking netserver to use CPU #10 only. super_netperf 8 -H server -T,10 -l 30 On server, use perf -e tcp:tcp_rcvbuf_grow while test is running. Before: sysctl -w net.ipv4.tcp_rcvbuf_low_rtt=1 perf record -a -e tcp:tcp_rcvbuf_grow sleep 30 ; perf script|tail -20|cut -c30-230 1153.051201: tcp:tcp_rcvbuf_grow: time=398 rtt_us=382 copied=6905856 inq=180224 space=6115328 ooo=0 scaling_ratio=240 rcvbuf=27666235 rcv_ssthresh=25878235 window_clamp=25937095 rcv_wnd=25600000 famil 1153.138752: tcp:tcp_rcvbuf_grow: time=446 rtt_us=413 copied=5529600 inq=180224 space=4505600 ooo=0 scaling_ratio=240 rcvbuf=23068672 rcv_ssthresh=21571860 window_clamp=21626880 rcv_wnd=21286912 famil 1153.361484: tcp:tcp_rcvbuf_grow: time=415 rtt_us=380 copied=7061504 inq=204800 space=6725632 ooo=0 scaling_ratio=240 rcvbuf=27666235 rcv_ssthresh=25878235 window_clamp=25937095 rcv_wnd=25600000 famil 1153.457642: tcp:tcp_rcvbuf_grow: time=483 rtt_us=421 copied=5885952 inq=720896 space=4407296 ooo=0 scaling_ratio=240 rcvbuf=23763511 rcv_ssthresh=22223271 window_clamp=22278291 rcv_wnd=21430272 famil 1153.466002: tcp:tcp_rcvbuf_grow: time=308 rtt_us=281 copied=3244032 inq=180224 space=2883584 ooo=0 scaling_ratio=240 rcvbuf=44854314 rcv_ssthresh=41992059 window_clamp=42050919 rcv_wnd=41713664 famil 1153.747792: tcp:tcp_rcvbuf_grow: time=394 rtt_us=332 copied=4460544 inq=585728 space=3063808 ooo=0 scaling_ratio=240 rcvbuf=44854314 rcv_ssthresh=41992059 window_clamp=42050919 rcv_wnd=41373696 famil 1154.260747: tcp:tcp_rcvbuf_grow: time=652 rtt_us=226 copied=10977280 inq=737280 space=9486336 ooo=0 scaling_ratio=240 rcvbuf=31165538 rcv_ssthresh=29197743 window_clamp=29217691 rcv_wnd=28368896 fami 1154.375019: tcp:tcp_rcvbuf_grow: time=461 rtt_us=443 copied=7573504 inq=507904 space=6856704 ooo=0 scaling_ratio=240 rcvbuf=27666235 rcv_ssthresh=25878235 window_clamp=25937095 rcv_wnd=25288704 famil 1154.463072: tcp:tcp_rcvbuf_grow: time=494 rtt_us=408 copied=7983104 inq=200704 space=7065600 ooo=0 scaling_ratio=240 rcvbuf=27666235 rcv_ssthresh=25878235 window_clamp=25937095 rcv_wnd=25579520 famil 1154.474658: tcp:tcp_rcvbuf_grow: time=507 rtt_us=459 copied=5586944 inq=540672 space=4718592 ooo=0 scaling_ratio=240 rcvbuf=17852266 rcv_ssthresh=16692999 window_clamp=16736499 rcv_wnd=16056320 famil 1154.584657: tcp:tcp_rcvbuf_grow: time=494 rtt_us=427 copied=8126464 inq=204800 space=7782400 ooo=0 scaling_ratio=240 rcvbuf=27666235 rcv_ssthresh=25878235 window_clamp=25937095 rcv_wnd=25600000 famil 1154.702117: tcp:tcp_rcvbuf_grow: time=480 rtt_us=406 copied=5734400 inq=180224 space=5349376 ooo=0 scaling_ratio=240 rcvbuf=23068672 rcv_ssthresh=21571860 window_clamp=21626880 rcv_wnd=21286912 famil 1155.941595: tcp:tcp_rcvbuf_grow: time=717 rtt_us=670 copied=11042816 inq=3784704 space=7159808 ooo=0 scaling_ratio=240 rcvbuf=19581357 rcv_ssthresh=18333222 window_clamp=18357522 rcv_wnd=14614528 fam 1156.384735: tcp:tcp_rcvbuf_grow: time=529 rtt_us=473 copied=9011200 inq=180224 space=7258112 ooo=0 scaling_ratio=240 rcvbuf=19581357 rcv_ssthresh=18333222 window_clamp=18357522 rcv_wnd=18018304 famil 1157.821676: tcp:tcp_rcvbuf_grow: time=529 rtt_us=272 copied=8224768 inq=602112 space=6545408 ooo=0 scaling_ratio=240 rcvbuf=67000000 rcv_ssthresh=62793576 window_clamp=62812500 rcv_wnd=62115840 famil 1158.906379: tcp:tcp_rcvbuf_grow: time=710 rtt_us=445 copied=11845632 inq=540672 space=10240000 ooo=0 scaling_ratio=240 rcvbuf=31165538 rcv_ssthresh=29205935 window_clamp=29217691 rcv_wnd=28536832 fam 1164.600160: tcp:tcp_rcvbuf_grow: time=841 rtt_us=430 copied=12976128 inq=1290240 space=11304960 ooo=0 scaling_ratio=240 rcvbuf=31165538 rcv_ssthresh=29212591 window_clamp=29217691 rcv_wnd=27856896 fa 1165.163572: tcp:tcp_rcvbuf_grow: time=845 rtt_us=800 copied=12632064 inq=540672 space=7921664 ooo=0 scaling_ratio=240 rcvbuf=27666235 rcv_ssthresh=25912795 window_clamp=25937095 rcv_wnd=25260032 fami 1165.653464: tcp:tcp_rcvbuf_grow: time=388 rtt_us=309 copied=4493312 inq=180224 space=3874816 ooo=0 scaling_ratio=240 rcvbuf=44854314 rcv_ssthresh=41995899 window_clamp=42050919 rcv_wnd=41713664 famil 1166.651211: tcp:tcp_rcvbuf_grow: time=556 rtt_us=553 copied=6328320 inq=540672 space=5554176 ooo=0 scaling_ratio=240 rcvbuf=23068672 rcv_ssthresh=21571860 window_clamp=21626880 rcv_wnd=20946944 famil After: sysctl -w net.ipv4.tcp_rcvbuf_low_rtt=1000 perf record -a -e tcp:tcp_rcvbuf_grow sleep 30 ; perf script|tail -20|cut -c30-230 1457.053149: tcp:tcp_rcvbuf_grow: time=128 rtt_us=24 copied=1441792 inq=40960 space=1269760 ooo=0 scaling_ratio=240 rcvbuf=2960741 rcv_ssthresh=2605474 window_clamp=2775694 rcv_wnd=2568192 family=AF_I 1458.000778: tcp:tcp_rcvbuf_grow: time=128 rtt_us=31 copied=1441792 inq=24576 space=1400832 ooo=0 scaling_ratio=240 rcvbuf=3060163 rcv_ssthresh=2810042 window_clamp=2868902 rcv_wnd=2674688 family=AF_I 1458.088059: tcp:tcp_rcvbuf_grow: time=190 rtt_us=110 copied=3227648 inq=385024 space=2781184 ooo=0 scaling_ratio=240 rcvbuf=6728240 rcv_ssthresh=6252705 window_clamp=6307725 rcv_wnd=5799936 family=AF 1458.148549: tcp:tcp_rcvbuf_grow: time=232 rtt_us=129 copied=3956736 inq=237568 space=2842624 ooo=0 scaling_ratio=240 rcvbuf=6731333 rcv_ssthresh=6252705 window_clamp=6310624 rcv_wnd=5918720 family=AF 1458.466861: tcp:tcp_rcvbuf_grow: time=193 rtt_us=83 copied=2949120 inq=180224 space=2457600 ooo=0 scaling_ratio=240 rcvbuf=5751438 rcv_ssthresh=5357689 window_clamp=5391973 rcv_wnd=5054464 family=AF_ 1458.775476: tcp:tcp_rcvbuf_grow: time=257 rtt_us=127 copied=4304896 inq=352256 space=3346432 ooo=0 scaling_ratio=240 rcvbuf=8067131 rcv_ssthresh=7523275 window_clamp=7562935 rcv_wnd=7061504 family=AF 1458.776631: tcp:tcp_rcvbuf_grow: time=200 rtt_us=96 copied=3260416 inq=143360 space=2768896 ooo=0 scaling_ratio=240 rcvbuf=6397256 rcv_ssthresh=5938567 window_clamp=5997427 rcv_wnd=5828608 family=AF_ 1459.707973: tcp:tcp_rcvbuf_grow: time=215 rtt_us=96 copied=2506752 inq=163840 space=1388544 ooo=0 scaling_ratio=240 rcvbuf=3068867 rcv_ssthresh=2768282 window_clamp=2877062 rcv_wnd=2555904 family=AF_ 1460.246494: tcp:tcp_rcvbuf_grow: time=231 rtt_us=80 copied=3756032 inq=204800 space=3117056 ooo=0 scaling_ratio=240 rcvbuf=7288091 rcv_ssthresh=6773725 window_clamp=6832585 rcv_wnd=6471680 family=AF_ 1460.714596: tcp:tcp_rcvbuf_grow: time=270 rtt_us=110 copied=4714496 inq=311296 space=3719168 ooo=0 scaling_ratio=240 rcvbuf=8957739 rcv_ssthresh=8339020 window_clamp=8397880 rcv_wnd=7933952 family=AF 1462.029977: tcp:tcp_rcvbuf_grow: time=101 rtt_us=19 copied=1105920 inq=40960 space=1036288 ooo=0 scaling_ratio=240 rcvbuf=2338970 rcv_ssthresh=2091684 window_clamp=2192784 rcv_wnd=1986560 family=AF_I 1462.802385: tcp:tcp_rcvbuf_grow: time=89 rtt_us=45 copied=1069056 inq=0 space=1064960 ooo=0 scaling_ratio=240 rcvbuf=2338970 rcv_ssthresh=2091684 window_clamp=2192784 rcv_wnd=2035712 family=AF_INET6 1462.918648: tcp:tcp_rcvbuf_grow: time=105 rtt_us=33 copied=1441792 inq=180224 space=1069056 ooo=0 scaling_ratio=240 rcvbuf=2383282 rcv_ssthresh=2091684 window_clamp=2234326 rcv_wnd=1896448 family=AF_ 1463.222533: tcp:tcp_rcvbuf_grow: time=273 rtt_us=144 copied=4603904 inq=385024 space=3469312 ooo=0 scaling_ratio=240 rcvbuf=8422564 rcv_ssthresh=7891053 window_clamp=7896153 rcv_wnd=7409664 family=AF 1466.519312: tcp:tcp_rcvbuf_grow: time=130 rtt_us=23 copied=1343488 inq=0 space=1261568 ooo=0 scaling_ratio=240 rcvbuf=2780158 rcv_ssthresh=2493778 window_clamp=2606398 rcv_wnd=2494464 family=AF_INET6 1466.681003: tcp:tcp_rcvbuf_grow: time=128 rtt_us=21 copied=1441792 inq=12288 space=1343488 ooo=0 scaling_ratio=240 rcvbuf=2932027 rcv_ssthresh=2578555 window_clamp=2748775 rcv_wnd=2568192 family=AF_I 1470.689959: tcp:tcp_rcvbuf_grow: time=255 rtt_us=122 copied=3932160 inq=204800 space=3551232 ooo=0 scaling_ratio=240 rcvbuf=8182038 rcv_ssthresh=7647384 window_clamp=7670660 rcv_wnd=7442432 family=AF 1471.754154: tcp:tcp_rcvbuf_grow: time=188 rtt_us=95 copied=2138112 inq=577536 space=1429504 ooo=0 scaling_ratio=240 rcvbuf=3113650 rcv_ssthresh=2806426 window_clamp=2919046 rcv_wnd=2248704 family=AF_ 1476.813542: tcp:tcp_rcvbuf_grow: time=269 rtt_us=99 copied=3088384 inq=180224 space=2564096 ooo=0 scaling_ratio=240 rcvbuf=6219470 rcv_ssthresh=5771893 window_clamp=5830753 rcv_wnd=5509120 family=AF_ 1477.738309: tcp:tcp_rcvbuf_grow: time=166 rtt_us=54 copied=1777664 inq=180224 space=1417216 ooo=0 scaling_ratio=240 rcvbuf=3117118 rcv_ssthresh=2874958 window_clamp=2922298 rcv_wnd=2613248 family=AF_ We can see sk_rcvbuf values are much smaller, and that rtt_us (estimation of rtt from a receiver point of view) is kept small, instead of being bloated. No difference in throughput. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Tested-by: Paolo Abeni Link: https://patch.msgid.link/20251119084813.3684576-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6d5dea68246ecb190a50a7fecbaf7f8c1ddb15e4 Author: Eric Dumazet Date: Wed Nov 19 08:48:12 2025 +0000 tcp: tcp_moderate_rcvbuf is only used in rx path sysctl_tcp_moderate_rcvbuf is only used from tcp_rcvbuf_grow(). Move it to netns_ipv4_read_rx group. Remove various CACHELINE_ASSERT_GROUP_SIZE() from netns_ipv4_struct_check(), as they have no real benefit but cause pain for all changes. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251119084813.3684576-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 738cd803b9d418861438df0c7232e9ca6afad58e Merge: 9e203721ec6117 e5a440bf020ef9 Author: Jakub Kicinski Date: Thu Nov 20 17:41:40 2025 -0800 Merge branch 'net-mdio-improve-reset-handling-of-mdio-devices' Buday Csaba says: ==================== net: mdio: improve reset handling of mdio devices This patchset refactors and slightly improves the reset handling of `mdio_device`. The patches were split from a larger series, discussed previously in the links below. The difference between v2 and v3, is that the helper function declarations have been moved to a new header file: drivers/net/phy/mdio-private.h See links for the previous versions, and for the now separate leak fix. ==================== Link: https://patch.msgid.link/cover.1763473655.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit e5a440bf020ef9ee11d442159bd394d66250db30 Author: Buday Csaba Date: Tue Nov 18 14:58:54 2025 +0100 net: mdio: improve reset handling in mdio_device.c Change fwnode_property_read_u32() in mdio_device_register_reset() to device_property_read_u32(), which is more appropriate here. Make mdio_device_unregister_reset() truly reverse mdio_device_register_reset() by setting the internal fields to their default values. Signed-off-by: Buday Csaba Link: https://patch.msgid.link/641df1488517ae71ba10158ec1e38424211d8651.1763473655.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit acde7ad968f6c536397b39b23e4c70dc466fbc59 Author: Buday Csaba Date: Tue Nov 18 14:58:53 2025 +0100 net: mdio: common handling of phy device reset properties Unify the handling of the per device reset properties for `mdio_device`. Merge mdio_device_register_gpiod() and mdio_device_register_reset() into mdio_device_register_reset(), that handles both reset-controllers and reset-gpios. Move reading of the reset firmware properties (reset-assert-us, reset-deassert-us) from fwnode_mdio.c to mdio_device_register_reset(), so all reset related initialization code is kept in one place. Introduce mdio_device_unregister_reset() to release the associated resources. These changes make tracking the reset properties easier. Added kernel-doc for mdio_device_register/unregister_reset(). Signed-off-by: Buday Csaba Link: https://patch.msgid.link/17c216efd7a47be17db104378b6aacfc8741d8b9.1763473655.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit 02aeff20e8f5ab5f7ebc64858239787d420d73c4 Author: Buday Csaba Date: Tue Nov 18 14:58:52 2025 +0100 net: mdio: move device reset functions to mdio_device.c The functions mdiobus_register_gpiod() and mdiobus_register_reset() handle the mdio device reset initialization, which belong to mdio_device.c. Move them from mdio_bus.c to mdio_device.c, and rename them to match the corresponding source file: mdio_device_register_gpio() and mdio_device_register_reset(). Remove 'static' qualifiers and declare them in drivers/net/phy/mdio-private.h (new header file). Signed-off-by: Buday Csaba Link: https://patch.msgid.link/5f684838ee897130f21b21beb07695eea4af8988.1763473655.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit 6a8818de21d294c1de6be9a71afe184d08350875 Author: Jim Mattson Date: Tue Oct 28 15:30:42 2025 -0700 KVM: selftests: Add a VMX test for LA57 nested state Add a selftest that verifies KVM's ability to save and restore nested state when the L1 guest is using 5-level paging and the L2 guest is using 4-level paging. Specifically, canonicality tests of the VMCS12 host-state fields should accept 57-bit virtual addresses. Signed-off-by: Jim Mattson Link: https://patch.msgid.link/20251028225827.2269128-5-jmattson@google.com [sean: rename to vmx_nested_la57_state_test to prep nested_ namespace] Signed-off-by: Sean Christopherson commit ec5806639e39950527593e3be0efe7f0d7b65bf7 Author: Jim Mattson Date: Tue Oct 28 15:30:41 2025 -0700 KVM: selftests: Change VM_MODE_PXXV48_4K to VM_MODE_PXXVYY_4K Use 57-bit addresses with 5-level paging on hardware that supports LA57. Continue to use 48-bit addresses with 4-level paging on hardware that doesn't support LA57. Suggested-by: Sean Christopherson Signed-off-by: Jim Mattson Link: https://patch.msgid.link/20251028225827.2269128-4-jmattson@google.com Signed-off-by: Sean Christopherson commit 2103a8baf5cb7e6169434e5f2cc6c311929f529a Author: Jim Mattson Date: Tue Oct 28 15:30:40 2025 -0700 KVM: selftests: Use a loop to walk guest page tables Walk the guest page tables via a loop when searching for a PTE, instead of using unique variables for each level of the page tables. This simplifies the code and makes it easier to support 5-level paging in the future. Signed-off-by: Jim Mattson Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20251028225827.2269128-3-jmattson@google.com Signed-off-by: Sean Christopherson commit ae5b498b8da96749cdad7b5a013053d17d815a6e Author: Jim Mattson Date: Tue Oct 28 15:30:39 2025 -0700 KVM: selftests: Use a loop to create guest page tables Walk the guest page tables via a loop when creating new mappings, instead of using unique variables for each level of the page tables. This simplifies the code and makes it easier to support 5-level paging in the future. Signed-off-by: Jim Mattson Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20251028225827.2269128-2-jmattson@google.com Signed-off-by: Sean Christopherson commit ff736dba478c2bcf8c8c8328ff8936b1e6d65e81 Author: Yosry Ahmed Date: Tue Oct 21 07:47:22 2025 +0000 KVM: selftests: Remove the unused argument to prepare_eptp() eptp_memslot is unused, remove it. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-10-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 28b2dced8ba4604b2cdd97c11d7fbd0fa99f9835 Author: Yosry Ahmed Date: Tue Oct 21 07:47:21 2025 +0000 KVM: selftests: Stop hardcoding PAGE_SIZE in x86 selftests Use PAGE_SIZE instead of 4096. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-9-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 3c40777f0ed81e8b8f7047319ad195e407614b69 Author: Yosry Ahmed Date: Tue Oct 21 07:47:20 2025 +0000 KVM: selftests: Extend vmx_tsc_adjust_test to cover SVM Add SVM L1 code to run the nested guest, and allow the test to run with SVM as well as VMX. Reviewed-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-8-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 91423b041d3ca9f07ebc0c7859a20ac7eac8c755 Author: Yosry Ahmed Date: Tue Oct 21 07:47:19 2025 +0000 KVM: selftests: Extend nested_invalid_cr3_test to cover SVM Add SVM L1 code to run the nested guest, and allow the test to run with SVM as well as VMX. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-7-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 4d256d00e44e02fae84851729d70df2bc2ebe6e9 Author: Yosry Ahmed Date: Tue Oct 21 07:47:18 2025 +0000 KVM: selftests: Move nested invalid CR3 check to its own test vmx_tsc_adjust_test currently verifies that a nested VMLAUNCH fails with an invalid CR3. This is irrelevant to TSC scaling, move it to a standalone test. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-6-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit e6bcdd21223835a6a5691af224c7c5ff4934436a Author: Yosry Ahmed Date: Tue Oct 21 07:47:17 2025 +0000 KVM: selftests: Extend vmx_nested_tsc_scaling_test to cover SVM Add SVM L1 code to run the nested guest, and allow the test to run with SVM as well as VMX. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-5-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 0a9eb2afa185e84cd6c6b35aefb190e8f92c4c5c Author: Yosry Ahmed Date: Tue Oct 21 07:47:16 2025 +0000 KVM: selftests: Extend vmx_close_while_nested_test to cover SVM Add SVM L1 code to run the nested guest, and allow the test to run with SVM as well as VMX. Reviewed-by: Jim Mattson Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251021074736.1324328-4-yosry.ahmed@linux.dev [sean: rename to "nested_close_kvm_test" to provide nested_* sorting] Signed-off-by: Sean Christopherson commit ee31621316cc20108eb2075de5d57f2cbd295677 Merge: ce0478b02ed294 7bc29d5fb6faff Author: Dave Airlie Date: Fri Nov 21 08:58:39 2025 +1000 Merge tag 'drm-msm-next-2025-11-18' of https://gitlab.freedesktop.org/drm/msm into drm-next Changes for v6.19: GPU: - Gen8 support: A840 (Kaanapali) and X2-85 (Glymur) - A612 support - A few NULL check fixes MDSS: - Added support for Glymur and QCS8300 platforms DPU: - Enabled Quad-Pipe support, unlocking higher resolutions support - Added support for Glymur platform - Documented DPU on QCS8300 platform as supported - Misc small fixes DisplayPort: - Added support for Glymur platform - Added support lame remapping inside DP block - Documented DisplayPort controller on QCS8300 and SM6150/QCS615 as supported Signed-off-by: Dave Airlie From: Rob Clark Link: https://patch.msgid.link/CACSVV00sFi65XrZipHCU3C0bYji7vgu7OgWvLeOQ1Cg475_pUA@mail.gmail.com commit ce0478b02ed29465c1de3d03c3eea721355f9d2d Merge: f0ded972d37150 6a23ae0a96a600 Author: Dave Airlie Date: Fri Nov 21 08:55:08 2025 +1000 Merge tag 'v6.18-rc6' into drm-next Linux 6.18-rc6 Backmerge in order to merge msm next Signed-off-by: Dave Airlie commit 6ed597fdbcfa5ffc1a01c8740320c5a20093b863 Author: FUKAUMI Naoki Date: Thu Nov 13 12:42:20 2025 +0000 arm64: dts: rockchip: Use default-state for power LED for Radxa boards Currently, on Radxa boards, the power LED is turned on immediately after power-up, independent of software control. The heartbeat LED and other available LEDs are subsequently turned on by the initial software, such as U-Boot, to indicate software is running. However, the device tree description for this behavior is inconsistent and fragmented, with definitions split between the main Linux DTS files and separate U-Boot files (u-boot/arch/arm/dts/*-u-boot.dtsi). This patch addresses the inconsistency for the power LED by using default-state = "on" instead of linux,default-trigger = "default-on". Signed-off-by: FUKAUMI Naoki Reviewed-by: Dragan Simic Link: https://patch.msgid.link/20251113124222.4691-2-naoki@radxa.com Signed-off-by: Heiko Stuebner commit c8ecda015eb4070ced887eba34cdb60737a9893b Author: Coia Prant Date: Fri Nov 14 17:21:15 2025 +0800 arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on 9Tripod X3568 v4 The regulator type is "regulator-fixed" since its voltage always be 3.3v, min and max should be 3300000 make the regulator has a voltage The regulator is supplied by dc_12v, so add the vin-supply. Link: https://github.com/rockchip-linux/kernel/commit/17e9559f67d26f3c602e38a24feb5194e51ac782 Signed-off-by: Coia Prant Link: https://patch.msgid.link/20251114092114.62664-2-coiaprant@gmail.com Signed-off-by: Heiko Stuebner commit f54b09d46f72e4548e14476ba771231b0ec2b0af Author: Heiko Stuebner Date: Tue Oct 21 09:42:50 2025 +0200 arm64: dts: rockchip: Add power-domain to RK3368 VOP controller The VOP is also part of the VIO power-domain and it definitely needs to be on when accessing it to not cause SError faults, so add the power-domains property to it. Fixes: ef06b5ddee1e ("arm64: dts: rockchip: Add display subsystem for RK3368") Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251021074254.87065-6-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 8319be65e860a2881e5213ed95e03992037bf5c1 Author: Heiko Stuebner Date: Tue Oct 21 09:42:49 2025 +0200 arm64: dts: rockchip: Add power-domain to RK3368 DSI controller The DSI controller is also part of the VIO power-domain and it definitely needs to be on when accessing it to not cause SError faults, so add the power-domains property to it. Fixes: 5023d0cd6183 ("arm64: dts: rockchip: Add DSI for RK3368") Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251021074254.87065-5-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 932feac9d8c591a6c5d3824765f71e2cd87f33e8 Author: Chris Morgan Date: Tue Nov 18 16:30:48 2025 -0600 arm64: dts: rockchip: Add host wake pin for wifi on Indiedroid Nova Add the pin definition for the host wake interrupt on the Indiedroid Nova. This necessitates adding a node for the wifi controller to properly define the interrupt. Additionally, we can consolidate both pinctrl definitions under a wifi node to note their common functionality. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251118223048.4531-5-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 6f563ebf0b21e661f6a663ea55ae00544192a213 Author: Chris Morgan Date: Tue Nov 18 16:30:47 2025 -0600 arm64: dts: rockchip: Correct pinctrl for pcie for Indiedroid Nova Correct the pin definitions of the PCIE controller on the Indiedroid Nova according to the schematics. Since GPIO3 D1 is already defined as a reset pin in the rk3588-base-pinctrl.dtsi file we do not need a custom definition anymore. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251118223048.4531-4-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 835c909e8576919437227f6ac1d4e4769016137f Author: Chris Morgan Date: Tue Nov 18 16:30:46 2025 -0600 arm64: dts: rockchip: Define regulator for pcie2x1l2 on Indiedroid Nova Add the correct regulator defined per the schematics to the PCIE interface for the Indiedroid Nova. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251118223048.4531-3-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit e0940c672ab4228caa33bcd7cc0ad8017482c2f1 Author: Nirbhay Sharma Date: Fri Nov 21 02:16:21 2025 +0530 bpf: Document cfi_stubs and owner fields in struct bpf_struct_ops Add missing kernel-doc documentation for the cfi_stubs and owner fields in struct bpf_struct_ops to fix the following warnings: Warning: include/linux/bpf.h:1931 struct member 'cfi_stubs' not described in 'bpf_struct_ops' Warning: include/linux/bpf.h:1931 struct member 'owner' not described in 'bpf_struct_ops' The cfi_stubs field was added in commit 2cd3e3772e41 ("x86/cfi,bpf: Fix bpf_struct_ops CFI") to provide CFI stub functions for trampolines, and the owner field is used for module reference counting. Signed-off-by: Nirbhay Sharma Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251120204620.59571-2-nirbhay.lkd@gmail.com commit 58b6fcd2ab34399258dc509f701d0986a8e0bcaa Author: Ahmet Eray Karadag Date: Tue Nov 18 03:18:34 2025 +0300 ocfs2: mark inode bad upon validation failure during read A VFS cache inconsistency, potentially triggered by sequences like buffered writes followed by open(O_DIRECT), can result in an invalid on-disk inode block (e.g., bad signature). OCFS2 detects this corruption when reading the inode block via ocfs2_validate_inode_block(), logs "Invalid dinode", and often switches the filesystem to read-only mode. The VFS open(O_DIRECT) operation appears to incorrectly clear the inode's I_DIRTY flag without ensuring the dirty metadata (reflecting the earlier buffered write, e.g., an updated i_size) is flushed to disk. This leaves the in-memory VFS inode object "in limbo" with an updated size (e.g., 38639 from the write) but marked clean, while its on-disk counterpart remains stale (e.g., size 0) or invalid. Currently, the function reading the inode block (ocfs2_read_inode_block_full()) fails to call make_bad_inode() upon detecting the validation error. Because the in-memory inode is not marked bad, subsequent operations (like ftruncate) proceed erroneously. They eventually reach code (e.g., ocfs2_truncate_file()) that compares the inconsistent in-memory size (38639) against the invalid/stale on-disk size (0), leading to kernel crashes via BUG_ON. Fix this by calling make_bad_inode(inode) within the error handling path of ocfs2_read_inode_block_full() immediately after a block read or validation error occurs. This ensures VFS is properly notified about the corrupt inode at the point of detection. Marking the inode bad allows VFS to correctly fail subsequent operations targeting this inode early, preventing kernel panics caused by operating on known inconsistent inode states. Link: https://lkml.kernel.org/r/20251118001833.423470-2-eraykrdg1@gmail.com Link: https://lore.kernel.org/all/20251029225748.11361-2-eraykrdg1@gmail.com/T/ Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag Reported-by: syzbot+b93b65ee321c97861072@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=b93b65ee321c97861072 Reviewed-by: Heming Zhao Co-developed-by: Albin Babu Varghese Acked-by: Joseph Qi Cc: David Hunter Cc: Joel Becker Cc: Mark Fasheh Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 13db54aad7442852d57bd384305bc8c10a9dcd1f Author: Thorsten Blum Date: Tue Nov 18 19:53:45 2025 +0100 ocfs2: replace deprecated strcpy with strscpy strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(), and copy directly into '->rf_signature' instead of using the start of the struct as the destination buffer. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Link: https://lkml.kernel.org/r/20251118185345.132411-3-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Joseph Qi Cc: Joel Becker Cc: Mark Fasheh Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 4022ba20050e8e2bb189155e0665b60953d7552c Author: Thorsten Blum Date: Tue Nov 18 19:53:44 2025 +0100 ocfs2: replace deprecated strcpy in ocfs2_create_xattr_block strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy(), and copy directly into '->xb_signature' instead of using the start of the struct as the destination buffer. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Link: https://lkml.kernel.org/r/20251118185345.132411-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Joseph Qi Cc: Joel Becker Cc: Mark Fasheh Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit ff713698bad2e7d052960cf182fa1ab465564dfd Author: Chia-Liang Wang Date: Wed Nov 19 18:11:44 2025 +0800 lib: ratelimit: fix spelling mistake 'seperately' Corrects a spelling mistake in a comment in ratelimit.c where 'seperately' was used instead of 'separately'. Link: https://lkml.kernel.org/r/20251119101144.3175-1-a0979625527@icloud.com Signed-off-by: Chia-Liang Wang Signed-off-by: Andrew Morton commit 2fe869ecbd06eaa37a77cd58c583f4231ce7de04 Author: Lance Yang Date: Wed Nov 19 19:08:22 2025 +0800 MAINTAINERS: add Petr as a reviewer of hung task detector Petr has been actively reviewing hung task detector patches lately. It's always good to have a fresh pair of eyes, so let's make it official. I checked with him, and he's happy to be added. Link: https://lkml.kernel.org/r/20251119110822.46566-1-lance.yang@linux.dev Signed-off-by: Lance Yang Acked-by: Petr Mladek Cc: "Masami Hiramatsu (Google)" Signed-off-by: Andrew Morton commit 9031b852c97f1db52180878aed66ca08946eca93 Author: Alice Ryhl Date: Tue Nov 18 17:32:50 2025 +0000 uaccess: gate _copy_[to|from]_user on !INLINE_COPY_FROM_USER These methods only exist when INLINE_COPY_FROM_USER is disabled, so update the header file to reflect that. This fixes the following error on builds that enable both RUST and INLINE_COPY_FROM_USER. ERROR: modpost: "_copy_from_user" [samples/rust/rust_misc_device.ko] undefined! ERROR: modpost: "_copy_to_user" [samples/rust/rust_misc_device.ko] undefined! This error is triggered because when a method is available both as a rust_helper_* and normal method, Rust will call the normal method. [akpm@linux-foundation.org: s/INLINE_COPY_FROM_USER/INLINE_COPY_TO_USER/, per Alice] Link: https://lkml.kernel.org/r/20251118173250.2821388-1-aliceryhl@google.com Fixes: d99dc586ca7c ("uaccess: decouple INLINE_COPY_FROM_USER and CONFIG_RUST") Signed-off-by: Alice Ryhl Cc: Alex Gaynor Cc: Andreas Hindborg Cc: Arnd Bergmann Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Gary Guo Cc: John Hubbard Cc: Miguel Ojeda Cc: Trevor Gross Cc: Yury Norov (NVIDIA) Signed-off-by: Andrew Morton commit aa0145563ce26a5f5a1154e9f26a2f8c21eee2ca Author: Sourabh Jain Date: Tue Nov 18 12:40:23 2025 +0530 crash: export crashkernel CMA reservation to userspace Add a sysfs entry /sys/kernel/kexec_crash_cma_ranges to expose all CMA crashkernel ranges. This allows userspace tools configuring kdump to determine how much memory is reserved for crashkernel. If CMA is used, tools can warn users when attempting to capture user pages with CMA reservation. The new sysfs hold the CMA ranges in below format: cat /sys/kernel/kexec_crash_cma_ranges 100000000-10c7fffff The reason for not including Crash CMA Ranges in /proc/iomem is to avoid conflicts. It has been observed that contiguous memory ranges are sometimes shown as two separate System RAM entries in /proc/iomem. If a CMA range overlaps two System RAM ranges, adding crashk_res to /proc/iomem can create a conflict. Reference [1] describes one such instance on the PowerPC architecture. Link: https://lkml.kernel.org/r/20251118071023.1673329-1-sourabhjain@linux.ibm.com Link: https://lore.kernel.org/all/20251016142831.144515-1-sourabhjain@linux.ibm.com/ [1] Signed-off-by: Sourabh Jain Acked-by: Baoquan He Cc: Aditya Gupta Cc: Dave Young Cc: Hari Bathini Cc: Jiri Bohac Cc: Madhavan Srinivasan Cc: Mahesh J Salgaonkar Cc: Pingfan Liu Cc: Ritesh Harjani (IBM) Cc: Shivang Upadhyay Cc: Vivek Goyal Signed-off-by: Andrew Morton commit fdd76c8d6327e616ee61ddd00db16753d722168c Author: Sourabh Jain Date: Mon Nov 17 09:21:53 2025 +0530 Documentation/ABI: add kexec and kdump sysfs interface Add an ABI document for following kexec and kdump sysfs interface: - /sys/kernel/kexec_loaded - /sys/kernel/kexec_crash_loaded - /sys/kernel/kexec_crash_size - /sys/kernel/crash_elfcorehdr_size Link: https://lkml.kernel.org/r/20251117035153.1199665-1-sourabhjain@linux.ibm.com Signed-off-by: Sourabh Jain Cc: Aditya Gupta Cc: Baoquan he Cc: Dave Young Cc: Hari Bathini Cc: Jiri Bohac Cc: Madhavan Srinivasan Cc: Mahesh J Salgaonkar Cc: Pingfan Liu Cc: Ritesh Harjani (IBM) Cc: Shivang Upadhyay Cc: Vivek Goyal Signed-off-by: Andrew Morton commit b1b72ac25f89125d91ef3abd257c3b88ec169962 Author: Guan-Chun Wu <409411716@gms.tku.edu.tw> Date: Fri Nov 14 14:02:40 2025 +0800 ceph: replace local base64 helpers with lib/base64 Remove the ceph_base64_encode() and ceph_base64_decode() functions and replace their usage with the generic base64_encode() and base64_decode() helpers from lib/base64. This eliminates the custom implementation in Ceph, reduces code duplication, and relies on the shared Base64 code in lib. The helpers preserve RFC 3501-compliant Base64 encoding without padding, so there are no functional changes. This change also improves performance: encoding is about 2.7x faster and decoding achieves 43-52x speedups compared to the previous local implementation. Link: https://lkml.kernel.org/r/20251114060240.89965-1-409411716@gms.tku.edu.tw Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Reviewed-by: Kuan-Wei Chiu Reviewed-by: Viacheslav Dubeyko Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Cc: Xiubo Li Cc: Ilya Dryomov Cc: Eric Biggers Cc: "Theodore Y. Ts'o" Cc: Jaegeuk Kim Cc: David Laight Cc: Yu-Sheng Huang Signed-off-by: Andrew Morton commit 7794510e2021a29095721e59f3d249d8b4242fb4 Author: Guan-Chun Wu <409411716@gms.tku.edu.tw> Date: Fri Nov 14 14:02:21 2025 +0800 fscrypt: replace local base64url helpers with lib/base64 Replace the base64url encoding and decoding functions in fscrypt with the generic base64_encode() and base64_decode() helpers from lib/base64. This removes the custom implementation in fscrypt, reduces code duplication, and relies on the shared Base64 implementation in lib. The helpers preserve RFC 4648-compliant URL-safe Base64 encoding without padding, so there are no functional changes. This change also improves performance: encoding is about 2.7x faster and decoding achieves 43-52x speedups compared to the previous implementation. Link: https://lkml.kernel.org/r/20251114060221.89734-1-409411716@gms.tku.edu.tw Reviewed-by: Kuan-Wei Chiu Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Cc: Christoph Hellwig Cc: David Laight Cc: Eric Biggers Cc: Ilya Dryomov Cc: Jaegeuk Kim Cc: Jens Axboe Cc: Keith Busch Cc: Sagi Grimberg Cc: "Theodore Y. Ts'o" Cc: Viacheslav Dubeyko Cc: Xiubo Li Cc: Yu-Sheng Huang Signed-off-by: Andrew Morton commit 8b365c4f5be9e979bb991a52a0cb4b1e4680c8bd Author: Guan-Chun Wu <409411716@gms.tku.edu.tw> Date: Fri Nov 14 14:01:57 2025 +0800 lib: add KUnit tests for base64 encoding/decoding Add a KUnit test suite to validate the base64 helpers. The tests cover both encoding and decoding, including padded and unpadded forms as defined by RFC 4648 (standard base64), and add negative cases for malformed inputs and padding errors. The test suite also validates other variants (URLSAFE, IMAP) to ensure their correctness. In addition to functional checks, the suite includes simple microbenchmarks which report average encode/decode latency for small (64B) and larger (1KB) inputs. These numbers are informational only and do not gate the tests. Kconfig (BASE64_KUNIT) and lib/tests/Makefile are updated accordingly. Sample KUnit output: KTAP version 1 # Subtest: base64 # module: base64_kunit 1..4 # base64_performance_tests: [64B] encode run : 32ns # base64_performance_tests: [64B] decode run : 35ns # base64_performance_tests: [1KB] encode run : 510ns # base64_performance_tests: [1KB] decode run : 530ns ok 1 base64_performance_tests ok 2 base64_std_encode_tests ok 3 base64_std_decode_tests ok 4 base64_variant_tests # base64: pass:4 fail:0 skip:0 total:4 # Totals: pass:4 fail:0 skip:0 total:4 Link: https://lkml.kernel.org/r/20251114060157.89507-1-409411716@gms.tku.edu.tw Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Reviewed-by: Kuan-Wei Chiu Cc: Christoph Hellwig Cc: David Laight Cc: Eric Biggers Cc: Ilya Dryomov Cc: Jaegeuk Kim Cc: Jens Axboe Cc: Keith Busch Cc: Sagi Grimberg Cc: "Theodore Y. Ts'o" Cc: Viacheslav Dubeyko Cc: Xiubo Li Cc: Yu-Sheng Huang Signed-off-by: Andrew Morton commit 9c7d3cf94d33927b6e4e576e7090a929e7162d05 Author: Guan-Chun Wu <409411716@gms.tku.edu.tw> Date: Fri Nov 14 14:01:32 2025 +0800 lib/base64: rework encode/decode for speed and stricter validation The old base64 implementation relied on a bit-accumulator loop, which was slow for larger inputs and too permissive in validation. It would accept extra '=', missing '=', or even '=' appearing in the middle of the input, allowing malformed strings to pass. This patch reworks the internals to improve performance and enforce stricter validation. Changes: - Encoder: * Process input in 3-byte blocks, mapping 24 bits into four 6-bit symbols, avoiding bit-by-bit shifting and reducing loop iterations. * Handle the final 1-2 leftover bytes explicitly and emit '=' only when requested. - Decoder: * Based on the reverse lookup tables from the previous patch, decode input in 4-character groups. * Each group is looked up directly, converted into numeric values, and combined into 3 output bytes. * Explicitly handle padded and unpadded forms: - With padding: input length must be a multiple of 4, and '=' is allowed only in the last two positions. Reject stray or early '='. - Without padding: validate tail lengths (2 or 3 chars) and require unused low bits to be zero. * Removed the bit-accumulator style loop to reduce loop iterations. Performance (x86_64, Intel Core i7-10700 @ 2.90GHz, avg over 1000 runs, KUnit): Encode: 64B ~90ns -> ~32ns (~2.8x) 1KB ~1332ns -> ~510ns (~2.6x) Decode: 64B ~1530ns -> ~35ns (~43.7x) 1KB ~27726ns -> ~530ns (~52.3x) [akpm@linux-foundation.org: remove u32 casts, per David and Guan-Chun] Link: https://lkml.kernel.org/r/20251114060132.89279-1-409411716@gms.tku.edu.tw Co-developed-by: Kuan-Wei Chiu Signed-off-by: Kuan-Wei Chiu Co-developed-by: Yu-Sheng Huang Signed-off-by: Yu-Sheng Huang Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Reviewed-by: David Laight Cc: Christoph Hellwig Cc: Eric Biggers Cc: Ilya Dryomov Cc: Jaegeuk Kim Cc: Jens Axboe Cc: Keith Busch Cc: Sagi Grimberg Cc: "Theodore Y. Ts'o" Cc: Viacheslav Dubeyko Cc: Xiubo Li Signed-off-by: Andrew Morton commit c4eb7ad32eab13ba64cc452c6f43d518b63f5e03 Author: Kuan-Wei Chiu Date: Fri Nov 14 14:01:07 2025 +0800 lib/base64: optimize base64_decode() with reverse lookup tables Replace the use of strchr() in base64_decode() with precomputed reverse lookup tables for each variant. This avoids repeated string scans and improves performance. Use -1 in the tables to mark invalid characters. Decode: 64B ~1530ns -> ~80ns (~19.1x) 1KB ~27726ns -> ~1239ns (~22.4x) [akpm@linux-foundation.org: fix kernedoc] Link: https://lkml.kernel.org/r/20251114060107.89026-1-409411716@gms.tku.edu.tw Signed-off-by: Kuan-Wei Chiu Co-developed-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Reviewed-by: David Laight Cc: Christoph Hellwig Cc: Eric Biggers Cc: Ilya Dryomov Cc: Jaegeuk Kim Cc: Jens Axboe Cc: Keith Busch Cc: Sagi Grimberg Cc: "Theodore Y. Ts'o" Cc: Viacheslav Dubeyko Cc: Xiubo Li Cc: Yu-Sheng Huang Signed-off-by: Andrew Morton commit f1e2ca801c54dfc09d6a5540207cec25e8d43f6f Author: Kuan-Wei Chiu Date: Fri Nov 14 14:00:45 2025 +0800 lib/base64: add support for multiple variants Patch series " lib/base64: add generic encoder/decoder, migrate users", v5. This series introduces a generic Base64 encoder/decoder to the kernel library, eliminating duplicated implementations and delivering significant performance improvements. The Base64 API has been extended to support multiple variants (Standard, URL-safe, and IMAP) as defined in RFC 4648 and RFC 3501. The API now takes a variant parameter and an option to control padding. As part of this series, users are migrated to the new interface while preserving their specific formats: fscrypt now uses BASE64_URLSAFE, Ceph uses BASE64_IMAP, and NVMe is updated to BASE64_STD. On the encoder side, the implementation processes input in 3-byte blocks, mapping 24 bits directly to 4 output symbols. This avoids bit-by-bit streaming and reduces loop overhead, achieving about a 2.7x speedup compared to previous implementations. On the decoder side, replace strchr() lookups with per-variant reverse tables and process input in 4-character groups. Each group is mapped to numeric values and combined into 3 bytes. Padded and unpadded forms are validated explicitly, rejecting invalid '=' usage and enforcing tail rules. This improves throughput by ~43-52x. This patch (of 6): Extend the base64 API to support multiple variants (standard, URL-safe, and IMAP) as defined in RFC 4648 and RFC 3501. The API now takes a variant parameter and an option to control padding. Update NVMe auth code to use the new interface with BASE64_STD. Link: https://lkml.kernel.org/r/20251114055829.87814-1-409411716@gms.tku.edu.tw Link: https://lkml.kernel.org/r/20251114060045.88792-1-409411716@gms.tku.edu.tw Signed-off-by: Kuan-Wei Chiu Co-developed-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Signed-off-by: Guan-Chun Wu <409411716@gms.tku.edu.tw> Reviewed-by: David Laight Cc: Christoph Hellwig Cc: Eric Biggers Cc: Ilya Dryomov Cc: Jaegeuk Kim Cc: Jens Axboe Cc: Keith Busch Cc: Sagi Grimberg Cc: "Theodore Y. Ts'o" Cc: Viacheslav Dubeyko Cc: Xiubo Li Cc: Yu-Sheng Huang Signed-off-by: Andrew Morton commit 03ef32d665e8a23d7ce5965b8b035666cfb47866 Author: Feng Tang Date: Thu Nov 13 19:10:39 2025 +0800 sys_info: add a default kernel sys_info mask Which serves as a global default sys_info mask. When users want the same system information for many error cases (panic, hung, lockup ...), they can chose to set this global knob only once, while not setting up each individual sys_info knobs. This just adds a 'lazy' option, and doesn't change existing kernel behavior as the mask is 0 by default. Link: https://lkml.kernel.org/r/20251113111039.22701-5-feng.tang@linux.alibaba.com Suggested-by: Andrew Morton Signed-off-by: Feng Tang Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Petr Mladek Cc: Steven Rostedt Signed-off-by: Andrew Morton commit a9af76a78760717361cccc884dc649e30db61c8b Author: Feng Tang Date: Thu Nov 13 19:10:38 2025 +0800 watchdog: add sys_info sysctls to dump sys info on system lockup When soft/hard lockup happens, developers may need different kinds of system information (call-stacks, memory info, locks, etc.) to help debugging. Add 'softlockup_sys_info' and 'hardlockup_sys_info' sysctl knobs to take human readable string like "tasks,mem,timers,locks,ftrace,...", and when system lockup happens, all requested information will be printed out. (refer kernel/sys_info.c for more details). Link: https://lkml.kernel.org/r/20251113111039.22701-4-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Reviewed-by: Petr Mladek Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Petr Mladek Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 8b2b9b4f6f4f7a61b7e323479ed7d9faa21d6287 Author: Feng Tang Date: Thu Nov 13 19:10:37 2025 +0800 hung_task: add hung_task_sys_info sysctl to dump sys info on task-hung When task-hung happens, developers may need different kinds of system information (call-stacks, memory info, locks, etc.) to help debugging. Add 'hung_task_sys_info' sysctl knob to take human readable string like "tasks,mem,timers,locks,ftrace,...", and when task-hung happens, all requested information will be dumped. (refer kernel/sys_info.c for more details). Meanwhile, the newly introduced sys_info() call is used to unify some existing info-dumping knobs. [feng.tang@linux.alibaba.com: maintain consistecy established behavior, per Lance and Petr] Link: https://lkml.kernel.org/r/aRncJo1mA5Zk77Hr@U-2FWC9VHC-2323.local Link: https://lkml.kernel.org/r/20251113111039.22701-3-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Reviewed-by: Petr Mladek Reviewed-by: Lance Yang Cc: Jonathan Corbet Cc: "Paul E . McKenney" Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 5f264c00b669b934300dff506d0aa9f6f8f8c53e Author: Feng Tang Date: Thu Nov 13 19:10:36 2025 +0800 docs: panic: correct some sys_ifo names in sysctl doc Patch series "Enable hung_task and lockup cases to dump system info on demand", v2. When working on kernel stability issues: panic, task-hung and soft/hard lockup are frequently met. And to debug them, user may need lots of system information at that time, like task call stacks, lock info, memory info, ftrace dump, etc. panic case already uses sys_info() for this purpose, and has a 'panic_sys_info' sysctl(also support cmdline setup) interface to take human readable string like "tasks,mem,timers,locks,ftrace,..." to control what kinds of information is needed. Which is also helpful to debug task-hung and lockup cases. So this patchset introduces the similar sys_info sysctl interface for task-hung and lockup cases. his is mainly for debugging and the info dumping could be intrusive, like dumping call stack for all tasks when system has huge number of tasks, similarly for ftrace dump (we may add tracing_stop() and tracing_start() around it) Locally these have been used in our bug chasing for stability issues and were helpful. As Andrew suggested, add a configurable global 'kernel_sys_info' knob. When error scenarios like panic/hung-task/lockup etc doesn't setup their own sys_info knob and calls sys_info() with parameter "0", this global knob will take effect. It could be used for other kernel cases like OOM, which may not need one dedicated sys_info knob. This patch (of 4): Some sys_info names wered forgotten to change in patch iterations, while the right names are defined in kernel/sys_info.c. Link: https://lkml.kernel.org/r/20251113111039.22701-1-feng.tang@linux.alibaba.com Link: https://lkml.kernel.org/r/20251113111039.22701-2-feng.tang@linux.alibaba.com Fixes: d747755917bf ("panic: add 'panic_sys_info' sysctl to take human readable string parameter") Signed-off-by: Feng Tang Reviewed-by: Petr Mladek Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 9ab38c5216634d8adb22156ddbd32f2d195b27a7 Author: Kuan-Wei Chiu Date: Thu Nov 13 19:34:13 2025 +0000 Revert "lib/plist.c: enforce memory ordering in plist_check_list" This reverts commit 7abcb84f953df037d40fad66f2109db318dd155b. The introduction of WRITE_ONCE() calls for the 'prev' and 'next' variables inside plist_check_list() was a misapplication. WRITE_ONCE() is fundamentally a compiler barrier designed to prevent compiler optimizations (like caching or reordering) on shared memory locations. However, the variables 'prev' and 'next' are local, stack-allocated pointers accessed only by the current thread's invocation of the function. Since these pointers are thread-local and are never accessed concurrently, applying WRITE_ONCE() to them is semantically incorrect and unnecessary. Furthermore, the use of WRITE_ONCE() on local variables prevents the compiler from performing standard optimizations, such as keeping these variables cached solely in CPU registers throughout the loop, potentially introducing performance overhead. Restore the conventional C assignment for local loop variables, allowing the compiler to generate optimal code. Link: https://lkml.kernel.org/r/20251113193413.499309-1-visitorckw@gmail.com Signed-off-by: Kuan-Wei Chiu Cc: I Hsin Cheng Cc: Ingo Molnar Signed-off-by: Andrew Morton commit b50144900a56404fb784c9fd6cddeeee4093b383 Author: Gustavo Padovan Date: Wed Nov 12 10:43:30 2025 -0300 MAINTAINERS: remove Gustavo from sync framework I haven't been involved in the work anymore for some time. It is only fair that I remove myself from it and let other continue to take care of it. Link: https://lkml.kernel.org/r/20251112134330.64130-1-gustavo.padovan@collabora.com Signed-off-by: Gustavo Padovan Cc: Sumit Semwal Signed-off-by: Andrew Morton commit 242b872239f6a7deacbc20ab9406ea40cb738ec6 Author: Xie Yuanbin Date: Sun Nov 9 16:37:15 2025 +0800 include/linux/once_lite.h: fix judgment in WARN_ONCE with clang For c code: ```c extern int xx; void test(void) { if (WARN_ONCE(xx, "x")) __asm__ volatile ("nop":::); } ``` Clang will generate the following assembly code: ```assemble test: movl xx(%rip), %eax // Assume xx == 0 (likely case) testl %eax, %eax // judge once je .LBB0_3 // jump to .LBB0_3 testb $1, test.__already_done(%rip) je .LBB0_2 .LBB0_3: testl %eax, %eax // judge again je .LBB0_5 // jump to .LBB0_5 .LBB0_4: nop .LBB0_5: retq // omit ``` In the above code, `xx == 0` should be a likely case, but in this case, xx has been judged twice. Test info: 1. kernel source: linux-next commit 9c0826a5d9aa4d52206d ("Add linux-next specific files for 20251107") 2. compiler: clang: Debian clang version 21.1.4 (8) with Debian LLD 21.1.4 (compatible with GNU linkers) 3. config: base on default x86_64_defconfig, and setting: CONFIG_MITIGATION_RETHUNK=n CONFIG_STACKPROTECTOR=n Add unlikely to __ret_cond to help the compiler optimize correctly. [akpm@linux-foundation.org: undo whitespace changes] Link: https://lkml.kernel.org/r/20251109083715.24495-1-qq570070308@gmail.com Signed-off-by: Xie Yuanbin Cc: Bill Wendling Cc: Jan Kara Cc: Justin Stitt Cc: Maninder Singh Cc: Masahiro Yamada Cc: Nathan Chancellor Cc: Will Deacon Signed-off-by: Andrew Morton commit 1ab980e90ce31f61067eae11772670f1dcdf5a8f Author: Ryusuke Konishi Date: Sat Nov 8 00:32:49 2025 +0900 MAINTAINERS: update nilfs2 entry Viacheslav has kindly offered to help with the maintenance of nilfs2 by upstreaming patches, similar to the HFS/HFS+ tree. I've accepted his offer, and will therefore add him as a co-maintainer and switch the project's git tree for that role. At the same time, change the outdated status field to Maintained to reflect the current state. Link: https://lkml.kernel.org/r/20251107153530.9023-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Acked-by: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit 14954cd190e8cd5664a25984179b1a977615c9ed Author: zhang jiao Date: Thu Nov 6 09:07:34 2025 +0800 fs/proc/page: remove unused KPMBITS KPMBITS is never referenced in the code. Just remove it. Link: https://lkml.kernel.org/r/20251106010735.1603-1-zhangjiao2@cmss.chinamobile.com Signed-off-by: zhang jiao Reviewed-by: Zi Yan Cc: David Hildenbrand Cc: Liu Ye Cc: Luiz Capitulino Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Signed-off-by: Andrew Morton commit f3fb126fdc9e148da38a6e25d7fc609774a99fc3 Author: Andy Shevchenko Date: Thu Nov 6 16:20:51 2025 +0100 math.h: amend abs() kernel-doc and add a note about signed type limits - amend the kernel-doc so the description is decoupled from the parameter descriptions. - add a note to explain behaviour for the signed types when supplied value is the minimum (e.g., INT_MIN for int type). Link: https://lkml.kernel.org/r/20251106152051.2361551-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Cc: Jonathan Cameron Signed-off-by: Andrew Morton commit 581ee79a254759ea8288057f762389820b39adcc Author: Ilya Leoshkevich Date: Thu Nov 6 13:43:42 2025 +0100 scripts/gdb/symbols: make BPF debug info available to GDB One can debug BPF programs with QEMU gdbstub by setting a breakpoint on bpf_prog_kallsyms_add(), waiting for a hit with a matching aux.name, and then setting a breakpoint on bpf_func. This is tedious, error-prone, and also lacks line numbers. Automate this in a way similar to the existing support for modules in lx-symbols. Enumerate and monitor changes to both BPF kallsyms and JITed progs. For each ksym, generate and compile a synthetic .s file containing the name, code, and size. In addition, if this ksym is also a prog, and not a trampoline, add line number information. Ensure that this is a no-op if the kernel is built without BPF support or if "as" is missing. In theory the "as" dependency may be dropped by generating the synthetic .o file manually, but this is too much complexity for too little benefit. Now one can debug BPF progs out of the box like this: (gdb) lx-symbols -bpf (gdb) b bpf_prog_4e612a6a881a086b_arena_list_add Breakpoint 2 (bpf_prog_4e612a6a881a086b_arena_list_add) pending. # ./test_progs -t arena_list Thread 4 hit Breakpoint 2, bpf_prog_4e612a6a881a086b_arena_list_add () at linux/tools/testing/selftests/bpf/progs/arena_list.c:51 51 list_head = &global_head; (gdb) n bpf_prog_4e612a6a881a086b_arena_list_add () at linux/tools/testing/selftests/bpf/progs/arena_list.c:53 53 for (i = zero; i < cnt && can_loop; i++) { This also works for subprogs. Link: https://lkml.kernel.org/r/20251106124600.86736-3-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkman Cc: Heiko Carstens Cc: Jan Kiszka Cc: Kieran Bingham Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit caa71919a622e3f7d290d4f17ae538b15f5cb6d3 Author: Ilya Leoshkevich Date: Thu Nov 6 13:43:41 2025 +0100 scripts/gdb/radix-tree: add lx-radix-tree-command Patch series "scripts/gdb/symbols: make BPF debug info available to GDB", v2. This series greatly simplifies debugging BPF progs when using QEMU gdbstub by providing symbol names, sizes, and line numbers to GDB. Patch 1 adds radix tree iteration, which is necessary for parsing prog_idr. Patch 2 is the actual implementation; its description contains some details on how to use this. This patch (of 2): Add a function and a command to iterate over radix tree contents. Duplicate the C implementation in Python, but drop support for tagging. Link: https://lkml.kernel.org/r/20251106124600.86736-1-iii@linux.ibm.com Link: https://lkml.kernel.org/r/20251106124600.86736-2-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich Cc: Alexander Gordeev Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkman Cc: Heiko Carstens Cc: Jan Kiszka Cc: Kieran Bingham Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit c9dddd981600538d8c39d58ba89679439231959f Author: Pratyush Yadav Date: Wed Nov 5 11:20:19 2025 +0100 MAINTAINERS: add Pratyush as a reviewer for KHO I have been reviewing most patches for KHO already, and it is easier to spot them if I am directly in Cc. Link: https://lkml.kernel.org/r/20251105102022.18798-1-pratyush@kernel.org Signed-off-by: Pratyush Yadav Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Cc: Alexander Graf Cc: Baoquan He Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 1d1ef8c1fb5e488c0f68499239d8dc61b1399db9 Author: David Laight Date: Wed Nov 5 20:10:35 2025 +0000 lib: test_mul_u64_u64_div_u64(): test the 32bit code on 64bit There are slight differences in the mul_u64_add_u64_div_u64() code between 32bit and 64bit systems. Compile and test the 32bit version on 64bit hosts for better test coverage. Link: https://lkml.kernel.org/r/20251105201035.64043-10-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit d10bb374c41e4c4dced04ae7d2fe2d782a5858a0 Author: David Laight Date: Wed Nov 5 20:10:34 2025 +0000 lib: mul_u64_u64_div_u64(): optimise the divide code Replace the bit by bit algorithm with one that generates 16 bits per iteration on 32bit architectures and 32 bits on 64bit ones. On my zen 5 this reduces the time for the tests (using the generic code) from ~3350ns to ~1000ns. Running the 32bit algorithm on 64bit x86 takes ~1500ns. It'll be slightly slower on a real 32bit system, mostly due to register pressure. The savings for 32bit x86 are much higher (tested in userspace). The worst case (lots of bits in the quotient) drops from ~900 clocks to ~130 (pretty much independant of the arguments). Other 32bit architectures may see better savings. It is possibly to optimise for divisors that span less than __LONG_WIDTH__/2 bits. However I suspect they don't happen that often and it doesn't remove any slow cpu divide instructions which dominate the result. Typical improvements for 64bit random divides: old new sandy bridge: 470 150 haswell: 400 144 piledriver: 960 467 I think rdpmc is very slow. zen5: 244 80 (Timing is 'rdpmc; mul_div(); rdpmc' with the multiply depending on the first rdpmc and the second rdpmc depending on the quotient.) Object code (64bit x86 test program): old 0x173 new 0x141. Link: https://lkml.kernel.org/r/20251105201035.64043-9-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit 630f96a687def5616d6fa7f069adcea158320909 Author: David Laight Date: Wed Nov 5 20:10:33 2025 +0000 lib: mul_u64_u64_div_u64(): optimise multiply on 32bit x86 gcc generates horrid code for both ((u64)u32_a * u32_b) and (u64_a + u32_b). As well as the extra instructions it can generate a lot of spills to stack (including spills of constant zeros and even multiplies by constant zero). mul_u32_u32() already exists to optimise the multiply. Add a similar add_u64_32() for the addition. Disable both for clang - it generates better code without them. Move the 64x64 => 128 multiply into a static inline helper function for code clarity. No need for the a/b_hi/lo variables, the implicit casts on the function calls do the work for us. Should have minimal effect on the generated code. Use mul_u32_u32() and add_u64_u32() in the 64x64 => 128 multiply in mul_u64_add_u64_div_u64(). Link: https://lkml.kernel.org/r/20251105201035.64043-8-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit f0bff2eb04686f13386b2af97bc7aaa09f020f35 Author: David Laight Date: Wed Nov 5 20:10:32 2025 +0000 lib: test_mul_u64_u64_div_u64(): test both generic and arch versions Change the #if in div64.c so that test_mul_u64_u64_div_u64.c can compile and test the generic version (including the 'long multiply') on architectures (eg amd64) that define their own copy. Test the kernel version and the locally compiled version on all arch. Output the time taken (in ns) on the 'test completed' trace. For reference, on my zen 5, the optimised version takes ~220ns and the generic version ~3350ns. Using the native multiply saves ~200ns and adding back the ilog2() 'optimisation' test adds ~50ms. Link: https://lkml.kernel.org/r/20251105201035.64043-7-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit 500db21917e8aaafd65360bfed35845d549aa3dd Author: David Laight Date: Wed Nov 5 20:10:31 2025 +0000 lib: add tests for mul_u64_u64_div_u64_roundup() Replicate the existing mul_u64_u64_div_u64() test cases with round up. Update the shell script that verifies the table, remove the comment markers so that it can be directly pasted into a shell. Rename the divisor from 'c' to 'd' to match mul_u64_add_u64_div_u64(). It any tests fail then fail the module load with -EINVAL. Link: https://lkml.kernel.org/r/20251105201035.64043-6-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit 6480241f31f543333ed0c7a209962412461f6e41 Author: David Laight Date: Wed Nov 5 20:10:30 2025 +0000 lib: add mul_u64_add_u64_div_u64() and mul_u64_u64_div_u64_roundup() The existing mul_u64_u64_div_u64() rounds down, a 'rounding up' variant needs 'divisor - 1' adding in between the multiply and divide so cannot easily be done by a caller. Add mul_u64_add_u64_div_u64(a, b, c, d) that calculates (a * b + c)/d and implement the 'round down' and 'round up' using it. Update the x86-64 asm to optimise for 'c' being a constant zero. Add kerndoc definitions for all three functions. Link: https://lkml.kernel.org/r/20251105201035.64043-5-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit d91f891d588557874a45a5f584b6da0b433acee7 Author: David Laight Date: Wed Nov 5 20:10:29 2025 +0000 lib: mul_u64_u64_div_u64(): simplify check for a 64bit product If the product is only 64bits div64_u64() can be used for the divide. Replace the pre-multiply check (ilog2(a) + ilog2(b) <= 62) with a simple post-multiply check that the high 64bits are zero. This has the advantage of being simpler, more accurate and less code. It will always be faster when the product is larger than 64bits. Most 64bit cpu have a native 64x64=128 bit multiply, this is needed (for the low 64bits) even when div64_u64() is called - so the early check gains nothing and is just extra code. 32bit cpu will need a compare (etc) to generate the 64bit ilog2() from two 32bit bit scans - so that is non-trivial. (Never mind the mess of x86's 'bsr' and any oddball cpu without fast bit-scan instructions.) Whereas the additional instructions for the 128bit multiply result are pretty much one multiply and two adds (typically the 'adc $0,%reg' can be run in parallel with the instruction that follows). The only outliers are 64bit systems without 128bit mutiply and simple in order 32bit ones with fast bit scan but needing extra instructions to get the high bits of the multiply result. I doubt it makes much difference to either, the latter is definitely not mainstream. If anyone is worried about the analysis they can look at the generated code for x86 (especially when cmov isn't used). Link: https://lkml.kernel.org/r/20251105201035.64043-4-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit 08092babd362170e059330a6a2d44c2891d9dbac Author: David Laight Date: Wed Nov 5 20:10:28 2025 +0000 lib: mul_u64_u64_div_u64(): combine overflow and divide by zero checks Since the overflow check always triggers when the divisor is zero move the check for divide by zero inside the overflow check. This means there is only one test in the normal path. Link: https://lkml.kernel.org/r/20251105201035.64043-3-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit 5944f875ac27cae8b831206aef011a444efa637d Author: David Laight Date: Wed Nov 5 20:10:27 2025 +0000 lib: mul_u64_u64_div_u64(): rename parameter 'c' to 'd' Patch series "Implement mul_u64_u64_div_u64_roundup()", v5. The pwm-stm32.c code wants a 'rounding up' version of mul_u64_u64_div_u64(). This can be done simply by adding 'divisor - 1' to the 128bit product. Implement mul_u64_add_u64_div_u64(a, b, c, d) = (a * b + c)/d based on the existing code. Define mul_u64_u64_div_u64(a, b, d) as mul_u64_add_u64_div_u64(a, b, 0, d) and mul_u64_u64_div_u64_roundup(a, b, d) as mul_u64_add_u64_div_u64(a, b, d-1, d). Only x86-64 has an optimsed (asm) version of the function. That is optimised to avoid the 'add c' when c is known to be zero. In all other cases the extra code will be noise compared to the software divide code. The test module has been updated to test mul_u64_u64_div_u64_roundup() and also enhanced it to verify the C division code on x86-64 and the 32bit division code on 64bit. This patch (of 9): Change to prototype from mul_u64_u64_div_u64(u64 a, u64 b, u64 c) to mul_u64_u64_div_u64(u64 a, u64 b, u64 d). Using 'd' for 'divisor' makes more sense. An upcoming change adds a 'c' parameter to calculate (a * b + c)/d. Link: https://lkml.kernel.org/r/20251105201035.64043-1-david.laight.linux@gmail.com Link: https://lkml.kernel.org/r/20251105201035.64043-2-david.laight.linux@gmail.com Signed-off-by: David Laight Reviewed-by: Nicolas Pitre Cc: Biju Das Cc: Borislav Betkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Jens Axboe Cc: Li RongQing Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Gleinxer Cc: Uwe Kleine-König Signed-off-by: Andrew Morton commit af9b65d6864aa5e94839d150b902168fd44c6107 Author: Christoph Hellwig Date: Tue Nov 4 07:19:20 2025 -0500 kernel/hung_task: unexport sysctl_hung_task_timeout_secs This was added by the bcachefs pull requests despite various objections, and with bcachefs removed is now unused. This reverts commit 5c3273ec3c6a ("kernel/hung_task.c: export sysctl_hung_task_timeout_secs"). Link: https://lkml.kernel.org/r/20251104121920.2430568-1-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Lance Yang Reviewed-by: Masami Hiramatsu (Google) Cc: Kent Overstreet Signed-off-by: Andrew Morton commit bd97c976419126ee3e9acd4957f6f16a90316643 Author: Andy Shevchenko Date: Tue Nov 4 19:38:34 2025 +0100 util_macros.h: fix kernel-doc for u64_to_user_ptr() The added documentation to u64_to_user_ptr() misspelled the function name. Fix it. Link: https://lkml.kernel.org/r/20251104183834.1046584-1-andriy.shevchenko@linux.intel.com Fixes: 029c896c4105 ("kernel.h: move PTR_IF() and u64_to_user_ptr() to util_macros.h") Signed-off-by: Andy Shevchenko Cc: Alexandru Ardelean Signed-off-by: Andrew Morton commit 464c7ea5c3ffa333a2c1a8dfd68b157ced1edc5a Author: Carlos López Date: Fri Oct 31 12:19:09 2025 +0100 checkpatch: add IDR to the deprecated list As of commit 85656ec193e9, the IDR interface is marked as deprecated in the documentation, but no checks are made in that regard for new code. Add the existing IDR initialization APIs to the deprecated list in checkpatch, so that if new code is introduced using these APIs, a warning is emitted. Link: https://lkml.kernel.org/r/20251031111908.2266077-2-clopez@suse.de Signed-off-by: Carlos López Suggested-by: Dan Williams Acked-by: Dan Williams Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Lukas Bulwahn Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 7f37d88f5cb32fff454f12cd99444686482ca23b Author: Borislav Petkov (AMD) Date: Wed Oct 29 13:27:43 2025 +0100 lib/Kconfig.debug: cleanup CONFIG_DEBUG_SECTION_MISMATCH help text Simplify formulations, correct flow, split it into proper paragraphs and update structure. No functional changes. Link: https://lkml.kernel.org/r/20251029122743.1110-1-bp@kernel.org Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Andrew Morton commit 93ce0ff117b0c468961d7c296a03ad57e1e8da9f Author: Deepanshu Kartikey Date: Thu Oct 30 18:30:03 2025 +0300 ocfs2: validate cl_bpc in allocator inodes to prevent divide-by-zero The chain allocator field cl_bpc (blocks per cluster) is read from disk and used in division operations without validation. A corrupted filesystem image with cl_bpc=0 causes a divide-by-zero crash in the kernel: divide error: 0000 [#1] PREEMPT SMP KASAN RIP: 0010:ocfs2_bg_discontig_add_extent fs/ocfs2/suballoc.c:335 [inline] RIP: 0010:ocfs2_block_group_fill+0x5bd/0xa70 fs/ocfs2/suballoc.c:386 Call Trace: ocfs2_block_group_alloc+0x7e9/0x1330 fs/ocfs2/suballoc.c:703 ocfs2_reserve_suballoc_bits+0x20a6/0x4640 fs/ocfs2/suballoc.c:834 ocfs2_reserve_new_inode+0x4f4/0xcc0 fs/ocfs2/suballoc.c:1074 ocfs2_mknod+0x83c/0x2050 fs/ocfs2/namei.c:306 This patch adds validation in ocfs2_validate_inode_block() to ensure cl_bpc matches the expected value calculated from the superblock's cluster size and block size for chain allocator inodes (identified by OCFS2_CHAIN_FL). Moving the validation to inode validation time (rather than allocation time) has several benefits: - Validates once when the inode is read, rather than on every allocation - Protects all code paths that use cl_bpc (allocation, resize, etc.) - Follows the existing pattern of inode validation in OCFS2 - Centralizes validation logic The validation catches both: - Zero values that cause divide-by-zero crashes - Non-zero but incorrect values indicating filesystem corruption or mismatched filesystem geometry With this fix, mounting a corrupted filesystem produces: OCFS2: ERROR (device loop0): ocfs2_validate_inode_block: Inode 74 has corrupted cl_bpc: ondisk=0 expected=16 instead of a kernel crash. [dmantipov@yandex.ru: combine into the series and tweak the message to fit the commonly used style] Link: https://lkml.kernel.org/r/20251030153003.1934585-2-dmantipov@yandex.ru Link: https://lore.kernel.org/ocfs2-devel/20251026132625.12348-1-kartikey406@gmail.com/T/#u [v1] Link: https://lore.kernel.org/all/20251027124131.10002-1-kartikey406@gmail.com/T/ [v2] Signed-off-by: Deepanshu Kartikey Signed-off-by: Dmitry Antipov Reported-by: syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fd8af97c7227fe605d95 Tested-by: syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com Suggested-by: Joseph Qi Reviewed-by: Joseph Qi Cc: Heming Zhao Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit e1c70505ee8158c1108340d9cd67182ade93af4a Author: Dmitry Antipov Date: Thu Oct 30 18:30:02 2025 +0300 ocfs2: add extra consistency checks for chain allocator dinodes When validating chain allocator dinode in 'ocfs2_validate_inode_block()', add an extra checks whether a) the maximum amount of chain records in 'struct ocfs2_chain_list' matches the value calculated based on the filesystem block size, and b) the next free slot index is within the valid range. Link: https://lkml.kernel.org/r/20251030153003.1934585-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reported-by: syzbot+77026564530dbc29b854@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854 Reported-by: syzbot+5054473a31f78f735416@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5054473a31f78f735416 Suggested-by: Joseph Qi Reviewed-by: Joseph Qi Cc: Junxiao Bi Cc: Jun Piao Cc: Deepanshu Kartikey Cc: Heming Zhao Cc: Joel Becker Cc: Mark Fasheh Signed-off-by: Andrew Morton commit 9125163273f8033af5d38907b483c1d9f99d781b Author: Andy Shevchenko Date: Thu Oct 30 12:44:22 2025 +0100 panic: sys_info: factor out read and write handlers For the sake of the code readability and easier maintenance factor out read and write sys_info handlers. [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20251030132007.3742368-7-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Cc: Feng Tang Signed-off-by: Andrew Morton commit f791dcc842cb1cb3777ae4122be4cd37624ad53d Author: Andy Shevchenko Date: Thu Oct 30 12:44:21 2025 +0100 panic: sys_info: deduplicate local variable 'table; assignments The both handlers use the local 'table' variable and assign the same data to it, deduplicate that. Link: https://lkml.kernel.org/r/20251030132007.3742368-6-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Feng Tang Reviewed-by: Petr Mladek Signed-off-by: Andrew Morton commit eb72c4667f4567a7363f6e00d082d2ab32b6a03a Author: Andy Shevchenko Date: Thu Oct 30 12:44:20 2025 +0100 panic: sys_info: rewrite a fix for a compilation error (`make W=1`) Compiler was not happy about dead variable in use: lib/sys_info.c:52:19: error: variable 'sys_info_avail' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] 52 | static const char sys_info_avail[] = "tasks,mem,timers,locks,ftrace,all_bt,blocked_tasks"; | ^~~~~~~~~~~~~~ This was fixed by adding __maybe_unused attribute that just hides the issue and didn't actually fix the root cause. Rewrite the fix by moving the local variable from stack to a heap. As a side effect this drops unneeded "synchronisation" of duplicative info and also makes code ready for the further refactoring. Link: https://lkml.kernel.org/r/20251030132007.3742368-5-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Cc: Feng Tang Signed-off-by: Andrew Morton commit d13adc6147f5848d6ad9900fdb1dbf9a280a2f64 Author: Andy Shevchenko Date: Thu Oct 30 12:44:19 2025 +0100 panic: sys_info:replace struct sys_info_name with plain array of strings There is no need to keep a custom structure just for the need of a plain array of strings. Replace struct sys_info_name with plain array of strings. With that done, simplify the code, in particular, naturally use for_each_set_bit() when iterating over si_bits_global bitmap. Link: https://lkml.kernel.org/r/20251030132007.3742368-4-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Cc: Feng Tang Signed-off-by: Andrew Morton commit 760fc597c33d5a727507c8bb19d6ab87a8c5885b Author: Andy Shevchenko Date: Thu Oct 30 12:44:18 2025 +0100 panic: sys_info: align constant definition names with parameters Align constant definition names with parameters to make it easier to map. It's also better to maintain and extend the names while keeping their uniqueness. Link: https://lkml.kernel.org/r/20251030132007.3742368-3-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Feng Tang Reviewed-by: Petr Mladek Signed-off-by: Andrew Morton commit d79a3aeb747c17095d679cc4402d87f0e7c3405e Author: Andy Shevchenko Date: Thu Oct 30 12:44:17 2025 +0100 panic: sys_info: capture si_bits_global before iterating over it Patch series "panic: sys_info: Refactor and fix a potential issue", v3. While targeting the compilation issue due to dangling variable, I have noticed more opportunities for refactoring that helps to avoid above mentioned compilation issue in a cleaner way and also fixes a potential problem with global variable access. This patch (of 6): The for-loop might re-read the content of the memory the si_bits_global points to on each iteration. Instead, just capture it for the sake of consistency and use that instead. Link: https://lkml.kernel.org/r/20251030132007.3742368-1-andriy.shevchenko@linux.intel.com Link: https://lkml.kernel.org/r/20251030132007.3742368-2-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Feng Tang Reviewed-by: Petr Mladek Signed-off-by: Andrew Morton commit e28f44013dc4ec820bdb7182d5a2188550bc07fd Author: Chris Morgan Date: Tue Nov 18 16:30:45 2025 -0600 arm64: dts: rockchip: Add clk32k_in for Indiedroid Nova The clk32k_in pin of the SoC is connected to the real time clock according to the schematics. Set the pin definition on the real time clock to reflect this. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251118223048.4531-2-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 9f80b3952318d7ef18573a5010f06118602f992e Author: Michael Opdenacker Date: Tue Nov 18 15:56:43 2025 +0000 arm64: dts: rockchip: Add Asus Tinker Board 3 and 3S device tree Add initial device tree support for Asus Tinker Board 3 [1] and 3S [2], which are SBCs based on the Rockchip 3566 SoC. The "3S" version ("S" for "storage") just adds a 16 GB eMMC and a "mask ROM" DIP switch (to mask the eMMC and enter "Mask ROM" mode for recovery) to the "3" version. This adds support for: - Debug UART (/dev/ttyS2) - SD card (/dev/mmcblk1) - eMMC (/dev/mmcblk0, only on Tinker Board 3S) - I2C: - i2c0 (internal bus with a PMIC and regulators) - i2c2 (internal bus with an at24 eeprom and an RTC device) - USB 2.0 ports - 2 GPIO LEDS [1] https://tinker-board.asus.com/series/tinker-board-3.html [2] https://tinker-board.asus.com/series/tinker-board-3s.html Signed-off-by: Michael Opdenacker Link: https://patch.msgid.link/20251118-tinker3-v3-2-2903693f2ebb@rootcommit.com Signed-off-by: Heiko Stuebner commit f4e81d0b95f3257a2fcfdbfaa2d8ed41015c621b Author: Michael Opdenacker Date: Tue Nov 18 15:56:42 2025 +0000 dt-bindings: arm: rockchip: Add Asus Tinker Board 3/3S Document the compatible strings for Asus Tinker Board 3 [1] and 3S [2], which are SBCs based on the Rockchip 3566 SoC. The "3S" version ("S" for "storage") just adds a 16 GB eMMC and a "mask ROM" DIP switch to the "3" version. [1] https://tinker-board.asus.com/series/tinker-board-3.html [2] https://tinker-board.asus.com/series/tinker-board-3s.html Signed-off-by: Michael Opdenacker Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251118-tinker3-v3-1-2903693f2ebb@rootcommit.com Signed-off-by: Heiko Stuebner commit 10c64d4ff42a9c59981382b0da44783ea76673b8 Author: Ping Cheng Date: Mon Oct 27 13:39:25 2025 -0700 selftests/hid-tablet: add ABS_DISTANCE test for stylus/pen For pen and stylus, the ABS_Z event reports ABS_DISTANCE values in the hid generic kernel driver. This test is to make sure that the assignment is properly done for all pen and stylus tools. Same as tilt, distance is an optional event. Signed-off-by: Benjamin Tissoires Signed-off-by: Ping Cheng Signed-off-by: Tatsunosuke Tobit Signed-off-by: Jiri Kosina commit 7953794f741e94d30df9dafaaa4c031c85b891d6 Author: Ping Cheng Date: Mon Oct 27 13:37:42 2025 -0700 HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen HID_GD_Z is mapped to ABS_Z for stylus and pen in hid-input.c. But HID_GD_Z should be used to report ABS_DISTANCE for stylus and pen as described at: Documentation/input/event-codes.rst#n226 * ABS_DISTANCE: - Used to describe the distance of a tool from an interaction surface. This event should only be emitted while the tool is hovering, meaning in close proximity of the device and while the value of the BTN_TOUCH code is 0. If the input device may be used freely in three dimensions, consider ABS_Z instead. - BTN_TOOL_ should be set to 1 when the tool comes into detectable proximity and set to 0 when the tool leaves detectable proximity. BTN_TOOL_ signals the type of tool that is currently detected by the hardware and is otherwise independent of ABS_DISTANCE and/or BTN_TOUCH. This patch makes the correct mapping. The ABS_DISTANCE is currently not mapped by any HID usage in hid-generic driver. Signed-off-by: Ping Cheng Cc: stable@kernel.org Signed-off-by: Jiri Kosina commit c7ba92bcfea34f6b4afc744c3b65c8f7420fefe0 Author: Lorenzo Stoakes Date: Mon Nov 17 17:33:39 2025 +0000 testing/selftests/mm: add soft-dirty merge self-test Assert that we correctly merge VMAs containing VM_SOFTDIRTY flags now that we correctly handle these as sticky. In order to do so, we have to account for the fact the pagemap interface checks soft dirty PTEs and additionally that newly merged VMAs are marked VM_SOFTDIRTY. We do this by using use unfaulted anon VMAs, establishing one and clearing references on that one, before establishing another and merging the two before checking that soft-dirty is propagated as expected. We check that this functions correctly with mremap() and mprotect() as sample cases, because VMA merge of adjacent newly mapped VMAs will automatically be made soft-dirty due to existing logic which does so. We are therefore exercising other means of merging VMAs. Link: https://lkml.kernel.org/r/d5a0f735783fb4f30a604f570ede02ccc5e29be9.1763399675.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Andrey Vagin Cc: David Hildenbrand (Red Hat) Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Cyrill Gorcunov Signed-off-by: Andrew Morton commit 6707915e030a3258868355f989b80140c1a45bbe Author: Lorenzo Stoakes Date: Mon Nov 17 17:33:38 2025 +0000 mm: propagate VM_SOFTDIRTY on merge Patch series "make VM_SOFTDIRTY a sticky VMA flag", v2. Currently we set VM_SOFTDIRTY when a new mapping is set up (whether by establishing a new VMA, or via merge) as implemented in __mmap_complete() and do_brk_flags(). However, when performing a merge of existing mappings such as when performing mprotect(), we may lose the VM_SOFTDIRTY flag. Now we have the concept of making VMA flags 'sticky', that is that they both don't prevent merge and, importantly, are propagated to merged VMAs, this seems a sensible alternative to the existing special-casing of VM_SOFTDIRTY. We additionally add a self-test that demonstrates that this logic behaves as expected. This patch (of 2): Currently we set VM_SOFTDIRTY when a new mapping is set up (whether by establishing a new VMA, or via merge) as implemented in __mmap_complete() and do_brk_flags(). However, when performing a merge of existing mappings such as when performing mprotect(), we may lose the VM_SOFTDIRTY flag. This is because currently we simply ignore VM_SOFTDIRTY for the purposes of merge, so one VMA may possess the flag and another not, and whichever happens to be the target VMA will be the one upon which the merge is performed which may or may not have VM_SOFTDIRTY set. Now we have the concept of 'sticky' VMA flags, let's make VM_SOFTDIRTY one which solves this issue. Additionally update VMA userland tests to propagate changes. [akpm@linux-foundation.org: update comments, per Lorenzo] Link: https://lkml.kernel.org/r/0019e0b8-ee1e-4359-b5ee-94225cbe5588@lucifer.local Link: https://lkml.kernel.org/r/cover.1763399675.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/955478b5170715c895d1ef3b7f68e0cd77f76868.1763399675.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Suggested-by: Vlastimil Babka Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Pedro Falcato Acked-by: Andrey Vagin Reviewed-by: Vlastimil Babka Acked-by: Cyrill Gorcunov Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 6e57c1ce81e0c14e4d46add2b8eb27a4b75d7b26 Author: SeongJae Park Date: Wed Nov 12 07:41:12 2025 -0800 Docs/mm/damon/maintainer-profile: fix grammatical errors Fix a few grammatical errors on DAMON maintainer-profile. Link: https://lkml.kernel.org/r/20251112154114.66053-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7ad58e009dd159d7004592d826749003197f4083 Author: SeongJae Park Date: Wed Nov 12 07:41:11 2025 -0800 Docs/mm/damon/maintainer-profile: fix a typo on mm-untable link Commit 0b473f9e6eac ("Docs/mm/damon/maintainer-profile: update for mm-new tree") mistakenly forgot putting a space between a link and the next word. Fix it. Link: https://lkml.kernel.org/r/20251112154114.66053-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 675774adbe800b350714ce46e184f48fa101512d Author: SeongJae Park Date: Wed Nov 12 07:41:10 2025 -0800 selftests/damon/sysfs.py: merge DAMON status dumping into commitment assertion For each test case, sysfs.py makes changes to DAMON, dumps DAMON internal status and asserts the expectation is met. The dumping part should be the same for all cases, so it is duplicated for each test case. Which means it is easy to make mistakes. Actually a few of those duplicates are not turning DAMON off in case of the dumping failure. It makes following selftests that need to turn DAMON on fails with -EBUSY. Merge the status dumping into commitment assertion with proper dumping failure handling, to deduplicate and avoid the unnecessary following tests failures. Link: https://lkml.kernel.org/r/20251112154114.66053-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 10e8c7ba64bb692c32a2fc26b30a664ea21d6a8e Author: SeongJae Park Date: Wed Nov 12 07:41:09 2025 -0800 mm/damon/tests/core-kunit: remove DAMON_MIN_REGION redefinition A few DAMON core functions including damon_set_regions() were hard-coded to use DAMON_MIN_REGION as their regions management granularity. For simple and human-readable unit tests' expectations, DAMON core layer kunit test re-defines DAMON_MIN_REGION to '1'. A previous patch series [1] has removed the hard-coded part but kept the redefinition and updated related function calls to explicitly use DAMON_MIN_REGION. Remove the unnecessary redefinition and update relevant function calls to pass literals (number '1') instead of the DAMON_MIN_REGION. Link: https://lkml.kernel.org/r/20251112154114.66053-7-sj@kernel.org Link: https://lore.kernel.org/20250828171242.59810-1-sj@kernel.org [1] Signed-off-by: SeongJae Park Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 09efc56a3b1cfda995586ef27ed8d6f8f92ed917 Author: SeongJae Park Date: Wed Nov 12 07:41:08 2025 -0800 mm/damon/vaddr: consistently use only pmd_entry for damos_migrate For page table walks, it is usual [1] to have only one pmd entry function. The vaddr.c code for DAMOS_MIGRATE_{HOT,COLD} is not following the pattern. Instead, it uses both pmd and pte entry functions without a special reason. Refactor it to use only the pmd entry function, to make the code under mm/ more consistent. Link: https://lkml.kernel.org/r/20251112154114.66053-6-sj@kernel.org Signed-off-by: SeongJae Park Suggested-by: David Hildenbrand Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f0eb046cd3cca429dda9ea8c68a527a461a063b9 Author: SeongJae Park Date: Wed Nov 12 07:41:07 2025 -0800 mm/damon/vaddr: use vm_normal_folio{,_pmd}() instead of damon_get_folio() A few page table walk entry callback functions in vaddr.c uses damon_get_folio() with p{te,md}_pfn() to get the folio, and then put_folio(). Simplify and drop unnecessary folio get/put by using vm_normal_folio() and its friends instead. Note that this cleanup was suggested by David Hildenbrand during a review of another patch series [1] and the patch was updated following the suggestion. This patch further applies the cleanup to DAMON code that merged before the patch. Link: https://lkml.kernel.org/r/20251112154114.66053-5-sj@kernel.org Link: https://lore.kernel.org/0cb3d5a5-683b-4dba-90a8-b45ab83eec53@redhat.com [1] Signed-off-by: SeongJae Park Suggested-by: David Hildenbrand Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 96549d56b89744bc4e9e221bd8abf089c9004d29 Author: SeongJae Park Date: Wed Nov 12 07:41:06 2025 -0800 mm/damon/vaddr: cleanup using pmd_trans_huge_lock() Three pmd walk functions in vaddr.c are using pmd_trans_huge() and pmd_lock() to handle THPs. Simplify the code by replacing the two function calls with a single pmd_trans_huge_lock() call. Note that this cleanup is not only reducing the lines of code, but also simplifies code execution flows for migration entries case, as kindly explained [1] by Hugh, who suggested this cleanup. [sj@kernel.org: provide lvalue to pmd_present()] Link: https://lkml.kernel.org/r/20251117154415.11041-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251112154114.66053-4-sj@kernel.org Link: https://lore.kernel.org/296c2b3f-6748-158f-b85d-2952165c0588@google.com [1] Signed-off-by: SeongJae Park Suggested-by: Hugh Dickins Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: kernel test robot Signed-off-by: Andrew Morton commit 53298afe456e62ad2c2dc8bc7aa54bb86a67ba2f Author: SeongJae Park Date: Wed Nov 12 07:41:05 2025 -0800 mm/damon: rename damos->filters to damos->core_filters DAMOS filters that are handled by the ops layer are linked to damos->ops_filters. Owing to the ops_ prefix on the name, it is easy to understand it is for ops layer handled filters. The other types of filters, which are handled by the core layer, are linked to damos->filters. Because of the name, it is easy to confuse the list is there for not only core layer handled ones but all filters. Avoid such confusions by renaming the field to core_filters. Link: https://lkml.kernel.org/r/20251112154114.66053-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8b02baf37311754518dfe78073583db03fbb0c07 Author: SeongJae Park Date: Wed Nov 12 07:41:04 2025 -0800 mm/damon: rename damos core filter helpers to have word core Patch series "mm/damon: misc cleanups". Yet another batch of misc cleanups and refactoring for DAMON code, tests, and documents. First two patches (1and 2) rename DAMOS core filters related code for readability. Three following patches (3-5) refactor page table walk callback functions in DAMON, as suggested by Hugh and David, and I promised. Next two patches (6 and 7) refactor DAMON core layer kunit test and sysfs interface selftest to be simple and deduplicated. Final two patches (8 and 9) fix up sphinx and grammatical errors on documents. This patch (of 9): DAMOS filters handled by the core layer are called core filters, while those handled by the ops layer are called ops filters. They share the same type but are managed in different places since core filters are evaluated before the ops filters. They also have different helper functions that depend on their managed places. The helper functions for ops filters have '_ops_' keyword on their name, so it is easy to know they are for ops filters. Meanwhile, the helper functions for core filters are not having the 'core' keyword on their name. This makes it easy to be mistakenly used for ops filters. Actually there was such a bug. To avoid future mistakes from similar confusions, rename DAMOS core filters helper functions to have a keyword 'core' on their names. Link: https://lkml.kernel.org/r/20251112154114.66053-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251112154114.66053-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bill Wendling Cc: Brendan Higgins Cc: David Gow Cc: Jonathan Corbet Cc: Justin Stitt Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Hildenbrand Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 1ec5d5810b6f17d5c247f1ffcaed0ed3e8e39609 Author: Mehdi Ben Hadj Khelifa Date: Tue Nov 11 21:54:27 2025 +0100 selftests/mm/uffd: remove static address usage in shmem_allocate_area() The current shmem_allocate_area() implementation uses a hardcoded virtual base address (BASE_PMD_ADDR) as a hint for mmap() when creating shmem-backed test areas. This approach is fragile and may fail on systems with ASLR or different virtual memory layouts, where the chosen address is unavailable. Replace the static base address with a dynamically reserved address range obtained via mmap(NULL, ..., PROT_NONE). The memfd-backed areas and their alias are then mapped into that reserved region using MAP_FIXED, preserving the original layout and aliasing semantics while avoiding collisions with unrelated mappings. This change improves robustness and portability of the test suite without altering its behavior or coverage. [mehdi.benhadjkhelifa@gmail.com: make cleanup code more clear, per Mike] Link: https://lkml.kernel.org/r/20251113142050.108638-1-mehdi.benhadjkhelifa@gmail.com Link: https://lkml.kernel.org/r/20251111205739.420009-1-mehdi.benhadjkhelifa@gmail.com Signed-off-by: Mehdi Ben Hadj Khelifa Suggested-by: Mike Rapoport Reviewed-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: David Hunter Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Peter Xu Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 603f67eb91e05a41c5d9da0fdc7145a57ce0ca27 Author: SeongJae Park Date: Tue Nov 11 10:44:10 2025 -0800 mm/damon/tests/core-kunit: add damon_commit_target_regions() test Add a new test for damon_commit_target_regions(). Link: https://lkml.kernel.org/r/20251111184415.141757-12-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 299a88f6ec131b54712167a527e4cb9de6013935 Author: SeongJae Park Date: Tue Nov 11 10:44:09 2025 -0800 mm/damon/tests/core-kunit: add damos_commit() test Add a new unit test for damos_commit(). Link: https://lkml.kernel.org/r/20251111184415.141757-11-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit eec573b8dd659e4565df8909d4a4f2262e3dde3d Author: SeongJae Park Date: Tue Nov 11 10:44:08 2025 -0800 mm/damon/tests/core-kunit: add damos_commit_dests() test Add a new unit test for damos_commit_dests(). Link: https://lkml.kernel.org/r/20251111184415.141757-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit c1cefda77668ddaed56d2f44020e217bd6476951 Author: SeongJae Park Date: Tue Nov 11 10:44:07 2025 -0800 mm/damon/core: pass migrate_dests to damos_commit_dests() damos_commit_dests() receives 'struct damos' pointers, while it uses only their ->migrate_dests fields. This makes code unnecessarily difficult to read. It also makes unit tests writing complicated. Refactor the function to receive pointers to the ->migrate_dests fields. Link: https://lkml.kernel.org/r/20251111184415.141757-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 11bb980d41682df3af06e36f9baf89e6d459fa4f Author: SeongJae Park Date: Tue Nov 11 10:44:06 2025 -0800 mm/damon/tests/core-kunit: add damos_commit_quota() test Add a new unit test for damos_commit_quota(). Link: https://lkml.kernel.org/r/20251111184415.141757-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit d9adfb8a28e70d71ee7812ff8561d7e82db0de96 Author: SeongJae Park Date: Tue Nov 11 10:44:05 2025 -0800 mm/damon/tests/core-kunit: add damos_commit_quota_goals() test Add a new unit test for damos_commit_quota_goals(). Link: https://lkml.kernel.org/r/20251111184415.141757-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 99f89debafc572fb18872ebecb9e35fc917e5ab2 Author: SeongJae Park Date: Tue Nov 11 10:44:04 2025 -0800 mm/damon/tests/core-kunit: add damos_commit_quota_goal() test Add a new unit test for damos_commit_quota_goal(). Link: https://lkml.kernel.org/r/20251111184415.141757-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 3caf767e21652348235fcfa84858f32a8db60071 Author: SeongJae Park Date: Tue Nov 11 10:44:03 2025 -0800 mm/damon/tests/core-kunit: add test cases to damos_test_commit_filter() damos_test_commit_filter() is covering only a single test case. Extend it to cover multiple combinations of inputs. Link: https://lkml.kernel.org/r/20251111184415.141757-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 1b43b7950d5eb3bf6fcc9b206ef7e69c21228ce7 Author: SeongJae Park Date: Tue Nov 11 10:44:02 2025 -0800 mm/damon/tests/core-kunit: extend damos_test_commit_filter_for() for union fields damos_commit_filter() also updates union fields of 'struct damos_filter'. Extend damos_test_commit_filter_for() to cover the expectations of the union fields. Link: https://lkml.kernel.org/r/20251111184415.141757-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 1968236f7517ffde240433f2cd84d902ecd11499 Author: SeongJae Park Date: Tue Nov 11 10:44:01 2025 -0800 mm/damon/tests/core-kunit: split out damos_test_commit_filter() core logic damos_test_commit_filter() is written for only a single test case. Split out the core logic of damos_test_commit_filter() as a general one so that it can be reused for multiple test cases. Link: https://lkml.kernel.org/r/20251111184415.141757-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 37104286f9390a3da330c299b01cabfb4c98af7c Author: SeongJae Park Date: Tue Nov 11 10:44:00 2025 -0800 mm/damon/tests/core-kunit: remove dynamic allocs on damos_test_commit_filter() Patch series "mm/damon/tests: add more tests for online parameters commit". A DAMON feature called parameters "commit" allows DAMON API callers and ABI users to update nearly every DAMON parameter while DAMON is running. This is being used for flexible DAMON use cases such as taking a snapshot of the monitoring results with minimum overhead, or adjusting access-aware system operations (DAMOS) for user-space driven auto-tuning or investigations. Compared to the usefulness of the feature and size of the implementation, the test coverage is pretty small. Only the filter commit part has a single test case, namely damos_test_commit_filter(). Actually, we found and fixed a few bugs of the feature in the past. The single existing test was also added to avoid reintroduction of a found bug. Add more unit tests for the feature. First four patches (1-4) refactor and extend the existing test for DAMOS filter commit for multiple test cases. Next three patches (5-7) add tests for DAMOS quota commit. Next two patches (8 and 9) refactor damos_commit_dests() for ease of code reading and test writing, and implement a new unit test of the function that is being refactored in a test-friendly way. Final two patches (10 and 11) further add new unit tests for damos_commit() and damon_commit_target_regions(). This patch (of 11): damos_test_commit_filter() is dynamically allocating test-purpose DAMOS filters. Allocation failure checks are making the code longer, complicated, and difficult to extend for more test cases. Refactor the code to remove the dynamic allocation. Link: https://lkml.kernel.org/r/20251111184415.141757-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251111184415.141757-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Signed-off-by: Andrew Morton commit 7370f8e1b3a8b908b2a4a9d5d02970697e9aba62 Author: Matthew Wilcox (Oracle) Date: Mon Nov 10 20:32:02 2025 +0000 mm: use vma_start_write_killable() in dup_mmap() Allow waiting for the VMA write lock to be interrupted by fatal signals. The explicit check for fatal_signal_pending() can be removed as it is checked during vma_start_write_killable(). Improves the latency of killing the task as we do not wait for the reader to finish before checking for signals. Link: https://lkml.kernel.org/r/20251110203204.1454057-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Reviewed-by: Vlastimil Babka Reviewed-by: Lorenzo Stoakes Cc: Chris Li Cc: Jann Horn Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 2197bb60f89077603cc580ff752c5cf6388c1099 Author: Matthew Wilcox (Oracle) Date: Mon Nov 10 20:32:01 2025 +0000 mm: add vma_start_write_killable() Patch series "vma_start_write_killable"", v2. When we added the VMA lock, we made a major oversight in not adding a killable variant. That can run us into trouble where a thread takes the VMA lock for read (eg handling a page fault) and then goes out to lunch for an hour (eg doing reclaim). Another thread tries to modify the VMA, taking the mmap_lock for write, then attempts to lock the VMA for write. That blocks on the first thread, and ensures that every other page fault now tries to take the mmap_lock for read. Because everything's in an uninterruptible sleep, we can't kill the task, which makes me angry. This patchset just adds vma_start_write_killable() and converts one caller to use it. Most users are somewhat tricky to convert, so expect follow-up individual patches per call-site which need careful analysis to make sure we've done proper cleanup. This patch (of 2): The vma can be held read-locked for a substantial period of time, eg if memory allocation needs to go into reclaim. It's useful to be able to send fatal signals to threads which are waiting for the write lock. Link: https://lkml.kernel.org/r/20251110203204.1454057-1-willy@infradead.org Link: https://lkml.kernel.org/r/20251110203204.1454057-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Suren Baghdasaryan Reviewed-by: Liam R. Howlett Reviewed-by: Vlastimil Babka Reviewed-by: Lorenzo Stoakes Cc: Chris Li Cc: Jann Horn Cc: Matthew Wilcox (Oracle) Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 3a47e8771c43bc9775f667b8de35c873975aa42e Author: Qi Zheng Date: Mon Nov 10 16:44:37 2025 +0800 mm: vmstat: correct the comment above preempt_disable_nested() The comment explaining why these parts use preempt_disable_nested() is in __mod_zone_page_state(), not in __mod_node_page_state(), so we should see __mod_zone_page_state(). Just correct it. Link: https://lkml.kernel.org/r/20251110084437.46701-1-qi.zheng@linux.dev Signed-off-by: Qi Zheng Acked-by: Vlastimil Babka Acked-by: Harry Yoo Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 2ab7f1bbafc927c69374d45578011c814c26ae2f Author: Lorenzo Stoakes Date: Mon Nov 10 17:22:58 2025 +0000 mm/madvise: allow guard page install/remove under VMA lock We only need to keep the page table stable so we can perform this operation under the VMA lock. PTE installation is stabilised via the PTE lock. One caveat is that, if we prepare vma->anon_vma we must hold the mmap read lock. We can account for this by adapting the VMA locking logic to explicitly check for this case and prevent a VMA lock from being acquired should it be the case. This check is safe, as while we might be raced on anon_vma installation, this would simply make the check conservative, there's no way for us to see an anon_vma and then for it to be cleared, as doing so requires the mmap/VMA write lock. We abstract the VMA lock validity logic to is_vma_lock_sufficient() for this purpose, and add prepares_anon_vma() to abstract the anon_vma logic. In order to do this we need to have a way of installing page tables explicitly for an identified VMA, so we export walk_page_range_vma() in an unsafe variant - walk_page_range_vma_unsafe() and use this should the VMA read lock be taken. We additionally update the comments in madvise_guard_install() to more accurately reflect the cases in which the logic may be reattempted, specifically THP huge pages being present. Link: https://lkml.kernel.org/r/cca1edbd99cd1386ad20556d08ebdb356c45ef91.1762795245.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Davidlohr Bueso Reviewed-by: Vlastimil Babka Acked-by: SeongJae Park Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit f4af67ff4fd8c4bcecb0d889652de93a75122f96 Author: Lorenzo Stoakes Date: Mon Nov 10 17:22:57 2025 +0000 mm: rename walk_page_range_mm() Patch series "mm: perform guard region install/remove under VMA lock", v2. There is no reason why can't perform guard region operations under the VMA lock, as long we take proper precautions to ensure that we do so in a safe manner. This is fine, as VMA lock acquisition is always best-effort, so if we are unable to do so, we can simply fall back to using the mmap read lock. Doing so will reduce mmap lock contention for callers performing guard region operations and help establish a precedent of trying to use the VMA lock where possible. As part of this change we perform a trivial rename of page walk functions which bypass safety checks (i.e. whether or not mm_walk_ops->install_pte is specified) in order that we can keep naming consistent with the mm walk. This is because we need to expose a VMA-specific walk that still allows us to install PTE entries. This patch (of 2): Make it clear we're referencing an unsafe variant of this function explicitly. This is laying the foundation for exposing more such functions and maintaining a consistent naming scheme. As a part of this change, rename check_ops_valid() to check_ops_safe() for consistency. Link: https://lkml.kernel.org/r/cover.1762795245.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/c684d91464a438d6e31172c9450416a373f10649.1762795245.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Davidlohr Bueso Reviewed-by: Vlastimil Babka Acked-by: SeongJae Park Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit bc8e51c05ad50a5a0b02114d3cc94d151a332595 Author: Shakeel Butt Date: Fri Nov 7 15:40:41 2025 -0800 mm: memcg: dump memcg protection info on oom or alloc failures Currently kernel dumps memory state on oom and allocation failures. One of the question usually raised on those dumps is why the kernel has not reclaimed the reclaimable memory instead of triggering oom. One potential reason is the usage of memory protection provided by memcg. So, let's also dump the memory protected by the memcg in such reports to ease the debugging. Link: https://lkml.kernel.org/r/20251107234041.3632644-1-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Roman Gushchin Cc: Johannes Weiner Cc: Shakeel Butt Cc: Muchun Song Cc: David Rientjes Signed-off-by: Andrew Morton commit 05be0287955970b043a0742e85b6c285dea4f286 Author: Huacai Chen Date: Fri Nov 7 17:55:36 2025 +0800 mm: remove unnecessary __GFP_HIGHMEM in __p*d_alloc_one_*() __{pgd,p4d,pud,pmd,pte}_alloc_one_*() always allocate pages with GFP flag GFP_PGTABLE_KERNEL/GFP_PGTABLE_USER. These two macros are defined as follows: #define GFP_PGTABLE_KERNEL (GFP_KERNEL | __GFP_ZERO) #define GFP_PGTABLE_USER (GFP_PGTABLE_KERNEL | __GFP_ACCOUNT) There is no __GFP_HIGHMEM in them, so we needn't to clear __GFP_HIGHMEM explicitly. Link: https://lkml.kernel.org/r/20251109021817.346181-1-chenhuacai@loongson.cn Link: https://lkml.kernel.org/r/20251107095536.3101371-1-chenhuacai@loongson.cn Signed-off-by: Huacai Chen Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Anshuman Khandual Reviewed-by: Kevin Brodsky Cc: Arnd Bergmann Cc: Jan Kara Signed-off-by: Andrew Morton commit c0ae966fac00bfd31490b6a9bf494d28865ff840 Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:51 2025 +0000 tools/testing/selftests/mm: add smaps visibility guard region test Assert that we observe guard regions appearing in /proc/$pid/smaps as expected, and when split/merge is performed too (with expected sticky behaviour). Also add handling for file systems which don't sanely handle mmap() VMA merging so we don't incorrectly encounter a test failure in this situation. Link: https://lkml.kernel.org/r/059e62b8c67e55e6d849878206a95ea1d7c1e885.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Pedro Falcato Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 89330ec89741d12970b513af94fd2c46997ae1db Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:50 2025 +0000 tools/testing/selftests/mm: add MADV_COLLAPSE test case To ensure the retract_page_tables() logic functions correctly with the introduction of VM_MAYBE_GUARD, add a test to assert that madvise collapse fails when guard regions are established in the collapsed range in all cases. Unfortunately we cannot differentiate between e.g. CONFIG_READ_ONLY_THP_FOR_FS not being set vs. a file-backed VMA having collapse correctly disallowed, so in each instance we will get an assert pass here. We add an additional check to see whether guard regions are preserved across collapse in case of a bug causing the collapse to succeed, which will give us more data to debug with should this occur in future. Link: https://lkml.kernel.org/r/0748beeb864525b8ddfa51adad7128dd32eb3ac4.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Pedro Falcato Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 29bef05e6d90b6123275159b52a1e520722243cb Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:49 2025 +0000 tools/testing/vma: add VMA sticky userland tests Modify existing merge new/existing userland VMA tests to assert that sticky VMA flags behave as expected. We do so by generating every possible permutation of VMAs being manipulated being sticky/not sticky and asserting that VMA flags with this property retain are retained upon merge. Link: https://lkml.kernel.org/r/5e2c7244485867befd052f8afc8188be6a4be670.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Pedro Falcato Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 49e14dabed7a294427588d4b315f57fbfcab9990 Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:48 2025 +0000 mm: set the VM_MAYBE_GUARD flag on guard region install Now we have established the VM_MAYBE_GUARD flag and added the capacity to set it atomically, do so upon MADV_GUARD_INSTALL. The places where this flag is used currently and matter are: * VMA merge - performed under mmap/VMA write lock, therefore excluding racing writes. * /proc/$pid/smaps - can race the write, however this isn't meaningful as the flag write is performed at the point of the guard region being established, and thus an smaps reader can't reasonably expect to avoid races. Due to atomicity, a reader will observe either the flag being set or not. Therefore consistency will be maintained. In all other cases the flag being set is irrelevant and atomicity guarantees other flags will be read correctly. Note that non-atomic updates of unrelated flags do not cause an issue with this flag being set atomically, as writes of other flags are performed under mmap/VMA write lock, and these atomic writes are performed under mmap/VMA read lock, which excludes the write, avoiding RMW races. Note that we do not encounter issues with KCSAN by adjusting this flag atomically, as we are only updating a single bit in the flag bitmap and therefore we do not need to annotate these changes. We intentionally set this flag in advance of actually updating the page tables, to ensure that any racing atomic read of this flag will only return false prior to page tables being updated, to allow for serialisation via page table locks. Note that we set vma->anon_vma for anonymous mappings. This is because the expectation for anonymous mappings is that an anon_vma is established should they possess any page table mappings. This is also consistent with what we were doing prior to this patch (unconditionally setting anon_vma on guard region installation). We also need to update retract_page_tables() to ensure that madvise(..., MADV_COLLAPSE) doesn't incorrectly collapse file-backed ranges contain guard regions. This was previously guarded by anon_vma being set to catch MAP_PRIVATE cases, but the introduction of VM_MAYBE_GUARD necessitates that we check this flag instead. We utilise vma_flag_test_atomic() to do so - we first perform an optimistic check, then after the PTE page table lock is held, we can check again safely, as upon guard marker install the flag is set atomically prior to the page table lock being taken to actually apply it. So if the initial check fails either: * Page table retraction acquires page table lock prior to VM_MAYBE_GUARD being set - guard marker installation will be blocked until page table retraction is complete. OR: * Guard marker installation acquires page table lock after setting VM_MAYBE_GUARD, which raced and didn't pick this up in the initial optimistic check, blocking page table retraction until the guard regions are installed - the second VM_MAYBE_GUARD check will prevent page table retraction. Either way we're safe. We refactor the retraction checks into a single file_backed_vma_is_retractable(), there doesn't seem to be any reason that the checks were separated as before. Note that VM_MAYBE_GUARD being set atomically remains correct as vma_needs_copy() is invoked with the mmap and VMA write locks held, excluding any race with madvise_guard_install(). Link: https://lkml.kernel.org/r/e9e9ce95b6ac17497de7f60fc110c7dd9e489e8d.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Pedro Falcato Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit ab04b530e7e8bd5cf9fb0c1ad20e0deee8f569ec Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:47 2025 +0000 mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one Gather all the VMA flags whose presence implies that page tables must be copied on fork into a single bitmap - VM_COPY_ON_FORK - and use this rather than specifying individual flags in vma_needs_copy(). We also add VM_MAYBE_GUARD to this list, as it being set on a VMA implies that there may be metadata contained in the page tables (that is - guard markers) which would will not and cannot be propagated upon fork. This was already being done manually previously in vma_needs_copy(), but this makes it very explicit, alongside VM_PFNMAP, VM_MIXEDMAP and VM_UFFD_WP all of which imply the same. Note that VM_STICKY flags ought generally to be marked VM_COPY_ON_FORK too - because equally a flag being VM_STICKY indicates that the VMA contains metadat that is not propagated by being faulted in - i.e. that the VMA metadata does not fully describe the VMA alone, and thus we must propagate whatever metadata there is on a fork. However, for maximum flexibility, we do not make this necessarily the case here. Link: https://lkml.kernel.org/r/5d41b24e7bc622cda0af92b6d558d7f4c0d1bc8c.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand (Red Hat) Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 64212ba02e66e705cabce188453ba4e61e9d7325 Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:46 2025 +0000 mm: implement sticky VMA flags It is useful to be able to designate that certain flags are 'sticky', that is, if two VMAs are merged one with a flag of this nature and one without, the merged VMA sets this flag. As a result we ignore these flags for the purposes of determining VMA flag differences between VMAs being considered for merge. This patch therefore updates the VMA merge logic to perform this action, with flags possessing this property being described in the VM_STICKY bitmap. Those flags which ought to be ignored for the purposes of VMA merge are described in the VM_IGNORE_MERGE bitmap, which the VMA merge logic is also updated to use. As part of this change we place VM_SOFTDIRTY in VM_IGNORE_MERGE as it already had this behaviour, alongside VM_STICKY as sticky flags by implication must not disallow merge. Ultimately it seems that we should make VM_SOFTDIRTY a sticky flag in its own right, but this change is out of scope for this series. The only sticky flag designated as such is VM_MAYBE_GUARD, so as a result of this change, once the VMA flag is set upon guard region installation, VMAs with guard ranges will now not have their merge behaviour impacted as a result and can be freely merged with other VMAs without VM_MAYBE_GUARD set. Also update the comments for vma_modify_flags() to directly reference sticky flags now we have established the concept. We also update the VMA userland tests to account for the changes. Link: https://lkml.kernel.org/r/22ad5269f7669d62afb42ce0c79bad70b994c58d.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 9119d6c2095bb20292cb9812dd70d37f17e3bd37 Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:45 2025 +0000 mm: update vma_modify_flags() to handle residual flags, document The vma_modify_*() family of functions each either perform splits, a merge or no changes at all in preparation for the requested modification to occur. When doing so for a VMA flags change, we currently don't account for any flags which may remain (for instance, VM_SOFTDIRTY) despite the requested change in the case that a merge succeeded. This is made more important by subsequent patches which will introduce the concept of sticky VMA flags which rely on this behaviour. This patch fixes this by passing the VMA flags parameter as a pointer and updating it accordingly on merge and updating callers to accommodate for this. Additionally, while we are here, we add kdocs for each of the vma_modify_*() functions, as the fact that the requested modification is not performed is confusing so it is useful to make this abundantly clear. We also update the VMA userland tests to account for this change. Link: https://lkml.kernel.org/r/23b5b549b0eaefb2922625626e58c2a352f3e93c.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand (Red Hat) Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 568822502383acd57d7cc1c72ee43932c45a9524 Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:44 2025 +0000 mm: add atomic VMA flags and set VM_MAYBE_GUARD as such This patch adds the ability to atomically set VMA flags with only the mmap read/VMA read lock held. As this could be hugely problematic for VMA flags in general given that all other accesses are non-atomic and serialised by the mmap/VMA locks, we implement this with a strict allow-list - that is, only designated flags are allowed to do this. We make VM_MAYBE_GUARD one of these flags. Link: https://lkml.kernel.org/r/97e57abed09f2663077ed7a36fb8206e243171a9.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lance Yang Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 5dba5cc2e0ffa76f2f6c8922a04469dc9602c396 Author: Lorenzo Stoakes Date: Tue Nov 18 10:17:43 2025 +0000 mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps Patch series "introduce VM_MAYBE_GUARD and make it sticky", v4. Currently, guard regions are not visible to users except through /proc/$pid/pagemap, with no explicit visibility at the VMA level. This makes the feature less useful, as it isn't entirely apparent which VMAs may have these entries present, especially when performing actions which walk through memory regions such as those performed by CRIU. This series addresses this issue by introducing the VM_MAYBE_GUARD flag which fulfils this role, updating the smaps logic to display an entry for these. The semantics of this flag are that a guard region MAY be present if set (we cannot be sure, as we can't efficiently track whether an MADV_GUARD_REMOVE finally removes all the guard regions in a VMA) - but if not set the VMA definitely does NOT have any guard regions present. It's problematic to establish this flag without further action, because that means that VMAs with guard regions in them become non-mergeable with adjacent VMAs for no especially good reason. To work around this, this series also introduces the concept of 'sticky' VMA flags - that is flags which: a. if set in one VMA and not in another still permit those VMAs to be merged (if otherwise compatible). b. When they are merged, the resultant VMA must have the flag set. The VMA logic is updated to propagate these flags correctly. Additionally, VM_MAYBE_GUARD being an explicit VMA flag allows us to solve an issue with file-backed guard regions - previously these established an anon_vma object for file-backed mappings solely to have vma_needs_copy() correctly propagate guard region mappings to child processes. We introduce a new flag alias VM_COPY_ON_FORK (which currently only specifies VM_MAYBE_GUARD) and update vma_needs_copy() to check explicitly for this flag and to copy page tables if it is present, which resolves this issue. Additionally, we add the ability for allow-listed VMA flags to be atomically writable with only mmap/VMA read locks held. The only flag we allow so far is VM_MAYBE_GUARD, which we carefully ensure does not cause any races by being allowed to do so. This allows us to maintain guard region installation as a read-locked operation and not endure the overhead of obtaining a write lock here. Finally we introduce extensive VMA userland tests to assert that the sticky VMA logic behaves correctly as well as guard region self tests to assert that smaps visibility is correctly implemented. This patch (of 9): Currently, if a user needs to determine if guard regions are present in a range, they have to scan all VMAs (or have knowledge of which ones might have guard regions). Since commit 8e2f2aeb8b48 ("fs/proc/task_mmu: add guard region bit to pagemap") and the related commit a516403787e0 ("fs/proc: extend the PAGEMAP_SCAN ioctl to report guard regions"), users can use either /proc/$pid/pagemap or the PAGEMAP_SCAN functionality to perform this operation at a virtual address level. This is not ideal, and it gives no visibility at a /proc/$pid/smaps level that guard regions exist in ranges. This patch remedies the situation by establishing a new VMA flag, VM_MAYBE_GUARD, to indicate that a VMA may contain guard regions (it is uncertain because we cannot reasonably determine whether a MADV_GUARD_REMOVE call has removed all of the guard regions in a VMA, and additionally VMAs may change across merge/split). We utilise 0x800 for this flag which makes it available to 32-bit architectures also, a flag that was previously used by VM_DENYWRITE, which was removed in commit 8d0920bde5eb ("mm: remove VM_DENYWRITE") and hasn't bee reused yet. We also update the smaps logic and documentation to identify these VMAs. Another major use of this functionality is that we can use it to identify that we ought to copy page tables on fork. We do not actually implement usage of this flag in mm/madvise.c yet as we need to allow some VMA flags to be applied atomically under mmap/VMA read lock in order to avoid the need to acquire a write lock for this purpose. Link: https://lkml.kernel.org/r/cover.1763460113.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/cf8ef821eba29b6c5b5e138fffe95d6dcabdedb9.1763460113.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Lance Yang Cc: Andrei Vagin Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Jann Horn Cc: Jonathan Corbet Cc: Liam Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit cdcb53e1deef9bd6ba782645b7297863061c0b4c Author: Hui Zhu Date: Thu Nov 6 11:08:23 2025 +0800 mm/hugetlb: extract sysctl into hugetlb_sysctl.c Following the extraction of sysfs code, this patch moves the sysctl interface implementation into a dedicated file to further improve code organization and maintainability of the hugetlb subsystem. The following components are moved to mm/hugetlb_sysctl.c: - proc_hugetlb_doulongvec_minmax() - hugetlb_sysctl_handler_common() - hugetlb_sysctl_handler() - hugetlb_mempolicy_sysctl_handler() (CONFIG_NUMA) - hugetlb_overcommit_handler() - hugetlb_table[] sysctl table definition - hugetlb_sysctl_init() The hugetlb_internal.h header file is updated to declare the sysctl initialization function with proper #ifdef guards for configurations without CONFIG_SYSCTL support. The Makefile is updated to compile hugetlb_sysctl.o when CONFIG_HUGETLBFS is enabled. This refactoring reduces the size of hugetlb.c and logically separates the sysctl interface from core hugetlb management code. MAINTAINERS is updated to add new file hugetlb_sysctl.c. No functional changes are introduced; all code is moved as-is from hugetlb.c with consistent formatting. Link: https://lkml.kernel.org/r/5bbee7ab5be71d0bb1aebec38642d7e83526bb7a.1762398359.git.zhuhui@kylinos.cn Signed-off-by: Geliang Tang Signed-off-by: Hui Zhu Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Cc: SeongJae Park Signed-off-by: Andrew Morton commit ecd6703f64d76ee4fc8cc2205bfb892d3bb9f538 Author: Hui Zhu Date: Thu Nov 6 11:08:22 2025 +0800 mm/hugetlb: extract sysfs into hugetlb_sysfs.c Patch series "mm/hugetlb: refactor sysfs/sysctl interfaces", v5. hugetlb.c has grown significantly and become difficult to maintain. This patch series extracts the sysfs and sysctl interface code into separate dedicated files to improve code organization. The refactoring includes: - Patch 1: Extract sysfs interface into mm/hugetlb_sysfs.c - Patch 2: Extract sysctl interface into mm/hugetlb_sysctl.c No functional changes are introduced in this series. The code is moved as-is, with only minor formatting adjustments for code style consistency. This should make future maintenance and enhancements to the hugetlb subsystem easier. Testing: The patch series has been compile-tested and maintains the same functionality as the original code. This patch (of 2): Currently, hugetlb.c contains both core management logic and sysfs interface implementations, making it difficult to maintain. This patch extracts the sysfs-related code into a dedicated file to improve code organization. The following components are moved to mm/hugetlb_sysfs.c: - sysfs attribute definitions and handlers - sysfs kobject management functions - NUMA per-node hstate attribute registration Several inline helper functions and macros are moved to mm/hugetlb_internal.h: - hstate_is_gigantic_no_runtime() - next_node_allowed() - get_valid_node_allowed() - hstate_next_node_to_alloc() - hstate_next_node_to_free() - for_each_node_mask_to_alloc/to_free macros To support code sharing, these functions are changed from static to exported symbols: - remove_hugetlb_folio() - add_hugetlb_folio() - init_new_hugetlb_folio() - prep_and_add_allocated_folios() - demote_pool_huge_page() - __nr_hugepages_store_common() The Makefile is updated to compile hugetlb_sysfs.o when CONFIG_HUGETLBFS is enabled. This maintains all existing functionality while improving maintainability by separating concerns. MAINTAINERS is updated to add new file hugetlb_sysfs.c. Link: https://lkml.kernel.org/r/cover.1762398359.git.zhuhui@kylinos.cn Link: https://lkml.kernel.org/r/656a03dff7e2bb20e24e841ede81fdca01d21410.1762398359.git.zhuhui@kylinos.cn Signed-off-by: Geliang Tang Signed-off-by: Hui Zhu Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Cc: SeongJae Park Signed-off-by: Andrew Morton commit 98be155451eb2aa4b0413b85c3f95e239de3636f Author: Matthew Wilcox (Oracle) Date: Thu Nov 6 20:35:25 2025 +0000 mm: constify __dump_folio() arguments These arguments aren't modified by the function; mark them as const to help the compiler. Link: https://lkml.kernel.org/r/20251106203526.2368275-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: David Hildenbrand Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 20605eb5bbea8184d2bb356d7e1419c8ec359efb Author: Matthew Wilcox (Oracle) Date: Thu Nov 6 20:14:50 2025 +0000 memory_hotplug: optimise try_offline_memory_block() Extract the zone number directly from the page instead of using the page's zone number to look up the zone and asking the zone what its number is. Link: https://lkml.kernel.org/r/20251106201452.2292631-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: David Hildenbrand Cc: Oscar Salvador Signed-off-by: Andrew Morton commit c537f0dd30344434b6e7585768d3fa38190d2d0c Author: Matthew Wilcox (Oracle) Date: Thu Nov 6 20:14:49 2025 +0000 migrate: optimise alloc_migration_target() Extract the zone number directly from the folio instead of using the folio's zone number to look up the zone and asking the zone what its number is. [ziy@nvidia.com: fix folio_zonenum() return type] Link: https://lkml.kernel.org/r/26E8FF35-503E-4F14-98F7-7B4FA25FBD37@nvidia.com Link: https://lkml.kernel.org/r/20251106201452.2292631-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Zi Yan Cc: David Hildenbrand Cc: Zi Yan Cc: Matthew Brost Cc: Joshua Hahn Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Signed-off-by: Andrew Morton commit e24f66e87bfbcd15a95336c30c2f131332855ba6 Author: Matthew Wilcox (Oracle) Date: Thu Nov 6 20:14:48 2025 +0000 hugetlb: optimise hugetlb_folio_init_tail_vmemmap() Extract the zone number directly from the folio instead of using the folio's zone number to look up the zone and asking the zone what its number is. Also we should use &folio->page instead of casting from folio to page Link: https://lkml.kernel.org/r/20251106201452.2292631-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Oscar Salvador Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 135e541ae8f3f166453177f1a94a0ff1f86ce30f Author: Zeng Chi Date: Wed Nov 5 10:39:25 2025 +0800 lib/alloc_tag: use %pe format specifier The %pe format specifier is designed to print error pointers. It prints a symbolic error name (eg. -EINVAL) and it makes the code simpler by omitting PTR_ERR(); This patch fixes this cocci report: lib/alloc_tag.c:776:63-70: WARNING: Consider using %pe to print PTR_ERR() Link: https://lkml.kernel.org/r/20251105023925.1447482-1-zeng_chi911@163.com Signed-off-by: Zeng Chi Acked-by: SeongJae Park Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Signed-off-by: Andrew Morton commit 340b59816bc417c306cd76b867914cfb4f386d2d Author: Kefeng Wang Date: Tue Nov 4 16:57:09 2025 +0800 mm: kill mm_wr_locked from unmap_vmas() and unmap_single_vma() Kill mm_wr_locked since commit f8e97613fed2 ("mm: convert VM_PFNMAP tracking to pfnmap_track() + pfnmap_untrack()") remove the user. Link: https://lkml.kernel.org/r/20251104085709.2688433-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Acked-by: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 3b12a53b64d0c86cf68cab772bd4137e451b17a5 Author: Ankit Khushwaha Date: Sat Nov 8 21:48:29 2025 +0530 selftest/mm: fix pointer comparison in mremap_test Pointer arthemitic with 'void * addr' and 'ulong dest_alignment' triggers following warning: mremap_test.c:1035:31: warning: pointer comparison always evaluates to false [-Wtautological-compare] 1035 | if (addr + c.dest_alignment < addr) { | ^ this warning is raised from clang version 20.1.8 (Fedora 20.1.8-4.fc42). use 'void *tmp_addr' to do the pointer arthemitic. Link: https://lkml.kernel.org/r/20251108161829.25105-1-ankitkhushwaha.linux@gmail.com Signed-off-by: Ankit Khushwaha Acked-by: Mike Rapoport (Microsoft) Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4f8961b29501f40a044bba56f61cc9b7e9bbdf94 Author: Baolin Wang Date: Thu Sep 18 11:46:54 2025 +0800 mm: vmscan: simplify the folio refcount check in pageout() Since we no longer attempt to write back filesystem folios in pageout() (they will be filtered out by the following check in pageout()), and only tmpfs/shmem folios and anonymous swapcache folios can be written back, we can remove the redundant folio_test_private() when checking the folio's refcount, as tmpfs/shmem and swapcache folios do not use the PG_private flag. While we're at it, we can open-code the folio refcount check instead of adding a simple helper that has only one user. Link: https://lkml.kernel.org/r/4cbbec5bb92397aa4597105f1f499aabf7a1901c.1758166683.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Acked-by: Shakeel Butt Cc: Hugh Dickins Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Qi Zheng Signed-off-by: Andrew Morton commit d94d9293a1ecde99514026950ded294dd5562e30 Author: Baolin Wang Date: Thu Sep 18 11:46:53 2025 +0800 mm: vmscan: remove folio_test_private() check in pageout() Patch series "some cleanups for pageout()", v2. Since we no longer attempt to write back filesystem folios in pageout(), and only tmpfs/shmem folios and anonymous swapcache folios can be written back, we can remove the redundant folio_test_private() related logic to simplify the logic of pageout(), as tmpfs/shmem and swapcache folios do not use the PG_private flag. This patch (of 2): The folio_test_private() check in pageout() was introduced by commit ce91b575332b ("orphaned pagecache memleak fix") in 2005 (checked from a history tree[1]). As the commit message mentioned, it was to address the issue where reiserfs pagecache may be truncated while still pinned. To further explain, the truncation removes the page->mapping, but the page is still listed in the VM queues because it still has buffers. In 2008, commit a2b345642f530 ("Fix dirty page accounting leak with ext3 data=journal") seems to be dealing with a similar issue, where the page becomes dirty after truncation, and it provides a very useful call stack: truncate_complete_page() cancel_dirty_page() // PG_dirty cleared, decr. dirty pages do_invalidatepage() ext3_invalidatepage() journal_invalidatepage() journal_unmap_buffer() __dispose_buffer() __journal_unfile_buffer() __journal_temp_unlink_buffer() mark_buffer_dirty(); // PG_dirty set, incr. dirty pages In this commit a2b345642f530, we forcefully clear the page's dirty flag during truncation (in truncate_complete_page()). Now it seems this was just a peculiar usage specific to reiserfs. Maybe reiserfs had some extra refcount on these pages, which caused them to pass the is_page_cache_freeable() check. With the fix provided by commit a2b345642f530 and reiserfs being removed in 2024 by commit fb6f20ecb121 ("reiserfs: The last commit"), such a case is unlikely to occur again. So let's remove the redundant folio_test_private() checks and related buffer_head release logic, and just leave a warning here to catch such a bug. [akpm@linux-foundation.org: redo comment, per David] Link: https://lkml.kernel.org/r/17d1b293-e393-4989-a357-7eea74b3c805@redhat.com [baolin.wang@linux.alibaba.com: remove comment and WARNing, per Hugh and others] Link: https://lkml.kernel.org/r/392a9ca3-31ac-4447-bd44-3c656d63e4ca@linux.alibaba.com Link: https://lkml.kernel.org/r/cover.1758166683.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/9ef0e560dc83650bc538eb5dcd1594e112c1369f.1758166683.git.baolin.wang@linux.alibaba.com Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git [1] Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Acked-by: Shakeel Butt Cc: Hugh Dickins Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Qi Zheng Signed-off-by: Andrew Morton commit 8e2d57e6539b1c2c9b76bc1726ac49384a96c04f Author: Samuel Wu Date: Wed Nov 19 09:14:25 2025 -0800 PM: sleep: Call pm_sleep_fs_sync() instead of ksys_sync_helper() Replace the direct calls to ksys_sync_helper() with the new pm_sleep_fs_sync() in suspend and hibernation code paths. This enables the new mechanism allowing the filesystem sync phase to be interrupted. Suggested-by: Saravana Kannan Signed-off-by: Samuel Wu Co-developed-by: Rafael J. Wysocki [ rjw: Subject and changelog edits, tags adjustment ] Link: https://patch.msgid.link/20251119171426.4086783-3-wusamuel@google.com Signed-off-by: Rafael J. Wysocki commit bf8867eae17fde94d7081545cf90ca8d5aba690a Author: Samuel Wu Date: Wed Nov 19 09:14:24 2025 -0800 PM: sleep: Add support for wakeup during filesystem sync Add helper function pm_sleep_fs_sync() and related data structures as a preparation for allowing system suspend and hibernation to be aborted by wakeup events while syncing file systems. The new function, to be called by the suspend process in order to sync file systems, uses a dedicated ordered workqueue to run ksys_sync_helper() in parallel with the calling process. Next, it waits for the completion of the filesystem sync and periodically checks if any system wakeup events are pending, in which case it will return an error. If that happens while the filesystem sync is still in progress, it will continue, possibly after pm_sleep_fs_sync() has returned, and if that function is called again before the sync is complete, a new work item to run ksys_sync_helper() again will be queued (and waited for) to increase the likelihood of writing all of the dirty pages in memory back to persistent storage. Suggested-by: Saravana Kannan Signed-off-by: Samuel Wu Co-developed-by: Rafael J. Wysocki [ rjw: Subject and changelog rewrite, tags adjustment ] Link: https://patch.msgid.link/20251119171426.4086783-2-wusamuel@google.com Signed-off-by: Rafael J. Wysocki commit 898f94465205e33295c29333a82a249b8f90aa74 Author: Jeff Layton Date: Thu Oct 23 09:12:39 2025 -0400 lockd: don't allow locking on reexported NFSv2/3 Since commit 9254c8ae9b81 ("nfsd: disallow file locking and delegations for NFSv4 reexport"), file locking when reexporting an NFS mount via NFSv4 is expressly prohibited by nfsd. Do the same in lockd: Add a new nlmsvc_file_cannot_lock() helper that will test whether file locking is allowed for a given file, and return nlm_lck_denied_nolocks if it isn't. Signed-off-by: Jeff Layton Tested-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit f6dcad1d748e192d8cd01d76736131ae913787af Author: Christoph Hellwig Date: Wed Oct 22 13:45:30 2025 +0200 MAINTAINERS: add a nfsd blocklayout reviewer Add a minimal entry for the block layout driver to make sure Christoph who wrote the code gets Cced on all patches. The actual maintenance stays with the nfsd maintainer team. Signed-off-by: Christoph Hellwig Acked-by: Jeff Layton Signed-off-by: Chuck Lever commit a857b530b355a9f2ded091b762207967a9a019f5 Merge: f384497a76ed95 46fc75a29b7034 Author: Rafael J. Wysocki Date: Thu Nov 20 22:28:23 2025 +0100 Merge back material related to system sleep for 6.19 commit c04507ac500e2cc8048000c2a849588227554e06 Author: Peter Zijlstra Date: Sun Nov 16 21:51:07 2025 +0100 sched: Provide and use set_need_resched_current() set_tsk_need_resched(current) requires set_preempt_need_resched(current) to work correctly outside of the scheduler. Provide set_need_resched_current() which wraps this correctly and replace all the open coded instances. Signed-off-by: Peter Zijlstra Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251116174750.665769842@linutronix.de commit 605945281a65ca68af00f3d7592a191b20b21ad4 Author: Michael Opdenacker Date: Wed Nov 19 09:22:38 2025 +0000 dt-bindings: arm: rockchip: merge Asus Tinker and Tinker S Merge sections for Asus Tinker Board and Asus Tinker Board S. Asus Tinker Board S (Storage) is just a variant of Tinker Board with an added eMMC chip. Signed-off-by: Michael Opdenacker Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251119-merge-tinker-bindings-v1-1-4072b55750c1@rootcommit.com Signed-off-by: Heiko Stuebner commit 1b541e10eea6ecea84431dd69d9052b12ed1f729 Author: Kaushlendra Kumar Date: Wed Nov 19 08:41:09 2025 +0530 cpufreq: ACPI: Replace udelay() with usleep_range() Replace udelay() with usleep_range() in check_freqs() to allow CPU scheduling during frequency polling. Signed-off-by: Kaushlendra Kumar [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251119031109.134583-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 8538e7ee09e2090335a91f43b81cafa4bb39402e Author: Srinivas Pandruvada Date: Tue Nov 18 14:36:19 2025 -0800 docs: driver-api/thermal/intel_dptf: Add new workload type hint Add documentation for longer term classification of workload type for power or performance. Signed-off-by: Srinivas Pandruvada Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://patch.msgid.link/20251118223620.554798-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit c9c19e8bbc1ebc4e74140f7f9acbd90dcdf36748 Author: Lai Jiangshan Date: Mon Nov 17 11:09:13 2025 +0800 workqueue: Init rescuer's affinities as wq_unbound_cpumask The affinity to set to the rescuers should be consistent in all paths when a rescuer is in detached state. The affinity could be either wq_unbound_cpumask or unbound_effective_cpumask(wq). Related paths: rescuer's worker_detach_from_pool() update wq_unbound_cpumask update wq's cpumask init_rescuer() Both affinities are Ok as long as they are consistent in all paths. In the commit 449b31ad2937 ("workqueue: Init rescuer's affinities as the wq's effective cpumask") makes init_rescuer use unbound_effective_cpumask(wq) which is consistent with then apply_wqattrs_commit(). But using unbound_effective_cpumask(wq) requres much more code to maintain the consistency, and it doesn't make much sense since the affinity is only effective when the rescuer is not processing works. wq_unbound_cpumask is more favorable. So apply_wqattrs_commit() and the path of "updating wq's cpumask" had been changed to not update the rescuer's affinity, and both the paths of "updating wq_unbound_cpumask" and "rescuer's worker_detach_from_pool()" had been changed to use wq_unbound_cpumask. Now, make init_rescuer() use wq_unbound_cpumask for rescuer's affinity and make all the paths consistent. Cc: Juri Lelli Cc: Waiman Long Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit 8ac4dbe7dd05f44121da120e480239dc89c3b496 Author: Lai Jiangshan Date: Mon Nov 17 11:09:12 2025 +0800 workqueue: Let DISASSOCIATED workers follow unbound wq cpumask changes When workqueue cpumask changes are committed, the DISASSOCIATED workers affinity is not touched and this might be a problem down the line for isolated setups when the DISASSOCIATED pools still have works to run after the cpu is offline. Make sure the workers' affinity is updated every time a workqueue cpumask changes, so these workers can't break isolation. Cc: Juri Lelli Cc: Waiman Long Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit e36bce4466d7807a40720abd277803fcad823c08 Author: Lai Jiangshan Date: Mon Nov 17 11:09:11 2025 +0800 workqueue: Update the rescuer's affinity only when it is detached When a rescuer is attached to a pool, its affinity should be only managed by the pool. But updating the detached rescuer's affinity is still meaningful so that it will not disrupt isolated CPUs when it is to be waken up. But the commit d64f2fa064f8 ("kernel/workqueue: Let rescuers follow unbound wq cpumask changes") updates the affinity unconditionally, and causes some issues 1) it also changes the affinity when the rescuer is already attached to a pool, which violates the affinity management. 2) the said commit tries to update the affinity of the rescuers, but it misses the rescuers of the PERCPU workqueues, and isolated CPUs can be possibly disrupted by these rescuers when they are summoned. 3) The affinity to set to the rescuers should be consistent in all paths when a rescuer is in detached state. The affinity could be either wq_unbound_cpumask or unbound_effective_cpumask(wq). Related paths: rescuer's worker_detach_from_pool() update wq_unbound_cpumask update wq's cpumask init_rescuer() Both affinities are Ok as long as they are consistent in all paths. But using unbound_effective_cpumask(wq) requres much more code to maintain the consistency, and it doesn't make much sense since the affinity is only effective when the rescuer is not processing works. wq_unbound_cpumask is more favorable. Fix the 1) issue by testing rescuer->pool before updating with wq_pool_attach_mutex held. Fix the 2) issue by moving the rescuer's affinity updating code to the place updating wq_unbound_cpumask and make it also update for PERCPU workqueues. Partially cleanup the 3) consistency issue by using wq_unbound_cpumask. So that the path of "updating wq's cpumask" doesn't need to maintain it. and both the paths of "updating wq_unbound_cpumask" and "rescuer's worker_detach_from_pool()" use wq_unbound_cpumask. Cleanup for init_rescuer()'s consistency for affinity can be done in future. Cc: Juri Lelli Cc: Waiman Long Signed-off-by: Lai Jiangshan Signed-off-by: Tejun Heo commit 84692a1519b32d61ff882cf24a9eda900961acad Author: Joanne Koong Date: Thu Nov 20 11:15:56 2025 -0800 io_uring/kbuf: remove obsolete buf_nr_pages and update comments The buf_nr_pages field in io_buffer_list was previously used to determine whether the buffer list uses ring-provided buffers or classic provided buffers. This is now determined by checking the IOBL_BUF_RING flag. Remove the buf_nr_pages field and update related comments. Signed-off-by: Joanne Koong Signed-off-by: Jens Axboe commit a3e69071289288e2721ba15254e7c5274eddd05a Author: Ard Biesheuvel Date: Tue Sep 9 10:06:33 2025 +0200 x86/boot: Drop unused sev_enable() fallback The misc.h header is not included by the EFI stub, which is the only C caller of sev_enable(). This means the fallback for cases where CONFIG_AMD_MEM_ENCRYPT is not set is never used, so it can be dropped. Signed-off-by: Ard Biesheuvel Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://patch.msgid.link/20250909080631.2867579-6-ardb+git@google.com commit 652c108cc44cd961b58b2998ff429f11ee60c9fd Author: Elaine Zhang Date: Tue Nov 11 10:57:36 2025 +0800 clk: rockchip: Add clock controller for the RV1126B Add the clock and reset tree definitions for the new rv1126b SoC. Signed-off-by: Elaine Zhang Link: https://patch.msgid.link/20251111025738.869847-4-zhangqing@rock-chips.com Signed-off-by: Heiko Stuebner commit d0d9a9629f505ac70e1ffd172e092ff71f5d989a Author: Elaine Zhang Date: Tue Nov 11 10:57:35 2025 +0800 dt-bindings: clock, reset: Add support for rv1126b Add clock and reset ID defines for rv1126b. Also add documentation for the rv1126b CRU core. Signed-off-by: Elaine Zhang Acked-by: Conor Dooley Link: https://patch.msgid.link/20251111025738.869847-3-zhangqing@rock-chips.com Signed-off-by: Heiko Stuebner commit 826eaa8f5bac6e919cf7c0b4161b2d783fdc45b3 Author: Elaine Zhang Date: Tue Nov 11 10:57:34 2025 +0800 clk: rockchip: Implement rockchip_clk_register_armclk_multi_pll() The current path will have an independent PLL(LPLL\BPLL) exclusively for the CPU to use. As follows: |-\ --lpll--| \ |mux|--[gate]--[div]--clk_core-- --gpll--| / |-/ The new chip does not have a dedicated PLL for the cpu; it is distributed nearby from the common PLL. If there are special frequency requirements that require the use of pvtpll, explanations will be submitted later. The clock path of new soc CPU simplified as follows: --gpll--|--\ | \ | \ | \ --v0pll--| mux |--[gate]--[div]--clk_core-- | / | / --v1pll--| / |--/ Signed-off-by: Elaine Zhang Link: https://patch.msgid.link/20251111025738.869847-2-zhangqing@rock-chips.com Signed-off-by: Heiko Stuebner commit ce0b84e766ad7b2ec5d2ac7840675f223640f3e3 Author: Heiko Stuebner Date: Wed Nov 12 22:42:06 2025 +0100 arm64: dts: rockchip: add QNAP TS233 devicetree The TS233 is a 2 bay NAS similar to the TS433. Architecture-wise it really seems to be the same minus the additional PCIe connected components the TS433 has. So it just uses two of the SoCs SATA ports and the SoC's gigabit ethernet. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251112214206.423244-6-heiko@sntech.de commit a576b51e13870ba957e13e6cc265431260a32a77 Author: Heiko Stuebner Date: Wed Nov 12 22:42:05 2025 +0100 dt-bindings: arm: rockchip: add TS233 to RK3568-based QNAP NAS devices QNAP builds a number of variants of the RK3568-based NAS design. Add the 2-bay TS233 variant. Acked-by: Conor Dooley Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251112214206.423244-5-heiko@sntech.de commit 35202606ea08b9ec2b1386ac937a729e25d5beb0 Author: Heiko Stuebner Date: Wed Nov 12 22:42:04 2025 +0100 arm64: dts: rockchip: move common qnap tsx33 parts to dtsi The NAS series based around the rk3568 contains a number of models with 1-4 drives, that reuse most of the board structure. Therefore move the shared parts to a dtsi, to be included by the devices. As the smallest device is the 1-bay TS133, keep everything > slot1 in the individual devicetree. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251112214206.423244-4-heiko@sntech.de commit 81f116991433d2547d7f350873cb4511ebcd4fec Author: Heiko Stuebner Date: Wed Nov 12 22:42:03 2025 +0100 arm64: dts: rockchip: describe mcu eeprom cells on rk3568-ts433 The MCU's eeprom contains the unit's serial and a number of slots for mac-addresses. As the MCU seems to be used in different devices, up to 8 mac addresses can live there and the unused slots are actually initialized with empty mac-address strings like 00:00:00:00:05:09 . Interestingly on the TS-433, the PCIe ethernet adapter brings its own memory to hold its mac, and the gmac0 is supposed to get its mac from the second mac-slot, while the first one stays empty. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251112214206.423244-3-heiko@sntech.de commit 15efa2414602ad4c411ea8d4113b87656ebe0737 Author: Heiko Stuebner Date: Wed Nov 12 22:42:02 2025 +0100 arm64: dts: rockchip: move cpu_thermal node to the correct position The &cpu_thermal node was added at the wrong position, move it to the correctly sorted one. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251112214206.423244-2-heiko@sntech.de commit 7dec062cfcf27808dbb70a0b231d1a698792743d Author: Gabriele Monaco Date: Thu Nov 20 15:56:53 2025 +0100 timers/migration: Exclude isolated cpus from hierarchy The timer migration mechanism allows active CPUs to pull timers from idle ones to improve the overall idle time. This is however undesired when CPU intensive workloads run on isolated cores, as the algorithm would move the timers from housekeeping to isolated cores, negatively affecting the isolation. Exclude isolated cores from the timer migration algorithm, extend the concept of unavailable cores, currently used for offline ones, to isolated ones: * A core is unavailable if isolated or offline; * A core is available if non isolated and online; A core is considered unavailable as isolated if it belongs to: * the isolcpus (domain) list * an isolated cpuset Except if it is: * in the nohz_full list (already idle for the hierarchy) * the nohz timekeeper core (must be available to handle global timers) CPUs are added to the hierarchy during late boot, excluding isolated ones, the hierarchy is also adapted when the cpuset isolation changes. Due to how the timer migration algorithm works, any CPU part of the hierarchy can have their global timers pulled by remote CPUs and have to pull remote timers, only skipping pulling remote timers would break the logic. For this reason, prevent isolated CPUs from pulling remote global timers, but also the other way around: any global timer started on an isolated CPU will run there. This does not break the concept of isolation (global timers don't come from outside the CPU) and, if considered inappropriate, can usually be mitigated with other isolation techniques (e.g. IRQ pinning). This effect was noticed on a 128 cores machine running oslat on the isolated cores (1-31,33-63,65-95,97-127). The tool monopolises CPUs, and the CPU with lowest count in a timer migration hierarchy (here 1 and 65) appears as always active and continuously pulls global timers, from the housekeeping CPUs. This ends up moving driver work (e.g. delayed work) to isolated CPUs and causes latency spikes: before the change: # oslat -c 1-31,33-63,65-95,97-127 -D 62s ... Maximum: 1203 10 3 4 ... 5 (us) after the change: # oslat -c 1-31,33-63,65-95,97-127 -D 62s ... Maximum: 10 4 3 4 3 ... 5 (us) The same behaviour was observed on a machine with as few as 20 cores / 40 threads with isocpus set to: 1-9,11-39 with rtla-osnoise-top. Signed-off-by: Gabriele Monaco Signed-off-by: Thomas Gleixner Tested-by: John B. Wyatt IV Reviewed-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20251120145653.296659-8-gmonaco@redhat.com commit b56651007fc018effe695a68d48caa6970b23094 Author: Yury Norov Date: Thu Nov 20 15:56:52 2025 +0100 cpumask: Add initialiser to use cleanup helpers Now we can simplify a code that allocates cpumasks for local needs. Automatic variables have to be initialized at declaration, or at least before any possibility for the logic to return, so that compiler wouldn't try to call an associate destructor function on a random stack number. Because cpumask_var_t, depending on the CPUMASK_OFFSTACK config, is either a pointer or an array, we have to have a macro for initialization. So define a CPUMASK_VAR_NULL macro, which allows to init struct cpumask pointer with NULL when CPUMASK_OFFSTACK is enabled, and effectively a no-op when CPUMASK_OFFSTACK is disabled (initialisation optimised out with -O2). Signed-off-by: Yury Norov Signed-off-by: Gabriele Monaco Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20251120145653.296659-7-gmonaco@redhat.com commit 185bccc79797d71477e672a1b2a2b7d0325044e7 Author: Gabriele Monaco Date: Thu Nov 20 15:56:51 2025 +0100 sched/isolation: Force housekeeping if isolcpus and nohz_full don't leave any Currently the user can set up isolcpus and nohz_full in such a way that leaves no housekeeping CPU (i.e. no CPU that is neither domain isolated nor nohz full). This can be a problem for other subsystems (e.g. the timer wheel imgration). Prevent this configuration by invalidating the last setting in case the union of isolcpus (domain) and nohz_full covers all CPUs. Signed-off-by: Gabriele Monaco Signed-off-by: Thomas Gleixner Reviewed-by: Waiman Long Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20251120145653.296659-6-gmonaco@redhat.com commit 22f8e41680efec63ead03d4693676587814f7a24 Author: Gabriele Monaco Date: Thu Nov 20 15:56:50 2025 +0100 cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks() update_unbound_workqueue_cpumask() updates unbound workqueues settings when there's a change in isolated CPUs, but it can be used for other subsystems requiring updated when isolated CPUs change. Generalise the name to update_isolation_cpumasks() to prepare for other functions unrelated to workqueues to be called in that spot. [longman: Change the function name to update_isolation_cpumasks()] Signed-off-by: Gabriele Monaco Signed-off-by: Waiman Long Signed-off-by: Thomas Gleixner Reviewed-by: Chen Ridong Acked-by: Frederic Weisbecker Acked-by: Waiman Long Link: https://patch.msgid.link/20251120145653.296659-5-gmonaco@redhat.com commit 4c2374ed86847c71dab5602c7882d21a0d56a4c7 Author: Gabriele Monaco Date: Thu Nov 20 15:56:49 2025 +0100 timers/migration: Use scoped_guard on available flag set/clear Cleanup tmigr_clear_cpu_available() and tmigr_set_cpu_available() to prepare for easier checks on the available flag. Signed-off-by: Gabriele Monaco Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/20251120145653.296659-4-gmonaco@redhat.com commit a048ca5f00ebd5a44f8551d546a3cd81fed7a204 Author: Gabriele Monaco Date: Thu Nov 20 15:56:48 2025 +0100 timers/migration: Add mask for CPUs available in the hierarchy Keep track of the CPUs available for timer migration in a cpumask. This prepares the ground to generalise the concept of unavailable CPUs. Signed-off-by: Gabriele Monaco Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/20251120145653.296659-3-gmonaco@redhat.com commit 8312cab5ff4702389a86129051eba6ea046a71a1 Author: Gabriele Monaco Date: Thu Nov 20 15:56:47 2025 +0100 timers/migration: Rename 'online' bit to 'available' The timer migration hierarchy excludes offline CPUs via the tmigr_is_not_available function, which is essentially checking the online bit for the CPU. Rename the online bit to available and all references in function names and tracepoint to generalise the concept of available CPUs. Signed-off-by: Gabriele Monaco Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/20251120145653.296659-2-gmonaco@redhat.com commit 9bef5cead63d5d8fad3ba7ebaf26f3f4ee172c82 Author: Hrishikesh Suresh Date: Wed Nov 19 23:16:10 2025 -0500 perf: replace strcpy() with strncpy() in util/jitdump.c Usage of strcpy() can lead to buffer overflows. Therefore, it has been replaced with strncpy(). The output file path is provided as a parameter and might be restricted by command-line by default. But this defensive patch will prevent any potential overflow, making the code more robust against future changes in input handling. Testing: - ran perf test from tools/perf and did not observe any regression with the earlier code Signed-off-by: Hrishikesh Suresh Signed-off-by: Namhyung Kim commit 3ce77655f026a316442f23d47da6c5cd89c1fdac Author: Namhyung Kim Date: Wed Nov 19 16:47:26 2025 -0800 perf list: Support filtering in JSON output Like regular output mode, it should honor command line arguments to limit to a certain type of PMUs or events. $ perf list -j hw [ { "Unit": "cpu", "Topic": "legacy hardware", "EventName": "branch-instructions", "EventType": "Kernel PMU event", "BriefDescription": "Retired branch instructions [This event is an alias of branches]", "Encoding": "cpu/event=0xc4\n/" }, { "Unit": "cpu", "Topic": "legacy hardware", "EventName": "branch-misses", "EventType": "Kernel PMU event", "BriefDescription": "Mispredicted branch instructions", "Encoding": "cpu/event=0xc5\n/" }, ... Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 58e0a81e76bf274afe7d24d80d7855a7642bb52a Author: Namhyung Kim Date: Wed Nov 19 16:47:25 2025 -0800 perf list: Share print state with JSON output The JSON print state has only one different field (need_sep). Let's add the default print state to the json state and use it. Then we can use the 'ps' variable to update the state properly. This is a preparation for the next commit. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 8cf9cca7f687044702228c51b8e3bb853a0e1b54 Author: Namhyung Kim Date: Wed Nov 19 16:47:24 2025 -0800 perf list: Print matching PMU events for --unit When --unit option is used, pmu_glob is set to the argument. It should match with event PMU and display the matching ones only. But it also shows raw events and metrics after that. $ perf list --unit tool List of pre-defined events (to be used in -e or -M): tool: core_wide [1 if not SMT,if SMT are events being gathered on all SMT threads 1 otherwise 0. Unit: tool] duration_time [Wall clock interval time in nanoseconds. Unit: tool] has_pmem [1 if persistent memory installed otherwise 0. Unit: tool] num_cores [Number of cores. A core consists of 1 or more thread,with each thread being associated with a logical Linux CPU. Unit: tool] num_cpus [Number of logical Linux CPUs. There may be multiple such CPUs on a core. Unit: tool] ... rNNN [Raw event descriptor] cpu/event=0..255,pc,edge,.../modifier [Raw event descriptor] [(see 'man perf-list' or 'man perf-record' on how to encode it)] breakpoint//modifier [Raw event descriptor] cstate_core/event=0..0xffffffffffffffff/modifier [Raw event descriptor] cstate_pkg/event=0..0xffffffffffffffff/modifier [Raw event descriptor] drm_i915//modifier [Raw event descriptor] hwmon_acpitz//modifier [Raw event descriptor] hwmon_ac//modifier [Raw event descriptor] hwmon_bat0//modifier [Raw event descriptor] hwmon_coretemp//modifier [Raw event descriptor] ... Metric Groups: Backend: [Grouping from Top-down Microarchitecture Analysis Metrics spreadsheet] tma_core_bound [This metric represents fraction of slots where Core non-memory issues were of a bottleneck] tma_info_core_ilp [Instruction-Level-Parallelism (average number of uops executed when there is execution) per thread (logical-processor)] tma_info_memory_l2mpki [L2 cache true misses per kilo instruction for retired demand loads] ... This change makes it print the tool PMU events only. Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 41b67ab3d2f5be9d0b6e5ba9cbec97c820fc50e8 Author: Ian Rogers Date: Wed Nov 19 11:30:47 2025 -0800 perf test all metrics: Fully ignore Default metric failures Determine if a metric is default from `perf list --raw-dump $m` eg: ``` $ perf list --raw-dump l1_prefetch_miss_rate Default4 l1_prefetch_miss_rate ``` If a metric has "not supported" or "no supported events" then ignore these failures for default metrics. Tidy up the skip/fail messages in the output to make them easier to spot/read. ``` $ perf list -vv "all metrics" ... Testing llc_miss_rate [Ignored llc_miss_rate] failed but as a Default metric this can be expected Error: No supported events found. The LLC-loads event is not supported. ... ``` Reported-by: Thomas Richter Closes: https://lore.kernel.org/linux-perf-users/20251119104751.51960-1-tmricht@linux.ibm.com/ Reported-by: Namhyung Kim Reported-by: James Clark Closes: https://lore.kernel.org/lkml/aRi9xnwdLh3Dir9f@google.com/ Signed-off-by: Ian Rogers Reviewed-by: James Clark Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit 35c3503908d320989d76b735580fd93aa497185f Author: Leon Romanovsky Date: Thu Nov 20 11:28:28 2025 +0200 vfio/pci: Enable peer-to-peer DMA transactions by default Make sure that all VFIO PCI devices have peer-to-peer capabilities enables, so we would be able to export their MMIO memory through DMABUF, VFIO has always supported P2P mappings with itself. VFIO type 1 insecurely reads PFNs directly out of a VMA's PTEs and programs them into the IOMMU allowing any two VFIO devices to perform P2P to each other. All existing VMMs use this capability to export P2P into a VM where the VM could setup any kind of DMA it likes. Projects like DPDK/SPDK are also known to make use of this, though less frequently. As a first step to more properly integrating VFIO with the P2P subsystem unconditionally enable P2P support for VFIO PCI devices. The struct p2pdma_provider will act has a handle to the P2P subsystem to do things like DMA mapping. While real PCI devices have to support P2P (they can't even tell if an IOVA is P2P or not) there may be fake PCI devices that may trigger some kind of catastrophic system failure. To date VFIO has never tripped up on such a case, but if one is discovered the plan is to add a PCI quirk and have pcim_p2pdma_init() fail. This will fully block the broken device throughout any users of the P2P subsystem in the kernel. Thus P2P through DMABUF will follow the historical VFIO model and be unconditionally enabled by vfio-pci. Reviewed-by: Kevin Tian Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-9-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 47d13c939d89d348966857b24bb15092398ed8bb Author: Vivek Kasireddy Date: Thu Nov 20 11:28:27 2025 +0200 vfio/pci: Share the core device pointer while invoking feature functions There is no need to share the main device pointer (struct vfio_device *) with all the feature functions as they only need the core device pointer. Therefore, extract the core device pointer once in the caller (vfio_pci_core_ioctl_feature) and share it instead. Signed-off-by: Vivek Kasireddy Reviewed-by: Kevin Tian Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-8-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 64a5dedcff801072154a806102d731ecdf0e7552 Author: Vivek Kasireddy Date: Thu Nov 20 11:28:26 2025 +0200 vfio: Export vfio device get and put registration helpers These helpers are useful for managing additional references taken on the device from other associated VFIO modules. Original-patch-by: Jason Gunthorpe Signed-off-by: Vivek Kasireddy Reviewed-by: Kevin Tian Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-7-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 3aa31a8bb11e47c0ff2b306988d1756b810c1c3c Author: Leon Romanovsky Date: Thu Nov 20 11:28:25 2025 +0200 dma-buf: provide phys_vec to scatter-gather mapping routine Add dma_buf_phys_vec_to_sgt() and dma_buf_free_sgt() helpers to convert an array of MMIO physical address ranges into scatter-gather tables with proper DMA mapping. These common functions are a starting point and support any PCI drivers creating mappings from their BAR's MMIO addresses. VFIO is one case, as shortly will be RDMA. We can review existing DRM drivers to refactor them separately. We hope this will evolve into routines to help common DRM that include mixed CPU and MMIO mappings. Compared to the dma_map_resource() abuse this implementation handles the complicated PCI P2P scenarios properly, especially when an IOMMU is enabled: - Direct bus address mapping without IOVA allocation for PCI_P2PDMA_MAP_BUS_ADDR, using pci_p2pdma_bus_addr_map(). This happens if the IOMMU is enabled but the PCIe switch ACS flags allow transactions to avoid the host bridge. Further, this handles the slightly obscure, case of MMIO with a phys_addr_t that is different from the physical BAR programming (bus offset). The phys_addr_t is converted to a dma_addr_t and accommodates this effect. This enables certain real systems to work, especially on ARM platforms. - Mapping through host bridge with IOVA allocation and DMA_ATTR_MMIO attribute for MMIO memory regions (PCI_P2PDMA_MAP_THRU_HOST_BRIDGE). This happens when the IOMMU is enabled and the ACS flags are forcing all traffic to the IOMMU - ie for virtualization systems. - Cases where P2P is not supported through the host bridge/CPU. The P2P subsystem is the proper place to detect this and block it. Helper functions fill_sg_entry() and calc_sg_nents() handle the scatter-gather table construction, splitting large regions into UINT_MAX-sized chunks to fit within sg->length field limits. Since the physical address based DMA API forbids use of the CPU list of the scatterlist this will produce a mangled scatterlist that has a fully zero-length and NULL'd CPU list. The list is 0 length, all the struct page pointers are NULL and zero sized. This is stronger and more robust than the existing mangle_sg_table() technique. It is a future project to migrate DMABUF as a subsystem away from using scatterlist for this data structure. Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Christian König Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-6-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 50d44fce53b6474147fcfa0a27a6e5fd290dd8ed Author: Jason Gunthorpe Date: Thu Nov 20 11:28:24 2025 +0200 PCI/P2PDMA: Document DMABUF model Reflect latest changes in p2p implementation to support DMABUF lifecycle. Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-5-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 395698bd2cd7639b85784a4a8f5ddb7a581e353c Author: Leon Romanovsky Date: Thu Nov 20 11:28:23 2025 +0200 PCI/P2PDMA: Provide an access to pci_p2pdma_map_type() function Provide an access to pci_p2pdma_map_type() function to allow subsystems to determine the appropriate mapping type for P2PDMA transfers between a provider and target device. The pci_p2pdma_map_type() function is the core P2P layer version of the existing public, but struct page focused, pci_p2pdma_state() function. It returns the same result. It is required to use the p2p subsystem from drivers that don't use the struct page layer. Like __pci_p2pdma_update_state() it is not an exported function. The idea is that only subsystem code will implement mapping helpers for taking in phys_addr_t lists, this is deliberately not made accessible to every driver to prevent abuse. Following patches will use this function to implement a shared DMA mapping helper for DMABUF. Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-4-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 372d6d1b8ae3cdfe6b0638a0a848c6865ec94567 Author: Leon Romanovsky Date: Thu Nov 20 11:28:22 2025 +0200 PCI/P2PDMA: Refactor to separate core P2P functionality from memory allocation Refactor the PCI P2PDMA subsystem to separate the core peer-to-peer DMA functionality from the optional memory allocation layer. This creates a two-tier architecture: The core layer provides P2P mapping functionality for physical addresses based on PCI device MMIO BARs and integrates with the DMA API for mapping operations. This layer is required for all P2PDMA users. The optional upper layer provides memory allocation capabilities including gen_pool allocator, struct page support, and sysfs interface for user space access. This separation allows subsystems like DMABUF to use only the core P2P mapping functionality without the overhead of memory allocation features they don't need. The core functionality is now available through the new pcim_p2pdma_provider() function that returns a p2pdma_provider structure. Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-3-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit d4504262f745e48c1739c8b864f779b4b0f9de80 Author: Leon Romanovsky Date: Thu Nov 20 11:28:21 2025 +0200 PCI/P2PDMA: Simplify bus address mapping API Update the pci_p2pdma_bus_addr_map() function to take a direct pointer to the p2pdma_provider structure instead of the pci_p2pdma_map_state. This simplifies the API by removing the need for callers to extract the provider from the state structure. The change updates all callers across the kernel (block layer, IOMMU, DMA direct, and HMM) to pass the provider pointer directly, making the code more explicit and reducing unnecessary indirection. This also removes the runtime warning check since callers now have direct control over which provider they use. Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-2-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit f58ef9d1d1355b15443719df95081f193067ab88 Author: Leon Romanovsky Date: Thu Nov 20 11:28:20 2025 +0200 PCI/P2PDMA: Separate the mmap() support from the core logic Currently the P2PDMA code requires a pgmap and a struct page to function. The was serving three important purposes: - DMA API compatibility, where scatterlist required a struct page as input - Life cycle management, the percpu_ref is used to prevent UAF during device hot unplug - A way to get the P2P provider data through the pci_p2pdma_pagemap The DMA API now has a new flow, and has gained phys_addr_t support, so it no longer needs struct pages to perform P2P mapping. Lifecycle management can be delegated to the user, DMABUF for instance has a suitable invalidation protocol that does not require struct page. Finding the P2P provider data can also be managed by the caller without need to look it up from the phys_addr. Split the P2PDMA code into two layers. The optional upper layer, effectively, provides a way to mmap() P2P memory into a VMA by providing struct page, pgmap, a genalloc and sysfs. The lower layer provides the actual P2P infrastructure and is wrapped up in a new struct p2pdma_provider. Rework the mmap layer to use new p2pdma_provider based APIs. Drivers that do not want to put P2P memory into VMA's can allocate a struct p2pdma_provider after probe() starts and free it before remove() completes. When DMA mapping the driver must convey the struct p2pdma_provider to the DMA mapping code along with a phys_addr of the MMIO BAR slice to map. The driver must ensure that no DMA mapping outlives the lifetime of the struct p2pdma_provider. The intended target of this new API layer is DMABUF. There is usually only a single p2pdma_provider for a DMABUF exporter. Most drivers can establish the p2pdma_provider during probe, access the single instance during DMABUF attach and use that to drive the DMA mapping. DMABUF provides an invalidation mechanism that can guarantee all DMA is halted and the DMA mappings are undone prior to destroying the struct p2pdma_provider. This ensures there is no UAF through DMABUFs that are lingering past driver removal. The new p2pdma_provider layer cannot be used to create P2P memory that can be mapped into VMA's, be used with pin_user_pages(), O_DIRECT, and so on. These use cases must still use the mmap() layer. The p2pdma_provider layer is principally for DMABUF-like use cases where DMABUF natively manages the life cycle and access instead of vmas/pin_user_pages()/struct page. In addition, remove the bus_off field from pci_p2pdma_map_state since it duplicates information already available in the pgmap structure. The bus_offset is only used in one location (pci_p2pdma_bus_addr_map) and is always identical to pgmap->bus_offset. Signed-off-by: Jason Gunthorpe Tested-by: Alex Mastro Tested-by: Nicolin Chen Signed-off-by: Leon Romanovsky Acked-by: Ankit Agrawal Link: https://lore.kernel.org/r/20251120-dmabuf-vfio-v9-1-d7f71607f371@nvidia.com Signed-off-by: Alex Williamson commit 31b4d3af63f9afcb2661b9be554f0cf55c86573b Author: Thomas Weißschuh Date: Wed Oct 29 17:02:56 2025 +0100 tools/nolibc: remove more __nolibc_enosys() fallbacks Commit e6366101ce1f ("tools/nolibc: remove __nolibc_enosys() fallback from time64-related functions") removed many of these fallbacks but forgot a few. Finish the job. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit 3e1da545db4c26c39955bd2eee2d71b62d1ba045 Author: Thomas Weißschuh Date: Wed Oct 29 17:02:55 2025 +0100 tools/nolibc: remove now superfluous overflow check in llseek As off_t is now always 64-bit wide this overflow can not happen anymore, remove the check. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Reviewed-by: Arnd Bergmann commit e800e9446867c78eeccb790de68375d4fe77ab65 Author: Thomas Weißschuh Date: Wed Oct 29 17:02:54 2025 +0100 tools/nolibc: use 64-bit off_t The kernel uses 64-bit values for file offsets. Currently these might be truncated to 32-bit when assigned to nolibc's off_t values. Switch to 64-bit off_t consistently. Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/lkml/cec27d94-c99d-4c57-9a12-275ea663dda8@app.fastmail.com/ Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit 19c5a681b2262fe30c027aefb3df637f69df140f Author: Thomas Weißschuh Date: Wed Oct 29 17:02:53 2025 +0100 tools/nolibc: prefer the llseek syscall Make sure to always use the 64-bit safe system call in preparation for 64-bit off_t on 32 bit architectures. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit d93d0593dd65b8cd72d6dc9bda7fc4982fd65afb Author: Thomas Weißschuh Date: Wed Oct 29 17:02:52 2025 +0100 tools/nolibc: handle 64-bit off_t for llseek Correctly handle 64-bit off_t values in preparation for 64-bit off_t on 32-bit architectures. Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Acked-by: Willy Tarreau commit 87506e44cb85cc1c2bf70b3d496b674178f219bd Author: Thomas Weißschuh Date: Wed Oct 29 17:02:51 2025 +0100 tools/nolibc: use 64-bit ino_t The kernel uses 64-bit values for inode numbers. Currently these might be truncated to 32-bit when assigned to nolibc's ino_t values. Switch to 64-bit ino_t consistently. As ino_t is never used directly in kernel ABIs, no systemcall wrappers need to be adapted. Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/lkml/cec27d94-c99d-4c57-9a12-275ea663dda8@app.fastmail.com/ Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit e6dc6eab80e6b582cc9c2632f082c0071e4173a9 Merge: 6f87b41303d3c4 5fc4e4cf7a2268 Author: Bartosz Golaszewski Date: Thu Nov 20 19:17:47 2025 +0100 Merge tag 'reset-gpio-for-v6.19' of https://git.pengutronix.de/git/pza/linux into gpio/for-next Reset/GPIO/swnode changes for v6.19 * Extend software node implementation, allowing its properties to reference existing firmware nodes. * Update the GPIO property interface to use reworked swnode macros. * Rework reset-gpio code to use GPIO lookup via swnode. * Fix spi-cs42l43 driver to work with swnode changes. commit f20810157f6e971e0faca77b5c53c59f188b6ed8 Author: Cai Xinchen Date: Thu Nov 20 01:30:25 2025 +0000 arm64: remove duplicate ARCH_HAS_MEM_ENCRYPT The commit e7bafbf717775 ("arm64: mm: Add top-level dispatcher for internal mem_encrypt API") adds ARCH_HAS_MEM_ENCRYPT. And then the commit 42be24a4178fe ("arm64: Enable memory encrypt for Realms") adds duplicate config. Just remove it. Fixes: 42be24a4178f ("arm64: Enable memory encrypt for Realms") Signed-off-by: Cai Xinchen Signed-off-by: Catalin Marinas commit a06494adb7efba2dda3866ac2e354aeacb3992f1 Author: Yang Shi Date: Tue Nov 18 20:19:45 2025 -0800 arm64: mm: use untagged address to calculate page index Nathan Chancellor reported the below bug: [ 0.149929] BUG: KASAN: invalid-access in change_memory_common+0x258/0x2d0 [ 0.151006] Read of size 8 at addr f96680000268a000 by task swapper/0/1 [ 0.152031] [ 0.152274] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1-00012-g37cb0aab9068 #1 PREEMPT [ 0.152288] Hardware name: linux,dummy-virt (DT) [ 0.152292] Call trace: [ 0.152295] show_stack+0x18/0x30 (C) [ 0.152309] dump_stack_lvl+0x60/0x80 [ 0.152320] print_report+0x480/0x498 [ 0.152331] kasan_report+0xac/0xf0 [ 0.152343] kasan_check_range+0x90/0xb0 [ 0.152353] __hwasan_load8_noabort+0x20/0x34 [ 0.152364] change_memory_common+0x258/0x2d0 [ 0.152375] set_memory_ro+0x18/0x24 [ 0.152386] bpf_prog_pack_alloc+0x200/0x2e8 [ 0.152397] bpf_jit_binary_pack_alloc+0x78/0x188 [ 0.152409] bpf_int_jit_compile+0xa4c/0xc74 [ 0.152420] bpf_prog_select_runtime+0x1c0/0x2bc [ 0.152430] bpf_prepare_filter+0x5a4/0x7c0 [ 0.152443] bpf_prog_create+0xa4/0x100 [ 0.152454] ptp_classifier_init+0x80/0xd0 [ 0.152465] sock_init+0x12c/0x178 [ 0.152474] do_one_initcall+0xa0/0x260 [ 0.152484] kernel_init_freeable+0x2d8/0x358 [ 0.152495] kernel_init+0x20/0x140 [ 0.152510] ret_from_fork+0x10/0x20 It is because the KASAN tagged address was used when calculating the page index. The untagged address should be used. Fixes: 37cb0aab9068 ("arm64: mm: make linear mapping permission update more robust for patial range") Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Yang Shi Signed-off-by: Catalin Marinas commit f1c668269ded16bea32a11d03f4584caa0c018c9 Author: Marco Crivellari Date: Thu Nov 6 15:50:03 2025 +0100 regulator: qcomm-labibb: replace use of system_wq with system_dfl_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This specific workload do not benefit from a per-cpu workqueue, so use the default unbound workqueue (system_dfl_wq) instead. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251106145003.245866-1-marco.crivellari@suse.com Signed-off-by: Mark Brown commit d088da904223e8f5e19c6d156cf372d5baec1a7c Author: Matt Bobrowski Date: Tue Nov 18 07:37:34 2025 +0000 selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names subtest_kmem_cache_iter_check_slabinfo() fundamentally compares slab cache names parsed out from /proc/slabinfo against those stored within struct kmem_cache_result. The current problem is that the slab cache name within struct kmem_cache_result is stored within a bounded fixed-length array (sized to SLAB_NAME_MAX(32)), whereas the name parsed out from /proc/slabinfo is not. Meaning, using ASSERT_STREQ() can certainly lead to test failures, particularly when dealing with slab cache names that are longer than SLAB_NAME_MAX(32) bytes. Notably, kmem_cache_create() allows callers to create slab caches with somewhat arbitrarily sized names via its __name identifier argument, so exceeding the SLAB_NAME_MAX(32) limit that is in place now can certainly happen. Make subtest_kmem_cache_iter_check_slabinfo() more reliable by only checking up to sizeof(struct kmem_cache_result.name) - 1 using ASSERT_STRNEQ(). Fixes: a496d0cdc84d ("selftests/bpf: Add a test for kmem_cache_iter") Signed-off-by: Matt Bobrowski Signed-off-by: Martin KaFai Lau Acked-by: Song Liu Link: https://patch.msgid.link/20251118073734.4188710-1-mattbobrowski@google.com commit 3af1815a2f9caebfc666af3912e24d030a5368d5 Author: Charles Keepax Date: Thu Nov 20 15:30:22 2025 +0000 ASoC: SDCA: Add basic SDCA function driver Add a driver to support the individual SDCA functions within the class driver. Use the SDCA helpers to parse the DisCo information and register a function driver based on those properties. Manage the boot of the function, reset, FDL, defaults. Manage the function level register map. Co-developed-by: Maciej Strozek Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-14-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 2d877d0659cb69cc0677ee2805e9521966d70ac5 Author: Charles Keepax Date: Thu Nov 20 15:30:21 2025 +0000 ASoC: SDCA: Add basic SDCA class driver Add a device level driver as the entry point for the class driver. Additional auxiliary drivers will be registered to support each function within the device. This driver will register those function drivers and provide the device level functionality, such as monitoring bus attach/detach, the device level register map, and the root for the IRQ handling. Co-developed-by: Maciej Strozek Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-13-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 4496d1c65bad7a3a32d2e09aaf3c54bc562c3fcc Author: Pierre-Louis Bossart Date: Thu Nov 20 15:30:20 2025 +0000 ASoC: SDCA: add function devices Use the auxiliary bus to register/unregister subdevices for each function. Each function will be handled with a separate driver, matched using a name. If a vendor wants to override a specific function driver, they could use a custom name to match with a custom function driver. Signed-off-by: Pierre-Louis Bossart Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-12-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 5acf17b6df5e759bfb8bc0a75fadcbb3e363a17b Author: Charles Keepax Date: Thu Nov 20 15:30:19 2025 +0000 ASoC: SDCA: Add helper to write initialization writes Add a helper function to write out the SDCA blind initialization writes. Acked-by: Vinod Koul Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-11-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 193c65ec8ed4d946b3f80b7d08e4320ded7ac4fa Author: Charles Keepax Date: Thu Nov 20 15:30:18 2025 +0000 ASoC: SDCA: Populate regmap cache for readable Controls It is not uncommon for an SDCA Control to have no specified default value in the DisCo. Non-volatile registers with no defaults will not be present in the cache until they are accessed. However, if the first operation user-space performs is a read whilst the device is runtime suspended this read will fail. To avoid such problems we should populate values from the hardware into the cache for all non-volatile readable registers with no defaults. Update the defaults handling to do this cache population since it is iterating over the Controls and happens at a time the hardware is always powered up. Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-10-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 222cbe172e5f7de130cc9c3c85f8f33d51c131bc Author: Charles Keepax Date: Thu Nov 20 15:30:17 2025 +0000 ASoC: SDCA: Factor out helper to process Control defaults The indentation of the loop processing writing out SDCA Control default values is getting a bit large. Reduce indentation and make adding more functionality easier by factoring out the Control handling into a helper function. Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-9-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit fb62da31fad29fe3c9844ba217b9bc99820d4622 Author: Charles Keepax Date: Thu Nov 20 15:30:16 2025 +0000 ASoC: SDCA: Use helper macros for control identification We have the SDCA_CTL_TYPE helper macros, we should use them when identifying specific controls to simplify the code a little. Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-8-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit edb82534ee655091e198edf95e223115dc27c284 Author: Charles Keepax Date: Thu Nov 20 15:30:15 2025 +0000 ASoC: SDCA: Move most of the messages from info to debug The SDCA code is very spammy on boot as it prints a lot of parsing details using info prints. Now primary development is complete move these to debug prints to reduce the spam. Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-7-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 336beae295bf6973e5c8c222dfec6b8faf3c55f6 Author: Charles Keepax Date: Thu Nov 20 15:30:14 2025 +0000 ASoC: SDCA: Add comment for function reset polling Add a comment to better explain the function reset polling rate. Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-6-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit cc58055bfefa065b68a8ab92a0196c9b24f46f02 Author: Charles Keepax Date: Thu Nov 20 15:30:13 2025 +0000 ASoC: SDCA: Correct FDL locking in sdca_fdl_process() The current locking in sdca_fdl_process() locks over sdca_ump_cancel_timeout() and the timeout work function takes the same lock, this can lead to a deadlock if the work runs as part of the cancel. To fix this use scoped_guard and move the cancel timeout to be outside the lock. Fixes: e92e25f77748 ("ASoC: SDCA: Add UMP timeout handling for FDL") Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-5-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 5fe65824b74c0414f105f0535437108cd6c31cc7 Author: Charles Keepax Date: Thu Nov 20 15:30:12 2025 +0000 ASoC: SDCA: Add missing forward declaration in header The structure sdca_function_desc contains a fwnode_handle which is undefined if the user doesn't pull in an appropriate header. Add a forward declaration to avoid this. Fixes: 996bf834d0b6 ("ASoC: SDCA: Add code to parse Function information") Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-4-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 3508311f2e1c872b645f13c6fd52840418089d41 Author: Charles Keepax Date: Thu Nov 20 15:30:11 2025 +0000 ASoC: SDCA: Fix missing dash in HIDE DisCo property The property name is "mipi-sdca-RxUMP-ownership-transition-max-delay", with a dash between max and delay. Add the missing dash. Fixes: 13ef21dffe76 ("ASoC: SDCA: add support for HIDE entity properties and HID descriptor/report") Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-3-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 549f618516a17f7d492cf64048713f77e057cd37 Author: Charles Keepax Date: Thu Nov 20 15:30:10 2025 +0000 ASoC: SDCA: Remove duplicated module macros Both HID and the IRQ are now build into the wider SDCA kernel module, so their module macros are redundant, remove them. Fixes: 5030abcb0aa3 ("ASoC: SDCA: Pull HID and IRQ into the primary SDCA module") Tested-by: Bard Liao Reviewed-by: Maciej Strozek Reviewed-by: Peter Ujfalusi Tested-by: Richard Fitzgerald Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120153023.2105663-2-ckeepax@opensource.cirrus.com Reviewed-by: Vinod Koul Signed-off-by: Mark Brown commit 43a3adb6dd39d98bf84e04569e7604be5e5c0d79 Author: Riccardo Mereu Date: Thu Nov 20 16:58:22 2025 +0100 spi: spidev: add compatible for arduino spi mcu interface Add compatible entry in spidev describing in Arduino UnoQ single-board computer the interface between Qualcomm QRB2210 microprocessor and STMicroelectronics STM32U585 microcontroller. It is handled in user space by the arduino-router service. Signed-off-by: Riccardo Mereu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251120155825.121483-4-r.mereu.kernel@arduino.cc Signed-off-by: Mark Brown commit a7bde7c10902a0f6f903d3bbe67461f2b402a9ca Author: Riccardo Mereu Date: Thu Nov 20 16:58:21 2025 +0100 dt-bindings: trivial-devices: add arduino spi mcu interface Add unoq mcu interface. It describes an iterface between Qualcomm QRB2210 microprocessor and STMicroelectronics STM32U585 microcontroller on Arduino UnoQ single-board computer. This is a trivial device since it's usage is handled in user space by the arduino-router service. Signed-off-by: Riccardo Mereu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251120155825.121483-3-r.mereu.kernel@arduino.cc Signed-off-by: Mark Brown commit 3efee7362dbf896072af1c1aaeaf9fd6e235c591 Author: Charles Keepax Date: Thu Nov 20 15:56:57 2025 +0000 ASoC: SDCA: Add stubs for FDL helper functions In the case the SDCA IRQ is built in but FDL support is not stub functions are required for the FDL helpers to avoid build failures. The FDL IRQs likely shouldn't get triggered in this case, however they would still be a part of the build. Fixes: 71f7990a34cd ("ASoC: SDCA: Add FDL library for XU entities") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511200419.SbU6YvjE-lkp@intel.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251120155657.2181751-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit df2602e1c68af8ea5e6e91da9e48a4312b88e943 Author: Marek Vasut Date: Tue Nov 18 13:13:10 2025 +0100 dt-bindings: eeprom: at25: Add Anvo ANV32C81W Document the compatible for ANV32C81W 256kb Serial SPI non-volatile SRAM. Although it is a SRAM device, it can be accessed through EEPROM interface. At least until there is no proper SRAM driver support for it. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20251118121513.88352-1-marex@nabladev.com Signed-off-by: Rob Herring (Arm) commit 9e203721ec6117b2f4436a26662413764fd669f0 Merge: 0888a0d76dc202 8e621c9a337555 Author: Jakub Kicinski Date: Thu Nov 20 09:12:41 2025 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.18-rc7). No conflicts, adjacent changes: tools/testing/selftests/net/af_unix/Makefile e1bb28bf13f4 ("selftest: af_unix: Add test for SO_PEEK_OFF.") 45a1cd8346ca ("selftests: af_unix: Add tests for ECONNRESET and EOF semantics") Signed-off-by: Jakub Kicinski commit 3b64ea4768e7e64b2d9ae5833dbcac19f6212145 Author: Xu Yang Date: Tue Nov 18 15:19:47 2025 +0800 phy: fsl-imx8mq-usb: support alternate reference clock This phy supports both 24MHz and 100MHz clock inputs. By default it's using XTAL 24MHz and the 100MHz clock is a alternate reference clock. Add supports to use alternate reference clock in case 24MHz clock can't work well. Reviewed-by: Frank Li Signed-off-by: Xu Yang Link: https://patch.msgid.link/20251118071947.2504789-2-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit 0e8fe19c0292d9912460b25043292227d5f1fdb2 Author: Xu Yang Date: Tue Nov 18 15:19:46 2025 +0800 dt-bindings: phy: imx8mq-usb: add alternate reference clock Beside default 24MHz clock input, there is an optional additional 100Mhz clock input 'alt' for USB PHY reference clock. Reviewed-by: Frank Li Acked-by: Conor Dooley Signed-off-by: Xu Yang Link: https://patch.msgid.link/20251118071947.2504789-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit 06a7415cf24774baf1945fc28ea152e888bd72bb Author: Rong Tao Date: Tue Nov 18 13:37:13 2025 +0800 sched_ext: tools: Removing duplicate targets during non-cross compilation When cross-compilation is not used, BPFOBJ and HOST_BPFOBJ are identical files, libbpf.a, and duplicate libbpf.a files should be removed. Signed-off-by: Rong Tao Signed-off-by: Tejun Heo commit 51023cf6cc5db3423dea6620746d9087e336e024 Author: Cristian Ciocaltea Date: Tue Oct 28 10:00:56 2025 +0200 phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Fixup PHY deskew FIFO to prevent the phase of D2 lane going ahead of other lanes. It's worth noting this might only happen when dealing with HDMI 2.0 rates. Fixes: 553be2830c5f ("phy: rockchip: Add Samsung HDMI/eDP Combo PHY driver") Co-developed-by: Algea Cao Signed-off-by: Algea Cao Signed-off-by: Cristian Ciocaltea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251028-phy-hdptx-fixes-v1-3-ecc642a59d94@collabora.com Signed-off-by: Vinod Koul commit 8daaced9f5eeb4a2c8ca08b0a8286b6a498a8387 Author: Cristian Ciocaltea Date: Tue Oct 28 10:00:55 2025 +0200 phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth Due to its relatively low frequency, a noise stemming from the 24MHz PLL reference clock may traverse the low-pass loop filter of ROPLL, which could potentially generate some HDMI flash artifacts. Reduce ROPLL loop bandwidth in an attempt to mitigate the problem. Fixes: 553be2830c5f ("phy: rockchip: Add Samsung HDMI/eDP Combo PHY driver") Co-developed-by: Algea Cao Signed-off-by: Algea Cao Signed-off-by: Cristian Ciocaltea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251028-phy-hdptx-fixes-v1-2-ecc642a59d94@collabora.com Signed-off-by: Vinod Koul commit 72126e9623e1696ea83c77ef6d0306a6263bdd6b Author: Cristian Ciocaltea Date: Tue Oct 28 10:00:54 2025 +0200 phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode When making use of the clock provider functionality, the output clock does normally match the TMDS character rate, which is what the PHY PLL gets configured to. However, this is only applicable for default color depth of 8 bpc. For higher depths, the output clock is further divided by the hardware according to the formula: output_clock_rate = tmds_char_rate * 8 / bpc Since the existence of the clock divider wasn't taken into account when support for high bpc has been introduced, make the necessary adjustments to report the correct clock rate. Fixes: 9d0ec51d7c22 ("phy: rockchip: samsung-hdptx: Add high color depth management") Reported-by: Andy Yan Signed-off-by: Cristian Ciocaltea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251028-phy-hdptx-fixes-v1-1-ecc642a59d94@collabora.com Signed-off-by: Vinod Koul commit 318e18ed22e89397635e15095c014accaf47ed30 Author: Pingfan Liu Date: Wed Nov 19 17:55:25 2025 +0800 sched/deadline: Walk up cpuset hierarchy to decide root domain when hot-unplug *** Bug description *** When testing kexec-reboot on a 144 cpus machine with isolcpus=managed_irq,domain,1-71,73-143 in kernel command line, I encounter the following bug: [ 97.114759] psci: CPU142 killed (polled 0 ms) [ 97.333236] Failed to offline CPU143 - error=-16 [ 97.333246] ------------[ cut here ]------------ [ 97.342682] kernel BUG at kernel/cpu.c:1569! [ 97.347049] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [...] In essence, the issue originates from the CPU hot-removal process, not limited to kexec. It can be reproduced by writing a SCHED_DEADLINE program that waits indefinitely on a semaphore, spawning multiple instances to ensure some run on CPU 72, and then offlining CPUs 1–143 one by one. When attempting this, CPU 143 failed to go offline. bash -c 'taskset -cp 0 $$ && for i in {1..143}; do echo 0 > /sys/devices/system/cpu/cpu$i/online 2>/dev/null; done' Tracking down this issue, I found that dl_bw_deactivate() returned -EBUSY, which caused sched_cpu_deactivate() to fail on the last CPU. But that is not the fact, and contributed by the following factors: When a CPU is inactive, cpu_rq()->rd is set to def_root_domain. For an blocked-state deadline task (in this case, "cppc_fie"), it was not migrated to CPU0, and its task_rq() information is stale. So its rq->rd points to def_root_domain instead of the one shared with CPU0. As a result, its bandwidth is wrongly accounted into a wrong root domain during domain rebuild. *** Issue *** The key point is that root_domain is only tracked through active rq->rd. To avoid using a global data structure to track all root_domains in the system, there should be a method to locate an active CPU within the corresponding root_domain. *** Solution *** To locate the active cpu, the following rules for deadline sub-system is useful -1.any cpu belongs to a unique root domain at a given time -2.DL bandwidth checker ensures that the root domain has active cpus. Now, let's examine the blocked-state task P. If P is attached to a cpuset that is a partition root, it is straightforward to find an active CPU. If P is attached to a cpuset that has changed from 'root' to 'member', the active CPUs are grouped into the parent root domain. Naturally, the CPUs' capacity and reserved DL bandwidth are taken into account in the ancestor root domain. (In practice, it may be unsafe to attach P to an arbitrary root domain, since that domain may lack sufficient DL bandwidth for P.) Again, it is straightforward to find an active CPU in the ancestor root domain. This patch groups CPUs into isolated and housekeeping sets. For the housekeeping group, it walks up the cpuset hierarchy to find active CPUs in P's root domain and retrieves the valid rd from cpu_rq(cpu)->rd. Signed-off-by: Pingfan Liu Cc: Waiman Long Cc: Chen Ridong Cc: Peter Zijlstra Cc: Juri Lelli Cc: Pierre Gondois Cc: Ingo Molnar Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Valentin Schneider To: linux-kernel@vger.kernel.org Signed-off-by: Tejun Heo commit 1f382215119a0bc165e766e5bc424b3d3e8dae35 Author: Pingfan Liu Date: Wed Nov 19 17:55:24 2025 +0800 cgroup/cpuset: Introduce cpuset_cpus_allowed_locked() cpuset_cpus_allowed() uses a reader lock that is sleepable under RT, which means it cannot be called inside raw_spin_lock_t context. Introduce a new cpuset_cpus_allowed_locked() helper that performs the same function as cpuset_cpus_allowed() except that the caller must have acquired the cpuset_mutex so that no further locking will be needed. Suggested-by: Waiman Long Signed-off-by: Pingfan Liu Cc: Waiman Long Cc: Tejun Heo Cc: Johannes Weiner Cc: Michal Koutný Cc: linux-kernel@vger.kernel.org To: cgroups@vger.kernel.org Reviewed-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 9d3daf9ca3239042c2cf473a76db2a77e6de22c6 Author: Dan Carpenter Date: Fri Oct 17 19:04:23 2025 +0300 phy: ti: gmii-sel: Add a sanity check on the phy_id The "phy_id" comes from the device tree so it's going to be correct. But static checkers sometimes complain when we have an upper bounds check with no lower bounds check. Also it's a bit unusual that the lowest valid number is 1 instead of 0 so adding a check could potentially help someone. Signed-off-by: Dan Carpenter Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/aPJpB-QI8FMpFGOk@stanley.mountain Signed-off-by: Vinod Koul commit 1797c6677ad6298ca463b6ee42245e19e9cc1206 Author: Prudhvi Yarlagadda Date: Mon Nov 3 23:56:26 2025 -0800 phy: qcom: qmp-pcie: Add support for Glymur PCIe Gen5x4 PHY Add support for Gen5 x4 PCIe QMP PHY found on Glymur platform. Signed-off-by: Prudhvi Yarlagadda Signed-off-by: Wenbin Yao Reviewed-by: Dmitry Baryshkov Acked-by: Manivannan Sadhasivam Signed-off-by: Qiang Yu Link: https://patch.msgid.link/20251103-glymur-pcie-upstream-v6-3-18a5e0a538dc@oss.qualcomm.com Signed-off-by: Vinod Koul commit bc2ba6e3fb8a35cd83813be1bd4c5f066a401d8b Author: Prudhvi Yarlagadda Date: Mon Nov 3 23:56:25 2025 -0800 phy: qcom-qmp: pcs: Add v8.50 register offsets The new Glymur SoC bumps up the HW version of QMP phy to v8.50 for PCIE g5x4. Add the new PCS offsets in a dedicated header file. Signed-off-by: Prudhvi Yarlagadda Signed-off-by: Wenbin Yao Reviewed-by: Dmitry Baryshkov Signed-off-by: Qiang Yu Link: https://patch.msgid.link/20251103-glymur-pcie-upstream-v6-2-18a5e0a538dc@oss.qualcomm.com Signed-off-by: Vinod Koul commit d877f881cec508a46f76dbed7c46ab78bc1c0d87 Author: Prudhvi Yarlagadda Date: Mon Nov 3 23:56:24 2025 -0800 dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Document the Glymur QMP PCIe PHY The fifth PCIe instance on Glymur has a Gen5 4-lane PHY. Document it as a separate compatible. Signed-off-by: Prudhvi Yarlagadda Signed-off-by: Wenbin Yao Acked-by: Rob Herring (Arm) Signed-off-by: Qiang Yu Link: https://patch.msgid.link/20251103-glymur-pcie-upstream-v6-1-18a5e0a538dc@oss.qualcomm.com Signed-off-by: Vinod Koul commit a7f0d69ecdd2fec89ce1f9b600a5c721c017fa9c Author: Krzysztof Kozlowski Date: Fri Oct 17 06:59:20 2025 +0200 dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Restrict resets per each device Bindings should be complete, thus complete the constraints for the resets by adding missing compatibles for devices with two resets and "else:" clause narrowing them for all other devices. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251017045919.34599-2-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 95e5905698983df94069e185f9eb3c67c7cf75d5 Author: Xiaolei Wang Date: Thu Sep 25 09:38:06 2025 +0800 phy: freescale: Initialize priv->lock Initialize priv->lock to fix the following warning. WARNING: CPU: 0 PID: 12 at kernel/locking/mutex.c:577 __mutex_lock+0x70c/0x8b8 Modules linked in: Hardware name: Freescale i.MX8QM MEK (DT) Call trace: __mutex_lock+0x70c/0x8b8 (P) mutex_lock_nested+0x24/0x30 imx_hsio_power_on+0x4c/0x764 phy_power_on+0x7c/0x12c imx_pcie_host_init+0x1d0/0x4d4 dw_pcie_host_init+0x188/0x4b0 imx_pcie_probe+0x324/0x6f4 platform_probe+0x5c/0x98 really_probe+0xbc/0x29c __driver_probe_device+0x78/0x12c driver_probe_device+0xd8/0x160 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x84/0xe4 __device_attach_async_helper+0xb8/0xdc async_run_entry_fn+0x34/0xe0 process_one_work+0x220/0x694 worker_thread+0x1c0/0x36c kthread+0x14c/0x224 Fixes: 82c56b6dd24f ("phy: freescale: imx8qm-hsio: Add i.MX8QM HSIO PHY driver support") Signed-off-by: Xiaolei Wang Reviewed-by: Frank Li Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20250925013806.569658-1-xiaolei.wang@windriver.com Signed-off-by: Vinod Koul commit ec5814578e3c36289c4992c466ae297e0b799c18 Author: Geert Uytterhoeven Date: Wed Sep 24 15:20:31 2025 +0200 phy: renesas: Remove unneeded semicolons Semicolons after end of function braces are not needed, remove them. Signed-off-by: Geert Uytterhoeven Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/a8807dafa87fcc3abcafd34a1895e4c722c39793.1758719985.git.geert+renesas@glider.be Signed-off-by: Vinod Koul commit 7044ed6749c8a7d49e67b2f07f42da2f29d26be6 Author: Ronak Raheja Date: Fri Sep 19 20:21:58 2025 -0700 phy: qcom: m31-eusb2: Update init sequence to set PHY_ENABLE Certain platforms may not have the PHY_ENABLE bit set on power on reset. Update the current sequence to explicitly write to enable the PHY_ENABLE bit. This ensures that regardless of the platform, the PHY is properly enabled. Signed-off-by: Ronak Raheja Signed-off-by: Wesley Cheng Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20250920032158.242725-1-wesley.cheng@oss.qualcomm.com Signed-off-by: Vinod Koul commit f842daf740114a8783be566219db34c6a0f1d02c Author: Neil Armstrong Date: Wed Nov 19 09:45:41 2025 +0100 phy: qcom: qmp-combo: get the USB3 & DisplayPort lanes mapping from DT The QMP USB3/DP Combo PHY hosts an USB3 phy and a DP PHY on top of a combo glue to route either lanes to the 4 shared physical lanes. The routing of the lanes can be: - 2 DP + 2 USB3 - 4 DP - 2 USB3 Get the lanes mapping from DT and stop registering the USB-C muxes in favor of a static mode and orientation detemined by the lanes mapping. This allows supporting boards with direct connection of USB3 and DisplayPort lanes to the QMP Combo PHY lanes, not using the USB-C Altmode feature. Reviewed-by: Dmitry Baryshkov Tested-by: Xilin Wu # qcs6490-radxa-dragon-q6a Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-topic-x1e80100-hdmi-v7-2-2bee0e66cc1b@linaro.org Signed-off-by: Vinod Koul commit 3faa2d0e794093df21c96550829d67d7d38e24bb Author: Neil Armstrong Date: Wed Nov 19 09:45:40 2025 +0100 dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: Document lanes mapping when not using in USB-C complex The QMP USB3/DP Combo PHY hosts an USB3 phy and a DP PHY on top of a combo glue to route either lanes to the 4 shared physical lanes. The routing of the lanes can be: - 2 DP + 2 USB3 - 4 DP - 2 USB3 The layout of the lanes was designed to be mapped and swapped related to the USB-C Power Delivery negociation, so it supports a finite set of mappings inherited by the USB-C Altmode layouts. Nevertheless those QMP Comby PHY can be used to drive a DisplayPort connector, DP->HDMI bridge, USB3 A Connector, etc... without an USB-C connector and no PD events. Document the data-lanes on numbered port@0 out endpoints, allowing us to document the lanes mapping to DisplayPort and/or USB3 connectors/peripherals. Reviewed-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-topic-x1e80100-hdmi-v7-1-2bee0e66cc1b@linaro.org Signed-off-by: Vinod Koul commit be866e68966d20bcc4a73708093d577176f99c0c Author: Shawn Lin Date: Tue Nov 18 17:52:06 2025 +0800 phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 When PCIe link enters L1 PM substates, the PHY will turn off its PLL for power-saving. However, it turns off the PLL too fast which leads the PHY to be broken. According to the PHY document, we need to delay PLL turnoff time. Fixes: f13bff25161b ("phy: rockchip-naneng-combo: Support rk3562") Signed-off-by: Shawn Lin Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/1763459526-35004-2-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Vinod Koul commit a2a18e5da64f8da306fa97c397b4c739ea776f37 Author: Shawn Lin Date: Tue Nov 18 17:52:05 2025 +0800 phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 When PCIe link enters L1 PM substates, the PHY will turn off its PLL for power-saving. However, it turns off the PLL too fast which leads the PHY to be broken. According to the PHY document, we need to delay PLL turnoff time. Fixes: bbcca4fac873 ("phy: rockchip: naneng-combphy: Add RK3528 support") Signed-off-by: Shawn Lin Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/1763459526-35004-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Vinod Koul commit 942a7a6bf4c6a8661324539f686a34c9448610bd Author: Claudiu Beznea Date: Wed Nov 19 14:04:18 2025 +0200 phy: renesas: rcar-gen3-usb2: Add suspend/resume support The Renesas RZ/G3S supports a power saving mode where power to most of the SoC components is turned off. The USB PHY is among these components. Because of this the settings applied in driver probe need to be executed also on resume path. On suspend path only reset signal need to be asserted. Add suspend/resume support. Signed-off-by: Claudiu Beznea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251119120418.686224-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 79d9db7f7a0c94b2b505666513879ac470c7e12f Author: Claudiu Beznea Date: Wed Nov 19 14:04:17 2025 +0200 phy: renesas: rcar-gen3-usb2: Move phy_data->init_bus check Move the check of phy_data->init_bus from rcar_gen3_phy_usb2_init_bus() to rcar_gen3_phy_usb2_probe() to avoid having it duplicated in both the probe path and the upcoming resume code. This is a preparatory patch. Signed-off-by: Claudiu Beznea Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251119120418.686224-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 662bb179d3381c7c069e44bb177396bcaee31cc8 Author: Christophe JAILLET Date: Thu Oct 23 16:58:05 2025 +0300 phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() If an error occurs after the reset_control_deassert(), reset_control_assert() must be called, as already done in the remove function. Use devm_add_action_or_reset() to add the missing call and simplify the .remove() function accordingly. While at it, drop struct rcar_gen3_chan::rstc as it is not used aymore. [claudiu.beznea: removed "struct reset_control *rstc = data;" from rcar_gen3_reset_assert(), dropped struct rcar_gen3_chan::rstc] Fixes: 4eae16375357 ("phy: renesas: rcar-gen3-usb2: Add support to initialize the bus") Signed-off-by: Christophe JAILLET Reviewed-by: Biju Das Reviewed-by: Geert Uytterhoeven Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251023135810.1688415-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit bc6f8b756c89d831c91a65ef9f3b5ceabdbae441 Author: Claudiu Beznea Date: Thu Oct 23 16:58:04 2025 +0300 dt-bindings: phy: renesas,usb2-phy: Mark resets as required for RZ/G3S The reset lines are mandatory for the Renesas RZ/G3S platform and must be explicitly defined in device tree. Fixes: f3c849855114 ("dt-bindings: phy: renesas,usb2-phy: Document RZ/G3S phy bindings") Reviewed-by: Geert Uytterhoeven Acked-by: Conor Dooley Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251023135810.1688415-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Vinod Koul commit 5e428e45bf17a8f3784099ca5ded16e3b5d59766 Author: André Draszik Date: Mon Oct 6 09:07:12 2025 +0100 phy: exynos5-usbdrd: fix clock prepare imbalance Commit f4fb9c4d7f94 ("phy: exynos5-usbdrd: allow DWC3 runtime suspend with UDC bound (E850+)") incorrectly added clk_bulk_disable() as the inverse of clk_bulk_prepare_enable() while it should have of course used clk_bulk_disable_unprepare(). This means incorrect reference counts to the CMU driver remain. Update the code accordingly. Fixes: f4fb9c4d7f94 ("phy: exynos5-usbdrd: allow DWC3 runtime suspend with UDC bound (E850+)") CC: stable@vger.kernel.org Signed-off-by: André Draszik Reviewed-by: Sam Protsenko Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20251006-gs101-usb-phy-clk-imbalance-v1-1-205b206126cf@linaro.org Signed-off-by: Vinod Koul commit fee6c075d28688b44adc9a4acad6977195ed6e22 Merge: d5089fffe1db04 3045e29d248bde Author: Mark Brown Date: Thu Nov 20 16:32:38 2025 +0000 firmware: cs_dsp: Cleanup debugfs for wmfw and bin Merge series from Richard Fitzgerald : These two patches improve the implementation of the debugfs files for the wmfw and bin file names. First patch removes duplicated code. Second patch replaces the old clunkiness of storing the filename with an appended \n. The \n can be appended when the file is read, to keep the stored string sane. commit 356d1924b9a6bc2164ce2bf1fad147b0c37ae085 Author: Johan Hovold Date: Fri Oct 17 07:45:37 2025 +0200 phy: broadcom: bcm63xx-usbh: fix section mismatches Platform drivers can be probed after their init sections have been discarded (e.g. on probe deferral or manual rebind through sysfs) so the probe function and match table must not live in init. Fixes: 783f6d3dcf35 ("phy: bcm63xx-usbh: Add BCM63xx USBH driver") Cc: stable@vger.kernel.org # 5.9 Cc: Álvaro Fernández Rojas Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251017054537.6884-1-johan@kernel.org Signed-off-by: Vinod Koul commit 785a9d5bb145109558063080ebc9a3e8be86471d Author: Chaoyi Chen Date: Thu Nov 6 10:06:29 2025 +0800 phy: rockchip: inno-dsidphy: Add support for rk3506 For MIPI mode, the inno-dsidphy found on RK3506 supports up to 2 lanes and a maximum data rate of 1.5GHz. Signed-off-by: Hongming Zou Signed-off-by: Chaoyi Chen Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251106020632.92-7-kernel@airkyi.com Signed-off-by: Vinod Koul commit 323c5c05a0a07b931ede1fa0a3396a1a165ed798 Author: Chaoyi Chen Date: Thu Nov 6 10:06:25 2025 +0800 dt-bindings: phy: rockchip-inno-dsidphy: Add compatible for rk3506 Document a compatible string for the rk3506 dsi-dphy. Signed-off-by: Chaoyi Chen Acked-by: Conor Dooley Link: https://patch.msgid.link/20251106020632.92-3-kernel@airkyi.com Signed-off-by: Vinod Koul commit 12d821bd13d42e6de3ecb1c13918b1f06a3ee213 Author: Andreas Kemnade Date: Sat Nov 15 07:50:51 2025 +0100 regulator: Add FP9931/JD9930 driver Add a driver for the FP9931/JD9930 regulator. Implement handling of the PG (power good), TS_EN (temperature sensor enable), and EN (enable regulators) pins. Implement the pair of symmetric LDOs as a single regulator because they share a single voltage set register. For simplicity, just add the temperature sensor (depending on external NTC) directly. Limitations: - As these regulators are controlled together with the VCOM regulator via the EN pin, some kind of management must be in place. As the enable op is not called when the regulator is already enabled, simple refcounting seems not to work to avoid clearing EN when one regulator is still enabled. As these regulators are typically used together, this limitation should not hurt hard, just provide the is_enabled op. - As the VCOM step is quite odd (5V/255 steps), rounding is needed. Due to some limitations in the regulator core, the max/min voltages in the devicetree must match the idea of the driver how to round things exactly. - Night mode is not implemented, so only the FP9931 compatible is needed in the driver, there is no REGULATOR_MODE_NIGHT and no clear definition in the datasheet what it does, also the XON pin which seems to be an input related to that night mode is not used. Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20251115-fp9931-submit-v3-3-92f5d0772b68@kemnade.info Signed-off-by: Mark Brown commit 80bbdefdfb4174ff7e5d4f17658c845ef8f0b623 Author: Andreas Kemnade Date: Sat Nov 15 07:50:50 2025 +0100 dt-bindings: regulator: Add Fitipower FP9931/JD9930 Document the FP9931/JD9930. As the FP9931 is a clear subset of the JD9930, define it as a fallback compatible. GPIO names are same as in the datasheet except for the EN pad which is described as "enable". Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20251115-fp9931-submit-v3-2-92f5d0772b68@kemnade.info Signed-off-by: Mark Brown commit 0d360d54ea6d0fb3928205d6c67801d1719dd958 Author: Andreas Kemnade Date: Sat Nov 15 07:50:49 2025 +0100 dt-bindings: vendor-prefixes: Add Fitipower Add Fitipower Integrated Technology Inc. to the vendor prefixes. Acked-by: Krzysztof Kozlowski Signed-off-by: Andreas Kemnade Link: https://patch.msgid.link/20251115-fp9931-submit-v3-1-92f5d0772b68@kemnade.info Signed-off-by: Mark Brown commit 2bae7beda19f3b2dc6ab2062c94df19c27923712 Author: Biju Das Date: Fri Nov 14 07:37:06 2025 +0000 ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width The strm->sample_width is not filled during rz_ssi_dai_hw_params(). This wrong value is used for caching sample_width in struct hw_params_cache. Fix this issue by replacing 'strm->sample_width'->'params_width(params)' in rz_ssi_dai_hw_params(). After this drop the variable sample_width from struct rz_ssi_stream as it is unused. Cc: stable@kernel.org Fixes: 4f8cd05a4305 ("ASoC: sh: rz-ssi: Add full duplex support") Reviewed-by: Kuninori Morimoto Signed-off-by: Biju Das Link: https://patch.msgid.link/20251114073709.4376-3-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 52a525011cb8e293799a085436f026f2958403f9 Author: Biju Das Date: Fri Nov 14 07:37:05 2025 +0000 ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode The full duplex audio starts with half duplex mode and then switch to full duplex mode (another FIFO reset) when both playback/capture streams available leading to random audio left/right channel swap issue. Fix this channel swap issue by detecting the full duplex condition by populating struct dup variable in startup() callback and synchronize starting both the play and capture at the same time in rz_ssi_start(). Cc: stable@kernel.org Fixes: 4f8cd05a4305 ("ASoC: sh: rz-ssi: Add full duplex support") Co-developed-by: Tony Tang Signed-off-by: Tony Tang Reviewed-by: Kuninori Morimoto Signed-off-by: Biju Das Link: https://patch.msgid.link/20251114073709.4376-2-biju.das.jz@bp.renesas.com Signed-off-by: Mark Brown commit 80ac0fba0f1a72be2c7b532b8e2ad61300a165c3 Author: Sjoerd Simons Date: Sat Nov 15 21:58:06 2025 +0100 dt-bindings: phy: mediatek,tphy: Add support for MT7981 Add a compatible string for Filogic 820, this chip integrates a MediaTek generic T-PHY version 2 Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Sjoerd Simons Link: https://patch.msgid.link/20251115-openwrt-one-network-v4-3-48cbda2969ac@collabora.com Signed-off-by: Vinod Koul commit 33822d795ab93067d9a65f42003c0d01c65d4a9d Author: Richard Fitzgerald Date: Thu Nov 20 13:44:37 2025 +0000 ASoC: cs35l56: Use SND_SOC_BYTES_E_ACC() for CAL_DATA_RB control Use the new SND_SOC_BYTES_E_ACC() macro instead of SND_SOC_BYTES_E() to define the CAL_DATA_RB control, so that it is marked as read-only and volatile. This avoids userland code expecting to be able to write to it and then getting an unexpected EPERM error, or assuming that its value can never change. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251120134437.1179191-5-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 4dd7f8aeed4c85234f3855ef3188ed2202f2c947 Author: Richard Fitzgerald Date: Thu Nov 20 13:44:36 2025 +0000 ASoC: cs35l56: Use SOC_ENUM_EXT_ACC() for CAL_SET_STATUS control Use the new SOC_ENUM_EXT_ACC() macro instead of SOC_ENUM_EXT() to define the CAL_SET_STATUS control, so that it is marked as read-only and volatile. This avoids userland code expecting to be able to write to it and then getting an unexpected EPERM error, or assuming that its value can never change. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251120134437.1179191-4-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d7a82707f19c7a11ce42dd46cb22ca34a58cc9b0 Author: Richard Fitzgerald Date: Thu Nov 20 13:44:35 2025 +0000 ASoC: soc.h: Add SND_SOC_BYTES_E_ACC() to allow setting access flags Add a macro SND_SOC_BYTES_E_ACC() to allow the access permission flags to be set. This is the same as SND_SOC_BYTES_E() but with an extra argument for the access flags. This will be used by the cs35l56.c driver to create a read-only volatile byte control. It's preferable to avoid custom control macros in codec drivers. Code maintenance is easier if all control macros are defined together in soc.h. This commit only creates this one macro that is actually going to be used. There's no point cluttering soc.h with unused macros - that just adds a maintenance burden. People can add equivalents for the other macros if they need them. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251120134437.1179191-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit cf6ec18ea6e12569b83af2709d0bd0cc09da198f Author: Richard Fitzgerald Date: Thu Nov 20 13:44:34 2025 +0000 ASoC: soc.h: Add SOC_ENUM_EXT_ACC() to allow setting access flags Add a macro SOC_ENUM_EXT_ACC() to allow the access permission flags to be set. This is the same as SOC_ENUM_EXT() but with an extra argument for the access flags. This will be used by the cs35l56.c driver to create a read-only volatile enum. It's preferable to avoid custom control macros in codec drivers. Code maintenance is easier if all control macros are defined together in soc.h. This commit only creates this one macro that is actually going to be used. There's no point cluttering soc.h with unused macros - that just adds a maintenance burden. People can add equivalents for the other macros if they need them. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251120134437.1179191-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 5fc4e4cf7a2268b5f73700fd1e8d02159f2417d8 Author: Bartosz Golaszewski Date: Thu Nov 20 14:24:04 2025 +0100 reset: gpio: use software nodes to setup the GPIO lookup GPIO machine lookup is a nice mechanism for associating GPIOs with consumers if we don't know what kind of device the GPIO provider is or when it will become available. However in the case of the reset-gpio, we are already holding a reference to the device and so can reference its firmware node. Let's setup a software node that references the relevant GPIO and attach it to the auxiliary device we're creating. Reviewed-by: Philipp Zabel Acked-by: Linus Walleij Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 109ce747ac22d22a88e5ebd76d606d60a834646c Author: Bartosz Golaszewski Date: Thu Nov 20 14:24:03 2025 +0100 reset: gpio: convert the driver to using the auxiliary bus As the reset-gpio devices are purely virtual and never instantiated from real firmware nodes, let's convert the driver to using the - more fitting - auxiliary bus. Reviewed-by: Philipp Zabel Acked-by: Linus Walleij Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 46dae84a90f9845df661adb116560e33d47a82ee Author: Bartosz Golaszewski Date: Thu Nov 20 14:24:02 2025 +0100 reset: make the provider of reset-gpios the parent of the reset device Auxiliary devices really do need a parent so ahead of converting the reset-gpios driver to registering on the auxiliary bus, make the GPIO device that provides the reset GPIO the parent of the reset-gpio device. To that end move the lookup of the GPIO device by fwnode to the beginning of __reset_add_reset_gpio_device() which has the added benefit of bailing out earlier, before allocating resources for the virtual device, if the chip is not up yet. Reviewed-by: Philipp Zabel Acked-by: Linus Walleij Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 97d85328e3dcb2b3acb249a7c82d96c18b6b0d5b Author: Bartosz Golaszewski Date: Thu Nov 20 14:24:01 2025 +0100 reset: order includes alphabetically in reset/core.c For better readability and easier maintenance order the includes alphabetically. Reviewed-by: Philipp Zabel Acked-by: Linus Walleij Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit 216c1204757190666b0f6bd3e32590a1008a4343 Author: Bartosz Golaszewski Date: Thu Nov 20 14:24:00 2025 +0100 gpio: swnode: allow referencing GPIO chips by firmware nodes When doing a software node lookup, we require both the fwnode that references a GPIO chip as well as the node associated with that chip to be software nodes. However, we now allow referencing generic firmware nodes from software nodes in driver core so we should allow the same in GPIO core. Make the software node name check optional and dependent on whether the referenced firmware node is a software node. If it's not, just continue with the lookup. Acked-by: Linus Walleij Reviewed-by: Andy Shevchenko Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Signed-off-by: Philipp Zabel commit d2a6cea44acc920fb18d7f29abfa0728b14d10c0 Author: Charles Keepax Date: Thu Nov 20 14:23:59 2025 +0100 spi: cs42l43: Use actual ACPI firmware node for chip selects On some systems the cs42l43 has amplifiers attached to its SPI controller that are not properly defined in ACPI. Currently software nodes are added to support this case, however, the chip selects for these devices are specified using a hack. A software node is added with the same name as the pinctrl driver, as the look up was name based, this allowed the GPIO look up to return the pinctrl driver even though the swnode was not owned by it. This was necessary as the swnodes did not support directly linking to real firmware nodes. Since commit e5d527be7e69 ("gpio: swnode: don't use the swnode's name as the key for GPIO lookup") changed the lookup to be fwnode based this hack will no longer find the pinctrl driver, resulting in the driver not probing. There is no pinctrl driver attached to the swnode itself. But other patches did add support for linking a swnode to a real fwnode node [1]. As such the hack is no longer needed, so switch over to just passing the real fwnode for the pinctrl property to avoid any issues. [Bartosz: - remove unneeded Fixes: tag, - use PROPERTY_ENTRY_REF_ARRAY() instead of PROPERTY_ENTRY_REF_ARRAY_LEN()] Link: https://lore.kernel.org/linux-gpio/20251106-reset-gpios-swnodes-v6-0-69aa852de9e4@linaro.org/ [1] Fixes: 439fbc97502a ("spi: cs42l43: Add bridged cs35l56 amplifiers") Cc: stable+noautosel@kernel.org # Don't backport, previous approach works, fix relies on swnode changes Signed-off-by: Charles Keepax Reviewed-by: Bartosz Golaszewski Signed-off-by: Bartosz Golaszewski Acked-by: Mark Brown Reviewed-by: Andy Shevchenko Signed-off-by: Philipp Zabel commit d7cdbbc93c564902169e854e78716a7b5e6cb241 Author: Bartosz Golaszewski Date: Thu Nov 20 14:23:58 2025 +0100 software node: allow referencing firmware nodes At the moment software nodes can only reference other software nodes. This is a limitation for devices created, for instance, on the auxiliary bus with a dynamic software node attached which cannot reference devices the firmware node of which is "real" (as an OF node or otherwise). Make it possible for a software node to reference all firmware nodes in addition to static software nodes. To that end: add a second pointer to struct software_node_ref_args of type struct fwnode_handle. The core swnode code will first check the swnode pointer and if it's NULL, it will assume the fwnode pointer should be set. Software node graphs remain the same, as in: the remote endpoints still have to be software nodes. Acked-by: Linus Walleij Reviewed-by: Sakari Ailus Reviewed-by: Andy Shevchenko Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Reviewed-by: Charles Keepax Tested-by: Charles Keepax Signed-off-by: Philipp Zabel commit 0651933c117e778e6f71183a52a57f4216c56efb Author: Bartosz Golaszewski Date: Thu Nov 20 14:23:57 2025 +0100 software node: increase the reference of the swnode by its fwnode Once we allow software nodes to reference other kinds of firmware nodes, the node in args will no longer necessarily be a software node so bump its reference count using its fwnode interface. Acked-by: Linus Walleij Reviewed-by: Sakari Ailus Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Charles Keepax Tested-by: Charles Keepax Signed-off-by: Philipp Zabel commit f11a8e996d5e27a85e8d7a05484db2942c267615 Author: Bartosz Golaszewski Date: Thu Nov 20 14:23:56 2025 +0100 software node: read the reference args via the fwnode API Once we allow software nodes to reference all kinds of firmware nodes, the refnode here will no longer necessarily be a software node so read its proprties going through its fwnode implementation. Acked-by: Linus Walleij Reviewed-by: Sakari Ailus Acked-by: Greg Kroah-Hartman Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Tested-by: Charles Keepax Reviewed-by: Charles Keepax Signed-off-by: Philipp Zabel commit 3b86c87f8dcbb8ba3b00d7adf7ccfff086f0f23e Author: Benjamin Tissoires Date: Tue Nov 18 18:16:31 2025 +0100 HID: bpf: fix typo in HID usage table We could go to the USB consortium, but it's probably easier that way. And update HID usage table json generated file from https://usb.org/sites/default/files/hut1_6.pdf updated: 01/30/2025 Reported-by: Colin Ian King Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/191 Signed-off-by: Benjamin Tissoires Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 71570e8fb760027842c0e748c669d5bf87dfba65 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:30 2025 +0100 HID: bpf: add the Huion Kamvas 27 Pro Same issues with a secondary tip switch instead of secondary barrel switch as the Kamvas 19. Copy the stable Kamvas 19 support back into testing and add the vid/pid for the Kamvas 27. Signed-off-by: Peter Hutterer Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/189 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 5e3e8f1b44e420800f62c993878bf6ad43adb038 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:29 2025 +0100 HID: bpf: add heuristics to the Huion Inspiroy 2S eraser button When pressing the phsyical eraser button (remapped by us to the Secondary Barrel Switch) while the tip is down, the device gives us several false reports with a Tip Switch 0: press| |release SBS: [0 0 ... 1 1 1 ... 1 0 0 0 0 0 0 ...] TS: [1 1 ... 1 0 1 ... 1 1 0 0 0 1 1 ...] In both press/release the number of Tip Switch 0 reports can be up to 4 and *sometimes* the Tip Switch is released in the same report as the button press/release event. Paper over this by forcing the tip down for a few reports if it was down before the button toggled. Signed-off-by: Peter Hutterer Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/195 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 88b5468f2cc564d532999c2fa068e158f5123691 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:28 2025 +0100 HID: bpf: Add support for XP-Pen Deco02 Modifies report to have tablet buttons report as buttons, rather than as keyboard key combinations. The dial is also converted to a relative input, using the dedicated bit previously reserved for modifier key information. Signed-off-by: Hannah Pittman Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/203 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 8ba327d50263a026a41cc891fc8c09689c4b95e2 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:27 2025 +0100 HID: bpf: Add support for the XP-Pen Deco 01 V3 This device needs a fix for the tilt range on the pen report descriptor and the usual conversion of the pad keys from the firmware's hardcoded keyboard shortcuts to actual pad buttons. Signed-off-by: Peter Hutterer Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/185 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 040adbe80135af3de7d924ea39db4bfabf57b66f Author: Benjamin Tissoires Date: Tue Nov 18 18:16:26 2025 +0100 HID: bpf: Add support for the Waltop Batteryless Tablet Several bugs as outlined in udev-hid-bpf#66 and udev-hid-bpf!198: - pressure curve is far from linear - tilt range is ±60, not ±127 - pressing the second button sets both tip down and barrel switch Fix the second button by adding a Secondary Barrel Switch in the existing padding and check for the tip down/barrel switch down combo. When both values become true at the same time, set the Secondary Barrel Switch instead. Implement a custom pressure curve that maps the hardware range 0-102 linearly to the logical range 0-1224, and maps the hardware range 103-2047 logarithmically to the logical range 1232-2047. This mapping isn’t perfect, but it’s way more natural than the stock configuration. Signed-off-by: Peter Hutterer Signed-off-by: Jan Felix Langenbach Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/200 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 029dff1c31c488e85c666d5e7e992700cd57462b Author: Benjamin Tissoires Date: Tue Nov 18 18:16:25 2025 +0100 HID: bpf: Add fixup for Logitech SpaceNavigator variants The 3Dconnexion SpaceNavigator HID report descriptor declares its axis data to be "relative" when it is actually "absolute". This quirk was addressed in the kernel in 2.6.33, but some SpaceNavigator variants have a slightly different report descriptor whose axis input items are at different offsets than those assumed by the kernel fixup. Add a BPF fixup to handle both sets of offsets for known SpaceNavigator variants if the descriptor has not already been fixed by the kernel. Signed-off-by: Curran Muhlberger Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/181 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 0412be1b8125204a15930128c2a1ed73b0f59f84 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:24 2025 +0100 HID: bpf: support for Huion Kamvas 16 Gen 3 Another Huion Kamvas tablet support. Again it's safer to duplicate the code source in a separate file to ensure we are not breaking any existing device. Signed-off-by: Higgins Dragon Signed-off-by: Benjamin Tissoires Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/207 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 5f2e058df65cac37aeeeb74fef650edd51fe1882 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:23 2025 +0100 HID: bpf: add support for Huion Kamvas 13 (Gen 3) (model GS1333) This assumes that the tablet has been switched into vendor mode (by using huion-switcher[1], for example) and is sending events using Huion's proprietary data format. This has been tested using the PW600L pen, which does not have an eraser. There is no expectation that a pen with an eraser will work at this time. [1] https://github.com/whot/huion-switcher Signed-off-by: Nicholas LaPointe Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/162 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 501ea61e2933ee61933ff2f8dd2844e154dd2746 Author: Benjamin Tissoires Date: Tue Nov 18 18:16:22 2025 +0100 HID: bpf: Add support for the Inspiroy 2M There are a differences in the report descriptor to the existing Inspiroy 2S which makes having this as separate file a more efficient approach than merging them together. Signed-off-by: Peter Hutterer Signed-off-by: Benjamin Tissoires Link: https://gitlab.freedesktop.org/libevdev/udev-hid-bpf/-/merge_requests/167 Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit f5ef3f722d76eb8fdd11be3f1f1f1cc4fefbf45b Author: Johan Hovold Date: Fri Nov 14 16:06:28 2025 +0100 dt-bindings: gnss: fix timepulse description The timepulse pin is an output that can be used to generate a pulse at a (configurable) frequency (i.e. it is not an input). Fixes: dba529605f55 ("dt-bindings: gnss: Rewrite common bindings in YAML") Acked-by: Conor Dooley Signed-off-by: Johan Hovold commit 4af167d8037d91f39e59475d02de03b45254493d Author: Johan Hovold Date: Fri Nov 14 16:05:29 2025 +0100 dt-bindings: gnss: u-blox: use lowercase company name The u-blox company name is written in lowercase so restore the style that was used before the binding was converted to YAML. Acked-by: Conor Dooley Signed-off-by: Johan Hovold commit 094f33935009832fc4e40cc7396049703f2dd05b Author: Johan Hovold Date: Fri Nov 14 16:54:13 2025 +0100 dt-bindings: gnss: u-blox: use open-drain reset and safeboot in example The RESET_N and SAFEBOOT_N pins should typically be left open and only be connected to ground in rare cases where a device is misbehaving. Specify GPIO_OPEN_DRAIN in the example as this is what should generally be used. Acked-by: Conor Dooley Signed-off-by: Johan Hovold commit 955cd0545b6abcefd297832e38f90f6851fc2ada Author: Alejandro Enrique Date: Wed May 14 15:54:42 2025 +0200 gnss: ubx: add support for the safeboot gpio U-Blox M8/M9 chip have a pin to start it in safeboot mode, to be used to recover from situations where the flash content has become corrupted and needs to be restored. If this pin is asserted at power up/reset, the receiver starts in safeboot mode and GNSS operation is disabled. Deassert the safeboot pin when probing this driver. Signed-off-by: Alejandro Enrique Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250911-ubx-safeboot-v3-2-32fe6b882a3c@geotab.com [ johan: deassert after requesting supplies ] Signed-off-by: Johan Hovold commit a95419ff9f21d246835a8c6ba6f89c8916f7f0d6 Author: Sjoerd Simons Date: Sat Nov 15 21:58:04 2025 +0100 dt-bindings: mfd: syscon: Add mt7981-topmisc This hardware block amongst other things includes a multiplexer for a high-speed Combo-Phy. This binding allows exposing the multiplexer Signed-off-by: Sjoerd Simons Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251115-openwrt-one-network-v4-1-48cbda2969ac@collabora.com Signed-off-by: Lee Jones commit 8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554 Author: Vikas Gupta Date: Mon Nov 17 17:11:19 2025 +0000 bng_en: Add RoCE aux device support Add an auxiliary (aux) device to support RoCE. The base driver is responsible for creating the auxiliary device and allocating the required resources to it, which will be owned by the bnge RoCE driver in future patches. Signed-off-by: Vikas Gupta Link: https://patch.msgid.link/20251117171136.128193-2-siva.kallam@broadcom.com Reviewed-by: Siva Reddy Kallam Acked-by: Jakub Kicinski Signed-off-by: Leon Romanovsky commit d834e68a0e8b4a3c673eb96d4d53e48f3c19a81e Author: Rafael J. Wysocki Date: Sun Nov 16 13:35:14 2025 +0100 cpuidle: governors: teo: Simplify intercepts-based state lookup Simplify the loop looking up a candidate idle state in the case when an intercept is likely to occur by adding a search for the state index limit if the tick is stopped before it. First, call tick_nohz_tick_stopped() just once and if it returns true, look for the shallowest state index below the current candidate one with target residency at least equal to the tick period length. Next, simply look for a state that is not shallower than the one found in the previous step and satisfies the intercepts majority condition (if there are no such states, the shallowest state that is not shallower than the one found in the previous step becomes the new candidate). Since teo_state_ok() has no callers any more after the above changes, drop it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle [ rjw: Changelog clarification and code comment edit ] Link: https://patch.msgid.link/2418792.ElGaqSPkdT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit fecaa0c74f66643d5bd55422b426aefeaaaa25f2 Author: Kalesh AP Date: Mon Nov 17 11:43:06 2025 +0530 RDMA/bnxt_re: Fix wrong check for CQ coalesc support Driver is not creating the debugfs hooks for CQ coalesc parameters because of a wrong check. Fixed the condition check inside bnxt_re_init_cq_coal_debugfs(). Fixes: cf2749079011 ("RDMA/bnxt_re: Add a debugfs entry for CQE coalescing tuning") Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20251117061306.1140588-1-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit c09816f2afce0f89f176c4bc58dc57ec9f204998 Author: Yue Haibing Date: Thu Nov 20 20:09:30 2025 +0800 KVM: x86: Remove unused declaration kvm_mmu_may_ignore_guest_pat() Commit 3fee4837ef40 ("KVM: x86: remove shadow_memtype_mask") removed the functions but leave this declaration. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20251120120930.1448593-1-yuehaibing@huawei.com Signed-off-by: Sean Christopherson commit 82f78acd5a9270370ef4aa3f032ede25f3dc91ee Merge: 38725491e76656 b06b8c421485e0 Author: Martin K. Petersen Date: Thu Nov 20 10:26:13 2025 -0500 Merge patch series "Add OP-TEE based RPMB driver for UFS devices" Bean Huo says: This patch series introduces OP-TEE based RPMB (Replay Protected Memory Block) support for UFS devices, extending the kernel-level secure storage capabilities that are currently available for eMMC devices. Previously, OP-TEE required a userspace supplicant to access RPMB partitions, which created complex dependencies and reliability issues, especially during early boot scenarios. Recent work by Linaro has moved core supplicant functionality directly into the Linux kernel for eMMC devices, eliminating userspace dependencies and enabling immediate secure storage access. This series extends the same approach to UFS devices, which are used in enterprise and mobile applications that require secure storage capabilities. Benefits: - Eliminates dependency on userspace supplicant for UFS RPMB access - Enables early boot secure storage access (e.g., fTPM, secure UEFI variables) - Provides kernel-level RPMB access as soon as UFS driver is initialized - Removes complex initramfs dependencies and boot ordering requirements - Ensures reliable and deterministic secure storage operations - Supports both built-in and modular fTPM configurations. Prerequisites: -------------- This patch series depends on commit 7e8242405b94 ("rpmb: move struct rpmb_frame to common header") which has been merged into mainline v6.18-rc2. Link: https://patch.msgid.link/20251107230518.4060231-1-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen commit ebec25438f3dbc79ea1ff274b1fe97d277b1545f Author: Paolo Bonzini Date: Thu Nov 13 19:36:33 2025 -0500 KVM: x86: Enable support for emulating AVX MOV instructions Some users of KVM have emulated devices (typically added to private forks of QEMU) that execute AVX instructions on PCI BARs. Whenever the guest OS tries to do that, an illegal instruction exception or emulation failure is triggered. Add the Avx flag to move instructions: - (66) 0f 10 - MOVUPS/MOVUPD from memory - (66) 0f 11 - MOVUPS/MOVUPD to memory - 66 0f 6f - MOVDQA from memory - 66 0f 7f - MOVDQA to memory - f3 0f 6f - MOVDQU from memory - f3 0f 7f - MOVDQU to memory - (66) 0f 28 - MOVAPS/MOVAPD from memory - (66) 0f 29 - MOVAPS/MOVAPD to memory - (66) 0f 2b - MOVNTPS/MOVNTPD to memory - 66 0f e7 - MOVNTDQ to memory - 66 0f 38 2a - MOVNTDQA to memory Co-developed-by: Keith Busch Signed-off-by: Keith Busch Link: https://lore.kernel.org/kvm/BD108C42-0382-4B17-B601-434A4BD038E7@fb.com/T/ Signed-off-by: Paolo Bonzini Link: https://patch.msgid.link/20251114003633.60689-11-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 072cd5f458d76b9e15d89ebdaea8b5cb1312eeef Author: Fenglin Wu Date: Wed Nov 19 14:06:43 2025 +0800 leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM The PWM signal from the LPG channel can be routed to PMIC GPIOs with proper GPIO configuration, and it is not necessary to enable the TRILED channel in that case. This also applies to the LPG channels that mapped to TRILED channels. Additionally, enabling the TRILED channel unnecessarily would cause a voltage increase in its power supply. Hence remove it. Fixes: 24e2d05d1b68 ("leds: Add driver for Qualcomm LPG") Signed-off-by: Fenglin Wu Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251119-lpg_triled_fix-v3-2-84b6dbdc774a@oss.qualcomm.com Signed-off-by: Lee Jones commit 5d390e7a02e850a995ee25248292d4be61314078 Author: Fenglin Wu Date: Wed Nov 19 14:06:42 2025 +0800 dt-bindings: leds: qcom-lpg: Explain standalone PWM usage LPG channels can be used for only outputting PWM signals by routing to PMIC GPIOs without enabling TRILED. Explain this usage in the description for better clarity. Signed-off-by: Fenglin Wu Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251119-lpg_triled_fix-v3-1-84b6dbdc774a@oss.qualcomm.com Signed-off-by: Lee Jones commit d1cadd4bfc2802c6f73b1739dbceef7513afc591 Author: David Laight Date: Wed Nov 19 22:41:28 2025 +0000 nodemask: use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Yury Norov (NVIDIA) commit 1759a0392f345689e155196c42f1db28a222618d Author: Rob Herring (Arm) Date: Tue Nov 18 15:35:40 2025 -0600 dt-bindings: mfd: fsl,mc13xxx: Fix LEDs node schema The 'leds' node is missing constraints on additional properties. It is mixing 'leds' node and child node properties as well as missing some properties. Add the 'led@' child nodes and the missing properties. Fixes: 1160f9f88be2 ("dt-bindings: mfd: fsl,mc13xxx: Convert txt to DT schema") Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251118213541.43812-1-robh@kernel.org Signed-off-by: Lee Jones commit 9420e720ad192c53c8d2803c5a2313b2d586adbd Author: David Laight Date: Wed Nov 19 22:41:08 2025 +0000 block: use min() instead of min_t() min_t(unsigned int, a, b) casts an 'unsigned long' to 'unsigned int'. Use min(a, b) instead as it promotes any 'unsigned int' to 'unsigned long' and so cannot discard significant bits. In this case the 'unsigned long' value is small enough that the result is ok. (Similarly for max_t() and clamp_t().) Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Jens Axboe commit 0888a0d76dc20207ed0e7e22aa0f6ad97db90ca5 Merge: 7828a4d3f6dbd8 6c10f1a1c08acd Author: Paolo Abeni Date: Thu Nov 20 15:43:05 2025 +0100 Merge branch 'ynl-cli-list-attrs-argument' Gal Pressman says: ==================== YNL CLI --list-attrs argument While experimenting with the YNL CLI, I found the process of going back and forth to examine the YAML spec files in order to figure out how to use each command quite tiring. The addition of --list-attrs helps by providing all information needed directly in the tool. I figured others would likely find it useful as well. v1: https://lore.kernel.org/all/20251116192845.1693119-1-gal@nvidia.com/ ==================== Link: https://patch.msgid.link/20251118143208.2380814-1-gal@nvidia.com Signed-off-by: Paolo Abeni commit 6c10f1a1c08acd948e4aa7064656ccc24ddabfe3 Author: Gal Pressman Date: Tue Nov 18 16:32:08 2025 +0200 tools: ynl: cli: Display enum values in --list-attrs output When listing attributes with --list-attrs, display the actual enum values for attributes that reference an enum type. # ./cli.py --family netdev --list-attrs dev-get [..] - xdp-features: u64 (enum: xdp-act) Flags: basic, redirect, ndo-xmit, xsk-zerocopy, hw-offload, rx-sg, ndo-xmit-sg Bitmask of enabled xdp-features. [..] Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20251118143208.2380814-4-gal@nvidia.com Signed-off-by: Paolo Abeni commit bc1bc1b357cdae75d17ecde0aabe1b95ce08c7a5 Author: Gal Pressman Date: Tue Nov 18 16:32:07 2025 +0200 tools: ynl: cli: Parse nested attributes in --list-attrs output Enhance the --list-attrs option to recursively display nested attributes instead of just showing "nest" as the type. Nested attributes now show their attribute set name and expand to display their contents. # ./cli.py --family ethtool --list-attrs rss-get [..] Do request attributes: - header: nest -> header - dev-index: u32 - dev-name: string - flags: u32 (enum: header-flags) - phy-index: u32 - context: u32 [..] Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20251118143208.2380814-3-gal@nvidia.com Signed-off-by: Paolo Abeni commit 2a2d5a3392b63ef5141c158117dba4f3b9b3ac22 Author: Gal Pressman Date: Tue Nov 18 16:32:06 2025 +0200 tools: ynl: cli: Add --list-attrs option to show operation attributes Add a --list-attrs option to the YNL CLI that displays information about netlink operations, including request and reply attributes. This eliminates the need to manually inspect YAML spec files to determine the JSON structure required for operations, or understand the structure of the reply. Example usage: # ./cli.py --family netdev --list-attrs dev-get Operation: dev-get Get / dump information about a netdev. Do request attributes: - ifindex: u32 netdev ifindex Do reply attributes: - ifindex: u32 netdev ifindex - xdp-features: u64 (enum: xdp-act) Bitmask of enabled xdp-features. - xdp-zc-max-segs: u32 max fragment count supported by ZC driver - xdp-rx-metadata-features: u64 (enum: xdp-rx-metadata) Bitmask of supported XDP receive metadata features. See Documentation/networking/xdp-rx-metadata.rst for more details. - xsk-features: u64 (enum: xsk-flags) Bitmask of enabled AF_XDP features. Dump reply attributes: - ifindex: u32 netdev ifindex - xdp-features: u64 (enum: xdp-act) Bitmask of enabled xdp-features. - xdp-zc-max-segs: u32 max fragment count supported by ZC driver - xdp-rx-metadata-features: u64 (enum: xdp-rx-metadata) Bitmask of supported XDP receive metadata features. See Documentation/networking/xdp-rx-metadata.rst for more details. - xsk-features: u64 (enum: xsk-flags) Bitmask of enabled AF_XDP features. Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20251118143208.2380814-2-gal@nvidia.com Signed-off-by: Paolo Abeni commit e8f0abdd49baacee3886d5827f113514fcd9fd05 Author: Chaitanya Kulkarni Date: Wed Nov 19 15:22:34 2025 -0800 zloop: clear nowait flag in workqueue context The zloop driver advertises REQ_NOWAIT support through BLK_FEAT_NOWAIT (enabled by default for all blk-mq devices), and honors the nowait behavior throughout zloop_queue_rq(). However, actual I/O to the backing file is performed in a workqueue, where blocking is allowed. To avoid imposing unnecessary non-blocking constraints in this blocking context, clear the REQ_NOWAIT flag before processing the request in the workqueue context. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit b11e483a1cc32e7b557ff680e9bfb4ff11dea9c1 Author: Chaitanya Kulkarni Date: Wed Nov 19 15:22:33 2025 -0800 loop: clear nowait flag in workqueue context The loop driver advertises REQ_NOWAIT support through BLK_FEAT_NOWAIT (enabled by default for all blk-mq devices), and honors the nowait behavior throughout loop_queue_rq(). However, actual I/O to the backing file is performed in a workqueue, where blocking is allowed. To avoid imposing unnecessary non-blocking constraints in this blocking context, clear the REQ_NOWAIT flag before processing the request in the workqueue context. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 4ba96cd38f22b24d72eb3f7c76a0e1cd0af1039d Author: Michael Walle Date: Thu Nov 20 09:01:22 2025 +0100 arm64: dts: ti: sa67: add build time dtb for overlays Since commit d8c8a575f5aa ("kbuild: Ensure .dtbo targets are applied to a base .dtb") kbuild will throw a warning for any stray overlays. Add a new .dtb which will only be build if CONFIG_OF_ALL_DTBS is enabled. Signed-off-by: Michael Walle Link: https://patch.msgid.link/20251120080138.2397851-1-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 7026f224e21cc0fb6056bbddeb8221265cbb7645 Author: Wadim Egorov Date: Wed Nov 19 04:32:16 2025 -0800 arm64: dts: ti: Enable build testing of PHYTEC board overlays Add missing PHYTEC overlay build targets so they are included in CONFIG_OF_ALL_DTBS coverage. This ensures all PHYTEC board-overlay combinations are apply-tested during build time testing. Signed-off-by: Wadim Egorov Link: https://patch.msgid.link/20251119123216.1481420-1-w.egorov@phytec.de Signed-off-by: Vignesh Raghavendra commit a6eb1771022613f01480c87a15a68939f9823671 Author: Geert Uytterhoeven Date: Fri Nov 14 11:51:29 2025 +0100 thermal/drivers/rcar_gen3: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas R-Car Gen3 thermal driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotation from its resume callback, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Signed-off-by: Daniel Lezcano Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/813ad36fdc8561cf1c396230436e8ff3ff903a1f.1763117455.git.geert+renesas@glider.be commit dd3feaf657a6fdf1a050bf94e0788a03d3f73dce Author: Yuntao Wang Date: Sat Nov 15 21:47:53 2025 +0800 of/reserved_mem: Simplify the logic of __reserved_mem_alloc_size() Use the existing helper functions to simplify the logic of __reserved_mem_alloc_size() Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-9-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 85a8a30c5b8e0ffaaf9f4dc51550dc71a1100df4 Author: Yuntao Wang Date: Sat Nov 15 21:47:52 2025 +0800 of/reserved_mem: Simplify the logic of fdt_scan_reserved_mem_reg_nodes() Use the existing helper functions to simplify the logic of fdt_scan_reserved_mem_reg_nodes() Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-8-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 8c0f606831c166ad3aa8f23e228f56c8a1278488 Author: Yuntao Wang Date: Sat Nov 15 21:47:51 2025 +0800 of/reserved_mem: Simplify the logic of __reserved_mem_reserve_reg() Use the existing helper functions to simplify the logic of __reserved_mem_reserve_reg() Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-7-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 46a8b0197575ac1187476f80d030d6c5089b2c40 Author: Yuntao Wang Date: Sat Nov 15 21:47:50 2025 +0800 of/fdt: Simplify the logic of early_init_dt_scan_memory() Use the existing helper functions to simplify the logic of early_init_dt_scan_memory() Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-6-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit c85da64ce2c36bba469f6feede9ca768f0361741 Author: Yuntao Wang Date: Sat Nov 15 21:47:49 2025 +0800 of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() When reading the fdt_size value, the argument passed to dt_mem_next_cell() is dt_root_addr_cells, but it should be dt_root_size_cells. The same issue occurs when reading the scratch_size value. Use a helper function to simplify the code and fix these issues. Fixes: 274cdcb1c004 ("arm64: add KHO support") Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-5-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 463942de13cd30fad5dba709f708483eab7efc2c Author: Yuntao Wang Date: Sat Nov 15 21:47:48 2025 +0800 of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range() The len value is in bytes, while `dt_root_addr_cells + dt_root_size_cells` is in cells (4 bytes per cell). Modulo calculation between them is incorrect, the units must be converted first. Use helper functions to simplify the code and fix this issue. Fixes: fb319e77a0e7 ("of: fdt: Add memory for devices by DT property "linux,usable-memory-range"") Fixes: 2af2b50acf9b9c38 ("of: fdt: Add generic support for handling usable memory range property") Fixes: 8f579b1c4e347b23 ("arm64: limit memory regions based on DT property, usable-memory-range") Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-4-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit bec5f6092bc1328895992ff02b862ba34b45a0b7 Author: Yuntao Wang Date: Sat Nov 15 21:47:47 2025 +0800 of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr() The len value is in bytes, while `dt_root_addr_cells + dt_root_size_cells` is in cells (4 bytes per cell). Comparing them directly is incorrect. Use a helper function to simplify the code and address this issue. Fixes: f7e7ce93aac1 ("of: fdt: Add generic support for handling elf core headers property") Fixes: e62aaeac426ab1dd ("arm64: kdump: provide /proc/vmcore file") Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-3-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 8278cb72c60399f6dc6300c409879fb4c7291513 Author: Yuntao Wang Date: Sat Nov 15 21:47:46 2025 +0800 of/fdt: Consolidate duplicate code into helper functions Currently, there are many pieces of nearly identical code scattered across different places. Consolidate the duplicate code into helper functions to improve maintainability and reduce the likelihood of errors. Signed-off-by: Yuntao Wang Link: https://patch.msgid.link/20251115134753.179931-2-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 186b5c2726647742bc597c076500c5d83539d9dc Author: Geert Uytterhoeven Date: Fri Nov 14 11:50:35 2025 +0100 thermal/drivers/rcar: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas R-Car thermal driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled, while increasing build coverage. Signed-off-by: Geert Uytterhoeven Signed-off-by: Daniel Lezcano Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/ee03ec71d10fd589e7458fa1b0ada3d3c19dbb54.1763117351.git.geert+renesas@glider.be commit fc6a6da64fd847c3122848c5a0850daaeb0874e5 Author: Konrad Dybcio Date: Mon Nov 17 14:45:59 2025 +0100 leds: rgb: leds-qcom-lpg: Allow LED_COLOR_ID_MULTI There's nothing special about RGB multi-led instances. Allow any color combinations by simply extending the "if _RGB" checks. Signed-off-by: Konrad Dybcio Reviewed-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Reviewed-by: David Heidelberg Link: https://patch.msgid.link/20251117-topic-lpg_multi-v1-1-05604374a2dd@oss.qualcomm.com Signed-off-by: Lee Jones commit c639065e142582b886f294be82130f46bbdc707a Author: René Rebe Date: Thu Nov 20 12:42:40 2025 +0100 ALSA: realtek/alc288 fix headphone for MS Surface 2/3 The Surface Pro 2 and 3 have a strange headphone frequency response and miss most of the bass. I discovered connecting the HP out to the main DAC fixes this. Maybe the other is mono or intentionally filtered signal for the built-in speakers? (At least the Lenovo Ideapad 720S (AMD) (0x17aa, 0x3812) exhibited the same problem, but I don't have it anymore for testing V2 changes.) Signed-off-by: René Rebe Co-developed-by: Takashi Iwai Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251120.124240.139462482701146043.rene@exactco.de commit 7828a4d3f6dbd8d44948726589457b152e3be79b Merge: 070b87f64a6435 c6a1ec1870e623 Author: Paolo Abeni Date: Thu Nov 20 15:24:13 2025 +0100 Merge branch 'add-af_xdp-zero-copy-support' Meghana Malladi says: ==================== Add AF_XDP zero copy support This series adds AF_XDP zero coppy support to icssg driver. Tests were performed on AM64x-EVM with xdpsock application [1]. A clear improvement is seen Transmit (txonly) and receive (rxdrop) for 64 byte packets. 1500 byte test seems to be limited by line rate (1G link) so no improvement seen there in packet rate Having some issue with l2fwd as the benchmarking numbers show 0 for 64 byte packets after forwading first batch packets and I am currently looking into it. AF_XDP performance using 64 byte packets in Kpps. AF_XDP performance using 64 byte packets in Kpps. Benchmark: XDP-SKB XDP-Native XDP-Native(ZeroCopy) rxdrop 253 473 656 txonly 350 354 855 l2fwd 178 240 0 AF_XDP performance using 1500 byte packets in Kpps. Benchmark: XDP-SKB XDP-Native XDP-Native(ZeroCopy) rxdrop 82 82 82 txonly 81 82 82 l2fwd 81 82 82 [1]: https://github.com/xdp-project/bpf-examples/tree/master/AF_XDP-example v5: https://lore.kernel.org/all/20251111101523.3160680-1-m-malladi@ti.com/ ==================== Link: https://patch.msgid.link/20251118135542.380574-1-m-malladi@ti.com Signed-off-by: Paolo Abeni commit c6a1ec1870e623ff74e70a481d11ff82932f31ff Author: Meghana Malladi Date: Tue Nov 18 19:25:42 2025 +0530 net: ti: icssg-prueth: Enable zero copy in XDP features Enable the zero copy feature flag in xdp_set_features_flag() for a given ndev to get the AF-XDP zero copy support running for both Tx and Rx. Reviewed-by: Jacob Keller Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20251118135542.380574-7-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 7a64bb388df3cf091afdd047c701039a13acd3b4 Author: Meghana Malladi Date: Tue Nov 18 19:25:41 2025 +0530 net: ti: icssg-prueth: Add AF_XDP zero copy for RX Use xsk_pool inside rx_chn to check if a given Rx queue id is registered for xsk zero copy, which gets populated during xsk enable. Update prueth_create_xdp_rxqs to register and support two different memory models (xsk and page) for a given Rx queue, if registered for zero copy. If xsk_pool is registered, allocate buffers from UMEM and map them to the hardware Rx descriptors. In NAPI context, run the XDP program for each packet and process the xsk buffer according to the XDP result codes. Also allocate new set of buffers from UMEM for the next batch of NAPI Rx processing. Add XDK_WAKEUP_RX support to support xsk wakeup for Rx. Move prueth_create_page_pool to prueth_init_rx_chns to avoid freeing and re-allocating the system memory every time there is a transition from zero copy to copy and prevents any type of memory fragmentation or leak. Reviewed-by: Jacob Keller Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20251118135542.380574-6-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 121133163c9ff0d1e6a2f7d4a461e535088fc2e3 Author: Meghana Malladi Date: Tue Nov 18 19:25:40 2025 +0530 net: ti: icssg-prueth: Make emac_run_xdp function independent of page emac_run_xdp function runs xdp program, at a given hook point in the Rx path of the driver in NAPI context and returns XDP return codes. In zero copy mode the driver receives packets using UMEM frames instead of pages (native XDP). Decouple the usage of page in this function. Reviewed-by: Jacob Keller Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20251118135542.380574-5-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 8756ef2eb078d9c92f7578c308e1650bb51c7f45 Author: Meghana Malladi Date: Tue Nov 18 19:25:39 2025 +0530 net: ti: icssg-prueth: Add AF_XDP zero copy for TX Use xsk_pool inside tx_chn to check if a given Tx queue id is registered for xsk zero copy, which gets populated during xsk enable If xsk_pool is set, get frames from the pool in NAPI context and submit them to the Tx channel. Tx completion is also handled in the NAPI context. Use PRUETH_SWDATA_XSK to recycle xsk buffers back to the umem pool. Add XDP_WAKEUP_TX support to enable xsk_wakeup for Tx. Reviewed-by: Jacob Keller Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20251118135542.380574-4-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 7dfd7597911f52c4d2e0e7b8c710f726ecc9d87f Author: Meghana Malladi Date: Tue Nov 18 19:25:38 2025 +0530 net: ti: icssg-prueth: Add XSK pool helpers Implement XSK NDOs (setup, wakeup) and create XSK Rx and Tx queues. xsk_qid stores the queue id for a given port which has been registered for zero copy AF_XDP and used to acquire UMEM pointer if registered. Based on the xsk_qid and the xsk_pool (umem) the driver is either in copy or zero copy mode. In case of copy mode the xsk_qid value will be invalid and will be set to valid queue id when enabling zero copy. To enable zero copy, the Rx queues are destroyed, i.e., descriptors pushed to fq and cq are freed to remap them to xdp buffers from the umem. Reviewed-by: Jacob Keller Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20251118135542.380574-3-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 41dde7f1d01343ebebe265edd8f4b59bca591db8 Author: Meghana Malladi Date: Tue Nov 18 19:25:37 2025 +0530 net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues Each port for a given ICSSG instance has their own set of Tx and Rx queues. Add functions to create and destroy these queues, which will be further used while performing ndo_bpf operations to set up XSK Tx/Rx queues for a given port. In the destroy Rx queue sequence add teardown wait to ensure that all the descriptors including the TDCM (teardown completion marker) have been serviced and freed to avoid any sort of descriptor leaks. Reviewed-by: Jacob Keller Signed-off-by: Meghana Malladi Link: https://patch.msgid.link/20251118135542.380574-2-m-malladi@ti.com Signed-off-by: Paolo Abeni commit 384bd58bf7095e4c4c8fcdbcede316ef342c630c Author: Haotian Zhang Date: Tue Nov 18 20:14:27 2025 +0800 mfd: mt6358-irq: Fix missing irq_domain_remove() in error path If devm_request_threaded_irq() fails after irq_domain_add_linear() succeeds in mt6358_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak. Call irq_domain_remove() in the error path after a successful irq_domain_add_linear() to properly release the IRQ domain. Fixes: 2b91c28f2abd ("mfd: Add support for the MediaTek MT6358 PMIC") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251118121427.583-1-vulab@iscas.ac.cn Signed-off-by: Lee Jones commit b4b1bd1f330fdd13706382be6c90ce9f58cee3f5 Author: Haotian Zhang Date: Tue Nov 18 20:15:00 2025 +0800 mfd: mt6397-irq: Fix missing irq_domain_remove() in error path If devm_request_threaded_irq() fails after irq_domain_create_linear() succeeds in mt6397_irq_init(), the function returns without removing the created IRQ domain, leading to a resource leak. Call irq_domain_remove() in the error path after a successful irq_domain_create_linear() to properly release the IRQ domain. Fixes: a4872e80ce7d ("mfd: mt6397: Extract IRQ related code from core driver") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251118121500.605-1-vulab@iscas.ac.cn Signed-off-by: Lee Jones commit 9494cb237b490cecc8c5d97824692b82097141c3 Author: Conor Dooley Date: Mon Nov 17 16:29:31 2025 +0000 dt-bindings: mfd: Document syscons falling back to atmel,sama5d2-sfrbu The sfrbu on both sama7g5 and sama6d65 both fall back to sama5d2 in devicetrees, but the former two compatibles were undocumented. Now that syscon.yaml has easy support for multiple soc-specific compatibles, add both of these undocumented devices. Signed-off-by: Conor Dooley Acked-by: Nicolas Ferre Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251117-marlin-mustang-5ffda4d211c7@spud Signed-off-by: Lee Jones commit 1f9793a4d5188cddc0eb69d7840b7c5c57c939a6 Author: Conor Dooley Date: Mon Nov 17 16:29:29 2025 +0000 dt-bindings: mfd: Document control-scb and sysreg-scb on pic64gx On pic64gx these syscons are identical to those on mpfs, and should use a fallback. Add support for multiple fallback compatibles to syscon.yaml with these as the first two users. Signed-off-by: Conor Dooley Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251117-aeration-smock-5e7ac06e2942@spud Signed-off-by: Lee Jones commit 81d75558406609f311766a37ec4b2c74d7b11ea0 Author: Faisal Hassan Date: Mon Sep 22 19:29:01 2025 +0530 phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup Replace the custom qmp_regulator_data structure with the standard regulator_bulk_data and use the init_load_uA field to set regulator load during initialization. This change simplifies the regulator setup by removing manual allocation and load configuration logic, and leverages devm_regulator_bulk_get_const() to automatically apply load settings before enabling regulators. Signed-off-by: Faisal Hassan Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20250922135901.2067-1-faisal.hassan@oss.qualcomm.com Signed-off-by: Vinod Koul commit 50db438231dcf7ceac187a6a9c68a1d757b8d883 Author: Rafael J. Wysocki Date: Sun Nov 16 13:34:29 2025 +0100 cpuidle: governors: teo: Fix tick_intercepts handling in teo_update() The condition deciding whether or not to increase cpu_data->tick_intercepts in teo_update() is reverse, so fix it. Fixes: d619b5cc6780 ("cpuidle: teo: Simplify counting events used for tick management") Cc: 6.14+ # 6.14+: 0796ddf4a7f0: cpuidle: teo: Use this_cpu_ptr() where possible Cc: 6.14+ # 6.14+: 8f3f01082d7a: cpuidle: governors: teo: Use s64 consistently in teo_update() Cc: 6.14+ # 6.14+: b54df61c7428: cpuidle: governors: teo: Decay metrics below DECAY_SHIFT threshold Cc: 6.14+ 6.14+: 083654ded547: cpuidle: governors: teo: Rework the handling of tick wakeups Cc: 6.14+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/5085160.31r3eYUQgx@rafael.j.wysocki commit 083654ded547238c70e0d4f57115cd1c91245b6e Author: Rafael J. Wysocki Date: Thu Nov 13 17:56:27 2025 +0100 cpuidle: governors: teo: Rework the handling of tick wakeups If the wakeup pattern is clearly dominated by tick wakeups, count those wakeups as hits on the deepest available idle state to increase the likelihood of stopping the tick, especially on systems where there are only 2 usable idle states and the tick can only be stopped when the deeper state is selected. This change is expected to reduce power on some systems where state 0 is selected relatively often even though they are almost idle. Without it, the governor may end up selecting the shallowest idle state all the time even if the system is almost completely idle due all tick wakeups being counted as hits on that state and preventing the tick from being stopped at all. Fixes: 4b20b07ce72f ("cpuidle: teo: Don't count non-existent intercepts") Reported-by: Reka Norman Closes: https://lore.kernel.org/linux-pm/CAEmPcwsNMNnNXuxgvHTQ93Mx-q3Oz9U57THQsU_qdcCx1m4w5g@mail.gmail.com/ Tested-by: Reka Norman Tested-by: Christian Loehle Cc: 6.11+ # 6.11+: 92ce5c07b7a1: cpuidle: teo: Reorder candidate state index checks Cc: 6.11+ # 6.11+: ea185406d1ed: cpuidle: teo: Combine candidate state index checks against 0 Cc: 6.11+ # 6.11+: b9a6af26bd83: cpuidle: teo: Drop local variable prev_intercept_idx Cc: 6.11+ # 6.11+: e24f8a55de50: cpuidle: teo: Clarify two code comments Cc: 6.11+ # 6.11+: d619b5cc6780: cpuidle: teo: Simplify counting events used for tick management Cc: 6.11+ # 6.11+: 13ed5c4a6d9c: cpuidle: teo: Skip getting the sleep length if wakeups are very frequent Cc: 6.11+ # 6.11+: ddcfa7964677: cpuidle: teo: Simplify handling of total events count Cc: 6.11+ # 6.11+: 65e18e654475: cpuidle: teo: Replace time_span_ns with a flag Cc: 6.11+ # 6.11+: 0796ddf4a7f0: cpuidle: teo: Use this_cpu_ptr() where possible Cc: 6.11+ # 6.11+: 8f3f01082d7a: cpuidle: governors: teo: Use s64 consistently in teo_update() Cc: 6.11+ # 6.11+: b54df61c7428: cpuidle: governors: teo: Decay metrics below DECAY_SHIFT threshold Cc: 6.11+ # 6.11+ Signed-off-by: Rafael J. Wysocki [ rjw: Rebase on commit 0796ddf4a7f0, changelog update ] Link: https://patch.msgid.link/6228387.lOV4Wx5bFT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 6f87b41303d3c4280a57b4f7360022a0951b43dd Author: Bartosz Golaszewski Date: Tue Nov 18 11:04:03 2025 +0100 string: fix kerneldoc formatting in strends() strends() kernel doc should have used `@str:` format for arguments instead of `@str -`. Fixes: 197b3f3c70d6 ("string: provide strends()") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20251118134748.40f03b9c@canb.auug.org.au/ Link: https://lore.kernel.org/r/20251118-strends-follow-up-v1-1-d3f8ef750f59@linaro.org Signed-off-by: Bartosz Golaszewski commit 87100151e090217b9325d7fc007b2930f6a46f02 Author: Jisheng Zhang Date: Wed Nov 19 22:04:55 2025 +0800 gpio: fxl6408: Add suspend/resume support Currently, during suspend, do nothing; during resume, just sync the regmap cache to hw regs. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20251119140455.10096-1-jszhang@kernel.org Signed-off-by: Bartosz Golaszewski commit 5dd9332c618473dee7c94946e482604cf095fbbc Author: Jose Javier Rodriguez Barbarin Date: Tue Nov 18 09:31:15 2025 +0100 gpio: menz127: add support for 16Z034 and 16Z037 GPIO controllers The 16Z034 and 16Z037 are 8 bits GPIO controllers that share the same registers and features of the 16Z127 GPIO controller. Signed-off-by: Jose Javier Rodriguez Barbarin Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251118083115.9545-1-dev-josejavier.rodriguez@duagon.com Signed-off-by: Bartosz Golaszewski commit d5089fffe1db04a802b028c2ef4875be1ed452a3 Author: Baojun Xu Date: Mon Nov 17 18:21:53 2025 +0800 ASoC: tas2781: Add tas2568/2574/5806m/5806md/5830 support TAS5806M, TAS5806MD, TAS5830 has on-chip DSP without current/voltage feedback, and in same family with TAS58XX. TAS2568, TAS2574 is in family with TAS257X. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251117102153.30644-2-baojun.xu@ti.com Signed-off-by: Mark Brown commit bb52dc1d0342a4d2dccbfb1aedda019b8415cce1 Author: Baojun Xu Date: Mon Nov 17 18:21:52 2025 +0800 ASoC: dt-bindings: ti,tas2781: Add TAS2568/2574/5806M/5806MD/5830 support TAS5806M, TAS5806MD and TAS5830 is in same family with TAS58XX. TAS2568, TAS2574 is in family with TAS257X. Signed-off-by: Baojun Xu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251117102153.30644-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit 041e502d4ca66341696fcf54a76f3724b80f0b1f Author: Kuninori Morimoto Date: Wed Nov 19 05:23:58 2025 +0000 ASoC: codecs: arizona: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fraasihe.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3045e29d248bde2a68da425498a656093ee0df69 Author: Richard Fitzgerald Date: Thu Nov 20 13:06:40 2025 +0000 firmware: cs_dsp: Append \n to debugfs string during read Append the terminating \n to the string during the debugfs file read instead of creating a string that already has a trailing \n. This avoids the ugly behaviour of having to include a trailing \n in the filenames stored to wmfw_file_name and bin_file_name in struct cs_dsp. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251120130640.1169780-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 78cfd833bc04c0398ca4cfc64704350aebe4d4c2 Author: Richard Fitzgerald Date: Thu Nov 20 13:06:39 2025 +0000 firmware: cs_dsp: Factor out common debugfs string read cs_dsp_debugfs_wmfw_read() and cs_dsp_debugfs_bin_read() were identical except for which struct member they printed. Move all this duplicated code into a common function cs_dsp_debugfs_string_read(). The check for dsp->booted has been removed because this is redundant. The two strings are set when the DSP is booted and cleared when the DSP is powered-down. Access to the string char * must be protected by the pwr_lock mutex. The string is passed into cs_dsp_debugfs_string_read() as a pointer to the char * so that the mutex lock can also be factored out into cs_dsp_debugfs_string_read(). wmfw_file_name and bin_file_name members of struct cs_dsp have been changed to const char *. It makes for a better API to pass a const pointer into cs_dsp_debugfs_string_read(). Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251120130640.1169780-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit d2b240f9a180ebd63477d0534633f22e16fe41ad Author: Frank Li Date: Fri Nov 14 16:30:36 2025 -0500 dt-bindings: mfd: Convert dlg,da9052-i2c.txt to yaml format Convert dlg,da9052-i2c.txt to yaml format. Additional changes: - compatible string fallback to dlg,da9052 to align existing dts files. - Add interrupts property. - Add ref to /schemas/spi/spi-peripheral-props.yaml# - Add dlg,da9053bc. Remove dlg,da9053 from trivial-devices.yaml. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251114213037.1211907-1-Frank.Li@nxp.com Signed-off-by: Lee Jones commit be2b723d94f2fa3f8ca028a55d313ba0b3007d44 Merge: bdf96e9135a0cf 7a0a8771212032 Author: Mark Brown Date: Thu Nov 20 12:39:38 2025 +0000 gpio: improve support for shared GPIOs Merge series from Bartosz Golaszewski : Problem statement: GPIOs are implemented as a strictly exclusive resource in the kernel but there are lots of platforms on which single pin is shared by multiple devices which don't communicate so need some way of properly sharing access to a GPIO. What we have now is the GPIOD_FLAGS_BIT_NONEXCLUSIVE flag which was introduced as a hack and doesn't do any locking or arbitration of access - it literally just hand the same GPIO descriptor to all interested users. The proposed solution is composed of three major parts: the high-level, shared GPIO proxy driver that arbitrates access to the shared pin and exposes a regular GPIO chip interface to consumers, a low-level shared GPIOLIB module that scans firmware nodes and creates auxiliary devices that attach to the proxy driver and finally a set of core GPIOLIB changes that plug the former into the GPIO lookup path. The changes are implemented in a way that allows to seamlessly compile out any code related to sharing GPIOs for systems that don't need it. The practical use-case for this are the powerdown GPIOs shared by speakers on Qualcomm db845c platform, however I have also extensively tested it using gpio-virtuser on arm64 qemu with various DT configurations. commit 1cfe3795c152c7415a9f49fc1e7f623c855d14ab Author: Christoph Hellwig Date: Tue Nov 18 07:49:42 2025 +0100 xfs: use zi more in xfs_zone_gc_mount Use the local variable instead of the extra pointer dereference when starting the GC thread. Signed-off-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Carlos Maiolino commit c7a2e5eed13b8eec5e1d38fa15d2108cc5f8c730 Author: LI Qingwu Date: Mon Nov 17 05:45:10 2025 +0000 leds: pwm: Reorder include files to alphabetic order Reorder include files to alphabetic order to simplify maintenance No functional change. Signed-off-by: LI Qingwu Link: https://patch.msgid.link/20251117054511.730246-3-Qing-wu.Li@leica-geosystems.com.cn Signed-off-by: Lee Jones commit bb64206276db15f1d6e115febb262c9830628625 Author: LI Qingwu Date: Mon Nov 17 05:45:09 2025 +0000 leds: pwm: Add optional GPIO enable pin support Add support for optional GPIO-based enable pin control to PWM LED driver. Some PWM LED driver chips like TPS92380 and LT3743 require a separate enable signal in addition to PWM control. Implement support for such GPIO control through the "enable-gpios" device tree property, activating the pin when LED brightness is non-zero and deactivating it when off. Tested on i.MX8MP EVK with TPS92380 LED driver chip Signed-off-by: LI Qingwu Link: https://patch.msgid.link/20251117054511.730246-2-Qing-wu.Li@leica-geosystems.com.cn Signed-off-by: Lee Jones commit d7dca03a48e2e95b4469d3e3a1ef23065d90f98b Author: LI Qingwu Date: Mon Nov 17 05:45:08 2025 +0000 dt-bindings: leds: pwm: Add enable-gpios property Some PWM LED driver chips like TPS92380 and LT3743 require a separate enable signal in addition to PWM control. Add this property to allow device trees to specify such GPIO, which will be controlled automatically by the driver based on the LED brightness state. Signed-off-by: LI Qingwu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251117054511.730246-1-Qing-wu.Li@leica-geosystems.com.cn Signed-off-by: Lee Jones commit 417bd0d502f90a2e785e7299dae4f248b5ac0292 Author: Tomas Glozar Date: Tue Oct 7 11:53:39 2025 +0200 tools/rtla: Fix --on-threshold always triggering Commit 8d933d5c89e8 ("rtla/timerlat: Add continue action") moved the code performing on-threshold actions (enabled through --on-threshold option) to inside the RTLA main loop. The condition in the loop does not check whether the threshold was actually exceeded or if stop tracing was requested by the user through SIGINT or duration. This leads to a bug where on-threshold actions are always performed, even when the threshold was not hit. (BPF mode is not affected, since it uses a different condition in the while loop.) Add a condition that checks for !stop_tracing before executing the actions. Also, fix incorrect brackets in hist_main_loop to match the semantics of top_main_loop. Fixes: 8d933d5c89e8 ("rtla/timerlat: Add continue action") Fixes: 2f3172f9dd58 ("tools/rtla: Consolidate code between osnoise/timerlat and hist/top") Reviewed-by: Crystal Wood Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20251007095341.186923-1-tglozar@redhat.com Signed-off-by: Tomas Glozar commit e4240db9336c25826a2d6634adcca86d5ee01bde Author: Tomas Glozar Date: Mon Oct 6 16:31:00 2025 +0200 rtla/timerlat_bpf: Stop tracing on user latency rtla-timerlat allows a *thread* latency threshold to be set via the -T/--thread option. However, the timerlat tracer calls this *total* latency (stop_tracing_total_us), and stops tracing also when the return-to-user latency is over the threshold. Change the behavior of the timerlat BPF program to reflect what the timerlat tracer is doing, to avoid discrepancy between stopping collecting data in the BPF program and stopping tracing in the timerlat tracer. Cc: stable@vger.kernel.org Fixes: e34293ddcebd ("rtla/timerlat: Add BPF skeleton to collect samples") Reviewed-by: Wander Lairson Costa Link: https://lore.kernel.org/r/20251006143100.137255-1-tglozar@redhat.com Signed-off-by: Tomas Glozar commit b4275b23010df719ec6508ddbc84951dcd24adce Author: Costa Shulyupin Date: Thu Oct 2 20:08:45 2025 +0300 tools/rtla: Fix unassigned nr_cpus In recently introduced timerlat_free(), the variable 'nr_cpus' is not assigned. Assign it with sysconf(_SC_NPROCESSORS_CONF) as done elsewhere. Remove the culprit: -Wno-maybe-uninitialized. The rest of the code is clean. Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Fixes: 2f3172f9dd58 ("tools/rtla: Consolidate code between osnoise/timerlat and hist/top") Link: https://lore.kernel.org/r/20251002170846.437888-1-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 671314fce1c60913012e5643ffecdaa4578cfcb3 Author: Costa Shulyupin Date: Thu Oct 2 15:35:39 2025 +0300 tools/rtla: Remove unused optional option_index The longindex argument of getopt_long() is optional and tied to the unused local variable option_index. Remove it to shorten the four longest functions and make the code neater. Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251002123553.389467-2-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 04fa6bf3736d727bb800dddb23c9a513969e565d Author: Costa Shulyupin Date: Thu Oct 2 15:35:38 2025 +0300 tools/rtla: Add for_each_monitored_cpu() helper The rtla tools have many instances of iterating over CPUs while checking if they are monitored. Add a for_each_monitored_cpu() helper macro to make the code more readable and reduce code duplication. Signed-off-by: Costa Shulyupin Reviewed-by: Tomas Glozar Link: https://lore.kernel.org/r/20251002123553.389467-1-costa.shul@redhat.com Signed-off-by: Tomas Glozar commit 070b87f64a6435897bc81f1fcaae3169472ca413 Merge: d877b1013cdb95 9b97b6b5635b3d Author: Paolo Abeni Date: Thu Nov 20 12:47:28 2025 +0100 Merge branch 'txgbe-support-more-modules' Jiawen Wu says: ==================== TXGBE support more modules Support CR modules for 25G devices and QSFP modules for 40G devices. And implement .get_module_eeprom_by_page() to get module info. v1: https://lore.kernel.org/all/20251112055841.22984-1-jiawenwu@trustnetic.com/ ==================== Link: https://patch.msgid.link/20251118080259.24676-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 9b97b6b5635b3de18debd07a3adcf25198ec8299 Author: Jiawen Wu Date: Tue Nov 18 16:02:59 2025 +0800 net: txgbe: support getting module EEPROM by page Getting module EEPROM has been supported in TXGBE SP devices, since SFP driver has already implemented it. Now add support to read module EEPROM for AML devices. Towards this, add a new firmware mailbox command to get the page data. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20251118080259.24676-6-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit c6e97daec549c2c01434d2978ae48b1a2f71a893 Author: Jiawen Wu Date: Tue Nov 18 16:02:58 2025 +0800 net: txgbe: delay to identify modules in .ndo_open For QSFP modules, there is a possibility that the module cannot be identified when read I2C immediately in .ndo_open. So just set the flag WX_FLAG_NEED_MODULE_RESET and do it in the subtask, which always wait 200 ms to identify the module. And this change has no impact on the original adaptation. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20251118080259.24676-5-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 57d39faed4c942ccd611588ce0065d1516778aab Author: Jiawen Wu Date: Tue Nov 18 16:02:57 2025 +0800 net: txgbe: improve functions of AML 40G devices Support to identify QSFP modules for AML 40G devices. The definition of GPIO pins follows the design of the QSFP modules, and TXGBE_GPIOBIT_4 is used for module present. Meanwhile, implement phylink in XLGMII mode by default, and get the link state from MAC link. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20251118080259.24676-4-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit dbba6b7a47cba914d48890da7233a64c7b9f3ccc Author: Jiawen Wu Date: Tue Nov 18 16:02:56 2025 +0800 net: txgbe: rename the SFP related QSFP supported will be introduced for AML 40G devices, the code related to identify various modules should be renamed to more appropriate names. And struct txgbe_hic_i2c_read used to get module information is renamed as struct txgbe_hic_get_module_info, because another SW-FW command to read I2C will be added later. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20251118080259.24676-3-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 354d128aa7212c53ffc7127877953264a445f5af Author: Jiawen Wu Date: Tue Nov 18 16:02:55 2025 +0800 net: txgbe: support CR modules for AML devices Support to identify 25G/10G CR modules for AML devices. Autoneg is enbaled by default in CR mode. Signed-off-by: Jiawen Wu Link: https://patch.msgid.link/20251118080259.24676-2-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni commit 79c11fb3da8581a2f222b290ce62a153ab1108fc Author: Thomas Gleixner Date: Wed Nov 19 18:26:59 2025 +0100 sched/mmcid: Use cpumask_weighted_or() Use cpumask_weighted_or() instead of cpumask_or() and cpumask_weight() on the result, which walks the same bitmap twice. Results in 10-20% less cycles, which reduces the runqueue lock hold time. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Acked-by: Yury Norov (NVIDIA) Link: https://patch.msgid.link/20251119172549.511736272@linutronix.de commit 437cb3ded25038d5280d21de489ce78c745118d5 Author: Thomas Gleixner Date: Wed Nov 19 18:26:57 2025 +0100 cpumask: Introduce cpumask_weighted_or() CID management OR's two cpumasks and then calculates the weight on the result. That's inefficient as that has to walk the same stuff twice. As this is done with runqueue lock held, there is a real benefit of speeding this up. Depending on the system this results in 10-20% less cycles spent with runqueue lock held for a 4K cpumask. Provide cpumask_weighted_or() and the corresponding bitmap functions which return the weight of the OR result right away. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Yury Norov (NVIDIA) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.448263340@linutronix.de commit 0d032a43ebeb9bf255cd7e3dad5f7a6371571648 Author: Thomas Gleixner Date: Wed Nov 19 18:26:55 2025 +0100 sched/mmcid: Prevent pointless work in mm_update_cpus_allowed() mm_update_cpus_allowed() is not required to be invoked for affinity changes due to migrate_disable() and migrate_enable(). migrate_disable() restricts the task temporarily to a CPU on which the task was already allowed to run, so nothing changes. migrate_enable() restores the actual task affinity mask. If that mask changed between migrate_disable() and migrate_enable() then that change was already accounted for. Move the invocation to the proper place to avoid that. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.385208276@linutronix.de commit b08ef5fc8fa01ae5285bef5ff783bbb425d1fb08 Author: Thomas Gleixner Date: Wed Nov 19 18:26:53 2025 +0100 sched/mmcid: Move scheduler code out of global header This is only used in the scheduler core code, so there is no point to have it in a global header. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Acked-by: Yury Norov (NVIDIA) Link: https://patch.msgid.link/20251119172549.321259077@linutronix.de commit 925b7847bb7d4eb523a7698b309e8441647796f2 Author: Thomas Gleixner Date: Wed Nov 19 18:26:51 2025 +0100 sched: Fixup whitespace damage With whitespace checks enabled in the editor this makes eyes bleed. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.258651925@linutronix.de commit be4463fa2c7185823d2989562162d578b45a89ae Author: Thomas Gleixner Date: Wed Nov 19 18:26:49 2025 +0100 sched/mmcid: Cacheline align MM CID storage Both the per CPU storage and the data in mm_struct are heavily used in context switch. As they can end up next to other frequently modified data, they are subject to false sharing. Make them cache line aligned. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.194111661@linutronix.de commit 8cea569ca785060b8c5cc7800713ddc3b1548a94 Author: Thomas Gleixner Date: Wed Nov 19 18:26:47 2025 +0100 sched/mmcid: Use proper data structures Having a lot of CID functionality specific members in struct task_struct and struct mm_struct is not really making the code easier to read. Encapsulate the CID specific parts in data structures and keep them separate from the stuff they are embedded in. No functional change. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.131573768@linutronix.de commit 77d7dc8bef482e987036bc204136bbda552d95cd Author: Thomas Gleixner Date: Wed Nov 19 18:26:45 2025 +0100 sched/mmcid: Revert the complex CID management The CID management is a complex beast, which affects both scheduling and task migration. The compaction mechanism forces random tasks of a process into task work on exit to user space causing latency spikes. Revert back to the initial simple bitmap allocating mechanics, which are known to have scalability issues as that allows to gradually build up a replacement functionality in a reviewable way. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Acked-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251119172549.068197830@linutronix.de commit b688a9447be360d09c0982234fcd703ac7dd8c15 Author: Chien Wong Date: Thu Nov 13 22:05:11 2025 +0800 wifi: mac80211: refactor CMAC packet handlers Merge CMAC-128 and CMAC-256 handlers since they are almost the same. This removes duplication. The comment 'MIC = AES-128-CMAC(IGTK, AAD ...' is out-dated since CMAC is also used with BIGTK, as is the comment for CMAC-256. Simply remove the comments. Tested-on: mac80211_hwsim Signed-off-by: Chien Wong Link: https://patch.msgid.link/20251113140511.48658-6-m@xv97.com Signed-off-by: Johannes Berg commit a22fb19244cb2425b075106541bd5b3eee42730c Author: Chien Wong Date: Thu Nov 13 22:05:10 2025 +0800 wifi: mac80211: refactor CMAC crypt functions ieee80211_aes_cmac() and ieee80211_aes_cmac_256() are almost the same. Merge them. This removes duplication. Signed-off-by: Chien Wong Link: https://patch.msgid.link/20251113140511.48658-5-m@xv97.com Signed-off-by: Johannes Berg commit edf62602fcbbc0440565ed18372a01e4c7bc9a9d Author: Chien Wong Date: Thu Nov 13 22:05:09 2025 +0800 wifi: mac80211: utilize the newly defined CMAC constants Make use of the added constants to reduce duplication. Signed-off-by: Chien Wong Link: https://patch.msgid.link/20251113140511.48658-4-m@xv97.com Signed-off-by: Johannes Berg commit 4255545a28f75fb6082b6f91d1e7ada28383ab22 Author: Chien Wong Date: Thu Nov 13 22:05:08 2025 +0800 wifi: mac80211: add generic MMIE struct defines The added struct is needed when writing generic handler for both CMAC-128 and CMAC-256. Signed-off-by: Chien Wong Link: https://patch.msgid.link/20251113140511.48658-3-m@xv97.com Signed-off-by: Johannes Berg commit 353cda30d30e5dc7cacf8de5d2546724708ae3bb Author: Chien Wong Date: Thu Nov 13 22:05:07 2025 +0800 wifi: mac80211: fix CMAC functions not handling errors The called hash functions could fail thus we should check return values. Fixes: 26717828b75d ("mac80211: aes-cmac: switch to shash CMAC driver") Signed-off-by: Chien Wong Link: https://patch.msgid.link/20251113140511.48658-2-m@xv97.com Signed-off-by: Johannes Berg commit 799e98708f748253cbeda75d633da81324d7e7db Author: Marco Crivellari Date: Thu Nov 20 10:45:24 2025 +0100 wifi: ipw2x00: replace use of system_wq with system_percpu_wq This patch continues the effort to refactor workqueue APIs, which has begun with the changes introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The point of the refactoring is to eventually alter the default behavior of workqueues to become unbound by default so that their workload placement is optimized by the scheduler. Before that to happen after a careful review and conversion of each individual case, workqueue users must be converted to the better named new workqueues with no intended behaviour changes: system_wq -> system_percpu_wq system_unbound_wq -> systemd_dfl_wq This way the old obsolete workqueues (system_wq, system_unbound_wq) can be removed in the future. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251120094524.45264-1-marco.crivellari@suse.com Signed-off-by: Johannes Berg commit 6cbc09b7719ec7fd9f650f18b3828b7f60c17881 Author: Lu Baolu Date: Thu Nov 20 15:25:24 2025 +0800 iommu/vt-d: Restore previous domain::aperture_end calculation Commit d373449d8e97 ("iommu/vt-d: Use the generic iommu page table") changed the calculation of domain::aperture_end. Previously, it was calculated as: domain->domain.geometry.aperture_end = __DOMAIN_MAX_ADDR(domain->gaw - 1); where domain->gaw was limited to less than MGAW. Currently, it is calculated purely based on the max level of the page table that the hardware supports. This is incorrect as stated in Section 3.6 of the VT-d spec: "Software using first-stage translation structures to translate an IO Virtual Address (IOVA) must use canonical addresses. Additionally, software must limit addresses to less than the minimum of MGAW and the lower canonical address width implied by FSPM (i.e., 47-bit when FSPM is 4-level and 56-bit when FSPM is 5-level)." Restore the previous calculation method for domain::aperture_end to avoid violating the spec. Incorrect aperture calculation causes GPU hangs without generating VT-d faults on some Intel client platforms. Fixes: d373449d8e97 ("iommu/vt-d: Use the generic iommu page table") Reported-by: Chaitanya Kumar Borah Closes: https://lore.kernel.org/r/4f15cf3b-6fad-4cd8-87e5-6d86c0082673@intel.com Suggested-by: Jason Gunthorpe Suggested-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 6b38a108eeb3936b21643191db535a35dd7c890b Author: Aashish Sharma Date: Wed Nov 19 13:16:13 2025 +0800 iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Invalidation hint (ih) in the function 'qi_desc_iotlb' is initialized to zero and never used. It is embedded in the 0th bit of the 'addr' parameter. Get the correct 'ih' value from there. Fixes: f701c9f36bcb ("iommu/vt-d: Factor out invalidation descriptor composition") Signed-off-by: Aashish Sharma Link: https://lore.kernel.org/r/20251009010903.1323979-1-aashish@aashishsharma.net Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit cb3db5a39e2a6b6396df1780d39a250f649d2e3a Author: Vineeth Pillai (Google) Date: Wed Nov 19 13:16:12 2025 +0800 iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD INTEL_IOMMU_FLOPPY_WA workaround was introduced to create direct mappings for first 16MB for floppy devices as the floppy drivers were not using dma apis. We need not do this direct map if floppy driver is not enabled. INTEL_IOMMU_FLOPPY_WA is generally not a good idea. Iommu will be mapping pages in this address range while kernel would also be allocating from this range(mostly on memory stress). A misbehaving device using this domain will have access to the pages that the kernel might be actively using. We noticed this while running a test that was trying to figure out if any pages used by kernel is in iommu page tables. This patch reduces the scope of the above issue by disabling the workaround when floppy driver is not enabled. But we would still need to fix the floppy driver to use dma apis so that we need not do direct map without reserving the pages. Or the other option is to reserve this memory range in firmware so that kernel will not use the pages. Fixes: d850c2ee5fe2 ("iommu/vt-d: Expose ISA direct mapping region via iommu_get_resv_regions") Fixes: 49a0429e53f2 ("Intel IOMMU: Iommu floppy workaround") Signed-off-by: Vineeth Pillai (Google) Link: https://lore.kernel.org/r/20251002161625.1155133-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit ee19b52c31b3b111f140c1affd88eca1ed11edd0 Author: André Draszik Date: Fri Nov 14 14:10:59 2025 +0000 mfd: sec: Use chained IRQs for s2mpg10 On S2MPG10 (and similar like S2MPG11), top-level interrupt status and mask registers exist which need to be unmasked to get the PMIC interrupts. This additional status doesn't seem to exist on other PMICs in the S2MP* family, and the S2MPG10 driver is manually dealing with masking and unmasking currently. The correct approach here is to register this hierarchy as chained interrupts, though, without any additional manual steps. Doing so will also simplify addition of other, similar, PMICs (like S2MPG11) in the future. Update the driver to do just that. Signed-off-by: André Draszik Link: https://patch.msgid.link/20251114-s2mpg10-chained-irq-v1-1-34ddfa49c4cd@linaro.org Signed-off-by: Lee Jones commit 56c1245d51faab70bf68cc3a5cd3925768e6375b Author: Heiko Stuebner Date: Thu Nov 13 17:52:18 2025 +0100 mfd: qnap-mcu: Add proper error handling for command errors Further investigation revealed that the MCU in QNAP devices may return two error states. One "@8" for a checksum error in the submitted command and one "@9" for any generic (and sadly unspecified) error. These error codes with 2 data character can of course also be shorter then the expected reply length for the submitted command, so we'll need to check the received data for error codes and exit the receive portion early in that case. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251113165218.449616-5-heiko@sntech.de Signed-off-by: Lee Jones commit c3223f562586307b1bcb014475d0b71913972145 Author: Heiko Stuebner Date: Thu Nov 13 17:52:17 2025 +0100 mfd: qnap-mcu: Move checksum verification to its own function We'll need the checksum check in a second place in the future, so move the verification code to a separate function. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251113165218.449616-4-heiko@sntech.de Signed-off-by: Lee Jones commit c94fce30e190555d74e2769b5fe4a932d0ad432e Author: Heiko Stuebner Date: Thu Nov 13 17:52:16 2025 +0100 mfd: qnap-mcu: Use EPROTO in stead of EIO on checksum errors EPROTO stands for protocol error and a lot of driver already use it to designate errors in the sent or received data from a peripheral. So use it in the qnap-mcu as well for checksum errors. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251113165218.449616-3-heiko@sntech.de Signed-off-by: Lee Jones commit b4881070a02b017aea84592c424d5a980ed261c4 Author: Heiko Stuebner Date: Thu Nov 13 17:52:15 2025 +0100 mfd: qnap-mcu: Calculate the checksum on the actual number of bytes received In the case of an error message, the number of received bytes can be less than originally expected but still contain a valid message. If the transfer itself ended in an error we would exit earlier already. So calculate the checksum on the number of received bytes and not the number of expected bytes. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251113165218.449616-2-heiko@sntech.de Signed-off-by: Lee Jones commit 57dc2ea0b7bdb828c5d966d9135c28fe854933a4 Author: Miguel Ojeda Date: Wed Nov 19 19:51:25 2025 +0100 rust: slice: fix broken intra-doc links In older versions of Rust, the compiler doesn't know about the newer `as_flattened*` methods, thus `rustdoc` complains about the intra-doc links, e.g. error: unresolved link to `slice::as_flattened` --> rust/kernel/slice.rs:19:23 | 19 | /// [`as_flattened`]: slice::as_flattened | ^^^^^^^^^^^^^^^^^^^ the primitive type `slice` has no associated item named `as_flattened` | = note: `-D rustdoc::broken-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::broken_intra_doc_links)]` Thus fix them by using an URL instead. Fixes: 88622323dde3 ("rust: enable slice_flatten feature and provide it through an extension trait") Signed-off-by: Miguel Ojeda Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251119185125.1411151-1-ojeda@kernel.org Signed-off-by: Alice Ryhl commit d5c3f49b75832553ba0dafabc2d394a885106498 Author: Conor Dooley Date: Wed Nov 12 17:09:25 2025 +0000 MAINTAINERS: Setup support for Anlogic tree Add myself as the maintainer of the Anlogic DR1V90 SoC tree, including the corresponding DTS and DT bindings paths for Anlogic RISC-V-based SoCs. I don't really want to look after this platform, but am due to irritation of the vendor's behaviour towards the contributor of support. Hence, Odd Fixes as the status. Signed-off-by: Conor Dooley commit fec4d9d6ffd297b1ce8f19a8f723f5b0aaac5b3e Author: Marco Crivellari Date: Thu Nov 13 17:20:32 2025 +0100 wifi: cfg80211: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Switch to using system_dfl_wq because system_unbound_wq is going away as part of a workqueue restructuring. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251113162032.394804-4-marco.crivellari@suse.com Signed-off-by: Johannes Berg commit e4582bdf5132ce80e7432d8143f2c321d258e60f Author: Marco Crivellari Date: Thu Nov 13 17:20:31 2025 +0100 wifi: cw1200: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251113162032.394804-3-marco.crivellari@suse.com Signed-off-by: Johannes Berg commit 2112519bdf05685c603c62bf633ab1c8f0edd3c6 Author: Marco Crivellari Date: Thu Nov 13 17:08:25 2025 +0100 wifi: wfx: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Reviewed-by: Jérôme Pouiller Link: https://patch.msgid.link/20251113160825.383883-1-marco.crivellari@suse.com Signed-off-by: Johannes Berg commit 5d5c121c4fb6b96c0b1ee9b1862047b09e0830aa Author: Marco Crivellari Date: Thu Nov 13 17:00:35 2025 +0100 wifi: qtnfmac: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Link: https://patch.msgid.link/20251113160035.376524-1-marco.crivellari@suse.com Signed-off-by: Johannes Berg commit a77f0ad44fde89874654ba48f461209fb0382107 Author: Pagadala Yesu Anjaneyulu Date: Wed Nov 12 11:10:23 2025 +0200 wifi: cfg80211: Add support for 6GHz AP role not relevant AP type Add IEEE80211_6GHZ_CTRL_REG_AP_ROLE_NOT_RELEVANT and map it to IEEE80211_REG_LPI_AP for safe regulatory compliance when AP role classification is not applicable. Use LPI as safe fallback to prevent power limit violations. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251112110828.856283677cc7.I36138a34847c3b4e680974bf347dde844448f3bc@changeid Signed-off-by: Johannes Berg commit c22f7a5cd205492c48c6deb72f5efe2ae63c931e Merge: 21e68bcb1b0c68 b871d9adffe5a6 Author: Mark Brown Date: Thu Nov 20 09:23:08 2025 +0000 gpio: improve support for shared GPIOs Merge series from Bartosz Golaszewski : Problem statement: GPIOs are implemented as a strictly exclusive resource in the kernel but there are lots of platforms on which single pin is shared by multiple devices which don't communicate so need some way of properly sharing access to a GPIO. What we have now is the GPIOD_FLAGS_BIT_NONEXCLUSIVE flag which was introduced as a hack and doesn't do any locking or arbitration of access - it literally just hand the same GPIO descriptor to all interested users. The proposed solution is composed of three major parts: the high-level, shared GPIO proxy driver that arbitrates access to the shared pin and exposes a regular GPIO chip interface to consumers, a low-level shared GPIOLIB module that scans firmware nodes and creates auxiliary devices that attach to the proxy driver and finally a set of core GPIOLIB changes that plug the former into the GPIO lookup path. The changes are implemented in a way that allows to seamlessly compile out any code related to sharing GPIOs for systems that don't need it. The practical use-case for this are the powerdown GPIOs shared by speakers on Qualcomm db845c platform, however I have also extensively tested it using gpio-virtuser on arm64 qemu with various DT configurations. commit 1387cb78f101553c7fc14ec04ba730cab03ea3df Author: Yue Haibing Date: Fri Nov 14 10:05:31 2025 +0800 Documentation: reset: Remove reset_controller_add_lookup() Commit 205b261463ff ("reset: remove legacy reset lookup code") removed this api, so update the document. Signed-off-by: Yue Haibing Signed-off-by: Philipp Zabel commit 9afbbf4903228cd1ffc9b5e4cfc3f7083fdcabd5 Author: Kailang Yang Date: Thu Nov 20 14:52:46 2025 +0800 ALSA: hda/realtek - Enable Mute LED and Tas2781 for HP platform Enable SPK Mute Led and Mic Mute Led for HP platform. It was also integrated with Tas2781 supported. Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai commit 2e90ff546240498c2158d9f9acfcfba30904ab6b Merge: ad5f82ab04bcad 5719a189c93459 Author: Takashi Iwai Date: Thu Nov 20 09:48:59 2025 +0100 Merge branch 'for-linus' into for-next Pull 6.18-devel branch for applying the further HD-audio fixups for HP. Signed-off-by: Takashi Iwai commit b2a186cced1199bb2777e229dc37a04d33507c6d Author: David Laight Date: Wed Nov 19 22:41:14 2025 +0000 gpiolib: acpi: use min() instead of min_t() min_t(u16, a, b) casts an 'unsigned long' to 'u16'. Use min(a, b) instead as it promotes the both values to int and so cannot discard significant bits. In this case the values should be ok. Detected by an extra check added to min_t(). Signed-off-by: David Laight Signed-off-by: Andy Shevchenko commit ac35e04f8000aaaf98635792464647e7a6f3422e Author: Slark Xiao Date: Wed Nov 19 18:56:14 2025 +0800 bus: mhi: host: pci_generic: Add Foxconn T99W760 modem T99W760 modem is based on Qualcomm SDX35 chipset. It uses the same channel configurations of Foxconn SDX61 modem. Hence, add support for it by reusing the 'modem_foxconn_sdx61_config' config structure. The EDL firmware for this modem has been pushed to linux-firmware. Signed-off-by: Slark Xiao [mani: reworded description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251119105615.48295-2-slark_xiao@163.com commit d877b1013cdb9500617c02d19c2a0c14184a872a Merge: beabc06ffb1b98 64ad6470c882fc Author: Jakub Kicinski Date: Wed Nov 19 20:32:29 2025 -0800 Merge branch 'net-mlx5-move-notifiers-outside-the-devlink-lock' Tariq Toukan says: ==================== net/mlx5: Move notifiers outside the devlink lock This series by Cosmin moves blocking notifier registration in the mlx5 driver outside the devlink lock during probe. This is mostly a no-op refactoring that consists of multiple pieces. It is necessary because upcoming code will introduce a potential locking cycle between the devlink lock and the blocking notifier head mutexes, so these notifiers must move out of the devlink-locked critical section. ==================== Link: https://patch.msgid.link/1763325940-1231508-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 64ad6470c882fcaecfa4a1da96ea94de7ca0dc80 Author: Cosmin Ratiu Date: Sun Nov 16 22:45:40 2025 +0200 net/mlx5: Move SF dev table notifier registration outside the PF devlink lock This completes the previous patches by moving notifier registration for SF dev tables outside the devlink locked critical section in mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions. This is only done for non-SFs, since SFs do not have a SF HW table themselves. After this patch, notifiers can grab the PF devlink lock (soon to be necessary) without creating a locking cycle. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763325940-1231508-7-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d4a0acbd94c2a93bf308a9fde9ab6719f5d98c7a Author: Cosmin Ratiu Date: Sun Nov 16 22:45:39 2025 +0200 net/mlx5: Move the SF table notifiers outside the devlink lock Move the SF table notifiers registration/unregistration outside of mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions. This is only done for non-SFs, since SFs do not have a SF table themselves and thus don't need notifiers. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763325940-1231508-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e63c9c5f0a4802deea81a48c2c40d0af56153e8a Author: Cosmin Ratiu Date: Sun Nov 16 22:45:38 2025 +0200 net/mlx5: Move the SF HW table notifier outside the devlink lock Move the SF HW table notifier registration/unregistration outside of mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions. This is only done for non-SFs, since SFs do not have a SF HW table themselves. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763325940-1231508-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d3a356db853bc2dfb51034eacafd41aca7dd4c37 Author: Cosmin Ratiu Date: Sun Nov 16 22:45:37 2025 +0200 net/mlx5: Move the vhca event notifier outside of the devlink lock The vhca event notifier consists of an atomic notifier for vhca state changes (used for SF events), multiple workqueues and a blocking notifier chain for delivering the vhca state change events for further processing. This patch moves the vhca notifier head outside of mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions. This allows called notifiers to grab the PF devlink lock which was previously impossible because it would create a circular lock dependency. mlx5_vhca_event_stop() is now called earlier in the cleanup phase and flushes the workqueues to ensure that after the call, there are no pending events. This simplifies the cleanup flow for vhca event consumers. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763325940-1231508-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3fee828789b1cf294a8fc83ad8a37f644c174fae Author: Cosmin Ratiu Date: Sun Nov 16 22:45:36 2025 +0200 net/mlx5: Move the esw mode notifier chain outside the devlink lock The esw mode change notifier chain is initialized/cleaned up in mlx5_init_one() / mlx5_uninit_one() with the devlink lock held. Move the notifier head from the eswitch struct into mlx5_priv directly, and initialize it outside the critical section. This will allow notifier registration to happen earlier in the init procedure in subsequent patches. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763325940-1231508-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit b6b03097f9826db72aeb3f751774c5e9edd9a5b3 Author: Cosmin Ratiu Date: Sun Nov 16 22:45:35 2025 +0200 net/mlx5: Initialize events outside devlink lock Move event init/cleanup outside of mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions. By doing this, we avoid the events being reinitialized on devlink reload and, more importantly, the events->sw_nh notifier chain becomes available earlier in the init procedure, which will be used in subsequent patches. This makes sense because the events struct is pure software, independent of any HW details. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763325940-1231508-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit beabc06ffb1b98ec8ef9cf5647b8d3c97a2436b3 Merge: 7c9dd386020db9 5d7fc63ab84182 Author: Jakub Kicinski Date: Wed Nov 19 20:29:29 2025 -0800 Merge branch 'net-adjust-conservative-values-around-napi' Jason Xing says: ==================== net: adjust conservative values around napi This series keeps at least 96 skbs per cpu and frees 32 skbs at one time in conclusion. More initial discussions with Eric can be seen at the link [1]. [1]: https://lore.kernel.org/all/CAL+tcoBEEjO=-yvE7ZJ4sB2smVBzUht1gJN85CenJhOKV==================== Link: https://patch.msgid.link/20251118070646.61344-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 5d7fc63ab84182f75d5e73e299ce0e7c9c20c092 Author: Jason Xing Date: Tue Nov 18 15:06:46 2025 +0800 net: prefetch the next skb in napi_skb_cache_get() After getting the current skb in napi_skb_cache_get(), the next skb in cache is highly likely to be used soon, so prefetch would be helpful. Suggested-by: Eric Dumazet Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251118070646.61344-5-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 2d67b5c5c67f934c54a55e00ee291a8587c5b4fe Author: Jason Xing Date: Tue Nov 18 15:06:45 2025 +0800 net: use NAPI_SKB_CACHE_FREE to keep 32 as default to do bulk free - Replace NAPI_SKB_CACHE_HALF with NAPI_SKB_CACHE_FREE - Only free 32 skbs in napi_skb_cache_put() Since the first patch adjusting NAPI_SKB_CACHE_SIZE to 128, the number of packets to be freed in the softirq was increased from 32 to 64. Considering a subsequent net_rx_action() calling napi_poll() a few times can easily consume the 64 available slots and we can afford keeping a higher value of sk_buffs in per-cpu storage, decrease NAPI_SKB_CACHE_FREE to 32 like before. So now the logic is 1) keeping 96 skbs, 2) freeing 32 skbs at one time. Suggested-by: Eric Dumazet Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251118070646.61344-4-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 01d7385618992a9017198534870aec62f54f963a Author: Jason Xing Date: Tue Nov 18 15:06:44 2025 +0800 net: increase default NAPI_SKB_CACHE_BULK to 32 The previous value 16 is a bit conservative, so adjust it along with NAPI_SKB_CACHE_SIZE, which can minimize triggering memory allocation in napi_skb_cache_get*(). Suggested-by: Eric Dumazet Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251118070646.61344-3-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 3505730d9042a8d26e89288ecab04e5d32794e4a Author: Jason Xing Date: Tue Nov 18 15:06:43 2025 +0800 net: increase default NAPI_SKB_CACHE_SIZE to 128 After commit b61785852ed0 ("net: increase skb_defer_max default to 128") changed the value sysctl_skb_defer_max to avoid many calls to kick_defer_list_purge(), the same situation can be applied to NAPI_SKB_CACHE_SIZE that was proposed in 2016. It's a trade-off between using pre-allocated memory in skb_cache and saving more a bit heavy function calls in the softirq context. With this patch applied, we can have more skbs per-cpu to accelerate the sending path that needs to acquire new skbs. Suggested-by: Eric Dumazet Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251118070646.61344-2-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 7c9dd386020db9c46b7faf5c6fa928df2831b6fb Merge: 672cb5c2a95848 4465ae435ddc01 Author: Jakub Kicinski Date: Wed Nov 19 20:24:25 2025 -0800 Merge branch 'disable-clkout-on-rtl8211f-d-i-vd-cg' Vladimir Oltean says: ==================== Disable CLKOUT on RTL8211F(D)(I)-VD-CG The Realtek RTL8211F(D)(I)-VD-CG is similar to other RTL8211F models in that the CLKOUT signal can be turned off - a feature requested to reduce EMI, and implemented via "realtek,clkout-disable" as documented in Documentation/devicetree/bindings/net/realtek,rtl82xx.yaml. It is also dissimilar to said PHY models because it has no PHYCR2 register, and disabling CLKOUT is done through some other register. The strategy adopted in this 6-patch series is to make the PHY driver not think in terms of "priv->has_phycr2" and "priv->phycr2", but of more high-level features ("priv->disable_clk_out") while maintaining behaviour. Then, the logic is extended for the new PHY. Very loosely based on previous work from Clark Wang, who took a different approach, to pretend that the RTL8211FVD_CLKOUT_REG is actually this PHY's PHYCR2. ==================== Link: https://patch.msgid.link/20251117234033.345679-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4465ae435ddc0162d5033a543658449d53d46d08 Author: Vladimir Oltean Date: Tue Nov 18 01:40:33 2025 +0200 net: phy: realtek: create rtl8211f_config_phy_eee() helper To simplify the rtl8211f_config_init() control flow and get rid of "early" returns for PHYs where the PHYCR2 register is absent, move the entire logic sub-block that deals with disabling PHY-mode EEE to a separate function. There, it is much more obvious what the early "return 0" skips, and it becomes more difficult to accidentally skip unintended stuff. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251117234033.345679-7-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit bb78b71faf60d11a15f07e3390fcfd31e5e523bb Author: Vladimir Oltean Date: Tue Nov 18 01:40:32 2025 +0200 net: phy: realtek: eliminate priv->phycr1 variable Previous changes have replaced the machine-level priv->phycr2 with a high-level priv->disable_clk_out. This created a discrepancy with priv->phycr1 which is resolved here, for uniformity. One advantage of this new implementation is that we don't read priv->phycr1 in rtl821x_probe() if we're never going to modify it. We never test the positive return code from phy_modify_mmd_changed(), so we could just as well use phy_modify_mmd(). I took the ALDPS feature description from commit d90db36a9e74 ("net: phy: realtek: add dt property to enable ALDPS mode") and transformed it into a function comment - the feature is sufficiently non-obvious to deserve that. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251117234033.345679-6-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit e1a31c41bef678afe0d99b7f0dc3711a80c68447 Author: Vladimir Oltean Date: Tue Nov 18 01:40:31 2025 +0200 net: phy: realtek: allow CLKOUT to be disabled on RTL8211F(D)(I)-VD-CG Add CLKOUT disable support for RTL8211F(D)(I)-VD-CG. Like with other PHY variants, this feature might be requested by customers when the clock output is not used, in order to reduce electromagnetic interference (EMI). In the common driver, the CLKOUT configuration is done through PHYCR2. The RTL_8211FVD_PHYID is singled out as not having that register, and execution in rtl8211f_config_init() returns early after commit 2c67301584f2 ("net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present"). But actually CLKOUT is configured through a different register for this PHY. Instead of pretending this is PHYCR2 (which it is not), just add some code for modifying this register inside the rtl8211f_disable_clk_out() function, and move that outside the code portion that runs only if PHYCR2 exists. In practice this reorders the PHYCR2 writes to disable PHY-mode EEE and to disable the CLKOUT for the normal RTL8211F variants, but this should be perfectly fine. It was not noted that RTL8211F(D)(I)-VD-CG would need a genphy_soft_reset() call after disabling the CLKOUT. Despite that, we do it out of caution and for symmetry with the other RTL8211F models. Co-developed-by: Clark Wang Signed-off-by: Clark Wang Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251117234033.345679-5-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 910ac7bfb1af1ae4cd141ef80e03a6729213c189 Author: Vladimir Oltean Date: Tue Nov 18 01:40:30 2025 +0200 net: phy: realtek: eliminate has_phycr2 variable This variable is assigned in rtl821x_probe() and used in rtl8211f_config_init(), which is more complex than it needs to be. Simply testing the same condition from rtl821x_probe() in rtl8211f_config_init() yields the same result (the PHY driver ID is a runtime invariant), but with one temporary variable less. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251117234033.345679-4-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 27033d06917758d47162581da7e9de8004049dee Author: Vladimir Oltean Date: Tue Nov 18 01:40:29 2025 +0200 net: phy: realtek: eliminate priv->phycr2 variable The RTL8211F(D)(I)-VD-CG PHY also has support for disabling the CLKOUT, and we'd like to introduce the "realtek,clkout-disable" property for that. But it isn't done through the PHYCR2 register, and it becomes awkward to have the driver pretend that it is. So just replace the machine-level "u16 phycr2" variable with a logical "bool disable_clk_out", which scales better to the other PHY as well. The change is a complete functional equivalent. Before, if the device tree property was absent, priv->phycr2 would contain the RTL8211F_CLKOUT_EN bit as read from hardware. Now, we don't save priv->phycr2, but we just don't call phy_modify_paged() on it. Also, we can simply call phy_modify_paged() with the "set" argument to 0. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251117234033.345679-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 8e982441ba601d982dd0739972115d85ae01d99b Author: Vladimir Oltean Date: Tue Nov 18 01:40:28 2025 +0200 net: phy: realtek: create rtl8211f_config_rgmii_delay() The control flow in rtl8211f_config_init() has some pitfalls which were probably unintended. Specifically it has an early return: switch (phydev->interface) { ... default: /* the rest of the modes imply leaving delay as is. */ return 0; } which exits the entire config_init() function. This means it also skips doing things such as disabling CLKOUT or disabling PHY-mode EEE. For the RTL8211FS, which uses PHY_INTERFACE_MODE_SGMII, this might be a problem. However, I don't know that it is, so there is no Fixes: tag. The issue was observed through code inspection. Signed-off-by: Vladimir Oltean Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251117234033.345679-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 672cb5c2a9584802ad43d61209d5e24cccee823d Author: Breno Leitao Date: Tue Nov 18 01:44:56 2025 -0800 net: vmxnet3: convert to use .get_rx_ring_count Convert the vmxnet3 driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc solely for handling ETHTOOL_GRXRINGS command. This simplifies the code by removing the switch statement and replacing it with a direct return of the queue count. The new callback provides the same functionality in a more direct way, following the ongoing ethtool API modernization. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251118-vmxnet3_grxrings-v1-1-ed8abddd2d52@debian.org Signed-off-by: Jakub Kicinski commit 6152f41da624a7b2fd854fe1216a327b8eb15f8d Merge: 929ca3bceab8ea 45120304e84171 Author: Jakub Kicinski Date: Wed Nov 19 20:12:01 2025 -0800 Merge branch 'net-mana-enforce-tx-sge-limit-and-fix-error-cleanup' Aditya Garg says: ==================== net: mana: Enforce TX SGE limit and fix error cleanup Add pre-transmission checks to block SKBs that exceed the hardware's SGE limit. Force software segmentation for GSO traffic and linearize non-GSO packets as needed. Update TX error handling to drop failed SKBs and unmap resources immediately. ==================== Link: https://patch.msgid.link/1763464269-10431-1-git-send-email-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 45120304e84171fd215c1b57b15b285446d15106 Author: Aditya Garg Date: Tue Nov 18 03:11:09 2025 -0800 net: mana: Drop TX skb on post_work_request failure and unmap resources Drop TX packets when posting the work request fails and ensure DMA mappings are always cleaned up. Signed-off-by: Aditya Garg Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/1763464269-10431-3-git-send-email-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 934fa943b53795339486cc0026b3ab7ad39dc600 Author: Aditya Garg Date: Tue Nov 18 03:11:08 2025 -0800 net: mana: Handle SKB if TX SGEs exceed hardware limit The MANA hardware supports a maximum of 30 scatter-gather entries (SGEs) per TX WQE. Exceeding this limit can cause TX failures. Add ndo_features_check() callback to validate SKB layout before transmission. For GSO SKBs that would exceed the hardware SGE limit, clear NETIF_F_GSO_MASK to enforce software segmentation in the stack. Add a fallback in mana_start_xmit() to linearize non-GSO SKBs that still exceed the SGE limit. Also, Add ethtool counter for SKBs linearized Co-developed-by: Dipayaan Roy Signed-off-by: Dipayaan Roy Signed-off-by: Aditya Garg Reviewed-by: Eric Dumazet Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/1763464269-10431-2-git-send-email-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 929ca3bceab8eaeeb452c0574999c7c6d12b3772 Author: Anshumali Gaur Date: Tue Nov 18 11:12:34 2025 +0530 octeontx2-af: Skip TM tree print for disabled SQs Currently, the TM tree is printing all SQ topology including those which are not enabled, this results in redundant output for SQs which are not active. This patch adds a check in print_tm_tree() to skip printing the TM tree hierarchy if the SQ is not enabled. Signed-off-by: Anshumali Gaur Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251118054235.1599714-1-agaur@marvell.com Signed-off-by: Jakub Kicinski commit 38725491e7665640545c8155db53a7b21bcdf886 Author: Bart Van Assche Date: Wed Nov 19 08:57:32 2025 -0800 scsi: MAINTAINERS: Add the UFS include directory Make sure that the linux-scsi mailing list is Cc-ed for changes to UFS include headers. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251119165742.536170-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit e54f7b4b8159d76d601788ca61267247fac67abf Merge: 13b77ed9c2a9e5 a2b32bc1d9e359 Author: Martin K. Petersen Date: Wed Nov 19 22:59:25 2025 -0500 Merge branch 6.18/scsi-fixes into 6.19/scsi-staging Pull in fixes branch to resolve UFS merge conflict. Signed-off-by: Martin K. Petersen commit 13b77ed9c2a9e5a1248222df8aeaecb0c2ead9cb Author: Bart Van Assche Date: Thu Nov 13 09:41:51 2025 -0800 scsi: scsi_debug: Support injecting unaligned write errors Allow user space software, e.g. a blktests test, to inject unaligned write errors. Acked-by: Douglas Gilbert Reviewed-by: Damien Le Moal Cc: Martin K. Petersen Cc: Christoph Hellwig Cc: Ming Lei Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251113174151.1095574-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 78b1a242fe612a755f2158fd206ee6bb577d18ca Author: Zilin Guan Date: Thu Nov 13 15:12:46 2025 +0000 scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc(). An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption. Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Signed-off-by: Zilin Guan Reviewed-by: Himanshu Madhani Link: https://patch.msgid.link/20251113151246.762510-1-zilin@seu.edu.cn Signed-off-by: Martin K. Petersen commit cda5f23eed84cdca374d60734bf0190138788608 Author: Shawn Lin Date: Thu Nov 13 13:18:11 2025 +0800 scsi: ufs: rockchip: Fix compile error without CONFIG_GPIOLIB drivers/ufs/host/ufs-rockchip.c:168:19: error: implicit declaration of function 'devm_gpiod_get'; did you mean 'em_pd_get'? [-Werror=implicit-function-declaration] drivers/ufs/host/ufs-rockchip.c:214:2: error: implicit declaration of function 'gpiod_set_value_cansleep'; did you mean 'gpio_set_value_cansleep'? [-Werror=implicit-function-declaration] Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511130238.LlA0MKxW-lkp@intel.com/ Signed-off-by: Shawn Lin Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/1763011091-243727-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Martin K. Petersen commit b0ee72db9132bd19b1b80152b35e0cf6a6cbd9f2 Author: Shawn Lin Date: Thu Nov 13 12:52:55 2025 +0800 scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify This fixes the dme-reset failed when doing recovery. Because device reset is not enough, we could occasionally see the error below: ufshcd-rockchip 2a2d0000.ufs: uic cmd 0x14 with arg3 0x0 completion timeout ufshcd-rockchip 2a2d0000.ufs: dme-reset: error code -110 ufshcd-rockchip 2a2d0000.ufs: DME_RESET failed ufshcd-rockchip 2a2d0000.ufs: ufshcd_host_reset_and_restore: Host init failed -110 Fix this by resetting the controller on PRE_CHANGE stage of hce enable notify. Fixes: d3cbe455d6eb ("scsi: ufs: rockchip: Initial support for UFS") Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1763009575-237552-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Martin K. Petersen commit bc41fbbf6faa9ffeaf0148019ed631077f7f150f Author: Sjoerd Simons Date: Sat Nov 15 21:58:09 2025 +0100 dt-bindings: net: mediatek,net: Correct bindings for MT7981 Different SoCs have different numbers of Wireless Ethernet Dispatch (WED) units: - MT7981: Has 1 WED unit - MT7986: Has 2 WED units - MT7988: Has 2 WED units Update the binding to reflect these hardware differences. The MT7981 also uses infracfg for PHY switching, so allow that property. Signed-off-by: Sjoerd Simons Acked-by: Conor Dooley Link: https://patch.msgid.link/20251115-openwrt-one-network-v4-6-48cbda2969ac@collabora.com Signed-off-by: Jakub Kicinski commit d53b4996584b448c5427ba9ab3ec06ec43190043 Author: Ian Rogers Date: Fri Nov 14 14:05:47 2025 -0800 perf evsel: Skip store_evsel_ids for non-perf-event PMUs The IDs are associated with perf events and not applicable to non-perf event PMUs. The failure to generate the ids was causing perf stat record to fail. ``` $ perf stat record -a sleep 1 Performance counter stats for 'system wide': 47,941 context-switches # nan cs/sec cs_per_second 0.00 msec cpu-clock # 0.0 CPUs CPUs_utilized 3,261 cpu-migrations # nan migrations/sec migrations_per_second 516 page-faults # nan faults/sec page_faults_per_second 7,525,483 cpu_core/branch-misses/ # 2.3 % branch_miss_rate 322,069,004 cpu_core/branches/ # nan M/sec branch_frequency 1,895,684,291 cpu_core/cpu-cycles/ # nan GHz cycles_frequency 2,789,777,426 cpu_core/instructions/ # 1.5 instructions insn_per_cycle 7,074,765 cpu_atom/branch-misses/ # 3.2 % branch_miss_rate (49.89%) 224,225,412 cpu_atom/branches/ # nan M/sec branch_frequency (50.29%) 2,061,679,981 cpu_atom/cpu-cycles/ # nan GHz cycles_frequency (50.33%) 2,011,242,533 cpu_atom/instructions/ # 1.0 instructions insn_per_cycle (50.33%) TopdownL1 (cpu_core) # 9.0 % tma_bad_speculation # 28.3 % tma_frontend_bound # 35.2 % tma_backend_bound # 27.5 % tma_retiring TopdownL1 (cpu_atom) # 36.8 % tma_backend_bound (59.65%) # 22.8 % tma_frontend_bound (59.60%) # 11.6 % tma_bad_speculation # 28.8 % tma_retiring (59.59%) 1.006777519 seconds time elapsed $ perf stat report Performance counter stats for 'perf': 1,013,376,154 duration_time duration_time duration_time duration_time duration_time duration_time 47,941 context-switches 0.00 msec cpu-clock 3,261 cpu-migrations 516 page-faults 7,525,483 cpu_core/branch-misses/ 322,069,814 cpu_core/branches/ 322,069,004 cpu_core/branches/ 1,895,684,291 cpu_core/cpu-cycles/ 1,895,679,209 cpu_core/cpu-cycles/ 2,789,777,426 cpu_core/instructions/ cpu_core/cpu-cycles/ cpu_core/stalled-cycles-frontend/ cpu_core/cpu-cycles/ cpu_core/stalled-cycles-backend/ cpu_core/stalled-cycles-backend/ cpu_core/instructions/ cpu_core/stalled-cycles-frontend/ 7,074,765 cpu_atom/branch-misses/ (49.89%) 221,679,088 cpu_atom/branches/ (49.89%) 224,225,412 cpu_atom/branches/ (50.29%) 2,061,679,981 cpu_atom/cpu-cycles/ (50.33%) 2,016,259,567 cpu_atom/cpu-cycles/ (50.33%) 2,011,242,533 cpu_atom/instructions/ (50.33%) cpu_atom/cpu-cycles/ cpu_atom/stalled-cycles-frontend/ cpu_atom/cpu-cycles/ cpu_atom/stalled-cycles-backend/ cpu_atom/stalled-cycles-backend/ cpu_atom/instructions/ cpu_atom/stalled-cycles-frontend/ 17,145,113 cpu_core/INT_MISC.UOP_DROPPING/ 10,594,226,100 cpu_core/TOPDOWN.SLOTS/ 2,919,021,401 cpu_core/topdown-retiring/ 943,101,838 cpu_core/topdown-bad-spec/ 3,031,152,533 cpu_core/topdown-fe-bound/ 3,739,756,791 cpu_core/topdown-be-bound/ 1,909,501,648 cpu_atom/CPU_CLK_UNHALTED.CORE/ (60.04%) 3,516,608,359 cpu_atom/TOPDOWN_BE_BOUND.ALL/ (59.65%) 2,179,403,876 cpu_atom/TOPDOWN_FE_BOUND.ALL/ (59.60%) 2,745,732,458 cpu_atom/TOPDOWN_RETIRING.ALL/ (59.59%) 1.006777519 seconds time elapsed Some events weren't counted. Try disabling the NMI watchdog: echo 0 > /proc/sys/kernel/nmi_watchdog perf stat ... echo 1 > /proc/sys/kernel/nmi_watchdog ``` Reported-by: James Clark Closes: https://lore.kernel.org/lkml/ca0f0cd3-7335-48f9-8737-2f70a75b019a@linaro.org/ Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit f0feb21e0a10c50e3a154e9bdf3fbb8a38480251 Author: Ian Rogers Date: Fri Nov 14 14:05:46 2025 -0800 perf pmu: Add PMU kind to simplify differentiating Rather than perf_pmu__is_xxx calls, and a notion of kind so that a single call can be used. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 1a6b0deb2b71d6e94497a284b9babce80b18cc7c Author: Ian Rogers Date: Fri Nov 14 14:05:45 2025 -0800 perf header: Switch "cpu" for find_core_pmu in caps feature writing Writing currently fails on non-x86 and hybrid CPUs. Switch to the more regular find_core_pmu that is normally used in this case. Tested on hybrid alderlake system. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit f0ded972d37150f9f889de75c9eecc5cb0730013 Merge: f3a1d69f9b3882 77b686f688126a Author: Dave Airlie Date: Thu Nov 20 10:42:50 2025 +1000 Merge tag 'drm-rust-next-2025-11-18' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next Cross-subsystem Changes: Rust - Make slice::as_flattened usable on all supported versions of rustc. - Add FromBytes::from_bytes_prefix() method. Core Changes: - Update Tyr in MAINTAINERS file. - Remove redundant device ptr from Rust GEM object. - Change how AlwaysRefCounted is implemented for GEM objects. - Add deferred vm_bo cleanup to GPUVM and use it in Panthor. Driver Changes: Nova Core - Introduction of bitfield! macro, with support for different storage sizes and custom visibility. - Introduction of safe converters between integer types for which the conversion is lossless. - GSP initialized up to fully booted state on Ampere. - Use more future-proof register for GPU identification. - Various simplifications and optimizations. Nova - Select NOVA_CORE. - Depend on CONFIG_64BIT. Signed-off-by: Dave Airlie From: Alice Ryhl Link: https://patch.msgid.link/aRxtJC0D1pQUepF4@google.com commit 36434959b6ea13d32343f4ec5fa3fb0d0120da2f Author: Ian Rogers Date: Tue Nov 18 21:05:55 2025 -0800 perf test maps: Additional maps__fixup_overlap_and_insert tests Add additional test to the maps covering maps__fixup_overlap_and_insert. Change the test suite to be for more than just 1 test. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 245cfbcd3d3b298c75e01946262b3ff2cf7d0796 Author: Ian Rogers Date: Tue Nov 18 21:05:54 2025 -0800 perf maps: Avoid RC_CHK use after free The case of __maps__fixup_overlap_and_insert where the "new" maps covers existing mappings can create a use-after-free with reference count checking enabled. The issue is that "pos" holds a map pointer from maps_by_address that is put from maps_by_address but then used to look for a map in maps_by_name (the compared map is now a use-after-free). The issue stems from using maps__remove which redoes some of the searches already done by __maps__fixup_overlap_and_insert, so optimize the code (by avoiding repeated searches) and avoid the use-after-free by inlining the appropriate removal code. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202511141407.f9edcfa6-lkp@intel.com Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit bdf96e9135a0cf53a853a19c30fa11131a744062 Author: Jonathan Marek Date: Mon Nov 17 00:15:21 2025 -0500 ASoC: codecs: lpass-rx-macro: fix mute_stream affecting all paths The current mute_steam() implementation affects all paths instead of only those in use by the DAI. For example, playing to 2 DAIs simultaneously with mixing, stopping one will mute the other. Rework to use the same logic as hw_params() to mute only the relevant paths. (also, use "rx->main_clk_users[j] > 0" instead of dsm_reg, which is equivalent. I also don't think the clock enable should be in this function, but that's a change for another patch) Signed-off-by: Jonathan Marek Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-9-jonathan@marek.ca Signed-off-by: Mark Brown commit 50c28498e9fd6784dea82378d509572d118111f9 Author: Jonathan Marek Date: Mon Nov 17 00:15:20 2025 -0500 ASoC: codecs: lpass-wsa-macro: remove unused WSA_MACRO_RX_MIX enum Minor cleanup. Signed-off-by: Jonathan Marek Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-8-jonathan@marek.ca Signed-off-by: Mark Brown commit 7ec95f46759ba0843a2695decba3cea028cb84ea Author: Jonathan Marek Date: Mon Nov 17 00:15:18 2025 -0500 ASoC: codecs: lpass-wsa-macro: remove main path event The event enables the main path clock when the mux is set to DEC0/DEC1. My patch ("ASoC: codecs: lpass-wsa-macro: fix path clock dependencies") makes it depend on the main path clock, so this event is now redundant. Signed-off-by: Jonathan Marek Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-6-jonathan@marek.ca Signed-off-by: Mark Brown commit da49a21b3fe9fbee7be0418916c43f27ed91ad0a Author: Jonathan Marek Date: Mon Nov 17 00:15:17 2025 -0500 ASoC: codecs: lpass-wsa-macro: add volume controls for mix path This allows changing the mix gain registers from the default value. Signed-off-by: Jonathan Marek Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-5-jonathan@marek.ca Signed-off-by: Mark Brown commit 3ea1b0dbc684191b2e0b5697356a74571ab28155 Author: Jonathan Marek Date: Mon Nov 17 00:15:16 2025 -0500 ASoC: codecs: lpass-wsa-macro: fix path clock dependencies "WSA_RX0_CLK",etc. are path clocks, but "WSA RX0",etc. are ports, and there isn't a correspondence between the ports and paths. For example "WSA RX0" port could be used by the "RX1 MIX" path. The problem becomes obvious when RX4,etc. ports are added. Enabling the path clocks should depend on the path being enabled. With this fix, the main path clock will be enabled whenever the path is active: previously using the mix ports only would only activate the mix path clock and no audio would play. Signed-off-by: Jonathan Marek Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-4-jonathan@marek.ca Signed-off-by: Mark Brown commit c47f28ef62cb03de1e5a97844a90eda0415da233 Author: Jonathan Marek Date: Mon Nov 17 00:15:15 2025 -0500 ASoC: codecs: lpass-wsa-macro: remove mix path event All it does it disable the mix path clk bit, but this is already managed by the WSA_RX_MIX0_CLK/WSA_RX_MIX1_CLK supplies. Signed-off-by: Jonathan Marek Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-3-jonathan@marek.ca Signed-off-by: Mark Brown commit 902f497a1ff5d275d2f48c2422d8a9eaa2174dee Author: Jonathan Marek Date: Mon Nov 17 00:15:14 2025 -0500 ASoC: codecs: lpass-wsa-macro: remove useless gain read/write sequence Reading and writing the same value to this register does nothing. Looking at downstream driver it seems there was meant to be an offset added Signed-off-by: Jonathan Marek Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla > --- Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-2-jonathan@marek.ca Signed-off-by: Mark Brown commit 38fc5addd2a0e51ba750c1a401efe7e3c84a2916 Author: Jonathan Marek Date: Mon Nov 17 00:15:13 2025 -0500 ASoC: codecs: lpass-wsa-macro: remove unnecessary bounds check WSA_MACRO_RX0 is 0 and WSA_MACRO_RX_MIX1 is (WSA_MACRO_RX_MAX-1), which means it is not possible for the bounds check to fail. Removing the WSA_MACRO_RX_MIX1 limit is needed to add support for other ports (RX4, RX5, etc.), in which case the valid range depends on the HW version: rely on the driver only setting valid ports in active_ch_mask instead (already the case). Signed-off-by: Jonathan Marek Tested-by: Srinivas Kandagatla Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251117051523.16462-1-jonathan@marek.ca Signed-off-by: Mark Brown commit a846505a193d7492ad3531e33cacfca31e4bcdd1 Author: Miaoqian Lin Date: Wed Oct 29 15:23:06 2025 +0800 drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() The function mtk_dp_dt_parse() calls of_graph_get_endpoint_by_regs() to get the endpoint device node, but fails to call of_node_put() to release the reference when the function returns. This results in a device node reference leak. Fix this by adding the missing of_node_put() call before returning from the function. Found via static analysis and code review. Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Markus Schneider-Pargmann Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20251029072307.10955-1-linmq006@gmail.com/ Signed-off-by: Chun-Kuang Hu commit a2f7990d330937a204b86b9cafbfef82f87a8693 Author: Masami Hiramatsu (Google) Date: Wed Nov 12 22:13:01 2025 +0900 selftests: tracing: Update fprobe selftest for ftrace based fprobe Since the ftrace fprobe is both fgraph and ftrace based implemented, the selftest needs to be updated. This does not count the actual number of lines, but just check the differences. Link: https://lore.kernel.org/r/176295318112.431538.11780280333728368327.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Shuah Khan commit a1ca238936aee3898216f6f7b2f91771aa858504 Author: Masami Hiramatsu (Google) Date: Fri Nov 7 23:35:01 2025 +0900 selftests: tracing: Add tprobe enable/disable testcase Commit 2867495dea86 ("tracing: tprobe-events: Register tracepoint when enable tprobe event") caused regression bug and tprobe did not work. To prevent similar problems, add a testcase which enables/disables a tprobe and check the results. Link: https://lore.kernel.org/r/176252610176.214996.3978515319000806265.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Shuah Khan commit 150ec68fa799dedb62ec89fba5887d0c93c28a1b Author: Viacheslav Dubeyko Date: Fri Sep 12 15:50:23 2025 -0700 hfs: introduce KUnit tests for HFS string operations This patch implements the initial Kunit based set of unit tests for HFS string operations. It checks functionality of hfs_strcmp(), hfs_hash_dentry(), and hfs_compare_dentry() methods. ./tools/testing/kunit/kunit.py run --kunitconfig ./fs/hfs/.kunitconfig [16:04:50] Configuring KUnit Kernel ... Regenerating .config ... Populating config with: $ make ARCH=um O=.kunit olddefconfig [16:04:51] Building KUnit Kernel ... Populating config with: $ make ARCH=um O=.kunit olddefconfig Building with: $ make all compile_commands.json scripts_gdb ARCH=um O=.kunit --jobs=22 [16:04:59] Starting KUnit Kernel (1/1)... [16:04:59] ============================================================ Running tests with: $ .kunit/linux kunit.enable=1 mem=1G console=tty kunit_shutdown=halt [16:04:59] ================= hfs_string (3 subtests) ================== [16:04:59] [PASSED] hfs_strcmp_test [16:04:59] [PASSED] hfs_hash_dentry_test [16:04:59] [PASSED] hfs_compare_dentry_test [16:04:59] =================== [PASSED] hfs_string ==================== [16:04:59] ============================================================ [16:04:59] Testing complete. Ran 3 tests: passed: 3 [16:04:59] Elapsed time: 9.087s total, 1.310s configuring, 7.611s building, 0.125s running v2 Fix linker error. v3 Chen Linxuan suggested to use EXPORT_SYMBOL_IF_KUNIT. Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org cc: Chen Linxuan Reviewed-by: Chen Linxuan Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250912225022.1083313-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit a5387fbc66486a54add1db74a11c12f383a44987 Author: Rob Herring (Arm) Date: Wed Oct 29 13:55:01 2025 -0500 dt-bindings: fpga: Convert lattice,ice40-fpga-mgr to DT schema Convert the lattice,ice40-fpga-mgr binding to DT schema format. It's a straight-forward conversion. Link: https://patch.msgid.link/20251029185503.2124434-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit f0585a714a7531afaa23b3351a316f61ccaa7b00 Author: Paolo Bonzini Date: Thu Nov 13 19:36:32 2025 -0500 KVM: x86: Add emulator support for decoding VEX prefixes After all the changes done in the previous patches, the only thing left to support AVX MOV instructions is to expand the VEX prefix into the appropriate REX, 66/F3/F2 and map prefixes. Three-operand instructions are not supported. The Avx bit in this case is not cleared, in fact it is used as the sign that the instruction does support VEX encoding. Until it is added to any instruction, however, the only functional change is to change some not-implemented instructions to #UD if they correspond to a VEX prefix with an invalid map. Co-developed-by: Keith Busch Signed-off-by: Keith Busch Signed-off-by: Paolo Bonzini Link: https://patch.msgid.link/20251114003633.60689-10-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 825f0aece084ecde02805083d44d08ab189a9249 Author: Chang S. Bae Date: Thu Nov 13 19:36:31 2025 -0500 KVM: x86: Refactor REX prefix handling in instruction emulation Restructure how to represent and interpret REX fields, preparing for handling of both REX2 and VEX. REX uses the upper four bits of a single byte as a fixed identifier, and the lower four bits containing the data. VEX and REX2 extends this so that the first byte identifies the prefix and the rest encode additional bits; and while VEX only has the same four data bits as REX, eight zero bits are a valid value for the data bits of REX2. So, stop storing the REX byte as-is. Instead, store only the low bits of the REX prefix and track separately whether a REX-like prefix was used. No functional changes intended. Signed-off-by: Chang S. Bae Message-ID: <20251110180131.28264-11-chang.seok.bae@intel.com> [Extracted from APX series; removed bitfields and REX2-specific default. - Paolo] Signed-off-by: Paolo Bonzini Link: https://patch.msgid.link/20251114003633.60689-9-pbonzini@redhat.com [sean: name REX_{BXRW} enum "rex_bits"] Signed-off-by: Sean Christopherson commit ee9b603ad43f9870eb75184f9fb0a84f8c3cc852 Author: Shikang Fan Date: Wed Nov 19 18:05:10 2025 +0800 drm/amdgpu: Add sriov vf check for VCN per queue reset support. Add SRIOV check when setting VCN ring's supported reset mask. Signed-off-by: Shikang Fan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 0db94da5a0a1cacda080b9ec8425fcbe4babc141 Author: Srinivasan Shanmugam Date: Tue Nov 18 14:28:33 2025 +0530 drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags The MMIO_REMAP BO is a special 4K IO page that does not have a ttm_tt behind it. However, amdgpu_ttm_tt_pde_flags() was treating it like normal TT/doorbell/preempt memory and unconditionally accessed ttm->caching. For the MMIO_REMAP BO, ttm is NULL, so this leads to a NULL pointer dereference when computing PDE flags. Fix this by checking that ttm is non-NULL before reading ttm->caching. This prevents the crash for MMIO_REMAP and also makes the code more defensive if other BOs ever come through without a ttm_tt. Fixes: fb5a52dbe9fe ("drm/amdgpu: Implement TTM handling for MMIO_REMAP placement") Suggested-by: Jesse Zhang Suggested-by: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Jesse Zhang Tested-by: Jesse Zhang Signed-off-by: Alex Deucher commit 8feeab26c80635b802f72b3ed986c693ff8f3212 Author: Timur Kristóf Date: Wed Nov 19 10:25:42 2025 +0100 drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag This fixes sparse mappings (aka. partially resident textures). Check the correct flags. Since a recent refactor, the code works with uAPI flags (for mapping buffer objects), and not PTE (page table entry) flags. Fixes: 6716a823d18d ("drm/amdgpu: rework how PTE flags are generated v3") Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 8366cd442d226463e673bed5d199df916f4ecbcf Author: Yifan Zha Date: Fri Nov 14 17:48:58 2025 +0800 drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled [Why] Accoreding to CP updated to RS64 on gfx11, WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW. That packet is used for MCBP on F32 based system. So it would lead to incorrect GRBM write and FW is not handling that extra case correctly. [How] With gfx11 rs64 enabled, skip emit de meta data. Signed-off-by: Yifan Zha Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 2a6c826cfeedd7714611ac115371a959ead55bda Author: Mario Limonciello Date: Tue Nov 18 07:18:10 2025 -0600 drm/amd: Skip power ungate during suspend for VPE During the suspend sequence VPE is already going to be power gated as part of vpe_suspend(). It's unnecessary to call during calls to amdgpu_device_set_pg_state(). It actually can expose a race condition with the firmware if s0i3 sequence starts as well. Drop these calls. Cc: Peyton.Lee@amd.com Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 4cb21be4c3b0cb6248da1dcc4f19f05d3443a235 Author: Paolo Bonzini Date: Thu Nov 13 19:36:30 2025 -0500 KVM: x86: Add AVX support to the emulator's register fetch and writeback Prepare struct operand for hosting AVX registers. Remove the existing, incomplete code that placed the Avx flag in the operand alignment field, and repurpose the name for a separate bit that indicates: - after decode, whether an instruction supports the VEX prefix; - before writeback, that the instruction did have the VEX prefix and therefore 1) it can have op_bytes == 32; 2) t should clear high bytes of XMM registers. Right now the bit will never be set and the patch has no intended functional change. However, this is actually more vexing than the decoder changes itself, and therefore worth separating. Co-developed-by: Keith Busch Signed-off-by: Keith Busch Signed-off-by: Paolo Bonzini Link: https://patch.msgid.link/20251114003633.60689-8-pbonzini@redhat.com [sean: guard ymm[8-15] accesses with #ifdef CONFIG_X86_64] Signed-off-by: Sean Christopherson commit f106797f81d633010e6795e34871a31883c9791f Author: Paolo Bonzini Date: Thu Nov 13 19:36:29 2025 -0500 KVM: x86: Add x86_emulate_ops.get_xcr() callback This will be necessary in order to check whether AVX is enabled. Signed-off-by: Paolo Bonzini Reviewed-by: Chang S. Bae Link: https://patch.msgid.link/20251114003633.60689-7-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 7e11eec989c840ff8cd11cee5005c7ce68ef1ab3 Author: Paolo Bonzini Date: Thu Nov 13 19:36:28 2025 -0500 KVM: x86: Share emulator's common register decoding code Remove all duplicate handling of register operands, including picking the right register class and fetching it, by extracting a new function that can be used for both REG and MODRM operands. Centralize setting op->orig_val = op->val in fetch_register_operand() as well. No functional change intended. Signed-off-by: Paolo Bonzini Reviewed-by: Chang S. Bae Link: https://patch.msgid.link/20251114003633.60689-6-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 1a84b07acaa45bb2e4a1d09be26b0ba6270929c3 Author: Paolo Bonzini Date: Thu Nov 13 19:36:27 2025 -0500 KVM: x86: Move op_prefix to struct x86_emulate_ctxt (from x86_decode_insn()) VEX decode will need to set it based on the "pp" bits, so make it a field in the struct rather than a local variable. No functional change intended. Signed-off-by: Paolo Bonzini Reviewed-by: Chang S. Bae Link: https://patch.msgid.link/20251114003633.60689-5-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 3d8834a0d1c984c7bda3d8a4d618026d8b3bcbd3 Author: Paolo Bonzini Date: Thu Nov 13 19:36:26 2025 -0500 KVM: x86: Improve formatting of the emulator's flags table Align a little better the comments on the right side and list explicitly the bits used by multi-bit fields. No functional change intended. Signed-off-by: Paolo Bonzini Reviewed-by: Chang S. Bae Link: https://patch.msgid.link/20251114003633.60689-4-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 3f3fc58df502567fb26703276691299c2b712996 Author: Paolo Bonzini Date: Thu Nov 13 19:36:25 2025 -0500 KVM: x86: Move Src2Shift up one bit (use bits 36:32 for Src2 in the emulator) An irresistible microoptimization (changing accesses to Src2 to just an AND :)) that also frees a bit for AVX in the low flags word. This makes it closer to SSE since both of them can access XMM registers, pointlessly shaving another clock cycle or two (maybe). No functional change intended. Signed-off-by: Paolo Bonzini Reviewed-by: Chang S. Bae commit c57d9bafbd0b89709c1bbbda346cf81dea5a3224 Author: Paolo Bonzini Date: Thu Nov 13 19:36:24 2025 -0500 KVM: x86: Add support for emulating MOVNTDQA MOVNTDQA is a simple MOV instruction, in fact it has the same characteristics as 0F E7 (MOVNTDQ) other than the aligned-address requirement. Signed-off-by: Paolo Bonzini Link: https://patch.msgid.link/20251114003633.60689-2-pbonzini@redhat.com Signed-off-by: Sean Christopherson commit 4ddfab5436b6918ce4e28f610e670e040a304152 Author: Raghavendra Rao Ananta Date: Thu Nov 13 05:24:52 2025 +0000 KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables When a large VM, specifically one that holds a significant number of PTEs, gets abruptly destroyed, the following warning is seen during the page-table walk: sched: CPU 0 need_resched set for > 100018840 ns (100 ticks) without schedule CPU: 0 UID: 0 PID: 9617 Comm: kvm_page_table_ Tainted: G O 6.16.0-smp-DEV #3 NONE Tainted: [O]=OOT_MODULE Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x3c/0xb8 dump_stack+0x18/0x30 resched_latency_warn+0x7c/0x88 sched_tick+0x1c4/0x268 update_process_times+0xa8/0xd8 tick_nohz_handler+0xc8/0x168 __hrtimer_run_queues+0x11c/0x338 hrtimer_interrupt+0x104/0x308 arch_timer_handler_phys+0x40/0x58 handle_percpu_devid_irq+0x8c/0x1b0 generic_handle_domain_irq+0x48/0x78 gic_handle_irq+0x1b8/0x408 call_on_irq_stack+0x24/0x30 do_interrupt_handler+0x54/0x78 el1_interrupt+0x44/0x88 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x84/0x88 stage2_free_walker+0x30/0xa0 (P) __kvm_pgtable_walk+0x11c/0x258 __kvm_pgtable_walk+0x180/0x258 __kvm_pgtable_walk+0x180/0x258 __kvm_pgtable_walk+0x180/0x258 kvm_pgtable_walk+0xc4/0x140 kvm_pgtable_stage2_destroy+0x5c/0xf0 kvm_free_stage2_pgd+0x6c/0xe8 kvm_uninit_stage2_mmu+0x24/0x48 kvm_arch_flush_shadow_all+0x80/0xa0 kvm_mmu_notifier_release+0x38/0x78 __mmu_notifier_release+0x15c/0x250 exit_mmap+0x68/0x400 __mmput+0x38/0x1c8 mmput+0x30/0x68 exit_mm+0xd4/0x198 do_exit+0x1a4/0xb00 do_group_exit+0x8c/0x120 get_signal+0x6d4/0x778 do_signal+0x90/0x718 do_notify_resume+0x70/0x170 el0_svc+0x74/0xd8 el0t_64_sync_handler+0x60/0xc8 el0t_64_sync+0x1b0/0x1b8 The warning is seen majorly on the host kernels that are configured not to force-preempt, such as CONFIG_PREEMPT_NONE=y. To avoid this, instead of walking the entire page-table in one go, split it into smaller ranges, by checking for cond_resched() between each range. Since the path is executed during VM destruction, after the page-table structure is unlinked from the KVM MMU, relying on cond_resched_rwlock_write() isn't necessary. Signed-off-by: Raghavendra Rao Ananta Link: https://msgid.link/20251113052452.975081-4-rananta@google.com Signed-off-by: Oliver Upton commit d68d66e57e2be9541fa67bafabdfe8826bb73799 Author: Raghavendra Rao Ananta Date: Thu Nov 13 05:24:51 2025 +0000 KVM: arm64: Split kvm_pgtable_stage2_destroy() Split kvm_pgtable_stage2_destroy() into two: - kvm_pgtable_stage2_destroy_range(), that performs the page-table walk and free the entries over a range of addresses. - kvm_pgtable_stage2_destroy_pgd(), that frees the PGD. This refactoring enables subsequent patches to free large page-tables in chunks, calling cond_resched() between each chunk, to yield the CPU as necessary. Existing callers of kvm_pgtable_stage2_destroy(), that probably cannot take advantage of this (such as nVMHE), will continue to function as is. Signed-off-by: Raghavendra Rao Ananta Suggested-by: Oliver Upton Link: https://msgid.link/20251113052452.975081-3-rananta@google.com Signed-off-by: Oliver Upton commit 156f70afcfecfc45be5fdc2e4adebc5ea70a93b0 Author: Oliver Upton Date: Wed Nov 19 14:11:50 2025 -0800 KVM: arm64: Only drop references on empty tables in stage2_free_walker A subsequent change to the way KVM frees stage-2s will invoke the free walker on sub-ranges of the VM's IPA space, meaning there's potential for only partially visiting a table's PTEs. Split the leaf and table visitors and only drop references on a table when the page count reaches 1, implying there are no valid PTEs that need to be visited. Invalidate the table PTE to avoid traversing the stale reference. Link: https://msgid.link/20251113052452.975081-2-rananta@google.com Signed-off-by: Oliver Upton commit d9e6269e330392fd75f8d9db268e7e10541a7ba4 Author: Brendan Jackman Date: Tue Nov 11 17:36:42 2025 +0000 selftests/run_kselftest.sh: exit with error if tests fail Parsing KTAP is quite an inconvenience, but most of the time the thing you really want to know is "did anything fail"? Let's give the user the his information without them needing to parse anything. Because of the use of subshells and namespaces, this needs to be communicated via a file. Just write arbitrary data into the file and treat non-empty content as a signal that something failed. In case any user depends on the current behaviour, such as running this from a script with `set -e` and parsing the result for failures afterwards, add a flag they can set to get the old behaviour, namely --no-error-on-fail. Link: https://lore.kernel.org/r/20251111-b4-ksft-error-on-fail-v3-1-0951a51135f6@google.com Signed-off-by: Brendan Jackman Signed-off-by: Shuah Khan commit 26347f844381a5ae870b51efb8a927bc35ab7d42 Author: Zhang Chujun Date: Thu Nov 6 11:30:56 2025 +0800 selftests/dma: fix invalid array access in printf The printf statement attempts to print the DMA direction string using the syntax 'dir[directions]', which is an invalid array access. The variable 'dir' is an integer, and 'directions' is a char pointer array. This incorrect syntax should be 'directions[dir]', using 'dir' as the index into the 'directions' array. Fix this by correcting the array access from 'dir[directions]' to 'directions[dir]'. Link: https://lore.kernel.org/r/20251104025234.2363-1-zhangchujun@cmss.chinamobile.com Signed-off-by: Zhang Chujun Signed-off-by: Shuah Khan commit adf60fda9a5e4b1d8c58da526541c969d69df041 Author: Pierre-Henry Moussay Date: Mon Nov 17 15:27:36 2025 +0000 dt-bindings: interrupt-controller: sifive,plic: Add pic64gx compatibility As mention in sifive,plic-1.0.0.yaml, a specific compatible should be used for pic64gx, so here it is. Signed-off-by: Pierre-Henry Moussay Acked-by: Conor Dooley Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20251117-evict-corridor-5efe40101eea@spud Signed-off-by: Rob Herring (Arm) commit 6ba51b7b34caac6a64efdb5ec49d1c0e45e6197b Author: Geert Uytterhoeven Date: Wed Nov 19 14:19:11 2025 +0100 of/irq: Handle explicit interrupt parent If an interrupt controller is used as a proxy, it may have an "interrupt-parent" property, but lack "interrupts" and "interrupts-extended" properties. In that case, the "interrupt-parent" property in the interrupt controller node is ignored, causing the interrupt controller to fail to probe, and leading to system boot failures or crashes. Fix this by also considering an explicit "interrupt-parent" property in the interrupt controller node itself. Fixes: 1b1f04d8271e7ba7 ("of/irq: Ignore interrupt parent for nodes without interrupts") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/20251118115037.1866871-1-m.szyprowski@samsung.com Reported-by: Mark Brown Closes: https://lore.kernel.org/b037f67a-b241-4689-9914-57ff578c1454@sirena.org.uk Signed-off-by: Geert Uytterhoeven Tested-by: Marek Szyprowski Tested-by: Mark Brown Link: https://patch.msgid.link/e89669c9b3a4fbac4a972ffadcbe00fddb365472.1763557994.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 494de8f67b1e586b0190eb7f835e97c97f6b81b1 Author: Tamir Duberstein Date: Mon Nov 17 11:38:07 2025 -0500 rust: sync: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20251117-core-cstr-cstrings-v4-1-924886ad9f75@gmail.com Signed-off-by: Miguel Ojeda commit 26866b6bb10b8f71e64f2f7a564e52a540c98335 Author: Brian Harring Date: Thu Oct 16 23:17:39 2025 +0200 rust: pin-init: fix typo in docs Signed-off-by: Brian Harring Signed-off-by: Benno Lossin Link: https://patch.msgid.link/20251016211740.653599-2-lossin@kernel.org Signed-off-by: Miguel Ojeda commit 53870c679e4933d11d9488db61caa3e670621528 Author: Benno Lossin Date: Thu Oct 16 23:17:38 2025 +0200 rust: pin-init: fix broken rust doc link Rust 1.92.0 warns when building the documentation that [`PinnedDrop`] is an invalid reference. This is correct and it's weird that it didn't warn before, so fix the link. [ The reason is that it is hidden -- I had asked about that in the upstream PR that changed the behavior because I wasn't sure it was intentional (and thus whether we needed to fix this and other cases): https://github.com/rust-lang/rust/pull/147153#issuecomment-3395484636 It turns out it was not, and it has been fixed for 1.92.0's upcoming release thanks to Guillaume and León. So we do not strictly need this patch and the other changes anymore: https://github.com/rust-lang/rust/pull/147809 However, checking hidden/private items or, even better, a runtime toggle to be able to see those on the fly, is something that I think would be quite nice so I have had it in our usual lists for a while. Guillaume is open to the idea and perhaps experimenting with an implementation on our side first -- he asked me to open issues upstream: https://github.com/rust-lang/rust/issues/149105 https://github.com/rust-lang/rust/issues/149106 - Miguel ] Signed-off-by: Benno Lossin Link: https://patch.msgid.link/20251016211740.653599-1-lossin@kernel.org Signed-off-by: Miguel Ojeda commit 101bf15887c99f4f0c6d60f427333923b07c2bd1 Merge: c0fb968656cb8e 2c42b6ce4a3ba5 Author: Christian Brauner Date: Mon Nov 17 12:03:56 2025 +0100 Merge patch series "ovl: convert copyup credential override to cred guard" Christian Brauner says: This simplifies the copyup specific credential override. The current code is centered around a helper struct ovl_cu_creds and is a bit convoluted. We can simplify this by using a cred guard. This will also allow us to remove the helper struct and associated functions. * patches from https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-0-ea3fb15cf427@kernel.org: ovl: remove struct ovl_cu_creds and associated functions ovl: port ovl_copy_up_tmpfile() to cred guard ovl: mark *_cu_creds() as unused temporarily ovl: port ovl_copy_up_workdir() to cred guard ovl: add copy up credential guard Link: https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-0-ea3fb15cf427@kernel.org Signed-off-by: Christian Brauner commit c0fb968656cb8e6ca261e1665c339be67b8173b7 Merge: 5c06bc9f060ce4 89a11f004f5e38 Author: Christian Brauner Date: Mon Nov 17 12:03:08 2025 +0100 Merge patch series "ovl: convert creation credential override to cred guard" Christian Brauner says: This cleans up the creation specific credential override. The current code to override credentials for creation operations is pretty difficult to understand as we override the credentials twice: (1) override with the mounter's credentials (2) copy the mounts credentials and override the fs{g,u}id with the inode {u,g}id And then we elide the revert_creds() because it would be an idempotent revert. That elision doesn't buy us anything anymore though because it's all reference count less anyway. The fact that this is done in a function and that the revert is happening in the original override makes this a lot to grasp. By introducing a cleanup guard for the creation case we can make this a lot easier to understand and extremely visually prevalent: with_ovl_creds(dentry->d_sb) { scoped_class(prepare_creds_ovl, cred, dentry, inode, mode) { if (IS_ERR(cred)) return PTR_ERR(cred); ovl_path_upper(dentry->d_parent, &realparentpath); /* more stuff you want to do */ } I think this is a big improvement over what we have now. * patches from https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-0-bd1c97a36d7b@kernel.org: ovl: drop ovl_setup_cred_for_create() ovl: port ovl_create_or_link() to new ovl_override_creator_creds cleanup guard ovl: mark ovl_setup_cred_for_create() as unused temporarily ovl: reflow ovl_create_or_link() ovl: port ovl_create_tmpfile() to new ovl_override_creator_creds cleanup guard ovl: add ovl_override_creator_creds cred guard Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-0-bd1c97a36d7b@kernel.org Signed-off-by: Christian Brauner commit 2c42b6ce4a3ba5b781b0138517c89fb2a736ed8f Author: Christian Brauner Date: Fri Nov 14 23:45:26 2025 +0100 ovl: remove struct ovl_cu_creds and associated functions Now that we have this all ported to a cred guard remove the struct and the associated helpers. Link: https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-5-ea3fb15cf427@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 72f098f0dd045e18938284ec210256b7e601ccf7 Author: Christian Brauner Date: Fri Nov 14 23:45:25 2025 +0100 ovl: port ovl_copy_up_tmpfile() to cred guard Remove the complicated struct ovl_cu_creds dance and use our new copy up cred guard. Link: https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-4-ea3fb15cf427@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 643b8a2c0a5bf88faf9f324b9617d2640d887a0f Author: Christian Brauner Date: Fri Nov 14 23:45:24 2025 +0100 ovl: mark *_cu_creds() as unused temporarily They will become unused in the next patch and we'll drop them after the conversion is finished together with the struct. This keeps the changes small and reviewable. Link: https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-3-ea3fb15cf427@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit bdba9c79c8ba6d194fb2821f504222e1630d5c5f Author: Christian Brauner Date: Wed Nov 19 20:27:21 2025 +0100 ovl: port ovl_copy_up_workdir() to cred guard Remove the complicated struct ovl_cu_creds dance and use our new copy up cred guard. Link: https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-2-ea3fb15cf427@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 81b77b5b0a2984e767674c50a35b71ca218da7e7 Author: Christian Brauner Date: Fri Nov 14 23:45:22 2025 +0100 ovl: add copy up credential guard Add a credential guard for copy up. This will allows us to waste struct struct ovl_cu_creds and simplify the code. Link: https://patch.msgid.link/20251114-work-ovl-cred-guard-copyup-v1-1-ea3fb15cf427@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 89a11f004f5e3806966cb0e522c4b975bbccc3a4 Author: Christian Brauner Date: Mon Nov 17 10:34:43 2025 +0100 ovl: drop ovl_setup_cred_for_create() It is now unused and can be removed. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-6-bd1c97a36d7b@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit e566bff963220ba0f740da42d46dd55c34ef745e Author: Christian Brauner Date: Mon Nov 17 10:34:42 2025 +0100 ovl: port ovl_create_or_link() to new ovl_override_creator_creds cleanup guard This clearly indicates the double-credential override and makes the code a lot easier to grasp with one glance. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-5-bd1c97a36d7b@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8a227c2766177db9733f86388d9d811df81e44ac Author: Christian Brauner Date: Mon Nov 17 10:34:41 2025 +0100 ovl: mark ovl_setup_cred_for_create() as unused temporarily The function will become unused in the next patch. We'll remove it in later patches to keep the diff legible. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-4-bd1c97a36d7b@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d6ef072d09b2341e606aeeaf14c3510dec329c63 Author: Christian Brauner Date: Mon Nov 17 10:34:40 2025 +0100 ovl: reflow ovl_create_or_link() Reflow the creation routine in preparation of porting it to a guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-3-bd1c97a36d7b@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8d7fc461e45abc7f67c455d908a2e709dec9e3b9 Author: Christian Brauner Date: Mon Nov 17 10:34:39 2025 +0100 ovl: port ovl_create_tmpfile() to new ovl_override_creator_creds cleanup guard This clearly indicates the double-credential override and makes the code a lot easier to grasp with one glance. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-2-bd1c97a36d7b@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit f37b334728814b14745e15d46f9eab73750b67ec Author: Christian Brauner Date: Mon Nov 17 10:34:38 2025 +0100 ovl: add ovl_override_creator_creds cred guard The current code to override credentials for creation operations is pretty difficult to understand. We effectively override the credentials twice: (1) override with the mounter's credentials (2) copy the mounts credentials and override the fs{g,u}id with the inode {u,g}id And then we elide the revert because it would be an idempotent revert. That elision doesn't buy us anything anymore though because I've made it all work without any reference counting anyway. All it does is mix the two credential overrides together. We can use a cleanup guard to clarify the creation codepaths and make them easier to understand. This just introduces the cleanup guard keeping the patch reviewable. We'll convert the caller in follow-up patches and then drop the duplicated code. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-prepare-v2-1-bd1c97a36d7b@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5c06bc9f060ce48aa87cabdcf3d9d6995362e501 Merge: 658d1322fad946 850e32512a8c92 Author: Christian Brauner Date: Mon Nov 17 12:01:28 2025 +0100 Merge patch series "ovl: convert to cred guard" Christian Brauner says: This adds an overlayfs specific extension of the cred guard infrastructure I introduced. This allows all of overlayfs to be ported to cred guards. I refactored a few functions to reduce the scope of the cred guard. I think this is beneficial as it's visually very easy to grasp the scope in one go. Lightly tested. * patches from https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-0-b31603935724@kernel.org: (42 commits) ovl: remove ovl_revert_creds() ovl: port ovl_fill_super() to cred guard ovl: refactor ovl_fill_super() ovl: port ovl_lower_positive() to cred guard ovl: port ovl_lookup() to cred guard ovl: refactor ovl_lookup() ovl: port ovl_copyfile() to cred guard ovl: port ovl_rename() to cred guard ovl: refactor ovl_rename() ovl: introduce struct ovl_renamedata ovl: port ovl_listxattr() to cred guard ovl: port ovl_xattr_get() to cred guard ovl: port ovl_xattr_set() to cred guard ovl: port ovl_nlink_end() to cred guard ovl: port ovl_nlink_start() to cred guard ovl: port ovl_check_empty_dir() to cred guard ovl: port ovl_dir_llseek() to cred guard ovl: refactor ovl_iterate() and port to cred guard ovl: don't override credentials for ovl_check_whiteouts() ovl: port ovl_maybe_lookup_lowerdata() to cred guard ... Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-0-b31603935724@kernel.org Signed-off-by: Christian Brauner commit 850e32512a8c92a5da3fb216ccd2ea45052fdb33 Author: Christian Brauner Date: Mon Nov 17 10:34:13 2025 +0100 ovl: remove ovl_revert_creds() The wrapper isn't needed anymore. Overlayfs completely relies on its cleanup guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-42-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 217e78d1b7eccf53d9e4fb3dedf7168b880bbcae Author: Christian Brauner Date: Mon Nov 17 10:34:12 2025 +0100 ovl: port ovl_fill_super() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-41-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit fc95cda6739381123ee8c53ab0b880b9853cb8f0 Author: Christian Brauner Date: Mon Nov 17 10:34:11 2025 +0100 ovl: refactor ovl_fill_super() Split the core into a separate helper in preparation of converting the caller to the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-40-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit db7cfe87832d34bd9720d961f0e9176721c456a8 Author: Christian Brauner Date: Mon Nov 17 10:34:10 2025 +0100 ovl: port ovl_lower_positive() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-39-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 6b6ef7d16fbb63179b33f98b19818d0d2710be64 Author: Christian Brauner Date: Mon Nov 17 10:34:09 2025 +0100 ovl: port ovl_lookup() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-38-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 15da486ad3bde6119d9b6353bebc2ffb6e9165c1 Author: Christian Brauner Date: Mon Nov 17 10:34:08 2025 +0100 ovl: refactor ovl_lookup() Split the core into a separate helper in preparation of converting the caller to the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-37-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 14d35fda5b1139bacefb47c69f083fe2cfad211b Author: Christian Brauner Date: Mon Nov 17 10:34:07 2025 +0100 ovl: port ovl_copyfile() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-36-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit ca0c657f258089cbb7b6d269cf91936ab83dac3f Author: Christian Brauner Date: Wed Nov 19 20:53:17 2025 +0100 ovl: port ovl_rename() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-35-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit a1da8401987e671ac18720eb26c7ee52e79e3d4c Author: Christian Brauner Date: Wed Nov 19 20:48:38 2025 +0100 ovl: refactor ovl_rename() Extract the code that runs under overridden credentials into a separate ovl_rename_upper() helper function and the code that runs before/after to ovl_rename_start/end(). Error handling is simplified. The helpers returns errors directly instead of using goto labels. Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-34-b31603935724@kernel.org Signed-off-by: Christian Brauner commit fb9f31fe9f7b3cecf1a59427a7395c3cf1d26706 Author: Christian Brauner Date: Wed Nov 19 18:50:56 2025 +0100 ovl: introduce struct ovl_renamedata Add a struct ovl_renamedata to group rename-related state that was previously stored in local variables. Embedd struct renamedata directly aligning with the vfs. Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-33-b31603935724@kernel.org Signed-off-by: Christian Brauner commit 0b5800172c8e0a93776e4ee74e50f56d7625bedc Author: Christian Brauner Date: Mon Nov 17 10:34:03 2025 +0100 ovl: port ovl_listxattr() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-32-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit ae64b5418555fa506e74152ebb644bcebc9f2cad Author: Christian Brauner Date: Mon Nov 17 10:34:02 2025 +0100 ovl: port ovl_xattr_get() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-31-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d6053017260113fe20cfaeab35fd84572f5b0e24 Author: Christian Brauner Date: Mon Nov 17 10:34:01 2025 +0100 ovl: port ovl_xattr_set() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-30-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 9e5ec68f3a706515fe348b674e908edf80e70e63 Author: Christian Brauner Date: Mon Nov 17 10:34:00 2025 +0100 ovl: port ovl_nlink_end() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-29-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 062c5b48d238f5de63b3e207cbd5153d0e77ed42 Author: Christian Brauner Date: Mon Nov 17 10:33:59 2025 +0100 ovl: port ovl_nlink_start() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-28-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 67bc75e6f48dcb5b1454a78fcf87e68a68e83e79 Author: Christian Brauner Date: Mon Nov 17 10:33:58 2025 +0100 ovl: port ovl_check_empty_dir() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-27-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5517646e14d18768ee72ae2f4320826f2169329a Author: Christian Brauner Date: Mon Nov 17 10:33:57 2025 +0100 ovl: port ovl_dir_llseek() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-26-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d25e4b739f8378419f990983f2542160e79738c5 Author: Christian Brauner Date: Mon Nov 17 10:33:56 2025 +0100 ovl: refactor ovl_iterate() and port to cred guard factor out ovl_iterate_merged() and move some code into ovl_iterate_real() for easier use of the scoped ovl cred guard. Signed-off-by: Amir Goldstein Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-25-b31603935724@kernel.org Signed-off-by: Christian Brauner commit 198d1822884a79e92a6e33284be90db5c09a48df Author: Christian Brauner Date: Mon Nov 17 10:33:55 2025 +0100 ovl: don't override credentials for ovl_check_whiteouts() The function is only called when rdd->dentry is non-NULL: if (!err && rdd->first_maybe_whiteout && rdd->dentry) err = ovl_check_whiteouts(realpath, rdd); | Caller | Sets rdd->dentry? | Can call ovl_check_whiteouts()? | |-------------------------------|-------------------|---------------------------------| | ovl_dir_read_merged() | ✓ Yes (line 430) | ✓ YES | | ovl_dir_read_impure() | ✗ No | ✗ NO | | ovl_check_d_type_supported() | ✗ No | ✗ NO | | ovl_workdir_cleanup_recurse() | ✗ No | ✗ NO | | ovl_indexdir_cleanup() | ✗ No | ✗ NO | VFS layer (.iterate_shared file operation) → ovl_iterate() [CRED OVERRIDE] → ovl_cache_get() → ovl_dir_read_merged() → ovl_dir_read() → ovl_check_whiteouts() [CRED REVERT] ovl_unlink() → ovl_do_remove() → ovl_check_empty_dir() [CRED OVERRIDE] → ovl_dir_read_merged() → ovl_dir_read() → ovl_check_whiteouts() [CRED REVERT] ovl_rename() → ovl_check_empty_dir() [CRED OVERRIDE] → ovl_dir_read_merged() → ovl_dir_read() → ovl_check_whiteouts() [CRED REVERT] All valid callchains already override credentials so drop the override. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-24-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit cb3c8cbaed041b8cf229f48b9d7503eca7969f97 Author: Christian Brauner Date: Mon Nov 17 10:33:54 2025 +0100 ovl: port ovl_maybe_lookup_lowerdata() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-23-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b1c47b3abcc6bf81cfc3b4e01faadc23ff261ba2 Author: Christian Brauner Date: Mon Nov 17 10:33:53 2025 +0100 ovl: port ovl_maybe_validate_verity() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-22-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 4975e683c2786c698827aaef18c999a3398bfe6a Author: Christian Brauner Date: Mon Nov 17 10:33:52 2025 +0100 ovl: port ovl_fileattr_get() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-21-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit af1d5d62f39e1f657ad0276f7d48d95d9d0d1326 Author: Christian Brauner Date: Mon Nov 17 10:33:51 2025 +0100 ovl: port ovl_fileattr_set() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-20-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit a3860a808f732384f8104250fba54481e6431f32 Author: Christian Brauner Date: Mon Nov 17 10:33:50 2025 +0100 ovl: port ovl_fiemap() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-19-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8e9698d6e4ef92f378f2cee9f1f8e035eece6cf8 Author: Christian Brauner Date: Mon Nov 17 10:33:49 2025 +0100 ovl: port ovl_set_or_remove_acl() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-18-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 71ac28fbcd3309cf6e08b69f611767560f366c0c Author: Christian Brauner Date: Mon Nov 17 10:33:48 2025 +0100 ovl: port do_ovl_get_acl() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-17-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 47eba7f7fd1543dd1a677e6f971b11925e8b9b9b Author: Christian Brauner Date: Mon Nov 17 10:33:47 2025 +0100 ovl: port ovl_get_link() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-16-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d81999b40baf669cc2566d4fb102356548f46a91 Author: Christian Brauner Date: Mon Nov 17 10:33:46 2025 +0100 ovl: port ovl_permission() to cred guard Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-15-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 81707ae827d3af60046544b8e00a7d86ad7660d3 Author: Christian Brauner Date: Mon Nov 17 10:33:45 2025 +0100 ovl: port ovl_getattr() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-14-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 7aedfa5a52b09896a0fd8f611966b9d7194fd3fa Author: Christian Brauner Date: Mon Nov 17 10:33:44 2025 +0100 ovl: port ovl_setattr() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-13-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 9763970984511861505a88b038dbee2c8c5e1623 Author: Christian Brauner Date: Mon Nov 17 10:33:43 2025 +0100 ovl: port ovl_flush() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-12-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8e8f4df93c1d32e57e3d6cb7ac8233c959423597 Author: Christian Brauner Date: Mon Nov 17 10:33:42 2025 +0100 ovl: port ovl_fadvise() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-11-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 2468017783027a9fb90fcb336094cc7c880f46ed Author: Christian Brauner Date: Mon Nov 17 10:33:41 2025 +0100 ovl: port ovl_fallocate() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-10-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 07a891c34676205a12caa002b22d30e6d9bed49d Author: Christian Brauner Date: Mon Nov 17 10:33:40 2025 +0100 ovl: port ovl_fsync() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-9-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 1fc4bc77c7865732694c6d32c98d990b2b1cddc8 Author: Christian Brauner Date: Mon Nov 17 10:33:39 2025 +0100 ovl: port ovl_llseek() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-8-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b27ebb3d4b9c6dc9628131c284e01e45ff0b7a17 Author: Christian Brauner Date: Mon Nov 17 10:33:38 2025 +0100 ovl: port ovl_open_realfile() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-7-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5f51dfe768a1ef3b5f478bdfb0597aacf2e080da Author: Christian Brauner Date: Mon Nov 17 10:33:37 2025 +0100 ovl: port ovl_create_tmpfile() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-6-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8368eb837e19d94ed0028a02007f27e928dc3c02 Author: Christian Brauner Date: Mon Nov 17 10:33:36 2025 +0100 ovl: port ovl_do_remove() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-5-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit ff4f6e4689e1f4d9870876651841ea7d996862c9 Author: Christian Brauner Date: Mon Nov 17 10:33:35 2025 +0100 ovl: port ovl_set_link_redirect() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-4-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8c9531edcf60014b7e36739697f5cc15d5e853a1 Author: Christian Brauner Date: Mon Nov 17 10:33:34 2025 +0100 ovl: port ovl_create_or_link() to cred guard Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-3-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 87809f12e057dbd482dc9810d0ad194cdca3d71d Author: Christian Brauner Date: Mon Nov 17 10:33:33 2025 +0100 ovl: port ovl_copy_up_flags() to cred guards Use the scoped ovl cred guard. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-2-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 6f5c84162a30514a795eab3495a12c19306d6f6c Author: Christian Brauner Date: Mon Nov 17 10:33:32 2025 +0100 ovl: add override_creds cleanup guard extension for overlayfs Overlayfs plucks the relevant creds from the superblock. Extend the override_creds cleanup class I added to override_creds_ovl which uses the ovl_override_creds() function as initialization helper. Add with_ovl_creds() based on this new class. Link: https://patch.msgid.link/20251117-work-ovl-cred-guard-v4-1-b31603935724@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 658d1322fad946bdfe670f51cf3f279258048c8d Merge: 2b21a6204d4214 523ac768800c95 Author: Christian Brauner Date: Wed Nov 19 21:56:47 2025 +0100 Merge branch 'vfs-6.19.directory.locking' into base.vfs-6.19.ovl Bring in the directory locking changes as they touch overlayfs in a pretty substantial way and we are about to change the credential override semantics quite substantially as well. Signed-off-by: Christian Brauner commit 2b21a6204d421437030d05e2177f0843f5efeb8b Merge: c8e00cdc7425d5 3c60b0b1e55adb Author: Christian Brauner Date: Wed Nov 19 21:56:17 2025 +0100 Merge branch 'kbuild-6.19.fms.extension' Bring in the shared branch with the kbuild tree to enable '-fms-extensions' for 6.19. The overlayfs cred guard work depends on this. Signed-off-by: Christian Brauner commit 85f329df293119d6ba1a26453d109556631081a4 Author: Maximilian Dittgen Date: Wed Nov 19 14:57:44 2025 +0100 KVM: selftests: SYNC after guest ITS setup in vgic_lpi_stress vgic_lpi_stress sends MAPTI and MAPC commands during guest GIC setup to map interrupt events to ITT entries and collection IDs to redistributors, respectively. We have no guarantee that the ITS will finish handling these mapping commands before the selftest calls KVM_SIGNAL_MSI to inject LPIs to the guest. If LPIs are injected before ITS mapping completes, the ITS cannot properly pass the interrupt on to the redistributor. Fix by adding a SYNC command to the selftests ITS library, then calling SYNC after ITS mapping to ensure mapping completes before signal_lpi() writes to GITS_TRANSLATER. Signed-off-by: Maximilian Dittgen Link: https://msgid.link/20251119135744.68552-2-mdittgen@amazon.de Signed-off-by: Oliver Upton commit 31df012da496968d8d4368f693ad45dfcbfba40b Author: Maximilian Dittgen Date: Wed Nov 19 14:57:43 2025 +0100 KVM: selftests: Assert GICR_TYPER.Processor_Number matches selftest CPU number The selftests GIC library and tests assume that the GICR_TYPER.Processor_number associated with a given CPU is the same as the CPU's selftest index. Since this assumption is not guaranteed by specification, add an assert in gicv3_cpu_init() that validates this is true. Signed-off-by: Maximilian Dittgen Link: https://msgid.link/20251119135744.68552-1-mdittgen@amazon.de Signed-off-by: Oliver Upton commit cb17d79ff51d41f656bcf7928330b2e9c0003583 Author: Oliver Upton Date: Wed Nov 19 01:38:22 2025 -0800 KVM: arm64: Use kvzalloc() for kvm struct allocation Physically-allocated KVM structs aren't necessary when in VHE mode as there's no need to share with the hyp's address space. Of course, there can still be a performance benefit from physical allocations. Use kvzalloc() for opportunistic physical allocations. Acked-by: Vishal Moola (Oracle) Reviewed-by: Marc Zyngier Reviewed-by: Joey Gouly Link: https://msgid.link/20251119093822.2513142-3-oupton@kernel.org Signed-off-by: Oliver Upton commit 297877069bc2fa079fb2a60ae91ca9abb481074a Author: Oliver Upton Date: Wed Nov 19 01:38:21 2025 -0800 KVM: arm64: Drop useless __GFP_HIGHMEM from kvm struct allocation A recent change on the receiving end of vmalloc() started warning about unsupported GFP flags passed by the caller. Nathan reports that this warning fires in kvm_arch_alloc_vm(), owing to the fact that KVM is passing a meaningless __GFP_HIGHMEM. Do as the warning says and fix the code. Cc: Vishal Moola (Oracle) Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/kvmarm/20251118224448.GA998046@ax162/ Acked-by: Vishal Moola (Oracle) Reviewed-by: Marc Zyngier Reviewed-by: Joey Gouly Link: https://msgid.link/20251119093822.2513142-2-oupton@kernel.org Signed-off-by: Oliver Upton commit d4839582bc7002095b013acb4a2dcaa1438c41aa Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/skx_common: Prepare for skx_set_hi_lo() The upcoming imh_edac driver for Intel Diamond Rapids servers cannot use skx_get_hi_lo() in skx_common to retrieve the TOHM (Top of High Memory) and TOLM (Top of Low Memory) parameters. Instead, it obtains these parameters within its own EDAC driver. To accommodate this, prepare skx_set_hi_lo() to allow the driver to notify skx_common of these parameters. Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-4-qiuxu.zhuo@intel.com commit 9529e697739e2d4dc8c4129bbe91576f744f79f6 Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/skx_common: Prepare for skx_get_edac_list() The Intel EDAC library 'skx_common' maintains the Intel server EDAC device list for {skx, i10nm}_edac drivers, which use skx_get_all_bus_mappings() to build and retrieve the EDAC device list. However, the upcoming Intel EDAC driver, imh_edac, for Diamond Rapids servers is designed for memory controllers that are MMIO-based devices rather than PCI devices. Consequently, it can't use skx_get_all_bus_mappings() due to the absence of a PCI bus. To accommodate this, prepare skx_get_edac_list() to enable the upcoming imh_edac driver to obtain the EDAC device list from the skx_common library and build the EDAC device list independently. Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-3-qiuxu.zhuo@intel.com commit b3d70059cbb262eef12927dbcf37ba8586d4a3ab Author: Qiuxu Zhuo Date: Wed Nov 19 12:11:40 2025 -0800 EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev Memory controllers in the new Intel server CPUs, such as Diamond Rapids, are presented as MMIO-based devices rather than PCI devices. Modify skx_register_mci() to be independent of 'pci_dev' and use a generic 'dev' of 'struct device' to prepare for support of such MMIO-based memory controllers. Tested-by: Yi Lai Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20251119134132.2389472-2-qiuxu.zhuo@intel.com commit f700b882a7aedec69a7dc3762c63b7c04ebdfb91 Merge: 1f2d68c354131e 5fb2f67341bd4b Author: Stephen Boyd Date: Wed Nov 19 11:40:56 2025 -0700 Merge tag 'renesas-clk-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add GPU clocks on R-Car V3U - Add USB3.0 clocks and resets on RZ/V2H and RZ/V2N - Add more serial (RSCI) clocks and resets on RZ/G3E - Add SPI clocks on RZ/T2H and RZ/N2H * tag 'renesas-clk-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: r9a09g077: Add SPI module clocks clk: renesas: r9a09g056: Add USB3.0 clocks/resets clk: renesas: r9a09g057: Add USB3.0 clocks/resets clk: renesas: r9a09g047: Add RSCI clocks/resets dt-bindings: clock: renesas,r9a09g056-cpg: Add USB3.0 core clocks dt-bindings: clock: renesas,r9a09g057-cpg: Add USB3.0 core clocks clk: renesas: r9a06g032: Fix memory leak in error path clk: renesas: r9a09g077: Use devm_ helpers for divider clock registration clk: renesas: r9a09g077: Remove stray blank line clk: renesas: r9a09g077: Propagate rate changes to parent clocks clk: renesas: r8a779a0: Add 3DGE module clock clk: renesas: r8a779a0: Add ZG Core clock clk: renesas: rcar-gen4: Add support for clock dividers in FRQCRB dt-bindings: clock: r8a779a0: Add ZG core clock commit ce1e1421f8d8cdb5e05e13dbb516caedd67e5ee8 Author: Ben Horgan Date: Wed Nov 19 12:23:04 2025 +0000 MAINTAINERS: new entry for MPAM Driver Create a maintainer entry for the new MPAM Driver. Add myself and James Morse as maintainers. James created the driver and I have taken up the later versions of his series. Cc: James Morse Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Acked-by: Catalin Marinas Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 2557e0eafec1547aa9e0e768d2376e66252dada4 Author: James Morse Date: Wed Nov 19 12:23:03 2025 +0000 arm_mpam: Add kunit tests for props_mismatch() When features are mismatched between MSC the way features are combined to the class determines whether resctrl can support this SoC. Add some tests to illustrate the sort of thing that is expected to work, and those that must be removed. Signed-off-by: James Morse Reviewed-by: Ben Horgan Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit e3565d1fd4dcf2c7ee6912094066e47c7500eaf2 Author: James Morse Date: Wed Nov 19 12:23:02 2025 +0000 arm_mpam: Add kunit test for bitmap reset The bitmap reset code has been a source of bugs. Add a unit test. This currently has to be built in, as the rest of the driver is builtin. Suggested-by: Jonathan Cameron Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Ben Horgan Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 201d96ca4c867695880450930258cd5c97f099d4 Author: James Morse Date: Wed Nov 19 12:23:01 2025 +0000 arm_mpam: Add helper to reset saved mbwu state resctrl expects to reset the bandwidth counters when the filesystem is mounted. To allow this, add a helper that clears the saved mbwu state. Instead of cross calling to each CPU that can access the component MSC to write to the counter, set a flag that causes it to be zero'd on the the next read. This is easily done by forcing a configuration update. Signed-off-by: James Morse Cc: Peter Newman Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 9e5afb7c32830bcd123976a7729ef4e2dff0cd77 Author: Rohit Mathew Date: Wed Nov 19 12:23:00 2025 +0000 arm_mpam: Use long MBWU counters if supported Now that the larger counter sizes are probed, make use of them. Callers of mpam_msmon_read() may not know (or care!) about the different counter sizes. Allow them to specify mpam_feat_msmon_mbwu and have the driver pick the counter to use. Only 32bit accesses to the MSC are required to be supported by the spec, but these registers are 64bits. The lower half may overflow into the higher half between two 32bit reads. To avoid this, use a helper that reads the top half multiple times to check for overflow. Signed-off-by: Rohit Mathew [morse: merged multiple patches from Rohit, added explicit counter selection ] Signed-off-by: James Morse Cc: Peter Newman Reviewed-by: Ben Horgan Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit fdc29a141d6364645509cb20129cba1f84e4c10f Author: Rohit Mathew Date: Wed Nov 19 12:22:59 2025 +0000 arm_mpam: Probe for long/lwd mbwu counters mpam v0.1 and versions above v1.0 support optional long counter for memory bandwidth monitoring. The MPAMF_MBWUMON_IDR register has fields indicating support for long counters. Probe these feature bits. The mpam_feat_msmon_mbwu feature is used to indicate that bandwidth monitors are supported, instead of muddling this with which size of bandwidth monitors, add an explicit 31 bit counter feature. Signed-off-by: Rohit Mathew [ morse: Added 31bit counter feature to simplify later logic ] Signed-off-by: James Morse Reviewed-by: Ben Horgan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit b35363793291e36c91d4a5b62d7ae7079c70d826 Author: Ben Horgan Date: Wed Nov 19 12:22:58 2025 +0000 arm_mpam: Consider overflow in bandwidth counter state Use the overflow status bit to track overflow on each bandwidth counter read and add the counter size to the correction when overflow is detected. This assumes that only a single overflow has occurred since the last read of the counter. Overflow interrupts, on hardware that supports them could be used to remove this limitation. Cc: Zeng Heng Reviewed-by: Gavin Shan Reviewed-by: Zeng Heng Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 41e8a14950e1732af51cfec8fa09f8ded02a5ca9 Author: James Morse Date: Wed Nov 19 12:22:57 2025 +0000 arm_mpam: Track bandwidth counter state for power management Bandwidth counters need to run continuously to correctly reflect the bandwidth. Save the counter state when the hardware is reset due to CPU hotplug. Add struct mbwu_state to track the bandwidth counter. Support for tracking overflow with the same structure will be added in a subsequent commit. Cc: Zeng Heng Reviewed-by: Gavin Shan Reviewed-by: Zeng Heng Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 823e7c3712c584641b4ef890a8af34884c677197 Author: James Morse Date: Wed Nov 19 12:22:56 2025 +0000 arm_mpam: Add mpam_msmon_read() to read monitor value Reading a monitor involves configuring what you want to monitor, and reading the value. Components made up of multiple MSC may need values from each MSC. MSCs may take time to configure, returning 'not ready'. The maximum 'not ready' time should have been provided by firmware. Add mpam_msmon_read() to hide all this. If (one of) the MSC returns not ready, then wait the full timeout value before trying again. CC: Shanker Donthineni Cc: Shaopeng Tan (Fujitsu) Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit c891bae66423bc69a680ca1de34940132e2c8ace Author: James Morse Date: Wed Nov 19 12:22:55 2025 +0000 arm_mpam: Add helpers to allocate monitors MPAM's MSC support a number of monitors, each of which supports bandwidth counters, or cache-storage-utilisation counters. To use a counter, a monitor needs to be configured. Add helpers to allocate and free CSU or MBWU monitors. Signed-off-by: James Morse Reviewed-by: Ben Horgan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 880df85d8673f8e2395f139d3618661366e5d4d8 Author: James Morse Date: Wed Nov 19 12:22:54 2025 +0000 arm_mpam: Probe and reset the rest of the features MPAM supports more features than are going to be exposed to resctrl. For partid other than 0, the reset values of these controls isn't known. Discover the rest of the features so they can be reset to avoid any side effects when resctrl is in use. PARTID narrowing allows MSC/RIS to support less configuration space than is usable. If this feature is found on a class of device we are likely to use, then reduce the partid_max to make it usable. This allows us to map a PARTID to itself. CC: Rohit Mathew CC: Zeng Heng CC: Dave Martin Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 09b89d2a72f37b078198cbb09d5b9e13ba9d68b9 Author: James Morse Date: Wed Nov 19 12:22:53 2025 +0000 arm_mpam: Allow configuration to be applied and restored during cpu online When CPUs come online the MSC's original configuration should be restored. Add struct mpam_config to hold the configuration. For each component, this has a bitmap of features that have been changed from the reset values. The mpam_config is also used on RIS reset where all bits are set to ensure all features are reset. Once the maximum partid is known, allocate a configuration array for each component, and reprogram each RIS configuration from this. CC: Dave Martin Signed-off-by: James Morse Cc: Fujitsu Fujitsu Cc: Peter Newman peternewman@google.com Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 3796f75aa7958d26b93a2508de5fc1e0b2f8a853 Author: James Morse Date: Wed Nov 19 12:22:52 2025 +0000 arm_mpam: Use a static key to indicate when mpam is enabled Once all the MSC have been probed, the system wide usable number of PARTID is known and the configuration arrays can be allocated. After this point, checking all the MSC have been probed is pointless, and the cpuhp callbacks should restore the configuration, instead of just resetting the MSC. Add a static key to enable this behaviour. This will also allow MPAM to be disabled in response to an error, and the architecture code to enable/disable the context switch of the MPAM system registers. Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Ben Horgan Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 49aa621c4dcaf8e3cfeb9e73d07a9746b889f9e8 Author: James Morse Date: Wed Nov 19 12:22:51 2025 +0000 arm_mpam: Register and enable IRQs Register and enable error IRQs. All the MPAM error interrupts indicate a software bug, e.g. out of range partid. If the error interrupt is ever signalled, attempt to disable MPAM. Only the irq handler accesses the MPAMF_ESR register, so no locking is needed. The work to disable MPAM after an error needs to happen at process context as it takes mutex. It also unregisters the interrupts, meaning it can't be done from the threaded part of a threaded interrupt. Instead, mpam_disable() gets scheduled. Enabling the IRQs in the MSC may involve cross calling to a CPU that can access the MSC. Once the IRQ is requested, the mpam_disable() path can be called asynchronously, which will walk structures sized by max_partid. Ensure this size is fixed before the interrupt is requested. CC: Rohit Mathew Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Rohit Mathew Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 3bd04fe7d807bbdcfe75b29ca82fae4e2d7dc524 Author: James Morse Date: Wed Nov 19 12:22:50 2025 +0000 arm_mpam: Extend reset logic to allow devices to be reset any time cpuhp callbacks aren't the only time the MSC configuration may need to be reset. Resctrl has an API call to reset a class. If an MPAM error interrupt arrives it indicates the driver has misprogrammed an MSC. The safest thing to do is reset all the MSCs and disable MPAM. Add a helper to reset RIS via their class. Call this from mpam_disable(), which can be scheduled from the error interrupt handler. Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: Fenghua Yu Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 475228d15dd653584b840b8e6c5828cdc3884b1c Author: James Morse Date: Wed Nov 19 12:22:49 2025 +0000 arm_mpam: Add a helper to touch an MSC from any CPU Resetting RIS entries from the cpuhp callback is easy as the callback occurs on the correct CPU. This won't be true for any other caller that wants to reset or configure an MSC. Add a helper that schedules the provided function if necessary. Callers should take the cpuhp lock to prevent the cpuhp callbacks from changing the MSC state. Signed-off-by: James Morse Reviewed-by: Ben Horgan Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit f188a36ca2416e8090453eacbabd2925b20eb906 Author: James Morse Date: Wed Nov 19 12:22:48 2025 +0000 arm_mpam: Reset MSC controls from cpuhp callbacks When a CPU comes online, it may bring a newly accessible MSC with it. Only the default partid has its value reset by hardware, and even then the MSC might not have been reset since its config was previously dirtied. e.g. Kexec. Any in-use partid must have its configuration restored, or reset. In-use partids may be held in caches and evicted later. MSC are also reset when CPUs are taken offline to cover cases where firmware doesn't reset the MSC over reboot using UEFI, or kexec where there is no firmware involvement. If the configuration for a RIS has not been touched since it was brought online, it does not need resetting again. To reset, write the maximum values for all discovered controls. CC: Rohit Mathew Signed-off-by: James Morse Reviewed-by: Fenghua Yu Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Gavin Shan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit c10ca83a778304f976cbea60bbbb2f1fac003f5c Author: James Morse Date: Wed Nov 19 12:22:47 2025 +0000 arm_mpam: Merge supported features during mpam_enable() into mpam_class To make a decision about whether to expose an mpam class as a resctrl resource we need to know its overall supported features and properties. Once we've probed all the resources, we can walk the tree and produce overall values by merging the bitmaps. This eliminates features that are only supported by some MSC that make up a component or class. If bitmap properties are mismatched within a component we cannot support the mismatched feature. Care has to be taken as vMSC may hold mismatched RIS. Signed-off-by: James Morse Reviewed-by: Ben Horgan Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 8c90dc68a5de4349ef9ba51449fb0a29cd690547 Author: James Morse Date: Wed Nov 19 12:22:46 2025 +0000 arm_mpam: Probe the hardware features resctrl supports Expand the probing support with the control and monitor types we can use with resctrl. CC: Dave Martin Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit d02beb06ca2a624e17004659c79d26a23484aa8b Author: James Morse Date: Wed Nov 19 12:22:45 2025 +0000 arm_mpam: Add helpers for managing the locking around the mon_sel registers The MSC MON_SEL register needs to be accessed from hardirq for the overflow interrupt, and when taking an IPI to access these registers on platforms where MSC are not accessible from every CPU. This makes an irqsave spinlock the obvious lock to protect these registers. On systems with SCMI or PCC mailboxes it must be able to sleep, meaning a mutex must be used. The SCMI or PCC platforms can't support an overflow interrupt, and can't access the registers from hardirq context. Clearly these two can't exist for one MSC at the same time. Add helpers for the MON_SEL locking. For now, use a irqsave spinlock and only support 'real' MMIO platforms. In the future this lock will be split in two allowing SCMI/PCC platforms to take a mutex. Because there are contexts where the SCMI/PCC platforms can't make an access, mpam_mon_sel_lock() needs to be able to fail. Do this now, so that all the error handling on these paths is present. This allows the relevant paths to fail if they are needed on a platform where this isn't possible, instead of having to make explicit checks of the interface type. Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit bd221f9f82afb616887e0b88b43fbb937479d744 Author: James Morse Date: Wed Nov 19 12:22:44 2025 +0000 arm_mpam: Probe hardware to find the supported partid/pmg values CPUs can generate traffic with a range of PARTID and PMG values, but each MSC may also have its own maximum size for these fields. Before MPAM can be used, the driver needs to probe each RIS on each MSC, to find the system-wide smallest value that can be used. The limits from requestors (e.g. CPUs) also need taking into account. While doing this, RIS entries that firmware didn't describe are created under MPAM_CLASS_UNKNOWN. This adds the low level MSC write accessors. While we're here, implement the mpam_register_requestor() call for the arch code to register the CPU limits. Future callers of this will tell us about the SMMU and ITS. Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 8f8d0ac1da7885c0d619636f93e0983239dc145c Author: James Morse Date: Wed Nov 19 12:22:43 2025 +0000 arm_mpam: Add cpuhp callbacks to probe MSC hardware Because an MSC can only by accessed from the CPUs in its cpu-affinity set we need to be running on one of those CPUs to probe the MSC hardware. Do this work in the cpuhp callback. Probing the hardware will only happen before MPAM is enabled, walk all the MSCs and probe those we can reach that haven't already been probed as each CPU's online call is made. This adds the low-level MSC register read accessors. Once all MSCs reported by the firmware have been probed from a CPU in their respective cpu-affinity set, the probe-time cpuhp callbacks are replaced. The replacement callbacks will ultimately need to handle save/restore of the runtime MSC state across power transitions, but for now there is nothing to do in them: so do nothing. The architecture's context switch code will be enabled by a static-key, this can be set by mpam_enable(), but must be done from process context, not a cpuhp callback because both take the cpuhp lock. Whenever a new MSC has been probed, the mpam_enable() work is scheduled to test if all the MSCs have been probed. If probing fails, mpam_disable() is scheduled to unregister the cpuhp callbacks and free memory. CC: Lecopzer Chen Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Ben Horgan Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit aa64b9e110515610b6498df0f8fce9b1c6c44f72 Author: James Morse Date: Wed Nov 19 12:22:42 2025 +0000 arm_mpam: Add MPAM MSC register layout definitions Memory Partitioning and Monitoring (MPAM) has memory mapped devices (MSCs) with an identity/configuration page. Add the definitions for these registers as offset within the page(s). Link: https://developer.arm.com/documentation/ihi0099/aa/ Signed-off-by: James Morse Reviewed-by: Ben Horgan Reviewed-by: Fenghua Yu Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 01fb4b8224726aa0f2170b63e4685cf0eec85d8d Author: James Morse Date: Wed Nov 19 12:22:41 2025 +0000 arm_mpam: Add the class and component structures for firmware described ris An MSC is a container of resources, each identified by their RIS index. Some RIS are described by firmware to provide their position in the system. Others are discovered when the driver probes the hardware. To configure a resource it needs to be found by its class, e.g. 'L2'. There are two kinds of grouping, a class is a set of components, which are visible to user-space as there are likely to be multiple instances of the L2 cache. (e.g. one per cluster or package) Add support for creating and destroying structures to allow a hierarchy of resources to be created. Reviewed-by: Gavin Shan Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit f04046f2577a5c76167333ca99d3903ee5331ba0 Author: James Morse Date: Wed Nov 19 12:22:40 2025 +0000 arm_mpam: Add probe/remove for mpam msc driver and kbuild boiler plate Probing MPAM is convoluted. MSCs that are integrated with a CPU may only be accessible from those CPUs, and they may not be online. Touching the hardware early is pointless as MPAM can't be used until the system-wide common values for num_partid and num_pmg have been discovered. Start with driver probe/remove and mapping the MSC. Cc: Carl Worth Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 115c5325beae7199219ab7c12ec2a2af8dea6c3c Author: James Morse Date: Wed Nov 19 12:22:39 2025 +0000 ACPI / MPAM: Parse the MPAM table Add code to parse the arm64 specific MPAM table, looking up the cache level from the PPTT and feeding the end result into the MPAM driver. This happens in two stages. Platform devices are created first for the MSC devices. Once the driver probes it calls acpi_mpam_parse_resources() to discover the RIS entries the MSC contains. For now the MPAM hook mpam_ris_create() is stubbed out, but will update the MPAM driver with optional discovered data about the RIS entries. CC: Carl Worth Link: https://developer.arm.com/documentation/den0065/3-0bet/?lang=en Reviewed-by: Lorenzo Pieralisi Reviewed-by: Gavin Shan Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 96f4a4d53e6660d9b62e8d739388267fbb660e9f Author: Ben Horgan Date: Wed Nov 19 12:22:38 2025 +0000 ACPI: Define acpi_put_table cleanup handler and acpi_get_table_pointer() helper Define a cleanup helper for use with __free to release the acpi table when the pointer goes out of scope. Also, introduce the helper acpi_get_table_pointer() to simplify a commonly used pattern involving acpi_get_table(). These are first used in a subsequent commit. Reviewed-by: Gavin Shan Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit f5915600cc4ca0338a37d5a8a4032e25d939156b Author: Ben Horgan Date: Wed Nov 19 12:22:37 2025 +0000 platform: Define platform_device_put cleanup handler Define a cleanup helper for use with __free to destroy platform devices automatically when the pointer goes out of scope. This is only intended to be used in error cases and so should be used with return_ptr() or no_free_ptr() directly to avoid the automatic destruction on success. A first use of this is introduced in a subsequent commit. Reviewed-by: Gavin Shan Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit d8bf01d80919e81a06dca77556dcfb351fa99b0c Author: James Morse Date: Wed Nov 19 12:22:36 2025 +0000 arm64: kconfig: Add Kconfig entry for MPAM The bulk of the MPAM driver lives outside the arch code because it largely manages MMIO devices that generate interrupts. The driver needs a Kconfig symbol to enable it. As MPAM is only found on arm64 platforms, the arm64 tree is the most natural home for the Kconfig option. This Kconfig option will later be used by the arch code to enable or disable the MPAM context-switch code, and to register properties of CPUs with the MPAM driver. Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Ben Horgan Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo CC: Dave Martin Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit a39a723a6f1ed9a1602ccf8dd56392402afa7339 Author: James Morse Date: Wed Nov 19 12:22:35 2025 +0000 ACPI / PPTT: Add a helper to fill a cpumask from a cache_id MPAM identifies CPUs by the cache_id in the PPTT cache structure. The driver needs to know which CPUs are associated with the cache. The CPUs may not all be online, so cacheinfo does not have the information. Add a helper to pull this information out of the PPTT. CC: Rohit Mathew Reviewed-by: Gavin Shan Reviewed-by: Fenghua Yu Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Jeremy Linton Tested-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 41a7bb39fede8ecc053c261b86cdfadea45b7b10 Author: James Morse Date: Wed Nov 19 12:22:34 2025 +0000 ACPI / PPTT: Find cache level by cache-id The MPAM table identifies caches by id. The MPAM driver also wants to know the cache level to determine if the platform is of the shape that can be managed via resctrl. Cacheinfo has this information, but only for CPUs that are online. Waiting for all CPUs to come online is a problem for platforms where CPUs are brought online late by user-space. Add a helper that walks every possible cache, until it finds the one identified by cache-id, then return the level. Signed-off-by: James Morse Signed-off-by: Ben Horgan Reviewed-by: Gavin Shan Reviewed-by: Fenghua Yu Reviewed-by: Shaopeng Tan Reviewed-by: Jonathan Cameron Reviewed-by: Jeremy Linton Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Catalin Marinas commit cfc085af8398479e855b86236a21e1d870d51184 Author: Ben Horgan Date: Wed Nov 19 12:22:33 2025 +0000 ACPI / PPTT: Add acpi_pptt_cache_v1_full to use pptt cache as one structure In actbl2.h, acpi_pptt_cache describes the fields in the original Cache Type Structure. In PPTT table version 3 a new field was added at the end, cache_id. This is described in acpi_pptt_cache_v1 but rather than including all v1 fields it just includes this one. In lieu of this being fixed in acpica, introduce acpi_pptt_cache_v1_full to contain all the fields of the Cache Type Structure . Update the existing code to use this new struct. This simplifies the code and removes a non-standard use of ACPI_ADD_PTR. Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Reviewed-by: Hanjun Guo Reviewed-by: Jeremy Linton Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit eeec7845e966f9278973c02573e3587e6733a4dd Author: James Morse Date: Wed Nov 19 12:22:32 2025 +0000 ACPI / PPTT: Stop acpi_count_levels() expecting callers to clear levels In acpi_count_levels(), the initial value of *levels passed by the caller is really an implementation detail of acpi_count_levels(), so it is unreasonable to expect the callers of this function to know what to pass in for this parameter. The only sensible initial value is 0, which is what the only upstream caller (acpi_get_cache_info()) passes. Use a local variable for the starting cache level in acpi_count_levels(), and pass the result back to the caller via the function return value. Get rid of the levels parameter, which has no remaining purpose. Fix acpi_get_cache_info() to match. Suggested-by: Jonathan Cameron Signed-off-by: James Morse Reviewed-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Hanjun Guo Reviewed-by: Jeremy Linton Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 796e29b857aed89f83f70f2c199585c45db5dc0f Author: James Morse Date: Wed Nov 19 12:22:31 2025 +0000 ACPI / PPTT: Add a helper to fill a cpumask from a processor container The ACPI MPAM table uses the UID of a processor container specified in the PPTT to indicate the subset of CPUs and cache topology that can access each MPAM System Component (MSC). This information is not directly useful to the kernel. The equivalent cpumask is needed instead. Add a helper to find the processor container by its id, then walk the possible CPUs to fill a cpumask with the CPUs that have this processor container as a parent. CC: Dave Martin Reviewed-by: Sudeep Holla Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Reviewed-by: Hanjun Guo Reviewed-by: Jeremy Linton Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Peter Newman Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: James Morse Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas commit 0346625cd7f125d056e1424e98d0037a1baa4614 Author: Ulf Hansson Date: Wed Nov 5 10:54:08 2025 +0100 pmdomain: Extend the genpd governor for CPUs to account for IPIs When the genpd governor for CPUs, tries to select the most optimal idle state for a group of CPUs managed in a PM domain, it fails far too often. On a Dragonboard 410c, which is an arm64 based platform with 4 CPUs in one cluster that is using PSCI OS-initiated mode, we can observe that we often fail when trying to enter the selected idle state. This is certainly a suboptimal behaviour that leads to many unnecessary requests being sent to the PSCI FW. A simple dd operation that reads from the eMMC, to generate some IRQs and I/O handling helps us to understand the problem, while also monitoring the rejected counters in debugfs for the corresponding idle states of the genpd in question. Menu governor: cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 1451 437 91 149 0 S1 65194 558 149 172 0 dd if=/dev/mmcblk0 of=/dev/null bs=1M count=500 524288000 bytes (500.0MB) copied, 3.562698 seconds, 140.3MB/s cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 2694 1073 265 892 1 S1 74567 829 561 790 0 The dd completed in ~3.6 seconds and rejects increased with 586. Teo governor: cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 4976 2096 392 1721 2 S1 160661 1893 1309 1904 0 dd if=/dev/mmcblk0 of=/dev/null bs=1M count=500 524288000 bytes (500.0MB) copied, 3.543225 seconds, 141.1MB/s cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 5192 2194 433 1830 2 S1 167677 2891 3184 4729 0 The dd completed in ~3.6 seconds and rejects increased with 1916. The main reason to the above problem is pending IPIs for one of the CPUs that is affected by the idle state that the genpd governor selected. This leads to that the PSCI FW refuses to enter it. To improve the behaviour, let's start to take into account pending IPIs for CPUs in the genpd governor, hence we fallback to use the shallower per CPU idle state. Re-testing with this change shows a significant improved behaviour. - Menu governor: cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 2556 878 19 368 1 S1 69974 596 10 152 0 dd if=/dev/mmcblk0 of=/dev/null bs=1M count=500 524288000 bytes (500.0MB) copied, 3.522010 seconds, 142.0MB/s cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 3360 1320 28 819 1 S1 70168 710 11 267 0 The dd completed in ~3.5 seconds and rejects increased with 10. - Teo governor cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 5145 1861 39 938 1 S1 188887 3117 51 1975 0 dd if=/dev/mmcblk0 of=/dev/null bs=1M count=500 524288000 bytes (500.0MB) copied, 3.653100 seconds, 136.9MB/s cat /sys/kernel/debug/pm_genpd/power-domain-cluster/idle_states State Time Spent(ms) Usage Rejected Above Below S0 5260 1923 42 1002 1 S1 190849 4033 52 2892 0 The dd completed in ~3.7 seconds and rejects increased with 4. Note that, the rejected counters in genpd are also being accumulated in the rejected counters that are managed by cpuidle, yet on a per CPU idle states basis. Comparing these counters before/after this change, through cpuidle's sysfs interface shows the similar improvements. Signed-off-by: Ulf Hansson commit ccde6525183c5489de293cf91a441585fff3c847 Author: Ulf Hansson Date: Wed Nov 5 10:54:07 2025 +0100 smp: Introduce a helper function to check for pending IPIs When governors used during cpuidle try to find the most optimal idle state for a CPU or a group of CPUs, they are known to quite often fail. One reason for this is, that they are not taking into account whether there has been an IPI scheduled for any of the CPUs that are affected by the selected idle state. To enable pending IPIs to be taken into account for cpuidle decisions, introduce a new helper function, cpus_peek_for_pending_ipi(). Suggested-by: Thomas Gleixner Reviewed-by: Thomas Gleixner Signed-off-by: Ulf Hansson commit 80ed617a62fe076bbfe700c8289fc2118d724821 Author: Brian Masney Date: Thu Nov 6 18:40:43 2025 -0500 pmdomain: mediatek: convert from clk round_rate() to determine_rate() The round_rate() clk ops is deprecated in the clk framework in favor of the determine_rate() clk ops, so let's convert this driver so that round_rate() can be removed from the clk core. Signed-off-by: Brian Masney Reviewed-by: Nicolas Frattaroli Signed-off-by: Ulf Hansson commit 3ee4082545fe0867e2fe951b68f7a7f9217240fe Author: Claudiu Beznea Date: Wed Aug 27 13:03:37 2025 +0300 amba: bus: Drop dev_pm_domain_detach() call Starting with commit f99508074e78 ("PM: domains: Detach on device_unbind_cleanup()"), there is no longer a need to call dev_pm_domain_detach() in the bus remove function. The device_unbind_cleanup() function now handles this to avoid invoking devres cleanup handlers while the PM domain is powered off, which could otherwise lead to failures as described in the above-mentioned commit. Drop the explicit dev_pm_domain_detach() call and rely instead on the flags passed to dev_pm_domain_attach() to power off the domain. Signed-off-by: Claudiu Beznea Signed-off-by: Ulf Hansson commit d4aa5960025ab0946c96be050586cdd2346c6471 Author: Stanimir Varbanov Date: Fri Oct 31 20:33:06 2025 +0200 pmdomain: bcm: bcm2835-power: Prepare to support BCM2712 BCM2712 has a PM block but lacks asb and rpivid_asb register spaces. To avoid unwanted results add a check for asb existence during probe and also add a new register offset for bcm2712 to control grafx_v3d power domain. The decision to use the new register is implicit - if asb register base is null then the driver is probed for bcm2712 (the other supported SoCs have asb register space). Signed-off-by: Stanimir Varbanov Reviewed-by: Florian Fainelli Signed-off-by: Ulf Hansson commit b0671a5fd3201efc5dd38254f1917cbbd805936c Author: Nicolas Frattaroli Date: Thu Oct 30 14:17:10 2025 +0100 pmdomain: mediatek: mtk-mfg: select MAILBOX in Kconfig The mtk-mfg pmdomain driver calls common mailbox framework functions. If the common mailbox framework is not selected in the kernel's configuration, the build runs into a linker error, as the symbols are absent. The hardware mailbox Kconfig system, MAILBOX, has no dependencies of its own. It's therefore safe to "select" it rather than use "depend on". Declare this "select" dependency in the Kconfig for the driver. Fixes: 1ff1f0db6aec ("pmdomain: mediatek: Add support for MFlexGraphics") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510301311.TcOCnZ1s-lkp@intel.com/ Signed-off-by: Nicolas Frattaroli Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit f08e7a4e8d6ac4de677727af352ea33c6ce9f444 Author: Nicolas Frattaroli Date: Fri Oct 17 17:31:12 2025 +0200 pmdomain: mediatek: Add support for MFlexGraphics Various MediaTek SoCs use GPU integration silicon named "MFlexGraphics" by MediaTek. On the MT8196 and MT6991 SoCs, interacting with this integration silicon is required to power on the GPU. This glue silicon is in the form of an embedded microcontroller running special-purpose firmware, which autonomously adjusts clocks and regulators. Implement a driver, modelled as a pmdomain driver with a set_performance_state operation, to support these SoCs. The driver also exposes the actual achieved clock rate, as read back from the MCU, as common clock framework clocks, by acting as a clock provider as well. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Nicolas Frattaroli Signed-off-by: Ulf Hansson commit 19e668e81e273b43b28608e8e05f4fb090a32f5a Author: Ulf Hansson Date: Thu Oct 23 13:44:36 2025 +0200 pmdomain: mediatek: Fix build-errors Let's add the missing header to fix the reported build-errors. Fixes: df4e9ec1ed86 ("pmdomain: mediatek: Add support for secure HWCCF infra power on") Reported-by: Stephen Rothwell Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510231317.ZZxNaFG0-lkp@intel.com/ Signed-off-by: Ulf Hansson commit e938ef83a025a385f441467bf8443bc803a3d1e6 Author: Thorsten Blum Date: Tue Oct 21 15:51:53 2025 +0200 cpuidle: psci: Replace deprecated strcpy in psci_idle_init_cpu strcpy() is deprecated; use strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Ulf Hansson commit 47c7b3c24b42f27eccbb1b181c33619774e46474 Author: Finley Xiao Date: Fri Oct 17 17:38:34 2025 +0800 pmdomain: rockchip: Add support for RV1126B Add configuration and power domains for RV1126 SoC. Signed-off-by: Finley Xiao Reviewed-by: Heiko Stuebner Signed-off-by: Ulf Hansson commit 56b0d23017ec127163f7851f8ee6c88cec7f1599 Author: AngeloGioacchino Del Regno Date: Thu Sep 25 16:31:16 2025 +0200 pmdomain: mediatek: Add support for MT8196 HFRPSYS power domains Add support for the HFRPSYS Multimedia power domains found in the MediaTek MT8196 Chromebook SoC. Those power domains are all managed by the Hardware Voter MCU. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 5437b2813f8f8ed02ec2bca78de08a35fbaea85c Author: AngeloGioacchino Del Regno Date: Thu Sep 25 16:31:15 2025 +0200 pmdomain: mediatek: Add support for MT8196 SCPSYS power domains Add a new SPM bus protection block and add support for both the direct control and HW Voter control SCPSYS power domains found in the MT8196 and MT6991 SoCs. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 8e98badec1d5e1ab7755a2cdfd092c8623f86ee5 Author: AngeloGioacchino Del Regno Date: Thu Sep 25 16:31:14 2025 +0200 pmdomain: mediatek: Add support for secure HWCCF infra power on Some SoCs, like the MediaTek Dimensity 9400 (MT6991), have granular power controls and will disable power to the infracfg to save power when the platform is in deeper sleep states (or when no IP in the the infracfg macro-block is in use). These chips also cannot control the infracfg power states directly via AP register writes as those are protected by the secure world. Add a new MTK_SCPD_INFRA_PWR_CTL cap and, if present, make a call to the secure world to poweron the infracfg block, as the HWV IP resides in there, when executing HWV domains power sequences. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 88914db077b6c2920b29a3ec76109a2fd3cf8d38 Author: AngeloGioacchino Del Regno Date: Thu Sep 25 16:31:13 2025 +0200 pmdomain: mediatek: Add support for Hardware Voter power domains New generation SoCs like MT8196/MT6991 feature a new type of power domains, managed by a Hardware Voter (HWV) helper (through a SoC internal fixed-function MCU): this is used to collect votes from both the AP and the various other remote processors present in the SoC and transparently power on/off various power domains, avoiding unpowered access of registers in various internal IPs from all of the integrated remote processors (or from the AP...!). Add a new power domain type and differentiate between the old SCPSYS_MTCMOS_TYPE_DIRECT_CTL - where power domains are controlled directly by and exclusively from the Application Processor, and the new SCPSYS_MTCMOS_TYPE_HW_VOTER, where the power domains are voted through the HWV. With the two needing different handling, check the power domain type and assign a different power_{off,on} callback for pm_genpd: for this specific reason, also move the check for the SCPD cap MTK_SCPD_KEEP_DEFAULT_OFF after the assignment, and use the assigned power_on function instead of calling scpsys_power_on() directly to make that work for both HW_VOTER and DIRECT_CTL. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 72b0a7b34b40cbc877edf1f70520953767fb4583 Author: Jishnu Prakash Date: Wed Sep 24 16:17:08 2025 -0700 pmdomain: qcom: rpmhpd: Add RPMh power domain support for Kaanapali Add the RPMh power domains present in Kaanapali SoCs. Also increase the maximum allowed number of levels for ARC resources from 16 to 32, as needed starting on the Kaanapali SoC where the ARC vote registers have been expanded from 4 to 5 bits. Signed-off-by: Jishnu Prakash Signed-off-by: Jingyi Wang Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Ulf Hansson commit 198576665b3c2762174969a739ef98807a21a935 Author: Peng Fan Date: Mon Sep 22 10:21:10 2025 +0800 usb: dwc3: imx8mp: Set out of band wakeup for i.MX95 i.MX95 DWC3 inside HSIOMIX could still wakeup Linux, even if HSIOMIX power domain(Digital logic) is off. There is still always on logic have the wakeup capability which is out band wakeup capbility. So use device_set_out_band_wakeup for i.MX95 to make sure DWC3 could wakeup system even if HSIOMIX power domain is in off state. Acked-by: Thinh Nguyen Tested-by: Xu Yang Reviewed-by: Xu Yang Signed-off-by: Peng Fan Signed-off-by: Ulf Hansson commit 854825367a1d28b3b6c757134460d0fe29a0b4a6 Author: Peng Fan Date: Mon Sep 22 10:21:09 2025 +0800 usb: chipidea: ci_hdrc_imx: Set out of band wakeup for i.MX95 i.MX95 USB2 inside HSIOMIX could still wakeup Linux, even if HSIOMIX power domain(Digital logic) is off. There is still always on logic have the wakeup capability which is out band wakeup capbility. So use device_set_out_band_wakeup for i.MX95 to make sure usb2 could wakeup system even if HSIOMIX power domain is in off state. Tested-by: Xu Yang Reviewed-by: Xu Yang Signed-off-by: Peng Fan Acked-by: Peter Chen Signed-off-by: Ulf Hansson commit dfdcfc19fe16f9a0612a119d7a741ed4d7206427 Author: Xu Yang Date: Mon Sep 22 10:21:08 2025 +0800 usb: chipidea: core: detach power domain for ci_hdrc platform device When add a platform device by calling ci_hdrc_add_device(), this device will reuse OF node of its parent device. If power-domains property is provided in the OF node, both two platform devices will be attached to the same power domain. This should be unnecessary and may bring other inconsistent behavior. For example, to support wakeup capability, these two platform device need different power domain state. The parent device need NOT power domain on for out-band interrupt, but the ci_hdrc device need power domain on for in-band interrupt. The i.MX95 Soc support out-band wakeup interrupt, the user need to enable wakeup for the parent device, but if the user also enable wakeup for ci_hdrc device, the power domain will keep at on state finally. To exclude such inconsistent behavior and simplify the power management, detach power domain for ci_hdrc platform device. Reviewed-by: Ulf Hansson Signed-off-by: Xu Yang Acked-by: Peter Chen Tested-by: Xu Yang Signed-off-by: Ulf Hansson commit 3b7685da41838eda57f56e804014091769a93700 Author: Peng Fan Date: Mon Sep 22 10:21:07 2025 +0800 pmdomain: core: Allow power-off for out-of-band wakeup-capable devices Currently, if a device is configured as a system wakeup source, the PM domain core avoids powering off its power domain during system-wide suspend. However, this can lead to unnecessary power consumption, especially for devices whose wakeup logic resides in an always-on domain, i.e., devices with out-of-band wakeup capability. To address this, add a check for device_out_band_wakeup() in genpd_finish_suspend(). If the device supports out-of-band wakeup, its power domain can be safely powered off, just like regular devices without wakeup enabled. And same check in genpd_finish_resume(). This change improves power efficiency without compromising wakeup functionality. Signed-off-by: Peng Fan Reviewed-by: Dhruva Gole Signed-off-by: Ulf Hansson commit 4acbfb6c116be5989d5a0e38a48deca2d5b8bb92 Author: Peng Fan Date: Mon Sep 22 10:21:06 2025 +0800 PM: wakeup: Add out-of-band system wakeup support for devices Some devices can wake up the system from suspend even when their power domains are turned off. This is possible because their system-wakeup logic resides in an always-on power domain - indicating that they support out-of-band system wakeup. Currently, PM domain core doesn't power off such devices if they are marked as system wakeup sources. To better represent devices with out-of-band wakeup capability, this patch introduces a new flag out_band_wakeup in 'struct dev_pm_info'. Two helper APIs are added: - device_set_out_band_wakeup() - to mark a device as having out-of-band wakeup capability. - device_out_band_wakeup() - to query the flag. Allow the PM core and drivers to distinguish between regular and out-of-band wakeup sources, enable more accurate power management decision. Signed-off-by: Peng Fan Reviewed-by: Dhruva Gole Signed-off-by: Ulf Hansson commit 31e6e7e54b294f1015681ca284c28d37e94a48eb Author: Bart Van Assche Date: Thu Nov 13 15:52:43 2025 -0800 scsi: ufs: core: Use scsi_device_busy() Use scsi_device_busy() instead of open-coding it. This patch prepares for skipping the SCSI device budget map initialization in certain cases. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251113235252.2015185-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 35cfef3ccb8654489d0b962260e8bbdb4b2665e0 Merge: 6a23ae0a96a600 34194cb3850336 Author: Ulf Hansson Date: Wed Nov 19 18:03:56 2025 +0100 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.19. Signed-off-by: Ulf Hansson commit 02b5822d2fea1e89009ff167fed5aea2f1e1de85 Author: Bart Van Assche Date: Fri Nov 14 11:34:03 2025 -0800 scsi: ufs: core: Fix single doorbell mode support Commit 22089c218037 ("scsi: ufs: core: Optimize the hot path") accidentally broke support for the legacy single doorbell mode. The tag_set.shared_tags pointer is only != NULL if shared tag support is enabled. The UFS driver only enables shared tag support in MCQ mode. Fix this by handling legacy and MCQ modes differently in ufshcd_tag_to_cmd(). Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/linux-scsi/c988a6dd-588d-4dbc-ab83-bbee17f2a686@samsung.com/ Reported-by: André Draszik Closes: https://lore.kernel.org/linux-scsi/83ffbceb9e66b2a3b6096231551d969034ed8a74.camel@linaro.org/ Tested-by: Marek Szyprowski Fixes: 22089c218037 ("scsi: ufs: core: Optimize the hot path") Signed-off-by: Bart Van Assche Tested-by: André Draszik Link: https://patch.msgid.link/20251114193406.3097237-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 0f900f11002ff52391fc2aa4a75e59f26ed1c242 Author: Trond Myklebust Date: Wed Nov 19 08:43:21 2025 -0500 NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Ensure that the verifiers are initialised before calling d_splice_alias() in _nfs4_open_and_get_state(). Reported-by: Michael Stoler Fixes: cf5b4059ba71 ("NFSv4: Fix races between open and dentry revalidation") Signed-off-by: Trond Myklebust commit 865a5d1a29be48875ff68c6ba7e8377180ab8e33 Merge: 7ac60a14d3fce8 bf351bbec57fd4 Author: Jakub Kicinski Date: Wed Nov 19 08:33:52 2025 -0800 Merge branch 'net-stmmac-sanitise-stmmac_is_jumbo_frm' Russell King says: ==================== net: stmmac: sanitise stmmac_is_jumbo_frm() stmmac_is_jumbo_frm() takes skb->len, which is unsigned int, but the parameter is passed as an "int" and then tested using signed comparisons. This can cause bugs. Change the parameter to be unsigned. Also arrange for it to return a bool. ==================== Link: https://patch.msgid.link/aRxDqJSWxOdOaRt4@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bf351bbec57fd4d09177974f762cf553a5ef8663 Author: Russell King (Oracle) Date: Tue Nov 18 10:01:20 2025 +0000 net: stmmac: stmmac_is_jumbo_frm() returns boolean stmmac_is_jumbo_frm() returns whether the driver considers the frame size to be a jumbo frame, and thus returns 0/1 values. This is boolean, so convert it to return a boolean and use false/true instead. Also convert stmmac_xmit()'s is_jumbo to be bool, which causes several variables to be repositioned to keep it in reverse Christmas-tree order. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vLIWW-0000000Ewkl-21Ia@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b5adada61e02c19fce48641283f0031d28981066 Author: Russell King (Oracle) Date: Tue Nov 18 10:01:15 2025 +0000 net: stmmac: stmmac_is_jumbo_frm() len should be unsigned stmmac_is_jumbo_frm() and the is_jumbo_frm() methods take skb->len which is an unsigned int. Avoid an implicit cast to "int" via the method parameter and then incorrectly doing signed comparisons on this unsigned value. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vLIWR-0000000Ewkf-1Tdx@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7ac60a14d3fce87f0bfd0e50a7bfd5e683c33817 Author: Russell King (Oracle) Date: Tue Nov 18 09:41:33 2025 +0000 net: stmmac: convert priv->sph* to boolean and rename priv->sph* only have 'true' and 'false' used with them, yet they are an int. Change their type to a bool, and rename to make their usage more clear. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vLIDN-0000000Evur-2NLU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a131fd60796dbfaa6297c0c8ca8e2a7610a64281 Author: Yao Zihong Date: Wed Nov 19 00:23:25 2025 +0800 selftests/riscv: Add Zicbop prefetch test Add selftests to cbo.c to verify Zicbop extension behavior, and split the previous `--sigill` mode into two options so they can be tested independently. The test checks: - That hwprobe correctly reports Zicbop presence and block size. - That prefetch instructions execute without exception on valid and NULL addresses when Zicbop is present. Signed-off-by: Yao Zihong Reviewed-by: Andrew Jones Link: https://patch.msgid.link/20251118162436.15485-3-zihong.plct@isrc.iscas.ac.cn Signed-off-by: Paul Walmsley commit e0a504984a88a2f1c0131aca5115fd529fc9974a Author: Yao Zihong Date: Wed Nov 19 00:23:24 2025 +0800 riscv: hwprobe: Expose Zicbop extension and its block size - Add `RISCV_HWPROBE_EXT_ZICBOP` to report the presence of the Zicbop extension. - Add `RISCV_HWPROBE_KEY_ZICBOP_BLOCK_SIZE` to expose the block size (in bytes) when Zicbop is supported. - Update hwprobe.rst to document the new extension bit and block size key, following the existing Zicbom/Zicboz style. Reviewed-by: Andrew Jones Signed-off-by: Yao Zihong Link: https://patch.msgid.link/20251118162436.15485-2-zihong.plct@isrc.iscas.ac.cn [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley commit ad1bb4b8525e497c95d48a2d3fd2e81fba4b5ad7 Author: Xu Lu Date: Mon Oct 20 12:20:50 2025 +0800 riscv: Introduce Zalasr instructions Introduce l{b|h|w|d}.{aq|aqrl} and s{b|h|w|d}.{rl|aqrl} instruction encodings. Signed-off-by: Xu Lu Reviewed-by: Guo Ren Link: https://patch.msgid.link/20251020042056.30283-5-luxu.kernel@bytedance.com Signed-off-by: Paul Walmsley commit f4922b69165735e81752ee47d174f873e989a449 Author: Xu Lu Date: Mon Oct 20 12:20:49 2025 +0800 riscv: hwprobe: Export Zalasr extension Export the Zalasr extension to userspace using hwprobe. Signed-off-by: Xu Lu Link: https://patch.msgid.link/20251020042056.30283-4-luxu.kernel@bytedance.com Signed-off-by: Paul Walmsley commit 4640be2588713766b3141998d2e396121b337e41 Author: Xu Lu Date: Mon Oct 20 12:20:48 2025 +0800 dt-bindings: riscv: Add Zalasr ISA extension description Add description for the Zalasr ISA extension Signed-off-by: Xu Lu Acked-by: Conor Dooley Link: https://patch.msgid.link/20251020042056.30283-3-luxu.kernel@bytedance.com Signed-off-by: Paul Walmsley commit c9651fbc6051d305765f9c7528b90ad6c88ba4f4 Author: Xu Lu Date: Mon Oct 20 12:20:47 2025 +0800 riscv: Add ISA extension parsing for Zalasr Add parsing for Zalasr ISA extension. Signed-off-by: Xu Lu Link: https://patch.msgid.link/20251020042056.30283-2-luxu.kernel@bytedance.com [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley commit f0ae09a89267552bde346c8cb27acb838a21eb1c Author: Yong-Xuan Wang Date: Mon Nov 17 21:19:30 2025 -0700 selftests: riscv: Add test for the Vector ptrace interface Add a test case that does some basic verification of the Vector ptrace interface. This forks a child process then using ptrace to inspect and manipulate the v31 register of the child. Signed-off-by: Yong-Xuan Wang Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251013091318.467864-3-yongxuan.wang@sifive.com Signed-off-by: Paul Walmsley commit 6efb1a9462ef0023f3f96a7b88542e1f878e31a0 Author: Yong-Xuan Wang Date: Mon Nov 17 21:19:29 2025 -0700 riscv: ptrace: Optimize the allocation of vector regset The vector regset uses the maximum possible vlen value to estimate the .n field. But not all the hardwares support the maximum vlen. Linux might wastes time to prepare a large memory buffer(about 2^6 pages) for the vector regset. The regset can only copy vector registers when the process are using vector. Add .active callback and determine the n field of vector regset in riscv_v_setup_ctx_cache() doesn't affect the ptrace syscall and coredump. It can avoid oversized allocations and better matches real hardware limits. Signed-off-by: Yong-Xuan Wang Reviewed-by: Greentime Hu Reviewed-by: Andy Chiu Tested-by: Andy Chiu Link: https://patch.msgid.link/20251013091318.467864-2-yongxuan.wang@sifive.com Signed-off-by: Paul Walmsley commit 3ac022bf389d60e696e4d3156b72f3ccd6e6368b Author: Chunyan Zhang Date: Mon Nov 17 21:19:25 2025 -0700 raid6: test: Add support for RISC-V Add RISC-V code to be compiled to allow the userspace raid6test program to be built and run on RISC-V. Signed-off-by: Chunyan Zhang Reviewed-by: Alexandre Ghiti Tested-by: Alexandre Ghiti Link: https://patch.msgid.link/20250718072711.3865118-6-zhangchunyan@iscas.ac.cn Signed-off-by: Paul Walmsley commit 3c58d7a51341fa032eda45d8b9904dbfae120ef5 Author: Chunyan Zhang Date: Mon Nov 17 21:19:25 2025 -0700 raid6: riscv: Allow code to be compiled in userspace To support userspace raid6test, this patch adds __KERNEL__ ifdef for kernel header inclusions also userspace wrapper definitions to allow code to be compiled in userspace. This patch also drops the NSIZE macro, instead of using the vector length, which can work for both kernel and user space. Reviewed-by: Alexandre Ghiti Signed-off-by: Chunyan Zhang Link: https://patch.msgid.link/20250718072711.3865118-5-zhangchunyan@iscas.ac.cn Signed-off-by: Paul Walmsley commit 6fcce9f028fb75ce03e4221f5f4f652741d178c4 Author: Chunyan Zhang Date: Mon Nov 17 21:19:24 2025 -0700 raid6: riscv: Prevent compiler from breaking inline vector assembly code To prevent the compiler from breaking the inline vector assembly code, this code must be built without compiler support for vector. Signed-off-by: Chunyan Zhang Link: https://patch.msgid.link/20250718072711.3865118-4-zhangchunyan@iscas.ac.cn [pjw@kernel.org: cleaned up commit message] Signed-off-by: Paul Walmsley commit 724c69447975e1e0854082c324b6871c8e2214f8 Author: Vivian Wang Date: Mon Nov 17 21:19:23 2025 -0700 riscv: cmpxchg: Use riscv_has_extension_likely Use riscv_has_extension_likely() to check for RISCV_ISA_EXT_ZAWRS, replacing the use of asm goto with ALTERNATIVE. The "likely" variant is used to match the behavior of the original implementation using ALTERNATIVE("j %l[no_zawrs]", "nop", ...). Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20251020-riscv-altn-helper-wip-v4-5-ef941c87669a@iscas.ac.cn Signed-off-by: Paul Walmsley commit 6b85e9ac4a25c5e69f8121e95eea14da6e3df2fa Author: Vivian Wang Date: Mon Nov 17 21:19:22 2025 -0700 riscv: bitops: Use riscv_has_extension_likely Use riscv_has_extension_likely() to check for RISCV_ISA_EXT_ZBB, replacing the use of asm goto with ALTERNATIVE. The "likely" variant is used to match the behavior of the original implementation using ALTERNATIVE("j %l[legacy]", "nop", ...). Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20251020-riscv-altn-helper-wip-v4-4-ef941c87669a@iscas.ac.cn Signed-off-by: Paul Walmsley commit 8261a9d167e8b3007c0e830a1f7ab8c8b8c24b79 Author: Vivian Wang Date: Mon Nov 17 21:19:22 2025 -0700 riscv: hweight: Use riscv_has_extension_likely Use riscv_has_extension_likely() to check for RISCV_ISA_EXT_ZBB, replacing the use of asm goto with ALTERNATIVE. The "likely" variant is used to match the behavior of the original implementation using ALTERNATIVE("j %l[legacy]", "nop", ...). Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20251020-riscv-altn-helper-wip-v4-3-ef941c87669a@iscas.ac.cn Signed-off-by: Paul Walmsley commit 1c7d491d8678ee056ee91de5cb14c9afa50175cb Author: Vivian Wang Date: Mon Nov 17 21:19:21 2025 -0700 riscv: checksum: Use riscv_has_extension_likely Use riscv_has_extension_likely() to check for RISCV_ISA_EXT_ZBB, replacing the use of asm goto with ALTERNATIVE. The "likely" variant is used to match the behavior of the original implementation using ALTERNATIVE("j %l[no_zbb]", "nop", ...). While we're at it, also remove bogus comment about Zbb being likely available. We have to choose between "likely" and "unlikely" due to limitations of the asm goto feature, but that does not mean we should put a bad comment on why we pick "likely" over "unlikely". Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20251020-riscv-altn-helper-wip-v4-2-ef941c87669a@iscas.ac.cn Signed-off-by: Paul Walmsley commit 0a067ae21bf26e245f2687ef24cfb7302393a8a0 Author: Vivian Wang Date: Mon Nov 17 21:19:21 2025 -0700 riscv: pgtable: Use riscv_has_extension_unlikely Use riscv_has_extension_unlikely() to check for RISCV_ISA_EXT_SVVPTC, replacing the use of asm goto with ALTERNATIVE. The "unlikely" variant is used to match the behavior of the original implementation using ALTERNATIVE("nop", "j %l[svvptc]", ...). Note that this makes the check for RISCV_ISA_EXT_SVVPTC a runtime one if RISCV_ALTERNATIVE=n, but it should still be worthwhile to do so given that TLB flushes are relatively slow. Signed-off-by: Vivian Wang Link: https://patch.msgid.link/20251020-riscv-altn-helper-wip-v4-1-ef941c87669a@iscas.ac.cn Signed-off-by: Paul Walmsley commit c9a71610448843b6178375547627b2272f0d6193 Author: Vishal Moola (Oracle) Date: Mon Nov 17 21:19:14 2025 -0700 riscv: Remove __GFP_HIGHMEM masking Remove unnecessary __GFP_HIGHMEM masking, which was introduced with commit 380f2c1ae9d4 ("riscv: convert alloc_{pmd, pte}_late() to use ptdescs"). GFP_KERNEL doesn't contain __GFP_HIGHMEM. Signed-off-by: Vishal Moola (Oracle) Link: https://patch.msgid.link/20251107182620.95844-1-vishal.moola@gmail.com Signed-off-by: Paul Walmsley commit 231fb999a9acd17b1335e79f0fd6fc627353a6bc Author: Anup Patel Date: Mon Nov 17 21:19:10 2025 -0700 RISC-V: Enable HOTPLUG_PARALLEL for secondary CPUs The core kernel already supports parallel bringup of secondary CPUs (aka HOTPLUG_PARALLEL). The x86 and MIPS architectures already use HOTPLUG_PARALLEL and ARM is also moving toward it. On RISC-V, there is no arch specific global data accessed in the RISC-V secondary CPU bringup path so enabling HOTPLUG_PARALLEL for RISC-V would only require: 1) Providing RISC-V specific arch_cpuhp_kick_ap_alive() 2) Calling cpuhp_ap_sync_alive() from smp_callin() This patch is tested natively with OpenSBI on QEMU RV64 virt machine with 64 cores and also tested with KVM RISC-V guest with 32 VCPUs. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Link: https://patch.msgid.link/20250905122512.71684-1-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 6f880e7bd103c38d583326f176db8aae8c8b71c2 Author: Peng Fan Date: Wed Nov 19 12:21:57 2025 +0800 remoteproc: imx_dsp_rproc: Simplify start/stop error handling Replace goto-based error handling with early return pattern in imx_dsp_rproc_{start,stop}() functions, and simplify if-else logic. No functional changes, only code structure improvements for better maintainability. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-12-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit ad5f82ab04bcad56de85723bdd48e44b70a16948 Author: Thorsten Blum Date: Wed Nov 19 14:52:17 2025 +0100 ALSA: pcmtest: Replace deprecated strcpy with strscpy_pad in setup_patt_bufs strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy_pad(), and use kmalloc() instead of kzalloc() because strscpy_pad() zero-pads the destination buffer and therefore avoids writing to it twice. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251119135217.233084-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 5c33a631a5780df70e2b392539a98e4a624cd752 Author: Peng Fan Date: Wed Nov 19 12:21:56 2025 +0800 remoteproc: imx_rproc: Remove enum imx_rproc_method There is no user of enum imx_rproc_method after moved to ops based method. Remove it. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-11-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 3f5c1277a9e947d251983042bf406405a35a52cc Author: Peng Fan Date: Wed Nov 19 12:21:55 2025 +0800 remoteproc: imx_dsp_rproc: Simplify IMX_RPROC_RESET_CONTROLLER switch case Introduce imx_dsp_rproc_reset_ctr_{start, stop, detect_mode}() helper functions for i.MX variants using IMX_RPROC_RESET_CONTROLLER to manage remote processors. Allows the removal of the IMX_RPROC_RESET_CONTROLLER switch-case blocks from imx_dsp_rproc_[start,stop,detect_mode](), resulting in cleaner and more maintainable code. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-10-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit d5eb4d512fb70a6c85bb5a1ec8c6b642f45c518f Author: Peng Fan Date: Wed Nov 19 12:21:54 2025 +0800 remoteproc: imx_dsp_rproc: Simplify IMX_RPROC_SCU_API switch case Introduce imx_dsp_rproc_scu_api_{start, stop, detect_mode}() helper functions for i.MX variants using IMX_RPROC_SCU_API to manage remote processors. Allows the removal of the IMX_RPROC_SCU_API switch-case blocks from imx_dsp_rproc_[start,stop,detect_mode](), resulting in cleaner and more maintainable code. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-9-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 8bff3a2bf7c50bf45766edcd5440329d6b5cdf96 Author: David Heidelberg Date: Wed Nov 19 15:21:37 2025 +0100 drm/panel: sofef00: Non-continuous mode and video burst are supported The panel supports both modes. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-12-6cd55471e84e@ixit.cz commit 73540e5e7c52264633c66aad681e53f7e2f54c57 Author: David Heidelberg Date: Wed Nov 19 15:21:36 2025 +0100 drm/panel: sofef00: Mark the LPM mode always-on The panel operated in low-power mode, with exception of changing the brightness levels. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-11-6cd55471e84e@ixit.cz commit 940c451981ebd0901f39675c9ff3b3e1c9760571 Author: David Heidelberg Date: Wed Nov 19 15:21:35 2025 +0100 drm/panel: sofef00: Simplify get_modes Levearage drm_connector_helper_get_modes_fixed helper function. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-10-6cd55471e84e@ixit.cz commit 6a353661e7058795a800de3535e4e1448d125676 Author: David Heidelberg Date: Wed Nov 19 15:21:34 2025 +0100 drm/panel: sofef00: Introduce compatible which includes the panel name Compatible should correspond to the panel used and the driver currently supports only AMS628NW01 panel. Adapt the internal driver structures to reflect the name. Original, not very descriptive, compatible is kept to ensure compatibility with older device-trees. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-9-6cd55471e84e@ixit.cz commit e2e94464cf44f91c92eb631d609f812c7aef8840 Author: Casey Connolly Date: Wed Nov 19 15:21:33 2025 +0100 drm/panel: sofef00: Initialise at 50% brightness Initialising at max brightness is not necessary. Half brightness is much more comfortable. Signed-off-by: Casey Connolly Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-8-6cd55471e84e@ixit.cz commit 1e534a56578bbea59165c3507d2b967f29771792 Author: Casey Connolly Date: Wed Nov 19 15:21:32 2025 +0100 drm/panel: sofef00: Add prepare_prev_first flag to drm_panel This corrects the host initialisation sequence so that we can send DSI/DCS commands in prepare(). Signed-off-by: Casey Connolly Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-7-6cd55471e84e@ixit.cz commit 9f1ba273f55f93759cfd1098e0682b03eb115bb4 Author: David Heidelberg Date: Wed Nov 19 15:21:31 2025 +0100 drm/panel: sofef00: Introduce page macro Introducing the macro make the code a bit clearer. Looking at other Samsung drivers, I assume it's lvl2, thou due to not available documentation it's only educated guess. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-6-6cd55471e84e@ixit.cz commit 18642542ac4916807fc0925cdcb9356f5802e2ae Author: David Heidelberg Date: Wed Nov 19 15:21:30 2025 +0100 drm/panel: sofef00: Split sending commands to the enable/disable functions It's not possible to send DSI panel commands in the .unprepare. Move it to .disable and do similar for prepare, where we move the display on to the .enable. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-5-6cd55471e84e@ixit.cz commit dfc7e0859e05991b0920bd249434e44866a11bd1 Author: David Heidelberg Date: Wed Nov 19 15:21:29 2025 +0100 drm/panel: sofef00: Handle all regulators Recently we documented, there is more than vddio regulator, adapt the driver to work with VCI and POC regulator. Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-4-6cd55471e84e@ixit.cz commit 05aeb5bb4b699b51f88d9f5585005b6eb66a496b Author: David Heidelberg Date: Wed Nov 19 15:21:28 2025 +0100 drm/panel: sofef00: Clean up panel description after s6e3fc2x01 removal Remove leftover from s6e3fc2x01 support drop and clarify supported panel. The Samsung SOFEF00 DDIC is used in multiple phones, so describe it properly and generalize. Fixes: e1eb7293ab41 ("drm/panel: samsung-sofef00: Drop s6e3fc2x01 support") Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-3-6cd55471e84e@ixit.cz commit 1388c08c84a2b1f37abae656c1f88d18ecb1364e Author: David Heidelberg Date: Wed Nov 19 15:21:26 2025 +0100 dt-bindings: panel: Convert Samsung SOFEF00 DDIC into standalone yaml Reason for moving from simple panel is this DDIC has three supplies, while panel-simple-dsi is limited to one. Previous compatible only described the DDIC, but didn't include panel connected to it. Let's fix it, and offer bindings authors two compatibles to distinguish the connected panel. Basic description for SOFEF00 DDIC with attached panels - Samsung AMS601NT22 6.01 inch, 1080x2160 pixels, 18:9 ratio - Samsung AMS628NW01 6.28 inch, 1080x2280 pixels, 19:9 ratio There is only one user which uses samsung,sofef00 and it's updated to comply within this patch series. Reviewed-by: Krzysztof Kozlowski Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251119-sofef00-rebuild-v3-1-6cd55471e84e@ixit.cz commit 9f356d1277343861810c1e762742cf383b639a3a Author: Peng Fan Date: Wed Nov 19 12:21:53 2025 +0800 remoteproc: imx_dsp_rproc: Simplify IMX_RPROC_MMIO switch case Introduce imx_dsp_rproc_mmio_{start, stop, detect_mode}() helper functions for i.MX variants using IMX_RPROC_MMIO to manage remote processors. Allows the removal of the IMX_RPROC_MMIO switch-case blocks from imx_dsp_rproc_[start,stop,detect_mode](), resulting in cleaner and more maintainable code. No functional changes. Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Frank Li Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-8-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 89b34ebed02ee39ae02069dcf2e5728aceec9deb Author: Chaoyi Chen Date: Thu Nov 6 10:06:28 2025 +0800 drm/panel: ilitek-ili9881d: Add support for Wanchanglong W552946AAA panel W552946AAA is a panel by Wanchanglong. This panel utilizes the Ilitek ILI9881D controller. W552946AAA is similar to W552946ABA, but the W552946AAA only uses 2 lanes. Tested on rk3506g-evb1-v10. Signed-off-by: Chaoyi Chen Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251106020632.92-6-kernel@airkyi.com commit 15e794bcbc9527736d33c96412ce077bd817d9af Author: Chaoyi Chen Date: Thu Nov 6 10:06:24 2025 +0800 dt-bindings: ili9881c: Add compatible string for Wanchanglong w552946aaa Like w552946aba, w552946aaa uses the Ilitek ILI9881D controller chip, and it supports up to 2 lanes. Signed-off-by: Chaoyi Chen Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251106020632.92-2-kernel@airkyi.com commit 66395eac5d557d76a599858f6b67f7bf8a84a005 Author: Peng Fan Date: Wed Nov 19 12:21:52 2025 +0800 remoteproc: imx_dsp_rproc: Move imx_dsp_rproc_dcfg closer to imx_dsp_rproc_of_match Move the imx_dsp_rproc_dcfg structure definitions closer to imx_dsp_rproc_of_match to prepare for adding start/stop/detect_mode ops for each i.MX variant. Avoids the need to declare function prototypes such as 'static int imx_dsp_rproc_mbox_init(struct imx_dsp_rproc *priv)' at the beginning of the file, improving code organization and readability. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-7-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 93f5a0dc2b7c2df71a93e0fc59edae474bb84c6f Author: Josua Mayer Date: Mon Nov 17 13:28:47 2025 +0100 drm/panel: ronbo-rb070d30: fix warning with gpio controllers that sleep The ronbo-rb070d30 controles the various gpios for reset, standby, vertical and horizontal flip using the non-sleeping gpiod_set_value() function. Switch to using gpiod_set_value_cansleep() when controlling reset_gpio to support GPIO providers that may sleep, such as I2C GPIO expanders. This fixes noisy complaints in kernel log for gpio providers that do sleep. Signed-off-by: Josua Mayer Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251117-imx8mp-hb-iiot-v3-5-bf1a4cf5fa8e@solid-run.com commit 72539c4b9e482f397cc9340bcd97bb7643c0692d Author: Josua Mayer Date: Mon Nov 17 13:28:45 2025 +0100 dt-bindings: panel: lvds: add Winstar WF70A8SYJHLNGA Add Winstar WF70A8SYJHLNGA 7 inch WSVGA lvds panel. Acked-by: Conor Dooley Signed-off-by: Josua Mayer Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251117-imx8mp-hb-iiot-v3-3-bf1a4cf5fa8e@solid-run.com commit 779640415ea28abb60bb7641d50f1d9cccaa4d73 Author: Josua Mayer Date: Mon Nov 17 13:28:44 2025 +0100 dt-bindings: display: panel: ronbo,rb070d30: panel-common ref Add missing ref on panel-common.yaml for this dsi panel so that common properties can be shared. Drop reset-gpios and backlight as they are already in panel-common. Switch from additionalProperties to unevaluatedProperties so that common panel properties are available without repeating them in this binding. Notably panel-common defines the "port" property for linking panels to a source - which was missing from this panel. Mark it as required. Signed-off-by: Josua Mayer Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251117-imx8mp-hb-iiot-v3-2-bf1a4cf5fa8e@solid-run.com commit 606e4811694a334fe8a1190a4e1d8e62d4c582df Author: Peng Fan Date: Wed Nov 19 12:21:51 2025 +0800 remoteproc: imx_dsp_rproc: Use start/stop/detect_mode ops from imx_rproc_dcfg Allow each platform to provide its own implementation of start/stop/ detect_mode operations, and prepare to eliminate the need for multiple switch-case statements. Improve code readability and maintainability by encapsulating platform-specific behavior. No functional changes. Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Frank Li Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-6-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit c8fd04c0e73370486fcb9203a1c90c244b7fa1ed Author: Abhishek Rajput Date: Mon Nov 17 12:17:02 2025 +0530 drm/panel: jadard-jd9365da-h3: Use dev_err_probe() instead of DRM_DEV_ERROR() during probing The DRM_DEV_ERROR() has been deprecated, and use dev_err_probe() can be better. The other reason is that dev_err_probe() help avoid unexpected repeated err logs during defered probing. Signed-off-by: Abhishek Rajput Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251117064702.222424-1-abhiraj21put@gmail.com commit 8049dc7b631e33a42d8413fe48b043113afa914c Author: Peng Fan Date: Wed Nov 19 12:21:50 2025 +0800 remoteproc: imx_dsp_rproc: Drop extra space Drop extra space between return and zero. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-5-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 1b2a9ec82099a39611705884c446cd45b6738537 Author: Fabio Estevam Date: Fri Nov 14 23:58:27 2025 -0300 drm/panel: simple: Add Raystar RFF500F-AWH-DNN panel entry Add support for the Raystar RFF500F-AWH-DNN 5.0" TFT 840x480 LVDS panel. Signed-off-by: Fabio Estevam Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251115025827.3113790-3-festevam@gmail.com commit 1594c6da54838823f7f88f7b692bd917530f6bd3 Author: Fabio Estevam Date: Fri Nov 14 23:58:26 2025 -0300 dt-bindings: display: simple: Add Raystar RFF500F-AWH-DNN panel Add Raystar RFF500F-AWH-DNN 5.0" TFT 840x480 LVDS panel compatible string. Signed-off-by: Fabio Estevam Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251115025827.3113790-2-festevam@gmail.com commit 9c1cd9e01c46bca66df47a4775685a862114c3a7 Author: Fabio Estevam Date: Fri Nov 14 23:58:25 2025 -0300 dt-bindings: vendor-prefixes: Add Raystar Optronics, Inc Raystar Optronics is an LCD manufacturer based in Taiwan: https://www.raystar-optronics.com/ Add a vendor prefix for it. Signed-off-by: Fabio Estevam Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251115025827.3113790-1-festevam@gmail.com commit e819a62d52030a26205ec09cba8797b6dc987a87 Author: Peng Fan Date: Wed Nov 19 12:21:49 2025 +0800 remoteproc: imx_dsp_rproc: Use dev_err_probe() for firmware and mode errors Use dev_err_probe() to simplify the code. No functional change. Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Frank Li Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-4-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit d082a3ebb3a31aef51ccf8b2e0426679c8c99e83 Author: Svyatoslav Ryhel Date: Mon Nov 10 11:14:35 2025 +0200 gpu/drm: panel: simple-panel: add Samsung LTL106AL01 LVDS panel support Samsung LTL106AL01 is a 10.6" FWXGA (1366x768) simple LVDS panel found in Microsoft Surface RT tablet. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251110091440.5251-6-clamor95@gmail.com commit 1acffba4ec99d1ef9d35aeeac2ef03d199729343 Author: Svyatoslav Ryhel Date: Mon Nov 10 11:14:34 2025 +0200 dt-bindings: display: panel: document Samsung LTL106AL01 simple panel Document Samsung LTL106AL01 simple LVDS panel. Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251110091440.5251-5-clamor95@gmail.com commit 02349a51368337ceac6a79eb2bd188c457f6e240 Author: Svyatoslav Ryhel Date: Mon Nov 10 11:14:32 2025 +0200 gpu/drm: panel: add support for LG LD070WX3-SL01 MIPI DSI panel The LD070WX3 is a Color Active Matrix Liquid Crystal Display with an integral Light Emitting Diode (LED) backlight system. The matrix employs a-Si Thin Film Transistor as the active element. It is a transmissive type display operating in the normally Black mode. This TFT-LCD has 7.0 inches diagonally measured active display area with WXGA resolution (800 by 1280 pixel array). LG LD070WX3-SL01 MIPI DSI panel was treated as simple DSI panel when it is actually not and requires proper setup for correct work. Simple panel work relied on preliminary configuration done by bootloader. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Douglas Anderson Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251110091440.5251-3-clamor95@gmail.com commit 88a18859791e7217c6ddf849bbf62484b9250bd2 Author: Svyatoslav Ryhel Date: Mon Nov 10 11:14:31 2025 +0200 dt-bindings: display: panel: properly document LG LD070WX3 panel LG LD070WX3-SL01 was mistakenly documented as a simple DSI panel, which it clearly is not. Address this by adding the proper schema for this panel. There is only one user of this panel binding in the mainline Linux kernel, which is the Nvidia tablet Tegra Note 7. Its panel is broken anyway since it cannot initialize properly if the bootloader does not leave a pre-initialized panel. It also cannot suspend or re-initialize properly, since no DSI configuration is set and it has a loose regulator which relies on an always-on property rather than being hooked to the panel where it belongs. Tegra Note 7 device tree is adjusted as a part of this series. Signed-off-by: Svyatoslav Ryhel Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://patch.msgid.link/20251110091440.5251-2-clamor95@gmail.com commit 412060242303d3c6aae55b1e0b7d040c30bd207d Author: Peng Fan Date: Wed Nov 19 12:21:48 2025 +0800 remoteproc: imx_dsp_rproc: Use devm_pm_runtime_enable() helper Current code on the cleanup path just disables runtime PM for a device. Using resource managed version devm_pm_runtime_enable() registers a cleanup callback that sets autosuspend to false and then disables runtime PM for a device. So, basically the same functionality as we don't use autosuspend anyway. As a result, the .remove callback is no longer needed, reducing boilerplate code. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-3-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 36951036a725271826773e7feb852496b16dc38d Author: Peng Fan Date: Wed Nov 19 12:21:47 2025 +0800 remoteproc: imx_dsp_rproc: Use devm_rproc_add() helper Replace manual rproc_add() and cleanup logic with devm_rproc_add(), which ties the remoteproc lifecycle to the device's lifecycle. This simplifies error handling and ensures proper cleanup. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-2-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit 46bddb5fbe7e3cb73204a952dbd4687cf0974ef5 Author: Andy Shevchenko Date: Tue Nov 11 12:18:36 2025 +0100 mfd: simple-mfd-i2c: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251111111930.796837-3-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 81d2cc9272df8c01e36a963dd8b23ca585b68032 Author: Andy Shevchenko Date: Tue Nov 11 12:18:35 2025 +0100 mfd: simple-mfd-i2c: Make ID table style consistent The lines in the OF ID table are written in three different styles. Choose the most common in the kernel and update accordingly. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251111111930.796837-2-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 3003773ad67ace7c2a0394efdca122824c709dd5 Author: Peng Fan Date: Wed Nov 19 12:21:46 2025 +0800 remoteproc: imx_dsp_rproc: Simplify power domain attach and error handling Refactor imx_dsp_attach_pm_domains() to use devm_pm_domain_attach_list() directly, removing manual detach logic and simplifying resource management. Also replace verbose error handling in imx_dsp_rproc_probe() with dev_err_probe() for cleaner and more consistent error reporting. No functional changes. Reviewed-by: Frank Li Reviewed-by: Daniel Baluta Reviewed-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Tested-by: Iuliana Prodan Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20251119-imx-dsp-2025-11-19-v4-1-adafd342d07b@nxp.com Signed-off-by: Mathieu Poirier commit cb1fa2e999558fd93b519f7c4c16e75e805af1e6 Author: Huang Ying Date: Fri Nov 14 16:54:03 2025 +0800 arm64, tlbflush: don't TLBI broadcast if page reused in write fault A multi-thread customer workload with large memory footprint uses fork()/exec() to run some external programs every tens seconds. When running the workload on an arm64 server machine, it's observed that quite some CPU cycles are spent in the TLB flushing functions. While running the workload on the x86_64 server machine, it's not. This causes the performance on arm64 to be much worse than that on x86_64. During the workload running, after fork()/exec() write-protects all pages in the parent process, memory writing in the parent process will cause a write protection fault. Then the page fault handler will make the PTE/PDE writable if the page can be reused, which is almost always true in the workload. On arm64, to avoid the write protection fault on other CPUs, the page fault handler flushes the TLB globally with TLBI broadcast after changing the PTE/PDE. However, this isn't always necessary. Firstly, it's safe to leave some stale read-only TLB entries as long as they will be flushed finally. Secondly, it's quite possible that the original read-only PTE/PDEs aren't cached in remote TLB at all if the memory footprint is large. In fact, on x86_64, the page fault handler doesn't flush the remote TLB in this situation, which benefits the performance a lot. To improve the performance on arm64, make the write protection fault handler flush the TLB locally instead of globally via TLBI broadcast after making the PTE/PDE writable. If there are stale read-only TLB entries in the remote CPUs, the page fault handler on these CPUs will regard the page fault as spurious and flush the stale TLB entries. To test the patchset, make the usemem.c from vm-scalability (https://git.kernel.org/pub/scm/linux/kernel/git/wfg/vm-scalability.git). support calling fork()/exec() periodically. To mimic the behavior of the customer workload, run usemem with 4 threads, access 100GB memory, and call fork()/exec() every 40 seconds. Test results show that with the patchset the score of usemem improves ~40.6%. The cycles% of TLB flush functions reduces from ~50.5% to ~0.3% in perf profile. Signed-off-by: Huang Ying Reviewed-by: Ryan Roberts Reviewed-by: Barry Song Acked-by: Zi Yan Cc: Will Deacon Cc: Andrew Morton Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Vlastimil Babka Cc: Baolin Wang Cc: Yang Shi Cc: Christoph Lameter (Ampere) Cc: Dev Jain Cc: Anshuman Khandual Cc: Kefeng Wang Cc: Kevin Brodsky Cc: Yin Fengwei Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org Reviewed-by: David Hildenbrand (Red Hat) Signed-off-by: Catalin Marinas commit 79301c7d605a10efea35af08167e0a362d8dffb1 Author: Huang Ying Date: Fri Nov 14 16:54:02 2025 +0800 mm: add spurious fault fixing support for huge pmd The page faults may be spurious because of the racy access to the page table. For example, a non-populated virtual page is accessed on 2 CPUs simultaneously, thus the page faults are triggered on both CPUs. However, it's possible that one CPU (say CPU A) cannot find the reason for the page fault if the other CPU (say CPU B) has changed the page table before the PTE is checked on CPU A. Most of the time, the spurious page faults can be ignored safely. However, if the page fault is for the write access, it's possible that a stale read-only TLB entry exists in the local CPU and needs to be flushed on some architectures. This is called the spurious page fault fixing. In the current kernel, there is spurious fault fixing support for pte, but not for huge pmd because no architectures need it. But in the next patch in the series, we will change the write protection fault handling logic on arm64, so that some stale huge pmd entries may remain in the TLB. These entries need to be flushed via the huge pmd spurious fault fixing mechanism. Signed-off-by: Huang Ying Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Zi Yan Cc: Will Deacon Cc: Andrew Morton Cc: Vlastimil Babka Cc: Baolin Wang Cc: Ryan Roberts Cc: Yang Shi Cc: Christoph Lameter (Ampere) Cc: Dev Jain Cc: Barry Song Cc: Anshuman Khandual Cc: Kefeng Wang Cc: Kevin Brodsky Cc: Yin Fengwei Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org Signed-off-by: Catalin Marinas commit b0ed6b6cce1abd1e57311584066e73d0ed877bef Author: Andy Shevchenko Date: Tue Nov 11 11:53:20 2025 +0100 mfd: Kconfig: Drop OF dependency on MFD_MAX5970 This is the only Kconfig symbol that depends on OF while selecting the common driver for several chips. Drop this unneeded dependency and make the component available on non-OF systems along with wider compile test. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251111105320.750131-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 3696ac1d0db2461bd62f89ea8379bb0565fc58e6 Author: Chen Ni Date: Tue Nov 11 13:24:51 2025 +0800 mfd: ls2kbmc: Remove unneeded semicolon from ls2k_bmc_recover_pci_data() Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20251111052451.3687740-1-nichen@iscas.ac.cn Signed-off-by: Lee Jones commit 9a948eefad594c42717f29824dd40d6dc0b7aa13 Author: Paul Moore Date: Tue Nov 18 19:18:10 2025 -0500 lsm: use unrcu_pointer() for current->cred in security_init() We need to directly allocate the cred's LSM state for the initial task when we initialize the LSM framework. Unfortunately, this results in a RCU related type mismatch, use the unrcu_pointer() macro to handle this a bit more elegantly. The explicit type casting still remains as we need to work around the constification of current->cred in this particular case. Reviewed-by: Xiu Jianfeng Signed-off-by: Paul Moore commit 26873e3e7f0cb26c45e6ad63656f9fe36b2aa31b Author: John Ogness Date: Thu Nov 13 17:09:48 2025 +0106 printk: Avoid scheduling irq_work on suspend Allowing irq_work to be scheduled while trying to suspend has shown to cause problems as some architectures interpret the pending interrupts as a reason to not suspend. This became a problem for printk() with the introduction of NBCON consoles. With every printk() call, NBCON console printing kthreads are woken by queueing irq_work. This means that irq_work continues to be queued due to printk() calls late in the suspend procedure. Avoid this problem by preventing printk() from queueing irq_work once console suspending has begun. This applies to triggering NBCON and legacy deferred printing as well as klogd waiters. Since triggering of NBCON threaded printing relies on irq_work, the pr_flush() within console_suspend_all() is used to perform the final flushing before suspending consoles and blocking irq_work queueing. NBCON consoles that are not suspended (due to the usage of the "no_console_suspend" boot argument) transition to atomic flushing. Introduce a new global variable @console_irqwork_blocked to flag when irq_work queueing is to be avoided. The flag is used by printk_get_console_flush_type() to avoid allowing deferred printing and switch NBCON consoles to atomic flushing. It is also used by vprintk_emit() to avoid klogd waking. Add WARN_ON_ONCE(console_irqwork_blocked) to the irq_work queuing functions to catch any code that attempts to queue printk irq_work during the suspending/resuming procedure. Cc: stable@vger.kernel.org # 6.13.x because no drivers in 6.12.x Fixes: 6b93bb41f6ea ("printk: Add non-BKL (nbcon) console basic infrastructure") Closes: https://lore.kernel.org/lkml/DB9PR04MB8429E7DDF2D93C2695DE401D92C4A@DB9PR04MB8429.eurprd04.prod.outlook.com Signed-off-by: John Ogness Reviewed-by: Petr Mladek Tested-by: Sherry Sun Link: https://patch.msgid.link/20251113160351.113031-3-john.ogness@linutronix.de Signed-off-by: Petr Mladek commit d01ff281bd9b1bfeac9ab98ec8a9ee41da900d5e Author: John Ogness Date: Thu Nov 13 17:09:47 2025 +0106 printk: Allow printk_trigger_flush() to flush all types Currently printk_trigger_flush() only triggers legacy offloaded flushing, even if that may not be the appropriate method to flush for currently registered consoles. (The function predates the NBCON consoles.) Since commit 6690d6b52726 ("printk: Add helper for flush type logic") there is printk_get_console_flush_type(), which also considers NBCON consoles and reports all the methods of flushing appropriate based on the system state and consoles available. Update printk_trigger_flush() to use printk_get_console_flush_type() to appropriately flush registered consoles. Suggested-by: Petr Mladek Signed-off-by: John Ogness Reviewed-by: Petr Mladek Link: https://lore.kernel.org/stable/20251113160351.113031-2-john.ogness%40linutronix.de Tested-by: Sherry Sun Link: https://patch.msgid.link/20251113160351.113031-2-john.ogness@linutronix.de Signed-off-by: Petr Mladek commit ba8abbdfd09e64f51ead8b86afc6b586505919b4 Author: Xianwei Zhao Date: Wed Nov 19 10:52:23 2025 +0800 soc: amlogic: meson-gx-socinfo: add new SoCs id Add new definition for Amlogic SoCs, include S6, S7, S7D. Reviewed-by: Neil Armstrong Reviewed-by: Martin Blumenstingl Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251119-soc-info-s6-s7-s7d-v3-2-1764c1995c04@amlogic.com Signed-off-by: Neil Armstrong commit 1d80bed4e35710287c584f998e51980a34fb3a4e Author: Xianwei Zhao Date: Wed Nov 19 10:52:22 2025 +0800 dt-bindings: arm: amlogic: meson-gx-ao-secure: support more SoCs Add new compatible for ao-secure of Amlogic SoCs(S6,S7,S7D). Acked-by: Conor Dooley Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20251119-soc-info-s6-s7-s7d-v3-1-1764c1995c04@amlogic.com Signed-off-by: Neil Armstrong commit a9637ab93c6cfdf7a80a299b7de691dea6a7d7ba Author: Damien Le Moal Date: Wed Nov 19 13:34:23 2025 +0900 zloop: fix zone append check in zloop_rw() While commit cf28f6f923cb ("zloop: fail zone append operations that are targeting full zones") added a check in zloop_rw() that a zone append is not issued to a full zone, commit e3a96ca90462 ("zloop: simplify checks for writes to sequential zones") inadvertently removed the check to verify that there is enough unwritten space in a zone for an incoming zone append opration. Re-add this check in zloop_rw() to make sure we do not write beyond the end of a zone. Of note is that this same check is already present in the function zloop_set_zone_append_sector() when ordered zone append is in use. Reported-by: Hans Holmberg Fixes: e3a96ca90462 ("zloop: simplify checks for writes to sequential zones") Signed-off-by: Damien Le Moal Reviewed-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit ebcc028b4a3db7f4a76f97b05d746aa6ff1a56ab Author: Damien Le Moal Date: Wed Nov 19 12:02:20 2025 +0900 MAINTAINERS: add a maintainer for zoned block device support Add myself as the maintainer of the block layer support for the zoned block device code and user API. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 00ed0350944dc33ac76cca2ddd2966e34f32a80e Author: Damien Le Moal Date: Wed Nov 19 12:02:19 2025 +0900 MAINTAINERS: add missing block layer user API header files Add the missing user API header files related to the block layer to the list of matching file patterns for Jens's block layer entry. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit c200892b46ba3df3dd210b7117a463ec283600c3 Author: Coiby Xu Date: Wed Nov 19 22:03:25 2025 +0800 ima: Access decompressed kernel module to verify appended signature Currently, when in-kernel module decompression (CONFIG_MODULE_DECOMPRESS) is enabled, IMA has no way to verify the appended module signature as it can't decompress the module. Define a new kernel_read_file_id enumerate READING_MODULE_COMPRESSED so IMA can calculate the compressed kernel module data hash on READING_MODULE_COMPRESSED and defer appraising/measuring it until on READING_MODULE when the module has been decompressed. Before enabling in-kernel module decompression, a kernel module in initramfs can still be loaded with ima_policy=secure_boot. So adjust the kernel module rule in secure_boot policy to allow either an IMA signature OR an appended signature i.e. to use "appraise func=MODULE_CHECK appraise_type=imasig|modsig". Reported-by: Karel Srot Suggested-by: Mimi Zohar Suggested-by: Paul Moore Signed-off-by: Coiby Xu Signed-off-by: Mimi Zohar commit da53dcd54cc35efa7a8236846bb39d40deeee034 Author: Marek Vasut Date: Tue Nov 18 13:11:24 2025 +0100 dt-bindings: pinctrl: cix,sky1-pinctrl: Drop duplicate newline Fix the following DT schema check warning: ./Documentation/devicetree/bindings/pinctrl/cix,sky1-pinctrl.yaml:68:1: [warning] too many blank lines (2 > 1) (empty-lines) One newline is enough. No functional change. Signed-off-by: Marek Vasut Signed-off-by: Linus Walleij commit 60b52af082b1462e878d10a0298fad40a26a8b35 Merge: 5ffe1910ed3e44 ee718481305938 Author: Georgi Djakov Date: Wed Nov 19 16:07:00 2025 +0200 Merge branch 'icc-sm6350' into icc-next Update dt-bindings, driver and dts in order to configure the QoS registers for the various SM6350 interconnects. * icc-sm6350 dt-bindings: interconnect: qcom,sm6350-rpmh: Add clocks for QoS interconnect: qcom: icc-rpmh: Get parent's regmap for nested NoCs interconnect: qcom: sm6350: Remove empty BCM arrays interconnect: qcom: sm6350: enable QoS configuration Link: https://lore.kernel.org/r/20251114-sm6350-icc-qos-v2-0-6af348cb9c69@fairphone.com Signed-off-by: Georgi Djakov commit ee7184813059388c86d73819d9c1c166aa3aab21 Author: Luca Weiss Date: Fri Nov 14 10:31:12 2025 +0100 interconnect: qcom: sm6350: enable QoS configuration Enable QoS configuration for master ports with predefined values for priority and urgency forwarding. While this does require some "clocks" to be specified in devicetree to work correctly, thanks to ".qos_requires_clocks = true," this is backwards compatible with old DT as QoS programming will be skipped for aggre1_noc and aggre2_noc when clocks are not provided. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251114-sm6350-icc-qos-v2-4-6af348cb9c69@fairphone.com Signed-off-by: Georgi Djakov commit ccd789e53a5c72bb90be85a5b2ebfbb26b9c03ea Author: Luca Weiss Date: Fri Nov 14 10:31:11 2025 +0100 interconnect: qcom: sm6350: Remove empty BCM arrays Clean up the code by removing empty BCM arrays to save some lines. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251114-sm6350-icc-qos-v2-3-6af348cb9c69@fairphone.com Signed-off-by: Georgi Djakov commit b56fb8aa66fc18cf4d44a95c4edb97ffcc3d63ef Author: Luca Weiss Date: Fri Nov 14 10:31:10 2025 +0100 interconnect: qcom: icc-rpmh: Get parent's regmap for nested NoCs Since commit 57eb14779dfd ("interconnect: qcom: icc-rpmh: Support child NoC device probe") the icc-rpmh driver supports initializing child NoCs, but those child NoCs also need to be able to get the parent's regmap in order to enable QoS. Change the driver to support that and support programming QoS register. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251114-sm6350-icc-qos-v2-2-6af348cb9c69@fairphone.com Signed-off-by: Georgi Djakov commit dfb1717308ff4940b5252857f76bccbfb25ae69c Author: Luca Weiss Date: Fri Nov 14 10:31:09 2025 +0100 dt-bindings: interconnect: qcom,sm6350-rpmh: Add clocks for QoS Add the clocks for some interconnects to the bindings that are required to set up the QoS correctly. Update one of the examples to aggre2_noc to have an example with clocks. Also while we're at it, remove #interconnect-cells: true as that's already provided from qcom,rpmh-common.yaml. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20251114-sm6350-icc-qos-v2-1-6af348cb9c69@fairphone.com Signed-off-by: Georgi Djakov commit 5ffe1910ed3e44ea2e442eda3afc06681f587aad Merge: d32e1c2dccb9ad ed7a3886957af4 Author: Georgi Djakov Date: Wed Nov 19 14:28:39 2025 +0200 Merge branch 'icc-dynamic-ids' into icc-next Currently most of Qualcomm interconnect drivers use static IDs, which poses a threat of possible conflicts with other drivers. Rework RPMh interconnect drivers to use dynamic IDs and drop static IDs code. * icc-dynamic-ids interconnect: qcom: icc-rpmh: convert link_nodes to dynamic array interconnect: qcom: sc7280: convert to dynamic IDs interconnect: qcom: sc8180x: convert to dynamic IDs interconnect: qcom: sc8280xp: convert to dynamic IDs interconnect: qcom: sdm845: convert to dynamic IDs interconnect: qcom: sm8250: convert to dynamic IDs interconnect: qcom: x1e80100: convert to dynamic IDs interconnect: qcom: qcs615: convert to dynamic IDs interconnect: qcom: qcs8300: convert to dynamic IDs interconnect: qcom: qdu1000: convert to dynamic IDs interconnect: qcom: sar2130p: convert to dynamic IDs interconnect: qcom: sc7180: convert to dynamic IDs interconnect: qcom: sdm670: convert to dynamic IDs interconnect: qcom: sdx55: convert to dynamic IDs interconnect: qcom: sdx65: convert to dynamic IDs interconnect: qcom: sdx75: convert to dynamic IDs interconnect: qcom: sm6350: convert to dynamic IDs interconnect: qcom: sm7150: convert to dynamic IDs interconnect: qcom: sm8150: convert to dynamic IDs interconnect: qcom: sm8350: convert to dynamic IDs interconnect: qcom: sm8450: convert to dynamic IDs interconnect: qcom: sm8550: convert to dynamic IDs interconnect: qcom: sm8650: convert to dynamic IDs interconnect: qcom: sm8750: convert to dynamic IDs interconnect: qcom: icc-rpmh: drop support for non-dynamic IDS Link: https://lore.kernel.org/r/20251031-rework-icc-v3-0-0575304c9624@oss.qualcomm.com Signed-off-by: Georgi Djakov commit a7840365d179af3002912af76b46d1a3f450ba57 Author: Jacky Chou Date: Mon Nov 17 20:37:50 2025 +0800 dt-bindings: pinctrl: aspeed,ast2600-pinctrl: Add PCIe RC PERST# group Add PCIe PERST# group to support for PCIe RC. Signed-off-by: Jacky Chou Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit bfef6e1f3488fc09ae966cb4dd2cb09f73cff791 Author: Mateusz Guzik Date: Fri Nov 14 21:18:03 2025 +0100 fs: move mntput_no_expire() slowpath into a dedicated routine In the stock variant the compiler spills several registers on the stack and employs stack smashing protection, adding even more code + a branch on exit.. The actual fast path is small enough that the compiler inlines it for all callers -- the symbol is no longer emitted. Forcing noinline on it just for code-measurement purposes shows the fast path dropping from 111 to 39 bytes. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251114201803.2183505-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 518c32a1bc4f8df1a8442ee8cdfea3e2fcff20a0 Author: Trond Myklebust Date: Wed Nov 19 08:39:50 2025 -0500 NFS: Initialise verifiers for visible dentries in nfs_atomic_open() Ensure that the verifiers are initialised before calling d_splice_alias() in nfs_atomic_open(). Reported-by: Michael Stoler Fixes: 809fd143de88 ("NFSv4: Ensure nfs_atomic_open set the dentry verifier on ENOENT") Signed-off-by: Trond Myklebust commit 9bd545539b233725a3416801f7c374bff0327d6e Author: Trond Myklebust Date: Wed Nov 19 08:36:16 2025 -0500 NFS: Initialise verifiers for visible dentries in readdir and lookup Ensure that the verifiers are initialised before calling d_splice_alias() in both nfs_prime_dcache() and nfs_lookup(). Reported-by: Michael Stoler Fixes: a1147b8281bd ("NFS: Fix up directory verifier races") Signed-off-by: Trond Myklebust commit 0b28f21ad46200fec9f8b8058692902d0de98221 Author: Binbin Wu Date: Mon Nov 10 13:05:39 2025 +0800 KVM: x86: Add a helper to dedup loading guest/host XCR0 and XSS Add and use a helper, kvm_load_xfeatures(), to dedup the code that loads guest/host xfeatures. Opportunistically return early if X86_CR4_OSXSAVE is not set to reduce indentations. No functional change intended. Suggested-by: Chao Gao Reviewed-by: Chao Gao Signed-off-by: Binbin Wu Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20251110050539.3398759-1-binbin.wu@linux.intel.com Signed-off-by: Sean Christopherson commit 7649412af3eab700037feb14822d03eba484c576 Author: Sean Christopherson Date: Tue Nov 18 14:23:28 2025 -0800 KVM: x86: Load guest/host PKRU outside of the fastpath run loop Move KVM's swapping of PKRU outside of the fastpath loop, as there is no KVM code anywhere in the fastpath that accesses guest/userspace memory, i.e. that can consume protection keys. As documented by commit 1be0e61c1f25 ("KVM, pkeys: save/restore PKRU when guest/host switches"), KVM just needs to ensure the host's PKRU is loaded when KVM (or the kernel at-large) may access userspace memory. And at the time of commit 1be0e61c1f25, KVM didn't have a fastpath, and PKU was strictly contained to VMX, i.e. there was no reason to swap PKRU outside of vmx_vcpu_run(). Over time, the "need" to swap PKRU close to VM-Enter was likely falsely solidified by the association with XFEATUREs in commit 37486135d3a7 ("KVM: x86: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c"), and XFEATURE swapping was in turn moved close to VM-Enter/VM-Exit as a KVM hack-a-fix ution for an #MC handler bug by commit 1811d979c716 ("x86/kvm: move kvm_load/put_guest_xcr0 into atomic context"). Deferring the PKRU loads shaves ~40 cycles off the fastpath for Intel, and ~60 cycles for AMD. E.g. using INVD in KVM-Unit-Test's vmexit.c, with extra hacks to enable CR4.PKE and PKRU=(-1u & ~0x3), latency numbers for AMD Turin go from ~1560 => ~1500, and for Intel Emerald Rapids, go from ~810 => ~770. Reviewed-by: Rick Edgecombe Reviewed-by: Jon Kohler Link: https://patch.msgid.link/20251118222328.2265758-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 75c69c82f21176ef6780f0b82de1019f656946e1 Author: Sean Christopherson Date: Tue Nov 18 14:23:27 2025 -0800 KVM: x86: Load guest/host XCR0 and XSS outside of the fastpath run loop Move KVM's swapping of XFEATURE masks, i.e. XCR0 and XSS, out of the fastpath loop now that the guts of the #MC handler runs in task context, i.e. won't invoke schedule() with preemption disabled and clobber state (or crash the kernel) due to trying to context switch XSTATE with a mix of host and guest state. For all intents and purposes, this reverts commit 1811d979c716 ("x86/kvm: move kvm_load/put_guest_xcr0 into atomic context"), which papered over an egregious bug/flaw in the #MC handler where it would do schedule() even though IRQs are disabled. E.g. the call stack from the commit: kvm_load_guest_xcr0 ... kvm_x86_ops->run(vcpu) vmx_vcpu_run vmx_complete_atomic_exit kvm_machine_check do_machine_check do_memory_failure memory_failure lock_page Commit 1811d979c716 "fixed" the immediate issue of XRSTORS exploding, but completely ignored that scheduling out a vCPU task while IRQs and preemption is wildly broken. Thankfully, commit 5567d11c21a1 ("x86/mce: Send #MC singal from task work") (somewhat incidentally?) fixed that flaw by pushing the meat of the work to the user-return path, i.e. to task context. KVM has also hardened itself against #MC goofs by moving #MC forwarding to kvm_x86_ops.handle_exit_irqoff(), i.e. out of the fastpath. While that's by no means a robust fix, restoring as much state as possible before handling the #MC will hopefully provide some measure of protection in the event that #MC handling goes off the rails again. Note, KVM always intercepts XCR0 writes for vCPUs without protected state, e.g. there's no risk of consuming a stale XCR0 when determining if a PKRU update is needed; kvm_load_host_xfeatures() only reads, and never writes, vcpu->arch.xcr0. Deferring the XCR0 and XSS loads shaves ~300 cycles off the fastpath for Intel, and ~500 cycles for AMD. E.g. using INVD in KVM-Unit-Test's vmexit.c, which an extra hack to enable CR4.OXSAVE, latency numbers for AMD Turin go from ~2000 => 1500, and for Intel Emerald Rapids, go from ~1300 => ~1000. Cc: Jon Kohler Reviewed-by: Rick Edgecombe Reviewed-by: Jon Kohler Link: https://patch.msgid.link/20251118222328.2265758-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 63669bd1d50f0b5cdb7bb390a0955b7b26821152 Author: Sean Christopherson Date: Tue Nov 18 14:23:26 2025 -0800 KVM: VMX: Handle #MCs on VM-Enter/TD-Enter outside of the fastpath Handle Machine Checks (#MC) that happen on VM-Enter (VMX or TDX) outside of KVM's fastpath so that as much host state as possible is re-loaded before invoking the kernel's #MC handler. The only requirement is that KVM invokes the #MC handler before enabling IRQs (and even that could _probably_ be related to handling #MCs before enabling preemption). Waiting to handle #MCs until "more" host state is loaded hardens KVM against flaws in the #MC handler, which has historically been quite brittle. E.g. prior to commit 5567d11c21a1 ("x86/mce: Send #MC singal from task work"), the #MC code could trigger a schedule() with IRQs and preemption disabled. That led to a KVM hack-a-fix in commit 1811d979c716 ("x86/kvm: move kvm_load/put_guest_xcr0 into atomic context"). Note, vmx_handle_exit_irqoff() is common to VMX and TDX guests. Cc: Tony Lindgren Cc: Rick Edgecombe Cc: Jon Kohler Reviewed-by: Tony Lindgren Link: https://patch.msgid.link/20251118222328.2265758-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 10c15296906952016a84e1e45d8dc361f35afbd8 Author: Raag Jadav Date: Wed Nov 12 09:10:11 2025 +0530 gpio: elkhartlake: Convert to auxiliary driver Since PCI device should not be abusing platform device, MFD parent to platform child path is no longer being pursued for this driver. Convert it to auxiliary driver, which will be used by EHL PSE auxiliary device. Signed-off-by: Raag Jadav Acked-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20251112034040.457801-3-raag.jadav@intel.com Signed-off-by: Bartosz Golaszewski commit a0c83150eea5807dbedf786f55cd49b14af118a8 Author: Raag Jadav Date: Wed Nov 12 09:10:10 2025 +0530 platform/x86/intel: Introduce Intel Elkhart Lake PSE I/O Intel Elkhart Lake Programmable Service Engine (PSE) includes two PCI devices that expose two different capabilities of GPIO and Timed I/O as a single PCI function through shared MMIO with below layout. GPIO: 0x0000 - 0x1000 TIO: 0x1000 - 0x2000 This driver enumerates the PCI parent device and creates auxiliary child devices for these capabilities. The actual functionalities are provided by their respective auxiliary drivers. Signed-off-by: Raag Jadav Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20251112034040.457801-2-raag.jadav@intel.com Signed-off-by: Bartosz Golaszewski commit 0a75f3d90e7ab9cd182327fca4b4e3bce379afe5 Author: Andy Shevchenko Date: Tue Nov 11 15:49:46 2025 +0100 devres: Move devm_alloc_percpu() and related to devres.h Move devm_alloc_percpu() and related to devres.h where it belongs. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251111145046.997309-3-andriy.shevchenko@linux.intel.com [ Fix minor typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit b871d9adffe5a64a1fd9edcb1aebbcc995b17901 Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:39 2025 +0100 regulator: make the subsystem aware of shared GPIOs GPIOLIB is now aware of shared GPIOs and - for platforms where access to such pins is managed internally - we don't need to keep track of the enable count. Once all users in the kernel switch to using the new mechanism, we'll be able to drop the internal counting of users from the regulator code. Acked-by: Mark Brown Acked-by: Linus Walleij Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251112-gpio-shared-v4-10-b51f97b1abd8@linaro.org Signed-off-by: Mark Brown commit 7a0a87712120329c034b0aae88bdaa05bd046f10 Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:38 2025 +0100 ASoC: wsa883x: drop GPIOD_FLAGS_BIT_NONEXCLUSIVE flag from GPIO lookup This driver is only used on Qualcomm platforms which now select HAVE_SHARED_GPIOS so this flag can be dropped. Acked-by: Mark Brown Acked-by: Linus Walleij Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251112-gpio-shared-v4-9-b51f97b1abd8@linaro.org Signed-off-by: Mark Brown commit d01fbee5c0d3d3061fb16235b71f5a117128e2c1 Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:37 2025 +0100 ASoC: wsa881x: drop GPIOD_FLAGS_BIT_NONEXCLUSIVE flag from GPIO lookup This driver is only used on Qualcomm platforms which now select HAVE_SHARED_GPIOS so this flag can be dropped. Reviewed-and-tested-by: Alexey Klimov # RB3 Acked-by: Mark Brown Acked-by: Linus Walleij Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251112-gpio-shared-v4-8-b51f97b1abd8@linaro.org Signed-off-by: Mark Brown commit ace38521705bd79a47e5f46b6bae6dc044f3cfdc Author: Andy Shevchenko Date: Thu Nov 13 15:32:35 2025 +0100 tracing: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Steven Rostedt (Google) Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-22-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 7b040d45718e8605906124f1e2c9537223b99890 Author: Andy Shevchenko Date: Thu Nov 13 15:32:34 2025 +0100 scsi: snic: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Martin K. Petersen Signed-off-by: Andy Shevchenko Acked-by: Karan Tilak Kumar Link: https://patch.msgid.link/20251113150217.3030010-21-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit e2c48498a93404743e0565dcac29450fec02e6a3 Author: jempty.liang Date: Wed Nov 19 10:11:16 2025 +0000 ASoC: soc-core: Pre-check zero CPU/codec DAIs, handle early rtd->dais alloc failure This commit adds a pre-check in ASoC to ensure there are non-zero CPU or codec DAIs. It also handles early failure of memory allocation for rtd->dais by going to the cleanup path, preventing potential issues from invalid configurations or out-of-memory situations. Signed-off-by: jempty.liang Link: https://patch.msgid.link/20251119101116.78676-1-imntjempty@163.com Signed-off-by: Mark Brown commit d710741f833fec1b7e9fcbf37e9b25590e65134d Author: Andy Shevchenko Date: Thu Nov 13 15:32:33 2025 +0100 scsi: fnic: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Martin K. Petersen Signed-off-by: Andy Shevchenko Acked-by: Karan Tilak Kumar Link: https://patch.msgid.link/20251113150217.3030010-20-andriy.shevchenko@linux.intel.com [pmladek@suse.com: Fixed output ordering and last_read_time update.] Signed-off-by: Petr Mladek commit ed40532ccdfb4fe8762a7844643d9edff1f314fd Author: Andy Shevchenko Date: Thu Nov 13 15:32:32 2025 +0100 s390/dasd: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Signed-off-by: Andy Shevchenko Acked-by: Stefan Haberland Link: https://patch.msgid.link/20251113150217.3030010-19-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 4e7c8ab42e19663b426b8e091f210be26b18ca70 Author: Andy Shevchenko Date: Thu Nov 13 15:32:31 2025 +0100 ptp: ocp: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. While at it, fix wrong use of %ptT against struct timespec64. It's kinda lucky that it worked just because the first member there 64-bit and it's of time64_t type. Now with %ptS it may be used correctly. Acked-by: Vadim Fedorenko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-18-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit b1e7286eeef33ac8a0b686230c250c416b36d200 Author: Andy Shevchenko Date: Thu Nov 13 15:32:30 2025 +0100 pps: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Rodolfo Giometti Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-17-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 3bc02fe0b82acaf660513789b9ae081a71cd4166 Author: Andy Shevchenko Date: Thu Nov 13 15:32:29 2025 +0100 PCI: epf-test: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Bjorn Helgaas Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-16-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit b8edf4fbb285b7adf83f4c25e779d81c33238c3a Author: Andy Shevchenko Date: Thu Nov 13 15:32:28 2025 +0100 net: dsa: sja1105: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Aleksandr Loktionov Signed-off-by: Andy Shevchenko Acked-by: Vladimir Oltean Tested-by: Vladimir Oltean Link: https://patch.msgid.link/20251113150217.3030010-15-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 12158d6747de1573afaabef97ea56013279292bb Author: Andy Shevchenko Date: Thu Nov 13 15:32:27 2025 +0100 mmc: mmc_test: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Signed-off-by: Andy Shevchenko Acked-by: Ulf Hansson Link: https://patch.msgid.link/20251113150217.3030010-14-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 5a1df7219d89cf53ca44688ac253e392615f0d15 Author: Andy Shevchenko Date: Thu Nov 13 15:32:26 2025 +0100 media: av7110: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Hans Verkuil Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-13-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 0cfc283d18bc5ca215ed2131bd3dfe4ef6c66585 Author: Andy Shevchenko Date: Thu Nov 13 15:32:25 2025 +0100 ipmi: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Corey Minyard Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-12-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 64acc20ec9c743be6f0376a7c6635a5130f2e3c4 Author: Andy Shevchenko Date: Thu Nov 13 15:32:24 2025 +0100 igb: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Aleksandr Loktionov Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-11-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 81e3db7ead99564169f975b05b96d4a2149dcf31 Author: Andy Shevchenko Date: Thu Nov 13 15:32:23 2025 +0100 e1000e: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Aleksandr Loktionov Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-10-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 51d3654916ccc65a2d217ec7c6e68131a2703772 Author: Andy Shevchenko Date: Thu Nov 13 15:32:22 2025 +0100 drm/xe: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Lucas De Marchi Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-9-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 083364667d4e24a04e375b8c5ff22b4cb674aced Author: Andy Shevchenko Date: Thu Nov 13 15:32:21 2025 +0100 drm/vblank: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-8-andriy.shevchenko@linux.intel.com Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek commit 6d228c181ed27957100bb1e77ccbb8078a22a8c1 Author: Christoph Hellwig Date: Wed Nov 19 11:14:15 2025 +0100 fs: remove spurious exports in fs/file_attr.c Commit 2f952c9e8fe1 ("fs: split fileattr related helpers into separate file") added various exports without users despite claiming to be a simple refactor. Drop them again. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251119101415.2732320-1-hch@lst.de Signed-off-by: Christian Brauner commit c29383a874ee86af1c68488f15f88544140414fe Author: Davidlohr Bueso Date: Tue Nov 18 13:07:06 2025 -0800 watch_queue: Use local kmap in post_one_notification() Replace the now deprecated kmap_atomic() with kmap_local_page(). Optimize for the non-highmem cases and avoid disabling preemption and pagefaults, the caller's context is atomic anyway, but that is irrelevant to kmap. The memcpy itself does not require any such semantics and the mapping would hold valid across context switches anyway. Further, highmem is planned to to be removed[1]. [1] https://lore.kernel.org/all/4ff89b72-03ff-4447-9d21-dd6a5fe1550f@app.fastmail.com/ Signed-off-by: Davidlohr Bueso Link: https://patch.msgid.link/20251118210706.1816303-1-dave@stgolabs.net Signed-off-by: Christian Brauner commit 5ef5f3c2245e13c62adf4cb0980cdd7bd72c59d0 Author: Levente Révész Date: Wed Nov 12 23:48:20 2025 +0100 Documentation: gpio: Add a compatibility and feature list for PCA953x I went through all the datasheets and created this note listing chip functions and register layouts. Signed-off-by: Levente Révész Signed-off-by: Andy Shevchenko Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Linus Walleij Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20251112224924.2091880-1-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit cda323dbda76600bf9761970d58517648f0de67d Author: Uwe Kleine-König Date: Tue Nov 18 18:43:02 2025 +0100 pwm: bcm2835: Make sure the channel is enabled after pwm_request() The .free callback cleared among others the enable bit PWENx in the control register. When the PWM is requested later again this bit isn't restored but the core assumes the PWM is enabled and thus skips a request to configure the same state as before. To fix that don't touch the hardware configuration in .free(). For symmetry also drop .request() and configure the mode completely in .apply(). Fixes: e5a06dc5ac1f ("pwm: Add BCM2835 PWM driver") Signed-off-by: Uwe Kleine-König Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251118174303.1761577-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 922a6f34c1756d2b0c35d9b2d915b8af19e85965 Author: Ian Kent Date: Tue Nov 18 10:46:31 2025 +0800 autofs: dont trigger mount if it cant succeed If a mount namespace contains autofs mounts, and they are propagation private, and there is no namespace specific automount daemon to handle possible automounting then attempted path resolution will loop until MAXSYMLINKS is reached before failing causing quite a bit of noise in the log. Add a check for this in autofs ->d_automount() so that the VFS can immediately return an error in this case. Since the mount is propagation private an EPERM return seems most appropriate. Suggested by: Christian Brauner Signed-off-by: Ian Kent Link: https://patch.msgid.link/20251118024631.10854-2-raven@themaw.net Signed-off-by: Christian Brauner commit 9d2a48c3a7029532294d3c5d32a4791ea737aa0f Author: Andy Shevchenko Date: Thu Nov 13 15:32:20 2025 +0100 drm/msm: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Signed-off-by: Andy Shevchenko Acked-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251113150217.3030010-7-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit fbd3aad6e034e90ac99661946b8594a995b8a23f Author: Andy Shevchenko Date: Thu Nov 13 15:32:19 2025 +0100 drm/amdgpu: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Acked-by: Alex Deucher Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-6-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit c6e049b6212b9af146074a10bb8949437bd4e4ed Author: Andy Shevchenko Date: Thu Nov 13 15:32:18 2025 +0100 dma-buf: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Christian König Acked-by: Sumit Semwal Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-5-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 98e41fb0eccc7328cd9e189ba1236127369b11f0 Author: Andy Shevchenko Date: Thu Nov 13 15:32:17 2025 +0100 libceph: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Viacheslav Dubeyko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-4-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 46ac6f51e55caa0ae6cf0f4e73d3ab812f9555c4 Author: Andy Shevchenko Date: Thu Nov 13 15:32:16 2025 +0100 ceph: Switch to use %ptSp Use %ptSp instead of open coded variants to print content of struct timespec64 in human readable format. Reviewed-by: Viacheslav Dubeyko Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251113150217.3030010-3-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit bccd5937447f8a2c9db0e4a92e5ecb641b8ce7de Author: Andy Shevchenko Date: Thu Nov 13 15:32:15 2025 +0100 lib/vsprintf: Add specifier for printing struct timespec64 A handful drivers want to print a content of the struct timespec64 in a format of %lld:%09ld. In order to make their lives easier, add the respecting specifier directly to the printf() implementation. Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20251113150217.3030010-2-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 376c18f30e226854062ff0a6eebc6af4ea62456b Author: Andy Shevchenko Date: Thu Nov 13 16:02:59 2025 +0100 lib/vsprintf: Deduplicate special hex number specifier data Two functions use the same specifier data for the special hex number. Almost the same as the field width is calculated on the size of the given type. Due to that, make a compound literal macro in order to deduplicate the rest. Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Tested-by: Petr Mladek Link: https://patch.msgid.link/20251113150313.3030700-1-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 1b2ae190ea43bebb8c73d21f076addc8a8c71849 Author: Konstantin Komarov Date: Thu Nov 6 16:17:19 2025 +0300 fs/ntfs3: check for shutdown in fsync Ensure fsync() returns -EIO when the ntfs3 filesystem is in forced shutdown, instead of silently succeeding via generic_file_fsync(). Signed-off-by: Konstantin Komarov commit 8ad236f8a457c88906261411bcafa1a91fa96124 Author: Bartosz Golaszewski Date: Tue Nov 18 11:54:51 2025 +0100 gpio: shared: extend the ifdef guard to gpio_shared_find_entry() While this function is supposed to be used by all scanning functions, so far we only have a single one for OF trees. Once we add support for ACPI and software nodes, we'll drop the CONFIG_OF guard around this routine but in order to avoid build warnings, let's extend it to cover it in the meantime. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511180232.EItKeYjY-lkp@intel.com/ Link: https://lore.kernel.org/r/20251118-gpiolib-shared-of-guard-v1-1-e4ef149a2e0b@linaro.org Signed-off-by: Bartosz Golaszewski commit 01be9047988d15850ca15d146c5f4aeb5de2f569 Author: Bartosz Golaszewski Date: Tue Nov 18 21:04:59 2025 +0100 gpio: shared: fix a NULL-pointer dereference The fact that CONFIG_OF is enabled does not mean that the device tree is populated and that of_root points to a valid device node. Check if it's NULL before trying to traverse the tree. Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support") Reported-by: Mark Brown Closes: https://lore.kernel.org/all/dbe20642-9662-40af-a593-c1263baea73b@sirena.org.uk/ Tested-by: Mark Brown Link: https://lore.kernel.org/r/20251118200459.13969-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 51d87d977ec4efe000ac662ac924f00b9d8a23ec Author: Ian Rogers Date: Tue Nov 18 13:13:24 2025 -0800 perf stat: Read tool events last When reading a metric like memory bandwidth on multiple sockets, the additional sockets will be on CPUS > 0. Because of the affinity reading, the counters are read on CPU 0 along with the time, then the later sockets are read. This can lead to the later sockets having a bandwidth larger than is possible for the period of time. To avoid this move the reading of tool events to occur after all other events are read. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 87cc0b44fc3eba8c6909b3d36aeb8592e32b12d0 Author: Leo Yan Date: Wed Nov 12 18:24:43 2025 +0000 perf arm_spe: Synthesize memory samples for SIMD operations Synthesize memory samples for SIMD operations (including Advanced SIMD, SVE, and SME). To provide complete information, also generate data source entries for SIMD operations. Since memory operations are not limited to load and store, set PERF_MEM_OP_STORE if the operation does not fall into these cases. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit b70aa41078a6ad044b655f124b6b431f916dfac5 Author: Leo Yan Date: Wed Nov 12 18:24:42 2025 +0000 perf arm_spe: Expose SIMD information in other operations The other operations contain SME data processing, ASE (Advanced SIMD) and floating-point operations. Expose these info in the records. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit d67835cd5d0a5ac5490895c6a0eafc3bd8e96932 Author: Leo Yan Date: Wed Nov 12 18:24:41 2025 +0000 perf arm_spe: Report GCS in record Report GCS related info in records. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit d4b61de44f34589d5233f3e7dc445e06df6bb388 Author: Leo Yan Date: Wed Nov 12 18:24:40 2025 +0000 perf arm_spe: Report memset and memcpy in records Expose memset and memcpy related info in records. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 6d47c32ccb0e85e484b523d324c471481b7ca9c1 Author: Leo Yan Date: Wed Nov 12 18:24:39 2025 +0000 perf arm_spe: Report associated info for SVE / SME operations SVE / SME operations can be predicated or Gather load / scatter store, save the relevant info into record. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit f3b9bed72e37e5fa14184d8634a9c88117d1fcb1 Author: Leo Yan Date: Wed Nov 12 18:24:38 2025 +0000 perf arm_spe: Report extended memory operations in records Extended memory operations include atomic (AT), acquire/release (AR), and exclusive (EXCL) operations. Save the relevant information in the records. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit c462dc70b1dc2b3fbb95d2cd2748185edc5ae30b Author: Leo Yan Date: Wed Nov 12 18:24:37 2025 +0000 perf arm_spe: Report MTE allocation tag in record Save MTE tag info in memory record. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 77e4291eaf74bc6e297519d472cd46e6035d91be Author: Leo Yan Date: Wed Nov 12 18:24:36 2025 +0000 perf arm_spe: Report register access in record Record register access info for load / store operations. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit cdc1aff17f1b72d112f508450f2d103b6b955b74 Author: Leo Yan Date: Wed Nov 12 18:24:35 2025 +0000 perf arm_spe: Introduce data processing macro for SVE operations Introduce the ARM_SPE_OP_DP (data processing) macro as associated information for SVE operations. For SVE register access, only ARM_SPE_OP_SVE is set; for SVE data processing, both ARM_SPE_OP_SVE and ARM_SPE_OP_DP are set together. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit b64bf913b3da2ba7a00ae780cbf9612ab25d9891 Author: Leo Yan Date: Wed Nov 12 18:24:34 2025 +0000 perf arm_spe: Consolidate operation types Consolidate operation types in a way: (a) Extract the second-level types into separate enums. (b) The second-level types for memory and SIMD operations are classified by modules. E.g., an operation may relate to general register, SIMD/FP, SVE, etc. (c) The associated information tells details. E.g., an operation is load or store, whether it is atomic operation, etc. Start the enum items for the second-level types from 8 to accommodate more entries within a 32-bit integer. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit c7c198b3ed686300eaf84e679cee7e0f94befa8f Author: Leo Yan Date: Wed Nov 12 18:24:33 2025 +0000 perf arm_spe: Remove unused operation types Remove unused SVE operation types. These operations will be reintroduced in subsequent refactoring, but with a different format. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit c4cfe1bcebb05c3ab71dcd3f24cc9ed350d860c0 Author: Leo Yan Date: Wed Nov 12 18:24:32 2025 +0000 perf arm_spe: Decode SME data processing packet For SME data processing, decode its Effective vector length or Tile Size (ETS), and print out if a floating-point operation. After: . 00000000: 49 00 SME-OTHER ETS 1024 FP . 00000002: b2 18 3c d7 83 00 80 ff ff VA 0xffff800083d73c18 . 0000000b: 9a 00 00 LAT 0 XLAT . 0000000e: 43 00 DATA-SOURCE 0 Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 876294a6455e9bba81391c76f78c4563c3b8bc1d Author: Leo Yan Date: Wed Nov 12 18:24:31 2025 +0000 perf arm_spe: Decode ASE and FP fields in other operation Add a check for other operation, which prevents any incorrectly classifying. Parse the ASE and FP fields. After: . 0000002f: 48 06 OTHER ASE FP INSN-OTHER . 00000031: b2 08 80 48 01 08 00 ff ff VA 0xffff000801488008 . 0000003a: 9a 00 00 LAT 0 XLAT . 0000003d: 42 16 EV RETIRED L1D-ACCESS TLB-ACCESS Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit c8bf2a05dff4bbbfd1ffe1888de8bbd1bf4e2c3a Author: Leo Yan Date: Wed Nov 12 18:24:30 2025 +0000 perf arm_spe: Rename SPE_OP_PKT_IS_OTHER_SVE_OP macro Rename the macro to SPE_OP_PKT_OTHER_SUBCLASS_SVE to unify naming. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit b4eaece3d9df603772070f03d3086746c113ae2e Author: Leo Yan Date: Wed Nov 12 18:24:29 2025 +0000 perf arm_spe: Decode GCS operation Decode a load or store from a GCS operation and the associated "common" field. After: . 00000000: 49 44 LD GCS COMM . 00000002: b2 18 3c d7 83 00 80 ff ff VA 0xffff800083d73c18 . 0000000b: 9a 00 00 LAT 0 XLAT . 0000000e: 43 00 DATA-SOURCE 0 Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit b61ca7219db82f474e71ec5ab68eb5370ce18df2 Author: Leo Yan Date: Wed Nov 12 18:24:28 2025 +0000 perf arm_spe: Unify operation naming Rename extended subclass and SVE/SME register access subclass, so that the naming can be consistent cross all sub classes. Add an log "SVE-SME-REG" for the SVE/SME register access, this is easier for parsing. Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 33e1fffea492b7158a168914dc0da6aedf78d08e Author: Leo Yan Date: Wed Nov 12 18:24:27 2025 +0000 perf arm_spe: Fix memset subclass in operation The operation subclass is extracted from bits [7..1] of the payload. Since bit [0] is not parsed, there is no chance to match the memset type (0x25). As a result, the memset payload is never parsed successfully. Instead of extracting a unified bit field, change to extract the specific bits for each operation subclass. Fixes: 34fb60400e32 ("perf arm-spe: Add raw decoding for SPEv1.3 MTE and MOPS load/store") Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit d7dbda87892039f19805b896d1fe0fa75aca1b06 Author: Fernando Fernandez Mancera Date: Sat Nov 15 10:59:39 2025 +0100 selftests: fib_tests: add fib6 from ra to static test The new test checks that a route that has been promoted from RA-learned to static does not switch back when a new RA message arrives. In addition, it checks that the route is owned by RA again when the static address is removed. Signed-off-by: Fernando Fernandez Mancera Link: https://patch.msgid.link/20251115095939.6967-2-fmancera@suse.de Signed-off-by: Jakub Kicinski commit f72514b3c5698e4b900b25345e09f9ed33123de6 Author: Fernando Fernandez Mancera Date: Sat Nov 15 10:59:38 2025 +0100 ipv6: clear RA flags when adding a static route When an IPv6 Router Advertisement (RA) is received for a prefix, the kernel creates the corresponding on-link route with flags RTF_ADDRCONF and RTF_PREFIX_RT configured and RTF_EXPIRES if lifetime is set. If later a user configures a static IPv6 address on the same prefix the kernel clears the RTF_EXPIRES flag but it doesn't clear the RTF_ADDRCONF and RTF_PREFIX_RT. When the next RA for that prefix is received, the kernel sees the route as RA-learned and wrongly configures back the lifetime. This is problematic because if the route expires, the static address won't have the corresponding on-link route. This fix clears the RTF_ADDRCONF and RTF_PREFIX_RT flags preventing that the lifetime is configured when the next RA arrives. If the static address is deleted, the route becomes RA-learned again. Fixes: 14ef37b6d00e ("ipv6: fix route lookup in addrconf_prefix_rcv()") Reported-by: Garri Djavadyan Closes: https://lore.kernel.org/netdev/ba807d39aca5b4dcf395cc11dca61a130a52cfd3.camel@gmail.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: David Ahern Link: https://patch.msgid.link/20251115095939.6967-1-fmancera@suse.de Signed-off-by: Jakub Kicinski commit cbf4d314acef1b24194a190cd7abb53f93062820 Merge: f83e0e0b63fe57 24fa77dad25c2f Author: Jakub Kicinski Date: Tue Nov 18 19:19:34 2025 -0800 Merge branch 'af_unix-gc-cleanup-and-optimisation' Kuniyuki Iwashima says: ==================== af_unix: GC cleanup and optimisation. Currently, AF_UNIX GC is triggered from close() and sendmsg() based on the number of inflight AF_UNIX sockets. This is because the old GC implementation had no idea of the shape of the graph formed by SCM_RIGHTS references. The new GC knows whether cyclic references (could) exist. This series refines such conditions not to trigger GC unless really needed. ==================== Link: https://patch.msgid.link/20251115020935.2643121-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 24fa77dad25c2f55cc4615c09df2201ef72c66f4 Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:38 2025 +0000 af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). unix_schedule_gc() and wait_for_unix_gc() share some code. Let's consolidate the two. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ab8b23150abccd34fddc3effe7776ad32c44b6c9 Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:37 2025 +0000 af_unix: Remove unix_tot_inflight. unix_tot_inflight is no longer used. Let's remove it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e29c7a4cec867f9d860b8ff3da0fc44c7177876a Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:36 2025 +0000 af_unix: Refine wait_for_unix_gc(). unix_tot_inflight is a poor metric, only telling the number of inflight AF_UNXI sockets, and we should use unix_graph_state instead. Also, if the receiver is catching up with the passed fds, the sender does not need to schedule GC. GC only helps unreferenced cyclic SCM_RIGHTS references, and in such a situation, the malicious sendmsg() will continue to call wait_for_unix_gc() and hit the UNIX_INFLIGHT_SANE_USER condition. Let's make only malicious users schedule GC and wait for it to finish if a cyclic reference exists during the previous GC run. Then, sane users will pay almost no cost for wait_for_unix_gc(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 384900542dc85f3aac7918fea8e7ef62141e3ea6 Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:35 2025 +0000 af_unix: Don't call wait_for_unix_gc() on every sendmsg(). We have been calling wait_for_unix_gc() on every sendmsg() in case there are too many inflight AF_UNIX sockets. This is also because the old GC implementation had poor knowledge of the inflight sockets and had to suspect every sendmsg(). This was improved by commit d9f21b361333 ("af_unix: Try to run GC async."), but we do not even need to call wait_for_unix_gc() if the process is not sending AF_UNIX sockets. The wait_for_unix_gc() call only helps when a malicious process continues to create cyclic references, and we can detect that in a better place and slow it down. Let's move wait_for_unix_gc() to unix_prepare_fpl() that is called only when AF_UNIX socket fd is passed via SCM_RIGHTS. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit da8fc7a39be897426e1ac05aa90263abf40621b7 Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:34 2025 +0000 af_unix: Don't trigger GC from close() if unnecessary. We have been triggering GC on every close() if there is even one inflight AF_UNIX socket. This is because the old GC implementation had no idea of the graph shape formed by SCM_RIGHTS references. The new GC knows whether there could be a cyclic reference or not, and we can do better. Let's not trigger GC from close() if there is no cyclic reference or GC is already in progress. While at it, unix_gc() is renamed to unix_schedule_gc() as it does not actually perform GC since commit 8b90a9f819dc ("af_unix: Run GC on only one CPU."). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6b6f3c71fe568aa8ed3e16e9135d88a5f4fd3e84 Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:33 2025 +0000 af_unix: Simplify GC state. GC manages its state by two variables, unix_graph_maybe_cyclic and unix_graph_grouped, both of which are set to false in the initial state. When an AF_UNIX socket is passed to an in-flight AF_UNIX socket, unix_update_graph() sets unix_graph_maybe_cyclic to true and unix_graph_grouped to false, making the next GC invocation call unix_walk_scc() to group SCCs. Once unix_walk_scc() finishes, sockets in the same SCC are linked via vertex->scc_entry. Then, unix_graph_grouped is set to true so that the following GC invocations can skip Tarjan's algorithm and simply iterate through the list in unix_walk_scc_fast(). In addition, if we know there is at least one cyclic reference, we set unix_graph_maybe_cyclic to true so that we do not skip GC. So the state transitions as follows: (unix_graph_maybe_cyclic, unix_graph_grouped) = (false, false) -> (true, false) -> (true, true) or (false, true) ^.______________/________________/ There is no transition to the initial state where both variables are false. If we consider the initial state as grouped, we can see that the GC actually has a tristate. Let's consolidate two variables into one enum. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 58b47c713711b8afbf68e3158d4d5acdead00e9b Author: Kuniyuki Iwashima Date: Sat Nov 15 02:08:32 2025 +0000 af_unix: Count cyclic SCC. __unix_walk_scc() and unix_walk_scc_fast() call unix_scc_cyclic() for each SCC to check if it forms a cyclic reference, so that we can skip GC at the following invocations in case all SCCs do not have any cycles. If we count the number of cyclic SCCs in __unix_walk_scc(), we can simplify unix_walk_scc_fast() because the number of cyclic SCCs only changes when it garbage-collects a SCC. So, let's count cyclic SCC in __unix_walk_scc() and decrement it in unix_walk_scc_fast() when performing garbage collection. Note that we will use this counter in a later patch to check if a cycle existed in the previous GC run. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251115020935.2643121-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit f83e0e0b63fe57801d22750e31a0afb5403b3d02 Merge: 1064d521d17702 70ca239b612cd1 Author: Jakub Kicinski Date: Tue Nov 18 18:53:38 2025 -0800 Merge branch 'net-mlx5-misc-changes-2025-11-17' Tariq Toukan says: ==================== net/mlx5: misc changes 2025-11-17 This series contains misc enhancements to the mlx5 driver. ==================== Link: https://patch.msgid.link/1763415729-1238421-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 70ca239b612cd154c9828fe4d0093fb9bd02a6c7 Author: Tariq Toukan Date: Mon Nov 17 23:42:09 2025 +0200 net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP Per Documentation/dev-tools/checkpatch.rst, ENOTSUPP is not a standard error code and should be avoided. EOPNOTSUPP should be used instead. Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Link: https://patch.msgid.link/1763415729-1238421-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit fbb9933666e31f84c62e9620e9ec4d220ee31ab4 Author: Saeed Mahameed Date: Mon Nov 17 23:42:08 2025 +0200 net/mlx5: Abort new commands if all command slots are stalled In case of a FW issue, FW might be not responding to FW commands, causing kernel lockout for a long period of time, e.g. rtnl_lock held while ethtool is trying to collect stats waiting for FW to respond to multiple commands, when all of them will timeout. While there's no immediate indication of the FW lockout, we can safely assume that something is wrong when all command slots are busy and in a timeout state and no FW completion was received on any of them. In such case, start immediately failing new commands. Signed-off-by: Saeed Mahameed Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763415729-1238421-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ea3270351c792632db5722ea3ca83b468cebb531 Author: Carolina Jubran Date: Mon Nov 17 23:42:07 2025 +0200 net/mlx5: Remove redundant bw_share minimal value assignment Remove unnecessary logic that sets bw_share to minimal value, when parent has bw_share configured but nodes don't have min_rate. This check is redundant because the parent bandwidth acts as the upper bound regardless, and the firmware always enforces the topmost bandwidth constraint. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763415729-1238421-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 391dad2e686f214932f769847cc8603a7df389eb Author: Carolina Jubran Date: Mon Nov 17 23:42:06 2025 +0200 net/mlx5e: Recover SQ on excessive PTP TX timestamp delta Extend the TX timestamp handler to recover the SQ when the difference between the port and CQE TX timestamps is abnormally large. The current logic aborts timestamp delivery if the delta exceeds 1/128 seconds, which matches the maximum expected packet interval in ptp4l. A larger delta makes the timestamps unreliable. This change adds recovery if the delta exceeds 0.5 seconds. Such a large gap should not occur in normal operation and indicates that firmware is stuck or metadata tracking is out of sync, leading to stale or mismatched timestamps. Recovering the SQ ensures forward progress and avoids silently dropping invalid timestamps. The timestamp handler now takes mlx5e_ptpsq directly to access both CQ stats and the recovery state. Signed-off-by: Carolina Jubran Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763415729-1238421-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2e4c44b12f4da60d3e8dcbc1ccf38bb28a878050 Author: Gal Pressman Date: Mon Nov 17 23:42:05 2025 +0200 net/mlx5: Refactor EEPROM query error handling to return status separately Matthew and Jakub reported [1] issues where inventory automation tools are calling EEPROM query repeatedly on a port that doesn't have an SFP connected, resulting in millions of error prints. Move MCIA register status extraction from the query functions to the callers, allowing use of extack reporting instead of a dmesg print when using the netlink API. [1] https://lore.kernel.org/netdev/20251028194011.39877-1-mattc@purestorage.com/ Cc: Matthew W Carlis Signed-off-by: Gal Pressman Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1763415729-1238421-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d56933e74d0d691dcd642876feda0b30f397e2ad Author: René Rebe Date: Mon Nov 17 19:50:48 2025 +0100 hwmon: (k10temp) Add AMD Steam Deck APU ID Add AMD Custom APU 0405 PCI ID as used in the Valve Steam Deck to k10temp. Signed-off-by: René Rebe Link: https://lore.kernel.org/r/20251117.195048.691713748773231900.rene@exactco.de Signed-off-by: Guenter Roeck commit 785205fd81399bd8e49065aee3362a99d5702321 Author: James Calligeros Date: Wed Nov 12 21:16:52 2025 +1000 hwmon: Add Apple Silicon SMC hwmon driver The System Management Controller on Apple Silicon devices is responsible for integrating and exposing the data reported by the vast array of hardware monitoring sensors present on these devices. It is also responsible for fan control, and allows users to manually set fan speeds if they so desire. Add a hwmon driver to expose current, power, temperature, and voltage monitoring sensors, as well as fan speed monitoring and control via the SMC on Apple Silicon devices. The SMC firmware has no consistency between devices, even when they share an SoC. The FourCC keys used to access sensors are almost random. An M1 Mac mini will have different FourCCs for its CPU core temperature sensors to an M1 MacBook Pro, for example. For this reason, the valid sensors for a given device are specified in a child of the SMC Devicetree node. The driver uses this information to determine which sensors to make available at runtime. Reviewed-by: Neal Gompa Acked-by: Guenter Roeck Co-developed-by: Janne Grunau Signed-off-by: Janne Grunau Signed-off-by: James Calligeros Link: https://lore.kernel.org/r/20251112-macsmc-subdevs-v5-6-728e4b91fe81@gmail.com [groeck: Added Documentation to index] Signed-off-by: Guenter Roeck commit 1064d521d177023358b3b516f250faa714415a6d Author: Hangbin Liu Date: Mon Nov 17 02:44:56 2025 +0000 netlink: specs: support ipv4-or-v6 for dual-stack fields Since commit 1b255e1beabf ("tools: ynl: add ipv4-or-v6 display hint"), we can display either IPv4 or IPv6 addresses for a single field based on the address family. However, most dual-stack fields still use the ipv4 display hint. This update changes them to use the new ipv4-or-v6 display hint and converts IPv4-only fields to use the u32 type. Field changes: - v4-or-v6 - IFA_ADDRESS, IFA_LOCAL - IFLA_GRE_LOCAL, IFLA_GRE_REMOTE - IFLA_VTI_LOCAL, IFLA_VTI_REMOTE - IFLA_IPTUN_LOCAL, IFLA_IPTUN_REMOTE - NDA_DST - RTA_DST, RTA_SRC, RTA_GATEWAY, RTA_PREFSRC - FRA_SRC, FRA_DST - ipv4 - IFA_BROADCAST - IFLA_GENEVE_REMOTE - IFLA_IPTUN_6RD_RELAY_PREFIX Reviewed-by: Asbjørn Sloth Tønnesen Reviewed-by: Donald Hunter Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251117024457.3034-3-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 4abe51dba69f1d72a13ba3b5d0dcc237cdd71404 Author: Hangbin Liu Date: Mon Nov 17 02:44:55 2025 +0000 tools: ynl: Add MAC address parsing support Add missing support for parsing MAC addresses when display_hint is 'mac' in the YNL library. This enables YNL CLI to accept MAC address strings for attributes like lladdr in rt-neigh operations. Reviewed-by: Donald Hunter Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20251117024457.3034-2-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit f779ac0b8784858c3700f6660d606f436c62157a Author: Jens Axboe Date: Tue Nov 18 19:30:45 2025 -0700 io_uring/register: use correct location for io_rings_layout A previous consolidated the ring size etc calculations into io_prepare_config(), but missed updating io_register_resize_rings() correctly to use the calculated values. As a result, it ended up using on-stack uninitialized values, and hence either failed validating the size correctly, or just failed resizing because the sizes were random. This caused failures in the liburing regression tests: [...] Running test resize-rings.t resize=-7 test_basic 3000 failed Test resize-rings.t failed with ret 1 Running test resize-rings.t /dev/sda resize=-7 test_basic 3000 failed Test resize-rings.t failed with ret 1 Running test resize-rings.t /dev/nvme1n1 resize=-7 test_basic 3000 failed Test resize-rings.t failed with ret 1 Running test resize-rings.t /dev/dm-0 resize=-7 test_basic 3000 failed Test resize-rings.t failed with ret 1 because io_create_region() would return -E2BIG because of unintialized reg->size values. Adjust the struct io_rings_layout rl pointer to point to the correct location, and remove the (now dead) __rl on stack struct. Fixes: eb76ff6a6829 ("io_uring: pre-calculate scq layout") Signed-off-by: Jens Axboe commit 616d8604392e25223fc2c0043c4744d4688b4890 Merge: eb74ae2f87d254 21664814b89e12 Author: Jakub Kicinski Date: Tue Nov 18 18:25:48 2025 -0800 Merge branch 'net-expand-napi_skb_cache-use' Eric Dumazet says: ==================== net: expand napi_skb_cache use This is a followup of commit e20dfbad8aab ("net: fix napi_consume_skb() with alien skbs"). Now the per-cpu napi_skb_cache is populated from TX completion path, we can make use of this cache, especially for cpus not used from a driver NAPI poll (primary user of napi_cache). With this series, I consistently reach 130 Mpps on my UDP tx stress test and reduce SLUB spinlock contention to smaller values. ==================== Link: https://patch.msgid.link/20251116202717.1542829-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 21664814b89e1268bc48e9f641b813746a7dbaae Author: Eric Dumazet Date: Sun Nov 16 20:27:17 2025 +0000 net: use napi_skb_cache even in process context This is a followup of commit e20dfbad8aab ("net: fix napi_consume_skb() with alien skbs"). Now the per-cpu napi_skb_cache is populated from TX completion path, we can make use of this cache, especially for cpus not used from a driver NAPI poll (primary user of napi_cache). We can use the napi_skb_cache only if current context is not from hard irq. With this patch, I consistently reach 130 Mpps on my UDP tx stress test and reduce SLUB spinlock contention to smaller values. Note there is still some SLUB contention for skb->head allocations. I had to tune /sys/kernel/slab/skbuff_small_head/cpu_partial and /sys/kernel/slab/skbuff_small_head/min_partial depending on the platform taxonomy. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Tested-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251116202717.1542829-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 294e63825966319e815e469931cfbfc437004d0f Author: Eric Dumazet Date: Sun Nov 16 20:27:16 2025 +0000 net: __alloc_skb() cleanup This patch refactors __alloc_skb() to prepare the following one, and does not change functionality. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251116202717.1542829-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit dac0236075684b9edfd71492e79a9122f3ef45cc Author: Eric Dumazet Date: Sun Nov 16 20:27:15 2025 +0000 net: add a new @alloc parameter to napi_skb_cache_get() We want to be able in the series last patch to get an skb from napi_skb_cache from process context, if there is one available. Signed-off-by: Eric Dumazet Reviewed-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251116202717.1542829-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit eb74ae2f87d254e54ab15429e845c2c46f8e970f Author: Alok Tiwari Date: Mon Nov 17 01:53:50 2025 -0800 net: dsa: ks8995: Fix incorrect OF match table name The driver declares an OF match table named ks8895_spi_of_match, even though it describes compatible strings for the KS8995 and related Micrel switches. This is a leftover typo, the correct name should match the chip family handled by this driver ks8995, and also match the variable used in spi_driver.of_match_table. Signed-off-by: Alok Tiwari Reviewed-by: Andrew Lunn Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20251117095356.2099772-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit efb238160e889e377578411d55abf47b1073492a Author: Thorsten Blum Date: Sun Nov 16 14:56:14 2025 +0100 kcm: Fix typo and add hyphen in Kconfig help text s/connectons/connections/ and s/message based/message-based/ Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251116135616.106079-2-thorsten.blum@linux.dev Signed-off-by: Jakub Kicinski commit 683c03b95c2ae95ff05ebf0dcc040bf3db633135 Merge: e45979641a9a9d d218ea171430e4 Author: Mark Brown Date: Wed Nov 19 02:10:20 2025 +0000 ASoC: mediatek: Add support for MT8189 SoC Merge series from Cyril Chao : This series of patches adds support for Mediatek AFE of MT8189 SoC. commit 932478bf9f6d3c7da9635c2fd0f87766c72ae683 Author: Kuniyuki Iwashima Date: Tue Nov 18 00:04:40 2025 +0000 tcp: Don't reinitialise tw->tw_transparent in tcp_time_wait(). tw->tw_transparent is initialised twice in inet_twsk_alloc() and tcp_time_wait(). Let's remove the latter. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jason Xing Link: https://patch.msgid.link/20251118000445.4091280-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6785aa9d2073afeb2183eaf0ecaa137bf5cbf546 Merge: f4e3402f59ac5e 939ba8c5b81cba Author: Jakub Kicinski Date: Tue Nov 18 17:55:41 2025 -0800 Merge tag 'ipsec-next-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2025-11-18 1) Relax a lock contention bottleneck to improve IPsec crypto offload performance. From Jianbo Liu. 2) Deprecate pfkey, the interface will be removed in 2027. 3) Update xfrm documentation and move it to ipsec maintainance. From Bagas Sanjaya. * tag 'ipsec-next-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: MAINTAINERS: Add entry for XFRM documentation net: Move XFRM documentation into its own subdirectory Documentation: xfrm_sync: Number the fifth section Documentation: xfrm_sysctl: Trim trailing colon in section heading Documentation: xfrm_sync: Trim excess section heading characters Documentation: xfrm_sync: Properly reindent list text Documentation: xfrm_device: Separate hardware offload sublists Documentation: xfrm_device: Use numbered list for offloading steps Documentation: xfrm_device: Wrap iproute2 snippets in literal code block pfkey: Deprecate pfkey xfrm: Skip redundant replay recheck for the hardware offload path xfrm: Refactor xfrm_input lock to reduce contention with RSS ==================== Link: https://patch.msgid.link/20251118092610.2223552-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit f4e3402f59ac5e6e629d8b94c3760414fb0f37bf Author: Pierre-Henry Moussay Date: Mon Nov 17 16:24:33 2025 +0000 dt-bindings: net: cdns,macb: Add pic64gx compatibility The pic64gx uses an identical integration of the macb IP to mpfs. Signed-off-by: Pierre-Henry Moussay Signed-off-by: Conor Dooley Acked-by: Nicolas Ferre Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251117-easter-machine-37851f20aaf3@spud Signed-off-by: Jakub Kicinski commit 6770eaad75ae039b620e9dc05f62dcbcfc2e5085 Author: Donald Hunter Date: Mon Nov 17 14:31:54 2025 +0000 tools: ynltool: ignore *.d deps files Add *.d to gitignore for ynltool Signed-off-by: Donald Hunter Link: https://patch.msgid.link/20251117143155.44806-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit ebd1a336550096bf7543699bab2e89fa401deac6 Author: Sean Christopherson Date: Tue Nov 18 14:23:25 2025 -0800 KVM: SVM: Handle #MCs in guest outside of fastpath Handle Machine Checks (#MC) that happen in the guest (by forwarding them to the host) outside of KVM's fastpath so that as much host state as possible is re-loaded before invoking the kernel's #MC handler. The only requirement is that KVM invokes the #MC handler before enabling IRQs (and even that could _probably_ be relaxed to handling #MCs before enabling preemption). Waiting to handle #MCs until "more" host state is loaded hardens KVM against flaws in the #MC handler, which has historically been quite brittle. E.g. prior to commit 5567d11c21a1 ("x86/mce: Send #MC singal from task work"), the #MC code could trigger a schedule() with IRQs and preemption disabled. That led to a KVM hack-a-fix in commit 1811d979c716 ("x86/kvm: move kvm_load/put_guest_xcr0 into atomic context"). Note, except for #MCs on VM-Enter, VMX already handles #MCs outside of the fastpath. Reviewed-by: Rick Edgecombe Reviewed-by: Jon Kohler Link: https://patch.msgid.link/20251118222328.2265758-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 38ee66cb1845dbf1e97c5e5d3db01ae4513f66a9 Author: Brendan Jackman Date: Thu Nov 13 15:37:46 2025 -0800 KVM: x86: Unify L1TF flushing under per-CPU variable Currently the tracking of the need to flush L1D for L1TF is tracked by two bits: one per-CPU and one per-vCPU. The per-vCPU bit is always set when the vCPU shows up on a core, so there is no interesting state that's truly per-vCPU. Indeed, this is a requirement, since L1D is a part of the physical CPU. So simplify this by combining the two bits. The vCPU bit was being written from preemption-enabled regions. To play nice with those cases, wrap all calls from KVM and use a raw write so that request a flush with preemption enabled doesn't trigger what would effectively be DEBUG_PREEMPT false positives. Preemption doesn't need to be disabled, as kvm_arch_vcpu_load() will mark the new CPU as needing a flush if the vCPU task is migrated, or if userspace runs the vCPU on a different task. Signed-off-by: Brendan Jackman [sean: put raw write in KVM instead of in a hardirq.h variant] Link: https://patch.msgid.link/20251113233746.1703361-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 05bd63959a9d682e5e765f950bb6b356d3d6d27a Author: Sean Christopherson Date: Thu Nov 13 15:37:45 2025 -0800 KVM: VMX: Disable L1TF L1 data cache flush if CONFIG_CPU_MITIGATIONS=n Disable support for flushing the L1 data cache to mitigate L1TF if CPU mitigations are disabled for the entire kernel. KVM's mitigation of L1TF is in no way special enough to justify ignoring CONFIG_CPU_MITIGATIONS=n. Deliberately use CPU_MITIGATIONS instead of the more precise MITIGATION_L1TF, as MITIGATION_L1TF only controls the default behavior, i.e. CONFIG_MITIGATION_L1TF=n doesn't completely disable L1TF mitigations in the kernel. Keep the vmentry_l1d_flush module param to avoid breaking existing setups, and leverage the .set path to alert the user to the fact that vmentry_l1d_flush will be ignored. Don't bother validating the incoming value; if an admin misconfigures vmentry_l1d_flush, the fact that the bad configuration won't be detected when running with CONFIG_CPU_MITIGATIONS=n is likely the least of their worries. Reviewed-by: Brendan Jackman Link: https://patch.msgid.link/20251113233746.1703361-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 0abd9610d6c6996317262f1712c959d74ed08de6 Author: Sean Christopherson Date: Thu Nov 13 15:37:44 2025 -0800 KVM: VMX: Bundle all L1 data cache flush mitigation code together Move vmx_l1d_flush(), vmx_cleanup_l1d_flush(), and the vmentry_l1d_flush param code up in vmx.c so that all of the L1 data cache flushing code is bundled together. This will allow conditioning the mitigation code on CONFIG_CPU_MITIGATIONS=y with minimal #ifdefs. No functional change intended. Reviewed-by: Brendan Jackman Reviewed-by: Pawan Gupta Link: https://patch.msgid.link/20251113233746.1703361-8-seanjc@google.com Signed-off-by: Sean Christopherson commit fc704b578976ed6a937f419e611d5ae92c939826 Author: Sean Christopherson Date: Thu Nov 13 15:37:43 2025 -0800 x86/bugs: KVM: Move VM_CLEAR_CPU_BUFFERS into SVM as SVM_CLEAR_CPU_BUFFERS Now that VMX encodes its own sequence for clearing CPU buffers, move VM_CLEAR_CPU_BUFFERS into SVM to minimize the chances of KVM botching a mitigation in the future, e.g. using VM_CLEAR_CPU_BUFFERS instead of checking multiple mitigation flags. No functional change intended. Reviewed-by: Brendan Jackman Acked-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251113233746.1703361-7-seanjc@google.com Signed-off-by: Sean Christopherson commit e6ff1d61de51ec5fe94c5fb79544a93f494104eb Author: Sean Christopherson Date: Thu Nov 13 15:37:42 2025 -0800 KVM: VMX: Handle MMIO Stale Data in VM-Enter assembly via ALTERNATIVES_2 Rework the handling of the MMIO Stale Data mitigation to clear CPU buffers immediately prior to VM-Enter, i.e. in the same location that KVM emits a VERW for unconditional (at runtime) clearing. Co-locating the code and using a single ALTERNATIVES_2 makes it more obvious how VMX mitigates the various vulnerabilities. Deliberately order the alternatives as: 0. Do nothing 1. Clear if vCPU can access MMIO 2. Clear always since the last alternative wins in ALTERNATIVES_2(), i.e. so that KVM will honor the strictest mitigation (always clear CPU buffers) if multiple mitigations are selected. E.g. even if the kernel chooses to mitigate MMIO Stale Data via X86_FEATURE_CLEAR_CPU_BUF_VM_MMIO, another mitigation may enable X86_FEATURE_CLEAR_CPU_BUF_VM, and that other thing needs to win. Note, decoupling the MMIO mitigation from the L1TF mitigation also fixes a mostly-benign flaw where KVM wouldn't do any clearing/flushing if the L1TF mitigation is configured to conditionally flush the L1D, and the MMIO mitigation but not any other "clear CPU buffers" mitigation is enabled. For that specific scenario, KVM would skip clearing CPU buffers for the MMIO mitigation even though the kernel requested a clear on every VM-Enter. Note #2, the flaw goes back to the introduction of the MDS mitigation. The MDS mitigation was inadvertently fixed by commit 43fb862de8f6 ("KVM/VMX: Move VERW closer to VMentry for MDS mitigation"), but previous kernels that flush CPU buffers in vmx_vcpu_enter_exit() are affected (though it's unlikely the flaw is meaningfully exploitable even older kernels). Fixes: 650b68a0622f ("x86/kvm/vmx: Add MDS protection when L1D Flush is not active") Suggested-by: Pawan Gupta Reviewed-by: Pawan Gupta Reviewed-by: Brendan Jackman Link: https://patch.msgid.link/20251113233746.1703361-6-seanjc@google.com Signed-off-by: Sean Christopherson commit f6106d41ec84e552a5e8adda1f8741cab96a5425 Author: Sean Christopherson Date: Thu Nov 13 15:37:41 2025 -0800 x86/bugs: Use an x86 feature to track the MMIO Stale Data mitigation Convert the MMIO Stale Data mitigation tracking from a static branch into an x86 feature flag so that it can be used via ALTERNATIVE_2 in KVM. No functional change intended. Reviewed-by: Pawan Gupta Reviewed-by: Brendan Jackman Link: https://patch.msgid.link/20251113233746.1703361-5-seanjc@google.com Signed-off-by: Sean Christopherson commit afb99ffbd5825bfbc88e8052bc5514e6ebdfec5e Author: Sean Christopherson Date: Thu Nov 13 15:37:40 2025 -0800 x86/bugs: Decouple ALTERNATIVE usage from VERW macro definition Decouple the use of ALTERNATIVE from the encoding of VERW to clear CPU buffers so that KVM can use ALTERNATIVE_2 to handle "always clear buffers" and "clear if guest can access host MMIO" in a single statement. No functional change intended. Reviewed-by: Brendan Jackman Reviewed-by: Pawan Gupta Link: https://patch.msgid.link/20251113233746.1703361-4-seanjc@google.com Signed-off-by: Sean Christopherson commit aba7de6088be5a3b5d766c5f7fdb5d0790ff8f13 Author: Pawan Gupta Date: Thu Nov 13 15:37:39 2025 -0800 x86/bugs: Use VM_CLEAR_CPU_BUFFERS in VMX as well TSA mitigation: d8010d4ba43e ("x86/bugs: Add a Transient Scheduler Attacks mitigation") introduced VM_CLEAR_CPU_BUFFERS for guests on AMD CPUs. Currently on Intel CLEAR_CPU_BUFFERS is being used for guests which has a much broader scope (kernel->user also). Make mitigations on Intel consistent with TSA. This would help handling the guest-only mitigations better in future. Signed-off-by: Pawan Gupta [sean: make CLEAR_CPU_BUF_VM mutually exclusive with the MMIO mitigation] Acked-by: Borislav Petkov (AMD) Reviewed-by: Brendan Jackman Link: https://patch.msgid.link/20251113233746.1703361-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 844afc1af3a9d98dc8c246855c3aac410be36bef Author: Sean Christopherson Date: Thu Nov 13 15:37:38 2025 -0800 KVM: VMX: Use on-stack copy of @flags in __vmx_vcpu_run() When testing for VMLAUNCH vs. VMRESUME, use the copy of @flags from the stack instead of first moving it to EBX, and then propagating VMX_RUN_VMRESUME to RFLAGS.CF (because RBX is clobbered with the guest value prior to the conditional branch to VMLAUNCH). Stashing information in RFLAGS is gross, especially with the writer and reader being bifurcated by yet more gnarly assembly code. Opportunistically drop the SHIFT macros as they existed purely to allow the VM-Enter flow to use Bit Test. Suggested-by: Borislav Petkov Acked-by: Borislav Petkov (AMD) Reviewed-by: Brendan Jackman Link: https://patch.msgid.link/20251113233746.1703361-2-seanjc@google.com Signed-off-by: Sean Christopherson commit d6ec0906d6c40435a6a79e4981342161c5d82ef1 Merge: ec12ab2cda6607 f484f4a3e058b5 Author: Alexei Starovoitov Date: Tue Nov 18 16:20:25 2025 -0800 Merge branch 'replace-bpf-memory-allocator-with-kmalloc_nolock-in-local-storage' Amery Hung says: ==================== Replace BPF memory allocator with kmalloc_nolock() in local storage This patchset tries to simplify bpf_local_storage.c by adopting kmalloc_nolock(). This removes memory preallocation and reduces the dependency of smap in bpf_selem_free() and bpf_local_storage_free(). The later will simplify a future refactor that replaces local_storage->lock and b->lock [1]. RFC v1 tried to switch to kmalloc_nolock() unconditionally. However, as there is substantial performance loss in socket local storage due to 1) defer_free() in kfree_nolock() and 2) no kfree_rcu() batching, replacing kzalloc() is postponed until necessary improvements in mm land. Benchmark ./bench -p 1 local-storage-create --storage-type \ --batch-size <16,32,64> The benchmark is a microbenchmark stress-testing how fast local storage can be created. For task local storage, switching from BPF memory allocator to kmalloc_nolock() yields a small amount of improvement. For socket local storage, it remains roughly the same as nothing has changed. Socket local storage memory alloc batch creation speed creation speed diff --------------- ---- ------------------ ---- kzalloc 16 144.149 ± 0.642k/s 3.10 kmallocs/create (before) 32 144.379 ± 1.070k/s 3.08 kmallocs/create 64 144.491 ± 0.818k/s 3.13 kmallocs/create kzalloc 16 146.180 ± 1.403k/s 3.10 kmallocs/create +1.4% (not changed) 32 146.245 ± 1.272k/s 3.10 kmallocs/create +1.3% 64 145.012 ± 1.545k/s 3.10 kmallocs/create +0.4% Task local storage memory alloc batch creation speed creation speed diff --------------- ---- ------------------ ---- BPF memory 16 24.668 ± 0.121k/s 2.54 kmallocs/create allocator 32 22.899 ± 0.097k/s 2.67 kmallocs/create (before) 64 22.559 ± 0.076k/s 2.56 kmallocs/create kmalloc_nolock 16 25.796 ± 0.059k/s 2.52 kmallocs/create +4.6% (after) 32 23.412 ± 0.069k/s 2.50 kmallocs/create +2.2% 64 23.717 ± 0.108k/s 2.60 kmallocs/create +5.1% [1] https://lore.kernel.org/bpf/20251002225356.1505480-1-ameryhung@gmail.com/ v1 -> v2 - Only replace BPF memory allocator with kmalloc_nolock() Link: https://lore.kernel.org/bpf/20251112175939.2365295-1-ameryhung@gmail.com/ ==================== Link: https://patch.msgid.link/20251114201329.3275875-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit f484f4a3e058b5641670ebaeb301c06589848521 Author: Amery Hung Date: Fri Nov 14 12:13:26 2025 -0800 bpf: Replace bpf memory allocator with kmalloc_nolock() in local storage Replace bpf memory allocator with kmalloc_nolock() to reduce memory wastage due to preallocation. In bpf_selem_free(), an selem now needs to wait for a RCU grace period before being freed when reuse_now == true. Therefore, rcu_barrier() should be always be called in bpf_local_storage_map_free(). In bpf_local_storage_free(), since smap->storage_ma is no longer needed to return the memory, the function is now independent from smap. Remove the outdated comment in bpf_local_storage_alloc(). We already free selem after an RCU grace period in bpf_local_storage_update() when bpf_local_storage_alloc() failed the cmpxchg since commit c0d63f309186 ("bpf: Add bpf_selem_free()"). Signed-off-by: Amery Hung Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251114201329.3275875-5-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 39a460c4253e4a437b6b372f462c0c043026784d Author: Amery Hung Date: Fri Nov 14 12:13:25 2025 -0800 bpf: Save memory alloction info in bpf_local_storage Save the memory allocation method used for bpf_local_storage in the struct explicitly so that we don't need to go through the hassle to find out the info. When a later patch replaces BPF memory allocator with kmalloc_noloc(), bpf_local_storage_free() will no longer need smap->storage_ma to return the memory and completely remove the dependency on smap in bpf_local_storage_free(). Signed-off-by: Amery Hung Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251114201329.3275875-4-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit e76a33e1c7186526c2c133af73ea70da9275e1ba Author: Amery Hung Date: Fri Nov 14 12:13:24 2025 -0800 bpf: Remove smap argument from bpf_selem_free() Since selem already saves a pointer to smap, use it instead of an additional argument in bpf_selem_free(). This requires moving the SDATA(selem)->smap assignment from bpf_selem_link_map() to bpf_selem_alloc() since bpf_selem_free() may be called without the selem being linked to smap in bpf_local_storage_update(). Signed-off-by: Amery Hung Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251114201329.3275875-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 0e854e55356908386605714e66f98c3985d9e266 Author: Amery Hung Date: Fri Nov 14 12:13:23 2025 -0800 bpf: Always charge/uncharge memory when allocating/unlinking storage elements Since commit a96a44aba556 ("bpf: bpf_sk_storage: Fix invalid wait context lockdep report"), {charge,uncharge}_mem are always true when allocating a bpf_local_storage_elem or unlinking a bpf_local_storage_elem from local storage, so drop these arguments. No functional change. Signed-off-by: Amery Hung Reviewed-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251114201329.3275875-2-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov commit 24e17a29cf7537f0947f26a50f85319abd723c6c Author: Viacheslav Dubeyko Date: Wed Nov 12 15:25:23 2025 -0800 hfsplus: fix volume corruption issue for generic/073 The xfstests' test-case generic/073 leaves HFS+ volume in corrupted state: sudo ./check generic/073 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/073 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent (see XFSTESTS-2/xfstests-dev/results//generic/073.full for details) Ran: generic/073 Failures: generic/073 Failed 1 of 1 tests sudo fsck.hfsplus -d /dev/loop51 ** /dev/loop51 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. Invalid directory item count (It should be 1 instead of 0) ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 CBTStat = 0x0000 CatStat = 0x00004000 ** Repairing volume. ** Rechecking volume. ** Checking non-journaled HFS Plus Volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled was repaired successfully. The test is doing these steps on final phase: mv $SCRATCH_MNT/testdir_1/bar $SCRATCH_MNT/testdir_2/bar $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir_1 $XFS_IO_PROG -c "fsync" $SCRATCH_MNT/foo So, we move file bar from testdir_1 into testdir_2 folder. It means that HFS+ logic decrements the number of entries in testdir_1 and increments number of entries in testdir_2. Finally, we do fsync only for testdir_1 and foo but not for testdir_2. As a result, this is the reason why fsck.hfsplus detects the volume corruption afterwards. This patch fixes the issue by means of adding the hfsplus_cat_write_inode() call for old_dir and new_dir in hfsplus_rename() after the successful ending of hfsplus_rename_cat(). This method makes modification of in-core inode objects for old_dir and new_dir but it doesn't save these modifications in Catalog File's entries. It was expected that hfsplus_write_inode() will save these modifications afterwards. However, because generic/073 does fsync only for testdir_1 and foo then testdir_2 modification hasn't beed saved into Catalog File's entry and it was flushed without this modification. And it was detected by fsck.hfsplus. Now, hfsplus_rename() stores in Catalog File all modified entries and correct state of Catalog File will be flushed during hfsplus_file_fsync() call. Finally, it makes fsck.hfsplus happy. sudo ./check generic/073 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc3+ #93 SMP PREEMPT_DYNAMIC Wed Nov 12 14:37:49 PST 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/073 32s ... 32s Ran: generic/073 Passed all 1 tests Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20251112232522.814038-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 005d4b0d33f6b4a23d382b7930f7a96b95b01f39 Author: Tetsuo Handa Date: Sat Nov 15 18:18:54 2025 +0900 hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted. According to [1], the permissions field was treated as reserved in Mac OS 8 and 9. According to [2], the reserved field was explicitly initialized with 0, and that field must remain 0 as long as reserved. Therefore, when the "mode" field is not 0 (i.e. no longer reserved), the file must be S_IFDIR if dir == 1, and the file must be one of S_IFREG/S_IFLNK/S_IFCHR/ S_IFBLK/S_IFIFO/S_IFSOCK if dir == 0. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d Link: https://developer.apple.com/library/archive/technotes/tn/tn1150.html#HFSPlusPermissions [1] Link: https://developer.apple.com/library/archive/technotes/tn/tn1150.html#ReservedAndPadFields [2] Signed-off-by: Tetsuo Handa Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/04ded9f9-73fb-496c-bfa5-89c4f5d1d7bb@I-love.SAKURA.ne.jp Signed-off-by: Viacheslav Dubeyko commit 9891d2f79a9fe9b77ad290f950eb8fa3e375330e Author: Serge Hallyn Date: Fri Nov 14 04:32:36 2025 +0000 Clarify the rootid_owns_currentns Split most of the rootid_owns_currentns() functionality into a more generic rootid_owns_ns() function which will be easier to write tests for. Rename the functions and variables to make clear that the ids being tested could be any uid. Signed-off-by: Serge Hallyn CC: Ryan Foster CC: Christian Brauner --- v2: change the function parameter documentation to mollify the bot. commit 11d984633f7f3fc97dbbc551fe15429adf10a8d5 Author: Chao Gao Date: Fri Nov 7 17:36:01 2025 -0800 KVM: x86: Allocate/free user_return_msrs at kvm.ko (un)loading time Move user_return_msrs allocation/free from vendor modules (kvm-intel.ko and kvm-amd.ko) (un)loading time to kvm.ko's to make it less risky to access user_return_msrs in kvm.ko. Tying the lifetime of user_return_msrs to vendor modules makes every access to user_return_msrs prone to use-after-free issues as vendor modules may be unloaded at any time. Opportunistically turn the per-CPU variable into full structs, as there's no practical difference between statically allocating the memory and allocating it unconditionally during module_init(). Zero out kvm_nr_uret_msrs on vendor module exit to further minimize the chances of consuming stale data, and WARN on vendor module load if KVM thinks there are existing user-return MSRs. Note! The user-return MSRs also need to be "destroyed" if ops->hardware_setup() fails, as both SVM and VMX expect common KVM to clean up (because common code, not vendor code, is responsible for kvm_nr_uret_msrs). Signed-off-by: Chao Gao Co-developed-by: Sean Christopherson Link: https://patch.msgid.link/20251108013601.902918-1-seanjc@google.com Signed-off-by: Sean Christopherson commit ea5514e300568cbe8f19431c3e424d4791db8291 Merge: b5bea8cee55c50 f1840efdb2bf4f Author: Dave Jiang Date: Tue Nov 18 16:27:58 2025 -0700 Merge branch 'for-6.19/cxl-misc' into cxl-for-next - Remove ret_limit race condition in mock_get_event() - Assign overflow_err_count from log->nr_overflow commit 8e1d91c2582d2b60d62616649546bb132fff566b Author: Chengkaitao Date: Tue Nov 18 09:26:44 2025 +0800 block: remove the declaration of elevator_init_mq function In commit 1e44bedbc921 ("block: unifying elevator change"), the elevator_init_mq function was deleted, but its declaration in elevator.h was overlooked. This patch fixes it. Signed-off-by: Chengkaitao Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit d32e1c2dccb9ad6ca65e70c9d5a68038d4924b36 Merge: 10ae71c96e7c53 6e38a225fc347d Author: Georgi Djakov Date: Wed Nov 19 01:24:58 2025 +0200 Merge branch 'icc-kaanapali' into icc-next Add interconnect dt-bindings and driver support for Qualcomm Kaanapali SoC. * icc-kaanapali dt-bindings: interconnect: document the RPMh Network-On-Chip interconnect in Kaanapali SoC interconnect: qcom: add Kaanapali interconnect provider driver dt-bindings: interconnect: qcom-bwmon: Document Kaanapali BWMONs Link: https://lore.kernel.org/r/20251031-knp-interconnect-v4-0-568bba2cb3e5@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 6e38a225fc347d05156e3ae9fa0bda6355aa29c8 Author: Amir Vajid Date: Fri Nov 14 01:22:03 2025 +0200 dt-bindings: interconnect: qcom-bwmon: Document Kaanapali BWMONs Document the Kaanapali BWMONs, which have one instance per cluster of BWMONv4. Signed-off-by: Amir Vajid Signed-off-by: Jingyi Wang Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250924-knp-bwmon-v1-1-56a9cdda7d72@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 1aaa5cfbd489e02d18973c7721a00613de544a63 Author: Alexandre Courbot Date: Sat Nov 8 11:23:49 2025 +0900 MAINTAINERS: add entry for the Rust `num` module This new module provides numerical features useful for the kernel, such as the `Integer` trait and the `Bounded` integer wrapper. Signed-off-by: Alexandre Courbot Acked-by: Yury Norov (NVIDIA) Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251108-bounded_ints-v4-3-c9342ac7ebd1@nvidia.com Signed-off-by: Miguel Ojeda commit 01e345e82ec3a5a7edeb9fa0dcb7fd4b0e5c534e Author: Alexandre Courbot Date: Sat Nov 8 11:23:48 2025 +0900 rust: num: add Bounded integer wrapping type Add the `Bounded` integer wrapper type, which restricts the number of bits allowed to represent of value. This is useful to e.g. enforce guarantees when working with bitfields that have an arbitrary number of bits. Alongside this type, provide many `From` and `TryFrom` implementations are to reduce friction when using with regular integer types. Proxy implementations of common integer operations are also provided. Signed-off-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251108-bounded_ints-v4-2-c9342ac7ebd1@nvidia.com [ Added intra-doc link. Fixed a few other nits. - Miguel ] Signed-off-by: Miguel Ojeda commit f1840efdb2bf4f8d0e698eebec8f676c6d745c6d Author: Alison Schofield Date: Sat Nov 15 17:30:32 2025 -0800 cxl/test: Assign overflow_err_count from log->nr_overflow mock_get_event() uses an uninitialized local variable, nr_overflow, to populate the overflow_err_count field. That results in incorrect overflow_err_count values in mocked cxl_overflow trace events, such as this case where the records are reported as 0 and should be non-zero: [] cxl_overflow: memdev=mem7 host=cxl_mem.6 serial=7: log=Failure : 0 records from 1763228189130895685 to 1763228193130896180 Fix by using log->nr_overflow and remove the unused local variable. A follow-up change was considered in cxl_mem_get_records_log() to confirm that the overflow_err_count is non-zero when the overflow flag is set [1]. Since the driver has no functional dependency on this constraint, and a device that violates this specific requirement does not cause incorrect driver behavior, no validation check is added. [1] CXL 3.2, Table 8-65 Get Event Records Output Payload Signed-off-by: Alison Schofield Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20251116013036.1713313-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit b6369daf0d6a96db5048edd26b07fc1aaed77dd1 Author: Alison Schofield Date: Sat Nov 15 17:37:49 2025 -0800 cxl/test: Remove ret_limit race condition in mock_get_event() Commit 364ee9f3265e ("cxl/test: Enhance event testing") changed the loop iterator in mock_get_event() from a static constant, CXL_TEST_EVENT_CNT, to a dynamic global variable, ret_limit. The intent was to vary the number of events returned per call to simulate events occurring while logs are being read. However, ret_limit is modified without synchronization. When multiple threads call mock_get_event() concurrently, one thread may read ret_limit, another thread may increment it, and the first thread's loop condition and size calculation see and use the updated value. This is visible during cxl_test module load when all memdevs are initializing simultaneously, which includes getting event records. It is not tied to the cxl-events.sh unit test specifically, as that operates on a single memdev. While no actual harm results (the buffer is always large enough and the record count fields correctly reflect what was written), this is a correctness issue. The race creates an inconsistent state within mock_get_event() and adding variability based on a race appears unintended. Make ret_limit a local variable populated from an atomic counter. Each call gets a stable value that won't change during execution. That preserves the intended behavior of varying the return counts across calls while eliminating the race condition. This implementation uses "+ 1" to produce the full range of 1 to CXL_TEST_EVENT_RET_MAX (4) records. Previously only 1, 2, 3 were produced. Signed-off-by: Alison Schofield Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20251116013819.1713780-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit d9813cd23d5a7b254cc1b1c1ea042634d8da62e6 Author: Longbin Li Date: Mon Nov 17 17:05:39 2025 +0800 spi: sophgo: Fix incorrect use of bus width value macros The previous code initialized the 'reg' value with specific bus-width values (BUS_WIDTH_2_BIT and BUS_WIDTH_4_BIT), which introduces ambiguity. Replace them with BUS_WIDTH_MASK to express the intention clearly. Fixes: de16c322eefb ("spi: sophgo: add SG2044 SPI NOR controller driver") Signed-off-by: Longbin Li Link: https://patch.msgid.link/20251117090559.78288-1-looong.bin@gmail.com Signed-off-by: Mark Brown commit 0341d1b1ebf10bcbb9f35e174e83dbb21068387d Author: Nathan Chancellor Date: Wed Nov 12 11:44:30 2025 -0700 pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data Clang warns (or errors with CONFIG_WERROR=y / W=e): pinctrl/mediatek/pinctrl-airoha.c:2064:41: error: variable 'an7583_pinctrl_drive_e2_conf' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration] 2064 | static const struct airoha_pinctrl_conf an7583_pinctrl_drive_e2_conf[] = { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Due to a typo, an7583_pinctrl_drive_e2_conf is only used within ARRAY_SIZE() (hence no instance of -Wunused-variable), which is evaluated at compile time, so it will not be needed in the final object file. Fix the .confs assignment for AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data to clear up the warning. Closes: https://github.com/ClangBuiltLinux/linux/issues/2142 Fixes: 3ffeb17a9a27 ("pinctrl: airoha: add support for Airoha AN7583 PINs") Signed-off-by: Nathan Chancellor Acked-by: Christian Marangi Signed-off-by: Linus Walleij commit f2bd5a0f59d052d16749bccf637690e51947a5d6 Author: Chukun Pan Date: Sat Nov 15 18:00:00 2025 +0800 pinctrl: airoha: fix pinctrl function mismatch issue The blamed commit made the following changes: -#define PINCTRL_FUNC_DESC(id)... - .desc = PINCTRL_PINFUNCTION(#id, ... +#define PINCTRL_FUNC_DESC(id, table)... + .desc = PINCTRL_PINFUNCTION(#id, ... - PINCTRL_FUNC_DESC(pon)... + PINCTRL_FUNC_DESC("pon", pon)... It's clear that the id of funcs doesn't match the definition. Remove redundant #string from the definition to fix this issue: pinctrl-airoha ...: invalid function mdio in map table Fixes: 4043b0c45f85 ("pinctrl: airoha: generalize pins/group/function/confs handling") Signed-off-by: Chukun Pan Acked-by: Christian Marangi Signed-off-by: Linus Walleij commit ec8e1f41a192b7f71e22f13116a23ae9e5d359ed Merge: f2596d9fa19c09 3b0cf6ab35909d Author: Linus Walleij Date: Wed Nov 19 00:00:58 2025 +0100 Merge tag 'renesas-pinctrl-for-v6.19-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.19 (take two) - Remove removed signals on R-Car V4H and V4M, - Refactor OEN register PWPR handling on RZ/G2L. Signed-off-by: Linus Walleij commit ec12ab2cda6607debde3f5cf6d425a1ec5fae1dd Author: Hoyeon Lee Date: Sun Nov 16 07:55:39 2025 +0900 selftests/bpf: Replace TCP CC string comparisons with bpf_strncmp The connect4_prog and bpf_iter_setsockopt tests duplicate the same open-coded TCP congestion control string comparison logic. Since bpf_strncmp() provides the same functionality, use it instead to avoid repeated open-coded loops. This change applies only to functional BPF tests and does not affect the verifier performance benchmarks (veristat.cfg). No functional changes intended. Reviewed-by: Amery Hung Signed-off-by: Hoyeon Lee Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251115225550.1086693-5-hoyeon.lee@suse.com commit f700b37314d9b96dce66e31d2da865b201fa6b38 Author: Hoyeon Lee Date: Sun Nov 16 07:55:38 2025 +0900 selftests/bpf: Move common TCP helpers into bpf_tracing_net.h Some BPF selftests contain identical copies of the min(), max(), before(), and after() helpers. These repeated snippets are the same across the tests and do not need to be defined separately. Move these helpers into bpf_tracing_net.h so they can be shared by TCP related BPF programs. This removes repeated code and keeps the helpers in a single place. Reviewed-by: Amery Hung Signed-off-by: Hoyeon Lee Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251115225550.1086693-4-hoyeon.lee@suse.com commit b5bea8cee55c50117e08675a2c15f35a6bef2472 Merge: 7ec9db66cc552f 26c5b0d9c080ff Author: Dave Jiang Date: Tue Nov 18 15:41:53 2025 -0700 Merge branch 'for-6.19/cxl-misc' into cxl-for-next - remove unused mock function for cxl_rcd_component_reg_phys() commit 26c5b0d9c080ff753c66de0b19d6e3e014a24877 Author: Alejandro Lucero Date: Tue Nov 18 18:22:02 2025 +0000 cxl/test: remove unused mock function for cxl_rcd_component_reg_phys() Since commit 733b57f262b0 ("cxl/pci: Early setup RCH dport component registers from RCRB") is not necessary under mocking tests. [ dj: Fixup commit representation flagged by checkpatch. ] [ dj: Ammend subject line to indicate which function. ] Signed-off-by: Alejandro Lucero Reviewed-by: Dave Jiang > --- Reviewed-by: Ira Weiny Link: https://patch.msgid.link/20251118182202.2083244-1-alejandro.lucero-palau@amd.com Signed-off-by: Dave Jiang commit 3664282f3345fdfa6a154feb6ed6c3217a8b3b0d Author: Konrad Dybcio Date: Tue Nov 18 18:33:12 2025 +0100 clk: qcom: x1e80100-dispcc: Add USB4 router link resets The router link clock branches also feature some reset logic, which is required to properly power sequence the hardware for DP tunneling over USB4. Describe these missing resets. Signed-off-by: Konrad Dybcio Reviewed-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251118-topic-usb4_x1e_dispcc-v1-2-14c68d842c71@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c84b824d3a8f14bedec8108cb8061da761180f49 Author: Konrad Dybcio Date: Tue Nov 18 18:33:11 2025 +0100 dt-bindings: clock: qcom: x1e80100-dispcc: Add USB4 router link resets The router link clock branches also feature some reset logic, which is required to properly power sequence the hardware for DP tunneling over USB4. Describe these missing resets. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251118-topic-usb4_x1e_dispcc-v1-1-14c68d842c71@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a160860529b55c54dbd54137f86c818a53d07655 Author: Taniya Das Date: Tue Nov 18 12:47:09 2025 +0530 clk: qcom: videocc-sm8750: Add video clock controller driver for SM8750 Add support for the video clock controller for video clients to be able to request for videocc clocks on SM8750 platform. Reviewed-by: Konrad Dybcio Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Imran Shaik Link: https://lore.kernel.org/r/20251118-sm8750-videocc-v2-v4-5-049882a70c9f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b190eaea57803da00a4318ba12359625337be9e8 Author: Taniya Das Date: Tue Nov 18 12:47:08 2025 +0530 dt-bindings: clock: qcom: Add SM8750 video clock controller Add compatible string for SM8750 video clock controller and the bindings for SM8750 Qualcomm SoC. Signed-off-by: Taniya Das Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251118-sm8750-videocc-v2-v4-4-049882a70c9f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit aa788d3b475652a3ebaca32ca714f02f8ece3393 Author: Taniya Das Date: Tue Nov 18 12:47:07 2025 +0530 clk: qcom: branch: Extend invert logic for branch2 mem clocks Some clock branches require inverted logic for memory gating, where disabling the memory involves setting a bit and enabling it involves clearing the same bit. This behavior differs from the standard approach memory branch clocks ops where enabling typically sets the bit. The mem_enable_invert to allow conditional handling of these sequences of the inverted control logic for memory operations required on those memory clock branches. Signed-off-by: Taniya Das Reviewed-by: Imran Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251118-sm8750-videocc-v2-v4-3-049882a70c9f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit caebce24f6a7f8315b1b87505b74066efb592d92 Author: Jens Axboe Date: Tue Nov 18 08:37:26 2025 -0700 Revert "block: consider discard merge last" This reverts commit 2516c246d01c23a5f5310e9ac78d9f8aad9b1d0e. Suspected issues with discard merging post this patch, hence revert it for now. Link: https://lore.kernel.org/linux-block/26acdfdf-de13-430b-8c73-f890c7689a84@kernel.dk/ Signed-off-by: Jens Axboe commit 935a20d1bebf6236076785fac3ff81e3931834e9 Author: Bart Van Assche Date: Fri Nov 14 13:04:07 2025 -0800 block: Remove queue freezing from several sysfs store callbacks Freezing the request queue from inside sysfs store callbacks may cause a deadlock in combination with the dm-multipath driver and the queue_if_no_path option. Additionally, freezing the request queue slows down system boot on systems where sysfs attributes are set synchronously. Fix this by removing the blk_mq_freeze_queue() / blk_mq_unfreeze_queue() calls from the store callbacks that do not strictly need these callbacks. Add the __data_racy annotation to request_queue.rq_timeout to suppress KCSAN data race reports about the rq_timeout reads. This patch may cause a small delay in applying the new settings. For all the attributes affected by this patch, I/O will complete correctly whether the old or the new value of the attribute is used. This patch affects the following sysfs attributes: * io_poll_delay * io_timeout * nomerges * read_ahead_kb * rq_affinity Here is an example of a deadlock triggered by running test srp/002 if this patch is not applied: task:multipathd Call Trace: __schedule+0x8c1/0x1bf0 schedule+0xdd/0x270 schedule_preempt_disabled+0x1c/0x30 __mutex_lock+0xb89/0x1650 mutex_lock_nested+0x1f/0x30 dm_table_set_restrictions+0x823/0xdf0 __bind+0x166/0x590 dm_swap_table+0x2a7/0x490 do_resume+0x1b1/0x610 dev_suspend+0x55/0x1a0 ctl_ioctl+0x3a5/0x7e0 dm_ctl_ioctl+0x12/0x20 __x64_sys_ioctl+0x127/0x1a0 x64_sys_call+0xe2b/0x17d0 do_syscall_64+0x96/0x3a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 task:(udev-worker) Call Trace: __schedule+0x8c1/0x1bf0 schedule+0xdd/0x270 blk_mq_freeze_queue_wait+0xf2/0x140 blk_mq_freeze_queue_nomemsave+0x23/0x30 queue_ra_store+0x14e/0x290 queue_attr_store+0x23e/0x2c0 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3b2/0x630 vfs_write+0x4fd/0x1390 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x276/0x17d0 do_syscall_64+0x96/0x3a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Cc: Christoph Hellwig Cc: Ming Lei Cc: Nilay Shroff Cc: Martin Wilck Cc: Benjamin Marzinski Cc: stable@vger.kernel.org Fixes: af2814149883 ("block: freeze the queue in queue_attr_store") Signed-off-by: Bart Van Assche Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 42adb2d4ef24d2834cbd3bb96a6660826ae763da Author: Bart Van Assche Date: Fri Nov 14 13:04:06 2025 -0800 fs: Add the __data_racy annotation to backing_dev_info.ra_pages Some but not all .ra_pages changes happen while block layer I/O is paused with blk_mq_freeze_queue(). Filesystems may read .ra_pages even while block layer I/O is paused, e.g. from inside their .fadvise callback. Annotating all .ra_pages reads with READ_ONCE() would be cumbersome. Hence, add the __data_racy annotatation to the .ra_pages member variable. Cc: Alexander Viro Cc: Christian Brauner Cc: Nilay Shroff Signed-off-by: Bart Van Assche Reviewed-by: Nilay Shroff Signed-off-by: Jens Axboe commit 152c331bcd805eddd520979c51cea46582e260fc Author: Xue He Date: Tue Nov 18 07:32:30 2025 +0000 block: plug attempts to batch allocate tags multiple times This patch aims to enable batch allocation of sufficient tags after batch IO submission with plug mechanism, thereby avoiding the need for frequent individual requests when the initial allocation is insufficient. ----------------------------------------------------------- HW: 16 CPUs/16 poll queues Disk: Samsung PM9A3 Gen4 3.84T CMD: [global] ioengine=io_uring group_reporting=1 time_based=1 runtime=1m refill_buffers=1 norandommap=1 randrepeat=0 fixedbufs=1 registerfiles=1 rw=randread iodepth=128 iodepth_batch_submit=32 iodepth_batch_complete_min=32 iodepth_batch_complete_max=128 iodepth_low=32 bs=4k numjobs=1 direct=1 hipri=1 [job1] filename=/dev/nvme0n1 name=batch_test ------------------------------------------------------------ Perf: base code: __blk_mq_alloc_requests() 1.47% patch: __blk_mq_alloc_requests() 0.75% ------------------------------------------------------------ Signed-off-by: hexue Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 4d24145a7833c14a6521dfab57c5f10076a0110f Author: Andy Shevchenko Date: Tue Nov 11 15:49:45 2025 +0100 devres: Remove unused devm_free_percpu() Remove unused devm_free_percpu(). By the way, it was never used in the drivers/ from day 1. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251111145046.997309-2-andriy.shevchenko@linux.intel.com Signed-off-by: Danilo Krummrich commit 1d779fa9962ffb150c02f67cc0bcec253d56513b Author: René Rebe Date: Tue Nov 18 17:46:54 2025 +0100 ata: pata_pcmcia: Add Iomega Clik! PCMCIA ATA/ATAPI Adapter Add Iomega Clik! "PCMCIA ATA/ATAPI Adapter" ID to pata_pcmcia. Signed-off-by: René Rebe Signed-off-by: Niklas Cassel commit 5a88a6e92bbf5963fadeb0e8f8c747c2fb425ba8 Author: Reinette Chatre Date: Mon Nov 17 16:42:45 2025 -0800 fs/resctrl: Consider sparse masks when initializing new group's allocation A new resource group is intended to be created with sane defaults. For a cache resource this means all cache portions the new group could possibly allocate into. This includes unused cache portions and shareable cache portions used by other groups and hardware. New resource group creation does not take sparse masks into account. After determining the bitmask reflecting the new group's possible allocations the bitmask is forced to be contiguous even if the system supports sparse masks. For example, a new group could by default allocate into a large portion of cache represented by 0xff0f, but it is instead created with a mask of 0xf. Do not force a contiguous allocation range if the system supports sparse masks. Signed-off-by: Reinette Chatre Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/abbbb008bc09d982d715e79d3b885c10f92c64e0.1763426240.git.reinette.chatre@intel.com commit e41ef37ddfe763b829b5b44662ce29e26549b42c Author: Thomas Zimmermann Date: Wed Oct 15 17:56:34 2025 +0200 efi/libstub: x86: Store EDID in boot_params Retrieve the GOP device's EDID information in the kernel's boot parameters. Makes the data avaialble to kernel graphics code and drives, such as efidrm. With efidrm, the EDID is now also available to user-space compositors via standard DRM interfaces. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit 17029cdd8f9d0182a6499e0b7bfc6391e8463091 Author: Thomas Zimmermann Date: Wed Oct 15 17:56:33 2025 +0200 efi/libstub: gop: Add support for reading EDID Add support for EFI_EDID_DISCOVERED_PROTOCOL and EFI_EDID_ACTIVE_PROTOCOL as defined in UEFI 2.8, sec 12.9. Define GUIDs and data structures in the rsp header files. In the GOP setup function, read the EDID of the primary GOP device. First try EFI_EDID_ACTIVE_PROTOCOL, which supports user-specified EDID data. Or else try EFI_EDID_DISCOVERED_PROTOCOL, which returns the display device's native EDID. If no EDID could be retrieved, clear the storage. Rename efi_setup_gop() to efi_setup_graphics() to reflect the changes Let callers pass an optional instance of struct edid_data, if they are interested. While screen_info and edid_info come from the same device handle, they should be considered indendent data. The former refers to the graphics mode, the latter refers to the display device. GOP devices might not provide both. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit ae42b9c5ddda213feb4e5e57673c4b1f9d2f5541 Author: Thomas Zimmermann Date: Wed Oct 15 17:56:32 2025 +0200 efi/libstub: gop: Initialize screen_info in helper function Move initialization of screen_info into a single helper function. Frees up space in the main setup helper for adding EDID support. No functional changes. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit 9d805709d897dc3765d32630178ef8c8b2b624ee Author: Thomas Zimmermann Date: Wed Oct 15 17:56:31 2025 +0200 efi/libstub: gop: Find GOP handle instead of GOP data The device handle of the GOP device is required to retrieve the correct EDID data. Find the handle instead of the GOP data. Still return the GOP data in the function arguments, as we already looked it up. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit d85b56af22f371409cbf667bab26f938e6528d2e Author: Thomas Zimmermann Date: Wed Oct 15 17:56:30 2025 +0200 efi: Fix trailing whitespace in header file Resolve an issue with the coding style. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit 70f62e52176df0f1f4684919546a6198d5e82529 Author: Junjie Cao Date: Mon Nov 17 11:23:58 2025 +0800 Input: ti_am335x_tsc - clamp coordinate_readouts to DT maximum (6) DT binding (ti,am3359-tsc.yaml) sets ti,coordinate-readouts to a maximum of 6. The MFD parent also enforces that (readouts * 2 + 2) + adc_channels <= 16 and fails probe if this is violated, so the touchscreen subdriver will not even probe in those cases. Clamp coordinate_readouts > 6 to 6 in the subdriver to align with the binding and keep behavior sane if invalid platform data bypasses schema checks. Keep the existing default to 5 for non-positive values. No functional change with valid DT. Signed-off-by: Junjie Cao Link: https://patch.msgid.link/20251117032358.891822-1-junjie.cao@intel.com Signed-off-by: Dmitry Torokhov commit 21e68bcb1b0c688c2d9ca0d457922febac650ac1 Author: Claudiu Beznea Date: Mon Nov 17 12:32:05 2025 +0200 regulator: renesas-usb-vbus-regulator: Remove unused headers Remove unused included headers. This makes the code simpler. Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251117103205.4038600-1-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Mark Brown commit d9d0be59be2580f2c5e4b7217aafb980e8c371cf Author: Martijn de Gouw Date: Mon Nov 17 21:22:14 2025 +0100 regulator: pca9450: Add support for setting debounce settings Make the different debounce timers configurable from the devicetree. Depending on the board design, these have to be set different than the default register values. Signed-off-by: Martijn de Gouw Link: https://patch.msgid.link/20251117202215.1936139-2-martijn.de.gouw@prodrive-technologies.com Signed-off-by: Mark Brown commit 93218e3f2cfeb1e7992768dd3e64c9012e705992 Author: Martijn de Gouw Date: Mon Nov 17 21:22:13 2025 +0100 regulator: dt-bindings: pca9540: add debounce timer configuration Make the different debounce timers configurable from the devicetree. Depending on the board design, these have to be set different than the default register values. Signed-off-by: Martijn de Gouw Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251117202215.1936139-1-martijn.de.gouw@prodrive-technologies.com Signed-off-by: Mark Brown commit bd79452b39c21599e2cff42e9fbeb182656b6f6a Author: Lukas Bulwahn Date: Mon Nov 17 11:40:44 2025 +0100 MAINTAINERS: adjust file entry in RISC-V MICROCHIP SUPPORT Commit 71c814e98696 ("spi: microchip: rename driver file and internal identifiers") renames spi-microchip-core.c to spi-mpfs.c, but misses to adjust the file entry in RISC-V MICROCHIP SUPPORT. Adjust the file entry after this renaming. Signed-off-by: Lukas Bulwahn Link: https://patch.msgid.link/20251117104044.291517-1-lukas.bulwahn@redhat.com Signed-off-by: Mark Brown commit 4dbb5f6e1b4eed64037d4462977c196acab2af16 Author: Carlos Song Date: Tue Nov 18 14:50:12 2025 +0800 spi: imx: add 16/32 bits per word support for target PIO mode Enable 16/32 bits per word support for spi-imx target PIO mode. Signed-off-by: Carlos Song Signed-off-by: Clark Wang Reviewed-by: Frank Li Link: https://patch.msgid.link/20251118065012.1418279-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit e45979641a9a9dbb48fc77c5b36a5091a92e7227 Author: HariKrishna Sagala Date: Tue Nov 11 10:59:21 2025 +0530 ASoC: SOF: sof-client-probes: Replace snprintf() with scnprintf() As per the C99 standard snprintf() returns the length of the data that *would have been* written if there were enough space for it. It's generally considered safer to use the scnprintf() variant. Link: https://github.com/KSPP/linux/issues/105 Signed-off-by: HariKrishna Sagala Link: https://patch.msgid.link/20251111052920.56459-2-hariconscious@gmail.com Signed-off-by: Mark Brown commit f5cb3ee251b4f9db2761aced191f10579bd7e64e Author: Charles Keepax Date: Tue Nov 11 14:06:17 2025 +0000 ASoC: SDCA: Add companion amp Function Add companion amp into the list of allowed SDCA Functions. More work will be required to fully support companion amp, but this will let parts including companion amp functions boot and it is a good first step to proper support. Signed-off-by: Charles Keepax Reviewed-by: Richard Fitzgerald Tested-by: Richard Fitzgerald Link: https://patch.msgid.link/20251111140617.2997454-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 94000534e0883b4f4ba9882e4630cfcdf2af539d Author: Laurentiu Mihalcea Date: Fri Nov 14 06:35:03 2025 -0800 ASoC: SOF: imx9: use SCMI API for LM management Linux supports NXP's LMM SCMI protocol so switch to using the appropriate API. The SIPs were intended to act as placeholders until the support for said protocol was upstreamed. The underlying CPU protocol command from IMX_SIP_SRC_M_RESET_ADDR_SET is replaced by a LMM protocol command with the same effect (i.e. setting the boot address) since using the CPU protocol would require additional permissions (which TF-A already had). Apart from this, the SIPs are replaced by their equivalent Linux LMM commands. Signed-off-by: Laurentiu Mihalcea Reviewed-by: Iuliana Prodan Link: https://patch.msgid.link/20251114143503.2139-1-laurentiumihalcea111@gmail.com Signed-off-by: Mark Brown commit d218ea171430e49412804efb794942dd121a8032 Author: Cyril Chao Date: Fri Oct 31 15:32:04 2025 +0800 ASoC: mediatek: mt8189: add machine driver with nau8825 Add support for mt8189 board with nau8825. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-11-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 4980df101676f598ad515725a94424d244a5c5a3 Author: Cyril Chao Date: Fri Oct 31 15:32:03 2025 +0800 ASoC: dt-bindings: mediatek,mt8189-nau8825: add mt8189-nau8825 document Add document for mt8189 board with nau8825. Signed-off-by: Cyril Chao Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251031073216.8662-10-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 7eb1535855983f67b95c2ba777d686cc17188285 Author: Cyril Chao Date: Fri Oct 31 15:32:02 2025 +0800 ASoC: mediatek: mt8189: add platform driver Add mt8189 platform driver. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-9-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 22e9bd51e518e8fcad269c0c1f4bd84467db093e Author: Cyril Chao Date: Fri Oct 31 15:32:01 2025 +0800 ASoC: dt-bindings: mediatek,mt8189-afe-pcm: add audio afe document Add mt8189 audio afe document. Signed-off-by: Cyril Chao Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251031073216.8662-8-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 402ff043395fd9444810c723056fe741c77dbc21 Author: Cyril Chao Date: Fri Oct 31 15:32:00 2025 +0800 ASoC: mediatek: mt8189: support PCM in platform driver Add mt8189 PCM DAI driver support. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-7-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 9f202872ba04d71c96908c56abcc6e3f4a629a40 Author: Cyril Chao Date: Fri Oct 31 15:31:59 2025 +0800 ASoC: mediatek: mt8189: support TDM in platform driver Add mt8189 TDM DAI driver support. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-6-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 34e437097247f92fba6fac3d6e40e33af5f32e3d Author: Cyril Chao Date: Fri Oct 31 15:31:58 2025 +0800 ASoC: mediatek: mt8189: support I2S in platform driver Add mt8189 I2S DAI driver support. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-5-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit e3acef6ef89ffbd6c80950d5fa0d024a8d11c1c4 Author: Cyril Chao Date: Fri Oct 31 15:31:57 2025 +0800 ASoC: mediatek: mt8189: support ADDA in platform driver Add mt8189 ADDA DAI driver support. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-4-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit dc637ffeed6c32c951520774897601ebd9ffc3d5 Author: Cyril Chao Date: Fri Oct 31 15:31:56 2025 +0800 ASoC: mediatek: mt8189: support audio clock control Add audio clock wrapper and audio tuner control. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-3-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit 81f8f29a48defd572ec34d2b9c84374fd05158cc Author: Cyril Chao Date: Fri Oct 31 15:31:55 2025 +0800 ASoC: mediatek: mt8189: add common header Add header files for register definitions and structures. Signed-off-by: Cyril Chao Link: https://patch.msgid.link/20251031073216.8662-2-Cyril.Chao@mediatek.com Signed-off-by: Mark Brown commit d5cb9574391cc0a4683c22944d00d0ad76a224d3 Author: Sohil Mehta Date: Tue Nov 18 10:29:10 2025 -0800 x86/cpu: Enable LASS during CPU initialization Linear Address Space Separation (LASS) mitigates a class of side-channel attacks that rely on speculative access across the user/kernel boundary. Enable LASS along with similar security features if the platform supports it. While at it, remove the comment above the SMAP/SMEP/UMIP/LASS setup instead of updating it, as the whole sequence is quite self-explanatory. Some EFI runtime and boot services may rely on 1:1 mappings in the lower half during early boot and even after SetVirtualAddressMap(). To avoid tripping LASS, the initial CR4 programming would need to be delayed until EFI has completely finished entering virtual mode (including efi_free_boot_services()). Also, LASS would need to be temporarily disabled while switching to efi_mm to avoid potential faults on stray runtime accesses. Similarly, legacy vsyscall page accesses are flagged by LASS resulting in a #GP (instead of a #PF). Without LASS, the #PF handler emulates the accesses and returns the appropriate values. Equivalent emulation support is required in the #GP handler with LASS enabled. In case of vsyscall XONLY (execute only) mode, the faulting address is readily available in the RIP which would make it easier to reuse the #PF emulation logic. For now, keep it simple and disable LASS if either of those are compiled in. Though not ideal, this makes it easier to start testing LASS support in some environments. In future, LASS support can easily be expanded to support EFI and legacy vsyscalls. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-9-sohil.mehta%40intel.com commit c9129cf0f0447cdf195df0c79b87940f266d3767 Author: Sohil Mehta Date: Tue Nov 18 10:29:09 2025 -0800 selftests/x86: Update the negative vsyscall tests to expect a #GP Some of the vsyscall selftests expect a #PF when vsyscalls are disabled. However, with LASS enabled, an invalid access results in a SIGSEGV due to a #GP instead of a #PF. One such negative test fails because it is expecting X86_PF_INSTR to be set. Update the failing test to expect either a #GP or a #PF. Also, update the printed messages to show the trap number (denoting the type of fault) instead of assuming a #PF. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-8-sohil.mehta%40intel.com commit 42fea0a3a707249cf88ee24aece1dfaba4953b97 Author: Alexander Shishkin Date: Tue Nov 18 10:29:08 2025 -0800 x86/traps: Communicate a LASS violation in #GP message A LASS violation typically results in a #GP. With LASS active, any invalid access to user memory (including the first page frame) would be reported as a #GP, instead of a #PF. Unfortunately, the #GP error messages provide limited information about the cause of the fault. This could be confusing for kernel developers and users who are accustomed to the friendly #PF messages. To make the transition easier, enhance the #GP Oops message to include a hint about LASS violations. Also, add a special hint for kernel NULL pointer dereferences to match with the existing #PF message. Signed-off-by: Alexander Shishkin Signed-off-by: Kirill A. Shutemov Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-7-sohil.mehta%40intel.com commit 731d43750cf8d3c67df7aabc78cc567c6d684111 Author: Sohil Mehta Date: Tue Nov 18 10:29:07 2025 -0800 x86/kexec: Disable LASS during relocate kernel The relocate kernel mechanism uses an identity mapping to copy the new kernel, which leads to a LASS violation when executing from a low address. LASS must be disabled after the original CR4 value is saved because kexec paths that preserve context need to restore CR4.LASS. But, disabling it along with CET during identity_mapped() is too late. So, disable LASS immediately after saving CR4, along with PGE, and before jumping to the identity-mapped page. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-6-sohil.mehta%40intel.com commit b3a7e973abe6fe3b56adb39be52a4bdaefe14b65 Author: Sohil Mehta Date: Tue Nov 18 10:29:06 2025 -0800 x86/alternatives: Disable LASS when patching kernel code For patching, the kernel initializes a temporary mm area in the lower half of the address range. LASS blocks these accesses because its enforcement relies on bit 63 of the virtual address as opposed to SMAP which depends on the _PAGE_BIT_USER bit in the page table. Disable LASS enforcement by toggling the RFLAGS.AC bit during patching to avoid triggering a #GP fault. Introduce LASS-specific STAC/CLAC helpers to set the AC bit only on platforms that need it. Name the wrappers as lass_stac()/_clac() instead of lass_disable()/_enable() because they only control the kernel data access enforcement. The entire LASS mechanism (including instruction fetch enforcement) is controlled by the CR4.LASS bit. Describe the usage of the new helpers in comparison to the ones used for SMAP. Also, add comments to explain when the existing stac()/clac() should be used. While at it, move the duplicated "barrier" comment to the same block. The Text poking functions use standard memcpy()/memset() while patching kernel code. However, objtool complains about calling such dynamic functions within an AC=1 region. See warning #9, regarding function calls with UACCESS enabled, in tools/objtool/Documentation/objtool.txt. To pacify objtool, one option is to add memcpy() and memset() to the list of allowed-functions. However, that would provide a blanket exemption for all usages of memcpy() and memset(). Instead, replace the standard calls in the text poking functions with their unoptimized, always-inlined versions. Considering that patching is usually small, there is no performance impact expected. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-5-sohil.mehta%40intel.com commit d9a96cc18bec65c39822ee0a1672d7dc3fda150a Author: Peter Zijlstra (Intel) Date: Tue Nov 18 10:29:05 2025 -0800 x86/asm: Introduce inline memcpy and memset Provide inline memcpy and memset functions that can be used instead of the GCC builtins when necessary. The immediate use case is for the text poking functions to avoid the standard memcpy()/memset() calls because objtool complains about such dynamic calls within an AC=1 region. See tools/objtool/Documentation/objtool.txt, warning #9, regarding function calls with UACCESS enabled. Some user copy functions such as copy_user_generic() and __clear_user() have similar rep_{movs,stos} usages. But, those are highly specialized and hard to combine or reuse for other things. Define these new helpers for all other usages that need a completely unoptimized, strictly inline version of memcpy() or memset(). Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-4-sohil.mehta%40intel.com commit e39c5387adebf2839aaf5779cdd09a3506963fc5 Author: Sohil Mehta Date: Tue Nov 18 10:29:04 2025 -0800 x86/cpu: Add an LASS dependency on SMAP With LASS enabled, any kernel data access to userspace typically results in a #GP, or a #SS in some stack-related cases. When the kernel needs to access user memory, it can suspend LASS enforcement by toggling the RFLAGS.AC bit. Most of these cases are already covered by the stac()/clac() pairs used to avoid SMAP violations. Even though LASS could potentially be enabled independently, it would be very painful without SMAP and the related stac()/clac() calls. There is no reason to support such a configuration because all future hardware with LASS is expected to have SMAP as well. Also, the STAC/CLAC instructions are architected to: #UD - If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0. So, make LASS depend on SMAP to conveniently reuse the existing AC bit toggling already in place. Note: Additional STAC/CLAC would still be needed for accesses such as text poking which are not flagged by SMAP. This is because such mappings are in the lower half but do not have the _PAGE_USER bit set which SMAP uses for enforcement. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-3-sohil.mehta%40intel.com commit 7baadd463e147fdcb6d3a091d85e23f89832569c Author: Sohil Mehta Date: Tue Nov 18 10:29:03 2025 -0800 x86/cpufeatures: Enumerate the LASS feature bits Linear Address Space Separation (LASS) is a security feature that mitigates a class of side-channel attacks relying on speculative access across the user/kernel boundary. Privilege mode based access protection already exists today with paging and features such as SMEP and SMAP. However, to enforce these protections, the processor must traverse the paging structures in memory. An attacker can use timing information resulting from this traversal to determine details about the paging structures, and to determine the layout of the kernel memory. LASS provides the same mode-based protections as paging but without traversing the paging structures. Because the protections are enforced prior to page-walks, an attacker will not be able to derive paging-based timing information from the various caching structures such as the TLBs, mid-level caches, page walker, data caches, etc. LASS enforcement relies on the kernel implementation to divide the 64-bit virtual address space into two halves: Addr[63]=0 -> User address space Addr[63]=1 -> Kernel address space Any data access or code execution across address spaces typically results in a #GP fault, with an #SS generated in some rare cases. The LASS enforcement for kernel data accesses is dependent on CR4.SMAP being set. The enforcement can be disabled by toggling the RFLAGS.AC bit similar to SMAP. Define the CPU feature bits to enumerate LASS. Also, disable the feature at compile time on 32-bit kernels. Use a direct dependency on X86_32 (instead of !X86_64) to make it easier to combine with similar 32-bit specific dependencies in the future. LASS mitigates a class of side-channel speculative attacks, such as Spectre LAM, described in the paper, "Leaky Address Masking: Exploiting Unmasked Spectre Gadgets with Noncanonical Address Translation". Add the "lass" flag to /proc/cpuinfo to indicate that the feature is supported by hardware and enabled by the kernel. This allows userspace to determine if the system is secure against such attacks. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Xin Li (Intel) Reviewed-by: Dave Hansen Link: https://patch.msgid.link/20251118182911.2983253-2-sohil.mehta%40intel.com commit 8bf3ad767587c0744fdf4a1eec02b5487baa82d3 Author: Krishna Chaitanya Chundru Date: Sat Nov 1 09:29:36 2025 +0530 PCI: qcom: Implement .assert_perst() Add support for assert_perst() for switches like TC9563, which require configuration before the PCIe link is established. Such devices use this function op to assert PERST# before configuring the device and once the configuration is done they de-assert PERST#. Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251101-tc9563-v9-5-de3429f7787a@oss.qualcomm.com commit 3445d3820770377c3e7dc96875ac0e928e497fd5 Author: Krishna Chaitanya Chundru Date: Sat Nov 1 09:29:34 2025 +0530 PCI: dwc: Implement .assert_perst() for dwc glue drivers Add .assert_perst() hook for dwc glue drivers to register with assert_perst() of pci ops, allowing for better control over the link initialization and shutdown process. Implement assert_perst() function op for dwc drivers. Signed-off-by: Krishna Chaitanya Chundru [bhelgaas: squash dwc host support] Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251101-tc9563-v9-3-de3429f7787a@oss.qualcomm.com Link: https://patch.msgid.link/20251101-tc9563-v9-4-de3429f7787a@oss.qualcomm.com commit 01ba82702957225218c54c06ad2c2d468b83f510 Author: Krishna Chaitanya Chundru Date: Sat Nov 1 09:29:33 2025 +0530 PCI: Add .assert_perst() to control PCIe PERST# Controller driver probes first, enables link training and scans the bus. When the PCI bridge is found, its child DT nodes will be scanned and pwrctrl devices will be created if needed. By the time pwrctrl driver probe gets called, link training is already enabled by controller driver. Certain devices like TC9563, which uses the PCI pwrctl framework, need to configure the device before the PCIe link is up. As the controller driver already enables link training as part of its probe, the moment device is powered on, controller and device participate in link training and link can come up immediately and may not have time to configure the device. So we need to stop the link training by using assert_perst() by asserting PERST# and de-asserting PERST# after device is configured. Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251101-tc9563-v9-2-de3429f7787a@oss.qualcomm.com commit 26f3ac8848354f493dc6e8fb687c7c7e1a7488af Author: Krishna Chaitanya Chundru Date: Sat Nov 1 09:29:32 2025 +0530 dt-bindings: PCI: Add binding for Toshiba TC9563 PCIe switch Add a device tree binding for the Toshiba TC9563 PCIe switch, which provides an Ethernet MAC integrated to the 3rd downstream port and two downstream PCIe ports. Signed-off-by: Krishna Chaitanya Chundru Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251101-tc9563-v9-1-de3429f7787a@oss.qualcomm.com commit 7fa3e7d114abc9cc71cc35d768e116641074ddb4 Author: Uladzislau Rezki (Sony) Date: Mon Nov 17 11:59:45 2025 +0100 dm-ebs: Mark full buffer dirty even on partial write When performing a read-modify-write(RMW) operation, any modification to a buffered block must cause the entire buffer to be marked dirty. Marking only a subrange as dirty is incorrect because the underlying device block size(ubs) defines the minimum read/write granularity. A lower device can perform I/O only on regions which are fully aligned and sized to ubs. This change ensures that write-back operations always occur in full ubs-sized chunks, matching the intended emulation semantics of the EBS target. As for user space visible impact, submitting sub-ubs and misaligned I/O for devices which are tuned to ubs sizes only, will reject such requests, therefore it can lead to losing data. Example: 1) Create a 8K nvme device in qemu by adding -device nvme,drive=drv0,serial=foo,logical_block_size=8192,physical_block_size=8192 2) Setup dm-ebs to emulate 512B to 8K mapping urezki@pc638:~/bin$ cat dmsetup.sh lower=/dev/nvme0n1 len=$(blockdev --getsz "$lower") echo "0 $len ebs $lower 0 1 16" | dmsetup create nvme-8k urezki@pc638:~/bin$ offset 0, ebs=1 and ubs=16(in sectors). 3) Create an ext4 filesystem(default 4K block size) urezki@pc638:~/bin$ sudo mkfs.ext4 -F /dev/dm-0 mke2fs 1.47.0 (5-Feb-2023) Discarding device blocks: done Creating filesystem with 2072576 4k blocks and 518144 inodes Filesystem UUID: bd0b6ca6-0506-4e31-86da-8d22c9d50b63 Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632 Allocating group tables: done Writing inode tables: done Creating journal (16384 blocks): done Writing superblocks and filesystem accounting information: mkfs.ext4: Input/output error while writing out and closing file system urezki@pc638:~/bin$ dmesg [ 1618.875449] buffer_io_error: 1028 callbacks suppressed [ 1618.875456] Buffer I/O error on dev dm-0, logical block 0, lost async page write [ 1618.875527] Buffer I/O error on dev dm-0, logical block 1, lost async page write [ 1618.875602] Buffer I/O error on dev dm-0, logical block 2, lost async page write [ 1618.875620] Buffer I/O error on dev dm-0, logical block 3, lost async page write [ 1618.875639] Buffer I/O error on dev dm-0, logical block 4, lost async page write [ 1618.894316] Buffer I/O error on dev dm-0, logical block 5, lost async page write [ 1618.894358] Buffer I/O error on dev dm-0, logical block 6, lost async page write [ 1618.894380] Buffer I/O error on dev dm-0, logical block 7, lost async page write [ 1618.894405] Buffer I/O error on dev dm-0, logical block 8, lost async page write [ 1618.894427] Buffer I/O error on dev dm-0, logical block 9, lost async page write Many I/O errors because the lower 8K device rejects sub-ubs/misaligned requests. with a patch: urezki@pc638:~/bin$ sudo mkfs.ext4 -F /dev/dm-0 mke2fs 1.47.0 (5-Feb-2023) Discarding device blocks: done Creating filesystem with 2072576 4k blocks and 518144 inodes Filesystem UUID: 9b54f44f-ef55-4bd4-9e40-c8b775a616ac Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632 Allocating group tables: done Writing inode tables: done Creating journal (16384 blocks): done Writing superblocks and filesystem accounting information: done urezki@pc638:~/bin$ sudo mount /dev/dm-0 /mnt/ urezki@pc638:~/bin$ ls -al /mnt/ total 24 drwxr-xr-x 3 root root 4096 Oct 17 15:13 . drwxr-xr-x 19 root root 4096 Jul 10 19:42 .. drwx------ 2 root root 16384 Oct 17 15:13 lost+found urezki@pc638:~/bin$ After this change: mkfs completes; mount succeeds. Signed-off-by: Uladzislau Rezki (Sony) Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org commit 61c73e8de99370ad0ee96ef6d65d8e35d302c5c1 Author: John Garry Date: Tue Oct 28 15:08:05 2025 +0000 dm mpath: enable DM_TARGET_ATOMIC_WRITES Both the bio- and rq-based paths have no problem supporting REQ_ATOMIC, so enable DM_TARGET_ATOMIC_WRITES. Signed-off-by: John Garry Signed-off-by: Mikulas Patocka commit ae97648e14f7907f4b0e0b295eb2fdcf43806f9d Author: Shubhankar Mishra Date: Wed Nov 5 14:06:44 2025 +0000 dm verity fec: Expose corrected block count via status Enhance visibility into dm-verity Forward Error Correction (FEC) activity. While FEC can correct on-disk corruptions, the number of successful correction events is not readily exposed through a standard interface. This change integrates FEC statistics into the verity target's .status handler for STATUSTYPE_INFO. The info output now includes count of corrected block by FEC. The counter is a per-device instance atomic64_t, maintained within the struct dm_verity_fec, tracking blocks successfully repaired by FEC on this specific device instance since it was created. This approach aligns with the standard Device Mapper mechanism for targets to report runtime information, as used by other targets like dm-integrity. This patch also updates Documentation/admin-guide/device-mapper/verity.rst to reflect the new status information. Tested: Induced single-bit errors on a block device protected by dm-verity with FEC on android phone. Confirmed 'dmctl status ' on Android reports an incrementing 'fec_corrected_blocks' count after the corrupted blocks were accessed. Signed-off-by: Shubhankar Mishra Signed-off-by: Mikulas Patocka commit c82faa893418f584da8f38f9cbdda4533f49fd55 Author: Jon Hunter Date: Fri Oct 31 15:34:55 2025 +0000 dm: Don't warn if IMA_DISABLE_HTABLE is not enabled Commit f1cd6cb24b6b ("dm ima: add a warning in dm_init if duplicate ima events are not measured") added a warning message if CONFIG_IMA is enabled but CONFIG_IMA_DISABLE_HTABLE is not to inform users. When enabling CONFIG_IMA, CONFIG_IMA_DISABLE_HTABLE is disabled by default and so warning is seen. Therefore, it seems more appropriate to make this an INFO level message than warning. If this truly is a warning, then maybe CONFIG_IMA_DISABLE_HTABLE should default to y if CONFIG_IMA is enabled. Signed-off-by: Jon Hunter Signed-off-by: Mikulas Patocka commit 0140fc11893bf22928a6f6ebcea96315671d75dc Merge: 20772c4e0f0b58 4422df6782eb7a Author: Mark Brown Date: Tue Nov 18 17:16:32 2025 +0000 ASoC: convert to snd_soc_dapm_xxx() Merge series from Kuninori Morimoto : This patch-set convert many functions to snd_soc_dapm_xxx(). This is preparation to move struct snd_soc_dapm_context into soc-dapm.c. For backport easy, this patch-set is added for each drivers. commit 0d616c28a35ef7525becd48b994fb6fb21f53119 Merge: 54760125b026f2 ee5f1a3f90a472 Author: Vinod Koul Date: Tue Nov 18 22:43:42 2025 +0530 phy: Add Renesas RZ/G3E USB3.0 PHY driver Biju says: This patch series aims to add Renesas RZ/G3E USB3.0 PHY driver support. This module is connected between USB3 Host and PHY module. The main functions of this module are: 1) Reset control 2) Control of PHY input pins 3) Monitoring of PHY output pins Biju Das (2): dt-bindings: phy: renesas: Document Renesas RZ/G3E USB3.0 PHY phy: renesas: Add Renesas RZ/G3E USB3.0 PHY driver Link: https://patch.msgid.link/20251029084037.108610-1-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit ee5f1a3f90a4720f89fd1e250fa6754470da1510 Author: Biju Das Date: Wed Oct 29 08:40:34 2025 +0000 phy: renesas: Add Renesas RZ/G3E USB3.0 PHY driver Add Renesas RZ/G3E USB3.0 PHY driver. This module is connected between USB3 Host and PHY module. The main functions of this module are: 1) Reset control 2) Control of PHY input pins 3) Monitoring of PHY output pins Signed-off-by: Biju Das Link: https://patch.msgid.link/20251029084037.108610-3-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit 4f816512aaa1fa3b74df7473ef771ebef511255e Author: Biju Das Date: Wed Oct 29 08:40:33 2025 +0000 dt-bindings: phy: renesas: Document Renesas RZ/G3E USB3.0 PHY Document Renesas RZ/G3E USB3.0 PHY. This IP is connected between USB3HOST and PHY module. The main functions of the module are as follows: - Reset control - Control of PHY input pins - Monitoring of PHY output pins Acked-by: Conor Dooley Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251029084037.108610-2-biju.das.jz@bp.renesas.com Signed-off-by: Vinod Koul commit 7bc29d5fb6faff2f547323c9ee8d3a0790cd2530 Author: Akhil P Oommen Date: Tue Nov 18 14:20:48 2025 +0530 dt-bindings: display/msm/gmu: Add Adreno X2-85 GMU Document Adreno X2-85 GMU found in Glymur chipsets in the dt-binding specification. It is very similar to Adreno 840 GMU with the additional requirement of RSCC HUB clock. Acked-by: Krzysztof Kozlowski Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689032/ Message-ID: <20251118-kaana-gpu-support-v4-21-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit e9bbdb4d53ec733d8154311b30724791f3c2ce22 Author: Akhil P Oommen Date: Tue Nov 18 14:20:47 2025 +0530 dt-bindings: display/msm/gmu: Add Adreno 840 GMU Document Adreno 840 GMU in the dt-binding specification. Acked-by: Rob Herring (Arm) Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689031/ Message-ID: <20251118-kaana-gpu-support-v4-20-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 3b9b0816f9ed757072dc8b1088ea09b7c69c543d Author: Akhil P Oommen Date: Tue Nov 18 14:20:46 2025 +0530 dt-bindings: arm-smmu: Add Kaanapali and Glymur GPU SMMU Update the devicetree bindings to document the GPU SMMUs present in Kaanapali and Glymur chipsets. Acked-by: Krzysztof Kozlowski Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689028/ Message-ID: <20251118-kaana-gpu-support-v4-19-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 01ff3bf272156615d6c3daa5286243408bf05e44 Author: Akhil P Oommen Date: Tue Nov 18 14:20:45 2025 +0530 drm/msm/a8xx: Add support for Adreno X2-85 GPU Adreno X2-85 GPU is found in the next generation of Qualcomm's compute series chipset called Snapdragon X2 Elite (a.k.a Glymur). It is based on the new A8x slice architecture and features up to 4 slices. Due to the wider 12 channel DDR support, there is higher DDR bandwidth available than previous generation to improve performance. Add a new entry in the catalog along with the necessary register configurations to enable support for it. Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689026/ Message-ID: <20251118-kaana-gpu-support-v4-18-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 60a4e18e0e8ab27d7dfd1316eab31706176481e9 Author: Akhil P Oommen Date: Tue Nov 18 14:20:44 2025 +0530 drm/msm/adreno: Do CX GBIF config before GMU start GMU lies on the CX domain and accesses CX GBIF. So do CX GBIF configurations before GMU wakes up. This was not a problem so far, but A840 GPU is very sensitive to this requirement. Also, move these registers to the catalog. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689024/ Message-ID: <20251118-kaana-gpu-support-v4-17-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 0700b9f6822d6e0843528db93de15928a36bc1a3 Author: Akhil P Oommen Date: Tue Nov 18 14:20:43 2025 +0530 drm/msm/a8xx: Add support for Adreno 840 GPU Adreno 840 present in Kaanapali SoC is the second generation GPU in A8x family. It comes in 2 variants with either 2 or 3 Slices. This is in addition to the SKUs supported based on the GPU FMAX. Add the necessary register configurations to the catalog and enable support for it. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689022/ Message-ID: <20251118-kaana-gpu-support-v4-16-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 16201a1ee232b2da8bf1acdf117c4fbb9aa11161 Author: Akhil P Oommen Date: Tue Nov 18 14:20:42 2025 +0530 drm/msm/adreno: Support AQE engine AQE (Applicaton Qrisc Engine) is a dedicated core inside CP which aides in Raytracing related workloads. Add support for loading the AQE firmware and initialize the necessary registers. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/689020/ Message-ID: <20251118-kaana-gpu-support-v4-15-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 288a932008925644d8d0ca69bf7a69a0dce82dc5 Author: Akhil P Oommen Date: Tue Nov 18 14:20:41 2025 +0530 drm/msm/adreno: Introduce A8x GPU Support A8x is the next generation of Adreno GPUs, featuring a significant hardware design change. A major update to the design is the introduction of Slice architecture. Slices are sort of mini-GPUs within the GPU which are more independent in processing Graphics and compute workloads. Also, in addition to the BV and BR pipe we saw in A7x, CP has more concurrency with additional pipes. From a software interface perspective, these changes have a significant impact on the KMD side. First, the GPU register space has been extensively reorganized. Second, to avoid a register space explosion caused by the new slice architecture and additional pipes, many registers are now virtualized, instead of duplicated as in A7x. KMD must configure an aperture register with the appropriate slice and pipe ID before accessing these virtualized registers. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689019/ Message-ID: <20251118-kaana-gpu-support-v4-14-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 06cfbca0e1c6e26855564fd48bb3babb9c66f446 Author: Akhil P Oommen Date: Tue Nov 18 14:20:40 2025 +0530 drm/msm/a6xx: Share dependency vote table with GMU A8x GMU firmwares expect a separate vote table which describes the relationship between the Gx rail and MxA rail (and possibly Cx rail). Create this new vote table and implement the new HFI message which allows passing vote tables to send this data to GMU. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689016/ Message-ID: <20251118-kaana-gpu-support-v4-13-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit ca04ce7a2f22652fdf6489fa7e02e7d2c08698f4 Author: Akhil P Oommen Date: Tue Nov 18 14:20:39 2025 +0530 drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Current logic assumes that the voltage corners in both MxG and MxA are always same. This is not true for recent targets. So, rework the rpmh init sequence to probe and calculate the votes with the respective rails, ie, GX rails should use MxG as secondary rail and Cx rail should use MxA as the secondary rail. Fixes: d6225e0cd096 ("drm/msm/adreno: Add support for X185 GPU") Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689014/ Message-ID: <20251118-kaana-gpu-support-v4-12-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 50e8a557d8d368718b906103d9202f8376832bbe Author: Akhil P Oommen Date: Tue Nov 18 14:20:38 2025 +0530 drm/msm/a8xx: Add support for A8x GMU A8x GMU configurations are very similar to A7x. Unfortunately, there are minor shuffling in the register offsets in the GMU CX register region. So, update the driver to use the correct register offsets on A8x hw. Some A8x GPUs have more than 16 powerlevels on GX domain and 4 on CX domain. To accommodate this, increase the arrays' sizes which hold gx and cx power levels. Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689013/ Message-ID: <20251118-kaana-gpu-support-v4-11-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 188db3d7fe66ca0f865a4f5608d00b961cc8b2d9 Author: Akhil P Oommen Date: Tue Nov 18 14:20:37 2025 +0530 drm/msm/a6xx: Rebase GMU register offsets GMU registers are always at a fixed offset from the GPU base address, a consistency maintained at least within a given architecture generation. In A8x family, the base address of the GMU has changed, but the offsets of the gmu registers remain largely the same. To enable reuse of the gmu code for A8x chipsets, update the gmu register offsets to be relative to the GPU's base address instead of GMU's. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689010/ Message-ID: <20251118-kaana-gpu-support-v4-10-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 1ef05ef9fa02188d859b2ee6a45e1a4c38420639 Author: Akhil P Oommen Date: Tue Nov 18 14:20:36 2025 +0530 drm/msm/a6xx: Sync latest register definitions Sync the latest register definitions from Mesa which includes the updates for A8x family. Co-developed-by: Rob Clark Signed-off-by: Rob Clark Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689009/ Message-ID: <20251118-kaana-gpu-support-v4-9-86eeb8e93fb6@oss.qualcomm.com> commit 54760125b026f25d329158ffb5f5569c8efcea93 Author: Claudiu Beznea Date: Mon Nov 17 12:34:22 2025 +0200 phy: core: Remove extra space after '=' Remove extra space after '=' to comply with coding style. Signed-off-by: Claudiu Beznea Reviewed-by: Neil Armstrong Signed-off-by: Vinod Koul commit 58e0f987c27040e4b23f1050836389229fc3a07e Merge: 42690b8ec861b5 a1af5d2be169ec Author: Vinod Koul Date: Tue Nov 18 22:26:04 2025 +0530 phy: Add new phy_notify_state() api Peter Griffin says: This series adds a new phy_notify_state() API to the phy subsystem. It is designed to be used when some specific runtime configuration parameters need to be changed when transitioning to the desired state which can't be handled by phy_calibrate()or phy_power_{on|off}(). The first user of the new API is phy-samsung-ufs and phy-gs101-ufs which need to issue some register writes when entering and exiting the hibern8 link state. A separate patch will be sent for ufs-exynos driver to make use of this new API in the hibern8 callbacks. Link: https://patch.msgid.link/20251112-phy-notify-pmstate-v5-0-39df622d8fcb@linaro.org Signed-off-by: Vinod Koul commit a1af5d2be169ecec92cb4d85c811450d68164aec Author: Peter Griffin Date: Wed Nov 12 16:27:07 2025 +0000 phy: samsung: gs101-ufs: Add .notify_phystate() & hibern8 enter/exit values Implement the .notify_phystate() callback and provide the gs101 specific phy values that need to be programmed when entering and exiting the hibern8 state. Signed-off-by: Peter Griffin Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251112-phy-notify-pmstate-v5-2-39df622d8fcb@linaro.org Signed-off-by: Vinod Koul commit 4edf654be5471659e3260be0a557eaa2ece668ab Author: Peter Griffin Date: Wed Nov 12 16:27:06 2025 +0000 phy: add new phy_notify_state() api Add a new phy_notify_state() api that notifies and configures a phy for a given state transition. This is intended to be used by phy drivers which need to do some runtime configuration of parameters that can't be handled by phy_calibrate() or phy_power_{on|off}(). The first usage of this API is in the Samsung UFS phy that needs to issue some register writes when entering and exiting the hibernate link state. Signed-off-by: Peter Griffin Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251112-phy-notify-pmstate-v5-1-39df622d8fcb@linaro.org Signed-off-by: Vinod Koul commit e64e190044de8876b6434652388c13e457cd8a0c Author: Bagas Sanjaya Date: Fri Oct 24 17:39:34 2025 +0700 Documentation: hid-alps: Format DataByte* subsection headings "Command Read/Write" section has two DataByte* subsections describing command bytes format. Add markup to these subsection heading texts. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jiri Kosina commit c6405fb9111d4fb25cc64cdebbe23d982a8a0e83 Author: Bagas Sanjaya Date: Fri Oct 24 17:39:33 2025 +0700 Documentation: hid-alps: Fix packet format section headings In "Packet Format" section, only "StickPointer data byte" subsection heading is shown as such in htmldocs output; "Touchpad data byte" one is in normal paragraph on the other hand. Properly format the headings to be consistent. Fixes: 2562756dde55 ("HID: add Alps I2C HID Touchpad-Stick support") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jiri Kosina commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 Author: Encrow Thorne Date: Mon Nov 10 14:10:37 2025 +0800 reset: fix BIT macro reference RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not include bits.h. This causes compilation errors when including reset.h standalone. Include bits.h to make reset.h self-contained. Suggested-by: Troy Mitchell Reviewed-by: Troy Mitchell Reviewed-by: Philipp Zabel Signed-off-by: Encrow Thorne Signed-off-by: Philipp Zabel commit cea5d43b63b221522f8532a7894149f3d8d11f4b Author: Dan Carpenter Date: Sat Nov 1 16:27:07 2025 +0300 reset: rzg2l-usbphy-ctrl: Fix a NULL vs IS_ERR() bug in probe The devm_regmap_field_alloc() function never returns NULL, it returns error pointers. Update the error checking to match. Fixes: 58128aa88867 ("reset: rzg2l-usbphy-ctrl: Add support for USB PWRRDY") Signed-off-by: Dan Carpenter Reviewed-by: Claudiu Beznea Signed-off-by: Philipp Zabel commit da91533c2b7a569b272b8271f0b2c407f86407ed Author: Yao Zi Date: Tue Oct 14 13:10:31 2025 +0000 reset: th1520: Support reset controllers in more subsystems Introduce reset controllers for AP, MISC, VI, VP and DSP subsystems and add their reset signal mappings. Signed-off-by: Yao Zi Reviewed-by: Drew Fustini Acked-by: Guo Ren Signed-off-by: Philipp Zabel commit 0040d9eac391bacefcb0c748cf32c8fe5900b13b Author: Yao Zi Date: Tue Oct 14 13:10:30 2025 +0000 reset: th1520: Prepare for supporting multiple controllers TH1520 SoC is divided into several subsystems, shipping distinct reset controllers with similar control logic. Let's make reset signal mapping a data structure specific to one compatible to prepare for introduction of more reset controllers in the future. Signed-off-by: Yao Zi Acked-by: Guo Ren Reviewed-by: Drew Fustini Signed-off-by: Philipp Zabel commit a35ac6f3bdb135debc8e1ff599d0009bc64dc329 Author: Yao Zi Date: Tue Oct 14 13:10:29 2025 +0000 dt-bindings: reset: thead,th1520-reset: Add controllers for more subsys TH1520 SoC is divided into several subsystems, most of them have distinct reset controllers. Let's document reset controllers other than the one for VO subsystem and IDs for their reset signals. Signed-off-by: Yao Zi Acked-by: Rob Herring (Arm) Reviewed-by: Drew Fustini Acked-by: Guo Ren Signed-off-by: Philipp Zabel commit 5334eb9de76c74e24821aae89e111e27398b5add Author: Yao Zi Date: Tue Oct 14 13:10:28 2025 +0000 dt-bindings: reset: thead,th1520-reset: Remove non-VO-subsystem resets Registers in control of TH1520_RESET_ID_{NPU,WDT0,WDT1} belong to AP reset controller, not the VO one which is documented as "thead,th1520-reset" and is the only reset controller supported for TH1520 for now. Let's remove the IDs, leaving them to be implemented by AP-subsystem reset controller in the future. Fixes: 30e7573babdc ("dt-bindings: reset: Add T-HEAD TH1520 SoC Reset Controller") Signed-off-by: Yao Zi Acked-by: Rob Herring (Arm) Reviewed-by: Drew Fustini Acked-by: Guo Ren Signed-off-by: Philipp Zabel commit 8bffbfdc01dff26f17f8b382266e71d48e63c5e9 Author: Bartosz Golaszewski Date: Wed Oct 22 15:51:32 2025 +0200 reset: remove legacy reset lookup code There are no more users of this code. Let's remove the exported symbols and the implementation from reset core. Reviewed-by: Philipp Zabel Signed-off-by: Bartosz Golaszewski [p.zabel@pengutronix.de: folded in 8e6ec20e-8965-4b42-99fc-0462269ff2f1@paulmck-laptop] Signed-off-by: Philipp Zabel commit a86aaf2b62fcf52e988fad47cdd18eb47cbd698f Author: Bartosz Golaszewski Date: Wed Oct 22 15:51:31 2025 +0200 clk: davinci: psc: drop unused reset lookup We no longer support any non-DT DaVinci boards so there are no more users of legacy reset lookup. Signed-off-by: Bartosz Golaszewski Acked-by: Stephen Boyd Acked-by: David Lechner Signed-off-by: Philipp Zabel commit 819ac6b055350c559dbb111f970a96e2c1c812ff Author: Claudiu Beznea Date: Thu Oct 23 16:58:08 2025 +0300 reset: rzg2l-usbphy-ctrl: Add support for RZ/G3S SoC The Renesas RZ/G3S SoC USB PHY HW block receives as input the USB PWRRDY signal from the system controller. Add support for the Renesas RZ/G3S SoC. Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 78f2d64e484753bfede6a0e9eab0ef35830c34fb Author: Claudiu Beznea Date: Thu Oct 23 16:58:07 2025 +0300 reset: rzg2l-usbphy-ctrl: Add support for USB PWRRDY On the Renesas RZ/G3S SoC, the USB PHY block has an input signal called PWRRDY. This signal is managed by the system controller and must be de-asserted after powering on the area where USB PHY resides and asserted before powering it off. On power-on/resume the USB PWRRDY signal need to be de-asserted before enabling clock and switching the module to normal state (through MSTOP support). The power-on/resume configuration sequence must be: 1/ PWRRDY=0 2/ CLK_ON=1 3/ MSTOP=0 On power-off/suspend the configuration sequence should be: 1/ MSTOP=1 2/ CLK_ON=0 3/ PWRRDY=1 The CLK_ON and MSTOP functionalities are controlled by clock drivers. The suspend/resume support will be handled by different patches. After long discussions with the internal HW team, it has been confirmed that the HW connection b/w USB PHY block, the USB channels, the system controller, clock, MSTOP, PWRRDY signal is as follows: ┌──────────────────────────────┐ │ │◄── CPG_CLKON_USB.CLK0_ON │ USB CH0 │ ┌──────────────────────────┐ │┌───────────────────────────┐ │◄── CPG_CLKON_USB.CLK2_ON │ ┌────────┐ ││host controller registers │ │ │ │ │ ││function controller registers│ │ │ PHY0 │◄──┤└───────────────────────────┘ │ │ USB PHY │ │ └────────────▲─────────────────┘ │ └────────┘ │ │ │ CPG_BUS_PERI_COM_MSTOP.MSTOP{6, 5}_ON │┌──────────────┐ ┌────────┐ ││USHPHY control│ │ │ ││ registers │ │ PHY1 │ ┌──────────────────────────────┐ │└──────────────┘ │ │◄──┤ USB CH1 │ │ └────────┘ │┌───────────────────────────┐ │◄── CPG_CLKON_USB.CLK1_ON └─▲───────▲─────────▲──────┘ ││ host controller registers │ │ │ │ │ │└───────────────────────────┘ │ │ │ │ └────────────▲─────────────────┘ │ │ │ │ │ │ │ CPG_BUS_PERI_COM_MSTOP.MSTOP7_ON │PWRRDY │ │ │ │ CPG_CLK_ON_USB.CLK3_ON │ │ │ CPG_BUS_PERI_COM_MSTOP.MSTOP4_ON │ ┌────┐ │SYSC│ └────┘ where: - CPG_CLKON_USB.CLK.CLKX_ON is the register bit controlling the clock X of different USB blocks, X in {0, 1, 2, 3} - CPG_BUS_PERI_COM_MSTOP.MSTOPX_ON is the register bit controlling the MSTOP of different USB blocks, X in {4, 5, 6, 7} - USB PHY is the USB PHY block exposing 2 ports, port0 and port1, used by the USB CH0, USB CH1 - SYSC is the system controller block controlling the PWRRDY signal - USB CHx are individual USB block with host and function capabilities (USB CH0 have both host and function capabilities, USB CH1 has only host capabilities) The USBPHY control registers are controlled though the reset-rzg2l-usbphy-ctrl driver. The USB PHY ports are controlled by phy_rcar_gen3_usb2 (drivers/phy/renesas/phy-rcar-gen3-usb2.c file). The USB PHY ports request resets from the reset-rzg2l-usbphy-ctrl driver. The connection b/w the system controller and the USB PHY CTRL driver is implemented through the renesas,sysc-pwrrdy device tree property proposed in this patch. This property specifies the register offset and the bitmask required to control the PWRRDY signal. Since the USB PHY CTRL driver needs to be probed before any other USB-specific driver on RZ/G3S, control of PWRRDY is passed exclusively to it. This guarantees the correct configuration sequence between clocks, MSTOP bits, and the PWRRDY bit on probe/resume and remove/suspend. At the same time, changes are kept minimal by avoiding modifications to the USB PHY driver to also handle the PWRRDY itself. Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 20eee0f69c9034a0f613528f829dcaca192740d5 Author: Claudiu Beznea Date: Thu Oct 23 16:58:06 2025 +0300 dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G3S support The Renesas USB PHY hardware block needs to have the PWRRDY bit in the system controller set before applying any other settings. The PWRRDY bit must be controlled during power-on, power-off, and system suspend/resume sequences as follows: - during power-on/resume, it must be set to zero before enabling clocks and modules - during power-off/suspend, it must be set to one after disabling clocks and modules Add the renesas,sysc-pwrrdy device tree property, which allows the reset-rzg2l-usbphy-ctrl driver to parse, map, and control the system controller PWRRDY bit at the appropriate time. Along with it add a new compatible for the RZ/G3S SoC. Reviewed-by: Rob Herring (Arm) Signed-off-by: Claudiu Beznea Signed-off-by: Philipp Zabel commit 0884bd97c08cfad9c23166ddee953498cf535284 Author: Xuyang Dong Date: Tue Sep 30 17:32:38 2025 +0800 reset: eswin: Add eic7700 reset driver Add support for reset controller in eic7700 series chips. Provide functionality for asserting and deasserting resets on the chip. Signed-off-by: Yifeng Huang Signed-off-by: Xuyang Dong Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel commit 23818ebb9c76bac8dfedec252cf33157230efc23 Author: Xuyang Dong Date: Tue Sep 30 17:32:18 2025 +0800 dt-bindings: reset: eswin: Documentation for eic7700 SoC Add device tree binding documentation and header file for the ESWIN eic7700 reset controller module. Signed-off-by: Yifeng Huang Signed-off-by: Xuyang Dong Reviewed-by: Krzysztof Kozlowski Signed-off-by: Philipp Zabel commit bf919ccfced7d47d14ec2d20ae465e8ae410aee6 Author: Robert Marko Date: Mon Sep 22 16:27:29 2025 +0200 reset: sparx5: add LAN969x support LAN969x uses the same reset configuration as LAN966x, but we need to allow compiling it when ARCH_LAN969X is selected. A fallback compatible to LAN966x will be used. Signed-off-by: Robert Marko Signed-off-by: Philipp Zabel commit fc80e57c51a2825ed7c995c1e7e95c9d7cb6fada Author: Robert Marko Date: Mon Sep 22 16:27:28 2025 +0200 dt-bindings: reset: microchip: Add LAN969x support LAN969x also uses the Microchip reset driver, it reuses the LAN966x support so use a fallback compatible. Signed-off-by: Robert Marko Acked-by: Conor Dooley Signed-off-by: Philipp Zabel commit e96190da17a2b2b2c3c92d06b31ce36c749fa97f Author: René Rebe Date: Tue Nov 18 14:59:42 2025 +0100 PNP: Fix ISAPNP to generate uevents to auto-load modules Currently ISAPNP devices do not generate an uevent for udev to auto-load the driver modules for Creative SoundBlaster or Gravis UltraSound to just work. Signed-off-by: René Rebe [ rjw: Subject edits ] Link: https://patch.msgid.link/20251118.145942.1445519082574147037.rene@exactco.de Signed-off-by: Rafael J. Wysocki commit 53a18958349a627ae5d6b1ea708289b6cf3d8b9d Author: Taniya Das Date: Tue Nov 18 12:47:06 2025 +0530 clk: qcom: ecpricc-qdu100: Add mem_enable_mask to the clock memory branch The ECPRI clock controller’s mem_ops clocks used the mem_enable_ack_mask directly for both setting and polling. Add the newly introduced 'mem_enable_mask' to the memory control branch clocks of ECPRI clock controller to align to the new mem_ops handling. Signed-off-by: Taniya Das Reviewed-by: Imran Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251118-sm8750-videocc-v2-v4-2-049882a70c9f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 165d0b6dd248b939fb0d31a00687e6ef672b3b3c Author: Taniya Das Date: Tue Nov 18 12:47:05 2025 +0530 clk: qcom: clk_mem_branch: add enable mask and invert flags Introduce mem_enable_mask and mem_enable_invert in clk_mem_branch to describe memory gating implementations that use a separate mask and/or inverted enable logic. This documents hardware behavior in data instead of code and will be used by upcoming platform descriptions. Signed-off-by: Taniya Das Reviewed-by: Imran Shaik Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251118-sm8750-videocc-v2-v4-1-049882a70c9f@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0a0ea5541d30c0fbb3dac975bd1983f299cd6948 Author: Alexey Minnekhanov Date: Sun Nov 16 04:12:34 2025 +0300 clk: qcom: mmcc-sdm660: Add missing MDSS reset Add offset for display subsystem reset in multimedia clock controller block, which is necessary to reset display when there is some configuration in display controller left by previous stock (Android) bootloader to provide continuous splash functionaluty. Before 6.17 power domains were turned off for long enough to clear registers, now this is not the case and a proper reset is needed to have functioning display. Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Cc: stable@vger.kernel.org # 6.17 Signed-off-by: Alexey Minnekhanov Reviewed-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251116-sdm660-mdss-reset-v2-2-6219bec0a97f@postmarketos.org Signed-off-by: Bjorn Andersson commit c57210bc15371caa06a5d4040e7d8aaeed4cb661 Author: Alexey Minnekhanov Date: Sun Nov 16 04:12:33 2025 +0300 dt-bindings: clock: mmcc-sdm660: Add missing MDSS reset Add definition for display subsystem reset control, so display driver can reset display controller properly, clearing any configuration left there by bootloader. Since 6.17 after PM domains rework it became necessary for display to function. Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Cc: stable@vger.kernel.org # 6.17 Signed-off-by: Alexey Minnekhanov Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251116-sdm660-mdss-reset-v2-1-6219bec0a97f@postmarketos.org Signed-off-by: Bjorn Andersson commit 34a28245b6a5c4227b7122c0ff9b98d22b39f033 Merge: f690e07859e675 992a9df41ad717 Author: Jonathan Corbet Date: Tue Nov 18 09:26:11 2025 -0700 Merge branch 'python-modules' into docs-mw scripts/lib was always a bit of an awkward place for Python libraries; give them a proper home under tools/lib/python. Put the modules from tools/docs/lib there for good measure. The second patch ties them into a single package namespace. It would be more aesthetically pleasing to add a kernel layer, so we could say: from kernel.kdoc import kdoc_parser ...and have the kernel-specific stuff clearly marked, but that means adding an empty directory in the hierarchy, which isn't as pleasing. There are some other "Python library" directories hidden in the kernel tree; we may eventually want to encourage them to move as well. commit 992a9df41ad7173588bf90e15b33d45db2811aea Author: Jonathan Corbet Date: Mon Nov 10 15:04:30 2025 -0700 docs: bring some order to our Python module hierarchy Now that we have tools/lib/python for our Python modules, turn them into proper packages with a single namespace so that everything can just use tools/lib/python in sys.path. No functional change. Signed-off-by: Jonathan Corbet Message-ID: <20251110220430.726665-3-corbet@lwn.net> commit 778b8ebe5192e7a7f00563a7456517dfa63e1d90 Author: Jonathan Corbet Date: Mon Nov 10 15:04:29 2025 -0700 docs: Move the python libraries to tools/lib/python "scripts/lib" was always a bit of an awkward place for Python modules. We already have tools/lib; create a tools/lib/python, move the libraries there, and update the users accordingly. While at it, move the contents of tools/docs/lib. Rather than make another directory, just put these documentation-oriented modules under "kdoc". Signed-off-by: Jonathan Corbet Message-ID: <20251110220430.726665-2-corbet@lwn.net> commit f690e07859e67505e7106ef5b4fae5e8b71b2109 Author: Borislav Petkov (AMD) Date: Wed Nov 12 12:46:41 2025 +0100 Documentation/kernel-parameters: Move the kernel build options Move the kernel build options abbreviations to the .txt file so that they are together instead of one having to go hunt them in the .rst file. Tweak the formatting so that the inclusion of kernel-parameters.txt still keeps the whole thing somewhat presentable in the html output too. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251112114641.8230-1-bp@kernel.org> commit 6ae0f2072768fb3db7846cee08b611a96310930d Author: Ankit Khushwaha Date: Sat Nov 15 17:12:33 2025 +0530 docs: parse-headers.rst: Fix a typo Replace "vantage" with "advantage" in the description of userspace API cross-references. Signed-off-by: Ankit Khushwaha Signed-off-by: Jonathan Corbet Message-ID: <20251115114233.32239-1-ankitkhushwaha.linux@gmail.com> commit 46a47693e109f49483391bc66ad5f0ed53a1857a Author: Xie Yuanbin Date: Sun Nov 16 22:53:02 2025 +0800 Documentation/kernel-parameters: fix typo in retbleed= kernel parameter description Fixes a typo in the retbleed= parameter description, changing "migitation" to "mitigation". Fixes: 7fbf47c7ce50 ("x86/bugs: Add AMD retbleed= boot parameter") Signed-off-by: Xie Yuanbin Acked-by: Borislav Petkov (AMD) Signed-off-by: Jonathan Corbet Message-ID: <20251116145302.3681-1-qq570070308@gmail.com> commit 42408773ffcf0e9d595f2ec8a39dfb36f1fe0a14 Author: Timur Kristóf Date: Thu Nov 13 17:33:48 2025 +0100 drm/amd/display: Move analog check to dce110_hwseq Instead of checking that the signal is analog before calling the HWSS disable_audio_stream() function to disable audio, move the check inside the HWSS function. Suggested-by: Ray Wu Signed-off-by: Timur Kristóf Reviewed-by: Harry Wentland Link: https://lore.kernel.org/r/20251113163348.137315-5-timur.kristof@gmail.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit dc82e1bb489d6c4a5bbe9dcc8b6390955b8849cd Author: Timur Kristóf Date: Thu Nov 13 17:33:47 2025 +0100 drm/amd/display: Cleanup early return in construct_phy Match pre-existing patterns in the DC code base. Instead of returning early from the construct_phy() function, add a label at the end and use goto to jump there. Additionally, respect the DC logger and let it log the function even when it returns early. Suggested-by: Ray Wu Signed-off-by: Timur Kristóf Reviewed-by: Harry Wentland Link: https://lore.kernel.org/r/20251113163348.137315-4-timur.kristof@gmail.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit d46e422f65aefcd027cd22e1c020a288fe99a600 Author: Timur Kristóf Date: Thu Nov 13 17:33:46 2025 +0100 drm/amd/display: Cleanup uses of the analog flag In the detect_link_and_local_sink() function, do not modify the EDID capabilities of the display based on the connector. Instead, respect the analog flag better and when the analog flag is set, check that the connector indeed supports analog displays. Suggested-by: Ray Wu Signed-off-by: Timur Kristóf Reviewed-by: Harry Wentland Link: https://lore.kernel.org/r/20251113163348.137315-3-timur.kristof@gmail.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit b9f55e04ef0cccbac9d4759891c6d05d351f0048 Author: Timur Kristóf Date: Thu Nov 13 17:33:45 2025 +0100 drm/amd/display: Fix warning for analog stream encoders Fixes the following warning that some users are reporting with some kernel configurations: "positional initialization of field in 'struct' declared with 'designated_init' attribute" Signed-off-by: Timur Kristóf Reviewed-by: Harry Wentland Acked-by: Kees Cook Link: https://lore.kernel.org/r/20251113163348.137315-2-timur.kristof@gmail.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db Author: Robert McClinton Date: Sun Nov 16 12:33:21 2025 -0500 drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. This can cause a self deadlock when signaled() tries to make forward progress on the wait queue. But advancing the queue is unneeded because incorrectly returning false from signaled() is perfectly acceptable. Link: https://github.com/brave/brave-browser/issues/49182 Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4641 Cc: Alex Deucher Signed-off-by: Robert McClinton Signed-off-by: Alex Deucher commit 7203fa78db33b1a95b64d28828372311da715f1d Author: Randy Dunlap Date: Fri Nov 7 17:35:04 2025 -0800 drm/amd/display: dc_hw_sequencer.c: remove kernel-doc comments Change comments from kernel-doc style "/**" to normal C comments "/*" since the comments are not in kernel-doc format. This fixes around 39 kernel-doc warnings like this one: drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c:1322: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511062036.Ry8Z2APc-lkp@intel.com/ Signed-off-by: Randy Dunlap Signed-off-by: Alex Deucher commit c58b5d82695cd781c6781d287076109fe91f713a Author: Lijo Lazar Date: Thu Nov 13 17:07:42 2025 +0530 drm/amdgpu: Unregister mce notifier Unregister mce notifier on unload. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b8ecd07f3df1448addc478de2cde9a599abb058c Author: Taimur Hassan Date: Fri Nov 7 20:15:20 2025 -0500 drm/amd/display: Promote DC to 3.2.359 This version brings along the following updates: - Add interface to capture expected HW state from SW state - Add panel Replay capability detection, DPCD reading, and enablement logic - Re-check seamless boot enablement on subsequent dc_commit_streams - Improve DPCD link capability retrieval with increased retries and per-retry delays - Add HPD filter for HDMI - Add pipe topology history tracking to DC - Fix MST initialization on resume when switching from SST to MST during suspend - Fix double cursor on DCN20 & DCN30 in non-native scaling - Check DCCG_AUDIO_DTO2 register mask before access - Fix pbn to kbps conversion Reviewed-by: Leo Li Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a8d5d9070831d63fb330d524ea851047d08e2ba1 Author: Taimur Hassan Date: Fri Nov 7 16:14:42 2025 -0500 drm/amd/display: Ignore Coverity false positive [Why&How] Ignore Coverity false positive analysis in the dmub_cmd.h Reviewed-by: Leo Li Signed-off-by: Taimur Hassan Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit e0dec00f3d05e8c0eceaaebfdca217f8d10d380c Author: Fangzhi Zuo Date: Fri Nov 7 15:01:30 2025 -0500 drm/amd/display: Fix pbn to kbps Conversion [Why] Existing routine has two conversion sequence, pbn_to_kbps and kbps_to_pbn with margin. Non of those has without-margin calculation. kbps_to_pbn with margin conversion includes fec overhead which has already been included in pbn_div calculation with 0.994 factor considered. It is a double counted fec overhead factor that causes potential bw loss. [How] Add without-margin calculation. Fix fec overhead double counted issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3735 Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit a6ec17263235b33051804851b2750ac8fb24186c Author: Charlene Liu Date: Mon Oct 27 21:40:21 2025 -0400 drm/amd/display: Check DCCG_AUDIO_DTO2 register mask exist [Why&How] Check DCCG_AUDIO_DTO2 register mask exist before access. Also, add a existing DIO_CLOCK_control register for later use. Reviewed-by: Roman Li Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8ffa289f90be1a9b5bf693aa61004a9411ffe93a Author: Charlene Liu Date: Thu Nov 6 18:10:30 2025 -0500 drm/amd/display: Add null pointer check in link_dpms [why] Check that the stream exists to add link->local_sink null pointer access protection. Reviewed-by: Harold Sun Reviewed-by: Ethan Cheung Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 79b3c037f972dcb13e325a8eabfb8da835764e15 Author: Ivan Lipski Date: Wed Nov 5 15:27:42 2025 -0500 drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 [Why] On DCN20 & DCN30, the 6th DPP's & HUBP's are powered on permanently and cannot be power gated. Thus, when dpp_reset() is invoked for the DPP5, while it's still powered on, the cached cursor_state (dpp_base->pos.cur0_ctl.bits.cur0_enable) and the actual state (CUR0_ENABLE) bit are unsycned. This can cause a double cursor in full screen with non-native scaling. [How] Force disable cursor on DPP5 on plane powerdown for ASICs w/ 6 DPPs/HUBPs. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4673 Reviewed-by: Aric Cyr Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 1a7322e985807e21d7b3e00b4138f0c69af863a8 Author: Nicholas Carbones Date: Fri Oct 31 16:36:09 2025 -0400 drm/amd/display: Add pipe topology history to dc [Why] There is no way to check pipe topology update history through a dump. [How] Add a topology history structure to dc with snapshots of the most recent pipe topology updates. Reviewed-by: George Shen Signed-off-by: Nicholas Carbones Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c918e75e1ed95be76f8e3156a411188f650fe03f Author: Ivan Lipski Date: Thu Oct 30 11:25:33 2025 -0400 drm/amd/display: Add an HPD filter for HDMI [Why] Some monitors perform rapid “autoscan” HPD re‑assertions right after a disconnect or powersaving mode enablement. These appear as a quick disconnect→reconnect with an identical EDID. Since Linux has no HDMI hotplug detection (HPD) filter, these quick reconnects are seen as hotplug events, which can unintentionally wake a system with DPMS off. An example: https://gitlab.freedesktop.org/drm/amd/-/issues/2876 Such 'fake reconnects' are considered when the interval between a disconnect and a connect is within 1500ms (experimentally chosen using several monitors), and the two connections have the same EDID. [How] Implement a time-based debounce mechanism: 1. On HDMI disconnect detection, instead of immediately processing the HPD event, save the current sink and schedule delayed work (default 1500ms) 2. If another HDMI disconnect HPD event arrives during the debounce period, it reschedules the pending work, ensuring only the final state is processed. 3. When the debounce timer expires, re-detect the display and compare the new sink with the cached one using EDID comparison. 4. If sinks match (same EDID), this was a spontaneous HPD toggle: - Update connector state internally - Skip hotplug event to prevent desktop rearrangement If sinks differ, this was a real display change: - Process normally with the hotplug event The debounce delay is configurable via module parameter 'hdmi_hpd_debounce_delay_ms'. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2876 Reviewed-by: Sun peng (Leo) Li Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit ad1c59ad7cf74ec06e32fe2c330ac1e957222288 Author: Mario Limonciello (AMD) Date: Mon Nov 3 12:11:31 2025 -0600 drm/amd/display: Increase DPCD read retries [Why] Empirical measurement of some monitors that fail to read EDID while booting shows that the number of retries with a 30ms delay between tries is as high as 16. [How] Increase number of retries to 20. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit cdf5ecc3f6e1b3cc5475b879c64e16ecf6de569b Author: Thorsten Blum Date: Tue Nov 18 14:56:22 2025 +0100 EDAC/ghes: Replace deprecated strcpy() in ghes_edac_report_mem_error() strcpy() has been deprecated¹ because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Use the safer strscpy() instead. ¹ https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Thorsten Blum Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Qiuxu Zhuo Link: https://patch.msgid.link/20251118135621.101148-2-thorsten.blum@linux.dev commit 669dca37b3348a447db04bbdcbb3def94d5997cc Author: Mario Limonciello (AMD) Date: Mon Nov 3 11:17:44 2025 -0600 drm/amd/display: Move sleep into each retry for retrieve_link_cap() [Why] When a monitor is booting it's possible that it isn't ready to retrieve link caps and this can lead to an EDID read failure: ``` [drm:retrieve_link_cap [amdgpu]] *ERROR* retrieve_link_cap: Read receiver caps dpcd data failed. amdgpu 0000:c5:00.0: [drm] *ERROR* No EDID read. ``` [How] Rather than msleep once and try a few times, msleep each time. Should be no changes for existing working monitors, but should correct reading caps on a monitor that is slow to boot. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4672 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d24203bb629fb2626442793495d614ffeb2d7b3b Author: Paul Hsieh Date: Thu Oct 30 12:17:53 2025 +0800 drm/amd/display: Re-check seamless boot can be enabled or not [Why] If the seamless boot feature has already been enabled, and dc_commit_streams is called again before receiving a flip, the driver will adjust the engine clock without turning off the screen, which will cause garbage to occur. However, in reality, the Pixel Clock from the first dc_commit_streams and the second dc_commit_streams are different. [How] If the apply seamless boot flag in the previous stream has not been cleared, and dc_commit_streams is received again, we need to recheck whether seamless boot should be disabled Reviewed-by: Nicholas Kazlauskas Signed-off-by: Paul Hsieh Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit c798836bb7b60afda892173dddda466752f321c7 Author: Jack Chang Date: Wed Aug 20 16:59:08 2025 +0800 drm/amd/display: Get panel replay capability from DPCD [Why&How] Read Panel replay caps from DPCD when retrieving link capability Reviewed-by: Robin Chen Signed-off-by: Jack Chang Signed-off-by: Leon Huang Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 2e6c79e4732437f4a8e8ed37ebcb2bf843734cb2 Author: Jack Chang Date: Thu Aug 21 13:19:23 2025 +0800 drm/amd/display: Add panel replay enablement option and logic [Why&How] 1.Add flow to enable and configure panel replay enablement and configuration 2.Add registry key for enable option 3.Add replay version check to be compatible with freesync replay 4.Add AC/DC switch function to notify ac/dc change. 5.Add flow in set event function to check and decide Replay enable/disable Reviewed-by: Robin Chen Signed-off-by: Jack Chang Signed-off-by: Leon Huang Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit ddc6b22d93039c59c27386fa588f25a1302c3c99 Author: Jack Chang Date: Fri Aug 8 11:20:56 2025 +0800 drm/amd/display: Add panel replay capability detection [Why&How] For supporting VESA PR, add flow to determine the support capability Reviewed-by: Robin Chen Signed-off-by: Jack Chang Signed-off-by: Leon Huang Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b0ff344fe70cd2c97ec45396c361bfe9a8b77b1e Author: George Shen Date: Wed Oct 29 11:27:32 2025 -0400 drm/amd/display: Add interface to capture expected HW state from SW state [Why] To debug certain issues, such as underflow, it is common practice to dump the HW state of all registers for analysis. The first thing to check with the dump is to ensure all values are programmed as expected according to SW state. [How] Add interface to DC to capture expected HW register values based on SW state. Reviewed-by: Dillon Varone Signed-off-by: George Shen Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0d9f5ee4583e770449c081460c2a3ff22532a1c2 Author: Akhil P Oommen Date: Tue Nov 18 14:20:35 2025 +0530 drm/msm/adreno: Add MMU fault handler to adreno_gpu_func Move MMU fault handler for each generation to adreno function list. This will help to use common code for mmu pagefault handler registration between a6x/a7x and a8x layer. Reviewed-by: Dmitry Baryshkov Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689007/ Message-ID: <20251118-kaana-gpu-support-v4-8-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit d46b25b8c1e8dd82edd78032e51c913a08ed62c4 Author: Akhil P Oommen Date: Tue Nov 18 14:20:34 2025 +0530 drm/msm/adreno: Move gbif_halt() to adreno_gpu_func Move the gbif halt fn to adreno_gpu_func so that we can call different implementation from common code. This will come handy when we implement A8x layer. Reviewed-by: Dmitry Baryshkov Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689005/ Message-ID: <20251118-kaana-gpu-support-v4-7-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 491fadb2b818e1d900229a1f8243de6458381306 Author: Akhil P Oommen Date: Tue Nov 18 14:20:33 2025 +0530 drm/msm/adreno: Move adreno_gpu_func to catalogue In A6x family (which is a pretty big one), there are separate adreno_func definitions for each sub-generations. To streamline the identification of the correct struct for a gpu, move it to the catalogue and move the gpu_init routine to struct adreno_gpu_funcs. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689003/ Message-ID: <20251118-kaana-gpu-support-v4-6-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit f5232d63ffa10a76d8b71929b75d7085ff99033b Author: Akhil P Oommen Date: Tue Nov 18 14:20:32 2025 +0530 drm/msm/adreno: Common-ize PIPE definitions Newer gen's introduce pipe enums which do not exist on older gens, but the numeric values do not conflict. IOW, they are backward compatible. So move its definition to adreno_common.xml. Reviewed-by: Dmitry Baryshkov Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/689001/ Message-ID: <20251118-kaana-gpu-support-v4-5-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit f2a742eb82524fb408089244f20c9c7972b15f5f Author: Akhil P Oommen Date: Tue Nov 18 14:20:31 2025 +0530 drm/msm/a6xx: Skip dumping SCRATCH registers Crashdec doesn't require SCRATCH registers anymore for a6xx and newer architectures. So skip dumping them during recovery. Suggested-by: Rob Clark Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/689000/ Message-ID: <20251118-kaana-gpu-support-v4-4-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit ff7a6de043fce21ea5891311746b16121b385c59 Author: Akhil P Oommen Date: Tue Nov 18 14:20:30 2025 +0530 drm/msm/a6xx: Fix the gemnoc workaround Correct the register offset and enable this workaround for all A7x and newer GPUs to match the recommendation. Also, downstream does this w/a after moving the fence to allow mode. So do the same. Fixes: dbfbb376b50c ("drm/msm/a6xx: Add A621 support") Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/688997/ Message-ID: <20251118-kaana-gpu-support-v4-3-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 180349b8407f3b268b2ceac0e590b8199e043081 Author: Akhil P Oommen Date: Tue Nov 18 14:20:29 2025 +0530 drm/msm/a6xx: Flush LRZ cache before PT switch As per the recommendation, A7x and newer GPUs should flush the LRZ cache before switching the pagetable. Update a6xx_set_pagetable() to do this. While we are at it, sync both BV and BR before issuing a CP_RESET_CONTEXT_STATE command, to match the downstream sequence. Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support") Reviewed-by: Konrad Dybcio Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/688995/ Message-ID: <20251118-kaana-gpu-support-v4-2-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 Author: Akhil P Oommen Date: Tue Nov 18 14:20:28 2025 +0530 drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers REG_A6XX_GMU_AO_AHB_FENCE_CTRL register falls under GMU's register range. So, use gmu_write() routines to write to this register. Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state") Cc: stable@vger.kernel.org Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/688993/ Message-ID: <20251118-kaana-gpu-support-v4-1-86eeb8e93fb6@oss.qualcomm.com> Signed-off-by: Rob Clark commit 036b3531a71eae6d5f1b4720696f6a6114d4f31f Author: Rob Clark Date: Tue Nov 18 07:29:49 2025 -0800 drm/msm/registers: Fix encoding fields in 64b registers Based on mesa commit 3f70b0578402 ("freedreno/registers: Fix encoding fields in 64b registers"), but with some fixes to not skip emitting interrupt enum values. v2: Don't append "ull" to 32b reg MASK defines, to avoid printf format conversion warnings all over the place Co-developed-by: Connor Abbott Signed-off-by: Connor Abbott Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/689141/ Message-ID: <20251118152952.226510-1-robin.clark@oss.qualcomm.com> commit 28fec8b95e67704df7b841dc4cbbba0957078213 Author: Darrick J. Wong Date: Fri Sep 5 09:30:48 2025 -0700 fuse: signal that a fuse inode should exhibit local fs behaviors Create a new fuse inode flag that indicates that the kernel should implement various local filesystem behaviors instead of passing vfs commands straight through to the fuse server and expecting the server to do all the work. For example, this means that we'll use the kernel to transform some ACL updates into mode changes, and later to do enforcement of the immutable and append iflags. Signed-off-by: "Darrick J. Wong" Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit dcbce328d3a2d87770133834210cf328c083d480 Author: Claudiu Beznea Date: Mon Nov 17 12:12:42 2025 +0200 mmc: renesas_sdhi: Add suspend/resume hooks Add suspend/resume hooks which assert/deassert the reset signals, along with forcing runtime suspend/resume. This allows using the driver in scenarios where the resume is done with the help of bootloader and the bootloader disables the SDHI clocks, resets, IRQs before passing execution to Linux. Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Signed-off-by: Ulf Hansson commit 50371ef025a433f782c04dfdd3b59251831a8be3 Author: Claudiu Beznea Date: Mon Nov 17 12:12:41 2025 +0200 mmc: renesas_sdhi: Switch to SYSTEM_SLEEP_PM_OPS()/RUNTIME_PM_OPS() and pm_ptr() SET_SYSTEM_SLEEP_PM_OPS() and SET_RUNTIME_PM_OPS() require __maybe_unused or #ifdefs protection against unused function warnings. The usage of pm_ptr() and SYSTEM_SLEEP_PM_OPS()/RUNTIME_PM_OPS() allows the compiler to see the functions, thus suppressing the warning. Drop the #ifdefs. Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Signed-off-by: Ulf Hansson commit 15213383a3d9195db582729ab3feb923605b6f63 Author: Claudiu Beznea Date: Mon Nov 17 12:12:40 2025 +0200 mmc: renesas_sdhi: Deassert the reset signal on probe Deassert the reset signal of the SDHI controller during probe to avoid relying on the previous bootloaders. Without deasserting the reset signal, the SDHI controller will not function. Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Signed-off-by: Ulf Hansson commit 7b6e6c4a117e0abb38f3afb9ddfd6d169e6fb2e4 Author: Krzysztof Kozlowski Date: Sat Nov 15 13:21:23 2025 +0100 dt-bindings: mmc: am654: Simplify dma-coherent property Common boolean properties need to be only allowed in the binding (":true"), because their type is already defined by core DT schema. Simplify dma-coherent property to match common syntax. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Ulf Hansson commit 1bed7f954865ceab45c8949017517c02e3f5cae3 Author: Martin Blumenstingl Date: Sun Nov 9 00:12:53 2025 +0100 mmc: meson-mx-sdio: Ignore disabled "mmc-slot" child-nodes The meson-mx-sdio (and mmc core) only support one MMC/SD/SDIO slot (device) per host. Thus having multiple mmc-slot nodes (one for the up to three supported slots with one device each on the meson-mx-sdio hardware) can be problematic. Allow specifying all slots (with their respective device) connected to the meson-mx-sdio hardware in device-tree, while making sure that only the enabled one(s) are actually considered by the driver. Signed-off-by: Martin Blumenstingl Signed-off-by: Ulf Hansson commit 38fffa9510827e1861ad0a5f0392148bc2aec5e6 Author: Martin Blumenstingl Date: Sun Nov 9 00:12:52 2025 +0100 mmc: meson-mx-sdio: Fix indentation in meson_mx_mmc_irq_thread() Keep the second line with arguments for dma_unmap_sg() aligned. Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Ulf Hansson commit 3241cde4702b67482ea0654099196f9b81ecbb65 Author: Martin Blumenstingl Date: Sun Nov 9 00:12:51 2025 +0100 mmc: meson-mx-sdio: Use dev_err_probe() where appropriate This streamlines probe error handling / logging with other drivers. Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Ulf Hansson commit baa74c2144278bab503ab14d1d115de62eacfaf0 Author: Binbin Zhou Date: Sun Nov 9 00:12:50 2025 +0100 mmc: meson-mx-sdio: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Signed-off-by: Binbin Zhou Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Ulf Hansson commit b63f8fc1d0891c5fa35963ba465a24eb71367c00 Author: Martin Blumenstingl Date: Sun Nov 9 00:12:49 2025 +0100 mmc: meson-mx-sdio: Refactor internal clock initialization Use modern common clock framework helpers for simplifying the clock controller management: - switch to struct clk_hw for internal clocks and only get the "cfg_div_clk" (which has to be managed at runtime) as struct clk using devm_clk_hw_get_clk() which is then the only clock used by struct meson_mx_mmc_host. - use CLK_HW_INIT_FW_NAME and CLK_HW_INIT_HW helper macros for simpler init data initialization - keep the clock controller memory allocation separate to prevent a potential use-after-free because struct meson_mx_mmc_host_clkc is free'd before controller_dev Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Ulf Hansson commit c0184b2f793b40bf1f6be17bab84c9abf3d368f9 Author: Martin Blumenstingl Date: Sun Nov 9 00:12:48 2025 +0100 mmc: meson-mx-sdio: Use devm_clk_get_enabled() This simplifies the code. No functional changes intended. Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Ulf Hansson commit 59472e8c2943b01a44ff1c4d9247c0025fe1acff Author: Martin Blumenstingl Date: Sun Nov 9 00:12:47 2025 +0100 mmc: meson-mx-sdio: Switch to regmap for register access Switch the driver over to use regmap to access the registers. This makes it consistent with the other Amlogic MMC drivers. No functional changes intended. Signed-off-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Ulf Hansson commit 9d3faec60b1303fbec53d7a9b48a8c0fc5ae029b Author: Chengkaitao Date: Tue Nov 18 09:27:54 2025 +0800 genirq: Use raw_spinlock_irq() in irq_set_affinity_notifier() Since irq_set_affinity_notifier() may sleep, interrupts are enabled. So raw_spinlock_irqsave() can be replaced with raw_spinlock_irq(). Signed-off-by: Chengkaitao Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251118012754.61805-1-pilgrimtao@gmail.com commit 80adaccf0e1c8c8fff44be2d959f6dba80af0491 Author: Dan Carpenter Date: Tue Nov 18 13:52:13 2025 +0300 rseq: Delete duplicate if statement in rseq_virt_userspace_exit() This if statement is indented weirdly. It's a duplicate and doesn't affect runtime (beyond wasting a little time). Delete it. Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/aRxP3YcwscrP1BU_@stanley.mountain commit a057e8e4ac5b1ddd12be590e2e039fa08d0c8aa4 Merge: 19f1d6c7230b7d 1b42e07af1ee65 Author: Paolo Abeni Date: Tue Nov 18 15:52:44 2025 +0100 Merge branch 'gve-implement-xdp-hw-rx-timestamping-support-for-dq' Tim Hostetler says: ==================== gve: Implement XDP HW RX Timestamping support for DQ From: Tim Hostetler This patch series adds support for bpf_xdp_metadata_rx_timestamp from an XDP program loaded into the driver on its own or bound to an XSK. This is only supported for DQ. ==================== Link: https://patch.msgid.link/20251114211146.292068-1-joshwash@google.com Signed-off-by: Paolo Abeni commit 1b42e07af1ee65d10ee72f90d6fbd02a9b53208c Author: Tim Hostetler Date: Fri Nov 14 13:11:46 2025 -0800 gve: Add Rx HWTS metadata to AF_XDP ZC mode By overlaying the struct gve_xdp_buff on top of the struct xdp_buff_xsk that AF_XDP utilizes, the driver records the 32 bit timestamp via the completion descriptor and the cached 64 bit NIC timestamp via gve_priv. The driver's implementation of xmo_rx_timestamp extends the timestamp to the full and up to date 64 bit timestamp and returns it to the user. gve_rx_xsk_dqo is modified to accept a pointer to the completion descriptor and no longer takes a buf_len explicitly as it can be pulled out of the descriptor. With this patch gve now supports bpf_xdp_metadata_rx_timestamp. Signed-off-by: Tim Hostetler Reviewed-by: Willem de Bruijn Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251114211146.292068-5-joshwash@google.com Signed-off-by: Paolo Abeni commit 66adaf1021282edcb9be50bea5ea5aa78afda527 Author: Tim Hostetler Date: Fri Nov 14 13:11:45 2025 -0800 gve: Prepare bpf_xdp_metadata_rx_timestamp support Support populating XDP RX metadata with hardware RX timestamps. This patch utilizes the same underlying logic to calculate hardware timestamps as the regular RX path. xdp_metadata_ops is registered with the net_device in a future patch. gve_rx_calculate_hwtstamp was pulled out so as to not duplicate logic between gve_xdp_rx_timestamp and gve_rx_hwtstamp. Signed-off-by: Tim Hostetler Reviewed-by: Willem de Bruijn Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251114211146.292068-4-joshwash@google.com Signed-off-by: Paolo Abeni commit f356a66b87bb19e5370dee469ec32e0094ac9da3 Author: Tim Hostetler Date: Fri Nov 14 13:11:44 2025 -0800 gve: Wrap struct xdp_buff RX timestamping will need to keep track of extra temporary information per-packet. In preparation for this, introduce gve_xdp_buff to wrap the xdp_buff. This is similar in function to stmmac_xdp_buff and ice_xdp_buff. Signed-off-by: Tim Hostetler Reviewed-by: Willem de Bruijn Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251114211146.292068-3-joshwash@google.com Signed-off-by: Paolo Abeni commit 46e7860ef941fa92fcc61c79caac315839f86df5 Author: Tim Hostetler Date: Fri Nov 14 13:11:43 2025 -0800 gve: Move ptp_schedule_worker to gve_init_clock Previously, gve had been only initializing ptp aux work when hardware timestamping was initialized through ndo_hwtsatmp_set. As this patch series introduces XDP hardware timestamp metadata which will require the ptp aux work, the work can't be gated on the kernel_hwtstamp_config being set and must be initialized elsewhere. For simplicity, ptp_schedule_worker is invoked right after the ptp_clock is registered with the kernel (which happens during gve_probe or following reset). The worker is scheduled in GVE_NIC_TS_SYNC_INTERVAL_MS as the synchronous call to gve_clock_nic_ts_read makes the worker redundant if scheduled immediately. If gve cannot read the device clock immediately, it errors out of gve_init_clock. Signed-off-by: Tim Hostetler Reviewed-by: Willem de Bruijn Reviewed-by: Harshitha Ramamurthy Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251114211146.292068-2-joshwash@google.com Signed-off-by: Paolo Abeni commit b20a374902bbb647b87e874bb2c9d708abc0109f Author: Rafael J. Wysocki Date: Fri Nov 14 19:48:34 2025 +0100 cpufreq: intel_pstate: Eliminate some code duplication To eliminate some code duplication from the intel_pstate driver, move the core_get_val() function body to a new function called get_perf_ctl_val() and make both core_get_val() and atom_get_val() invoke it to carry out the same computation. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Acked-by: Srinivas Pandruvada Link: https://patch.msgid.link/2829273.mvXUDI8C0e@rafael.j.wysocki commit 58075aec92a8141fd7f42e1c36d1bc54552c015e Author: Kaushlendra Kumar Date: Tue Oct 28 15:48:14 2025 +0530 powercap: intel_rapl: Add support for Nova Lake processors Add RAPL support for Intel Nova Lake and Nova Lake L processors using the core defaults configuration. Signed-off-by: Kaushlendra Kumar [ rjw: Subject and changelog edits, rebase ] Link: https://patch.msgid.link/20251028101814.3482508-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 4322c8f81c58da493a3c46eda32f0e7534a350a0 Author: Christophe Leroy Date: Mon Nov 17 17:43:44 2025 +0100 lib/strn*,uaccess: Use masked_user_{read/write}_access_begin when required Properly use masked_user_read_access_begin() and masked_user_write_access_begin() instead of masked_user_access_begin() in order to match user_read_access_end() and user_write_access_end(). This is important for architectures like PowerPC that enable separately user reads and user writes. That means masked_user_read_access_begin() is used when user memory is exclusively read during the window and masked_user_write_access_begin() is used when user memory is exclusively writen during the window. masked_user_access_begin() remains and is used when both reads and writes are performed during the open window. Each of them is expected to be terminated by the matching user_read_access_end(), user_write_access_end() and user_access_end(). Signed-off-by: Christophe Leroy Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/cb5e4b0fa49ea9c740570949d5e3544423389757.1763396724.git.christophe.leroy@csgroup.eu commit 1c204914bc4401623a1b242305c583060a0b7e4f Author: Christophe Leroy Date: Mon Nov 17 17:43:43 2025 +0100 scm: Convert put_cmsg() to scoped user access Replace the open coded implementation with the scoped user access guard. That also corrects the imbalance between masked_user_access_begin() and user_write_access_end(), which would affect PowerPC when it gains masked user access support. No functional change intended. [ tglx: Amend change log ] Signed-off-by: Christophe Leroy Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/793219313f641eda09a892d06768d2837246bf9f.1763396724.git.christophe.leroy@csgroup.eu commit 803abedbd540617f136a2c4d7066ff2e304f016d Author: Christophe Leroy Date: Mon Nov 17 17:43:42 2025 +0100 iov_iter: Add missing speculation barrier to copy_from_user_iter() The results of "access_ok()" can be mis-speculated. The result is that the CPU can end speculatively: if (access_ok(from, size)) // Right here For the same reason as done in copy_from_user() in commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()"), add a speculation barrier to copy_from_user_iter(). Signed-off-by: Christophe Leroy Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/6b73e69cc7168c89df4eab0a216e3ed4cca36b0a.1763396724.git.christophe.leroy@csgroup.eu commit 4db1df7a7217827ee7f8a3414932e250f1ac2204 Author: Christophe Leroy Date: Mon Nov 17 17:43:41 2025 +0100 iov_iter: Convert copy_from_user_iter() to masked user access copy_from_user_iter() lacks a speculation barrier, which will degrade performance on some architecture like x86, which would be unfortunate as copy_from_user_iter() is a critical hotpath function. Convert copy_from_user_iter() to using masked user access on architecture that support it. This allows to add the speculation barrier without impacting performance. This is similar to what was done for copy_from_user() in commit 0fc810ae3ae1 ("x86/uaccess: Avoid barrier_nospec() in 64-bit copy_from_user()") [ tglx: Massage change log ] Signed-off-by: Christophe Leroy Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/58e4b07d469ca68a2b9477fe2c1ccc8a44cef131.1763396724.git.christophe.leroy@csgroup.eu commit 19f1d6c7230b7da3775a2db915dc8eb9d3151658 Author: Horatiu Vultur Date: Fri Nov 14 09:42:24 2025 +0100 net: phy: micrel: lan8814: Enable in-band auto-negotiation The lan8814 supports two interfaces towards the host (QSGMII and QUSGMII). Currently the lan8814 disables the auto-negotiation towards the host side. So, extend this to allow to configure to use in-band auto-negotiation. I have tested this only with the QSGMII interface. Signed-off-by: Horatiu Vultur Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251114084224.3268928-1-horatiu.vultur@microchip.com Signed-off-by: Paolo Abeni commit 8daf70e6aa4118fa71a9eb5f361f1a29567e12ed Merge: 885b92bad87aed 3bcfd55bedfc62 Author: Andy Shevchenko Date: Tue Nov 18 15:14:06 2025 +0100 Merge patch series "pinctrl: intel: Export intel_gpio_add_pin_ranges() and use it" Andy Shevchenko says: Deduplicate more code with help of being exported intel_gpio_add_pin_ranges(). Link: https://patch.msgid.link/20251118123444.1217863-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko commit 3bcfd55bedfc62e73cc36395e77a67827116cfcd Author: Andy Shevchenko Date: Tue Nov 18 13:34:02 2025 +0100 pinctrl: cherryview: Convert to use intel_gpio_add_pin_ranges() Driver is ready to use intel_gpio_add_pin_ranges() directly instead of custom approach. Convert it now. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 2f61c00972193d014185655e533a809d824cef47 Author: Andy Shevchenko Date: Tue Nov 18 13:34:01 2025 +0100 pinctrl: intel: Export intel_gpio_add_pin_ranges() Export intel_gpio_add_pin_ranges() for reuse in other drivers. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit f43fdeb9a368a5ff56b088b46edc245bd4b52cde Merge: 2c6d792d4b7676 837ed303964673 Author: Jens Axboe Date: Tue Nov 18 06:49:59 2025 -0700 Merge branch 'loop-aio-nowait' into for-6.19/block Merge async IO IOCB_NOWAIT support from Ming: "This patchset improves loop aio perf by using IOCB_NOWAIT for avoiding to queue aio command to workqueue context, meantime refactor lo_rw_aio() a bit. In my test VM, loop disk perf becomes very close to perf of the backing block device(nvme/mq virtio-scsi). And Mikulas verified that this way can improve 12jobs sequential readwrite io by ~5X, and basically solve the reported problem together with loop MQ change. https://lore.kernel.org/linux-block/a8e5c76a-231f-07d1-a394-847de930f638@redhat.com/ Zhaoyang Huang also mentioned it may fix their performance issue on Android use case. The loop MQ change will be posted as standalone patch, because it needs UAPI change." Link: https://lore.kernel.org/linux-block/20251015110735.1361261-1-ming.lei@redhat.com/ Signed-off-by: Jens Axboe * loop-aio-nowait: loop: add hint for handling aio via IOCB_NOWAIT loop: try to handle loop aio command via NOWAIT IO first loop: move command blkcg/memcg initialization into loop_queue_work loop: add lo_submit_rw_aio() loop: add helper lo_rw_aio_prep() loop: add helper lo_cmd_nr_bvec() commit 837ed303964673cf0c7e6a4624cd68d8cf254827 Author: Ming Lei Date: Wed Oct 15 19:07:31 2025 +0800 loop: add hint for handling aio via IOCB_NOWAIT Add hint for using IOCB_NOWAIT to handle loop aio command for avoiding to cause write(especially randwrite) perf regression on sparse backed file. Try IOCB_NOWAIT in the following situations: - backing file is block device OR - READ aio command OR - there isn't any queued blocking async WRITEs, because NOWAIT won't cause contention with blocking WRITE, which often implies exclusive lock With this simple policy, perf regression of randwrite/write on sparse backing file is fixed. Link: https://lore.kernel.org/dm-devel/7d6ae2c9-df8e-50d0-7ad6-b787cb3cfab4@redhat.com/ Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 0ba93a906dda7ede9e7669adefe005ee18f3ff42 Author: Ming Lei Date: Wed Oct 15 19:07:30 2025 +0800 loop: try to handle loop aio command via NOWAIT IO first Try to handle loop aio command via NOWAIT IO first, then we can avoid to queue the aio command into workqueue. This is usually one big win in case that FS block mapping is stable, Mikulas verified [1] that this way improves IO perf by close to 5X in 12jobs sequential read/write test, in which FS block mapping is just stable. Fallback to workqueue in case of -EAGAIN. This way may bring a little cost from the 1st retry, but when running the following write test over loop/sparse_file, the actual effect on randwrite is obvious: ``` truncate -s 4G 1.img #1.img is created on XFS/virtio-scsi losetup -f 1.img --direct-io=on fio --direct=1 --bs=4k --runtime=40 --time_based --numjobs=1 --ioengine=libaio \ --iodepth=16 --group_reporting=1 --filename=/dev/loop0 -name=job --rw=$RW ``` - RW=randwrite: obvious IOPS drop observed - RW=write: a little drop(%5 - 10%) This perf drop on randwrite over sparse file will be addressed in the following patch. BLK_MQ_F_BLOCKING has to be set for calling into .read_iter() or .write_iter() which might sleep even though it is NOWAIT, and the only effect is that rcu read lock is replaced with srcu read lock. Link: https://lore.kernel.org/linux-block/a8e5c76a-231f-07d1-a394-847de930f638@redhat.com/ [1] Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit f4788ae9d7bc01735cb6ada333b038c2e3fff260 Author: Ming Lei Date: Wed Oct 15 19:07:29 2025 +0800 loop: move command blkcg/memcg initialization into loop_queue_work Move loop command blkcg/memcg initialization into loop_queue_work, and prepare for supporting to handle loop io command by IOCB_NOWAIT. Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit c66e9708f92760147a1ea7f66c7b60ec801f85e3 Author: Ming Lei Date: Wed Oct 15 19:07:28 2025 +0800 loop: add lo_submit_rw_aio() Refactor lo_rw_aio() by extracting the I/O submission logic into a new helper function lo_submit_rw_aio(). This further improves code organization by separating the I/O preparation, submission, and completion handling into distinct phases. Prepare for using NOWAIT to improve loop performance. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit fd858d1ca9694c88703a8a936d5c7596c86ada74 Author: Ming Lei Date: Wed Oct 15 19:07:27 2025 +0800 loop: add helper lo_rw_aio_prep() Add helper lo_rw_aio_prep() to separate the preparation phase(setting up bio vectors and initializing the iocb structure) from the actual I/O execution in the loop block driver. Prepare for using NOWAIT to improve loop performance. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit c3e6c11147f6f05c15e9c2d74f5d234a6661013c Author: Ming Lei Date: Wed Oct 15 19:07:26 2025 +0800 loop: add helper lo_cmd_nr_bvec() Add lo_cmd_nr_bvec() and prepare for refactoring lo_rw_aio(). Reviewed-by: Christoph Hellwig Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit 2c6d792d4b7676e2b340df05425330452fee1f40 Author: Sukrut Heroorkar Date: Tue Nov 18 14:37:53 2025 +0530 drbd: turn bitmap I/O comments into regular block comments W=1 build warns because the bitmap I/O comments use '/**', which marks them as kernel-doc comments even though these functions do not document an external API. Convert these comments to regular block comments so kernel-doc no longer parses them. Signed-off-by: Sukrut Heroorkar Acked-by: Christoph Böhmwalder Signed-off-by: Jens Axboe commit 20ac36b71c53b8c36c6903b5ca87c75226700a97 Author: Jay Liu Date: Sun Sep 21 13:53:05 2025 +0800 drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue if matrixbit is 11, The range of color matrix is from 0 to (BIT(12) - 1). Values from 0 to (BIT(11) - 1) represent positive numbers, values from BIT(11) to (BIT(12) - 1) represent negative numbers. For example, -1 need converted to 8191. so convert S31.32 to HW Q2.11 format by drm_color_ctm_s31_32_to_qm_n, and set int_bits to 2. Fixes: 738ed4156fba ("drm/mediatek: Add matrix_bits private data for ccorr") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jay Liu Link: https://patchwork.kernel.org/project/dri-devel/patch/20250921055416.25588-2-jay.liu@mediatek.com/ Signed-off-by: Chun-Kuang Hu commit bcbb8d0afd94927215e8ae97c40cfefa807cfe0b Author: Konstantin Komarov Date: Thu Oct 30 23:51:09 2025 +0300 fs/ntfs3: change the default mount options for "acl" and "prealloc" Switch the "acl" and "prealloc" mount parameters to fsparam_flag_no(), making them enabled by default and allowing users to disable them with "noacl" and "noprealloc". Signed-off-by: Konstantin Komarov commit ccc4e86d1c24260c18ae94541198c3711c140da6 Author: Edward Adam Davis Date: Tue Nov 11 19:05:42 2025 +0800 fs/ntfs3: Prevent memory leaks in add sub record If a rb node with the same ino already exists in the rb tree, the newly alloced mft_inode in ni_add_subrecord() will not have its memory cleaned up, which leads to the memory leak issue reported by syzbot. The best option to avoid this issue is to put the newly alloced mft node when a rb node with the same ino already exists in the rb tree and return the rb node found in the rb tree to the parent layer. syzbot reported: BUG: memory leak unreferenced object 0xffff888110bef280 (size 128): backtrace (crc 126a088f): ni_add_subrecord+0x31/0x180 fs/ntfs3/frecord.c:317 ntfs_look_free_mft+0xf0/0x790 fs/ntfs3/fsntfs.c:715 BUG: memory leak unreferenced object 0xffff888109093400 (size 1024): backtrace (crc 7197c55e): mi_init+0x2b/0x50 fs/ntfs3/record.c:105 mi_format_new+0x40/0x220 fs/ntfs3/record.c:422 Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Reported-by: syzbot+3932ccb896e06f7414c9@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Konstantin Komarov commit 4d78d1173a653acdaf7500a32b8dc530ca4ad075 Author: Edward Adam Davis Date: Tue Nov 11 19:13:56 2025 +0800 fs/ntfs3: out1 also needs to put mi After ntfs_look_free_mft() executes successfully, all subsequent code that fails to execute must put mi. Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Signed-off-by: Edward Adam Davis Signed-off-by: Konstantin Komarov commit 5008c3ec3f891456e74f8dab882fcd5bc515d327 Author: Jakub Czapiga Date: Fri Sep 19 18:15:47 2025 +0000 mtd: spi-nor: core: Check read CR support Some SPI controllers like Intel's one on the PCI bus do not support opcode 35h. This opcode is used to read the Configuration Register on SPI-NOR chips that have 16-bit Status Register configured regardless of the controller support for it. Adding a check call in the setup step allows disabling use of the 35h opcode and falling back to the manual Status Registers management. Before: openat(AT_FDCWD, "/dev/mtd0", O_RDWR) = 4 ioctl(4, MIXER_WRITE(6) or MEMUNLOCK, {start=0, length=0x2000000}) = -1 EOPNOTSUPP After: openat(AT_FDCWD, "/dev/mtd0", O_RDWR) = 4 ioctl(4, MIXER_WRITE(6) or MEMUNLOCK, {start=0, length=0x2000000}) = 0 ioctl(4, MIXER_WRITE(5) or MEMLOCK, {start=0x1800000, length=0x800000}) = 0 Suggested-by: Adeel Arshad Signed-off-by: Jakub Czapiga Reviewed-by: Pratyush Yadav Signed-off-by: Pratyush Yadav commit bb7c963d0008f6d652ca7c7aa1aedae3d03425c7 Author: Pierre-Henry Moussay Date: Mon Nov 17 15:59:18 2025 +0000 dt-bindings: gpio: mpfs-gpio: Add pic64gx GPIO compatibility pic64gx GPIO is compatible with mpfs-gpio controller, add it with a fallback. Signed-off-by: Pierre-Henry Moussay Signed-off-by: Conor Dooley Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251117-grumbly-oversized-2215fe887181@spud Signed-off-by: Bartosz Golaszewski commit 7f77c561e22783387af91cd16f3a4324a99c9a4f Author: Haibo Chen Date: Wed Nov 12 19:05:13 2025 +0800 mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba The MT35XU02GCBA flash device does not support chip erase, according to its datasheet. It supports die erase, which means the current driver implementation will likely need to be converted to use die erase. Furthermore, similar to the MT35XU01GBBA, the SPI_NOR_IO_MODE_EN_VOLATILE flag probably needs to be enabled. Currently no active contributor has access to this hardware so there is no way of testing the fixes. Add a TODO item on the flash entry so someone with the flash can test that the support is indeed broken and send the fixes. Link: https://datasheet.octopart.com/MT35XU02GCBA1G12-0AAT-Micron-datasheet-138896808.pdf Reviewed-by: Tudor Ambarus Signed-off-by: Haibo Chen [pratyush@kernel.org: refactor the comment and commit message to make the purpose of the comment clearer] Signed-off-by: Pratyush Yadav commit a5dff51e190c20226cc5a6ade9a35fd71b22f42c Author: Haibo Chen Date: Wed Nov 12 19:05:12 2025 +0800 mtd: spi-nor: micron-st: add mt35xu01gbba support mt35xu01gbba is similar with mt35xu512aba, but with two dies. mt35xu01gbba has SFDP and support 8D-8D-8D mode, but SFDP lack SNOR_F_IO_MODE_EN_VOLATILE, so add this fixup flags here. Besides, mt35xu01gbba do not support chip erase, but support die erase, so add that in late_init(). Link: https://datasheet.octopart.com/MT35XU02GCBA1G12-0AAT-Micron-datasheet-138896808.pdf Signed-off-by: Haibo Chen Reviewed-by: Tudor Ambarus Signed-off-by: Pratyush Yadav commit 44dd635cd632824f412ff2a6b320d9302a277ad0 Author: Haibo Chen Date: Wed Nov 12 19:05:11 2025 +0800 mtd: spi-nor: micron-st: use SFDP of mt35xu512aba mt35xu512aba has SFDP, already contain the necessary information, so remove size and some flags here. Reviewed-by: Tudor Ambarus Signed-off-by: Haibo Chen Signed-off-by: Pratyush Yadav commit 9437a14ae2167124ce8741aed8c8922de8ae01e5 Author: Haibo Chen Date: Wed Nov 12 19:05:10 2025 +0800 mtd: spi-nor: micron-st: move set_octal_dtr to late_init() Move params->set_octal_dtr from flash_info->fixups->default_init() to spi_nor_manufacturer-> fixups-> late_init(), this can cover all Micorn and ST chips without repeat in each chip's flash_info. Reviewed-by: Tudor Ambarus Signed-off-by: Haibo Chen Signed-off-by: Pratyush Yadav commit 74883accfa4a717337413c3ca243e997cc384a55 Author: Haibo Chen Date: Wed Nov 12 19:05:09 2025 +0800 mtd: spi-nor: micron-st: rename the die_late_init functions st_nor_two/four_die_late_init() also suit for micron chips, so rename to micron_st_nor_two/four_die_late_init(), and move these functions up, then micron can use these function without declaration. Reviewed-by: Tudor Ambarus Signed-off-by: Haibo Chen Signed-off-by: Pratyush Yadav commit f2fb3f7bdf8b996ef7bd1ecc13c93c4dfc9b0d2a Merge: 96498e804cb662 9e510e677090bb Author: Mark Brown Date: Tue Nov 18 11:37:19 2025 +0000 spi: aspeed: Add AST2700 SoC support and Quad SPI Merge series from Chin-Ting Kuo : This series adds AST2700 support to the ASPEED FMC/SPI driver and bindings, introduces 64-bit address compatibility, and improves Quad SPI page programming behavior. It also implements AST2700-specific segment logic, where range adjustment is not required because the AST2700 SPI hardware controller already fixes decoding issues on the existing platforms and adopts an updated scheme. commit 20772c4e0f0b58211ebdddfb8606694677c4c4c8 Merge: 05b0e94153e313 d5c8b7902a4162 Author: Mark Brown Date: Tue Nov 18 11:37:11 2025 +0000 ASoC: Intel: avs: Allow for NHLT configuration Merge series from Cezary Rojewski From AudioDSP perspective, only gateway-related modules e.g.: Copier: Small set of changes providing new feature which the driver is already utilizing on the market - for its Long-Term-Support (LTS) devices. The goal is to cover systems which shipped with invalid Non HDAudio Link Table (NHLT) - not just the descriptors (headers), but cases where the hardware configuration is invalid too. The table is part of the ACPI tree and forcing BIOS updates is not a feasible solution. With the override, the topology file can carry the hardware configuration instead. From AudioDSP perspective, only gateway-related modules e.g.: Copier care about the procedure. To ensure correct order of operations when initializing such modules, the overrides take precedence over what's currently there in the NHLT. commit 45a1cd8346ca245a1ca475b26eb6ceb9d8b7c6f0 Author: Sunday Adelodun Date: Thu Nov 13 12:28:02 2025 +0100 selftests: af_unix: Add tests for ECONNRESET and EOF semantics Add selftests to verify and document Linux’s intended behaviour for UNIX domain sockets (SOCK_STREAM and SOCK_DGRAM) when a peer closes. The tests verify that: 1. SOCK_STREAM returns EOF when the peer closes normally. 2. SOCK_STREAM returns ECONNRESET if the peer closes with unread data. 3. SOCK_SEQPACKET returns EOF when the peer closes normally. 4. SOCK_SEQPACKET returns ECONNRESET if the peer closes with unread data. 5. SOCK_DGRAM does not return ECONNRESET when the peer closes. This follows up on review feedback suggesting a selftest to clarify Linux’s semantics. Suggested-by: Kuniyuki Iwashima Signed-off-by: Sunday Adelodun Link: https://patch.msgid.link/20251113112802.44657-1-adelodunolaoluwa@yahoo.com Signed-off-by: Paolo Abeni commit 4e1b0afa61403a1c8e13fd475f9bedf97b5de8d9 Merge: 7c898b71e59c51 c171e679ee66d7 Author: Paolo Abeni Date: Tue Nov 18 10:43:44 2025 +0100 Merge branch 'net-stmmac-disable-eee-rx-clock-stop-when-vlan-is-enabled' Ovidiu Panait says: ==================== net: stmmac: Disable EEE RX clock stop when VLAN is enabled This series fixes a couple of VLAN issues observed on the Renesas RZ/V2H EVK platform (stmmac + Microchip KSZ9131RNXI PHY): - The first patch fixes a bug where VLAN ID 0 would not be properly removed due to how vlan_del_hw_rx_fltr() matched entries in the VLAN filter table. - The second patch addresses RX clock gating issues that occur during VLAN creation and deletion when EEE is enabled with RX clock-stop active (the default configuration). For example: # ip link add link end1 name end1.5 type vlan id 5 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter RTNETLINK answers: Device or resource busy The stmmac hardware requires the receive clock to be running when writing certain registers, including VLAN registers. However, by default the driver enables Energy Efficient Ethernet (EEE) and allows the PHY to stop the receive clock when the link is idle. As a result, the RX clock might be stopped when attempting to access these registers, leading to timeouts. A more comprehensive overview of receive clock related issues in the stmmac driver can be found here: https://lore.kernel.org/all/Z9ySeo61VYTClIJJ@shell.armlinux.org.uk/ Most of the issues were resolved by commit dd557266cf5fb ("net: stmmac: block PHY RXC clock-stop"), which wraps register accesses with phylink_rx_clk_stop_block()/unblock() calls. However, VLAN add/delete operations are invoked with bottom halves disabled, where sleeping is not permitted, so those helpers cannot be used. To avoid these VLAN timeouts, the second patch disables the EEE RX clock-stop feature when VLAN support is enabled. This ensures the receive clock remains active, allowing VLAN operations to complete successfully. ==================== Link: https://patch.msgid.link/20251113112721.70500-1-ovidiu.panait.rb@renesas.com Signed-off-by: Paolo Abeni commit c171e679ee66d7c0e2b58db9531af96797a76bca Author: Ovidiu Panait Date: Thu Nov 13 11:27:21 2025 +0000 net: stmmac: Disable EEE RX clock stop when VLAN is enabled On the Renesas RZ/V2H EVK platform, where the stmmac MAC is connected to a Microchip KSZ9131RNXI PHY, creating or deleting VLAN interfaces may fail with timeouts: # ip link add link end1 name end1.5 type vlan id 5 15c40000.ethernet end1: Timeout accessing MAC_VLAN_Tag_Filter RTNETLINK answers: Device or resource busy Disabling EEE at runtime avoids the problem: # ethtool --set-eee end1 eee off # ip link add link end1 name end1.5 type vlan id 5 # ip link del end1.5 The stmmac hardware requires the receive clock to be running when writing certain registers, such as those used for MAC address configuration or VLAN filtering. However, by default the driver enables Energy Efficient Ethernet (EEE) and allows the PHY to stop the receive clock when the link is idle. As a result, the RX clock might be stopped when attempting to access these registers, leading to timeouts and other issues. Commit dd557266cf5fb ("net: stmmac: block PHY RXC clock-stop") addressed this issue for most register accesses by wrapping them in phylink_rx_clk_stop_block()/phylink_rx_clk_stop_unblock() calls. However, VLAN add/delete operations may be invoked with bottom halves disabled, where sleeping is not allowed, so using these helpers is not possible. Therefore, to fix this, disable the RX clock stop feature in the phylink configuration if VLAN features are set. This ensures the RX clock remains active and register accesses succeed during VLAN operations. Signed-off-by: Ovidiu Panait Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251113112721.70500-3-ovidiu.panait.rb@renesas.com Signed-off-by: Paolo Abeni commit d9db25723677c3741a0cf3643f7f7429fc983921 Author: Ovidiu Panait Date: Thu Nov 13 11:27:20 2025 +0000 net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() When the "rx-vlan-filter" feature is enabled on a network device, the 8021q module automatically adds a VLAN 0 hardware filter when the device is brought administratively up. For stmmac, this causes vlan_add_hw_rx_fltr() to create a new entry for VID 0 in the mac_device_info->vlan_filter array, in the following format: VLAN_TAG_DATA_ETV | VLAN_TAG_DATA_VEN | vid Here, VLAN_TAG_DATA_VEN indicates that the hardware filter is enabled for that VID. However, on the delete path, vlan_del_hw_rx_fltr() searches the vlan_filter array by VID only, without verifying whether a VLAN entry is enabled. As a result, when the 8021q module attempts to remove VLAN 0, the function may mistakenly match a zero-initialized slot rather than the actual VLAN 0 entry, causing incorrect deletions and leaving stale entries in the hardware table. Fix this by verifying that the VLAN entry's enable bit (VLAN_TAG_DATA_VEN) is set before matching and deleting by VID. This ensures only active VLAN entries are removed and avoids leaving stale entries in the VLAN filter table, particularly for VLAN ID 0. Fixes: ed64639bc1e08 ("net: stmmac: Add support for VLAN Rx filtering") Signed-off-by: Ovidiu Panait Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251113112721.70500-2-ovidiu.panait.rb@renesas.com Signed-off-by: Paolo Abeni commit e2c1b56f3dfa014128e775e898774c0356e3ff05 Author: Armin Wolf Date: Tue Nov 11 14:11:25 2025 +0100 platform/x86: wmi: Move WMI core code into a separate directory Move the WMI core code into a separate directory to prepare for future additions to the WMI driver. Also update the description of the Kconfig entry to better fit with the other subsystem Kconfig entries. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251111131125.3379-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 32e3fee88a4ac183541b478f5bc94084ea76436c Author: Armin Wolf Date: Tue Nov 11 14:11:24 2025 +0100 platform/x86: wmi: Remove extern keyword from prototypes The external function definitions do not need the "extern" keyword. Remove it to silence the associated checkpatch warnings. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251111131125.3379-4-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c209195a2a4ad920ff481b56628ca942d62e01b1 Author: Armin Wolf Date: Tue Nov 11 14:11:23 2025 +0100 platform/x86: wmi: Use correct type when populating ACPI objects When evaluating a WMxx/WSxx ACPI control method, the data buffer either needs to be passed as an ACPI buffer or as an ACPI string. Use the correct type (buffer/string) when populating the associated ACPI object. Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251111131125.3379-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 25524b6190295577e4918c689644451365e6466d Author: Armin Wolf Date: Tue Nov 11 14:11:22 2025 +0100 fs/nls: Fix utf16 to utf8 conversion Currently the function responsible for converting between utf16 and utf8 strings will ignore any characters that cannot be converted. This however also includes multi-byte characters that do not fit into the provided string buffer. This can cause problems if such a multi-byte character is followed by a single-byte character. In such a case the multi-byte character might be ignored when the provided string buffer is too small, but the single-byte character might fit and is thus still copied into the resulting string. Fix this by stop filling the provided string buffer once a character does not fit. In order to be able to do this extend utf32_to_utf8() to return useful errno codes instead of -1. Fixes: 74675a58507e ("NLS: update handling of Unicode") Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251111131125.3379-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2092007aa32f8dd968c38751bd1b7cac9b1f738d Author: Josh Poimboeuf Date: Wed Nov 12 15:32:34 2025 -0800 objtool/klp: Only enable --checksum when needed With CONFIG_KLP_BUILD enabled, checksums are only needed during a klp-build run. There's no need to enable them for normal kernel builds. This also has the benefit of softening the xxhash dependency. Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Tested-by: Michael Kelley Link: https://patch.msgid.link/edbb1ca215e4926e02edb493b68b9d6d063e902f.1762990139.git.jpoimboe@kernel.org commit ee0b48fabadf9b073b24f761ac09da7293eee7b7 Author: Josh Poimboeuf Date: Wed Nov 12 15:32:33 2025 -0800 objtool: Set minimum xxhash version to 0.8 XXH3 is only supported starting with xxhash 0.8. Enforce that. Fixes: 0d83da43b1e1 ("objtool/klp: Add --checksum option to generate per-function checksums") Closes: https://lore.kernel.org/SN6PR02MB41579B83CD295C9FEE40EED6D4FCA@SN6PR02MB4157.namprd02.prod.outlook.com Reported-by: Michael Kelley Signed-off-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Michael Kelley Tested-by: Michael Kelley Link: https://patch.msgid.link/7227c94692a3a51840278744c7af31b4797c6b96.1762990139.git.jpoimboe@kernel.org commit 39ae6c50e599aa0cf62ea3d0dcf06492f7690ed7 Author: Luke D. Jones Date: Sun Nov 2 22:53:19 2025 +0100 platform/x86: asus-armoury: add ppt_* and nv_* tuning knobs Adds the ppt_* and nv_* tuning knobs that are available via WMI methods and adds proper min/max levels plus defaults. The min/max are defined by ASUS and typically gained by looking at what they allow in the ASUS Armoury Crate application - ASUS does not share the values outside of this. It could also be possible to gain the AMD values by use of ryzenadj and testing for the minimum stable value. The general rule of thumb for adding to the match table is that if the model range has a single CPU used throughout, then the DMI match can omit the last letter of the model number as this is the GPU model. If a min or max value is not provided it is assumed that the particular setting is not supported. for example ppt_pl2_sppt_min/max is not set. If a _def is not set then the default is assumed to be _max It is assumed that at least AC settings are available so that the firmware attributes will be created - if no DC table is available and power is on DC, then reading the attributes is -ENODEV. Co-developed-by: Denis Benato Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Reviewed-by: Mario Limonciello Tested-by: Mateusz Schyboll Tested-by: Porfet Lillian Link: https://patch.msgid.link/20251102215319.3126879-10-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d849a9f2380d5287d5133eac5bae602a147b86c2 Author: Denis Benato Date: Sun Nov 2 22:53:18 2025 +0100 platform/x86: asus-wmi: rename ASUS_WMI_DEVID_PPT_FPPT Maintain power-related WMI macros naming consistency: rename ASUS_WMI_DEVID_PPT_FPPT to ASUS_WMI_DEVID_PPT_PL3_FPPT. Link: https://lore.kernel.org/all/cad7b458-5a7a-4975-94a1-d0c74f6f3de5@oracle.com/ Suggested-by: ALOK TIWARI Signed-off-by: Denis Benato Link: https://.../ Link: https://patch.msgid.link/20251102215319.3126879-9-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c683651b6791e85c2f892f8009268f1525f71408 Author: Luke D. Jones Date: Sun Nov 2 22:53:17 2025 +0100 platform/x86: asus-wmi: deprecate bios features With the existence of the asus-armoury module the attributes no longer need to live under the /sys/devices/platform/asus-nb-wmi/ path. Deprecate all those that were implemented in asus-bioscfg with the goal of removing them fully in the next LTS cycle. Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/20251102215319.3126879-8-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7725a2dc58632cb44eeef2e5b959ab7b7931298d Author: Luke D. Jones Date: Sun Nov 2 22:53:16 2025 +0100 platform/x86: asus-armoury: add screen auto-brightness toggle Add screen_auto_brightness toggle supported on some laptops. Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Reviewed-by: Mario Limonciello Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251102215319.3126879-7-denis.benato@linux.dev Signed-off-by: Ilpo Järvinen commit 9c7dacf5d51910f34a3bd709403f6a82ffc8c960 Author: Luke D. Jones Date: Sun Nov 2 22:53:14 2025 +0100 platform/x86: asus-armoury: add apu-mem control support Implement the APU memory size control under the asus-armoury module using the fw_attributes class. This allows the APU allocated memory size to be adjusted depending on the users priority. A reboot is required after change. Co-developed-by: Denis Benato Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Link: https://patch.msgid.link/20251102215319.3126879-5-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 9b0305968d60a7672a7db29c07cfbe03bc5ae3ab Author: Christoph Hellwig Date: Mon Oct 27 08:01:50 2025 +0100 xfs: remove the unused bv field in struct xfs_gc_bio Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Reviewed-by: Hans Holmberg Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 5b3a426affbd30a4293d284ab0d37164a4064531 Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:36 2025 +0530 powerpc/64s/slb: Add no_slb_preload early cmdline param no_slb_preload cmdline can come useful in quickly disabling and/or testing the performance impact of userspace slb preloads. Recently there was a slb multi-hit issue due to slb preload cache which was very difficult to triage. This cmdline option allows to quickly disable preloads and verify if the issue exists in preload cache or somewhere else. This can also be a useful option to see the effect of slb preloads for any application workload e.g. number of slb faults with or w/o slb preloads. with slb_preload: slb_faults (minimal initrd boot): 15 slb_faults (full systemd boot): 300 with no_slb_preload: slb_faults (minimal initrd boot): 33 slb_faults (full systemd boot): 138180 Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/de484b55c45d831bc2db63945f455153c89a9a65.1761834163.git.ritesh.list@gmail.com commit 2a492d6b38c2943c9d2f9008f31a8bb3afc3a40b Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:35 2025 +0530 powerpc/64s/slb: Make preload_add return type as void We dropped preload_new_slb_context() & slb_setup_new_exec() in a previous patch. That means we don't really need preload_add() return type anymore. So let's make its return type as void. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/88b07223e93b0fc56c1119f6889b7d9c83e20109.1761834163.git.ritesh.list@gmail.com commit 3d44be297e7e01357b95dd13d2b335e6550ccfcd Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:34 2025 +0530 powerpc/ptdump: Dump PXX level info for kernel_page_tables This patch adds PGD/PUD/PMD/PTE level information while dumping kernel page tables. Before this patch it was hard to identify which entries belongs to which page table level e.g. ~ # dmesg |grep -i radix [0.000000] radix-mmu: Mapped 0x0000000000000000-0x0000000005400000 with 2.00 MiB pages (exec) [0.000000] radix-mmu: Mapped 0x0000000005400000-0x0000000040000000 with 2.00 MiB pages [0.000000] radix-mmu: Mapped 0x0000000040000000-0x0000000100000000 with 1.00 GiB pages [0.000000] radix-mmu: Initializing Radix MMU Before: ---[ Start of kernel VM ]--- 0xc000000000000000-0xc000000003ffffff XXX 64M r X pte valid present dirty accessed 0xc000000004000000-0xc00000003fffffff XXX 960M r w pte valid present dirty accessed 0xc000000040000000-0xc0000000ffffffff XXX 3G r w pte valid present dirty accessed ... ---[ vmemmap start ]--- 0xc00c000000000000-0xc00c0000003fffff XXX 4M r w pte valid present dirty accessed After: ---[ Start of kernel VM ]--- 0xc000000000000000-0xc000000003ffffff XXX 64M PMD r X pte valid present dirty accessed 0xc000000004000000-0xc00000003fffffff XXX 960M PMD r w pte valid present dirty accessed 0xc000000040000000-0xc0000000ffffffff XXX 3G PUD r w pte valid present dirty accessed ... ---[ vmemmap start ]--- 0xc00c000000000000-0xc00c0000003fffff XXX 4M PMD r w pte valid present dirty accessed Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/95defb675ee5607ef3923a1e6aeac39311b8fad4.1761834163.git.ritesh.list@gmail.com commit 6394f0e8abe7ca3132faa1321c97c53d0994aecc Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:33 2025 +0530 powerpc/64s/pgtable: Enable directMap counters in meminfo for Hash This patch enables the directMap counters to be printed in proc/meminfo for Hash mmu. With this patch on a system with 8G of DRAM we can see the entire RAM mapped with 16M pagesize: cat /proc/meminfo |grep -i direct DirectMap4k: 0 kB DirectMap64k: 0 kB DirectMap16M: 8388608 kB DirectMap16G: 0 kB Tested with devdax too: root@buildroot:/# ndctl create-namespace -r region0 -m devdax -s 2G { "dev":"namespace0.0", "mode":"devdax", "map":"dev", "size":"2032.00 MiB (2130.71 MB)", "uuid":"aa383ded-cd99-43a0-979f-5225467cfb40", "daxregion":{ "id":0, "size":"2032.00 MiB (2130.71 MB)", "align":16777216, "devices":[ { "chardev":"dax0.0", "size":"2032.00 MiB (2130.71 MB)", "target_node":0, "align":"16.00 MiB (16.78 MB)", "mode":"devdax" } ] }, "align":16777216 } root@buildroot:/# cat /proc/meminfo |grep -i direct DirectMap4k: 0 kB DirectMap64k: 0 kB DirectMap16M: 10485760 kB DirectMap16G: 0 kB root@buildroot:/# ndctl destroy-namespace -f all destroyed 1 namespace root@buildroot:/# cat /proc/meminfo |grep -i direct DirectMap4k: 0 kB DirectMap64k: 0 kB DirectMap16M: 8388608 kB DirectMap16G: 0 kB Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/ffe47912e17075649b6ce5b2ee5d7f3eb5352e0b.1761834163.git.ritesh.list@gmail.com commit b296fda58d1d095c95c8207b09856b2ceafa1397 Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:32 2025 +0530 powerpc/64s/hash: Update directMap page counters for Hash Update the directMap page counters for Hash. Hash by default always uses mmu_linear_psize only, for it's directMap. However, once the kernel has booted and the dmesg log is wrapped over there is no way of knowing the kernel linear pagesize with Hash mmu. Features like debug_page_alloc can make mmu_linear_psize to be PAGE_SIZE instead of PMD / PUD mappings. It would be easier if we have this info printed in proc meminfo similar to Radix for debugging purposes. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/208e6f946d2ba9c1e2b8b4f665728abe5c891e7c.1761834163.git.ritesh.list@gmail.com commit b80691e25ec632d020b90eb9de3af0f956dff0a0 Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:31 2025 +0530 powerpc/64s/hash: Hash hpt_order should be only available with Hash MMU This disables creating hpt_order debugfs entry with radix mode. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/99237176a51c73e85f4a7edd60a2460017882d69.1761834163.git.ritesh.list@gmail.com commit fec40fe7e6dc08c97370420301377ee031199a6d Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:30 2025 +0530 powerpc/64s/hash: Improve hash mmu printk messages Let's use pr_info() instead of printk() in order to utilize the pr_fmt set to "hash-mmu:". This improves the debug messages that are spitted out during kernel bootup. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/a2af842f85c099cdbd19bf468606960c5226a079.1761834163.git.ritesh.list@gmail.com commit 178dd2ee2b72817a67a8814c35a65fd901b325ba Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:29 2025 +0530 powerpc/64s/hash: Fix phys_addr_t printf format in htab_initialize() We get below errors when we try to enable debug logs in book3s64/hash_utils.c This patch fixes these errors related to phys_addr_t printf format. arch/powerpc/mm/book3s64/hash_utils.c: In function ‘htab_initialize’: arch/powerpc/mm/book3s64/hash_utils.c:1401:21: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘phys_addr_t’ {aka ‘long long unsigned int’} [-Werror=format=] 1401 | DBG("creating mapping for region: %lx..%lx (prot: %lx)\n", arch/powerpc/mm/book3s64/hash_utils.c:1401:21: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘phys_addr_t’ {aka ‘long long unsigned int’} [-Werror=format=] cc1: all warnings being treated as errors make[6]: *** [../scripts/Makefile.build:287: arch/powerpc/mm/book3s64/hash_utils.o] Error 1 Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/4873e9692fc4411099c9741005d218d5e734c345.1761834163.git.ritesh.list@gmail.com commit eae40a6da63faa9fb63ff61f8fa2b3b57da78a84 Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:28 2025 +0530 powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format HPTE format was changed since Power9 (ISA 3.0) onwards. While dumping kernel hash page tables, nothing gets printed on powernv P9+. This patch utilizes the helpers added in the patch tagged as fixes, to convert new format to old format and dump the hptes. This fix is only needed for native_find() (powernv), since pseries continues to work fine with the old format. Fixes: 6b243fcfb5f1e ("powerpc/64: Simplify adaptation to new ISA v3.00 HPTE format") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/4c2bb9e5b3cfbc0dd80b61b67cdd3ccfc632684c.1761834163.git.ritesh.list@gmail.com commit 17b45ccf09882e0c808ad2cf62acdc90ad968746 Author: Ritesh Harjani (IBM) Date: Thu Oct 30 20:27:27 2025 +0530 powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit When HV=0 & IR/DR=0, the Hash MMU is said to be in Virtual Real Addressing Mode during early boot. During this, we should ensure that memory region allocations for stress_hpt_struct should happen from within RMA region as otherwise the boot might get stuck while doing memset of this region. History behind why do we have RMA region limitation is better explained in these 2 patches [1] & [2]. This patch ensures that memset to stress_hpt_struct during early boot does not cross ppc64_rma_size boundary. [1]: https://lore.kernel.org/all/20190710052018.14628-1-sjitindarsingh@gmail.com/ [2]: https://lore.kernel.org/all/87wp54usvj.fsf@linux.vnet.ibm.com/ Fixes: 6b34a099faa12 ("powerpc/64s/hash: add stress_hpt kernel boot option to increase hash faults") Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/ada1173933ea7617a994d6ee3e54ced8797339fc.1761834163.git.ritesh.list@gmail.com commit 00312419f0863964625d6dcda8183f96849412c6 Author: Donet Tom Date: Thu Oct 30 20:27:26 2025 +0530 powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry. To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache. If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error. The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch. CPU 0 CPU 1 ----- ----- Process P exec swapper/1 load_elf_binary begin_new_exc activate_mm switch_mm_irqs_off switch_mmu_context switch_slb /* * This invalidates all * the entries in the HW * and setup the new HW * SLB entries as per the * preload cache. */ context_switch sched_migrate_task migrates process P to cpu-1 Process swapper/0 context switch (to process P) (uses mm_struct of Process P) switch_mm_irqs_off() switch_slb load_slb++ /* * load_slb becomes 0 here * and we evict an entry from * the preload cache with * preload_age(). We still * keep HW SLB and preload * cache in sync, that is * because all HW SLB entries * anyways gets evicted in * switch_slb during SLBIA. * We then only add those * entries back in HW SLB, * which are currently * present in preload_cache * (after eviction). */ load_elf_binary continues... setup_new_exec() slb_setup_new_exec() sched_switch event sched_migrate_task migrates process P to cpu-0 context_switch from swapper/0 to Process P switch_mm_irqs_off() /* * Since both prev and next mm struct are same we don't call * switch_mmu_context(). This will cause the HW SLB and SW preload * cache to go out of sync in preload_new_slb_context. Because there * was an SLB entry which was evicted from both HW and preload cache * on cpu-1. Now later in preload_new_slb_context(), when we will try * to add the same preload entry again, we will add this to the SW * preload cache and then will add it to the HW SLB. Since on cpu-0 * this entry was never invalidated, hence adding this entry to the HW * SLB will cause a SLB multi-hit error. */ load_elf_binary continues... START_THREAD start_thread preload_new_slb_context /* * This tries to add a new EA to preload cache which was earlier * evicted from both cpu-1 HW SLB and preload cache. This caused the * HW SLB of cpu-0 to go out of sync with the SW preload cache. The * reason for this was, that when we context switched back on CPU-0, * we should have ideally called switch_mmu_context() which will * bring the HW SLB entries on CPU-0 in sync with SW preload cache * entries by setting up the mmu context properly. But we didn't do * that since the prev mm_struct running on cpu-0 was same as the * next mm_struct (which is true for swapper / kernel threads). So * now when we try to add this new entry into the HW SLB of cpu-0, * we hit a SLB multi-hit error. */ WARNING: CPU: 0 PID: 1810970 at arch/powerpc/mm/book3s64/slb.c:62 assert_slb_presence+0x2c/0x50(48 results) 02:47:29 [20157/42149] Modules linked in: CPU: 0 UID: 0 PID: 1810970 Comm: dd Not tainted 6.16.0-rc3-dirty #12 VOLUNTARY Hardware name: IBM pSeries (emulated by qemu) POWER8 (architected) 0x4d0200 0xf000004 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c00000000015426c LR: c0000000001543b4 CTR: 0000000000000000 REGS: c0000000497c77e0 TRAP: 0700 Not tainted (6.16.0-rc3-dirty) MSR: 8000000002823033 CR: 28888482 XER: 00000000 CFAR: c0000000001543b0 IRQMASK: 3 <...> NIP [c00000000015426c] assert_slb_presence+0x2c/0x50 LR [c0000000001543b4] slb_insert_entry+0x124/0x390 Call Trace: 0x7fffceb5ffff (unreliable) preload_new_slb_context+0x100/0x1a0 start_thread+0x26c/0x420 load_elf_binary+0x1b04/0x1c40 bprm_execve+0x358/0x680 do_execveat_common+0x1f8/0x240 sys_execve+0x58/0x70 system_call_exception+0x114/0x300 system_call_common+0x160/0x2c4 >From the above analysis, during early exec the hardware SLB is cleared, and entries from the software preload cache are reloaded into hardware by switch_slb. However, preload_new_slb_context and slb_setup_new_exec also attempt to load some of the same entries, which can trigger a multi-hit. In most cases, these additional preloads simply hit existing entries and add nothing new. Removing these functions avoids redundant preloads and eliminates the multi-hit issue. This patch removes these two functions. We tested process switching performance using the context_switch benchmark on POWER9/hash, and observed no regression. Without this patch: 129041 ops/sec With this patch: 129341 ops/sec We also measured SLB faults during boot, and the counts are essentially the same with and without this patch. SLB faults without this patch: 19727 SLB faults with this patch: 19786 Fixes: 5434ae74629a ("powerpc/64s/hash: Add a SLB preload cache") cc: stable@vger.kernel.org Suggested-by: Nicholas Piggin Signed-off-by: Donet Tom Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/0ac694ae683494fe8cadbd911a1a5018d5d3c541.1761834163.git.ritesh.list@gmail.com commit 78fc63ffa7813e33681839bb33826c24195f0eb7 Author: Dave Vasilevsky Date: Sun Nov 16 01:40:46 2025 -0500 powerpc, mm: Fix mprotect on book3s 32-bit On 32-bit book3s with hash-MMUs, tlb_flush() was a no-op. This was unnoticed because all uses until recently were for unmaps, and thus handled by __tlb_remove_tlb_entry(). After commit 4a18419f71cd ("mm/mprotect: use mmu_gather") in kernel 5.19, tlb_gather_mmu() started being used for mprotect as well. This caused mprotect to simply not work on these machines: int *ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); *ptr = 1; // force HPTE to be created mprotect(ptr, 4096, PROT_READ); *ptr = 2; // should segfault, but succeeds Fixed by making tlb_flush() actually flush TLB pages. This finally agrees with the behaviour of boot3s64's tlb_flush(). Fixes: 4a18419f71cd ("mm/mprotect: use mmu_gather") Cc: stable@vger.kernel.org Reviewed-by: Christophe Leroy Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Dave Vasilevsky Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251116-vasi-mprotect-g3-v3-1-59a9bd33ba00@vasilevsky.ca commit 18a4895370a79a3efb4a53ccd1efffef6c5b634e Author: Antheas Kapenekakis Date: Sun Oct 26 20:16:35 2025 +0100 ALSA: hda/realtek: Add match for ASUS Xbox Ally projects Bind the realtek codec to TAS2781 I2C audio amps on ASUS Xbox Ally projects. While these projects work without a quirk, adding it increases the output volume significantly. Cc: stable@vger.kernel.org # 6.17 Signed-off-by: Antheas Kapenekakis Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251026191635.2447593-2-lkml@antheas.dev commit 945865a0ddf3e3950aea32e23e10d815ee9b21bc Author: Antheas Kapenekakis Date: Sun Oct 26 20:16:34 2025 +0100 ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Currently, on ASUS projects, the TAS2781 codec attaches the speaker GPIO to the first tasdevice_priv instance using devm. This causes tas2781_read_acpi to fail on subsequent probes since the GPIO is already managed by the first device. This causes a failure on Xbox Ally X, because it has two amplifiers, and prevents us from quirking both the Xbox Ally and Xbox Ally X in the realtek codec driver. It is unnecessary to attach the GPIO to a device as it is static. Therefore, instead of attaching it and then reading it when loading the firmware, read its value directly in tas2781_read_acpi and store it in the private data structure. Then, make reading the value non-fatal so that ASUS projects that miss a speaker pin can still work, perhaps using fallback firmware. Fixes: 4e7035a75da9 ("ALSA: hda/tas2781: Add speaker id check for ASUS projects") Cc: stable@vger.kernel.org # 6.17 Signed-off-by: Antheas Kapenekakis Reviewed-by: Baojun Xu Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251026191635.2447593-1-lkml@antheas.dev commit 7dc211c1159d991db609bdf4b0fb9033c04adcbc Author: Pu Lehui Date: Sat Nov 15 10:23:43 2025 +0000 bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL. Fixes: 492ecee892c2 ("bpf: enable program stats") Signed-off-by: Pu Lehui Link: https://lore.kernel.org/r/20251115102343.2200727-1-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov commit eb028c33451af08bb34f45c6be6967ef1c98cbd1 Author: Al Viro Date: Mon Oct 27 18:32:21 2025 -0400 d_make_discardable(): warn if given a non-persistent dentry At this point there are very few call chains that might lead to d_make_discardable() on a dentry that hadn't been made persistent: calls of simple_unlink() and simple_rmdir() in configfs and apparmorfs. Both filesystems do pin (part of) their contents in dcache, but they are currently playing very unusual games with that. Converting them to more usual patterns might be possible, but it's definitely going to be a long series of changes in both cases. For now the easiest solution is to have both stop using simple_unlink() and simple_rmdir() - that allows to make d_make_discardable() warn when given a non-persistent dentry. Rather than giving them full-blown private copies (with calls of d_make_discardable() replaced with dput()), let's pull the parts of simple_unlink() and simple_rmdir() that deal with timestamps and link counts into separate helpers (__simple_unlink() and __simple_rmdir() resp.) and have those used by configfs and apparmorfs. Signed-off-by: Al Viro commit ca459ca70f60ce05445845eca74c788b0d5ddb1b Author: Al Viro Date: Sat Oct 25 18:34:49 2025 -0400 kill securityfs_recursive_remove() it's an unused alias for securityfs_remove() Acked-by: Paul Moore Signed-off-by: Al Viro commit 2026c6f8eb23df3b77b81d4d9a19d25126c2f1cf Author: Al Viro Date: Tue May 14 07:01:27 2024 -0600 convert securityfs securityfs uses simple_recursive_removal(), but does not bother to mark dentries persistent. This is the only place where it still happens; get rid of that irregularity. * use simple_{start,done}_creating() and d_make_persitent(); kill_litter_super() use was already gone, since we empty the filesystem instance before it gets shut down. Acked-by: Paul Moore Signed-off-by: Al Viro commit fc45aee66223253ec5547094d7552819914abdfb Author: Al Viro Date: Mon Mar 10 00:06:29 2025 -0400 get rid of kill_litter_super() Not used anymore. Signed-off-by: Al Viro commit 4433d8e25d73a619c7d855cca8100d0eea89abda Author: Al Viro Date: Sat Oct 25 17:32:50 2025 -0400 convert rust_binderfs Parallel to binderfs stuff: * use simple_start_creating()/simple_done_creating()/d_make_persistent() instead of manual inode_lock()/lookup_noperm()/d_instanitate()/inode_unlock(). * allocate inode first - simpler cleanup that way. * use simple_recursive_removal() instead of open-coding it. * switch to kill_anon_super() Signed-off-by: Al Viro commit 0c9a266868f5b8174b7a0c56ff1b8a948e0786d4 Author: Al Viro Date: Mon Feb 26 01:37:54 2024 -0500 convert nfsctl One instance per net-ns. There's a fixed subset (several files in root, an optional symlink in root + initially empty /clients/) + per-client subdirectory in /clients/. Clients can appear only after the filesystem is there and they are all gone before it gets through ->kill_sb(). Fixed subset created in fill_super(), regular files by simple_fill_super(), then a subdirectory and a symlink - manually. It is removed by kill_litter_super(). Per-client subdirectories are created by nfsd_client_mkdir() (populated with client-supplied list of files in them). Removed by nfsd_client_rmdir(), which is simple_recursive_removal(). All dentries except for the ones from simple_fill_super() come from * nfsd_mkdir() (subdirectory, dentry from simple_start_creating()). Called from fill_super() (creates initially empty /clients) and from nfsd_client_mkdir (creates a per-client subdirectory in /clients). * _nfsd_symlink() (symlink, dentry from simple_start_creating()), called from fill_super(). * nfsdfs_create_files() (regulars, dentry from simple_start_creating()), called only from nfsd_client_mkdir(). Turn d_instatiate() + inode_unlock() into d_make_persistent() + simple_done_creating() in nfsd_mkdir(), _nfsd_symlink() and nfsdfs_create_files() and we are done. Signed-off-by: Al Viro commit 946e2256775e50cc0d60f588ecfee60cf3b86b45 Author: Al Viro Date: Mon Feb 26 02:26:46 2024 -0500 convert rpc_pipefs Just use d_make_persistent() + dput() (and fold the latter into simple_finish_creating()) and that's it... NOTE: pipe->dentry is a borrowed reference - it does not contribute to dentry refcount. Signed-off-by: Al Viro commit 2a3d40476b9f77912100fdcd93d155a9675c3d05 Author: Al Viro Date: Thu May 9 15:55:34 2024 -0400 convert hypfs just have hypfs_create_file() do the usual simple_start_creating()/ d_make_persistent()/simple_done_creating() and that's it Signed-off-by: Al Viro commit 723c2ba85900cf00f79cab4713d75dedd8e094df Author: Al Viro Date: Thu Sep 18 00:30:57 2025 -0400 hypfs: swich hypfs_create_u64() to returning int same story as for hypfs_create_str() Signed-off-by: Al Viro commit 63f76f51fe47353296f03fbc91488432aa5ae340 Author: Al Viro Date: Wed Sep 17 23:10:49 2025 -0400 hypfs: switch hypfs_create_str() to returning int Every single caller only cares about PTR_ERR_OR_ZERO() of return value... Signed-off-by: Al Viro commit 781716cd4a927a6df09f78106f192cdb30560552 Author: Al Viro Date: Thu May 9 16:00:48 2024 -0400 hypfs: don't pin dentries twice hypfs dentries end up with refcount 2 when they are not busy. Refcount 1 is enough to keep them pinned, and going that way allows to simplify things nicely: * don't need to drop an extra reference before the call of kill_litter_super() in ->kill_sb(); all we need there is to reset the cleanup list - everything on it will be taken out automatically. * we can make use of simple_recursive_removal() on tree rebuilds; just make sure that only children of root end up in the cleanup list and hypfs_delete_tree() becomes much simpler Signed-off-by: Al Viro commit 57db9d428ba5008ca7d664463d7ee1d486b86976 Author: Al Viro Date: Sun Mar 9 22:56:17 2025 -0400 convert gadgetfs same as functionfs Signed-off-by: Al Viro commit b65e3b11e9236952c2f0d12a97dca274e653a570 Author: Al Viro Date: Thu Sep 18 01:20:18 2025 -0400 gadgetfs: switch to simple_remove_by_name() No need to return dentry from gadgetfs_create_file() or keep it around afterwards. Signed-off-by: Al Viro commit 6ca67378d0e79a914420cbc8f300b7aaf8dadde6 Author: Al Viro Date: Sat Mar 8 22:22:29 2025 -0500 convert functionfs All files are regular; ep0 is there all along, other ep* may appear and go away during the filesystem lifetime; all of those are guaranteed to be gone by the time we umount it. Object creation is in ffs_sb_create_file(), removals - at ->kill_sb() time (for ep0) or by simple_remove_by_name() from ffs_epfiles_destroy() (for the rest of them). Switch ffs_sb_create_file() to simple_start_creating()/d_make_persistent()/ simple_done_creating() and that's it. Signed-off-by: Al Viro commit c7747fafaba0dcdad3d7da240e961927b4865f98 Author: Al Viro Date: Wed Sep 17 22:55:33 2025 -0400 functionfs: switch to simple_remove_by_name() No need to return dentry from ffs_sb_create_file() or keep it around afterwards. To avoid subtle issues with getting to ffs from epfiles in ffs_epfiles_destroy(), pass the superblock as explicit argument. Callers have it anyway. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit e5bf5ee266633cb18fff6f98f0b7d59a62819eee Author: Al Viro Date: Fri Nov 14 02:18:22 2025 -0500 functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object. There is a total count of opened files on functionfs (both ep0 and dynamic ones) and when it hits zero, dynamic files get removed. Unfortunately, that removal can happen while another thread is in ffs_epfile_open(), but has not incremented the count yet. In that case open will succeed, leaving us with UAF on any subsequent read() or write(). The root cause is that ffs->opened is misused; atomic_dec_and_test() vs. atomic_add_return() is not a good idea, when object remains visible all along. To untangle that * serialize openers on ffs->mutex (both for ep0 and for dynamic files) * have dynamic ones use atomic_inc_not_zero() and fail if we had zero ->opened; in that case the file we are opening is doomed. * have the inodes of dynamic files marked on removal (from the callback of simple_recursive_removal()) - clear ->i_private there. * have open of dynamic ones verify they hadn't been already removed, along with checking that state is FFS_ACTIVE. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit 1544775687f093e799439fca5519340b88c84e2c Author: Al Viro Date: Mon Nov 17 16:49:59 2025 -0500 functionfs: need to cancel ->reset_work in ->kill_sb() ... otherwise we just might free ffs with ffs->reset_work still on queue. That needs to be done after ffs_data_reset() - that's the cutoff point for configfs accesses (serialized on gadget_info->lock), which is where the schedule_work() would come from. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit fe47466282a69499ae17a22f064e827badb77078 Author: Al Viro Date: Mon Nov 17 14:40:21 2025 -0500 functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}() A reference is held by the superblock (it's dropped in ffs_kill_sb()) and filesystem will not get to ->kill_sb() while there are any opened files, TYVM... Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit fcb8985143540cbcb8e91c0ea8b7fb5d37c88177 Author: Al Viro Date: Mon Nov 17 14:22:46 2025 -0500 functionfs: don't abuse ffs_data_closed() on fs shutdown ffs_data_closed() has a seriously confusing logics in it: in addition to the normal "decrement a counter and do some work if it hits zero" there's "... and if it has somehow become negative, do that" bit. It's not a race, despite smelling rather fishy. What really happens is that in addition to "call that on close of files there, to match the increments of counter on opens" there's one call in ->kill_sb(). Counter starts at 0 and never goes negative over the lifetime of filesystem (or we have much worse problems everywhere - ->release() call of some file somehow unpaired with successful ->open() of the same). At the filesystem shutdown it will be 0 or, again, we have much worse problems - filesystem instance destroyed with files on it still open. In other words, at that call and at that call alone the decrement would go from 0 to -1, hitting that chunk (and not hitting the "if it hits 0" part). So that check is a weirdly spelled "called from ffs_kill_sb()". Just expand the call in the latter and kill the misplaced chunk in ffs_data_closed(). Reviewed-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit 7c898b71e59c51ba356aab095ea4ee1f867ad595 Merge: 5b8b343c5c9897 01e0e8b6a2d798 Author: Jakub Kicinski Date: Mon Nov 17 20:23:39 2025 -0800 Merge branch 'dpll-zl3073x-refactor-state-management' Ivan Vecera says: ==================== dpll: zl3073x: Refactor state management This patch set is a refactoring of the zl3073x driver to clean up state management, improve modularity, and significantly reduce on-demand I/O. The driver's dpll.c implementation previously performed on-demand register reads and writes (wrapped in mailbox operations) to get or set properties like frequency, phase, and embedded-sync settings. This cluttered the DPLL logic with low-level I/O, duplicated locking, and led to inefficient bus traffic. This series addresses this by: 1. Splitting the monolithic 'core.c' into logical units ('ref.c', 'out.c', 'synth.c'). 2. Implementing a full read/write-back cache for 'zl3073x_ref' and 'zl3073x_out' structures. All state is now read once during '_state_fetch()' (and status updated periodically). DPLL get callbacks read from this cache. Set callbacks modify a copy of the state, which is then committed via a new '..._state_set()' function. These '_state_set' functions compare the new state to the cached state and write *only* the modified register values back to the hardware, all within a single mailbox sequence. The result is a much cleaner 'dpll.c' that is almost entirely free of direct register I/O, and all state logic is properly encapsulated in its respective file. The series is broken down as follows: * Patch 1: Changes the state structs to store raw register values (e.g., 'config', 'ctrl') instead of parsed booleans, centralizing parsing logic into the helpers. * Patch 2: Splits the logic from 'core.c' into new 'ref.c', 'out.c' and 'synth.c' files, creating a 'zl3073x_dev_...' abstraction layer. * Patch 3: Introduces the caching concept by reading and caching the reference monitor status periodically, removing scattered reads from 'dpll.c'. * Patch 4: Expands the 'zl3073x_ref' struct to cache *all* reference properties and adds 'zl3073x_ref_state_set()' to write back changes. * Patch 5: Does the same for the 'zl3073x_out' struct, caching all output properties and adding 'zl3073x_out_state_set()'. * Patch 6: A final cleanup that removes the 'zl3073x_dev_...' wrapper functions that became redundant after the refactoring. ==================== Link: https://patch.msgid.link/20251113074105.141379-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 01e0e8b6a2d798e7403f4f636b15bcf644a7f110 Author: Ivan Vecera Date: Thu Nov 13 08:41:05 2025 +0100 dpll: zl3073x: Remove unused dev wrappers Remove several zl3073x_dev_... inline wrapper functions from core.h as they are no longer used by any callers. Removed functions: * zl3073x_dev_ref_ffo_get * zl3073x_dev_ref_is_enabled * zl3073x_dev_synth_dpll_get * zl3073x_dev_synth_is_enabled * zl3073x_dev_out_signal_format_get This is a cleanup after recent refactoring, as the remaining callers now fetch the state object and use the base helpers directly. Reviewed-by: Petr Oros Tested-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251113074105.141379-7-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 5fb9b0d411f81ec46833ea8e43c0263515060c64 Author: Ivan Vecera Date: Thu Nov 13 08:41:04 2025 +0100 dpll: zl3073x: Cache all output properties in zl3073x_out Expand the zl3073x_out structure to cache all output-related hardware registers, including divisors, widths, embedded-sync parameters and phase compensation. Modify zl3073x_out_state_fetch() to read and populate all these new fields at once, including zero-divisor checks. Refactor all dpll "getter" functions in dpll.c to read from this new cached state instead of performing direct register access. Introduce a new function, zl3073x_out_state_set(), to handle writing changes back to the hardware. This function compares the provided state with the current cached state and writes *only* the modified register values via a single mailbox sequence before updating the local cache. Refactor all dpll "setter" functions to modify a local copy of the output state and then call zl3073x_out_state_set() to commit the changes. This change centralizes all output-related register I/O into out.c, significantly reduces bus traffic, and simplifies the logic in dpll.c. Reviewed-by: Petr Oros Tested-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251113074105.141379-6-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 5bc02b190a3fb703bf8cadc4d778fc22cd4d1e78 Author: Ivan Vecera Date: Thu Nov 13 08:41:03 2025 +0100 dpll: zl3073x: Cache all reference properties in zl3073x_ref Expand the zl3073x_ref structure to cache all reference-related hardware registers, including frequency components, embedded-sync settings and phase compensation. Previously, these registers were read on-demand from various functions in dpll.c leading to frequent mailbox operations. Modify zl3073x_ref_state_fetch() to read and populate all these new fields at once. Refactor all "getter" functions in dpll.c to read from this new cached state instead of performing direct register access. Remove the standalone zl3073x_dpll_input_ref_frequency_get() helper, as its functionality is now replaced by zl3073x_ref_freq_get() which operates on the cached state and add a corresponding zl3073x_dev_... wrapper. Introduce a new function, zl3073x_ref_state_set(), to handle writing changes back to the hardware. This function compares the provided state with the current cached state and writes *only* the modified register values to the device via a single mailbox sequence before updating the local cache. Refactor all dpll "setter" functions to modify a local copy of the ref state and then call zl3073x_ref_state_set() to commit the changes. As a cleanup, update callers in dpll.c that already have a struct zl3073x_ref * to use the direct helpers instead of the zl3073x_dev_... wrappers. This change centralizes all reference-related register I/O into ref.c, significantly reduces bus traffic, and simplifies the logic in dpll.c. Reviewed-by: Petr Oros Tested-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251113074105.141379-5-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 5534a8202d7cf9b2e4557517745583c43662b6a8 Author: Ivan Vecera Date: Thu Nov 13 08:41:02 2025 +0100 dpll: zl3073x: Cache reference monitor status Instead of reading the ZL_REG_REF_MON_STATUS register every time the reference status is needed, cache this value in the zl3073x_ref struct. This is achieved by: * Adding a mon_status field to struct zl3073x_ref * Introducing zl3073x_dev_ref_status_update() to read the status for all references into this new cache field * Calling this update function from the periodic work handler * Adding zl3073x_ref_is_status_ok() and zl3073x_dev_ref_is_status_ok() helpers to check the cached value * Refactoring all callers in dpll.c to use the new zl3073x_dev_ref_is_status_ok() helper, removing direct register reads This change consolidates all status register reads into a single periodic function and reduces I/O bus traffic in dpll callbacks. Reviewed-by: Petr Oros Tested-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251113074105.141379-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 607f2c00c61faa3b437dbb0d38287e7a9d398a52 Author: Ivan Vecera Date: Thu Nov 13 08:41:01 2025 +0100 dpll: zl3073x: Split ref, out, and synth logic from core Refactor the zl3073x driver by splitting the logic for input references, outputs and synthesizers out of the monolithic core.[ch] files. Move the logic for each functional block into its own dedicated files: ref.[ch], out.[ch] and synth.[ch]. Specifically: - Move state structures (zl3073x_ref, zl3073x_out, zl3073x_synth) from core.h into their respective new headers - Move state-fetching functions (..._state_fetch) from core.c to their new .c files - Move the zl3073x_ref_freq_factorize helper from core.c to ref.c - Introduce a new helper layer to decouple the core device logic from the state-parsing logic: 1. Move the original inline helpers (e.g., zl3073x_ref_is_enabled) to the new headers (ref.h, etc.) and make them operate on a const struct ... * pointer. 2. Create new zl3073x_dev_... prefixed functions in core.h (e.g., zl3073x_dev_ref_is_enabled) and Implement these _dev_ functions to fetch state using a new ..._state_get() helper and then call the non-prefixed helper. 3. Update all driver-internal callers (in dpll.c, prop.c, etc.) to use the new zl3073x_dev_... functions. Reviewed-by: Petr Oros Tested-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251113074105.141379-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 58fb88d30b0250f928e1afa0eaa4547770d86229 Author: Ivan Vecera Date: Thu Nov 13 08:41:00 2025 +0100 dpll: zl3073x: Store raw register values instead of parsed state The zl3073x_ref, zl3073x_out and zl3073x_synth structures previously stored state that was parsed from register reads. This included values like boolean 'enabled' flags, synthesizer selections, and pre-calculated frequencies. This commit refactors the state management to store the raw register values directly in these structures. The various inline helper functions are updated to parse these raw values on-demand using FIELD_GET. Reviewed-by: Petr Oros Tested-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20251113074105.141379-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 5b8b343c5c989711ab1388ecc6bd8e5e5669ebe9 Merge: 28c0074fd4b79c 53e58437b47022 Author: Jakub Kicinski Date: Mon Nov 17 20:02:05 2025 -0800 Merge branch 's390-qeth-improve-handling-of-osa-rcs' Aswin Karuvally says: ==================== s390/qeth: Improve handling of OSA RCs This two patch series aims to improve how return codes from OSA Express are handled in the qeth driver. OSA defines a number of return codes whose meaning is determined by the issuing command, ie. they are ambiguous. The first patch moves definitions of all return codes including the ambiguous ones to a single enum block to aid readability and maintainability. The second patch implements a mechanism to interpret return codes based on the issuing command to ensure accurate debug messages. While at it, remove extern keyword and fix indentation for function declarations to be in line with Linux kernel coding style. ==================== Link: https://patch.msgid.link/20251113144209.2140061-1-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski commit 53e58437b470227b56478a17c6498bc26c03f65c Author: Aswin Karuvally Date: Thu Nov 13 15:42:09 2025 +0100 s390/qeth: Handle ambiguous OSA RCs in s390dbf OSA Express defines a number of return codes whose meaning is determined by the issuing command, making them ambiguous. The important ones are reported as debug messages through the s390 debug feature. The qeth driver currently does not take the issuing command into account when interpreting the return code which sometimes leads to incorrect debug messages. Implement a mechanism to interpret and report these return codes properly. While at it, remove extern keyword and fix indentation for function declarations to be in line with Linux kernel coding style. Suggested-by: Alexandra Winter Reviewed-by: Alexandra Winter Signed-off-by: Aswin Karuvally Link: https://patch.msgid.link/20251113144209.2140061-3-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski commit eef1f5ae73d17a770f1019b33566507f926a1377 Author: Aswin Karuvally Date: Thu Nov 13 15:42:08 2025 +0100 s390/qeth: Move all OSA RCs to single enum OSA Express defines a number of return codes whose meaning is determined by the issuing command, making them ambiguous. Move definitions of all return codes including the ambiguous ones to a single enum block to aid readability and maintainability. Reviewed-by: Alexandra Winter Signed-off-by: Aswin Karuvally Link: https://patch.msgid.link/20251113144209.2140061-2-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski commit 28c0074fd4b79c1bae561ca8ea2bfa6bb47a9f46 Author: Heiner Kallweit Date: Thu Nov 13 22:09:08 2025 +0100 r8169: bail out from probe if fiber mode is detected on RTL8127AF It was reported that on a card with RTL8127AF (SFP + DAC) link-up isn't detected. Realtek hides the SFP behind the internal PHY, which isn't behaving fully compliance with clause 22 any longer in fiber mode. Due to not having access to chip documentation there isn't much I can do for now. Instead of silently failing to detect link-up in fiber mode, inform the user that fiber mode isn't support and bail out. The logic to detect fiber mode is borrowed from Realtek's r8127 driver. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/fab6605a-54e2-4f54-b194-11c2b9caaaa9@gmail.com Signed-off-by: Jakub Kicinski commit e8c84b989f36881bbbef12c3e6d6694561a19c3a Merge: 6e90c767d5fcd8 db37c6e510deab Author: Jakub Kicinski Date: Mon Nov 17 19:57:41 2025 -0800 Merge branch 'net-stmmac-dwmac-sophgo-add-phy-interface-filter' Inochi Amaoto says: ==================== net: stmmac: dwmac-sophgo: Add phy interface filter As the SG2042 has an internal rx delay, the delay should be remove when init the mac, otherwise the phy will be misconfigurated. Since this delay fix is common for other MACs, add a common helper for it. And use it to fix SG2042. ==================== Link: https://patch.msgid.link/20251114003805.494387-1-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit db37c6e510deabc9b0ee27c08f1c5aaa19f2e8ef Author: Inochi Amaoto Date: Fri Nov 14 08:38:05 2025 +0800 net: stmmac: dwmac-sophgo: Add phy interface filter As the SG2042 has an internal rx delay, the delay should be removed when initializing the mac, otherwise the phy will be misconfigurated. Fixes: 543009e2d4cd ("net: stmmac: dwmac-sophgo: Add support for Sophgo SG2042 SoC") Signed-off-by: Inochi Amaoto Tested-by: Han Gao Reviewed-by: Andrew Lunn Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251114003805.494387-4-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 24afd7827efb7c69adfc41835390470e3eec4740 Author: Inochi Amaoto Date: Fri Nov 14 08:38:04 2025 +0800 net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay The "phy-mode" property of devicetree indicates whether the PCB has delay now, which means the mac needs to modify the PHY mode based on whether there is an internal delay in the mac. This modification is similar for many ethernet drivers. To simplify code, define the helper phy_fix_phy_mode_for_mac_delays(speed, mac_txid, mac_rxid) to fix PHY mode based on whether mac adds internal delay. Suggested-by: Russell King (Oracle) Signed-off-by: Inochi Amaoto Reviewed-by: Maxime Chevallier Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251114003805.494387-3-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 6b1aa3c87fcbf06b29b1a7123c386ad5cf2c8e9b Author: Inochi Amaoto Date: Fri Nov 14 08:38:03 2025 +0800 dt-bindings: net: sophgo,sg2044-dwmac: add phy mode restriction As the ethernet controller of SG2044 and SG2042 only supports RGMII phy. Add phy-mode property to restrict the value. Also, since SG2042 has internal rx delay in its mac, make only "rgmii-txid" and "rgmii-id" valid for phy-mode. Fixes: e281c48a7336 ("dt-bindings: net: sophgo,sg2044-dwmac: Add support for Sophgo SG2042 dwmac") Signed-off-by: Inochi Amaoto Acked-by: Conor Dooley Link: https://patch.msgid.link/20251114003805.494387-2-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 6e90c767d5fcd8a27bf7722e8463a163147274fa Merge: 2f2dee1696e29d be4f1d67ec56f2 Author: Jakub Kicinski Date: Mon Nov 17 19:52:34 2025 -0800 Merge branch 'net-mana-refactor-gf-stats-handling-and-add-rx_missed_errors-counter' Erni Sri Satya Vennela says: ==================== net: mana: Refactor GF stats handling and add rx_missed_errors counter Restructure mana_query_gf_stats() to operate on the per-VF mana_context, instead of per-port statistics. Introduce mana_ethtool_hc_stats to isolate hardware counter statistics and update the "ethtool -S " output to expose all relevant counters while preserving backward compatibility. Add support for the standard rx_missed_errors counter by mapping it to the hardware's hc_rx_discards_no_wqe metric. Refresh statistics every 2 seconds. ==================== Link: https://patch.msgid.link/1763120599-6331-1-git-send-email-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit be4f1d67ec56f23f37714ac73c01094e63c7ff28 Author: Erni Sri Satya Vennela Date: Fri Nov 14 03:43:19 2025 -0800 net: mana: Add standard counter rx_missed_errors Report standard counter stats->rx_missed_errors using hc_rx_discards_no_wqe from the hardware. Add a global workqueue to periodically run mana_query_gf_stats every 2 seconds to get the latest info in eth_stats and define a driver capability flag to notify hardware of the periodic queries. To avoid repeated failures and log flooding, the workqueue is not rescheduled if mana_query_gf_stats fails on HWC timeout error and the stats are reset to 0. Other errors are transient which will not need a VF reset for recovery. Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/1763120599-6331-3-git-send-email-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit e275d9091c01b3b46f3ec534ce4ac77cffc9e3ae Author: Erni Sri Satya Vennela Date: Fri Nov 14 03:43:18 2025 -0800 net: mana: Move hardware counter stats from per-port to per-VF context Move hardware counter (HC) statistics from mana_port_context to mana_context to enable sharing stats across multiple network ports on the same MANA VF. Previously, each network port queried hardware counters independently using MANA_QUERY_GF_STAT command (GF = Generic Function stats from GDMA hardware), resulting in redundant queries when multiple ports existed on the same device. Isolate hardware counter stats by introducing mana_ethtool_hc_stats in mana_context and update the code to ensure all stats are properly reported via ethtool -S , maintaining consistency with previous behavior. Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/1763120599-6331-2-git-send-email-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 2f2dee1696e29d837c87a70a3a44923d2ad6641b Merge: 7cf3ac8a9c0aee 6409249ccc152a Author: Jakub Kicinski Date: Mon Nov 17 19:48:00 2025 -0800 Merge branch 'net-stmmac-clean-up-plat_dat-allocation-initialisation' Russell King says: ==================== net: stmmac: clean up plat_dat allocation/initialisation This series cleans up the plat_dat allocation and initialisation, moving common themes into the allocator. This results in a nice saving: 7 files changed, 53 insertions(+), 148 deletions(-) ==================== Link: https://patch.msgid.link/aRdKVMPHXlIn457m@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6409249ccc152a3170cdd14f0f660d1d70046601 Author: Russell King (Oracle) Date: Fri Nov 14 15:29:15 2025 +0000 net: stmmac: remove unnecessary .pkt_route queue initialisation PCI drivers explicitly set .pkt_route to zero. However, as the struct is allocated using devm_kzalloc(), all members default to zero unless explicitly initialised. Thus, explicitly setting these to zero is unnecessary. Remove these. This leaves only stmmac_platform.c where this is explicitly initialised depending on DT properties. $ grep '\.pkt_route =' *.c dwmac-intel.c: plat->rx_queues_cfg[0].pkt_route = 0x0; dwmac-intel.c: plat->rx_queues_cfg[i].pkt_route = 0x0; dwmac-loongson.c: plat->rx_queues_cfg[0].pkt_route = 0x0; stmmac_main.c: if (priv->plat->rx_queues_cfg[queue].pkt_route == 0x0) stmmac_pci.c: plat->rx_queues_cfg[0].pkt_route = 0x0; stmmac_pci.c: plat->rx_queues_cfg[i].pkt_route = 0x0; stmmac_platform.c: plat->rx_queues_cfg[queue].pkt_route = PACKET_AVCPQ; stmmac_platform.c: plat->rx_queues_cfg[queue].pkt_route = PACKET_PTPQ; stmmac_platform.c: plat->rx_queues_cfg[queue].pkt_route = PACKET_DCBCPQ; stmmac_platform.c: plat->rx_queues_cfg[queue].pkt_route = PACKET_UPQ; stmmac_platform.c: plat->rx_queues_cfg[queue].pkt_route = PACKET_MCBCQ; stmmac_platform.c: plat->rx_queues_cfg[queue].pkt_route = 0x0; Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvjf-0000000EVkO-1ZaO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0a20999ed4521cd18348a3ca0a55f3406f879f7a Author: Russell King (Oracle) Date: Fri Nov 14 15:29:10 2025 +0000 net: stmmac: remove unnecessary .prio queue initialisation stmmac_platform.c explicitly sets .prio to zero if the snps,priority property is not present in DT for the queue. However, as the struct is allocated using devm_kzalloc(), all members default to zero unless explicitly initialised, and of_property_read_u32() will not write to its argument if the property is not found. Thus, explicitly setting these to zero is unnecessary. Remove these. $ grep '\.prio =' *.c stmmac_platform.c: plat->rx_queues_cfg[queue].prio = 0; stmmac_platform.c: plat->tx_queues_cfg[queue].prio = 0; Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvja-0000000EVkI-0zUH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c03101cb1bf020fb6897864afe2a63f54c65b778 Author: Russell King (Oracle) Date: Fri Nov 14 15:29:05 2025 +0000 net: stmmac: remove unnecessary .use_prio queue initialisation Several drivers (see below) explicitly set the queue .use_prio configuration to false. However, as this structure is allocated using devm_kzalloc(), all members default to zero unless otherwise explicitly initialised. .use_prio isn't, so defaults to false. Remove these unnecessary initialisations, leaving stmmac_platform.c as the only file that .use_prio is set true. $ grep 'use_prio =' *.c dwmac-intel.c: plat->tx_queues_cfg[0].use_prio = false; dwmac-intel.c: plat->rx_queues_cfg[0].use_prio = false; dwmac-intel.c: plat->rx_queues_cfg[i].use_prio = false; dwmac-intel.c: plat->tx_queues_cfg[i].use_prio = false; dwmac-loongson.c: plat->tx_queues_cfg[0].use_prio = false; dwmac-loongson.c: plat->rx_queues_cfg[0].use_prio = false; stmmac_pci.c: plat->tx_queues_cfg[0].use_prio = false; stmmac_pci.c: plat->rx_queues_cfg[0].use_prio = false; stmmac_pci.c: plat->tx_queues_cfg[i].use_prio = false; stmmac_pci.c: plat->rx_queues_cfg[i].use_prio = false; stmmac_platform.c: plat->rx_queues_cfg[queue].use_prio = false; stmmac_platform.c: plat->rx_queues_cfg[queue].use_prio = true; stmmac_platform.c: plat->tx_queues_cfg[queue].use_prio = false; stmmac_platform.c: plat->tx_queues_cfg[queue].use_prio = true; Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvjV-0000000EVkC-0WAV@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b6d013b3260be4c82a7ef9b1cb98b874b209a50c Author: Russell King (Oracle) Date: Fri Nov 14 15:29:00 2025 +0000 net: stmmac: setup default RX channel map in stmmac_plat_dat_alloc() Setup the default 1:1 RX channel map in stmmac_plat_dat_alloc() and remove 1:1 initialisations from platform glue drivers. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvjQ-0000000EVk6-05z7@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d5e788e86fe3dcbbe8fcad41663f7756f1eee1a3 Author: Russell King (Oracle) Date: Fri Nov 14 15:28:54 2025 +0000 net: stmmac: move initialisation of queues_to_use to stmmac_plat_dat_alloc() Move the default initialisation of plat_dat->tx_queues_to_use and plat_dat->rx_queues_to_use to 1 to stmmac_plat_dat_alloc(). This means platform glue only needs to override this if different. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvjK-0000000EVk0-3qb2@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bcb145c696903712a82a1234c6848f49188b9cd3 Author: Russell King (Oracle) Date: Fri Nov 14 15:28:49 2025 +0000 net: stmmac: move initialisation of unicast_filter_entries to stmmac_plat_dat_alloc() Move the default initialisation of plat_dat->unicast_filter_entries to 1 to stmmac_plat_dat_alloc(). This means platform glue only needs to override this if different. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvjF-0000000EVju-3LfS@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 07cedb9eed41067b059b4fe8149b5c60080add87 Author: Russell King (Oracle) Date: Fri Nov 14 15:28:44 2025 +0000 net: stmmac: move initialisation of multicast_filter_bins to stmmac_plat_dat_alloc() Move the default initialisation of plat_dat->multicast_filter_bins to HASH_TABLE_SIZE to stmmac_plat_dat_alloc(). This means platform glue only needs to override this if different. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvjA-0000000EVjo-2qVn@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 528478a746a514a542f769a93cc3f0b5b847fe27 Author: Russell King (Oracle) Date: Fri Nov 14 15:28:39 2025 +0000 net: stmmac: move initialisation of maxmtu to stmmac_plat_dat_alloc() Move the default initialisation of plat_dat->maxmtu to JUMBO_LEN to stmmac_plat_dat_alloc(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvj5-0000000EVji-2EYA@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ae4f29712bf3468111b9ca65b6ecd94c062cb98f Author: Russell King (Oracle) Date: Fri Nov 14 15:28:34 2025 +0000 net: stmmac: move initialisation of clk_csr to stmmac_plat_dat_alloc() Move the default initialisation of plat_dat->clk_csr to stmmac_plat_dat_alloc(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJvj0-0000000EVjb-1jDh@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 99e6ddaabdb4a4562d18eb7d2225f98801235904 Author: Russell King (Oracle) Date: Fri Nov 14 15:28:29 2025 +0000 net: stmmac: move initialisation of phy_addr to stmmac_plat_dat_alloc() Move the default initialisation of plat_dat->phy_addr to stmmac_plat_dat_alloc(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJviv-0000000EVjV-1CLF@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 511171e47f8bfd922ce76d10ce1487ae469cdfda Author: Russell King (Oracle) Date: Fri Nov 14 15:28:24 2025 +0000 net: stmmac: add stmmac_plat_dat_alloc() Add a function to allocate and initialise the plat_stmmacenet_data structure with default values. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJviq-0000000EVjP-0c0l@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7cf3ac8a9c0aeef2803018d3d371f886839d0b52 Author: Randy Dunlap Date: Sat Nov 15 23:09:59 2025 -0800 NFC: mei_phy: fix kernel-doc warnings Fix kernel-doc warnings in mei_phy.h to avoid build warnings and to improve and documentation: mei_phy.h:15: warning: missing initial short description on line: * struct nfc_mei_phy mei_phy.h:19: warning: bad line: Signed-off-by: Randy Dunlap Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251116070959.85055-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 95236dfce3345a9b8cbe02e6ec086608d6b57c1a Merge: ef3b682aca223f 89ae72f21be369 Author: Jakub Kicinski Date: Mon Nov 17 19:30:16 2025 -0800 Merge branch 'convert-drivers-to-use-ndo_hwtstamp-callbacks-part-4' Vadim Fedorenko says: ==================== convert drivers to use ndo_hwtstamp callbacks part 4 This patchset is a subset of part 3 patchset to convert bnx2x and qede drviers to use ndo callbacks instead ioctl to configure and report time stamping. These drivers implemented only SIOCSHWTSTAMP command, but converted to also provide configuration back to users. Some logic is changed to avoid reporting configuration which is not in sync with the HW in case of error happened. ==================== Link: https://patch.msgid.link/20251116094610.3932005-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 89ae72f21be369a3f245a65f3c44a0f4ffde55bd Author: Vadim Fedorenko Date: Sun Nov 16 09:46:10 2025 +0000 qede: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl cmd only, but it stores configuration in private structure, so it can be reported back to users. Implement both ndo_hwtstamp_set and ndo_hwtstamp_set callbacks. ndo_hwtstamp_set implements a check of unsupported 1-step timestamping and qede_ptp_cfg_filters() becomes void as it cannot fail anymore. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251116094610.3932005-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 889e6af87734389068fd924431f2141ddacad65e Author: Vadim Fedorenko Date: Sun Nov 16 09:46:09 2025 +0000 bnx2x: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl command only, but at the same time it has configuration stored in a private structure. Implement both ndo_hwtstamp_set and ndo_hwtstamp_get callback using stored info. ndo_hwtstamp_set callback implements a check for unsupported 1-step timestamping. The same check is removed from bnx2x_configure_ptp_filters function as it's not needed anymore. Another call site of bnx2x_configure_ptp_filters has hwtstamp_ioctl_called guard. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251116094610.3932005-2-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit ef3b682aca223ff903d1e488e5103270d1eef343 Merge: ca412f25d6b2c2 eea2f44870d297 Author: Jakub Kicinski Date: Mon Nov 17 19:28:03 2025 -0800 Merge branch 'selftests-mptcp-counter-cache-stats-before-timeout' Matthieu Baerts says: ==================== selftests: mptcp: counter cache & stats before timeout Here are a bunch of small improvements to the MPTCP selftests: - Patch 1: move code to mptcp_lib.sh to prepare the new features. - Patch 2: simplify mptcp_lib_pr_err_stats helper use. - Patch 3: remove unused last column from nstat output. - Patch 4: improve stats dump in mptcp_join.sh. - Patch 5: get counters from nstat history and simplify mptcp_connect.sh. - Patch 6: avoid taking the same packet trace twice. - Patch 7: wait for an event instead of a fix time. - Patch 8: instead of using 'timeout' and print the stats after, another internal timeout is used: if it fires, it will print stats, then stop everything. This avoids confusions around stats in case of timeout. ==================== Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-0-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit eea2f44870d297f0535944bf4dbf49d8b90c838e Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:12 2025 +0100 selftests: mptcp: get stats just before timing out Recently, some debugging happened around a test that was timing out. The stats were showing connections being closed which was confusing because the closing state was caused by the timeout stopping the transfer. To avoid such confusion, the timeout is no longer done per mptcp_connect process, but separately. In case of timeout, the stats are now printed, then the apps are killed. The stats will still be printed after the kill, but that's fine, and this might even be useful, just in case. Timeout should be exceptional. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-8-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit 39348f5f2f13c2da122b5049952066c2e802d3a0 Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:11 2025 +0100 selftests: mptcp: wait for port instead of sleep After having started mptcp_connect in listening mode, 'mptcp_lib_wait_local_port_listen' can be used to wait for the listening socket to be ready. This is better than using the 'sleep' command, not to pause for a fixed amount of time, but waiting for an event. This helper is used in all other MPTCP selftests, but not in these two. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-7-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit 8c1fe0a500519d21e9777433aa67d482862b2f3e Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:10 2025 +0100 selftests: mptcp: connect: avoid double packet traces When the same netns is used for the listener and the connector, no need to take exactly the same packet trace twice, one is enough. This avoids confusions when the traces are the same, and wasting resources which might not help reproducing an issue. While at it, avoid long lines and double spaces now that these lines are no longer aligned. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-6-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit 71388a9f331da20bab70e09bdf010f925ad7ce79 Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:09 2025 +0100 selftests: mptcp: lib: get counters from nstat history Before, 'nstat' was used to retrieve each individual counter: this means querying 4 different sources from /proc/net and iterating over 100+ counters each time. Instead, the stats could be retrieved once, and the output file could be parsed for each counter. Even better, such file is already present: the nstat history file. To be able to get this working, the nstat history file also needs to contains zero counters too, so it is still possible to know if a counter is missing or set to 0. This also simplifies mptcp_connect.sh: instead of checking multiple counters before and after a test to compute the difference, the stats history files can be reset before each test, and nstat can display only the difference. mptcp_lib_get_counter() continues to work when no history file is available: by fetching nstat directly, like before. This is the case in diag.sh and userspace_pm.sh where there is no need to save the history file. This is also the case in mptcp_join.sh, when 'run_tests' is executed in the background: easier to continue fetching counters than updating the history each time it is needed. Note: 'nstat' is called with '-s' in mptcp_lib_nstat_get(), so this helper can be called multiple times during the test if needed. Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-5-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit 658e531417801cd8d9aac630cee712e160ab5380 Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:08 2025 +0100 selftests: mptcp: join: dump stats from history In case of errors, dump the stats from history instead of using nstat. There are multiple advantages to that: - The same filters from pr_err_stats are used, e.g. the unused 'rate' column is not displayed. - The counters are closer to the ones from when the test stopped. - While at it, the errors can be better presented: error colours, a small indentation to distinguish the different parts, extra new lines. Even if it should only happen in rare cases -- internal errors, or netns issues -- if no history is available, 'nstat' is used like before, just in case. Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-4-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit 2e6daf6b9bc86e3fe0e3217def16aaaaf0924801 Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:07 2025 +0100 selftests: mptcp: lib: stats: remove nstat rate columns With the MPTCP selftests, the nstat daemon is not used. It means that the last column (the rate) is always 0.0, and that's not something interesting to display. Then, this last column can be filtered out. Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-3-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit a89fc262b6260c1ef69439a9fc233d84e58357d3 Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:06 2025 +0100 selftests: mptcp: lib: remove stats files args Now that these files are written from MPTCP lib helpers, the stats file paths are uniformed. Then, no need to specify them from the each selftest. No behavioural changes intended. Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-2-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit d3305c016a6a978688ca40422a539d0c46c59366 Author: Matthieu Baerts (NGI0) Date: Fri Nov 14 19:12:05 2025 +0100 selftests: mptcp: lib: introduce 'nstat_{init,get}' These new helpers are easier to read than the long and multi lines commands. Plus it will ease the addition of new features related to that in the next commits. No behavioural changes intended. Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251114-net-next-mptcp-sft-count-cache-stats-timeout-v1-1-863cb04e1b7b@kernel.org Signed-off-by: Jakub Kicinski commit d8d8a0b3603a9a8fa207cf9e4f292e81dc5d1008 Author: Ian Rogers Date: Thu Nov 13 10:05:13 2025 -0800 perf tool_pmu: More accurately set the cpus for tool events The user and system time events can record on different CPUs, but for all other events a single CPU map of just CPU 0 makes sense. In parse-events detect a tool PMU and then pass the perf_event_attr so that the tool_pmu can return CPUs specific for the event. This avoids a CPU map of all online CPUs being used for events like duration_time. Avoiding this avoids the evlist CPUs containing CPUs for which duration_time just gives 0. Minimizing the evlist CPUs can remove unnecessary sched_setaffinity syscalls that delay metric calculations. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit d702c0f4af6e065846e67ff89b34aec2cca7ffa7 Author: Ian Rogers Date: Thu Nov 13 10:05:12 2025 -0800 perf stat: Reduce scope of walltime_nsecs_stats walltime_nsecs_stats is no longer used for counter values, move into that stat_config where it controls certain things like noise measurement. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 557c34435b4492860452d6c0e8444320f8614f62 Author: Ian Rogers Date: Thu Nov 13 10:05:11 2025 -0800 perf stat: Reduce scope of ru_stats The ru_stats are used to capture user and system time stats when a process exits. These are then applied to user and system time tool events if their reads fail due to the process terminating. Reduce the scope now the metric code no longer reads these values. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 3d65f6445fd93e3eb4cb63a828c36625b4929abd Author: Ian Rogers Date: Thu Nov 13 10:05:10 2025 -0800 perf stat-shadow: Read tool events directly When reading time values for metrics don't use the globals updated in builtin-stat, just read the events as regular events. The only exception is for time events where nanoseconds need converting to seconds as metrics assume time metrics are in seconds. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit bdf96c4ecd69523d97c98e47284caddde20b1df7 Author: Ian Rogers Date: Thu Nov 13 10:05:09 2025 -0800 perf tool_pmu: Use old_count when computing count values for time events When running in interval mode every third count of a time event isn't showing properly: ``` $ perf stat -e duration_time -a -I 1000 1.001082862 1,002,290,425 duration_time 2.004264262 1,003,183,516 duration_time 3.007381401 duration_time 4.011160141 1,003,705,631 duration_time 5.014515385 1,003,290,110 duration_time 6.018539680 duration_time 7.022065321 1,003,591,720 duration_time ``` The regression came in with a different fix, found through bisection, commit 68cb1567439f ("perf tool_pmu: Fix aggregation on duration_time"). The issue is caused by the enabled and running time of the event matching the old_count's and creating a delta of 0, which is indicative of an error. Fixes: 68cb1567439f ("perf tool_pmu: Fix aggregation on duration_time") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit f69d34e8f23db8bca38c82a04ee9cd990777aaa2 Author: Ian Rogers Date: Thu Nov 13 10:05:08 2025 -0800 perf pmu: perf_cpu_map__new_int to avoid parsing a string Prefer perf_cpu_map__new_int(0) to perf_cpu_map__new("0") as it avoids strings parsing. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit af9e8d12b139c92e748eb2956bbef03315ea7516 Author: Ian Rogers Date: Thu Nov 13 10:05:07 2025 -0800 libperf cpumap: Reduce allocations and sorting in intersect On hybrid platforms the CPU maps are often disjoint. Rather than copy CPUs and trim, compute the number of common CPUs, if none early exit, otherwise copy in an sorted order. This avoids memory allocation in the disjoint case and avoids a second malloc and useless sort in the previous trim cases. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c453d9c5bb8aa1510078a53eef37ea437c21ab07 Author: Zenm Chen Date: Mon Nov 17 07:44:03 2025 +0800 wifi: rtw89: Add default ID 0bda:b831 for RTL8831BU Add 0bda:b831 for RTL8831BU-based adapters that use this default ID. Tested with TOTOLINK X900USM in station mode very briefly. Signed-off-by: Zenm Chen Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251116234403.8803-1-zenmchen@gmail.com commit 9b5b9c042b30befc5b37e4539ace95af70843473 Author: Abdun Nihaal Date: Fri Nov 14 15:15:26 2025 +0530 wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit. Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the freed priv->rx_buf entry to null, to avoid double free. Fixes: f653211197f3 ("Add rtl8180 wireless driver") Signed-off-by: Abdun Nihaal Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114094527.79842-1-nihaal@cse.iitm.ac.in commit c8d212fa81c5e0cad15655918b5fb8fcf6e6fe57 Author: Ping-Ke Shih Date: Thu Nov 13 13:34:59 2025 +0800 wifi: rtw89: use separated function to set RX filter Normally use rtw89_write32_mask() with a consecutive bit mask, but mask of RX filter B_AX_RX_FLTR_CFG_MASK is bits 31-22 and 15-0, which excludes bits of B_AX_RX_MPDU_MAX_LEN_MASK (bits 21-16). Though the original logic is well to set RX filter, change it to a separate function to avoid the tricky design. Cc: Geert Uytterhoeven Signed-off-by: Ping-Ke Shih Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251113053459.34995-1-pkshih@realtek.com commit 289815011c91dc6532d3fff7ca1c5f0bea08b474 Author: Ian Rogers Date: Wed Nov 12 11:53:11 2025 -0800 perf stat: Display metric-only for 0 counters 0 counters may occur in hypervisor settings but metric-only output is always expected. This resolves an issue in the "perf stat STD output linter" test. Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Signed-off-by: Namhyung Kim commit 09afd209a84421948ac9bf2076459a0418e102ec Author: Chih-Kang Chang Date: Fri Nov 14 14:01:28 2025 +0800 wifi: rtw89: correct user macid mask of RX info for RTL8922D The user MAC ID mask of RX info in MAC PPDU for RTL8922A and RTL8922D is different, correct it accordingly. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-15-pkshih@realtek.com commit 9dab26b9fa457ee538be650ca0bddf352c059e79 Author: Chih-Kang Chang Date: Fri Nov 14 14:01:27 2025 +0800 wifi: rtw89: update format of addr cam H2C command The addr cam H2C command is to tell firmware the addr related info. For RTL8922D and RTL8922A after firmware version 0.35.84.0, the addr cam must be updated with update mode to avoid clearing previously set fields. Update it accordingly. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-14-pkshih@realtek.com commit fc2e8c873f4620f07a34f1acd5697187c3ca8a8c Author: Ping-Ke Shih Date: Fri Nov 14 14:01:26 2025 +0800 wifi: rtw89: add addr cam H2C command v1 The coming RTL8922D uses different format of address CAM command, so add the new format accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-13-pkshih@realtek.com commit 239dd70d776cf94f39000740b307c91e4f72d615 Author: Ping-Ke Shih Date: Fri Nov 14 14:01:25 2025 +0800 wifi: rtw89: fill addr cam H2C command by struct The addr cam is used to tell firmware the MAC address and BSSID associated to connected stations. Use struct instead of macros with pointer arithmetic to fill the data. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-12-pkshih@realtek.com commit aa8d1a8805bb892f01283e168afbb58462f4a94c Author: Ping-Ke Shih Date: Fri Nov 14 14:01:24 2025 +0800 wifi: rtw89: align RA H2C format v1 for RTL8922A For RTL8922A, the bits [16:31] of word 3 of v1 format isn't as WiFi 6 chips. Instead, it only needs to fill additional band type and partial bandwidth ER. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-11-pkshih@realtek.com commit 1c2ada09628b6c3de539d45015c62f10f1f00a59 Author: Ping-Ke Shih Date: Fri Nov 14 14:01:23 2025 +0800 wifi: rtw89: fw: print band and port where beacon update on The C2H event of BCN_UPD_DONE is to notify driver that firmware changes beacon content on certain band/port asked by driver. Print the notification for debug purpose for now. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-10-pkshih@realtek.com commit 5607a141bf283960326f44780b65ab607467a14c Author: Ping-Ke Shih Date: Fri Nov 14 14:01:22 2025 +0800 wifi: rtw89: phy: ignore DCFO if not defined in chip_info For WiFi 7 chips, DCFO (digital carrier frequency offset) feature isn't supported, so the corresponding registers aren't defined in chip_info. Check and ignore this feature accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-9-pkshih@realtek.com commit 9df55e8d41aa6943846d526487a674316c06e307 Author: Ping-Ke Shih Date: Fri Nov 14 14:01:21 2025 +0800 wifi: rtw89: phy: consider type 15 in BB gain table BB gain table is a table to configure gain for certain channels. Newly added type 15 is considered to write registers accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-8-pkshih@realtek.com commit 7fefea11001d5f5cf948a069f5f2cecc8fa5633f Author: Ping-Ke Shih Date: Fri Nov 14 14:01:20 2025 +0800 wifi: rtw89: mac: update wcpu_on to download firmware for RTL8922D The RTL8922D does more settings before downloading firmware, so add them accordingly. Also, update the missed settings for RTL8922A. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-7-pkshih@realtek.com commit d375434cbceae79f841ecb0739ae6f5174b968e2 Author: Ping-Ke Shih Date: Fri Nov 14 14:01:19 2025 +0800 wifi: rtw89: mac: remove undefined bit B_BE_PPDU_MAC_INFO The bit is defined during test chip development, but formal chips don't have this. Remove it. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-6-pkshih@realtek.com commit 12e84effcb6d6d2a58e03cb237c1100c817dd479 Author: Ping-Ke Shih Date: Fri Nov 14 14:01:18 2025 +0800 wifi: rtw89: phy: calling BB pre-init by chips with/without BB MCU The existing flow is doing BB pre-init before downloading BB MCU firmware, because existing chip RTL8922A has BB MCU. However, the coming chips don't have this, and BB pre-init configuring registers can affect downloading WiFi-CPU firmware. Therefore, calling BB pre-init afterward for new coming chips without BB MCU. For existing WiFi 6 chips, no BB pre-init. For RTL8922A, don't change the logic. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-5-pkshih@realtek.com commit af5eb17ff893bf6e52680a31059e1816749c2d20 Author: Zixian Zeng Date: Tue Sep 16 21:22:53 2025 +0800 riscv: dts: sophgo: Enable SPI NOR node for SG2042_EVB_V2 Enable SPI NOR node for SG2042_EVB_V2 device tree According to SG2042_EVB_V2 schematic, SPI-NOR Flash cannot support QSPI due to hardware design. Thus spi-(tx|rx)-bus-width must be set to 1. Signed-off-by: Han Gao Signed-off-by: Zixian Zeng Link: https://lore.kernel.org/r/20250916-sfg-spidts-v2-4-b5d9024fe1c8@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 11f4d84c9f724ec4c6810567d6b9713b054bb28b Author: Zixian Zeng Date: Tue Sep 16 21:22:52 2025 +0800 riscv: dts: sophgo: Enable SPI NOR node for SG2042_EVB_V1 Enable SPI NOR node for SG2042_EVB_V1 device tree According to SG2042_EVB_V1 schematic, SPI-NOR Flash cannot support QSPI due to hardware design. Thus spi-(tx|rx)-bus-width must be set to 1. Signed-off-by: Han Gao Signed-off-by: Zixian Zeng Link: https://lore.kernel.org/r/20250916-sfg-spidts-v2-3-b5d9024fe1c8@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit f49314cbbc98f9ab2bf4eb82ccacbf79f179db6c Author: Zixian Zeng Date: Tue Sep 16 21:22:51 2025 +0800 riscv: dts: sophgo: Enable SPI NOR node for PioneerBox Enable SPI NOR node for PioneerBox device tree According to PioneerBox schematic, SPI-NOR Flash cannot support QSPI due to hardware design. Thus spi-(tx|rx)-bus-width must be set to 1. Reviewed-by: Chen Wang Tested-by: Chen Wang Signed-off-by: Zixian Zeng Link: https://lore.kernel.org/r/20250916-sfg-spidts-v2-2-b5d9024fe1c8@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 59dc89fdfe0bbcce186116651bd017cfb9f70fc0 Author: Zixian Zeng Date: Tue Sep 16 21:22:50 2025 +0800 riscv: dts: sophgo: Add SPI NOR node for SG2042 Add SPI NOR controller node for SG2042 Reviewed-by: Chen Wang Tested-by: Chen Wang Signed-off-by: Zixian Zeng Link: https://lore.kernel.org/r/20250916-sfg-spidts-v2-1-b5d9024fe1c8@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit a2a64fe2346374940c8e8953b42c73983a84559b Author: Ping-Ke Shih Date: Fri Nov 14 14:01:17 2025 +0800 wifi: rtw89: mac: separate pre-init code before downloading firmware Driver needs to initialize registers before downloading firmware, so move pre-init part (power on) from original rtw89_mac_init(). The consequence patches will add more pre-init codes before downloading firmware. Since rtw89_phy_init_bb_afe() is used by coming RTL8922D, don't change logic at all for existing chips. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-4-pkshih@realtek.com commit 92db331de6de948f4308ab4c80ddbe7ae27f39bb Author: Ping-Ke Shih Date: Fri Nov 14 14:01:16 2025 +0800 wifi: rtw89: fw: part size to download firmware by header info The part size is the unit to download firmware piece by piece. Old chips use 2020 bytes as a piece, but in new chips the part size is defined in firmware header. Change to use the value dynamically. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-3-pkshih@realtek.com commit 3a12581fc292997f5ca6dafe3238afd39b77e798 Author: Chih-Kang Chang Date: Fri Nov 14 14:01:15 2025 +0800 wifi: rtw89: flush TX queue before deleting key In the wpa_supplicant rekey flow, it sends an EAPOL packet 4/4 through nl80211_tx_control_port() and triggers wake_tx_queue() in the driver. Then, it sends nl80211_new_key() to configure a new key in mac80211. However, in wake_tx_queue(), a workqueue is used to process the TX packet, which might cause the driver to process the EAPOL packet later than nl80211_new_key(). This results in the EAPOL packet 4/4 being transmitted with the new key and IV, causing it to be dropped by the AP. Therefore, needs to flush TX queue before deleting the old key to ensure that the EAPOL 4/4 packet is transmitted using the old key. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251114060128.35363-2-pkshih@realtek.com commit ca412f25d6b2c21f69a6cf12da062e0be4a5f45e Author: Eric Dumazet Date: Fri Nov 14 13:51:41 2025 +0000 tcp: reduce tcp_comp_sack_slack_ns default value to 10 usec net.ipv4.tcp_comp_sack_slack_ns current default value is too high. When a flow has many drops (1 % or more), and small RTT, adding 100 usec before sending SACK stalls the sender relying on getting SACK fast enough to keep the pipe busy. Decrease the default to 10 usec. This is orthogonal to Congestion Control heuristics to determine if drops are caused by congestion or not. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251114135141.3810964-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5860bb1ce0ddb9c5c964f7b46a8f0c4a48f919b1 Author: Heiner Kallweit Date: Wed Nov 12 22:06:13 2025 +0100 net: phy: fixed_phy: remove setting supported/advertised modes from fixed_phy_register This code was added with 34b31da486a5 ("phy: fixed_phy: Set supported speed in phydev") 10 yrs ago. The commit message of this change mentions a use case involving callback adjust_link of struct dsa_switch_driver. This struct doesn't exist any longer, and in general usage of the legacy fixed PHY has been removed from DSA with the switch to phylink. Note: Supported and advertised modes are now set by phy_probe() when the fixed PHY is attached to the netdev and bound to the genphy driver. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/3abaa3c5-fbb9-4052-9346-6cb096a25878@gmail.com Signed-off-by: Jakub Kicinski commit 40ea40853da9c3fa03d52c2998998d103b80f593 Author: Jakub Kicinski Date: Sat Nov 15 14:55:08 2025 -0800 tools: ynltool: remove -lmnl from link flags The libmnl dependency has been removed from libynl back in commit 73395b43819b ("tools: ynl: remove the libmnl dependency") Remove it from the ynltool Makefile. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20251115225508.1000072-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0135333914d63181f823bd340ae96737c8a820ca Author: Mohsin Bashir Date: Thu Nov 13 15:26:10 2025 -0800 eth: fbnic: Configure RDE settings for pause frame fbnic supports pause frames. When pause frames are enabled presumably user expects lossless operation from the NIC. Make sure we configure RDE (Rx DMA Engine) to DROP_NEVER mode to avoid discards due to delays in fetching Rx descriptors from the host. While at it enable DROP_NEVER when NIC only has a single queue configured. In this case the NIC acts as a FIFO so there's no risk of head-of-line blocking other queues by making RDE wait. If pause is disabled this just moves the packet loss from the DMA engine to the Rx buffer. Remove redundant call to fbnic_config_drop_mode_rcq(), introduced by commit 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free"). This call does not add value as fbnic_enable_rcq(), which is called immediately afterward, already handles this. Although we do not support autoneg at this time, preserve tx_pause in .mac_link_up instead of fbnic_phylink_get_pauseparam() Signed-off-by: Mohsin Bashir Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251113232610.1151712-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 122ac16b8c95423da011e4c07a818138cb297ed9 Merge: c9dfb92de0738e 945499665f6319 Author: Jakub Kicinski Date: Mon Nov 17 16:20:10 2025 -0800 Merge branch 'net-mlx-migrate-to-new-get_rx_ring_count-ethtool-api' Breno Leitao says: ==================== net: mlx: migrate to new get_rx_ring_count ethtool API This series migrates the mlx4 and mlx5 drivers to use the new .get_rx_ring_count() callback introduced in commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries"). Previously, these drivers handled ETHTOOL_GRXRINGS within the .get_rxnfc() callback. With the dedicated .get_rx_ring_count() API, this handling can be extracted and simplified. For mlx5, this affects both the ethernet and IPoIB drivers. The ETHTOOL_GRXRINGS handling was previously kept in .get_rxnfc() to support "ethtool -x" when CONFIG_MLX5_EN_RXNFC=n, but this is no longer necessary with the new dedicated callback. Note: The mlx4 changes are compile-tested only, while mlx5 changes were properly tested. ==================== Link: https://patch.msgid.link/20251113-mlx_grxrings-v1-0-0017f2af7dd0@debian.org Signed-off-by: Jakub Kicinski commit 945499665f63197801b64fabb0bccf9d15ed09bf Author: Breno Leitao Date: Thu Nov 13 08:46:04 2025 -0800 mlx5: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count() for both the mlx5 ethernet and IPoIB drivers. The ETHTOOL_GRXRINGS handling was previously kept in .get_rxnfc() to support "ethtool -x" when CONFIG_MLX5_EN_RXNFC=n. With the new dedicated .get_rx_ring_count() callback, this is no longer necessary. This simplifies the RX ring count retrieval and aligns mlx5 with the new ethtool API for querying RX ring parameters. Signed-off-by: Breno Leitao Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20251113-mlx_grxrings-v1-2-0017f2af7dd0@debian.org Signed-off-by: Jakub Kicinski commit 467c3f008d0cafe8c21af7ad9f3036c1a15ec13d Author: Breno Leitao Date: Thu Nov 13 08:46:03 2025 -0800 mlx4: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). This simplifies the RX ring count retrieval and aligns mlx4 with the new ethtool API for querying RX ring parameters. This is compiled tested only. Signed-off-by: Breno Leitao Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20251113-mlx_grxrings-v1-1-0017f2af7dd0@debian.org Signed-off-by: Jakub Kicinski commit b43652d867cf2a5f31b14e3d9a320ad01fca0992 Author: Yicong Yang Date: Mon Nov 17 10:47:55 2025 +0000 memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() Extend cpu_cache_invalidate_memregion() to support invalidating a particular range of memory by introducing start and length parameters. Control of types of invalidation is left for when use cases turn up. For now everything is Clean and Invalidate. Where the range is unknown, use the provided cpu_cache_invalidate_all() helper to act as documentation of intent in a fashion that is clearer than passing (0, -1) to cpu_cache_invalidate_memregion(). Signed-off-by: Yicong Yang Reviewed-by: Dan Williams Acked-by: Davidlohr Bueso Signed-off-by: Jonathan Cameron Signed-off-by: Conor Dooley commit f49ae86483c494ddc793d889f6df5ea68d138569 Author: Jonathan Cameron Date: Mon Nov 17 10:47:54 2025 +0000 memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() The res_desc parameter was originally introduced for documentation purposes and with the idea that with HDM-DB CXL invalidation could be triggered from the device. That has not come to pass and the continued existence of the option is confusing when we add a range in the following patch which might not be a strict subset of the res_desc. So avoid that confusion by dropping the parameter. Link: https://lore.kernel.org/linux-mm/686eedb25ed02_24471002e@dwillia2-xfh.jf.intel.com.notmuch/ Reviewed-by: Dan Williams Suggested-by: Dan Williams Signed-off-by: Jonathan Cameron Signed-off-by: Conor Dooley commit d52341da4db0cd993d3549aa20cbdf063b412c3b Author: Pierre-Henry Moussay Date: Mon Nov 17 14:24:37 2025 +0000 dt-bindings: cache: sifive,ccache0: add a pic64gx compatible The pic64gx use the same IP than mpfs, therefore add compatibility with mpfs as fallback. Signed-off-by: Pierre-Henry Moussay Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit bd4928ec799b31c492eb63f9f4a0c1e0bb4bb3f7 Author: Trond Myklebust Date: Mon Nov 17 15:28:17 2025 -0500 NFS: Avoid changing nlink when file removes and attribute updates race If a file removal races with another operation that updates its attributes, then skip the change to nlink, and just mark the attributes as being stale. Reported-by: Aiden Lambert Fixes: 59a707b0d42e ("NFS: Ensure we revalidate the inode correctly after remove or rename") Signed-off-by: Trond Myklebust commit e4addc7cc2dfcc19f1c8c8e47f3834b22cb21559 Author: Markus Probst Date: Mon Oct 27 20:06:03 2025 +0000 rust: Add trait to convert a device reference to a bus device reference Implement the `AsBusDevice` trait for converting a `Device` reference to a bus device reference for all bus devices. The `AsBusDevice` trait allows abstractions to provide the bus device in class device callbacks. It must not be used by drivers and is intended for bus and class device abstractions only. Signed-off-by: Markus Probst Link: https://patch.msgid.link/20251027200547.1038967-2-markus.probst@posteo.de [ * Remove unused import. * Change visibility of AsBusDevice to public. * Fix build for USB. * Add impl for I2cClient. - Danilo ] Signed-off-by: Danilo Krummrich commit 90f3df4fdfb682e2394ee3f97dfe91a402d5c46a Author: Alexandre Courbot Date: Sat Nov 8 11:23:47 2025 +0900 rust: add num module and Integer trait Introduce the `num` module, which will provide numerical extensions and utilities for the kernel. For now, introduce the `Integer` trait, which is implemented for all primitive integer types to provides their core properties to generic code. Signed-off-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251108-bounded_ints-v4-1-c9342ac7ebd1@nvidia.com Signed-off-by: Miguel Ojeda commit e5d330e13f67d574f683c052c9a342814fd8fa39 Author: Miguel Ojeda Date: Mon Nov 17 09:07:13 2025 +0100 rust: allow `clippy::disallowed_names` for doctests Examples (i.e. doctests) may want to use names such as `foo`, thus the `clippy::disallowed_names` lint [1] gets in the way. Thus allow it for all doctests. In addition, remove it from the existing `expect`s we have in a few doctests. This does not mean that we should stop trying to find good names for our examples, though. Link: https://rust-lang.github.io/rust-clippy/stable/index.html#disallowed_names [1] Suggested-by: Alice Ryhl Link: https://lore.kernel.org/rust-for-linux/aRHSLChi5HYXW4-9@google.com/ Reviewed-by: Alice Ryhl Acked-by: Benno Lossin Link: https://patch.msgid.link/20251117080714.876978-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 048213a38e7ac1591f725e370c152cc80dd84105 Author: Heiko Stuebner Date: Tue Oct 21 09:42:48 2025 +0200 soc: rockchip: grf: Add select correct PWM implementation on RK3368 Similar to the RK3288, the RK3368 has two different implementations of the PWM block inside the SoC - the newer ones that we have a driver for and that is used on every SoC and a previous variant that was likely left as a fallback if the new one creates problems. The devicetree is already set up for the new variant, so make sure we actually use it - similar to the RK3288. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251021074254.87065-4-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 13ae55e24a854efd33eb84bbd19a74b933228ccd Author: Igor Korotin Date: Sun Nov 16 16:22:10 2025 +0000 samples: rust: add Rust I2C client registration sample Add a new `rust_i2c_client` sample, showing how to create a new i2c client using `i2c::Registration` Acked-by: Wolfram Sang Signed-off-by: Igor Korotin Link: https://patch.msgid.link/20251116162210.171542-1-igor.korotin.linux@gmail.com [ * Remove dependency to I2C_CHARDEV, depend on I2C=y. * Remove unnecessary impl Drop for SampleDriver. * Rename i2c::Registration, import Devres. * Fixup module description. * Add new source file to MAINTAINERS. - Danilo ] Signed-off-by: Danilo Krummrich commit d05b8e97690fa19be39f0af03e7f117f601b6319 Author: Igor Korotin Date: Sun Nov 16 16:22:04 2025 +0000 samples: rust: add Rust I2C sample driver Add a new `rust_driver_i2c` sample, showing how to create a new i2c driver using ACPI/OF/Legacy ID tables. Acked-by: Wolfram Sang Signed-off-by: Igor Korotin Link: https://patch.msgid.link/20251116162204.171518-1-igor.korotin.linux@gmail.com Signed-off-by: Danilo Krummrich commit f3cc26a417b77a07ff4418f7621dd318a1c533b1 Author: Igor Korotin Date: Sun Nov 16 16:21:54 2025 +0000 rust: i2c: add manual I2C device creation abstractions In addition to the basic I2C device support, add rust abstractions upon `i2c_new_client_device`/`i2c_unregister_device` C functions. Implement the core abstractions needed for manual creation/deletion of I2C devices, including: * `i2c::Registration` — a NonNull pointer created by the function `i2c_new_client_device` * `i2c::I2cAdapter` — a ref counted wrapper around `struct i2c_adapter` * `i2c::I2cBoardInfo` — a safe wrapper around `struct i2c_board_info` Acked-by: Wolfram Sang Signed-off-by: Igor Korotin Link: https://patch.msgid.link/20251116162154.171493-1-igor.korotin.linux@gmail.com [ Remove unnecessary safety comment. - Danilo ] Signed-off-by: Danilo Krummrich commit 57c5bd9aee944b0f5c2ab314e10a86fae51f7bf2 Author: Igor Korotin Date: Sun Nov 16 16:21:44 2025 +0000 rust: i2c: add basic I2C device and driver abstractions Implement the core abstractions needed for I2C drivers, including: * `i2c::Driver` — the trait drivers must implement, including `probe` * `i2c::I2cClient` — a safe wrapper around `struct i2c_client` * `i2c::Adapter` — implements `driver::RegistrationOps` to hook into the generic `driver::Registration` machinery * `i2c::DeviceId` — a `RawDeviceIdIndex` implementation for I2C device IDs Acked-by: Wolfram Sang Signed-off-by: Igor Korotin Link: https://patch.msgid.link/20251116162144.171469-1-igor.korotin.linux@gmail.com [ Remove unnecessary safety comment; fix rustdoc `Device` -> `I2cClient`. - Danilo ] Signed-off-by: Danilo Krummrich commit f3a1d69f9b388271986f4efe1fd775df15b443c1 Merge: fd1a11ea111b08 ccd3b4c7c37fbb Author: Dave Airlie Date: Tue Nov 18 06:58:01 2025 +1000 Merge tag 'amd-drm-next-6.19-2025-11-14' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.19-2025-11-14: amdgpu: - RAS updates - GC12 DCC P2P fix - Documentation fixes - Power limit code cleanup - Userq updates - VRR fix - SMART OLED support - DSC refactor for DCN 3.5 - Replay updates - DC clockgating updates - HDCP refactor - ISP fix - SMU 13.0.12 updates - JPEG 5.0.1 fix - VCE1 support - Enable DC by default on SI - Refactor CIK and SI enablement - Enable amdgpu by default for CI dGPUs - XGMI fixes - SR-IOV fixes - Memory allocation critical path fixes - Enable amdgpu by default on SI dGPUs amdkfd: - Relax checks on save area overallocations - Fix GPU mappings after prefetch radeon: - Refactor CIK and SI enablement Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251114192553.442621-1-alexander.deucher@amd.com commit fd1a11ea111b083aa3d19f36516ecda5efa2b69f Merge: f88f3575bc9099 3bcf7894a93e18 Author: Dave Airlie Date: Tue Nov 18 06:52:08 2025 +1000 Merge tag 'drm-intel-gt-next-2025-11-14' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: Fixes/improvements/new stuff: - Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD (Janusz Krzysztofik) - Use standard API for seqcount read in TLB invalidation [gt] (Andi Shyti) Miscellaneous: - Wait longer for threads in migrate selftest on CHV/BXT+VTD (Janusz Krzysztofik) - Wait for page_sizes_gtt in gtt selftest on CHV/BXT+VTD (Janusz Krzysztofik) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patch.msgid.link/aRdXOAKlTVX_b0en@linux commit cfa3c76e059a2ed134f8da4ab8d2f46e3582b94e Author: Andy Shevchenko Date: Fri Nov 14 19:52:01 2025 +0100 PCI: stm32: Don't use 'proxy' headers Update header inclusions to follow IWYU (Include What You Use) principle. In particular, replace of_gpio.h, which is subject to removal by the GPIOLIB subsystem, with the respective headers that are being used by the driver. Signed-off-by: Andy Shevchenko Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251114185534.3287497-1-andriy.shevchenko@linux.intel.com commit ff529a9307a03ec03ed9751da053b57149300053 Author: Christian Bruel Date: Fri Nov 14 09:08:05 2025 +0100 PCI: stm32: Fix EP page_size alignment pci_epc_mem_alloc_addr() allocates a CPU address from the ATU window phys base and a page number. Set the ep->page_size so the resulting CPU address is correctly aligned with the ATU required alignment. Fixes: 151f3d29baf4 ("PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25") Signed-off-by: Christian Bruel [mani: added fixes tag] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251114-atu_align_ep-v1-1-88da5366fa04@foss.st.com commit fa81d6099007728cae39c6f937d83903bbddab5e Author: Christian Bruel Date: Fri Nov 14 08:45:52 2025 +0100 PCI: stm32: Fix LTSSM EP race with start link If the host has deasserted PERST# and started link training before the link is started on EP side, enabling LTSSM before the endpoint registers are initialized in the perst_irq handler results in probing incorrect values. Thus, wait for the PERST# level-triggered interrupt to start link training at the end of initialization and cleanup the stm32_pcie_[start stop]_link functions. Fixes: 151f3d29baf4 ("PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25") Signed-off-by: Christian Bruel [mani: added fixes tag] Signed-off-by: Manivannan Sadhasivam [bhelgaas: wrap line] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251114-perst_ep-v1-1-e7976317a890@foss.st.com commit a0245b42f881be6f0ddf678ce7a0d150362938c8 Author: Mark Brown Date: Wed Oct 15 18:56:38 2025 +0100 kselftest/arm64: Cover disabling streaming mode without SVE in fp-ptrace On a system which support SME but not SVE we can now disable streaming mode via ptrace by writing FPSIMD formatted data through NT_ARM_SVE with a VL of 0. Extend fp-ptrace to cover rather than skip these cases, relax the check for SVE writes of FPSIMD format data to not skip if SME is supported and accept 0 as the VL when performing the ptrace write. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit eb9df6d69a96717fa9320c8d2be8e0033695f353 Author: Mark Brown Date: Wed Oct 15 18:56:37 2025 +0100 kselftst/arm64: Test NT_ARM_SVE FPSIMD format writes on non-SVE systems In order to allow exiting streaming mode on systems with SME but not SVE we allow writes of FPSIMD format data via NT_ARM_SVE even when SVE is not supported, add a test case that covers this to sve-ptrace. We do not support reads. Signed-off-by: Mark Brown Signed-off-by: Catalin Marinas commit 472800cd5e382ff69c4f9d4179580ed46ab0a436 Author: Mark Brown Date: Wed Oct 15 18:56:36 2025 +0100 arm64/sme: Support disabling streaming mode via ptrace on SME only systems Currently it is not possible to disable streaming mode via ptrace on SME only systems, the interface for doing this is to write via NT_ARM_SVE but such writes will be rejected on a system without SVE support. Enable this functionality by allowing userspace to write SVE_PT_REGS_FPSIMD format data via NT_ARM_SVE with the vector length set to 0 on SME only systems. Such writes currently error since we require that a vector length is specified which should minimise the risk that existing software is relying on current behaviour. Reads are not supported since I am not aware of any use case for this and there is some risk that an existing userspace application may be confused if it reads NT_ARM_SVE on a system without SVE. Existing kernels will return FPSIMD formatted register state from NT_ARM_SVE if full SVE state is not stored, for example if the task has not used SVE. Returning a vector length of 0 would create a risk that software would try to do things like allocate space for register state with zero sizes, while returning a vector length of 128 bits would look like SVE is supported. It seems safer to just not make the changes to add read support. It remains possible for userspace to detect a SME only system via the ptrace interface only since reads of NT_ARM_SSVE and NT_ARM_ZA will succeed while reads of NT_ARM_SVE will fail. Read/write access to the FPSIMD registers in non-streaming mode is available via REGSET_FPR. sve_set_common() already avoids allocating SVE storage when doing a FPSIMD formatted write and allocating SME storage when doing a NT_ARM_SVE write so we change the function to validate the new case and skip setting a vector length for it. The aim is to make a minimally invasive change, no operation that would previously have succeeded will be affected, and we use a previously defined interface in new circumstances rather than define completely new ABI. Signed-off-by: Mark Brown Reviewed-by: David Spickett Signed-off-by: Catalin Marinas commit f88f3575bc9099395232fa85da91c51f2861d582 Merge: 490fd9336650a3 b84befa3126634 Author: Dave Airlie Date: Tue Nov 18 05:55:51 2025 +1000 Merge tag 'drm-intel-next-2025-11-14' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull #2 for v6.19: Features and functionality: - Add initial display support for Xe3p_LPD, display version 35 (Sai Teja, Matt R, Gustavo, Matt A, Ankit, Juha-pekka, Luca, Ravi Kumar) - Compute LT PHY HDMI params when port clock not in predefined tables (Suraj) Refactoring and cleanups: - Refactor intel_frontbuffer split between i915, xe, and display (Ville) - Clean up intel_de_wait_custom() usage (Ville) - Unify display register polling interfaces (Ville) - Finish removal of the expensive format info lookups (Ville) - Cursor code cleanups (Ville) - Convert intel_rom interfaces to struct drm_device (Jani) Fixes: - Fix uninitialized variable in DSI exec packet (Jonathan) - Fix PIPEDMC logging (Alok Tiwari) - Fix PSR pipe to vblank conversion (Jani) - Fix intel_frontbuffer lifetime handling (Ville) - Disable Panel Replay on DP MST for the time being (Imre) Merges: - Backmerge drm-next to get the drm_print.h changes (Jani) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/b131309bb7310ab749f1770aa6e36fa8d6a82fa5@intel.com commit 46fc75a29b7034d1971afcbdf47b88926a46b1ea Author: Sunday Adelodun Date: Fri Nov 14 23:04:38 2025 +0100 PM: hibernate: Clean up kernel-doc comment style usage Several static functions in kernel/power/swap.c were described using the kernel-doc comment style (/** ... */) even though they are not exported or referenced by generated documentation. This led to kernel-doc warnings and stylistic inconsistencies. Convert these unnecessary kernel-doc blocks to regular C comments, remove comment blocks that are no longer useful, relocate comments to more appropriate positions where needed, and fix a few "Return:" descriptions that were either missing or incorrectly formatted. No functional changes. Signed-off-by: Sunday Adelodun [ rjw: Subject adjustment, changelog edits, comment edits ] Link: https://patch.msgid.link/20251114220438.52448-1-adelodunolaoluwa@yahoo.com Signed-off-by: Rafael J. Wysocki commit d5c0ae872e2ec16280245a2f7a1edab8ba11be24 Merge: 862fa23acc6783 b340412a3b22b6 Author: Guenter Roeck Date: Mon Nov 17 10:54:37 2025 -0800 Merge tag 'ib-mfd-hwmon-v6.19' into hwmon-next Immutable branch between MFD and HWMON due for the v6.19 merge window commit 862fa23acc678343986ab39e7f6c2ceaf14f34c2 Author: Igor Reznichenko Date: Sat Nov 15 10:29:08 2025 -0800 Documentation/hwmon: Fix broken datasheet links for zl6100 Some of the datasheet links contained .pdf suffix which resulted in 404. This patch updates the links to the correct URLs on Renesas website. Signed-off-by: Igor Reznichenko Link: https://lore.kernel.org/r/20251115182908.1357793-1-igor@reznichenko.net Signed-off-by: Guenter Roeck commit 3179a5f7f86bcc3acd5d6fb2a29f891ef5615852 Author: Li Chen Date: Mon Nov 17 13:34:07 2025 +0800 block: rate-limit capacity change info log loop devices under heavy stress-ng loop streessor can trigger many capacity change events in a short time. Each event prints an info message from set_capacity_and_notify(), flooding the console and contributing to soft lockups on slow consoles. Switch the printk in set_capacity_and_notify() to pr_info_ratelimited() so frequent capacity changes do not spam the log while still reporting occasional changes. Cc: stable@vger.kernel.org Signed-off-by: Li Chen Reviewed-by: Chaitanya Kulkarni Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit 7ec9db66cc552f2f8a6779c16d01a2a01eccedde Merge: 33bedb92d26b74 68f4a852e18329 Author: Dave Jiang Date: Mon Nov 17 11:05:47 2025 -0700 Merge branch 'for-6.19/cxl-elc-test' into cxl-for-next Extended linear cache unit testing support - Standardize CXL auto region size - Add cxl_test CFMWS support for extended linear cache - Add support for acpi extended linear cache commit 50a0b122cfc8a7dc35009ef9bf33cf6034c7bd69 Author: Connor Abbott Date: Fri Jul 18 09:50:17 2025 -0400 drm/msm: Wait for MMU devcoredump when waiting for GMU If there is a flood of faults then the MMU can become saturated while it waits for the kernel to process the first fault and resume it, so that the GMU becomes blocked. This is mainly a problem when the kernel reads the state of the GPU for a devcoredump, because this takes a while. If we timeout waiting for the GMU, check if this has happened and retry after we're finished. Signed-off-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/664685/ Signed-off-by: Rob Clark commit a3a22373fce576560757f5616eb48dbf85891d9c Author: Dmitry Baryshkov Date: Thu Nov 13 22:40:50 2025 +0200 drm/msm/a2xx: stop over-complaining about the legacy firmware If the rootfs have a legacy A200 firmware, currently the driver will complain each time the hw is reinited (which can happen a lot). E.g. with GL testsuite the hw is reinited after each test, spamming the console. Make sure that the message is printed only once: when we detect the firmware that doesn't support protection. Fixes: 302295070d3c ("drm/msm/a2xx: support loading legacy (iMX) firmware") Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/688098/ Signed-off-by: Rob Clark commit 3065e6a4d3594b42dae6176b3e2c0c3563cf94b8 Author: Huiwen He Date: Thu Nov 13 01:19:47 2025 +0800 drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() The crashstate_get_bos() function allocates memory for `state->bos` using kcalloc(), but the vmbind path does not check for allocation failure before dereferencing it in the following drm_gpuvm_for_each_va() loop. This could lead to a NULL pointer dereference if memory allocation fails. Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check on state->bos, similar to the safety check in the non-vmbind path. Fixes: af9aa6f316b3d ("drm/msm: Crashdump support for sparse") Signed-off-by: Huiwen He Patchwork: https://patchwork.freedesktop.org/patch/687556/ Signed-off-by: Rob Clark commit 3099e0247e3217e1b39c1c61766e06ec3d13835f Author: Huiwen He Date: Thu Nov 13 01:04:11 2025 +0800 drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() crashstate_get_vm_logs() did not check the return value of kmalloc_array(). In low-memory situations, kmalloc_array() may return NULL, leading to a NULL pointer dereference when the function later accesses state->vm_logs. Fix this by checking the return value of kmalloc_array() and setting state->nr_vm_logs to 0 if allocation fails. Fixes: 9edc52967cc7 ("drm/msm: Add VM logging for VM_BIND updates") Signed-off-by: Huiwen He Patchwork: https://patchwork.freedesktop.org/patch/687555/ Signed-off-by: Rob Clark commit d8c8a575f5aa7afc7cc7718b779c29ae5f7abc58 Author: Rob Herring (Arm) Date: Fri Nov 14 16:25:37 2025 -0600 kbuild: Ensure .dtbo targets are applied to a base .dtb It is a requirement that DT overlays in the kernel are applied at build time to a base DTB in order to validate they can be applied and to validate them against the DT schemas. DT overlays on their own may be incomplete and can't be validated. Add a kbuild check so this doesn't have to be checked and fixed periodically. Signed-off-by: Rob Herring (Arm) commit 1b1f04d8271e7ba70fbbb13754b1e869f70aa785 Author: Geert Uytterhoeven Date: Fri Nov 14 11:47:54 2025 +0100 of/irq: Ignore interrupt parent for nodes without interrupts The Devicetree Specification states: The root of the interrupt tree is determined when traversal of the interrupt tree reaches an interrupt controller node without an interrupts property and thus no explicit interrupt parent. However, of_irq_init() gratuitously assumes that a node without interrupts has an actual interrupt parent if it finds an interrupt-parent property higher up in the device tree. Hence when such a property is present (e.g. in the root node), the root interrupt controller may not be detected as such, causing a panic: OF: of_irq_init: children remain, but no parents Kernel panic - not syncing: No interrupt controller found. Commit e91033621d56e055 ("of/irq: Use interrupts-extended to find parent") already fixed a first part, by checking for the presence of an interrupts-extended property. Fix the second part by only calling of_irq_find_parent() when an interrupts property is present. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/fbe6fc3657070fe2df7f0529043542b52b827449.1763116833.git.geert+renesas@glider.be Signed-off-by: Rob Herring (Arm) commit 96498e804cb6629e02747336a0a33e4955449732 Author: Bartosz Golaszewski Date: Mon Nov 17 17:12:47 2025 +0100 spi: davinci: remove platform data header There are no longer any board files including the DaVinci SPI platform data header. Let's move the bits and pieces that are used in the driver into the driver .c file itself and remove the header. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251117-davinci-spi-v2-1-cd799d17f04a@linaro.org Signed-off-by: Mark Brown commit c7496597adbd85fb1d7293d2938ba21f12c212e4 Author: Yuntao Wang Date: Wed Nov 12 22:35:20 2025 +0800 of/address: Remove the incorrect and misleading comment The of_bus_default_match() function appears to have been copied from of_bus_default_flags_match() with some modifications. However, the comment was left unchanged and still describes the behavior of of_bus_default_flags_match(), it is incorrect and misleading, remove it. Signed-off-by: Yuntao Wang Fixes: 6e5773d52f4a2d9c ("of/address: Fix WARN when attempting translating non-translatable addresses") Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251112143520.233870-11-yuntao.wang@linux.dev Signed-off-by: Rob Herring (Arm) commit 8b9ef71400a382fc5ad5ef98e9a3d11d02be784e Author: Rob Herring (Arm) Date: Mon Oct 13 16:30:35 2025 -0500 dt-bindings: dma: Convert apm,xgene-storm-dma to DT schema Convert APM X-Gene Storm DMA binding to DT schema format. It's a straight-forward conversion. Link: https://patch.msgid.link/20251013213037.684981-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit a18b0c924870c050222c71c2b3a8fb341a21f961 Author: Rob Herring (Arm) Date: Thu Oct 30 14:52:33 2025 -0500 dt-bindings: thermal: Drop db8500-thermal.txt The binding is already defined in mfd/stericsson,db8500-prcmu.yaml and none of 'the tripN.*' properties appear to be in use. Acked-by: Conor Dooley Link: https://patch.msgid.link/20251030195234.439141-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 91d1e3f0f2306b51757ba7dec9a16a0e59b0e94d Author: Rob Herring (Arm) Date: Mon Oct 13 16:58:09 2025 -0500 dt-bindings: thermal: Convert brcm,sr-thermal to DT schema Convert the brcm,sr-thermal binding to DT schema format. It's a straight-forward conversion. "polling-delay", "thermal-sensors", and "temperature" all apply to the thermal zones, not the sensor node. Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251013215810.783006-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 3c09ca88c61d3af2141667ffa691009c9e2cef1c Author: Rob Herring (Arm) Date: Mon Oct 13 16:58:18 2025 -0500 dt-bindings: thermal: Convert amazon,al-thermal to DT schema Convert amazon,al-thermal binding to DT schema format. It's a straight-forward conversion. Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251013215820.783272-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit b012c2ac3745a9d446a2338fb10214ad82df1327 Author: Christophe JAILLET Date: Fri Oct 24 21:50:58 2025 +0200 of: overlay: Avoid spurious error messages in of_overlay_remove() Make of_overlay_remove() tolerate ovcs_id being 0 without logging an error. Suggested-by: Dan Carpenter Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/f756e04e8bc239b33a0428c2dd055f202e214f0b.1761335298.git.christophe.jaillet@wanadoo.fr Signed-off-by: Rob Herring (Arm) commit 527bb3a747d289e52b717b8ce33f96b888f9a3cb Author: David Heidelberg Date: Thu Oct 23 20:00:02 2025 +0200 docs: dt-bindings: Extend the ordering list with a blank newline before status For better readability, it is recommended to insert a newline before the 'status' property. Adjust the examples accordingly. Signed-off-by: David Heidelberg Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251023-docs-dt-newline-v1-1-1bf5e0040c0b@ixit.cz Signed-off-by: Rob Herring (Arm) commit 0b2333183ade2bad21a7ed7b16b93d87d0a83043 Author: Rob Herring (Arm) Date: Thu Oct 23 09:37:56 2025 -0500 dt-bindings: Remove extra blank lines Generally at most 1 blank line is the standard style for DT schema files. Remove the few cases with more than 1 so that the yamllint check for this can be enabled. Acked-by: Lee Jones Reviewed-by: Mathieu Poirier # remoteproc Acked-by: Georgi Djakov Acked-by: Vinod Koul Acked-by: Andi Shyti Acked-by: Bartosz Golaszewski Acked-by: Jonathan Cameron Acked-by: Philipp Zabel Acked-by: Uwe Kleine-König # for allwinner,sun4i-a10-pwm.yaml Reviewed-by: Miquel Raynal # mtd Acked-by: Guenter Roeck Acked-by: Mark Brown Acked-by: Greg Kroah-Hartman Acked-by: Sebastian Reichel Acked-by: Manivannan Sadhasivam # For PCI controller bindings Link: https://patch.msgid.link/20251023143957.2899600-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit bcc357c8e0614939352e3b72bbfd79c27e0bf10a Author: Krzysztof Kozlowski Date: Tue Oct 21 11:53:55 2025 +0200 dt-bindings: Update Krzysztof Kozlowski's email Update Krzysztof Kozlowski's email address to kernel.org account to stay reachable. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251021095354.86455-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 4827728f75c99a018250f1a71ce8a98cdb2746cf Author: Rob Herring (Arm) Date: Tue Oct 14 10:29:56 2025 -0500 dt-bindings: nvmem: Convert brcm,ocotp to DT schema Convert the brcm,ocotp binding to DT schema format. It's a straight-forward conversion. Link: https://patch.msgid.link/20251014152957.3782962-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit fbf97d6c1dd4152344a001257e57b19a4103d943 Author: Ariel D'Alessandro Date: Wed Oct 1 15:31:15 2025 -0300 dt-bindings: media: Convert MediaTek mt8173-mdp bindings to DT schema Convert the existing text-based DT bindings for MediaTek MT8173 Media Data Path to a DT schema. Signed-off-by: Ariel D'Alessandro Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251001183115.83111-1-ariel.dalessandro@collabora.com Signed-off-by: Rob Herring (Arm) commit fc75109288709d74bc76a95bd859da0afbab9f2e Author: Rob Herring (Arm) Date: Wed Oct 22 13:11:43 2025 -0500 dt-bindings: arm: Add missing LGE SoC platforms LGE LG131x SoCs have been in use for some time, but the root compatibles have not been documented. Add them. Acked-by: Chanho Min Link: https://patch.msgid.link/20251022181144.4147944-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 12466504abd08d56e3ac375d0539acfa732674bb Author: Rob Herring (Arm) Date: Wed Oct 22 13:11:11 2025 -0500 dt-bindings: arm: Add missing AMD Seattle SoC platforms AMD Seattle SoC has been in use for some time, but the root compatibles have not been documented. Add them. Link: https://patch.msgid.link/20251022181112.4147188-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 6ca388cb90c0697258a8e4be1b638d775b6995b5 Author: Rob Herring (Arm) Date: Wed Oct 22 13:11:27 2025 -0500 dt-bindings: arm: Add missing APM X-Gene SoC platforms APM X-Gene SoCs have been in use for some time, but the root compatibles have not been documented. Add them. Link: https://patch.msgid.link/20251022181127.4147542-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 01585d7470aa5b8990645919dfbc2179171caaf9 Author: Rob Herring (Arm) Date: Wed Oct 15 18:12:35 2025 -0500 dt-bindings: Fix inconsistent quoting yamllint has gained a new check which checks for inconsistent quoting (mixed " and ' quotes within a file). Fix all the cases yamllint found so we can enable the check (once the check is in a release). As single quotes are (slightly) preferred, use them throughout the modified files even if double quotes are mostly used. Acked-by: Alexandre Belloni Reviewed-by: Krzysztof Kozlowski Acked-by: Jonathan Cameron Acked-by: Andrew Jeffery Acked-by: Jassi Brar Acked-by: Linus Walleij Acked-by: Lee Jones Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/20251015232015.846282-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 0b651695a330fa7fb33ae3faffb8873498ced584 Author: Rob Herring (Arm) Date: Mon Oct 13 16:58:26 2025 -0500 dt-bindings: power: Convert Actions Owl SPS to DT schema Convert the Actions S500/S700/S900 Smart Power System binding to DT schema format. It's a straight-forward conversion. Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251013215834.783501-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 85cc68691c3b3a9d6c540976a4301bf8535e9132 Author: Louis-Alexis Eyraud Date: Tue Oct 21 09:30:51 2025 +0200 dt-bindings: gpu: mali-bifrost: Add compatible for MT8365 SoC Add a compatible for the MediaTek MT8365 SoC, that has an integrated ARM Mali G52 MC1 GPU and compatible with arm,mali-bifrost. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Signed-off-by: Louis-Alexis Eyraud Link: https://patch.msgid.link/20251021-mt8365-enable-gpu-v2-1-17e05cff2c86@collabora.com Signed-off-by: Rob Herring (Arm) commit d2d3d76e740912c4092f22451e241a564fd07d19 Author: Niravkumar L Rabara Date: Fri Oct 17 16:38:49 2025 +0800 MAINTAINERS: Change Altera socfpga-ecc-manager.yaml maintainer Update Altera socfpga-ecc-manager dt bindings maintainer from to as Matthew Gerlack is moving out of Altera. Signed-off-by: Niravkumar L Rabara Acked-by: Matthew Gerlach Link: https://patch.msgid.link/20251017083849.3213192-1-niravkumarlaxmidas.rabara@altera.com Signed-off-by: Rob Herring (Arm) commit 3da115f9e0b75504a89f8c5b47f4903b1ca43da6 Author: Wolfram Sang Date: Mon Oct 20 08:09:50 2025 +0200 dt-bindings: bus: don't check node names Node names are already and properly checked by the core schema. No need to do it again. Signed-off-by: Wolfram Sang Acked-by: Jernej Skrabec Link: https://patch.msgid.link/20251020060951.30776-7-wsa+renesas@sang-engineering.com Signed-off-by: Rob Herring (Arm) commit 7b0f510376ac81131bd72d2c435cd09f1284d0e8 Author: Erick Setubal Bacurau Date: Mon Oct 20 14:11:45 2025 +0200 dt-bindings: fix redundant quotes on fsl,imx6q-vdoa.yaml Fix a dt-schema error: `fsl,imx6q-vdoa.yaml:19:12: [error] string value is redundantly quoted with any quotes (quoted-strings)` Signed-off-by: Erick Setubal Bacurau Link: https://patch.msgid.link/20251020121145.190020-1-erick.setubal@gmx.de Signed-off-by: Rob Herring (Arm) commit 81d35c9f2e0b40f9c1daf57faf8144cbb0238976 Author: Marek Vasut Date: Sat Oct 11 18:51:52 2025 +0200 dt-bindings: interrupt-controller: fsl,irqsteer: Add i.MX95 support Add compatible string "fsl,imx95-irqsteer" for the i.MX95 chip, which is backward compatible with "fsl,imx-irqsteer". Signed-off-by: Marek Vasut Reviewed-by: Frank Li Acked-by: Conor Dooley Link: https://patch.msgid.link/20251011170213.128907-38-marek.vasut@mailbox.org Signed-off-by: Rob Herring (Arm) commit 02fe7ca03166ed8be6278dec14c2ce2be9abf668 Author: Rob Herring (Arm) Date: Tue Oct 14 10:30:38 2025 -0500 dt-bindings: arm: Convert Marvell AP80x System Controller to DT schema Convert the Marvell AP80x System Controller binding to DT schema format. There's not any specific compatible for the whole block which is a separate problem, so just the child nodes are documented. Only the pinctrl and clock child nodes need to be converted as the GPIO node already has a schema. Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20251014153040.3783896-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 45a8d350e72cc98e91bce2c20d4f26a8d9ccfffa Author: Rob Herring (Arm) Date: Tue Oct 14 10:30:19 2025 -0500 dt-bindings: arm: Convert Marvell CP110 System Controller to DT schema Convert the Marvell CP110 System Controller binding to DT schema format. There's not any specific compatible for the whole block which is a separate problem, so just the child nodes are documented. Only the pinctrl and clock child nodes need to be converted as the GPIO node already has a schema. Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20251022165509.3917655-2-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit e544bc7548df5e462190b8f143eac10b9dd5b94b Author: Rob Herring (Arm) Date: Tue Oct 14 10:30:05 2025 -0500 dt-bindings: bus: Convert cznic,moxtet to DT schema Convert the cznic,moxtet binding to DT schema format. It's a straight-forward conversion. Reviewed-by: Marek Behún Link: https://patch.msgid.link/20251014153009.3783183-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 393f40ef96628f603b40e97b6da9847d20a904c0 Author: Parvathi Pudi Date: Mon Nov 3 18:24:51 2025 +0530 ARM: multi_v7_defconfig: Enable TI PRU Ethernet driver The Programmable Real-time Unit and Industrial Communication Subsystem Megabit (ICSSM) is a microcontroller subsystem in TI SoCs such as AM57x, AM437x, and AM335x. It provides real-time processing capabilities for industrial communication and custom peripheral interfaces. Currently, EVMs based on AM57x, AM437x, and AM335x use the ICSSM driver for PRU-based Ethernet functionality. This patch enables TI_PRUSS and TI_PRUETH as a module for TI SoCs. Signed-off-by: Parvathi Pudi Link: https://lore.kernel.org/r/20251103125451.1679404-1-parvathi@couthit.com Signed-off-by: Kevin Hilman commit 68f4a852e18329e84bb5d36168a45b0a52cdf236 Author: Dave Jiang Date: Mon Nov 17 07:46:11 2025 -0700 cxl/test: Add support for acpi extended linear cache Add the mock wrappers for hmat_get_extended_linear_cache_size() in order to emulate the ACPI helper function for the regions that are mock'd by cxl_test. Reviewed-by: Jonathan Cameron Tested-by: Alison Schofield Reviewed-by: Alison Schofield Reviewed-by: Fabio M. De Francesco Link: https://patch.msgid.link/20251117144611.903692-4-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 4b1c0466c8fbe23d688a1f54584670a9d1dceabd Author: Dave Jiang Date: Mon Nov 17 07:46:10 2025 -0700 cxl/test: Add cxl_test CFMWS support for extended linear cache Add a module parameter to allow activation of extended linear cache on the auto region for cxl_test. The current platform implementation for extended linear cache is 1:1 of DRAM and CXL memory. A CFMWS is created with the size of both memory together where DRAM takes the first part of the memory range and CXL covers the second part. The current CXL auto region on cxl_test consists of 2 256M devices that creates a 512M region. The new extended linear cache setup will have 512M DRAM and 512M CXL memory for a total of 1G CFMWS. The hardware decoders must have their starting offset moved to after the DRAM region to handle the CXL regions. [ dj: Fixup commenting style. (Jonathan) ] Reviewed-by: Jonathan Cameron Tested-by: Alison Schofield Reviewed-by: Alison Schofield Reviewed-by: Fabio M. De Francesco Link: https://patch.msgid.link/20251117144611.903692-3-dave.jiang@intel.com Signed-off-by: Dave Jiang commit fa59c35167afdba043efcc80cf460863868141e7 Author: Dave Jiang Date: Mon Nov 17 07:46:09 2025 -0700 cxl/test: Standardize CXL auto region size Create a global define for the size of the mock CXL auto region used in cxl_test. Remove the declared size in mock_init_hdm_decoder() function. Reviewed-by: Jonathan Cameron Tested-by: Alison Schofield Reviewed-by: Alison Schofield Reviewed-by: Fabio M. De Francesco Link: https://patch.msgid.link/20251117144611.903692-2-dave.jiang@intel.com Signed-off-by: Dave Jiang commit ade260ca858627b21be87711b1e12a7bf80c0261 Author: Damien Le Moal Date: Sat Nov 15 21:15:56 2025 +0900 Documentation: admin-guide: blockdev: update zloop parameters In Documentation/admin-guide/blockdev/zoned_loop.rst, add the description of the zone_append and ordered_zone_append configuration arguments of zloop "add" command (device creation). Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit fcc6eaa3a03a0e94f6f1d0ac455209b520ef8024 Author: Damien Le Moal Date: Sat Nov 15 21:15:55 2025 +0900 zloop: introduce the ordered_zone_append configuration parameter The zone append operation processing for zloop devices is similar to any other command, that is, the operation is processed as a command work item, without any special serialization between the work items (beside the zone mutex for mutually exclusive code sections). This processing is fine and gives excellent performance. However, it has a side effect: zone append operation are very often reordered and processed in a sequence that is very different from their issuing order by the user. This effect is very visible using an XFS file system on top of a zloop device. A simple file write leads to many file extents as the data writes using zone append are reordered and so result in the physical order being different than the file logical order. E.g. executing: $ dd if=/dev/zero of=/mnt/test bs=1M count=10 && sync $ xfs_bmap /mnt/test /mnt/test: 0: [0..4095]: 2162688..2166783 1: [4096..6143]: 2168832..2170879 2: [6144..8191]: 2166784..2168831 3: [8192..10239]: 2170880..2172927 4: [10240..12287]: 2174976..2177023 5: [12288..14335]: 2172928..2174975 6: [14336..20479]: 2177024..2183167 For 10 IOs, 6 extents are created. This is fine and actually allows to exercise XFS zone garbage collection very well. However, this also makes debugging/working on XFS data placement harder as the underlying device will most of the time reorder IOs, resulting in many file extents. Allow a user to mitigate this with the new ordered_zone_append configuration parameter. For a zloop device created with this parameter specified, the sector of a zone append command is set early, when the command is submitted by the block layer with the zloop_queue_rq() function, instead of in the zloop_rw() function which is exectued later in the command work item context. This change ensures that more often than not, zone append operations data end up being written in the same order as the command submission by the user. In the case of XFS, this leads to far less file data extents. E.g., for the previous example, we get a single file data extent for the written file. $ dd if=/dev/zero of=/mnt/test bs=1M count=10 && sync $ xfs_bmap /mnt/test /mnt/test: 0: [0..20479]: 2162688..2183167 Since we cannot use a mutex in the context of the zloop_queue_rq() function to atomically set a zone append operation sector to the target zone write pointer location and increment that the write pointer, a new per-zone spinlock is introduced to protect a zone write pointer access and modifications. To check a zone write pointer location and set a zone append operation target sector to that value, the function zloop_set_zone_append_sector() is introduced and called from zloop_queue_rq(). Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 9236c5fdd5a8bec2445e834e7e1bbefb2eb62f67 Author: Damien Le Moal Date: Sat Nov 15 21:15:54 2025 +0900 zloop: introduce the zone_append configuration parameter A zloop zoned block device declares to the block layer that it supports zone append operations. That is, a zloop device ressembles an NVMe ZNS devices supporting zone append. This native support is fine but it does not allow exercising the block layer zone write plugging emulation of zone append, as is done with SCSI or ATA SMR HDDs. Introduce the zone_append configuration parameter to allow creating a zloop device without native support for zone append, thus relying on the block layer zone append emulation. If not specified, zone append support is enabled by default. Otherwise, a value of 0 disables native zone append and a value of 1 enables it. Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit e3a96ca90462f80d9f58a1236514823334deef39 Author: Damien Le Moal Date: Sat Nov 15 21:15:53 2025 +0900 zloop: simplify checks for writes to sequential zones The function zloop_rw() already checks early that a request is fully contained within the target zone. So this check does not need to be done again for regular writes to sequential zones. Furthermore, since zone append operations are always directed to the zone write pointer location, we do not need to check for their alignment to that value after setting it. So turn the "if" checking the write pointer alignment into an "else if". While at it, improve the comment describing the write pointer modification and how this value is corrected in case of error. Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit cf28f6f923cb1dd2765b5c3d7697bb4dcf2096a0 Author: Damien Le Moal Date: Sat Nov 15 21:15:52 2025 +0900 zloop: fail zone append operations that are targeting full zones zloop_rw() will fail any regular write operation that targets a full sequential zone. The check for this is indirect and achieved by checking the write pointer alignment of the write operation. But this check is ineffective for zone append operations since these are alwasy automatically directed at a zone write pointer. Prevent zone append operations from being executed in a full zone with an explicit check of the zone condition. Fixes: eb0570c7df23 ("block: new zoned loop block device driver") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 866d65745b635927c3d1343ab67e6fd4a99d116d Author: Damien Le Moal Date: Sat Nov 15 21:15:51 2025 +0900 zloop: make the write pointer of full zones invalid The write pointer of zones that are in the full condition is always invalid. Reflect that fact by setting the write pointer of full zones to ULLONG_MAX. Fixes: eb0570c7df23 ("block: new zoned loop block device driver") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe commit 6483faa3938bfbd2c9f8ae090f647635f3bd2877 Author: Guenter Roeck Date: Fri Nov 14 15:54:34 2025 -0800 block/blk-throttle: Remove throtl_slice from struct throtl_data throtl_slice is now a constant. Remove the variable and use the constant directly where needed. Cc: Yu Kuai Cc: Tejun Heo Signed-off-by: Guenter Roeck Signed-off-by: Khazhismel Kumykov Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit 20d0b359c73d15b25abea04066ef4cdbc6a8738d Author: Guenter Roeck Date: Fri Nov 14 15:54:33 2025 -0800 block/blk-throttle: drop unneeded blk_stat_enable_accounting After the removal of CONFIG_BLK_DEV_THROTTLING_LOW, it is no longer necessary to enable block accounting, so remove the call to blk_stat_enable_accounting(). With that, the track_bio_latency variable is no longer used and can be deleted from struct throtl_data. Also, including blk-stat.h is no longer necessary. Fixes: bf20ab538c81 ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW") Cc: Yu Kuai Cc: Tejun Heo Signed-off-by: Guenter Roeck Signed-off-by: Khazhismel Kumykov Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit f76581f9f1d29e32e120b0242974ba266e79de58 Author: Guenter Roeck Date: Fri Nov 14 15:54:32 2025 -0800 block/blk-throttle: Fix throttle slice time for SSDs Commit d61fcfa4bb18 ("blk-throttle: choose a small throtl_slice for SSD") introduced device type specific throttle slices if BLK_DEV_THROTTLING_LOW was enabled. Commit bf20ab538c81 ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW") removed support for BLK_DEV_THROTTLING_LOW, but left the device type specific throttle slices in place. This effectively changed throttling behavior on systems with SSD which now use a different and non-configurable slice time compared to non-SSD devices. Practical impact is that throughput tests with low configured throttle values (65536 bps) experience less than expected throughput on SSDs, presumably due to rounding errors associated with the small throttle slice time used for those devices. The same tests pass when setting the throttle values to 65536 * 4 = 262144 bps. The original code sets the throttle slice time to DFL_THROTL_SLICE_HD if CONFIG_BLK_DEV_THROTTLING_LOW is disabled. Restore that code to fix the problem. With that, DFL_THROTL_SLICE_SSD is no longer necessary. Revert to the original code and re-introduce DFL_THROTL_SLICE to replace both DFL_THROTL_SLICE_HD and DFL_THROTL_SLICE_SSD. This effectively reverts commit d61fcfa4bb18 ("blk-throttle: choose a small throtl_slice for SSD"). While at it, also remove MAX_THROTL_SLICE since it is not used anymore. Fixes: bf20ab538c81 ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW") Cc: Yu Kuai Cc: Tejun Heo Signed-off-by: Guenter Roeck Signed-off-by: Khazhismel Kumykov Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit 2516c246d01c23a5f5310e9ac78d9f8aad9b1d0e Author: Keith Busch Date: Fri Nov 14 10:31:45 2025 -0800 block: consider discard merge last If the next discard range is contiguous with the current range being considered, it's cheaper to expand the current range than to append an additional bio. Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Jens Axboe commit 33cf66d88306663d16e4759e9d24766b0aaa2e17 Author: Peter Zijlstra Date: Fri Nov 7 17:01:31 2025 +0100 sched/fair: Proportional newidle balance Add a randomized algorithm that runs newidle balancing proportional to its success rate. This improves schbench significantly: 6.18-rc4: 2.22 Mrps/s 6.18-rc4+revert: 2.04 Mrps/s 6.18-rc4+revert+random: 2.18 Mrps/S Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: 6.17: -6% 6.17+revert: 0% 6.17+revert+random: -1% Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Tested-by: Chris Mason Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com Link: https://patch.msgid.link/20251107161739.770122091@infradead.org commit 08d473dd8718e4a4d698b1113a14a40ad64a909b Author: Peter Zijlstra Date: Fri Nov 7 17:01:27 2025 +0100 sched/fair: Small cleanup to update_newidle_cost() Simplify code by adding a few variables. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Tested-by: Chris Mason Link: https://patch.msgid.link/20251107161739.655208666@infradead.org commit e78e70dbf603c1425f15f32b455ca148c932f6c1 Author: Peter Zijlstra Date: Fri Nov 7 17:01:24 2025 +0100 sched/fair: Small cleanup to sched_balance_newidle() Pull out the !sd check to simplify code. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Tested-by: Chris Mason Link: https://patch.msgid.link/20251107161739.525916173@infradead.org commit d206fbad9328ddb68ebabd7cf7413392acd38081 Author: Peter Zijlstra Date: Fri Nov 7 17:01:20 2025 +0100 sched/fair: Revert max_newidle_lb_cost bump Many people reported regressions on their database workloads due to: 155213a2aed4 ("sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails") For instance Adam Li reported a 6% regression on SpecJBB. Conversely this will regress schbench again; on my machine from 2.22 Mrps/s down to 2.04 Mrps/s. Reported-by: Joseph Salisbury Reported-by: Adam Li Reported-by: Dietmar Eggemann Reported-by: Hazem Mohamed Abuelfotoh Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Tested-by: Dietmar Eggemann Tested-by: Chris Mason Link: https://lkml.kernel.org/r/20250626144017.1510594-2-clm@fb.com Link: https://lkml.kernel.org/r/006c9df2-b691-47f1-82e6-e233c3f91faf@oracle.com Link: https://patch.msgid.link/20251107161739.406147760@infradead.org commit e837456fdca81899a3c8e47b3fd39e30eae6e291 Author: Mel Gorman Date: Wed Nov 12 12:25:21 2025 +0000 sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals Reimplement NEXT_BUDDY preemption to take into account the deadline and eligibility of the wakee with respect to the waker. In the event multiple buddies could be considered, the one with the earliest deadline is selected. Sync wakeups are treated differently to every other type of wakeup. The WF_SYNC assumption is that the waker promises to sleep in the very near future. This is violated in enough cases that WF_SYNC should be treated as a suggestion instead of a contract. If a waker does go to sleep almost immediately then the delay in wakeup is negligible. In other cases, it's throttled based on the accumulated runtime of the waker so there is a chance that some batched wakeups have been issued before preemption. For all other wakeups, preemption happens if the wakee has a earlier deadline than the waker and eligible to run. While many workloads were tested, the two main targets were a modified dbench4 benchmark and hackbench because the are on opposite ends of the spectrum -- one prefers throughput by avoiding preemption and the other relies on preemption. First is the dbench throughput data even though it is a poor metric but it is the default metric. The test machine is a 2-socket machine and the backing filesystem is XFS as a lot of the IO work is dispatched to kernel threads. It's important to note that these results are not representative across all machines, especially Zen machines, as different bottlenecks are exposed on different machines and filesystems. dbench4 Throughput (misleading but traditional) 6.18-rc1 6.18-rc1 vanilla sched-preemptnext-v5 Hmean 1 1268.80 ( 0.00%) 1269.74 ( 0.07%) Hmean 4 3971.74 ( 0.00%) 3950.59 ( -0.53%) Hmean 7 5548.23 ( 0.00%) 5420.08 ( -2.31%) Hmean 12 7310.86 ( 0.00%) 7165.57 ( -1.99%) Hmean 21 8874.53 ( 0.00%) 9149.04 ( 3.09%) Hmean 30 9361.93 ( 0.00%) 10530.04 ( 12.48%) Hmean 48 9540.14 ( 0.00%) 11820.40 ( 23.90%) Hmean 79 9208.74 ( 0.00%) 12193.79 ( 32.42%) Hmean 110 8573.12 ( 0.00%) 11933.72 ( 39.20%) Hmean 141 7791.33 ( 0.00%) 11273.90 ( 44.70%) Hmean 160 7666.60 ( 0.00%) 10768.72 ( 40.46%) As throughput is misleading, the benchmark is modified to use a short loadfile report the completion time duration in milliseconds. dbench4 Loadfile Execution Time 6.18-rc1 6.18-rc1 vanilla sched-preemptnext-v5 Amean 1 14.62 ( 0.00%) 14.69 ( -0.46%) Amean 4 18.76 ( 0.00%) 18.85 ( -0.45%) Amean 7 23.71 ( 0.00%) 24.38 ( -2.82%) Amean 12 31.25 ( 0.00%) 31.87 ( -1.97%) Amean 21 45.12 ( 0.00%) 43.69 ( 3.16%) Amean 30 61.07 ( 0.00%) 54.33 ( 11.03%) Amean 48 95.91 ( 0.00%) 77.22 ( 19.49%) Amean 79 163.38 ( 0.00%) 123.08 ( 24.66%) Amean 110 243.91 ( 0.00%) 175.11 ( 28.21%) Amean 141 343.47 ( 0.00%) 239.10 ( 30.39%) Amean 160 401.15 ( 0.00%) 283.73 ( 29.27%) Stddev 1 0.52 ( 0.00%) 0.51 ( 2.45%) Stddev 4 1.36 ( 0.00%) 1.30 ( 4.04%) Stddev 7 1.88 ( 0.00%) 1.87 ( 0.72%) Stddev 12 3.06 ( 0.00%) 2.45 ( 19.83%) Stddev 21 5.78 ( 0.00%) 3.87 ( 33.06%) Stddev 30 9.85 ( 0.00%) 5.25 ( 46.76%) Stddev 48 22.31 ( 0.00%) 8.64 ( 61.27%) Stddev 79 35.96 ( 0.00%) 18.07 ( 49.76%) Stddev 110 59.04 ( 0.00%) 30.93 ( 47.61%) Stddev 141 85.38 ( 0.00%) 40.93 ( 52.06%) Stddev 160 96.38 ( 0.00%) 39.72 ( 58.79%) That is still looking good and the variance is reduced quite a bit. Finally, fairness is a concern so the next report tracks how many milliseconds does it take for all clients to complete a workfile. This one is tricky because dbench makes to effort to synchronise clients so the durations at benchmark start time differ substantially from typical runtimes. This problem could be mitigated by warming up the benchmark for a number of minutes but it's a matter of opinion whether that counts as an evasion of inconvenient results. dbench4 All Clients Loadfile Execution Time 6.18-rc1 6.18-rc1 vanilla sched-preemptnext-v5 Amean 1 15.06 ( 0.00%) 15.07 ( -0.03%) Amean 4 603.81 ( 0.00%) 524.29 ( 13.17%) Amean 7 855.32 ( 0.00%) 1331.07 ( -55.62%) Amean 12 1890.02 ( 0.00%) 2323.97 ( -22.96%) Amean 21 3195.23 ( 0.00%) 2009.29 ( 37.12%) Amean 30 13919.53 ( 0.00%) 4579.44 ( 67.10%) Amean 48 25246.07 ( 0.00%) 5705.46 ( 77.40%) Amean 79 29701.84 ( 0.00%) 15509.26 ( 47.78%) Amean 110 22803.03 ( 0.00%) 23782.08 ( -4.29%) Amean 141 36356.07 ( 0.00%) 25074.20 ( 31.03%) Amean 160 17046.71 ( 0.00%) 13247.62 ( 22.29%) Stddev 1 0.47 ( 0.00%) 0.49 ( -3.74%) Stddev 4 395.24 ( 0.00%) 254.18 ( 35.69%) Stddev 7 467.24 ( 0.00%) 764.42 ( -63.60%) Stddev 12 1071.43 ( 0.00%) 1395.90 ( -30.28%) Stddev 21 1694.50 ( 0.00%) 1204.89 ( 28.89%) Stddev 30 7945.63 ( 0.00%) 2552.59 ( 67.87%) Stddev 48 14339.51 ( 0.00%) 3227.55 ( 77.49%) Stddev 79 16620.91 ( 0.00%) 8422.15 ( 49.33%) Stddev 110 12912.15 ( 0.00%) 13560.95 ( -5.02%) Stddev 141 20700.13 ( 0.00%) 14544.51 ( 29.74%) Stddev 160 9079.16 ( 0.00%) 7400.69 ( 18.49%) This is more of a mixed bag but it at least shows that fairness is not crippled. The hackbench results are more neutral but this is still important. It's possible to boost the dbench figures by a large amount but only by crippling the performance of a workload like hackbench. The WF_SYNC behaviour is important for these workloads and is why the WF_SYNC changes are not a separate patch. hackbench-process-pipes 6.18-rc1 6.18-rc1 vanilla sched-preemptnext-v5 Amean 1 0.2657 ( 0.00%) 0.2150 ( 19.07%) Amean 4 0.6107 ( 0.00%) 0.6060 ( 0.76%) Amean 7 0.7923 ( 0.00%) 0.7440 ( 6.10%) Amean 12 1.1500 ( 0.00%) 1.1263 ( 2.06%) Amean 21 1.7950 ( 0.00%) 1.7987 ( -0.20%) Amean 30 2.3207 ( 0.00%) 2.5053 ( -7.96%) Amean 48 3.5023 ( 0.00%) 3.9197 ( -11.92%) Amean 79 4.8093 ( 0.00%) 5.2247 ( -8.64%) Amean 110 6.1160 ( 0.00%) 6.6650 ( -8.98%) Amean 141 7.4763 ( 0.00%) 7.8973 ( -5.63%) Amean 172 8.9560 ( 0.00%) 9.3593 ( -4.50%) Amean 203 10.4783 ( 0.00%) 10.8347 ( -3.40%) Amean 234 12.4977 ( 0.00%) 13.0177 ( -4.16%) Amean 265 14.7003 ( 0.00%) 15.5630 ( -5.87%) Amean 296 16.1007 ( 0.00%) 17.4023 ( -8.08%) Processes using pipes are impacted but the variance (not presented) indicates it's close to noise and the results are not always reproducible. If executed across multiple reboots, it may show neutral or small gains so the worst measured results are presented. Hackbench using sockets is more reliably neutral as the wakeup mechanisms are different between sockets and pipes. hackbench-process-sockets 6.18-rc1 6.18-rc1 vanilla sched-preemptnext-v2 Amean 1 0.3073 ( 0.00%) 0.3263 ( -6.18%) Amean 4 0.7863 ( 0.00%) 0.7930 ( -0.85%) Amean 7 1.3670 ( 0.00%) 1.3537 ( 0.98%) Amean 12 2.1337 ( 0.00%) 2.1903 ( -2.66%) Amean 21 3.4683 ( 0.00%) 3.4940 ( -0.74%) Amean 30 4.7247 ( 0.00%) 4.8853 ( -3.40%) Amean 48 7.6097 ( 0.00%) 7.8197 ( -2.76%) Amean 79 14.7957 ( 0.00%) 16.1000 ( -8.82%) Amean 110 21.3413 ( 0.00%) 21.9997 ( -3.08%) Amean 141 29.0503 ( 0.00%) 29.0353 ( 0.05%) Amean 172 36.4660 ( 0.00%) 36.1433 ( 0.88%) Amean 203 39.7177 ( 0.00%) 40.5910 ( -2.20%) Amean 234 42.1120 ( 0.00%) 43.5527 ( -3.42%) Amean 265 45.7830 ( 0.00%) 50.0560 ( -9.33%) Amean 296 50.7043 ( 0.00%) 54.3657 ( -7.22%) As schbench has been mentioned in numerous bugs recently, the results are interesting. A test case that represents the default schbench behaviour is schbench Wakeup Latency (usec) 6.18.0-rc1 6.18.0-rc1 vanilla sched-preemptnext-v5 Amean Wakeup-50th-80 7.17 ( 0.00%) 6.00 ( 16.28%) Amean Wakeup-90th-80 46.56 ( 0.00%) 19.78 ( 57.52%) Amean Wakeup-99th-80 119.61 ( 0.00%) 89.94 ( 24.80%) Amean Wakeup-99.9th-80 3193.78 ( 0.00%) 328.22 ( 89.72%) schbench Requests Per Second (ops/sec) 6.18.0-rc1 6.18.0-rc1 vanilla sched-preemptnext-v5 Hmean RPS-20th-80 8900.91 ( 0.00%) 9176.78 ( 3.10%) Hmean RPS-50th-80 8987.41 ( 0.00%) 9217.89 ( 2.56%) Hmean RPS-90th-80 9123.73 ( 0.00%) 9273.25 ( 1.64%) Hmean RPS-max-80 9193.50 ( 0.00%) 9301.47 ( 1.17%) Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251112122521.1331238-3-mgorman@techsingularity.net commit aceccac58ad76305d147165788ea6b939bef179b Author: Mel Gorman Date: Wed Nov 12 12:25:20 2025 +0000 sched/fair: Enable scheduler feature NEXT_BUDDY The NEXT_BUDDY feature reinforces wakeup preemption to encourage the last wakee to be scheduled sooner on the assumption that the waker/wakee share cache-hot data. In CFS, it was paired with LAST_BUDDY to switch back on the assumption that the pair of tasks still share data but also relied on START_DEBIT and the exact WAKEUP_PREEMPTION implementation to get good results. NEXT_BUDDY has been disabled since commit 0ec9fab3d186 ("sched: Improve latencies and throughput") and LAST_BUDDY was removed in commit 5e963f2bd465 ("sched/fair: Commit to EEVDF"). The reasoning is not clear but as vruntime spread is mentioned so the expectation is that NEXT_BUDDY had an impact on overall fairness. It was not noted why LAST_BUDDY was removed but it is assumed that it's very difficult to reason what LAST_BUDDY's correct and effective behaviour should be while still respecting EEVDFs goals. Peter Zijlstra noted during review; I think I was just struggling to make sense of things and figured less is more and axed it. I have vague memories trying to work through the dynamics of a wakeup-stack and the EEVDF latency requirements and getting a head-ache. NEXT_BUDDY is easier to reason about given that it's a point-in-time decision on the wakees deadline and eligibilty relative to the waker. Enable NEXT_BUDDY as a preparation path to document that the decision to ignore the current implementation is deliberate. While not presented, the results were at best neutral and often much more variable. Signed-off-by: Mel Gorman Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251112122521.1331238-2-mgorman@techsingularity.net commit aaab6bb54ab9bc4c37ff33b816031918d2760517 Author: Phil Auld Date: Thu Sep 11 12:13:00 2025 -0400 sched: Increase sched_tick_remote timeout Increase the sched_tick_remote WARN_ON timeout to remove false positives due to temporarily busy HK cpus. The suggestion was 30 seconds to catch really stuck remote tick processing but not trigger it too easily. Suggested-by: Frederic Weisbecker Signed-off-by: Phil Auld Signed-off-by: Peter Zijlstra (Intel) Acked-by: Frederic Weisbecker Link: https://patch.msgid.link/20250911161300.437944-1-pauld@redhat.com commit 522fb20fbdbe48ed98f587d628637ff38ececd2d Author: Peter Zijlstra Date: Mon Nov 17 17:13:09 2025 +0100 sched/fair: Have SD_SERIALIZE affect newidle balancing Also serialize the possiblty much more frequent newidle balancing for the 'expensive' domains that have SD_BALANCE set. Initial benchmarking by K Prateek and Tim showed no negative effect. Split out from the larger patch moving sched_balance_running around for ease of bisect and such. Suggested-by: Shrikanth Hegde Seconded-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/df068896-82f9-458d-8fff-5a2f654e8ffd@amd.com Link: https://patch.msgid.link/6fed119b723c71552943bfe5798c93851b30a361.1762800251.git.tim.c.chen@linux.intel.com # Conflicts: # kernel/sched/fair.c commit 3324b2180c17b21c31c16966cc85ca41a7c93703 Author: Tim Chen Date: Mon Nov 10 10:47:35 2025 -0800 sched/fair: Skip sched_balance_running cmpxchg when balance is not due The NUMA sched domain sets the SD_SERIALIZE flag by default, allowing only one NUMA load balancing operation to run system-wide at a time. Currently, each sched group leader directly under NUMA domain attempts to acquire the global sched_balance_running flag via cmpxchg() before checking whether load balancing is due or whether it is the designated load balancer for that NUMA domain. On systems with a large number of cores, this causes significant cache contention on the shared sched_balance_running flag. This patch reduces unnecessary cmpxchg() operations by first checking that the balancer is the designated leader for a NUMA domain from should_we_balance(), and the balance interval has expired before trying to acquire sched_balance_running to load balance a NUMA domain. On a 2-socket Granite Rapids system with sub-NUMA clustering enabled, running an OLTP workload, 7.8% of total CPU cycles were previously spent in sched_balance_domain() contending on sched_balance_running before this change. : 104 static __always_inline int arch_atomic_cmpxchg(atomic_t *v, int old, int new) : 105 { : 106 return arch_cmpxchg(&v->counter, old, new); 0.00 : ffffffff81326e6c: xor %eax,%eax 0.00 : ffffffff81326e6e: mov $0x1,%ecx 0.00 : ffffffff81326e73: lock cmpxchg %ecx,0x2394195(%rip) # ffffffff836bb010 : 110 sched_balance_domains(): : 12234 if (atomic_cmpxchg_acquire(&sched_balance_running, 0, 1)) 99.39 : ffffffff81326e7b: test %eax,%eax 0.00 : ffffffff81326e7d: jne ffffffff81326e99 : 12238 if (time_after_eq(jiffies, sd->last_balance + interval)) { 0.00 : ffffffff81326e7f: mov 0x14e2b3a(%rip),%rax # ffffffff828099c0 0.00 : ffffffff81326e86: sub 0x48(%r14),%rax 0.00 : ffffffff81326e8a: cmp %rdx,%rax After applying this fix, sched_balance_domain() is gone from the profile and there is a 5% throughput improvement. [peterz: made it so that redo retains the 'lock' and split out the CPU_NEWLY_IDLE change to a separate patch] Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chen Yu Reviewed-by: Vincent Guittot Reviewed-by: Shrikanth Hegde Reviewed-by: K Prateek Nayak Reviewed-by: Srikar Dronamraju Tested-by: Mohini Narkhede Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/6fed119b723c71552943bfe5798c93851b30a361.1762800251.git.tim.c.chen@linux.intel.com commit 37d6d92fe0859f72a25f91f875efa6feb676de68 Merge: 0b6c10cb8479d0 a10ad1b104024e Author: Rafael J. Wysocki Date: Mon Nov 17 16:55:55 2025 +0100 Merge back earlier material related to system sleep for 6.19 commit e78fb96b41c6ac85c1a02c7e9610d1ebaa9b5d98 Author: Lei Chen Date: Tue Aug 19 23:20:27 2025 +0800 KVM: x86: remove comment about ntp correction sync for Since vcpu local clock is no longer affected by ntp, remove comment about ntp correction sync for function kvm_gen_kvmclock_update. Signed-off-by: Lei Chen Link: https://patch.msgid.link/20250819152027.1687487-4-lei.chen@smartx.com Signed-off-by: Sean Christopherson commit 446fcce2a52b533c543dabba26777813c347577c Author: Lei Chen Date: Tue Aug 19 23:20:26 2025 +0800 Revert "x86: kvm: rate-limit global clock updates" This reverts commit 7e44e4495a398eb553ce561f29f9148f40a3448f. Commit 7e44e4495a39 ("x86: kvm: rate-limit global clock updates") intends to use a kvmclock_update_work to sync ntp corretion across all vcpus kvmclock, which is based on commit 0061d53daf26f ("KVM: x86: limit difference between kvmclock updates") Since kvmclock has been switched to mono raw, this commit can be reverted. Signed-off-by: Lei Chen Link: https://patch.msgid.link/20250819152027.1687487-3-lei.chen@smartx.com Signed-off-by: Sean Christopherson commit 43ddbf16edf5c1790684b32d5eb920a1b0eea285 Author: Lei Chen Date: Tue Aug 19 23:20:25 2025 +0800 Revert "x86: kvm: introduce periodic global clock updates" This reverts commit 332967a3eac06f6379283cf155c84fe7cd0537c2. Commit 332967a3eac0 ("x86: kvm: introduce periodic global clock updates") introduced a 300s interval work to sync ntp corrections across all vcpus. Since commit 53fafdbb8b21 ("KVM: x86: switch KVMCLOCK base to monotonic raw clock"), kvmclock switched to mono raw clock, we can no longer take ntp into consideration. Signed-off-by: Lei Chen Link: https://patch.msgid.link/20250819152027.1687487-2-lei.chen@smartx.com Signed-off-by: Sean Christopherson commit a091fe60c2d3943b058132a64682a509d55bd325 Author: Sean Christopherson Date: Thu Nov 13 12:51:14 2025 -0800 KVM: x86: Grab lapic_timer in a local variable to cleanup periodic code Stash apic->lapic_timer in a local "ktimer" variable in advance_periodic_target_expiration() to eliminate a few unaligned wraps, and to make the code easier to read overall. No functional change intended. Link: https://patch.msgid.link/20251113205114.1647493-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 18ab3fc8e880791aa9f7c000261320fc812b5465 Author: fuqiang wang Date: Thu Nov 13 12:51:13 2025 -0800 KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When advancing the target expiration for the guest's APIC timer in periodic mode, set the expiration to "now" if the target expiration is in the past (similar to what is done in update_target_expiration()). Blindly adding the period to the previous target expiration can result in KVM generating a practically unbounded number of hrtimer IRQs due to programming an expired timer over and over. In extreme scenarios, e.g. if userspace pauses/suspends a VM for an extended duration, this can even cause hard lockups in the host. Currently, the bug only affects Intel CPUs when using the hypervisor timer (HV timer), a.k.a. the VMX preemption timer. Unlike the software timer, a.k.a. hrtimer, which KVM keeps running even on exits to userspace, the HV timer only runs while the guest is active. As a result, if the vCPU does not run for an extended duration, there will be a huge gap between the target expiration and the current time the vCPU resumes running. Because the target expiration is incremented by only one period on each timer expiration, this leads to a series of timer expirations occurring rapidly after the vCPU/VM resumes. More critically, when the vCPU first triggers a periodic HV timer expiration after resuming, advancing the expiration by only one period will result in a target expiration in the past. As a result, the delta may be calculated as a negative value. When the delta is converted into an absolute value (tscdeadline is an unsigned u64), the resulting value can overflow what the HV timer is capable of programming. I.e. the large value will exceed the VMX Preemption Timer's maximum bit width of cpu_preemption_timer_multi + 32, and thus cause KVM to switch from the HV timer to the software timer (hrtimers). After switching to the software timer, periodic timer expiration callbacks may be executed consecutively within a single clock interrupt handler, because hrtimers honors KVM's request for an expiration in the past and immediately re-invokes KVM's callback after reprogramming. And because the interrupt handler runs with IRQs disabled, restarting KVM's hrtimer over and over until the target expiration is advanced to "now" can result in a hard lockup. E.g. the following hard lockup was triggered in the host when running a Windows VM (only relevant because it used the APIC timer in periodic mode) after resuming the VM from a long suspend (in the host). NMI watchdog: Watchdog detected hard LOCKUP on cpu 45 ... RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm] ... RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046 RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500 RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0 R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0 R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8 FS: 00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0 PKRU: 55555554 Call Trace: apic_timer_fn+0x31/0x50 [kvm] __hrtimer_run_queues+0x100/0x280 hrtimer_interrupt+0x100/0x210 ? ttwu_do_wakeup+0x19/0x160 smp_apic_timer_interrupt+0x6a/0x130 apic_timer_interrupt+0xf/0x20 Moreover, if the suspend duration of the virtual machine is not long enough to trigger a hard lockup in this scenario, since commit 98c25ead5eda ("KVM: VMX: Move preemption timer <=> hrtimer dance to common x86"), KVM will continue using the software timer until the guest reprograms the APIC timer in some way. Since the periodic timer does not require frequent APIC timer register programming, the guest may continue to use the software timer in perpetuity. Fixes: d8f2f498d9ed ("x86/kvm: fix LAPIC timer drift when guest uses periodic mode") Cc: stable@vger.kernel.org Signed-off-by: fuqiang wang [sean: massage comments and changelog] Link: https://patch.msgid.link/20251113205114.1647493-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 9633f180ce994ab293ce4924a9b7aaf4673aa114 Author: fuqiang wang Date: Thu Nov 13 12:51:12 2025 -0800 KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() When restarting an hrtimer to emulate a the guest's APIC timer in periodic mode, explicitly set the expiration using the target expiration computed by advance_periodic_target_expiration() instead of adding the period to the existing timer. This will allow making adjustments to the expiration, e.g. to deal with expirations far in the past, without having to implement the same logic in both advance_periodic_target_expiration() and apic_timer_fn(). Cc: stable@vger.kernel.org Signed-off-by: fuqiang wang [sean: split to separate patch, write changelog] Link: https://patch.msgid.link/20251113205114.1647493-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 0ea9494be9c931ddbc084ad5e11fda91b554cf47 Author: Sean Christopherson Date: Thu Nov 13 12:51:11 2025 -0800 KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 WARN and don't restart the hrtimer if KVM's callback runs with the guest's APIC timer in periodic mode but with a period of '0', as not advancing the hrtimer's deadline would put the CPU into an infinite loop of hrtimer events. Observing a period of '0' should be impossible, even when the hrtimer is running on a different CPU than the vCPU, as KVM is supposed to cancel the hrtimer before changing (or zeroing) the period, e.g. when switching from periodic to one-shot. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251113205114.1647493-2-seanjc@google.com Signed-off-by: Sean Christopherson commit b3e5b670c94968f237ce3f93d1345dfe41f54c15 Author: Sean Christopherson Date: Thu Nov 6 13:02:06 2025 -0800 KVM: x86: Use "checked" versions of get_user() and put_user() Use the normal, checked versions for get_user() and put_user() instead of the double-underscore versions that omit range checks, as the checked versions are actually measurably faster on modern CPUs (12%+ on Intel, 25%+ on AMD). The performance hit on the unchecked versions is almost entirely due to the added LFENCE on CPUs where LFENCE is serializing (which is effectively all modern CPUs), which was added by commit 304ec1b05031 ("x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec"). The small optimizations done by commit b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()") likely shave a few cycles off, but the bulk of the extra latency comes from the LFENCE. Don't bother trying to open-code an equivalent for performance reasons, as the loss of inlining (e.g. see commit ea6f043fc984 ("x86: Make __get_user() generate an out-of-line call") is largely a non-factor (ignoring setups where RET is something entirely different), As measured across tens of millions of calls of guest PTE reads in FNAME(walk_addr_generic): __get_user() get_user() open-coded open-coded, no LFENCE Intel (EMR) 75.1 67.6 75.3 65.5 AMD (Turin) 68.1 51.1 67.5 49.3 Note, Hyper-V MSR emulation is not a remotely hot path, but convert it anyways for consistency, and because there is a general desire to remove __{get,put}_user() entirely. Reported-by: Linus Torvalds Closes: https://lore.kernel.org/all/CAHk-=wimh_3jM9Xe8Zx0rpuf8CPDu6DkRCGb44azk0Sz5yqSnw@mail.gmail.com Cc: Borislav Petkov Link: https://patch.msgid.link/20251106210206.221558-1-seanjc@google.com Signed-off-by: Sean Christopherson commit a71e4f103aed69e7a11ea913312726bb194c76ee Author: Christian Brauner Date: Mon Nov 17 13:36:13 2025 +0100 pidfs: simplify PIDFD_GET__NAMESPACE ioctls We have reworked namespaces sufficiently that all this special-casing shouldn't be needed anymore Link: https://patch.msgid.link/20251117-eidesstattlich-apotheke-36d2e644079f@brauner Signed-off-by: Christian Brauner commit 82d20481024cbae2ea87fe8b86d12961bfda7169 Author: Rene Rebe Date: Fri Nov 14 14:41:27 2025 +0100 floppy: fix for PAGE_SIZE != 4KB For years I wondered why the floppy driver does not just work on sparc64, e.g: root@SUNW_375_0066:# disktype /dev/fd0 disktype: Can't open /dev/fd0: No such device or address [ 525.341906] disktype: attempt to access beyond end of device fd0: rw=0, sector=0, nr_sectors = 16 limit=8 [ 525.341991] floppy: error 10 while reading block 0 Turns out floppy.c __floppy_read_block_0 tries to read one page for the first test read to determine the disk size and thus fails if that is greater than 4k. Adjust minimum MAX_DISK_SIZE to PAGE_SIZE to fix floppy on sparc64 and likely all other PAGE_SIZE != 4KB configs. Cc: stable@vger.kernel.org Signed-off-by: René Rebe Signed-off-by: Jens Axboe commit 348d3c587ac6fa5aaa24ab5c71b7b5635c47e765 Author: Zqiang Date: Mon Nov 17 20:53:11 2025 +0800 sched_ext: Use kvfree_rcu() to release per-cpu ksyncs object The free_kick_syncs_rcu() rcu-callback only invoke kvfree() to release per-cpu ksyncs object, this can use kvfree_rcu() replace call_rcu() to release per-cpu ksyncs object in the free_kick_syncs(). Signed-off-by: Zqiang Signed-off-by: Tejun Heo commit e0f44f74ed6313e50b38eb39a2c7f210ae208db2 Author: Johan Hovold Date: Tue Sep 23 17:23:40 2025 +0200 drm/mediatek: ovl_adaptor: Fix probe device leaks Make sure to drop the references taken to the component devices by of_find_device_by_node() during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 453c3364632a ("drm/mediatek: Add ovl_adaptor support for MT8195") Cc: stable@vger.kernel.org # 6.4 Cc: Nancy.Lin Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-6-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 2a2a04be8e869a19c9f950b89b1e05832a0f7ec7 Author: Johan Hovold Date: Tue Sep 23 17:23:38 2025 +0200 drm/mediatek: Fix probe device leaks Make sure to drop the reference taken to each component device during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 6ea6f8276725 ("drm/mediatek: Use correct device pointer to get CMDQ client register") Cc: stable@vger.kernel.org # 5.12 Cc: Chun-Kuang Hu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-4-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 5e49200593f331cd0629b5376fab9192f698e8ef Author: Johan Hovold Date: Tue Sep 23 17:23:37 2025 +0200 drm/mediatek: Fix probe memory leak The Mediatek DRM driver allocates private data for components without a platform driver but as the lifetime is tied to each component device, the memory is never freed. Tie the allocation lifetime to the DRM platform device so that the memory is released on probe failure (e.g. probe deferral) and when the driver is unbound. Fixes: c0d36de868a6 ("drm/mediatek: Move clk info from struct mtk_ddp_comp to sub driver private data") Cc: stable@vger.kernel.org # 5.12 Cc: CK Hu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-3-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 07c7c640a8eb9e196f357d15d88a59602a947197 Author: Johan Hovold Date: Tue Sep 23 17:23:36 2025 +0200 drm/mediatek: Fix probe resource leaks Make sure to unmap and release the component iomap and clock on probe failure (e.g. probe deferral) and on driver unbind. Note that unlike of_iomap(), devm_of_iomap() also checks whether the region is already mapped. Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") Cc: stable@vger.kernel.org # 4.7 Cc: CK Hu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-2-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 65773aa51d98ac21fc75f4b6f85f354c3a14c131 Author: Sjoerd Simons Date: Thu Oct 23 12:32:37 2025 +0200 drm/mediatek: mtk_hdmi_common: Defer probe when ddc i2c bus isn't available yet The i2c adapter for ddc might not be available yet due to e.g. its module not yet being loaded. To handle that defer probing rather then returning a fatal error when probing. Signed-off-by: Sjoerd Simons Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Chun-Kuang Hu commit 28b7c8a16715dd798a386850b7397d186387fb78 Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:36 2025 +0200 drm/mediatek: mtk_hdmi_v2: Add debugfs ops and implement ABIST Implement the Automated Built-In Self-Test ABIST functionality provided by the HDMIv2 IP and expose it through the "hdmi_abist" debugfs file. Write "1" to this file to activate ABIST, or "0" to deactivate. The ABIST functionality can be used to validate that the HDMI Transmitter itself works and that can output a valid image to the HDMI Display that is connected. This is especially useful when trying to rule out any possible issue that is related to the display pipeline, as the HDMI Tx is always the last component; this means that HDMI ABIST can be used even without prior display controller pipeline configuration. The expected output is a 100% color bar (rainbow) test pattern. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-10-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 8d0f798862731c62b09e7138a9032964d70566c2 Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:35 2025 +0200 drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188 Add support for the newer HDMI-TX (Encoder) v2 and DDC v2 IPs found in MediaTek's MT8195, MT8188 SoC and their variants, and including support for display modes up to 4k60 and for HDMI Audio, as per the HDMI 2.0 spec. HDCP and CEC functionalities are also supported by this hardware, but are not included in this commit and that also poses a slight difference between the V2 and V1 controllers in how they handle Hotplug Detection (HPD). While the v1 controller was using the CEC controller to check HDMI cable connection and disconnection, in this driver the v2 one does not. This is due to the fact that on parts with v2 designs, like the MT8195 SoC, there is one CEC controller shared between the HDMI Transmitter (HDMI-TX) and Receiver (HDMI-RX): before eventually adding support to use the CEC HW to wake up the HDMI controllers it is necessary to have support for one TX, one RX *and* for both at the same time. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-9-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu ddc_v2 ddc_v2 commit 3cbf91147a534032f84d23cf1349595bfb1638a8 Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:34 2025 +0200 drm/mediatek: mtk_hdmi_common: Add var to enable interlaced modes Add an interlace_allowed bool member to struct mtk_hdmi_ver_conf which will be used to signal whether interlaced modes are supported by the bridge (in our case, the HDMI IP), and enable it for HDMIv2. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-8-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit b139557f41e5eecb3ec65d2bbc9b05b13f2ccc8c Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:33 2025 +0200 drm/mediatek: mtk_hdmi_common: Add OP_HDMI if helper funcs assigned In preparation for adding the HDMI TX v2 driver, and to allow a future modernization of the HDMI v1 one, perform changes that enable the usage of the HDMI Helpers provided by DRM. Check if the HDMI driver provides the function pointers to hdmi_{clear,write}_infoframe used by the HDMI Helper API and, if present, add DRM_BRIDGE_OP_HDMI to the drm_bridge ops, enabling the drm API to register the bridge as HDMI and to use the HDMI Helper functions. If the hdmi_{write,clear}_infoframe pointers are not assigned, vendor and product strings and HDMI helpers will not be used, hence this commit brings no functional changes to drivers that have not been refactored to use the new helpers. This also means that, in the current state, there is effectively no functional change to mtk_hdmi and its other components. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-7-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 06e2d1d2c8010fb397d8c88169c088b32e9c1730 Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:32 2025 +0200 drm/mediatek: mtk_hdmi_common: Assign DDC adapter pointer to bridge In preparation for adding the new HDMI TX v2 IP driver, assign the pointer to the DDC adapter to struct drm_bridge during probe. This commit brings no functional changes. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-6-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit a71afdc00563d8e5685d5e58aa4335b812239fbd Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:31 2025 +0200 drm/mediatek: mtk_hdmi_common: Make CEC support optional In preparation for adding a new driver for HDMIv2, for which CEC is not strictly required, change the of_get_compatible_child() failure error to -EOPNOTSUPP to be able to differentiate between error conditions in mtk_hdmi_dt_parse_pdata(). In that case, if -EOPNOTSUPP is returned, this driver will print an informative message saying that CEC support is unavailable, as the devicetree node for that was not found, but after that, function mtk_hdmi_dt_parse_pdata() will not return error to the caller. This will not change functionality of the mtk_hdmi (v1) driver as that is still checking whether CEC is present and, if not, will fail probing with an error saying that CEC is required by HDMIv1. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-5-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 86b1e68fe0869bdcb38ed5283a25931a5581ffcc Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:30 2025 +0200 drm/mediatek: mtk_hdmi: Split driver and add common probe function In preparation for adding a new driver for the HDMI TX v2 IP, split out the functions that will be common between the already present mtk_hdmi (v1) driver and the new one. Since the probe flow for both drivers is 90% similar, add a common probe function that will be called from each driver's .probe() callback, avoiding lots of code duplication. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-4-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 23161299558d50ca80cc2f839dee19ac802f0b76 Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:29 2025 +0200 drm/mediatek: mtk_hdmi: Add HDMI IP version configuration to pdata In preparation for adding a driver for the HDMIv2 IP and before moving the common bits out of this driver, add a new structure `mtk_hdmi_ver_conf`, holding pointers to HDMI IP version specific drm_bridge_funcs, hdmi_codec_ops and clock array used for probe, and nest it into the mtk_hdmi_conf platform data structure. While at it, also convert all of the direct users of mtk_hdmi_bridge_funcs, mtk_hdmi_audio_codec_ops, mtk_hdmi_clk_names to use pointers from the ver_conf platform data. In order to do so, it was also necessary to fill a new version 1 specific const `mtk_hdmi_v1_ver_conf` and assign it to all of the currently supported compatibles for this driver. This commit brings no functional change. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-3-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 0d410bd10ae430652d6a2f1169ca84be82bfeaff Author: AngeloGioacchino Del Regno Date: Thu Oct 23 12:32:28 2025 +0200 drm/mediatek: mtk_hdmi: Improve mtk_hdmi_get_all_clk() flexibility In preparation for splitting common bits of this driver and for introducing a new version of the MediaTek HDMI Encoder IP, improve the flexibility of function mtk_hdmi_get_all_clk() by adding a pointer to the clock names array and size of it to its parameters. Also change the array of struct clock pointers in the mtk_hdmi structure to be dynamically allocated, and allocate it in probe. Reviewed-by: CK Hu Signed-off-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-2-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 257dfd9e204fd0245d5e309f2b5ddf9dece576da Author: Louis-Alexis Eyraud Date: Thu Oct 23 12:32:27 2025 +0200 drm/mediatek: mtk_hdmi: Drop redundant clock retrieval in mtk_hdmi_get_cec_dev In mtk_hdmi driver, when the CEC device parsing logic was moved from mtk_hdmi_dt_parse_pdata function to the new mtk_hdmi_get_cec_dev sub function, the call to mtk_hdmi_get_all_clk was kept in both functions, whereas it was only called once in the original mtk_hdmi_dt_parse_pdata code and does not need to be called a second time. So, remove this call from mtk_hdmi_get_cec_dev to keep the same sequence as previously. Fixes: 7485be967f7f ("drm/mediatek: mtk_hdmi: Move CEC device parsing in new function") Reviewed-by: CK Hu Signed-off-by: Louis-Alexis Eyraud Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20251023-mediatek-drm-hdmi-v2-v11-1-7873ec4a1edf@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 9545bae5c8acd5a47af7add606718d94578bd838 Author: Johan Hovold Date: Tue Sep 23 17:23:39 2025 +0200 drm/mediatek: mtk_hdmi: Fix probe device leaks Make sure to drop the references to the DDC adapter and CEC device taken during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support") Cc: stable@vger.kernel.org # 4.8 Cc: Jie Qiu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-5-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 78cd170d035fe9b0372c0527f1613ddde8296667 Author: Eric Biggers Date: Thu Oct 16 11:15:34 2025 -0700 nfsd: Use MD5 library instead of crypto_shash Update NFSD's support for "legacy client tracking" (which uses MD5) to use the MD5 library instead of crypto_shash. This has several benefits: - Simpler code. Notably, much of the error-handling code is no longer needed, since the library functions can't fail. - Improved performance due to reduced overhead. A microbenchmark of nfs4_make_rec_clidname() shows a speedup from 1455 cycles to 425. - The MD5 code can now safely be built as a loadable module when nfsd is built as a loadable module. (Previously, nfsd forced the MD5 code to built-in, presumably to work around the unreliability of the name-based loading.) Thus select MD5 from the tristate option NFSD if NFSD_LEGACY_CLIENT_TRACKING, instead of from the bool option NFSD_V4. - Fixes a bug where legacy client tracking was not supported on kernels booted with "fips=1", due to crypto_shash not allowing MD5 to be used. This particular use of MD5 is not for a cryptographic purpose, though, so it is acceptable even when fips=1 (see https://lore.kernel.org/r/dae495a93cbcc482f4ca23c3a0d9360a1fd8c3a8.camel@redhat.com/). Signed-off-by: Eric Biggers Acked-by: Ard Biesheuvel Acked-by: Jeff Layton Reviewed-by: Scott Mayhew Signed-off-by: Chuck Lever commit fceb8734e7f1e5dd698c03403ff500923e0fd612 Author: NeilBrown Date: Thu Oct 16 09:49:58 2025 -0400 nfsd: stop pretending that we cache the SEQUENCE reply. nfsd does not cache the reply to a SEQUENCE. As the comment above nfsd4_replay_cache_entry() says: * The sequence operation is not cached because we can use the slot and * session values. The comment above nfsd4_cache_this() suggests otherwise. * The session reply cache only needs to cache replies that the client * actually asked us to. But it's almost free for us to cache compounds * consisting of only a SEQUENCE op, so we may as well cache those too. * Also, the protocol doesn't give us a convenient response in the case * of a replay of a solo SEQUENCE op that wasn't cached The code in nfsd4_store_cache_entry() makes it clear that only responses beyond 'cstate.data_offset' are actually cached, and data_offset is set at the end of nfsd4_encode_sequence() *after* the sequence response has been encoded. This patch simplifies code and removes the confusing comments. - nfsd4_is_solo_sequence() is discarded as not-useful. - nfsd4_cache_this() is now trivial so it too is discarded with the code placed in-line at the one call-site in nfsd4_store_cache_entry(). - nfsd4_enc_sequence_replay() is open-coded in to nfsd4_replay_cache_entry(), and then simplified to (hopefully) make the process of replaying a reply clearer. Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8320b75b2b8bf94d4d4f1b59f75ec8dd7188dc76 Author: Bagas Sanjaya Date: Mon Nov 17 17:24:17 2025 +0700 NFS: nfsd-maintainer-entry-profile: Inline function name prefixes Sphinx reports htmldocs warnings: Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst:185: ERROR: Unknown target name: "nfsd". [docutils] Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst:188: ERROR: Unknown target name: "nfsdn". [docutils] Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst:192: ERROR: Unknown target name: "nfsd4m". [docutils] These are due to Sphinx confusing function name prefixes for external link syntax. Fix the warnings by inlining the prefixes. Fixes: 3a1ce35030e1e0 ("NFSD: Add a subsystem policy document") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251117174218.29365f30@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Signed-off-by: Chuck Lever commit ff64e078e45faee50cc6ca7900a3520e8ff1c79e Author: Alex Elder Date: Thu Nov 13 15:45:37 2025 -0600 PCI: spacemit: Add SpacemiT PCIe host driver Introduce a driver for the PCIe host controller found in the SpacemiT K1 SoC. The hardware is derived from the Synopsys DesignWare PCIe IP. The driver supports up to three PCIe ports operating at PCIe link speed up to 5 GT/s. The first port uses a combo PHY, which may be configured for use for USB3 instead. Signed-off-by: Alex Elder [mani: added FIXME to the comment on disabling ASPM L1] Signed-off-by: Manivannan Sadhasivam Tested-by: Jason Montleon Tested-by: Johannes Erdfelt Tested-by: Aurelien Jarno Link: https://patch.msgid.link/20251113214540.2623070-6-elder@riscstar.com commit a812b09a6b599ea80ec1065a9a635724a235843d Author: Alex Elder Date: Thu Nov 13 15:45:35 2025 -0600 dt-bindings: pci: spacemit: Introduce PCIe host controller Add the Devicetree binding for the PCIe Root Complex found on the SpacemiT K1 SoC. This Root Complex is derived from the Synopsys Designware PCIe IP. It supports up to three PCIe ports operating at PCIe link speed up to 5 GT/sec. One of the ports uses a combo PHY, which is typically used to support a USB3 port. Signed-off-by: Alex Elder Signed-off-by: Manivannan Sadhasivam Tested-by: Jason Montleon Tested-by: Johannes Erdfelt Tested-by: Aurelien Jarno Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251113214540.2623070-4-elder@riscstar.com commit 3b83eea6334acd07ae5fa043442a6ade732d7a39 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:52 2025 +0100 dt-bindings: PCI: qcom,pcie-x1e80100: Add missing required power-domains and resets Power domains and resets should be required for PCI, so the proper SoC supplies are turned on. Fixes: 692eadd51698 ("dt-bindings: PCI: qcom: Document the X1E80100 PCIe Controller") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-9-28c1f11599fe@linaro.org commit e60c6f34b9f3a83f96006243c0ef96c134520257 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:51 2025 +0100 dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets Commit b8d3404058a6 ("dt-bindings: PCI: qcom,pcie-sm8550: Move SM8550 to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: b8d3404058a6 ("dt-bindings: PCI: qcom,pcie-sm8550: Move SM8550 to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-8-28c1f11599fe@linaro.org commit 667facc4000c49a7c280097ef6638f133bcb1e59 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:50 2025 +0100 dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets Commit 88c9b3af4e31 ("dt-bindings: PCI: qcom,pcie-sm8450: Move SM8450 to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: 88c9b3af4e31 ("dt-bindings: PCI: qcom,pcie-sm8450: Move SM8450 to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-7-28c1f11599fe@linaro.org commit 012ba0d5f02e1f192eda263b5f9f826e47d607bb Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:49 2025 +0100 dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets Commit 2278b8b54773 ("dt-bindings: PCI: qcom,pcie-sm8350: Move SM8350 to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: 2278b8b54773 ("dt-bindings: PCI: qcom,pcie-sm8350: Move SM8350 to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-6-28c1f11599fe@linaro.org commit 2620c6bcd8c141b79ff2afe95dc814dfab644f63 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:48 2025 +0100 dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets Commit 4891b66185c1 ("dt-bindings: PCI: qcom,pcie-sm8250: Move SM8250 to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: 4891b66185c1 ("dt-bindings: PCI: qcom,pcie-sm8250: Move SM8250 to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-5-28c1f11599fe@linaro.org commit 31cb432b62fb796e0c1084542ba39311d2f716d5 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:47 2025 +0100 dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets Commit 51bc04d5b49d ("dt-bindings: PCI: qcom,pcie-sm8150: Move SM8150 to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: 51bc04d5b49d ("dt-bindings: PCI: qcom,pcie-sm8150: Move SM8150 to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-4-28c1f11599fe@linaro.org commit ea551601404d286813aef6819ddf0bf1d7d69a24 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:46 2025 +0100 dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets Commit c007a5505504 ("dt-bindings: PCI: qcom,pcie-sc8280xp: Move SC8280XP to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: c007a5505504 ("dt-bindings: PCI: qcom,pcie-sc8280xp: Move SC8280XP to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-3-28c1f11599fe@linaro.org commit ef99c2efeacac7758cc8c2d00e3200100a4da16c Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:45 2025 +0100 dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets Commit 756485bfbb85 ("dt-bindings: PCI: qcom,pcie-sc7280: Move SC7280 to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: 756485bfbb85 ("dt-bindings: PCI: qcom,pcie-sc7280: Move SC7280 to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-2-28c1f11599fe@linaro.org commit 2ca17727b3623228466d15a562c6c4f4bea8cc49 Author: Krzysztof Kozlowski Date: Thu Oct 30 09:50:44 2025 +0100 dt-bindings: PCI: qcom,pcie-sa8775p: Add missing required power-domains and resets Commit 544e8f96efc0 ("dt-bindings: PCI: qcom,pcie-sa8775p: Move SA8775p to dedicated schema") move the device schema to separate file, but it missed a "if:not:...then:" clause in the original binding which was requiring power-domains and resets for this particular chip. Fixes: 544e8f96efc0 ("dt-bindings: PCI: qcom,pcie-sa8775p: Move SA8775p to dedicated schema") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251030-dt-bindings-pci-qcom-fixes-power-domains-v2-1-28c1f11599fe@linaro.org commit 77b686f688126a5f758b51441a03186e9eb1b0f1 Author: Alice Ryhl Date: Mon Nov 17 10:39:17 2025 +0000 gpu: nova-core: make formatting compatible with rust tree Commit 38b7cc448a5b ("gpu: nova-core: implement Display for Spec") in drm-rust-next introduced some usage of the Display trait, but the Display trait is being modified in the rust tree this cycle. Thus, to avoid conflicts with the Rust tree, tweak how the formatting machinery is used in a way where it works both with and without the changes in the Rust tree. Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Link: https://patch.msgid.link/20251117-nova-fmt-rust-v1-1-651ca28cd98f@google.com Signed-off-by: Alice Ryhl commit 38eff72f2d3a83475d70ac3a1280b5051d1e46b0 Author: Niravkumar L Rabara Date: Fri Nov 14 23:40:17 2025 +0800 arm64: dts: socfpga: agilex5: update qspi partitions for 013b board Update qspi flash partitions to support Remote System Update (RSU). Signed-off-by: Niravkumar L Rabara Signed-off-by: Dinh Nguyen commit 9c3af1b2f73cc72f5035bc9372c18b3780e1f258 Author: Peter Ujfalusi Date: Tue Nov 4 14:16:50 2025 +0200 ALSA: hda: controllers: intel: add support for Nova Lake S Add NVL-S to the PCI-ID list. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-8-peter.ujfalusi@linux.intel.com commit eece72a0d4093e17ae71ad739fe0cdb56bb9ba98 Author: Peter Ujfalusi Date: Tue Nov 4 14:16:49 2025 +0200 ALSA: hda: core: intel-dsp-config: Add support for NVL-S Same recipes as PTL for NVL-S from the Nova Lake family. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-7-peter.ujfalusi@linux.intel.com commit d3df422f66e8a67e93e8a5f275a8a52a8a4b6b4f Author: Peter Ujfalusi Date: Tue Nov 4 14:16:48 2025 +0200 ASoC: SOF: Intel: add initial support for NVL-S Add support for Nova Lake S (NVL-S). Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Acked-by: Mark Brown Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-6-peter.ujfalusi@linux.intel.com commit 41566e3de40616375e8dfe5455344558b79f9354 Author: Bard Liao Date: Tue Nov 4 14:16:47 2025 +0200 ASoC: Intel: soc-acpi-intel-nvl-match: add rt722 l3 support Add rt722 on SDW link 3 support Signed-off-by: Bard Liao Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Acked-by: Mark Brown Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-5-peter.ujfalusi@linux.intel.com commit 2bd7bf3ccc83074dbaf53c941539732652451b09 Author: Peter Ujfalusi Date: Tue Nov 4 14:16:46 2025 +0200 ASoC: Intel: soc-acpi: add NVL match tables For now the tables are basic for mockup devices Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Acked-by: Mark Brown Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-4-peter.ujfalusi@linux.intel.com commit cd53591ae4cd0dc6cf2c26d511172452d4b2f5aa Author: Peter Ujfalusi Date: Tue Nov 4 14:16:45 2025 +0200 ALSA: hda/hdmi: intelhdmi: add HDMI codec ID for Intel NVL Add HDMI codec ID for Intel Nova Lake platform. Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-3-peter.ujfalusi@linux.intel.com commit e678c2a0063ec931642b3c5935fb0c3c1282b6b3 Author: Peter Ujfalusi Date: Tue Nov 4 14:16:44 2025 +0200 PCI: Add Intel Nova Lake S audio Device ID Add Nova Lake S (NVL-S) audio Device ID The ID will be used by HDA legacy, SOF audio stack and the driver to determine which audio stack should be used (intel-dsp-config). Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Reviewed-by: Ranjani Sridharan Acked-by: Bjorn Helgaas Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20251104121650.21872-2-peter.ujfalusi@linux.intel.com commit 2a2153a2bac7d9388b661a18d49707a8d885b231 Author: Peter Oberparleiter Date: Fri Nov 14 15:04:20 2025 +0100 s390/debug: Update description of resize operation With commit 1204777867e8 ("s390/debug: keep debug data on resize") the behavior of a debug area resize operation was changed. Update the associated documentation to reflect this change. Fixes: 1204777867e8 ("s390/debug: keep debug data on resize") Reported-by: Heiko Carstens Signed-off-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit b98994cb9bc24f5c7575c86650f96c384576fdfa Author: Daniel Golle Date: Mon Nov 17 02:54:19 2025 +0000 mtd: spinand: esmt: add support for F50L1G41LC This adds support for ESMT F50L1G41LC, which appears to be an updated version of the already supported F50L1G41LB. Add esmt_8c SPI_NAND manufacturer to account for the newly used vendor ID with support for the ESMT F50L1G41LC chip. Link: https://github.com/openwrt/openwrt/pull/15214#issuecomment-3514824435 Signed-off-by: Daniel Golle Signed-off-by: Miquel Raynal commit 1f3dcfe5fcf57739b4a82811c12e55c48d794f86 Author: Haotian Zhang Date: Tue Nov 4 18:08:41 2025 +0800 mtd: rawnand: lpc32xx_slc: Convert to use devm_gpiod_get_optional() The initial fix for a GPIO descriptor leak added manual gpiod_put() calls in the error path and remove function. This follow-up patch improves upon the fix by switching to the resource-managed devm_gpiod_get_optional() API. Suggested-by: Vladimir Zapolskiy Signed-off-by: Haotian Zhang Reviewed-by: Vladimir Zapolskiy Signed-off-by: Miquel Raynal commit 64ef5f454e167bb66cf70104f033c3d71e6ef9c0 Author: Christian Marangi Date: Sun Nov 9 12:52:44 2025 +0100 mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions Commit 5c2f7727d437 ("mtd: mtdpart: check for subpartitions parsing result") introduced some kind of regression with parser on subpartitions where if a parser emits an error then the entire parsing process from the upper parser fails and partitions are deleted. Not checking for error in subpartitions was originally intended as special parser can emit error also in the case of the partition not correctly init (for example a wiped partition) or special case where the partition should be skipped due to some ENV variables externally provided (from bootloader for example) One example case is the TRX partition where, in the context of a wiped partition, returns a -ENOENT as the trx_magic is not found in the expected TRX header (as the partition is wiped) To better handle this and still keep some kind of error tracking (for example to catch -ENOMEM errors or -EINVAL errors), permit parser on subpartition to emit -ENOENT error, print a debug log and skip them accordingly. This results in giving better tracking of the status of the parser (instead of returning just 0, dropping any kind of signal that there is something wrong with the parser) and to some degree restore the original logic of the subpartitions parse. (worth to notice that some special partition might have all the special header present for the parser and declare 0 partition in it, this is why it would be wrong to simply return 0 in the case of a special partition that is NOT init for the scanning parser) Cc: stable@vger.kernel.org Fixes: 5c2f7727d437 ("mtd: mtdpart: check for subpartitions parsing result") Signed-off-by: Christian Marangi Signed-off-by: Miquel Raynal commit a697c671cc317aac3714ac735a336346af15d025 Author: Abdun Nihaal Date: Mon Nov 3 20:51:39 2025 +0530 mtd: maps: pcmciamtd: fix potential memory leak in pcmciamtd_detach() The memory allocated for struct pcmciamtd_dev in pcmciamtd_probe() is not freed in the corresponding remove function pcmciamtd_detach(). Fix that by freeing it in the remove function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Abdun Nihaal Signed-off-by: Miquel Raynal commit 4d822b0a4a272902039c77e68c9b12bdb20c233f Author: Johan Hovold Date: Mon Nov 10 12:12:12 2025 +0100 USB: serial: ftdi_sio: drop NDI quirk module parameter NDI devices have been using a latency timer of 1 ms since commit b760dac290c3 ("USB: ftdi: support NDI devices"), which also added a vendor specific module parameter that could be used to override the default value for these devices. Module parameters should generally be avoided as they apply to all devices managed by a driver and vendor specific hacks should be kept out of mainline. Drop the module parameter in favour of the generic sysfs interface for setting the latency timer (e.g. using udev rules) while keeping the default 1 ms timer for NDI devices. Note that there seems to be no (correct) public references to the module parameter and most likely no one is using it. Cc: Ryan Mann Signed-off-by: Johan Hovold commit cde24373724bd3a0937b7af9453dfc6d7433c726 Author: Johan Hovold Date: Mon Nov 10 12:12:11 2025 +0100 USB: serial: ftdi_sio: clean up NDI speed hack NDI devices remap the 19200 line speed to 1.2 Mbps. Use the quirk pointer from the match table to enable the quirk instead of comparing PIDs on every speed change. Signed-off-by: Johan Hovold commit 96e5d1b1e69097cb89f8002770cccf464c0dfa1c Author: Johan Hovold Date: Mon Nov 10 12:12:10 2025 +0100 USB: serial: ftdi_sio: enable NDI speed hack consistently The original submission adding support for NDI EMGUIDE Gemini enabled the existing NDI speed hack which remaps the 19200 line speed to 1.2 Mbps, but this silently fell out during resubmission. Enable the speed hack also for the new NDI product for consistency. This will also allow for cleaning up the implementation without resorting to overengineering. Link: https://lore.kernel.org/all/YQXPR01MB49870CB7B3075ADDF88A3FD4DF43A@YQXPR01MB4987.CANPRD01.PROD.OUTLOOK.COM/ Link: https://lore.kernel.org/all/YQXPR01MB4987F1E0DA41E689779E6958DF48A@YQXPR01MB4987.CANPRD01.PROD.OUTLOOK.COM/ Cc: Ryan Mann Signed-off-by: Johan Hovold commit f5fef0c5f641435dbd69b9b1f1795ceec67cfe06 Author: Johan Hovold Date: Mon Nov 10 12:12:09 2025 +0100 USB: serial: ftdi_sio: rename quirk symbols Use lower case names for the quirk symbols and rename the NDI quirk probe function for consistency. Signed-off-by: Johan Hovold commit 47ed918ececc7cad21268ae32bf69be80014e04f Author: Johan Hovold Date: Mon Nov 10 12:12:08 2025 +0100 USB: serial: ftdi_sio: clean up quirk comments Clean up the quirk function comments that were using odd formatting and were referring to a non-existing function. Signed-off-by: Johan Hovold commit 73de1ddaf4e6f851eb3f67751c3aadb62229094b Author: Johan Hovold Date: Mon Nov 10 12:12:07 2025 +0100 USB: serial: ftdi_sio: rewrite 8u2232c quirk Rewrite the 8u2232c quirk to avoid the manufacturer and product string comparisons for the second port which will always be bound. Signed-off-by: Johan Hovold commit 448016e3265410ee61006da1ffa3478854baba4b Author: Johan Hovold Date: Mon Nov 10 12:12:06 2025 +0100 USB: serial: ftdi_sio: silence jtag probe Probe of a device should generally be silent unless errors are encountered. Stop logging that the JTAG port is ignored when probing devices with such a reserved port. This also maintains consistency with devices that match on interface number to avoid binding to reserved ports. Note that the message is not even correct for the second port of the ST Micro Connect Lite. Signed-off-by: Johan Hovold commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd Author: Johan Hovold Date: Mon Nov 10 12:12:05 2025 +0100 USB: serial: ftdi_sio: match on interface number for jtag Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it. As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already). This avoids probing interfaces that will never be bound and cleans up the match table somewhat. Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries. Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 0d79affa31cbee477a45642efc49957d05466307 Merge: 52a1f73d1733e6 4ac286c4a8d904 Author: Heiko Carstens Date: Mon Nov 17 11:11:48 2025 +0100 Merge branch 'compat-removal' Heiko Carstens says: ==================== Remove s390 compat support to allow for code simplification and especially reduced test effort. To the best of our knowledge there aren't any 31 bit binaries out in the world anymore that would matter for newer kernels or newer distributions. Distributions do not provide compat packages since quite some time or even have CONFIG_COMPAT disabled. Instead of adding deprecation warnings to config option, or adding kernel messages, just remove the code. Deprecation warnings haven't proven to be useful. If it turns out there is still a reason to keep the compat support this series can be reverted at any time in the future. ==================== Signed-off-by: Heiko Carstens commit 4ac286c4a8d904c8818a6f019da8117ec31b2c27 Author: Heiko Carstens Date: Mon Nov 10 19:54:40 2025 +0100 s390/syscalls: Switch to generic system call table generation The s390 syscall.tbl format differs slightly from most others, and therefore requires an s390 specific system call table generation script. With compat support gone use the opportunity to switch to generic system call table generation. The abi for all 64 bit system calls is now common, since there is no need to specify if system call entry points are only for 64 bit anymore. Furthermore create the system call table in C instead of assembler code in order to get type checking for all system call functions contained within the table. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit f4e1f1b1379df5b44fffbf09940761921d35da66 Author: Heiko Carstens Date: Mon Nov 10 19:54:39 2025 +0100 s390/syscalls: Remove system call table pointer from thread_struct With compat support gone there is only one system call table left. Therefore remove the sys_call_table pointer from thread_struct and use the sys_call_table directly. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit 3db5cf9354710c3b9268af74a0dca88514279453 Author: Heiko Carstens Date: Mon Nov 10 19:54:38 2025 +0100 s390/uapi: Remove 31 bit support from uapi header files Since the kernel does not support running 31 bit / compat binaries anymore, remove also the corresponding 31 bit support from uapi header files. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit 8e0b986c59c67e08ada646249f834655a9e6da16 Author: Heiko Carstens Date: Mon Nov 10 19:54:37 2025 +0100 s390: Remove compat support There shouldn't be any 31 bit code around anymore that matters. Remove the compat layer support required to run 31 bit code. Reason for removal is code simplification and reduced test effort. Note that this comes without any deprecation warnings added to config options, or kernel messages, since most likely those would be ignored anyway. If it turns out there is still a reason to keep the compat layer this can be reverted at any time in the future. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit 169ebcbb90829bec0429ff9f6012a0313169e45f Author: Heiko Carstens Date: Mon Nov 10 19:54:36 2025 +0100 tools: Remove s390 compat support Remove s390 compat support from everything within tools, since s390 compat support will be removed from the kernel. Reviewed-by: Arnd Bergmann Acked-by: Thomas Weißschuh # tools/nolibc selftests/nolibc Reviewed-by: Thomas Weißschuh # selftests/vDSO Acked-by: Alexei Starovoitov # bpf bits Signed-off-by: Heiko Carstens commit 7afb095df3e3c2f0d2f27d2d27bbe574ca9479f0 Author: Heiko Carstens Date: Mon Nov 10 19:54:35 2025 +0100 s390/syscalls: Add pt_regs parameter to SYSCALL_DEFINE0() syscall wrapper All system call wrappers should match the sys_call_ptr_t type. This is not the case for system calls without parameters. Add the missing pt_regs parameter there too. Note: this is currently not a problem, since the parameter is unused. However it prevents to create a correctly typed system call table in C. With the current assembler implementation this works because of missing type checking. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit b2da5f6400b458659c4d3fc90d27c2da42435169 Author: Heiko Carstens Date: Mon Nov 10 19:54:34 2025 +0100 s390/kvm: Use psw32_t instead of psw_compat_t kvm_s390_handle_lpsw() make use of the psw_compat_t type even though the code has nothing to do with CONFIG_COMPAT, for which the type is supposed to be used. Use psw32_t instead. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit 8c633c78c23a85a9efbabbe47d815ebdd7739905 Author: Heiko Carstens Date: Mon Nov 10 19:54:33 2025 +0100 s390/ptrace: Rename psw_t32 to psw32_t Use a standard "_t" suffix for psw_t32 and rename it to psw32_t. Reviewed-by: Arnd Bergmann Signed-off-by: Heiko Carstens commit 67f9b828d4e5e47caf3472a399c25c3c0ddc824a Author: Kartik Rajput Date: Thu Nov 13 22:01:12 2025 +0530 gpio: tegra186: Fix GPIO name collisions for Tegra410 On Tegra410, Compute and System GPIOs have same port names. This results in the same GPIO names for both Compute and System GPIOs during initialization in `tegra186_gpio_probe()`, which results in following warnings: kernel: gpio gpiochip1: Detected name collision for GPIO name 'PA.00' kernel: gpio gpiochip1: Detected name collision for GPIO name 'PA.01' kernel: gpio gpiochip1: Detected name collision for GPIO name 'PA.02' kernel: gpio gpiochip1: Detected name collision for GPIO name 'PB.00' kernel: gpio gpiochip1: Detected name collision for GPIO name 'PB.01' ... Add GPIO name prefix in the SoC data and use it to initialize the GPIO name. Port names remain unchanged for previous SoCs. On Tegra410, Compute GPIOs are named COMPUTE-P.GPIO, and System GPIOs are named SYSTEM-P.GPIO. Fixes: 9631a10083d8 ("gpio: tegra186: Add support for Tegra410") Signed-off-by: Kartik Rajput Acked-by: Thierry Reding Reviewed-by: Jon Hunter Link: https://lore.kernel.org/r/20251113163112.885900-1-kkartik@nvidia.com Signed-off-by: Bartosz Golaszewski commit ade570c138a509c11b5d016a227009f2f399fd4a Author: Andy Shevchenko Date: Wed Nov 12 10:32:02 2025 +0100 gpiolib: legacy: Allow to kill devm_gpio_request_one() independently Allow to kill devm_gpio_request_one() independently by converting it to use legacy APIs that will be alive a bit longer. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251112093608.1481030-3-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 61e1fd2abca4c551fb40afcb733a31de1991c656 Author: Andy Shevchenko Date: Wed Nov 12 10:32:01 2025 +0100 gpiolib: legacy: Make sure we kill gpio_request_one() first Make sure we kill gpio_request_one() first by converting it to use legacy APIs that will be alive a bit longer. In particular, this also shows the code we will use in another function to make it die independently. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251112093608.1481030-2-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 82e71fe4368699341333e7e0d059ef7df139cf95 Merge: b6d31cd41814a3 e511d484cbe44f Author: Bartosz Golaszewski Date: Mon Nov 17 10:37:37 2025 +0100 Merge tag 'gpio/shared-gpios-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git into gpio/for-next Immutable branch between the GPIO, ASoC and regulator trees for v6.19-rc1 Add better support for GPIOs shared by multiple consumers. commit eb374f764a7012eda28019266a6d9191670c4fa5 Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:35 2025 +0100 gpio: provide gpiod_is_shared() Provide an interface allowing consumers to check if a GPIO descriptor represents a GPIO that can potentially be shared by multiple consumers at the same time. This is exposed to allow subsystems that already work around the limitations of the current non-exclusive GPIO handling in some ways, to gradually convert to relying on the new shared GPIO feature of GPIOLIB. Extend the gpiolib-shared module to mark the GPIO shared proxy descriptors with a flag checked by the new interface. Reviewed-by: Linus Walleij Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-6-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit e511d484cbe44fe48a1b9f621f6a947c72503f9e Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:36 2025 +0100 arm64: select HAVE_SHARED_GPIOS for ARCH_QCOM Some qualcomm platforms use shared GPIOs. Enable support for them by selecting the Kconfig switch provided by GPIOLIB. Acked-by: Linus Walleij Acked-by: Bjorn Andersson Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-7-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 1e4f6db614a310cc34d07ffbf031c76ea9581bcf Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:34 2025 +0100 gpiolib: support shared GPIOs in core subsystem code As the final step in adding official support for shared GPIOs, enable the previously added elements in core GPIO subsystem code. Set-up shared GPIOs when adding a GPIO chip, tear it down on removal and check if a GPIO descriptor looked up during the firmware-node stage is shared and fall-back to machine lookup in this case. Reviewed-by: Linus Walleij Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-5-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit e992d54c6f970b382ffeacd7c88f68b94a3c6caf Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:33 2025 +0100 gpio: shared-proxy: implement the shared GPIO proxy driver Add a virtual GPIO proxy driver which arbitrates access to a single shared GPIO by multiple users. It works together with the core shared GPIO support from GPIOLIB and functions by acquiring a reference to a shared GPIO descriptor exposed by gpiolib-shared and making sure that the state of the GPIO stays consistent. In general: if there's only one user at the moment: allow it to do anything as if this was a normal GPIO (in essence: just propagate calls to the underlying real hardware driver). If there are more users: don't allow to change the direction set by the initial user, allow to change configuration options but warn about possible conflicts and finally: treat the output-high value as a reference counted, logical "GPIO enabled" setting, meaning: the GPIO value is set to high when the first user requests it to be high and back to low once the last user stops "voting" for high. Reviewed-by: Linus Walleij Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-4-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit a060b8c511abb0997381b397e52149a5e3e5259a Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:32 2025 +0100 gpiolib: implement low-level, shared GPIO support This module scans the device tree (for now only OF nodes are supported but care is taken to make other fwnode implementations easy to integrate) and determines which GPIO lines are shared by multiple users. It stores that information in memory. When the GPIO chip exposing shared lines is registered, the shared GPIO descriptors it exposes are marked as shared and virtual "proxy" devices that mediate access to the shared lines are created. When a consumer of a shared GPIO looks it up, its fwnode lookup is redirected to a just-in-time machine lookup that points to this proxy device. This code can be compiled out on platforms which don't use shared GPIOs. Reviewed-by: Linus Walleij Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-3-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit d4340ff75eaa083f261e16d49f13191236bfad06 Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:31 2025 +0100 gpiolib: define GPIOD_FLAG_SHARED Define a new GPIO descriptor flag for marking pins that are shared by multiple consumer. This flag will be used in several places so we need to do it in advance and separately from other changes. Reviewed-by: Linus Walleij Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-2-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 197b3f3c70d61ff1c7ca24f66d567e06fe8ed3d9 Author: Bartosz Golaszewski Date: Wed Nov 12 14:55:30 2025 +0100 string: provide strends() Implement a function for checking if a string ends with a different string and add its kunit test cases. Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20251112-gpio-shared-v4-1-b51f97b1abd8@linaro.org Signed-off-by: Bartosz Golaszewski commit c08934a61201db8f1d1c66fcc63fb2eb526b656d Author: Johan Hovold Date: Mon Oct 20 06:53:18 2025 +0200 iommu/tegra: fix device leak on probe_device() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device(). Note that commit 9826e393e4a8 ("iommu/tegra-smmu: Fix missing put_device() call in tegra_smmu_find") fixed the leak in an error path, but the reference is still leaking on success. Fixes: 891846516317 ("memory: Add NVIDIA Tegra memory controller support") Cc: stable@vger.kernel.org # 3.19: 9826e393e4a8 Cc: Miaoqian Lin Acked-by: Robin Murphy Acked-by: Thierry Reding Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit f916109bf53864605d10bf6f4215afa023a80406 Author: Johan Hovold Date: Mon Oct 20 06:53:17 2025 +0200 iommu/sun50i: fix device leak on of_xlate() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 4100b8c229b3 ("iommu: Add Allwinner H6 IOMMU driver") Cc: stable@vger.kernel.org # 5.8 Cc: Maxime Ripard Acked-by: Robin Murphy Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit 13e1d629d8eda8505d6d4227ab0bd3b0ad898534 Author: Johan Hovold Date: Mon Oct 20 06:53:16 2025 +0200 iommu/omap: simplify probe_device() error handling Simplify the probe_device() error handling by dropping the iommu OF node reference sooner. Acked-by: Robin Murphy Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit b5870691065e6bbe6ba0650c0412636c6a239c5a Author: Johan Hovold Date: Mon Oct 20 06:53:15 2025 +0200 iommu/omap: fix device leaks on probe_device() Make sure to drop the references taken to the iommu platform devices when looking up their driver data during probe_device(). Note that the arch data device pointer added by commit 604629bcb505 ("iommu/omap: add support for late attachment of iommu devices") has never been used. Remove it to underline that the references are not needed. Fixes: 9d5018deec86 ("iommu/omap: Add support to program multiple iommus") Fixes: 7d6827748d54 ("iommu/omap: Fix iommu archdata name for DT-based devices") Cc: stable@vger.kernel.org # 3.18 Cc: Suman Anna Acked-by: Robin Murphy Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit ab31cf041e4916bdf5c6b60a5286521c806a7033 Author: Johan Hovold Date: Mon Oct 20 06:53:14 2025 +0200 iommu/mediatek-v1: add missing larb count sanity check Add the missing larb count sanity check to avoid writing beyond a fixed sized array in case of a malformed devicetree. Acked-by: Robin Murphy Reviewed-by: Yong Wu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Joerg Roedel commit 46207625c9f33da0e43bb4ae1e91f0791b6ed633 Author: Johan Hovold Date: Mon Oct 20 06:53:13 2025 +0200 iommu/mediatek-v1: fix device leaks on probe() Make sure to drop the references taken to the larb devices during probe on probe failure (e.g. probe deferral) and on driver unbind. Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW") Cc: stable@vger.kernel.org # 4.8 Cc: Honghui Zhang Acked-by: Robin Murphy Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Joerg Roedel commit c77ad28bfee0df9cbc719eb5adc9864462cfb65b Author: Johan Hovold Date: Mon Oct 20 06:53:12 2025 +0200 iommu/mediatek-v1: fix device leak on probe_device() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during probe_device(). Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW") Cc: stable@vger.kernel.org # 4.8 Cc: Honghui Zhang Acked-by: Robin Murphy Reviewed-by: Yong Wu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Joerg Roedel commit 4f2a4aec1cf6f89743cf7acaac6c62eb2f21120b Author: Johan Hovold Date: Mon Oct 20 06:53:11 2025 +0200 iommu/mediatek: simplify dt parsing error handling As previously documented by commit 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse"), the id mapping may not be linear so the whole larb array needs to be iterated on devicetree parsing errors. Simplify the loop by iterating from index zero while dropping the redundant NULL check for consistency with later cleanups. Also add back the comment which was removed by commit 462e768b55a2 ("iommu/mediatek: Fix forever loop in error handling") to prevent anyone from trying to optimise the loop by iterating backwards from 'i'. Cc: Yong Wu Acked-by: Robin Murphy Signed-off-by: Johan Hovold Reviewed-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Joerg Roedel commit de83d4617f9fe059623e97acf7e1e10d209625b5 Author: Johan Hovold Date: Mon Oct 20 06:53:10 2025 +0200 iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound. Fixes: 26593928564c ("iommu/mediatek: Add error path for loop of mm_dts_parse") Cc: stable@vger.kernel.org Cc: Yong Wu Acked-by: Robin Murphy Signed-off-by: Johan Hovold Reviewed-by: Yong Wu Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Joerg Roedel commit b3f1ee18280363ef17f82b564fc379ceba9ec86f Author: Johan Hovold Date: Mon Oct 20 06:53:09 2025 +0200 iommu/mediatek: fix device leak on of_xlate() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 0df4fabe208d ("iommu/mediatek: Add mt8173 IOMMU driver") Cc: stable@vger.kernel.org # 4.6 Acked-by: Robin Murphy Reviewed-by: Yong Wu Signed-off-by: Johan Hovold Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Joerg Roedel commit 80aa518452c4aceb9459f9a8e3184db657d1b441 Author: Johan Hovold Date: Mon Oct 20 06:53:08 2025 +0200 iommu/ipmmu-vmsa: fix device leak on of_xlate() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 7b2d59611fef ("iommu/ipmmu-vmsa: Replace local utlb code with fwspec ids") Cc: stable@vger.kernel.org # 4.14 Cc: Magnus Damm Acked-by: Robin Murphy Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit 05913cc43cb122f9afecdbe775115c058b906e1b Author: Johan Hovold Date: Mon Oct 20 06:53:07 2025 +0200 iommu/exynos: fix device leak on of_xlate() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Note that commit 1a26044954a6 ("iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success. Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree") Cc: stable@vger.kernel.org # 4.2: 1a26044954a6 Cc: Yu Kuai Acked-by: Robin Murphy Acked-by: Marek Szyprowski Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit 6a3908ce56e6879920b44ef136252b2f0c954194 Author: Johan Hovold Date: Mon Oct 20 06:53:06 2025 +0200 iommu/qcom: fix device leak on of_xlate() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Note that commit e2eae09939a8 ("iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate()") fixed the leak in a couple of error paths, but the reference is still leaking on success and late failures. Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu") Cc: stable@vger.kernel.org # 4.14: e2eae09939a8 Cc: Rob Clark Cc: Yu Kuai Acked-by: Robin Murphy Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit a6eaa872c52a181ae9a290fd4e40c9df91166d7a Author: Johan Hovold Date: Mon Oct 20 06:53:05 2025 +0200 iommu/apple-dart: fix device leak on of_xlate() Make sure to drop the reference taken to the iommu platform device when looking up its driver data during of_xlate(). Fixes: 46d1fb072e76 ("iommu/dart: Add DART iommu driver") Cc: stable@vger.kernel.org # 5.15 Cc: Sven Peter Acked-by: Robin Murphy Signed-off-by: Johan Hovold Signed-off-by: Joerg Roedel commit 4fd24676865c383eab77d21ed02ffb432061df54 Author: Bagas Sanjaya Date: Sat Nov 8 06:33:17 2025 +0700 iommupt: Actually correct pt_test_sw_bit_{acquire_release}() parameter description In review comment for v1 of genpt documentation fixes [1], Randy suggested that pt_test_sw_bit_acquire() parameters description should be written using "to read". Commit e4dfaf25df1210 ("iommupt: Describe @bitnr parameter"), however, misunderstood the review by instead using "to read" on @bitnr parameter on both pt_test_sw_bit_acquire() and pt_test_sw_bit_release(). Actually correct the description. [1]: https://lore.kernel.org/linux-doc/9dba0eb7-6f32-41b7-b70b-12379364585f@infradead.org/ Fixes: e4dfaf25df1210 ("iommupt: Describe @bitnr parameter") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Signed-off-by: Joerg Roedel commit 90bbe88e0ea61bf3ab2376b0497bacf42b66e4a9 Author: Max Krummenacher Date: Tue Nov 11 16:16:14 2025 +0100 arm64: dts: freescale: add Toradex SMARC iMX95 Add DT support for Toradex SMARC iMX95 SoM and Development carrier board. The module consists of an NXP i.MX95 family SoC, up to 16GB of LPDDR5 RAM and up to 128GB of storage, a USB 3.0 Host Hub and 2.0 OTG, two Gigabit Ethernet PHYs, a 10 Gigabit Ethernet interface, an I2C EEPROM and Temperature Sensor, an RX8130 RTC, a Quad/Dual lane CSI interface, and some optional addons: TPM 2.0, DSI, LVDS, DisplayPort (through a DSI-DP bridge), and Wi-Fi/BT module. Link: https://www.toradex.com/computer-on-modules/smarc-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/smarc-development-board-kit Signed-off-by: Max Krummenacher Co-developed-by: Ernest Van Hoecke Signed-off-by: Ernest Van Hoecke Co-developed-by: Emanuele Ghidoli Signed-off-by: Emanuele Ghidoli Co-developed-by: João Paulo Gonçalves Signed-off-by: João Paulo Gonçalves Co-developed-by: Vitor Soares Signed-off-by: Vitor Soares Co-developed-by: Francesco Dolcini Signed-off-by: Francesco Dolcini Signed-off-by: Shawn Guo commit 5ffac985b5f4272c8fccb0ef58369724bd10cd8d Author: João Paulo Gonçalves Date: Tue Nov 11 16:16:13 2025 +0100 dt-bindings: arm: fsl: add Toradex SMARC iMX95 Add DT compatible strings for Toradex SMARC iMX95 SoM and Toradex SMARC Development carrier board. Link: https://www.toradex.com/computer-on-modules/smarc-arm-family/nxp-imx95 Link: https://www.toradex.com/products/carrier-board/smarc-development-board-kit Signed-off-by: João Paulo Gonçalves Signed-off-by: Francesco Dolcini Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 2469f2e78d074bf2d416ea82c32b154f5632effe Author: Colin Ian King Date: Tue May 9 08:28:55 2023 +0100 fs/ntfs3: Fix spelling mistake "recommened" -> "recommended" There is a spelling mistake in a ntfs_info message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Konstantin Komarov commit 266ab6d02aa34586baac68e2f986085f48efd96f Author: Konstantin Komarov Date: Thu Oct 30 23:49:27 2025 +0300 fs/ntfs3: update mode in xattr when ACL can be reduced to mode If a file's ACL can be reduced to standard mode bits, update mode accordingly, persist the change, and update the cached ACL. This keeps mode and ACL consistent and avoids redundant xattrs. Signed-off-by: Konstantin Komarov commit d8e1e0d33d975952e65945c9dd68c76c7f946435 Author: Konstantin Komarov Date: Thu Oct 30 23:45:33 2025 +0300 fs/ntfs3: check minimum alignment for direct I/O Add a check for minimum alignment when performing direct I/O reads. If the file offset or user buffer is not aligned to the device's logical block size, fall back to buffered I/O instead of continuing with unaligned direct I/O. Signed-off-by: Konstantin Komarov commit ae91dfe38966fa30d713e705a69bf6c5c7f4c2aa Author: Konstantin Komarov Date: Thu Oct 30 23:41:01 2025 +0300 fs/ntfs3: implement NTFS3_IOC_SHUTDOWN ioctl Add support for the NTFS3_IOC_SHUTDOWN ioctl, allowing userspace to request a filesystem shutdown. The ioctl number is shared with other filesystems such as ext4, exfat, and f2fs. Signed-off-by: Konstantin Komarov commit 2109b080240ca0e1a3ebe28cf7577ebb00a5d887 Author: Konstantin Komarov Date: Thu Oct 30 23:35:24 2025 +0300 fs/ntfs3: correct attr_collapse_range when file is too fragmented Fix incorrect VCN adjustments in attr_collapse_range() that caused filesystem errors or corruption on very fragmented NTFS files when performing collapse-range operations. Signed-off-by: Konstantin Komarov commit e307248a3c2df4432a7bbbde306ffcb33ec55898 Author: Longbin Li Date: Sat Nov 1 09:43:23 2025 +0800 riscv: dts: sophgo: Add USB support for cv18xx Add USB controller node for cv18xx and enable it for Huashan Pi, milkv-duo. Co-developed-by: Inochi Amaoto Signed-off-by: Longbin Li Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20251101014329.18439-4-looong.bin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 126a1b3c61cbec15ffaadf141adb9c4163da1757 Author: Longbin Li Date: Sat Nov 1 09:43:22 2025 +0800 riscv: dts: sophgo: Add syscon node for cv18xx Add top syscon node and all subdevice nodes for cv18xx series SoC. Co-developed-by: Inochi Amaoto Signed-off-by: Longbin Li Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20251101014329.18439-3-looong.bin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 565c450124c105a0b4f4ff3265e19502d44bf23b Author: Longbin Li Date: Sat Nov 1 09:43:21 2025 +0800 dt-bindings: soc: sophgo: add TOP syscon for CV18XX/SG200X series SoC The Sophgo CV18XX/SG200X SoC top misc system controller provides register access to configure related modules. It includes a usb2 phy and a dma multiplexer. Co-developed-by: Inochi Amaoto Signed-off-by: Longbin Li Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20251101014329.18439-2-looong.bin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit a73d4a055622d0973e371382b16a13f9795ffec7 Author: Thorsten Blum Date: Fri Oct 31 12:21:31 2025 +0100 drivers/xen/xenbus: Replace deprecated strcpy in xenbus_transaction_end strcpy() is deprecated; inline the read-only string instead. Fix the function comment and use bool instead of int while we're at it. Link: https://github.com/KSPP/linux/issues/88 Reviewed-by: Juergen Gross Signed-off-by: Thorsten Blum Signed-off-by: Juergen Gross Message-ID: <20251031112145.103257-2-thorsten.blum@linux.dev> commit ab844cf32058d6ba9bd98a921afa2256085e21fc Author: Miguel Ojeda Date: Mon Nov 10 12:35:27 2025 +0100 rust: allow `unreachable_pub` for doctests Examples (i.e. doctests) may want to show public items such as structs, thus the `unreachable_pub` warning is not very helpful. Thus allow it for all doctests. In addition, remove it from the existing `expect`s we have in a couple doctests. Suggested-by: Alice Ryhl Link: https://lore.kernel.org/rust-for-linux/aRG9VjsaCjsvAwUn@google.com/ Reviewed-by: David Gow Acked-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251110113528.1658238-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 479d186fc946b16c440f57995d5cb2151bfe61c0 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:49 2025 +0200 thunderbolt: Fix typos in xdomain.c Fix typos in xdomain.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 9527d0c5436c02905cb1befe74ff764f6b4ea5b8 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:48 2025 +0200 thunderbolt: Fix typos in usb4.c Fix typos in usb4.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit c3d53000d2a59c0922615aa10e97161a28a094f2 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:47 2025 +0200 thunderbolt: Fix typos in tunnel.c Fix typos in tunnel.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 5d463af9818cd4d6206abac59ba32bcd42bf5d7c Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:46 2025 +0200 thunderbolt: Fix typos in tmu.c Fix typos in tmu.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 836fe732db6068e6d3909c32bfebcf7572a2bbc6 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:45 2025 +0200 thunderbolt: Fix typos in tb_regs.h Fix typos in tb_regs.h. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 20b2af31286b265a2b8cc4bfa237bae3658e0127 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:44 2025 +0200 thunderbolt: Fix typos in tb.h Fix typos in tb.h. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 6cdbf50107cc4697eb65152b3832c0fce12a79e6 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:43 2025 +0200 thunderbolt: Fix typos in tb.c Fix typos in tb.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit cafe5dd8bba426b92f233678f166b2295679a4d4 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:42 2025 +0200 thunderbolt: Fix typos in switch.c Fix typos in switch.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 6c1e5744e68935047bfe3bb1dc5d41619eb4feda Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:41 2025 +0200 thunderbolt: Fix typos in retimer.c Fix typos in retimer.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 1c9ad530d36c2890dabb66c81b77e067f2c6100b Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:40 2025 +0200 thunderbolt: Fix typos in nhi.c Fix typos in nhi.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 0370b14fd55cb9590d76cdea20a6ce0e45d6d3c3 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:39 2025 +0200 thunderbolt: Fix typos in lc.c Fix typos in lc.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 91c7b372a31751a2cc79cc13fe67b7942b4156ef Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:38 2025 +0200 thunderbolt: Fix typos in icm.c Fix typos in icm.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit efee18981aeebc14d6fa06f7556a6df1bd1acf92 Author: Ian Rogers Date: Wed Nov 12 11:53:10 2025 -0800 perf test: Don't fail if user rdpmc returns 0 when disabled In certain hypervisor set ups the value 0 may be returned but this is only erroneous if the user rdpmc isn't disabled. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit d3726d4e5bd70e2c159ecb9feb43d3eaa6d76020 Author: Ian Rogers Date: Wed Nov 12 11:53:09 2025 -0800 perf parse-events: Add debug logging to perf_event If verbose is enabled and parse_event is called, typically by tests, log failures. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c335b7a960291d5b35221304a0b5bf8ebafced15 Author: Ian Rogers Date: Wed Nov 12 11:53:08 2025 -0800 perf test: Be tolerant of missing json metric none value print_metric_only_json and print_metric_end in stat-display.c may create a metric value of "none" which fails validation as isfloat. Add a helper to properly validate metric numeric values. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 4994e9a711a9de736c0d898e86e5b10b860d7e4f Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:36 2025 +0200 thunderbolt: Fix typos in domain.c Fix typos in domain.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit b719f112d250d56b5b019c8414393d7e068efbb6 Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:35 2025 +0200 thunderbolt: Fix typos in debugfs.c Fix typos in debugfs.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit d0d7c4062d321bd8cf187db6d9b0d4eb8b0650ef Author: Alan Borzeszkowski Date: Tue Sep 2 16:38:34 2025 +0200 thunderbolt: Fix typos in ctl.c Fix typos in ctl.c. No functional changes. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg commit 38367a22abba12b9ecd66536ff62274f0afbcf6f Author: liujing Date: Mon Sep 22 17:50:57 2025 +0800 perf sample: Fix the wrong format specifier In the file tools/perf/util/cs-etm.c, queue_nr is of type unsigned int and should be printed with %u. Signed-off-by: liujing Reviewed-by: Mike Leach Signed-off-by: Namhyung Kim commit 6fec913ff1c9811e35e1bb64779efce9bb41b7ec Author: Thorsten Blum Date: Wed Nov 12 18:14:07 2025 +0100 drivers/xen/xenbus: Simplify return statement in join() Don't unnecessarily negate 'buffer' and simplify the return statement. Reviewed-by: Jason Andryuk Signed-off-by: Thorsten Blum Signed-off-by: Juergen Gross Message-ID: <20251112171410.3140-2-thorsten.blum@linux.dev> commit bd4b5902e7b647f0dbea1b9426d664ae00186159 Author: ke zijie Date: Sun Nov 16 17:16:56 2025 +0800 docs: zh_CN: scsi: fix broken references in scsi-parameters.rst 0day CI reported several broken references under Documentation/translations/zh_CN/scsi/scsi-parameters.rst. These files do not exist under the translations directory. The correct references are the original English documents under Documentation/scsi/. This patch updates all broken paths accordingly. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511130315.WOiKJQTu-lkp@intel.com/ Signed-off-by: ke zijie Signed-off-by: Alex Shi commit 7dfe67ab5a830083d28a072d262c5f6d3df6b39f Author: Jun Guo Date: Fri Oct 31 15:30:03 2025 +0800 arm64: dts: cix: add a compatible string for the cix sky1 SoC The SPI IP design for the cix sky1 SoC uses a FIFO with a data width of 32 bits, instead of the default 8 bits. Therefore, a compatible string is added to specify the FIFO data width configuration for the cix sky1 SoC. Signed-off-by: Jun Guo Link: https://lore.kernel.org/r/20251031073003.3289573-4-jun.guo@cixtech.com Signed-off-by: Peter Chen commit b2bc5a821b941b15ed46df39b7c21c48510bea47 Author: Hans Zhang Date: Sat Nov 8 22:03:05 2025 +0800 arm64: dts: cix: Enable PCIe on the Orion O6 board Add PCIe RC support on Orion O6 board. The Orion O6 board includes multiple PCIe root complexes. The current device tree configuration enables detection and basic operation of PCIe endpoints on this platform. GPIO and pinctrl subsystems for this platform are not yet ready for upstream inclusion. Consequently, attributes such as reset-gpios and pinctrl configurations are temporarily omitted from the PCIe node definitions. Endpoint detection and functionality are confirmed to be operational with this basic configuration. The missing GPIO and pinctrl support will be added incrementally in future patches as the dependent subsystems become available upstream. Acked-by: Manivannan Sadhasivam Signed-off-by: Hans Zhang Link: https://lore.kernel.org/r/20251108140305.1120117-11-hans.zhang@cixtech.com Signed-off-by: Peter Chen commit 0b014cd8f15e3b8607fa1e9e25e5566c9eac75f2 Author: Hans Zhang Date: Sat Nov 8 22:03:04 2025 +0800 arm64: dts: cix: Add PCIe Root Complex on sky1 Add pcie_x*_rc node to support Sky1 PCIe driver based on the Cadence PCIe core. Supports Gen1/Gen2/Gen3/Gen4, 1/2/4/8 lane, MSI/MSI-x interrupts using the ARM GICv3. Acked-by: Manivannan Sadhasivam Signed-off-by: Hans Zhang Link: https://lore.kernel.org/r/20251108140305.1120117-10-hans.zhang@cixtech.com Signed-off-by: Peter Chen commit 490fd9336650a39c57ce2a652676a8cb9dc6c842 Merge: 727bf2dc96a6e0 ca2583412306ce Author: Dave Airlie Date: Mon Nov 17 14:21:48 2025 +1000 Merge tag 'drm-misc-next-2025-11-14-1' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.19: UAPI Changes: - Add sysfs entries, coredump support and uevents to QAIC. - Add fdinfo memory statistics to ivpu. Cross-subsystem Changes: - Handle stub fence initialization during module init. - Stop using system_wq in scheduler and drivers. Core Changes: - Documentation updates to ttm, vblank. - Add EDID quirk for sharp panel. - Use drm_crtc_vblank_(crtc,waitqueue) more in core and drivers. Driver Changes: - Small updates and fixes to panfrost, amdxdna, vmwgfx, ast, ivpu. - Handle preemption in amdxdna. - Add PM support to qaic. - Huge refactor of sun4i's layer code to decouple plane code from output and improve support for DE33. - Add larger page and compression support to nouveau. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/1ad3ea69-d029-4a21-8b3d-6b264b1b2a30@linux.intel.com commit 727bf2dc96a6e0eeb35f5adffaede020981ac17c Merge: 61926c915f0a5e 6bcb180f6f4585 Author: Dave Airlie Date: Mon Nov 17 13:39:45 2025 +1000 Merge tag 'drm-xe-next-2025-11-14' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: Avoid TOCTOU when montoring throttle reasons (Lucas) Add/extend workaround (Nitin) SRIOV migration work / plumbing (Michal Wajdeczko, Michal Winiarski, Lukasz) Drop debug flag requirement for VF resource fixup Fix MTL vm_max_level (Rodrigo) Changes around TILE_ADDR_RANGE for platform compatibility (Fei, Lucas) Add runtime registers for GFX ver >= 35 (Piotr) Kerneldoc fix (Kriish) Rework pcode error mapping (Lucas) Allow lockdown the PF (Michal) Eliminate GUC code caching of some frequency values (Sk) Improvements around forcewake referencing (Matt Roper) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aRcJOrisG2qPbucE@fedora commit 80d725f96c44e6e8eff02a9820dbbeef6a52091a Author: SeongJae Park Date: Sat Nov 1 11:20:16 2025 -0700 mm/damon/tests/core-kunit: remove unused ctx in damon_test_split_regions_of() damon_test_split_regions_of() dynamically allocates a 'struct damon_ctx' object, but it is not really being used in the code other than handling the allocation failure and deallocating it at the end of the function. Remove the unnecessary allocation and deallocation of the object. Link: https://lkml.kernel.org/r/20251101182021.74868-23-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Signed-off-by: Andrew Morton commit 40b11d1eb19cf5c53a642d35f27fd1eafd9e0caf Author: SeongJae Park Date: Sat Nov 1 11:20:15 2025 -0700 mm/damon/tests/core-kunit: remove unnecessary damon_ctx variable on damon_test_split_at() damon_test_split_at() dynamically allocates a 'struct damon_ctx' object, but it is not really being used in the code other than handling the allocation failure and deallocating it at the end of the function. Remove the unnecessary allocation and deallocation of the object. Link: https://lkml.kernel.org/r/20251101182021.74868-22-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Signed-off-by: Andrew Morton commit 7d808bf13943f4c6a6142400bffe14267f6dc997 Author: SeongJae Park Date: Sat Nov 1 11:20:14 2025 -0700 mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() damon_sysfs_test_add_targets() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-21-sj@kernel.org Fixes: b8ee5575f763 ("mm/damon/sysfs-test: add a unit test for damon_sysfs_set_targets()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.7+] Signed-off-by: Andrew Morton commit 0a63a0e7570b9b2631dfb8d836dc572709dce39e Author: SeongJae Park Date: Sat Nov 1 11:20:13 2025 -0700 mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() damon_test_split_evenly_succ() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-20-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit 7890e5b5bb6e386155c6e755fe70e0cdcc77f18e Author: SeongJae Park Date: Sat Nov 1 11:20:12 2025 -0700 mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() damon_test_split_evenly_fail() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-19-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit 2b22d0fcc6320ba29b2122434c1d2f0785fb0a25 Author: SeongJae Park Date: Sat Nov 1 11:20:11 2025 -0700 mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() damon_do_test_apply_three_regions() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-18-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit 84be856cc87317bc60ff54bd7c8f8a5aa8f0e2c8 Author: SeongJae Park Date: Sat Nov 1 11:20:10 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures on damon_test_set_filters_default_reject() damon_test_set_filters_default_reject() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-17-sj@kernel.org Fixes: 094fb14913c7 ("mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.16+] Signed-off-by: Andrew Morton commit d14d5671e7c9cc788c5a1edfa94e6f9064275905 Author: SeongJae Park Date: Sat Nov 1 11:20:09 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() damon_test_filter_out() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-16-sj@kernel.org Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.6+] Signed-off-by: Andrew Morton commit 3e5c4a1a1737bd79abaaa184233d0f815e62273b Author: SeongJae Park Date: Sat Nov 1 11:20:08 2025 -0700 mm/damon/tests/core-kunit: handle alloc failure on damos_test_commit_filter() damon_test_commit_filter() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-15-sj@kernel.org Fixes: f6a4a150f1ec ("mm/damon/tests/core-kunit: add damos_commit_filter test") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.18+] Signed-off-by: Andrew Morton commit 28ab2265e9422ccd81e4beafc0ace90f78de04c4 Author: SeongJae Park Date: Sat Nov 1 11:20:07 2025 -0700 mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() damon_test_new_filter() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-14-sj@kernel.org Fixes: 2a158e956b98 ("mm/damon/core-test: add a test for damos_new_filter()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.6+] Signed-off-by: Andrew Morton commit 915a2453d824a9b6bf724e3f970d86ae1d092a61 Author: SeongJae Park Date: Sat Nov 1 11:20:06 2025 -0700 mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() damon_test_set_attrs() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-13-sj@kernel.org Fixes: aa13779be6b7 ("mm/damon/core-test: add a test for damon_set_attrs()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.5+] Signed-off-by: Andrew Morton commit 8cf298c01b7fdb08eef5b6b26d0fe98d48134d72 Author: SeongJae Park Date: Sat Nov 1 11:20:05 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() damon_test_update_monitoring_result() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-12-sj@kernel.org Fixes: f4c978b6594b ("mm/damon/core-test: add a test for damon_update_monitoring_results()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.3+] Signed-off-by: Andrew Morton commit 74d5969995d129fd59dd93b9c7daa6669cb6810f Author: SeongJae Park Date: Sat Nov 1 11:20:04 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() damon_test_set_regions() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-11-sj@kernel.org Fixes: 62f409560eb2 ("mm/damon/core-test: test damon_set_regions") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.1+] Signed-off-by: Andrew Morton commit 4f835f4e8c863985f15abd69db033c2f66546094 Author: SeongJae Park Date: Sat Nov 1 11:20:03 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() damon_test_ops_registration() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-10-sj@kernel.org Fixes: 4f540f5ab4f2 ("mm/damon/core-test: add a kunit test case for ops registration") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.19+] Signed-off-by: Andrew Morton commit eded254cb69044bd4abde87394ea44909708d7c0 Author: SeongJae Park Date: Sat Nov 1 11:20:02 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() damon_test_split_regions_of() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-9-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit 0998d2757218771c59d5ca59ccf13d1542a38f17 Author: SeongJae Park Date: Sat Nov 1 11:20:01 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() damon_test_merge_regions_of() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-8-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit 3d443dd29a1db7efa587a4bb0c06a497e13ca9e4 Author: SeongJae Park Date: Sat Nov 1 11:20:00 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() damon_test_merge_two() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-7-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit 5e80d73f22043c59c8ad36452a3253937ed77955 Author: SeongJae Park Date: Sat Nov 1 11:19:59 2025 -0700 mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() damon_test_split_at() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-6-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit f79f2fc44ebd0ed655239046be3e80e8804b5545 Author: SeongJae Park Date: Sat Nov 1 11:19:58 2025 -0700 mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() damon_test_aggregate() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-5-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit fafe953de2c661907c94055a2497c6b8dbfd26f3 Author: SeongJae Park Date: Sat Nov 1 11:19:57 2025 -0700 mm/damon/tests/core-kunit: handle memory failure from damon_test_target() damon_test_target() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-4-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit e16fdd4f754048d6e23c56bd8d920b71e41e3777 Author: SeongJae Park Date: Sat Nov 1 11:19:56 2025 -0700 mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() damon_test_regions() is assuming all dynamic memory allocation in it will succeed. Those are indeed likely in the real use cases since those allocations are too small to fail, but theoretically those could fail. In the case, inappropriate memory access can happen. Fix it by appropriately cleanup pre-allocated memory and skip the execution of the remaining tests in the failure cases. Link: https://lkml.kernel.org/r/20251101182021.74868-3-sj@kernel.org Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [5.15+] Signed-off-by: Andrew Morton commit b5ab490d85b772bc99d2648182a282f39f08feb6 Author: SeongJae Park Date: Sat Nov 1 11:19:55 2025 -0700 mm/damon/tests/core-kunit: fix memory leak in damon_test_set_filters_default_reject() Patch series "mm/damon/tests: fix memory bugs in kunit tests". DAMON kunit tests were initially written assuming those will be run on environments that are well controlled and therefore tolerant to transient test failures and bugs in the test code itself. The user-mode linux based manual run of the tests is one example of such an environment. And the test code was written for adding more test coverage as fast as possible, over making those safe and reliable. As a result, the tests resulted in having a number of bugs including real memory leaks, theoretical unhandled memory allocation failures, and unused memory allocations. The allocation failures that are not handled well are unlikely in the real world, since those allocations are too small to fail. But in theory, it can happen and cause inappropriate memory access. It is arguable if bugs in test code can really harm users. But, anyway bugs are bugs that need to be fixed. Fix the bugs one by one. Also Cc stable@ for the fixes of memory leak and unhandled memory allocation failures. The unused memory allocations are only a matter of memory efficiency, so not Cc-ing stable@. The first patch fixes memory leaks in the test code for the DAMON core layer. Following fifteen, three, and one patches respectively fix unhandled memory allocation failures in the test code for DAMON core layer, virtual address space DAMON operation set, and DAMON sysfs interface, one by one per test function. Final two patches remove memory allocations that are correctly deallocated at the end, but not really being used by any code. This patch (of 22): Kunit test function for damos_set_filters_default_reject() allocates two 'struct damos_filter' objects and not deallocates those, so that the memory for the two objects are leaked for every time the test runs. Fix this by deallocating those objects at the end of the test code. Link: https://lkml.kernel.org/r/20251101182021.74868-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251101182021.74868-2-sj@kernel.org Fixes: 094fb14913c7 ("mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()") Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Gow Cc: Kefeng Wang Cc: [6.16+] Signed-off-by: Andrew Morton commit ebb9aeb980e5d3d8d9505d187005b02942cc1cd9 Author: Ankit Agrawal Date: Sun Nov 2 18:44:34 2025 +0000 vfio/nvgrace-gpu: register device memory for poison handling The nvgrace-gpu-vfio-pci module [1] maps the device memory to the user VA (Qemu) using remap_pfn_range() without adding the memory to the kernel. The device memory pages are not backed by struct page. The previous patch implements the mechanism to handle ECC/poison on memory page without struct page. This new mechanism is being used here. The module registers its memory region and the address_space with the kernel MM for ECC handling using the register_pfn_address_space() registration API exposed by the kernel. Link: https://lore.kernel.org/all/20240220115055.23546-1-ankita@nvidia.com/ [1] Link: https://lkml.kernel.org/r/20251102184434.2406-4-ankita@nvidia.com Signed-off-by: Ankit Agrawal Acked-by: Alex Williamson Cc: Aniket Agashe Cc: Borislav Betkov Cc: David Hildenbrand Cc: Hanjun Guo Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Kevin Tian Cc: Kirti Wankhede Cc: Len Brown Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Luck, Tony" Cc: Matthew R. Ochs Cc: Mauro Carvalho Chehab Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Neo Jia Cc: Peter Zijlstra Cc: Shuai Xue Cc: Smita Koralahalli Channabasappa Cc: Suren Baghdasaryan Cc: Tarun Gupta Cc: Uwe Kleine-König Cc: Vikram Sethi Cc: Vlastimil Babka Cc: Zhi Wang Signed-off-by: Andrew Morton commit 2ec41967189cd65a8f79c760dd1b50c4f56e8ac6 Author: Ankit Agrawal Date: Sun Nov 2 18:44:33 2025 +0000 mm: handle poisoning of pfn without struct pages Poison (or ECC) errors can be very common on a large size cluster. The kernel MM currently does not handle ECC errors / poison on a memory region that is not backed by struct pages. If a memory region mapped using remap_pfn_range() for example, but not added to the kernel, MM will not have associated struct pages. Add a new mechanism to handle memory failure on such memory. Make kernel MM expose a function to allow modules managing the device memory to register the device memory SPA and the address space associated it. MM maintains this information as an interval tree. On poison, MM can search for the range that the poisoned PFN belong and use the address_space to determine the mapping VMA. In this implementation, kernel MM follows the following sequence that is largely similar to the memory_failure() handler for struct page backed memory: 1. memory_failure() is triggered on reception of a poison error. An absence of struct page is detected and consequently memory_failure_pfn() is executed. 2. memory_failure_pfn() collects the processes mapped to the PFN. 3. memory_failure_pfn() sends SIGBUS to all the processes mapping the faulty PFN using kill_procs(). Note that there is one primary difference versus the handling of the poison on struct pages, which is to skip unmapping to the faulty PFN. This is done to handle the huge PFNMAP support added recently [1] that enables VM_PFNMAP vmas to map at PMD or PUD level. A poison to a PFN mapped in such as way would need breaking the PMD/PUD mapping into PTEs that will get mirrored into the S2. This can greatly increase the cost of table walks and have a major performance impact. Link: https://lore.kernel.org/all/20240826204353.2228736-1-peterx@redhat.com/ [1] Link: https://lkml.kernel.org/r/20251102184434.2406-3-ankita@nvidia.com Signed-off-by: Ankit Agrawal Cc: Aniket Agashe Cc: Borislav Betkov Cc: David Hildenbrand Cc: Hanjun Guo Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Kevin Tian Cc: Kirti Wankhede Cc: Len Brown Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Luck, Tony" Cc: Matthew R. Ochs Cc: Mauro Carvalho Chehab Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Neo Jia Cc: Peter Zijlstra Cc: Shuai Xue Cc: Smita Koralahalli Channabasappa Cc: Suren Baghdasaryan Cc: Tarun Gupta Cc: Uwe Kleine-König Cc: Vikram Sethi Cc: Vlastimil Babka Cc: Zhi Wang Signed-off-by: Andrew Morton commit 30d0a1291046a3641b5d9d547591228ad9c6aae0 Author: Ankit Agrawal Date: Sun Nov 2 18:44:32 2025 +0000 mm: change ghes code to allow poison of non-struct pfn Poison (or ECC) errors can be very common on a large size cluster. The kernel MM currently handles ECC errors / poison only on memory page backed by struct page. The handling is currently missing for the PFNMAP memory that does not have struct pages. The series adds such support. Implement a new ECC handling for memory without struct pages. Kernel MM expose registration APIs to allow modules that are managing the device to register its device memory region. MM then tracks such regions using interval tree. The mechanism is largely similar to that of ECC on pfn with struct pages. If there is an ECC error on a pfn, all the mapping to it are identified and a SIGBUS is sent to the user space processes owning those mappings. Note that there is one primary difference versus the handling of the poison on struct pages, which is to skip unmapping to the faulty PFN. This is done to handle the huge PFNMAP support added recently [1] that enables VM_PFNMAP vmas to map at PMD or PUD level. A poison to a PFN mapped in such as way would need breaking the PMD/PUD mapping into PTEs that will get mirrored into the S2. This can greatly increase the cost of table walks and have a major performance impact. nvgrace-gpu-vfio-pci module maps the device memory to user VA (Qemu) using remap_pfn_range without being added to the kernel [2]. These device memory PFNs are not backed by struct page. So make nvgrace-gpu-vfio-pci module make use of the mechanism to get poison handling support on the device memory. This patch (of 3): The GHES code allows calling of memory_failure() on the PFNs that pass the pfn_valid() check. This contract is broken for the remapped PFNs which fails the check and ghes_do_memory_failure() returns without triggering memory_failure(). Update code to allow memory_failure() call on PFNs failing pfn_valid(). Link: https://lkml.kernel.org/r/20251102184434.2406-1-ankita@nvidia.com Link: https://lkml.kernel.org/r/20251102184434.2406-2-ankita@nvidia.com Signed-off-by: Ankit Agrawal Reviewed-by: Shuai Xue Cc: Aniket Agashe Cc: Ankit Agrawal Cc: Borislav Betkov Cc: David Hildenbrand Cc: Hanjun Guo Cc: Ira Weiny Cc: Jason Gunthorpe Cc: Joanthan Cameron Cc: Kevin Tian Cc: Kirti Wankhede Cc: Len Brown Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Luck, Tony" Cc: Matthew R. Ochs Cc: Mauro Carvalho Chehab Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Neo Jia Cc: Peter Zijlstra Cc: Smita Koralahalli Channabasappa Cc: Suren Baghdasaryan Cc: Tarun Gupta Cc: Uwe Kleine-König Cc: Vikram Sethi Cc: Vlastimil Babka Cc: Zhi Wang Signed-off-by: Andrew Morton commit ee040cbd6e48165ba543c1d0405596283b1514ca Author: Baokun Li Date: Wed Nov 5 16:56:52 2025 +0800 mm/page_alloc: don't warn about large allocations with __GFP_NOFAIL Filesystems use __GFP_NOFAIL to allocate block-sized folios for metadata reads at critical points, since they cannot afford to go read-only, shut down, or enter an inconsistent state due to memory pressure. Currently, attempting to allocate page units greater than order-1 with the __GFP_NOFAIL flag triggers a WARN_ON() in __alloc_pages_slowpath(). However, filesystems supporting large block sizes (blocksize > PAGE_SIZE) can easily require allocations larger than order-1. As Matthew Wilcox noted in [1], if we have a filesystem with 64KiB sectors, there will be many clean folios in the page cache that are 64KiB or larger. He also explained in [2] why kvmalloc isn't a valid approach here. With gfp flags and order already included in the OOM report, both Vlastimil Babka and Michal Hocko suggested that we can take the risk of removing this warning first and then observe whether a large number of related OOM reports appear. If that happens, we can consider adding special handling in other places. Link: https://lkml.kernel.org/r/20251105085652.4081123-1-libaokun@huaweicloud.com Signed-off-by: Baokun Li Suggested-by: Matthew Wilcox Link: https://lore.kernel.org/all/aQPX1-XWQjKaMTZB@casper.infradead.org [1] Link: https://lore.kernel.org/all/aQTHMI3t5mNXp0M1@casper.infradead.org [2] Suggested-by: Vlastimil Babka Link: https://lore.kernel.org/all/188a95ba-6384-4319-bb74-c0d9ec6c4079@suse.cz Suggested-by: Michal Hocko Link: https://lore.kernel.org/all/aQotQBjnDDeL_wHx@tiehlicka Acked-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Brendan Jackman Cc: ErKun Yang Cc: Jan Kara Cc: Johannes Weiner Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: "zhangyi (F)" Cc: Zi Yan Signed-off-by: Andrew Morton commit 77a7cfd96c17f2414a8319c28a12ff69b36e626a Author: Zhang Chujun Date: Mon Nov 3 14:59:09 2025 +0800 mm/debug: fix missing space in case statement In setup_vm_debug() , the case statement for 'p' option is written as 'case'p':' without a space between 'case' and the character constant. While this is syntactically valid C, it violates the Linux kernel coding style, which requires a space after 'case'. This patch adds the missing space to comply with coding standards. Link: https://lkml.kernel.org/r/20251103065910.2196-1-zhangchujun@cmss.chinamobile.com Signed-off-by: Zhang Chujun Reviewed-by: Dev Jain Acked-by: Vlastimil Babka Acked-by: David Hildenbrand Reviewed-by: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 05c3fa9c9fa636b4e5856b0d86c3f194bbc804e4 Author: Pedro Demarchi Gomes Date: Wed Nov 5 15:49:12 2025 -0300 ksm: replace function unmerge_ksm_pages with break_ksm Function unmerge_ksm_pages() is unnecessary since now break_ksm() walks an address range. So replace it with break_ksm(). Link: https://lkml.kernel.org/r/20251105184912.186329-4-pedrodemargomes@gmail.com Signed-off-by: Pedro Demarchi Gomes Suggested-by: David Hildenbrand (Red Hat) Acked-by: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 5d4939fc2258e80e0eda2a8a190c9e4f78f52456 Author: Pedro Demarchi Gomes Date: Wed Nov 5 15:49:11 2025 -0300 ksm: perform a range-walk in break_ksm Make break_ksm() receive an address range and change break_ksm_pmd_entry() to perform a range-walk and return the address of the first ksm page found. This change allows break_ksm() to skip unmapped regions instead of iterating every page address. When unmerging large sparse VMAs, this significantly reduces runtime. In a benchmark unmerging a 32 TiB sparse virtual address space where only one page was populated, the runtime dropped from 9 minutes to less then 5 seconds. Link: https://lkml.kernel.org/r/20251105184912.186329-3-pedrodemargomes@gmail.com Signed-off-by: Pedro Demarchi Gomes Suggested-by: David Hildenbrand (Red Hat) Acked-by: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit 912aa825957f556a29d781c8f4cb4f4dfd938a9d Author: Pedro Demarchi Gomes Date: Wed Nov 5 15:49:10 2025 -0300 Revert "mm/ksm: convert break_ksm() from walk_page_range_vma() to folio_walk" Patch series "ksm: perform a range-walk to jump over holes in break_ksm", v4. When unmerging an address range, unmerge_ksm_pages function walks every page address in the specified range to locate ksm pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing the process to get blocked for several minutes. This patch makes break_ksm, function called by unmerge_ksm_pages for every page in an address range, perform a range walk, allowing it to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. As pointed out by David Hildenbrand in [1], unmerge_ksm_pages() is called from: * ksm_madvise() through madvise(MADV_UNMERGEABLE). There are not a lot of users of that function. * __ksm_del_vma() through ksm_del_vmas(). Effectively called when disabling KSM for a process either through the sysctl or from s390x gmap code when enabling storage keys for a VM. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: #include #include #include /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); madvise(area, size, MADV_UNMERGEABLE); return 0; } Without this patch, this program takes 9 minutes to finish, while with this patch it finishes in less then 5 seconds. This patch (of 3): This reverts commit e317a8d8b4f600fc7ec9725e26417030ee594f52 and changes function break_ksm_pmd_entry() to use folios. This reverts break_ksm() to use walk_page_range_vma() instead of folio_walk_start(). Change break_ksm_pmd_entry() to call is_ksm_zero_pte() only if we know the folio is present, and also rename variable ret to found. This will make it easier to later modify break_ksm() to perform a proper range walk. Link: https://lkml.kernel.org/r/20251105184912.186329-1-pedrodemargomes@gmail.com Link: https://lkml.kernel.org/r/20251105184912.186329-2-pedrodemargomes@gmail.com Link: https://lore.kernel.org/linux-mm/e0886fdf-d198-4130-bd9a-be276c59da37@redhat.com/ [1] Signed-off-by: Pedro Demarchi Gomes Suggested-by: David Hildenbrand (Red Hat) Acked-by: David Hildenbrand (Red Hat) Signed-off-by: Andrew Morton commit ed1f8855dd7b82a0ad87960b1729a3e848dc5589 Author: Israel Batista Date: Wed Oct 29 19:56:32 2025 +0000 mm: change type of parameter for memory_notify memory_notify() is responsible for sending events related to memory hotplugging to a notification queue. Since all the events must match one of the values from the enum memory_block_state, it is appropriate to change the function parameter type to make this condition explicit at compile time. Link: https://lkml.kernel.org/r/20251029195617.2210700-4-linux@israelbatista.dev.br Signed-off-by: Israel Batista Acked-by: Mike Rapoport (Microsoft) Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Omar Sandoval Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 8bc7ba3d265d6ee698de4b1941b7e8f7d91a0562 Author: Israel Batista Date: Wed Oct 29 19:56:30 2025 +0000 mm: change type of state in struct memory_block The state of a memory block should be restricted to values specified in the documentation of the memory hotplug API. However, since the state field in the memory_block struct was defined as an unsigned long, this restriction was not enforced at compile time. With the introduction of the enum memory_block_state, it is now possible to incorporate the desired semantics in the field declaration and enforce these restrictions at compile time. [akpm@linux-foundation.org: fix whitespace, per Randy] Link: https://lkml.kernel.org/r/20251029195617.2210700-3-linux@israelbatista.dev.br Signed-off-by: Israel Batista Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Cc: Omar Sandoval Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 1a4f70f6851a1916c4f0e52731c7ecfe99bf36e6 Author: Israel Batista Date: Wed Oct 29 19:56:28 2025 +0000 mm: convert memory block states (MEM_*) macros to enum Patch series "mm: Convert memory block states (MEM_*) macros to enums", v2. The MEM_* constants indicating the state of a memory block are currently defined as macros, meaning their definitions will be omitted from the debuginfo on most kernel builds. This makes it harder for debuggers to correctly map the block state at runtime, which can be quite useful when analysing errors related to memory hot plugging and unplugging with tools such as drgn. Converting the constants to an enum ensures the correct information is emitted by the compiler and available for the debugger, without needing to hard-code them into the debugger and track their changes. This patch series aims to replace the current macros with a newly created enum named memory_block_state, while also taking advantage of the compile time guarantees that we get when using enums. The first patch does the conversion of the macros to an enum, while the 2nd and 3rd patches use this enum to clean up some type declarations and make sure that only valid values are used. This patch (of 3): Converting the MEM_* constants from macros to an enum ensures that their values will be correctly emitted in the debug symbols, making it easier to trace the meaning of each value when debugging with tools such as drgn, without the need to hard-code the values. Since the values are mutually exclusive and they are not exposed directly to userspace, I also dropped the misleading pattern (1< Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Cc: Omar Sandoval Cc: Randy Dunlap Signed-off-by: Andrew Morton commit 52f37efc5949058a9c967965ad2b8d4852ea5248 Author: Baoquan He Date: Tue Oct 28 11:43:08 2025 +0800 mm/swap: select swap device with default priority round robin Swap devices are assumed to have similar accessing speed when swapon if no priority is specified. It's unfair and doesn't make sense just because one swap device is swapped on firstly, its priority will be higher than the one swapped on later. Here, set all swap devicess to have priority '-1' by default. With this change, swap device with default priority will be selected round robin when swapping out. This can improve the swapping efficiency a lot among multiple swap devices with default priority. Below are swapon output during the processes when high pressure vm-scability test is being taken: 1) This is pre-commit a2468cc9bfdf, swap device is selectd one by one by priority from high to low when one swap device is exhausted: ------------------------------------ [root@hp-dl385g10-03 ~]# swapon NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 16G -1 /dev/zram1 partition 16G 966.2M -2 /dev/zram2 partition 16G 0B -3 /dev/zram3 partition 16G 0B -4 2) This is behaviour with commit a2468cc9bfdf, on node, swap device sharing the same node id is selected firstly until exhausted; while on node no swap device sharing the node id it selects the one with highest priority until exhaustd: ------------------------------------ [root@hp-dl385g10-03 ~]# swapon NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 15.7G -2 /dev/zram1 partition 16G 3.4G -3 /dev/zram2 partition 16G 3.4G -4 /dev/zram3 partition 16G 2.6G -5 3) After this patch applied, swap devices with default priority are selectd round robin: ------------------------------------ [root@hp-dl385g10-03 block]# swapon NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 6.6G -1 /dev/zram1 partition 16G 6.6G -1 /dev/zram2 partition 16G 6.6G -1 /dev/zram3 partition 16G 6.6G -1 With the change, about 18% efficiency promotion relative to node based way as below. (Surely, the pre-commit a2468cc9bfdf way is the worst.) vm-scability test: ================== Test with: usemem --init-time -O -y -x -n 31 2G (4G memcg, zram as swap) one by one: node based: round robin: System time: 1087.38 s 637.92 s 526.74 s (lower is better) Sum Throughput: 2036.55 MB/s 3546.56 MB/s 4207.56 MB/s (higher is better) Single process Throughput: 65.69 MB/s 114.40 MB/s 135.72 MB/s (high is better) free latency: 15769409.48 us 10138455.99 us 6810119.01 us(lower is better) Link: https://lkml.kernel.org/r/20251028034308.929550-3-bhe@redhat.com Signed-off-by: Baoquan He Suggested-by: Chris Li Acked-by: Chris Li Acked-by: Nhat Pham Cc: Barry Song Cc: Kairui Song Cc: Kemeng Shi Signed-off-by: Andrew Morton commit 8e689f8ea45ffdae20350246dd37d124d7092c92 Author: Baoquan He Date: Tue Oct 28 11:43:07 2025 +0800 mm/swap: do not choose swap device according to numa node Patch series "mm/swapfile.c: select swap devices of default priority round robin", v5. Currently, on system with multiple swap devices, swap allocation will select one swap device according to priority. The swap device with the highest priority will be chosen to allocate firstly. People can specify a priority from 0 to 32767 when swapon a swap device, or the system will set it from -2 then downwards by default. Meanwhile, on NUMA system, the swap device with node_id will be considered first on that NUMA node of the node_id. In the current code, an array of plist, swap_avail_heads[nid], is used to organize swap devices on each NUMA node. For each NUMA node, there is a plist organizing all swap devices. The 'prio' value in the plist is the negated value of the device's priority due to plist being sorted from low to high. The swap device owning one node_id will be promoted to the front position on that NUMA node, then other swap devices are put in order of their default priority. E.g I got a system with 8 NUMA nodes, and I setup 4 zram partition as swap devices. Current behaviour: their priorities will be(note that -1 is skipped): NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 0B -2 /dev/zram1 partition 16G 0B -3 /dev/zram2 partition 16G 0B -4 /dev/zram3 partition 16G 0B -5 And their positions in the 8 swap_avail_lists[nid] will be: swap_avail_lists[0]: /* node 0's available swap device list */ zram0 -> zram1 -> zram2 -> zram3 prio:1 prio:3 prio:4 prio:5 swap_avali_lists[1]: /* node 1's available swap device list */ zram1 -> zram0 -> zram2 -> zram3 prio:1 prio:2 prio:4 prio:5 swap_avail_lists[2]: /* node 2's available swap device list */ zram2 -> zram0 -> zram1 -> zram3 prio:1 prio:2 prio:3 prio:5 swap_avail_lists[3]: /* node 3's available swap device list */ zram3 -> zram0 -> zram1 -> zram2 prio:1 prio:2 prio:3 prio:4 swap_avail_lists[4-7]: /* node 4,5,6,7's available swap device list */ zram0 -> zram1 -> zram2 -> zram3 prio:2 prio:3 prio:4 prio:5 The adjustment for swap device with node_id intended to decrease the pressure of lock contention for one swap device by taking different swap device on different node. The adjustment was introduced in commit a2468cc9bfdf ("swap: choose swap device according to numa node"). However, the adjustment is a little coarse-grained. On the node, the swap device sharing the node's id will always be selected firstly by node's CPUs until exhausted, then next one. And on other nodes where no swap device shares its node id, swap device with priority '-2' will be selected firstly until exhausted, then next with priority '-3'. This is the swapon output during the process high pressure vm-scability test is being taken. It's clearly showing zram0 is heavily exploited until exhausted. =================================== [root@hp-dl385g10-03 ~]# swapon NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 15.7G -2 /dev/zram1 partition 16G 3.4G -3 /dev/zram2 partition 16G 3.4G -4 /dev/zram3 partition 16G 2.6G -5 The node based strategy on selecting swap device is much better then the old way one by one selecting swap device. However it is still unreasonable because swap devices are assumed to have similar accessing speed if no priority is specified when swapon. It's unfair and doesn't make sense just because one swap device is swapped on firstly, its priority will be higher than the one swapped on later. So in this patchset, change is made to select the swap device round robin if default priority. In code, the plist array swap_avail_heads[nid] is replaced with a plist swap_avail_head which reverts commit a2468cc9bfdf. Meanwhile, on top of the revert, further change is taken to make any device w/o specified priority get the same default priority '-1'. Surely, swap device with specified priority are always put foremost, this is not impacted. If you care about their different accessing speed, then use 'swapon -p xx' to deploy priority for your swap devices. New behaviour: swap_avail_list: /* one global available swap device list */ zram0 -> zram1 -> zram2 -> zram3 prio:1 prio:1 prio:1 prio:1 This is the swapon output during the process high pressure vm-scability being taken, all is selected round robin: ======================================= [root@hp-dl385g10-03 linux]# swapon NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 12.6G -1 /dev/zram1 partition 16G 12.6G -1 /dev/zram2 partition 16G 12.6G -1 /dev/zram3 partition 16G 12.6G -1 With the change, we can see about 18% efficiency promotion as below: vm-scability test: ================== Test with: usemem --init-time -O -y -x -n 31 2G (4G memcg, zram as swap) Before: After: System time: 637.92 s 526.74 s (lower is better) Sum Throughput: 3546.56 MB/s 4207.56 MB/s (higher is better) Single process Throughput: 114.40 MB/s 135.72 MB/s (higher is better) free latency: 10138455.99 us 6810119.01 us (low is better) This patch (of 2): This reverts commit a2468cc9bfdf ("swap: choose swap device according to numa node"). After this patch, the behaviour will change back to pre-commit a2468cc9bfdf. Means the priority will be set from -1 then downwards by default, and when swapping, it will exhault swap device one by one according to priority from high to low. This is preparation work for later change. [root@hp-dl385g10-03 ~]# swapon NAME TYPE SIZE USED PRIO /dev/zram0 partition 16G 16G -1 /dev/zram1 partition 16G 966.2M -2 /dev/zram2 partition 16G 0B -3 /dev/zram3 partition 16G 0B -4 Link: https://lkml.kernel.org/r/20251028034308.929550-1-bhe@redhat.com Link: https://lkml.kernel.org/r/20251028034308.929550-2-bhe@redhat.com Signed-off-by: Baoquan He Suggested-by: Chris Li Acked-by: Chris Li Acked-by: Nhat Pham Reviewed-by: Kairui Song Cc: Barry Song Cc: Kemeng Shi Signed-off-by: Andrew Morton commit 6af766c86b1c9f075e30ba7bd291c6aa5384c1f6 Author: Jiayuan Chen Date: Mon Oct 27 22:18:17 2025 +0800 mm: vmstat: output reserved_highatomic and free_highatomic in zoneinfo The nr_free_highatomic is a key factor in calculating watermarks as it affects the free pages count. Adding this metric, along with nr_reserved_highatomic, to /proc/zoneinfo facilitates easier diagnosis memory watermark calculations and memory pressure states. Sample output: cat /proc/zoneinfo ...... pagesets cpu: 0 count: 52069 high: 52675 batch: 63 high_min: 13971 high_max: 62284 vm stats threshold: 10 node_unreclaimable: 0 start_pfn: 4096 reserved_highatomic: 5120 free_highatomic: 2081 Link: https://lkml.kernel.org/r/20251027141818.283587-1-jiayuan.chen@linux.dev Signed-off-by: Jiayuan Chen Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 272239dc8fcb109b9f1ec1a73bb85405dac92eda Author: Anshuman Khandual Date: Tue Oct 21 03:56:38 2025 +0100 mm: make INVALID_PHYS_ADDR a generic macro INVALID_PHYS_ADDR has very similar definitions across the code base. Hence just move that inside header for more generic usage. Also drop the now redundant ones which are no longer required. Link: https://lkml.kernel.org/r/20251021025638.2420216-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: Alexander Gordeev [s390] Signed-off-by: Andrew Morton commit b734b9d973ccd7ad1cfebc2e1f7db693824a37ef Author: Lorenzo Stoakes Date: Fri Oct 24 10:09:02 2025 +0100 mm/vma: small VMA lock cleanups We declare vma_start_read() as a static function in mm/mmap_lock.c, so there is no need to provide a stub for !CONFIG_PER_VMA_LOCK. __is_vma_write_locked() is declared in a header and should therefore be static inline. Put parens around (refcnt & VMA_LOCK_OFFSET) in is_vma_writer_only() to make precedence clear. Link: https://lkml.kernel.org/r/20251024090902.1118174-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Shakeel Butt Reviewed-by: Vlastimil Babka Cc: Liam Howlett Signed-off-by: Andrew Morton commit ad8b2e096181bd23a32d8672de107136d0c478e9 Author: Harry Yoo Date: Fri Oct 24 20:30:47 2025 +0900 treewide: include linux/pgalloc.h instead of asm/pgalloc.h For now, including instead of is technically fine unless the .c file calls p*d_populate_kernel() helper functions. But it is a better practice to always include . Include instead of outside arch/. Link: https://lkml.kernel.org/r/20251024113047.119058-3-harry.yoo@oracle.com Signed-off-by: Harry Yoo Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Mike Rapoport (Microsoft) Cc: Liam Howlett Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: SeongJae Park Signed-off-by: Andrew Morton commit 5e0fa7ed984d1c3b8bda4158e35a46cb2b0badac Author: Harry Yoo Date: Fri Oct 24 20:30:46 2025 +0900 MAINTAINERS: add include/linux/pgalloc.h to MM CORE section Patch series "mm: MISC follow-up patches for linux/pgalloc.h", v2. This is a follow-up patch series for the patch series named: "[PATCH V5 mm-hotfixes 0/3] mm, x86: fix crash due to missing page table sync and make it harder to miss". This patch (of 2): Since include/linux/pgtable.h is already listed in the MM CORE section, add it to the section as well to keep it maintained by the appropriate maintainers. Link: https://lkml.kernel.org/r/20251024113047.119058-1-harry.yoo@oracle.com Link: https://lkml.kernel.org/r/20251024113047.119058-2-harry.yoo@oracle.com Signed-off-by: Harry Yoo Acked-by: SeongJae Park Acked-by: Lorenzo Stoakes Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Liam Howlett Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 809ba69f9f4d17f9c04f4aaba5e680fdd71975dd Author: SeongJae Park Date: Wed Oct 22 18:25:33 2025 -0700 selftests/damon/sysfs: add obsolete_target test A new DAMON sysfs file for pin-point target removal, namely obsolete_target, has been added. Add a test for the functionality. It starts DAMON with three monitoring target processes, mark one in the middle as obsolete, commit it, and confirm the internal DAMON status is updated to remove the target in the middle. Link: https://lkml.kernel.org/r/20251023012535.69625-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 65a9033db722bef4226b41fc205dab304c3fec70 Author: SeongJae Park Date: Wed Oct 22 18:25:32 2025 -0700 sysfs.py: extend assert_ctx_committed() for monitoring targets assert_ctx_committed() is not asserting monitoring targets commitment, since all existing callers of the function assume no target changes. Extend it for future usage. Link: https://lkml.kernel.org/r/20251023012535.69625-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a00f18abef3750167eef7aa9ecd96da96f74fc3f Author: SeongJae Park Date: Wed Oct 22 18:25:31 2025 -0700 drgn_dump_damon_status: dump damon_target->obsolete A new field of damon_target for pin-point target removal, namely obsolete, has newly been added. Extend drgn_dump_damon_status.py to dump it, for easily writing a future DAMON selftests of it. Link: https://lkml.kernel.org/r/20251023012535.69625-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit badfa4361cb116fd9af71aaa2ea470236a8aa25b Author: SeongJae Park Date: Wed Oct 22 18:25:30 2025 -0700 selftests/damon/_damon_sysfs: support obsolete_target file A DAMON sysfs file, namely obsolete_target, has been newly introduced. Add a support of that file to _damon_sysfs.py so that DAMON selftests for the file can be easily written. Link: https://lkml.kernel.org/r/20251023012535.69625-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9abe8d05192846c76f41c9187fac1b800c013b04 Author: SeongJae Park Date: Wed Oct 22 18:25:29 2025 -0700 Docs/ABI/damon: document obsolete_target sysfs file Update DAMON ABI document for the newly added obsolete_target DAMON sysfs file. Link: https://lkml.kernel.org/r/20251023012535.69625-6-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e06469cdf1fdb0d842e5fcaaddfefae3a31e26d9 Author: SeongJae Park Date: Wed Oct 22 18:25:28 2025 -0700 Docs/admin-guide/mm/damon/usage: document obsolete_target file Document the newly added obsolete_target DAMON sysfs file. Link: https://lkml.kernel.org/r/20251023012535.69625-5-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e35afdf228ccaaafe3baf8034429448ae505be47 Author: SeongJae Park Date: Wed Oct 22 18:25:27 2025 -0700 mm/damon/sysfs: implement obsolete_target file There is no good way to remove DAMON targets in the middle of the existing targets list. It restricts efficient and flexible DAMON use cases. Improve the usability by implementing a new DAMON sysfs interface file, namely obsolete_target, under each target directory. It is connected to the obsolete field of parameters commit-source targets, so allows removing arbitrary targets in the middle of existing targets list. Note that the sysfs files are not automatically updated. For example, let's suppose there are three targets in the running context, and a user removes the third target using this feature. If the user writes 'commit' to the kdamond 'state' file again, DAMON sysfs interface will again try to remove the third target. But because there is no matching target in the running context, the commit will fail. It is the user's responsibility to understand resulting DAMON internal targets list change, and construct sysfs files (using nr_targets and other sysfs files) to correctly represent it. Also note that this is arguably an improvement rather than a fix of broken things. Link: https://lkml.kernel.org/r/20251023012535.69625-4-sj@kernel.org Signed-off-by: SeongJae Park Reported-by: Bijan Tabatabai Closes: https://github.com/damonitor/damo/issues/36 Reviewed-by: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 60bd24f272d00302a98cd8cb4cf3ab8189c82193 Author: SeongJae Park Date: Wed Oct 22 18:25:26 2025 -0700 mm/damon/sysfs: test commit input against realistic destination DAMON sysfs interface tests if given online parameters update request is valid, by committing those using the DAMON kernel API, to a test-purpose destination context. The test-purpose destination context is constructed using damon_new_ctx(), so it has no target, no scheme. If a source target has the obsolete field set, the test-purpose commit will fail because damon_commit_targets() fails when there is a source obsolete target that cannot find its matching destination target. DAMON sysfs interface is not letting users set the field for now, so there is no problem. However, the following commit will support that. Also there could be similar future changes that making commit fails based on current context structure. Make the test purpose commit destination context similar to the current running one, by committing the running one to the test purpose context, before doing the real test-purpose commit. Link: https://lkml.kernel.org/r/20251023012535.69625-3-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit adf7d6cdd716e1f3826789befc453c961dfafcf2 Author: SeongJae Park Date: Wed Oct 22 18:25:25 2025 -0700 mm/damon/core: add damon_target->obsolete for pin-point removal Patch series "mm/damon: support pin-point targets removal". DAMON maintains the targets in a list, and allows committing only an entire list of targets having the new parameters. Targets having same index on the lists are treated as matching source and destination targets. If an existing target cannot find a matching one in the sources list, the target is removed. This means that there is no way to remove only a specific monitoring target in the middle of the current targets list. Such pin-point target removal is really needed in some use cases, though. Monitoring access patterns on virtual address spaces of processes that spawned from the same ancestor is one example. If a process of the group is terminated, the user may want to remove the matching DAMON target as soon as possible, to save in-kernel memory usage for the unnecessary target data. The user may also want to do that without turning DAMON off or removing unnecessary targets, to keep the current monitoring results for other active processes. Extend DAMON kernel API and sysfs ABI to support the pin-point removal in the following way. For API, add a new damon_target field, namely 'obsolete'. If the field on parameters commit source target is set, it means the matching destination target is obsolete. Then the parameters commit logic removes the destination target from the existing targets list. For sysfs ABI, add a new file under the target directory, namely 'obsolete_target'. It is connected with the 'obsolete' field of the commit source targets, so internally using the new API. Also add a selftest for the new feature. The related helper scripts for manipulating the sysfs interface and dumping in-kernel DAMON status are also extended for this. Note that the selftest part was initially posted as an individual RFC series [1], but now merged into this one. Bijan Tabatabai has originally reported this issue, and participated in this solution design on a GitHub issue [1] for DAMON user-space tool. This patch (of 9): DAMON's monitoring targets parameters update function, damon_commit_targets(), is not providing a way to remove a target in the middle of the existing targets list. Extend the API by adding a field to struct damon_target. If the field of a damon_commit_targets() source target is set, it indicates the matching target on the existing targets list is obsolete. damon_commit_targets() understands that and removes those from the list, while respecting the index based matching for other non-obsolete targets. Link: https://lkml.kernel.org/r/20251023012535.69625-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251023012535.69625-2-sj@kernel.org Link: https://github.com/damonitor/damo/issues/36 [1] Signed-off-by: SeongJae Park Reviewed-by: Bijan Tabatabai Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit e97d7c5165227e6e4423b4a869d7805b01706392 Author: Dmitry Ilvokhin Date: Thu Oct 23 18:12:02 2025 +0000 mm: shmem/tmpfs hugepage defaults config choice Allow to override defaults for shemem and tmpfs at config time. This is consistent with how transparent hugepages can be configured. Same results can be achieved with the existing 'transparent_hugepage_shmem' and 'transparent_hugepage_tmpfs' settings in the kernel command line, but it is more convenient to define basic settings at config time instead of changing kernel command line later. Defaults for shmem and tmpfs were not changed. They are remained the same as before: 'never' for both cases. Options 'deny' and 'force' are omitted intentionally since these are special values and supposed to be used for emergencies or testing and are not expected to be permanent ones. Primary motivation for adding config option is to enable policy enforcement at build time. In large-scale production environments (Meta's for example), the kernel configuration is often maintained centrally close to the kernel code itself and owned by the kernel engineers, while boot parameters are managed independently (e.g. by provisioning systems). In such setups, the kernel build defines the supported and expected behavior in a single place, but there is no reliable or uniform control over the kernel command line options. A build-time default allows kernel integrators to enforce a predictable hugepage policy for shmem/tmpfs on a base layer, ensuring reproducible behavior and avoiding configuration drift caused by possible boot-time differences. In short, primary benefit is mostly operational: it provides a way to codify preferred policy in the kernel configuration, which is versioned, reviewed, and tested as part of the kernel build process, rather than depending on potentially variable boot parameters. [d@ilvokhin.com: v2] Link: https://lkml.kernel.org/r/aQECPpjd-fU_TC79@shell.ilvokhin.com Link: https://lkml.kernel.org/r/aPpv8sAa2sYgNu3L@shell.ilvokhin.com Signed-off-by: Dmitry Ilvokhin Reviewed-by: Lorenzo Stoakes Acked-by: Michal Hocko Reviewed-by: Baolin Wang Acked-by: Kiryl Shutsemau Cc: David Hildenbrand Cc: Hugh Dickins Cc: Liam Howlett Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f46dbea0d95668dbbaf0aaa5f2c3aabf8f4d8fda Author: SeongJae Park Date: Sun Oct 26 11:22:13 2025 -0700 Docs/admin-guide/mm/damon/stat: document negative idle time Commit a983a26d5298 ("mm/damon/stat: expose negative idle time") introduced the negative idle time feature for DAMON_STAT. But it is not documented. Document it on the usage document. Link: https://lkml.kernel.org/r/20251026182216.118200-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit da8644a476f5af7d282e304daf43f5c78c0acf13 Author: SeongJae Park Date: Sun Oct 26 11:22:12 2025 -0700 Docs/admin-guide/mm/damon/stat: document aggr_interval_us parameter Commit cc7ceb1d14b0 ("mm/damon/stat: expose the current tuned aggregation interval"), has introduced 'aggr_interval_us' parameter for DAMON_STAT. But the new parameter is not yet documented. Document it on the usage document for the module. Link: https://lkml.kernel.org/r/20251026182216.118200-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 448666e418bfe456bbc629f978c8b6d6c5027212 Author: SeongJae Park Date: Sun Oct 26 11:22:11 2025 -0700 Docs/admin-guide/mm/damon/lru_sort: document addr_unit parameter Commit 2e0fe9245d6b ("mm/damon/lru_sort: support addr_unit for DAMON_LRU_SORT") introduced the 'addr_unit' parameter for DAMON_LRU_SORT. But the usage document is not updated for that. Update the document. Link: https://lkml.kernel.org/r/20251026182216.118200-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bb01656e003de155f8575483089c66f89f535026 Author: SeongJae Park Date: Sun Oct 26 11:22:10 2025 -0700 Docs/admin-guide/mm/damon/reclaim: document addr_unit parameter Commit 7db551fcfb2a ("mm/damon/reclaim: support addr_unit for DAMON_RECLAIM") introduced the 'addr_unit' parameter for DAMON_RECLAIM. But the usage document is not updated for that. Update the document. Link: https://lkml.kernel.org/r/20251026182216.118200-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 29221406f09d8c4b523ffea86c5c69f628c2f6db Author: SeongJae Park Date: Sun Oct 26 11:22:09 2025 -0700 Docs/admin-guide/mm/damon/usage: document empty target regions commit behavior Committing a monitoring target with empty target regions is for keeping the current monitoring results. This behavior was introduced by commit 973233600676 ("mm/damon/sysfs: update monitoring target regions for online input commit"). The behavior is not documented, though. Update the usage document for clarifying this behavior. Link: https://lkml.kernel.org/r/20251026182216.118200-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit a01386c16dc2d4ef3284c415cfe414f8137e0ea1 Author: SeongJae Park Date: Sun Oct 26 11:22:08 2025 -0700 Docs/admin-guide/mm/damon/stat: fix a typo: s/sampling events/sampling interval/ It is a contextual typo. Fix it. Link: https://lkml.kernel.org/r/20251026182216.118200-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d7484f6edd31a26a1d32aa1e8e20df40dbc1cb7d Author: SeongJae Park Date: Sun Oct 26 11:22:07 2025 -0700 Docs/mm/damon/design: fix wrong link to intervals goal section Commit b243d666d107 ("Docs/admin-guide/mm/damon/usage: add intervals_goal directory on the hierarchy") mistakenly added a wrong reference for intervals goal usage documentation on the design document. Fix it. Link: https://lkml.kernel.org/r/20251026182216.118200-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 50ca6423643cdb26871970b4f8870b4940b4c498 Author: SeongJae Park Date: Sun Oct 26 11:22:06 2025 -0700 mm/damon/core: fix wrong comment of damon_call() return timing Patch series "mm/damon: misc documentation fixups". First three patches fix up issues in the documents, including wrong explanation of a behavior, wrong link, and a contextual typo. Following five patches update documents for not yet documented features and behaviors. This patch (of 8): damon_call() works asynchronously and synchronously for repeat and non-repeat mode requests, respectively. The comment about the behavior is wrong, though. Fix it. The wrong comment was introduced together with the repeat mode, by commit 43df7676e550 ("mm/damon/core: introduce repeat mode damon_call()"). Link: https://lkml.kernel.org/r/20251026182216.118200-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251026182216.118200-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 4fd58b51ef090e7c8d67a2bc98d994616af3c449 Author: Kairui Song Date: Fri Oct 24 02:00:43 2025 +0800 mm, swap: remove redundant argument for isolating a cluster The order argument was introduced by an intermediate commit and was then never used, just remove it. Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-5-a709469052e7@tencent.com Signed-off-by: Kairui Song Acked-by: Nhat Pham Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit ab61de9b78dda140573fb474af65f0e1ae13ff5b Author: Kairui Song Date: Fri Oct 24 02:00:42 2025 +0800 mm/migrate, swap: drop usage of folio_index This helper was used when swap cache was mixed with page cache. Now they are completely separate from each other, access to the swap cache is all wrapped by the swap_cache_* helpers, which expect the folio's swap entry as a parameter. This helper is no longer used, remove the last redundant user and drop it. Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-4-a709469052e7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Acked-by: Nhat Pham Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit a983471cfc454afeba23526ee5d17fd8cdc7876f Author: Kairui Song Date: Fri Oct 24 02:00:41 2025 +0800 mm, swap: cleanup swap entry allocation parameter We no longer need this GFP parameter after commit 8578e0c00dcf ("mm, swap: use the swap table for the swap cache and switch API"). Before that commit the GFP parameter is already almost identical for all callers, so nothing changed by that commit. Swap table just moved the GFP to lower layer and make it more defined and changes depend on atomic or sleep allocation. Now this parameter is no longer used, just remove it. No behavior change. Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-3-a709469052e7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Acked-by: Nhat Pham Reviewed-by: Baolin Wang Reviewed-by: David Hildenbrand Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit e4adea27b97061e25a9db908421bf2bcc31c89eb Author: Kairui Song Date: Fri Oct 24 02:00:40 2025 +0800 mm, swap: rename helper for setup bad slots The name inc_cluster_info_page is very confusing, as this helper is only used during swapon to mark bad slots. Rename it properly and turn the VM_BUG_ON in it into WARN_ON to expose more potential issues. Swapon is a cold path, so adding more checks should be a good idea. No feature change except new WARN_ON. Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-2-a709469052e7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Acked-by: Nhat Pham Reviewed-by: David Hildenbrand Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: "Huang, Ying" Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 9fb749cd15078c7bdc46e5d45c37493f83323e33 Author: Kairui Song Date: Fri Oct 24 02:34:11 2025 +0800 mm, swap: do not perform synchronous discard during allocation Patch series "mm, swap: misc cleanup and bugfix", v2. A few cleanups and a bugfix that are either suitable after the swap table phase I or found during code review. Patch 1 is a bugfix and needs to be included in the stable branch, the rest have no behavioral change. This patch (of 5): Since commit 1b7e90020eb77 ("mm, swap: use percpu cluster as allocation fast path"), swap allocation is protected by a local lock, which means we can't do any sleeping calls during allocation. However, the discard routine is not taken well care of. When the swap allocator failed to find any usable cluster, it would look at the pending discard cluster and try to issue some blocking discards. It may not necessarily sleep, but the cond_resched at the bio layer indicates this is wrong when combined with a local lock. And the bio GFP flag used for discard bio is also wrong (not atomic). It's arguable whether this synchronous discard is helpful at all. In most cases, the async discard is good enough. And the swap allocator is doing very differently at organizing the clusters since the recent change, so it is very rare to see discard clusters piling up. So far, no issues have been observed or reported with typical SSD setups under months of high pressure. This issue was found during my code review. But by hacking the kernel a bit: adding a mdelay(500) in the async discard path, this issue will be observable with WARNING triggered by the wrong GFP and cond_resched in the bio layer for debug builds. So now let's apply a hotfix for this issue: remove the synchronous discard in the swap allocation path. And when order 0 is failing with all cluster list drained on all swap devices, try to do a discard following the swap device priority list. If any discards released some cluster, try the allocation again. This way, we can still avoid OOM due to swap failure if the hardware is very slow and memory pressure is extremely high. This may cause more fragmentation issues if the discarding hardware is really slow. Ideally, we want to discard pending clusters before continuing to iterate the fragment cluster lists. This can be implemented in a cleaner way if we clean up the device list iteration part first. Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-0-a709469052e7@tencent.com Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-1-c5b0e1092927@tencent.com Fixes: 1b7e90020eb7 ("mm, swap: use percpu cluster as allocation fast path") Signed-off-by: Kairui Song Acked-by: Nhat Pham Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: David Hildenbrand Cc: "Huang, Ying" Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit f0b1602871f8506c5aa704e9641b004f21918759 Author: Wei Yang Date: Tue Oct 21 21:21:42 2025 +0000 mm/huge_memory: optimize old_order derivation during folio splitting Folio splitting requires both the folio's original order (@old_order) and the new target order (@split_order). In the current implementation, @old_order is repeatedly retrieved using folio_order(). However, for every iteration after the first, the folio being split is the result of the previous split, meaning its order is already known to be equal to the previous iteration's @split_order. This commit optimizes the logic: * Instead of calling folio_order(), we now set @old_order directly to the value of @split_order from the previous iteration. This change avoids unnecessary function calls and simplifies the loop setup. Also it removes a check for non-existent case, since for uniform splitting we only do split when @split_order == @new_order. Link: https://lkml.kernel.org/r/20251021212142.25766-5-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: wang lian Reviewed-by: Lorenzo Stoakes Cc: Zi Yan Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit fc4f15ee0bcd56f40ad1df723ac9889d7e82f5a0 Author: Wei Yang Date: Tue Oct 21 21:21:41 2025 +0000 mm/huge_memory: optimize and simplify folio stat update after split The loop executed after a successful folio split currently has two combined responsibilities: * updating statistics for the new folios * determining the folio for the next split iteration. This commit refactors the logic to directly calculate and update folio statistics, eliminating the need for the iteration step. We can do this because all necessary information is already available: * All resulting new folios have the same order, which is @split_order. * The exact number of new folios can be calculated directly using @old_order and @split_order. * The folio for the subsequent split is simply the one containing @split_at. By leveraging this knowledge, we can achieve the stat update more cleanly and efficiently without the looping logic. Link: https://lkml.kernel.org/r/20251021212142.25766-4-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: wang lian Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 092ef3899707ac2a5ad195b96bcfb3c85d97f25c Author: Wei Yang Date: Tue Oct 21 21:21:40 2025 +0000 mm/huge_memory: update folio stat after successful split The current implementation complicates this process: * It iterates over the resulting new folios. * It uses a flag (@stop_split) to conditionally skip updating the stat for the folio at @split_at during the loop. * It then attempts to update the skipped stat on a subsequent failure path. This logic is unnecessarily hard to follow. This commit refactors the code to update the folio statistics only after a successful split. This makes the logic much cleaner and sets the stage for further simplification of the stat-handling code. Link: https://lkml.kernel.org/r/20251021212142.25766-3-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: wang lian Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ef0258857d40dd8e33c52e28ea3a1c82099a6879 Author: Wei Yang Date: Tue Oct 21 21:21:39 2025 +0000 mm/huge_memory: avoid reinvoking folio_test_anon() Patch series "mm/huge_memory: cleanup __split_unmapped_folio()", v3. This patch series cleans up and optimizes the internal logic of the __split_unmapped_folio() function. The goal is to improve clarity and efficiency by eliminating redundant checks, caching stable attribute values, and simplifying the iteration logic used for updating folio statistics. These changes make the code easier to follow and maintain. The split_huge_page_test selftest pass. This patch (of 4): During the execution of __split_unmapped_folio(), the folio's anon/!anon attribute is invariant (not expected to change). Therefore, it is safe and more efficient to retrieve this attribute once at the start and reuse it throughout the function. Link: https://lkml.kernel.org/r/20251021212142.25766-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251016004613.514-1-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251016004613.514-2-richard.weiyang@gmail.com Link: https://lkml.kernel.org/r/20251021212142.25766-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Zi Yan Reviewed-by: wang lian Reviewed-by: Barry Song Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Nico Pache Signed-off-by: Andrew Morton commit eca1fba23344ef6e289548bddd59127734873264 Author: Anshuman Khandual Date: Wed Oct 22 04:29:51 2025 +0100 mm/debug_vm_pgtable: add [pte|pmd]_mkwrite_novma() tests Add some [pte|pmd]_mkwrite_novma() relevant tests. [anshuman.khandual@arm.com: add a new test combination per Huang Ying] Link: https://lkml.kernel.org/r/20251024013137.136926-1-anshuman.khandual@arm.com Link: https://lkml.kernel.org/r/20251022032951.3498553-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Suggested-by: Catalin Marinas Reviewed-by: Catalin Marinas Reviewed-by: Huang Ying Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit e37d5a2d60a338c5917c45296bac65da1382eda5 Author: Lu Baolu Date: Wed Oct 22 16:26:34 2025 +0800 iommu/sva: invalidate stale IOTLB entries for kernel address space Introduce a new IOMMU interface to flush IOTLB paging cache entries for the CPU kernel address space. This interface is invoked from the x86 architecture code that manages combined user and kernel page tables, specifically before any kernel page table page is freed and reused. This addresses the main issue with vfree() which is a common occurrence and can be triggered by unprivileged users. While this resolves the primary problem, it doesn't address some extremely rare case related to memory unplug of memory that was present as reserved memory at boot, which cannot be triggered by unprivileged users. The discussion can be found at the link below. Enable SVA on x86 architecture since the IOMMU can now receive notification to flush the paging cache before freeing the CPU kernel page table pages. Link: https://lkml.kernel.org/r/20251022082635.2462433-9-baolu.lu@linux.intel.com Link: https://lore.kernel.org/linux-iommu/04983c62-3b1d-40d4-93ae-34ca04b827e5@intel.com/ Co-developed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe Signed-off-by: Lu Baolu Suggested-by: Jann Horn Reviewed-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Reviewed-by: Kevin Tian Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Hansen Cc: David Hildenbrand Cc: Ingo Molnar Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport (Microsoft) Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit 5ba2f0a1556479638ac11a3c201421f5515e89f5 Author: Dave Hansen Date: Wed Oct 22 16:26:33 2025 +0800 mm: introduce deferred freeing for kernel page tables This introduces a conditional asynchronous mechanism, enabled by CONFIG_ASYNC_KERNEL_PGTABLE_FREE. When enabled, this mechanism defers the freeing of pages that are used as page tables for kernel address mappings. These pages are now queued to a work struct instead of being freed immediately. This deferred freeing allows for batch-freeing of page tables, providing a safe context for performing a single expensive operation (TLB flush) for a batch of kernel page tables instead of performing that expensive operation for each page table. Link: https://lkml.kernel.org/r/20251022082635.2462433-8-baolu.lu@linux.intel.com Signed-off-by: Dave Hansen Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit bf9e4e30f3538391745a99bc2268ec4f5e4a401e Author: Lu Baolu Date: Wed Oct 22 16:26:32 2025 +0800 x86/mm: use pagetable_free() The kernel's memory management subsystem provides a dedicated interface, pagetable_free(), for freeing page table pages. Updates two call sites to use pagetable_free() instead of the lower-level __free_page() or free_pages(). This improves code consistency and clarity, and ensures the correct freeing mechanism is used. Link: https://lkml.kernel.org/r/20251022082635.2462433-7-baolu.lu@linux.intel.com Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Hansen Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Kevin Tian Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit 01894295672335ff304beed4359f30d14d5765f2 Author: Dave Hansen Date: Wed Oct 22 16:26:31 2025 +0800 mm: introduce pure page table freeing function The pages used for ptdescs are currently freed back to the allocator in a single location. They will shortly be freed from a second location. Create a simple helper that just frees them back to the allocator. Link: https://lkml.kernel.org/r/20251022082635.2462433-6-baolu.lu@linux.intel.com Signed-off-by: Dave Hansen Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit 412d000346ea38ac4b9bb715a86c73ef89d90dea Author: Dave Hansen Date: Wed Oct 22 16:26:30 2025 +0800 x86/mm: use 'ptdesc' when freeing PMD pages There are a billion ways to refer to a physical memory address. One of the x86 PMD freeing code location chooses to use a 'pte_t *' to point to a PMD page and then call a PTE-specific freeing function for it. That's a bit wonky. Just use a 'struct ptdesc *' instead. Its entire purpose is to refer to page table pages. It also means being able to remove an explicit cast. Right now, pte_free_kernel() is a one-liner that calls pagetable_dtor_free(). Effectively, all this patch does is remove one superfluous __pa(__va(paddr)) conversion and then call pagetable_dtor_free() directly instead of through a helper. Link: https://lkml.kernel.org/r/20251022082635.2462433-5-baolu.lu@linux.intel.com Signed-off-by: Dave Hansen Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: David Hildenbrand Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport (Microsoft) Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit 977870522af34359b461060597ee3a86f27450d6 Author: Dave Hansen Date: Wed Oct 22 16:26:29 2025 +0800 mm: actually mark kernel page table pages Now that the API is in place, mark kernel page table pages just after they are allocated. Unmark them just before they are freed. Note: Unconditionally clearing the 'kernel' marking (via ptdesc_clear_kernel()) would be functionally identical to what is here. But having the if() makes it logically clear that this function can be used for kernel and non-kernel page tables. Link: https://lkml.kernel.org/r/20251022082635.2462433-4-baolu.lu@linux.intel.com Signed-off-by: Dave Hansen Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit 27bfafac65d87c58639f5d7af1353ec1e7886963 Author: Dave Hansen Date: Wed Oct 22 16:26:28 2025 +0800 mm: add a ptdesc flag to mark kernel page tables The page tables used to map the kernel and userspace often have very different handling rules. There are frequently *_kernel() variants of functions just for kernel page tables. That's not great and has lead to code duplication. Instead of having completely separate call paths, allow a 'ptdesc' to be marked as being for kernel mappings. Introduce helpers to set and clear this status. Note: this uses the PG_referenced bit. Page flags are a great fit for this since it is truly a single bit of information. Use PG_referenced itself because it's a fairly benign flag (as opposed to things like PG_lock). It's also (according to Willy) unlikely to go away any time soon. PG_referenced is not in PAGE_FLAGS_CHECK_AT_FREE. It does not need to be cleared before freeing the page, and pages coming out of the allocator should have it cleared. Regardless, introduce an API to clear it anyway. Having symmetry in the API makes it easier to change the underlying implementation later, like if there was a need to move to a PAGE_FLAGS_CHECK_AT_FREE bit. Link: https://lkml.kernel.org/r/20251022082635.2462433-3-baolu.lu@linux.intel.com Signed-off-by: Dave Hansen Signed-off-by: Lu Baolu Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Signed-off-by: Andrew Morton commit 72f98ef9a4be30d2a60136dd6faee376f780d06c Author: Lu Baolu Date: Wed Oct 22 16:26:27 2025 +0800 iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel page table entries. When a kernel page table page is freed and reallocated for another purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-free or write-after-free condition, potentially leading to privilege escalation or data corruption. This solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The x86 architecture maps the kernel's virtual address space into the upper portion of every process's page table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries. The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and errors out. This means the IOMMU still caches these intermediate page table entries, making the described vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to flush the paging cache before freeing the CPU kernel page table pages. Link: https://lkml.kernel.org/r/20251022082635.2462433-1-baolu.lu@linux.intel.com Link: https://lkml.kernel.org/r/20251022082635.2462433-2-baolu.lu@linux.intel.com Fixes: 26b25a2b98e4 ("iommu: Bind process address spaces to devices") Signed-off-by: Lu Baolu Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Cc: Alistair Popple Cc: Andy Lutomirski Cc: Borislav Betkov Cc: Dave Hansen Cc: David Hildenbrand Cc: Ingo Molnar Cc: Jann Horn Cc: Jean-Philippe Brucker Cc: Joerg Roedel Cc: Kevin Tian Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Robin Murohy Cc: Thomas Gleinxer Cc: "Uladzislau Rezki (Sony)" Cc: Vasant Hegde Cc: Vinicius Costa Gomes Cc: Vlastimil Babka Cc: Will Deacon Cc: Yi Lai Cc: Signed-off-by: Andrew Morton commit 5ff592bec75ad79ed7f1a817477ab6eef8dc5efc Author: Shakeel Butt Date: Tue Oct 21 16:44:25 2025 -0700 memcg: manually uninline __memcg_memory_event __memcg_memory_event() has been unnecessarily marked inline even when it is not really performance critical. It is usually called to track extreme conditions. Over the time, it has evolved to include more functionality and inlining it is causing more harm. Before the patch: $ size mm/memcontrol.o net/ipv4/tcp_input.o net/ipv4/tcp_output.o text data bss dec hex filename 35645 10574 4192 50411 c4eb mm/memcontrol.o 54738 1658 0 56396 dc4c net/ipv4/tcp_input.o 34644 1065 0 35709 8b7d net/ipv4/tcp_output.o After the patch: $ size mm/memcontrol.o net/ipv4/tcp_input.o net/ipv4/tcp_output.o text data bss dec hex filename 35137 10446 4192 49775 c26f mm/memcontrol.o 54322 1562 0 55884 da4c net/ipv4/tcp_input.o 34492 1017 0 35509 8ab5 net/ipv4/tcp_output.o [akpm@linux-foundation.org: use EXPORT_SYMBOL_GPL for __memcg_memory_event, per Michal and Christoph] Link: https://lkml.kernel.org/r/20251021234425.1885471-1-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: SeongJae Park Acked-by: Roman Gushchin Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Muchun Song Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit a0615780439938e8e61343f1f92a4c54a71dc6a5 Author: Vishal Moola (Oracle) Date: Tue Oct 21 12:44:56 2025 -0700 mm/vmalloc: request large order pages from buddy allocator Sometimes, vm_area_alloc_pages() will want many pages from the buddy allocator. Rather than making requests to the buddy allocator for at most 100 pages at a time, we can eagerly request large order pages a smaller number of times. We still split the large order pages down to order-0 as the rest of the vmalloc code (and some callers) depend on it. We still defer to the bulk allocator and fallback path in case of order-0 pages or failure. Running 1000 iterations of allocations on a small 4GB system finds: 1000 2mb allocations: [Baseline] [This patch] real 46.310s real 0m34.582 user 0.001s user 0.006s sys 46.058s sys 0m34.365s 10000 200kb allocations: [Baseline] [This patch] real 56.104s real 0m43.696 user 0.001s user 0.003s sys 55.375s sys 0m42.995s Link: https://lkml.kernel.org/r/20251021194455.33351-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton commit 645a3c4243473d5c8b780927d2cc573e3da5a20c Author: Jing Su Date: Tue Oct 21 15:37:07 2025 +0800 mm/vmstat: fix indentation in fold_diff function Adjust misaligned braces in fold_diff() to improve code readability and maintain consistent coding style. [akpm@linux-foundation.org: add braces, per Vlastimil & Liam] Link: https://lkml.kernel.org/r/aPc4I/8zXCGyiapN@pilot-ThinkCentre-M930t-N000 Signed-off-by: Jing Su Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Donet Tom Acked-by: Vlastimil Babka Reviewed-by: Dev Jain Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit fe62415c9b0da808dab7507dacff588e329f8ff3 Author: William Kucharski Date: Tue Oct 21 05:00:04 2025 -0600 mm: remove reference to destructor in comment in calculate_sizes() The commit that removed support for destructors from kmem_cache_alloc() never removed the comment regarding destructors in the explanation of the possible relocation of the free pointer in calculate_sizes(). Link: https://lkml.kernel.org/r/20251021110004.2209008-1-william.kucharski@oracle.com Fixes: 20c2df83d25c ("mm: Remove slab destructors from kmem_cache_create().") Signed-off-by: William Kucharski Acked-by: Roman Gushchin Reviewed-by: Christoph Lameter (Ampere) Acked-by: SeongJae Park Cc: David Rientjes Cc: Paul Mundt Cc: Vlastimil Babka Cc: Harry Yoo Signed-off-by: Andrew Morton commit 2da6fe91c29c5402ede36bcd286696c227b99020 Author: Leon Hwang Date: Tue Oct 21 21:44:31 2025 +0800 mm/khugepaged: factor out common logic in [scan,alloc]_sleep_millisecs_store() Both scan_sleep_millisecs_store() and alloc_sleep_millisecs_store() perform the same operations: parse the input value, update their respective sleep interval, reset khugepaged_sleep_expire, and wake up the khugepaged thread. Factor out this duplicated logic into a helper function __sleep_millisecs_store(), and simplify both store functions. No functional change intended. Link: https://lkml.kernel.org/r/20251021134431.26488-1-leon.hwang@linux.dev Signed-off-by: Leon Hwang Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Reviewed-by: Lance Yang Acked-by: David Hildenbrand Acked-by: Nico Pache Reviewed-by: Dev Jain Reviewed-by: SeongJae Park Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Ryan Roberts Signed-off-by: Andrew Morton commit fae4e86024bdcf23fc87b47122a11b93c009d570 Author: Swaraj Gaikwad Date: Tue Oct 21 21:53:24 2025 +0000 mm/damon/sysfs: remove misleading todo comment in nid_show() The TODO comment in nid_show() suggested returning an error if the goal was not using nid. However, this comment was found to be inaccurate and misleading.This patch removes the TODO comment without changing any existing behavior. This change follows feedback from SJ who pointed out [1] that wiring-order independence is expected and the function should simply show the last set value. and [2] checkpatch.pl complain about number of chars per line No functional code changes were made. Tested with KUnit: - Built kernel with KUnit and DAMON sysfs tests enabled. - Executed KUnit tests: ./tools/testing/kunit/kunit.py run --kunitconfig ./mm/damon/tests/ - All 25 tests passed, including damon_sysfs_test_add_targets. Link: https://lkml.kernel.org/r/20251021215323.29734-2-swarajgaikwad1925@gmail.com Link: https://lore.kernel.org/lkml/20251020151315.66260-1-sj@kernel.org/ [1] Link: https://lore.kernel.org/lkml/20251021010847.68473-1-sj@kernel.org/ [2] Signed-off-by: Swaraj Gaikwad Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Cc: David Hunter Signed-off-by: Andrew Morton commit f0c74b6cb91d97cea74176a5400e89c183732cb2 Author: Mehdi Ben Hadj Khelifa Date: Sat Oct 18 21:11:48 2025 +0100 mm/vmalloc: use kmalloc_array() instead of kmalloc() The number of NUMA nodes (nr_node_ids) is bounded, so overflow is not a practical concern here. However, using kmalloc_array() better reflects the intent to allocate an array of unsigned ints, and improves consistency with other NUMA-related allocations. No functional change intended. Link: https://lkml.kernel.org/r/20251018201207.27441-1-mehdi.benhadjkhelifa@gmail.com Signed-off-by: Mehdi Ben Hadj Khelifa Reviewed-by: Uladzislau Rezki (Sony) Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Khalid Aziz Cc: David Hunter Signed-off-by: Andrew Morton commit 184c7533426ada7625c029b54143fec4ef4daa28 Author: Bagas Sanjaya Date: Mon Oct 20 11:49:33 2025 +0700 vmalloc: separate gfp_mask adjunctive parentheses in __vmalloc_node_noprof() kernel-doc comment Sphinx reports htmldocs warning on __vmalloc_node() comment: Documentation/core-api/mm-api:52: ./mm/vmalloc.c:4036: WARNING: Inline strong start-string without end-string. [docutils] Fix it by separating adjunctive parentheses from preceding gfp_mask formatting markup. Link: https://lkml.kernel.org/r/20251020044933.15222-1-bagasdotme@gmail.com Fixes: 32904ba6f5ef ("vmalloc: update __vmalloc_node_noprof() documentation") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251020134902.3a11107e@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Uladzislau Rezki (Sony) Cc: Baoquan He Cc: Stehen Rothwell Signed-off-by: Andrew Morton commit 8247e2600e5348a364c393a75fd204846d4092da Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:32 2025 +0100 mm: update resctl to use mmap_prepare Make use of the ability to specify a remap action within mmap_prepare to update the resctl pseudo-lock to use mmap_prepare in favour of the deprecated mmap hook. Link: https://lkml.kernel.org/r/95b28b066f37ca25f56fa9460a9367f1a866f88b.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Reinette Chatre Reviewed-by: Jason Gunthorpe Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit ab04945f91bcad1668af57bbb575771e794aea8d Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:31 2025 +0100 mm: update mem char driver to use mmap_prepare Update the mem char driver (backing /dev/mem and /dev/zero) to use f_op->mmap_prepare hook rather than the deprecated f_op->mmap. The /dev/zero implementation has a very unique and rather concerning characteristic in that it converts MAP_PRIVATE mmap() mappings anonymous when they are, in fact, not. The new f_op->mmap_prepare() can support this, but rather than introducing a helper function to perform this hack (and risk introducing other users), utilise the success hook to do so. We utilise the newly introduced shmem_zero_setup_desc() to allow for the shared mapping case via an f_op->mmap_prepare() hook. We also use the desc->action_error_hook to filter the remap error to -EAGAIN to keep behaviour consistent. Link: https://lkml.kernel.org/r/48f60764d7a6901819d1af778fa33b775d2e8c77.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 89646d9c748c0902600090f37ae585f3b99deb4d Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:30 2025 +0100 mm: add shmem_zero_setup_desc() Add the ability to set up a shared anonymous mapping based on a VMA descriptor rather than a VMA. This is a prerequisite for converting to the char mm driver to use the mmap_prepare hook. Link: https://lkml.kernel.org/r/d9181517a7e3d6b014a5697c6990d3722c2c9fcd.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit ea52cb24cd3fb121283754ab82b2cb3044609359 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:29 2025 +0100 mm/hugetlbfs: update hugetlbfs to use mmap_prepare Since we can now perform actions after the VMA is established via mmap_prepare, use desc->action_success_hook to set up the hugetlb lock once the VMA is setup. We also make changes throughout hugetlbfs to make this possible. Note that we must hide newly established hugetlb VMAs from the rmap until the operation is entirely complete as we establish a hugetlb lock during VMA setup that can be raced by rmap users. Link: https://lkml.kernel.org/r/b1afa16d3cfa585a03df9ae215ae9f905b3f0ed7.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Tested-by: Sumanth Korikkar Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit da003453dce728857bea2e3de74132a90c9c78e7 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:28 2025 +0100 doc: update porting, vfs documentation for mmap_prepare actions Now we have introduced the ability to specify that actions should be taken after a VMA is established via the vm_area_desc->action field as specified in mmap_prepare, update both the VFS documentation and the porting guide to describe this. Link: https://lkml.kernel.org/r/472ce3da7662ed1065cc299d14bffb70b1a845e7.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jan Kara Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit ac0a3fc9c07df79dc8a4ce9d274df00afc7bf12d Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:27 2025 +0100 mm: add ability to take further action in vm_area_desc Some drivers/filesystems need to perform additional tasks after the VMA is set up. This is typically in the form of pre-population. The forms of pre-population most likely to be performed are a PFN remap or the insertion of normal folios and PFNs into a mixed map. We start by implementing the PFN remap functionality, ensuring that we perform the appropriate actions at the appropriate time - that is setting flags at the point of .mmap_prepare, and performing the actual remap at the point at which the VMA is fully established. This prevents the driver from doing anything too crazy with a VMA at any stage, and we retain complete control over how the mm functionality is applied. Unfortunately callers still do often require some kind of custom action, so we add an optional success/error _hook to allow the caller to do something after the action has succeeded or failed. This is done at the point when the VMA has already been established, so the harm that can be done is limited. The error hook can be used to filter errors if necessary. There may be cases in which the caller absolutely must hold the file rmap lock until the operation is entirely complete. It is an edge case, but certainly the hugetlbfs mmap hook requires it. To accommodate this, we add the hide_from_rmap_until_complete flag to the mmap_action type. In this case, if a new VMA is allocated, we will hold the file rmap lock until the operation is entirely completed (including any success/error hooks). Note that we do not need to update __compat_vma_mmap() to accommodate this flag, as this function will be invoked from an .mmap handler whose VMA is not yet visible, so we implicitly hide it from the rmap. If any error arises on these final actions, we simply unmap the VMA altogether. Also update the stacked filesystem compatibility layer to utilise the action behaviour, and update the VMA tests accordingly. While we're here, rename __compat_vma_mmap_prepare() to __compat_vma_mmap() as we are now performing actions invoked by the mmap_prepare in addition to just the mmap_prepare hook. Link: https://lkml.kernel.org/r/2601199a7b2eaeadfcd8ab6e199c6d1706650c94.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jason Gunthorpe Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit db91b783290e395443151b0fe4b8dc32aceebef5 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:26 2025 +0100 mm: introduce io_remap_pfn_range_[prepare, complete]() We introduce the io_remap*() equivalents of remap_pfn_range_prepare() and remap_pfn_range_complete() to allow for I/O remapping via mmap_prepare. Make these internal to mm, as they should only be used by internal helpers. Link: https://lkml.kernel.org/r/4065134f13a24a3e14691b7443bcee7490b18a5c.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit c707a68f9468e4ef4a3546b636a9dd088fe7b7f1 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:25 2025 +0100 mm: abstract io_remap_pfn_range() based on PFN The only instances in which we customise this function are ones in which we customise the PFN used. Instances where architectures were not passing the pgprot value through pgprot_decrypted() are ones where pgprot_decrypted() was a no-op anyway, so we can simply always pass pgprot through this function. Use this fact to simplify the use of io_remap_pfn_range(), by abstracting the PFN via io_remap_pfn_range_pfn() and using this instead of providing a general io_remap_pfn_range() function per-architecture. Link: https://lkml.kernel.org/r/d086191bf431b58ce3b231b4f4f555d080f60327.1760959442.git.lorenzo.stoakes@oracle.com Suggested-by: Jason Gunthorpe Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 51e38e7d40d617965504f4dcba569ecf9302f245 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:24 2025 +0100 mm: add remap_pfn_range_prepare(), remap_pfn_range_complete() We need the ability to split PFN remap between updating the VMA and performing the actual remap, in order to do away with the legacy f_op->mmap hook. To do so, update the PFN remap code to provide shared logic, and also make remap_pfn_range_notrack() static, as its one user, io_mapping_map_user() was removed in commit 9a4f90e24661 ("mm: remove mm/io-mapping.c"). Then, introduce remap_pfn_range_prepare(), which accepts VMA descriptor and PFN parameters, and remap_pfn_range_complete() which accepts the same parameters as remap_pfn_rangte(). remap_pfn_range_prepare() will set the cow vma->vm_pgoff if necessary, so it must be supplied with a correct PFN to do so. While we're here, also clean up the duplicated #ifdef __HAVE_PFNMAP_TRACKING check and put into a single #ifdef/#else block. We keep these internal to mm as they should only be used by internal helpers. Link: https://lkml.kernel.org/r/75b55de63249b3aa0fd5b3b08ed1d3ff19255d0d.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Acked-by: Pedro Falcato Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 2bcd9207dedc585bae33ad7b337f2232a8a11da8 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:23 2025 +0100 mm/vma: rename __mmap_prepare() function to avoid confusion Now we have the f_op->mmap_prepare() hook, having a static function called __mmap_prepare() that has nothing to do with it is confusing, so rename the function to __mmap_setup(). Link: https://lkml.kernel.org/r/d25a22c60ca0f04091697ef9cda0d72ce0cf8af3.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Pedro Falcato Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 651fdda8406d42a5004c5c79f269540a85d6a1ab Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:22 2025 +0100 relay: update relay to use mmap_prepare It is relatively trivial to update this code to use the f_op->mmap_prepare hook in favour of the deprecated f_op->mmap hook, so do so. Link: https://lkml.kernel.org/r/7c9e82cdddf8b573ea3edb8cdb697363e3ccb5d7.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Pedro Falcato Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 54c58a2f5fa191839cf192fa4ebab39395272a3e Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:21 2025 +0100 mm: add vma_desc_size(), vma_desc_pages() helpers It's useful to be able to determine the size of a VMA descriptor range used on f_op->mmap_prepare, expressed both in bytes and pages, so add helpers for both and update code that could make use of it to do so. Link: https://lkml.kernel.org/r/74ef338203c9ff08a9ace73a8f1f6116a79112a0.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jan Kara Acked-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Pedro Falcato Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit cf1d98f44d056d7114554beb78665c20d1ed244a Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:20 2025 +0100 mm/vma: remove unused function, make internal functions static unlink_file_vma() is not used by anything, so remove it. vma_link() and vma_link_file() are only used within mm/vma.c, so make them static. Link: https://lkml.kernel.org/r/f2ab9ea051225a02e6d1d45a7608f4e149220117.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David Hildenbrand Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jan Kara Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Pedro Falcato Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 8e18a7f43557f5caea18dfd82a24b6839ab0a956 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:19 2025 +0100 device/dax: update devdax to use mmap_prepare The devdax driver does nothing special in its f_op->mmap hook, so straightforwardly update it to use the mmap_prepare hook instead. Link: https://lkml.kernel.org/r/1e8665d052ac8cf2f7ff92b6c7862614f7fd306c.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Jan Kara Reviewed-by: Jason Gunthorpe Acked-by: Pedro Falcato Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit ab3c8e7b8687a26eacb95ba343de5dad4fb95880 Author: Lorenzo Stoakes Date: Mon Oct 20 13:11:18 2025 +0100 mm/shmem: update shmem to use mmap_prepare Patch series "expand mmap_prepare functionality, port more users", v5. Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), The f_op->mmap hook has been deprecated in favour of f_op->mmap_prepare. This was introduced in order to make it possible for us to eventually eliminate the f_op->mmap hook which is highly problematic as it allows drivers and filesystems raw access to a VMA which is not yet correctly initialised. This hook also introduced complexity for the memory mapping operation, as we must correctly unwind what we do should an error arises. Overall this interface being so open has caused significant problems for us, including security issues, it is important for us to simply eliminate this as a source of problems. Therefore this series continues what was established by extending the functionality further to permit more drivers and filesystems to use mmap_prepare. We start by udpating some existing users who can use the mmap_prepare functionality as-is. We then introduce the concept of an mmap 'action', which a user, on mmap_prepare, can request to be performed upon the VMA: * Nothing - default, we're done * Remap PFN - perform PFN remap with specified parameters * I/O remap PFN - perform I/O PFN remap with specified parameters By setting the action in mmap_prepare, this allows us to dynamically decide what to do next, so if a driver/filesystem needs to determine whether to e.g. remap or use a mixed map, it can do so then change which is done. This significantly expands the capabilities of the mmap_prepare hook, while maintaining as much control as possible in the mm logic. We split [io_]remap_pfn_range*() functions which allow for PFN remap (a typical mapping prepopulation operation) split between a prepare/complete step, as well as io_mremap_pfn_range_prepare, complete for a similar purpose. From there we update various mm-adjacent logic to use this functionality as a first set of changes. We also add success and error hooks for post-action processing for e.g. output debug log on success and filtering error codes. This patch (of 15): This simply assigns the vm_ops so is easily updated - do so. Link: https://lkml.kernel.org/r/cover.1760959441.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/7b93b1e89028e39507dac5ca01991e1374d5bbe8.1760959442.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Reviewed-by: David Hildenbrand Reviewed-by: Jan Kara Reviewed-by: Jason Gunthorpe Reviewed-by: Pedro Falcato Cc: Alexander Gordeev Cc: Al Viro Cc: Andreas Larsson Cc: Andrey Konovalov Cc: Arnd Bergmann Cc: Baoquan He Cc: Chatre, Reinette Cc: Christian Borntraeger Cc: Christian Brauner Cc: Dan Williams Cc: Dave Jiang Cc: Dave Martin Cc: Dave Young Cc: David S. Miller Cc: Dmitriy Vyukov Cc: Greg Kroah-Hartman Cc: Guo Ren Cc: Heiko Carstens Cc: Hugh Dickins Cc: James Morse Cc: Jann Horn Cc: Jonathan Corbet Cc: Kevin Tian Cc: Konstantin Komarov Cc: Liam Howlett Cc: "Luck, Tony" Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nicolas Pitre Cc: Oscar Salvador Cc: Robin Murohy Cc: Sumanth Korikkar Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Thomas Bogendoerfer Cc: "Uladzislau Rezki (Sony)" Cc: Vasily Gorbik Cc: Vishal Verma Cc: Vivek Goyal Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit dfc02531f413bf18f5e0ac79a52d2af6f69e99c3 Author: Quanmin Yan Date: Mon Oct 20 21:01:25 2025 +0800 mm/damon/reclaim: use min_sz_region for core address alignment when setting regions When setting regions in DAMON_RECLAIM, DAMON_MIN_REGION will be applied as the core address alignment, and the monitoring target address ranges would be aligned on DAMON_MIN_REGION * addr_unit. When users 1) set addr_unit to a value larger than 1, and 2) set the monitoring target address range as not aligned on DAMON_MIN_REGION * addr_unit, it will cause DAMON_RECLAIM to operate on unexpectedly large physical address ranges. For example, if the user sets the monitoring target address range to [4, 8) and addr_unit as 1024, the aimed monitoring target address range is [4 KiB, 8 KiB). Assuming DAMON_MIN_REGION is 4096, so resulting target address range will be [0, 4096) in the DAMON core layer address system, and [0, 4 MiB) in the physical address space, which is an unexpected range. To fix the issue, use min_sz_region for core address alignment when setting regions. Link: https://lkml.kernel.org/r/20251020130125.2875164-3-yanquanmin1@huawei.com Fixes: 7db551fcfb2a ("mm/damon/reclaim: support addr_unit for DAMON_RECLAIM") Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Signed-off-by: Andrew Morton commit e859a224fad65cb4848fe202aea9896a14fdb7f4 Author: Quanmin Yan Date: Mon Oct 20 21:01:24 2025 +0800 mm/damon: add a min_sz_region parameter to damon_set_region_biggest_system_ram_default() Patch series "mm/damon: fixes for address alignment issues in DAMON_LRU_SORT and DAMON_RECLAIM", v2. In DAMON_LRU_SORT and DAMON_RECLAIM, damon_set_regions() will apply DAMON_MIN_REGION as the core address alignment, and the monitoring target address ranges would be aligned on DAMON_MIN_REGION * addr_unit. When users 1) set addr_unit to a value larger than 1, and 2) set the monitoring target address range as not aligned on DAMON_MIN_REGION * addr_unit, it will cause DAMON_LRU_SORT and DAMON_RECLAIM to operate on unexpectedly large physical address ranges. For example, if the user sets the monitoring target address range to [4, 8) and addr_unit as 1024, the aimed monitoring target address range is [4 KiB, 8 KiB). Assuming DAMON_MIN_REGION is 4096, so resulting target address range will be [0, 4096) in the DAMON core layer address system, and [0, 4 MiB) in the physical address space, which is an unexpected range. To fix the issue, add a min_sz_region parameter to damon_set_region_biggest_system_ram_default() and use it when calling damon_set_regions(), replacing the direct use of DAMON_MIN_REGION. This patch (of 2): In DAMON_LRU_SORT, damon_set_regions() will apply DAMON_MIN_REGION as the core address alignment, and the monitoring target address ranges would be aligned on DAMON_MIN_REGION * addr_unit. When users 1) set addr_unit to a value larger than 1, and 2) set the monitoring target address range as not aligned on DAMON_MIN_REGION * addr_unit, it will cause DAMON_LRU_SORT to operate on unexpectedly large physical address ranges. For example, if the user sets the monitoring target address range to [4, 8) and addr_unit as 1024, the aimed monitoring target address range is [4 KiB, 8 KiB). Assuming DAMON_MIN_REGION is 4096, so resulting target address range will be [0, 4096) in the DAMON core layer address system, and [0, 4 MiB) in the physical address space, which is an unexpected range. To fix the issue, add a min_sz_region parameter to damon_set_region_biggest_system_ram_default() and use it when calling damon_set_regions(), replacing the direct use of DAMON_MIN_REGION. Link: https://lkml.kernel.org/r/20251020130125.2875164-1-yanquanmin1@huawei.com Link: https://lkml.kernel.org/r/20251020130125.2875164-2-yanquanmin1@huawei.com Fixes: 2e0fe9245d6b ("mm/damon/lru_sort: support addr_unit for DAMON_LRU_SORT") Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Signed-off-by: Andrew Morton commit 074f027d15c10cb376b3ad88405b8e512fa5b3a8 Author: Lance Yang Date: Mon Oct 20 23:11:11 2025 +0800 mm/khugepaged: guard is_zero_pfn() calls with pte_present() A non-present entry, like a swap PTE, contains completely different data (swap type and offset). pte_pfn() doesn't know this, so if we feed it a non-present entry, it will spit out a junk PFN. What if that junk PFN happens to match the zeropage's PFN by sheer chance? While really unlikely, this would be really bad if it did. So, let's fix this potential bug by ensuring all calls to is_zero_pfn() in khugepaged.c are properly guarded by a pte_present() check. Link: https://lkml.kernel.org/r/20251020151111.53561-1-lance.yang@linux.dev Signed-off-by: Lance Yang Suggested-by: Lorenzo Stoakes Reviewed-by: Nico Pache Reviewed-by: Dev Jain Reviewed-by: Baolin Wang Reviewed-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Liam Howlett Cc: Ryan Roberts Cc: Wei Yang Cc: Zi Yan Signed-off-by: Andrew Morton commit 40d923acfa83d514718d1aee96b2af91e4e1fff2 Author: SeongJae Park Date: Fri Oct 17 14:27:02 2025 -0700 Docs/ABI/damon: document DAMOS quota goal path file A DAMON sysfs interface file for DAMOS quota goal's optional path argument has been added. Document it on the ABI doc. Link: https://lkml.kernel.org/r/20251017212706.183502-11-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 87b83515801fbc5fde52b5d97921e434bcc6c889 Author: SeongJae Park Date: Fri Oct 17 14:27:01 2025 -0700 Docs/admin-guide/mm/damon/usage: document DAMOS quota goal path file A new DAMON sysfs interface file, namely 'path' has been added under DAMOS quota goal directory, for specifying the cgroup for DAMOS_QUOTA_NODE_MEMCG_{USED,FREE}_BP metrics. Document it on the usage document. Link: https://lkml.kernel.org/r/20251017212706.183502-10-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 4cc00d41c6c9f8dfb8b6db831e9fca77582112b2 Author: SeongJae Park Date: Fri Oct 17 14:27:00 2025 -0700 Docs/mm/damon/design: document DAMOS_QUOTA_NODE_MEMCG_{USED,FREE}_BP Update design doc for the newly added two DAMOS quota auto-tuning target goal metrics, DAMOS_QUOTA_NODE_MEMCG_{USED,FREE}_BP. Link: https://lkml.kernel.org/r/20251017212706.183502-9-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit c2fbf2da4cd94035cd885af5d91eed827509e421 Author: SeongJae Park Date: Fri Oct 17 14:26:59 2025 -0700 mm/damon/sysfs-schemes: support DAMOS_QUOTA_NODE_MEMCG_FREE_BP Extend DAMON sysfs to support DAMOS_QUOTA_NODE_MEMCG_FREE_BP. Link: https://lkml.kernel.org/r/20251017212706.183502-8-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 98fdce76fb7ed7070df21afbee46a4b36cb6a7c6 Author: SeongJae Park Date: Fri Oct 17 14:26:58 2025 -0700 mm/damon/core: add DAMOS quota gaol metric for per-memcg per-numa free memory Add a variant of DAMOS_QUOTA_NODE_MEMCG_USED_BP, for the free memory portion. The value of the metric is implemented as the entire memory of the given NUMA node subtracted by the given cgroup's usage. So from a perspective, "unused" could be a better term than "free". But arguably it is not very clear what is better, so use the term "free". Link: https://lkml.kernel.org/r/20251017212706.183502-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit a1d1df78acb3b038d72f97a66b8f5e01af021b7c Author: SeongJae Park Date: Fri Oct 17 14:26:57 2025 -0700 mm/damon/sysfs-schemes: support DAMOS_QUOTA_NODE_MEMCG_USED_BP Add support of DAMOS_QUOTA_NODE_MEMCG_USED_BP. For this, extend quota goal metric inputs for the new metric, and update DAMOS core layer request construction logic to set the target cgroup, which is specified by the user, via the 'path' file. Link: https://lkml.kernel.org/r/20251017212706.183502-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit c41e253a411eb73a5ac651c14f40c2ea2f274ebd Author: SeongJae Park Date: Fri Oct 17 14:26:56 2025 -0700 mm/damon/sysfs-schemes: implement path file under quota goal directory Add a DAMOS sysfs file for specifying the cgroup of the interest for DAMOS_QUOTA_NODE_MEMCG_USED_BP. Link: https://lkml.kernel.org/r/20251017212706.183502-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit b74a120bcf50787e5b9a2c3dcff999f9836ce1db Author: SeongJae Park Date: Fri Oct 17 14:26:55 2025 -0700 mm/damon/core: implement DAMOS_QUOTA_NODE_MEMCG_USED_BP Implement the handling of the new DAMOS quota goal metric for per-memcg per-node memory usage, namely DAMOS_QUOTA_NODE_MEMCG_USED_BP. The metric value is calculated as the sum of active/inactive anon/file pages of the given cgroup for a given NUMA node. Link: https://lkml.kernel.org/r/20251017212706.183502-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 6a18bbe48361acad1eae8d86aa47d353b1cfe619 Author: SeongJae Park Date: Fri Oct 17 14:26:54 2025 -0700 mm/damon: add DAMOS quota goal type for per-memcg per-node memory usage Define a new DAMOS quota auto-tuning target metric for per-cgroup per-node memory usage. For specifying the cgroup of the interest, add a field, namely memcg_id, to damos_quota_goal struct. Note that this commit is only implementing the interface. The handling of the interface (the metric value calculation) will be implemented in the following commit. Link: https://lkml.kernel.org/r/20251017212706.183502-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit d3946c5f4c1c5db63532eb433a55c7d881de1389 Author: SeongJae Park Date: Fri Oct 17 14:26:53 2025 -0700 mm/damon: document damos_quota_goal->nid use case Patch series "mm/damon: allow DAMOS auto-tuned for per-memcg per-node memory usage". Introduce two new DAMOS quota auto-tuning target metrics for per-cgroup per-NUMA node memory utilization. Expected use cases are cgroup level access-aware NUMA memory managements, such as memory tiering or proactive reclamation on cgroup-based multi-tenant NUMA systems. Background ========== The aim-oriented aggressiveness auto-tuning feature of DAMOS is a highly recommended way for modern DAMOS use cases. Using it, users can specify what system status they want to achieve with what access-aware system operations. For example, reclaim cold memory aiming for 0.5 percent of memory pressure (proactive reclaim), or migrate hot and cold memory between NUMA nodes having different speed (memory tiering). Then DAMOS automatically adjusts the aggressiveness of the system operation (e.g., increase/decrease reclaim target coldness threshold) based on current status of the system. The use case is limited by the supported system status metrics for specifying the target system status. Two new system metrics for per-node memory usage ratio, namely DAMOS_QUOTA_NODE_MEM_{USED,FREE}_BP, were recently added to extend the use cases for access-aware NUMA nodes management, such as memory tiering. Those are expected to be useful for not only memory tiering but also general access-aware inter-NUMA node page migration, though. Limitation ---------- The per-node memory usage based auto-tuning can be applied only system-wide. For cgroups-based multi-tenant systems, it could arguably harm the fairness. For example, a cgroup may use faster NUMA node memory more than other cgroup, depending on their access pattern. If the user of each cgroup are promised to get the same quality and amount of the system resource, this can arguably be an unfair situation. DAMOS supports cgroup level system operations via DAMOS filter. But the quota auto-tuning system is not aware of cgroups. New DAMOS Quota Tuning Metrics for Per-Cgroup Per-NUMA Memory Usage =================================================================== To overcome the limitation, introduce two new DAMOS quota auto-tuning goal metrics, namely DAMOS_QUOTA_NODE_MEMCG_{USED,FREE}_BP. Those can be thought of as a variant of DAMOS_QUOTA_NODE_MEM_{USED,FREE}_BP that extended for cgroups. The two metrics specifies per-cgroup, per-node amount of used and unused memory in ratio to the total memory of the node. For example, let's assume a system has two NUMA nodes of size 100 GiB and 50 GiB. And two cgroups are using 40 GiB and 60 GiB of node 0, 20 GiB and 10 GiB of node 1, respectively, as illustrated by the below table. node-0 node-1 Total memory 100 GiB 50 GiB Cgroup A usage 40 GiB 20 GiB Cgroup B usage 60 GiB 10 GiB Then, DAMOS_QUOTA_NODE_MEMCG_USED_BP for the cgroups for the first node are, 40 GiB / 100 GiB = 4,000 bp (40 percent) and 60 GiB / 100 GiB = 6,000 bp (60 percent), respectively. Those for the second node are, 20 GiB / 50 GiB = 4000 bp (40 percent) and 10 GiB / 50 GiB = 2000 bp (20 percent), respectively. DAMOS_QUOTA_NODE_MEMCG_FREE_BP for the four cases are, 60 GiB /100 GiB = 6000 bp, 40 GiB / 100 GiB = 4000 bp, 30 GiB / 50 GiB = 6000 bp, and 40 GiB / 50 GiB = 8000 bp, respectively. DAMOS_QUOTA_NODE_MEMCG_USED_BP for cgroup A node-0: 4000 bp DAMOS_QUOTA_NODE_MEMCG_USED_BP for cgroup B node-0: 6000 bp DAMOS_QUOTA_NODE_MEMCG_USED_BP for cgroup A node-1: 4000 bp DAMOS_QUOTA_NODE_MEMCG_USED_BP for cgroup B node-1: 2000 bp DAMOS_QUOTA_NODE_MEMCG_FREE_BP for cgroup A node-0: 6000 bp DAMOS_QUOTA_NODE_MEMCG_FREE_BP for cgroup B node-0: 4000 bp DAMOS_QUOTA_NODE_MEMCG_FREE_BP for cgroup A node-1: 6000 bp DAMOS_QUOTA_NODE_MEMCG_FREE_BP for cgroup B node-1: 8000 bp Using these, users can specify how much [un]used amount of memory for per-cgroup and per-node DAMOS should make as a result of the auto-tuning. Example Usecase: Cgroup Level Memory Tiering ============================================ Let's suppose a typical and simple tiered memory system. The system equips two NUMA nodes. The first node (node 0) is CPU-attached and fast. The second node (node 1) is CPU-unattached and slow. It runs two cgroups that desire to use about 30 percent and 70 percent of the faster node as much as possible for their hot data, respectively. Then, the user can implement DAMOS-based memory tiering for the system using the DAMON user-space tool (damo), like below. # ./damo start \ `# kdamond for node 1 (slow)` \ --numa_node 1 --monitoring_intervals_goal 4% 3 5ms 10s \ `# promotion scheme for cgroup a` \ --damos_action migrate_hot 0 --damos_access_rate 5% max \ --damos_apply_interval 1s \ --damos_filter allow memcg /workloads/a \ --damos_filter allow young \ --damos_quota_interval 1s --damos_quota_space 200MB \ --damos_quota_goal node_memcg_used_bp 29.7% 0 /workloads/a \ \ `# promotion scheme for cgroup b` \ --damos_action migrate_hot 0 --damos_access_rate 5% max \ --damos_apply_interval 1s \ --damos_filter allow memcg /workloads/b \ --damos_filter allow young \ --damos_quota_interval 1s --damos_quota_space 200MB \ --damos_quota_goal node_memcg_used_bp 69.7% 0 workloads/b \ \ `# kdamond for node 0 (fast)` \ --numa_node 0 --monitoring_intervals_goal 4% 3 5ms 10s \ `# demotion scheme for cgroup a` \ --damos_action migrate_cold 1 --damos_access_rate 0% 0% \ --damos_apply_interval 1s \ --damos_filter allow memcg /workloads/a \ --damos_filter reject young \ --damos_quota_interval 1s --damos_quota_space 200MB \ --damos_quota_goal node_memcg_free_bp 70.5% 0 \ \ `# demotion scheme for cgroup b` \ --damos_action migrate_cold 1 --damos_access_rate 0% 0% \ --damos_apply_interval 1s \ --damos_filter allow memcg /workloads/a \ --damos_filter reject young \ --damos_quota_interval 1s --damos_quota_space 200MB \ --damos_quota_goal node_memcg_free_bp 30.5% 0 \ \ --damos_nr_quota_goals 1 1 1 1 --damos_nr_filters 1 1 1 1 \ --nr_targets 1 1 --nr_schemes 2 2 --nr_ctxs 1 1 With the command, the user-space tool will ask DAMON to spawn two kernel threads, each for monitoring accesses to node 1 (slow) and node 0 (fast), respectively. It installs two DAMOS schemes on each thread. Let's call them "promotion scheme for cgroup a/b", and "demotion scheme for cgroup a/b" in the order. The promotion schemes are installed on the DAMON thread for node 1 (slow), and demotion schemes are installed on the DAMON thread for node 0 (fast). Cgroup Level Hot Pages Migration (Promotion) -------------------------------------------- Promotion schemes will find memory regions on node 1 (slow), that some access was detected. The schemes will then migrate the found memory to node 0 (fast), hottest pages first. For accurate and effective migration, these schemes use two page level filters. First, the migration will be filtered for only cgroup A and cgroup B. That is, "promotion scheme for cgroup B" will not do the migration if the page is for cgroup A. Secondly, the schemes will ignore pages that having their page table's Accessed bits unset. The per-page Accessed bit check logic will also unset the bit if it was set, for the next check. For controlled amounts of system resource consumption and aiming on the target memory usage, the schemes use quotas setup. The migration is limited to be done only up to 200 MiB per second, to limit the peak system resource usage. And DAMOS_QUOTA_NODE_MEMCG_USED_BP target is set for 29.7% and 69.7% of node 0 (fast), respectively. The target value is lower than the high level goal (30% and 70% system memory), to give headroom on node 0 (fast). DAMOS will adjust the speed of the pages migration based on the target and current per-cgroup node 0 memory usage. For example, if cgroup A is utilizing only 10% of node 0, DAMOS will try to migrate more of cgroup A hot pages from node 1 to node 0, up to 200 MiB per second. If cgroup A utilizes more than 29.7% of node 0 memory, the cgroup A hot pages migration from node 1 to node 0 will be slowed and eventually stopped. Cgroup Level Cold Pages Migration (Demotion) -------------------------------------------- Demotion schemes are similar to promotion schemes, but differ in filtering setup and quota tuning setup. Those filter out pages having their page table Accessed bits set. And set 70.5% and 30.5% of node 0 memory free rate for the cgroup A and B, respectively. Hence, if promotion schemes or something made cgroup A and/or B uses more than 29.5% and 69.5% of node 0, demotion schemes will start migrating cold pages of appropriate cgroups in node 0 to node 1, under the 200 MiB per second speed cap, while adjusting the speed based on how much more than wanted memory is being used. The quota target values are set to overlap with promotion targets, to keep a minimum level of page exchanges between the nodes. This is to avoid a case that the target memory utilization is met, and then access pattern changes (pages in node 1 become hotter than pages in node 0) while the memory utilization is unchanged. Without the overlap, neither promotion of hotter pages in node 1, nor demotion of colder pages in node 0 will happen since both goals are met. As a result, the faster and slower node will unexpectedly serve cold and hot data. Test: Per-cgroup Memory Tiering =============================== I ran a simplified cgroup level memory tiering using the feature, and confirmed it works as intended. Setup ----- I configured a QEMU virtual machine representing a simplified version of the system that described on the above cgroup level memory tiering example use case. The system equips 40 CPU cores and two NUMA nodes each having 30 GiB physical memory. The first node (node 0) represents the faster NUMA node, and the second node (node 1) represents the slower NUMA node. In specific, below qemu command line options are used. [...] -object memory-backend-ram,size=30G,id=m0 \ -object memory-backend-ram,size=30G,id=m1 \ -numa node,cpus=0-39,memdev=m0 \ -numa node,memdev=m1 \ [...] I booted the virtual machine with a kernel that this patch series is applied. On the virtual machine, I created two cgroups, namely workload_a and workload_b. And ran a test program in each cgroup, resulting in one process per cgroup. The test program allocates 10 GiB memory and evenly split it into 10 regions. After the allocation, it repeatedly access the first region for one minute, than the second one for one minute, and so on. After the one minute repeated access for the 10-th region is done, it repeats the access from the first region. So the process has 10 GiB of data in total, but only 1 GiB of it is hot at a given moment, and the hot data is gradually changed. While the processes are running, run DAMON for a simple access-aware memory tiering using below script. It migrates hot and cold data of the cgroups into node 0 and node 1, aiming the first and the second cgroups (workload_a and workload_b, respectively) utilizing about 9.7 percent and 19.7 percent of node 0, respectively. Note that this setup is a simplified version of the above example use case, for ease of test. Also note that we assigned 30 GiB physical memory to node 0, but DAMON in this setup works for only 27 GiB of the memory. It is due to an internal implementation detail of DAMON user-space tool that not really important for this test. #!/bin/bash damo start \ --numa_node 1 \ --damos_action migrate_hot 0 --damos_access_rate 5% max \ --damos_apply_interval 1s \ --damos_filter allow memcg /workload_a \ --damos_filter allow young \ --damos_quota_interval 1s \ --damos_quota_goal node_memcg_used_bp 9.7% 0 /workload_a \ --damos_action migrate_hot 0 --damos_access_rate 5% max \ --damos_apply_interval 1s \ --damos_filter allow memcg /workload_b \ --damos_filter allow young \ --damos_quota_interval 1s \ --damos_quota_goal node_memcg_used_bp 19.7% 0 /workload_b \ --numa_node 0 \ --damos_action migrate_cold 1 --damos_access_rate 0% 0% \ --damos_apply_interval 1s \ --damos_filter allow memcg /workload_a \ --damos_filter reject young \ --damos_quota_interval 1s \ --damos_quota_goal node_memcg_free_bp 90.5% 0 /workload_a \ --damos_action migrate_cold 1 --damos_access_rate 0% 0% \ --damos_apply_interval 1s \ --damos_filter allow memcg /workload_b \ --damos_filter reject young \ --damos_quota_interval 1s \ --damos_quota_goal node_memcg_free_bp 80.5% 0 /workload_b \ --damos_nr_quota_goals 1 1 1 1 --damos_nr_filters 2 2 2 2 \ --nr_targets 1 1 --nr_schemes 2 2 --nr_ctxs 1 1 After starting DAMON, the pages continuously be migrated across nodes. A few minutes later, the memory usage of the cgroups converges into the aimed amounts, and keeps the level, as expected. To confirm the status is kept in the target level as expected, I collected the memory usage stat of the cgroups using memory.numa_stat file, after the stats are converged. I repeat the stat collection 42 times with 5 seconds delay between each of the collections. The results are as below: node0_memory_usage average stdev workload_a 2.79GiB 522.06MiB workload_b 5.15GiB 739.10MiB The average values are quite close to the targeted values: 27 GiB * 9.7% = 2.619 GiB for workload_a, and 27 GiB * 19.7% = 5.319 GiB. A level of variances are expected, given the overlap of the promotion/demotion targets, and dynamic data access pattern of the workloads. Give that, the measured variances are at a reasonable level. Patches Sequence ================ The first patch (patch 1) updates the kernel-doc comment of damos_quota_goal struct to clarify usage of optional fields of the struct, since later patches will add such optional fields. Following four patches (patches 2-5) implement a new DAMOS quota goal metric for per-cgroup per-node memory usage. Those extends the core layer interface for the new metric (patch 2), implement the metric value calculation on the core layer (patch 3), add DAMON sysfs interface file for the target cgroup specification (patch 4), and implement support of the new metric on DAMON sysfs interface (patch 5). Next two patches implment the second new DAMOS quota goal metric for per-cgroup per-node free (or, unused) memory. Those implement it in the core layer (patch 6) and DAMON sysfs interface (patch 7), extending the existing implementation for memory usage metric. Final three patches update the design (patch 8), the usage (patch 9), and the ABI (patch 10) documents for the changes that are introduced by this patch series. This patch (of 10): damos_quota_goal kerneldoc comment is not explaining when @metric is used. Update the comment for that. Link: https://lkml.kernel.org/r/20251017212706.183502-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251017212706.183502-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 2f05435df9320e70f7a98149eb4b043ff361a120 Author: Baolin Wang Date: Fri Oct 17 15:53:07 2025 +0800 mm: vmscan: simplify the logic for activating dirty file folios After commit 6b0dfabb3555 ("fs: Remove aops->writepage"), we no longer attempt to write back filesystem folios through reclaim. However, in the shrink_folio_list() function, there still remains some logic related to writeback control of dirty file folios. The original logic was that, for direct reclaim, or when folio_test_reclaim() is false, or the PGDAT_DIRTY flag is not set, the dirty file folios would be directly activated to avoid being scanned again; otherwise, it will try to writeback the dirty file folios. However, since we can no longer perform writeback on dirty folios, the dirty file folios will still be activated. Additionally, under the original logic, if we continue to try writeback dirty file folios, we will also check the references flag, sc->may_writepage, and may_enter_fs(), which may result in dirty file folios being left in the inactive list. This is unreasonable. Even if these dirty folios are scanned again, we still cannot clean them. Therefore, the checks on these dirty file folios appear to be redundant and can be removed. Dirty file folios should be directly moved to the active list to avoid being scanned again. Since we set the PG_reclaim flag for the dirty folios, once the writeback is completed, they will be moved back to the tail of the inactive list to be retried for quick reclaim. Link: https://lkml.kernel.org/r/ba5c49955fd93c6850bcc19abf0e02e1573768aa.1760687075.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Signed-off-by: Andrew Morton commit b34619af9c3fa181624babcdd319d63f5f4d92e7 Author: Baolin Wang Date: Fri Oct 17 15:53:06 2025 +0800 mm: vmscan: filter out the dirty file folios for node_reclaim() Patch series "optimize the logic for handling dirty file folios during reclaim", v2. Since we no longer attempt to write back filesystem folios during reclaim, some logic for handling dirty file folios in the reclaim process also needs to be updated. Please check the details in each patch. This patch (of 2): After commit 6b0dfabb3555 ("fs: Remove aops->writepage"), we no longer attempt to write back filesystem folios in pageout(), and only tmpfs/shmem folios and anonymous swapcache folios can be written back. Therefore, we should also filter out the dirty filesystem folios for node_reclaim() to avoid unnecessary LRU scans. Link: https://lkml.kernel.org/r/cover.1760687075.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/c91f5ecc5152b647904c7503618a01885d913928.1760687075.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 5bf65d4a8dbe354999596ef6d14bd70839573b16 Author: Ye Liu Date: Thu Oct 16 13:49:25 2025 +0800 tools/mm/page_owner_sort: add help option support Add -h/--help option to display usage information and improve code style. Link: https://lkml.kernel.org/r/20251016054927.138510-1-ye.liu@linux.dev Signed-off-by: Ye Liu Cc: SeongJae Park Signed-off-by: Andrew Morton commit d929525c2e30abee621bf71f143ba6104c81ff2b Author: Shakeel Butt Date: Thu Oct 16 09:10:35 2025 -0700 memcg: net: track network throttling due to memcg memory pressure The kernel can throttle network sockets if the memory cgroup associated with the corresponding socket is under memory pressure. The throttling actions include clamping the transmit window, failing to expand receive or send buffers, aggressively prune out-of-order receive queue, FIN deferred to a retransmitted packet and more. Let's add memcg metric to track such throttling actions. At the moment memcg memory pressure is defined through vmpressure and in future it may be defined using PSI or we may add more flexible way for the users to define memory pressure, maybe through ebpf. However the potential throttling actions will remain the same, so this newly introduced metric will continue to track throttling actions irrespective of how memcg memory pressure is defined. Link: https://lkml.kernel.org/r/20251016161035.86161-1-shakeel.butt@linux.dev Signed-off-by: Shakeel Butt Acked-by: Roman Gushchin Reviewed-by: Kuniyuki Iwashima Reviewed-by: Daniel Sedlak Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kacinski Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Neal Cardwell Cc: Paolo Abeni Cc: Simon Horman Cc: Tejun Heo Cc: Willem de Bruijn Signed-off-by: Andrew Morton commit a059ad48b453ad9ebdefaba6248229e83e5ad4d9 Author: wang lian Date: Wed Oct 15 17:29:57 2025 +0800 mm/khugepaged: fix comment for default scan sleep duration The comment for khugepaged_scan_sleep_millisecs incorrectly states the default scan period is 30 seconds. The actual default value in the code is 10000ms (10 seconds). This patch corrects the comment to match the code, preventing potential confusion. The incorrect comment has existed since the feature was first introduced. While at it, replace the magic value 512 by HPAGE_PMD_NR and use 'ptes'. Link: https://lkml.kernel.org/r/20251015092957.37432-1-lianux.mm@gmail.com Signed-off-by: wang lian Suggested-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Wei Yang Reviewed-by: Lance Yang Acked-by: David Hildenbrand Reviewed-by: SeongJae Park Reviewed-by: Vishal Moola (Oracle) Acked-by: Nico Pache Cc: Andrea Arcangeli Cc: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Rik van Riel Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 2f79ddb64b472e50482f6728fec3b44156e5d844 Author: Ye Liu Date: Wed Oct 15 17:38:50 2025 +0800 tools/mm: use in page_owner_sort.c Use standard instead of manually defining bool, true and false. Link: https://lkml.kernel.org/r/20251015093851.109663-1-ye.liu@linux.dev Signed-off-by: Ye Liu Reviewed-by: Dev Jain Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 0f21b911011f9fcdc8fab584d6bd5a284e2119eb Author: Vlastimil Babka Date: Wed Oct 15 19:50:38 2025 +0200 mm/page_alloc: simplify and cleanup pcp locking The pcp locking relies on pcp_spin_trylock() which has to be used together with pcp_trylock_prepare()/pcp_trylock_finish() to work properly on !SMP !RT configs. This is tedious and error-prone. We can remove pcp_spin_lock() and underlying pcpu_spin_lock() because we don't use it. Afterwards pcp_spin_unlock() is only used together with pcp_spin_trylock(). Therefore we can add the UP_flags parameter to them both and handle pcp_trylock_prepare()/finish() within. Additionally for the configs where pcp_trylock_prepare()/finish() are no-op (SMP || RT) make them pass &UP_flags to a no-op inline function. This ensures typechecking and makes the local variable "used" so we can remove the __maybe_unused attributes. In my compile testing, bloat-o-meter reported no change on SMP config, so the compiler is capable of optimizing away the no-ops same as before, and we have simplified the code using pcp_spin_trylock(). Link: https://lkml.kernel.org/r/20251015-b4-pcp-lock-cleanup-v2-1-740d999595d5@suse.cz Signed-off-by: Vlastimil Babka Reviewed-by: Joshua Hahn Reviewed-by: Suren Baghdasaryan Cc: Brendan Jackman Cc: Johannes Weiner Cc: Mel Gorman Cc: Michal Hocko Cc: Zi Yan Signed-off-by: Andrew Morton commit 91e691296646e68d4116b8303aa11d6de0376aef Author: Joshua Hahn Date: Tue Oct 14 07:50:10 2025 -0700 mm/page_alloc: batch page freeing in free_frozen_page_commit Before returning, free_frozen_page_commit calls free_pcppages_bulk using nr_pcp_free to determine how many pages can appropritately be freed, based on the tunable parameters stored in pcp. While this number is an accurate representation of how many pages should be freed in total, it is not an appropriate number of pages to free at once using free_pcppages_bulk, since we have seen the value consistently go above 2000 in the Meta fleet on larger machines. As such, perform batched page freeing in free_pcppages_bulk by using pcp->batch. In order to ensure that other processes are not starved of the zone lock, free both the zone lock and pcp lock to yield to other threads. Note that because free_frozen_page_commit now performs a spinlock inside the function (and can fail), the function may now return with a freed pcp. To handle this, return true if the pcp is locked on exit and false otherwise. In addition, since free_frozen_page_commit must now be aware of what UP flags were stored at the time of the spin lock, and because we must be able to report new UP flags to the callers, add a new unsigned long* parameter UP_flags to keep track of this. The following are a few synthetic benchmarks, made on three machines. The first is a large machine with 754GiB memory and 316 processors. The second is a relatively smaller machine with 251GiB memory and 176 processors. The third and final is the smallest of the three, which has 62GiB memory and 36 processors. On all machines, I kick off a kernel build with -j$(nproc). Negative delta is better (faster compilation) Large machine (754GiB memory, 316 processors) make -j$(nproc) +------------+---------------+-----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+-----------+ | real | 0.8070 | - 1.4865 | | user | 0.2823 | + 0.4081 | | sys | 5.0267 | -11.8737 | +------------+---------------+-----------+ Medium machine (251GiB memory, 176 processors) make -j$(nproc) +------------+---------------+----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+----------+ | real | 0.2806 | +0.0351 | | user | 0.0994 | +0.3170 | | sys | 0.6229 | -0.6277 | +------------+---------------+----------+ Small machine (62GiB memory, 36 processors) make -j$(nproc) +------------+---------------+----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+----------+ | real | 0.1503 | -2.6585 | | user | 0.0431 | -2.2984 | | sys | 0.1870 | -3.2013 | +------------+---------------+----------+ Here, variation is the coefficient of variation, i.e. standard deviation / mean. [joshua.hahnjy@gmail.com: simplify checks] Link: https://lkml.kernel.org/r/20251014192827.851389-1-joshua.hahnjy@gmail.com Link: https://lkml.kernel.org/r/20251014145011.3427205-4-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Suggested-by: Chris Mason Co-developed-by: Johannes Weiner Reviewed-by: Vlastimil Babka Cc: Brendan Jackman Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit fc4b909c368f3a7b08c895dd5926476b58e85312 Author: Joshua Hahn Date: Tue Oct 14 07:50:09 2025 -0700 mm/page_alloc: batch page freeing in decay_pcp_high It is possible for pcp->count - pcp->high to exceed pcp->batch by a lot. When this happens, we should perform batching to ensure that free_pcppages_bulk isn't called with too many pages to free at once and starve out other threads that need the pcp or zone lock. Since we are still only freeing the difference between the initial pcp->count and pcp->high values, there should be no change to how many pages are freed. Link: https://lkml.kernel.org/r/20251014145011.3427205-3-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Suggested-by: Chris Mason Suggested-by: Andrew Morton Co-developed-by: Johannes Weiner Reviewed-by: Vlastimil Babka Cc: Brendan Jackman Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 0acc67c4030c39f39ac90413cc5d0abddd3a9527 Author: Joshua Hahn Date: Tue Oct 14 07:50:08 2025 -0700 mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection Patch series "mm/page_alloc: Batch callers of free_pcppages_bulk", v5. Motivation & Approach ===================== While testing workloads with high sustained memory pressure on large machines in the Meta fleet (1Tb memory, 316 CPUs), we saw an unexpectedly high number of softlockups. Further investigation showed that the zone lock in free_pcppages_bulk was being held for a long time, and was called to free 2k+ pages over 100 times just during boot. This causes starvation in other processes for the zone lock, which can lead to the system stalling as multiple threads cannot make progress without the locks. We can see these issues manifesting as warnings: [ 4512.591979] rcu: INFO: rcu_sched self-detected stall on CPU [ 4512.604370] rcu: 20-....: (9312 ticks this GP) idle=a654/1/0x4000000000000000 softirq=309340/309344 fqs=5426 [ 4512.626401] rcu: hardirqs softirqs csw/system [ 4512.638793] rcu: number: 0 145 0 [ 4512.651177] rcu: cputime: 30 10410 174 ==> 10558(ms) [ 4512.666657] rcu: (t=21077 jiffies g=783665 q=1242213 ncpus=316) While these warnings don't indicate a crash or a kernel panic, they do point to the underlying issue of lock contention. To prevent starvation in both locks, batch the freeing of pages using pcp->batch. Because free_pcppages_bulk is called with the pcp lock and acquires the zone lock, relinquishing and reacquiring the locks are only effective when both of them are broken together (unless the system was built with queued spinlocks). Thus, instead of modifying free_pcppages_bulk to break both locks, batch the freeing from its callers instead. A similar fix has been implemented in the Meta fleet, and we have seen significantly less softlockups. Testing ======= The following are a few synthetic benchmarks, made on three machines. The first is a large machine with 754GiB memory and 316 processors. The second is a relatively smaller machine with 251GiB memory and 176 processors. The third and final is the smallest of the three, which has 62GiB memory and 36 processors. On all machines, I kick off a kernel build with -j$(nproc). Negative delta is better (faster compilation). Large machine (754GiB memory, 316 processors) make -j$(nproc) +------------+---------------+-----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+-----------+ | real | 0.8070 | - 1.4865 | | user | 0.2823 | + 0.4081 | | sys | 5.0267 | -11.8737 | +------------+---------------+-----------+ Medium machine (251GiB memory, 176 processors) make -j$(nproc) +------------+---------------+----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+----------+ | real | 0.2806 | +0.0351 | | user | 0.0994 | +0.3170 | | sys | 0.6229 | -0.6277 | +------------+---------------+----------+ Small machine (62GiB memory, 36 processors) make -j$(nproc) +------------+---------------+----------+ | Metric (s) | Variation (%) | Delta(%) | +------------+---------------+----------+ | real | 0.1503 | -2.6585 | | user | 0.0431 | -2.2984 | | sys | 0.1870 | -3.2013 | +------------+---------------+----------+ Here, variation is the coefficient of variation, i.e. standard deviation / mean. Based on these results, it seems like there are varying degrees to how much lock contention this reduces. For the largest and smallest machines that I ran the tests on, it seems like there is quite some significant reduction. There is also some performance increases visible from userspace. Interestingly, the performance gains don't scale with the size of the machine, but rather there seems to be a dip in the gain there is for the medium-sized machine. One possible theory is that because the high watermark depends on both memory and the number of local CPUs, what impacts zone contention the most is not these individual values, but rather the ratio of mem:processors. This patch (of 5): Currently, refresh_cpu_vm_stats returns an int, indicating how many changes were made during its updates. Using this information, callers like vmstat_update can heuristically determine if more work will be done in the future. However, all of refresh_cpu_vm_stats's callers either (a) ignore the result, only caring about performing the updates, or (b) only care about whether changes were made, but not *how many* changes were made. Simplify the code by returning a bool instead to indicate if updates were made. In addition, simplify fold_diff and decay_pcp_high to return a bool for the same reason. Link: https://lkml.kernel.org/r/20251014145011.3427205-1-joshua.hahnjy@gmail.com Link: https://lkml.kernel.org/r/20251014145011.3427205-2-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Reviewed-by: Vlastimil Babka Reviewed-by: SeongJae Park Cc: Brendan Jackman Cc: Chris Mason Cc: Johannes Weiner Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit f66e2727ddfcbbe3dbb459e809824f721a914464 Author: Kefeng Wang Date: Thu Oct 23 19:37:37 2025 +0800 mm: huge_memory: use folio_can_map_prot_numa() for pmd folio The folio_can_map_prot_numa() checks whether the folio can map prot numa, which skips unsuitable folio, i.e. zone device, shared folios (KSM, CoW), non-movable dma pinned, dirty file folio and folios that already have the expected node affinity. Although the ksm only applies to small folios, an extra test was added for large folios, but the other policies should be applied to pmd folio, which helps to avoid unnecessary pmd change and folio migration attempts. Link: https://lkml.kernel.org/r/20251023113737.3572790-5-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: David Hildenbrand Reviewed-by: Sidhartha Kumar Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit ca43034cdb224131f2ff70a914f3dc43eaa2f516 Author: Kefeng Wang Date: Thu Oct 23 19:37:36 2025 +0800 mm: mprotect: convert to folio_can_map_prot_numa() The prot_numa_skip() naming is not good since it updates the folio access time except checking whether to skip prot NUMA, so rename it to folio_can_map_prot_numa(), and cleanup it a bit, remove ret by directly return value instead of goto style. Adding a new helper vma_is_single_threaded_private() to check whether it's a single threaded private VMA, and make folio_can_map_prot_numa() a non-static function so that they could be reused in change_huge_pmd(), since folio_can_map_prot_numa() will be shared in different paths, let's move it near change_prot_numa() in mempolicy.c. Link: https://lkml.kernel.org/r/20251023113737.3572790-4-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Barry Song Cc: Dev Jain Cc: Lance Yang Cc: Liam Howlett Cc: Ryan Roberts Cc: Sidhartha Kumar Cc: Zi Yan Signed-off-by: Andrew Morton commit 6e97624dacc1a3599bae3724c79f1942e11c2912 Author: Kefeng Wang Date: Thu Oct 23 19:37:35 2025 +0800 mm: mprotect: avoid unnecessary struct page accessing if pte_protnone() If the pte_protnone() is true, we could avoid unnecessary struct page accessing and reduce cache footprint when scanning page tables for prot numa, there was a similar change before, see more commit a818f5363a0e ("autonuma: reduce cache footprint when scanning page tables"). Link: https://lkml.kernel.org/r/20251023113737.3572790-3-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Sidhartha Kumar Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Barry Song Cc: Lance Yang Cc: Liam Howlett Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 03aa8e4f273284a6abf28c0d86529cf3947328b2 Author: Kefeng Wang Date: Thu Oct 23 19:37:34 2025 +0800 mm: mprotect: always skip dma pinned folio in prot_numa_skip() Patch series "mm: some optimizations for prot numa", v5. This patch (of 4): If the folio (even not CoW folio) is dma pinned, it can't be migrated due to the elevated reference count. So always skip a pinned folio to avoid wasting cycles when folios are migrated. Link: https://lkml.kernel.org/r/20251023113737.3572790-1-wangkefeng.wang@huawei.com Link: https://lkml.kernel.org/r/20251023113737.3572790-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Barry Song Reviewed-by: Dev Jain Reviewed-by: Lance Yang Reviewed-by: Sidhartha Kumar Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Liam Howlett Cc: Ryan Roberts Signed-off-by: Andrew Morton commit d945667dcb1996ddf00ffa8408b579e4ce573652 Author: Donet Tom Date: Tue Oct 14 21:09:17 2025 +0530 drivers/base/node: fold unregister_node() into unregister_one_node() unregister_node() is only called from unregister_one_node(). This patch folds unregister_node() into its only caller and renames unregister_one_node() to unregister_node(). This reduces unnecessary indirection and simplifies the code structure. No functional changes are introduced. [donettom@linux.ibm.com: remove extra spaces before @nid and "All"] Link: https://lkml.kernel.org/r/cff01514-9074-4c97-bcf1-d4e3594e48b0@linux.ibm.com Link: https://lkml.kernel.org/r/32b7d5d8f0f30d313c3e1d8798f591459c8746f9.1760097208.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Acked-by: SeongJae Park Cc: Aboorva Devarajan Cc: Christophe Leroy Cc: Danilo Krummrich Cc: Dave Jiang Cc: Greg Kroah-Hartman Cc: Ingo Molnar Cc: Madhavan Srinivasan Cc: Oscar Salvador Cc: Peter Zijlstra Cc: "Ritesh Harjani (IBM)" Signed-off-by: Andrew Morton commit eb8762dc220c0b0573100a941bfc68df34ece74f Author: Donet Tom Date: Tue Oct 14 21:09:16 2025 +0530 drivers/base/node: fold register_node() into register_one_node() Patch series "drivers/base/node: fold node register and unregister functions", v2. The first patch merges register_one_node() and register_node(), leaving a single register_node() function. The second patch merges unregister_one_node() and unregister_node(), leaving a single unregister_node() function. There are no functional changes in these patches. This patch (of 2): register_node() is only called from register_one_node(). This patch folds register_node() into its only caller and renames register_one_node() to register_node(). This reduces unnecessary indirection and simplifies the code structure. No functional changes are introduced. [akpm@linux-foundation.org: fix kerneldoc, per David] Link: https://lkml.kernel.org/r/cover.1760097207.git.donettom@linux.ibm.com Link: https://lkml.kernel.org/r/910853c9dd61f7a2190a56cba101e73e9c6859be.1760097207.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: Mike Rapoport (Microsoft) Acked-by: SeongJae Park Acked-by: David Hildenbrand Cc: Aboorva Devarajan Cc: Christophe Leroy Cc: Danilo Krummrich Cc: Dave Jiang Cc: David Hildenbrand Cc: Greg Kroah-Hartman Cc: Ingo Molnar Cc: Madhavan Srinivasan Cc: Oscar Salvador Cc: Peter Zijlstra Cc: "Ritesh Harjani (IBM)" Signed-off-by: Andrew Morton commit 900fcf00e16844423aa2b08c4999c5773a7a29ec Author: Huacai Chen Date: Mon Oct 13 17:56:20 2025 +0800 mm: remove the BOUNCE config option Commit eeadd68e2a5f ("block: remove bounce buffering support") remove block/bounce.c but left the BOUNCE config option. Now this option has no users, so remove it. Link: https://lkml.kernel.org/r/20251013095620.1111061-1-chenhuacai@loongson.cn Signed-off-by: Huacai Chen Acked-by: David Hildenbrand Acked-by: Jens Axboe Reviewed-by: Christoph Hellwig Reviewed-by: Anshuman Khandual Cc: Hannes Reinecke Cc: Johannes Thumshirn Cc: John Garry Signed-off-by: Andrew Morton commit 8cb290dd4b82ab8dd773a36b918fcad2439d2147 Author: Uladzislau Rezki (Sony) Date: Mon Oct 13 19:42:22 2025 +0200 vmalloc: update __vmalloc_node_noprof() documentation The kernel-doc for __vmalloc_node_noprof() incorrectly states that __GFP_NOFAIL reclaim modifier is not supported. In fact it has been supported since commit 9376130c390a ("mm/vmalloc: add support for __GFP_NOFAIL"). To avoid duplication and future drift, point this helper's doc to __vmalloc_node_range_noprof() for details and the full description. Link: https://lkml.kernel.org/r/20251013174222.90123-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Cc: Michal Hocko Signed-off-by: Andrew Morton commit a739e6b557af0939ed4031419374f2c563e95b68 Author: Yadong Qi Date: Fri Oct 10 09:43:11 2025 +0800 mm: vmalloc: WARN_ON if mapping size is not PAGE_SIZE aligned In mm/vmalloc.c, the function vmap_pte_range() assumes that the mapping size is aligned to PAGE_SIZE. If this assumption is violated, the loop will become infinite because the termination condition (`addr != end`) will never be met. This can lead to overwriting other VA ranges and/or random pages physically follow the page table. It's the caller's responsibility to ensure that the mapping size is aligned to PAGE_SIZE. However, the memory corruption is hard to root cause. To identify the programming error in the caller easier, check whether the mapping size is PAGE_SIZE aligned with WARN_ON_ONCE(). [yadong.qi@linux.alibaba.com: fix uninitialized value issue] Closes: https://lore.kernel.org/r/202510110050.VG9YKMRK-lkp@intel.com/ Link: https://lkml.kernel.org/r/20251010014311.1689-1-yadong.qi@linux.alibaba.com Signed-off-by: Yadong Qi Reviewed-by: Huang Ying Reviewed-by: Dev Jain Reviewed-by: Uladzislau Rezki (Sony) Signed-off-by: Andrew Morton commit ca30ac479e6cf7a210dcad32fa2ee99ca0357e91 Author: Song Hu Date: Tue Sep 30 17:21:52 2025 +0800 mm/page_owner: simplify zone iteration logic in init_early_allocated_pages() The current implementation uses nested loops: first iterating over all online nodes, then over zones within each node. This can be simplified by using the for_each_populated_zone() macro which directly iterates through all populated zones. This change: 1. Removes the intermediate init_zones_in_node() function 2. Simplifies init_early_allocated_pages() to use direct zone iteration 3. Updates init_pages_in_zone() to take only zone parameter and access node_id via zone->zone_pgdat The functionality remains identical, but the code is cleaner and more maintainable. Link: https://lkml.kernel.org/r/20250930092153.843109-2-husong@kylinos.cn Signed-off-by: Song Hu Reviewed-by: Vlastimil Babka Reviewed-by: Ye Liu Acked-by: Vlastimil Babka Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 9686080d627ae95e9a60de29518c07843aad3f77 Author: Song Hu Date: Tue Sep 30 17:21:51 2025 +0800 mm/page_owner: rename proc-prefixed variables for clarity `proc_page_owner_operations` and related variables were renamed to `page_owner_fops` to better reflect their association with `debugfs` rather than `/proc`. This improves code clarity and aligns with kernel naming conventions. Link: https://lkml.kernel.org/r/20250930092153.843109-1-husong@kylinos.cn Signed-off-by: Song Hu Acked-by: Vlastimil Babka Reviewed-by: Ye Liu Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit ada5cbe33a5321f8c896a3362c3aafa0bf262110 Author: Sabyrzhan Tasbolatov Date: Thu Oct 9 20:54:03 2025 +0500 kasan: cleanup of kasan_enabled() checks Deduplication of kasan_enabled() checks which are already used by callers. * Altered functions: check_page_allocation Delete the check because callers have it already in __wrappers in include/linux/kasan.h: __kasan_kfree_large __kasan_mempool_poison_pages __kasan_mempool_poison_object kasan_populate_vmalloc, kasan_release_vmalloc Add __wrappers in include/linux/kasan.h. They are called externally in mm/vmalloc.c. __kasan_unpoison_vmalloc, __kasan_poison_vmalloc Delete checks because there're already kasan_enabled() checks in respective __wrappers in include/linux/kasan.h. release_free_meta -- Delete the check because the higher caller path has it already. See the stack trace: __kasan_slab_free -- has the check already __kasan_mempool_poison_object -- has the check already poison_slab_object kasan_save_free_info release_free_meta kasan_enabled() -- Delete here Link: https://lkml.kernel.org/r/20251009155403.1379150-3-snovitoll@gmail.com Signed-off-by: Sabyrzhan Tasbolatov Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Baoquan He Cc: Christophe Leroy Cc: Dmitriy Vyukov Cc: "Ritesh Harjani (IBM)" Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 27109f5703398d87727affdabd408f7802925e67 Author: Sabyrzhan Tasbolatov Date: Thu Oct 9 20:54:02 2025 +0500 kasan: remove __kasan_save_free_info wrapper Patch series "kasan: cleanups for kasan_enabled() checks". This patch series is the continuation of [1] the previous discussion related to the KASAN internal refactoring. Here we remove kasan_enabled() checks which are duplicated by higher callers. These checks deduplication are also related to the separate patch series [2]. This patch (of 2): We don't need a kasan_enabled() check in kasan_save_free_info() at all. Both the higher level paths (kasan_slab_free and kasan_mempool_poison_object) already contain this check. Therefore, remove the __wrapper. Link: https://lkml.kernel.org/r/20251009155403.1379150-1-snovitoll@gmail.com Link: https://lkml.kernel.org/r/20251009155403.1379150-2-snovitoll@gmail.com Link: https://lore.kernel.org/all/CA+fCnZce3AR+pUesbDkKMtMJ+iR8eDrcjFTbVpAcwjBoZ=gJnQ@mail.gmail.com/ [1] Link: https://lore.kernel.org/all/aNTfPjS2buXMI46D@MiWiFi-R3L-srv/ [2] Signed-off-by: Sabyrzhan Tasbolatov Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Baoquan He Cc: Christophe Leroy Cc: Dmitriy Vyukov Cc: "Ritesh Harjani (IBM)" Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit cc22b9978509ec973b08457e72d81fbfe4d91ef2 Author: Lokesh Gidra Date: Tue Sep 23 00:10:19 2025 -0700 mm/userfaultfd: don't lock anon_vma when performing UFFDIO_MOVE Now that rmap_walk() is guaranteed to be called with the folio lock held, we can stop serializing on the src VMA anon_vma lock when moving an exclusive folio from a src VMA to a dst VMA in UFFDIO_MOVE ioctl. When moving a folio, we modify folio->mapping through folio_move_anon_rmap() and adjust folio->index accordingly. Doing that while we could have concurrent RMAP walks would be dangerous. Therefore, to avoid that, we had to acquire anon_vma of src VMA in write-mode. That meant that when multiple threads called UFFDIO_MOVE concurrently on distinct pages of the same src VMA, they would serialize on it, hurting scalability. In addition to avoiding the scalability bottleneck, this patch also simplifies the complicated lock dance that UFFDIO_MOVE has to go through between RCU, folio-lock, ptl, and anon_vma. folio_move_anon_rmap() already enforces that the folio is locked. So when we have the folio locked we can no longer race with concurrent rmap_walk() as used by folio_referenced() and others who call it on unlocked non-KSM anon folios, and therefore the anon_vma lock is no longer required. Note that this handling is now the same as for other folio_move_anon_rmap() users that also do not hold the anon_vma lock -- namely COW reuse handling (do_wp_page()->wp_can_reuse_anon_folio(), do_huge_pmd_wp_page(), and hugetlb_wp()). These users never required the anon_vma lock as they are only moving the anon VMA closer to the anon_vma leaf of the VMA, for example, from an anon_vma root to a leaf of that root. rmap walks were always able to tolerate that scenario. Link: https://lkml.kernel.org/r/20250923071019.775806-3-lokeshgidra@google.com Signed-off-by: Lokesh Gidra Acked-by: David Hildenbrand Acked-by: Peter Xu Reviewed-by: Lorenzo Stoakes Cc: Suren Baghdasaryan Cc: Barry Song Cc: Jann Horn Cc: Kalesh Singh Cc: Lokesh Gidra Cc: Nicolas Geoffray Cc: Harry Yoo Cc: SeongJae Park Signed-off-by: Andrew Morton commit 95b34d66480bbc9bc31e78c26b1d5be47358ffc0 Author: Lokesh Gidra Date: Tue Sep 23 00:10:18 2025 -0700 mm: always call rmap_walk() on locked folios Patch series "Improve UFFDIO_MOVE scalability by removing anon_vma lock", v2. Userfaultfd has a scalability issue in its UFFDIO_MOVE ioctl, which is heavily used in Android as its java garbage collector uses it for concurrent heap compaction. The issue arises because UFFDIO_MOVE updates folio->mapping to an anon_vma with a different root, in order to move the folio from a src VMA to dst VMA. It performs the operation with the folio locked, but this is insufficient, because rmap_walk() can be performed on non-KSM anonymous folios without folio lock. This means that UFFDIO_MOVE has to acquire the anon_vma write lock of the root anon_vma belonging to the folio it wishes to move. This causes scalability bottleneck when multiple threads perform UFFDIO_MOVE simultanously on distinct pages of the same src VMA. In field traces of arm64 android devices, we have observed janky user interactions due to long (sometimes over ~50ms) uninterruptible sleeps on main UI thread caused by anon_vma lock contention in UFFDIO_MOVE. This is particularly severe during the beginning of GC's compaction phase when it is likely to have multiple threads involved. This patch resolves the issue by removing the exception in rmap_walk() for non-KSM anon folios by ensuring that all folios are locked during rmap walk. This is less problematic than it might seem, as the only major caller which utilises this mode is shrink_active_list(), which is covered in detail in the first patch of this series. As a result of changing our approach to locking, we can remove all the code that took steps to acquire an anon_vma write lock instead of a folio lock. This results in a significant simplification and scalability improvement of the code (currently only in UFFDIO_MOVE). Furthermore, as a side-effect, folio_lock_anon_vma_read() gets simpler as we don't need to worry that folio->mapping may have changed under us. This patch (of 2): Guarantee that rmap_walk() is called on locked folios so that threads changing folio->mapping and folio->index for non-KSM anon folios can serialize on fine-grained folio lock rather than anon_vma lock. Other folio types are already always locked before rmap_walk(). With this, we are going from 'not necessarily' locking the non-KSM anon folio to 'definitely' locking it during rmap walks. This patch is in preparation for removing anon_vma write-lock from UFFDIO_MOVE. With this patch, three functions are now expected to be called with a locked folio. To be careful of not missing any case, here is the exhaustive list of all their callers. 1) rmap_walk() is called from: a) folio_referenced() b) damon_folio_mkold() c) damon_folio_young() d) page_idle_clear_pte_refs() e) try_to_unmap() f) try_to_migrate() g) folio_mkclean() h) remove_migration_ptes() In the above list, first 4 are changed in this patch to try-lock non-KSM anon folios, similar to other types of folios. The remaining functions in the list already hold folio lock when calling rmap_walk(). 2) folio_lock_anon_vma_read() is called from following functions: a) collect_procs_anon() b) page_idle_clear_pte_refs() c) damon_folio_mkold() d) damon_folio_young() e) folio_referenced() f) try_to_unmap() g) try_to_migrate() All the functions in above list, except collect_procs_anon(), are covered by the rmap_walk() list above. For collect_procs_anon(), with kill_procs_now() changed to take folio lock in this patch ensures that all callers of folio_lock_anon_vma_read() now hold the lock. 3) folio_get_anon_vma() is called from following functions, all of which already hold the folio lock: a) move_pages_huge_pmd() b) __folio_split() c) move_pages_ptes() d) migrate_folio_unmap() e) unmap_and_move_huge_page() Functionally, this patch doesn't break the logic because rmap walkers generally do some other check to see if what is expected to mapped did happen so it's fine, or otherwise treat things as best-effort. Among the 4 functions changed in this patch, folio_referenced() is the only core-mm function, and is also frequently accessed. To assess the impact of locking non-KSM anon folios in shrink_active_list()->folio_referenced() path, we performed an app cycle test on an arm64 android device. During the whole duration of the test there were over 140k invocations of shrink_active_list(), out of which over 29k had at least one non-KSM anon folio on which folio_referenced() was called. In none of these invocations folio_trylock() failed. Of course, we now take a lock where we wouldn't previously have. In the past it would have had a major impact in causing a CoW write fault to copy a page in do_wp_page(), as commit 09854ba94c6a ("mm: do_wp_page() simplification") caused a failure to obtain folio lock to result in a page copy even if one wasn't necessary. However, since commit 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive"), and the introduction of the folio anon exclusive flag, this issue is significantly mitigated. The only case remaining that we might worry about from this perspective is that of read-only folios immediately after fork where the anon exclusive bit will not have been set yet. We note however in the case of read-only just-forked folios that wp_can_reuse_anon_folio() will notice the raised reference count established by shrink_active_list() via isolate_lru_folios() and refuse to reuse in any case, so this will in fact have no impact - the folio lock is ultimately immaterial here. All-in-all it appears that there is little opportunity for meaningful negative impact from this change. Link: https://lkml.kernel.org/r/20250923071019.775806-1-lokeshgidra@google.com Link: https://lkml.kernel.org/r/20250923071019.775806-2-lokeshgidra@google.com Signed-off-by: Lokesh Gidra Acked-by: David Hildenbrand Acked-by: Peter Xu Reviewed-by: Lorenzo Stoakes Cc: Harry Yoo Cc: Suren Baghdasaryan Cc: Barry Song Cc: SeongJae Park Cc: Jann Horn Cc: Kalesh Singh Cc: Nicolas Geoffray Signed-off-by: Andrew Morton commit eb02f14c4a2bf4c242d91c4a5d7fb57c3c0ad1b1 Author: Usama Arif Date: Thu Oct 9 18:24:31 2025 +0100 mm/hugetlb: allow overcommitting gigantic hugepages Currently, gigantic hugepages cannot use the overcommit mechanism (nr_overcommit_hugepages), forcing users to permanently reserve memory via nr_hugepages even when pages might not be actively used. The restriction was added in 2011 [1], which was before there was support for reserving 1G hugepages at runtime. Remove this blanket restriction on gigantic hugepage overcommit. This will bring the same benefits to gigantic pages as hugepages: - Memory is only taken out of regular use when actually needed - Unused surplus pages can be returned to the system - Better memory utilization, especially with CMA backing which can significantly increase the changes of hugepage allocation Without this patch: echo 3 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_overcommit_hugepages bash: echo: write error: Invalid argument With this patch: echo 3 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_overcommit_hugepages ./mmap_hugetlb_test Successfully allocated huge pages at address: 0x7f9d40000000 cat mmap_hugetlb_test.c ... unsigned long ALLOC_SIZE = 3 * (unsigned long) HUGE_PAGE_SIZE; addr = mmap(NULL, ALLOC_SIZE, // 3GB PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB | MAP_HUGE_1GB, -1, 0); if (addr == MAP_FAILED) { fprintf(stderr, "mmap failed: %s\n", strerror(errno)); return 1; } printf("Successfully allocated huge pages at address: %p\n", addr); ... Link: https://lkml.kernel.org/r/20251009172433.4158118-2-usamaarif642@gmail.com Link: https://git.zx2c4.com/linux-rng/commit/mm/hugetlb.c?id=adbe8726dc2a3805630d517270db17e3af86e526 [1] Signed-off-by: Usama Arif Reviewed-by: Shakeel Butt Reviewed-by: Kefeng Wang Acked-by: Oscar Salvador Cc: David Hildenbrand Cc: Johannes Weiner Cc: Muchun Song Cc: Rik van Riel Cc: SeongJae Park Signed-off-by: Andrew Morton commit a743e0af503a633e4ca68a100d9b2a1a071fe8ae Author: Usama Arif Date: Thu Oct 9 18:24:30 2025 +0100 mm/hugetlb: create hstate_is_gigantic_no_runtime helper This is a common condition used to skip operations that cannot be performed on gigantic pages when runtime support is disabled. This helper is introduced as the condition will exist even more when allowing "overcommit" of gigantic hugepages. No functional change intended with this patch. Link: https://lkml.kernel.org/r/20251009172433.4158118-1-usamaarif642@gmail.com Signed-off-by: Usama Arif Suggested-by: Andrew Morton Reviewed-by: Shakeel Butt Reviewed-by: Kefeng Wang Acked-by: David Hildenbrand Acked-by: Oscar Salvador Cc: Johannes Weiner Cc: Muchun Song Cc: Rik van Riel Cc: SeongJae Park Signed-off-by: Andrew Morton commit 2783088ef24e32df9d70eb2a24f70de28b476a05 Author: Joshua Hahn Date: Thu Oct 9 12:29:31 2025 -0700 mm/page_alloc: prevent reporting pcp->batch = 0 zone_batchsize returns the appropriate value that should be used for pcp->batch. If it finds a zone with less than 4096 pages or PAGE_SIZE > 1M, however, it leads to some incorrect math. In the above case, we will get an intermediary value of 1, which is then rounded down to the nearest power of two, and 1 is subtracted from it. Since 1 is already a power of two, we will get batch = 1-1 = 0: batch = rounddown_pow_of_two(batch + batch/2) - 1; A pcp->batch value of 0 is nonsensical. If this were actually set, then functions like drain_zone_pages would become no-ops, since they could only free 0 pages at a time. Of the two callers of zone_batchsize, the one that is actually used to set pcp->batch works around this by setting pcp->batch to the maximum of 1 and zone_batchsize. However, the other caller, zone_pcp_init, incorrectly prints out the batch size of the zone to be 0. This is probably rare in a typical zone, but the DMA zone can often have less than 4096 pages, which means it will print out "LIFO batch:0". Before: [ 0.001216] DMA zone: 3998 pages, LIFO batch:0 After: [ 0.001210] DMA zone: 3998 pages, LIFO batch:1 Instead of dealing with the error handling and the mismatch between the reported and actual zone batchsize, just return 1 if the zone_batchsize is 1 page or less before the rounding. Link: https://lkml.kernel.org/r/20251009192933.3756712-3-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Acked-by: Vlastimil Babka Cc: Brendan Jackman Cc: Dave Hansen Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 4dcf65bf5be22e32d389628b0e655731f97f525e Author: Joshua Hahn Date: Thu Oct 9 12:29:30 2025 -0700 mm/page_alloc: clarify batch tuning in zone_batchsize Patch series "mm/page_alloc: pcp->batch cleanups", v2. Two small cleanups for mm/page_alloc. Patch 1 cleans up a misleading comment about how pcp->batch is calculated, and folds in the calculation to increase clarity. No functional change intended. Patch 2 corrects zones from reporting that their pcp->batch is 0 when it is actually 1. Namely, corrects ZONE_DMA from reporting that its batch size is 0. This patch (of 2): Recently while working on another patch about batching free_pcppages_bulk [1], I was curious why pcp->batch was always 63 on my machine. This led me to zone_batchsize(), where I found this set of lines to determine what the batch size should be for the host: batch = min(zone_managed_pages(zone) >> 10, SZ_1M / PAGE_SIZE); batch /= 4; /* We effectively *= 4 below */ if (batch < 1) batch = 1; All of this is good, except the comment above which says "We effectively *= 4 below". Nowhere else in the function zone_batchsize(), is there a corresponding multipliation by 4. Looking into the history of this, it seems like Dave Hansen had also noticed this back in 2013 [1]. Turns out there *used* to be a corresponding *= 4, which was turned into a *= 6 later on to be used in pageset_setup_from_batch_size(), which no longer exists. Despite this mismatch not being corrected in the comments, it seems that getting rid of the /= 4 leads to a performance regression on machines with less than 250G memory and 176 processors. As such, let us preserve the functionality but clean up the comments. Fold the /= 4 into the calculation above: bitshift by 10+2=12, and instead of dividing 1MB, divide 256KB and adjust the comments accordingly. No functional change intended. Link: https://lkml.kernel.org/r/20251009192933.3756712-1-joshua.hahnjy@gmail.com Link: https://lkml.kernel.org/r/20251009192933.3756712-2-joshua.hahnjy@gmail.com Link: https://lore.kernel.org/all/20251002204636.4016712-1-joshua.hahnjy@gmail.com/ [1] Signed-off-by: Joshua Hahn Suggested-by: Dave Hansen Acked-by: Vlastimil Babka Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton commit 0de9a442eeba4a6435af74120822b10b12ab8449 Author: Mauricio Faria de Oliveira Date: Wed Oct 1 14:56:11 2025 -0300 mm/page_owner: update Documentation with 'show_handles' and 'show_stacks_handles' Describe and provide examples for 'show_handles' and 'show_stacks_handles'. Link: https://lkml.kernel.org/r/20251001175611.575861-6-mfo@igalia.com Signed-off-by: Mauricio Faria de Oliveira Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 5513cfbcf4da97ba0476d63e7670fdfcde59580f Author: Mauricio Faria de Oliveira Date: Wed Oct 1 14:56:10 2025 -0300 mm/page_owner: add debugfs file 'show_stacks_handles' Add the file 'show_stacks_handles' to show just stack traces and their handles, in order to resolve stack traces and handles (i.e., to identify the stack traces for handles in previous reads from 'show_handles'). All stacks/handles must show up, regardless of their number of pages, that might have become zero or no longer make 'count_threshold', but made it in previous reads from 'show_handles' -- and need to be resolved later. P.S.: now, print the extra newline independently of the number of pages. Link: https://lkml.kernel.org/r/20251001175611.575861-5-mfo@igalia.com Signed-off-by: Mauricio Faria de Oliveira Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 3b52b9e31a860df97bb46e9f3bfdab9f36d5d893 Author: Mauricio Faria de Oliveira Date: Wed Oct 1 14:56:09 2025 -0300 mm/page_owner: add debugfs file 'show_handles' Add the flag STACK_PRINT_FLAG_HANDLE to print a stack's handle number from stackdepot, and add the file 'show_handles' to show just handles and their number of pages. This is similar to 'show_stacks', with handles instead of stack traces. Link: https://lkml.kernel.org/r/20251001175611.575861-4-mfo@igalia.com Signed-off-by: Mauricio Faria de Oliveira Reviewed-by: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 5c8ca473d5cb600f906820933cb0a8df44105045 Author: Mauricio Faria de Oliveira Date: Wed Oct 1 14:56:08 2025 -0300 mm/page_owner: add struct stack_print_ctx.flags Add the flags field to stack_print_ctx, and define two flags for current behavior (printing stack traces and their number of base pages). The plumbing of flags is debugfs_create_file(data) -> inode.i_private -> page_owner_stack_open() -> stack_print_ctx.flags -> stack_print(). No behavior change intended. Link: https://lkml.kernel.org/r/20251001175611.575861-3-mfo@igalia.com Signed-off-by: Mauricio Faria de Oliveira Reviewed-by: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 156c0c5d1463c26348316864f7f0dc8bf809f454 Author: Mauricio Faria de Oliveira Date: Wed Oct 1 14:56:07 2025 -0300 mm/page_owner: introduce struct stack_print_ctx Patch series "mm/page_owner: add debugfs files 'show_handles' and 'show_stacks_handles'", v2. Context: The page_owner debug feature can help understand a particular situation in in a point in time (e.g., identify biggest memory consumers; verify memory counters that do not add up). Another useful usecase is to collect data repeatedly over time, and use it for profiling, monitoring, and even comparing different kernel versions, at the stack trace level (e.g., watch for trends, leaks, correlations, and regressions). For this usecase, userspace periorically collects the data from page_owner and organizes it in data structures appropriate for access per-stack trace. Problem: The usecase of tracking memory usage per stack trace (or tracking it for a particular stack trace) requires uniquely identifying each stack trace (i.e., keys to store their memory usage over periodic data collections). This has to be done for every stack trace in every sample/data collection, even if tracking only one stack trace (to identify it among all others). Therefore, an approach like hashing the stack traces in userspace to create unique keys/identifiers for them during post-processing can quickly become expensive, considering the repetition and a growing number of stack traces. Solution: Fortunately, the kernel can provide a unique identifier for stack traces in page_owner, which is the handle number in stackdepot. This eliminates the need for creating keys (hashing) in userspace during post-processing. Additionally, with that information, the stack traces themselves are not needed until the memory usage should be resolved from a handle to a stack trace (say, to look at the stack traces of a few top consumers). This can reduce the amount of text emitted/copied by the kernel to userspace, and save userspace from matching and discarding stack traces when not needed. Changes: This patchset adds 2 files to provide information, like 'show_stacks': - show_handles: print handle number and number of pages (no stack traces) - show_stacks_handles: print handle numbers and stack traces (no pages) Now, it's possible to periodically collect data with handle numbers (keys) and without stack traces (lower overhead) from 'show_handles', and later do a final collection with handles and stack traces from 'show_stacks_handles' to resolve the handles to their stack traces. The output format follows the existing 'show_stacks' file, for simplicity, but it can certainly be changed if a different format is more convenient. Example: The number of base pages collected can be stored per-handle number over the periodic data collections, and finally resolved to stack traces per-handle number as well with a final collection. Later, one can, for example, identify the biggest consumers and watch their trends or correlate increases/decreases with other events in the system, or watch a particular stack trace(s) of interest during development. Testing: Tested on next-20250929. - show_stacks: register_dummy_stack+0x32/0x70 init_page_owner+0x29/0x2f0 page_ext_init+0x27c/0x2b0 mm_core_init+0xdc/0x110 nr_base_pages: 47 - show_handles: handle: 1 nr_base_pages: 47 - show_stacks_handles: register_dummy_stack+0x32/0x70 init_page_owner+0x29/0x2f0 page_ext_init+0x27c/0x2b0 mm_core_init+0xdc/0x110 handle: 1 - count_threshold: # echo 100 >/sys/kernel/debug/page_owner_stacks/count_threshold # grep register_dummy_stack show_stacks # not present # grep -B4 '^handle: 1$' show_handles # not present # grep -B4 '^handle: 1$' show_stacks_handles # present register_dummy_stack+0x32/0x70 init_page_owner+0x29/0x2f0 page_ext_init+0x27c/0x2b0 mm_core_init+0xdc/0x110 handle: 1 This patch (of 5): Currently, struct seq_file.private is used as an iterator in stack_list by stack_start|next(), for stack_print(). Create a context struct for this, in order to add another field next. No behavior change intended. P.S.: page_owner_stack_open() is expanded with separate statements for variable definition and return just in preparation for the next patch. Link: https://lkml.kernel.org/r/20251001175611.575861-1-mfo@igalia.com Link: https://lkml.kernel.org/r/20251001175611.575861-2-mfo@igalia.com Signed-off-by: Mauricio Faria de Oliveira Reviewed-by: Oscar Salvador Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit b4e53984f24082005a92ec76f91348a73653dadb Author: Anshuman Khandual Date: Mon Oct 6 06:52:14 2025 +0100 mm/dirty: replace READ_ONCE() with pudp_get() Replace READ_ONCE() with a standard page table accessor i.e pudp_get() that anyways defaults into READ_ONCE() in cases where platform does not override Link: https://lkml.kernel.org/r/20251006055214.1845342-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Oscar Salvador Cc: Lance Yang Signed-off-by: Andrew Morton commit 9ac09bb9feaccc2f45e5606dc48a3f748d478dc4 Author: Ryan Roberts Date: Fri Oct 3 16:53:04 2025 +0100 mm: consistently use current->mm in mm_get_unmapped_area() mm_get_unmapped_area() is a wrapper around arch_get_unmapped_area() / arch_get_unmapped_area_topdown(), both of which search current->mm for some free space. Neither take an mm_struct - they implicitly operate on current->mm. But the wrapper takes an mm_struct and uses it to decide whether to search bottom up or top down. All callers pass in current->mm for this, so everything is working consistently. But it feels like an accident waiting to happen; eventually someone will call that function with a different mm, expecting to find free space in it, but what gets returned is free space in the current mm. So let's simplify by removing the parameter and have the wrapper use current->mm to decide which end to start at. Now everything is consistent and self-documenting. Link: https://lkml.kernel.org/r/20251003155306.2147572-1-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Dev Jain Reviewed-by: Anshuman Khandual Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 0fdaa13ee93a068251d32ea7f60fd439b445adbe Author: SeongJae Park Date: Fri Oct 3 13:38:51 2025 -0700 Docs/admin-guide/mm/zswap: s/red-black tree/xarray/ The change from commit 796c2c23e14e ("zswap: replace RB tree with xarray") is not reflected on the document. Update the document. Link: https://lkml.kernel.org/r/20251003203851.43128-5-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: Yosry Ahmed Acked-by: Nhat Pham Reviewed-by: Chengming Zhou Cc: Chris Li Cc: David Hildenbrand Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 1f52f3de4bf8adc15732d2eb7d4e2be222245d5e Author: SeongJae Park Date: Fri Oct 3 13:38:50 2025 -0700 mm/zswap: s/red-black tree/xarray/ Changes made by commit 796c2c23e14e ("zswap: replace RB tree with xarray") are not reflected on a comment. Update the comment. Link: https://lkml.kernel.org/r/20251003203851.43128-4-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: Yosry Ahmed Acked-by: Nhat Pham Reviewed-by: Chengming Zhou Cc: Chris Li Cc: David Hildenbrand Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f7ed6bf2372df0123a43cb680d5e63063a9f2d49 Author: SeongJae Park Date: Fri Oct 3 13:38:49 2025 -0700 mm/zswap: fix typos: s/zwap/zswap/ As the subject says. Link: https://lkml.kernel.org/r/20251003203851.43128-3-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: Yosry Ahmed Acked-by: Nhat Pham Reviewed-by: Chengming Zhou Cc: Chris Li Cc: David Hildenbrand Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 138336d674d2e51f1e5699d2a30af1e9aa1352b4 Author: SeongJae Park Date: Fri Oct 3 13:38:48 2025 -0700 mm/zswap: remove unnecessary dlen writes for incompressible pages Patch series "mm/zswap: misc cleanup of code and documentations". Clean up an unnecessary local variable write in incompressible pages handling, typos (s/zwap/zswap/) and outdated comments/documentations about the zswap's red-black tree, which is replaced by xarray. This patch (of 4): Incompressible pages handling logic in zswap_compress() is setting 'dlen' as PAGE_SIZE twice. Once before deciding whether to save the content as is, and once again after it is decided to save it as is. But the value of 'dlen' is used only if it is decided to save the content as is, so the first write is unnecessary. It is not causing real user issues, but making code confusing to read. Remove the unnecessary write operation. Link: https://lkml.kernel.org/r/20251003203851.43128-1-sj@kernel.org Link: https://lkml.kernel.org/r/20251003203851.43128-2-sj@kernel.org Signed-off-by: SeongJae Park Acked-by: Yosry Ahmed Acked-by: Nhat Pham Reviewed-by: Chengming Zhou Cc: David Hildenbrand Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Chris Li Signed-off-by: Andrew Morton commit bd63d0fde2a2c328fe30456b8aa2521222c6f3fe Author: Fushuai Wang Date: Mon Oct 6 09:49:48 2025 +0800 mm/vmscan: remove redundant __GFP_NOWARN The __GFP_NOWARN flag was included in GFP_NOWAIT since commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT"). So remove the redundant __GFP_NOWARN flag. Link: https://lkml.kernel.org/r/20251006014948.44695-1-wangfushuai@baidu.com Signed-off-by: Fushuai Wang Acked-by: David Hildenbrand Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Shakeel Butt Reviewed-by: Lorenzo Stoakes Cc: Axel Rasmussen Cc: Johannes Weiner Cc: Michal Hocko Cc: Qi Zheng Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton commit 9f1edf1aedac1b287355f63f768ba4275de72dca Author: Roman Gushchin Date: Mon Oct 6 10:51:06 2025 -0700 mm: readahead: make thp readahead conditional to mmap_miss logic Commit 4687fdbb805a ("mm/filemap: Support VM_HUGEPAGE for file mappings") introduced a special handling for VM_HUGEPAGE mappings: even if the readahead is disabled, 1 or 2 HPAGE_PMD_ORDER pages are allocated. This change causes a significant regression for containers with a tight memory.max limit, if VM_HUGEPAGE is widely used. Prior to this commit, mmap_miss logic would eventually lead to the readahead disablement, effectively reducing the memory pressure in the cgroup. With this change the kernel is trying to allocate 1-2 huge pages for each fault, no matter if these pages are used or not before being evicted, increasing the memory pressure multi-fold. To fix the regression, let's make the new VM_HUGEPAGE conditional to the mmap_miss check, but keep independent from the ra->ra_pages. This way the main intention of commit 4687fdbb805a ("mm/filemap: Support VM_HUGEPAGE for file mappings") stays intact, but the regression is resolved. The logic behind this changes is simple: even if a user explicitly requests using huge pages to back the file mapping (using VM_HUGEPAGE flag), under a very strong memory pressure it's better to fall back to ordinary pages. Link: https://lkml.kernel.org/r/20251006175106.377411-1-roman.gushchin@linux.dev Fixes: 4687fdbb805a ("mm/filemap: Support VM_HUGEPAGE for file mappings") Signed-off-by: Roman Gushchin Reviewed-by: Dev Jain Reviewed-by: Jan Kara Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit c0efdb373c3aaacb32db59cadb0710cac13e44ae Author: Anshuman Khandual Date: Tue Oct 7 07:31:00 2025 +0100 mm: replace READ_ONCE() with standard page table accessors Replace all READ_ONCE() with a standard page table accessors i.e pxdp_get() that defaults into READ_ONCE() in cases where platform does not override. Link: https://lkml.kernel.org/r/20251007063100.2396936-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Reviewed-by: Lance Yang Reviewed-by: Wei Yang Reviewed-by: Dev Jain Signed-off-by: Andrew Morton commit bda7bf06840d4eb133abefa5a2fd75544277bd86 Author: xu xin Date: Tue Oct 7 18:29:35 2025 +0800 selftests: update ksm inheritance tests for prctl fork/exec To reproduce the issue mentioned by [1], this add a setting of pages_to_scan and sleep_millisecs at the start of test_prctl_fork_exec(). The main change is just raise the scanning frequency of ksmd. [1] https://lore.kernel.org/all/202510012256278259zrhgATlLA2C510DMD3qI@zte.com.cn/ Link: https://lkml.kernel.org/r/20251007182935207jm31wCIgLpZg5XbXQY64S@zte.com.cn Signed-off-by: xu xin Cc: David Hildenbrand Cc: Jinjiang Tu Cc: Stefan Roesch Cc: Wang Yaxin Cc: Yang Yang Signed-off-by: Andrew Morton commit 590c03ca6a3fbb114396673314e2aa483839608b Author: xu xin Date: Tue Oct 7 18:28:21 2025 +0800 mm/ksm: fix exec/fork inheritance support for prctl Patch series "ksm: fix exec/fork inheritance", v2. This series fixes exec/fork inheritance. See the detailed description of the issue below. This patch (of 2): Background ========== commit d7597f59d1d33 ("mm: add new api to enable ksm per process") introduced MMF_VM_MERGE_ANY for mm->flags, and allowed user to set it by prctl() so that the process's VMAs are forcibly scanned by ksmd. Subsequently, the 3c6f33b7273a ("mm/ksm: support fork/exec for prctl") supported inheriting the MMF_VM_MERGE_ANY flag when a task calls execve(). Finally, commit 3a9e567ca45fb ("mm/ksm: fix ksm exec support for prctl") fixed the issue that ksmd doesn't scan the mm_struct with MMF_VM_MERGE_ANY by adding the mm_slot to ksm_mm_head in __bprm_mm_init(). Problem ======= In some extreme scenarios, however, this inheritance of MMF_VM_MERGE_ANY during exec/fork can fail. For example, when the scanning frequency of ksmd is tuned extremely high, a process carrying MMF_VM_MERGE_ANY may still fail to pass it to the newly exec'd process. This happens because ksm_execve() is executed too early in the do_execve flow (prematurely adding the new mm_struct to the ksm_mm_slot list). As a result, before do_execve completes, ksmd may have already performed a scan and found that this new mm_struct has no VM_MERGEABLE VMAs, thus clearing its MMF_VM_MERGE_ANY flag. Consequently, when the new program executes, the flag MMF_VM_MERGE_ANY inheritance missed. Root reason =========== commit d7597f59d1d33 ("mm: add new api to enable ksm per process") clear the flag MMF_VM_MERGE_ANY when ksmd found no VM_MERGEABLE VMAs. Solution ======== Firstly, Don't clear MMF_VM_MERGE_ANY when ksmd found no VM_MERGEABLE VMAs, because perhaps their mm_struct has just been added to ksm_mm_slot list, and its process has not yet officially started running or has not yet performed mmap/brk to allocate anonymous VMAS. Secondly, recheck MMF_VM_MERGEABLE again if a process takes MMF_VM_MERGE_ANY, and create a mm_slot and join it into ksm_scan_list again. Link: https://lkml.kernel.org/r/20251007182504440BJgK8VXRHh8TD7IGSUIY4@zte.com.cn Link: https://lkml.kernel.org/r/20251007182821572h_SoFqYZXEP1mvWI4n9VL@zte.com.cn Fixes: 3c6f33b7273a ("mm/ksm: support fork/exec for prctl") Fixes: d7597f59d1d3 ("mm: add new api to enable ksm per process") Signed-off-by: xu xin Cc: Stefan Roesch Cc: David Hildenbrand Cc: Jinjiang Tu Cc: Wang Yaxin Cc: Yang Yang Cc: Signed-off-by: Andrew Morton commit c6307674ed82c0c57d6e1e3408e84ac449ab8e94 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:35 2025 +0200 mm: kvmalloc: add non-blocking support for vmalloc Extend __kvmalloc_node_noprof() to handle non-blocking GFP flags (GFP_NOWAIT and GFP_ATOMIC). Previously such flags were rejected, returning NULL. With this change: - kvmalloc() can fall back to vmalloc() if non-blocking contexts; - for non-blocking allocations the VM_ALLOW_HUGE_VMAP option is disabled, since the huge mapping path still contains might_sleep(); - documentation update to reflect that GFP_NOWAIT and GFP_ATOMIC are now supported. Link: https://lkml.kernel.org/r/20251007122035.56347-11-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Reviewed-by: Baoquan He Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit 0667b209e92965da8c2006b673bea69050ede1a2 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:34 2025 +0200 mm/vmalloc: update __vmalloc_node_range() documentation __vmalloc() now supports non-blocking flags such as GFP_ATOMIC and GFP_NOWAIT. Update the documentation accordingly. Link: https://lkml.kernel.org/r/20251007122035.56347-10-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Baoquan He Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit 7241bb2ea33d5ff50b77a5981342bcc826bef52a Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:33 2025 +0200 mm: skip might_alloc() warnings when PF_MEMALLOC is set might_alloc() catches invalid blocking allocations in contexts where sleeping is not allowed. However when PF_MEMALLOC is set, the page allocator already skips reclaim and other blocking paths. In such cases, a blocking gfp_mask does not actually lead to blocking, so triggering might_alloc() splats is misleading. Adjust might_alloc() to skip warnings when the current task has PF_MEMALLOC set, matching the allocator's actual blocking behaviour. Link: https://lkml.kernel.org/r/20251007122035.56347-9-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Acked-by: Michal Hocko Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit b186a94227b753f2fdcab0df29dfc636c63ac329 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:32 2025 +0200 kmsan: remove hard-coded GFP_KERNEL flags kmsan_vmap_pages_range_noflush() allocates its temp s_pages/o_pages arrays with GFP_KERNEL, which may sleep. This is inconsistent with vmalloc() as it will support non-blocking requests later. Plumb gfp_mask through the kmsan_vmap_pages_range_noflush(), so it can use it internally for its demand. Please note, the subsequent __vmap_pages_range_noflush() still uses GFP_KERNEL and can sleep. If a caller runs under reclaim constraints, sleeping is forbidden, it must establish the appropriate memalloc scope API. Link: https://lkml.kernel.org/r/20251007122035.56347-8-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Alexander Potapenko Cc: Marco Elver Cc: Andrey Ryabinin Cc: Baoquan He Cc: Michal Hocko Cc: Michal Hocko Signed-off-by: Andrew Morton commit ad435e79f8f5d6a5dae8ec122b14802d810defbf Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:31 2025 +0200 mm/kasan: support non-blocking GFP in kasan_populate_vmalloc() A "gfp_mask" is already passed to kasan_populate_vmalloc() as an argument to respect GFPs from callers and KASAN uses it for its internal allocations. But apply_to_page_range() function ignores GFP flags due to a hard-coded mask. Wrap the call with memalloc_apply_gfp_scope()/memalloc_restore_scope() so that non-blocking GFP flags(GFP_ATOMIC, GFP_NOWAIT) are respected. Link: https://lkml.kernel.org/r/20251007122035.56347-7-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Reviewed-by: Andrey Ryabinin Cc: Alexander Potapenko Cc: Marco Elver Cc: Michal Hocko Cc: Michal Hocko Signed-off-by: Andrew Morton commit 8da89ba18ed4e9000d9b9b5b1f699e5004f4abf6 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:30 2025 +0200 mm/vmalloc: handle non-blocking GFP in __vmalloc_area_node() Make __vmalloc_area_node() respect non-blocking GFP masks such as GFP_ATOMIC and GFP_NOWAIT. - Add memalloc_apply_gfp_scope()/memalloc_restore_scope() helpers to apply a proper scope. - Apply memalloc_apply_gfp_scope()/memalloc_restore_scope() around vmap_pages_range() for page table setup. - Set "nofail" to false if a non-blocking mask is used, as they are mutually exclusive. This is particularly important for page table allocations that internally use GFP_PGTABLE_KERNEL, which may sleep unless such scope restrictions are applied. For example: __pte_alloc_kernel() pte_alloc_one_kernel(&init_mm); pagetable_alloc_noprof(GFP_PGTABLE_KERNEL & ~__GFP_HIGHMEM, 0); Note: in most cases, PTE entries are established only up to the level required by current vmap space usage, meaning the page tables are typically fully populated during the mapping process. Link: https://lkml.kernel.org/r/20251007122035.56347-6-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Reviewed-by: Baoquan He Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit 9c47753167a6a585d0305663c6912f042e131c2d Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:29 2025 +0200 mm/vmalloc: defer freeing partly initialized vm_struct __vmalloc_area_node() may call free_vmap_area() or vfree() on error paths, both of which can sleep. This becomes problematic if the function is invoked from an atomic context, such as when GFP_ATOMIC or GFP_NOWAIT is passed via gfp_mask. To fix this, unify error paths and defer the cleanup of partly initialized vm_struct objects to a workqueue. This ensures that freeing happens in a process context and avoids invalid sleeps in atomic regions. Link: https://lkml.kernel.org/r/20251007122035.56347-5-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Reviewed-by: Baoquan He Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit 86e968d8ca6dc823086b4436721a6e3a10241503 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:28 2025 +0200 mm/vmalloc: support non-blocking GFP flags in alloc_vmap_area() alloc_vmap_area() currently assumes that sleeping is allowed during allocation. This is not true for callers which pass non-blocking GFP flags, such as GFP_ATOMIC or GFP_NOWAIT. This patch adds logic to detect whether the given gfp_mask permits blocking. It avoids invoking might_sleep() or falling back to reclaim path if blocking is not allowed. This makes alloc_vmap_area() safer for use in non-sleeping contexts, where previously it could hit unexpected sleeps, trigger warnings. It is a preparation and adjustment step to later allow both GFP_ATOMIC and GFP_NOWAIT allocations in this series. Link: https://lkml.kernel.org/r/20251007122035.56347-4-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Acked-by: Michal Hocko Reviewed-by: Baoquan He Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit e781c1c0a9fcb462181ebe95b271221e96cf2aa1 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:27 2025 +0200 lib/test_vmalloc: remove xfail condition check A test marked with "xfail = true" is expected to fail but that does not mean it is predetermined to fail. Remove "xfail" condition check for tests which pass successfully. Link: https://lkml.kernel.org/r/20251007122035.56347-3-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Baoquan He Cc: Marco Elver Cc: Michal Hocko Cc: Michal Hocko Signed-off-by: Andrew Morton commit 9ff86ca1cccc071db5ede284852728027412fd88 Author: Uladzislau Rezki (Sony) Date: Tue Oct 7 14:20:26 2025 +0200 lib/test_vmalloc: add no_block_alloc_test case Patch series "__vmalloc()/kvmalloc() and no-block support", v4. This patch (of 10): Introduce a new test case "no_block_alloc_test" that verifies non-blocking allocations using __vmalloc() with GFP_ATOMIC and GFP_NOWAIT flags. It is recommended to build kernel with CONFIG_DEBUG_ATOMIC_SLEEP enabled to help catch "sleeping while atomic" issues. This test ensures that memory allocation logic under atomic constraints does not inadvertently sleep. Link: https://lkml.kernel.org/r/20251007122035.56347-2-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Cc: Baoquan He Cc: Michal Hocko Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Marco Elver Cc: Michal Hocko Signed-off-by: Andrew Morton commit 11119b19f62dc8f3aac6e458fb27a468ad5861ce Author: Anshuman Khandual Date: Wed Oct 1 05:25:02 2025 +0100 mm/ptdump: replace READ_ONCE() with standard page table accessors Replace READ_ONCE() with standard page table accessors i.e pxdp_get() which anyways default into READ_ONCE() in cases where platform does not override. Also convert ptep_get_lockless() into ptep_get() as well. Link: https://lkml.kernel.org/r/20251001042502.1400726-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Reviewed-by: Dev Jain Acked-by: Lance Yang Acked-by: SeongJae Park Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit b6c46600bfb28b4be4e9cff7bad4f2cf357e0fb7 Author: jianyun.gao Date: Mon Sep 29 08:26:08 2025 +0800 mm: fix some typos in mm module Below are some typos in the code comments: intevals ==> intervals addesses ==> addresses unavaliable ==> unavailable facor ==> factor droping ==> dropping exlusive ==> exclusive decription ==> description confict ==> conflict desriptions ==> descriptions otherwize ==> otherwise vlaue ==> value cheching ==> checking exisitng ==> existing modifed ==> modified differenciate ==> differentiate refernece ==> reference permissons ==> permissions indepdenent ==> independent spliting ==> splitting Just fix it. Link: https://lkml.kernel.org/r/20250929002608.1633825-1-jianyungao89@gmail.com Signed-off-by: jianyun.gao Reviewed-by: SeongJae Park Reviewed-by: Wei Yang Reviewed-by: Dev Jain Reviewed-by: Liam R. Howlett Acked-by: Chris Li Signed-off-by: Andrew Morton commit 37d17925480404f1293f24d027fbf3c9975603d7 Author: Anshuman Khandual Date: Mon Sep 29 11:46:43 2025 +0100 mm/thp: drop follow_devmap_pmd() default stub follow_devmap_pmd() has already been dropped by the commit fd2825b0760a ("mm/gup: remove pXX_devmap usage from get_user_pages()"). The fallback stub in the header which is now redundant, can be dropped off as well. Link: https://lkml.kernel.org/r/20250929104643.1100421-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Dev Jain Reviewed-by: Alistair Popple Reviewed-by: Wei Yang Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 3407caccb898a3c4b6bdca4754146b595c960c31 Merge: e9a6fb0bcdd760 1c2a936edd71e1 Author: Andrew Morton Date: Sun Nov 16 17:24:35 2025 -0800 Merge branch 'mm-hotfixes-stable' into mm-stable to be able to merge "mm: introduce deferred freeing for kernel page tables" into mm-stable. commit 691d5ccb42df69472cb2aa5d9bf72940739c9648 Author: Alexander Stein Date: Fri Nov 14 09:39:58 2025 +0100 arm64: dts: freescale: tqma9352: Add vcc-supply for spi-nor (Q)SPI NOR flash is supplied by 1.8V. Add the corresponding supply. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit e9c909657d1627568a6d5b6472c63f9183b9c0ec Author: Alexander Stein Date: Thu Nov 13 11:48:56 2025 +0100 arm64: dts: mb-smarc-2: Add MicIn routing MicIn is connected to IN3_L. Add routing including the Mic Bias. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit c3184d2ecf1d9c7cf6f2af6802b96115cbdfbc44 Author: Alexander Stein Date: Thu Nov 13 11:48:55 2025 +0100 arm64: dts: mba8xx: Add MicIn routing MicIn is connected to IN3_L. Add routing including the Mic Bias. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 9a9396de05b4432471c5842e965583d05c4a8203 Author: Alexander Stein Date: Thu Nov 13 11:48:54 2025 +0100 arm64: dts: mba8mx: Add MicIn routing MicIn is connected to IN3_L. Add routing including the Mic Bias. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 9ceb1cf5b200d215292ea92a3e176806c847dae1 Author: Laurentiu Mihalcea Date: Tue Nov 11 04:00:22 2025 -0800 arm64: dts: imx8mp: make 'dsp' node depend on 'aips5' The DSP needs to access peripherals on AIPSTZ5 (to communicate with the AP using AUDIOMIX MU, for instance). To do so, the security-related registers of the bridge have to be configured before the DSP is started. Enforce a dependency on AIPSTZ5 by adding the 'access-controllers' property to the 'dsp' node. Reviewed-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit 286e622bf4192b604b99a06ba1f37456a44862c2 Author: Laurentiu Mihalcea Date: Tue Nov 11 04:00:21 2025 -0800 arm64: dts: imx8mp: convert 'aips5' to 'aipstz5' Change the programming model of the "aips5" node to allow configuring the security-related registers exposed by the AIPSTZ5 bridge. Without this, masters such as the HIFI4 DSP will have their access to the peripherals connected to the bridge denied after power cycling the AUDIOMIX domain. Co-developed-by: Daniel Baluta Signed-off-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit 45011b7633d673bbf5cb026aa7396e09e5177b89 Author: Marco Felsch Date: Fri Nov 7 15:49:52 2025 +0100 arm64: dts: imx8mp-skov: add Rev.C HDMI support From software perspective, Rev.C HDMI and Rev.B HDMI don't differ since the panel is connected via HDMI and the touchscreen is connected via USB. However, the bootloader firmware expects to find a dts with the correct revc-hdmi compatible. Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo commit d1da1068bc31d211d158b413cd1897ea94692ade Author: Marek Vasut Date: Tue Nov 4 02:50:13 2025 +0100 arm64: dts: imx8mp: Add missing LED enumerators for DH electronics i.MX8M Plus DHCOM on PDK2 The LED enumerators are missing, which prevents the LEDs from being accurately told apart by label. Fill in the enumerators the same way they are already present on PDK3. Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 40c687a4f216c0aa10aa8d790e62057502f89d84 Author: Jan Petrous (OSS) Date: Mon Nov 3 10:24:01 2025 +0100 arm64: dts: freescale: Add GMAC Ethernet for S32G2 EVB and RDB2 and S32G3 RDB3 Add support for the Ethernet connection over GMAC controller connected to the Micrel KSZ9031 Ethernet RGMII PHY located on the boards. The mentioned GMAC controller is one of two network controllers embedded on the NXP Automotive SoCs S32G2 and S32G3. The supported boards: * EVB: S32G-VNP-EVB with S32G2 SoC * RDB2: S32G-VNP-RDB2 * RDB3: S32G-VNP-RDB3 Tested-by: Enric Balletbo i Serra Signed-off-by: Jan Petrous (OSS) Signed-off-by: Shawn Guo commit cb9273791950b84ff1714db4add9454906657d0b Author: Max Krummenacher Date: Fri Oct 31 13:55:07 2025 +0100 arm64: dts: imx8qm-apalis: add pwm used by the backlight Add pwm node used by the backlight output pin BKL1_PWM and reference it from the pwm-backlight node. Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit 916e7983031bf4dfe08f6dfebff57d74313339af Author: Markus Niebel Date: Thu Oct 30 14:53:01 2025 +0100 arm64: dts: imx95-tqma9596sa-mb-smarc-2: add aliases for SPI Add missing alias for SPI controllers. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit f19950eb8a3c7811ca12f223b7b8ceaa283f7e70 Author: Markus Niebel Date: Thu Oct 30 14:53:00 2025 +0100 arm64: dts: imx95-tqma9596sa-mb-smarc-2: remove superfluous line Remove empty line, no functional changes. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit dc4290f5fa109f0e88d7c2ef205bfc61b95796a0 Author: Alexander Stein Date: Thu Oct 30 14:52:59 2025 +0100 arm64: dts: imx95-tqma9596sa-mb-smarc-2: mark LPUART1 as reserved LPUART1 is not disabled, but used by system manager (SM) and should not be used by Linux. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 2d226e54041a33083d7f4bea82cb9cf6529e5da3 Author: Alexander Stein Date: Thu Oct 30 14:52:58 2025 +0100 arm64: dts: imx95-tqma9596sa-mb-smarc-2: Add MicIn routing MicIn is connected to IN3_L. Add routing including the Mic Bias. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit c0a596011391946e1df3c97792dfced03ab086d5 Author: Markus Niebel Date: Thu Oct 30 14:52:57 2025 +0100 arm64: dts: imx95-tqma9596sa: add EEPROM pagesize The special ID device of the EEPROMS needs pagesize, too. Otherwise only slow byte write is possible. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit e0ac00be7ae844c901e34f426f95bb65ffdae4b4 Author: Alexander Stein Date: Thu Oct 30 14:52:56 2025 +0100 arm64: dts: imx95-tqma9596sa: whitespace fixes Use tabs instead of spaces for indentation. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit b5a07fe96d3d6c371568a5c9f2a92b7e8f24ab66 Author: Alexander Stein Date: Thu Oct 30 14:52:55 2025 +0100 arm64: dts: imx95-tqma9596sa: add gpio bus recovery for i2c Add pinctrl group for GPIO based bus recovery. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 35eecf5d8c92b87b6ce8c756ffd11a77f36a64a9 Author: Alexander Stein Date: Thu Oct 30 14:52:54 2025 +0100 arm64: dts: imx95-tqma9596sa: remove superfluous pinmux for usdhci A sleep pin mux is not useful if it is the same as the normal pin mux. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit b997a3acdccee5fd500754bdf2a72e90cbef5a09 Author: Alexander Stein Date: Thu Oct 30 14:52:53 2025 +0100 arm64: dts: imx95-tqma9596sa: remove superfluous pinmux for i2c A sleep pin mux is not useful if it is the same as the normal pin mux. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 88b02dc67350de6db47de335a6164a2730891afc Author: Alexander Stein Date: Thu Oct 30 13:49:17 2025 +0100 arm64: dts: imx95-tqma9596sa: remove superfluous pinmux for flexspi A sleep pin mux is not useful if it is the same as the normal pin mux. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 0df2b380e5edfd04106a336164fe928c24e9bb7b Author: Alexander Stein Date: Thu Oct 30 13:49:16 2025 +0100 arm64: dts: imx95-tqma9596sa: update pcie config Fix pcie clock config and switch from deprecated reset-gpio to reset-gpios. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit ab5b4a9158181e7f8bf8eaaa81b7efbda60b292d Author: Alexander Stein Date: Thu Oct 30 13:49:15 2025 +0100 arm64: dts: imx95-tqma9596sa: move pcie config to SOM The muxing and other features are mostly determined by SOM, so add it at this level. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 8b452dddd89101b6a71fca7354dacda576b1bc45 Author: Alexander Stein Date: Thu Oct 30 13:49:14 2025 +0100 arm64: dts: imx95-tqma9596sa: move sai config to SOM The muxing and other features are mostly determined by SOM, so add it at this level. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 16471a32346f1b9dd0f14c036411220d91b75a60 Author: Markus Niebel Date: Thu Oct 30 13:49:13 2025 +0100 arm64: dts: imx95-tqma9596sa: move USDHC2 config to SOM The muxing and other features are mostly determined by SOM, so add it at this level. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 68b7d5383b50879f600a4e50efd23f3df055adaf Author: Alexander Stein Date: Thu Oct 30 13:49:12 2025 +0100 arm64: dts: imx95-tqma9596sa: move lpspi3 pinctrl to SOM The muxing is determined by SOM, so add it at this level. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 438a4d0cd577d4541c0e9ebb87e008a1732ad1bc Author: Alexander Stein Date: Thu Oct 30 13:49:11 2025 +0100 arm64: dts: imx95-tqma9596sa: move flexcan pinctrl to SOM The muxing for flexcan is determined by SOM, so add it at this level. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 310b0aaa656ec9b58b0c5056b82ae42b166b2715 Author: Alexander Stein Date: Thu Oct 30 13:49:10 2025 +0100 arm64: dts: imx95-tqma9596sa: increase flexspi slew rate Switch to fast slew rate. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 461be3802562b2d41250b40868310579a32f32c1 Author: Alexander Stein Date: Thu Oct 30 13:49:09 2025 +0100 arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz 66 MHz is the maximum FlexPI clock frequency in normal/overdrive mode when RXCLKSRC = 0 (Default) Fixes: 91d1ff322c47 ("arm64: dt: imx95: Add TQMa95xxSA") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 046cb64923e8c05a8fb656baffcd8c3fc67fb688 Author: Markus Niebel Date: Thu Oct 30 13:49:08 2025 +0100 arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name tpm4grp will be overwritten. Fix node name Fixes: 91d1ff322c47 ("arm64: dt: imx95: Add TQMa95xxSA") Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 9e510e677090bb794b46348b10e1c8038286e00a Author: Chin-Ting Kuo Date: Fri Nov 14 18:10:42 2025 +0800 spi: aspeed: Add support for the AST2700 SPI controller Extend the driver to support the AST2700 SPI controller. Compared to AST2600, AST2700 has the following characteristics: - A 64-bit memory address space. - A 64KB address decoding unit. - Segment registers now use (start <= range < end) semantics, which differs slightly from (start <= range <= end) in AST2600. - Known issues related to address decoding range registers have been resolved, and the decoding range is now 1GB, which is sufficient. Therefore, the adjust_window callback is no longer required on AST2700 for range adjustment and bug fixes. - The SPI clock divider method and timing calibration logic remain unchanged from AST2600. Signed-off-by: Chin-Ting Kuo Link: https://patch.msgid.link/20251114101042.1520997-5-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit 508f3d3b688e1650ed383fe208b323aa6c164420 Author: Chin-Ting Kuo Date: Fri Nov 14 18:10:41 2025 +0800 spi: aspeed: Use phys_addr_t for bus addresses to support 64-bit platforms Update bus address types from u32 to phys_addr_t to support systems with 64-bit memory address space. This change ensures compatibility with upcoming SoCs that extend the system bus beyond 32-bit, while maintaining support for existing platforms. Signed-off-by: Chin-Ting Kuo Link: https://patch.msgid.link/20251114101042.1520997-4-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit be6671d3908e97a2128f5327610a1dcb4d420cfa Author: Chin-Ting Kuo Date: Fri Nov 14 18:10:39 2025 +0800 spi: dt-bindings: aspeed,ast2600-fmc: Add AST2700 SoC support Add AST2700 to the list of supported SoCs in the ASPEED FMC/SPI bindings. AST2700 FMC/SPI controllers are not compatible with AST2600 due to the following hardware differences: - Address decoding unit uses 64KB granularity (AST2600 uses 1MB). - Segment register semantics are changed. AST2600: start <= range <= end AST2700: start <= range < end - Hardware limitations in AST2600 address decoding registers have been resolved in AST2700, so extra callback function used for bug fixup is no longer required. These differences require distinct compatible strings for AST2700. Signed-off-by: Chin-Ting Kuo Acked-by: Conor Dooley Link: https://patch.msgid.link/20251114101042.1520997-2-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit 716d0a0a2ab00c601120c19bb357f4373f4722d1 Author: Chin-Ting Kuo Date: Fri Nov 14 18:10:40 2025 +0800 spi: aspeed: Enable Quad SPI mode for page program Ensure the controller switches to quad I/O mode when spi-tx-bus-width dts property is 4 and the Quad SPI program opcode (32h or 34h) is used. Without this change, high-bit data will be lost during page programming. Signed-off-by: Chin-Ting Kuo Link: https://patch.msgid.link/20251114101042.1520997-3-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit 2196e8172bee2002e9baaa0d02b2f9f2dd213949 Author: Ma Ke Date: Sun Nov 16 11:37:16 2025 +0800 ASoC: codecs: Fix error handling in pm4125 audio codec driver pm4125_bind() acquires references through pm4125_sdw_device_get() but fails to release them in error paths and during normal unbind operations. This could result in reference count leaks, preventing proper cleanup and potentially causing resource exhaustion over multiple bind/unbind cycles. Calling path: pm4125_sdw_device_get() -> bus_find_device_by_of_node() -> bus_find_device() -> get_device. Found by code review. Cc: stable@vger.kernel.org Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver") Signed-off-by: Ma Ke Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20251116033716.29369-1-make24@iscas.ac.cn Signed-off-by: Mark Brown commit 578ccfe344c5f421c2c6343b872995b397ffd3ff Author: Ma Ke Date: Sun Nov 16 14:16:23 2025 +0800 ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver In wcd937x_bind(), the driver calls of_sdw_find_device_by_node() to obtain references to RX and TX SoundWire devices, which increment the device reference counts. However, the corresponding put_device() are missing in both the error paths and the normal unbind path in wcd937x_unbind(). Add proper error handling with put_device() calls in all error paths of wcd937x_bind() and ensure devices are released in wcd937x_unbind(). Found by code review. Cc: stable@vger.kernel.org Fixes: 772ed12bd04e ("ASoC: codecs: wcdxxxx: use of_sdw_find_device_by_node helper") Signed-off-by: Ma Ke Reviewed-by: David Heidelberg Link: https://patch.msgid.link/20251116061623.11830-1-make24@iscas.ac.cn Signed-off-by: Mark Brown commit 4422df6782eb7aa9725a3c09d9ba3c38ecc85df4 Author: Kuninori Morimoto Date: Tue Nov 11 00:37:24 2025 +0000 ASoC: ux500: mop500_ab8500: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4ts8u3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fefd4e0b26392ab7676b13b597166b6478eec4c6 Author: Kuninori Morimoto Date: Tue Nov 11 00:37:20 2025 +0000 ASoC: ti: rx51: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9s8u8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c69951603150c2b08f69feb8eb2475d58c1ef7cd Author: Kuninori Morimoto Date: Tue Nov 11 00:37:16 2025 +0000 ASoC: ti: omap3pandora: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9ps8ub.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 42e142c842cb9c7dbde569ff137974e76d1a0e67 Author: Kuninori Morimoto Date: Tue Nov 11 00:37:13 2025 +0000 ASoC: ti: omap-twl4030: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu5s8uf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4fb45e5d4abda09bfd805b08fa3446686aa3c6bb Author: Kuninori Morimoto Date: Tue Nov 11 00:37:10 2025 +0000 ASoC: ti: omap-abe-twl6040: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seels8ui.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9b5a1d32da7e343e8fbdfbc536770544551ef59b Author: Kuninori Morimoto Date: Tue Nov 11 00:37:07 2025 +0000 ASoC: ti: n810: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1s8ul.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a3fc90c52ad0d525918aa5039cb07d937dc1d841 Author: Kuninori Morimoto Date: Tue Nov 11 00:37:04 2025 +0000 ASoC: ti: j721e-evm: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jhs8uo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9188f03aa5157abbe8eba3130df4381245fe4cd0 Author: Kuninori Morimoto Date: Tue Nov 11 00:37:01 2025 +0000 ASoC: ti: davinci-evm: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3xs8ur.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cf3c9aa075313898ac1669d0214946f0af84d18b Author: Kuninori Morimoto Date: Tue Nov 11 00:36:57 2025 +0000 ASoC: ti: ams-delta: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0ods8uu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a6aa027dffef1b6d6ebc9ef87210493bcf7abf22 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:54 2025 +0000 ASoC: tegra: tegra_wm8903: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8ts8ux.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 03258f7765e8c0210ea35b865f8e5c03fd9ccab9 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:51 2025 +0000 ASoC: tegra: tegra_asoc_machine: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm5tnfg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0019f120bfe862a583aa1a4347c1761e947e0054 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:48 2025 +0000 ASoC: tegra: tegra210_ahub: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346ltnfk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f0762675a23396e80a30fdb6d71a89dcfb972154 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:44 2025 +0000 ASoC: sunxi: sun8i-codec: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1tnfq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d4dfae0a980c30ecb4c9c3bd90d36171735dcc79 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:38 2025 +0000 ASoC: sunxi: sun8i-codec-analog: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbhtnft.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fd73d62f5f8b61bd396e4e4185ba2f8ad3a712db Author: Kuninori Morimoto Date: Tue Nov 11 00:36:35 2025 +0000 ASoC: sunxi: sun50i-codec-analog: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvxtnfx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bc8ec019290f00d605423db6ba5fd9db81e83bac Author: Kuninori Morimoto Date: Tue Nov 11 00:36:31 2025 +0000 ASoC: sunxi: sun4i-codec: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgdtng0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 49b476efceb52a8cefd4e1c74672b55826680c4e Author: Kuninori Morimoto Date: Tue Nov 11 00:36:28 2025 +0000 ASoC: sof-client-probes: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50ttng3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 088fa2cc7c4c4ec80a293692456f48c43b4da0e7 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:25 2025 +0000 ASoC: soc-topology: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9tng7.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit eb802ba07bcc1fbcf637b9ccf1ffcdc74277cca4 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:21 2025 +0000 ASoC: soc-pcm: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5ptngb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0813e864070dd6fca79619bb4f99e38c97422383 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:16 2025 +0000 ASoC: soc-jack: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq5tngf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b10489e9da2850bcaa53117df1331dc371df8d35 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:13 2025 +0000 ASoC: soc-dapm: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fraltngi.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e758b08d7170ee96e3461cec5c5b33e9aff5a75e Author: Kuninori Morimoto Date: Tue Nov 11 00:36:09 2025 +0000 ASoC: soc-core: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v1tngm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5b54c4ae6c880024699a7c0391991e45ca053477 Author: Kuninori Morimoto Date: Tue Nov 11 00:36:06 2025 +0000 ASoC: sdw_utils: soc_sdw_utils: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfhtngp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fdc5ce7f7272e59a1c32919b1ba8ab73d1bc28ab Author: Kuninori Morimoto Date: Tue Nov 11 00:36:03 2025 +0000 ASoC: sdw_utils: soc_sdw_ti_amp: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzxtngt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2bcf4235819c22b8a6dcbae9d9101d6202ea949c Author: Kuninori Morimoto Date: Tue Nov 11 00:35:55 2025 +0000 ASoC: sdw_utils: soc_sdw_rt_sdca_jack_common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkdtnh0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d10755f895eb295738c4db23ab970f8acaebd7ce Author: Kuninori Morimoto Date: Tue Nov 11 00:35:52 2025 +0000 ASoC: sdw_utils: soc_sdw_rt_mf_sdca: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4ttnh4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 805759446d9e8f278881f03d5b4b6bcacf9f0ce3 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:48 2025 +0000 ASoC: sdw_utils: soc_sdw_rt_amp: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9tnh8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5fca4f6a958c51f2c82d0838735b1cc6ba4da3dd Author: Kuninori Morimoto Date: Tue Nov 11 00:35:44 2025 +0000 ASoC: sdw_utils: soc_sdw_rt711: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9ptnhb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6353596bb18588c5d24c96501081c1ef9cce5754 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:41 2025 +0000 ASoC: sdw_utils: soc_sdw_rt700: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu5tnhf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9abf16750a7bb052799229b5cff5b14459d3bb21 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:34 2025 +0000 ASoC: sdw_utils: soc_sdw_rt5682: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seeltnhl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f39ee5784bb848d320e7e387ef2c11ef21c97e83 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:30 2025 +0000 ASoC: sdw_utils: soc_sdw_maxim: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1tnhq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fbada860c48112083c6212d2a0df5e4d919998c9 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:26 2025 +0000 ASoC: sdw_utils: soc_sdw_dmic: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jhtnht.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d0764e1476da99ad781745b5b6a7d583cbf1d7e5 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:22 2025 +0000 ASoC: sdw_utils: soc_sdw_cs_amp: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3xtnhx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 97a57e6ea996a773b278106755368755a9c2dc18 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:19 2025 +0000 ASoC: sdw_utils: soc_sdw_cs42l43: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0odtni1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 574a59412d32e8e094e636feeaa4d29b55d35410 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:15 2025 +0000 ASoC: sdw_utils: soc_sdw_cs42l42: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8ttni4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cb5aaf1bab5f7ef98f04eea303eb39ed05325dfe Author: Kuninori Morimoto Date: Tue Nov 11 00:35:11 2025 +0000 ASoC: sdw_utils: soc_sdw_bridge_cs35l56: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm5v22o.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5a2b4ddc2cf7f150328f4d1ae617b62a3a3df45c Author: Kuninori Morimoto Date: Tue Nov 11 00:35:08 2025 +0000 ASoC: sdca: sdca_asoc: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346lv22r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1c4143ea606a60a11d623a0bd751c8b0af0119e0 Author: Kuninori Morimoto Date: Tue Nov 11 00:35:05 2025 +0000 ASoC: samsung: tobermory: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1v22u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b6ba1a11ea626dd82672e06ffa7809beb671277a Author: Kuninori Morimoto Date: Tue Nov 11 00:35:01 2025 +0000 ASoC: samsung: tm2_wm5110: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbhv22y.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d1cca4a46f6dfad9a383e5aa30dd8a63833d7a82 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:57 2025 +0000 ASoC: samsung: speyside: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvxv232.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 620fd65ec496b4fe0f49f3b6bc1fd1f890432fd6 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:54 2025 +0000 ASoC: samsung: smdk_wm8994: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgdv235.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 311c12f7031d845c27e383f2987e53a35b684e5c Author: Kuninori Morimoto Date: Tue Nov 11 00:34:51 2025 +0000 ASoC: samsung: midas_wm1811: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50tv238.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit eac123525d4214d4ef4d751cb48649130b4cf51f Author: Kuninori Morimoto Date: Tue Nov 11 00:34:48 2025 +0000 ASoC: samsung: lowland: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9v23b.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c9d3bcafc711794efe493b7ad26ff704d560b725 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:44 2025 +0000 ASoC: samsung: littlemill: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5pv23f.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 857c31f15cef81745855a53262b021bec95ca7a8 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:41 2025 +0000 ASoC: samsung: bells: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq5v23i.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 02697e7049ddca90e128a89ca276e3ccaeff447a Author: Kuninori Morimoto Date: Tue Nov 11 00:34:38 2025 +0000 ASoC: samsung: aries_wm8994: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fralv23l.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 256cfc79911658a90caa7655e88c255255068ad1 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:35 2025 +0000 ASoC: rockchip: rockchip_max98090: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v1v23p.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 26de56c382450acd5d397631f490dc2d50e7a9c4 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:31 2025 +0000 ASoC: rockchip: rk3288_hdmi_analog: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfhv23s.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cacd21b61750c998f74e3d6aabfca1315298e699 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:28 2025 +0000 ASoC: qcom: sc7180: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzxv23v.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a4230eea80ddb9d08e4098f980ddf1d22bbc18ef Author: Kuninori Morimoto Date: Tue Nov 11 00:34:24 2025 +0000 ASoC: qcom: topology: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkdv23z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f74aa1e909e7ea960effb5d054cb9ff7e39d84b8 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:21 2025 +0000 ASoC: qcom: q6usb: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4tv242.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8686dd09358b92c2d3dc7b6d0cc893d1d72ef628 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:17 2025 +0000 ASoC: qcom: q6routing: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9v246.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 22219a4af85457a7ab8fdfa925a1fa2bffe66dd2 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:14 2025 +0000 ASoC: pxa: spitz: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9pv249.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a0593f6d1200bb17b69f85e89a9c6c6bcb2966b2 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:10 2025 +0000 ASoC: meson: t9015: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu5v24d.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 74c772546632500f64a4fc4b318cde9f87a29cf6 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:07 2025 +0000 ASoC: meson: g12a-tohdmitx: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seelv24g.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6a995aaaa4b63c324116f03adb94985654a6cb6e Author: Kuninori Morimoto Date: Tue Nov 11 00:34:04 2025 +0000 ASoC: meson: g12a-toacodec: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1v24k.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0c02abd9f443565b00f79f5d84166d610200b1a5 Author: Kuninori Morimoto Date: Tue Nov 11 00:34:00 2025 +0000 ASoC: meson: axg-tdm-interface: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jhv24n.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 32fc5bf2ea987504d10afe329727ab8c6fd8c836 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:57 2025 +0000 ASoC: meson: axg-spdifout: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3xv24r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6c65a8c3ad82616e6654c82ec0da33233e6f4e02 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:53 2025 +0000 ASoC: meson: aiu-codec-ctrl: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0odv24u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 047191ae16d336b5343b3eec1ad3532dedacee2d Author: Kuninori Morimoto Date: Tue Nov 11 00:33:50 2025 +0000 ASoC: meson: aiu-acodec-ctrl: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8tv24x.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ab947ebd0e06b1bba68702cadec93359371f0c16 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:46 2025 +0000 ASoC: mediatek: mt8365-afe-pcm: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm5wgph.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8d5a933224b59fa5a4d540f37b77fee5d22b3eb9 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:43 2025 +0000 ASoC: mediatek: mt8195-mt6359: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346lwgpl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit af535c76426ebbd3df12a804fa6da5b9e8c0339e Author: Kuninori Morimoto Date: Tue Nov 11 00:33:39 2025 +0000 ASoC: mediatek: mt8188-mt6359: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1wgpo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 771f522d64303751f976d888a9d6160a345042e2 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:35 2025 +0000 ASoC: mediatek: mt8186-mt6366: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbhwgps.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit aa851ed8746e20d4123efad82fa4ea3dd1f2b14e Author: Kuninori Morimoto Date: Tue Nov 11 00:33:32 2025 +0000 ASoC: mediatek: mt8186-mt6366-common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvxwgpw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b63f223ce0d402237ef339b8482ecc627320df3d Author: Kuninori Morimoto Date: Tue Nov 11 00:33:28 2025 +0000 ASoC: mediatek: mtk-dsp-sof-common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgdwgpz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 063e91a9141e708fe07a2a06d50fb0b3ed1ecbea Author: Kuninori Morimoto Date: Tue Nov 11 00:33:24 2025 +0000 ASoC: mediatek: mtk-afe-platform-driver: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50twgq3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5a3c54a94c9101ce126cae1fe21df0cab5d80c63 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:20 2025 +0000 ASoC: intel: boards: sof_rt5682: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9wgq7.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8124fe3d5b254a0c17da853591616c8d8ee602e7 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:17 2025 +0000 ASoC: intel: boards: sof_realtek_common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5pwgqb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 85216ea34568352c7c06ba7152ab1e9ccc73eff7 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:13 2025 +0000 ASoC: intel: boards: sof_pcm512x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq5wgqe.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9c95183d4e0cd557bcae21608b03ae9cf0eb87cb Author: Kuninori Morimoto Date: Tue Nov 11 00:33:09 2025 +0000 ASoC: intel: boards: sof_nuvoton_common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fralwgqi.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9defa941d828ad48bb24249363b0f956b3dd3770 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:06 2025 +0000 ASoC: intel: boards: sof_nau8825: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v1wgqm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f1ead097d7ddb7014215518f290e49e7fc374266 Author: Kuninori Morimoto Date: Tue Nov 11 00:33:01 2025 +0000 ASoC: intel: boards: sof_maxim_common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfhwgqq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit beb865ab8e5a2d92ae11daca23bdfa51aea587cb Author: Kuninori Morimoto Date: Tue Nov 11 00:32:58 2025 +0000 ASoC: intel: boards: sof_es8336: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzxwgqt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 638d14a0a0658f7fd8b868ebb93289d21fb64006 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:53 2025 +0000 ASoC: intel: boards: sof_da7219: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkdwgqy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5969275804b8f033618ff8f7309b016deb5e5117 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:50 2025 +0000 ASoC: intel: boards: sof_cirrus_common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4twgr2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a30381e9cc2d32d8e0d4077cfa6aab0c70d34105 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:46 2025 +0000 ASoC: intel: boards: sof_board_helpers: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9wgr6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit be0c2c4010c2e641772408c2bce1649e5db20f2f Author: Kuninori Morimoto Date: Tue Nov 11 00:32:41 2025 +0000 ASoC: intel: boards: cht_bsw_rt5672: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9pwgra.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 61907c9a0d25200ea4681a0ae6b2f7c7673ea5bb Author: Kuninori Morimoto Date: Tue Nov 11 00:32:38 2025 +0000 ASoC: intel: boards: cht_bsw_rt5645: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu5wgrd.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8c62a765be9ece320dd4da00dcd038f6b83ea2f2 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:35 2025 +0000 ASoC: intel: boards: cht_bsw_max98090_ti: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seelwgrh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2990b658ed446abd3b509854e2b266eaef666ac5 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:31 2025 +0000 ASoC: intel: boards: bytcr_wm5102: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1wgrk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 575eb51c72251f73d21408829ed39b8b03e67894 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:27 2025 +0000 ASoC: intel: boards: bytcr_rt5651: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jhwgro.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e6995aa8165571c0f85ca259de15edde713bfa7c Author: Kuninori Morimoto Date: Tue Nov 11 00:32:23 2025 +0000 ASoC: intel: boards: bytcr_rt5640: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3xwgrs.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d02bbabec7e330346b85a43c0f89ee61144985a8 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:19 2025 +0000 ASoC: intel: boards: bytcht_es8316: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0odwgrw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9c082ab3ebb8baa1f9f17a5c4a85d2345f5b305c Author: Kuninori Morimoto Date: Tue Nov 11 00:32:15 2025 +0000 ASoC: intel: boards: bytcht_cx2072x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8twgs0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e3c9bc1f31214f33e24fae70ade0d748ed5cba95 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:11 2025 +0000 ASoC: intel: boards: bdw-rt5677: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm5xvck.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 738a0014640cc1a2ee75d66e13327db87fca8a58 Author: Kuninori Morimoto Date: Tue Nov 11 00:32:06 2025 +0000 ASoC: intel: avs: pcm: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346lxvcp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6603016167aace5d4c78bdfa5eb1f928a42d7e47 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:38 2025 +0000 ASoC: intel: avs: control: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1xvdh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4cc345c56b2458d449bf2479cb72afbb8e9dfc1c Author: Kuninori Morimoto Date: Tue Nov 11 00:31:34 2025 +0000 ASoC: intel: avs: rt5640: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbhxvdl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit dd929092b3122a9cfd1f7115c4eecdb7944c45a8 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:22 2025 +0000 ASoC: intel: avs: rt5514: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvxxvdy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2f8d6a86936e10bb65042f2c4da8c84e164b3693 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:18 2025 +0000 ASoC: intel: avs: rt274: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgdxve1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 84496142859a4c66aab3d82ce110952541614ef3 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:14 2025 +0000 ASoC: intel: avs: nau8825: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50txve5.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8c827c1c78b7260bfdd33cd8ddf82e3c19c24bb2 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:11 2025 +0000 ASoC: intel: avs: es8336: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9xve8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2988abc11bb7c4cf756b4197de0879ed92bb39bf Author: Kuninori Morimoto Date: Tue Nov 11 00:31:07 2025 +0000 ASoC: intel: avs: da7219: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5pxvec.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 194c43841d9e5695837789f288889ca02c023074 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:04 2025 +0000 ASoC: intel: atom: sst-atom-controls: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq5xveg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1014ec36b43a997a8d8fcf68728d1fd6c891b004 Author: Kuninori Morimoto Date: Tue Nov 11 00:31:00 2025 +0000 ASoC: generic: audio-graph-card: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fralxvej.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 21838f53f47e2fa4dfdda71a9bc895f599e7cf9f Author: Kuninori Morimoto Date: Tue Nov 11 00:30:56 2025 +0000 ASoC: fsl: imx-rpmsg: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v1xven.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7fb390727decac201fc9370bb14b17d91c334da6 Author: Kuninori Morimoto Date: Tue Nov 11 00:30:53 2025 +0000 ASoC: fsl: fsl-asoc-card: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfhxver.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e70ef8a90d431157ad1b314a78125aab50eeda3e Author: Kuninori Morimoto Date: Tue Nov 11 00:30:49 2025 +0000 ASoC: codecs: wm_hubs: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzxxvev.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0e435dd54f5e3f4077ae3c8db1d1c3c2e5823a8a Author: Kuninori Morimoto Date: Tue Nov 11 00:30:45 2025 +0000 ASoC: codecs: wm_adsp: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkdxvey.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2f558a84ced9e7ad6d5e53617d6848df9696ecd9 Author: Kuninori Morimoto Date: Tue Nov 11 00:30:41 2025 +0000 ASoC: codecs: wm9713: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4txvf2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c2bdc0301db723b67b9c6cbd572f8df4b473cc4a Author: Kuninori Morimoto Date: Tue Nov 11 00:30:37 2025 +0000 ASoC: codecs: wm9712: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9xvf6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2cc325972373bf86f561eaec45680d4ab957e4eb Author: Kuninori Morimoto Date: Tue Nov 11 00:30:34 2025 +0000 ASoC: codecs: wm9090: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9pxvfa.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fef5517fff15652903f56f153938eaf93c2c53a0 Author: Kuninori Morimoto Date: Tue Nov 11 00:30:22 2025 +0000 ASoC: codecs: wm9081: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu5xvfl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8a19eabf16304642a1c281f6676b7248b234ca1d Author: Kuninori Morimoto Date: Tue Nov 11 00:30:17 2025 +0000 ASoC: codecs: wm8998: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seelxvfr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1a8870e2e2eeb7819ad540f0027faec500833351 Author: Kuninori Morimoto Date: Tue Nov 11 00:30:12 2025 +0000 ASoC: codecs: wm8997: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1xvfw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9050b9a872a9bb78874ff6b7ba933ca0a90dcecd Author: Kuninori Morimoto Date: Tue Nov 11 00:30:07 2025 +0000 ASoC: codecs: wm8996: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jhxvg0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0e8d0789ded09e681cb3ba48beaceca125d441f5 Author: Kuninori Morimoto Date: Tue Nov 11 00:30:04 2025 +0000 ASoC: codecs: wm8995: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3xxvg3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 10d5d21a3379b56a0655609918fcc4b4ccb4909d Author: Kuninori Morimoto Date: Tue Nov 11 00:29:59 2025 +0000 ASoC: codecs: wm8994: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0odxvg8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 69532b4263a264c5bf9ad11046ad1acb2ab3534e Author: Kuninori Morimoto Date: Tue Nov 11 00:29:55 2025 +0000 ASoC: codecs: wm8993: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8txvgc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6f917e47db4984e784a5245b4e3f35ca16b01ccf Author: Kuninori Morimoto Date: Tue Nov 11 00:29:52 2025 +0000 ASoC: codecs: wm8991: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm5za0w.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4e111f49809959bd568cf68bea83155908872164 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:48 2025 +0000 ASoC: codecs: wm8990: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346lza0z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7881b033afa1a2f6ec587dabfe2e12d0bfdef022 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:45 2025 +0000 ASoC: codecs: wm8988: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1za13.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d4ed7da08c767437400b2550092b7ea67cfac294 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:41 2025 +0000 ASoC: codecs: wm8985: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbhza16.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 19bf3fb9baf235cca9f9bb52cee488662e5bba0c Author: Kuninori Morimoto Date: Tue Nov 11 00:29:38 2025 +0000 ASoC: codecs: wm8983: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvxza1a.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 21bb118ea37adc40027771b1f45a246eb3956265 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:34 2025 +0000 ASoC: codecs: wm8978: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgdza1d.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8268a73d6c93b9cadf323bb9ef92fd01d4eb6529 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:31 2025 +0000 ASoC: codecs: wm8974: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50tza1g.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8efb94a90e6558a2aeffac518e7b7479fdaa14d9 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:28 2025 +0000 ASoC: codecs: wm8971: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9za1k.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 58fc7681c470d39332f01aae88b2259e613e53e3 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:24 2025 +0000 ASoC: codecs: wm8962: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5pza1n.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8d27adc88a5461b08990d33a16d215e3e7e890dc Author: Kuninori Morimoto Date: Tue Nov 11 00:29:21 2025 +0000 ASoC: codecs: wm8961: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq5za1q.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit aa57703fd738d0d9f1328d44bc6b9ee82daf0326 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:18 2025 +0000 ASoC: codecs: wm8960: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fralza1u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5d1a88f50569d1c4637fe29620e6d194f7e50014 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:14 2025 +0000 ASoC: codecs: wm8955: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v1za1x.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a5a6abd02d100913327a150e764dbc29045970a1 Author: Kuninori Morimoto Date: Tue Nov 11 00:29:11 2025 +0000 ASoC: codecs: wm8940: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfhza20.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3f2848403a817345c2d0984c49f128fc9dc28b3b Author: Kuninori Morimoto Date: Tue Nov 11 00:29:08 2025 +0000 ASoC: codecs: wm8904: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzxza24.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5b08edab386559a7d8549fa94688ea3878e9574f Author: Kuninori Morimoto Date: Tue Nov 11 00:29:04 2025 +0000 ASoC: codecs: wm8903: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkdza27.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4f9d291e6828aa92503988e319b175c0fa3303af Author: Kuninori Morimoto Date: Tue Nov 11 00:29:01 2025 +0000 ASoC: codecs: wm8900: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4tza2b.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1b6934ca2a68bca2d6a776497f47ba319419d7dd Author: Kuninori Morimoto Date: Tue Nov 11 00:28:57 2025 +0000 ASoC: codecs: wm8804: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9za2e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit acee6bda8872f715dcc6d3ff1fe387606d752661 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:54 2025 +0000 ASoC: codecs: wm8776: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9pza2i.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 92a3e4bb1813cd5eaba1050b9d82356b17daca2e Author: Kuninori Morimoto Date: Tue Nov 11 00:28:48 2025 +0000 ASoC: codecs: wm8770: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu5za2n.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 23805d059a597b001bd5e3655ee0bae652142944 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:45 2025 +0000 ASoC: codecs: wm8753: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seelza2r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c153d6da9cde3efc5fbfcf39515d224c2b6ad48f Author: Kuninori Morimoto Date: Tue Nov 11 00:28:41 2025 +0000 ASoC: codecs: wm8750: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1za2u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 04b80a9aa21f2d02ac6ccbfacc33eb0827eb9899 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:37 2025 +0000 ASoC: codecs: wm8737: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jhza2y.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit da9ad75afba487013bd4345d4b77477f35ed25ec Author: Kuninori Morimoto Date: Tue Nov 11 00:28:34 2025 +0000 ASoC: codecs: wm8731: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3xza31.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3f553ac8005e07e7c3d84edfdc08727439e4f5c7 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:31 2025 +0000 ASoC: codecs: wm8728: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0odza35.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9e1666651224267179d1e4f1e366cd526c384ae8 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:27 2025 +0000 ASoC: codecs: wm8711: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8tza38.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit dde23aa355aa0fc1fbafd40dc53ffb2d67a7e8b9 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:23 2025 +0000 ASoC: codecs: wm8580: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm51kgo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8df50a4f2f9faaf336d3640174a828e9b979544b Author: Kuninori Morimoto Date: Tue Nov 11 00:28:20 2025 +0000 ASoC: codecs: wm8523: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346l1kgr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 098c486f07000c70fe18abd879a0abdb96ccfc23 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:16 2025 +0000 ASoC: codecs: wm8510: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir11kgv.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 863a396f09f559344e41ccaf2cab6aea12bcc3bc Author: Kuninori Morimoto Date: Tue Nov 11 00:28:13 2025 +0000 ASoC: codecs: wm8400: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbh1kgz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 62d12a8e945605468a8d119960c988014c44f6c0 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:09 2025 +0000 ASoC: codecs: wm8350: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvx1kh2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a3de4a9c3e0627989efe88ea31f422f1da896dcc Author: Kuninori Morimoto Date: Tue Nov 11 00:28:05 2025 +0000 ASoC: codecs: wm5110: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgd1kh6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit eba22be8d911dea8132ae6bf8e83e26740e068b2 Author: Kuninori Morimoto Date: Tue Nov 11 00:28:02 2025 +0000 ASoC: codecs: wm5102: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50t1kh9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0ba0819b8fb4ea27d700e5784e150217e2d9f295 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:58 2025 +0000 ASoC: codecs: wm5100: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl91khd.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c13e3d24dbe84b398bc9e5ea767e4d3515b06771 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:54 2025 +0000 ASoC: codecs: wm0010: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5p1khh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2416360daf6e17c10af12f40139bfa84c99f7f2f Author: Kuninori Morimoto Date: Tue Nov 11 00:27:51 2025 +0000 ASoC: codecs: wcd937x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq51khl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7b10c284495c7f9a666f7057351e67d6bc9c54bd Author: Kuninori Morimoto Date: Tue Nov 11 00:27:46 2025 +0000 ASoC: codecs: wcd934x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fral1khp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 46f360c51cfeb7b29340815885e4a7e82b411bc8 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:42 2025 +0000 ASoC: codecs: wcd9335: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v11kht.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 697f92e637d1c0de9ec9d1dc31a6fa3c921be831 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:39 2025 +0000 ASoC: codecs: uda1380: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfh1khx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c5b5f6d75ecc87eb543ca8e867ca1585c03b242a Author: Kuninori Morimoto Date: Tue Nov 11 00:27:34 2025 +0000 ASoC: codecs: twl6040: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzx1ki1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 00246ae603ef2ee4765fd71923519849a1690286 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:17 2025 +0000 ASoC: codecs: twl4030: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkd1kij.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3affdae134871f7be7d28fe5a763f2a17d1c18ab Author: Kuninori Morimoto Date: Tue Nov 11 00:27:13 2025 +0000 ASoC: codecs: tlv320dac33: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4t1kim.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cf61841233bd0c905b3493f879b45fa9f7d44ff4 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:10 2025 +0000 ASoC: codecs: tlv320aic3x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p91kiq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0da5d1fb00c1108e543fa94c92419006a1008d84 Author: Kuninori Morimoto Date: Tue Nov 11 00:27:06 2025 +0000 ASoC: codecs: tlv320aic32x4: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9p1kit.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1ddafb83a431b2d4c847b2640b352cfca0d1b077 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:57 2025 +0000 ASoC: codecs: tlv320aic31xx: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu51kj2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit eeb152d9636f3a1355ce1d2bdc481cb70e0ca2bb Author: Kuninori Morimoto Date: Tue Nov 11 00:26:51 2025 +0000 ASoC: codecs: tlv320adc3xxx: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seel1kj8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a9b239d098dbbfa8dd0cc56001cfc80053da1317 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:48 2025 +0000 ASoC: codecs: tas6424: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz11kjb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 88539900888437c446f44b8248797b958e10d14f Author: Kuninori Morimoto Date: Tue Nov 11 00:26:45 2025 +0000 ASoC: codecs: tas571x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jh1kjf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ca7f864f91bff158a697349dae2c81afae2b3073 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:41 2025 +0000 ASoC: codecs: sta529: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3x1kji.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f8b494b28806efc8e6dece1f66f30c371376788c Author: Kuninori Morimoto Date: Tue Nov 11 00:26:37 2025 +0000 ASoC: codecs: sta350: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0od1kjm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8454435315e5a6e2f8e531b5ec038c6db4d6ebfe Author: Kuninori Morimoto Date: Tue Nov 11 00:26:34 2025 +0000 ASoC: codecs: sta32x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8t1kjp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 664ae39314732223786b1c94ac6031b01886fc84 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:31 2025 +0000 ASoC: codecs: ssm4567: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm52z48.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b637319d1fdc3686b669ab9c0ec6faee5e8954c2 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:27 2025 +0000 ASoC: codecs: ssm2602: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346l2z4c.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 12cdef76abbbd5209829e73cc58d44a0921deeda Author: Kuninori Morimoto Date: Tue Nov 11 00:26:23 2025 +0000 ASoC: codecs: ssm2518: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir12z4g.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5d9958b2eff8ef283bb70fd0ae82cc6e65372876 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:20 2025 +0000 ASoC: codecs: sma1307: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbh2z4k.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 636819c3962b9a2377bfdd3baa11e187cba39916 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:16 2025 +0000 ASoC: codecs: sma1303: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvx2z4n.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 128cd2206689ebddb6f7a9682f5671190a570a56 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:13 2025 +0000 ASoC: codecs: simple-mux: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgd2z4r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 46db12032942a47d6c2b1158633514a739f780eb Author: Kuninori Morimoto Date: Tue Nov 11 00:26:09 2025 +0000 ASoC: codecs: rt721-sdca: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50t2z4v.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bdc210a4485b640b65f3cf9cfd6fbe1e564e7645 Author: Kuninori Morimoto Date: Tue Nov 11 00:26:05 2025 +0000 ASoC: codecs: rt715: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl92z4z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6254032a219c7581df8203b31480f06a2babd46d Author: Kuninori Morimoto Date: Tue Nov 11 00:26:00 2025 +0000 ASoC: codecs: rt715-sdca: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5p2z53.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 24bca18098187d56257a938dfcae2673f8fa847a Author: Kuninori Morimoto Date: Tue Nov 11 00:25:57 2025 +0000 ASoC: codecs: rt712-sdca: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq52z57.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 52239c555cbd7369b4009dbf72791f0bb56469b6 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:53 2025 +0000 ASoC: codecs: rt712-sdca-dmic: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fral2z5a.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6db8ba3439c995a08def399f9eda4e1d2b95afa8 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:49 2025 +0000 ASoC: codecs: rt711: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v12z5e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 49a22e9811e1524cf4ee6c84e795526104f4fc3c Author: Kuninori Morimoto Date: Tue Nov 11 00:25:46 2025 +0000 ASoC: codecs: rt711-sdca: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfh2z5h.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1b30118264fc75f164ebf8a9888a16ddd2ebb3d4 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:43 2025 +0000 ASoC: codecs: rt700: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzx2z5l.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e727c8d01a5d6049e756fc15dfec08fbf4f7b0cf Author: Kuninori Morimoto Date: Tue Nov 11 00:25:39 2025 +0000 ASoC: codecs: rt5682s: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkd2z5o.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cf3937987c18980c3dffc456c91fc1f7b1cec4ca Author: Kuninori Morimoto Date: Tue Nov 11 00:25:36 2025 +0000 ASoC: codecs: rt5682: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4t2z5r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6ad9058c495691f004e8e697e1acbb2b4775c7e2 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:33 2025 +0000 ASoC: codecs: rt5677: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p92z5v.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9bcc76f58217c1701deeb4b4092e54dc64ce38bc Author: Kuninori Morimoto Date: Tue Nov 11 00:25:29 2025 +0000 ASoC: codecs: rt5670: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9p2z5y.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 60b6a547a88313022ca10af6a3029891bc638b1d Author: Kuninori Morimoto Date: Tue Nov 11 00:25:24 2025 +0000 ASoC: codecs: rt5668: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu52z63.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0c8392fd64e8be4fab28d8f568582f4cd7092196 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:21 2025 +0000 ASoC: codecs: rt5665: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seel2z67.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 82d779d150ed27232c940a7908c0f42c248a981f Author: Kuninori Morimoto Date: Tue Nov 11 00:25:17 2025 +0000 ASoC: codecs: rt5663: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz12z6b.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 453dfd1c9b486f2289d60871ee11fa05809303ab Author: Kuninori Morimoto Date: Tue Nov 11 00:25:13 2025 +0000 ASoC: codecs: rt5660: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jh2z6e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2049f715599eb677722a2e91d3616c4feff0e1fc Author: Kuninori Morimoto Date: Tue Nov 11 00:25:09 2025 +0000 ASoC: codecs: rt5659: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3x2z6i.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d6abe1e31fef77aab57f252c842acb92517ba9d3 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:06 2025 +0000 ASoC: codecs: rt5651: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0od2z6l.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cd0cd7e57d2b300d3d63cb9befa9edcf3e05ad68 Author: Kuninori Morimoto Date: Tue Nov 11 00:25:03 2025 +0000 ASoC: codecs: rt5645: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8t2z6o.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c3282edee7bd18cde6cfdf31a918dbd112dd794b Author: Kuninori Morimoto Date: Tue Nov 11 00:25:00 2025 +0000 ASoC: codecs: rt5640: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm54dr8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ab7963a3adc1dec9dd6efb9f4755fedb9b56d35d Author: Kuninori Morimoto Date: Tue Nov 11 00:24:55 2025 +0000 ASoC: codecs: rt5631: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346l4drc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cffb8638191684198b4e696393c678498791c590 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:50 2025 +0000 ASoC: codecs: rt5516: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir14drh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ca6cd3d3f1d7f98908dbc8342a28663346067b9a Author: Kuninori Morimoto Date: Tue Nov 11 00:24:46 2025 +0000 ASoC: codecs: rt5514: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbh4drl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 11c256c49d75c3d795339c93f52a19a202db5a15 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:43 2025 +0000 ASoC: codecs: rt298: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvx4drp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c2b942fbf952d734646352ff56f04bea6c151d3a Author: Kuninori Morimoto Date: Tue Nov 11 00:24:39 2025 +0000 ASoC: codecs: rt286: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgd4drs.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7d6ca6db9b6ee95adfdfabe84819b3b1900dfc05 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:36 2025 +0000 ASoC: codecs: rt274: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50t4drv.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8b1c56ae39d3bf304ab0c8de456e8f02081be9ed Author: Kuninori Morimoto Date: Tue Nov 11 00:24:32 2025 +0000 ASoC: codecs: rt1015: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl94drz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5b35bb517f27fc2401ec3cfd8c02a127627a0188 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:29 2025 +0000 ASoC: codecs: rt1011: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5p4ds2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2d8a091725e6f71c87a7ae35e51550693afdef77 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:26 2025 +0000 ASoC: codecs: rk3308: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq54ds5.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 02dbbb7e982a6873f81e69e4fef59a42decb7b1a Author: Kuninori Morimoto Date: Tue Nov 11 00:24:21 2025 +0000 ASoC: codecs: pcm512x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fral4dsa.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d1b06d4a37c301a09403746f1d12bdcaeed40830 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:18 2025 +0000 ASoC: codecs: pcm186x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v14dsd.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 42f4ff0c0b21ac72ae3af23c67ce51209809e2a4 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:13 2025 +0000 ASoC: codecs: nau8825: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfh4dsi.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3eca632e86ac79012fbbeb3b7753d345f0baad04 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:10 2025 +0000 ASoC: codecs: nau8824: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzx4dsl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8000e233e920062dc08222fc6911e13c193d7719 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:07 2025 +0000 ASoC: codecs: nau8822: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkd4dsp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0314d78729a936de02f97daabd8756eb361922d4 Author: Kuninori Morimoto Date: Tue Nov 11 00:24:03 2025 +0000 ASoC: codecs: nau8821: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4t4dss.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 588dc19b1246fc05bd62b3471a01b19cafdc3809 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:59 2025 +0000 ASoC: codecs: nau8810: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p94dsw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f72c526d2e7a512ab969c3492a365633f5ff2f33 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:56 2025 +0000 ASoC: codecs: mt6359: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9p4dsz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ea9d164c67245f5d94da8d46eac1de25fd1059d6 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:51 2025 +0000 ASoC: codecs: mt6358: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu54dt4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4ddf34b148dfb08d47b3e920fdf831eabd973130 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:48 2025 +0000 ASoC: codecs: mt6357: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seel4dt8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e195aad3cd473030ff696fdecb76a04d11f1d3b4 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:44 2025 +0000 ASoC: codecs: ml26124: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz14dtc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 46fb094b54c89ddf314f7e807e5457be9b185bbc Author: Kuninori Morimoto Date: Tue Nov 11 00:23:40 2025 +0000 ASoC: codecs: max9867: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jh4dtf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a7ab96cf1366f2e35d05b1e773db2a4c1b5e4a45 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:37 2025 +0000 ASoC: codecs: max9850: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3x4dtj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bbbd507ab3c76f0ed262a29af89f36177a43d65b Author: Kuninori Morimoto Date: Tue Nov 11 00:23:33 2025 +0000 ASoC: codecs: max98396: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0od4dtm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f97289522b7910921d771af00b7c0ec915f4e21f Author: Kuninori Morimoto Date: Tue Nov 11 00:23:30 2025 +0000 ASoC: codecs: max98390: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8t4dtr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2dcb4f1d27e9c7a610ca40ac37d2dd177db35a52 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:25 2025 +0000 ASoC: codecs: max98373: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm55sea.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2e20be4b48c1d2886ff11147b302caab76f3c4b7 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:22 2025 +0000 ASoC: codecs: max98095: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346l5sed.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6ef8e2f7e5eb6933e0897575e7869741ac34e302 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:18 2025 +0000 ASoC: codecs: max98090: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir15seh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9c3c02de4883862fdccbc38943ade051fc0de0e2 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:15 2025 +0000 ASoC: codecs: max98088: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbh5sel.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0682c592ec98ba18ac65d1cd4b9c345e2995c121 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:11 2025 +0000 ASoC: codecs: madera: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvx5seo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit af9a1da6c3ae130fc44f218293410859f39bbd80 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:08 2025 +0000 ASoC: codecs: lpass-wsa-macro: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgd5ser.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5328d3d6b68d1819c199555aff88edad3ccd8bf3 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:04 2025 +0000 ASoC: codecs: lpass-va-macro: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50t5sev.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3df33a9e0faae857dc4c594a915404afa6a7a8f8 Author: Kuninori Morimoto Date: Tue Nov 11 00:23:01 2025 +0000 ASoC: codecs: lpass-tx-macro: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl95sez.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 16d4e8616e78e5edbcb99268050b431afcfe4610 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:57 2025 +0000 ASoC: codecs: lpass-rx-macro: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5p5sf2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 45da4a452aeb4f5f44bcbf50079291b70bec9dc5 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:54 2025 +0000 ASoC: codecs: lm49453: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq55sf5.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit daaf102aee4069d2fcaa4da60949b6e02f845c37 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:50 2025 +0000 ASoC: codecs: jz4770: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fral5sf9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f7e9d040d2b3243f9682c21ac7dda77a54b03c62 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:47 2025 +0000 ASoC: codecs: jz4760: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v15sfc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f4435734559b8b4bd2dd6c457705b8a22baca0a9 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:43 2025 +0000 ASoC: codecs: jz4740: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfh5sfg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b4403cf77e39c2d0e2694b1cf5311683cbfac789 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:40 2025 +0000 ASoC: codecs: hdmi-codec: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzx5sfj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f2d57e22b51c0aa1b2d222b30c07cdf80e4a6ca5 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:36 2025 +0000 ASoC: codecs: hdac_hdmi: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkd5sfn.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a3151663d0274f79c52bb7ae11e69c0dad1f2267 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:33 2025 +0000 ASoC: codecs: hdac_hda: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4t5sfq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4b9ac2be5fc62ea65c032c3e6e554e60757e5944 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:29 2025 +0000 ASoC: codecs: hda: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p95sfu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2e20e32c2e3ac17aae4f53ce6205a5d8bf34e895 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:26 2025 +0000 ASoC: codecs: es8389: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9p5sfx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a5511a6e10f1e1462d61aec8420d6ac4cd9e3efe Author: Kuninori Morimoto Date: Tue Nov 11 00:22:22 2025 +0000 ASoC: codecs: es8328: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu55sg1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit eec3b674f2a5c2334d2f1a2200b231975277e2c9 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:19 2025 +0000 ASoC: codecs: es8326: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seel5sg4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1505741d727e210650c7f2cbe16ab450f0b1b0bf Author: Kuninori Morimoto Date: Tue Nov 11 00:22:15 2025 +0000 ASoC: codecs: es8316: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz15sg8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c475f3468361bb37815aa5beaac056568d18fb56 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:12 2025 +0000 ASoC: codecs: es8311: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jh5sgc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 82e5de78dbdeec04257d8bdba8465217ad9447d9 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:08 2025 +0000 ASoC: codecs: es7134: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3x5sgf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 464ac2a1085749dbfeee899ac06d51bea7ef1041 Author: Kuninori Morimoto Date: Tue Nov 11 00:22:05 2025 +0000 ASoC: codecs: da9055: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0od5sgi.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 476fb171ed43ce544d54cd082ec56df2e8f8aa5d Author: Kuninori Morimoto Date: Tue Nov 11 00:22:02 2025 +0000 ASoC: codecs: da732x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8t5sgm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 96b0a24773849ca2d051a552a19eee262f1f7444 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:56 2025 +0000 ASoC: codecs: da7219: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm57717.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit aaf1f90c99d920f8ab95413cab7abc627316fdf6 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:52 2025 +0000 ASoC: codecs: da7219-aad: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346l771b.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 12223b4534dd70bc13d792a836f53369db89caa1 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:48 2025 +0000 ASoC: codecs: da7218: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1771f.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0a87517ae3e7af2019f80e32df01252dd8604080 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:43 2025 +0000 ASoC: codecs: da7213: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbh771k.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e6f48607ac801864b99ff93e5193f3f422d55f7b Author: Kuninori Morimoto Date: Tue Nov 11 00:21:39 2025 +0000 ASoC: codecs: cs2072x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvx771o.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 78ad27bc554d33963fa829632c789ab8fb191a09 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:35 2025 +0000 ASoC: codecs: cx20442: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgd771s.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fa2defb800d7c7b67fa7d9fa95824b7780a90575 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:32 2025 +0000 ASoC: codecs: cs53l30: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50t771v.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7fdcd1d1add9c3abc1379563c98bcfcc5ce26343 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:28 2025 +0000 ASoC: codecs: cs530x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9771z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 97062ef891393c82107cf44a0eb50c6e1a399e18 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:25 2025 +0000 ASoC: codecs: cs48l32: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5p7722.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4c0f28830a4f96487cccfb0e8b78efd628766d91 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:20 2025 +0000 ASoC: codecs: cs47l92: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq57727.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 638d7077e67f03926f94201f5508c886d0683adc Author: Kuninori Morimoto Date: Tue Nov 11 00:21:16 2025 +0000 ASoC: codecs: cs47l90: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fral772b.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ce99b1dd71340e78d5f8f94af1fdf929bc386b61 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:13 2025 +0000 ASoC: codecs: cs47l85: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v1772e.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 80ac220583627912ef478a25e22b02bd813d5268 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:10 2025 +0000 ASoC: codecs: cs47l35: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfh772h.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 729a995620ca34f589135f9852d2ef1c9ee7ebb2 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:06 2025 +0000 ASoC: codecs: cs47l24: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzx772l.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4db61b8cd50441c846ac8e6afb53781f62f92029 Author: Kuninori Morimoto Date: Tue Nov 11 00:21:03 2025 +0000 ASoC: codecs: cs47l15: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkd772p.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 75dc6bf1d4dd08d78dd9568eeb041a3e0787084d Author: Kuninori Morimoto Date: Tue Nov 11 00:20:58 2025 +0000 ASoC: codecs: cs42xx8: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4t772t.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2bed4e2a81bcc1e59eb747d0a51e46a24bf3a1b3 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:54 2025 +0000 ASoC: codecs: cs42l73: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p9772x.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 770f17143988f1804d24cb5ab5a4bb9087a715b2 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:51 2025 +0000 ASoC: codecs: cs42l56: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9p7730.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4d01421647562d3f16319d79197d2afa8f3f1c84 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:47 2025 +0000 ASoC: codecs: cs42l52: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu57734.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c9ba54d36ac20fd94c9479e8b82b32610a4cb979 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:44 2025 +0000 ASoC: codecs: cs42l51: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seel7737.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5dc2dcbb10614ca77b32340d88d24cef47cd8d58 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:41 2025 +0000 ASoC: codecs: cs42l43: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz1773b.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 098931e46c0ed4e0203bcdc626ff94bcd58dbf36 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:37 2025 +0000 ASoC: codecs: cs42l43-jack: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jh773f.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit efdc8c78a5191c85096ee772a36330ca280873ce Author: Kuninori Morimoto Date: Tue Nov 11 00:20:32 2025 +0000 ASoC: codecs: cs4234: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3x773j.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bccf1a2e2a7819f2f9caebd5a135fe119f09dbd1 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:29 2025 +0000 ASoC: codecs: cs35l56: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0od773m.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4bac87b4742d479384ee133c0b591db9234acf0e Author: Kuninori Morimoto Date: Tue Nov 11 00:20:25 2025 +0000 ASoC: codecs: cs35l45: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8t773q.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f0962b1a35043b8d0e3384b7004f3785b7c7ffd0 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:21 2025 +0000 ASoC: codecs: cs35l41: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm58loa.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 436a4d82d2460926aa2a772acf5399accedfbc00 Author: Kuninori Morimoto Date: Tue Nov 11 00:20:17 2025 +0000 ASoC: codecs: cs35l33: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346l8loe.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cc1bb5d435d601035be92d98295cea0b973ae5c2 Author: Kuninori Morimoto Date: Tue Nov 11 00:19:56 2025 +0000 ASoC: codecs: cpcap: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir18loz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 57bea9f5f02e76cb81d84de17576faf336526167 Author: Kuninori Morimoto Date: Tue Nov 11 00:19:51 2025 +0000 ASoC: codecs: aw88395: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbh8lp4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7bb1edac96067d523a30b4ef5808d21c86725f64 Author: Kuninori Morimoto Date: Tue Nov 11 00:19:47 2025 +0000 ASoC: codecs: aw88261: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvx8lp9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0ad0505f61402ddcd08d3a6c8f741f0e1487bdc0 Author: Kuninori Morimoto Date: Tue Nov 11 00:19:40 2025 +0000 ASoC: codecs: audio-iio-aux: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgd8lpf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 335f0d947f52113110e2ed2ad2c030050d220ad8 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:59 2025 +0000 ASoC: codecs: arizona-jack: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87cy5p8lqk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 797e4164fe55a03db19930ae94d021173c8e726b Author: Kuninori Morimoto Date: Tue Nov 11 00:18:56 2025 +0000 ASoC: codecs: alc5623: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ecq58lqo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7a7ecd8d0a428e96f9271ea59b067b2a5c318de9 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:52 2025 +0000 ASoC: codecs: ak4641: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87fral8lqr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 87bb65464be16f83e5a7a6642f33084b6ce22d2d Author: Kuninori Morimoto Date: Tue Nov 11 00:18:47 2025 +0000 ASoC: codecs: adav80x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87h5v18lqx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 31f28cda703d442b75c4ae9f3d0855d787c6e909 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:41 2025 +0000 ASoC: codecs: adau7118: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ikfh8lr2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bdd43845598cae0591f0203d6e70f510c4af852d Author: Kuninori Morimoto Date: Tue Nov 11 00:18:38 2025 +0000 ASoC: codecs: adau1977: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87jyzx8lr6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 09ff5df2edbea67256209eb814bca4570436b7c6 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:34 2025 +0000 ASoC: codecs: adau17x1: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ldkd8lr9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f7a7e796a36f487758a9444408cef41f94460158 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:31 2025 +0000 ASoC: codecs: adau1781: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87ms4t8lrd.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4a9eb06f9b36ca43106e6e12231b5171a660e4ce Author: Kuninori Morimoto Date: Tue Nov 11 00:18:27 2025 +0000 ASoC: codecs: adau1761: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87o6p98lrg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 696713199ea5128a3d031a45f275bbfd275b87db Author: Kuninori Morimoto Date: Tue Nov 11 00:18:24 2025 +0000 ASoC: codecs: ad193x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87pl9p8lrk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e765581ceba401ef62329a4699403d00cb17ce2b Author: Kuninori Morimoto Date: Tue Nov 11 00:18:20 2025 +0000 ASoC: codecs: ad1836: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Nuno Sá Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87qzu58lrn.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 946d58ae54f8cd9ead30571a71c75a3981d7862a Author: Kuninori Morimoto Date: Tue Nov 11 00:18:17 2025 +0000 ASoC: codecs: 88pm860x: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87seel8lrr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cdc8feb84f7f22a9b21483b706382cea3cd248cd Author: Kuninori Morimoto Date: Tue Nov 11 00:18:13 2025 +0000 ASoC: codecs: ab8500: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87tsz18lru.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6d2188983a12e036531ecc67d89c6e1388855ea1 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:10 2025 +0000 ASoC: atmel: tse850-pcm5142: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87v7jh8lrx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f3e9bca581321403c9614a075002e29d8e29c60d Author: Kuninori Morimoto Date: Tue Nov 11 00:18:07 2025 +0000 ASoC: atmel: sam9g20_wm8731: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87wm3x8ls0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b42c7f40d2aa8be24601eaa80c672e2c34742c18 Author: Kuninori Morimoto Date: Tue Nov 11 00:18:03 2025 +0000 ASoC: amd: acp5x-mach: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87y0od8ls4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 170bc7a0e26ca3d36f543db4111cb7195137c145 Author: Kuninori Morimoto Date: Tue Nov 11 00:17:59 2025 +0000 ASoC: amd: acp3x-es83xx: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87zf8t8ls8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6b1b50ed3c9409a85ff28335ca9b471ed399e652 Author: Kuninori Morimoto Date: Tue Nov 11 00:17:56 2025 +0000 ASoC: amd: acp-mach-common: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/871pm5a0cr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8855eb7d29400fb7b2882da33725db2801c410e4 Author: Kuninori Morimoto Date: Tue Nov 11 00:17:52 2025 +0000 ASoC: asoc.h: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87346la0cv.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4d5c668c268b7812ff15452d303974ce247ad378 Author: Kuninori Morimoto Date: Tue Nov 11 00:17:48 2025 +0000 ASoC: soc.h: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/874ir1a0cz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ee0f171f4b9d21af0b202cec35c44c1eaf6e0beb Author: Kuninori Morimoto Date: Tue Nov 11 00:17:44 2025 +0000 ASoC: audio_topology: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/875xbha0d3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ed71deee195d5d2478363d606b0fbe5665e99d7f Author: Kuninori Morimoto Date: Tue Nov 11 00:17:41 2025 +0000 ASoC: audio_helper: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/877bvxa0d6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 64f90b329ffadae00b187ac797837ba598289707 Author: Kuninori Morimoto Date: Tue Nov 11 00:17:37 2025 +0000 ASoC: audio_codec: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/878qgda0da.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 91f20e5167d38eb943a087e3087927d1ce7a5c78 Author: Kuninori Morimoto Date: Tue Nov 11 00:17:32 2025 +0000 ASoC: arizona-micsupp: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87a50ta0df.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d6b8ebab363bf3dd46cf4d64727910d648bd35cf Author: Kuninori Morimoto Date: Tue Nov 11 00:17:25 2025 +0000 ASoC: arizona-haptics: convert to snd_soc_dapm_xxx() This patch converts below functions. dapm->dev -> snd_soc_dapm_to_dev() dapm->card -> snd_soc_dapm_to_card() dapm->component -> snd_soc_dapm_to_component() dapm_kcontrol_get_value() -> snd_soc_dapm_kcontrol_get_value() snd_soc_component_enable_pin() -> snd_soc_dapm_enable_pin() snd_soc_component_enable_pin_unlocked() -> snd_soc_dapm_enable_pin_unlocked() snd_soc_component_disable_pin() -> snd_soc_dapm_disable_pin() snd_soc_component_disable_pin_unlocked() -> snd_soc_dapm_disable_pin_unlocked() snd_soc_component_nc_pin() -> snd_soc_dapm_nc_pin() snd_soc_component_nc_pin_unlocked() -> snd_soc_dapm_nc_pin_unlocked() snd_soc_component_get_pin_status() -> snd_soc_dapm_get_pin_status() snd_soc_component_force_enable_pin() -> snd_soc_dapm_force_enable_pin() snd_soc_component_force_enable_pin_unlocked() -> snd_soc_dapm_force_enable_pin_unlocked() snd_soc_component_force_bias_level() -> snd_soc_dapm_force_bias_level() snd_soc_component_get_bias_level() -> snd_soc_dapm_get_bias_level() snd_soc_component_init_bias_level() -> snd_soc_dapm_init_bias_level() snd_soc_component_get_dapm() -> snd_soc_component_to_dapm() snd_soc_dapm_kcontrol_component() -> snd_soc_dapm_kcontrol_to_component() snd_soc_dapm_kcontrol_widget() -> snd_soc_dapm_kcontrol_to_widget() snd_soc_dapm_kcontrol_dapm() -> snd_soc_dapm_kcontrol_to_dapm() snd_soc_dapm_np_pin() -> snd_soc_dapm_disable_pin() Signed-off-by: Kuninori Morimoto Reviewed-by: Charles Keepax Link: https://patch.msgid.link/87bjl9a0dm.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bf724be7f00cf2cbafc105422476f6242e917a90 Author: Tamir Duberstein Date: Thu Nov 13 17:58:29 2025 -0500 rust: macros: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20251113-core-cstr-cstrings-v3-6-411b34002774@gmail.com Signed-off-by: Miguel Ojeda commit 118eb2cb97b8fc0d515bb0449495959247db58f0 Author: Jonas Gorski Date: Sun Nov 16 10:33:34 2025 +0100 spi: bcm63xx: drop wrong casts in probe() Both bs->regs and bs->{rx,tx}_io are tagged __iomem, so we shouldn't cast them to anything else. Silences the following sparse warning: drivers/spi/spi-bcm63xx.c:571:22: warning: cast removes address space '__iomem' of expression drivers/spi/spi-bcm63xx.c:571:19: warning: incorrect type in assignment (different address spaces) drivers/spi/spi-bcm63xx.c:571:19: expected unsigned char [noderef] [usertype] __iomem *tx_io drivers/spi/spi-bcm63xx.c:571:19: got unsigned char [usertype] * drivers/spi/spi-bcm63xx.c:572:22: warning: cast removes address space '__iomem' of expression drivers/spi/spi-bcm63xx.c:572:19: warning: incorrect type in assignment (different address spaces) drivers/spi/spi-bcm63xx.c:572:19: expected unsigned char const [noderef] [usertype] __iomem *rx_io drivers/spi/spi-bcm63xx.c:572:19: got unsigned char const [usertype] * Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251116093334.17423-1-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit d5c8b7902a41625ea328b52c78ebe750fbf6fef7 Author: Cezary Rojewski Date: Sat Nov 15 19:06:27 2025 +0100 ASoC: Intel: avs: Honor NHLT override when setting up a path In case topology provides NHLT configuration, use it instead of relying on the table in ACPI tree. Only gateway-related modules e.g.: Copier care about the process. For those the order of fetching for hardware configuration becomes: 1) check if NHLT override is set, 2) check if NHLT descriptor override is set, 3) use NHLT from ACPI directly Such approach ensures no conflicts exist between 1) and 2) and that 1) always takes precedence. Co-developed-by: Amadeusz Sławiński Signed-off-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251115180627.3589520-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit dd9896d41fdf1050934d6a46a1c5ca2164284e72 Author: Cezary Rojewski Date: Sat Nov 15 19:06:26 2025 +0100 ASoC: Intel: avs: Allow the topology to carry NHLT data Typically the hardware configuration for I2S and DMIC devices resides in the Non-HDAudio Link Table (NHLT) that is part of the ACPI tree. As the NHLTs existing in the field are not always perfect, workaround mechanisms are provided to patch them. Currently the avs-driver is utilizing the ->blob_fmt override (see topology.h and struct avs_tplg_modcfg_ext) when there is a valid entry within a NHLT to configure the hardware for specific format but its descriptor (header) is invalid. A separate case is when there is no correct hardware configuration at all within the NHLT available in the system. Patching the header won't help and forcing ad-hoc BIOS updates for dated system is not feasible. Allowing the topology to carry the data is the solution of choice as replacing a userspace file that is part of /lib/firmware/intel/ is less invasive than BIOS update and solves the problem. Co-developed-by: Amadeusz Sławiński Signed-off-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20251115180627.3589520-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit ab8a6c7b34513e48eb4fa766daaa81e75e4306ed Author: Tamir Duberstein Date: Thu Nov 13 17:58:26 2025 -0500 rust: str: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20251113-core-cstr-cstrings-v3-3-411b34002774@gmail.com [ Removed unused `c_str` import in doctest. - Miguel ] Signed-off-by: Miguel Ojeda commit 305b795730684796f3f4bbb1aa8f04d52cd2005d Author: Tamir Duberstein Date: Thu Nov 13 17:58:24 2025 -0500 rust: firmware: replace `kernel::c_str!` with C-Strings C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Acked-by: Greg Kroah-Hartman Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20251113-core-cstr-cstrings-v3-1-411b34002774@gmail.com Signed-off-by: Miguel Ojeda commit 3a1ce35030e1e0e35bc38db5e0be0165945f7e7f Author: Chuck Lever Date: Tue Oct 14 11:09:58 2025 -0400 NFSD: Add a subsystem policy document Steer contributors to NFSD's patchworks instance, list our patch submission preferences, and more. The new document is based on the existing netdev and xfs subsystem policy documents. This is an attempt to add transparency to the process of accepting contributions to NFSD and getting them merged upstream. Suggested-by: "Darrick J. Wong" Cc: Luis Chamberlain Cc: Martin K. Petersen Reviewed-by: NeilBrown [ cel: Hand-edits to address review comments ] Signed-off-by: Chuck Lever commit 6b3b697d65d46a0f640216a3f6c72856c159c567 Author: Jeff Layton Date: Mon Oct 13 09:54:53 2025 -0400 sunrpc: allocate a separate bvec array for socket sends svc_tcp_sendmsg() calls xdr_buf_to_bvec() with the second slot of rq_bvec as the start, but doesn't reduce the array length by one, which could lead to an array overrun. Also, rq_bvec is always rq_maxpages in length, which can be too short in some cases, since the TCP record marker consumes a slot. Fix both problems by adding a separate bvec array to the svc_sock that is specifically for sending. For TCP, make this array one slot longer than rq_maxpages, to account for the record marker. For UDP, only allocate as large an array as we need since it's limited to 64k of payload. Signed-off-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit ebd3330d1ca8844b0a0dba060d223523a186a5f9 Author: Chuck Lever Date: Wed Oct 8 11:39:56 2025 -0400 SUNRPC: Improve "fragment too large" warning Including the client IP address that generated the overrun traffic seems like it would be helpful. The message now reads: kernel: svc: nfsd oversized RPC fragment (1064958 octets) from 100.64.0.11:45866 Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d686e64e931c594af8b27597f6bf04944c857ed7 Author: Chuck Lever Date: Wed Oct 8 09:52:30 2025 -0400 NFSD: Implement NFSD_IO_DIRECT for NFS READ Add an experimental option that forces NFS READ operations to use direct I/O instead of reading through the NFS server's page cache. There is already at least one other layer of read caching: the page cache on NFS clients. The server's page cache, in many cases, is unlikely to provide additional benefit. Some benchmarks have demonstrated that the server's page cache is actively detrimental for workloads whose working set is larger than the server's available physical memory. For instance, on small NFS servers, cached NFS file content can squeeze out local memory consumers. For large sequential workloads, an enormous amount of data flows into and out of the page cache and is consumed by NFS clients exactly once -- caching that data is expensive to do and totally valueless. For now this is a hidden option that can be enabled on test systems for benchmarking. In the longer term, this option might be enabled persistently or per-export. When the exported file system does not support direct I/O, NFSD falls back to using either DONTCACHE or buffered I/O to fulfill NFS READ requests. Suggested-by: Mike Snitzer Reviewed-by: Mike Snitzer Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit d7de37d6d7ccfac9321d8cc4f36fc85dfadad54a Author: Chuck Lever Date: Wed Oct 8 09:52:29 2025 -0400 NFSD: Relocate the xdr_reserve_space_vec() call site In order to detect when a direct READ is possible, we need the send buffer's .page_len to be zero when there is nothing in the buffer's .pages array yet. However, when xdr_reserve_space_vec() extends the size of the xdr_stream to accommodate a READ payload, it adds to the send buffer's .page_len. It should be safe to reserve the stream space /after/ the VFS read operation completes. This is, for example, how an NFSv3 READ works: the VFS read goes into the rq_bvec, and is then added to the send xdr_stream later by svcxdr_encode_opaque_pages(). Now that xdr_reserve_space_vec() uses the number of bytes actually read, the xdr_truncate_encode() call is no longer necessary. Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 803bc849f0039291f546ba0e2237faebeb5c073e Author: Mike Snitzer Date: Wed Oct 8 09:52:28 2025 -0400 NFSD: pass nfsd_file to nfsd_iter_read() Prepare for nfsd_iter_read() to use the DIO alignment stored in nfsd_file by passing the nfsd_file to nfsd_iter_read() rather than just the file which is associaed with the nfsd_file. This means nfsd4_encode_readv() now also needs the nfsd_file rather than the file. Instead of changing the file arg to be the nfsd_file, we discard the file arg as the nfsd_file (and indeed the file) is already available via the "read" argument. Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit cc6c40e09d7b1c559bdf42f0fe99b16eb7cfc5e3 Author: Sergey Bashirov Date: Fri Oct 3 12:11:06 2025 +0300 NFSD/blocklayout: Support multiple extents per LAYOUTGET Allow the pNFS server to respond with multiple extents to a LAYOUTGET request, thereby avoiding unnecessary load on the server and improving performance for the client. The number of LAYOUTGET requests is significantly reduced for various file access patterns, including random and parallel writes. Additionally, this change allows the client to request layouts with the loga_minlength value greater than the minimum possible length of a single extent in XFS. We use this functionality to fix a livelock in the client. Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 0cd0d15d47f9e1a77ff64aedb2dbcf1c100e4006 Author: Sergey Bashirov Date: Fri Oct 3 12:11:05 2025 +0300 NFSD/blocklayout: Introduce layout content structure Add a layout content structure instead of a single extent. The ability to store and encode an array of extents is then used to implement support for multiple extents per LAYOUTGET. Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit a1dce715c64d4376321b5534366ae48fd7d14bcc Author: Sergey Bashirov Date: Fri Oct 3 12:11:04 2025 +0300 NFSD/blocklayout: Extract extent mapping from proc_layoutget No changes in functionality. Split the proc_layoutget function to create a helper function that maps single extent to the requested range. This helper function is then used to implement support for multiple extents per LAYOUTGET. Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 3524b021b0ec620a76c89aee78e9d4b4130fb711 Author: Sergey Bashirov Date: Fri Oct 3 12:11:03 2025 +0300 NFSD/blocklayout: Fix minlength check in proc_layoutget The extent returned by the file system may have a smaller offset than the segment offset requested by the client. In this case, the minimum segment length must be checked against the requested range. Otherwise, the client may not be able to continue the read/write operation. Fixes: 8650b8a05850 ("nfsd: pNFS block layout driver") Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 566a414558aec1ab263ab8709fa783dfa2e34325 Author: Chuck Lever Date: Thu Oct 2 10:00:52 2025 -0400 svcrdma: Increase the server's default RPC/RDMA credit grant The range of commits from commit e3274026e2ec ("SUNRPC: move all of xprt handling into svc_xprt_handle()") to commit 15d39883ee7d ("SUNRPC: change the back-channel queue to lwq") enabled NFSD performance to scale better as the number of nfsd threads is increased. These commits were merged in v6.7. Now that the nfsd thread count can scale to more threads, permit individual clients to make more use of those threads. Increase the RPC/RDMA per-connection credit grant from 64 to 128 -- same as the Linux NFS client. Simple single client fio-based benchmarking so far shows only improvement, no regression. Signed-off-by: Chuck Lever commit 166274a2456e5de9dc7e63a0818f7b842f218a5c Author: Chuck Lever Date: Wed Oct 1 09:24:31 2025 -0400 NFSD: Update comment documenting unsupported fattr4 attributes TIME_CREATE has been supported since commit e377a3e698fb ("nfsd: Add support for the birth time attribute"). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit bfce8e4273d81a1d056ed3d79a27e1b2c4f60759 Author: Matvey Kovalev Date: Mon Sep 29 20:35:20 2025 +0300 nfsd: delete unreachable confusing code in nfs4_open_delegation() op_delegate_type is assigned OPEN_DELEGATE_NONE just before the if-block where condition specifies it not be equal to OPEN_DELEGATE_NONE. Compiler treats the block as unreachable and optimizes it out from the resulting executable. In that aspect commit d08d32e6e5c0 ("nfsd4: return delegation immediately if lease fails") notably makes no difference. Seems it's better to just drop this code instead of fiddling with memory barriers or atomics. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Matvey Kovalev Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ccd608e29b7a73b7bee45b06bfeef088a97c4c92 Author: Chuck Lever Date: Wed Sep 17 10:31:40 2025 -0400 NFSD: Add array bounds-checking in nfsd_iter_read() The *count parameter does not appear to be explicitly restricted to being smaller than rsize, so it might be possible to overrun the rq_bvec or rq_pages arrays. Rather than overrunning these arrays (damage done!) and then WARNING once, let's harden the loop so that it terminates before the end of the arrays are reached. This should result in a short read, which is OK -- clients recover by sending additional READ requests for the remaining unread bytes. Reported-by: NeilBrown Reviewed-by: Jeff Layton Reviewed-by: Mike Snitzer Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit b5fc406bc730806662429272300fb56e4e6592d8 Author: Jeff Layton Date: Tue Sep 9 11:48:08 2025 -0400 nfsd: switch the default for NFSD_LEGACY_CLIENT_TRACKING to "n" We added this Kconfig option a little over a year ago. Switch the default to "n" in preparation for its eventual removal. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 4552f4e3f2c96597914f07b060d5c5db84420ddd Author: NeilBrown Date: Mon Sep 8 11:38:33 2025 +1000 nfsd: change nfs4_client_to_reclaim() to allocate data The calling convention for nfs4_client_to_reclaim() is clumsy in that the caller needs to free memory if the function fails. It is much cleaner if the function frees its own memory. This patch changes nfs4_client_to_reclaim() to re-allocate the .data fields to be stored in the newly allocated struct nfs4_client_reclaim, and to free everything on failure. __cld_pipe_inprogress_downcall() needs to allocate the data anyway to copy it from user-space, so now that data is allocated twice. I think that is a small price to pay for a cleaner interface. Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 89bd77cf436bf25e448817a662ebf76515f22863 Author: NeilBrown Date: Mon Sep 15 12:55:13 2025 +1000 nfsd: move name lookup out of nfsd4_list_rec_dir() nfsd4_list_rec_dir() is called with two different callbacks. One of the callbacks uses vfs_rmdir() to remove the directory. The other doesn't use the dentry at all, just the name. As only one callback needs the dentry, this patch moves the lookup into that callback. This prepares of changes to how directory operations are locked. Signed-off-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit bf94dea7fd4e6708d1a784be23db65eff84d82f1 Author: Chuck Lever Date: Wed Sep 3 11:53:35 2025 -0400 svcrdma: Release transport resources synchronously NFSD has always supported added network listeners. The new netlink protocol now enables the removal of listeners. Olga noticed that if an RDMA listener is removed and immediately re-added, the deferred __svc_rdma_free() function might not have run yet, so some or all of the old listener's RDMA resources linger, which prevents a new listener on the same address from being created. Also, svc_xprt_free() does a module_put() just after calling ->xpo_free(). That means if there is deferred work going on, the module could be unloaded before that work is even started, resulting in a UAF. Neil asks: > What particular part of __svc_rdma_free() needs to run in order for a > subsequent registration to succeed? > Can that bit be run directory from svc_rdma_free() rather than be > delayed? > (I know almost nothing about rdma so forgive me if the answers to these > questions seems obvious) The reasons I can recall are: - Some of the transport tear-down work can sleep - Releasing a cm_id is tricky and can deadlock We might be able to mitigate the second issue with judicious application of transport reference counting. Reported-by: Olga Kornievskaia Closes: https://lore.kernel.org/linux-nfs/20250821204328.89218-1-okorniev@redhat.com/ Suggested-by: NeilBrown Signed-off-by: Chuck Lever commit 61926c915f0a5e5db1a1ba45e1ecfac511307bd0 Merge: 2a084f4ad72724 424e2cce078255 Author: Dave Airlie Date: Mon Nov 17 08:21:58 2025 +1000 Merge tag 'drm-xe-next-2025-11-05' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: Limit number of jobs per exec queue (Shuicheng) Add sriov_admin sysfs tree (Michal) Driver Changes: Fix an uninitialized value (Thomas) Expose a residency counter through debugfs (Mohammed Thasleem) Workaround enabling and improvement (Tapani, Tangudu) More Crescent Island-specific support (Sk Anirban, Lucas) PAT entry dump imprement (Xin) Inline gt_reset in the worker (Lucas) Synchronize GT reset with device unbind (Balasubramani) Do clean shutdown also when using flr (Jouni) Fix serialization on burst of unbinds (Matt Brost) Pagefault Refactor (Matt Brost) Remove some unused code (Gwan-gyeong) Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patch.msgid.link/aQuBECxNOhudc0Bz@fedora commit f56b131723826dfdbf829d014591d831d649ae4a Author: Vitaly Wool Date: Tue Oct 14 14:33:39 2025 +0200 rust: rbtree: add immutable cursor Sometimes we may need to iterate over, or find an element in a read only (or read mostly) red-black tree, and in that case we don't need a mutable reference to the tree, which we'll however have to take to be able to use the current (mutable) cursor implementation. This patch adds a simple immutable cursor implementation to RBTree, which enables us to use an immutable tree reference. The existing (fully featured) cursor implementation is renamed to CursorMut, while retaining its functionality. The only existing user of the [mutable] cursor for RBTrees (binder) is updated to match the changes. Signed-off-by: Vitaly Wool Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251014123339.2492210-1-vitaly.wool@konsulko.se [ Applied `rustfmt`. Added intra-doc link. Fixed unclosed example. Fixed docs description. Fixed typo and other formatting nits. - Miguel ] Signed-off-by: Miguel Ojeda commit f9e05791642810a0cf6237d39fafd6fec5e0b4bb Author: Shi Hao Date: Sun Nov 16 15:46:20 2025 +0530 staging: iio: adt7316: replace sprintf() with sysfs_emit() Convert several sprintf() calls to sysfs_emit() in the sysfs show functions, as it is the preferred helper and prevents potential buffer overruns. No functional changes intended. Signed-off-by: Shi Hao Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 02d44a1b64f11cdbcd5349063f149309c42a9fa5 Author: Akhilesh Patil Date: Sun Nov 16 11:48:49 2025 +0530 iio: pressure: Arrange Makefile alphabetically Fix hp206c and st_pressure_* entries in pressure Makefiles to follow alphabetical order as per guideline mentioned in iio/pressure/Makefile. Signed-off-by: Akhilesh Patil Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6f813b7814d305cac27b81d5cabe3ebdebd1d8f2 Author: Stefan Prisacariu Date: Wed Nov 12 15:44:16 2025 +0100 ARM: dts: imx6qdl: make VAR-SOM SoM SoC-agnostic Make SoM .dtsi SoC-agnostic by moving SoC include to board level imx6qdl-var-som.dtsi currently includes imx6q.dtsi, which makes this SoM description Quad/Dual specific and prevents reuse from i.MX6DL boards. Changes: - Move imx6q.dtsi include from imx6qdl-var-som.dtsi to imx6q-var-mx6customboard.dts. - Remove /dts-v1/; from imx6qdl-var-som.dtsi (dtsi files should not declare version) This keeps the SoM .dtsi SoC-agnostic (it already relies on imx6qdl.dtsi for family-common parts) and allows boards using the DualLite or Solo to include imx6dl.dtsi instead. Why this is needed: To reuse imx6qdl-var-som.dtsi on i.MX6DL board. No functional changes for imx6q-var-mx6customboard are intended. Signed-off-by: Stefan Prisacariu Link: https://lore.kernel.org/all/20250925104942.4148376-1-stefan.prisacariu@prevas.dk/ Signed-off-by: Shawn Guo commit 910ab02fbbfe1621a13b366b3761b6dd9d499c32 Author: Laurentiu Mihalcea Date: Tue Nov 11 04:00:20 2025 -0800 arm64: defconfig: enable i.MX AIPSTZ driver Enable the i.MX AIPSTZ driver, which is used for i.MX8MP-based boards such as NXP's IMX8MP-EVK. Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit 88f717c042bba8189dc0a11e5ac1ea7215bc69ce Author: Marco Felsch Date: Fri Nov 7 15:49:51 2025 +0100 dt-bindings: arm: fsl: add Skov Rev.C HDMI support From software perspective, Rev.C HDMI and Rev.B HDMI don't differ since the panel is connected via HDMI and the touchscreen is connected via USB. However, the bootloader firmware expects to find a dts with the correct revc-hdmi compatible. Signed-off-by: Marco Felsch Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 35d7230cebc1cdf1ca7a9508a81e0e961f385907 Author: Michal Vokáč Date: Thu Nov 6 09:54:29 2025 +0100 ARM: dts: imx6dl-yapp4: Model the RGB LED as a single multi-led part Describe the RGB LED indicator according to the reality - it is a single part containing all the three R,G and B LEDs in one package. With this description the chan-name property becomes useless, remove it. Signed-off-by: Michal Vokáč Signed-off-by: Shawn Guo commit c8bf7740aad9b58ddab17501e9a9d6c951a59a03 Author: Michal Vokáč Date: Thu Nov 6 09:54:28 2025 +0100 ARM: dts: imx6dl-yapp43: Enable pwm-beeper on boards with speaker Lynx, Pegasus and Pegasus+ boards have a speaker connected to the PWM3. Enable a pwm-beeper on these boards so the system can produce simple sounds. Signed-off-by: Michal Vokáč Signed-off-by: Shawn Guo commit 92c49b3f4df8f9acfa95551ef38fc00c675319fd Author: Maud Spierings Date: Sun Nov 16 11:52:07 2025 +0100 drm/bridge: simple: add the Parade PS185HDM DP-to-HDMI bridge The Parade PS185HDM is a transparent Displayport to HDMI bridge. Reviewed-by: Dmitry Baryshkov Signed-off-by: Maud Spierings Link: https://patch.msgid.link/20251116-asus_usbc_dp-v2-2-cc8f51136c9f@hotmail.com Signed-off-by: Dmitry Baryshkov commit 07b391b6f99bc1e62f41e4ac249e7c82d46480aa Author: Maud Spierings Date: Sun Nov 16 11:52:06 2025 +0100 dt-bindings: display: bridge: simple: document the Parade PS185HDM DP-to-HDMI bridge The Parade PS185HDM is a transparent Displayport to HDMI bridge. Acked-by: Krzysztof Kozlowski Signed-off-by: Maud Spierings Link: https://patch.msgid.link/20251116-asus_usbc_dp-v2-1-cc8f51136c9f@hotmail.com Signed-off-by: Dmitry Baryshkov commit 5651eff270befcecc479a89ee7f619d57ed7512e Author: Stefano Radaelli Date: Thu Oct 30 13:01:24 2025 +0100 arm64: dts: freescale: imx93-var-som: Add support for ADS7846 touchscreen The VAR-SOM-MX93 integrates an ADS7846 resistive touchscreen controller. The controller is physically located on the SOM, and its signals are routed to the SOM pins, allowing carrier boards to make use of it. This patch adds the ADS7846 node and the appropriate SPI controller. Signed-off-by: Stefano Radaelli Signed-off-by: Shawn Guo commit c815711e27531578cc7e7ad13b94e48d6b5c5e97 Author: Stefano Radaelli Date: Thu Oct 30 13:01:23 2025 +0100 arm64: dts: freescale: imx93-var-som: Add support for WM8904 audio codec The VAR-SOM-MX93 can integrate the WM8904, a high-performance ultra-low-power stereo codec optimized for portable audio applications. This patch adds the WM8904 device to the appropriate I2C bus, enables the SAI peripheral, and introduces the sound node to expose the sound card to the system. Signed-off-by: Stefano Radaelli Signed-off-by: Shawn Guo commit 2e2a8aa9fc49bb409f81f8aee9ac5897008615b5 Author: Stefano Radaelli Date: Thu Oct 30 13:01:22 2025 +0100 arm64: dts: freescale: imx93-var-som: Add PMIC support The VAR-SOM-MX93 features Dual Freescale/NXP PCA9541 chip as a Power Management Integrated circuit (PMIC). The PMIC is programmable via the I2C interface and its associated register map, and this patch adds its support. Signed-off-by: Stefano Radaelli Signed-off-by: Shawn Guo commit 5d0c788263dd3be78ae8ccd7e67a54928c3888b9 Author: Stefano Radaelli Date: Thu Oct 30 13:01:21 2025 +0100 arm64: dts: freescale: imx93-var-som: Add WiFi and Bluetooth support Add device tree nodes for the WiFi and Bluetooth module mounted on the VAR-SOM-MX93. The module can be based on either the NXP IW612 or IW611 chipset, depending on the configuration chosen by the customer. Regardless of the chipset used, WiFi communicates over SDIO and Bluetooth over UART. Signed-off-by: Stefano Radaelli Signed-off-by: Shawn Guo commit d59ae05e3d070f651102157dd6167160ca6c9577 Author: Frank Li Date: Wed Oct 29 15:54:48 2025 -0400 arm64: dts: imx8qxp-mek: change space with tab Change space with tab to align with code style. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 5d82ec7472d94aa5355820fe809888dc44d41f2a Author: Sherry Sun Date: Wed Oct 29 15:54:47 2025 -0400 arm64: dts: imx8qxp-mek: Add lpuart1 to support the M.2 PCIE9098 bluetooth Add the lpuart1 dts node to support the PCIE9098 bluetooth on M.2 connector. Signed-off-by: Sherry Sun Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit b85104933a0e7f19b6853820726275fb0f56b031 Author: Joy Zou Date: Wed Oct 29 15:54:45 2025 -0400 arm64: dts: imx8: add edma error interrupt support Add edma error interrupt for i.MX8QM, i.MX8QXP and i.MX8DXL. Signed-off-by: Joy Zou Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 0e2dbdcfadbc9060386e631fc3141922d1660cf5 Author: Frank Li Date: Wed Oct 29 15:54:44 2025 -0400 arm64: dts: imx8qxp-mek: add fec2 support Add fec2 and related nodes. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit f4dcaab01b335cd70c75b5440bccf664df8f0499 Author: Frank Li Date: Wed Oct 29 15:54:43 2025 -0400 arm64: dts: imx8qxp-mek: add phandle ocotp mac-address for fec Add phandle to the OCOTP mac-address nodes so the FEC can obtain a fixed MAC address specific to each board. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 339cd3056b729a732f89d6daa983e5dd83a38440 Author: Frank Li Date: Wed Oct 29 15:54:42 2025 -0400 arm64: dts: imx8qxp-mek: add flexspi and flash Add flexspi and flash node. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 00f69e5f6df1a2046071672871d0b1ae180f934d Author: Frank Li Date: Wed Oct 29 15:54:41 2025 -0400 arm64: dts: imx8qxp-mek: update usdhc1 clock to 400Mhz Update usdhc1 clock to 400Mhz to support eMMC HS400. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 1c1e81ef393b841f2ac956a369abaa595e8c8f1d Author: Frank Li Date: Wed Oct 29 15:54:40 2025 -0400 arm64: dts: imx8qxp-mek: add state_100mhz and state_200mhz for usdhc default, state_100mhz and state_200mhz use the same settings. But current driver use these to indicate if sd3.0 support. Add SD gpio pin group (Reset, CD, WP) for usdhc2. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 6f90786d7342560c88c0f495706a75393c65c6ca Author: Frank Li Date: Wed Oct 29 15:54:39 2025 -0400 arm64: dts: imx8qxp: add wakeup source for power-key Add wakeup source property for power-key. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit a29a5a55969ec3e30b88923cd28c176611ee0a65 Author: Frank Li Date: Wed Oct 29 15:54:37 2025 -0400 arm64: dts: imx8qxp: add MAC address in ocotp Add MAC address nodes in ocotp. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 05a14dc3f6fdd4a0dcaa60df7e6230f22131ecf6 Author: Frank Li Date: Tue Oct 28 16:30:49 2025 -0400 arm64: dts: imx8qm-mek: replace space with tab Replace space with tab. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 9c70313efe262a1980cc73441f56b1527e5f6202 Author: Frank Li Date: Tue Oct 28 16:30:47 2025 -0400 arm64: dts: imx8qm-mek: add usbotg1 and related nodes Add usbotg1 and related nodes. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 5c9f27cd7e909a6aa21bab45ec54ebfeac683466 Author: Frank Li Date: Tue Oct 28 16:30:46 2025 -0400 arm64: dts: imx8qm-mek: add pmic thermal-zones Add pmic thermal-zones. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 70051810d063b768ea3750ca230bc7a96adffa14 Author: Frank Li Date: Tue Oct 28 16:30:45 2025 -0400 arm64: dts: imx8qm: add label thermal_zones Add label thermal_zones to prepare add pmic thermal zones. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit a8eebe6195234c01aa558da18be16ff2fb996feb Author: Frank Li Date: Tue Oct 28 16:30:44 2025 -0400 arm64: dts: imx8qm-mek: add lpuart1 and bluetooth node Add lpuart1 and bluetooth support. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 64b60a72801103b1c9d6f7d1529b4ff7521f7b68 Author: Frank Li Date: Tue Oct 28 16:30:43 2025 -0400 arm64: dts: imx8qm-mek: assign double SD bus frequency for usdhc1 Assign double SD bus frequency to support SDR104 mode, where the operating clock runs at 208 MHz. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 2984af793281bc269fc8de3a204400fbfdbe42a7 Author: Frank Li Date: Tue Oct 28 16:30:42 2025 -0400 arm64: dts: imx8qm-mek: add state_100mhz and state_200mhz for usdhc default, state_100mhz and state_200mhz use the same settings. But current driver use these to indicate if sd3.0 support. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit e58a4296807b24c271fb6677188d4b5ce49558cb Author: Andreas Kemnade Date: Tue Oct 28 16:00:36 2025 +0100 ARM: dts: imx: e70k02: add sy7636 Add the EPD PMIC for the e70k02 based devices as a step towards full EPD support. Acked-by: Alistair Francis Reviewed-by: Peng Fan Signed-off-by: Andreas Kemnade Signed-off-by: Shawn Guo commit 09b33db32e1df762feb64725a11d3eb9eab0b25f Author: Primoz Fiser Date: Tue Oct 28 12:58:20 2025 +0100 arm64: dts: freescale: imx93-phyboard-nash: Add pwm-fan overlay Add overlay to support PWM fan on the phyBOARD-Nash-i.MX93 board. Fan can be connected to the FAN (X48) connector on the board and will be controlled according to the following CPU temperature trips table: - bellow 50 degrees - fan is off (<1% duty cycle) - between 50 and 58 degrees - low fan speed (~35% duty cycle) - between 58 and 65 degrees - fan medium speed (~60% duty cycle) - above 65 degrees - fan at full speed (>99% duty cycle) The output frequency of PWM signal is set to 25 kHz. Signed-off-by: Primoz Fiser Reviewed-by: Alberto Merciai Signed-off-by: Shawn Guo commit af21bfd1f7ce1cc05d0ee2e698efba28e4cc6c6b Author: Primoz Fiser Date: Tue Oct 28 12:58:19 2025 +0100 arm64: dts: freescale: imx93-phyboard-nash: Add jtag overlay Add overlay to enable JTAG pins on the board's JTAG (X41) connector. Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit 3b0bf0659551e9df4f3d28a5ce92ea1c51f275a2 Author: Teresa Remmet Date: Tue Oct 28 09:58:13 2025 +0100 arm64: dts: imx8mm-phyboard-polis-peb-av-10: Fix audio codec reset pin ctl Enable internal pull up of the active low audio codec reset pin. Otherwise the audio codec does not reset properly and is not working. Signed-off-by: Teresa Remmet Signed-off-by: Jan Remmet Signed-off-by: Shawn Guo commit f7a77fb14c7fc2da5a5495bca35b63d7172fce3e Author: Jan Remmet Date: Tue Oct 28 09:58:12 2025 +0100 arm64: dts: imx8mm-phyboard-polis-peb-av-10-ph128800t006 Add support for powertip,ph128800t006-zhc01 connected via peb-av-10 Signed-off-by: Jan Remmet Signed-off-by: Shawn Guo commit 4f03fd6d95fd40496c17ea48053acfd61f4af31b Author: Jan Remmet Date: Tue Oct 28 09:58:11 2025 +0100 arm64: dts: imx8mm-phyboard-polis-peb-av-10: split display configuration The PEB-AV-10 board can be used with different displays or in audio-only mode. Split the device tree overlays to reflect these use cases. To use the board with the EDT ETML1010G3DRA display, the overlay imx8mm-phyboard-polis-peb-av-10-etml1010g3dra.dtbo must now be used instead of imx8mm-phyboard-polis-peb-av-10.dtbo. Signed-off-by: Jan Remmet Signed-off-by: Shawn Guo commit c277c95959eca255409c33e392712dd366b5095d Author: Jan Remmet Date: Tue Oct 28 09:58:10 2025 +0100 arm64: dts: imx8mm-phyboard-polis-peb-av-10: reorder properties to match dts coding style Sort properties. Rename regulator label to match schematics. Signed-off-by: Jan Remmet Signed-off-by: Shawn Guo commit 4b73a1bd864208b6db66ffd534b3a67fd574469e Author: Jan Remmet Date: Tue Oct 28 09:58:09 2025 +0100 arm64: dts: imx8mm-phyboard-polis: move mipi bridge to som sn65dsi83 is mounted on som. Add the static configuration there. So it can be used by other boards too. Use mipi_dsi_out from imx8mm.dtsi directly. Signed-off-by: Jan Remmet Signed-off-by: Shawn Guo commit aab882780ab1aad9e89c3cab8cb374a0a03aa75b Author: Jan Remmet Date: Tue Oct 28 09:58:08 2025 +0100 arm64: dts: imx8mm-phyboard-polis: Use GPL-2.0-or-later OR MIT Update license and remove individual authorship. Signed-off-by: Jan Remmet Acked-by: Teresa Remmet Signed-off-by: Shawn Guo commit 33583fa58e431415c1b0a95e3d02988955373086 Author: Primoz Fiser Date: Tue Oct 28 05:32:44 2025 +0100 arm64: dts: freescale: Add phyBOARD-Segin-i.MX91 support Add initial support for the PHYTEC phyBOARD-Segin-i.MX91 board [1] based on the PHYTEC phyCORE-i.MX91 SoM (System-on-Module) [2]. Supported features: * Audio * CAN * eMMC * Ethernet * I2C * RTC * SD-Card * UART * USB For more details see the product pages for the development board and the SoM: [1] https://www.phytec.eu/en/produkte/development-kits/phyboard-segin-kit/ [2] https://www.phytec.eu/en/produkte/system-on-modules/phycore-imx-91-93/ Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit 21906e6f52b25340dc4c5de48a878c9ea7c13b72 Author: Primoz Fiser Date: Tue Oct 28 05:32:43 2025 +0100 dt-bindings: arm: fsl: Add PHYTEC phyBOARD-Segin-i.MX91 board Add device-tree bindings for PHYTEC phyBOARD-Segin-i.MX91 board based on the PHYTEC phyCORE-i.MX91 SoM (System-on-Module). Signed-off-by: Primoz Fiser Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit cd08d17f39b7b7c54bfa35437fa4cd4e144d8179 Author: Al Viro Date: Mon Feb 26 02:06:37 2024 -0500 convert selinuxfs Tree has invariant part + two subtrees that get replaced upon each policy load. Invariant parts stay for the lifetime of filesystem, these two subdirs - from policy load to policy load (serialized on lock_rename(root, ...)). All object creations are via d_alloc_name()+d_add() inside selinuxfs, all removals are via simple_recursive_removal(). Turn those d_add() into d_make_persistent()+dput() and that's mostly it. Acked-by: Paul Moore Reviewed-by: Stephen Smalley Tested-by: Stephen Smalley Signed-off-by: Al Viro commit d1e4a99358ea86854882ee325d4ceedd97f46e97 Author: Al Viro Date: Sat Oct 4 16:54:10 2025 -0400 selinuxfs: new helper for attaching files to tree allocating dentry after the inode has been set up reduces the amount of boilerplate - "attach this inode under that name and this parent or drop inode in case of failure" simplifies quite a few places. Acked-by: Paul Moore Reviewed-by: Stephen Smalley Tested-by: Stephen Smalley Signed-off-by: Al Viro commit d297622875f9bedd8c1105e1797040e0b8d19402 Author: Al Viro Date: Sun Sep 21 18:09:48 2025 -0400 selinuxfs: don't stash the dentry of /policy_capabilities Don't bother to store the dentry of /policy_capabilities - it belongs to invariant part of tree and we only use it to populate that directory, so there's no reason to keep it around afterwards. Same situation as with /avc, /ss, etc. There are two directories that get replaced on policy load - /class and /booleans. These we need to stash (and update the pointers on policy reload); /policy_capabilities is not in the same boat. Acked-by: Paul Moore Reviewed-by: Stephen Smalley Tested-by: Stephen Smalley Signed-off-by: Al Viro commit 7beafd51c4e11138e9ff848e3e6583cda748d50b Author: Al Viro Date: Mon May 13 22:02:44 2024 -0600 convert binfmt_misc removals are done with locked_recursive_removal(); switch creations to simple_start_creating()/d_make_persistent()/simple_done_creating() and take them to a helper (add_entry()), while we are at it - simpler control flow that way. Signed-off-by: Al Viro commit b85d6b24192463c9969ed6d3a111498af465275f Author: Al Viro Date: Thu May 9 12:44:53 2024 -0400 convert autofs creation/removal is via normal VFS paths; make ->mkdir() and ->symlink() use d_make_persistent(); ->rmdir() and ->unlink() - d_make_discardable() instead of dput() and that's it. d_make_persistent() works for unhashed just fine... Note that only persistent dentries are ever hashed there; unusual absense of ->d_delete() in dentry_operations is due to that - anything that has refcount reach 0 will be unhashed there, so it won't get to checking ->d_delete anyway. Signed-off-by: Al Viro commit 4c7d25094f5caa145d5e574d64fdad784caecfdf Author: Al Viro Date: Thu May 9 12:42:45 2024 -0400 autofs_{rmdir,unlink}: dentry->d_fsdata->dentry == dentry there Signed-off-by: Al Viro commit b89aa544821d5018002829fce5d10c9d00cc567f Author: Al Viro Date: Sun Mar 10 15:26:05 2024 -0400 convert binderfs Objects are created either by d_alloc_name()+d_add() (in binderfs_ctl_create()) or by simple_start_creating()+d_instantiate(). Removals are by simple_recurisive_removal(). Switch d_add()/d_instantiate() to d_make_persistent() + dput(). Voila - kill_litter_super() is not needed anymore. Fold dput()+unlocking the parent into simple_done_creating(), while we are at it. NOTE: return value of binderfs_create_file() is borrowed; it may get stored in proc->binderfs_entry. See binder_release()... Signed-off-by: Al Viro commit 02da8d2c0965fe9183b6100e438a3aee8bc4e088 Author: Al Viro Date: Wed May 8 23:21:06 2024 -0400 binderfs_binder_ctl_create(): kill a bogus check It's called once, during binderfs mount, right after allocating root dentry. Checking that it hadn't been already called is only obfuscating things. Looks like that bogosity had been copied from devpts... Signed-off-by: Al Viro commit 185d241c884401a455cfef808ebab633bf372b3a Author: Al Viro Date: Wed May 8 23:07:22 2024 -0400 binderfs: use simple_start_creating() binderfs_binder_device_create() gets simpler, binderfs_create_dentry() simply goes away... Signed-off-by: Al Viro commit b4a76faf9d960fd87cf03166aeab65a9d5aa9c83 Author: Al Viro Date: Mon Feb 26 02:34:49 2024 -0500 convert devpts Two kinds of objects there - ptmx and everything else (pty). The former is created on mount and kept until the fs shutdown; the latter get created and removed by tty layer (the references are borrowed into tty->driver_data). The reference to ptmx dentry is also kept, but we only ever use it to find ptmx inode on remount. * turn d_add() into d_make_persistent() + dput() both in mknod_ptmx() and in devpts_pty_new(). * turn dput() to d_make_discardable() in devpts_pty_kill(). * switch mknod_ptmx() to simple_{start,done}_creating(). * instead of storing in pts_fs_info a reference to ptmx dentry, store a reference to its inode, seeing that this is what we use it for. Signed-off-by: Al Viro commit b83431564db66cd854954a43e27bfd26b09575ea Author: Al Viro Date: Mon May 13 21:12:00 2024 -0600 ibmasmfs: get rid of ibmasmfs_dir_ops it is always equal (and always had been equal) to &simple_dir_operations Signed-off-by: Al Viro commit e6ef35deec697cb7f6d3b424808c135071a8729b Author: Al Viro Date: Mon Feb 26 02:06:37 2024 -0500 convert ibmasmfs static contents for each "service processor", whatever the fuck it is. Congruent subdirectories of root, created at mount time, taken out by kill_litter_super(). All dentries created with d_alloc_name() and are left pinned. The odd part is that the list of service providers is assumed to be unchanging - no locking, nothing to handle removals or extra elements added later on. ... and it's a PCI device. If you ever tell it to remove an instance, you are fucked - it doesn't bother with removing its directory from filesystem, it has a strange check that presumably wanted to be a check for removed devices, but it had never been fleshed out. Anyway, d_add() -> d_make_persistent()+dput() in ibmasmfs_create_dir() and ibmasmfs_create_file(), and make the latter return int - no need to even borrow that dentry, callers completely ignore it. Signed-off-by: Al Viro commit ea800a515f2530bec0d56ea27faccb7909795e60 Author: Al Viro Date: Thu May 9 16:40:13 2024 -0400 convert spufs have spufs_new_file() use d_make_persistent() instead of d_add() and do an uncondition dput() in the caller; the rest is completely straightforward. [a braino in spufs_mkgang() fixed] Signed-off-by: Al Viro commit e11e247608585fef489f1dbb4d73eec456c8d4a5 Author: Al Viro Date: Mon Feb 26 01:27:23 2024 -0500 convert efivarfs Initially filesystem is populated with d_alloc_name() + d_add(). That becomes d_alloc_name() + d_make_persistent() + dput(). Dynamic creation is switched to d_make_persistent(); removal - to simple_unlink() (no point open-coding it in efivarfs_unlink(), better call it there) Signed-off-by: Al Viro commit 0703b36e4e1cee524cabdefab927896022300195 Author: Al Viro Date: Fri Sep 19 18:58:42 2025 -0400 debugfs: remove duplicate checks in callers of start_creating() we'd already verified that DEBUGFS_ALLOW_API was there in start_creating() - it would've failed otherwise Acked-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit ebb54484c3dfcd0ab63e1cec9c115f9ffa827461 Author: Al Viro Date: Mon May 13 15:19:05 2024 -0600 convert debugfs similar to tracefs - simulation of normal codepath for creation, simple_recursive_removal() for removal. Acked-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit 50d7fd3c3a3e6e14f618f28bd16ef7a9cfd02e90 Author: Al Viro Date: Wed May 8 23:51:40 2024 -0400 convert tracefs A mix of persistent and non-persistent dentries in there. Strictly speaking, no need for kill_litter_super() anyway - it pins an internal mount whenever a persistent dentry is created, so at fs shutdown time there won't be any to deal with. However, let's make it explicit - replace d_instantiate() with d_make_persistent() + dput() (the latter in tracefs_end_creating(), where it folds with inode_unlock() into simple_done_creating()) for dentries we want persistent and have d_make_discardable() done either by simple_recursive_removal() (used by tracefs_remove()) or explicitly in eventfs_remove_events_dir(). Acked-by: Steven Rostedt (Google) Signed-off-by: Al Viro commit eec876df5e7647bca03b72e0bcecb2e8bf0390a5 Author: Al Viro Date: Thu May 9 03:01:37 2024 -0400 convert pstore object creation by d_alloc_name()+d_add() in pstore_mkfile(), removal - via normal VFS codepaths (with ->unlink() using simple_unlink()) or in pstore_put_backend_records() via locked_recursive_removal() Replace d_add() with d_make_persistent()+dput() - that's what really happens there. The reference that goes into record->dentry is valid only until the unlink (and explicitly cleared by pstore_unlink()). Reviewed-by: Kees Cook Signed-off-by: Al Viro commit 5a8993a15a79f03cd1a43ddc071d0e49a1247cd5 Author: Al Viro Date: Thu May 9 01:07:01 2024 -0400 convert fuse_ctl objects are created in fuse_ctl_add_dentry() by d_alloc_name()+d_add(), removed by simple_remove_by_name(). What we return is a borrowed reference - it is valid until the call of fuse_ctl_remove_conn() and we depend upon the exclusion (on fuse_mutex) for safety. Return value is used only within the caller (fuse_ctl_add_conn()). Replace d_add() with d_make_persistent() + dput(). dput() is paired with d_alloc_name() and return value is the result of d_make_persistent(). Acked-by: Miklos Szeredi Signed-off-by: Al Viro commit ae1fde9038f333adab4be8283410ddc8570931c9 Author: Al Viro Date: Thu May 9 01:26:44 2024 -0400 convert dlmfs All modifications via normal VFS codepaths; just take care of making persistent in ->create() and ->mkdir() and that's it (removal side doesn't need any changes, since it uses simple_rmdir() for ->rmdir() and calls simple_unlink() from ->unlink()). Signed-off-by: Al Viro commit c5055286f88fdedcff9c974b4b85fbe221bf0972 Author: Al Viro Date: Thu May 9 12:26:53 2024 -0400 convert bpf object creation goes through the normal VFS paths or approximation thereof (user_path_create()/done_path_create() in case of bpf_obj_do_pin(), open-coded simple_{start,done}_creating() in bpf_iter_link_pin_kernel() at mount time), removals go entirely through the normal VFS paths (and ->unlink() is simple_unlink() there). Enough to have bpf_dentry_finalize() use d_make_persistent() instead of dget() and we are done. Convert bpf_iter_link_pin_kernel() to simple_{start,done}_creating(), while we are at it. Signed-off-by: Al Viro commit 1e508e05dd087b182143d9f55809e7feca662fb7 Author: Al Viro Date: Mon Feb 26 01:46:35 2024 -0500 convert mqueue All modifications via normal VFS codepaths; just take care of making persistent in in mqueue_create_attr() and discardable in mqueue_unlink() and it doesn't need kill_litter_super() at all. mqueue_unlink() side is best handled by having it call simple_unlink() rather than duplicating its guts... Signed-off-by: Al Viro commit 50889f533f69eeccbde48886a283726bb66d405c Author: Al Viro Date: Mon Feb 26 01:40:22 2024 -0500 convert hugetlbfs Very much ramfs-like; dget()+d_instantiate() -> d_make_persistent() (in two places) is all it takes. NB: might make sense to turn its ->put_super() into ->kill_sb(). Signed-off-by: Al Viro commit bdd80b5c1b35eb727a5065369ae5f45791f2a9cd Author: Al Viro Date: Mon Feb 26 02:07:09 2024 -0500 convert smackfs Entirely static tree populated by simple_fill_super(). Can use kill_anon_super() as-is. Acked-by: Casey Schaufler Signed-off-by: Al Viro commit 153f99a45a833fcbbddd51730bd34b85fa3ca5db Author: Al Viro Date: Mon Feb 26 01:41:34 2024 -0500 convert xenfs entirely static tree, populated by simple_fill_super(). Can switch to kill_anon_super() without any other changes. Signed-off-by: Al Viro commit b1494e6bc47c18df9c759445fb03764a3bdb7ec3 Author: Al Viro Date: Sun Mar 9 23:54:44 2025 -0400 configfs, securityfs: kill_litter_super() not needed These are guaranteed to be empty by the time they are shut down; both are single-instance and there is an internal mount maintained for as long as there is any contents. Both have that internal mount pinned by every object in root. In other words, kill_litter_super() boils down to kill_anon_super() for those. Reviewed-by: Joel Becker Acked-by: Paul Moore (LSM) Acked-by: Andreas Hindborg (configfs) Signed-off-by: Al Viro commit 23cbc7a795853bc7a8d0512b7c686ef879f6e909 Author: Al Viro Date: Mon Feb 26 01:55:36 2024 -0500 procfs: make /self and /thread_self dentries persistent ... and there's no need to remember those pointers anywhere - ->kill_sb() no longer needs to bother since kill_anon_super() will take care of them anyway and proc_pid_readdir() only wants the inumbers, which we had in a couple of static variables all along. Signed-off-by: Al Viro commit 2313598222f9d9d737f2db725334d000ffaff809 Author: Al Viro Date: Mon Feb 26 01:25:24 2024 -0500 convert ramfs and tmpfs Quite a bit is already done by infrastructure changes (simple_link(), simple_unlink()) - all that is left is replacing d_instantiate() + pinning dget() (in ->symlink() and ->mknod()) with d_make_persistent(), and, in case of shmem, using simple_unlink() and simple_link() in ->unlink() and ->link() resp., instead of open-coding those there. Since d_make_persistent() accepts (and hashes) unhashed ones, shmem situation gets simpler - we no longer care whether ->lookup() has hashed the sucker. With that done, we don't need kill_litter_super() for these filesystems anymore - by the umount time all remaining dentries will be marked persistent and kill_litter_super() will boil down to call of kill_anon_super(). The same goes for devtmpfs and rootfs - they are handled by ramfs or by shmem, depending upon config. NB: strictly speaking, both devtmpfs and rootfs ought to use ramfs_kill_sb() if they end up using ramfs; that's a separate story and the only impact of "just use kill_{litter,anon}_super()" is that we fail to free their sb->s_fs_info... on reboot. That's orthogonal to the changes in this series - kill_litter_super() is identical to kill_anon_super() for those at this point. Signed-off-by: Al Viro commit e49ce25855532573c28fc403058d2b223048675e Author: Al Viro Date: Mon Mar 3 20:29:46 2025 -0500 convert simple_{link,unlink,rmdir,rename,fill_super}() to new primitives Note that simple_unlink() et.al. are used by many filesystems; for now they can not assume that persistency mark will have been set back when the object got created. Once all conversions are done we'll have them complain if called for something that had not been marked persistent. Signed-off-by: Al Viro commit bacdf1d70bbe2027619c7bbbe48b379a806a9678 Author: Al Viro Date: Mon Mar 3 19:38:04 2025 -0500 primitives for maintaining persisitency * d_make_persistent(dentry, inode) - bump refcount, mark persistent and make hashed positive. Return value is a borrowed reference to dentry; it can be used until something removes persistency (at the very least, until the parent gets unlocked, but some filesystems may have stronger exclusion). * d_make_discardable() - remove persistency mark and drop reference. d_make_persistent() is similar to combination of d_instantiate(), dget() and setting flag. The only difference is that unlike d_instantiate() it accepts hashed and unhashed negatives alike. It is always called in strong locking environment (parent held exclusive, or, in some cases, dentry coming from d_alloc_name()); if we ever start using it with parent held only shared and dentry coming from d_alloc_parallel(), we'll need to copy the in-lookup logics from __d_add(). d_make_discardable() is eqiuvalent to combination of removing flag and dput(); since flag removal requires ->d_lock, there's no point trying to avoid taking that for refcount decrement as fast_dput() does. The slow path of dput() has been taken into a helper and reused in d_make_discardable() instead. Signed-off-by: Al Viro commit 8a210cacf5dc2a6210ee42aeca5cd03b2400876f Author: Al Viro Date: Mon Mar 3 19:15:35 2025 -0500 introduce a flag for explicitly marking persistently pinned dentries Some filesystems use a kinda-sorta controlled dentry refcount leak to pin dentries of created objects in dcache (and undo it when removing those). Reference is grabbed and not released, but it's not actually _stored_ anywhere. That works, but it's hard to follow and verify; among other things, we have no way to tell _which_ of the increments is intended to be an unpaired one. Worse, on removal we need to decide whether the reference had already been dropped, which can be non-trivial if that removal is on umount and we need to figure out if this dentry is pinned due to e.g. unlink() not done. Usually that is handled by using kill_litter_super() as ->kill_sb(), but there are open-coded special cases of the same (consider e.g. /proc/self). Things get simpler if we introduce a new dentry flag (DCACHE_PERSISTENT) marking those "leaked" dentries. Having it set claims responsibility for +1 in refcount. The end result this series is aiming for: * get these unbalanced dget() and dput() replaced with new primitives that would, in addition to adjusting refcount, set and clear persistency flag. * instead of having kill_litter_super() mess with removing the remaining "leaked" references (e.g. for all tmpfs files that hadn't been removed prior to umount), have the regular shrink_dcache_for_umount() strip DCACHE_PERSISTENT of all dentries, dropping the corresponding reference if it had been set. After that kill_litter_super() becomes an equivalent of kill_anon_super(). Doing that in a single step is not feasible - it would affect too many places in too many filesystems. It has to be split into a series. Here we * introduce the new flag * teach shrink_dcache_for_umount() to handle it (i.e. remove and drop refcount on anything that survives to umount with that flag still set) * teach kill_litter_super() that anything with that flag does *not* need to be unpinned. Next commits will add primitives for maintaing that flag and convert the common helpers to those. After that - a long series of per-filesystem patches converting to those primitives. Signed-off-by: Al Viro commit 1552ddc7fade1ae55af298580ef6c913b8db74bc Author: Al Viro Date: Fri Sep 19 17:46:01 2025 -0400 new helper: simple_done_creating() should be paired with simple_start_creating() - unlocks parent and drops dentry reference. Signed-off-by: Al Viro commit 4051a9115ad24bb9a691774730ca9c1dd56de665 Author: Al Viro Date: Wed Sep 17 22:19:10 2025 -0400 new helper: simple_remove_by_name() simple_recursive_removal(), but instead of victim dentry it takes parent + name. Used to be open-coded in fs/fuse/control.c, but there's no need to expose the guts of that thing there and there are other potential users, so let's lift it into libfs... Acked-by: Miklos Szeredi Signed-off-by: Al Viro commit 798a401660a151633cb171738a72a8f1efb9b0b4 Author: Al Viro Date: Sat Oct 25 18:13:48 2025 -0400 tracefs: fix a leak in eventfs_create_events_dir() If we have LOCKDOWN_TRACEFS, the function bails out - *after* having locked the parent directory and without bothering to undo that. Just check it before tracefs_start_creating()... Fixes: e24709454c45 "tracefs/eventfs: Add missing lockdown checks" Acked-by: Steven Rostedt (Google) Signed-off-by: Al Viro commit c460192aae197df1b4db1dca493c35ad529f1b64 Author: Al Viro Date: Sun Oct 26 02:38:43 2025 -0400 fuse_ctl_add_conn(): fix nlink breakage in case of early failure fuse_ctl_remove_conn() used to decrement the link count of root manually; that got subsumed by simple_recursive_removal(), but in case when subdirectory creation has failed the latter won't get called. Just move the modification of parent's link count into fuse_ctl_add_dentry() to keep the things simple. Allows to get rid of the nlink argument as well... Fixes: fcaac5b42768 "fuse_ctl: use simple_recursive_removal()" Acked-by: Miklos Szeredi Signed-off-by: Al Viro commit 2f185905da8a617ea9177f34ec6ee7a73f83109a Author: Dario Binacchi Date: Mon Oct 27 17:10:23 2025 +0100 ARM: dts: imx28-amarula-rmm: add I2S audio Add support for I2S audio on Amarula rmm board. Audio codec TLV320AIC3X is connected as slave to SAIF0, which provides bitclock, frame and MCLK. Co-developed-by: Michael Trimarchi Signed-off-by: Michael Trimarchi Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit 193c1baab081104916e061e97e7be7343e097399 Author: Dario Binacchi Date: Mon Oct 27 17:10:24 2025 +0100 ARM: mxs_defconfig: enable sound drivers for imx28-amarula-rmm Enable TLV320AIC3X I2C codec and simple-card support used on Amarula rmm board. Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit ef2429fe38a6cd9477871aa322347be352ad41a3 Author: João Paulo Gonçalves Date: Mon Oct 27 09:17:53 2025 -0300 arm64: defconfig: Enable i.MX95 drivers for pinctrl, Ethernet and PCIe Enable i.MX95 pinctrl driver necessary for booting. Also enable the missing drivers required for Ethernet and PCIe functionality. These drivers are used on i.MX95 boards, including the NXP i.MX95 19x19 EVK. The below configurations were enabled (listed with their DT nodes on imx95.dtsi): * CONFIG_PINCTRL_IMX_SCMI for the `scmi_iomuxc` pinctrl. * CONFIG_CLK_IMX95_BLK_CTL for the HSIO domain clock controller (`hsio_blk_ctl`) used by the PCIe controller. * CONFIG_NXP_NETC_BLK_CTRL for the NETC hardware domain controller (`netc_blk_ctrl`). * CONFIG_NXP_ENETC4 for the Ethernet controller (`enetc_port*`). Signed-off-by: João Paulo Gonçalves Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 4c9cf0b3f1b795e05606fa54888a2b4dced39d64 Author: Stefan Eichenberger Date: Mon Oct 27 10:30:11 2025 +0100 arm64: dts: imx8-apalis: use startup-delay-us for wifi regulator We used regulator-settling-time-us for the wifi regulator which is wrong for regulator-fixed. We have to use startup-delay-us instead. Signed-off-by: Stefan Eichenberger Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit aa6f6799f9091721b559d4872db9e199ba4069ba Author: Stefan Eichenberger Date: Mon Oct 27 10:30:10 2025 +0100 arm64: dts: imx8-apalis: rename wifi regulator Rename the wifi regulator to what is the net name in the schematic. Signed-off-by: Stefan Eichenberger Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit 4a5977155584f0f4f757f884ee992e97bfc0932c Author: Max Krummenacher Date: Mon Oct 27 10:30:09 2025 +0100 arm64: dts: imx8-apalis: specify adc reference voltage regulator This sets in_voltage_scale to calculate the measured voltage from the raw digital value of the ADC. Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit a2c79d55bd838b3d71e08e21f43b4b48cdc83c6f Author: Max Krummenacher Date: Mon Oct 27 10:30:08 2025 +0100 arm64: dts: imx8-apalis: add thermal nodes Add the thermal-zones and cooling-maps nodes for the PMIC device. Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit 53948d7f54201585d31de1feef8f80ba9e8ea374 Author: Max Krummenacher Date: Mon Oct 27 10:30:07 2025 +0100 arm64: dts: imx8-apalis: cleanup todo Functionality has been added without removing the associated TODO comments. Clean that up by removing TODOs no longer applicable. Signed-off-by: Max Krummenacher Reviewed-by: Daniel Baluta Signed-off-by: Shawn Guo commit b21f87b8322f4ce17ad49d521b0f03c986941156 Author: Shengjiu Wang Date: Tue Sep 23 13:30:01 2025 +0800 arm64: dts: imx8mp-evk: enable hdmi_pai device Enable hdmi_pai device. Aud2htx module, hdmi_pai and hdmi controller compose the hdmi audio pipeline. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Tested-by: Alexander Stein Signed-off-by: Shawn Guo commit 4677a3f84ce18dcd00d25982ccac627791c321dd Author: Shengjiu Wang Date: Tue Sep 23 13:30:00 2025 +0800 arm64: dts: imx8mp: Add hdmi parallel audio interface node The HDMI TX Parallel Audio Interface (HTX_PAI) is a bridge between the Audio Subsystem to the HDMI TX Controller. Shrink register map size of hdmi_pvi to avoid overlapped hdmi_pai device. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Tested-by: Alexander Stein Signed-off-by: Shawn Guo commit 78f316e90906d54c8aa6029e5c19ae83e420e56a Author: Michael Riesch Date: Fri Nov 14 16:20:24 2025 +0100 arm64: dts: rockchip: add vicap node to rk356x Add the device tree node for the RK356x Video Capture (VICAP) unit. Signed-off-by: Michael Riesch Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Link: https://patch.msgid.link/20240220-rk3568-vicap-v15-13-8f4915ee365d@collabora.com Signed-off-by: Heiko Stuebner commit d2da7e98c0bf7f75433809ad875c6e1ae57f0cea Author: Mehdi Djait Date: Fri Nov 14 16:20:23 2025 +0100 arm64: dts: rockchip: add the vip node to px30 Add the device tree node for the PX30 Video Input Processor (VIP). Signed-off-by: Mehdi Djait [added cosmetic changes] Signed-off-by: Michael Riesch Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Link: https://patch.msgid.link/20240220-rk3568-vicap-v15-12-8f4915ee365d@collabora.com Signed-off-by: Heiko Stuebner commit 60705b039f960378bb2a0a844f9378646bc0c6c8 Author: Michael Riesch Date: Fri Nov 14 16:20:22 2025 +0100 arm64: defconfig: enable rockchip camera interface The Rockchip Camera Interface (CIF) is featured in many Rockchip SoCs in different variations. Enable the driver for it in the default configuration. Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Link: https://patch.msgid.link/20240220-rk3568-vicap-v15-11-8f4915ee365d@collabora.com Signed-off-by: Heiko Stuebner commit 4e8cb8e0328a4b3ba17905f0051ac98ab709c3ab Author: Chukun Pan Date: Sat Nov 1 20:00:09 2025 +0800 arm64: dts: rockchip: fixes audio for 100ASK DshanPi A1 Correct the i2c address of the ES8388 chip and the gpio of hp_det pin. According to the schematic, the ES8388 chip is connected to the SoC's sai2 controller instead of sai1, fix it. Fixes: d809417c5a40 ("arm64: dts: rockchip: add DTs for 100ASK DShanPi A1") Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251101120010.41729-5-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit eaf661552b0f67278d8af4d42e6a5f97ceb0281f Author: Chukun Pan Date: Sat Nov 1 20:00:08 2025 +0800 arm64: dts: rockchip: fixes vcc3v3_s0 supply for 100ASK DshanPi A1 From the schematic, the supply of ES8388 chip and the vmmc-supply of SD card both originate from the VCC3V3_S0 regulator, fix it. Fixes: d809417c5a40 ("arm64: dts: rockchip: add DTs for 100ASK DShanPi A1") Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251101120010.41729-4-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 28b53b35c037c05bfedd28ef027e80a1b505f4aa Author: Antoni Pokusinski Date: Wed Nov 12 23:57:01 2025 +0100 iio: ABI: document pressure event attributes Add sysfs pressure event attributes exposed by the mpl3115 driver. These allow controlling the threshold value and the enable state. Reviewed-by: Marcelo Schmitt Signed-off-by: Antoni Pokusinski Signed-off-by: Jonathan Cameron commit 6062cd20cbea6006d30af50e6f7d2a8722baa81b Author: Antoni Pokusinski Date: Wed Nov 12 23:57:00 2025 +0100 iio: mpl3115: add threshold events support Add support for pressure and temperature rising threshold events. For both channels *_en and *_value (in raw units) attributes are exposed. Since in write_event_config() the ctrl_reg1.active and ctrl_reg4 are modified, accessing the data->ctrl_reg{1,4} in set_trigger_state() and write_event_config() needs to be now guarded by data->lock. Otherwise, it would be possible that 2 concurrent threads executing these functions would access the data->ctrl_reg{1,4} at the same time and then one would overwrite the other's result. Signed-off-by: Antoni Pokusinski Signed-off-by: Jonathan Cameron commit 47e4b1ca441cc4f1d9db13ff5e9b89e53aae0198 Author: Antoni Pokusinski Date: Wed Nov 12 23:56:59 2025 +0100 iio: mpl3115: use get_unaligned_be24() to retrieve pressure data The pressure measurement result is arranged as 20-bit unsigned value residing in three 8-bit registers. Hence, it can be retrieved using get_unaligned_be24() and by applying 4-bit shift. Reviewed-by: Marcelo Schmitt Signed-off-by: Antoni Pokusinski Signed-off-by: Jonathan Cameron commit 86ce2a29dd9a3564fd7be584c8bb7ced28f7ca02 Author: James Clark Date: Fri Nov 14 14:06:18 2025 +0000 perf script: Fix build by removing unused evsel_script() The evsel_script() function is unused since the linked commit. Fix the build by removing it. Fixes the following compilation error: static inline struct evsel_script *evsel_script(struct evsel *evsel) ^ builtin-script.c:347:36: error: unused function 'evsel_script' [-Werror,-Wunused-function] Fixes: 3622990efaab ("perf script: Change metric format to use json metrics") Signed-off-by: James Clark Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 0de73abe5f5c2b58d66d6dcb7d44df05b0f73684 Author: Liang Jie Date: Fri Nov 14 16:47:25 2025 +0800 iio: buffer: use dma_buf_unmap_attachment_unlocked() helper Replace open-coded dma_resv_lock()/dma_resv_unlock() around dma_buf_unmap_attachment() in iio_buffer_dmabuf_release() with the dma_buf_unmap_attachment_unlocked() helper. This aligns with the standard DMA-BUF API, avoids duplicating locking logic and eases future maintenance. No functional change. Reviewed-by: fanggeng Signed-off-by: Liang Jie Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit c76ba4b2644424b8dbacee80bb40991eac29d39e Author: Andy Shevchenko Date: Wed Nov 12 15:55:10 2025 +0100 iio: core: Replace lockdep_set_class() + mutex_init() by combined call Replace lockdep_set_class() + mutex_init() by combined call mutex_init_with_key(). Signed-off-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit b0e6871415b25f5e84a79621834e3d0c9d4627a6 Author: Andy Shevchenko Date: Wed Nov 12 15:55:09 2025 +0100 iio: core: Clean up device correctly on iio_device_alloc() failure Once we called device_initialize() we have to call put_device() on it. Refactor the code to make it in the right order. Fixes: fe6f45f6ba22 ("iio: core: check return value when calling dev_set_name()") Fixes: 847ec80bbaa7 ("Staging: IIO: core support for device registration and management") Signed-off-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit f5d203467a31798191365efeb16cd619d2c8f23a Author: Andy Shevchenko Date: Wed Nov 12 15:55:08 2025 +0100 iio: core: add missing mutex_destroy in iio_dev_release() Add missing mutex_destroy() call in iio_dev_release() to properly clean up the mutex initialized in iio_device_alloc(). Ensure proper resource cleanup and follows kernel practices. Found by code review. While at it, create a lockdep key before mutex initialisation. This will help with converting it to the better API in the future. Fixes: 847ec80bbaa7 ("Staging: IIO: core support for device registration and management") Fixes: ac917a81117c ("staging:iio:core set the iio_dev.info pointer to null on unregister under lock.") Signed-off-by: Andy Shevchenko Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron commit 15cc59ac954eb953252d5e98852569bf22ad5d8b Author: Jie Zhang Date: Fri Nov 7 02:20:06 2025 +0530 drm/msm/a6xx: Add support for Adreno 612 Add support for Adreno 612 GPU found in SM6150/QCS615 chipsets. A612 falls under ADRENO_6XX_GEN1 family and is a cut down version of A615 GPU. A612 has a new IP called Reduced Graphics Management Unit or RGMU which is a small state machine which helps to toggle GX GDSC (connected to CX rail) to implement IFPC feature. It doesn't support any other features of a full fledged GMU like clock control, resource voting to rpmh etc. So we need linux clock driver support like other gmu-wrapper implementations to control gpu core clock and gpu GX gdsc. This patch skips RGMU core initialization and act more like a gmu-wrapper case. Signed-off-by: Jie Zhang Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/686212/ Signed-off-by: Rob Clark commit 0ecad1964315bf171d4eb0874da65e3a7aeb1b3d Author: Jonathan Santos Date: Fri Nov 14 19:14:02 2025 -0300 iio: accel: adxl380: add support for ADXL318 and ADXL319 The ADXL318 and ADXL319 are low noise density, low power, 3-axis accelerometers based on ADXL380 and ADXL382, respectively. The main difference between the new parts and the existing ones are the absence of interrupts and events like tap detection, activity/inactivity, and free-fall detection. Other differences in the new parts are fewer power modes, basically allowing only idle and measurement modes, and the removal of the 12-bit SAR ADC path for the 3-axis signals (known as lower signal chain), being excluisive for the temperature sensor in the ADXL318/319. Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Santos Signed-off-by: Jonathan Cameron commit 839c3f75c263f4ecbb5b30f41a24b236321abb3a Author: Rob Clark Date: Tue Nov 4 14:02:45 2025 -0800 MAINTAINERS: Add Akhil as a reviewer for the Adreno driver Akhil should be getting tagged to review GPU patches. Cc: Akhil P Oommen Signed-off-by: Rob Clark Acked-by: Akhil P Oommen Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Patchwork: https://patchwork.freedesktop.org/patch/685650/ Signed-off-by: Rob Clark commit 89194773f5738a0617240ac92b190fbd553e58bc Author: Gopi Krishna Menon Date: Sat Oct 4 16:30:04 2025 +0530 drm/msm: Add NULL check in vm_op_enqueue() vm_op_enqueue() allocates an msm_vm_op struct with kmalloc, but the return value is not checked for NULL value which can be returned by kmalloc under low-memory conditions. This can result in NULL pointer dereference when the pointer is dereferenced. Add NULL check after the allocation and propagate -ENOMEM back to the caller in case of a failure. Signed-off-by: Gopi Krishna Menon Patchwork: https://patchwork.freedesktop.org/patch/678416/ Signed-off-by: Rob Clark commit 8775ebd25abcdedb6f3ddf1c3ad69277f9b76081 Author: Jonathan Santos Date: Fri Nov 14 19:13:55 2025 -0300 dt-bindings: iio: accel: adxl380: add new supported parts Include ADXL318 and ADXL319 accelerometers to the documentation. The ADXL318 is based on the ADXL380, while the ADXL319 is based on the ADXL382. However, the ADXL318/319 do not support some built-in features like single tap, double tap and triple tap detection, and also activity and inactivity detection. Signed-off-by: Jonathan Santos Acked-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 93a8cb5b69c92e3ad173ed6dba3796bb2976ccbe Author: Igor Reznichenko Date: Fri Nov 14 23:31:34 2025 -0800 MAINTAINERS: Add entry for ST TSC1641 driver Add myself as maintainer for the TSC1641 driver Signed-off-by: Igor Reznichenko Link: https://lore.kernel.org/r/20251115073134.1345535-1-igor@reznichenko.net Signed-off-by: Guenter Roeck commit 5bcc5786a0cfa9249ccbe539833040a6285d0de3 Author: Haotian Zhang Date: Wed Nov 5 16:42:20 2025 +0800 watchdog: starfive: Fix resource leak in probe error path If pm_runtime_put_sync() fails after watchdog_register_device() succeeds, the probe function jumps to err_exit without unregistering the watchdog device. This leaves the watchdog registered in the subsystem while the driver fails to load, resulting in a resource leak. Add a new error label err_unregister_wdt to properly unregister the watchdog device. Fixes: 8bc22a2f1bf0 ("watchdog: starfive: Check pm_runtime_enabled() before decrementing usage counter") Signed-off-by: Haotian Zhang Reviewed-by: Wim Van Sebroeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6fbf541520025ca1825aa689fefb6c6fd818329c Author: Christian Marangi Date: Mon Sep 29 13:49:13 2025 +0200 dt-bindings: watchdog: airoha: Add support for Airoha AN7583 SoC Add compatible for Airoha AN7583 SoC. The implementation is exactly the same of Airoha EN7581 hence we add the compatible in addition to EN7581 ones. Signed-off-by: Christian Marangi Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 26f2f5ed164ab6d459c7b9b94af86d45d4131178 Author: Aleksander Jan Bajkowski Date: Mon Oct 27 22:06:57 2025 +0100 dt-bindings: watchdog: lantiq,wdt: convert bindings to dtschema Convert the Lantiq WDT Watchdog bindings to yaml format. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a8c762cbd120d5eadb766bbfefbe56980f2a7332 Author: Heiko Stuebner Date: Wed Oct 22 00:33:08 2025 +0200 dt-bindings: watchdog: Add RK3506 compatible The watchdog used on the RK3506 is still the same snps,dw-wdt compatible one that is in use since the RK3066 days, so add the RK3506 to the variant list. Signed-off-by: Heiko Stuebner Acked-by: Conor Dooley pw-bot: not-applicable Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit aa33a6c8ce00597b281d36f3e0a95590b5e016a9 Author: Jingyi Wang Date: Wed Sep 24 16:24:22 2025 -0700 dt-bindings: watchdog: Document Qualcomm Kaanapali watchdog Add devicetree binding for watchdog present on Qualcomm Kaanapali SoC. Signed-off-by: Jingyi Wang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 25c0b472eab8379683d4eef681185c104bed8ffd Author: Haotian Zhang Date: Thu Nov 13 10:30:32 2025 +0800 watchdog: wdat_wdt: Fix ACPI table leak in probe function wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but never calls acpi_put_table() on any paths. This causes a permanent ACPI table memory leak. Add a single cleanup path which calls acpi_put_table() to ensure the ACPI table is always released. Fixes: 058dfc767008 ("ACPI / watchdog: Add support for WDAT hardware watchdog") Suggested-by: Guenter Roeck Signed-off-by: Haotian Zhang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e0c50cddbd942338cbd6029ddbbcef4268a30718 Author: Binbin Zhou Date: Fri Nov 7 14:01:51 2025 +0800 watchdog: loongson1: Add Loongson-2k0300 watchdog support According to the manual, the Loongson-2K0300 watchdog is similar to the Loongson-1, except for some register offsets and inconsistent register bit definitions. Separate definitions via driver_data suffice. Co-developed-by: Xiaochuang Mao Signed-off-by: Xiaochuang Mao Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e4948e801129aa577cc4aa8b67c224fe5f037f77 Author: Binbin Zhou Date: Fri Nov 7 14:01:50 2025 +0800 dt-bindings: watchdog: loongson,ls1x-wdt: Add ls2k0300-wdt compatible Add "loongson,ls2k0300-wdt" compatible to the dt-schema document, which is similar to Loongson-1 watchdog, but with differences in some register offsets and bit definitions. Signed-off-by: Binbin Zhou Acked-by: Conor Dooley pw-bot: not-applicable Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 9d8ca99d60a1f058c6aba0241c00550ec8356119 Author: Binbin Zhou Date: Fri Nov 7 14:01:29 2025 +0800 watchdog: loongson1: Drop CONFIG_OF The general recommendation is to not use of_match_ptr() or CONFIG_OF ifdef. Drop them. Signed-off-by: Binbin Zhou Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6121d0b8891a67b6a2924ace6caae364438ab5d7 Author: Binbin Zhou Date: Fri Nov 7 14:01:28 2025 +0800 watchdog: loongson1: Simplify ls1x_wdt_probe code Remove meaningless output to simplify ls1x_wdt_probe(). Signed-off-by: Binbin Zhou Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f909b3d4f1abc87486c3ff3b71b0df4bd862d9df Author: Binbin Zhou Date: Fri Nov 7 14:01:27 2025 +0800 watchdog: loongson1: Add missing MODULE_PARM_DESC Add documentation for module_param so that they're visible with modinfo command. Signed-off-by: Binbin Zhou Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f0a4bf61f1a6080d0d2452c7d19066eba0e227b7 Author: Zoe Gates Date: Mon Oct 27 22:14:50 2025 -0500 watchdog/diag288: Fix module comment typos Correct spelling and capitalizaion in the header comment so the documentation reads cleanly. Signed-off-by: Zoe Gates Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a742d1713c34dff992d1273f614548d214ba1550 Author: Jack Hsu Date: Tue Nov 11 14:59:20 2025 +0800 dt-bindings: watchdog: Support MediaTek MT8189 wdt modify dt-binding for support mt8189 dts node of wdt Signed-off-by: Jack Hsu Acked-by: Conor Dooley Acked-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 26d21c835ff049ff6aa11ff33d2a3d61f3ad73e2 Author: Louis-Alexis Eyraud Date: Thu Oct 30 08:40:07 2025 +0100 dt-bindings: watchdog: mediatek,mtk-wdt: Add compatible for MT8189 SoC Add compatible string for the watchdog block on MT8189 SoC, which is compatible with the one used on MT6589. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley pw-bot: not-applicable Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 550d1bda39828bf72e2dc71318a1ee8d47df22d3 Author: Krzysztof Kozlowski Date: Mon Oct 20 18:52:22 2025 +0200 dt-bindings: mfd: rohm,bd96801-pmic: Correct timeout-sec length and reference watchdog schema The parent node of ROHM BD96801 PMIC is also holding properties for the watchdog, thus it should reference watchdog.yaml schema. OTOH, the timeout-sec property is used only as one number. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring (Arm) Acked-by: Matti Vaittinen Acked-by: Lee Jones Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 017bca91639f01302382013033b685ec8759aba4 Author: Krzysztof Kozlowski Date: Mon Oct 20 18:52:21 2025 +0200 dt-bindings: watchdog: Allow node names named 'pmic' Watchdog is often part of more complex devices like Power Management ICs (PMIC), e.g. on rohm,bd96801, and the schema can be referenced by a binding describing parent (main) node. Allow another typical name for such PMIC devices: pmic. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Acked-by: Rob Herring (Arm) Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 091713596371358e45e1705714bec21d84f0e37b Author: Krzysztof Kozlowski Date: Mon Oct 20 18:52:20 2025 +0200 dt-bindings: watchdog: Restrict timeout-sec to one number Linux kernel expects only one number for the watchdog timeout and the type is an array (defined in property-units.yaml in DT schema), so restrict the property. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring (Arm) Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit babe81b06158da7e845d19fae0a9205baf2b211d Author: Wolfram Sang Date: Fri Oct 17 12:15:49 2025 +0200 watchdog: renesas_wwdt: add driver This driver adds support for the Renesas Window Watchdog Timer (WWDT). Because it can only be setup once after boot and we cannot know if this already happened in early boot stages, it is mandated that the firmware configures the watchdog. Linux then adapts according to the given setup. Note that this watchdog only reports an overflow to the Error Control Module (ECM) and does not reset the SoC on its own. Signed-off-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ece1ad19c34eae869ea7afcd180c009e6f083b85 Author: Wolfram Sang Date: Fri Oct 17 12:15:48 2025 +0200 dt-bindings: watchdog: Add Renesas WWDT Describe the Window Watchdog Timer found on Renesas R-Car SoCs from late Gen3 onwards. Signed-off-by: Wolfram Sang Reviewed-by: Conor Dooley pw-bot: not-applicable Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fbd10d967045e8b2b6e0af2f00e546fe2d0f830d Author: Rob Herring (Arm) Date: Tue Oct 14 17:41:26 2025 -0500 dt-bindings: watchdog: Convert marvell,orion-wdt to DT schema Convert the Marvell Orion and Armada watchdog binding to DT schema format. It's a straight-forward conversion. Reviewed-by: Guenter Roeck Acked-by: Gregory CLEMENT Signed-off-by: Rob Herring (Arm) Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit af34a25336edf7f8978ee4066ac068d03dbe4e2f Author: Rob Herring (Arm) Date: Mon Oct 13 16:31:35 2025 -0500 dt-bindings: watchdog: Convert TI OMAP to DT schema Convert the TI OMAP watchdog binding to DT schema format. The compatible string list was incomplete. The "reg" and "interrupts" properties were missing. "ti,hwmods" is also deprecated and not required. Signed-off-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 13e86646710dd5e1ec68798ab44773e314612d83 Author: Chin-Ting Kuo Date: Fri Oct 10 16:03:15 2025 +0800 watchdog: aspeed: Add support for AST2700 platform Add AST2700 platform support to the ASPEED watchdog driver. This includes a new per-platform configuration with SCU reset status register at SCU1_070 and support for 5 reset mask registers. Signed-off-by: Chin-Ting Kuo Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0eb54296dc784de757724055983d32b03c9e2df1 Author: Chin-Ting Kuo Date: Fri Oct 10 16:03:14 2025 +0800 watchdog: aspeed: Support variable number of reset mask registers Starting from the AST2600 platform, the SoC design has become more complex, with an increased number of reset mask registers. To support this, introduce a new field 'num_reset_masks' in the 'aspeed_wdt_config' structure to specify the number of reset mask registers per platform. This change removes the need for hardcoded platform-specific logic and improves scalability for future SoCs. Signed-off-by: Chin-Ting Kuo Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b3bc229b54e780fe02a41ec65a0cb06acf7ac1d9 Author: Chin-Ting Kuo Date: Fri Oct 10 16:03:13 2025 +0800 dt-bindings: watchdog: aspeed,ast2400-wdt: Add support for AST2700 Add support for the AST2700 SoC in the ASPEED watchdog device tree bindings. This includes: - Adding "aspeed,ast2700-wdt" to the compatible string list. - Extending the "aspeed,reset-mask" property description for AST2700. - Defining AST2700-specific reset mask bits in aspeed-wdt.h, covering RESET1 to RESET5. Signed-off-by: Chin-Ting Kuo Reviewed-by: Rob Herring (Arm) Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 1cafd2a8508190eb2c4ae2a3cc62268866452c87 Author: Wolfram Sang Date: Thu Oct 9 12:45:03 2025 +0200 dt-bindings: watchdog: renesas,wdt: add SWDT exception for V3H The SWDT on V3H has no reset bit. Make resets optional on this SoC. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Rob Herring (Arm) Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit fcba2855251ffc83ffbddc9e42a0430578691884 Author: Wolfram Sang Date: Thu Oct 9 12:45:02 2025 +0200 dt-bindings: watchdog: factor out RZ/V2H(P) watchdog Renesas created different watchdog IPs but they are all handled in the same binding documentation. This leads to a lot of conditional handling which makes it unnecessarily hard to add new items. Factor out the RZ/V2H(P) watchdog to make handling easier. Reviewed-by: Guenter Roeck Reviewed-by: Lad Prabhakar Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 909c8ea1ad018a4a419ae8c0fb80439eb3ea94c0 Author: Wolfram Sang Date: Thu Oct 9 12:45:01 2025 +0200 dt-bindings: watchdog: factor out RZ/G2L watchdog Renesas created different watchdog IPs but they are all handled in the same binding documentation. This leads to a lot of conditional handling which makes it unnecessarily hard to add new items. Factor out the RZ/G2L watchdog to make handling easier. Reviewed-by: Guenter Roeck Reviewed-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a3e32b41c2ca023f809b3897c537a1aef62046b1 Author: Wolfram Sang Date: Thu Oct 9 12:45:00 2025 +0200 dt-bindings: watchdog: factor out RZ/N1 watchdog Renesas created different watchdog IPs but they are all handled in the same binding documentation. This leads to a lot of conditional handling which makes it unnecessarily hard to add new items. Factor out the RZ/N1 watchdog to make handling easier. Reviewed-by: Guenter Roeck Reviewed-by: Lad Prabhakar Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 055f0576e82a732bd5f8d2dd06ecad21eac13b59 Author: Wolfram Sang Date: Thu Oct 9 12:44:59 2025 +0200 dt-bindings: watchdog: factor out RZ/A watchdog Renesas created different watchdog IPs but they are all handled in the same binding documentation. This leads to a lot of conditional handling which makes it unnecessarily hard to add new items. Factor out the RZ/A watchdog to make handling easier. Reviewed-by: Guenter Roeck Reviewed-by: Lad Prabhakar Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7aa31ee9ec92915926e74731378c009c9cc04928 Author: Li Qiang Date: Sun Sep 28 16:33:32 2025 +0800 via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses allocate_resource() to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a name, which causes the kernel resource tree to contain an entry marked as "" under /proc/iomem on x86 platforms. During boot, this unnamed resource can lead to a critical hang because subsequent resource lookups and conflict checks fail to handle the invalid entry properly. Signed-off-by: Li Qiang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ce89e3e019f1ec4b11356f35feb8bd8c0f2c6bf7 Author: John Hubbard Date: Fri Nov 14 17:09:22 2025 -0800 gpu: nova-core: provide a clear error report for unsupported GPUs Pass in a PCI device to Spec::new(), and provide a Display implementation for boot42, in order to provide a clear, concise report of what happened: the driver read NV_PMC_BOOT42, and found that the GPU is not supported. For very old GPUs (older than Fermi), the driver still returns ENODEV, but it does so without a driver-specific dmesg report. That is exactly appropriate, because if such a GPU is installed, it can only be supported by Nouveau. And if so, the user is not helped by additional error messages from Nova. Here's the full dmesg output for a Blackwell (not yet supported) GPU: NovaCore 0000:01:00.0: Probe Nova Core GPU driver. NovaCore 0000:01:00.0: Unsupported chipset: boot42 = 0x1b2a1000 (architecture 0x1b, implementation 0x2) NovaCore 0000:01:00.0: probe with driver NovaCore failed with error -524 Cc: Alexandre Courbot Cc: Danilo Krummrich Cc: Timur Tabi Cc: Joel Fernandes Signed-off-by: John Hubbard [acourbot@nvidia.com: fix commit log with ENODEV (not ENOTSUPP) error code for unsupported GPUs.] Signed-off-by: Alexandre Courbot Message-ID: <20251115010923.1192144-5-jhubbard@nvidia.com> commit 0ecc08e2c450d9d3aebfc0c093db444d77557469 Author: John Hubbard Date: Fri Nov 14 17:09:21 2025 -0800 gpu: nova-core: add boot42 support for next-gen GPUs NVIDIA GPUs are moving away from using NV_PMC_BOOT_0 to contain architecture and revision details, and will instead use NV_PMC_BOOT_42 in the future. NV_PMC_BOOT_0 will contain a specific set of values that will mean "go read NV_PMC_BOOT_42 instead". Change the selection logic in Nova so that it will claim Turing and later GPUs. This will work for the foreseeable future, without any further code changes here, because all NVIDIA GPUs are considered, from the oldest supported on Linux (NV04), through the future GPUs. Add some comment documentation to explain, chronologically, how boot0 and boot42 change with the GPU eras, and how that affects the selection logic. Cc: Alexandre Courbot Cc: Danilo Krummrich Cc: Timur Tabi Reviewed-by: Joel Fernandes Signed-off-by: John Hubbard [acourbot@nvidia.com: remove unneeded `From for Revision` implementation.] Signed-off-by: Alexandre Courbot Message-ID: <20251115010923.1192144-4-jhubbard@nvidia.com> commit 4d980333a66341a764a64a29df668aac1cd6ec41 Author: John Hubbard Date: Fri Nov 14 17:09:20 2025 -0800 gpu: nova-core: make Architecture behave as a u8 type This allows Architecture to be passed into register!() and bitfield!() macro calls. That in turn requires a default implementation for Architecture. This simplifies transforming BOOT0 (and later, BOOT42) register values into GPU architectures. Cc: Danilo Krummrich Cc: Timur Tabi Suggested-by: Alexandre Courbot Reviewed-by: Joel Fernandes Signed-off-by: John Hubbard Signed-off-by: Alexandre Courbot Message-ID: <20251115010923.1192144-3-jhubbard@nvidia.com> commit df6137e263ee6ac3921f87321e784421eb64fb35 Author: John Hubbard Date: Fri Nov 14 17:09:19 2025 -0800 gpu: nova-core: prepare Spec and Revision types for boot0/boot42 Allow a both Revision and Spec to be constructed directly from a NV_PMC_BOOT_0 register. Also, slightly enhance the comment about Spec, to be more precise. Cc: Alexandre Courbot Cc: Danilo Krummrich Cc: Timur Tabi Reviewed-by: Joel Fernandes Signed-off-by: John Hubbard Signed-off-by: Alexandre Courbot Message-ID: <20251115010923.1192144-2-jhubbard@nvidia.com> commit 7d5864dc5d5ea6a35983dd05295fb17f2f2f44ce Author: Nicolas Ferre Date: Fri Nov 14 15:02:25 2025 +0100 ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 Unlike standalone spi peripherals, on sama5d2, the flexcom spi have fifo size of 32 data. Fix flexcom/spi nodes where this property is wrong. Fixes: 6b9a3584c7ed ("ARM: dts: at91: sama5d2: Add missing flexcom definitions") Cc: stable@vger.kernel.org # 5.8+ Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20251114140225.30372-1-nicolas.ferre@microchip.com Signed-off-by: Claudiu Beznea commit 13f85988d4fa31bda73a9504d71b10f7a14f1856 Author: Alistair Popple Date: Fri Nov 14 14:55:52 2025 -0500 gpu: nova-core: gsp: Retrieve GSP static info to gather GPU information After GSP initialization is complete, retrieve the static configuration information from GSP-RM. This information includes GPU name, capabilities, memory configuration, and other properties. On some GPU variants, it is also required to do this for initialization to complete. Signed-off-by: Alistair Popple Co-developed-by: Joel Fernandes Signed-off-by: Joel Fernandes Reviewed-by: Lyude Paul [acourbot@nvidia.com: properly abstract the command's bindings, add relevant methods, make str_from_null_terminated return an Option, fix size of GPU name array.] Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-14-joelagnelf@nvidia.com> commit 0e7d572b4baa64c582dafc4af36cfc8a4c3c1252 Author: Alistair Popple Date: Fri Nov 14 14:55:51 2025 -0500 gpu: nova-core: gsp: Wait for gsp initialization to complete This adds the GSP init done command to wait for GSP initialization to complete. Once this command has been received the GSP is fully operational and will respond properly to normal RPC commands. Signed-off-by: Alistair Popple Co-developed-by: Joel Fernandes Signed-off-by: Joel Fernandes Reviewed-by: Lyude Paul [acourbot@nvidia.com: move new definitions to end of commands.rs, rename to `wait_gsp_init_done` and remove timeout argument.] Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-13-joelagnelf@nvidia.com> commit 774109857b70e4af0908ce20d99e913ba5ba611a Author: Joel Fernandes Date: Fri Nov 14 14:55:50 2025 -0500 gpu: nova-core: sequencer: Implement core resume operation Implement core resume operation. This is the last step of the sequencer resulting in resume of the GSP and proceeding to INIT_DONE stage of GSP boot. Signed-off-by: Joel Fernandes Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-12-joelagnelf@nvidia.com> commit 9641f052230041cdf853357c07e77632b729113f Author: Joel Fernandes Date: Fri Nov 14 14:55:49 2025 -0500 gpu: nova-core: sequencer: Implement basic core operations These opcodes implement various falcon-related boot operations: reset, start, wait-for-halt. Signed-off-by: Joel Fernandes Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-11-joelagnelf@nvidia.com> commit e386680e8dbb37ff2973a2cbcf7124899e5359df Author: Joel Fernandes Date: Fri Nov 14 14:55:48 2025 -0500 gpu: nova-core: sequencer: Add delay opcode support Implement a sequencer opcode for delay operations. Signed-off-by: Joel Fernandes Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-10-joelagnelf@nvidia.com> commit 2367ce2e9e5eae3bfe72ed79a7fbd86936158569 Author: Joel Fernandes Date: Fri Nov 14 14:55:47 2025 -0500 gpu: nova-core: sequencer: Add register opcodes These opcodes are used for register write, modify, poll and store (save) sequencer operations. Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot [acourbot@nvidia.com: apply Lyude's suggested fixes.] Message-ID: <20251114195552.739371-9-joelagnelf@nvidia.com> commit 7ecb5c36b1360dd127e02e1d300dd07d764095cd Author: Javier Garcia Date: Mon Nov 10 17:52:14 2025 +0100 fbdev: gxt4500fb: Use dev_err instead of printk Signed-off-by: Javier Garcia Signed-off-by: Helge Deller commit e3f44742bbb10537fe53d83d20dea2a7c167674d Author: Rene Rebe Date: Fri Nov 14 16:00:42 2025 +0100 fbdev: gbefb: fix to use physical address instead of dma address While debuggigng why X would not start on mips64 Sgi/O2 I found the phys adress being off. Turns out the gbefb passed the internal dma_addr as phys. May be broken pre git history. Fix by converting dma_to_phys. Signed-off-by: René Rebe Cc: # v4.0+ Signed-off-by: Helge Deller commit b104df377da169913fe7cbfe409e1c52fdfa75c5 Author: Javier Garcia Date: Thu Oct 30 21:07:23 2025 +0100 fbdev: vesafb: Use dev_* fn's instead printk Family dev_* fn's will show device name, giving extra info to logs. Delete the prefix `vesafb:` from msg strings, not needed now, e.g.: vesa-framebuffer vesa-framebuffer.0: scrolling: redraw Signed-off-by: Javier Garcia Signed-off-by: Helge Deller commit 6c317ceefac0c8ac82002ce2923f692102e50c02 Author: Javier Garcia Date: Tue Oct 28 20:16:15 2025 +0100 fbdev: vga16fb: Request memory region This patch reserve and release VGA memory region. This align with Documentation/drm/todo.rst "Request memory regions in all fbdev drivers" I've tested with 32bits kernel and qemu. Signed-off-by: Javier Garcia Signed-off-by: Helge Deller commit b8a65b2d8b206cab339de8393f164482328c2bde Author: Vivek BalachandharTN Date: Thu Oct 16 10:54:46 2025 +0000 fbdev: vga16fb: replace printk() with dev_*() in probe Use dev_*() with &dev->dev and drop the hard-coded prefix. Keep original severities. No functional change. Signed-off-by: Vivek BalachandharTN Signed-off-by: Helge Deller commit 6ddfc892a529cb314e4708c5654beb0fa37e2071 Author: Joel Fernandes Date: Fri Nov 14 14:55:46 2025 -0500 gpu: nova-core: Implement the GSP sequencer Implement the GSP sequencer which culminates in INIT_DONE message being received from the GSP indicating that the GSP has successfully booted. This is just initial sequencer support, the actual commands will be added in the next patches. Signed-off-by: Joel Fernandes [acourbot@nvidia.com: move GspSequencerInfo definition before its impl blocks and rename it to GspSequence, adapt imports in sequencer.rs to new formatting rules, remove `timeout` argument to harmonize with other commands.] Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-8-joelagnelf@nvidia.com> commit 1f2353f5a1af995efbf7bea44341aa0d03460b28 Author: Michael Riesch Date: Fri Nov 14 16:20:21 2025 +0100 media: rockchip: rkcif: add support for rk3568 vicap mipi capture The RK3568 Video Capture (VICAP) unit features a MIPI CSI-2 capture interface. Add support for the MIPI capture interface in general and for the RK3568 VICAP MIPI capture in particular. Signed-off-by: Michael Riesch Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit c348d671697b556d2198c7d2e49e95390dc33e66 Author: Michael Riesch Date: Fri Nov 14 16:20:20 2025 +0100 media: rockchip: rkcif: add support for rk3568 vicap dvp capture The RK3568 Video Capture (VICAP) unit features a Digital Video Port (DVP). Add support for it. Tested-by: Gerald Loacker Reviewed-by: Gerald Loacker Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 75e28594624f68322c6eb052e5f4e8c0589d89a6 Author: Michael Riesch Date: Fri Nov 14 16:20:19 2025 +0100 media: rockchip: rkcif: add support for px30 vip dvp capture The PX30 Video Input Processor (VIP) unit features a Digital Video Port (DVP). Add support for the DVP in general and for the PX30 VIP DVP in particular. Tested-by: Gerald Loacker Reviewed-by: Gerald Loacker Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 501802e2ad517a1e2b9766e1b4e396b10f13f140 Author: Michael Riesch Date: Fri Nov 14 16:20:18 2025 +0100 media: rockchip: rkcif: add abstraction for dma blocks Add an abstraction for the DMA parts and the ping-pong scheme (a double-buffering mechanism) of the different CIF variants. Each stream is represented as V4L2 device whose corresponding media entity has one sink pad. This sink pad is connected to an instance of the INTERFACE/CROP abstraction. Tested-by: Gerald Loacker Reviewed-by: Gerald Loacker Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil [hverkuil: dropped deprecated vb2_ops_wait_prepare/finish callbacks] commit 85411d17bee99b0a99e983f37188f9cdacfded54 Author: Michael Riesch Date: Fri Nov 14 16:20:17 2025 +0100 media: rockchip: rkcif: add abstraction for interface and crop blocks Add an abstraction for the INTERFACE and CROP parts of the different Rockchip Camera Interface (CIF) variants. These parts are represented as V4L2 subdevice with one sink pad and one source pad. The sink pad is connected to a subdevice: either the subdevice provided by the driver of the companion chip connected to the DVP, or the subdevice provided by the MIPI CSI-2 receiver. The source pad is connected to V4l2 device(s) provided by one or many instance(s) of the DMA abstraction. Tested-by: Gerald Loacker Reviewed-by: Gerald Loacker Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit f53fb31a388901cfe11b95a3a2cf1594355321e4 Author: Michael Riesch Date: Fri Nov 14 16:20:16 2025 +0100 media: rockchip: add driver for the rockchip camera interface Add the skeleton for a media controller centric V4L2 driver for the Rockchip Camera Interface (CIF). The skeleton features support for the PX30 Video Input Processor (VIP) and the RK3568 Video Capture (VICAP) unit. Tested-by: Gerald Loacker Reviewed-by: Gerald Loacker Reviewed-by: Bryan O'Donoghue Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 60836eeca0fb27ad6a41bc2c303be80a0371447f Author: Michael Riesch Date: Fri Nov 14 16:20:15 2025 +0100 media: dt-bindings: add rockchip rk3568 vicap Add documentation for the Rockchip RK3568 Video Capture (VICAP) unit. Signed-off-by: Michael Riesch Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a36a0b28b94e86432239c4893e6fc2c39ce31a53 Author: Mehdi Djait Date: Fri Nov 14 16:20:14 2025 +0100 media: dt-bindings: add rockchip px30 vip Add documentation for the Rockchip PX30 Video Input Processor (VIP). Signed-off-by: Mehdi Djait [revised description] Reviewed-by: Rob Herring (Arm) Signed-off-by: Michael Riesch Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4a09126a33638945a1640e064ed73e983b51ae07 Author: Michael Riesch Date: Fri Nov 14 16:20:13 2025 +0100 media: dt-bindings: video-interfaces: add defines for sampling modes Add defines for the pixel clock sampling modes (rising edge, falling edge, dual edge) for parallel video interfaces. This avoids hardcoded constants in device tree sources. Acked-by: Rob Herring Signed-off-by: Michael Riesch Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1c5e4cf1d5d2e1089d8a26aded36e749b97527f0 Author: Michael Riesch Date: Fri Nov 14 16:20:12 2025 +0100 Documentation: admin-guide: media: add rockchip camera interface Add a document that describes the different variants of the Rockchip Camera Interface (CIF), their hardware layout, as well as their representation in the media controller centric rkcif device driver, which is located under drivers/media/platform/rockchip/rkcif. Reviewed-by: Heiko Stuebner Reviewed-by: Bryan O'Donoghue Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit eaf0989c77e434ce491b2ed70ef505d8cf1d1d4b Author: Joel Fernandes Date: Fri Nov 14 14:55:45 2025 -0500 gpu: nova-core: Add bindings required by GSP sequencer Add several firmware bindings required by GSP sequencer code. Co-developed-by: Alistair Popple Signed-off-by: Alistair Popple Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes [acourbot@nvidia.com: remove a couple stray lines/unwanted comment changes.] Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-7-joelagnelf@nvidia.com> commit f77be04d00d8ce403ecaf547f1515a844bbde060 Author: Joel Fernandes Date: Fri Nov 14 14:55:44 2025 -0500 gpu: nova-core: gsp: Add support for checking if GSP reloaded During the sequencer process, we need to check if GSP was successfully reloaded. Add functionality to check for the same. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-6-joelagnelf@nvidia.com> commit 0f2c8e278e9c6219c080d1e016cd72b07d50e444 Author: Joel Fernandes Date: Fri Nov 14 14:55:43 2025 -0500 gpu: nova-core: falcon: Move dma_reset functionality into helper Move dma_reset so we can use it for the upcoming sequencer functionality. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-5-joelagnelf@nvidia.com> commit 4f7656f79901dc00481b102c821705c992f7b982 Author: Joel Fernandes Date: Fri Nov 14 14:55:42 2025 -0500 gpu: nova-core: falcon: Move mbox functionalities into helper Move falcon reading/writing to mbox functionality into helper so we can use it from the sequencer resume flow. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes [acourbot@nvidia.com: make write/read mailbox methods unfallible.] Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-4-joelagnelf@nvidia.com> commit 2f1e88814ce1388c932e2c1c91e1e176c740154f Author: Jacopo Mondi Date: Fri Nov 14 21:19:20 2025 +0100 media: mali-c55: Mark pm handlers as __maybe_unused As the Mali-C55 driver is instrumented to work without depending on CONFIG_PM, mark the two pm_runtime handlers as __maybe_unused to suppress the compiler warning when compiling without CONFIG_PM. Signed-off-by: Jacopo Mondi Reviewed-by: Daniel Scally Signed-off-by: Hans Verkuil commit c5c0cfa67aa429b171676c6162f123adecb3a5ec Author: Joel Fernandes Date: Fri Nov 14 14:55:41 2025 -0500 gpu: nova-core: falcon: Move start functionality into separate helper Move start functionality into a separate helper so we can use it from the sequencer. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-3-joelagnelf@nvidia.com> commit 2d981773e14c1d7fc8f8e19a19d306d8372db571 Author: Joel Fernandes Date: Fri Nov 14 14:55:40 2025 -0500 gpu: nova-core: falcon: Move waiting until halted to a helper Move the "waiting until halted" functionality into a helper so that we can use it in the sequencer, which is a separate sequencer operation. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251114195552.739371-2-joelagnelf@nvidia.com> commit cffe9f58de1eb1a2cefce10c9512162fca3f7c89 Author: Naman Jain Date: Thu Nov 13 04:41:48 2025 +0000 Drivers: hv: Export some symbols for mshv_vtl MSHV_VTL driver is going to be introduced, which is supposed to provide interface for Virtual Machine Monitors (VMMs) to control Virtual Trust Level (VTL). Export the symbols needed to make it work (vmbus_isr, hv_context and hv_post_message). Co-developed-by: Roman Kisel Signed-off-by: Roman Kisel Co-developed-by: Saurabh Sengar Signed-off-by: Saurabh Sengar Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506110544.q0NDMQVc-lkp@intel.com/ Reviewed-by: Michael Kelley Signed-off-by: Naman Jain Signed-off-by: Wei Liu commit 796ef5a7fe86a8605f2844471ed7baa8e80bace8 Author: Naman Jain Date: Thu Nov 13 04:41:47 2025 +0000 static_call: allow using STATIC_CALL_TRAMP_STR() from assembly STATIC_CALL_TRAMP_STR() could not be used from .S files because static_call_types.h was not safe to include in assembly as it pulled in C types/constructs that are unavailable under __ASSEMBLY__. Make the header assembly-friendly by adding __ASSEMBLY__ checks and providing only the minimal definitions needed for assembly, so that it can be safely included by .S code. This enables emitting the static call trampoline symbol name via STATIC_CALL_TRAMP_STR() directly in assembly sources, to be used with 'call' instruction. Also, move a certain definitions out of __ASSEMBLY__ checks in compiler_types.h to meet the dependencies. No functional change for C compilation. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Naman Jain Signed-off-by: Wei Liu commit c91fe5f162f278d4aa960d06d2dbc42f9857593a Author: Muminul Islam Date: Thu Nov 13 11:45:33 2025 -0800 mshv: Extend create partition ioctl to support cpu features The existing mshv create partition ioctl does not provide a way to specify which cpu features are enabled in the guest. Instead, it attempts to enable all features and those that are not supported are silently disabled by the hypervisor. This was done to reduce unnecessary complexity and is sufficient for many cases. However, new scenarios require fine-grained control over these features. Define a new mshv_create_partition_v2 structure which supports passing the disabled processor and xsave feature bits through to the create partition hypercall directly. Introduce a new flag MSHV_PT_BIT_CPU_AND_XSAVE_FEATURES which enables the new structure. If unset, the original mshv_create_partition struct is used, with the old behavior of enabling all features. Co-developed-by: Jinank Jain Signed-off-by: Jinank Jain Signed-off-by: Muminul Islam Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit f91bc8f61abf0e1d23108ae9871c60d7612a09b2 Author: Magnus Kulke Date: Thu Nov 6 14:13:31 2025 -0800 mshv: Allow mappings that overlap in uaddr Currently the MSHV driver rejects mappings that would overlap in userspace. Some VMMs require the same memory to be mapped to different parts of the guest's address space, and so working around this restriction is difficult. The hypervisor itself doesn't prohibit mappings that overlap in uaddr, (really in SPA; system physical addresses), so supporting this in the driver doesn't require any extra work: only the checks need to be removed. Since no userspace code until now has been able to overlap regions in userspace, relaxing this constraint can't break any existing code. Signed-off-by: Magnus Kulke Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit ba9eb9b86d232854e983203dc2fb1ba18e316681 Author: Nuno Das Neves Date: Thu Nov 6 14:13:30 2025 -0800 mshv: Fix create memory region overlap check The current check is incorrect; it only checks if the beginning or end of a region is within an existing region. This doesn't account for userspace specifying a region that begins before and ends after an existing region. Change the logic to a range intersection check against gfns and uaddrs for each region. Remove mshv_partition_region_by_uaddr() as it is no longer used. Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Reported-by: Michael Kelley Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB41575BE0406D3AB22E1D7DB5D4C2A@SN6PR02MB4157.namprd02.prod.outlook.com/ Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 8ec6070fc8aca0fce6327d8b2cb8bd77adb155c9 Author: Marco Crivellari Date: Fri Nov 7 14:27:12 2025 +0100 mshv: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Wei Liu commit 22cb2f06fac9a05455eafa3ef3dc49ed7dedb240 Author: Rahul Kumar Date: Tue Nov 4 17:46:18 2025 +0530 Drivers: hv: Use kmalloc_array() instead of kmalloc() Documentation/process/deprecated.rst recommends against the use of kmalloc with dynamic size calculations due to the risk of overflow and smaller allocation being made than the caller was expecting. Replace kmalloc() with kmalloc_array() in hv_common.c to make the intended allocation size clearer and avoid potential overflow issues. The number of pages (pgcount) is bounded, so overflow is not a practical concern here. However, using kmalloc_array() better reflects the intent to allocate an array and improves consistency with other allocations. No functional change intended. Signed-off-by: Rahul Kumar Signed-off-by: Wei Liu commit 5f4b5edcb1a389b16b852fb30dcd435bfb1f8d23 Author: Stanislav Kinsburskii Date: Wed Oct 8 22:43:29 2025 +0000 Drivers: hv: Resolve ambiguity in hypervisor version log Update the log message in hv_common_init to explicitly state that the reported version is for the Microsoft Hypervisor, not the host OS. Previously, this message was accurate for guests running on Windows hosts, where the host and hypervisor versions matched. With support for Linux hosts running the Hyper-V hypervisor, the host OS and hypervisor versions may differ. This change avoids confusion by making it clear that the version refers to the Microsoft Hypervisor regardless of the host operating system. Signed-off-by: Stanislav Kinsburskii Reviewed-by: Nuno Das Neves Signed-off-by: Wei Liu commit 6626f815a1716259f161a4df8d105c9f0c8cbae9 Author: Kriish Sharma Date: Sat Oct 25 12:07:07 2025 +0000 Drivers: hv: fix missing kernel-doc description for 'size' in request_arr_init() Add missing kernel-doc entry for the @size parameter in request_arr_init(), fixing the following documentation warning reported by the kernel test robot and detected via kernel-doc: Warning: drivers/hv/channel.c:595 function parameter 'size' not described in 'request_arr_init' Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202503021934.wH1BERla-lkp@intel.com Signed-off-by: Kriish Sharma Reviewed-by: Easwar Hariharan Signed-off-by: Wei Liu commit 77c860d2dbb72d1f3c6a2e882a07d19eca399db5 Author: Mukesh Rathor Date: Mon Oct 6 15:42:08 2025 -0700 x86/hyperv: Enable build of hypervisor crashdump collection files Enable build of the new files introduced in the earlier commits and add call to do the setup during boot. Signed-off-by: Mukesh Rathor [ wei: fix build ] Signed-off-by: Wei Liu commit 94212d34618c2608758128da32ddac2ad834cb9f Author: Mukesh Rathor Date: Mon Oct 6 15:42:07 2025 -0700 x86/hyperv: Implement hypervisor RAM collection into vmcore Introduce a new file to implement collection of hypervisor RAM into the vmcore collected by linux. By default, the hypervisor RAM is locked, ie, protected via hw page table. Hyper-V implements a disable hypercall which essentially devirtualizes the system on the fly. This mechanism makes the hypervisor RAM accessible to linux. Because the hypervisor RAM is already mapped into linux address space (as reserved RAM), it is automatically collected into the vmcore without extra work. More details of the implementation are available in the file prologue. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit b0574ba75525c6b7e7448dd755d5cc09391478b1 Author: Mukesh Rathor Date: Mon Oct 6 15:42:06 2025 -0700 x86/hyperv: Add trampoline asm code to transition from hypervisor Introduce a small asm stub to transition from the hypervisor to Linux after devirtualization. Devirtualization means disabling hypervisor on the fly, so after it is done, the code is running on physical processor instead of virtual, and hypervisor is gone. This can be done by a root vm only. At a high level, during panic of either the hypervisor or the root, the NMI handler asks hypervisor to devirtualize. As part of that, the arguments include an entry point to return back to Linux. This asm stub implements that entry point. The stub is entered in protected mode, uses temporary gdt and page table to enable long mode and get to kernel entry point which then restores full kernel context to resume execution to kexec. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit e0a975ecd2e671664d208723476eeabb3baf08be Author: Mukesh Rathor Date: Mon Oct 6 15:42:05 2025 -0700 hyperv: Add definitions for hypervisor crash dump support Add data structures for hypervisor crash dump support to the hypervisor host ABI header file. Details of their usages are in subsequent commits. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 56c3feb3cc17b764f51191fd3dc461ab55a7b803 Author: Mukesh Rathor Date: Mon Oct 6 15:42:04 2025 -0700 hyperv: Add two new hypercall numbers to guest ABI public header In preparation for the subsequent crashdump patches, copy two hypercall numbers to the guest ABI header published by Hyper-V. One to notify hypervisor of an event that occurs in the root partition, other to ask hypervisor to disable the hypervisor. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 91a076d30450237181e474396e3128082d0ffe6e Author: Mukesh Rathor Date: Mon Oct 6 15:42:03 2025 -0700 x86/hyperv: Rename guest crash shutdown function Rename hv_machine_crash_shutdown to more appropriate hv_guest_crash_shutdown and make it applicable to guests only. This in preparation for the subsequent hypervisor root crash support patches. Signed-off-by: Mukesh Rathor Signed-off-by: Wei Liu commit 77c3a45a0f4866d4c36246abdf9633d3bde13f9e Author: Jiapeng Chong Date: Wed Oct 15 09:50:14 2025 +0800 x86: mshyperv: Remove duplicate asm/msr.h header ./arch/x86/kernel/cpu/mshyperv.c: asm/msr.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=26164 Signed-off-by: Jiapeng Chong Signed-off-by: Wei Liu commit 428ca2d4c6aa4124fb91580e5918f012d32ad4c4 Author: Long Li Date: Fri Oct 17 14:58:14 2025 -0700 MAINTAINERS: Add Long Li as a Hyper-V maintainer Also include MANA RDMA driver in the Hyper-V maintained list. Signed-off-by: Long Li Signed-off-by: Wei Liu commit d62313bdf5961b5f815f0b212f029cf146a8a804 Author: Jinank Jain Date: Fri Oct 10 14:55:51 2025 -0700 mshv: Introduce new hypercall to map stats page for L1VH partitions Introduce HVCALL_MAP_STATS_PAGE2 which provides a map location (GPFN) to map the stats to. This hypercall is required for L1VH partitions, depending on the hypervisor version. This uses the same check as the state page map location; mshv_use_overlay_gpfn(). Add mshv_map_vp_state_page() helpers to use this new hypercall or the old one depending on availability. For unmapping, the original HVCALL_UNMAP_STATS_PAGE works for both cases. Signed-off-by: Jinank Jain Signed-off-by: Nuno Das Neves Reviewed-by: Easwar Hariharan Signed-off-by: Wei Liu commit 19c515c27cee3bbba7e70a4d84f4b7e4d8d1cd7e Author: Jinank Jain Date: Fri Oct 10 14:55:50 2025 -0700 mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH Introduce mshv_use_overlay_gpfn() to check if a page needs to be allocated and passed to the hypervisor to map VP state pages. This is only needed on L1VH, and only on some (newer) versions of the hypervisor, hence the need to check vmm_capabilities. Introduce functions hv_map/unmap_vp_state_page() to handle the allocation and freeing. Signed-off-by: Jinank Jain Signed-off-by: Nuno Das Neves Reviewed-by: Praveen K Paladugu Reviewed-by: Easwar Hariharan Reviewed-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam Reviewed-by: Tianyu Lan Signed-off-by: Wei Liu commit fd612d97a458f0c44d1395e2def4fa719ec2ea48 Author: Purna Pavan Chandra Aekkaladevi Date: Fri Oct 10 14:55:49 2025 -0700 mshv: Get the vmm capabilities offered by the hypervisor Some hypervisor APIs are gated by feature bits in the "vmm capabilities" partition property. Store the capabilities on mshv_root module init, using HVCALL_GET_PARTITION_PROPERTY_EX. This is not supported on all hypervisors. In that case, just set the capabilities to 0 and proceed as normal. Signed-off-by: Purna Pavan Chandra Aekkaladevi Signed-off-by: Nuno Das Neves Reviewed-by: Praveen K Paladugu Reviewed-by: Easwar Hariharan Reviewed-by: Tianyu Lan Signed-off-by: Wei Liu commit 59aeea195948fd507cef2e439a5a964b8432750e Author: Purna Pavan Chandra Aekkaladevi Date: Fri Oct 10 14:55:48 2025 -0700 mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall This hypercall can be used to fetch extended properties of a partition. Extended properties are properties with values larger than a u64. Some of these also need additional input arguments. Add helper function for using the hypercall in the mshv_root driver. Signed-off-by: Purna Pavan Chandra Aekkaladevi Signed-off-by: Nuno Das Neves Reviewed-by: Anirudh Rayabharam Reviewed-by: Praveen K Paladugu Reviewed-by: Easwar Hariharan Reviewed-by: Tianyu Lan Signed-off-by: Wei Liu commit 9ebc528cfdada055984f919710c31be281cb717c Author: Nuno Das Neves Date: Fri Oct 10 14:55:47 2025 -0700 mshv: Only map vp->vp_stats_pages if on root scheduler This mapping is only used for checking if the dispatch thread is blocked. This is only relevant for the root scheduler, so check the scheduler type to determine whether to map/unmap these pages, instead of the current check, which is incorrect. Signed-off-by: Nuno Das Neves Reviewed-by: Anirudh Rayabharam Reviewed-by: Praveen K Paladugu Reviewed-by: Easwar Hariharan Reviewed-by: Tianyu Lan Acked-by: Stanislav Kinsburskii Reviewed-by: Anirudh Rayabharam (Microsoft) Signed-off-by: Wei Liu commit 2647c96649ba4ba9fb0fa5dfd101a15257145a3d Author: Roman Kisel Date: Wed Oct 8 16:34:19 2025 -0700 Drivers: hv: Support establishing the confidential VMBus connection To establish the confidential VMBus connection the CoCo VM, the guest first checks on the confidential VMBus availability, and then proceeds to initializing the communication stack. Implement that in the VMBus driver initialization. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit b537794bc28aafd05c317bda9d7a4d8f7d6a528d Author: Roman Kisel Date: Wed Oct 8 16:34:18 2025 -0700 Drivers: hv: Set the default VMBus version to 6.0 The confidential VMBus is supported by the protocol version 6.0 onwards. Attempt to establish the VMBus 6.0 connection thus enabling the confidential VMBus features when available. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit bf35d298bb9ab2ccbcf654c1acb65ddc758ad690 Author: Roman Kisel Date: Wed Oct 8 16:34:17 2025 -0700 Drivers: hv: Support confidential VMBus channels To make use of Confidential VMBus channels, initialize the co_ring_buffers and co_external_memory fields of the channel structure. Advertise support upon negotiating the version and compute values for those fields and initialize them. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 510164539f16062e842a9de762616b5008616fa1 Author: Roman Kisel Date: Wed Oct 8 16:34:16 2025 -0700 Drivers: hv: Free msginfo when the buffer fails to decrypt The early failure path in __vmbus_establish_gpadl() doesn't deallocate msginfo if the buffer fails to decrypt. Fix the leak by breaking out the cleanup code into a separate function and calling it where required. Fixes: d4dccf353db80 ("Drivers: hv: vmbus: Mark vmbus ring buffer visible to host in Isolation VM") Reported-by: Michael Kelley Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB41573796F9787F67E0E97049D472A@SN6PR02MB4157.namprd02.prod.outlook.com Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 0a4534bdf29a5b7f5a355c267d28dad9c40ba252 Author: Roman Kisel Date: Wed Oct 8 16:34:15 2025 -0700 Drivers: hv: Allocate encrypted buffers when requested Confidential VMBus is built around using buffers not shared with the host. Support allocating encrypted buffers when requested. Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit e096fe2bd623f77d5407f1d9a40f5d8d2a596680 Author: Roman Kisel Date: Wed Oct 8 16:34:14 2025 -0700 Drivers: hv: Functions for setting up and tearing down the paravisor SynIC The confidential VMBus runs with the paravisor SynIC and requires configuring it with the paravisor. Add the functions for configuring the paravisor SynIC. Update overall SynIC initialization logic to initialize the SynIC if it is present. Finally, break out SynIC interrupt enable/disable code into separate functions so that SynIC interrupts can be enabled or disabled via the paravisor instead of the hypervisor if the paravisor SynIC is present. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 74fa5d7e5fbdecdff64f149d9c14c74baa5cb27b Author: Roman Kisel Date: Wed Oct 8 16:34:13 2025 -0700 Drivers: hv: Rename the SynIC enable and disable routines The confidential VMBus requires support for the both hypervisor facing SynIC and the paravisor one. Rename the functions that enable and disable SynIC with the hypervisor. No functional changes. Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 09406f2f8466fe44894f444943134a09c8519e4f Author: Roman Kisel Date: Wed Oct 8 16:34:12 2025 -0700 Drivers: hv: Check message and event pages for non-NULL before iounmap() It might happen that some hyp SynIC pages aren't allocated. Check for that and only then call iounmap(). Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 1bb15327d529a4e30f69b6c3486dfe8d7a753ff5 Author: Roman Kisel Date: Wed Oct 8 16:34:11 2025 -0700 Drivers: hv: remove stale comment The comment about the x2v shim is ancient and long since incorrect. Remove the incorrect comment. Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 25059d5e4c5af37688797d87b2d2004ac1cddff7 Author: Roman Kisel Date: Wed Oct 8 16:34:10 2025 -0700 Drivers: hv: Post messages through the confidential VMBus if available When the confidential VMBus is available, the guest should post messages to the paravisor. Update hv_post_message() to post messages to the paravisor rather than through GHCB or TD calls. Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 226494e5ee4eb0bae4fc7b525505828271d5047e Author: Roman Kisel Date: Wed Oct 8 16:34:09 2025 -0700 Drivers: hv: Allocate the paravisor SynIC pages when required Confidential VMBus requires interacting with two SynICs -- one provided by the host hypervisor, and one provided by the paravisor. Each SynIC requires its own message and event pages. Refactor and extend the existing code to add allocating and freeing the message and event pages for the paravisor SynIC when it is present. Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 163224c189e8b679ce919aa64ccabb7a992ca2d1 Author: Roman Kisel Date: Wed Oct 8 16:34:08 2025 -0700 Drivers: hv: Rename fields for SynIC message and event pages Confidential VMBus requires interacting with two SynICs -- one provided by the host hypervisor, and one provided by the paravisor. Each SynIC requires its own message and event pages. Rename the existing host-accessible SynIC message and event pages with the "hyp_" prefix to clearly distinguish them from the paravisor ones. The field name is also changed in mshv_root.* for consistency. No functional changes. Signed-off-by: Roman Kisel Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit a156ad8c508209ce22f3213d25c3c2ae1774a57d Author: Roman Kisel Date: Wed Oct 8 16:34:07 2025 -0700 arch/x86: mshyperv: Trap on access for some synthetic MSRs hv_set_non_nested_msr() has special handling for SINT MSRs when a paravisor is present. In addition to updating the MSR on the host, the mirror MSR in the paravisor is updated, including with the proxy bit. But with Confidential VMBus, the proxy bit must not be used, so add a special case to skip it. Signed-off-by: Roman Kisel Reviewed-by: Alok Tiwari Reviewed-by: Tianyu Lan Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit e6eeb3c782739cd1613a8da856b878b99f741943 Author: Roman Kisel Date: Wed Oct 8 16:34:06 2025 -0700 arch: hyperv: Get/set SynIC synth.registers via paravisor The existing Hyper-V wrappers for getting and setting MSRs are hv_get/set_msr(). Via hv_get/set_non_nested_msr(), they detect when running in a CoCo VM with a paravisor, and use the TDX or SNP guest-host communication protocol to bypass the paravisor and go directly to the host hypervisor for SynIC MSRs. The "set" function also implements the required special handling for the SINT MSRs. Provide functions that allow manipulating the SynIC registers through the paravisor. Move vmbus_signal_eom() to a more appropriate location (which also avoids breaking KVM). Signed-off-by: Roman Kisel Reviewed-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 7c8b6c326d830ca5c6b95f390c703966e14167e6 Author: Roman Kisel Date: Wed Oct 8 16:34:05 2025 -0700 arch/x86: mshyperv: Discover Confidential VMBus availability Confidential VMBus requires enabling paravisor SynIC, and the x86_64 guest has to inspect the Virtualization Stack (VS) CPUID leaf to see if Confidential VMBus is available. If it is, the guest shall enable the paravisor SynIC. Read the relevant data from the VS CPUID leaf. Refactor the code to avoid repeating CPUID and add flags to the struct ms_hyperv_info. For ARM64, the flag for Confidential VMBus is not set which provides the desired behaviour for now as it is not available on ARM64 just yet. Once ARM64 CCA guests are supported, this flag will be set unconditionally when running such a guest. Signed-off-by: Roman Kisel Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 6802d8af47d1dccd9a74a1f708fb9129244ef843 Author: Roman Kisel Date: Wed Oct 8 16:34:04 2025 -0700 Drivers: hv: VMBus protocol version 6.0 The confidential VMBus is supported starting from the protocol version 6.0 onwards. Provide the required definitions. No functional changes. Signed-off-by: Roman Kisel Reviewed-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 92c7053b44b312e1cda765507f45fc170dee1b41 Author: Roman Kisel Date: Wed Oct 8 16:34:03 2025 -0700 Documentation: hyperv: Confidential VMBus Define what the confidential VMBus is and describe what advantages it offers on the capable hardware. Signed-off-by: Roman Kisel Reviewed-by: Alok Tiwari Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 5e52db91d112bd1da00b520e21f570db14105bde Author: Tianyu Lan Date: Thu Sep 18 11:00:22 2025 -0400 x86/hyperv: Allow Hyper-V to inject STIMER0 interrupts When Secure AVIC is enabled, call Secure AVIC function to allow Hyper-V to inject STIMER0 interrupt. Reviewed-by: Neeraj Upadhyay Reviewed-by: Michael Kelley Signed-off-by: Tianyu Lan Signed-off-by: Wei Liu commit c52c957e41e75d3f74157acffc53cefa3089ffa7 Author: Tianyu Lan Date: Thu Sep 18 11:00:21 2025 -0400 x86/hyperv: Don't use auto-eoi when Secure AVIC is available Hyper-V doesn't support auto-eoi with Secure AVIC. So set the HV_DEPRECATING_AEOI_RECOMMENDED flag to force writing the EOI register after handling an interrupt. Reviewed-by: Michael Kelley Reviewed-by: Neeraj Upadhyay Signed-off-by: Tianyu Lan Signed-off-by: Wei Liu commit 3e1b611515d286c6725028e17170f7143e5e51fc Author: Tianyu Lan Date: Thu Sep 18 11:00:20 2025 -0400 drivers: hv: Allow vmbus message synic interrupt injected from Hyper-V When Secure AVIC is enabled, VMBus driver should call x2apic Secure AVIC interface to allow Hyper-V to inject VMBus message interrupt. Reviewed-by: Michael Kelley Reviewed-by: Neeraj Upadhyay Signed-off-by: Tianyu Lan Signed-off-by: Wei Liu commit f34f5e576f5e17de5591c9ae306aeab2911d8533 Author: Tianyu Lan Date: Thu Sep 18 11:00:19 2025 -0400 x86/hyperv: Don't use hv apic driver when Secure AVIC is available When Secure AVIC is available, the AMD x2apic Secure AVIC driver will be selected. In that case, have hv_apic_init() return immediately without doing anything. Reviewed-by: Michael Kelley Reviewed-by: Neeraj Upadhyay Signed-off-by: Tianyu Lan Signed-off-by: Wei Liu commit 4cc1aa469cd6b714adc958547a4866247bfd60a9 Author: Nuno Das Neves Date: Fri Oct 17 11:58:17 2025 -0700 mshv: Fix deposit memory in MSHV_ROOT_HVCALL When the MSHV_ROOT_HVCALL ioctl is executing a hypercall, and gets HV_STATUS_INSUFFICIENT_MEMORY, it deposits memory and then returns -EAGAIN to userspace. The expectation is that the VMM will retry. However, some VMM code in the wild doesn't do this and simply fails. Rather than force the VMM to retry, change the ioctl to deposit memory on demand and immediately retry the hypercall as is done with all the other hypercall helper functions. In addition to making the ioctl easier to use, removing the need for multiple syscalls improves performance. There is a complication: unlike the other hypercall helper functions, in MSHV_ROOT_HVCALL the input is opaque to the kernel. This is problematic for rep hypercalls, because the next part of the input list can't be copied on each loop after depositing pages (this was the original reason for returning -EAGAIN in this case). Introduce hv_do_rep_hypercall_ex(), which adds a 'rep_start' parameter. This solves the issue, allowing the deposit loop in MSHV_ROOT_HVCALL to restart a rep hypercall after depositing pages partway through. Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs") Signed-off-by: Nuno Das Neves Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit 7563d021e28ec71bc6266e1848b22205ed7863d6 Author: Nuno Das Neves Date: Tue Oct 14 11:20:17 2025 -0700 mshv: Fix VpRootDispatchThreadBlocked value This value in the VP stats page is used to track if the VP can be dispatched for execution when there are no fast interrupts injected. The original value of 201 was used in a version of the hypervisor which did not ship. It was subsequently changed to 202 so that is the correct value. Signed-off-by: Stanislav Kinsburskii Signed-off-by: Nuno Das Neves Signed-off-by: Wei Liu commit c9dfb92de0738eb7fe6a591ad1642333793e8b6e Merge: c7b6dd2a8a024d 5422318e27d7a4 Author: Jakub Kicinski Date: Fri Nov 14 18:55:38 2025 -0800 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-11-13 The following pull-request contains common mlx5 updates * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Expose definition for 1600Gbps link mode net/mlx5: fs, set non default device per namespace net/mlx5: fs, Add other_eswitch support for steering tables net/mlx5: Add OTHER_ESWITCH HW capabilities net/mlx5: Add direct ST mode support for RDMA PCI/TPH: Expose pcie_tph_get_st_table_loc() {rdma,net}/mlx5: Query vports mac address from device ==================== Link: https://patch.msgid.link/1763027252-1168760-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 4722981cca373a338bbcf3a93ecf7144a892b03b Author: Altgelt, Max (Nextron) Date: Tue Nov 4 14:26:56 2025 +0000 bpf: don't skip other information if xlated_prog_insns is skipped If xlated_prog_insns should not be exposed, other information (such as func_info) still can and should be filled in. Therefore, instead of directly terminating in this case, continue with the normal flow. Signed-off-by: Max Altgelt Link: https://lore.kernel.org/r/efd00fcec5e3e247af551632726e2a90c105fbd8.camel@nextron-systems.com Signed-off-by: Alexei Starovoitov commit 6cc73f35406cae1f053e984e8de40e6dc9681446 Author: Martin KaFai Lau Date: Wed Nov 12 15:23:31 2025 -0800 selftests/bpf: Test bpf_skb_check_mtu(BPF_MTU_CHK_SEGS) when transport_header is not set Add a test to check that bpf_skb_check_mtu(BPF_MTU_CHK_SEGS) is rejected (-EINVAL) if skb->transport_header is not set. The test needs to lower the MTU of the loopback device. Thus, take this opportunity to run the test in a netns by adding "ns_" to the test name. The "serial_" prefix can then be removed. Signed-off-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251112232331.1566074-2-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov commit d946f3c98328171fa50ddb908593cf833587f725 Author: Martin KaFai Lau Date: Wed Nov 12 15:23:30 2025 -0800 bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next. Fixes: 34b2021cc616 ("bpf: Add BPF-helper for MTU checking") Cc: Jesper Dangaard Brouer Reported-by: Kaiyan Mei Reported-by: Yinhao Hu Signed-off-by: Martin KaFai Lau Link: https://lore.kernel.org/r/20251112232331.1566074-1-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov commit c7b6dd2a8a024d11a8edf03ba01491ce843cce37 Merge: 04ca7a69a35b06 1188741cb5a291 Author: Jakub Kicinski Date: Fri Nov 14 18:33:59 2025 -0800 Merge branch 'net-stmmac-rk-use-phy_intf_sel_x' Russell King says: ==================== net: stmmac: rk: use PHY_INTF_SEL_x This series is a minimal conversion of the dwmac-rk huge driver to use PHY_INTF_SEL_x constants. Patch 2 appears to reorder the output functions making diffing the generated code impossible. ==================== Link: https://patch.msgid.link/aRYZaKTIvfYoV3wE@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1188741cb5a29187a93ee908274f7034e81486f6 Author: Russell King (Oracle) Date: Thu Nov 13 17:46:50 2025 +0000 net: stmmac: rk: use PHY_INTF_SEL_x in functions Rather than defining one xxx_GMAC_PHY_INTF_SEL_xxx() for each mode, define xxx_GMAC_PHY_INTF_SEL() which takes the phy_intf_sel value. Pass the appropriate value into these new macros in the set_to_xxx() methods. No change to produced code on aarch64. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vJbPG-0000000EBqb-2cF2@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5e37047f745b1a705ba7a1b580b5e5fe2bfd5993 Author: Russell King (Oracle) Date: Thu Nov 13 17:46:45 2025 +0000 net: stmmac: rk: use PHY_INTF_SEL_x constants The values used in the xxx_GMAC_PHY_INTF_SEL_xxx() macros are the phy_intf_sel values used for the dwmac core. Use these to define these constants. No change to produced code on aarch64. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vJbPB-0000000EBqV-27GS@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 764ebe423ef946daaa63336b14dc71a942507982 Author: Russell King (Oracle) Date: Thu Nov 13 17:46:40 2025 +0000 net: stmmac: rk: convert all bitfields to GRF_FIELD*() Convert all bitfields to GRF_FIELD() or GRF_FIELD_CONST(), which makes the bitfield values more readable, and also allows the aarch64 compiler to produce better code. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vJbP6-0000000EBqP-1cmm@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ebb07edf97383e6821e7263d17cf6b591603c47b Author: Russell King (Oracle) Date: Thu Nov 13 17:46:35 2025 +0000 net: stmmac: rk: replace HIWORD_UPDATE() with GRF_FIELD() Provide GRF_FIELD() which takes the high/low bit numbers of the field and field value, generates the mask and passes it to FIELD_PREP_WM16. Replace all HIWORD_UPDATE() instances with this. No change to produced code on aarch64. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vJbP1-0000000EBqJ-1AjR@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 04ca7a69a35b060ecee60a9923e9891f5dd92eca Author: Breno Leitao Date: Wed Nov 12 01:50:23 2025 -0800 net: bnx2x: convert to use get_rx_ring_count Convert the bnx2x driver to use the new .get_rx_ring_count ethtool operation instead of implementing .get_rxnfc solely for handling ETHTOOL_GRXRINGS command. This simplifies the code by replacing the switch statement with a direct return of the queue count. The new callback provides the same functionality in a more direct way, following the ongoing ethtool API modernization. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251112-bnx_grxrings-v1-1-1c2cb73979e2@debian.org Signed-off-by: Jakub Kicinski commit f455d3f02d8998edb20a0accac5eeee769bd6fcd Author: Breno Leitao Date: Thu Nov 13 06:23:29 2025 -0800 net: ixgbe: convert to use .get_rx_ring_count Convert the ixgbe driver to use the new .get_rx_ring_count ethtool operation for handling ETHTOOL_GRXRINGS command. This simplifies the code by extracting the ring count logic into a dedicated callback. The new callback provides the same functionality in a more direct way, following the ongoing ethtool API modernization. This was compile-tested only. Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20251113-ixgbe_gxrings-v2-1-0ecf57808a78@debian.org Signed-off-by: Jakub Kicinski commit 06ac470658190e97518f131df01c9c530c293320 Author: Yue Haibing Date: Thu Nov 13 19:45:01 2025 +0800 sctp: Remove unused declaration sctp_auth_init_hmacs() Commit bf40785fa437 ("sctp: Use HMAC-SHA1 and HMAC-SHA256 library for chunk authentication") removed the implementation but leave declaration. Signed-off-by: Yue Haibing Reviewed-by: Eric Biggers Link: https://patch.msgid.link/20251113114501.32905-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 6d650ae9282bcec1e76205b44cb8f17e2265052e Author: Eric Dumazet Date: Thu Nov 13 14:03:57 2025 +0000 tcp: gro: inline tcp_gro_pull_header() tcp_gro_pull_header() is used in GRO fast path, inline it. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251113140358.58242-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4f7bc83b983743b439e36b4d30883a87b371cba3 Author: Puranjay Mohan Date: Fri Nov 14 15:40:22 2025 +0000 bpf: verifier: Move desc->imm setup to sort_kfunc_descs_by_imm_off() Metadata about a kfunc call is added to the kfunc_tab in add_kfunc_call() but the call instruction itself could get removed by opt_remove_dead_code() later if it is not reachable. If the call instruction is removed, specialize_kfunc() is never called for it and the desc->imm in the kfunc_tab is never initialized for this kfunc call. In this case, sort_kfunc_descs_by_imm_off(env->prog); in do_misc_fixups() doesn't sort the table correctly. This is a problem for s390 as its JIT uses this table to find the addresses for kfuncs, and if this table is not sorted properly, JIT may fail to find addresses for valid kfunc calls. This was exposed by: commit d869d56ca848 ("bpf: verifier: refactor kfunc specialization") as before this commit, desc->imm was initialised in add_kfunc_call() which happens before dead code elimination. Move desc->imm setup down to sort_kfunc_descs_by_imm_off(), this fixes the problem and also saves us from having the same logic in add_kfunc_call() and specialize_kfunc(). Suggested-by: Eduard Zingerman Signed-off-by: Puranjay Mohan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251114154023.12801-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit a4d31f451d5be2a65cfe8459808948071e9b54a0 Author: Mykyta Yatsenko Date: Wed Nov 5 13:21:05 2025 +0000 selftests/bpf: Align kfuncs renamed in bpf tree bpf_task_work_schedule_resume() and bpf_task_work_schedule_signal() have been renamed in bpf tree to bpf_task_work_schedule_resume_impl() and bpf_task_work_schedule_signal_impl() accordingly. There are few uses of these kfuncs in selftests that are not in bpf tree, so that when we port [1] into bpf-next, those BPF programs will not compile. This patch aligns those remaining callsites with the kfunc renaming. It should go on top of [1] when applying on bpf-next. 1: https://lore.kernel.org/all/20251104-implv2-v3-0-4772b9ae0e06@meta.com/ Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20251105132105.597344-1-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit eca8b8fc74cb492591f73dcdd945a5fe4612b1a4 Author: Jakub Kicinski Date: Thu Nov 13 07:27:03 2025 -0800 selftests: drv-net: xdp: make the XDP qstats tests less flaky The XDP qstats tests send 2k packets over a single socket. Looks like when netdev CI is busy running those tests in QEMU occasionally flakes. The target doesn't get to run at all before all 2000 packets are sent. Lower the number of packets to 1000 and reopen the socket every 50 packets, to give RSS a chance to spread the packets to multiple queues. For the netdev CI testing either lowering the count or using multiple sockets is enough, but let's do both for extra resiliency. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20251113152703.3819756-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e1215d1d38c00d244e5e7db4648598a0a03cc446 Author: Dimitri Daskalakis Date: Wed Nov 12 20:31:02 2025 -0800 selftests: drv-net: xdp: Fix register spill error with clang 20 On clang 20.1.8 the XDP program fails to load with a register spill error. Since hdr_len is a __u32, the compiler decided it only needed the lower 32-bits of ctx->data, which later triggers the register spill verifier error. Suggested-by: Martin KaFai Lau Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20251113043102.4062150-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit c7dc5b5228822d2389e6e441f10169e460bcc67a Author: Jakub Kicinski Date: Wed Nov 12 19:17:00 2025 -0800 ipv6: clean up routes when manually removing address with a lifetime When an IPv6 address with a finite lifetime (configured with valid_lft and preferred_lft) is manually deleted, the kernel does not clean up the associated prefix route. This results in orphaned routes (marked "proto kernel") remaining in the routing table even after their corresponding address has been deleted. This is particularly problematic on networks using combination of SLAAC and bridges. 1. Machine comes up and performs RA on eth0. 2. User creates a bridge - does an ip -6 addr flush dev eth0; - adds the eth0 under the bridge. 3. SLAAC happens on br0. Even tho the address has "moved" to br0 there will still be a route pointing to eth0, but eth0 is not usable for IP any more. Reviewed-by: David Ahern Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251113031700.3736285-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e47b68bda4de6a848a8b6c79316542326a8fb3ca Merge: ef2c0b2e56ad71 7a0892d2836e12 Author: Alexei Starovoitov Date: Fri Nov 14 17:43:41 2025 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after 6.18-rc5+ Cross-merge BPF and other fixes after downstream PR. Minor conflict in kernel/bpf/helpers.c Signed-off-by: Alexei Starovoitov commit ef2c0b2e56ad710a2b5a85b678a6c685756e03a4 Merge: c13339039891db a69e09823ee941 Author: Andrii Nakryiko Date: Fri Nov 14 17:07:21 2025 -0800 Merge branch 'libbpf-fix-btf-dedup-to-support-recursive-typedef' Paul Houssel says: ==================== libbpf: fix BTF dedup to support recursive typedef Pahole fails to encode BTF for some Go projects (e.g. Kubernetes and Podman) due to recursive type definitions that create reference loops not representable in C. These recursive typedefs trigger a failure in the BTF deduplication algorithm. This patch extends btf_dedup_struct_types() to properly handle potential recursion for BTF_KIND_TYPEDEF, similar to how recursion is already handled for BTF_KIND_STRUCT. This allows pahole to successfully generate BTF for Go binaries using recursive types without impacting existing C-based workflows. Changes in v4: fix typo found by Claude-based CI Changes in v3: 1. Patch 1: Adjusted the comment of btf_dedup_ref_type() to refer to typedef as well. 2. Patch 2: Update of the "dedup: recursive typedef" test to include a duplicated version of the types to make sure deduplication still happens in this case. Changes in v2: 1. Patch 1: Refactored code to prevent copying existing logic. Instead of adding a new function we modify the existing btf_dedup_struct_type() function to handle the BTF_KIND_TYPEDEF case. Calls to btf_hash_struct() and btf_shallow_equal_struct() are replaced with calls to functions that select btf_hash_struct() / btf_hash_typedef() based on the type. 2. Patch 2: Added tests v3: https://lore.kernel.org/lkml/cover.1763024337.git.paul.houssel@orange.com/ v2: https://lore.kernel.org/lkml/cover.1762956564.git.paul.houssel@orange.com/ v1: https://lore.kernel.org/lkml/20251107153408.159342-1-paulhoussel2@gmail.com/ ==================== Link: https://patch.msgid.link/cover.1763037045.git.paul.houssel@orange.com Signed-off-by: Andrii Nakryiko commit a69e09823ee94131be76be050d639272c19994d4 Author: Paul Houssel Date: Thu Nov 13 13:39:51 2025 +0100 selftests/bpf: Add BTF dedup tests for recursive typedef definitions Add several ./test_progs tests: 1. btf/dedup:recursive typedef ensures that deduplication no longer fails on recursive typedefs. 2. btf/dedup:typedef ensures that typedefs are deduplicated correctly just as they were before this patch. Signed-off-by: Paul Houssel Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/9fac2f744089f6090257d4c881914b79f6cd6c6a.1763037045.git.paul.houssel@orange.com commit 3781413465df6e0fb7f3c2001f986c9886b7f126 Author: Paul Houssel Date: Thu Nov 13 13:39:50 2025 +0100 libbpf: Fix BTF dedup to support recursive typedef definitions Handle recursive typedefs in BTF deduplication Pahole fails to encode BTF for some Go projects (e.g. Kubernetes and Podman) due to recursive type definitions that create reference loops not representable in C. These recursive typedefs trigger a failure in the BTF deduplication algorithm. This patch extends btf_dedup_ref_type() to properly handle potential recursion for BTF_KIND_TYPEDEF, similar to how recursion is already handled for BTF_KIND_STRUCT. This allows pahole to successfully generate BTF for Go binaries using recursive types without impacting existing C-based workflows. Suggested-by: Tristan d'Audibert Co-developed-by: Martin Horth Co-developed-by: Ouail Derghal Co-developed-by: Guilhem Jazeron Co-developed-by: Ludovic Paillat Co-developed-by: Robin Theveniaut Signed-off-by: Martin Horth Signed-off-by: Ouail Derghal Signed-off-by: Guilhem Jazeron Signed-off-by: Ludovic Paillat Signed-off-by: Robin Theveniaut Signed-off-by: Paul Houssel Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/bf00857b1e06f282aac12f6834de7396a7547ba6.1763037045.git.paul.houssel@orange.com commit c13339039891dbdfa6c1972f0483bd07f610b776 Author: Alexei Starovoitov Date: Thu Nov 13 09:11:53 2025 -0800 selftests/bpf: Fix failure paths in send_signal test When test_send_signal_kern__open_and_load() fails parent closes the pipe which cases ASSERT_EQ(read(pipe_p2c...)) to fail, but child continues and enters infinite loop, while parent is stuck in wait(NULL). Other error paths have similar issue, so kill the child before waiting on it. The bug was discovered while compiling all of selftests with -O1 instead of -O2 which caused progs/test_send_signal_kern.c to fail to load. Fixes: ab8b7f0cb358 ("tools/bpf: Add self tests for bpf_send_signal_thread()") Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20251113171153.2583-1-alexei.starovoitov@gmail.com commit d3fe9aa495854f8d88c69c41a4b31e69424656ad Author: Andy Yan Date: Wed Nov 12 16:50:23 2025 +0800 drm/rockchip: vop2: Use OVL_LAYER_SEL configuration instead of use win_mask calculate used layers When there are multiple Video Ports, and only one of them is working (for example, VP1 is working while VP0 is not), in this case, the win_mask of VP0 is 0. However, we have already set the port mux for VP0 according to vp0->nlayers, and at the same time, in the OVL_LAYER_SEL register, there are windows will also be assigned to layers which will map to the inactive VPs. In this situation, vp0->win_mask is zero as it now working, it is more reliable to calculate the used layers based on the configuration of the OVL_LAYER_SEL register. Note: as the configuration of OVL_LAYER_SEL is take effect when the vsync is come, so we use the value backup in vop2->old_layer_sel instead of read OVL_LAYER_SEL directly. Fixes: 3e89a8c68354 ("drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568") Cc: stable@vger.kernel.org Reported-by: Diederik de Haas Closes: https://bugs.kde.org/show_bug.cgi?id=511274 Signed-off-by: Andy Yan Tested-by: Dang Huynh Tested-by: Diederik de Haas Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251112085024.2480111-1-andyshrk@163.com commit f2f22721aca46cebb63c589eefda843721908833 Author: Sean Christopherson Date: Wed Nov 12 08:07:08 2025 -0800 x86/sgx: Fix a typo in the kernel-doc comment for enum sgx_attribute Use the exact enum name when documenting "enum sgx_attribute" to fix a warning if the file is fed into kernel-doc processing: WARNING: ./arch/x86/include/asm/sgx.h:139 expecting prototype for enum sgx_attributes. Prototype was for enum sgx_attribute instead Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251112160708.1343355-6-seanjc%40google.com commit 55bf13b612579a2b4ed81f3891c36d1cde7579a3 Author: Sean Christopherson Date: Wed Nov 12 08:07:07 2025 -0800 x86/sgx: Remove superfluous asterisk from copyright comment in asm/sgx.h Drop an asterisk from a file-level copyright comment so that the comment isn't intrepeted as a kernel-doc comment. E.g. if arch/x86/include/asm/sgx.h is fed into kernel-doc processing: WARNING: ./arch/x86/include/asm/sgx.h:2 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251112160708.1343355-5-seanjc%40google.com commit 905885fdb1f73368b876de7320e8160e29e2dd03 Author: Sean Christopherson Date: Wed Nov 12 08:07:06 2025 -0800 x86/sgx: Document structs and enums with '@', not '%' Use '@' to document structure members and enum values in kernel-doc markup, as per Documentation/doc-guide/kernel-doc.rst and flagged by make htmldocs. WARNING: arch/x86/include/uapi/asm/sgx.h:17 Enum value 'SGX_PAGE_MEASURE' not described in enum 'sgx_page_flags' Opportunistically add a missing ':' for SGX_CHILD_PRESENT. Closes: https://lore.kernel.org/all/20251106145506.145fc620@canb.auug.org.au Reported-by: Stephen Rothwell Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251112160708.1343355-4-seanjc%40google.com commit 243ea511fea00572c720199f5b0e00623e9ffc62 Author: Sean Christopherson Date: Wed Nov 12 08:07:05 2025 -0800 x86/sgx: Add kernel-doc descriptions for params passed to vDSO user handler Add kernel-doc markup for the register parameters passed by the vDSO blob to the user handler to suppress build warnings, e.g. WARNING: arch/x86/include/uapi/asm/sgx.h:157 function parameter 'r8' not described in 'sgx_enclave_user_handler_t' Call out that except for RSP, the registers are undefined on asynchronous exits as far as the vDSO ABI is concerned. E.g. the vDSO's exception handler clobbers RDX, RDI, and RSI, and the kernel doesn't guarantee that R8 or R9 will be zero (the synthetic value loaded by the CPU). Closes: https://lore.kernel.org/all/20251106145506.145fc620@canb.auug.org.au Reported-by: Stephen Rothwell Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251112160708.1343355-3-seanjc%40google.com commit 75801ca620a6ba9f3da7d4e3d3a8ad10811c579e Author: Sean Christopherson Date: Wed Nov 12 08:07:04 2025 -0800 x86/sgx: Add a missing colon in kernel-doc markup for "struct sgx_enclave_run" Add a missing ':' for the description of sgx_enclave_run.reserved so that documentation for the member is correctly generated: WARNING: arch/x86/include/uapi/asm/sgx.h:184 struct member 'reserved' not described in 'sgx_enclave_run' Closes: https://lore.kernel.org/all/20251106145506.145fc620@canb.auug.org.au Reported-by: Stephen Rothwell Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251112160708.1343355-2-seanjc%40google.com commit 7d7bb790aced3b1b8550b74e02fdfc001d044bee Author: Dmitry Osipenko Date: Wed Oct 22 19:19:48 2025 +0300 drm/rockchip: Set VOP for the DRM DMA device Use VOP for DMA operations performed by DRM core. Rockchip DRM driver is backed by a virtual device that isn't IOMMU-capable, while VOP is the actual display controller device backed by IOMMU. Fixes "swiotlb buffer is full" warning messages originated from GEM prime code paths. Note, that backporting is non-trivial as this depends on commit 143ec8d3f9396 ("drm/prime: Support dedicated DMA device for dma-buf imports"), which landed in v6.16 and commit 421be3ee36a4 ("drm/rockchip: Refactor IOMMU initialisation"), which landed in v5.19. Reported-by: Daniel Stone Fixes: 2048e3286f34 ("drm: rockchip: Add basic drm driver") Cc: stable@vger.kernel.org # v6.16+ Reviewed-by: Sebastian Reichel Signed-off-by: Dmitry Osipenko Tested-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251022161948.199731-1-dmitry.osipenko@collabora.com commit f7ae6d4ec6520a901787cbab273983e96d8516da Author: Dan Williams Date: Wed Nov 12 18:14:46 2025 -0800 PCI/TSM: Add 'dsm' and 'bound' attributes for dependent functions PCI/TSM sysfs for physical function 0 devices, i.e. the "DSM" (Device Security Manager), contains the 'connect' and 'disconnect' attributes. After a successful 'connect' operation the DSM, its dependent functions (SR-IOV virtual functions, non-zero multi-functions, or downstream endpoints of a switch DSM) are candidates for being transitioned into a TDISP (TEE Device Interface Security Protocol) operational state, via pci_tsm_bind(). At present sysfs is blind to which devices are capable of TDISP operation and it is ambiguous which functions are serviced by which DSMs. Add a 'dsm' attribute to identify a function's DSM device, and add a 'bound' attribute to identify when a function has entered a TDISP operational state. Cc: Bjorn Helgaas Cc: Lukas Wunner Cc: Samuel Ortiz Cc: Alexey Kardashevskiy Cc: Xu Yilun Cc: Suzuki K Poulose Cc: Aneesh Kumar K.V Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-9-dan.j.williams@intel.com Signed-off-by: Dan Williams commit c316c75d57fbb34e2305690813f4dbec9311f2b0 Author: Dan Williams Date: Wed Nov 12 18:14:45 2025 -0800 PCI/TSM: Add pci_tsm_guest_req() for managing TDIs A PCIe device function interface assigned to a TVM is a TEE Device Interface (TDI). A TDI instantiated by pci_tsm_bind() needs additional steps taken by the TVM to be accepted into the TVM's Trusted Compute Boundary (TCB) and transitioned to the RUN state. pci_tsm_guest_req() is a channel for the guest to request TDISP collateral, like Device Interface Reports, and effect TDISP state changes, like LOCKED->RUN transititions. Similar to IDE establishment and pci_tsm_bind(), these are long running operations involving SPDM message passing via the DOE mailbox. The path for a TVM to invoke pci_tsm_guest_req() is: * TSM triggers exit via guest-to-host-interface ABI (implementation specific) * VMM invokes handler (KVM handle_exit() -> userspace io) * handler issues request (userspace io handler -> ioctl() -> pci_tsm_guest_req()) * handler supplies response * VMM posts response, notifies/re-enters TVM This path is purely a transport for messages from TVM to platform TSM. By design the host kernel does not and must not care about the content of these messages. I.e. the host kernel is not in the TCB of the TVM. As this is an opaque passthrough interface, similar to fwctl, the kernel requires that implementations stay within the bounds defined by 'enum pci_tsm_req_scope'. Violation of those expectations likely has market and regulatory consequences. Out of scope requests are blocked by default. Co-developed-by: Xu Yilun Signed-off-by: Xu Yilun Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-8-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 50cbec192f5317e29be993e2a634bbbdfcf0230e Author: Dan Williams Date: Wed Nov 12 18:14:44 2025 -0800 PCI/TSM: Add pci_tsm_bind() helper for instantiating TDIs After a PCIe device has established a secure link and session between a TEE Security Manager (TSM) and its local Device Security Manager (DSM), the device or its subfunctions are candidates to be bound to a private memory context, a TVM. A PCIe device function interface assigned to a TVM is a TEE Device Interface (TDI). The pci_tsm_bind() requests the low-level TSM driver to associate the device with private MMIO and private IOMMU context resources of a given TVM represented by a @kvm argument. A device in the bound state corresponds to the TDISP protocol LOCKED state and awaits validation by the TVM. It is a 'struct pci_tsm_link_ops' operation because, similar to IDE establishment, it involves host side resource establishment and context setup on behalf of the guest. It is also expected to be performed lazily to allow for operation of the device in non-confidential "shared" context for pre-lock configuration. Co-developed-by: Xu Yilun Signed-off-by: Xu Yilun Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-7-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 079115370d00c78ef69b31dd15def90adf2aa579 Author: Dan Williams Date: Wed Nov 12 18:14:43 2025 -0800 PCI/IDE: Initialize an ID for all IDE streams The PCIe spec defines two types of streams - selective and link. Each stream has an ID from the same bucket so a stream ID does not tell the type. The spec defines an "enable" bit for every stream and required stream IDs to be unique among all enabled stream but there is no such requirement for disabled streams. However, when IDE_KM is programming keys, an IDE-capable device needs to know the type of stream being programmed to write it directly to the hardware as keys are relatively large, possibly many of them and devices often struggle with keeping around rather big data not being used. Walk through all streams on a device and initialise the IDs to some unique number, both link and selective. The weakest part of this proposal is the host bridge ide_stream_ids_ida. Technically, a Stream ID only needs to be unique within a given partner pair. However, with "anonymous" / unassigned streams there is no convenient place to track the available ids. Proceed with an ida in the host bridge for now, but consider moving this tracking to be an ide_stream_ids_ida per device. Co-developed-by: Alexey Kardashevskiy Signed-off-by: Alexey Kardashevskiy Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-6-dan.j.williams@intel.com Signed-off-by: Dan Williams commit f86e51399c2a911a5b01d441de513f17bf773856 Author: Xu Yilun Date: Thu Nov 13 17:02:27 2025 -0800 PCI/IDE: Add Address Association Register setup for downstream MMIO The address ranges for downstream Address Association Registers need to cover memory addresses for all functions (PFs/VFs/downstream devices) managed by a Device Security Manager (DSM). The proposed solution is get the memory (32-bit only) range and prefetchable-memory (64-bit capable) range from the immediate ancestor downstream port (either the direct-attach RP or deepest switch port when switch attached). Similar to RID association, address associations will be set by default if hardware sets 'Number of Address Association Register Blocks' in the 'Selective IDE Stream Capability Register' to a non-zero value. TSM drivers can opt-out of the settings by zero'ing out unwanted / unsupported address ranges. E.g. TDX Connect only supports prefetachable (64-bit capable) memory ranges for the Address Association setting. If the immediate downstream port provides both a memory range and prefetchable-memory range, but the IDE partner port only provides 1 Address Association Register block then the TSM driver can pick which range to associate, or let the PCI core prioritize memory. Note, the Address Association Register setup for upstream requests is still uncertain so is not included. Co-developed-by: Aneesh Kumar K.V Signed-off-by: Aneesh Kumar K.V Co-developed-by: Arto Merilainen Signed-off-by: Arto Merilainen Signed-off-by: Xu Yilun Co-developed-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251114010227.567693-1-dan.j.williams@intel.com Signed-off-by: Dan Williams commit e95b9ff6bfa400d34e1cfcd8062641ba3be821a7 Author: Cristian Ciocaltea Date: Tue Oct 21 13:19:18 2025 +0300 drm/rockchip: dw_hdmi_qp: Add high color depth support Since both RK3576 and RK3588 SoCs are capable of handling 10 bpc color depth, introduce a pair of new helpers to program the necessary registers, as well as passing bpc at PHY configuration level. Note max_bpc is unconditionally set to 10 before initializing the QP bridge library, as there is no need to adjust it dynamically, i.e. per SoC variant, for now. While setting up .enc_init() callbacks of rockchip_hdmi_qp_ctrl_ops, also replace the unnecessary whitespace chars before .irq_callback() assignments. Acked-by: Daniel Stone Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251021-rk3588-10bpc-v3-5-3d3eed00a6db@collabora.com commit 97ffefaaf4e9ab3aeddb2273e1a9b2854c481b11 Author: Cristian Ciocaltea Date: Tue Oct 21 13:19:17 2025 +0300 drm/rockchip: dw_hdmi_qp: Use bit macros for RK3576 regs For consistency and improved readability, redefine a few RK3576 specific register configurations by relying on GENMASK() and unshifted values for color depth and output format. Those are not used at the moment, but will be needed soon to support the related features. While at it, drop a few other defines which are unlikely to be ever required. Acked-by: Daniel Stone Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251021-rk3588-10bpc-v3-4-3d3eed00a6db@collabora.com commit ba9c2fe18c171fabe0958502e080e000671ac36f Author: Cristian Ciocaltea Date: Tue Oct 21 13:19:16 2025 +0300 drm/rockchip: dw_hdmi_qp: Switch to phy_configure() Stop relying on phy_set_bus_width() based workaround to setup the TMDS character rate and, instead, use the recently introduced HDMI PHY configuration API. This is also a prerequisite to enable high color depth and FRL support. Additionally, move the logic to ->atomic_check() callback where the current mode rate is already provided by the connector state. As a matter of fact this is actually necessary to ensure the link rate is configured before VOP2 attempts to use the PHY PLL as a DCLK source in vop2_crtc_atomic_enable(). The rationale is to restrict any changes of the PHY rate via CCF and, instead, prefer the PHY configuration API for this purpose. Acked-by: Daniel Stone Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251021-rk3588-10bpc-v3-3-3d3eed00a6db@collabora.com commit 1ff27c5929ab0f5e34d5062637369ca542a6d385 Author: Cristian Ciocaltea Date: Tue Oct 21 13:19:15 2025 +0300 drm/bridge: dw-hdmi-qp: Handle platform supported formats and color depth Extend struct dw_hdmi_qp_plat_data to include the supported display output formats and maximum bits per color channel. When provided by the platform driver, use them to setup the HDMI bridge accordingly. Additionally, improve debug logging in dw_hdmi_qp_bridge_atomic_enable() to also show the current HDMI output format and bpc. Acked-by: Daniel Stone Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251021-rk3588-10bpc-v3-2-3d3eed00a6db@collabora.com commit b0362c45c401c36412a1305b34a3bfeae35dbca7 Author: Cristian Ciocaltea Date: Tue Oct 21 13:19:14 2025 +0300 drm/rockchip: vop2: Check bpc before switching DCLK source When making use of the HDMI PHY PLL as a VOP2 DCLK source, it's output rate does normally match the mode clock. But this is only applicable for default color depth of 8 bpc. For higher depths, the output clock is further divided by the hardware according to the formula: output rate = PHY PLL rate * 8 / bpc Hence there is no need for VOP2 to compensate for bpc when adjusting DCLK, but it is required to do so when computing its maximum operating frequency. Take color depth into consideration before deciding to switch DCLK source. Reviewed-by: Daniel Stone Signed-off-by: Cristian Ciocaltea Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251021-rk3588-10bpc-v3-1-3d3eed00a6db@collabora.com commit 836b5e9c6dbd5e5ab82d0a153483048e355a79c1 Author: Damon Ding Date: Mon Nov 10 15:58:17 2025 +0800 drm/rockchip: analogix_dp: Use dev_err_probe() instead of DRM_DEV_ERROR() during probing The DRM_DEV_ERROR() has been deprecated, and use dev_err_probe() can be better. The other reason is that dev_err_probe() help avoid unexpected repeated err logs during defered probing. Signed-off-by: Damon Ding Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251110075817.1159857-1-damon.ding@rock-chips.com commit 63066b7a8ed544592005c66c261625204d2ec99a Author: Alexei Starovoitov Date: Mon Nov 10 19:29:31 2025 -0800 selftests/bpf: Convert glob_match() to bpf arena Increase arena test coverage. Convert glob_match() to bpf arena in two steps: 1. Copy paste lib/glob.c into bpf_arena_strsearch.h Copy paste lib/globtests.c into progs/arena_strsearch.c 2. Add __arena to pointers Add __arg_arena to global functions that accept arena pointers Add cond_break to loops The test also serves as a good example of what's possible with bpf arena and how existing algorithms can be converted. Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251111032931.21430-1-alexei.starovoitov@gmail.com commit 0936fa80150ef9121c6a4340fa2369bc9f16a520 Author: Aaron Kling Date: Tue May 13 16:10:54 2025 -0500 arm64: tegra: Remove OTG ID GPIO from Jetson TX2 NX The P3509 carrier board does not connect the ID GPIO. Prior to this, the GPIO role switch driver could not detect the mode of the OTG port. Signed-off-by: Aaron Kling Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit a72c3372ad6301705ccfdf463e32a2fc888eb173 Author: Aaron Kling Date: Mon May 26 20:22:26 2025 -0500 arm64: tegra: Set USB Micro-B port to OTG mode on P3450 The USB Micro-B port on p3450 is capable of OTG and doesn't need to be hardcoded to peripheral. No other supported Tegra device is set up like this, so align for consistency. Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 7beff596dd375fc894173090a9b1b8eea1a83e38 Author: Diogo Ivo Date: Mon Jun 30 09:48:44 2025 +0100 arm64: tegra: Add NVJPG node for Tegra210 platforms The Tegra X1 chip contains a NVJPG accelerator capable of encoding/decoding JPEG files in hardware. Complete its DT node and enable it. Reviewed-by: Mikko Perttunen Signed-off-by: Diogo Ivo Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit 172de4d681eadce124a2e0a0b881ac139afac584 Author: Diogo Ivo Date: Mon Jun 30 09:48:43 2025 +0100 arm64: tegra: Add Tegra210 NVJPG power-domain node Add the NVJPG power-domain node in order to support the NVJPG accelerator in Tegra210 platforms. Reviewed-by: Mikko Perttunen Signed-off-by: Diogo Ivo Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit 11c52a226ef535de2ec9b09f2811eced4b9931b2 Author: Haotien Hsu Date: Mon Aug 11 15:45:56 2025 +0800 arm64: tegra: Add interrupts for Tegra234 USB wake events Add interrupts for Tegra234 USB wake events to support the USB wake-up function. Signed-off-by: Haotien Hsu Signed-off-by: Thierry Reding commit 3da2ea1933c6372e22d2a536bbe86dd3e7d09121 Author: Aaron Kling Date: Sun Aug 3 22:14:31 2025 -0500 arm64: tegra: Add reserved-memory node for P2180 The Tegra210 L4T bootloader RAM training will corrupt the in-RAM kernel DT if no reserved-memory node exists. This prevents said bootloader from being able to boot a kernel without this node, unless a chainloaded bootloader loads the DT. Add the node to eliminate the requirement for extra boot stages. Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 28f917d1a84afc86853513351cb0320844f51265 Author: Aaron Kling Date: Sun Aug 3 22:14:30 2025 -0500 arm64: tegra: Add reserved-memory node for P3450 The Tegra210 L4T bootloader RAM training will corrupt the in-RAM kernel DT if no reserved-memory node exists. This prevents said bootloader from being able to boot a kernel without this node, unless a chainloaded bootloader loads the DT. Add the node to eliminate the requirement for extra boot stages. Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 961e69a5dc78491f6c8402c6016c5d6e3c1f11f7 Author: Aaron Kling Date: Sat Aug 16 01:03:21 2025 -0500 arm64: tegra: Enable NVDEC and NVENC on Tegra210 The other engines are already enabled, finish filling out the media engine nodes and power domains. Signed-off-by: Aaron Kling Reviewed-by: Jon Hunter Signed-off-by: Thierry Reding commit feee7f5ae275dc6573f029824736ef61158cdb77 Author: Nino Zhang Date: Fri Aug 22 18:41:11 2025 +0800 arm64: tegra: Fix APB DMA controller node name The APB DMA controller node is currently named "dma@60020000", but according to the DT bindings the node name should be "dma-controller". Update the node name to match the binding and fix dtbs_check warnings. Signed-off-by: Nino Zhang Signed-off-by: Thierry Reding commit 6db753b9211082e11454cd6f4b2de308967b57bf Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:55 2025 +0200 arm64: tegra: Add default GIC address cells on Tegra210 Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: tegra210.dtsi:31.3-41: Warning (interrupt_map): /pcie@1003000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@50041000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 7d14d53bc81079d55cc5df25f1975d28e9c2b640 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:54 2025 +0200 arm64: tegra: Add default GIC address cells on Tegra194 Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: tegra194.dtsi:2391.4-42: Warning (interrupt_map): /bus@0/pcie@14100000:interrupt-map: Missing property '#address-cells' in node /bus@0/interrupt-controller@3881000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 311cbb9c130e2af184f5e0dc49bd891b020b6596 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:53 2025 +0200 arm64: tegra: Add default GIC address cells on Tegra186 Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: tegra186.dtsi:1355.3-41: Warning (interrupt_map): /pcie@10003000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@3881000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit cddc94edf1979b5afacf9bf6f3709585baa36b78 Author: Krzysztof Kozlowski Date: Fri Aug 22 15:33:52 2025 +0200 arm64: tegra: Add default GIC address cells on Tegra132 Add missing address-cells 0 to GIC interrupt node to silence W=1 warning: tegra132.dtsi:32.3-41: Warning (interrupt_map): /pcie@1003000:interrupt-map: Missing property '#address-cells' in node /interrupt-controller@50041000, using 0 as fallback Value '0' is correct because: 1. GIC interrupt controller does not have children, 2. interrupt-map property (in PCI node) consists of five components and the fourth component "parent unit address", which size is defined by '#address-cells' of the node pointed to by the interrupt-parent component, is not used (=0) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 654427e0b9b755d968bfd4147fc249ba1bd56ea9 Author: Aaron Kling Date: Tue Oct 21 22:13:24 2025 -0500 arm64: tegra: Add OPP tables on Tegra210 This adds OPP tables for ACTMON and EMC, enabling dynamic frequency scaling for system memory. Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 3cad4369399a31277e9e20de723c665b30cba574 Author: Aaron Kling Date: Tue Oct 21 22:13:23 2025 -0500 arm64: tegra: Add interconnect properties for Tegra210 Add interconnect properties to the Memory Controller, External Memory Controller and the Display Controller nodes in order to describe the hardware interconnection. Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 60bb55de5d6ccdf07a9389cb856661753c0f9713 Author: Aaron Kling Date: Tue Oct 21 22:13:22 2025 -0500 arm64: tegra: Add ACTMON on Tegra210 This enables the action monitor to facilitate dynamic frequency scaling. Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 53dd063bb6b342ca00d2a0c138ba58807a690417 Author: Cristian Ciocaltea Date: Tue Oct 28 00:26:41 2025 +0200 drm/rockchip: dw_hdmi_qp: Fixup usage of enable_gpio member in main struct The name of the enable_gpio member in struct rockchip_hdmi_qp is too generic, as initially "borrowed" from downstream BSP code. Moreover, this hasn't been really in use so far, since there is neither a DT providing an "enable-gpios" property to any of the "hdmi" nodes, nor a binding documenting it. The actual purpose of this GPIO line is to control the voltage bias for the HDMI TX data lines when switching between TMDS and FRL operating modes. A previous patch introduced the "frl-enable-gpios" property of the RK3588 HDMI TX Controller binding, hence pass the updated string to devm_gpiod_get_optional(), rename the struct member accordingly and set it to a low level. Signed-off-by: Cristian Ciocaltea Signed-off-by: Laurent Pinchart Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251027222641.25066-3-laurent.pinchart@ideasonboard.com commit ca408d8d93d33423cafe3046f40bcc81bc6ee5f3 Author: Cristian Ciocaltea Date: Tue Oct 28 00:26:40 2025 +0200 dt-bindings: display: rk3588-dw-hdmi-qp: Add frl-enable-gpios property Add an optional property to RK3588 HDMI TX Controller binding describing a GPIO line to be asserted when operating in HDMI 2.1 FRL mode and deasserted for HDMI 1.4/2.0 TMDS. This is used to control an external voltage bias for HDMI data lines. Signed-off-by: Cristian Ciocaltea Co-developed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Acked-by: Conor Dooley Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20251027222641.25066-2-laurent.pinchart@ideasonboard.com commit fea3f5e83c5cd80a76d97343023a2f2e6bd862bf Author: Menglong Dong Date: Mon Nov 10 20:07:05 2025 +0800 bpf: Handle return value of ftrace_set_filter_ip in register_fentry The error that returned by ftrace_set_filter_ip() in register_fentry() is not handled properly. Just fix it. Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)") Signed-off-by: Menglong Dong Acked-by: Song Liu Link: https://lore.kernel.org/r/20251110120705.1553694-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit e5d2e34e726bb657f56f9374ade194828c7d379a Author: Eduard Zingerman Date: Fri Nov 14 12:05:42 2025 -0800 bpf: Add missing checks to avoid verbose verifier log There are a few places where log level is not checked before calling "verbose()". This forces programs working only at BPF_LOG_LEVEL_STATS (e.g. veristat) to allocate unnecessarily large log buffers. Add missing checks. Reported-by: Emil Tsalapatis Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251114200542.912386-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit a0131c39270de634c33950a799d8870da2191974 Author: Michal Koutný Date: Fri Nov 14 19:21:27 2025 +0100 docs: cgroup: No special handling of unpopulated memcgs The current kernel doesn't handle unpopulated cgroups any special regarding reclaim protection. Furthermore, this wasn't a case even when this was introduced in bf8d5d52ffe89 ("memcg: introduce memory.min") Drop the incorrect documentation. (Implementation taking into account the inner-node constraint may be added later.) Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit 3755c11679d4f826e35d7a565ff366b8f64684c1 Author: Michal Koutný Date: Fri Nov 14 19:21:26 2025 +0100 docs: cgroup: Note about sibling relative reclaim protection Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit e27179958ce76b182ea38718113cdff1d2bb7d10 Author: Michal Koutný Date: Fri Nov 14 19:21:25 2025 +0100 docs: cgroup: Explain reclaim protection target The protection target is necessary to understand how effective reclaim protection applies in the hierarchy. Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit 1dcb98bbb7538d4b9015d47c934acdf5ea86045c Author: Tejun Heo Date: Thu Nov 13 15:33:41 2025 -1000 sched_ext: Pass locked CPU parameter to scx_hardlockup() and add docs With the buddy lockup detector, smp_processor_id() returns the detecting CPU, not the locked CPU, making scx_hardlockup()'s printouts confusing. Pass the locked CPU number from watchdog_hardlockup_check() as a parameter instead. Also add kerneldoc comments to handle_lockup(), scx_hardlockup(), and scx_rcu_cpu_stall() documenting their return value semantics. Suggested-by: Doug Anderson Reviewed-by: Douglas Anderson Acked-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit c1da3df7191f1b4df9256bcd30d78f78201e1d17 Author: Sahil Chandna Date: Fri Nov 14 12:19:22 2025 +0530 bpf: Prevent nesting overflow in bpf_try_get_buffers bpf_try_get_buffers() returns one of multiple per-CPU buffers based on a per-CPU nesting counter. This mechanism expects that buffers are not endlessly acquired before being returned. migrate_disable() ensures that a task remains on the same CPU, but it does not prevent the task from being preempted by another task on that CPU. Without disabled preemption, a task may be preempted while holding a buffer, allowing another task to run on same CPU and acquire an additional buffer. Several such preemptions can cause the per-CPU nest counter to exceed MAX_BPRINTF_NEST_LEVEL and trigger the warning in bpf_try_get_buffers(). Adding preempt_disable()/preempt_enable() around buffer acquisition and release prevents this task preemption and preserves the intended bounded nesting behavior. Reported-by: syzbot+b0cff308140f79a9c4cb@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68f6a4c8.050a0220.1be48.0011.GAE@google.com/ Fixes: 4223bf833c849 ("bpf: Remove preempt_disable in bpf_try_get_buffers") Suggested-by: Yonghong Song Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Sahil Chandna Link: https://lore.kernel.org/r/20251114064922.11650-1-chandna.sahil@gmail.com Signed-off-by: Alexei Starovoitov commit 07f42f8290e927a38ee4248505fc39ed0518519e Author: Rafael J. Wysocki Date: Thu Nov 13 20:35:27 2025 +0100 PCI/sysfs: Use PM_RUNTIME_ACQUIRE()/PM_RUNTIME_ACQUIRE_ERR() Use new PM_RUNTIME_ACQUIRE() and PM_RUNTIME_ACQUIRE_ERR() wrapper macros to make the code look more straightforward. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Dhruva Gole Reviewed-by: Jonathan Cameron [ rjw; Typo fix in the changelog ] Link: https://patch.msgid.link/3932581.kQq0lBPeGt@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 70dcad34009e00523b50818eda082958986ebc0b Author: Rafael J. Wysocki Date: Thu Nov 13 20:34:53 2025 +0100 ACPI: TAD: Use PM_RUNTIME_ACQUIRE()/PM_RUNTIME_ACQUIRE_ERR() Use new PM_RUNTIME_ACQUIRE() and PM_RUNTIME_ACQUIRE_ERR() wrapper macros to make the code look more straightforward. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Dhruva Gole Reviewed-by: Jonathan Cameron [ rjw: Typo fix in the changelog ] Link: https://patch.msgid.link/2040585.PYKUYFuaPT@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit ef8057b07c72a817537856b98d6e7493b9404eaf Author: Rafael J. Wysocki Date: Thu Nov 13 20:33:33 2025 +0100 PM: runtime: Wrapper macros for ACQUIRE()/ACQUIRE_ERR() Add wrapper macros for ACQUIRE()/ACQUIRE_ERR() and runtime PM usage counter guards introduced recently: pm_runtime_active_try, pm_runtime_active_auto_try, pm_runtime_active_try_enabled, and pm_runtime_active_auto_try_enabled. The new macros should be more straightforward to use. For example, they can be used for rewriting a piece of code like below: ACQUIRE(pm_runtime_active_try, pm)(dev); if ((ret = ACQUIRE_ERR(pm_runtime_active_try, &pm))) return ret; in the following way: PM_RUNTIME_ACQUIRE(dev, pm); if ((ret = PM_RUNTIME_ACQUIRE_ERR(&pm))) return ret; If the original code does not care about the specific error code returned when attepmting to resume the device: ACQUIRE(pm_runtime_active_try, pm)(dev); if (ACQUIRE_ERR(pm_runtime_active_try, &pm)) return -ENXIO; it may be changed like this: PM_RUNTIME_ACQUIRE(dev, pm); if (PM_RUNTIME_ACQUIRE_ERR(&pm)) return -ENXIO; Link: https://lore.kernel.org/linux-pm/5068916.31r3eYUQgx@rafael.j.wysocki/ Signed-off-by: Rafael J. Wysocki Reviewed-by: Dan Williams Reviewed-by: Dhruva Gole Reviewed-by: Jonathan Cameron Reviewed-by: Frank Li Link: https://patch.msgid.link/3400866.aeNJFYEL58@rafael.j.wysocki commit 308bc2e33885df9288d3f1ed946a2b212e37db62 Author: Thomas Weißschuh Date: Thu Nov 6 16:15:24 2025 +0100 selftests/timers/nanosleep: Add tests for return of remaining time If interrupted by a signal clock_nanosleep() returns the remaining time into the structure pointed to by the rmtp parameter. So far this functionality was not tested by the timer selftests. Extend the nanosleep selftest to cover this feature. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251106-nanosleep-rtmp-selftest-v1-1-f9212fb295fe@linutronix.de commit 05d89fe7e46a52bb5dde7ac3f07b383895fab528 Author: Wake Liu Date: Mon Nov 3 19:45:02 2025 +0800 selftests/timers: Clean up kernel version check in posix_timers Several tests in the posix_timers selftest which test timer behavior related to SIG_IGN fail on kernels older than 6.13. This is due to a refactoring of signal handling in commit caf77435dd8a ("signal: Handle ignored signals in do_sigaction(action != SIG_IGN)"). A previous attempt to fix this by adding a kernel version check to each of the nine affected tests was suboptimal, as it resulted in emitting the same skip message nine times. Following the suggestion from Thomas Gleixner, this is refactored to perform a single version check in main(). To satisfy the kselftest framework's requirement for the test count to match the declared plan, the plan is now conditionally set to 10 (for older kernels) or 19. While setting the plan conditionally may seem complex, it is the better approach to avoid the alternatives: either running tests on unsupported kernels that are known to fail, or emitting a noisy series of nine identical skip messages. A single informational message is now printed instead when the tests are skipped. Signed-off-by: Wake Liu Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250807085042.1690931-1-wakel@google.com/ Link: https://patch.msgid.link/20251103114502.584940-1-wakel@google.com commit 4518767be9089ea4f54754ad27364d6134fc46e2 Author: Jianyun Gao Date: Sat Sep 27 17:34:10 2025 +0800 time: Fix a few typos in time[r] related code comments Signed-off-by: Jianyun Gao Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20250927093411.1509275-1-jianyungao89@gmail.com commit e67997021fd0d73f230ee0473da3ad4e3d3ce37c Author: Borislav Petkov (AMD) Date: Fri Nov 14 18:10:04 2025 +0100 x86/bugs: Get rid of the forward declarations Get rid of the forward declarations of the mitigation functions by moving their single caller below them. No functional changes. Suggested-by: Josh Poimboeuf Signed-off-by: Borislav Petkov (AMD) Acked-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20251105200447.GBaQut3w4dLilZrX-z@fat_crate.local commit bc089c47250e8923892873809471e54e05919d80 Author: Steven Rostedt Date: Fri Nov 14 14:22:33 2025 -0500 tracing: Convert function graph set_flags() to use a switch() statement Currently the set_flags() of the function graph tracer has a bunch of: if (bit == FLAG1) { [..] } if (bit == FLAG2) { [..] } To clean it up a bit, convert it over to a switch statement. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251114192319.117123664@kernel.org Signed-off-by: Steven Rostedt (Google) commit 5abb6ccb58f0626a0b7577908bcb698b18812eed Author: Steven Rostedt Date: Fri Nov 14 14:22:32 2025 -0500 tracing: Have function graph tracer option sleep-time be per instance Currently the option to have function graph tracer to ignore time spent when a task is sleeping is global when the interface is per-instance. Changing the value in one instance will affect the results of another instance that is also running the function graph tracer. This can lead to confusing results. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251114192318.950255167@kernel.org Fixes: c132be2c4fcc1 ("function_graph: Have the instances use their own ftrace_ops for filtering") Signed-off-by: Steven Rostedt (Google) commit 4132886e1b74d031a1de8f0e9bac44056cf57304 Author: Steven Rostedt Date: Fri Nov 14 14:22:31 2025 -0500 tracing: Move graph-time out of function graph options The option "graph-time" affects the function profiler when it is using the function graph infrastructure. It has nothing to do with the function graph tracer itself. The option only affects the global function profiler and does nothing to the function graph tracer. Move it out of the function graph tracer options and make it a global option that is only available at the top level instance. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251114192318.781711154@kernel.org Signed-off-by: Steven Rostedt (Google) commit 6479325eca0148d417a82f0edcb37b58c4c0cf0a Author: Steven Rostedt Date: Fri Nov 14 14:22:30 2025 -0500 tracing: Have function graph tracer option funcgraph-irqs be per instance Currently the option to trace interrupts in the function graph tracer is global when the interface is per-instance. Changing the value in one instance will affect the results of another instance that is also running the function graph tracer. This can lead to confusing results. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251114192318.613867934@kernel.org Fixes: c132be2c4fcc1 ("function_graph: Have the instances use their own ftrace_ops for filtering") Signed-off-by: Steven Rostedt (Google) commit deab487e0f9b39ae4603e22d7d00908ebfc9753c Author: Thomas Weißschuh Date: Fri Nov 14 14:43:58 2025 +0100 kbuild: allow architectures to override CC_CAN_LINK The generic test for CC_CAN_LINK assumes that all architectures use -m32 and -m64 to switch between 32-bit and 64-bit compilation. This is overly simplistic. Architectures may use other flags (-mabi, -m31, etc.) or may also require byte order handling (-mlittle-endian, -EL). Expressing all of the different possibilities will be very complicated and brittle. Instead allow architectures to supply their own logic which will be easy to understand and evolve. Both the boolean ARCH_HAS_CC_CAN_LINK and the string ARCH_USERFLAGS need to be implemented as kconfig does not allow the reuse of string options. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251114-kbuild-userprogs-bits-v3-3-4dee0d74d439@linutronix.de Signed-off-by: Nicolas Schier commit 80623f2c83d7de5c289d4240b8f4cef4103c51fc Author: Thomas Weißschuh Date: Fri Nov 14 14:43:57 2025 +0100 init: deduplicate cc-can-link.sh invocations The command to invoke scripts/cc-can-link.sh is very long and new usages are about to be added. Add a helper variable to make the code easier to read and maintain. Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251114-kbuild-userprogs-bits-v3-2-4dee0d74d439@linutronix.de Signed-off-by: Nicolas Schier commit d81d9d389b9b73acd68f300c8889c7fa1acd4977 Author: Thomas Weißschuh Date: Fri Nov 14 14:43:56 2025 +0100 kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings It is possible that the kernel toolchain generates warnings when used together with the system toolchain. This happens for example when the older kernel toolchain does not handle new versions of sframe debug information. While these warnings where ignored during the evaluation of CC_CAN_LINK, together with CONFIG_WERROR the actual userprog build will later fail. Example warning: .../x86_64-linux/13.2.0/../../../../x86_64-linux/bin/ld: error in /lib/../lib64/crt1.o(.sframe); no .sframe will be created collect2: error: ld returned 1 exit status Make sure that the very simple example program does not generate warnings already to avoid breaking the userprog compilations. Fixes: ec4a3992bc0b ("kbuild: respect CONFIG_WERROR for linker and assembler") Fixes: 3f0ff4cc6ffb ("kbuild: respect CONFIG_WERROR for userprogs") Signed-off-by: Thomas Weißschuh Reviewed-by: Nicolas Schier Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251114-kbuild-userprogs-bits-v3-1-4dee0d74d439@linutronix.de Signed-off-by: Nicolas Schier commit e54dd0474c281ebcd32ada4bdbe1e0ada2e1c22b Author: Sunday Adelodun Date: Thu Nov 6 12:39:38 2025 +0100 time: tick-oneshot: Add missing Return and parameter descriptions to kernel-doc Several functions in kernel/time/tick-oneshot.c are missing parameter and return value descriptions in their kernel-doc comments. This causes warnings during doc generation. Update the kernel-doc blocks to include detailed @param and Return: descriptions for better clarity and to fix kernel-doc warnings. No functional code changes are made. Signed-off-by: Sunday Adelodun Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251106113938.34693-3-adelodunolaoluwa@yahoo.com commit 2e1fe44e06e3f5ac234190a6680d6cd8147f3083 Author: Diogo Ivo Date: Mon Jun 30 09:48:42 2025 +0100 drm/tegra: Add NVJPG driver Add support for booting and using NVJPG on Tegra210 to the Host1x and TegraDRM drivers. This driver only supports the new TegraDRM uAPI. Acked-by: Mikko Perttunen Signed-off-by: Diogo Ivo Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250630-diogo-nvjpg-v3-1-a553c7e91354@tecnico.ulisboa.pt commit bf0a90fc907e47344f88e5b9b241082184dbac27 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:53 2025 +0200 PCI: Convert BAR sizes bitmasks to u64 PCIe r7.0, sec 7.8.6, defines resizable BAR sizes beyond the currently supported maximum of 128TB, which will require more than u32 to store the entire bitmask. Convert Resizable BAR related functions to use u64 bitmask for BAR sizes to make the typing more future-proof. The support for the larger BAR sizes themselves is not added at this point. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Link: https://patch.msgid.link/20251113180053.27944-12-ilpo.jarvinen@linux.intel.com commit c7df7059e3baa1df96d03429923cc137f134658c Author: Ilpo Järvinen Date: Thu Nov 13 20:00:52 2025 +0200 drm/amdgpu: Use pci_rebar_get_max_size() Use pci_rebar_get_max_size() to simplify amdgpu_device_resize_fb_bar(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Link: https://patch.msgid.link/20251113180053.27944-11-ilpo.jarvinen@linux.intel.com commit 46ba95bed95424080671a38ecfb872954e1707bd Author: Ilpo Järvinen Date: Thu Nov 13 20:00:51 2025 +0200 drm/xe/vram: Use pci_rebar_get_max_size() Use pci_rebar_get_max_size() from PCI core in resize_vram_bar() to simplify code. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Acked-by: Christian König Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20251113180053.27944-10-ilpo.jarvinen@linux.intel.com commit 1c680f2acdbb3b64965962ca060a6daa6379575d Author: Ilpo Järvinen Date: Thu Nov 13 20:00:50 2025 +0200 PCI: Add pci_rebar_get_max_size() Add pci_rebar_get_max_size() to allow simplifying code that wants to know the maximum possible size for a Resizable BAR. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Link: https://patch.msgid.link/20251113180053.27944-9-ilpo.jarvinen@linux.intel.com commit 2987a64de3f257028998c3f1b5b9646359bda94f Author: Ilpo Järvinen Date: Thu Nov 13 20:00:49 2025 +0200 drm/xe/vram: Use PCI rebar helpers in resize_vram_bar() PCI core provides pci_rebar_size_supported() and pci_rebar_size_to_bytes(); use them in resize_vram_bar() to simplify code. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Acked-by: Christian König Acked-by: Rodrigo Vivi Link: https://patch.msgid.link/20251113180053.27944-8-ilpo.jarvinen@linux.intel.com commit c59038d3c059451267b111629ab5b9404f3b3015 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:48 2025 +0200 drm/i915/gt: Use pci_rebar_size_supported() PCI core provides pci_rebar_size_supported() that helps in checking if an encoded BAR Size is supported for the BAR or not. Use it in i915_resize_lmem_bar() to simplify code. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Jani Nikula Reviewed-by: Andi Shyti Acked-by: Christian König Acked-by: Jani Nikula Link: https://patch.msgid.link/20251113180053.27944-7-ilpo.jarvinen@linux.intel.com commit bb1fabd0d94efc29f88f86fb996c40ac06db3669 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:47 2025 +0200 PCI: Add pci_rebar_size_supported() helper Many callers of pci_rebar_get_possible_sizes() are interested in finding out if a particular encoded BAR Size (PCIe r7.0, sec 7.8.6.3) is supported by the particular BAR. Add pci_rebar_size_supported() into PCI core to make it easy for the drivers to determine if the BAR size is supported or not. Use the new function in pci_resize_resource() and in pci_iov_vf_bar_set_size(). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Reviewed-by: Andi Shyti Link: https://patch.msgid.link/20251113180053.27944-6-ilpo.jarvinen@linux.intel.com commit ce04b2f9b0b59f2962c4632f3c6abf08601729e7 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:46 2025 +0200 PCI: Improve Resizable BAR functions kernel doc Fix the copy-pasted errors in the Resizable BAR handling functions kernel doc and generally improve wording choices. Fix the formatting errors of the Return: line. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Link: https://patch.msgid.link/20251113180053.27944-5-ilpo.jarvinen@linux.intel.com commit a337869885083131e575c6367c679f4da4b68bb0 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:45 2025 +0200 PCI: Move pci_rebar_size_to_bytes() and export it pci_rebar_size_to_bytes() is in drivers/pci/pci.h but would be useful for endpoint drivers as well. Move the function to rebar.c and export it. In addition, convert the literal to where the number comes from (PCI_REBAR_MIN_SIZE). Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Link: https://patch.msgid.link/20251113180053.27944-4-ilpo.jarvinen@linux.intel.com commit 876e15943e9205096441cbe520dc9ccf82df8344 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:44 2025 +0200 PCI: Move pci_rebar_bytes_to_size() and clean it up Move pci_rebar_bytes_to_size() from include/linux/pci.h to rebar.c as it does not look very trivial and is not expected to be performance critical. Convert literals to use a newly added PCI_REBAR_MIN_SIZE define. Also add kernel doc for the function as the function is exported. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Reviewed-by: Michael J. Ruhl Link: https://patch.msgid.link/20251113180053.27944-3-ilpo.jarvinen@linux.intel.com commit 9f71938cd77f32a448f40a288e409eca60e55486 Author: Ilpo Järvinen Date: Thu Nov 13 20:00:43 2025 +0200 PCI: Move Resizable BAR code to rebar.c For lack of a better place to put it, Resizable BAR code has been placed inside pci.c and setup-res.c that do not use it for anything. Upcoming changes are going to add more Resizable BAR related functions, increasing the code size. As pci.c is huge as is, move the Resizable BAR related code and the BAR resize code from setup-res.c to rebar.c. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Christian König Link: https://patch.msgid.link/20251113180053.27944-2-ilpo.jarvinen@linux.intel.com commit 7409c1b12c5b11157d10108db644bd39c0a99426 Author: Ilpo Järvinen Date: Thu Nov 13 18:26:28 2025 +0200 PCI: Prevent restoring assigned resources restore_dev_resource() copies saved addresses and flags from the struct pci_dev_resource back to the struct resource, typically, during rollback from a failure or in preparation for a retry attempt. If the resource is within resource tree, the resource must not be modified as the resource tree could be corrupted. Thus, it's a bug to call restore_dev_resource() for assigned resources (which did happen due to logic flaws in the BAR resize rollback). Add WARN_ON_ONCE() into restore_dev_resource() to detect such bugs easily and return without altering the resource to prevent corruption. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-12-ilpo.jarvinen@linux.intel.com commit db92e3fef53e2083001dcc4c86a3ecff4ab4dc4e Author: Ilpo Järvinen Date: Thu Nov 13 18:26:27 2025 +0200 drm/amdgpu: Remove driver side BAR release before resize PCI core handles releasing device's resources and their rollback in case of failure of a BAR resizing operation. Releasing resource prior to calling pci_resize_resource() prevents PCI core from restoring the BARs as they were. Remove driver-side release of BARs from the amdgpu driver. Also remove the driver initiated assignment as pci_resize_resource() should try to assign as much as possible. If the driver side call manages to get more required resources assigned in some scenario, such a problem should be fixed inside pci_resize_resource() instead. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-11-ilpo.jarvinen@linux.intel.com commit 4efaa80b3d75bdbe8fd1f8ef56e6541511da4600 Author: Ilpo Järvinen Date: Thu Nov 13 18:26:26 2025 +0200 drm/i915: Remove driver side BAR release before resize PCI core handles releasing device's resources and their rollback in case of failure of a BAR resizing operation. Releasing resource prior to calling pci_resize_resource() prevents PCI core from restoring the BARs as they were. Remove driver-side release of BARs from the i915 driver. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251113162628.5946-10-ilpo.jarvinen@linux.intel.com commit 1a3c05b32bf06f3440ddd8a6fef97e628f14aaec Author: Ilpo Järvinen Date: Thu Nov 13 18:26:25 2025 +0200 drm/xe: Remove driver side BAR release before resize PCI core handles releasing device's resources and their rollback in case of failure of a BAR resizing operation. Releasing resource prior to calling pci_resize_resource() prevents PCI core from restoring the BARs as they were. Remove driver-side release of BARs from the xe driver. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251113162628.5946-9-ilpo.jarvinen@linux.intel.com commit d787018e2dfdc4c1331538e7a8717690d1b7c9b3 Author: Ilpo Järvinen Date: Thu Nov 13 18:26:24 2025 +0200 PCI: Add kerneldoc for pci_resize_resource() As pci_resize_resource() is meant to be used also outside of PCI core, document the interface with kerneldoc. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-8-ilpo.jarvinen@linux.intel.com commit 337b1b566db087347194e4543ddfdfa5645275cc Author: Ilpo Järvinen Date: Thu Nov 13 18:26:23 2025 +0200 PCI: Fix restoring BARs on BAR resize rollback path BAR resize operation is implemented in the pci_resize_resource() and pbus_reassign_bridge_resources() functions. pci_resize_resource() can be called either from __resource_resize_store() from sysfs or directly by the driver for the Endpoint Device. The pci_resize_resource() requires that caller has released the device resources that share the bridge window with the BAR to be resized as otherwise the bridge window is pinned in place and cannot be changed. pbus_reassign_bridge_resources() rolls back resources if the resize operation fails, but rollback is performed only for the bridge windows. Because releasing the device resources are done by the caller of the BAR resize interface, these functions performing the BAR resize do not have access to the device resources as they were before the resize. pbus_reassign_bridge_resources() could try __pci_bridge_assign_resources() after rolling back the bridge windows as they were, however, it will not guarantee the resource are assigned due to differences in how FW and the kernel assign the resources (alignment of the start address and tail). To perform rollback robustly, the BAR resize interface has to be altered to also release the device resources that share the bridge window with the BAR to be resized. Also, remove restoring from the entries failed list as saved list should now contain both the bridge windows and device resources so the extra restore is duplicated work. Some drivers (currently only amdgpu) want to prevent releasing some resources. Add exclude_bars param to pci_resize_resource() and make amdgpu pass its register BAR (BAR 2 or 5), which should never be released during resize operation. Normally 64-bit prefetchable resources do not share a bridge window with the 32-bit only register BAR, but there are various fallbacks in the resource assignment logic which may make the resources share the bridge window in rare cases. This change (together with the driver side changes) is to counter the resource releases that had to be done to prevent resource tree corruption in the ("PCI: Release assigned resource before restoring them") change. As such, it likely restores functionality in cases where device resources were released to avoid resource tree conflicts which appeared to be "working" when such conflicts were not correctly detected by the kernel. Reported-by: Simon Richter Link: https://lore.kernel.org/linux-pci/f9a8c975-f5d3-4dd2-988e-4371a1433a60@hogyros.de/ Reported-by: Alex Bennée Link: https://lore.kernel.org/linux-pci/874irqop6b.fsf@draig.linaro.org/ Signed-off-by: Ilpo Järvinen [bhelgaas: squash amdgpu BAR selection from https://lore.kernel.org/r/20251114103053.13778-1-ilpo.jarvinen@linux.intel.com] Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Reviewed-by: Christian König Link: https://patch.msgid.link/20251113162628.5946-7-ilpo.jarvinen@linux.intel.com commit 1d8a0506f69895b7cfd9d5c4546761c508231a8a Author: Ilpo Järvinen Date: Thu Nov 13 18:26:22 2025 +0200 PCI: Free saved list without holding pci_bus_sem Freeing the saved list does not require holding pci_bus_sem, so the critical section can be made shorter. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-6-ilpo.jarvinen@linux.intel.com commit 121d3e9e4b217f2f23715901fb15c6a3ca2bab46 Author: Ilpo Järvinen Date: Thu Nov 13 18:26:21 2025 +0200 PCI: Try BAR resize even when no window was released Usually, resizing BARs requires releasing bridge windows in order to resize it to fit a larger BAR into the window. This is not always the case, however, FW could have made the window large enough to accommodate larger BAR as is, or the user might prefer to shrink a BAR to make more space for another Resizable BAR. Thus, replace the check that requires that at least one bridge window was released with a check that simply ensures bridge is not NULL. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-5-ilpo.jarvinen@linux.intel.com commit 34c702ea0497e092a487eacdf28a037f43e3e39f Author: Ilpo Järvinen Date: Thu Nov 13 18:26:20 2025 +0200 PCI: Change pci_dev variable from 'bridge' to 'dev' Upcoming fix to BAR resize will store also device BAR resource in the saved list. Change the pci_dev variable in the loop from 'bridge' to 'dev' as the former would be misleading with non-bridges in the list. This is in a separate change to reduce churn in the upcoming BAR resize fix. While it appears that the logic in the loop doing pci_setup_bridge() is altered as 'bridge' variable is no longer updated, a bridge should never appear more than once in the saved list so the check can only match to the first entry. As such, the code with two distinct pci_dev variables better represents the intention of the check compared with the old code where bridge variable was reused for a different purpose. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Reviewed-by: Alex Bennée Link: https://patch.msgid.link/20251113162628.5946-4-ilpo.jarvinen@linux.intel.com commit 4687b3315a3f76647746f5b7f92684cf1045b085 Author: Ilpo Järvinen Date: Thu Nov 13 18:26:19 2025 +0200 PCI/IOV: Adjust ->barsz[] when changing BAR size pci_rebar_set_size() adjusts BAR size for both normal and IOV BARs. The struct pci_sriov keeps a cached copy of BAR size in ->barsz[] which is not adjusted by pci_rebar_set_size() but by pci_iov_resource_set_size(). pci_iov_resource_set_size() is called also from pci_resize_resource_set_size(). The current arrangement is problematic once BAR resize algorithm starts to roll back changes properly in case of a failure. The normal resource fitting algorithm rolls back resource size using the struct pci_dev_resource easily but also calling pci_resize_resource_set_size() or pci_iov_resource_set_size() to roll back BAR size would be an extra burden, whereas combining ->barsz[] update with pci_rebar_set_size() naturally rolls back it when restoring the old BAR size on a different layer of the BAR resize operation. Thus, rework pci_rebar_set_size() to also update ->barsz[]. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-3-ilpo.jarvinen@linux.intel.com commit 91c4c89db41499eea1b29c56655f79c3bae66e93 Author: Ilpo Järvinen Date: Thu Nov 13 18:26:18 2025 +0200 PCI: Prevent resource tree corruption when BAR resize fails pbus_reassign_bridge_resources() saves bridge windows into the saved list before attempting to adjust resource assignments to perform a BAR resize operation. If resource adjustments cannot be completed fully, rollback is attempted by restoring the resource from the saved list. The rollback, however, does not check whether the resources it restores were assigned by the partial resize attempt. If restore changes addresses of the resource, it can result in corrupting the resource tree. An example of a corrupted resource tree with overlapping addresses: 6200000000000-6203fbfffffff : pciex@620c3c0000000 6200000000000-6203fbff0ffff : PCI Bus 0030:01 6200020000000-62000207fffff : 0030:01:00.0 6200000000000-6203fbff0ffff : PCI Bus 0030:02 A resource that are assigned into the resource tree must remain unchanged. Thus, release such a resource before attempting to restore and claim it back. For simplicity, always do the release and claim back for the resource even in the cases where it is restored to the same address range. Note: this fix may "break" some cases where devices "worked" because the resource tree corruption allowed address space double counting to fit more resource than what can now be assigned without double counting. The upcoming changes to BAR resizing should address those scenarios (to the extent possible). Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs") Reported-by: Simon Richter Link: https://lore.kernel.org/linux-pci/67840a16-99b4-4d8c-9b5c-4721ab0970a2@hogyros.de/ Reported-by: Alex Bennée Link: https://lore.kernel.org/linux-pci/874irqop6b.fsf@draig.linaro.org/ Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Tested-by: Alex Bennée # AVA, AMD GPU Link: https://patch.msgid.link/20251113162628.5946-2-ilpo.jarvinen@linux.intel.com commit 905f0dcc38f8078f0641c5cf855f420d78f10ea7 Author: Haotien Hsu Date: Mon Aug 11 15:45:55 2025 +0800 dt-bindings: usb: Add wake-up support for Tegra234 XUSB host controller Populate USB wake events for Tegra234 XUSB host controller. These wake-up events are optional to maintain backward compatibility and because the USB controller does not require them for normal operation. Signed-off-by: Haotien Hsu Acked-by: Conor Dooley Signed-off-by: Thierry Reding commit 275d6d1189e6d5f8e7c1da43ffd4b09d7089f174 Author: Tom Lendacky Date: Mon Oct 27 14:33:52 2025 -0500 KVM: SEV: Add known supported SEV-SNP policy bits Add to the known supported SEV-SNP policy bits that don't require any implementation support from KVM in order to successfully use them. At this time, this includes: - CXL_ALLOW - MEM_AES_256_XTS - RAPL_DIS - CIPHERTEXT_HIDING_DRAM - PAGE_SWAP_DISABLE Arguably, RAPL_DIS and CIPHERTEXT_HIDING_DRAM require KVM and the CCP driver to enable these features in order for the setting of the policy bits to be successfully handled. But, a guest owner may not wish their guest to run on a system that doesn't provide support for those features, so allowing the specification of these bits accomplishes that. Whether or not the bit is supported by SEV firmware, a system that doesn't support these features will either fail during the KVM validation of supported policy bits before issuing the LAUNCH_START or fail during the LAUNCH_START. Signed-off-by: Tom Lendacky Link: https://patch.msgid.link/ec040de9864099cf592a97c201dc4cc110b2b0cf.1761593632.git.thomas.lendacky@amd.com Signed-off-by: Sean Christopherson commit 7a61d61396b97fd6bb9b9bde321c68513034ad11 Author: Tom Lendacky Date: Mon Oct 27 14:33:51 2025 -0500 KVM: SEV: Publish supported SEV-SNP policy bits Define the set of policy bits that KVM currently knows as not requiring any implementation support within KVM. Provide this value to userspace via the KVM_GET_DEVICE_ATTR ioctl. Signed-off-by: Tom Lendacky Link: https://patch.msgid.link/c596f7529518f3f826a57970029451d9385949e5.1761593632.git.thomas.lendacky@amd.com Signed-off-by: Sean Christopherson commit c9434e64e8b4d17511f514f7495008f573595e3e Author: Tom Lendacky Date: Mon Oct 27 14:33:50 2025 -0500 crypto: ccp - Add an API to return the supported SEV-SNP policy bits Supported policy bits are dependent on the level of SEV firmware that is currently running. Create an API to return the supported policy bits for the current level of firmware. Signed-off-by: Tom Lendacky Acked-by: Herbert Xu Link: https://patch.msgid.link/e3f711366ddc22e3dd215c987fd2e28dc1c07f54.1761593632.git.thomas.lendacky@amd.com Signed-off-by: Sean Christopherson commit dd03d34d6d8e7a3f62450fb7a1408d86fb35487c Author: Haotien Hsu Date: Mon Aug 11 15:45:57 2025 +0800 soc/tegra: pmc: Add USB wake events for Tegra234 Add USB wake events for Tegra234 so that system can be woken up from suspend when USB devices hot-plug/unplug event is detected. Signed-off-by: Haotien Hsu Signed-off-by: Thierry Reding commit ce62118a2e4838bcef1050fff55001a0bf87f0cb Author: Tom Lendacky Date: Mon Oct 27 14:33:49 2025 -0500 KVM: SEV: Consolidate the SEV policy bits in a single header file Consolidate SEV policy bit definitions into a single file. Use include/linux/psp-sev.h to hold the definitions and remove the current definitions from the arch/x86/kvm/svm/sev.c and arch/x86/include/svm.h files. No functional change intended. Signed-off-by: Tom Lendacky Link: https://patch.msgid.link/d9639f88a0b521a1a67aeac77cc609fdea1f90bd.1761593632.git.thomas.lendacky@amd.com Signed-off-by: Sean Christopherson commit 1dc830ee4c155bff572a43a66b948e1c46483d6a Author: Guopeng Zhang Date: Fri Nov 14 18:24:40 2025 +0800 selftests/cgroup: conform test to KTAP format output Conform the layout, informational and status messages to KTAP. No functional change is intended other than the layout of output messages. Signed-off-by: Guopeng Zhang Suggested-by: Sebastian Chlad Acked-by: Michal Koutný Signed-off-by: Tejun Heo commit 33bedb92d26b746f00269fd5d04aab74480d2a06 Merge: 482dc84e91a597 7e71fa6e015e46 Author: Dave Jiang Date: Fri Nov 14 10:54:34 2025 -0700 Merge branch 'for-6.19/cxl-prm' into cxl-for-next - Simplify cxl_rd_ops allocation - Group xor arithmetric setup code - Remove local variable @inc in cxl_port_setup_targets() commit 7bc16e72ddb993d706f698c2f6cee694e485f557 Author: Thomas Weißschuh Date: Thu Nov 6 11:32:39 2025 +0100 kunit: Make filter parameters configurable via Kconfig Enable the preset of filter parameters from kconfig options, similar to how other KUnit configuration parameters are handled already. This is useful to run a subset of tests even if the cmdline is not readily modifyable. Link: https://lore.kernel.org/r/20251106-kunit-filter-kconfig-v1-1-d723fb7ac221@linutronix.de Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Signed-off-by: Shuah Khan commit ef8ff0429a1fc4e7fb899208f49c719ed8293f81 Author: Svyatoslav Ryhel Date: Tue Sep 9 10:33:35 2025 +0300 drm/tegra: dsi: Calculate packet parameters for video mode Calculate packet parameters for video mode same way it is done for command mode, by halving timings plugged into equations. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250909073335.91531-3-clamor95@gmail.com commit ae4235f7997f87a0c84a1a001684f148d06f3e69 Author: Svyatoslav Ryhel Date: Tue Sep 9 10:33:34 2025 +0300 drm/tegra: dsi: Make SOL delay calculation mode independent Move SOL delay calculation outside of video mode conditions. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250909073335.91531-2-clamor95@gmail.com commit 7e71fa6e015e46275efd900a728a42d5fcd75179 Author: Robert Richter Date: Fri Nov 14 08:58:43 2025 +0100 cxl/region: Remove local variable @inc in cxl_port_setup_targets() Simplify the code by removing local variable @inc. The variable is not used elsewhere, remove it and directly increment the target number. Reviewed-by: Jonathan Cameron Signed-off-by: Robert Richter Link: https://patch.msgid.link/20251114075844.1315805-4-rrichter@amd.com Signed-off-by: Dave Jiang commit c42a4d2ee3b2c432ada9080e29343f4b27ad72bf Author: Robert Richter Date: Fri Nov 14 08:58:42 2025 +0100 cxl/acpi: Group xor arithmetric setup code in a single block Simplify the xor arithmetric setup code by grouping it in a single block. No need to split the block for QoS setup. It is safe to reorder the call of cxl_setup_extended_linear_cache() because there are no dependencies. Reviewed-by: Jonathan Cameron Signed-off-by: Robert Richter Tested-by: Gregory Price Link: https://patch.msgid.link/20251114075844.1315805-3-rrichter@amd.com Signed-off-by: Dave Jiang commit 6123133ee90fc55a5437364d442dd5876648628d Author: Robert Richter Date: Fri Nov 14 08:58:41 2025 +0100 cxl: Simplify cxl_rd_ops allocation and handling A root decoder's callback handlers are collected in struct cxl_rd_ops. The structure is dynamically allocated, though it contains only a few pointers in it. This also requires to check two pointes to check for the existence of a callback. Simplify the allocation, release and handler check by embedding the ops statically in struct cxl_root_decoder. Implementation is equivalent to how struct cxl_root_ops handles the callbacks. [ dj: Fix spelling error in commit log. ] Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Robert Richter Link: https://patch.msgid.link/20251114075844.1315805-2-rrichter@amd.com Signed-off-by: Dave Jiang commit b80a7b4713c967479752ea4801eb1d1933093f58 Author: Manikandan K Pillai Date: Sat Nov 8 22:02:58 2025 +0800 PCI: cadence: Move PCIe RP common functions to a separate file Move the Cadence PCIe controller RP common functions into a separate file. The common library functions are split from legacy PCIe RP controller functions to a separate file. Signed-off-by: Manikandan K Pillai [mani: removed the unused variable] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251108140305.1120117-4-hans.zhang@cixtech.com commit 3977be25f5fd973cad6bed810ac1045ba8cfbfa6 Author: Manikandan K Pillai Date: Sat Nov 8 22:02:57 2025 +0800 PCI: cadence: Split PCIe controller header file Split the Cadence PCIe header file by moving the Legacy (LGA) controller register definitions to a separate header file for support of next generation PCIe controller architecture. Signed-off-by: Manikandan K Pillai Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251108140305.1120117-3-hans.zhang@cixtech.com commit 611627a4e5e4af7b96aab4f10d130f6a8a615020 Author: Manikandan K Pillai Date: Sat Nov 8 22:02:56 2025 +0800 PCI: cadence: Add module support for platform controller driver Add support for building PCI cadence platforms as a module. Signed-off-by: Manikandan K Pillai Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251108140305.1120117-2-hans.zhang@cixtech.com commit bfe68975768a983d4e59c7fb465301999b863a7e Author: Mikko Perttunen Date: Wed Sep 17 10:48:30 2025 +0900 gpu: host1x: Syncpoint interrupt performance optimization Optimize performance of syncpoint interrupt handling by reading the status register in 64-bit chunks when possible, and skipping processing when the read value is zero. Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20250917-host1x-syncpt-irq-perf-v2-1-736ef69b1347@nvidia.com commit 0d5077c73aceb51ef10d096160dd62a11db2f3e4 Author: Steven Rostedt Date: Wed Nov 12 11:35:56 2025 -0500 MAINTAINERS: Add Tomas Glozar as a maintainer to RTLA tool Tomas will start taking over managing the changes to the Real-time Linux Analysis (RTLA) tool. Make him officially one of the maintainers. Also update the RTLA entry to include the linux-kernel mailing list as well as list the patchwork and git repository that the patches will go through. Cc: Tomas Glozar Cc: Gabriele Monaco Cc: John Kacur Cc: Crystal Wood Cc: Linus Torvalds Link: https://patch.msgid.link/20251112113556.47ec9d12@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 23a29a81b44e3a7a139fee4d3eada5f299d8985e Author: Jon Hunter Date: Fri Oct 10 11:36:12 2025 +0100 ARM: tegra: Enable EXT4 for Tegra After commit d6ace46c82fd ("ext4: remove obsolete EXT3 config options") was added, when using the 'tegra_defconfig' kernel configuration, mounting an MMC device on Tegra20, Tegra30 and Tegra124 boards is failing with "unknown filesystem type 'ext4'". Fix this by updating the 'tegra_defconfig' to use the EXT4 config options and remove the obselete EXT2/3 options. Fixes: d6ace46c82fd ("ext4: remove obsolete EXT3 config options") Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit 22c788aec2efc80d6c8f4e8fa00c5a4fb10f8956 Author: Aaron Kling Date: Tue Oct 21 22:09:26 2025 -0500 dt-bindings: devfreq: tegra30-actmon: Add Tegra124 fallback for Tegra210 The Tegra210 actmon is compatible with the existing Tegra124 driver. Describe the compatibles as such. Acked-by: Chanwoo Choi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit 500e1368e46928f4b2259612dcabb6999afae2a6 Author: Johan Hovold Date: Thu Sep 25 17:00:07 2025 +0200 amba: tegra-ahb: Fix device leak on SMMU enable Make sure to drop the reference taken to the AHB platform device when looking up its driver data while enabling the SMMU. Note that holding a reference to a device does not prevent its driver data from going away. Fixes: 89c788bab1f0 ("ARM: tegra: Add SMMU enabler in AHB") Cc: stable@vger.kernel.org # 3.5 Signed-off-by: Johan Hovold Signed-off-by: Thierry Reding commit f224e936dad0933a1baa3b7152f48918cdd98498 Author: Svyatoslav Ryhel Date: Tue Oct 28 11:25:26 2025 +0200 ARM: tegra: Add device-tree for Xiaomi Mi Pad (A0101) The Mi Pad is a tablet computer based on Nvidia Tegra K1 SoC which originally ran the Android operating system. The Mi Pad has a 7.9" IPS display with 1536 x 2048 (324 ppi) resolution. 2 GB of RAM and 16/64 GB of internal memory that can be supplemented with a microSDXC card giving up to 128 GB of additional storage. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Thierry Reding commit aaca2e9933a362bcd89ec563b3e89de18460335f Author: Thierry Reding Date: Wed Oct 29 16:10:33 2025 +0100 soc/tegra: pmc: Document tegra_pmc.syscore field This eliminates a warning from the documentation build targets. Signed-off-by: Thierry Reding commit 1c458bbe4b335d1675c47d64df0c8cd34961d2bf Author: Prathamesh Shete Date: Fri Nov 14 16:17:11 2025 +0000 soc/tegra: pmc: Don't fail if "aotag" is not present The "aotog" is an optional aperture, so if that aperture is not defined for a given device, then initialise the 'aotag' pointer to NULL instead of returning an error. Note that the PMC driver will not use 'aotag' pointer if initialised to NULL. Co-developed-by: Shardar Mohammed Signed-off-by: Shardar Mohammed Signed-off-by: Prathamesh Shete Signed-off-by: Jon Hunter Signed-off-by: Thierry Reding commit ccd3b4c7c37fbbd3e5244d3c54ca24ae0a37810d Author: Timur Kristóf Date: Fri Nov 14 13:07:36 2025 +0100 drm/amdgpu: Use amdgpu by default on SI dedicated GPUs (v2) Now that the DC analog connector support and VCE1 support landed, amdgpu is at feature parity with the old radeon driver on SI dGPUs. Enabling the amdgpu driver by default for SI dGPUs has the following benefits: - More stable OpenGL support through RadeonSI - Vulkan support through RADV - Improved performance - Better display features through DC Users who want to keep using the old driver can do so using: amdgpu.si_support=0 radeon.si_support=1 v2: - Update documentation in Kconfig file Reviewed-by: Christian König Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit c034426671d0aa3eed9a7cc924bdd2ae3b76fd5d Author: Timur Kristóf Date: Fri Nov 14 09:26:08 2025 -0500 drm/amdgpu: Use amdgpu by default on CIK dedicated GPUs The amdgpu driver has been working well on CIK dGPUs for years. Now that the DC analog connector support landed, amdgpu is at feature parity with the old radeon driver on CIK dGPUs. Enabling the amdgpu driver by default for CIK dGPUs has the following benefits: - More stable OpenGL support through RadeonSI - Vulkan support through RADV - Improved performance - Better display features through DC Users who want to keep using the old driver can do so using: amdgpu.cik_support=0 radeon.cik_support=1 v2: - Update documentation in Kconfig file v3: - Rebase documentation updates (Alex) Reviewed-by: Christian König Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 6a37539973f8a38e7e165a6bcdeb107edf7c490a Author: YiPeng Chai Date: Thu Oct 23 14:47:07 2025 +0800 drm/amdgpu: Fix the issue of missing ras message on sriov host This code only applies to amdgpu processing poison consumption after uniras is enabled, but not to sriov. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 2b198d459f0983313fc090b1527c68569f406575 Author: YiPeng Chai Date: Mon Jul 21 15:22:27 2025 +0800 drm/amdgpu: Add lock to serialize sriov command execution Add lock to serialize sriov command execution. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit c0e870407bcaf4c1e074aedb4df3a43eb3f05303 Author: YiPeng Chai Date: Tue Nov 11 16:56:35 2025 +0800 drm/amdgpu: Synchronize sriov host to add block_mmsch bit field Synchronize sriov host to add block_mmsch bit field. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 991a4343b47acd34ba3541be76a5b3ff6fa71f9f Author: Christian König Date: Tue Oct 28 11:16:12 2025 +0100 drm/amdgpu: use GFP_ATOMIC instead of NOWAIT in the critical path Otherwise job submissions can fail with ENOMEM. We probably need to re-design the per VMID tracking at some point. Signed-off-by: Christian König Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4258 Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 20459c098d688971237e56e30263ddce467c8c9b Author: Christian König Date: Wed Oct 29 15:36:32 2025 +0100 drm/amdgpu: avoid memory allocation in the critical code path v3 When we run out of VMIDs we need to wait for some to become available. Previously we were using a dma_fence_array for that, but this means that we have to allocate memory. Instead just wait for the first not signaled fence from the least recently used VMID to signal. That is not as efficient since we end up in this function multiple times again, but allocating memory can easily fail or deadlock if we have to wait for memory to become available. v2: remove now unused VM manager fields v3: fix dma_fence reference Signed-off-by: Christian König Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4258 Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f8bdb559c01e8291f1862ee9ab4a7eb13d6d62ac Author: Will Aitken Date: Tue Oct 7 14:49:15 2025 +0000 drm/amdgpu: Enable xgmi extended peer links for sriov guest The amd-smi tool relies on extended peer link information to report xgmi link metrics. The necessary xgmi ta command, GET_EXTEND_PEER_LINKS, has been enabled in the host driver and this change is necessary for the guest to make use of it. To handle the case where the host driver does not have the latest xgmi ta, the guest driver checks for guest support through a pf2vf feature flag before invoking psp. Signed-off-by: Will Aitken Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 4d0e55965c9c2f085a83f6a69acd7b5a44132de5 Author: Will Aitken Date: Tue Oct 7 14:19:45 2025 +0000 drm/amdgpu: Update headers for sriov xgmi ext peer link support feature flag Adds new sriov msg flag to match host, feature flag in the amdgim enum, and a wrapper macro to check it. Signed-off-by: Will Aitken Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit f1a2cd427d0401c1888c04613fb18d272825a5c2 Author: Will Aitken Date: Tue Sep 30 16:24:07 2025 +0000 drm/amdgpu: Refactor sriov xgmi topology filling to common code amdgpu_xgmi_fill_topology_info and psp_xgmi_reflect_topology_info perform the same logic of copying topology info of one node to every other node in the hive. Instead of having two functions that purport to do the same thing, this refactoring moves the logic of the fill function to the reflect function and adds reflecting port number info as well for complete functionality. Signed-off-by: Will Aitken Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit b84bc92607144f04c5d140177fe45faec0ec9b9b Author: Timur Kristóf Date: Sun Nov 9 16:41:06 2025 +0100 drm/amdgpu: Use amdgpu by default on CIK dedicated GPUs The amdgpu driver has been working well on CIK dGPUs for years. Now that the DC analog connector support landed, these GPUs are at feature parity with the old radeon driver. Additionally, amdgpu yields extra performance, supports Vulkan and provides more display features through DC as well as more robust power management. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 7fe9ad4011fa550081cd6675fb8251e9c5973c59 Author: Timur Kristóf Date: Sun Nov 9 16:41:05 2025 +0100 drm/amdgpu: Refactor how SI and CIK support is determined Move the determination into a separate function. Change amdgpu.si_support and amdgpu.cik_support so that their default value is -1 (default). This prepares the code for changing the default driver based on the chip. Also adjust the module param documentation. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 5c1a781af370c498b367f9b7ff9e3eb35328d4d2 Author: Timur Kristóf Date: Sun Nov 9 16:41:04 2025 +0100 drm/radeon: Refactor how SI and CIK support is determined Move the determination into a separate function. Change radeon.si_support and radeon.cik_support so that their default value is -1 (default). This prepares the code for changing the default driver based on the chip. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 43d08222adf70f6b3ff6ded8dd8e8e4ed3ceff05 Author: Lijo Lazar Date: Thu Nov 6 13:49:59 2025 +0530 drm/amdgpu: Avoid xgmi register access On single GPU systems, avoid accesses to XGMI link registers. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3402bc010d7630acafde9cbe893e926617f439d8 Author: Srinivas Pandruvada Date: Thu Nov 13 13:21:03 2025 -0800 Documentation: thermal: Document thermal throttling on Intel platforms Add documentation for Intel thermal throttling reporting events. Signed-off-by: Srinivas Pandruvada Tested-by: Randy Dunlap [ rjw: Subject adjustment, file name change, minor edits ] Link: https://patch.msgid.link/20251113212104.221632-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 05b0e94153e313132b594783fa6a3fe9e0100595 Merge: c2561572031a1a e65b871c9b5af9 Author: Mark Brown Date: Fri Nov 14 16:20:06 2025 +0000 ASoC: codecs: pm4125: Two minor fixes for Merge series from Krzysztof Kozlowski : I marked these as fixes, but the issue is not likely to trigger in normal conditions. Not tested on hardware, please kindly provide tested-by, the best with some probe bind/unbind cycle. commit c2561572031a1a0ac94d1112fd9b768f65d9bdd5 Merge: 6402ddf3027d89 8ff3dcb0e8a8bf Author: Mark Brown Date: Fri Nov 14 16:20:02 2025 +0000 ASoC: codecs: lpass-macro: complete sm6115 support Merge series from Srinivas Kandagatla : This patch series fixes SM6115 lpass codec macro support and adding missing dt-bindings to complete support for SM6115. SM6115 lpass codec macro support is added partially and broken to some extent, Fix this broken support and add complete lpass macro support for this SoC. commit 688dfe40b4d7b33047cfa009f4f88a9526265126 Author: Aaron Kling Date: Tue Oct 21 22:11:15 2025 -0500 soc/tegra: fuse: speedo-tegra210: Add SoC speedo 2 The Jetson Nano series of modules only have 2 EMC table entries, different from other SoC SKUs. As the EMC driver uses the SoC speedo ID to populate the EMC OPP tables, add a new speedo ID to uniquely identify this. Signed-off-by: Aaron Kling Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit ce27c9c2129679551c4e5fe71c1c5d42fff399c2 Author: Aaron Kling Date: Tue Sep 23 11:58:05 2025 -0500 soc/tegra: fuse: speedo-tegra210: Update speedo IDs Existing code only sets CPU and GPU speedo IDs 0 and 1. The CPU DVFS code supports 11 IDs and nouveau supports 5. This aligns with what the downstream vendor kernel supports. Align SKUs with the downstream list. The Tegra210 CVB tables were added in the first referenced fixes commit. Since then, all Tegra210 SoCs have tried to scale to 1.9 GHz, when the supported devkits are only supposed to scale to 1.5 or 1.7 GHZ. Overclocking should not be the default state. Fixes: 2b2dbc2f94e5 ("clk: tegra: dfll: add CVB tables for Tegra210") Fixes: 579db6e5d9b8 ("arm64: tegra: Enable DFLL support on Jetson Nano") Signed-off-by: Aaron Kling Signed-off-by: Thierry Reding commit c94f134729491ab60fc68fcd919821014334db97 Merge: af330925a18ff4 059f545832be85 Author: Mark Brown Date: Fri Nov 14 16:15:36 2025 +0000 Add support for Microchip CoreSPI Controller Merge series from Prajna Rajendra Kumar : This patch series adds support for the Microchip FPGA CoreSPI "soft" IP and documents its device tree bindings. As preparation, the existing Microchip SPI driver is renamed to clearly indicate that it supports only the Microchip PolarFire SoC "hard" controller. Although it was originally named with the expectation that it might also cover the FPGA CoreSPI "soft" IP, the register layouts differ significantly, so separate drivers are required. commit 79bd8c9814a273fa7ba43399e1c07adec3fc95db Author: Rene Rebe Date: Fri Nov 14 15:30:33 2025 +0100 ps3disk: use memcpy_{from,to}_bvec index With 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec) converting ps3disk to new bvec helpers, incrementing the offset was accidently lost, corrupting consecutive buffers. Restore index for non-corrupted data transfers. Fixes: 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec) Signed-off-by: René Rebe Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit a10ad1b104024efe0a01d21ce7c08002cf4034c4 Author: Riwen Lu Date: Thu Nov 13 09:26:38 2025 +0800 PM: suspend: Make pm_test delay interruptible by wakeup events Modify the suspend_test() function to allow the test delay to be interrupted by wakeup events. This improves the responsiveness of the system during suspend testing when wakeup events occur, allowing the suspend process to proceed without waiting for the full test delay to complete when wakeup events are detected. Additionally, using msleep() instead of mdelay() avoids potential soft lockup "CPU stuck" issues when long test delays are configured. Co-developed-by: xiongxin Signed-off-by: xiongxin Signed-off-by: Riwen Lu [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251113012638.1362013-1-luriwen@kylinos.cn Signed-off-by: Rafael J. Wysocki commit 7b9725b3d1222c60571e8117f15fd8057b38ee83 Author: Mario Limonciello (AMD) Date: Wed Nov 12 16:40:25 2025 -0600 usb: sl811-hcd: Add PM_EVENT_POWEROFF into suspend callbacks When the PM core uses hibernation callbacks for shutdown drivers will receive PM_EVENT_POWEROFF and should handle it the same as PM_EVENT_HIBERNATE would have been used. Tested-by: Eric Naim Signed-off-by: Mario Limonciello (AMD) [ rjw: Changelog adjustment ] Link: https://patch.msgid.link/20251112224025.2051702-4-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 988dd0bd914d034860b969214e7f6b2217978565 Author: Mario Limonciello (AMD) Date: Wed Nov 12 16:40:24 2025 -0600 scsi: Add PM_EVENT_POWEROFF into suspend callbacks If the PM core uses hibernation callbacks for powering off the system, drivers will receive PM_EVENT_POWEROFF and should handle it the same as they previously handled PM_EVENT_HIBERNATE. Support this case in the scsi driver. No functional changes. Reviewed-by: Martin K. Petersen Tested-by: Eric Naim Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251112224025.2051702-3-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 0ca04993dac9b0d21ffbfd22bf54cc43ec2c49f2 Author: Mario Limonciello (AMD) Date: Wed Nov 12 16:40:23 2025 -0600 PM: Introduce new PMSG_POWEROFF event PMSG_POWEROFF will be used for the PM core to allow differentiating between a hibernation or shutdown sequence when re-using callbacks for common code. Hibernation is started by writing a hibernation method (such as 'platform' 'shutdown', or 'reboot') to use into /sys/power/disk and writing 'disk' to /sys/power/state. Shutdown is initiated with the reboot() syscall with arguments on whether to halt the system or power it off. Tested-by: Eric Naim Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251112224025.2051702-2-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit bdfacf441b04937656d6c1ad13f7e59c4f57b76a Merge: 58ca21d591994c 4e48e7baa3a1ac Author: Rafael J. Wysocki Date: Fri Nov 14 16:56:40 2025 +0100 Merge back earlier runtime PM changes for 6.19 commit 4702f4eceb639b6af199151e352e570943619d98 Author: Thomas Weißschuh Date: Mon Nov 10 10:38:53 2025 +0100 hrtimer: Store time as ktime_t in restart block The hrtimer core uses ktime_t to represent times, use that also for the restart block. CPU timers internally use nanoseconds instead of ktime_t but use the same restart block, so use the correct accessors for those. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251110-restart-block-expiration-v1-3-5d39cc93df4f@linutronix.de commit c42ba5a87bdccbca11403b7ca8bad1a57b833732 Author: Thomas Weißschuh Date: Mon Nov 10 10:38:52 2025 +0100 futex: Store time as ktime_t in restart block The futex core uses ktime_t to represent times, use that also for the restart block. This allows the simplification of the accessors. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Jan Kara Link: https://patch.msgid.link/20251110-restart-block-expiration-v1-2-5d39cc93df4f@linutronix.de commit 145cde94a5435920cb9f78aacfe91bea6795efaf Author: Shubhi Garg Date: Tue Oct 7 13:57:38 2025 +0000 arm64: defconfig: Enable NVIDIA VRS PSEQ RTC Enable NVIDIA VRS (Voltage Regulator Specification) RTC device module. It provides functionality to get/set system time, retain system time across boot, wake system from suspend and shutdown state. Supported platforms: - NVIDIA Jetson AGX Orin Developer Kit - NVIDIA IGX Orin Development Kit - NVIDIA Jetson Orin NX Developer Kit - NVIDIA Jetson Orin Nano Developer Kit Signed-off-by: Shubhi Garg Reviewed-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Thierry Reding commit b1806f2b4e781b010101f531e75bf8eda9aabff0 Author: Shubhi Garg Date: Tue Oct 7 13:57:36 2025 +0000 arm64: tegra: Add device-tree node for NVVRS RTC Add NVIDIA VRS (Voltage Regulator Specification) RTC device tree node for Tegra234 P3701 and P3767 platforms. Assign VRS RTC as primary RTC (rtc0). Signed-off-by: Shubhi Garg Reviewed-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Thierry Reding commit f481e772e014da92fa1232de54e4cac66b5fc5e4 Author: Krishna Kurapati Date: Fri Nov 14 11:45:53 2025 +0530 arm64: dts: qcom: sdx75: Add missing usb-role-switch property Add missing usb-role-switch property to usb controller node. Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/20251114061553.512441-3-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 101dae743d4bfa1c779de4ef1c65393cc4824d4e Author: Krishna Kurapati Date: Fri Nov 14 11:45:52 2025 +0530 arm64: dts: qcom: sdx75: Flatten usb controller node Flatten usb controller node and update to using latest bindings and flattened driver approach. Signed-off-by: Krishna Kurapati Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251114061553.512441-2-krishna.kurapati@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e13c1f34aa8675363f45593e85c125e15b9a4410 Author: Bruno Sobreira França Date: Fri Oct 24 01:35:14 2025 +0000 soc/tegra: Resolve a spelling error in the tegra194-cbb.c Fix a typo spotted during code reading. Signed-off-by: Bruno Sobreira França Reviewed-by: Jon Hunter Acked-by: Uwe Kleine-König Reviewed-by: Herve Codina Signed-off-by: Thierry Reding commit c87f820bc4748fdd4d50969e8930cd88d1b61582 Author: Kartik Rajput Date: Wed Oct 8 16:46:18 2025 +0530 soc/tegra: fuse: Do not register SoC device on ACPI boot On Tegra platforms using ACPI, the SMCCC driver already registers the SoC device. This makes the registration performed by the Tegra fuse driver redundant. When booted via ACPI, skip registering the SoC device and suppress printing SKU information from the Tegra fuse driver, as this information is already provided by the SMCCC driver. Fixes: 972167c69080 ("soc/tegra: fuse: Add ACPI support for Tegra194 and Tegra234") Cc: stable@vger.kernel.org Signed-off-by: Kartik Rajput Signed-off-by: Thierry Reding commit f797e587eb8bb7a8f11482b24c46e3359d8a9ffe Author: Svyatoslav Ryhel Date: Wed Oct 22 17:20:41 2025 +0300 arm64: tegra: Move avdd-dsi-csi-supply into CSI node avdd-dsi-csi-supply belongs in CSI node, not VI. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Tested-by: Luca Ceresoli # tegra20, parallel camera Signed-off-by: Thierry Reding commit dc3ec7cbe933b11280272cc40236a9763a5316e9 Author: Svyatoslav Ryhel Date: Thu Oct 16 10:41:52 2025 +0300 arm64: tegra: Drop redundant clock and reset names from TSEC node Clock and reset names are not needed if node contains only one clock and one reset. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 8911ee2543663588480d762184e00331cc2f008f Author: Thierry Reding Date: Tue Nov 4 14:22:04 2025 +0100 arm64: tegra: Move HDA into the correct bus HDA is part of the DISP_USB bus, so move it into that and drop the address prefix accordingly. Acked-by: Jon Hunter Signed-off-by: Thierry Reding commit e2f085ab8636fae2ebe0adf42071e7558234cd7b Author: Xiangxu Yin Date: Tue Nov 4 09:33:24 2025 +0800 dt-bindings: display: msm: sm6150-mdss: Fix example indentation and OPP values Improve the binding example by fixing indentation and adding missing blank lines for better readability. Also correct the OPP clock values to match the actual SM6150 DTS configuration. Reviewed-by: Rob Herring (Arm) Signed-off-by: Xiangxu Yin Patchwork: https://patchwork.freedesktop.org/patch/685342/ Link: https://lore.kernel.org/r/20251104-add-displayport-support-to-qcs615-devicetree-v7-2-e51669170a6f@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit f43f0338835ff0ac5e167280d033c88e81463175 Author: Xiangxu Yin Date: Tue Nov 4 09:33:23 2025 +0800 dt-bindings: display: msm: sm6150-mdss: Add DisplayPort controller SM6150 uses the same DisplayPort controller as SM8150, which is compatible with SM8350. Add SM6150-specific compatible string for the DisplayPort controller. Signed-off-by: Xiangxu Yin Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Patchwork: https://patchwork.freedesktop.org/patch/685343/ Link: https://lore.kernel.org/r/20251104-add-displayport-support-to-qcs615-devicetree-v7-1-e51669170a6f@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 7f334ae4d7784242424f05a89dda0b4794c2d170 Author: Xiangxu Yin Date: Tue Sep 16 20:11:03 2025 +0800 dt-bindings: display/msm: dp-controller: Add SM6150 Add DisplayPort controller binding for Qualcomm SM6150 SoC. SM6150 uses the same controller IP as SM8150. Declare 'qcom,sm6150-dp' as a fallback compatible to 'qcom,sm8150-dp' and 'qcom,sm8350-dp' for consistency with existing bindings and to ensure correct matching and future clarity. Signed-off-by: Xiangxu Yin Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/674893/ Link: https://lore.kernel.org/r/20250916-add-dp-controller-support-for-sm6150-v3-1-dd60ebbd101e@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit e149847cb722faad3f96313799c180c9cdd1ba03 Author: Randy Dunlap Date: Mon Nov 10 22:03:53 2025 -0800 drm/msm/disp: fix kernel-doc warnings Fix all kernel-doc warnings in msm_disp_snapshot.h: msm_disp_snapshot.h:53: warning: Function parameter or struct member 'blocks' not described in 'msm_disp_state' msm_disp_snapshot.h:69: warning: Function parameter or struct member 'node' not described in 'msm_disp_state_block' msm_disp_snapshot.h:69: warning: Excess struct member 'drm_dev' description in 'msm_disp_state_block' msm_disp_snapshot.h:95: warning: No description found for return value of 'msm_disp_snapshot_state_sync' msm_disp_snapshot.h:100: warning: bad line: msm_disp_snapshot.h:117: warning: bad line: msm_disp_snapshot.h:125: warning: bad line: msm_disp_snapshot.h:142: warning: Excess function parameter 'name' description in 'msm_disp_snapshot_add_block' Signed-off-by: Randy Dunlap Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/687132/ Link: https://lore.kernel.org/r/20251111060353.1972869-1-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit fef68b2aaa44bf9a73573e6e190ba04d6b3f6a39 Author: Yongxing Mou Date: Wed Oct 29 16:51:38 2025 +0800 drm/msm: mdss: Add QCS8300 support Add Mobile Display Subsystem (MDSS) support for the QCS8300 platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Yongxing Mou Patchwork: https://patchwork.freedesktop.org/patch/684205/ Link: https://lore.kernel.org/r/20251029-qcs8300_mdss-v13-5-e8c8c4f82da2@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit ad1b6a10de698cc861cef323eccd7e166f44e0aa Author: Yongxing Mou Date: Wed Oct 29 16:51:36 2025 +0800 dt-bindings: display/msm: Document MDSS on QCS8300 Document the MDSS hardware found on the Qualcomm QCS8300 platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yongxing Mou Patchwork: https://patchwork.freedesktop.org/patch/684201/ Link: https://lore.kernel.org/r/20251029-qcs8300_mdss-v13-3-e8c8c4f82da2@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit f080ccd90fdde2db184c3f81890015dc284bc0b3 Author: Yongxing Mou Date: Wed Oct 29 16:51:35 2025 +0800 dt-bindings: display/msm: dp-controller: document QCS8300 compatible Add compatible string for the DisplayPort controller found on the Qualcomm QCS8300 SoC. The Qualcomm QCS8300 platform comes with one DisplayPort controller that supports 4 MST streams, similar to the one found on the SA8775P. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yongxing Mou Patchwork: https://patchwork.freedesktop.org/patch/684200/ Link: https://lore.kernel.org/r/20251029-qcs8300_mdss-v13-2-e8c8c4f82da2@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit b40f0e185d7332411411b4701d0925ed3f421e53 Author: Yongxing Mou Date: Wed Oct 29 16:51:34 2025 +0800 dt-bindings: display/msm: Document the DPU for QCS8300 Document the DPU for Qualcomm QCS8300 platform. It use the same DPU hardware with SA8775P and reuse it's driver. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Yongxing Mou Patchwork: https://patchwork.freedesktop.org/patch/684198/ Link: https://lore.kernel.org/r/20251029-qcs8300_mdss-v13-1-e8c8c4f82da2@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 244fe8c9edd9be6bb8e762bcb935a0c4895c9d8a Author: Abel Vesa Date: Mon Oct 27 16:59:23 2025 +0200 drm/msm/dp: Add support for Glymur The Qualcomm Glymur platform comes with 4 DisplayPort controllers, which have a different core revision compared to all previous platforms. Describe them and add the compatible. Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Patchwork: https://patchwork.freedesktop.org/patch/683722/ Link: https://lore.kernel.org/r/20251027-glymur-display-v3-6-aa13055818ac@linaro.org Signed-off-by: Dmitry Baryshkov commit e2aeb8deddae72190728923c1bcd80f42f81dc91 Author: Abel Vesa Date: Mon Oct 27 16:59:22 2025 +0200 drm/msm/dpu: Add support for Glymur Add DPU version v12.2 support for the Glymur platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Patchwork: https://patchwork.freedesktop.org/patch/683721/ Link: https://lore.kernel.org/r/20251027-glymur-display-v3-5-aa13055818ac@linaro.org Signed-off-by: Dmitry Baryshkov commit 3dceef35b6229bcd7aeb7f6df46adf34b5e15f97 Author: Abel Vesa Date: Mon Oct 27 16:59:21 2025 +0200 drm/msm/mdss: Add Glymur device configuration Add Mobile Display Subsystem (MDSS) support for the Glymur platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Abel Vesa Patchwork: https://patchwork.freedesktop.org/patch/683718/ Link: https://lore.kernel.org/r/20251027-glymur-display-v3-4-aa13055818ac@linaro.org Signed-off-by: Dmitry Baryshkov commit 8f63bf908213c33624fd539547902432546695ac Author: Abel Vesa Date: Mon Oct 27 16:59:20 2025 +0200 dt-bindings: display: msm: Document the Glymur DiplayPort controller Document the DisplayPort controller found in the Qualcomm Glymur SoC. There are 4 controllers and their new core revision is different when compared to all previous platforms, therefore being incompatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Patchwork: https://patchwork.freedesktop.org/patch/683717/ Link: https://lore.kernel.org/r/20251027-glymur-display-v3-3-aa13055818ac@linaro.org Signed-off-by: Dmitry Baryshkov commit ceee64dd50965cf7c1d1d5933adc37e6ba6ece24 Author: Abel Vesa Date: Mon Oct 27 16:59:19 2025 +0200 dt-bindings: display: msm: Document the Glymur Display Processing Unit Add DPU for Qualcomm Glymur SoC which has very few changes compared to SM8750, just enough to make them incompatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Patchwork: https://patchwork.freedesktop.org/patch/683716/ Link: https://lore.kernel.org/r/20251027-glymur-display-v3-2-aa13055818ac@linaro.org Signed-off-by: Dmitry Baryshkov commit 1aee577bbc60d81a6e1ea1b1ccb6f9793762bb01 Author: Abel Vesa Date: Mon Oct 27 16:59:18 2025 +0200 dt-bindings: display: msm: Document the Glymur Mobile Display SubSystem The MDSS/MDP display subsystem found on Glymur platform is 2 minor version increase compared to SM8750, which makes it incompatible with all previous platforms. So document it. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Abel Vesa Patchwork: https://patchwork.freedesktop.org/patch/683714/ Link: https://lore.kernel.org/r/20251027-glymur-display-v3-1-aa13055818ac@linaro.org Signed-off-by: Dmitry Baryshkov commit d9792823d18ff9895eaf5769a29a54804f24bc25 Author: Dmitry Baryshkov Date: Mon Oct 27 15:35:17 2025 +0200 drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype The commit a106ed98af68 ("drm/msm/dpu: use devres-managed allocation for HW blocks") dropped all dpu_hw_foo_destroy() functions, but the prototype for dpu_hw_dsc_destroy() was omitted. Drop it now to clean up the header. Fixes: a106ed98af68 ("drm/msm/dpu: use devres-managed allocation for HW blocks") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/683697/ Link: https://lore.kernel.org/r/20251027-dpu-drop-dsc-destroy-v1-1-968128de4bf6@oss.qualcomm.com commit dd06398da10656428b337131258d6930f2664f66 Author: Krzysztof Kozlowski Date: Tue Oct 21 13:10:51 2025 +0200 dt-bindings: display/msm: Reference DAI schema for DAI properties DisplayPort nodes are DAIs (Digital Audio Interfaces): they have already 'sound-dai-cells'. Reference the common DAI schema to bring common properties for them, which allows also customizing DAI name prefix. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Patchwork: https://patchwork.freedesktop.org/patch/682376/ Link: https://lore.kernel.org/r/20251021111050.28554-3-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Baryshkov commit 6fb0cf3e7c4b1d1259137b2e79dc50cb9b014484 Author: Xiangxu Yin Date: Fri Sep 19 22:24:31 2025 +0800 drm/msm/dp: Add support for lane mapping configuration QCS615 platform requires non-default logical-to-physical lane mapping due to its unique hardware routing. Unlike the standard mapping sequence <0 1 2 3>, QCS615 uses <3 2 0 1>, which necessitates explicit configuration via the data-lanes property in the device tree. This ensures correct signal routing between the DP controller and PHY. For partial definitions, fill remaining lanes with unused physical lanes in ascending order. Signed-off-by: Xiangxu Yin Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/675645/ Link: https://lore.kernel.org/r/20250919-add-displayport-support-for-qcs615-platform-v5-14-eae6681f4002@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit c8fc72804da1858223e05eaedf23065b6c677560 Author: Xiangxu Yin Date: Fri Sep 19 22:24:30 2025 +0800 drm/msm/dp: move link-specific parsing from dp_panel to dp_link Since max_dp_lanes and max_dp_link_rate are link-specific parameters, move their parsing from dp_panel to dp_link for better separation of concerns. Reviewed-by: Dmitry Baryshkov Signed-off-by: Xiangxu Yin Patchwork: https://patchwork.freedesktop.org/patch/675643/ Link: https://lore.kernel.org/r/20250919-add-displayport-support-for-qcs615-platform-v5-13-eae6681f4002@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit d7ec9366b15cd04508fa015cb94d546b1c01edfb Author: Jun Nie Date: Thu Sep 18 21:29:02 2025 +0800 drm/msm/dpu: Enable quad-pipe for DSC and dual-DSI case To support high-resolution cases that exceed the width limitation of a pair of SSPPs, or scenarios that surpass the maximum MDP clock rate, additional pipes are necessary to enable parallel data processing within the SSPP width constraints and MDP clock rate. Request 4 mixers and 4 DSCs for high-resolution cases where both DSC and dual interfaces are enabled. More use cases can be incorporated later if quad-pipe capabilities are required. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675418/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-10-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit e7dc9c3a6fc46e2530119b7c1d174fa9af2b6acb Author: Svyatoslav Ryhel Date: Wed Oct 22 17:49:28 2025 +0300 dt-bindings: display: tegra: Document Tegra20 and Tegra30 CSI Document CSI HW block found in Tegra20 and Tegra30 SoC. The #nvidia,mipi-calibrate-cells is not an introduction of property, such property already exists in nvidia,tegra114-mipi.yaml and is used in multiple device trees. In case of Tegra30 and Tegra20 CSI block combines mipi calibration function and CSI function, in Tegra114+ mipi calibration got a dedicated hardware block which is already supported. This property here is used to align with mipi-calibration logic used by Tegra114+. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit 2cf244db791ab26b7be4d50b651a3b6d5d83a9a2 Author: Svyatoslav Ryhel Date: Wed Oct 22 17:49:29 2025 +0300 ARM: tegra: add CSI nodes for Tegra20 and Tegra30 Add CSI node to Tegra20 and Tegra30 device trees. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit aabd179bcbde9f795a89cc015953a1057600c21e Author: Xueyao An Date: Wed Nov 5 13:45:47 2025 +0800 arm64: dts: qcom: HAMOA-IOT-SOM: Unreserve GPIOs blocking SPI11 access GPIOs 44-47 were previously reserved, preventing Linux from accessing SPI11 (qupv1_se3). Since there is no TZ use case for these pins on Linux, they can be safely unreserved. Removing them from the reserved list resolves the SPI11 access issue for Linux. Signed-off-by: Xueyao An Reviewed-by: Abel Vesa Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251105054548.2347569-1-xueyao.an@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9c92d36b0b1ea8b2a19dbe0416434f3491dbfaaf Author: Praveen Talari Date: Mon Nov 10 15:40:40 2025 +0530 arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm For BT use cases, pins are configured with pull-up state in sleep state to avoid noise. If IRQ type is configured as level high and the GPIO line is also in a high state, it causes continuous interrupt assertions leading to an IRQ storm when wakeup irq enables at system suspend/runtime suspend. Switching to edge-triggered interrupt (IRQ_TYPE_EDGE_FALLING) resolves this by only triggering on state transitions (high-to-low) rather than maintaining sensitivity to the static level state, effectively preventing the continuous interrupt condition and eliminating the wakeup IRQ storm. Fixes: 9380e0a1d449 ("arm64: dts: qcom: qrb2210-rb1: add Bluetooth support") Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251110101043.2108414-2-praveen.talari@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bba4562adc06a9ca70bbbc9c3c17d4174e794bf9 Author: Bjorn Andersson Date: Mon Nov 10 12:16:24 2025 -0600 Revert "arm64: dts: qcom: sc7280: Increase config size to 256MB for ECAM feature" The author failed to document the dependencies of this commit, resulting in a regression. This reverts commit 03e928442d469f7d8dafc549638730647202d9ce. Signed-off-by: Bjorn Andersson commit 1435db44ec1c81ede88470ed3486a2f5a8765704 Author: Jacopo Mondi Date: Fri Nov 14 12:02:12 2025 +0100 media: mali-c55: Assert ISP blocks size correctness For each supported ISP block type the v4l2-isp framework expects one handler and one block type info. Static assert that the array of handlers is of the same size of the array of block types info. Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Reviewed-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d619dd9a3d401063cc6d31cada98c99db449d381 Author: Jacopo Mondi Date: Fri Nov 14 12:02:11 2025 +0100 media: v4l2-isp: Rename block_info to block_type_info The v4l2_isp_params_block_info structure contains validation information that apply to a block -type- and not only to a specific ISP block implementation. Clarify this by renaming v4l2_isp_params_block_info in v4l2_isp_params_block_type_info and update the documentation and the users of v4l2-isp accordingly. Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Reviewed-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 48ecdf254df0de34473b031c9c5de7a57c76c379 Author: Daniel Scally Date: Tue Nov 11 16:34:26 2025 +0000 MAINTAINERS: Add entry for rzv2h-ivc driver Add an entry to the MAINTAINERS file for the rzv2h-ivc driver Reviewed-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit f0b3984d821b3a603cd8786dca6cc73d47c4521a Author: Daniel Scally Date: Tue Nov 11 16:34:25 2025 +0000 media: platform: Add Renesas Input Video Control block driver Add a driver for the Input Video Control block in an RZ/V2H(P) SoC which feeds data into the Arm Mali-C55 ISP. [ivc: Remove check on buffers list in start_streaming] [ivc: put_autosuspend() implies mark_last_busy()] [media: rzv2h-ivc: Do not delay frame completion] Signed-off-by: Jacopo Mondi Reviewed-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil [hverkuil: remove deprecated vb2_ops_wait_prepare/finish callbacks] [hverkuil: replace "select PM" by "depends on PM"] commit ef5a75b44403f53af920e6731e04c9033330fbb6 Author: Daniel Scally Date: Tue Nov 11 16:34:24 2025 +0000 dt-bindings: media: Add bindings for the RZ/V2H(P) IVC block The RZ/V2H(P) SoC has a block called the Input Video Control block which feeds image data into the Image Signal Processor. Add dt bindings to describe the IVC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 87b214ddfed2350d57633066fd60f3c71c57c185 Author: Daniel Scally Date: Tue Nov 11 16:15:59 2025 +0000 Documentation: media: mali-c55: Document the mali-c55 parameter setting Document the mali-c55 parameter setting by expanding the relevant pages in both admin-guide/ and userspace-api/. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 01535ea086746ebc9ba3b0d817285ae89ec5ae0d Author: Daniel Scally Date: Tue Nov 11 16:15:58 2025 +0000 media: platform: Add mali-c55 parameters video node Add a new code file to the mali-c55 driver that registers an output video node for userspace to queue buffers of parameters to. Handlers are included to program the statistics generation plus the white balance, black level correction and mesh shading correction blocks. Update the rest of the driver to register and link the new video node Tested-by: Lad Prabhakar Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil [hverkuil: remove deprecated vb2_ops_wait_prepare/finish callbacks] commit 08a99369f44eeb63eacc56fe42f4c67a6c7dbc37 Author: Daniel Scally Date: Tue Nov 11 16:15:57 2025 +0000 media: uapi: Add parameters structs to mali-c55-config.h Add structures describing the ISP parameters to mali-c55-config.h Tested-by: Lad Prabhakar Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 1ab3cb233d61131b2d02650f8ed9e4e077fd4508 Author: Jacopo Mondi Date: Tue Nov 11 16:15:56 2025 +0000 media: mali-c55: Add image formats for Mali-C55 parameters buffer Add a new V4L2 meta format code for the Mali-C55 parameters. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit b35d9f3e301dce2c822704ee4d95c0337ed9fb14 Author: Daniel Scally Date: Tue Nov 11 16:15:55 2025 +0000 Documentation: media: mali-c55: Add Statistics documentation Add documentation explaining the ability to capture statistics from the mali-c55 driver's new V4L2 device, as well as the various tap points from which those statistics can be drawn in the ISP's processing flow. Additionally add a page detailing the new V4L2 meta format for the mali-c55 statistics. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 5d1f7403d681f8a4664c1b4072798eb236ae82be Author: Daniel Scally Date: Tue Nov 11 16:15:54 2025 +0000 media: platform: Add mali-c55 3a stats devnode Add a new code file to govern the 3a statistics capture node. On ISP_START, fill the stats buffer by reading out the metering space in the ISP's memory. This is done for the non-active config just as the dma transfer of the registers is. To acheive that, move the checking of the current config outside of mali_c55_swap_next_config() so we can use it for both functions. Tested-by: Lad Prabhakar Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil [hverkuil: remove deprecated vb2_ops_wait_prepare/finish callbacks] commit c7f832f6f8129bb666346cb4805805ad056059b7 Author: Daniel Scally Date: Tue Nov 11 16:15:53 2025 +0000 media: uapi: Add 3a stats buffer for mali-c55 Describe the format of the 3A statistics buffers in the userspace API header for the mali-c55 ISP. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 4d36f732366aeb32bf3486545e597500a3bf0994 Author: Daniel Scally Date: Tue Nov 11 16:15:52 2025 +0000 media: Add MALI_C55_3A_STATS meta format Add a new meta format for the Mali-C55 ISP's 3A Statistics along with a new descriptor entry. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 5a99e8675e53daf3912bdbd4ca9c2baab8f61f21 Author: Daniel Scally Date: Tue Nov 11 16:15:51 2025 +0000 MAINTAINERS: Add entry for mali-c55 driver Add a MAINTAINERS entry for the mali-c55 driver and its associated documentation. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit dfb999e70504847ca6e6c6d48a2e71194f34f791 Author: Daniel Scally Date: Tue Nov 11 16:15:50 2025 +0000 media: Documentation: Add Mali-C55 ISP Documentation Add a documentation page for the mali-c55 driver, which gives a brief overview of the hardware and explains how to use the driver's capture devices and the crop/scaler functions. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit d5f281f3dd2988998daf45f591920c6013a620d8 Author: Daniel Scally Date: Tue Nov 11 16:15:49 2025 +0000 media: mali-c55: Add Mali-C55 ISP driver Add a driver for Arm's Mali-C55 Image Signal Processor. The driver is V4L2 and Media Controller compliant and creates subdevices to manage the ISP itself, its internal test pattern generator as well as the crop, scaler and output format functionality for each of its two output devices. Tested-by: Lad Prabhakar Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil [hverkuil: remove deprecated vb2_ops_wait_prepare/finish callbacks] commit 8d0bbed21ef737195277c0af8c30511fb72e608b Author: Daniel Scally Date: Tue Nov 11 16:15:48 2025 +0000 media: uapi: Add controls for Mali-C55 ISP Add definitions and documentation for the custom control that will be needed by the Mali-C55 ISP driver. This will be a read only bitmask of the driver's capabilities, informing userspace of which blocks are fitted and which are absent. Tested-by: Lad Prabhakar Reviewed-by: Lad Prabhakar Reviewed-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 3743764750fb0122622c277ce1b6770d25e43929 Author: Daniel Scally Date: Tue Nov 11 16:15:47 2025 +0000 dt-bindings: media: Add bindings for ARM mali-c55 Add the yaml binding for ARM's Mali-C55 Image Signal Processor. Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Reviewed-by: Krzysztof Kozlowski Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 2477ab037621632c3ec167187dc9e7afac2ba7f2 Author: Daniel Scally Date: Tue Nov 11 16:15:46 2025 +0000 media: uapi: Add 20-bit bayer formats The Mali-C55 requires input data be in 20-bit format, MSB aligned. Add some new media bus format macros to represent that input format. Reviewed-by: Lad Prabhakar Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit ec4ac3cb7198070611987a6e91829fce0f4ce6d0 Author: Daniel Scally Date: Tue Nov 11 16:15:45 2025 +0000 media: uapi: Add MEDIA_BUS_FMT_RGB202020_1X60 format code The Mali-C55 ISP by ARM requires 20-bits per colour channel input on the bus. Add a new media bus format code to represent it. Reviewed-by: Lad Prabhakar Tested-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Nayden Kanchev Co-developed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Daniel Scally Signed-off-by: Hans Verkuil commit 76799be6eb56e7f95d2d6aeebab7c7ec94b12f85 Author: Jacopo Mondi Date: Mon Jul 7 17:55:35 2025 +0200 media: Documentation: kapi: Add v4l2 generic ISP support Add to the driver-api documentation the v4l2-isp.h types and helpers documentation. Reviewed-by: Daniel Scally Reviewed-by: Michael Riesch Acked-by: Sakari Ailus Reviewed-by: Laurent Pinchart Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 9f7d23d558c745794cf355201afde9a0bb91ba3e Author: Jacopo Mondi Date: Mon Jul 7 16:39:53 2025 +0200 media: amlogic-c3: Use v4l2-isp for validation Convert c3-isp-params.c to use the helpers defined in v4l2-isp.h to perform validation of a ISP parameters buffer. Reviewed-by: Keke Li Reviewed-by: Daniel Scally Acked-by: Sakari Ailus Reviewed-by: Laurent Pinchart Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 3a2730a45020cca8a504a96432d9c7f0ccf9dcf9 Author: Jacopo Mondi Date: Mon Jul 7 10:49:06 2025 +0200 media: rkisp1: Use v4l2-isp for validation Convert rkisp1-params.c to use the helpers defined in v4l2-isp.h to perform validation of a ISP parameters buffer. Reviewed-by: Daniel Scally Acked-by: Sakari Ailus Reviewed-by: Laurent Pinchart Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 3cb6de6fafb8fca55b14313e63f13ce10ecc6fc4 Author: Jacopo Mondi Date: Tue Jul 1 18:57:17 2025 +0200 media: v4l2-core: Introduce v4l2-isp.c Add to the V4L2 framework helper functions to support drivers when validating a buffer of V4L2 ISP parameters. Driver shall use v4l2_isp_params_validate_buffer_size() to verify the size correctness of the data received from userspace, and after having copied the data to a kernel-only memory location, complete the validation by calling v4l2_isp_params_validate_buffer(). Reviewed-by: Daniel Scally Reviewed-by: Laurent Pinchart Reviewed-by: Michael Riesch Acked-by: Sakari Ailus Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 8923679cd47e1b743a75a98ca78f608bec92c5e5 Author: Jacopo Mondi Date: Fri Jul 4 17:50:24 2025 +0200 media: Documentation: uapi: Add V4L2 ISP documentation Add userspace documentation for V4L2 ISP generic parameters and statistics formats. Reviewed-by: Daniel Scally Reviewed-by: Michael Riesch Acked-by: Sakari Ailus Reviewed-by: Laurent Pinchart Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 45662082855c6acd1719c11e077388cbccf3baf2 Author: Jacopo Mondi Date: Mon Jul 7 14:18:52 2025 +0200 media: uapi: Convert Amlogic C3 to V4L2 extensible params With the introduction of common types for extensible parameters format, convert the c3-isp-config.h header to use the new types. Factor-out the documentation that is now part of the common header and only keep the driver-specific on in place. The conversion to use common types doesn't impact userspace as the new types are either identical to the ones already existing in the C3 ISP uAPI or are 1-to-1 type convertible. Reviewed-by: Daniel Scally Reviewed-by: Keke Li Reviewed-by: Laurent Pinchart Acked-by: Sakari Ailus Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 1e8152db64bdee9f13e84e516c2b8a9bb10f025e Author: Jacopo Mondi Date: Mon Jul 7 14:13:53 2025 +0200 media: uapi: Convert RkISP1 to V4L2 extensible params With the introduction of common types for extensible parameters format, convert the rkisp1-config.h header to use the new types. Factor out the documentation that is now part of the common header and only keep the driver-specific on in place. The conversion to use common types doesn't impact userspace as the new types are either identical to the ones already existing in the RkISP1 uAPI or are 1-to-1 type convertible. Reviewed-by: Daniel Scally Reviewed-by: Laurent Pinchart Reviewed-by: Michael Riesch Acked-by: Sakari Ailus Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit e36dbd1cf3dfc4ce18e9f7a80183b53cae257e30 Author: Jacopo Mondi Date: Fri Jul 4 17:43:19 2025 +0200 media: uapi: Introduce V4L2 generic ISP types Introduce v4l2-isp.h in the Linux kernel uAPI. The header includes types for generic ISP configuration parameters and will be extended in the future with support for generic ISP statistics formats. Generic ISP parameters support is provided by introducing two new types that represent an extensible and versioned buffer of ISP configuration parameters. The v4l2_params_buffer represents the container for the ISP configuration data block. The generic type is defined with a 0-sized data member that the ISP driver implementations shall properly size according to their capabilities. The v4l2_params_block_header structure represents the header to be prepend to each ISP configuration block. Signed-off-by: Daniel Scally Reviewed-by: Daniel Scally Reviewed-by: Laurent Pinchart Reviewed-by: Michael Riesch Acked-by: Sakari Ailus Tested-by: Lad Prabhakar Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit af330925a18ff483adace1c4ed2dcc975a31d5c0 Merge: 1d562ba0aa7df8 4e00135b2dd1d7 Author: Mark Brown Date: Fri Nov 14 14:47:49 2025 +0000 spi-cadence: support transmission with Merge series from Jun Guo : The Cadence SPI IP supports configurable FIFO data widths during integration. On some SoCs, the FIFO data width is designed to be 16 or 32 bits at the chip design stage. However, the current driver only supports communication with an 8-bit FIFO data width. Therefore, these patches are added to enable the driver to support communication with 16-bit and 32-bit FIFO data widths. commit ad5eb81cbd47dfa1b96484362023be58085230eb Author: Svyatoslav Ryhel Date: Thu Oct 16 10:41:51 2025 +0300 ARM: tegra: Add missing HOST1X device nodes on Tegra124 Add nodes for devices on the HOST1X bus: VI, ISP, ISPB, MSENC and TSEC. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit cead96a67e5d312a2d77c0d556c1cf73fb87e1de Author: Svyatoslav Ryhel Date: Thu Oct 16 10:41:50 2025 +0300 ARM: tegra: Add missing HOST1X device nodes on Tegra114 Add nodes for devices on the HOST1X bus: VI, EPP, ISP, MSENC and TSEC. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit a0c70244e5a877be917fc6aaf1e58a4debd99c4d Author: Svyatoslav Ryhel Date: Thu Oct 16 10:41:49 2025 +0300 dt-bindings: display: tegra: document EPP, ISP, MPE and TSEC for Tegra114+ The current EPP, ISP and MPE schemas are largely compatible with Tegra114+, requiring only minor adjustments. Additionally, the TSEC schema for the Security engine, which is available from Tegra114 onwards, is included. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding commit 38b7cc448a5b6772cad2b853a011f507ad95306a Author: John Hubbard Date: Thu Nov 13 18:41:04 2025 -0800 gpu: nova-core: implement Display for Spec Implement Display for Spec. This simplifies the dev_info!() code for printing banners such as: NVIDIA (Chipset: GA104, Architecture: Ampere, Revision: a.1) Cc: Alexandre Courbot Cc: Danilo Krummrich Cc: Timur Tabi Reviewed-by: Joel Fernandes Signed-off-by: John Hubbard Signed-off-by: Alexandre Courbot Message-ID: <20251114024109.465136-2-jhubbard@nvidia.com> commit b54df61c7428ff50b21a03a53e3d580c6e84d1bf Author: Rafael J. Wysocki Date: Wed Nov 12 19:03:08 2025 +0100 cpuidle: governors: teo: Decay metrics below DECAY_SHIFT threshold If a given governor metric falls below a certain value (8 for DECAY_SHIFT equal to 3), it will not decay any more due to the simplistic decay implementation. This may in some cases lead to subtle inconsistencies in the governor behavior, so change the decay implementation to take it into account and set the metric at hand to 0 in that case. Suggested-by: Christian Loehle Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Tested-by: Christian Loehle Link: https://patch.msgid.link/2819353.mvXUDI8C0e@rafael.j.wysocki commit 8f3f01082d7ab334706c7d96c9271cd99e68aabc Author: Rafael J. Wysocki Date: Wed Nov 12 17:24:40 2025 +0100 cpuidle: governors: teo: Use s64 consistently in teo_update() Two local variables in teo_update() are defined as u64, but their values are then compared with s64 values, so it is more consistent to use s64 as their data type. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Tested-by: Christian Loehle Link: https://patch.msgid.link/3026616.e9J7NaK4W3@rafael.j.wysocki commit 17673f64a002fa7bd8f688f45b12ed32b59dba26 Author: Rafael J. Wysocki Date: Wed Nov 12 17:23:24 2025 +0100 cpuidle: governors: teo: Drop redundant function parameter The last no_poll parameter of teo_find_shallower_state() is always false, so drop it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Tested-by: Christian Loehle Link: https://patch.msgid.link/2253109.irdbgypaU6@rafael.j.wysocki commit a03b2011808ab02ccb7ab6b573b013b77fbb5921 Author: Rafael J. Wysocki Date: Thu Nov 13 14:24:31 2025 +0100 cpuidle: governors: teo: Drop misguided target residency check When the target residency of the current candidate idle state is greater than the expected time till the closest timer (the sleep length), it does not matter whether or not the tick has already been stopped or if it is going to be stopped. The closest timer will trigger anyway at its due time, so if an idle state with target residency above the sleep length is selected, energy will be wasted and there may be excess latency. Of course, if the closest timer were canceled before it could trigger, a deeper idle state would be more suitable, but this is not expected to happen (generally speaking, hrtimers are not expected to be canceled as a rule). Accordingly, the teo_state_ok() check done in that case causes energy to be wasted more often than it allows any energy to be saved (if it allows any energy to be saved at all), so drop it and let the governor use the teo_find_shallower_state() return value as the new candidate idle state index. Fixes: 21d28cd2fa5f ("cpuidle: teo: Do not call tick_nohz_get_sleep_length() upfront") Cc: All applicable Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Tested-by: Christian Loehle Link: https://patch.msgid.link/5955081.DvuYhMxLoT@rafael.j.wysocki commit 6402ddf3027d8975f135cf2b2014d6bbeb2d3436 Author: Lukas Bulwahn Date: Fri Nov 14 12:37:12 2025 +0100 MAINTAINERS: refer to trivial-codec.yaml in relevant sections Commit 4acbfcf11cbe ("ASoC: dt-bindings: consolidate simple audio codec to trivial-codec.yaml") aggregates a few sound device-tree bindings, i.e., txt and yaml files, into a common trivial-codec.yaml, but misses to adjust the references in ANALOG DEVICES INC ASOC CODEC DRIVERS, ARM/APPLE MACHINE SOUND DRIVERS, NXP TFA9879 DRIVER and WOLFSON MICROELECTRONICS DRIVERS, which refer to files removed by the commit above. Make these sections refer to trivial-codec.yaml, in order to inform the maintainers on changes to the device-tree binding relevant to the hardware drivers. Signed-off-by: Lukas Bulwahn Link: https://patch.msgid.link/20251114113713.231513-1-lukas.bulwahn@redhat.com Signed-off-by: Mark Brown commit 059f545832be85d29ac9ccc416a16f647aa78485 Author: Prajna Rajendra Kumar Date: Fri Nov 14 10:45:45 2025 +0000 spi: add support for microchip "soft" spi controller Introduce driver support for the Microchip FPGA CoreSPI IP. This driver supports only Motorola SPI mode and frame size of 8-bits. TI/NSC modes and wider frame sizes are not currently supported. Signed-off-by: Prajna Rajendra Kumar Reviewed-by: Conor Dooley Acked-by: Conor Dooley Link: https://patch.msgid.link/20251114104545.284765-4-prajna.rajendrakumar@microchip.com Signed-off-by: Mark Brown commit 8ce9a2ed153bcaa750aa494e91ce2e70c3b0cdc5 Author: Prajna Rajendra Kumar Date: Fri Nov 14 10:45:44 2025 +0000 spi: dt-binding: document Microchip CoreSPI Add device tree bindings for Microchip's CoreSPI controller. CoreSPI is a "soft" IP core intended for FPGA implementations. Its configurations are set in Libero. These properties represent non-discoverable configurations determined by Verilog parameters to the IP. Signed-off-by: Prajna Rajendra Kumar Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20251114104545.284765-3-prajna.rajendrakumar@microchip.com Signed-off-by: Mark Brown commit 71c814e98696f2cd53e9e6cef7501c2d667d4c5a Author: Prajna Rajendra Kumar Date: Fri Nov 14 10:45:43 2025 +0000 spi: microchip: rename driver file and internal identifiers The spi-microchip-core.c driver provides support for the Microchip PolarFire SoC (MPFS) "hard" SPI controller. It was originally named "core" with the expectation that it might also cover Microchip's CoreSPI "soft" IP, but that never materialized. The CoreSPI IP cannot be supported by this driver because its register layout differs substantially from the MPFS SPI controller. In practice most of the code would need to be replaced to handle those differences so keeping the drivers separate is the simpler approach. The file and internal symbols are renamed to reflect MPFS support and to free up "spi-microchip-core.c" for CoreSPI driver. Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") Signed-off-by: Prajna Rajendra Kumar Acked-by: Conor Dooley Link: https://patch.msgid.link/20251114104545.284765-2-prajna.rajendrakumar@microchip.com Signed-off-by: Mark Brown commit cd91b502f1b4bb81e82fbae38678c698ee5ac026 Author: André Almeida Date: Mon Nov 10 19:41:30 2025 -0300 selftests/futex: Create test for robust list Create a test for the robust list mechanism. Test the following uAPI operations: - Creating a robust mutex where the lock waiter is wake by the kernel when the lock owner died - Setting a robust list to the current task - Getting a robust list from the current task - Getting a robust list from another task - Using the list_op_pending field from robust_list_head struct to test robustness when the lock owner dies before completing the locking - Setting a invalid size for syscall argument `len` - Adding multiple elements to a robust list wait waiting for each of them - Creating a circular list and checking that the kernel does not get stuck in an infinity loop Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251110224130.3044761-1-andrealmeid@igalia.com commit 275498b88104b36a0f7f913da53dc81c1daed277 Author: Carlos Llamas Date: Thu Oct 16 16:19:41 2025 +0000 selftests/futex: Skip tests if shmget unsupported On systems where the shmget() syscall is not supported, tests like anon_page and shared_waitv will fail. Skip these tests in such cases to allow the rest of the test suite to run. Signed-off-by: Carlos Llamas Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251016162009.3270784-1-cmllamas@google.com commit 9407d138b8d5eff1cabceb4b3176f03191871479 Author: Carlos Llamas Date: Wed Oct 15 17:35:41 2025 +0000 selftests/futex: Add newline to ksft_exit_fail_msg() This was missed in commit e5c04d0f3ea0 ("selftests/futex: Refactor futex_wait with kselftest_harness.h") while replacing previous perror() calls, which automatically append the newline character. Fixes: e5c04d0f3ea0 ("selftests/futex: Refactor futex_wait with kselftest_harness.h") Signed-off-by: Carlos Llamas Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251015173556.2899646-1-cmllamas@google.com commit 2d98144440f0101e6e432a748ec9f14a0f8be9e5 Author: André Almeida Date: Wed Oct 1 19:04:38 2025 -0300 selftests/futex: Remove unused test_futex_mpol() Commit ed323aeda5e09 ("selftest/futex: Compile also with libnuma < 2.0.16") removed the unused function test_futex_mpol() and commit d35ca2f64272 ("selftests/futex: Refactor futex_numa_mpol with kselftest_harness.h") added it back by accident. Remove it again. Fixes: d35ca2f64272 ("selftests/futex: Refactor futex_numa_mpol with kselftest_harness.h") Signed-off-by: André Almeida Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251001220438.66227-1-andrealmeid@igalia.com commit 0fc1b4b6fda8f64385f3932984cf2f651c735eb3 Author: Alejandro Enrique Date: Wed May 14 15:54:41 2025 +0200 dt-bindings: gnss: u-blox: add safeboot gpio U-Blox M8/M9 chip have a pin to start it in safeboot mode, to be used to recover from situations where the flash content has become corrupted and needs to be restored. Signed-off-by: Alejandro Enrique Signed-off-by: Johan Hovold commit 44964e81d12809d3a909c9a81068753bb95ef954 Author: Niravkumar L Rabara Date: Fri Nov 14 08:59:53 2025 +0800 arm64: dts: socfpga: add Agilex3 board Agilex3 SoCFPGA development kit is a small form factor board similar to Agilex5 013b board. Agilex3 is derived from Agilex5 SoCFPGA, with the main difference of CPU cores — Agilex3 has 2 cores compared to 4 in Agilex5. Signed-off-by: Niravkumar L Rabara Signed-off-by: Dinh Nguyen commit 425c16c37da25b6a7e8b9dd8bb1bce21562ff83f Author: Niravkumar L Rabara Date: Fri Nov 14 08:59:52 2025 +0800 dt-bindings: intel: Add Agilex3 SoCFPGA board Add compatible string for Agilex3 SoCFPGA board, which shares the same architecture as Agilex5 but with two fewer CPU cores. Signed-off-by: Niravkumar L Rabara Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 523ac768800c95d34522e8e33775bf911b883fe2 Merge: 3a8660878839fa cf296b294c3bd8 Author: Christian Brauner Date: Fri Nov 14 13:16:04 2025 +0100 Merge patch series "Create and use APIs to centralise locking for directory ops." NeilBrown says: This series is the next part of my effort to change directory-op locking to allow multiple concurrent ops in a directory. Ultimately we will (in my plan) lock the target dentry(s) rather than the whole parent directory. To help with changing the locking protocol, this series centralises locking and lookup in some helpers. The various helpers are introduced and then used in the same patch - roughly one patch per helper though with various exceptions. I haven't introduced these helpers into the various filesystems that Al's tree-in-dcache series is changing. That series introduces and uses similar helpers tuned to the specific needs of that set of filesystems. Ultimately all the helpers will use the same backends which can then be adjusted when it is time to change the locking protocol. One change that deserves highlighting is in patch 13 where vfs_mkdir() is changed to unlock the parent on failure, as well as the current behaviour of dput()ing the dentry on failure. Once this change is in place, the final step of both create and an remove sequences only requires the target dentry, not the parent. So e.g. end_creating() is only given the dentry (which may be IS_ERR() after vfs_mkdir()). This helps establish the pattern that it is the dentry that is being locked and unlocked (the lock is currently held on dentry->d_parent->d_inode, but that can change). * patches from https://patch.msgid.link/20251113002050.676694-1-neilb@ownmail.net: VFS: introduce end_creating_keep() VFS: change vfs_mkdir() to unlock on failure. ecryptfs: use new start_creating/start_removing APIs Add start_renaming_two_dentries() VFS/ovl/smb: introduce start_renaming_dentry() VFS/nfsd/ovl: introduce start_renaming() and end_renaming() VFS: add start_creating_killable() and start_removing_killable() VFS: introduce start_removing_dentry() smb/server: use end_removing_noperm for for target of smb2_create_link() VFS: introduce start_creating_noperm() and start_removing_noperm() VFS/nfsd/cachefiles/ovl: introduce start_removing() and end_removing() VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating() VFS: tidy up do_unlinkat() VFS: introduce start_dirop() and end_dirop() debugfs: rename end_creating() to debugfs_end_creating() Link: https://patch.msgid.link/20251113002050.676694-1-neilb@ownmail.net Signed-off-by: Christian Brauner commit cf296b294c3bd8f7db229060efe677dfd49e46b6 Author: NeilBrown Date: Thu Nov 13 11:18:38 2025 +1100 VFS: introduce end_creating_keep() Occasionally the caller of end_creating() wants to keep using the dentry. Rather then requiring them to dget() the dentry (when not an error) before calling end_creating(), provide end_creating_keep() which does this. cachefiles and overlayfs make use of this. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-16-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit fe497f0759e0efb949f9480911d00b6045c21f50 Author: NeilBrown Date: Thu Nov 13 11:18:37 2025 +1100 VFS: change vfs_mkdir() to unlock on failure. vfs_mkdir() already drops the reference to the dentry on failure but it leaves the parent locked. This complicates end_creating() which needs to unlock the parent even though the dentry is no longer available. If we change vfs_mkdir() to unlock on failure as well as releasing the dentry, we can remove the "parent" arg from end_creating() and simplify the rules for calling it. Note that cachefiles_get_directory() can choose to substitute an error instead of actually calling vfs_mkdir(), for fault injection. In that case it needs to call end_creating(), just as vfs_mkdir() now does on error. ovl_create_real() will now unlock on error. So the conditional end_creating() after the call is removed, and end_creating() is called internally on error. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-15-neilb@ownmail.net Signed-off-by: Christian Brauner commit f046fbb4d81d1b0c4a169707411e3cd540c03354 Author: NeilBrown Date: Thu Nov 13 11:18:36 2025 +1100 ecryptfs: use new start_creating/start_removing APIs This requires the addition of start_creating_dentry() which is given the dentry which has already been found, and asks for it to be locked and its parent validated. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-14-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 833d2b3a072f7ff6005bf84c065c7cbda81a8aaa Author: NeilBrown Date: Thu Nov 13 11:18:35 2025 +1100 Add start_renaming_two_dentries() A few callers want to lock for a rename and already have both dentries. Also debugfs does want to perform a lookup but doesn't want permission checking, so start_renaming_dentry() cannot be used. This patch introduces start_renaming_two_dentries() which is given both dentries. debugfs performs one lookup itself. As it will only continue with a negative dentry and as those cannot be renamed or unlinked, it is safe to do the lookup before getting the rename locks. overlayfs uses start_renaming_two_dentries() in three places and selinux uses it twice in sel_make_policy_nodes(). In sel_make_policy_nodes() we now lock for rename twice instead of just once so the combined operation is no longer atomic w.r.t the parent directory locks. As selinux_state.policy_mutex is held across the whole operation this does not open up any interesting races. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-13-neilb@ownmail.net Signed-off-by: Christian Brauner commit ac50950ca143fd637dec4f7457a9162e1a4344e8 Author: NeilBrown Date: Thu Nov 13 11:18:34 2025 +1100 VFS/ovl/smb: introduce start_renaming_dentry() Several callers perform a rename on a dentry they already have, and only require lookup for the target name. This includes smb/server and a few different places in overlayfs. start_renaming_dentry() performs the required lookup and takes the required lock using lock_rename_child() It is used in three places in overlayfs and in ksmbd_vfs_rename(). In the ksmbd case, the parent of the source is not important - the source must be renamed from wherever it is. So start_renaming_dentry() allows rd->old_parent to be NULL and only checks it if it is non-NULL. On success rd->old_parent will be the parent of old_dentry with an extra reference taken. Other start_renaming function also now take the extra reference and end_renaming() now drops this reference as well. ovl_lookup_temp(), ovl_parent_lock(), and ovl_parent_unlock() are all removed as they are no longer needed. OVL_TEMPNAME_SIZE and ovl_tempname() are now declared in overlayfs.h so that ovl_check_rename_whiteout() can access them. ovl_copy_up_workdir() now always cleans up on error. Reviewed-by: Namjae Jeon Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-12-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 5c8752729970cc2323ba86817254749f7f21f163 Author: NeilBrown Date: Thu Nov 13 11:18:33 2025 +1100 VFS/nfsd/ovl: introduce start_renaming() and end_renaming() start_renaming() combines name lookup and locking to prepare for rename. It is used when two names need to be looked up as in nfsd and overlayfs - cases where one or both dentries are already available will be handled separately. __start_renaming() avoids the inode_permission check and hash calculation and is suitable after filename_parentat() in do_renameat2(). It subsumes quite a bit of code from that function. start_renaming() does calculate the hash and check X permission and is suitable elsewhere: - nfsd_rename() - ovl_rename() In ovl, ovl_do_rename_rd() is factored out of ovl_do_rename(), which itself will be gone by the end of the series. Acked-by: Chuck Lever (for nfsd parts) Reviewed-by: Jeff Layton Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown -- Changes since v3: - added missig dput() in ovl_rename when "whiteout" is not-NULL. Changes since v2: - in __start_renaming() some label have been renamed, and err is always set before a "goto out_foo" rather than passing the error in a dentry*. - ovl_do_rename() changed to call the new ovl_do_rename_rd() rather than keeping duplicate code - code around ovl_cleanup() call in ovl_rename() restructured. Link: https://patch.msgid.link/20251113002050.676694-11-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Acked-by: Chuck Lever Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit ff7c4ea11a05c886f018fff4a4d4f4d68d951e25 Author: NeilBrown Date: Thu Nov 13 11:18:32 2025 +1100 VFS: add start_creating_killable() and start_removing_killable() These are similar to start_creating() and start_removing(), but allow a fatal signal to abort waiting for the lock. They are used in btrfs for subvol creation and removal. btrfs_may_create() no longer needs IS_DEADDIR() and start_creating_killable() includes that check. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-10-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 7bb1eb45e43c4730cbc5a48b9e9295049fccdacb Author: NeilBrown Date: Thu Nov 13 11:18:31 2025 +1100 VFS: introduce start_removing_dentry() start_removing_dentry() is similar to start_removing() but instead of providing a name for lookup, the target dentry is given. start_removing_dentry() checks that the dentry is still hashed and in the parent, and if so it locks and increases the refcount so that end_removing() can be used to finish the operation. This is used in cachefiles, overlayfs, smb/server, and apparmor. There will be other users including ecryptfs. As start_removing_dentry() takes an extra reference to the dentry (to be put by end_removing()), there is no need to explicitly take an extra reference to stop d_delete() from using dentry_unlink_inode() to negate the dentry - as in cachefiles_delete_object(), and ksmbd_vfs_unlink(). cachefiles_bury_object() now gets an extra ref to the victim, which is drops. As it includes the needed end_removing() calls, the caller doesn't need them. Reviewed-by: Amir Goldstein Reviewed-by: Namjae Jeon Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-9-neilb@ownmail.net Signed-off-by: Christian Brauner commit 1ead2213dd7d14fecad7414e9dbeb2161cfcf8c3 Author: NeilBrown Date: Thu Nov 13 11:18:30 2025 +1100 smb/server: use end_removing_noperm for for target of smb2_create_link() Sometimes smb2_create_link() needs to remove the target before creating the link. It uses ksmbd_vfs_kern_locked(), and is the only user of that interface. To match the new naming, that function is changed to ksmbd_vfs_kern_start_removing(), and related functions or flags are also renamed. The lock actually happens in ksmbd_vfs_path_lookup() and that is changed to use start_removing_noperm() - permission to perform lookup in the parent was already checked in vfs_path_parent_lookup(). Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-8-neilb@ownmail.net Signed-off-by: Christian Brauner commit c9ba789dad15ba65662bba17595c0aeaa0cfcf1c Author: NeilBrown Date: Thu Nov 13 11:18:29 2025 +1100 VFS: introduce start_creating_noperm() and start_removing_noperm() xfs, fuse, ipc/mqueue need variants of start_creating or start_removing which do not check permissions. This patch adds _noperm versions of these functions. Note that do_mq_open() was only calling mntget() so it could call path_put() - it didn't really need an extra reference on the mnt. Now it doesn't call mntget() and uses end_creating() which does the dput() half of path_put(). Also mq_unlink() previously passed d_inode(dentry->d_parent) as the dir inode to vfs_unlink(). This is after locking d_inode(mnt->mnt_root) These two inodes are the same, but normally calls use the textual parent. So I've changes the vfs_unlink() call to be given d_inode(mnt->mnt_root). Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown -- changes since v2: - dir arg passed to vfs_unlink() in mq_unlink() changed to match the dir passed to lookup_noperm() - restore assignment to path->mnt even though the mntget() is removed. Link: https://patch.msgid.link/20251113002050.676694-7-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit bd6ede8a06e89ca5a94a8b51cea792705d1b8ca2 Author: NeilBrown Date: Thu Nov 13 11:18:28 2025 +1100 VFS/nfsd/cachefiles/ovl: introduce start_removing() and end_removing() start_removing() is similar to start_creating() but will only return a positive dentry with the expectation that it will be removed. This is used by nfsd, cachefiles, and overlayfs. They are changed to also use end_removing() to terminate the action begun by start_removing(). This is a simple alias for end_dirop(). Apart from changes to the error paths, as we no longer need to unlock on a lookup error, an effect on callers is that they don't need to test if the found dentry is positive or negative - they can be sure it is positive. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-6-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 7ab96df840e60eb933abfe65fc5fe44e72f16dc0 Author: NeilBrown Date: Thu Nov 13 11:18:27 2025 +1100 VFS/nfsd/cachefiles/ovl: add start_creating() and end_creating() start_creating() is similar to simple_start_creating() but is not so simple. It takes a qstr for the name, includes permission checking, and does NOT report an error if the name already exists, returning a positive dentry instead. This is currently used by nfsd, cachefiles, and overlayfs. end_creating() is called after the dentry has been used. end_creating() drops the reference to the dentry as it is generally no longer needed. This is exactly the first section of end_creating_path() so that function is changed to call the new end_creating() These calls help encapsulate locking rules so that directory locking can be changed. Occasionally this change means that the parent lock is held for a shorter period of time, for example in cachefiles_commit_tmpfile(). As this function now unlocks after an unlink and before the following lookup, it is possible that the lookup could again find a positive dentry, so a while loop is introduced there. In overlayfs the ovl_lookup_temp() function has ovl_tempname() split out to be used in ovl_start_creating_temp(). The other use of ovl_lookup_temp() is preparing for a rename. When rename handling is updated, ovl_lookup_temp() will be removed. Reviewed-by: Jeff Layton Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-5-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 3661a7887462b2352ef5199a04e79c3d3c11fff3 Author: NeilBrown Date: Thu Nov 13 11:18:26 2025 +1100 VFS: tidy up do_unlinkat() The simplification of locking in the previous patch opens up some room for tidying up do_unlinkat() - change all "exit" labels to describe what will happen at the label. - always goto an exit label on an error - unwrap the "if (!IS_ERR())" branch. - Move the "slashes" handing inline, but mark it as unlikely() - simplify use of the "inode" variable - we no longer need to test for NULL. Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-4-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 4037d966f034ba5da2872c413b2ec17eca867e68 Author: NeilBrown Date: Thu Nov 13 11:18:25 2025 +1100 VFS: introduce start_dirop() and end_dirop() The fact that directory operations (create,remove,rename) are protected by a lock on the parent is known widely throughout the kernel. In order to change this - to instead lock the target dentry - it is best to centralise this knowledge so it can be changed in one place. This patch introduces start_dirop() which is local to VFS code. It performs the required locking for create and remove. Rename will be handled separately. Various functions with names like start_creating() or start_removing_path(), some of which already exist, will export this functionality beyond the VFS. end_dirop() is the partner of start_dirop(). It drops the lock and releases the reference on the dentry. It *is* exported so that various end_creating etc functions can be inline. As vfs_mkdir() drops the dentry on error we cannot use end_dirop() as that won't unlock when the dentry IS_ERR(). For now we need an explicit unlock when dentry IS_ERR(). I hope to change vfs_mkdir() to unlock when it drops a dentry so that explicit unlock can go away. end_dirop() can always be called on the result of start_dirop(), but not after vfs_mkdir(). After a vfs_mkdir() we still may need the explicit unlock as seen in end_creating_path(). As well as adding start_dirop() and end_dirop() this patch uses them in: - simple_start_creating (which requires sharing lookup_noperm_common() with libfs.c) - start_removing_path / start_removing_user_path_at - filename_create / end_creating_path() - do_rmdir(), do_unlinkat() Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-3-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 8b45b9a882338e1e4daf7eac46e3bad30e9bfde3 Author: NeilBrown Date: Thu Nov 13 11:18:24 2025 +1100 debugfs: rename end_creating() to debugfs_end_creating() By not using the generic end_creating() name here we are free to use it more globally for a more generic function. This should have been done when start_creating() was renamed. For consistency, also rename failed_creating(). Reviewed-by: Amir Goldstein Reviewed-by: Jeff Layton Acked-by: Greg Kroah-Hartman Signed-off-by: NeilBrown Link: https://patch.msgid.link/20251113002050.676694-2-neilb@ownmail.net Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit 5654889a94b0de5ad6ceae3793e7f5e0b61b50b6 Author: Nicolas Ferre Date: Fri Nov 14 11:33:13 2025 +0100 ARM: dts: microchip: sama7g5: fix uart fifo size to 32 On some flexcom nodes related to uart, the fifo sizes were wrong: fix them to 32 data. Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") Cc: stable@vger.kernel.org # 5.15+ Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20251114103313.20220-2-nicolas.ferre@microchip.com Signed-off-by: Claudiu Beznea commit 1f591be0a02c697f65a21be35f1d74117bbf4be2 Author: Nicolas Ferre Date: Fri Nov 14 11:33:12 2025 +0100 ARM: dts: microchip: sama7d65: fix uart fifo size to 32 On some flexcom nodes related to uart, the fifo sizes were wrong: fix them to 32 data. Note that product datasheet is being reviewed to fix inconsistency, but this value is validated by product's designers. Fixes: 261dcfad1b59 ("ARM: dts: microchip: add sama7d65 SoC DT") Fixes: b51e4aea3ecf ("ARM: dts: microchip: sama7d65: Add FLEXCOMs to sama7d65 SoC") Cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20251114103313.20220-1-nicolas.ferre@microchip.com Signed-off-by: Claudiu Beznea commit cc7d6c65b8df0587de7541031dd91b7ee751a4b6 Author: Kriish Sharma Date: Tue Nov 11 11:25:33 2025 +0000 nstree: fix kernel-doc comments for internal functions Documentation build reported: Warning: kernel/nstree.c:325 function parameter 'ns_tree' not described in '__ns_tree_adjoined_rcu' Warning: kernel/nstree.c:325 expecting prototype for ns_tree_adjoined_rcu(). Prototype was for __ns_tree_adjoined_rcu() instead Warning: kernel/nstree.c:353 expecting prototype for ns_tree_gen_id(). Prototype was for __ns_tree_gen_id() instead The kernel-doc comments for `__ns_tree_adjoined_rcu()` and `__ns_tree_gen_id()` had mismatched function names and a missing parameter description. This patch updates the function names in the kernel-doc headers and adds the missing `@ns_tree` parameter description for `__ns_tree_adjoined_rcu()`. Fixes: 885fc8ac0a4d ("nstree: make iterator generic") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511061542.0LO7xKs8-lkp@intel.com Signed-off-by: Kriish Sharma Link: https://patch.msgid.link/20251111112533.2254432-1-kriish.sharma2006@gmail.com Signed-off-by: Christian Brauner commit cefd55bd2159f427228d44864747243946296739 Author: Christian Brauner Date: Tue Nov 11 22:29:44 2025 +0100 nsproxy: fix free_nsproxy() and simplify create_new_namespaces() Make it possible to handle NULL being passed to the reference count helpers instead of forcing the caller to handle this. Afterwards we can nicely allow a cleanup guard to handle nsproxy freeing. Active reference count handling is not done in nsproxy_free() but rather in free_nsproxy() as nsproxy_free() is also called from setns() failure paths where a new nsproxy has been prepared but has not been marked as active via switch_task_namespaces(). Link: https://lore.kernel.org/690bfb9e.050a0220.2e3c35.0013.GAE@google.com Link: https://patch.msgid.link/20251111-sakralbau-guthaben-7dcc277d337f@brauner Fixes: 3c9820d5c64a ("ns: add active reference count") Reported-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com Reported-by: syzbot+0a8655a80e189278487e@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit fa0d2dc69e945ddbb1d023dfb4f7ba4103523213 Merge: 8e1bf774ab1815 37f0c7a8df7ad7 Author: Jens Axboe Date: Fri Nov 14 05:10:09 2025 -0700 Merge branch 'p2pdma-mmio-6.19.v5' into for-6.19/block Merge MMIO P2P DMA series from Leon: "This patch series improves block layer and NVMe driver support for MMIO memory regions, particularly for peer-to-peer (P2P) DMA transfers that go through the host bridge. The series addresses a critical gap where P2P transfers through the host bridge (PCI_P2PDMA_MAP_THRU_HOST_BRIDGE) were not properly marked as MMIO memory, leading to potential issues with: - Inappropriate CPU cache synchronization operations on MMIO regions - Incorrect DMA mapping/unmapping that doesn't respect MMIO semantics - Missing IOMMU configuration for MMIO memory handling This work is extracted from the larger DMA physical API improvement series [1] and focuses specifically on block layer and NVMe requirements for MMIO memory support. [1] https://lore.kernel.org/all/cover.1757423202.git.leonro@nvidia.com/" Link: https://lore.kernel.org/linux-block/20251114-block-with-mmio-v5-0-69d00f73d766@nvidia.com/ Signed-off-by: Jens Axboe * p2pdma-mmio-6.19.v5: block-dma: properly take MMIO path nvme-pci: migrate to dma_map_phys instead of map_page commit 37f0c7a8df7ad719a68fa1c2dbf066cfebc391a7 Author: Leon Romanovsky Date: Fri Nov 14 11:07:04 2025 +0200 block-dma: properly take MMIO path In commit eadaa8b255f3 ("dma-mapping: introduce new DMA attribute to indicate MMIO memory"), DMA_ATTR_MMIO attribute was added to describe MMIO addresses, which require to avoid any memory cache flushing, as an outcome of the discussion pointed in Link tag below. In case of PCI_P2PDMA_MAP_THRU_HOST_BRIDGE transfer, blk-mq-dm logic treated this as regular page and relied on "struct page" DMA flow. That flow performs CPU cache flushing, which shouldn't be done here, and doesn't set IOMMU_MMIO flag in DMA-IOMMU case. As a solution, let's encode peer-to-peer transaction type in NVMe IOD flags variable and provide it to blk-mq-dma API. Link: https://lore.kernel.org/all/f912c446-1ae9-4390-9c11-00dce7bf0fd3@arm.com/ Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Keith Busch Signed-off-by: Leon Romanovsky Signed-off-by: Jens Axboe commit 61d43b1731e0bc122a0f78df42ce424db5b14a19 Author: Leon Romanovsky Date: Fri Nov 14 11:07:03 2025 +0200 nvme-pci: migrate to dma_map_phys instead of map_page After introduction of dma_map_phys(), there is no need to convert from physical address to struct page in order to map page. So let's use it directly. Reviewed-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: Leon Romanovsky Signed-off-by: Jens Axboe commit 5949d419c193ce8e285acfbaafad88efe87f9dfa Author: Alistair Popple Date: Mon Nov 10 22:34:23 2025 +0900 gpu: nova-core: gsp: Boot GSP Boot the GSP to the RISC-V active state. Completing the boot requires running the CPU sequencer which will be added in a future commit. Reviewed-by: Lyude Paul Signed-off-by: Alistair Popple Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-15-8ae4058e3c0e@nvidia.com> commit 945c1eee7dbeb0dcafc9d151eaa46a4273d386fa Author: Joel Fernandes Date: Mon Nov 10 22:34:22 2025 +0900 gpu: nova-core: falcon: Add support to write firmware version This will be needed by both the GSP boot code as well as GSP resume code in the sequencer. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-14-8ae4058e3c0e@nvidia.com> commit bb58d1aee6081dba5f64eacf48993c077e99dd4a Author: Joel Fernandes Date: Mon Nov 10 22:34:21 2025 +0900 gpu: nova-core: falcon: Add support to check if RISC-V is active Add definition for RISCV_CPUCTL register and use it in a new falcon API to check if the RISC-V core of a Falcon is active. It is required by the sequencer to know if the GSP's RISCV processor is active. Reviewed-by: Lyude Paul Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-13-8ae4058e3c0e@nvidia.com> commit 19b0a6e7c2be35f9b11c51c0c21c9a02c23252ff Author: Alistair Popple Date: Mon Nov 10 22:34:20 2025 +0900 gpu: nova-core: gsp: Add SetRegistry command Add support for sending the SetRegistry command, which is critical to GSP initialization. The RM registry is serialized into a packed format and sent via the command queue. For now only three parameters which are required to boot GSP are hardcoded. In the future a kernel module parameter will be added to enable other parameters to be added. Signed-off-by: Alistair Popple [acourbot@nvidia.com: split into its own patch.] Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-12-8ae4058e3c0e@nvidia.com> commit edcb134264f7db95295a9f0feb7a8b3acde72a08 Author: Alistair Popple Date: Mon Nov 10 22:34:19 2025 +0900 gpu: nova-core: gsp: Add SetSystemInfo command Add support for sending the SetSystemInfo command, which provides required hardware information to the GSP and is critical to its initialization. Signed-off-by: Alistair Popple Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-11-8ae4058e3c0e@nvidia.com> commit 4fd4acd973ec6c734e928d19aaa649d4268303a1 Author: Alistair Popple Date: Mon Nov 10 22:34:18 2025 +0900 gpu: nova-core: gsp: Create rmargs Initialise the GSP resource manager arguments (rmargs) which provides initialisation parameters to the GSP firmware during boot. The rmargs structure contains arguments to configure the GSP message/command queue location. These are mapped for coherent DMA and added to the libos data structure for access when booting GSP. Signed-off-by: Alistair Popple Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-10-8ae4058e3c0e@nvidia.com> commit 75f6b1de8133ea337b72901464989dc811d3305d Author: Alistair Popple Date: Mon Nov 10 22:34:17 2025 +0900 gpu: nova-core: gsp: Add GSP command queue bindings and handling This commit introduces core infrastructure for handling GSP command and message queues in the nova-core driver. The command queue system enables bidirectional communication between the host driver and GSP firmware through a remote message passing interface. The interface is based on passing serialised data structures over a ring buffer with separate transmit and receive queues. Commands are sent by writing to the CPU transmit queue and waiting for completion via the receive queue. To ensure safety mutable or immutable (depending on whether it is a send or receive operation) references are taken on the command queue when allocating the message to write/read to. This ensures message memory remains valid and the command queue can't be mutated whilst an operation is in progress. Currently this is only used by the probe() routine and therefore can only used by a single thread of execution. Locking to enable safe access from multiple threads will be introduced in a future series when that becomes necessary. Signed-off-by: Alistair Popple Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-9-8ae4058e3c0e@nvidia.com> commit 88622323dde3d9d6efd6f2efcfaa0bced5af94c3 Author: Alexandre Courbot Date: Mon Nov 10 22:34:16 2025 +0900 rust: enable slice_flatten feature and provide it through an extension trait In Rust 1.80, the previously unstable `slice::flatten` family of methods have been stabilized and renamed to `slice::as_flattened`. This creates an issue as we want to use `as_flattened`, but need to support the MSRV (which at the moment is Rust 1.78) where it is named `flatten`. Solve this by enabling the `slice_flatten` feature, and providing an `as_flattened` implementation through an extension trait for compiler versions where it is not available. The trait is then exported from the prelude, making the `as_flattened` family of methods transparently available for all supported compiler versions. This extension trait can be removed once the MSRV passes 1.80. Suggested-by: Miguel Ojeda Link: https://lore.kernel.org/all/CANiq72kK4pG=O35NwxPNoTO17oRcg1yfGcvr3==Fi4edr+sfmw@mail.gmail.com/ Acked-by: Danilo Krummrich Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-8-8ae4058e3c0e@nvidia.com> Message-ID: <20251104-b4-as-flattened-v3-1-6cb9c26b45cd@nvidia.com> commit 6b5a10dad555310e44ff5f53f97e18be76b395ea Author: Alistair Popple Date: Mon Nov 10 22:34:15 2025 +0900 gpu: nova-core: Add zeroable trait to bindings Derive the Zeroable trait for existing bindgen generated bindings. This is safe because all bindgen generated types are simple integer types for which any bit pattern, including all zeros, is valid. Signed-off-by: Alistair Popple Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-7-8ae4058e3c0e@nvidia.com> commit d416035fb6fb4367e40388552ff8079a97c7155f Author: Joel Fernandes Date: Mon Nov 10 22:34:14 2025 +0900 gpu: nova-core: Add a slice-buffer (sbuffer) datastructure A data structure that can be used to write across multiple slices which may be out of order in memory. This lets SBuffer user correctly and safely write out of memory order, without error-prone tracking of pointers/offsets. let mut buf1 = [0u8; 3]; let mut buf2 = [0u8; 5]; let mut sbuffer = SBuffer::new([&mut buf1[..], &mut buf2[..]]); let data = b"hello"; let result = sbuffer.write(data); Reviewed-by: Lyude Paul Co-developed-by: Alistair Popple Signed-off-by: Alistair Popple Signed-off-by: Joel Fernandes Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-6-8ae4058e3c0e@nvidia.com> commit 41235c40eda024f8d2a1e2456ab7a82c9db05e78 Author: Alistair Popple Date: Mon Nov 10 22:34:13 2025 +0900 gpu: nova-core: gsp: Create wpr metadata The GSP requires some pieces of metadata to boot. These are passed in a struct which the GSP transfers via DMA. Create this struct and get a handle to it for future use when booting the GSP. Signed-off-by: Alistair Popple Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-5-8ae4058e3c0e@nvidia.com> commit f38b4f105cfc19598bdb512c08f5d27be774f0de Author: Alistair Popple Date: Mon Nov 10 22:34:12 2025 +0900 gpu: nova-core: Create initial Gsp The GSP requires several areas of memory to operate. Each of these have their own simple embedded page tables. Set these up and map them for DMA to/from GSP using CoherentAllocation's. Return the DMA handle describing where each of these regions are for future use when booting GSP. Signed-off-by: Alistair Popple Co-developed-by: Alexandre Courbot Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-4-8ae4058e3c0e@nvidia.com> commit 89605daa1ee0de634d7f2ee6370363cfaa8c9499 Author: Alexandre Courbot Date: Mon Nov 10 22:34:11 2025 +0900 gpu: nova-core: num: add functions to safely convert a const value to a smaller type There are times where we need to store a constant value defined as a larger type (e.g. through a binding) into a smaller type, knowing that the value will fit. Rust, unfortunately, only provides us with the `as` operator for that purpose, the use of which is discouraged as it silently strips data. Extend the `num` module with functions allowing to perform the conversion infallibly, at compile time. Example: const FOO_VALUE: u32 = 1; // `FOO_VALUE` fits into a `u8`, so the conversion is valid. let foo = num::u32_to_u8::<{ FOO_VALUE }>(); We are going to use this feature extensively in Nova. Reviewed-by: Mikko Perttunen [acourbot@nvidia.com: fix mistake in example pointed out by Mikko.] Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-3-8ae4058e3c0e@nvidia.com> commit a5d51e02d6fa550aed4b31ed67d230e82a771ed5 Merge: 0a47e5e864c726 9075ceeadac3e4 Author: Uwe Kleine-König Date: Fri Nov 7 10:33:34 2025 +0100 Merge branch 'pwm/th1520' into pwm/for-next commit 0a47e5e864c72627aacde1ed464539ba83e45221 Author: Uwe Kleine-König Date: Thu Oct 30 23:25:27 2025 +0100 pwm: mediatek: Make use of struct_size macro struct_size provides the size of a struct with a flexible array member. Use that instead of open-coding it (with less checks than the global macro). Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202510301753.iqGmTwae-lkp@intel.com/ Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20251030222528.632836-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit a875806eac0b0d4be5bbf901350fcca22f515d92 Author: Chen Ni Date: Tue Nov 4 15:33:04 2025 +0800 pwm: mediatek: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. This was introduced in commit 3a4a308c069a ("pwm: mediatek: Convert to waveform API"). Signed-off-by: Chen Ni Link: https://patch.msgid.link/20251105214847.1279520-1-nichen@iscas.ac.cn [ukleinek: Add reference to introducing commit.] Signed-off-by: Uwe Kleine-König commit b55bbc2872eb8d6ccb5011133e05f6349351fa37 Author: Benjamin Larsson Date: Mon Oct 13 12:34:03 2025 +0200 pwm: airoha: Add support for EN7581 SoC Introduce driver for PWM module available on EN7581 SoC. Limitations: - Only 8 concurrent waveform generators are available for 8 combinations of duty_cycle and period. Waveform generators are shared between 16 GPIO pins and 17 SIPO GPIO pins. - Supports only normal polarity. - On configuration the currently running period is completed. - Minimum supported period is 4 ms - Maximum supported period is 1s Signed-off-by: Benjamin Larsson Reviewed-by: AngeloGioacchino Del Regno Co-developed-by: Lorenzo Bianconi Signed-off-by: Lorenzo Bianconi Reviewed-by: Andy Shevchenko Co-developed-by: Christian Marangi Signed-off-by: Christian Marangi Link: https://patch.msgid.link/20251013103408.14724-1-ansuelsmth@gmail.com Signed-off-by: Uwe Kleine-König commit 24ec5632a10d0dc569b2eab8ad9573b9d91b2c7a Author: Uwe Kleine-König Date: Mon Oct 13 13:42:56 2025 +0200 pwm: mediatek: Convert to waveform API Implement the new waveform callbacks which makes the usage of this hardware more flexible and allows to use it via the pwm character device. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20251013114258.149260-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 0251fa8887416702cdebf75a509b949ff2cb0a0d Author: Mathieu Dubois-Briand Date: Wed Sep 24 11:06:40 2025 +0200 pwm: max7360: Clean MAX7360 code Duty steps computation can never end in values higher than MAX7360_PWM_MAX: remove useless use of min(). Signed-off-by: Mathieu Dubois-Briand Suggested-by: Uwe Kleine-König Link: https://patch.msgid.link/20250924-mdb-max7360-pwm-optimize-v1-1-5959eeed20d8@bootlin.com Signed-off-by: Uwe Kleine-König commit 0559730b8570259ef948e9083653f8a87baba182 Author: Uwe Kleine-König Date: Mon Sep 22 11:43:28 2025 +0200 pwm: Drop unused function pwm_apply_args() The function pwm_apply_args() was introduced with the concept of atomic PWM configuration and needed for drivers not using this concept yet. Now all drivers are converted accordingly and so no callers are left which allows to remove this function. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20250922094327.1143944-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 5f7ff902e7f324c10f2b64c5ba2e5e2d0bc4e07e Author: Uwe Kleine-König Date: Mon Oct 6 15:35:26 2025 +0200 pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id %u is the right conversion specifier to emit an unsigned int value. Fixes: 62099abf67a2 ("pwm: Add debugfs interface") Fixes: 0360a4873372 ("pwm: Mention PWM chip ID in /sys/kernel/debug/pwm") Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20251006133525.2457171-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 3cf8e55894b51c14f8500cae5e68ed48b1b0f3fd Author: Uwe Kleine-König Date: Fri Sep 26 18:57:03 2025 +0200 pwm: Simplify printf to emit chip->npwm in $debugfs/pwm Instead of caring to correctly pluralize "PWM device(s)" using (chip->npwm != 1) ? "s" : "" or str_plural(chip->npwm) just simplify the format to not need a plural-s. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20250926165702.321514-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 52a1f73d1733e6d5bf2cbfa93296207e542cdea7 Author: Heiko Carstens Date: Tue Nov 4 11:48:57 2025 +0100 s390/fault: Print unmodified PSW address on protection exception In case of a kernel crash caused by a protection exception, print the unmodified PSW address as reported by the CPU. The protection exception handler modifies the PSW address in order to keep fault handling easy, however that leads to misleading call traces. Therefore restore the original PSW address before printing it. Before this change the output in case of a protection exception looks like this: Oops: 0004 ilc:2 [#1]SMP Krnl PSW : 0704c00180000000 000003ffe0b40d78 (sysrq_handle_crash+0x28/0x40) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Krnl Code: 000003ffe0b40d66: e3e0f0980024 stg %r14,152(%r15) 000003ffe0b40d6c: c010fffffff2 larl %r1,000003ffe0b40d50 #000003ffe0b40d72: c0200046b6bc larl %r2,000003ffe1417aea >000003ffe0b40d78: 92021000 mvi 0(%r1),2 000003ffe0b40d7c: c0e5ffae03d6 brasl %r14,000003ffe0101528 With this change it looks like this: Oops: 0004 ilc:2 [#1]SMP Krnl PSW : 0704c00180000000 000003ffe0b40dfc (sysrq_handle_crash+0x2c/0x40) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Krnl Code: 000003ffe0b40dec: c010fffffff2 larl %r1,000003ffe0b40dd0 000003ffe0b40df2: c0200046b67c larl %r2,000003ffe1417aea *000003ffe0b40df8: 92021000 mvi 0(%r1),2 >000003ffe0b40dfc: c0e5ffae03b6 brasl %r14,000003ffe0101568 000003ffe0b40e02: 0707 bcr 0,%r7 Note that with this change the PSW address points to the instruction behind the instruction which caused the exception like it is expected for protection exceptions. This also replaces the '#' marker in the disassembly with '*', which allows to distinguish between new and old behavior. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit a603a0039965ee66d7e521bacf8161d3109bfd75 Author: Heiko Carstens Date: Tue Nov 4 11:48:56 2025 +0100 s390/uprobes: Use __forward_psw() instead of private implementation With adjust_psw_addr() the uprobes code contains more or less a private __forward_psw() implementation. Switch it to use __forward_psw(), and remove adjust_psw_addr(). Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 37450e0994f717d8f621b1dfc1c713f9c66cf59c Author: Heiko Carstens Date: Tue Nov 4 11:48:55 2025 +0100 s390/processor: Add __forward_psw() helper Similar to __rewind_psw() add the counter part __forward_psw(). This helps to make code more readable if a PSW address has to be forwarded, since it is more natural to write addr = __forward_psw(psw, ilen); instead of addr = __rewind_psw(psw, -ilen); This renames also the ilc parameter of __rewind_psw() to ilen, since the parameter reflects an instruction length, and not an instruction length code. Also change the type of ilen from unsigned long to long so it reflects that lengths can be negative or positive. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 14e4e4175b64dd9216b522f6ece8af6997d063b2 Author: Aleksei Nikiforov Date: Fri Nov 7 16:59:16 2025 +0100 s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is detected when running ping command. An inline assembly instruction 'vstl' can write varied amount of bytes depending on value of 'index' argument. If 'index' > 0, 'vstl' writes at least 2 bytes. clang generates kmsan write helper call depending on inline assembly constraints. Constraints are evaluated compile-time, but value of 'index' argument is known only at runtime. clang currently generates call to __msan_instrument_asm_store with 1 byte as size. Manually call kmsan function to indicate correct amount of bytes written and fix false-positive report. This change fixes following kmsan reports: [ 36.563119] ===================================================== [ 36.563594] BUG: KMSAN: uninit-value in virtqueue_add+0x35c6/0x7c70 [ 36.563852] virtqueue_add+0x35c6/0x7c70 [ 36.564016] virtqueue_add_outbuf+0xa0/0xb0 [ 36.564266] start_xmit+0x288c/0x4a20 [ 36.564460] dev_hard_start_xmit+0x302/0x900 [ 36.564649] sch_direct_xmit+0x340/0xea0 [ 36.564894] __dev_queue_xmit+0x2e94/0x59b0 [ 36.565058] neigh_resolve_output+0x936/0xb40 [ 36.565278] __neigh_update+0x2f66/0x3a60 [ 36.565499] neigh_update+0x52/0x60 [ 36.565683] arp_process+0x1588/0x2de0 [ 36.565916] NF_HOOK+0x1da/0x240 [ 36.566087] arp_rcv+0x3e4/0x6e0 [ 36.566306] __netif_receive_skb_list_core+0x1374/0x15a0 [ 36.566527] netif_receive_skb_list_internal+0x1116/0x17d0 [ 36.566710] napi_complete_done+0x376/0x740 [ 36.566918] virtnet_poll+0x1bae/0x2910 [ 36.567130] __napi_poll+0xf4/0x830 [ 36.567294] net_rx_action+0x97c/0x1ed0 [ 36.567556] handle_softirqs+0x306/0xe10 [ 36.567731] irq_exit_rcu+0x14c/0x2e0 [ 36.567910] do_io_irq+0xd4/0x120 [ 36.568139] io_int_handler+0xc2/0xe8 [ 36.568299] arch_cpu_idle+0xb0/0xc0 [ 36.568540] arch_cpu_idle+0x76/0xc0 [ 36.568726] default_idle_call+0x40/0x70 [ 36.568953] do_idle+0x1d6/0x390 [ 36.569486] cpu_startup_entry+0x9a/0xb0 [ 36.569745] rest_init+0x1ea/0x290 [ 36.570029] start_kernel+0x95e/0xb90 [ 36.570348] startup_continue+0x2e/0x40 [ 36.570703] [ 36.570798] Uninit was created at: [ 36.571002] kmem_cache_alloc_node_noprof+0x9e8/0x10e0 [ 36.571261] kmalloc_reserve+0x12a/0x470 [ 36.571553] __alloc_skb+0x310/0x860 [ 36.571844] __ip_append_data+0x483e/0x6a30 [ 36.572170] ip_append_data+0x11c/0x1e0 [ 36.572477] raw_sendmsg+0x1c8c/0x2180 [ 36.572818] inet_sendmsg+0xe6/0x190 [ 36.573142] __sys_sendto+0x55e/0x8e0 [ 36.573392] __s390x_sys_socketcall+0x19ae/0x2ba0 [ 36.573571] __do_syscall+0x12e/0x240 [ 36.573823] system_call+0x6e/0x90 [ 36.573976] [ 36.574017] Byte 35 of 98 is uninitialized [ 36.574082] Memory access of size 98 starts at 0000000007aa0012 [ 36.574218] [ 36.574325] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.17.0-dirty #16 NONE [ 36.574541] Tainted: [B]=BAD_PAGE, [N]=TEST [ 36.574617] Hardware name: IBM 3931 A01 703 (KVM/Linux) [ 36.574755] ===================================================== [ 63.532541] ===================================================== [ 63.533639] BUG: KMSAN: uninit-value in virtqueue_add+0x35c6/0x7c70 [ 63.533989] virtqueue_add+0x35c6/0x7c70 [ 63.534940] virtqueue_add_outbuf+0xa0/0xb0 [ 63.535861] start_xmit+0x288c/0x4a20 [ 63.536708] dev_hard_start_xmit+0x302/0x900 [ 63.537020] sch_direct_xmit+0x340/0xea0 [ 63.537997] __dev_queue_xmit+0x2e94/0x59b0 [ 63.538819] neigh_resolve_output+0x936/0xb40 [ 63.539793] ip_finish_output2+0x1ee2/0x2200 [ 63.540784] __ip_finish_output+0x272/0x7a0 [ 63.541765] ip_finish_output+0x4e/0x5e0 [ 63.542791] ip_output+0x166/0x410 [ 63.543771] ip_push_pending_frames+0x1a2/0x470 [ 63.544753] raw_sendmsg+0x1f06/0x2180 [ 63.545033] inet_sendmsg+0xe6/0x190 [ 63.546006] __sys_sendto+0x55e/0x8e0 [ 63.546859] __s390x_sys_socketcall+0x19ae/0x2ba0 [ 63.547730] __do_syscall+0x12e/0x240 [ 63.548019] system_call+0x6e/0x90 [ 63.548989] [ 63.549779] Uninit was created at: [ 63.550691] kmem_cache_alloc_node_noprof+0x9e8/0x10e0 [ 63.550975] kmalloc_reserve+0x12a/0x470 [ 63.551969] __alloc_skb+0x310/0x860 [ 63.552949] __ip_append_data+0x483e/0x6a30 [ 63.553902] ip_append_data+0x11c/0x1e0 [ 63.554912] raw_sendmsg+0x1c8c/0x2180 [ 63.556719] inet_sendmsg+0xe6/0x190 [ 63.557534] __sys_sendto+0x55e/0x8e0 [ 63.557875] __s390x_sys_socketcall+0x19ae/0x2ba0 [ 63.558869] __do_syscall+0x12e/0x240 [ 63.559832] system_call+0x6e/0x90 [ 63.560780] [ 63.560972] Byte 35 of 98 is uninitialized [ 63.561741] Memory access of size 98 starts at 0000000005704312 [ 63.561950] [ 63.562824] CPU: 3 UID: 0 PID: 192 Comm: ping Tainted: G B N 6.17.0-dirty #16 NONE [ 63.563868] Tainted: [B]=BAD_PAGE, [N]=TEST [ 63.564751] Hardware name: IBM 3931 A01 703 (KVM/Linux) [ 63.564986] ===================================================== Fixes: dcd3e1de9d17 ("s390/checksum: provide csum_partial_copy_nocheck()") Signed-off-by: Aleksei Nikiforov Signed-off-by: Heiko Carstens commit d17901e8e8ddef130222c5e087854811d9fdaff4 Author: Thomas Richter Date: Thu Nov 6 14:23:33 2025 +0100 s390/pai: Calculate size of reserved PAI extension control block area The PAI extension 1 control block area is 512 bytes in total. It currently contains three address pointer which refer to counter memory blocks followed by a reserved area. Calculate the reserved area instead of hardcoding its size. This makes the code more readable and maintainable. No functional chance. Signed-off-by: Thomas Richter Suggested-by: Jan Polensky Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit b60d126c8ea3444d8c1f29538542d5c03d219e3e Author: Heiko Carstens Date: Mon Nov 3 16:25:33 2025 +0100 s390/mm: Let dump_fault_info() print additional information Let dump_fault_info() print additional information to make debugging easier: Print "FSI" if the access-exception-fetch/store-indication facility is installed. If it is installed the TEID may also indicate if an exception happened because of a fetch or a store operation. Print "SOP", "ESOP-1", or "ESOP-2" depending on the type of the installed Suppression-on-Protection facility. This also gives additional information about the validity and meaning of the TEID bits. The output is changed from something like: Failing address: 0000000000000000 TEID: 0000000000000803 to Failing address: 0000000000000000 TEID: 0000000000000803 ESOP-2 FSI Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 76502abca219fc8579353458a12744587b7a281f Author: Heiko Carstens Date: Mon Nov 3 16:25:32 2025 +0100 s390/mm: Change comment and die() message if teid.b61 is zero The comments in do_protection() give the impression that a TEID, where bit 61 is zero, indicates a low address protection exception. This is not necessarily true, and it depends on the type of Suppression-on-Protection facility of the machine (see Princples of Operation) what this means. Rework the comments and the die() message to reflect this. This may also help to avoid confusion. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 02310adcc621ca59d09263074de8fe44b30abbe8 Author: Heiko Carstens Date: Mon Nov 3 11:54:20 2025 +0100 s390/mm: Remove unused flush_tlb() flush_tlb() exists for historic reasons and was never used. Remove it. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit f518d469fe59e1b3b9b0b4d845926e07153924fd Merge: c1287d67c3a91a 492578d3a2bce2 Author: Heiko Carstens Date: Fri Nov 14 11:30:50 2025 +0100 Merge branch 'pai-pmu-merge' Thomas Richter says: ==================== The PAI PMUs pai_crypto and pai_ext both operate on memory mapped counters supported by z16 and follow on machines. These memory mapped counters have a lot in common, like: - validation, installing and removing events - starting and stopping events - retrieving counter values - collecting sample data. However both PMU drivers have slightly different parameters, for example: - different mapped memory size - different number of supported counters - different counter numbers and names - different bits in the CR0 register - different anchor address in lowcore Due to these different parameters, two independent PMUs have been developed. However both PMU drivers have very much in common and most of the PMU call back functions look very similar and are sometimes identical. This patch set combines both independent PMU device drivers perf_pai_crypto.c and per_pai_ext.c into one device driver. The new device driver operations on a table which contains the different parameters and uses common functions for event operations. Result is one PAI PMU driver which supports both PMUs. It is also extendable to support new PAI PMUs. ==================== Signed-off-by: Heiko Carstens commit 492578d3a2bce24b73f24728bc244add0bdf3fee Author: Thomas Richter Date: Wed Nov 5 15:39:02 2025 +0100 s390/pai: Rename perf_pai_crypto.c to perf_pai.c Rename perf_pai_crypto.c to perf_pai.c. The new perf_pai.c contains both PAI device drivers: - pai_crypto for PAI crypto counter set - pai_ext for PAI NNPA counter set The rename reflects this common driver supporting both PMUs. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 8b65b0ba3541c738af671377872270af6ee6a8ac Author: Thomas Richter Date: Wed Nov 5 15:39:01 2025 +0100 s390/pai_crypto: Merge pai_ext PMU into pai_crypto Combine PAI cryptography and PAI extension (NNPA) PMUs in one driver. Remove file perf_pai_ext.c and registration of PMU "pai_ext" from perf_pai_crypto.c. Includes: - Shared alloc/free and sched_task handling - NNPA events with exclude_kernel enforced, exclude_user rejected - Setup CR0 bits for both PMUs Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 3abb6b16758045b44d5fdf50915befa6744eaaca Author: Thomas Richter Date: Wed Nov 5 15:39:00 2025 +0100 s390/pai_crypto: Introduce PAI crypto specific event delete function Introduce PAI crypto specific event delete function to handle additional actions to be done at event removal. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 35a27bad075d594ebaabc62f94b665fa2a135433 Author: Thomas Richter Date: Wed Nov 5 15:38:59 2025 +0100 s390/pai_crypto: Make pai_root per-PMU and unify naming Prepare the common PAI PMU driver to handle multiple PMUs. Convert pai_root into an array indexed by PAI_PMU_IDX(event) so that per-CPU state becomes per-PMU. Adjust all call sites accordingly. Rename KMSG_COMPONENT and the s390dbf buffer from "pai_crypto" to "pai" for consistent naming. No functional change intended beyond log identifiers. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit f12473541356f5765e4130a7b5af77862a872a51 Author: Thomas Richter Date: Wed Nov 5 15:38:58 2025 +0100 s390/pai_crypto: Rename paicrypt_copy() to pai_copy() To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename paicrypt_copy() to pai_copy() to indicate its common usage. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 42e6a0f6d2f0e9ac96d0d6045624a1fa44ab6871 Author: Thomas Richter Date: Wed Nov 5 15:38:57 2025 +0100 s390/pai_crypto: Add common pai_del() function To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Add a common usable function pai_stop() for the event on a CPU. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit ac03223f0723cf7ee11171be963f19958a91f7b3 Author: Thomas Richter Date: Wed Nov 5 15:38:56 2025 +0100 s390/pai_crypto: Add common pai_stop() function To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Add a common usable function pai_stop() for the event on a CPU. Call this common pai_stop() from paicrypt_del(). Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit a65a4d7e806402e394b1ef0323aafec23903888b Author: Thomas Richter Date: Wed Nov 5 15:38:55 2025 +0100 s390/pai_crypto: Add common pai_add() function To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Add a common usable function pai_add() for the event on a CPU. Call this common pai_add() from paicrypt_add(). Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 6fe66b21570f138017ee493b72cd4f724c8f1df1 Author: Thomas Richter Date: Wed Nov 5 15:38:54 2025 +0100 s390/pai_crypto: Add common pai_start() function To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Add a common usable function pai_start() to the event on a CPU. The function expects a PAI PMU specific read function as second parameter to read out the start value for an event. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 8f6116fd4940ad60adbfaca3525567b087054b5b Author: Thomas Richter Date: Wed Nov 5 15:38:53 2025 +0100 s390/pai_crypto: Add common pai_read() function To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Add a common usable function pai_read() to read counter values. The function expects a PAI PMU specific read function as second parameter. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 74466e87e7fae1e5d746037a3d0484fd0afb03b2 Author: Thomas Richter Date: Wed Nov 5 15:38:52 2025 +0100 s390/pai_crypto: Unify sample push logic and update context handling Unify naming and logic for PAI PMU drivers to support both PMUs pai_crypto and pai_ext. Rename paicrypt_push_sample() to pai_push_sample() to reflect its common usage. Add detailed comments about invocation context and scheduler callbacks. Use struct pai_pmu to determine area_size instead of PAGE_SIZE for counter backup. Remove obsolete variable paicrypt_cnt. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 0f1c0d754ac9c27cfb21e2e10c95261b1459e212 Author: Thomas Richter Date: Wed Nov 5 15:38:51 2025 +0100 s390/pai_crypto: Rename paicrypt_have_samples() to pai_have_samples() To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename paicrypt_have_samples() to pai_have_samples() to reflect its common usage. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 360e180d8b5d448429079d2c541c1968f3b82790 Author: Thomas Richter Date: Wed Nov 5 15:38:50 2025 +0100 s390/pai_crypto: Rename paicrypt_getctr() to pai_getctr() To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename paicrypt_getctr() to pai_getctr() to reflect is common purpose. pai_getctr() now uses pai_pmu table to extract PAI PMU characteristics such as kernel_offset inside the counter area page. Also rename paicrypt_have_sample() to pai_have_sample(). Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 42cd0c82422775e34528b9d0df438e51150a4db9 Author: Thomas Richter Date: Wed Nov 5 15:38:49 2025 +0100 s390/pai_crypto: Rename paicrypt_getdata() to pai_getdata() To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename paicrypt_getdata() to pai_getdata(). Use the PAI PMU characteristics in the pai_pmu table to determine the number of counters to be extracted. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 65b9831bd3ced5acb0d4a0fad66f7585a3ad3db8 Author: Thomas Richter Date: Wed Nov 5 15:38:48 2025 +0100 s390/pai_crypto: Rename some function for common usage. To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename functions - paicrypt_free() -> pai_free() - paicrypt_destroy_event() -> pai_destroy_event() - paicrypt_destroy_event_cpu() -> pai_destroy_event_cpu() to reflect their future common usage. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 413957980ac86d04afa6a634eaab1182dcd8c6c3 Author: Thomas Richter Date: Wed Nov 5 15:38:47 2025 +0100 s390/pai_crypto: Introduce generic event init using pai_pmu[] To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rework PAI crypto event initialization. Add a common function for event initialization. It uses the PAI characteristics stored in the pai_pmu table instead of hardcoded values. Enlarge pai_event_valid() to check all event validation aspects. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit a3f8423622ef34cca050816c49be4291f9f41b1d Author: Thomas Richter Date: Wed Nov 5 15:38:46 2025 +0100 s390/pai_crypto: Add PAI crypto characteristics table for parameters Create and add a PMU characteristics table to store the parameters of the PAI crypto PMU. This table contains PMU details such as - number of available counters - name of these counters to export to /sysfs - Size of the memory mapped counter area - base number of first counter - etc Also define a PMU specific initialization function to be called when a PAI PMU feature is supported. At device driver initialization test these features and if available use instruction qpaci to retrieve the number of available counters. Also export these counter names to /sysfs and register this PMU. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 387c7b5f04eff53f5bd7990b9909f7cc3a4e2e8c Author: Thomas Richter Date: Wed Nov 5 15:38:45 2025 +0100 s390/pai_crypto: Rename paicrypt_root_alloc() and paicrypt_root_free() To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename functions paicrypt_root_alloc() and paicrypt_root_free() to pai_root_alloc() and pai_root_free(). No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 3f082c2e479b02e553bf1ed0b47f0a315179585c Author: Thomas Richter Date: Wed Nov 5 15:38:44 2025 +0100 s390/pai_crypto: Rename structure paicrypt_root To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename structure paicrypt_root to pai_root. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit a626e0d46acb84acb07534c672b19690d5363315 Author: Thomas Richter Date: Wed Nov 5 15:38:43 2025 +0100 s390/pai_crypto: Rename structure paicrypt_map to pai_map To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename structure paicrypt_map to pai_map. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 2706ea193af5c7d727eda2d24c9c9833e2c47ddb Author: Thomas Richter Date: Wed Nov 5 15:38:42 2025 +0100 s390/pai_crypto: Rename structure paicrypt_mapptr to pai_mapptr To support one common PAI PMU device driver which handles both PMUs pai_crypto and pai_ext, use a common naming scheme for structures and variables suitable for both device drivers. Rename structure paicrypt_mapptr to pai_mapptr. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit c124208b74a66713d2743089ae1c55a1661e8cd9 Author: Thomas Richter Date: Wed Nov 5 15:38:41 2025 +0100 s390/pai_crypto: Rename member paicrypt_map::page Rename member page in struct paicrypt_map to area. This rename creates consistent naming for both PMU drivers paicrypto and PMU paiext. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit abc524caa1382a56f82d07d0621b7fa80f33e207 Author: Thomas Richter Date: Wed Nov 5 15:38:40 2025 +0100 s390/pai_crypto: Rename variable cfm_dbg The global variable cfm_dbg points to the s390dbf debug buffer. Rename it to paidbg to better reflect its purpose. No functional change. Signed-off-by: Thomas Richter Reviewed-by: Jan Polensky Signed-off-by: Heiko Carstens commit 76ce17f6f7f78ab79b9741388bdb4dafa985b4e9 Author: Zilin Guan Date: Sun Nov 9 14:56:48 2025 +0000 crypto: iaa - Fix incorrect return value in save_iaa_wq() The save_iaa_wq() function unconditionally returns 0, even when an error is encountered. This prevents the error code from being propagated to the caller. Fix this by returning the 'ret' variable, which holds the actual status of the operations within the function. Fixes: ea7a5cbb43696 ("crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core") Signed-off-by: Zilin Guan Signed-off-by: Herbert Xu commit 2236fc007a78b2d734cf0c236c33b722d344daa3 Author: Thorsten Blum Date: Sat Nov 8 15:57:07 2025 +0100 crypto: zstd - Remove unnecessary size_t cast Use max() instead of max_t() since zstd_cstream_workspace_bound() and zstd_dstream_workspace_bound() already return size_t and casting the values is unnecessary. Signed-off-by: Thorsten Blum Reviewed-by: David Sterba Signed-off-by: Herbert Xu commit 6cf32607555da7ef99005ff0d73f3d8597cbbd04 Author: Thorsten Blum Date: Sat Nov 8 13:07:40 2025 +0100 crypto: zstd - Annotate struct zstd_ctx with __counted_by Add the __counted_by() compiler attribute to the flexible array member 'wksp' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Use struct_size(), which provides additional compile-time checks for structures with flexible array members (e.g., __must_be_array()), for the allocation size for a new 'zstd_ctx' while we're at it. Signed-off-by: Thorsten Blum Reviewed-by: David Sterba Signed-off-by: Herbert Xu commit af3852cda347a72335c7625f92b29d31495aeeda Author: Tetsuo Handa Date: Fri Nov 7 23:49:37 2025 +0900 padata: remove __padata_list_init() syzbot is reporting possibility of deadlock due to sharing lock_class_key between padata_init_squeues() and padata_init_reorder_list(). This is a false positive, for these callers initialize different object. Unshare lock_class_key by embedding __padata_list_init() into these callers. Reported-by: syzbot+bd936ccd4339cea66e6b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bd936ccd4339cea66e6b Signed-off-by: Tetsuo Handa Signed-off-by: Herbert Xu commit 06c489ce5b5053d6f9eddac7ccc0d80839e11198 Author: Marco Crivellari Date: Fri Nov 7 12:23:54 2025 +0100 crypto: qat - add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Acked-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 054c7f7ad323fde38fd8d1a7858aae16330e4fc1 Author: Krzysztof Kozlowski Date: Fri Nov 7 09:15:53 2025 +0100 crypto: cesa - Simplify with of_device_get_match_data() Driver's probe function matches against driver's of_device_id table, where each entry has non-NULL match data, so of_match_node() can be simplified with of_device_get_match_data(). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 4ae946a45dcdd0f99b3c233c6718e7ff0b183a2c Author: Krzysztof Kozlowski Date: Fri Nov 7 09:15:52 2025 +0100 crypto: ccp - Simplify with of_device_get_match_data() Driver's probe function matches against driver's of_device_id table, where each entry has non-NULL match data, so of_match_node() can be simplified with of_device_get_match_data(). Acked-by: Tom Lendacky Signed-off-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit ec2054c1244c8aa192632a40a07a0d210d7116e1 Author: Krzysztof Kozlowski Date: Fri Nov 7 09:15:51 2025 +0100 crypto: ccp - Constify 'dev_vdata' member sp_device->dev_vdata points to only const data (see 'static const struct sp_dev_vdata dev_vdata'), so can be made pointer to const for code safety. Update also sp_get_acpi_version() function which returns this pointer to 'pointer to const' for code readability, even though it is not needed. On the other hand, do not touch similar function sp_get_of_version() because it will be immediately removed in next patches. Acked-by: Tom Lendacky Signed-off-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit c6c247ae336aa7a85e8400d60c1b2c4f2edf93d4 Author: Krzysztof Kozlowski Date: Fri Nov 7 09:15:50 2025 +0100 crypto: artpec6 - Simplify with of_device_get_match_data() Driver's probe function matches against driver's of_device_id table, so of_match_node() can be simplified with of_device_get_match_data(). This requires changing the enum used in the driver match data entries to non-zero, to be able to recognize error case of of_device_get_match_data(). Signed-off-by: Krzysztof Kozlowski Acked-by: Jesper Nilsson Signed-off-by: Herbert Xu commit 6b94eb68ad2147c7ed0e978b1924707f88922e4c Author: Krzysztof Kozlowski Date: Fri Nov 7 09:15:49 2025 +0100 hwrng: bcm2835 - Simplify with of_device_get_match_data() Driver's probe function matches against driver's of_device_id table, where each entry has non-NULL match data, so of_match_node() can be simplified with of_device_get_match_data(). Reviewed-by: Florian Fainelli Signed-off-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit cdd7bbce7b507bfa608e6c6abefdc43661c24035 Author: Krzysztof Kozlowski Date: Fri Nov 7 09:15:48 2025 +0100 hwrng: bcm2835 - Move MODULE_DEVICE_TABLE() to table definition Convention is to place MODULE_DEVICE_TABLE() immediately after definition of the affected table, so one can easily spot missing such. There is on the other hand no benefits of putting MODULE_DEVICE_TABLE() far away. Reviewed-by: Florian Fainelli Signed-off-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 7e8f232ae8d7ceffcb65b949600cb1529dd92663 Author: Marco Crivellari Date: Thu Nov 6 17:42:36 2025 +0100 crypto: cavium/nitrox - add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Herbert Xu commit 5f8c6c931827cace83c876e1f13ee488fe8618b7 Author: Marco Crivellari Date: Thu Nov 6 17:37:58 2025 +0100 crypto: atmel-i2c - add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Herbert Xu commit d52e9b8843749f446dff2afcfc5da3d8bbe806cc Author: Karina Yankevich Date: Wed Nov 5 17:52:04 2025 +0300 crypto: rockchip - drop redundant crypto_skcipher_ivsize() calls The function already initialized the ivsize variable at the point of declaration, let's use it instead of calling crypto_skcipher_ivsize() extra couple times. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 57d67c6e8219 ("crypto: rockchip - rework by using crypto_engine") Signed-off-by: Karina Yankevich Reviewed-by: Sergey Shtylyov Signed-off-by: Herbert Xu commit a97fbc3ee3e2a536fafaff04f21f45472db71769 Author: Thierry Reding Date: Wed Oct 29 17:33:30 2025 +0100 syscore: Pass context data to callbacks Several drivers can benefit from registering per-instance data along with the syscore operations. To achieve this, move the modifiable fields out of the syscore_ops structure and into a separate struct syscore that can be registered with the framework. Add a void * driver data field for drivers to store contextual data that will be passed to the syscore ops. Acked-by: Rafael J. Wysocki (Intel) Signed-off-by: Thierry Reding commit 3bae4748c1cdd51f5d25b6c2fcf5a5634ab686f1 Author: Gatien Chevallier Date: Thu Nov 6 10:31:50 2025 +0100 bus: rifsc: add debugfs entry to dump the firewall configuration RIFSC configuration can be difficult to debug. Add a debugfs entry that dumps the configuration of the RISUPs, the RISALs and the RIMUs. This will allow to display the whole RIFSC firewall configuration at runtime. While there, fix a bug on the computation of firewall entries in the probe function. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20251106-rifsc_debugfs-v2-3-f90e94ae756d@foss.st.com Signed-off-by: Alexandre Torgue commit a6961e2ced5190c68acd78a7e372de07f565fcd6 Author: Gatien Chevallier Date: Thu Nov 6 10:31:49 2025 +0100 arm64: dts: st: set RIFSC as an access controller on stm32mp21x platforms Similarly to stm32mp23x/25x platforms, the RIFSC is a firewall controller. Declare it as an access controller, keep the "simple-bus" compatible in case CONFIG_STM32_FIREWALL is not set and update the child nodes. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20251106-rifsc_debugfs-v2-2-f90e94ae756d@foss.st.com Signed-off-by: Alexandre Torgue commit d50807fee6aced4d82e14fd7894ad5ed8db438b1 Author: Gatien Chevallier Date: Thu Nov 6 10:31:48 2025 +0100 dt-bindings: bus: add stm32mp21 RIFSC compatible The STM32MP21x platforms have a slightly different RIFSC. While its core functionalities are similar, the wiring is not the same. Hence, declare a new compatible. Signed-off-by: Gatien Chevallier Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20251106-rifsc_debugfs-v2-1-f90e94ae756d@foss.st.com Signed-off-by: Alexandre Torgue commit af9c7a6c5de98460002f5d14353c0165e0f6f9d2 Author: Gatien Chevallier Date: Fri Oct 31 11:00:43 2025 +0100 ARM: dts: stm32: add the IWDG2 interrupt line in stm32mp131.dtsi Add the interrupt line that can be used for the early interrupt of the IWDG2 to the IWDG2 node Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20251031-iwdg1-v2-4-2dc6e0116725@foss.st.com Signed-off-by: Alexandre Torgue commit 5da23908a3c0c22df63846ce01e33dd713f290db Author: Gatien Chevallier Date: Fri Oct 31 11:00:42 2025 +0100 ARM: dts: stm32: enable the ARM SMC watchdog node in stm32mp135f-dk On the stm32mp135f-dk board, the IWDG1 is secured and used to monitor the cortex-A7. Use the ARM SMC watchdog to communicate with it. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20251031-iwdg1-v2-3-2dc6e0116725@foss.st.com Signed-off-by: Alexandre Torgue commit 5512618b583670ef2ac17af43eee66745c8885c7 Author: Gatien Chevallier Date: Fri Oct 31 11:00:41 2025 +0100 ARM: dts: stm32: add the ARM SMC watchdog in stm32mp131.dtsi Add the arm_wdt node in the stm32mp131.dtsi SoC device tree file. When the platform watchdog is managed by the secure world, SMC calls are used to interact with it. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20251031-iwdg1-v2-2-2dc6e0116725@foss.st.com Signed-off-by: Alexandre Torgue commit 0b1aa90e2d6ccb8ce7530f3a15426939871e1c07 Author: Gatien Chevallier Date: Fri Oct 31 11:00:40 2025 +0100 ARM: dts: stm32: add iwdg1 node in stm32mp131.dtsi Add the IWDG1 node in the stm32mp131.dtsi SoC device tree file. It can be used by Linux as the Cortex-A7 watchdog when it's configured as non-secure. Signed-off-by: Gatien Chevallier Link: https://lore.kernel.org/r/20251031-iwdg1-v2-1-2dc6e0116725@foss.st.com Signed-off-by: Alexandre Torgue commit e613ef5c1516b7b281f9f437598a6b3e320fffe1 Author: Antonio Borneo Date: Thu Oct 23 15:27:00 2025 +0200 arm64: dts: st: Add I/O sync to eth pinctrl in stm32mp25-pinctrl.dtsi On board stm32mp257f-ev1, the propagation delay between eth1/eth2 and the external PHY requires a compensation to guarantee that no packet get lost in all the working conditions. Add I/O synchronization properties in pinctrl on all the RGMII data pins, activating re-sampling on both edges of the clock. Co-developed-by: Christophe Roullier Signed-off-by: Christophe Roullier Signed-off-by: Antonio Borneo Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20251023132700.1199871-13-antonio.borneo@foss.st.com Signed-off-by: Alexandre Torgue commit 22f0ae971cf5536349521853737d3e06203286d8 Author: Patrice Chotard Date: Fri Oct 31 15:07:03 2025 +0100 arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1 In order to set the AMCR register, which configures the memory-region split between ospi1 and ospi2, we need to identify the ospi instance. By using memory-region-names, it allows to identify the ospi instance this memory-region belongs to. Fixes: cad2492de91c ("arm64: dts: st: Add SPI NOR flash support on stm32mp257f-ev1 board") Signed-off-by: Patrice Chotard Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20251031-upstream_fix_dts_omm-v4-1-e4a059a50074@foss.st.com Signed-off-by: Alexandre Torgue commit c1932fb85af8e51ac9f6bd9947145b06c716106e Author: Ian Rogers Date: Wed Nov 12 08:24:39 2025 -0800 perf vendor metrics s390: Avoid has_event(INSTRUCTIONS) The instructions event is now provided in json meaning the has_event test always succeeds. Switch to using non-legacy event names in the affected metrics. Reported-by: Thomas Richter Closes: https://lore.kernel.org/linux-perf-users/3e80f453-f015-4f4f-93d3-8df6bb6b3c95@linux.ibm.com/ Fixes: 0012e0fa221b ("perf jevents: Add legacy-hardware and legacy-cache json") Signed-off-by: Ian Rogers Reviewed-by: Thomas Richter Tested-by: Thomas Richter Signed-off-by: Namhyung Kim commit ca016b6527e154013693722a2cdbec7c05fb6df7 Author: Ian Rogers Date: Sun Nov 9 17:31:52 2025 -0800 perf auxtrace: Remove errno.h from auxtrace.h and fix transitive dependencies errno.h isn't used in auxtrace.h so remove it and fix build failures caused by transitive dependencies through auxtrace.h on errno.h. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 754187ad73b73bcb44f106a8e5fc88789beff1bd Author: Ian Rogers Date: Sun Nov 9 17:31:51 2025 -0800 perf build: Remove NO_AUXTRACE build option The NO_AUXTRACE build option was used when the __get_cpuid feature test failed or if it was provided on the command line. The option no longer avoids a dependency on a library and so having the option is just adding complexity to the code base. Remove the option CONFIG_AUXTRACE from Build files and HAVE_AUXTRACE_SUPPORT by assuming it is always defined. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit c819bfdc4a762ba8a3035815c910c2d5443b616b Author: Ian Rogers Date: Sun Nov 9 17:31:50 2025 -0800 tool build: Remove __get_cpuid feature test This feature test is no longer used so remove. The function tested by the feature test is used in: tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c however, the Makefile just assumes the presence of the function and doesn't perform a build feature test for it. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 2566bbfc0a042feadeb0bea1f1f4b2b13f91c664 Author: Ian Rogers Date: Sun Nov 9 17:31:49 2025 -0800 perf build: Don't add NO_AUXTRACE if missing feature-get_cpuid The intel-pt code dependent on __get_cpuid is no longer present so remove the feature test in the Makefile.config. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit 8933c624d9c793eed8fa778add30fa50fd8ef4d7 Author: Ian Rogers Date: Sun Nov 9 17:31:48 2025 -0800 perf intel-pt: Use the perf provided "cpuid.h" Rather than having a feature test and include of for the __get_cpuid function, use the cpuid function provided by tools/perf/arch/x86/util/cpuid.h. Signed-off-by: Ian Rogers Reviewed-by: James Clark Signed-off-by: Namhyung Kim commit fb2ff9fa72e20a75cab0ffc9dc8735de68ed4d0d Author: Srikar Dronamraju Date: Wed Nov 12 13:18:59 2025 +0530 powerpc/smp: Expose die_id and die_cpumask >From Power10 processors onwards, each chip has 2 hemispheres. For LPARs running on PowerVM Hypervisor, hypervisor determines the allocation of CPU groups to each LPAR, resulting in two LPARs with the same number of CPUs potentially having different numbers of CPUs from each hemisphere. Additionally, it is not feasible to ascertain the hemisphere based solely on the CPU number. Users wishing to assign their workload to all CPUs, or a subset of CPUs within a specific hemisphere, encounter difficulties in identifying the cpumask. To address this, it is proposed to expose hemisphere information as a die in sysfs. This aligns with other architectures and facilitates the identification of CPUs within the same hemisphere. Tools such as lstopo can also access this information. Please note: The hypervisor reveals the locality of the CPUs to hemispheres only in dedicated mode. Consequently, in systems where hemisphere information is unavailable, such as shared LPARs, the die_cpus information in sysfs will mirror package_cpus, with die_id set to -1. Without this change. $ grep . /sys/devices/system/cpu/cpu16/topology/{die*,package*} 2>/dev/null /sys/devices/system/cpu/cpu16/topology/package_cpus:000000,000000ff,ffff0000 /sys/devices/system/cpu/cpu16/topology/package_cpus_list:16-39 With this change. $ grep . /sys/devices/system/cpu/cpu16/topology/{die*,package*} 2>/dev/null /sys/devices/system/cpu/cpu16/topology/die_cpus:000000,00000000,00ff0000 /sys/devices/system/cpu/cpu16/topology/die_cpus_list:16-23 /sys/devices/system/cpu/cpu16/topology/die_id:2 /sys/devices/system/cpu/cpu16/topology/package_cpus:000000,000000ff,ffff0000 /sys/devices/system/cpu/cpu16/topology/package_cpus_list:16-39 snipped lstopo-no-graphics o/p Group0 L#0 (total=8747584KB) Package L#0 (total=3564096KB CPUModel="POWER10 (architected), altivec supported" CPURevision="2.0 (pvr 0080 0200)") NUMANode L#0 (P#0 local=3564096KB total=3564096KB) Die L#0 (P#0) Core L#0 (P#0) Package L#1 (total=5183488KB CPUModel="POWER10 (architected), altivec supported" CPURevision="2.0 (pvr 0080 0200)") NUMANode L#1 (P#1 local=5183488KB total=5183488KB) Die L#2 (P#2) Core L#2 (P#16) L3Cache L#4 (size=4096KB linesize=128 ways=16) L2Cache L#4 (size=1024KB linesize=128 ways=8) L1dCache L#4 (size=32KB linesize=128 ways=8) L1iCache L#4 (size=48KB linesize=128 ways=6) PU L#16 (P#16) PU L#17 (P#18) PU L#18 (P#20) PU L#19 (P#22) L3Cache L#5 (size=4096KB linesize=128 ways=16) L2Cache L#5 (size=1024KB linesize=128 ways=8) L1dCache L#5 (size=32KB linesize=128 ways=8) L1iCache L#5 (size=48KB linesize=128 ways=6) PU L#20 (P#17) PU L#21 (P#19) PU L#22 (P#21) PU L#23 (P#23) Die L#3 (P#3) Core L#3 (P#24) L3Cache L#6 (size=4096KB linesize=128 ways=16) L2Cache L#6 (size=1024KB linesize=128 ways=8) L1dCache L#6 (size=32KB linesize=128 ways=8) L1iCache L#6 (size=48KB linesize=128 ways=6) PU L#24 (P#24) PU L#25 (P#26) PU L#26 (P#28) PU L#27 (P#30) L3Cache L#7 (size=4096KB linesize=128 ways=16) L2Cache L#7 (size=1024KB linesize=128 ways=8) L1dCache L#7 (size=32KB linesize=128 ways=8) L1iCache L#7 (size=48KB linesize=128 ways=6) PU L#28 (P#25) PU L#29 (P#27) PU L#30 (P#29) PU L#31 (P#31) Core L#4 (P#32) L3Cache L#8 (size=4096KB linesize=128 ways=16) L2Cache L#8 (size=1024KB linesize=128 ways=8) L1dCache L#8 (size=32KB linesize=128 ways=8) L1iCache L#8 (size=48KB linesize=128 ways=6) PU L#32 (P#32) PU L#33 (P#34) PU L#34 (P#36) PU L#35 (P#38) L3Cache L#9 (size=4096KB linesize=128 ways=16) L2Cache L#9 (size=1024KB linesize=128 ways=8) L1dCache L#9 (size=32KB linesize=128 ways=8) L1iCache L#9 (size=48KB linesize=128 ways=6) PU L#36 (P#33) PU L#37 (P#35) PU L#38 (P#37) PU L#39 (P#39) Group0 L#1 (total=7736896KB) Package L#2 (total=5170880KB CPUModel="POWER10 (architected), altivec supported" CPURevision="2.0 (pvr 0080 0200)") NUMANode L#2 (P#2 local=5170880KB total=5170880KB) Die L#4 (P#4) Reviewed-by: Shrikanth Hegde Signed-off-by: Srikar Dronamraju Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251112074859.814087-1-srikar@linux.ibm.com commit 1c0608d860db973ad09b5a9ccb19b76ae07622a3 Author: Mikhail Kshevetskiy Date: Mon Nov 10 06:56:44 2025 +0300 clk: en7523: Add reset-controller support for EN7523 SoC Introduce reset API support to EN7523 clock driver. EN7523 uses the same reset logic as EN7581, so just reuse existing code. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Philipp Zabel Signed-off-by: Stephen Boyd commit 947643509279a605a09959a06d332bf027e8be57 Author: Mikhail Kshevetskiy Date: Mon Nov 10 06:56:43 2025 +0300 dt-bindings: clock: airoha: Add reset support to EN7523 clock binding Introduce reset capability to EN7523 device-tree clock binding documentation. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit 5978864e34b66bdae4d7613834c03dd5d0a0c891 Author: Jun Nie Date: Thu Sep 18 21:29:01 2025 +0800 drm/msm/dpu: support plane splitting in quad-pipe case The content of every half of screen is sent out via one interface in dual-DSI case. The content for every interface is blended by a LM pair in quad-pipe case, thus a LM pair should not blend any content that cross the half of screen in this case. Clip plane into pipes per left and right half screen ROI if topology is quad pipe case. The clipped rectangle on every half of screen is futher handled by two pipes if its width exceeds a limit for a single pipe. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675416/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-9-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit cf63d61337c35842eeb9d93f0cf714d7866c9a17 Author: Jun Nie Date: Thu Sep 18 21:29:00 2025 +0800 drm/msm/dpu: support SSPP assignment for quad-pipe case Currently, SSPPs are assigned to a maximum of two pipes. However, quad-pipe usage scenarios require four pipes and involve configuring two stages. In quad-pipe case, the first two pipes share a set of mixer configurations and enable multi-rect mode when certain conditions are met. The same applies to the subsequent two pipes. Assign SSPPs to the pipes in each stage using a unified method and to loop the stages accordingly. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675414/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-8-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit c11684cce9e577d659b42afed7541f870f81161b Author: Jun Nie Date: Thu Sep 18 21:28:59 2025 +0800 drm/msm/dpu: blend pipes per mixer pairs config Currently, only 2 pipes are used at most for a plane. A stage structure describes the configuration for a mixer pair. So only one stage is needed for current usage cases. The quad-pipe case will be added in future and 2 stages are used in the case. So extend the stage to an array with array size STAGES_PER_PLANE and blend pipes per mixer pair with configuration in the stage structure. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675412/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-7-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit aed75641425c5c9393803bae494666c37c9aad05 Author: Jun Nie Date: Thu Sep 18 21:28:58 2025 +0800 drm/msm/dpu: Use dedicated WB number definition Currently MAX_CHANNELS_PER_ENC is defined as 2, because 2 channels are supported at most in one encoder. The case of 4 channels per encoder is to be added. To avoid breaking current WB usage case, use dedicated WB definition before 4 WB usage case is supported in future. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675410/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-6-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit 5d45171e262eb74b2c7daaa849c6f17c6eedef6a Author: Jun Nie Date: Thu Sep 18 21:28:57 2025 +0800 drm/msm/dpu: split PIPES_PER_STAGE definition per plane and mixer The stage contains configuration for a mixer pair. Currently the plane supports just one stage and 2 pipes. Quad-pipe support will require handling 2 stages and 4 pipes at the same time. In preparation for that add a separate define, PIPES_PER_PLANE, to denote number of pipes that can be used by the plane. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675408/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-5-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit fb4c972b638f3e6b2ca6c33804dfc9662ebdaa3b Author: Jun Nie Date: Thu Sep 18 21:28:56 2025 +0800 drm/msm/dpu: handle pipes as array There are 2 pipes in a drm plane at most currently, while 4 pipes are required for quad-pipe case. Generalize the handling to pipe pair and ease handling to another pipe pair later. Store pipes in array with removing dedicated r_pipe. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675406/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-4-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit 2c94547e0cede200853d5fc54633ebf9cbc8876a Author: Jun Nie Date: Thu Sep 18 21:28:55 2025 +0800 drm/msm/dpu: Add pipe as trace argument Add pipe as trace argument in trace_dpu_crtc_setup_mixer() to ease converting pipe into pipe array later. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675404/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-3-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit e4f87fdd911ed93cedda940f19709ff8995121dd Author: Jun Nie Date: Thu Sep 18 21:28:54 2025 +0800 drm/msm/dpu: bind correct pingpong for quad pipe There are 2 interfaces and 4 pingpong in quad pipe. Map the 2nd interface to 3rd PP instead of the 2nd PP. Signed-off-by: Jun Nie Reviewed-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/675402/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-2-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit 74c4efe691e7efd22e53ab22927042416d28e401 Author: Jun Nie Date: Thu Sep 18 21:28:53 2025 +0800 drm/msm/dpu: fix mixer number counter on allocation Current code only supports usage cases with one pair of mixers at most. To support quad-pipe usage case, two pairs of mixers need to be reserved. The lm_count for all pairs is cleared if a peer allocation fails in current implementation. Reset the current lm_count to an even number instead of completely clearing it. This prevents all pairs from being cleared in cases where multiple LM pairs are needed. Signed-off-by: Jun Nie Reviewed-by: Jessica Zhang Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/675400/ Link: https://lore.kernel.org/r/20250918-v6-16-rc2-quad-pipe-upstream-4-v16-1-ff6232e3472f@linaro.org Signed-off-by: Dmitry Baryshkov commit 762dd3eb0c0f51bb4f2ab00c2cd73d6534483752 Author: Christophe JAILLET Date: Thu Oct 9 22:09:32 2025 +0200 drm/msm/dpu: Remove dead-code in dpu_encoder_helper_reset_mixers() 'mixer' is only zeroed and is not use. Remove it. Signed-off-by: Christophe JAILLET Reviewed-by: Dmitry Baryshkov Acked-By: Mahesh Bharadwaj Kannan Fixes: ae4d721ce100 ("drm/msm/dpu: add an API to reset the encoder related hw blocks") Patchwork: https://patchwork.freedesktop.org/patch/679854/ Link: https://lore.kernel.org/r/8e3b2fbbf5440aa219feb667f5423c7479eb2656.1760040536.git.christophe.jaillet@wanadoo.fr Signed-off-by: Dmitry Baryshkov commit 7ee9719771eb316bc9aae9cc3bda5a693f113d85 Merge: 44244194e114b0 d669ec6be0b196 Author: Stephen Boyd Date: Thu Nov 13 19:49:32 2025 -0800 Merge tag 'samsung-clk-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull more Samsung clk driver updates from Krzysztof Kozlowski: - ExynosAutov920: add support for additional clock controllers (M2M and MFC) * tag 'samsung-clk-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: clk-pll: simplify samsung_pll_lock_wait() clk: samsung: exynosautov920: add block mfc clock support clk: samsung: exynosautov920: add clock support dt-bindings: clock: exynosautov920: add mfc clock definitions dt-bindings: clock: exynosautov920: add m2m clock definitions dt-bindings: clock: google,gs101-clock: add power-domains commit 44244194e114b01368fd76dec2577755ead526b8 Merge: 3a8660878839fa 6837c006d4e72d Author: Stephen Boyd Date: Thu Nov 13 19:37:27 2025 -0800 Merge tag 'samsung-drivers-firmware-clk-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung clk driver updates from Krzysztof Kozlowski: Extend Samsung ACPM (Alive Clock and Power Manager) firmware drivers: - Add support for passing DVFS (Dynamic Voltage and Frequency) messages to configure the clocks in ACPM device. - Add Exynos ACPM clock driver, which exposes to Linux several clocks handled by the ACPM (firmware) * tag 'samsung-drivers-firmware-clk-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: firmware: exynos-acpm: add empty method to allow compile test MAINTAINERS: add ACPM clock bindings and driver clk: samsung: add Exynos ACPM clock driver firmware: exynos-acpm: register ACPM clocks pdev firmware: exynos-acpm: add DVFS protocol dt-bindings: firmware: google,gs101-acpm-ipc: add ACPM clocks commit 52075d2c7595cfd6c1ce211a9cd138a9b067c448 Author: Diogo Ivo Date: Wed Nov 12 16:00:12 2025 +0000 platform/chrome: sensorhub: Support devices without FIFO_INT_ENABLE Some devices (such as Smaug) report having MOTION_SENSE_FIFO but do not support controlling the behaviour of the FIFO interrupt via the FIFO_INT_ENABLE command and in these cases the interrupt is always enabled. However, currently the code assumes that if MOTION_SENSE_FIFO is supported then so is FIFO_INT_ENABLE, and when it tries to enable the interrupt via this command and an unsupported device reports a failure it then propagates this into failing the sensors probe. Interpret the return value -EINVAL as a device where FIFO_INT_ENABLE is not present and the interrupt is always enabled. Signed-off-by: Diogo Ivo Link: https://lore.kernel.org/r/20251112-diogo-smaug_ec_sensorhub-v1-1-f71d4e9eb9d4@tecnico.ulisboa.pt Signed-off-by: Tzung-Bi Shih commit 2e12d91cbf3d0105fc58d07b8a0548ebd7bb619b Author: Encrow Thorne Date: Tue Nov 11 23:50:09 2025 +0800 clk: spacemit: fix comment typo Fix incorrect comment to match the filename. Reviewd-by: Troy Mitchell Signed-off-by: Encrow Thorne Reviewed-by: Yixun Lan Signed-off-by: Stephen Boyd commit fa3542e822c99196a27f030e87eab5458072613a Author: Adrian Barnaś Date: Tue Oct 28 16:16:42 2025 +0000 clk: keystone: Fix discarded const qualifiers Add const qualifiers to the pointers returned from 'container_of' macro to prevent breaking the const promise on const struct pointers from parameters. Once you have a mutable container structure pointer, you can change structure fields through it, which violates the const guarantee. Signed-off-by: Adrian Barnaś Reviewed-by: Nishanth Menon Signed-off-by: Stephen Boyd commit 1101c442410cd57af848c30804e985aab9e0e569 Author: Alistair Popple Date: Mon Nov 10 22:34:10 2025 +0900 gpu: nova-core: Set correct DMA mask Set the correct DMA mask. Without this DMA will fail on some setups. Signed-off-by: Alistair Popple Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-2-8ae4058e3c0e@nvidia.com> commit 7c01dc25f5c828401a5807307c4f7dda6555469f Author: Alexandre Courbot Date: Mon Nov 10 22:34:09 2025 +0900 gpu: nova-core: compute layout of more framebuffer regions required for GSP Compute more of the required FB layout information to boot the GSP firmware. This information is dependent on the firmware itself, so first we need to import and abstract the required firmware bindings in the `nvfw` module. Then, a new FB HAL method is introduced in `fb::hal` that uses these bindings and hardware information to compute the correct layout information. This information is then used in `fb` and the result made visible in `FbLayout`. These 3 things are grouped into the same patch to avoid lots of unused warnings that would be tedious to work around. As they happen in different files, they should not be too difficult to track separately. Acked-by: Danilo Krummrich Signed-off-by: Alexandre Courbot Message-ID: <20251110-gsp_boot-v9-1-8ae4058e3c0e@nvidia.com> commit df58ee7d8faf353ebf5d4703c35fcf3e578e9b1b Merge: de9c41624c9cda df397943196f7f Author: Jakub Kicinski Date: Thu Nov 13 17:48:45 2025 -0800 Merge branch 'net-phy-mscc-add-support-for-phy-led-control' Lad Prabhakar says: ==================== net: phy: mscc: Add support for PHY LED control This patch series adds support for controlling the PHY LEDs on the VSC85xx family of PHYs from Microsemi (now part of Renesas). The first two patches simplify and consolidate existing probe code the third patch introduces the LED control functionality. The LED control feature allows users to configure the LED behavior based on link activity, speed, and other criteria. ==================== Link: https://patch.msgid.link/20251112135715.1017117-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit df397943196f7ff396beb41449583b4629ee99e2 Author: Lad Prabhakar Date: Wed Nov 12 13:57:15 2025 +0000 net: phy: mscc: Handle devm_phy_package_join() failure in vsc85xx_probe_common() devm_phy_package_join() may fail and return a negative error code. Update vsc85xx_probe_common() to properly handle this failure by checking the return value and propagating the error to the caller. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251112135715.1017117-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit eb47c5c4888d86d4f2bfd1513f4cf79a920e65b5 Author: Lad Prabhakar Date: Wed Nov 12 13:57:14 2025 +0000 net: phy: mscc: Add support for PHY LED control Add support for the PHY LED controller in the MSCC VSC85xx driver. The implementation provides LED brightness and hardware control through the LED subsystem and integrates with the standard 'netdev' trigger. Introduce new register definitions for the LED behavior register (MSCC_PHY_LED_BEHAVIOR = 30) and the LED combine disable bits, which control whether LEDs indicate link-only or combined link and activity status. Implement a helper, vsc8541_led_combine_disable_set(), to update these bits safely using phy_modify(). Add support for LED brightness control and hardware mode configuration. The new callbacks implement the standard LED class operations, allowing user control through sysfs. The brightness control maps to PHY LED force on/off modes. The hardware control get and set functions translate between the PHY-specific LED mode encodings and the LED subsystem TRIGGER_NETDEV_* rules. The combine feature is managed automatically based on the selected rules. When both RX and TX activity are disabled, the combine feature is turned off, causing LEDs to indicate link-only status. When either RX or TX activity is enabled, the combine feature remains active and LEDs indicate combined link and activity. Register the LED callbacks for all VSC85xx PHY variants so that the LED subsystem can manage their indicators consistently. Existing device tree LED configuration and default behavior are preserved. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251112135715.1017117-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit 217eb2d60f564681cf5d57e3571eb52e3ebfa465 Author: Lad Prabhakar Date: Wed Nov 12 13:57:13 2025 +0000 net: phy: mscc: Consolidate probe functions into a common helper Unify the probe implementations of the VSC85xx PHY family into a single vsc85xx_probe_common() helper. The existing probe functions for the vsc85xx, vsc8514, vsc8574, and vsc8584 variants contained almost identical initialization logic, differing only in configuration parameters such as the number of LEDs, supported LED modes, hardware statistics, and PTP support. Introduce a vsc85xx_probe_config structure to describe the per-variant parameters, and move all common setup code into the shared helper. Each variant's probe function now defines a constant configuration instance and calls vsc85xx_probe_common(). Also mark the default LED mode array parameter as const to match its usage. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251112135715.1017117-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit c31783c2b5ae2399388b349f48fa89818b66f6d8 Author: Lad Prabhakar Date: Wed Nov 12 13:57:12 2025 +0000 net: phy: mscc: Simplify LED mode update using phy_modify() The vsc85xx_led_cntl_set() function currently performs a manual read-modify-write sequence protected by the PHY lock to update the LED mode register (MSCC_PHY_LED_MODE_SEL). Replace this sequence with a call to phy_modify(), which already handles read-modify-write operations with proper locking inside the PHY core. Signed-off-by: Lad Prabhakar Reviewed-by: Andrew Lunn Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20251112135715.1017117-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit de9c41624c9cda3a96a9ac6cd9b048d9a25d787d Author: Oliver Neukum Date: Wed Nov 12 11:25:00 2025 +0100 net: usb: usbnet: adhere to style This satisfies the coding style. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20251112102610.281565-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit c294432be1509205022de2cb5bf2a8e513861f4c Author: Felix Maurer Date: Wed Nov 12 18:29:53 2025 +0100 netlink: specs: rt-link: Add attributes for hsr YNL wasn't able to decode the linkinfo from hsr interfaces. Add the linkinfo attribute definitions for hsr interfaces. Example output now looks like this: $ ynl --spec Documentation/netlink/specs/rt-link.yaml --do getlink \ --json '{"ifname": "hsr0"}' --output-json | jq .linkinfo { "kind": "hsr", "data": { "slave1": 15, "slave2": 13, "supervision-addr": "01:15:4e:00:01:00", "seq-nr": 64511, "version": 1, "protocol": 0 } } Signed-off-by: Felix Maurer Link: https://patch.msgid.link/926077a70de614f1539c905d06515e258905255e.1762968225.git.fmaurer@redhat.com Signed-off-by: Jakub Kicinski commit 55f943c6af6d12a1b44978f7e87c90f9a9c05806 Author: Vladimir Oltean Date: Wed Nov 12 23:11:18 2025 +0200 net: pcs: xpcs-plat: fix MODULE_AUTHOR This field needs to hold just Serge's name. Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20251112211118.700875-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 4aa73c6051cb65046e6fa601b7877b5c1e6edc85 Author: Heiner Kallweit Date: Wed Nov 12 21:46:24 2025 +0100 net: dsa: remove definition of struct dsa_switch_driver Since 93e86b3bc842 ("net: dsa: Remove legacy probing support") this struct has no user any longer. Signed-off-by: Heiner Kallweit Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/4053a98f-052f-4dc1-a3d4-ed9b3d3cc7cb@gmail.com Signed-off-by: Jakub Kicinski commit 992b7d5fd8a889dc77e384143ad5b4f5fe2a70de Author: Kriish Sharma Date: Wed Nov 12 05:56:42 2025 +0000 dpll: zl3073x: fix kernel-doc name and missing parameter in fw.c Documentation build reported: Warning: drivers/dpll/zl3073x/fw.c:365 function parameter 'comp' not described in 'zl3073x_fw_component_flash' Warning: drivers/dpll/zl3073x/fw.c:365 expecting prototype for zl3073x_flash_bundle_flash(). Prototype was for zl3073x_fw_component_flash() instead Warning: drivers/dpll/zl3073x/fw.c:365 No description found for return value of 'zl3073x_fw_component_flash' The kernel-doc comment above `zl3073x_fw_component_flash()` used the wrong function name (`zl3073x_flash_bundle_flash`) and omitted the `@comp` parameter. Update the comment to correctly document the `zl3073x_fw_component_flash()` function and its arguments. Signed-off-by: Kriish Sharma Reviewed-by: Ivan Vecera Link: https://patch.msgid.link/20251112055642.2597450-1-kriish.sharma2006@gmail.com Signed-off-by: Jakub Kicinski commit 205305c028ad986d0649b8b100bab6032dcd1bb5 Author: Chen Ni Date: Wed Nov 12 15:27:09 2025 +0800 net/sched: act_ife: convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20251112072709.73755-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski commit c3716126cf578918bc1fe6cf4fb6624731975d56 Author: Yue Haibing Date: Wed Nov 12 17:20:55 2025 +0800 vxlan: Remove unused declarations eth_vni_hash() and fdb_head_index() Commit 1f763fa808e9 ("vxlan: Convert FDB table to rhashtable") removed the implementations but leave declarations. Signed-off-by: Yue Haibing Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20251112092055.3546703-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit c16af019d9d6d23f211c82b5561f2ecd2a7dff54 Author: Dan Williams Date: Wed Nov 12 18:14:41 2025 -0800 resource: Introduce resource_assigned() for discerning active resources A PCI bridge resource lifecycle involves both a "request" and "assign" phase. At any point in time that resource may not yet be assigned, or may have failed to assign (because it does not fit). There are multiple conventions to determine when assignment has not completed: IORESOURCE_UNSET, IORESOURCE_DISABLED, and checking whether the resource is parented. In code paths that are known to not be racing assignment, e.g. post subsys_initcall(), the most reliable method to judge that a bridge resource is assigned is to check the resource is parented [1]. Introduce a resource_assigned() helper for this purpose. Link: http://lore.kernel.org/2b9f7f7b-d6a4-be59-14d4-7b4ffccfe373@linux.intel.com [1] Suggested-by: Ilpo Järvinen Cc: Bjorn Helgaas Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-4-dan.j.williams@intel.com Signed-off-by: Dan Williams commit e5b5f8b7c26f72fe86b59979e51d8e6cf36ea903 Author: Dan Williams Date: Wed Nov 12 18:14:40 2025 -0800 PCI/TSM: Drop stub for pci_tsm_doe_transfer() Just like pci_tsm_pf0_{con,de}structor(), in the CONFIG_PCI_TSM=n case there should be no callers of pci_tsm_doe_transfer(). Reported-by: Xu Yilun Closes: http://lore.kernel.org/aRFfk14DJWEVhC/R@yilunxu-OptiPlex-7050 Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-3-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 110c155e8a684d8b2423a72cfde147903881f765 Author: Dan Williams Date: Wed Nov 12 18:14:39 2025 -0800 drivers/virt: Drop VIRT_DRIVERS build dependency All of the objects in drivers/virt/ have their own configuration symbols to gate compilation. I.e. nothing gets added to the kernel with CONFIG_VIRT_DRIVERS=y in isolation. Unconditionally descend into drivers/virt/ so that consumers do not need to add an additional CONFIG_VIRT_DRIVERS dependency. Fix warnings of the form: Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for TSM Depends on [n]: VIRT_DRIVERS [=n] Selected by [y]: - PCI_TSM [=y] && PCI [=y] ...where PCI_TSM selects CONFIG_TSM, but fails to select CONFIG_VIRT_DRIVERS. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511041832.ylcgIiqN-lkp@intel.com/ Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251113021446.436830-2-dan.j.williams@intel.com Signed-off-by: Dan Williams commit ed490f36f439b877393c12a2113601e4145a5a56 Author: Viacheslav Dubeyko Date: Fri Oct 31 17:12:30 2025 -0700 hfsplus: fix volume corruption issue for generic/070 The xfstests' test-case generic/070 leaves HFS+ volume in corrupted state: sudo ./check generic/070 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/070 _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent (see xfstests-dev/results//generic/070.full for details) Ran: generic/070 Failures: generic/070 Failed 1 of 1 tests sudo fsck.hfsplus -d /dev/loop50 ** /dev/loop50 Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking non-journaled HFS Plus Volume. The volume name is test ** Checking extents overflow file. Unused node is not erased (node = 1) ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0004 CBTStat = 0x0000 CatStat = 0x00000000 ** Repairing volume. ** Rechecking volume. ** Checking non-journaled HFS Plus Volume. The volume name is test ** Checking extents overflow file. ** Checking catalog file. ** Checking multi-linked files. ** Checking catalog hierarchy. ** Checking extended attributes file. ** Checking volume bitmap. ** Checking volume information. ** The volume test was repaired successfully. It is possible to see that fsck.hfsplus detected not erased and unused node for the case of extents overflow file. The HFS+ logic has special method that defines if the node should be erased: bool hfs_bnode_need_zeroout(struct hfs_btree *tree) { struct super_block *sb = tree->inode->i_sb; struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb); const u32 volume_attr = be32_to_cpu(sbi->s_vhdr->attributes); return tree->cnid == HFSPLUS_CAT_CNID && volume_attr & HFSPLUS_VOL_UNUSED_NODE_FIX; } However, it is possible to see that this method works only for the case of catalog file. But debugging of the issue has shown that HFSPLUS_VOL_UNUSED_NODE_FIX attribute has been requested for the extents overflow file too: catalog file kernel: hfsplus: node 4, num_recs 0, flags 0x10 kernel: hfsplus: tree->cnid 4, volume_attr 0x80000800 extents overflow file kernel: hfsplus: node 1, num_recs 0, flags 0x10 kernel: hfsplus: tree->cnid 3, volume_attr 0x80000800 This patch modifies the hfs_bnode_need_zeroout() by checking only volume_attr but not the b-tree ID because node zeroing can be requested for all HFS+ b-tree types. sudo ./check generic/070 FSTYP -- hfsplus PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc3+ #79 SMP PREEMPT_DYNAMIC Fri Oct 31 16:07:42 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/070 33s ... 34s Ran: generic/070 Passed all 1 tests Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20251101001229.247432-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 00c14a09a70e10ae18eb3707d0059291425c04bd Author: Viacheslav Dubeyko Date: Thu Oct 2 13:00:21 2025 -0700 hfs/hfsplus: prevent getting negative values of offset/length The syzbot reported KASAN out-of-bounds issue in hfs_bnode_move(): [ 45.588165][ T9821] hfs: dst 14, src 65536, len -65536 [ 45.588895][ T9821] ================================================================== [ 45.590114][ T9821] BUG: KASAN: out-of-bounds in hfs_bnode_move+0xfd/0x140 [ 45.591127][ T9821] Read of size 18446744073709486080 at addr ffff888035935400 by task repro/9821 [ 45.592207][ T9821] [ 45.592420][ T9821] CPU: 0 UID: 0 PID: 9821 Comm: repro Not tainted 6.16.0-rc7-dirty #42 PREEMPT(full) [ 45.592428][ T9821] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.592431][ T9821] Call Trace: [ 45.592434][ T9821] [ 45.592437][ T9821] dump_stack_lvl+0x1c1/0x2a0 [ 45.592446][ T9821] ? __virt_addr_valid+0x1c8/0x5c0 [ 45.592454][ T9821] ? __pfx_dump_stack_lvl+0x10/0x10 [ 45.592461][ T9821] ? rcu_is_watching+0x15/0xb0 [ 45.592469][ T9821] ? lock_release+0x4b/0x3e0 [ 45.592476][ T9821] ? __virt_addr_valid+0x1c8/0x5c0 [ 45.592483][ T9821] ? __virt_addr_valid+0x4a5/0x5c0 [ 45.592491][ T9821] print_report+0x17e/0x7c0 [ 45.592497][ T9821] ? __virt_addr_valid+0x1c8/0x5c0 [ 45.592504][ T9821] ? __virt_addr_valid+0x4a5/0x5c0 [ 45.592511][ T9821] ? __phys_addr+0xd3/0x180 [ 45.592519][ T9821] ? hfs_bnode_move+0xfd/0x140 [ 45.592526][ T9821] kasan_report+0x147/0x180 [ 45.592531][ T9821] ? _printk+0xcf/0x120 [ 45.592537][ T9821] ? hfs_bnode_move+0xfd/0x140 [ 45.592544][ T9821] ? hfs_bnode_move+0xfd/0x140 [ 45.592552][ T9821] kasan_check_range+0x2b0/0x2c0 [ 45.592557][ T9821] ? hfs_bnode_move+0xfd/0x140 [ 45.592565][ T9821] __asan_memmove+0x29/0x70 [ 45.592572][ T9821] hfs_bnode_move+0xfd/0x140 [ 45.592580][ T9821] hfs_brec_remove+0x473/0x560 [ 45.592589][ T9821] hfs_cat_move+0x6fb/0x960 [ 45.592598][ T9821] ? __pfx_hfs_cat_move+0x10/0x10 [ 45.592607][ T9821] ? seqcount_lockdep_reader_access+0x122/0x1c0 [ 45.592614][ T9821] ? lockdep_hardirqs_on+0x9c/0x150 [ 45.592631][ T9821] ? __lock_acquire+0xaec/0xd80 [ 45.592641][ T9821] hfs_rename+0x1dc/0x2d0 [ 45.592649][ T9821] ? __pfx_hfs_rename+0x10/0x10 [ 45.592657][ T9821] vfs_rename+0xac6/0xed0 [ 45.592664][ T9821] ? __pfx_vfs_rename+0x10/0x10 [ 45.592670][ T9821] ? d_alloc+0x144/0x190 [ 45.592677][ T9821] ? bpf_lsm_path_rename+0x9/0x20 [ 45.592683][ T9821] ? security_path_rename+0x17d/0x490 [ 45.592691][ T9821] do_renameat2+0x890/0xc50 [ 45.592699][ T9821] ? __pfx_do_renameat2+0x10/0x10 [ 45.592707][ T9821] ? getname_flags+0x1e5/0x540 [ 45.592714][ T9821] __x64_sys_rename+0x82/0x90 [ 45.592720][ T9821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.592725][ T9821] do_syscall_64+0xf3/0x3a0 [ 45.592741][ T9821] ? exc_page_fault+0x9f/0xf0 [ 45.592748][ T9821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.592754][ T9821] RIP: 0033:0x7f7f73fe3fc9 [ 45.592760][ T9821] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 45.592765][ T9821] RSP: 002b:00007ffc7e116cf8 EFLAGS: 00000283 ORIG_RAX: 0000000000000052 [ 45.592772][ T9821] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7f73fe3fc9 [ 45.592776][ T9821] RDX: 0000200000000871 RSI: 0000200000000780 RDI: 00002000000003c0 [ 45.592781][ T9821] RBP: 00007ffc7e116d00 R08: 0000000000000000 R09: 00007ffc7e116d30 [ 45.592784][ T9821] R10: fffffffffffffff0 R11: 0000000000000283 R12: 00005557e81f8250 [ 45.592788][ T9821] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 45.592795][ T9821] [ 45.592797][ T9821] [ 45.619721][ T9821] The buggy address belongs to the physical page: [ 45.620300][ T9821] page: refcount:1 mapcount:1 mapping:0000000000000000 index:0x559a88174 pfn:0x35935 [ 45.621150][ T9821] memcg:ffff88810a1d5b00 [ 45.621531][ T9821] anon flags: 0xfff60000020838(uptodate|dirty|lru|owner_2|swapbacked|node=0|zone=1|lastcpupid=0x7ff) [ 45.622496][ T9821] raw: 00fff60000020838 ffffea0000d64d88 ffff888021753e10 ffff888029da0771 [ 45.623260][ T9821] raw: 0000000559a88174 0000000000000000 0000000100000000 ffff88810a1d5b00 [ 45.624030][ T9821] page dumped because: kasan: bad access detected [ 45.624602][ T9821] page_owner tracks the page as allocated [ 45.625115][ T9821] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO0 [ 45.626685][ T9821] post_alloc_hook+0x240/0x2a0 [ 45.627127][ T9821] get_page_from_freelist+0x2101/0x21e0 [ 45.627628][ T9821] __alloc_frozen_pages_noprof+0x274/0x380 [ 45.628154][ T9821] alloc_pages_mpol+0x241/0x4b0 [ 45.628593][ T9821] vma_alloc_folio_noprof+0xe4/0x210 [ 45.629066][ T9821] folio_prealloc+0x30/0x180 [ 45.629487][ T9821] __handle_mm_fault+0x34bd/0x5640 [ 45.629957][ T9821] handle_mm_fault+0x40e/0x8e0 [ 45.630392][ T9821] do_user_addr_fault+0xa81/0x1390 [ 45.630862][ T9821] exc_page_fault+0x76/0xf0 [ 45.631273][ T9821] asm_exc_page_fault+0x26/0x30 [ 45.631712][ T9821] page last free pid 5269 tgid 5269 stack trace: [ 45.632281][ T9821] free_unref_folios+0xc73/0x14c0 [ 45.632740][ T9821] folios_put_refs+0x55b/0x640 [ 45.633177][ T9821] free_pages_and_swap_cache+0x26d/0x510 [ 45.633685][ T9821] tlb_flush_mmu+0x3a0/0x680 [ 45.634105][ T9821] tlb_finish_mmu+0xd4/0x200 [ 45.634525][ T9821] exit_mmap+0x44c/0xb70 [ 45.634914][ T9821] __mmput+0x118/0x420 [ 45.635286][ T9821] exit_mm+0x1da/0x2c0 [ 45.635659][ T9821] do_exit+0x652/0x2330 [ 45.636039][ T9821] do_group_exit+0x21c/0x2d0 [ 45.636457][ T9821] __x64_sys_exit_group+0x3f/0x40 [ 45.636915][ T9821] x64_sys_call+0x21ba/0x21c0 [ 45.637342][ T9821] do_syscall_64+0xf3/0x3a0 [ 45.637756][ T9821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.638290][ T9821] page has been migrated, last migrate reason: numa_misplaced [ 45.638956][ T9821] [ 45.639173][ T9821] Memory state around the buggy address: [ 45.639677][ T9821] ffff888035935300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.640397][ T9821] ffff888035935380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.641117][ T9821] >ffff888035935400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.641837][ T9821] ^ [ 45.642207][ T9821] ffff888035935480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.642929][ T9821] ffff888035935500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 45.643650][ T9821] ================================================================== This commit [1] fixes the issue if an offset inside of b-tree node or length of the request is bigger than b-tree node. However, this fix is still not ready for negative values of the offset or length. Moreover, negative values of the offset or length doesn't make sense for b-tree's operations. Because we could try to access the memory address outside of the beginning of memory page's addresses range. Also, using of negative values make logic very complicated, unpredictable, and we could access the wrong item(s) in the b-tree node. This patch changes b-tree interface by means of converting signed integer arguments of offset and length on u32 type. Such conversion has goal to prevent of using negative values unintentionally or by mistake in b-tree operations. [1] 'commit a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")' Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20251002200020.2578311-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit 9c79c9e03547068404cca5139dfea281d655ff90 Author: Chukun Pan Date: Sat Nov 1 20:00:07 2025 +0800 arm64: dts: rockchip: fixes ethernet for 100ASK DshanPi A1 Currently, Ethernet is unusable due to an incorrect PHY address. This commit fixes this, removes the incorrect 25M clock pinctrl, and adds the missing PHY supply. Fixes: d809417c5a40 ("arm64: dts: rockchip: add DTs for 100ASK DShanPi A1") Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251101120010.41729-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 0b822c59c826f47dc63d9470b4710bd251266cae Author: Chukun Pan Date: Sat Nov 1 20:00:06 2025 +0800 arm64: dts: rockchip: fixes regulator for 100ASK DshanPi A1 Referencing the schematic [1], correct the names of the USB regulator, remove these non-existent RTC and UFS regulators. [1] https://dl.100ask.net/Hardware/MPU/RK3576-DshanPi-A1/DshanPi-A1-RK3576-SCH_V1.1.pdf Fixes: d809417c5a40 ("arm64: dts: rockchip: add DTs for 100ASK DShanPi A1") Signed-off-by: Chukun Pan Link: https://patch.msgid.link/20251101120010.41729-2-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 152af114287851583cf7e0abc10129941f19466a Author: Yang Chenzhi Date: Fri Aug 29 17:39:12 2025 +0800 hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to create it. Thread A: hfsplus_write_inode() -> hfsplus_write_system_inode() -> hfs_btree_write() -> hfs_bnode_find(tree, 0) -> __hfs_bnode_create(tree, 0) Thread B: hfsplus_create_cat() -> hfs_brec_insert() -> hfs_bnode_split() -> hfs_bmap_alloc() -> hfs_bnode_find(tree, 0) -> __hfs_bnode_create(tree, 0) In this case, thread A creates the bnode, sets refcnt=1, and hashes it. Thread B also tries to create the same bnode, notices it has already been inserted, drops its own instance, and uses the hashed one without getting the node. ``` node2 = hfs_bnode_findhash(tree, cnid); if (!node2) { <- Thread A hash = hfs_bnode_hash(cnid); node->next_hash = tree->node_hash[hash]; tree->node_hash[hash] = node; tree->node_hash_cnt++; } else { <- Thread B spin_unlock(&tree->hash_lock); kfree(node); wait_event(node2->lock_wq, !test_bit(HFS_BNODE_NEW, &node2->flags)); return node2; } ``` However, hfs_bnode_find() requires each call to take a reference. Here both threads end up setting refcnt=1. When they later put the node, this triggers: BUG_ON(!atomic_read(&node->refcnt)) In this scenario, Thread B in fact finds the node in the hash table rather than creating a new one, and thus must take a reference. Fix this by calling hfs_bnode_get() when reusing a bnode newly created by another thread to ensure the refcount is updated correctly. A similar bug was fixed in HFS long ago in commit a9dc087fd3c4 ("fix missing hfs_bnode_get() in __hfs_bnode_create") but the same issue remained in HFS+ until now. Reported-by: syzbot+005d2a9ecd9fbf525f6a@syzkaller.appspotmail.com Signed-off-by: Yang Chenzhi Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250829093912.611853-1-yang.chenzhi@vivo.com Signed-off-by: Viacheslav Dubeyko commit 41289b4834c8542075a3955bfaa7b455e3345439 Merge: e3d63f4ef36910 4f7ffdfb9928a7 Author: Greg Kroah-Hartman Date: Thu Nov 13 17:55:05 2025 -0500 Merge tag 'socfpga_firmware_updates_for_v6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-next Dinh writes: SoCFPGA firmware updates for v6.19 - Add support for voltage and temperature sensor - Add a mutex to memory operations on Stratix10 service driver - Add support for asynchronous communications in the service driver - Replace scnprintf() with sysfs_emit() * tag 'socfpga_firmware_updates_for_v6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: firmware: stratix10-rsu: replace scnprintf() with sysfs_emit() in *_show() functions firmware: stratix10-rsu: Migrate RSU driver to use stratix10 asynchronous framework. firmware: stratix10-svc: Add support for RSU commands in asynchronous framework firmware: stratix10-svc: Add support for async communication firmware: stratix10-svc: Add mutex in stratix10 memory management firmware: stratix10-svc: Add definition for voltage and temperature sensor commit 76f4f7e04c213eff794ef6dcb1f216a57c6f2a16 Author: Johan Jonker Date: Sat Nov 1 16:35:26 2025 +0100 arm64: dts: rockchip: correct assigned-clock-rates spelling on 2 boards Due to some copy and paste from the manufacturer tree the property assigned-clock-rate is missing a letter "s". Correct spelling to reduce dtbs_check output. Signed-off-by: Johan Jonker Link: https://patch.msgid.link/92714b6c-6c0d-4a10-afe4-73ed313c87c0@gmail.com Signed-off-by: Heiko Stuebner commit e3d63f4ef3691036e6d30c4f951d3661d461576d Merge: c428900703aaa5 3112b589d3a99a Author: Greg Kroah-Hartman Date: Thu Nov 13 17:54:22 2025 -0500 Merge tag 'peci-next-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/iwi/linux into char-misc-next Iwona writes: Update peci-next for v6.19-rc1 A small change in peci-aspeed converting the driver away from deprecated round_rate(), allowing it to eventually be removed from clk subsystem. * tag 'peci-next-6.19-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/iwi/linux: peci: controller: peci-aspeed: convert from round_rate() to determine_rate() commit 10712ce694a67304a99dbba20f8cb146ca5f4fd6 Author: Johan Jonker Date: Sun Nov 2 00:18:13 2025 +0100 ARM: dts: rockchip: move edp assigned-clocks to edp node on rk3288 The rk3288 power-controller node contains an assigned-clocks property that conflicts with the bindings. From the git history it shows that they wanted to assign the rk3288 EDP_24M clock input centrally before an edp node was available. Move the edp assigned-clocks property to the edp node to reduce dtbs_check output. Signed-off-by: Johan Jonker Link: https://patch.msgid.link/7d6fa223-ab90-4c44-9180-54df78467ea5@gmail.com Signed-off-by: Heiko Stuebner commit c1ffe499306b26a61f390b7d83c5703aa8e2af55 Author: Coia Prant Date: Fri Nov 7 21:38:38 2025 +0800 arm64: dts: rockchip: clean up devicetree for 9Tripod X3568 v4 Fix indentation, remove unused SDIO properties, and drop the GMAC clock that was used for input direction. The board uses the clock as output, so the input clock is not needed. Signed-off-by: Coia Prant Link: https://patch.msgid.link/20251107133839.300252-1-coiaprant@gmail.com Signed-off-by: Heiko Stuebner commit 7230cdc1fc3cd1b6721df1dbf46c1e2403042203 Author: Chris Morgan Date: Fri Nov 7 15:47:24 2025 -0600 arm64: dts: rockchip: Enable USB-C DP Alt for Indiedroid Nova Enable the Display Port alt-mode for the USB-C port on the Indiedroid Nova. Note that while ROCKCHIP_VOP2_EP_DP0 is defined as 10 we need to set the address to "a" or else we receive a dtc warning. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251107214724.878955-1-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 9d856aa1c81930a5d8df0e29d6cb0faa3fa87206 Author: Sebastian Reichel Date: Fri Oct 31 16:58:24 2025 +0100 arm64: dts: rockchip: add eMMC CQE support for rk3588 The RK3588 eMMC controller supports CQE, so add the missing DT flag. Signed-off-by: Sebastian Reichel Link: https://patch.msgid.link/20251031-rockchip-emmc-cqe-support-v2-2-958171f5edad@collabora.com Signed-off-by: Heiko Stuebner commit 3906f8558838841dad2bb96fc6ca10fe54a99f09 Author: Torsten Duwe Date: Mon Nov 10 19:11:53 2025 +0100 arm64: dts: rockchip: enable HDMI audio on Rock 5 ITX The Rock 5 ITX only needs enablement for 2 nodes in order to send audio on HDMI1, the connector closer to the 12V barrel jack and farther from S/PDIF. It is sufficient to declare the audio injection as okay, and to activate I2S6. Note that for the other HDMI output it is not that trivial, as the video data there originates from the SoC's DisplayPort output DP1 and is only converted to HDMI in U7 (an RA620). Signed-off-by: Torsten Duwe [fixed commit subject prefixes] Link: https://patch.msgid.link/20251110181153.CC62B6732A@verein.lst.de Signed-off-by: Heiko Stuebner commit 93ce3bee311d6f885bffb4a83843bddbe6b126be Author: Matt Bobrowski Date: Thu Nov 13 09:25:19 2025 +0000 selftests/bpf: retry bpf_map_update_elem() when E2BIG is returned Executing the test_maps binary on platforms with extremely high core counts may cause intermittent assertion failures in test_update_delete() (called via test_map_parallel()). This can occur because bpf_map_update_elem() under some circumstances (specifically in this case while performing bpf_map_update_elem() with BPF_NOEXIST on a BPF_MAP_TYPE_HASH with its map_flags set to BPF_F_NO_PREALLOC) can return an E2BIG error code i.e. error -7 7 tools/testing/selftests/bpf/test_maps.c:#: void test_update_delete(unsigned int, void *): Assertion `err == 0' failed. tools/testing/selftests/bpf/test_maps.c:#: void __run_parallel(unsigned int, void (*)(unsigned int, void *), void *): Assertion `status == 0' failed. As it turns out, is_map_full() which is called from alloc_htab_elem() can take on a conservative approach when htab->use_percpu_counter is true (which is the case here because the percpu_counter is used when a BPF_MAP_TYPE_HASH is created with its map_flags set to BPF_F_NO_PREALLOC). This conservative approach prioritizes preventing over-allocation and potential issues that could arise from possibly exceeding htab->map.max_entries in highly concurrent environments, even if it means slightly under-utilizing the htab map's capacity. Given that bpf_map_update_elem() from test_update_delete() can return E2BIG, update can_retry() such that it also accounts for the E2BIG error code (specifically only when running with map_flags being set to BPF_F_NO_PREALLOC). The retry loop will allow the global count belonging to the percpu_counter to become synchronized and better reflect the current htab map's capacity. Signed-off-by: Matt Bobrowski Acked-by: Song Liu Link: https://lore.kernel.org/r/20251113092519.2632079-1-mattbobrowski@google.com Signed-off-by: Alexei Starovoitov commit 260316d35cf8f8606c5ed7a349cc92e1e71d8150 Author: FUKAUMI Naoki Date: Wed Nov 12 03:51:31 2025 +0000 arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C The VCC supply for the BL24C16 EEPROM chip found on Radxa ROCK 3C is vcca1v8_pmu. [1] Describe this supply. [1] https://dl.radxa.com/rock3/docs/hw/3c/v1400/radxa_rock_3c_v1400_schematic.pdf p.13 Fixes: ee219017ddb50 ("arm64: dts: rockchip: Add Radxa ROCK 3C") Signed-off-by: FUKAUMI Naoki Link: https://patch.msgid.link/20251112035133.28753-4-naoki@radxa.com Signed-off-by: Heiko Stuebner commit 3069ff1930aa71e125874c780ffaa6caeda5800a Author: FUKAUMI Naoki Date: Wed Nov 12 03:51:30 2025 +0000 arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A The VCC supply for the BL24C16 EEPROM chip found on Radxa ROCK 5A is vcc_3v3_pmu, which is routed to vcc_3v3_s3 via a zero-ohm resistor. [1] Describe this supply. [1] https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.4, p.19 Fixes: 89c880808cff8 ("arm64: dts: rockchip: add I2C EEPROM to rock-5a") Signed-off-by: FUKAUMI Naoki Link: https://patch.msgid.link/20251112035133.28753-3-naoki@radxa.com Signed-off-by: Heiko Stuebner commit 92e6e0b0e595afdda6296c760551ad3ffe9d5231 Author: FUKAUMI Naoki Date: Wed Nov 12 03:51:29 2025 +0000 arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A The BL24C16 EEPROM chip found on Radxa ROCK 5A is connected to the i2c0 bus, [1] so move the eeprom node from the i2c2 bus to the i2c0 bus. [1] Link: https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.19 Fixes: 89c880808cff8 ("arm64: dts: rockchip: add I2C EEPROM to rock-5a") Signed-off-by: FUKAUMI Naoki Link: https://patch.msgid.link/20251112035133.28753-2-naoki@radxa.com Signed-off-by: Heiko Stuebner commit 4c609425988969e46a6d562329f4061c82017945 Author: Heiko Stuebner Date: Thu Nov 6 00:54:08 2025 +0100 arm64: dts: rockchip: use SCMI clock id for gpu clock on rk356x Instead of hard-coding 1, use the more descriptive ID from the binding to reference the SCMI clock for the gpu on rk356x. Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251105235408.163282-1-heiko@sntech.de commit f151b74eadc65b14a60577d3d186385d69c4d79a Author: Shawn Lin Date: Tue Nov 11 15:04:33 2025 +0800 arm64: dts: rockchip: Remove sdmmc max-frequency on RK3588S EVB1 board sdmmc on RK3588S EVB1 could work fine under 200Mhz, no need to limit it to 150Mhz. Signed-off-by: Shawn Lin Link: https://patch.msgid.link/1762844673-123776-1-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Heiko Stuebner commit 57bd160290f39ee90bc51b4daa224b481d726480 Author: FUKAUMI Naoki Date: Tue Nov 11 07:17:30 2025 +0000 arm64: dts: rockchip: Remove sdmmc max-frequency for Radxa ROCK 5 ITX/5B/5B+/5T Default max-frequency for sdmmc is "200000000"[1]. Remove redundant definition. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi?h=v6.17#n2013 Signed-off-by: FUKAUMI Naoki Link: https://patch.msgid.link/20251111071730.126238-4-naoki@radxa.com Signed-off-by: Heiko Stuebner commit c7a9549ce46e7422e96e2b677ab578b32b3eef25 Author: FUKAUMI Naoki Date: Tue Nov 11 07:17:28 2025 +0000 arm64: dts: rockchip: Switch microSD card detect to gpio on Radxa ROCK 5 ITX/5C Due to the discussion about cd-gpios and sdmmmc_det pin functionality [1], it would be better to use cd-gpios for now. When the sdmmc controller runtime-suspends, the detection logic inside the controller cannot detect anything anymore, which using the gpio variant fixes. The Rock 5B/5B+/5T already uses cd-gpios, so only get the pinctrl added. [1] https://lore.kernel.org/linux-rockchip/20240912152538.1.I858c2a0bf83606c8b59ba1ab6944978a398d2ac5@changeid/ Signed-off-by: FUKAUMI Naoki [amended commit description a bit and squashed the pinctrl patch] Link: https://patch.msgid.link/20251111071730.126238-2-naoki@radxa.com Signed-off-by: Heiko Stuebner commit 6bcb180f6f4585554cefbe8c412aa8879b15f07a Author: Matt Roper Date: Mon Nov 10 15:20:21 2025 -0800 drm/xe/oa: Store forcewake reference in stream structure Calls to xe_force_wake_put() should generally pass the exact reference returned by xe_force_wake_get(). Since OA grabs and releases forcewake in different functions, xe_oa_stream_destroy() is currently calling put with a hardcoded ALL mask. Although this works for now, it's somewhat fragile in case OA moves to more precise power domain management in the future. Stash the original reference obtained during stream initialization inside the stream structure so that we can use it directly when the stream is destroyed. Cc: Ashutosh Dixit Reviewed-by: Gustavo Sousa Reviewed-by: Ashutosh Dixit Link: https://patch.msgid.link/20251110232017.1475869-35-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 9de2606f4a795ac7d62c1d0877e65caf32fb67cd Author: Matt Roper Date: Mon Nov 10 15:20:20 2025 -0800 drm/xe/eustall: Store forcewake reference in stream structure Calls to xe_force_wake_put() should generally pass the exact reference returned by xe_force_wake_get(). Since EU stall grabs and releases forcewake in different functions, xe_eu_stall_disable_locked() is currently calling put with a hardcoded RENDER domain. Although this works for now, it's somewhat fragile in case the power domain(s) required by stall sampling change in the future, or if workarounds show up that require us to obtain additional domains. Stash the original reference obtained during stream enable inside the stream structure so that we can use it directly when the stream is disabled. Cc: Harish Chegondi Reviewed-by: Harish Chegondi Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20251110232017.1475869-34-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit defdf272844639649a0bdc1729d164eb8c9ca812 Author: Matt Roper Date: Mon Nov 10 15:20:19 2025 -0800 drm/xe/forcewake: Improve kerneldoc Improve the kerneldoc for forcewake a bit to give more detail about what the structures represent. Reviewed-by: Gustavo Sousa Reviewed-by: Stuart Summers Link: https://patch.msgid.link/20251110232017.1475869-33-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 9f4ce4878878cb9694c4284f7a483984d52d4d9a Author: Yosry Ahmed Date: Thu Oct 30 22:37:57 2025 +0000 KVM: x86: Document a virtualization gap for GIF on AMD CPUs According to the APM Volume #2, Section 15.17, Table 15-10 (24593—Rev. 3.42—March 2024), When "GIF==0", an "Debug exception or trap, due to breakpoint register match" should be "Ignored and discarded". KVM lacks any handling of this. Even when vGIF is enabled and vGIF==0, the CPU does not ignore #DBs and relies on the VMM to do so. Handling this is possible, but the complexity is unjustified given the rarity of using HW breakpoints when GIF==0 (e.g. near VMRUN). KVM would need to intercept the #DB, temporarily disable the breakpoint, singe-step over the instruction (probably reusing NMI singe-stepping), and re-enable the breakpoint. Instead, document this as an erratum. Signed-off-by: Yosry Ahmed Reviewed-by: Bagas Sanjaya Link: https://patch.msgid.link/20251030223757.2950309-1-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 4da3768e1820cf15cced390242d8789aed34f54d Author: Omar Sandoval Date: Tue Nov 4 09:55:26 2025 -0800 KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when KVM decodes the instruction to get the next RIP. As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction"), failure to verify that the correct INTn instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus specifying the wrong next RIP. The bug most often manifests as "Oops: int3" panics on static branch checks in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's "text poke" code patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily) replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new code stream except for the first byte, and finally replaces the int3 with the first byte of the new code stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP is incorrect, then this lookup fails and the guest kernel panics. The bug reproduces almost instantly by hacking the guest kernel to repeatedly check a static branch[1] while running a drgn script[2] on the host to constantly swap out the memory containing the guest's TSS. [1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a [2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b Fixes: 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction") Cc: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Omar Sandoval Link: https://patch.msgid.link/1cc6dcdf36e3add7ee7c8d90ad58414eeb6c3d34.1762278762.git.osandov@fb.com Signed-off-by: Sean Christopherson commit c99ebb6132595b4b288a413981197eb076547c5a Merge: f694d215d34035 d0309c054362a2 Author: Jakub Kicinski Date: Thu Nov 13 12:32:50 2025 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.18-rc6). No conflicts, adjacent changes in: drivers/net/phy/micrel.c 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface") 61b7ade9ba8c ("net: phy: micrel: Add support for non PTP SKUs for lan8814") and a trivial one in tools/testing/selftests/drivers/net/Makefile. Signed-off-by: Jakub Kicinski commit 3c48eb382e57a9e2d2817f22f11f6c754e601dc8 Author: Marius Zachmann Date: Thu Nov 13 11:00:24 2025 +0100 hwmon: (corsair-cpro) Replace magic values with constants Replace two magic values in ccp_device with existing constants. Signed-off-by: Marius Zachmann Link: https://lore.kernel.org/r/20251113100024.11103-3-mail@mariuszachmann.de [groeck: Updated subject to include subsystem/driver] Signed-off-by: Guenter Roeck commit 6ae5101d6f3a8fbecfc7a50af076e1ce890fd62c Author: Marius Zachmann Date: Thu Nov 13 11:00:23 2025 +0100 hwmon: (corsair-cpro) Read temperature as a signed value Convert temperature to s16 to correctly read negative temperatures. Signed-off-by: Marius Zachmann Link: https://lore.kernel.org/r/20251113100024.11103-2-mail@mariuszachmann.de [groeck: Updated subject, coding style] Signed-off-by: Guenter Roeck commit 006f661e024f2f0e89f3b458a3db0b10b657afa5 Author: Bruno Thomsen Date: Tue Nov 11 15:44:06 2025 +0100 hwmon: (tmp421) Remove duplicate return in switch-case Use single read permission return in switch-case that handles attributes in tmp421_is_visible(). Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20251111144406.7489-2-bruno.thomsen@gmail.com Signed-off-by: Guenter Roeck commit 638196d43bd3c8548c6576d26475e071c023a9b3 Author: Bruno Thomsen Date: Tue Nov 11 15:44:05 2025 +0100 hwmon: (tmp421) Check error when loading label from dt Add error checking when loading temperature channel label defined in device tree. Handling of error from of_property_read_string() is inspired by lm90 driver and therefor contain same error string. Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20251111144406.7489-1-bruno.thomsen@gmail.com Signed-off-by: Guenter Roeck commit c432180a7d95081353a96fd6d5bd75b0fc8a27c3 Author: Claudiu Beznea Date: Wed Nov 5 09:05:26 2025 +0200 soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config Not all system controller registers are accessible from Linux. Accessing such registers generates synchronous external abort. Populate the readable_reg and writeable_reg members of the regmap config to inform the regmap core which registers can be accessed. The list will need to be updated whenever new system controller functionality is exported through regmap. Fixes: 2da2740fb9c8 ("soc: renesas: rz-sysc: Add syscon/regmap support") Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251105070526.264445-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4ff787433ba6d564b00334b4bfd6350f5b6f4bb3 Author: Claudiu Beznea Date: Wed Nov 5 09:05:25 2025 +0200 soc: renesas: r9a09g056-sys: Populate max_register Populate max_register to avoid external aborts. Fixes: 2da2740fb9c8 ("soc: renesas: rz-sysc: Add syscon/regmap support") Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251105070526.264445-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3b0cf6ab35909d7ac8d561e18159c62d42d914c2 Author: John Madieu Date: Thu Nov 6 09:07:58 2025 +0100 pinctrl: renesas: rzg2l: Refactor OEN register PWPR handling Extract the OEN register write with PWPR protection logic into a helper function to eliminate code duplication between rzg2l_write_oen() and rzg2l_pinctrl_resume_noirq(). Introduce rzg2l_oen_write_with_pwpr() helper that encapsulates the PWPR unlock, OEN register write, and PWPR lock sequence. This helper must be called with pctrl->lock already held by the caller. Reported-by: Pavel Machek Closes: https://lore.kernel.org/cip-dev/OS9PR01MB16368C765305362F5F4132759FFC4A@OS9PR01MB16368.jpnprd01.prod.outlook.com/T/#u Signed-off-by: John Madieu Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106080758.36645-1-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit b272b94fd223977a79cb521dc7f14a8041b3fb3f Author: Lad Prabhakar Date: Mon Nov 10 20:39:26 2025 +0000 arm64: dts: renesas: rzt2h-n2h-evk: Enable Ethernet support Enable Ethernet support on the RZ/T2H and RZ/N2H EVKs. Configure the MIIC converter in mode 0x6: Port 0 <-> ETHSW Port 0 Port 1 <-> ETHSW Port 1 Port 2 <-> GMAC2 Port 3 <-> GMAC1 Enable the ETHSS, GMAC1 and GMAC2 nodes. ETHSW support will be added once the switch driver is available. Configure the MIIC converters to map ports according to the selected switching mode, with converters 0 and 1 mapped to switch ports and converters 2 and 3 mapped to GMAC ports. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251110203926.692242-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1eb61aa4d88d916f2d5aaf2a1fe30b3d01354bbe Author: Ovidiu Panait Date: Fri Nov 7 21:07:06 2025 +0000 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable RTC Enable RTC. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251107210706.45044-5-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit cfc733da4e79018f88d8ac5f3a5306abbba8ef89 Author: Ovidiu Panait Date: Fri Nov 7 21:07:05 2025 +0000 arm64: dts: renesas: r9a09g057: Add RTC node Add RTC node to Renesas RZ/V2H ("R9A09G057") SoC DTSI. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251107210706.45044-4-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit f61c497a91c4f7f5b34e78475dafc511cdcebca6 Author: Ovidiu Panait Date: Mon Oct 27 14:06:51 2025 +0000 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add NMI pushbutton support RZ/V2H EVK has a user pushbutton connected to the SoC NMI pin, which can be used to wake up the system from suspend to idle. Add a DT node in the device tree to instantiate the gpio-keys driver for this button. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251027140651.18367-1-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit 0926e6e69852a450dc2f6e3f8412ae58f773e29b Author: Claudiu Beznea Date: Thu Oct 23 16:58:10 2025 +0300 arm64: dts: renesas: rzg3s-smarc: Enable USB support Enable USB support (host, device, USB PHYs). Reviewed-by: Geert Uytterhoeven Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251023135810.1688415-8-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c837ad879e7110227bac0096a32a7c610e430a8e Author: Claudiu Beznea Date: Thu Oct 23 16:58:09 2025 +0300 arm64: dts: renesas: r9a08g045: Add USB support Add USB nodes for the Renesas RZ/G3S SoC. This consists of PHY reset, host and device support. Reviewed-by: Geert Uytterhoeven Tested-by: Wolfram Sang Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20251023135810.1688415-7-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1f77aced8c5c6f69566e69f63c3a6c1960f7fc87 Author: Ovidiu Panait Date: Mon Oct 20 14:31:07 2025 +0000 arm64: dts: renesas: r9a09g057: Add TSU nodes The Renesas RZ/V2H SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The device provides real-time temperature measurements for thermal management, utilizing two dedicated channels for temperature sensing: - TSU0, which is located near the DRP-AI block - TSU1, which is located near the CPU and DRP-AI block Since TSU1 is physically closer the CPU and the highest temperature spot, it is used for CPU throttling through a passive trip and cooling map. TSU0 is configured only with a critical trip. Add TSU nodes along with thermal zones and keep them enabled in the SoC DTSI. Signed-off-by: Ovidiu Panait Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251020143107.13974-4-ovidiu.panait.rb@renesas.com Signed-off-by: Geert Uytterhoeven commit 5fb2f67341bd4b7c482f2bbda6b78244a51c3923 Author: Cosmin Tanislav Date: Wed Nov 5 12:41:38 2025 +0200 clk: renesas: r9a09g077: Add SPI module clocks The Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs have four SPI peripherals, each with their own clock divider, which divides PLL4 by either 24, 25, 30 or 32, similar to the SCI peripheral. The dividers feed into the usual module clocks. Add them all. Signed-off-by: Cosmin Tanislav Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251105104151.1489281-2-cosmin-gabriel.tanislav.xa@renesas.com Signed-off-by: Geert Uytterhoeven commit 7efa3a6d96348bfbe02e330219b05ec922958fab Author: Lad Prabhakar Date: Sat Nov 1 05:00:34 2025 +0000 clk: renesas: r9a09g056: Add USB3.0 clocks/resets Add USB3.0 clock and reset entries. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251101050034.738807-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4ecc8ccde5b488eb7284c1e674f274850eb039a6 Author: Lad Prabhakar Date: Sat Nov 1 05:00:33 2025 +0000 clk: renesas: r9a09g057: Add USB3.0 clocks/resets Add USB3.0 clock and reset entries. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251101050034.738807-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c23be4242bed1009ff57aaa4578abe638696e5de Merge: c6b63d54c6f8d8 a95ce05cd0cc8b Author: Geert Uytterhoeven Date: Thu Nov 13 21:17:37 2025 +0100 Merge tag 'renesas-r9a09g057-dt-binding-defs-tag5' into renesas-clk-for-v6.19 Renesas RZ/V2N and RZ/V2H USB3.0 Core Clock DT Binding Definitions USB3.0 core clock DT binding definitions for the Renesas RZ/V2N (R9A09G056) and RZ/V2H (R9A09G057) SoCs, shared by driver and DT source files. commit c6b63d54c6f8d81e72c8b9b8e8d1cb5ada03c5dd Author: Biju Das Date: Mon Oct 27 15:45:48 2025 +0000 clk: renesas: r9a09g047: Add RSCI clocks/resets Add RSCI clock and reset entries. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251027154615.115759-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 97e047f44d347a4f4033c0b62f77a15a9deaf750 Author: Yongliang Gao Date: Thu Nov 13 08:02:52 2025 +0800 trace/pid_list: optimize pid_list->lock contention When the system has many cores and task switching is frequent, setting set_ftrace_pid can cause frequent pid_list->lock contention and high system sys usage. For example, in a 288-core VM environment, we observed 267 CPUs experiencing contention on pid_list->lock, with stack traces showing: #4 [ffffa6226fb4bc70] native_queued_spin_lock_slowpath at ffffffff99cd4b7e #5 [ffffa6226fb4bc90] _raw_spin_lock_irqsave at ffffffff99cd3e36 #6 [ffffa6226fb4bca0] trace_pid_list_is_set at ffffffff99267554 #7 [ffffa6226fb4bcc0] trace_ignore_this_task at ffffffff9925c288 #8 [ffffa6226fb4bcd8] ftrace_filter_pid_sched_switch_probe at ffffffff99246efe #9 [ffffa6226fb4bcf0] __schedule at ffffffff99ccd161 Replaces the existing spinlock with a seqlock to allow concurrent readers, while maintaining write exclusivity. Link: https://patch.msgid.link/20251113000252.1058144-1-leonylgao@gmail.com Reviewed-by: Huang Cun Signed-off-by: Yongliang Gao Signed-off-by: Steven Rostedt (Google) commit a95ce05cd0cc8b53f1559390c4e690bb8f79562f Author: Lad Prabhakar Date: Sat Nov 1 05:00:32 2025 +0000 dt-bindings: clock: renesas,r9a09g056-cpg: Add USB3.0 core clocks Add definitions for USB3.0 core clocks in the R9A09G056 CPG DT bindings header file. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251101050034.738807-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 280b7cdddc3d96c4887fdb31b6766e4db1b2f2a3 Author: Lad Prabhakar Date: Sat Nov 1 05:00:31 2025 +0000 dt-bindings: clock: renesas,r9a09g057-cpg: Add USB3.0 core clocks Add definitions for USB3.0 core clocks in the R9A09G057 CPG DT bindings header file. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251101050034.738807-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e29aa918a928408c3e64b0d1025e4eb9f6fc549e Author: Steven Rostedt Date: Tue Nov 11 18:24:09 2025 -0500 tracing: Have function graph tracer define options per instance Currently the function graph tracer's options are saved via a global mask when it should be per instance. Use the new infrastructure to define a "default_flags" field in the tracer structure that is used for the top level instance as well as new ones. Currently the global mask causes confusion: # cd /sys/kernel/tracing # mkdir instances/foo # echo function_graph > instances/foo/current_tracer # echo 1 > options/funcgraph-args # echo function_graph > current_tracer # cat trace [..] 2) | _raw_spin_lock_irq(lock=0xffff96b97dea16c0) { 2) 0.422 us | do_raw_spin_lock(lock=0xffff96b97dea16c0); 7) | rcu_sched_clock_irq(user=0) { 2) 1.478 us | } 7) 0.758 us | rcu_is_cpu_rrupt_from_idle(); 2) 0.647 us | enqueue_hrtimer(timer=0xffff96b97dea2058, base=0xffff96b97dea1740, mode=0); # cat instances/foo/options/funcgraph-args 1 # cat instances/foo/trace [..] 4) | __x64_sys_read() { 4) | ksys_read() { 4) 0.755 us | fdget_pos(); 4) | vfs_read() { 4) | rw_verify_area() { 4) | security_file_permission() { 4) | apparmor_file_permission() { 4) | common_file_perm() { 4) | aa_file_perm() { 4) | rcu_read_lock_held() { [..] The above shows that updating the "funcgraph-args" option at the top level instance also updates the "funcgraph-args" option in the instance but because the update is only done by the instance that gets changed (as it should), it's confusing to see that the option is already set in the other instance. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251111232429.641030027@kernel.org Fixes: c132be2c4fcc1 ("function_graph: Have the instances use their own ftrace_ops for filtering") Signed-off-by: Steven Rostedt (Google) commit 036176d9dba74e23e3ef358e171a77b75837fee0 Author: Takashi Sakamoto Date: Wed Nov 12 07:38:34 2025 +0900 firewire: core: abort pending transactions at card removal IEEE 1394 defines the split, concatenated, and unified transaction. To support the split transaction, core function uses linked list to maintain the transactions waiting for acknowledge packet. After clearing sources of hardware interrupts, the acknowledge packet is no longer handled, therefore it is required to abort the pending transactions. This commit executes callback with RCODE_CANCELLED for the pending transactions at card removal. Link: https://lore.kernel.org/r/20251111223834.311287-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit e65b871c9b5af9265aefc5b8cd34993586d93aab Author: Krzysztof Kozlowski Date: Thu Oct 23 11:02:51 2025 +0200 ASoC: codecs: pm4125: Remove irq_chip on component unbind Component bind uses devm_regmap_add_irq_chip() to add IRQ chip, so it will be removed only during driver unbind, not component unbind. A component unbind-bind cycle for the same Linux device lifetime would result in two chips added. Fix this by manually removing the IRQ chip during component unbind. Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251023-asoc-regmap-irq-chip-v1-2-17ad32680913@linaro.org Signed-off-by: Mark Brown commit fd94857a934cbe613353810a024c84d54826ead3 Author: Krzysztof Kozlowski Date: Thu Oct 23 11:02:50 2025 +0200 ASoC: codecs: pm4125: Fix potential conflict when probing two devices Qualcomm PM4125 codec is always a single device on the board, however nothing stops board designers to have two of them, thus same device driver could probe twice. Device driver is not ready for that case, because it allocates statically 'struct regmap_irq_chip' as non-const and stores during component bind in 'irq_drv_data' member a pointer to per-probe state container ('struct pm4125_priv'). Second component bind would overwrite the 'irq_drv_data' from previous device probe, so interrupts would be executed in wrong context. The fix makes use of currently unused 'struct pm4125_priv' member 'pm4125_regmap_irq_chip', but renames it to a shorter name. Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251023-asoc-regmap-irq-chip-v1-1-17ad32680913@linaro.org Signed-off-by: Mark Brown commit 76ade2443397ef7612c978f92858d525e5b2eeab Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:30 2025 +0000 slab: Remove references to folios from virt_to_slab() Use page_slab() instead of virt_to_folio() which will work perfectly when struct slab is separated from struct folio. This was the last user of folio_slab(), so delete it. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-17-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit bbe711730515f688a0bf4ab76a2639bcede933f9 Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:29 2025 +0000 kasan: Remove references to folio in __kasan_mempool_poison_object() In preparation for splitting struct slab from struct page and struct folio, remove mentions of struct folio from this function. There is a mild improvement for large kmalloc objects as we will avoid calling compound_head() for them. We can discard the comment as using PageLargeKmalloc() rather than !folio_test_slab() makes it obvious. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: kasan-dev Link: https://patch.msgid.link/20251113000932.1589073-16-willy@infradead.org Acked-by: Harry Yoo Signed-off-by: Vlastimil Babka commit b8557d109e7de6962ad4fe217b93316f4e659130 Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:28 2025 +0000 memcg: Convert mem_cgroup_from_obj_folio() to mem_cgroup_from_obj_slab() In preparation for splitting struct slab from struct page and struct folio, convert the pointer to a slab rather than a folio. This means we can end up passing a NULL slab pointer to mem_cgroup_from_obj_slab() if the pointer is not to a page allocated to slab, and we handle that appropriately by returning NULL. Signed-off-by: Matthew Wilcox (Oracle) Cc: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Cc: Shakeel Butt Cc: Muchun Song Cc: cgroups@vger.kernel.org Link: https://patch.msgid.link/20251113000932.1589073-15-willy@infradead.org Acked-by: Johannes Weiner Signed-off-by: Vlastimil Babka commit e0431ff998bd32dcc1e591a45b4e156fcb0325a3 Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:42:20 2025 +0100 firmware: ti_sci: Partial-IO support Add support for Partial-IO poweroff. In Partial-IO pins of a few hardware units can generate system wakeups while DDR memory is not powered resulting in a fresh boot of the system. These hardware units in the SoC are always powered so that some logic can detect pin activity. If the system supports Partial-IO as described in the fw capabilities, a sys_off handler is added. This sys_off handler decides if the poweroff is executed by entering normal poweroff or Partial-IO instead. The decision is made by checking if wakeup is enabled on all devices that may wake up the SoC from Partial-IO. The possible wakeup devices are found by checking which devices reference a "Partial-IO" system state in the list of wakeup-source system states. Only devices that are actually enabled by the user will be considered as an active wakeup source. If none of the wakeup sources is enabled the system will do a normal poweroff. If at least one wakeup source is enabled it will instead send a TI_SCI_MSG_PREPARE_SLEEP message from the sys_off handler. Sending this message will result in an immediate shutdown of the system. No execution is expected after this point. The code will wait for 5s and do an emergency_restart afterwards if Partial-IO wasn't entered at that point. A short documentation about Partial-IO can be found in section 6.2.4.5 of the TRM at https://www.ti.com/lit/pdf/spruiv7 Signed-off-by: Markus Schneider-Pargmann (TI.com) Reviewed-by: Dhruva Gole Reviewed-by: Kendall Willis Reviewed-by: Sebin Francis Link: https://patch.msgid.link/20251103-topic-am62-partialio-v6-12-b4-v10-2-0557e858d747@baylibre.com Signed-off-by: Nishanth Menon commit 170a3ef6052cfa2462b3bb572a6bb985bf83d21e Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:42:19 2025 +0100 firmware: ti_sci: Support transfers without response Check the header flags if an response is expected or not. If it is not expected skip the receive part of ti_sci_do_xfer(). This prepares the driver for one-way messages as prepare_sleep for Partial-IO. Reviewed-by: Kendall Willis Signed-off-by: Markus Schneider-Pargmann (TI.com) Reviewed-by: Dhruva Gole Reviewed-by: Sebin Francis Link: https://patch.msgid.link/20251103-topic-am62-partialio-v6-12-b4-v10-1-0557e858d747@baylibre.com Signed-off-by: Nishanth Menon commit 8d63e85c5b50f1dbfa0ccb214bd91fe5d7e2e860 Author: Randy Dunlap Date: Tue Nov 4 11:26:53 2025 -0800 firmware: cs_dsp: fix kernel-doc warnings in a header file Use correct kernel-doc format to avoid kernel-doc warnings in nclude/linux/firmware/cirrus/cs_dsp_test_utils.h: - mark one struct member as private: since the comment says that it is private - add ending ':' to struct members where needed Warning: include/linux/firmware/cirrus/cs_dsp_test_utils.h:30 struct member 'saw_bus_write' not described in 'cs_dsp_test' Warning: include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'id' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'ver' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'xm_base_words' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'xm_size_words' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'ym_base_words' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'ym_size_words' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'zm_base_words' not described in 'cs_dsp_mock_alg_def' Warning: ../include/linux/firmware/cirrus/cs_dsp_test_utils.h:53 struct member 'zm_size_words' not described in 'cs_dsp_mock_alg_def' Signed-off-by: Randy Dunlap Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20251104192653.929157-1-rdunlap@infradead.org Signed-off-by: Mark Brown commit 4e00135b2dd1d7924a58bffa551b6ceb3bd836f2 Author: Jun Guo Date: Fri Oct 31 15:30:02 2025 +0800 spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 The default FIFO data width of the Cadence SPI IP is 8 bits, but the hardware supports configurations of 16 bits and 32 bits. This patch enhances the driver to support communication with both 16-bits and 32-bits FIFO data widths. Signed-off-by: Jun Guo Link: https://patch.msgid.link/20251031073003.3289573-3-jun.guo@cixtech.com Signed-off-by: Mark Brown commit 55b5d192bab5e152bda8f8cefe837c4ed0ec60c5 Author: Jun Guo Date: Fri Oct 31 15:30:01 2025 +0800 dt-bindings: spi: spi-cadence: update DT binding docs to support cix sky1 SoC - Add new compatible strings to the DT binding documents to support cix sky1 SoC. Signed-off-by: Jun Guo Acked-by: Conor Dooley Link: https://patch.msgid.link/20251031073003.3289573-2-jun.guo@cixtech.com Signed-off-by: Mark Brown commit 8ff3dcb0e8a8bf6c41f23ed4aa62d066d3948a10 Author: Srinivas Kandagatla Date: Fri Oct 31 12:07:03 2025 +0000 ASoC: codecs: lpass-rx-macro: add SM6115 compatible SM6115 does not have "macro" clock, so its bindings differ with existing SoC support in rx-macro. So add dedicated compatible in both driver and dt-bindings to be able to address that difference. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251031120703.590201-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 893e2fd509e968cc1d76caadee0f5d2f2c72f137 Author: Srinivas Kandagatla Date: Fri Oct 31 12:07:02 2025 +0000 ASoC: codecs: lpass-va-macro: add SM6115 compatible SM6115 does not have "macro" clock, so its bindings differ with existing SoC support in va-macro. So add dedicated compatible in both driver and dt-bindings to be able to address that difference. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251031120703.590201-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 675f41b8d1675d9a51a6dcb978ff76b95cbb4b92 Author: Srinivas Kandagatla Date: Fri Oct 31 12:07:01 2025 +0000 ASoC: dt-bindings: qcom,lpass-va-macro: Add sm6115 LPASS VA Add bindings for Qualcomm SM6115 SoC Low Power Audio SubSystem (LPASS) VA macro codec. This SoC does not provide macro clock so reflect that in the bindings. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251031120703.590201-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 5a0438622b49df1e723960ac9c0bf75e04370fdc Author: Srinivas Kandagatla Date: Fri Oct 31 12:07:00 2025 +0000 ASoC: dt-bindings: qcom,lpass-va-macro: re-arrange clock-names re-arrange clock-names in the bindings to be more specific to the SoC compatibles, this will give more flexibility to add new SoC's which do not support some clocks. Move all the clock-names under the SoC compatible rather than keeping int on the top level, this makes it more align with other lpass codec macros. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251031120703.590201-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 65d03e84d8b8e42cf4636fcabb81c9b130cec710 Author: Srinivas Kandagatla Date: Fri Oct 31 12:06:59 2025 +0000 ASoC: dt-bindings: qcom,lpass-rx-macro: Add sm6115 LPASS RX Add bindings for Qualcomm SM6115 SoC Low Power Audio SubSystem (LPASS) RX macro codec. This SoC does not provide macro clock so reflect that in the bindings. Signed-off-by: Srinivas Kandagatla Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251031120703.590201-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 7c63b5a8ed972a2c8c03d984f6a43349007cea93 Author: Srinivas Kandagatla Date: Fri Oct 31 12:06:58 2025 +0000 ASoC: codecs: lpass-tx-macro: fix SM6115 support SM6115 does have soundwire controller in tx. For some reason we ended up with this incorrect patch. Fix this by adding the flag to reflect this in SoC data. Fixes: 510c46884299 ("ASoC: codecs: lpass-tx-macro: Add SM6115 support") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251031120703.590201-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 444a43bf3c029cc0a7c8d97611b3c126cddb5489 Author: Anand Moon Date: Tue Oct 28 21:12:24 2025 +0530 PCI: j721e: Use 'pcie->reset_gpio' directly and drop the local variable Assign the result of devm_gpiod_get_optional() directly to pcie->reset_gpio, thereby removing the local variable. Signed-off-by: Anand Moon Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251028154229.6774-3-linux.amoon@gmail.com commit 6fad11c61d0dbf87601ab9e2e37cba7a9a427f7b Author: Anand Moon Date: Tue Oct 28 21:12:23 2025 +0530 PCI: j721e: Use devm_clk_get_optional_enabled() to get and enable the clock Use devm_clk_get_optional_enabled() helper instead of calling devm_clk_get_optional() and then clk_prepare_enable(). Assign the result of devm_clk_get_optional_enabled() directly to pcie->refclk to avoid using a local 'clk' variable. Signed-off-by: Anand Moon Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251028154229.6774-2-linux.amoon@gmail.com commit bc10d0ad540df599a3ab154f0255d901d3c2b030 Author: Siddharth Vadapalli Date: Wed Oct 29 13:34:52 2025 +0530 PCI: keystone: Add support to build as a loadable module The 'pci-keystone.c' driver is the application/glue/wrapper driver for the Designware PCIe Controllers on TI SoCs. Now that all of the helper APIs that the 'pci-keystone.c' driver depends upon have been exported for use, enable support to build the driver as a loadable module. When building the driver as a module, the functions marked by the '__init' keyword may be invoked after the init memory has been freed by the kernel. This results will result in an exception of the form: Unable to handle kernel paging request at virtual address ... Mem abort info: ... pc : ks_pcie_host_init+0x0/0x540 lr : dw_pcie_host_init+0x170/0x498 ... ks_pcie_host_init+0x0/0x540 (P) ks_pcie_probe+0x728/0x84c platform_probe+0x5c/0x98 really_probe+0xbc/0x29c __driver_probe_device+0x78/0x12c driver_probe_device+0xd8/0x15c To address this, introduce a new function namely 'ks_pcie_init()' to register the 'fault handler' while removing the '__init' keyword from existing functions. Note that hook_fault_code() is defined as '__init' function. Since the init functions should never be called during runtime (after init memory freeing stage), the driver is made as a built-in if CONFIG_ARM (where hook_fault_code() is used) is selected. Signed-off-by: Siddharth Vadapalli [mani: added a note about hook_fault_code()] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251029080547.1253757-5-s-vadapalli@ti.com commit 5aa84c034a36fc67afd6c2048404716083fff75a Author: Siddharth Vadapalli Date: Wed Oct 29 13:34:50 2025 +0530 PCI: dwc: Export dw_pcie_allocate_domains() and dw_pcie_ep_raise_msix_irq() The pci-keystone.c driver uses the functions 'dw_pcie_allocate_domains()' and 'dw_pcie_ep_raise_msix_irq()'. Export them in preparation for enabling the pci-keystone.c driver to be built as a loadable module. Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251029080547.1253757-3-s-vadapalli@ti.com commit 36640d21fdfe0152c96e6cb9b58e3336291dfbaa Author: Siddharth Vadapalli Date: Wed Oct 29 13:34:49 2025 +0530 PCI: Export pci_get_host_bridge_device() for use by pci-keystone The pci-keystone.c driver uses the 'pci_get_host_bridge_device()' helper. Export it in preparation for enabling the pci-keystone.c driver to be built as a loadable module. Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251029080547.1253757-2-s-vadapalli@ti.com commit 95d9c3f0e4546eaec0977f3b387549a8463cd49f Author: Siddharth Vadapalli Date: Wed Oct 29 13:34:51 2025 +0530 PCI: keystone: Exit ks_pcie_probe() for invalid mode Commit under Fixes introduced support for PCIe EP mode on AM654x platforms. When the mode happens to be either "DW_PCIE_RC_TYPE" or "DW_PCIE_EP_TYPE", the PCIe Controller is configured accordingly. However, when the mode is neither of them, an error message is displayed, but the driver probe succeeds. Since this "invalid" mode is not associated with a functional PCIe Controller, the probe should fail. Fix the behavior by exiting "ks_pcie_probe()" with the return value of "-EINVAL" in addition to displaying the existing error message when the mode is invalid. Fixes: 23284ad677a9 ("PCI: keystone: Add support for PCIe EP in AM654x Platforms") Signed-off-by: Siddharth Vadapalli Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251029080547.1253757-4-s-vadapalli@ti.com commit f8f115baae2d83e7b5931114d294d8b7fc8f9642 Merge: 5bd38e18d5287f 00d91481279fb2 Author: Jens Axboe Date: Thu Nov 13 11:20:19 2025 -0700 Merge branch 'zcrx-updates-6.19' into for-6.19/io_uring Merge zcrx updates from Pavel: "Zcrx updates for 6.19. It includes a bunch of small patches, IORING_REGISTER_ZCRX_CTRL and RQ flushing (Patches 4-5) and David's work on sharing zcrx b/w multiple io_uring instances." Link: https://lore.kernel.org/io-uring/cover.1763029704.git.asml.silence@gmail.com/ Signed-off-by: Jens Axboe * zcrx-updates-6.19: io_uring/zcrx: share an ifq between rings io_uring/zcrx: add io_fill_zcrx_offsets() io_uring/zcrx: export zcrx via a file io_uring/zcrx: move io_zcrx_scrub() and dependencies up io_uring/zcrx: count zcrx users io_uring/zcrx: add sync refill queue flushing io_uring/zcrx: introduce IORING_REGISTER_ZCRX_CTRL io_uring/zcrx: elide passing msg flags io_uring/zcrx: use folio_nr_pages() instead of shift operation io_uring/zcrx: convert to use netmem_desc commit 00d91481279fb2df8c46d19090578afd523ca630 Author: David Wei Date: Thu Nov 13 10:46:18 2025 +0000 io_uring/zcrx: share an ifq between rings Add a way to share an ifq from a src ring that is real (i.e. bound to a HW RX queue) with other rings. This is done by passing a new flag IORING_ZCRX_IFQ_REG_IMPORT in the registration struct io_uring_zcrx_ifq_reg, alongside the fd of an exported zcrx ifq. Signed-off-by: David Wei Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0926f94ab36a6d76d07fa8f0934e65f5f66647ec Author: David Wei Date: Thu Nov 13 10:46:17 2025 +0000 io_uring/zcrx: add io_fill_zcrx_offsets() Add a helper io_fill_zcrx_offsets() that sets the constant offsets in struct io_uring_zcrx_offsets returned to userspace. Signed-off-by: David Wei Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d7af80b213e5675664b14f12240cb282e81773d5 Author: Pavel Begunkov Date: Thu Nov 13 10:46:16 2025 +0000 io_uring/zcrx: export zcrx via a file Add an option to wrap a zcrx instance into a file and expose it to the user space. Currently, users can't do anything meaningful with the file, but it'll be used in a next patch to import it into another io_uring instance. It's implemented as a new op called ZCRX_CTRL_EXPORT for the IORING_REGISTER_ZCRX_CTRL registration opcode. Signed-off-by: David Wei Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 742cb2e14ecb059cd4a77b92aa4945c20f85d414 Author: David Wei Date: Thu Nov 13 10:46:15 2025 +0000 io_uring/zcrx: move io_zcrx_scrub() and dependencies up In preparation for adding zcrx ifq exporting and importing, move io_zcrx_scrub() and its dependencies up the file to be closer to io_close_queue(). Signed-off-by: David Wei Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 39c9676f789eb71ce1005a22eebe2be80a00de6a Author: Pavel Begunkov Date: Thu Nov 13 10:46:14 2025 +0000 io_uring/zcrx: count zcrx users zcrx tries to detach ifq / terminate page pools when the io_uring ctx owning it is being destroyed. There will be multiple io_uring instances attached to it in the future, so add a separate counter to track the users. Note, refs can't be reused for this purpose as it only used to prevent zcrx and rings destruction, and also used by page pools to keep it alive. Signed-off-by: David Wei Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 475eb39b00478b1898bc9080344dcd8e86c53c7a Author: Pavel Begunkov Date: Thu Nov 13 10:46:13 2025 +0000 io_uring/zcrx: add sync refill queue flushing Add an zcrx interface via IORING_REGISTER_ZCRX_CTRL that forces the kernel to flush / consume entries from the refill queue. Just as with the IORING_REGISTER_ZCRX_REFILL attempt, the motivation is to address cases where the refill queue becomes full, and the user can't return buffers and needs to stash them. It's still a slow path, and the user should size refill queue appropriately, but it should be helpful for handling temporary traffic spikes and other unpredictable conditions. The interface is simpler comparing to ZCRX_REFILL as it doesn't need temporary refill entry arrays and gives natural batching, whereas ZCRX_REFILL requires even more user logic to be somewhat efficient. Also, add a structure for the operation. It's not currently used but can serve for future improvements like limiting the number of buffers to process, etc. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit d663976dad68de9b2e3df59cc31f0a24ee4c4511 Author: Pavel Begunkov Date: Thu Nov 13 10:46:12 2025 +0000 io_uring/zcrx: introduce IORING_REGISTER_ZCRX_CTRL It'll be annoying and take enough of boilerplate code to implement new zcrx features as separate io_uring register opcode. Introduce IORING_REGISTER_ZCRX_CTRL that will multiplex such calls to zcrx. Note, there are no real users of the opcode in this patch. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 1b8b5d0316da7468ae4d40f6c2102d559d9e3ca2 Author: Pavel Begunkov Date: Thu Nov 13 10:46:11 2025 +0000 io_uring/zcrx: elide passing msg flags zcrx sqe->msg_flags has never been defined and checked to be zero. It doesn't need to be a MSG_* bitmask. Keep them undefined, don't mix with MSG_DONTWAIT, and don't pass into io_zcrx_recv() as it's ignored anyway. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a0169c3a62875d1bafa0caffa42e1d1cf6aa40e6 Author: Pedro Demarchi Gomes Date: Thu Nov 13 10:46:10 2025 +0000 io_uring/zcrx: use folio_nr_pages() instead of shift operation folio_nr_pages() is a faster helper function to get the number of pages when NR_PAGES_IN_LARGE_FOLIO is enabled. Signed-off-by: Pedro Demarchi Gomes Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit f0243d2b86b97a575a7a013370e934f70ee77dd3 Author: Pavel Begunkov Date: Thu Nov 13 10:46:09 2025 +0000 io_uring/zcrx: convert to use netmem_desc Convert zcrx to struct netmem_desc, and use struct net_iov::desc to access its fields instead of struct net_iov inner union alises. zcrx only directly reads niov->pp, so with this patch it doesn't depend on the union anymore. Signed-off-by: Pavel Begunkov Reviewed-by: Byungchul Park Signed-off-by: Jens Axboe commit 5bd38e18d5287f316cecf173199650072e83be2f Merge: d741c6255524f0 4aaa9bc4d59213 Author: Jens Axboe Date: Thu Nov 13 11:18:19 2025 -0700 Merge branch 'zcrx-query-6.19' into for-6.19/io_uring Merge zcrx SQ/CQ query changes from Pavel: "Introduce zcrx and SQ/CQ layout queries. The former returns what zcrx features are available. And both return the ring size information to help with allocation size calculation for user provided rings like IORING_SETUP_NO_MMAP and. IORING_MEM_REGION_TYPE_USER" Link: https://lore.kernel.org/io-uring/cover.1763030298.git.asml.silence@gmail.com/ Signed-off-by: Jens Axboe * zcrx-query-6.19: io_uring/query: introduce rings info query io_uring/query: introduce zcrx query commit 4aaa9bc4d5921363490d95fe66c4db086a915799 Author: Pavel Begunkov Date: Thu Nov 13 10:48:58 2025 +0000 io_uring/query: introduce rings info query Same problem as with zcrx in the previous patch, the user needs to know SQ/CQ header sizes to allocated memory before setup to use it for user provided rings, i.e. IORING_SETUP_NO_MMAP, however that information is only returned after registration, hence the user is guessing kernel implementation details. Return the header size and alignment, which is split with the same motivation, to allow the user to know the real structure size without alignment in case there will be more flexible placement schemes in the future. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 2647e2ecc096d2330d6b6a34a3a1f0a99828c14c Author: Pavel Begunkov Date: Thu Nov 13 10:48:57 2025 +0000 io_uring/query: introduce zcrx query Add a new query type IO_URING_QUERY_ZCRX returning the user some basic information about the interface, which includes allowed flags for areas and registration and supported IORING_REGISTER_ZCRX_CTRL subcodes. There is also a chicken-egg problem with user provided refill queue memory, where offsets and size information is returned after registration, but to properly allocate memory you need to know it beforehand, which is why the userspace currently has to guess the RQ headers size and severely overestimates it. Return the size information. It's split into "size" and "alignment" fields because for default placement modes the user is interested in the aligned size, however if it gets support for more flexible placement, it'll need to only know the actual header size. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a04fbfb8a175d4904727048b97fcdef12e392ed1 Author: Sascha Bischoff Date: Wed Oct 22 13:45:37 2025 +0000 arm64/sysreg: Add ICH_VMCR_EL2 Add the ICH_VMCR_EL2 register, which is required for the upcoming GICv5 KVM support. This register has two different field encodings, based on if it is used for GICv3 or GICv5-based VMs. The GICv5-specific field encodings are generated with a FEAT_GCIE prefix. This register is already described in the GICv3 KVM code directly. This will be ported across to use the generated encodings as part of an upcoming change. Signed-off-by: Sascha Bischoff Signed-off-by: Catalin Marinas commit a0b130eedde0bc8c2d03932539e6753e2f0f70bc Author: Sascha Bischoff Date: Wed Oct 22 13:45:37 2025 +0000 arm64/sysreg: Move generation of RES0/RES1/UNKN to function The RESx and UNKN define generation happens in two places (EndSysreg and EndSysregFields), and was using nearly identical code. Split this out into a function, and call that instead, rather then keeping the dupliated code. There are no changes to the generated sysregs as part of this change. Signed-off-by: Sascha Bischoff Signed-off-by: Catalin Marinas commit fe2ef46995d5db49a37337f11fe2c6733676c24c Author: Sascha Bischoff Date: Wed Oct 22 13:45:36 2025 +0000 arm64/sysreg: Support feature-specific fields with 'Prefix' descriptor Some system register field encodings change based on, for example the in-use architecture features, or the context in which they are accessed. In order to support these different field encodings, introduce the Prefix descriptor (Prefix, EndPrefix) for describing such sysregs. The Prefix descriptor can be used in the following way: Sysreg EXAMPLE 0 1 2 3 4 Prefix FEAT_A Field 63:0 Foo EndPrefix Prefix FEAT_B Field 63:1 Bar Res0 0 EndPrefix Field 63:0 Baz EndSysreg This will generate a single set of system register encodings (REG_, SYS_, ...), and then generate three sets of field definitions for the system register called EXAMPLE. The first set is prefixed by FEAT_A, e.g. FEAT_A_EXAMPLE_Foo. The second set is prefixed by FEAT_B, e.g., FEAT_B_EXAMPLE_Bar. The third set is not given a prefix at all, e.g. EXAMPLE_BAZ. For each set, a corresponding set of defines for Res0, Res1, and Unkn is generated. The intent for the final prefix-less fields is to describe default or legacy field encodings. This ensure that prefixed encodings can be added to already-present sysregs without affecting existing legacy code. Prefixed fields must be defined before those without a prefix, and this is checked by the generator. This ensures consisnt ordering within the sysregs definitions. The Prefix descriptor can be used within Sysreg or SysregFields blocks. Field, Res0, Res1, Unkn, Rax, SignedEnum, Enum can all be used within a Prefix block. Fields and Mapping can not. Fields that vary with features must be described as part of a SysregFields block, instead. Mappings, which are just a code comment, make little sense in this context, and have hence not been included. There are no changes to the generated system register definitions as part of this change. Signed-off-by: Sascha Bischoff Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit 0aab5772a53dd006c13ba629e8dc8816b7cd213d Author: Sascha Bischoff Date: Wed Oct 22 13:45:36 2025 +0000 arm64/sysreg: Fix checks for incomplete sysreg definitions The checks for incomplete sysreg definitions were checking if the next_bit was greater than 0, which is incorrect and missed occasions where bit 0 hasn't been defined for a sysreg. The reason is that next_bit is -1 when all bits have been processed (LSB - 1). Change the checks to use >= 0, instead. Also, set next_bit in Mapping to -1 instead of 0 to match these new checks. There are no changes to the generated sysreg definitons as part of this change, and conveniently no definitions lack definitions for bit 0. Signed-off-by: Sascha Bischoff Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit 37cb0aab9068e8d7907822405fe5545a2cd7af0b Author: Yang Shi Date: Thu Oct 23 13:44:28 2025 -0700 arm64: mm: make linear mapping permission update more robust for patial range The commit fcf8dda8cc48 ("arm64: pageattr: Explicitly bail out when changing permissions for vmalloc_huge mappings") made permission update for partial range more robust. But the linear mapping permission update still assumes update the whole range by iterating from the first page all the way to the last page of the area. Make it more robust by updating the linear mapping permission from the page mapped by start address, and update the number of numpages. Reviewed-by: Ryan Roberts Reviewed-by: Dev Jain Signed-off-by: Yang Shi Signed-off-by: Catalin Marinas commit c320dbb7c80d93a762c01b4a652d9292629869e7 Author: Dev Jain Date: Fri Oct 17 21:32:51 2025 +0530 arm64/mm: Elide TLB flush in certain pte protection transitions Currently arm64 does an unconditional TLB flush in mprotect(). This is not required for some cases, for example, when changing from PROT_NONE to PROT_READ | PROT_WRITE (a real usecase - glibc malloc does this to emulate growing into the non-main heaps), and unsetting uffd-wp in a range. Therefore, implement pte_needs_flush() for arm64, which is already implemented by some other arches as well. Running a userspace program changing permissions back and forth between PROT_NONE and PROT_READ | PROT_WRITE, and measuring the average time taken for the none->rw transition, I get a reduction from 3.2 microseconds to 2.85 microseconds, giving a 12.3% improvement. Reviewed-by: Kefeng Wang Signed-off-by: Dev Jain Signed-off-by: Catalin Marinas commit 4145fc363eb23a1caf14f7ebf6830ab32bcaa50e Author: Gabor Juhos Date: Thu Nov 13 17:42:52 2025 +0100 clk: qcom: use different Kconfig prompts for APSS IPQ5424/6018 drivers Both the IPQ_APSS_5424 and IPQ_APSS_6018 symbols are using the same prompt which complicates to see that which option corresponds to which driver. Add a prefix to both prompts to make it easier to differentiate the two options. While at it, also fix a typo in the help text of the IPQ_APSS_5424 symbol. Signed-off-by: Gabor Juhos Link: https://lore.kernel.org/r/20251113-clk-qcom-apss-ipq-prompt-v1-1-b62cf2142609@gmail.com Signed-off-by: Bjorn Andersson commit dc937f12e6c3488713de1262e37a30307ee9feac Author: Gabor Juhos Date: Thu Nov 13 17:15:25 2025 +0100 clk: qcom: apss-ipq5424: remove unused 'apss_clk' structure The locally defined 'apss_clk' structure is not used in the code, so remove that. Compile tested only. Signed-off-by: Gabor Juhos Link: https://lore.kernel.org/r/20251113-ipq5424-remove-apss_clk-v1-1-e942e720cf99@gmail.com Signed-off-by: Bjorn Andersson commit f1d8c6580b86fb9018af834421bf2a472fe387f9 Merge: 3249e8a17e62ee c1cbf0d21c4194 Author: Alexei Starovoitov Date: Thu Nov 13 09:14:16 2025 -0800 Merge branch 'percpu_hash-maps' Leon Hwang says: ==================== In the discussion thread "[PATCH bpf-next v9 0/7] bpf: Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags for percpu maps"[1], it was pointed out that missing calls to bpf_obj_free_fields() could lead to memory leaks. A selftest was added to confirm that this is indeed a real issue - the refcount of BPF_KPTR_REF field is not decremented when bpf_obj_free_fields() is missing after copy_map_value[,_long](). Further inspection of copy_map_value[,_long]() call sites revealed two locations affected by this issue: 1. pcpu_copy_value() 2. htab_map_update_elem() when used with BPF_F_LOCK Similar case happens when update local storage maps with BPF_F_LOCK. This series fixes the cases where BPF_F_LOCK is not involved by properly calling bpf_obj_free_fields() after copy_map_value[,_long](), and adds a selftest to verify the fix. The remaining cases involving BPF_F_LOCK will be addressed in a separate patch set after the series "bpf: Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags for percpu maps" is applied. Changes: v5 -> v6: * Update the test name to include "refcounted_kptr". * Update some local variables' name in the test (per Alexei). * v5: https://lore.kernel.org/bpf/20251104142714.99878-1-leon.hwang@linux.dev/ v4 -> v5: * Use a local variable to store the this_cpu_ptr()/per_cpu_ptr() result, and reuse it between copy_map_value[,_long]() and bpf_obj_free_fields() in patch #1 (per Andrii). * Drop patch #2 and #3, because the combination of BPF_F_LOCK with other special fields (except for BPF_SPIN_LOCK) will be disallowed on the UAPI side in the future (per Alexei). * v4: https://lore.kernel.org/bpf/20251030152451.62778-1-leon.hwang@linux.dev/ v3 -> v4: * Target bpf-next tree. * Address comments from Amery: * Drop 'bpf_obj_free_fields()' in the path of updating local storage maps without BPF_F_LOCK. * Drop the corresponding self test. * Respin the other test of local storage maps using syscall BPF programs. * v3: https://lore.kernel.org/bpf/20251026154000.34151-1-leon.hwang@linux.dev/ v2 -> v3: * Free special fields when update local storage maps without BPF_F_LOCK. * Add test to verify decrementing refcount when update cgroup local storage maps without BPF_F_LOCK. * Address review from AI bot: * Slow path with BPF_F_LOCK (around line 642-646) in 'bpf_local_storage.c'. * v2: https://lore.kernel.org/bpf/20251020164608.20536-1-leon.hwang@linux.dev/ v1 -> v2: * Add test to verify decrementing refcount when update cgroup local storage maps with BPF_F_LOCK. * Address review from AI bot: * Fast path without bucket lock (around line 610) in 'bpf_local_storage.c'. * v1: https://lore.kernel.org/bpf/20251016145801.47552-1-leon.hwang@linux.dev/ ==================== Link: https://patch.msgid.link/20251105151407.12723-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit c1cbf0d21c4194513248568e7ab935cf9bb92ff9 Author: Leon Hwang Date: Wed Nov 5 23:14:07 2025 +0800 selftests/bpf: Add test to verify freeing the special fields in pcpu maps Add test to verify that updating [lru_,]percpu_hash maps decrements refcount when BPF_KPTR_REF objects are involved. The tests perform the following steps: . Call update_elem() to insert an initial value. . Use bpf_refcount_acquire() to increment the refcount. . Store the node pointer in the map value. . Add the node to a linked list. . Probe-read the refcount and verify it is *2*. . Call update_elem() again to trigger refcount decrement. . Probe-read the refcount and verify it is *1*. Signed-off-by: Leon Hwang Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251105151407.12723-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit 6af6e49a76c9af7d42eb923703e7648cb2bf401a Author: Leon Hwang Date: Wed Nov 5 23:14:06 2025 +0800 bpf: Free special fields when update [lru_,]percpu_hash maps As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the map gets freed. Fix this by calling 'bpf_obj_free_fields()' after 'copy_map_value[,_long]()' in 'pcpu_copy_value()'. Fixes: 65334e64a493 ("bpf: Support kptrs in percpu hashmap and percpu LRU hashmap") Signed-off-by: Leon Hwang Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20251105151407.12723-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit ca2583412306ceda9304a7c4302fd9efbf43e963 Author: Lizhi Hou Date: Fri Nov 7 10:10:50 2025 -0800 accel/amdxdna: Fix deadlock between context destroy and job timeout Hardware context destroy function holds dev_lock while waiting for all jobs to complete. The timeout job also needs to acquire dev_lock, this leads to a deadlock. Fix the issue by temporarily releasing dev_lock before waiting for all jobs to finish, and reacquiring it afterward. Fixes: 4fd6ca90fc7f ("accel/amdxdna: Refactor hardware context destroy routine") Reviewed-by: Maciej Falkowski Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251107181050.1293125-1-lizhi.hou@amd.com commit 8d4ec3fbb15e97b58c395398c743453012bbb93f Author: Jim Quinlan Date: Wed Oct 29 15:36:15 2025 -0400 PCI: brcmstb: Add panic/die handler to driver Most PCIe HW returns 0xffffffff for failed reads on PCIe, but by default Broadcom's STB PCIe controller effects an abort. Some SoCs -- 7216 and its descendants -- have new HW that identifies error details. Add a simple handler to print diagnostic info in case the PCIe controller was the cause of the abort. Unfortunately, an abort still occurs. Read the error registers only when the PCIe bridge is active and the PCIe registers are accessible. Otherwise, a "die" event caused by something other than PCIe could cause an abort if the PCIe "die" handler tried to access registers when the bridge is off. Example error output: brcm-pcie 8b20000.pcie: Error: Mem Acc: 32bit, read, @0x38000000 brcm-pcie 8b20000.pcie: Type: TO=0 Abt=0 UnspReq=1 AccDsble=0 BadAddr=0 Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251029193616.3670003-3-james.quinlan@broadcom.com commit a3f00f24d67014721e4efed9238be77b5b67f6fe Author: Jim Quinlan Date: Wed Oct 29 15:36:14 2025 -0400 PCI: brcmstb: Add a way to indicate if PCIe bridge is active In a future commit, a new handler will be introduced that in part does reads and writes to some of the PCIe registers. When this handler is invoked, it is paramount that it does not do these register accesses when the PCIe bridge is inactive, as this will cause CPU abort errors. To solve this we keep a spinlock that guards a variable which indicates whether the bridge is on or off. When the bridge is on, access of the PCIe HW registers may proceed. Since there are multiple ways to reset the bridge, we introduce a general function to obtain the spinlock, call the specific function that is used for the specific SoC, sets the bridge active indicator variable, and releases the spinlock. Signed-off-by: Jim Quinlan Signed-off-by: Bjorn Helgaas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251029193616.3670003-2-james.quinlan@broadcom.com commit 6ff9385c07aa311f01f87307e6256231be7d8675 Author: Lizhi Hou Date: Fri Nov 7 10:11:15 2025 -0800 accel/amdxdna: Clear mailbox interrupt register during channel creation The mailbox interrupt register is not always cleared when a mailbox channel is created. This can leave stale interrupt states from previous operations. Fix this by explicitly clearing the interrupt register in the mailbox channel creation function. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Maciej Falkowski Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251107181115.1293158-1-lizhi.hou@amd.com commit 68f3d40ea0ce9fe3a26b9fd1d8ea734386bfb9ec Author: Mauro Carvalho Chehab Date: Tue Nov 11 17:25:11 2025 +0100 docs: parse-headers.rst: remove uneeded parenthesis As pointed by Randy, the parenthesis there is not needed and it violates the document coding style. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/linux-doc/9d709020-03fe-467c-be7f-d5ee251bb79a@infradead.org/ Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: commit 00fb4c73b67d36783c5ab95a830f0cf0142b9fc3 Author: Vignesh Raghavendra Date: Wed Nov 5 09:46:44 2025 -0600 arm64: dts: ti: k3-am62l: add initial reference board file Add the initial board file for the AM62L3's Evaluation Module. Reviewed-by: Dhruva Gole Signed-off-by: Bryan Brattlof Link: https://patch.msgid.link/20251105-am62lx-v8-3-496f353e8237@ti.com Signed-off-by: Vignesh Raghavendra commit 5f016758b0ab5ff8cd5952fc7a25d409d7cb73a3 Author: Vignesh Raghavendra Date: Wed Nov 5 09:46:43 2025 -0600 arm64: dts: ti: k3-am62l: add initial infrastructure Add the initial infrastructure needed for the AM62L. ALl of which can be found in the Technical Reference Manual (TRM) located here: https://www.ti.com/lit/pdf/sprujb4 Reviewed-by: Dhruva Gole Signed-off-by: Bryan Brattlof Link: https://patch.msgid.link/20251105-am62lx-v8-2-496f353e8237@ti.com Signed-off-by: Vignesh Raghavendra commit 398180f93cf3c7bb0ee3f512b139ad01843f3ddf Author: Sean Christopherson Date: Mon Nov 10 13:24:53 2025 -0800 KVM: TDX: Use struct_size to simplify tdx_get_capabilities() Use struct_size() instead of manually calculating the number of bytes to allocate for 'caps', including the nested flexible array, and copy all of 'caps' to user space with a single copy_to_user() call (thanks to the full size being provided by struct_size()). Signed-off-by: Thorsten Blum Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20251017213914.167301-1-thorsten.blum@linux.dev [sean: separate from swap of get_user() vs. kzalloc() ordering] Signed-off-by: Sean Christopherson commit 11b79f8318aefc7ddfd12668fd1d80bde1c9f7bc Author: Thorsten Blum Date: Fri Oct 17 23:39:14 2025 +0200 KVM: TDX: Check size of user's kvm_tdx_capabilities array before allocating When userspace is getting TDX capabilities, retrieve and check the number of user entries before allocating kernel scratch space to avoid having to unwind the allocation if get_user() fails or if 'user_caps' is too small to fit 'caps'. Signed-off-by: Thorsten Blum Tested-by: Rick Edgecombe Link: https://patch.msgid.link/20251017213914.167301-1-thorsten.blum@linux.dev [sean: split to separate patch] Signed-off-by: Sean Christopherson commit 8e1bf774ab18157cb8041628f2661aa12e425914 Merge: c3f42a6de708db d4c3ef56a1618c Author: Jens Axboe Date: Thu Nov 13 09:28:00 2025 -0700 Merge branch 'elevator-switch-6.19' into for-6.19/block Merge elevator switching improvements from Nilay: "This patchset reorganizes the elevator switch path used during both nr_hw_queues update and elv_iosched_store() operations to address a recently reported lockdep splat [1]. The warning highlights a locking dependency between ->freeze_lock and ->elevator_lock on pcpu_alloc_mutex, triggered when the Kyber scheduler dynamically allocates its private scheduling data. The fix is to ensure that such allocations occur outside the locked sections, thus eliminating the dependency chain. While working on this, it also became evident that the nr_hw_queue update code maintains two disjoint xarrays—one for elevator tags and another for elevator type—both serving the same purpose. Unifying these into a single elv_change_ctx structure improves clarity and maintainability. This series therefore implements five patches: The first perparatory patch unifies elevator tags and type xarrays. It combines both xarrays into a single struct elv_change_ctx, simplifying per-queue elevator state management. The second patch is aimed to group together all elevator-related resources that share the same lifetime and as a first step we move the elevator tags pointer from struct elv_change_ctx into the newly introduced struct elevator_resources. The subsequent patch extends the struct elevator_resources to include other elevator-related data. The third patch introduce ->alloc_sched_data and ->free_sched_data elevator ops which could be then used to safely allocate and free scheduler data. The fourth patch now builds upon the previous patch and starts using the newly introduced alloc/free sched data methods in the earlier patch during elevator switch and nr_hw_queue update. And while doing so, it's ensured that sched data allocation and free happens before we acquire ->freeze_lock and ->elevator_lock thus preventing its dependency on pcpu_alloc_mutex. The last patch of this series converts Kyber scheduler to use the new methods inroduced in the previous patch. It hooks Kyber’s scheduler data allocation and teardown logic from ->init_sched and ->exit_sched into the new methods, ensuring memory operations are performed outside locked sections. Together, these changes simplify the elevator switch logic and prevent the reported lockdep splat." Link: https://lore.kernel.org/linux-block/20251113090619.2030737-1-nilay@linux.ibm.com/ Signed-off-by: Jens Axboe * elevator-switch-6.19: block: define alloc_sched_data and free_sched_data methods for kyber block: use {alloc|free}_sched data methods block: introduce alloc_sched_data and free_sched_data elevator methods block: move elevator tags into struct elevator_resources block: unify elevator tags and type xarrays into struct elv_change_ctx commit d4c3ef56a1618cb7d55a4be74a09cda09165745a Author: Nilay Shroff Date: Thu Nov 13 14:28:22 2025 +0530 block: define alloc_sched_data and free_sched_data methods for kyber Currently, the Kyber elevator allocates its private data dynamically in ->init_sched and frees it in ->exit_sched. However, since ->init_sched is invoked during elevator switch after acquiring both ->freeze_lock and ->elevator_lock, it may trigger the lockdep splat [1] due to dependency on pcpu_alloc_mutex. To resolve this, move the elevator data allocation and deallocation logic from ->init_sched and ->exit_sched into the newly introduced ->alloc_sched_data and ->free_sched_data methods. These callbacks are invoked before acquiring ->freeze_lock and ->elevator_lock, ensuring that memory allocation happens safely without introducing additional locking dependencies. This change breaks the dependency chain involving pcpu_alloc_mutex and prevents the reported lockdep warning. [1] https://lore.kernel.org/all/CAGVVp+VNW4M-5DZMNoADp6o2VKFhi7KxWpTDkcnVyjO0=-D5+A@mail.gmail.com/ Reported-by: Changhui Zhong Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAGVVp+VNW4M-5DZMNoADp6o2VKFhi7KxWpTDkcnVyjO0=-D5+A@mail.gmail.com/ Tested-by: Yi Zhang Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Signed-off-by: Nilay Shroff Signed-off-by: Jens Axboe commit 0315476e78c050048e80f66334a310e5581b46bb Author: Nilay Shroff Date: Thu Nov 13 14:28:21 2025 +0530 block: use {alloc|free}_sched data methods The previous patch introduced ->alloc_sched_data and ->free_sched_data methods. This patch builds upon that by now using these methods during elevator switch and nr_hw_queue update. It's also ensured that scheduler-specific data is allocated and freed through the new callbacks outside of the ->freeze_lock and ->elevator_lock locking contexts, thereby preventing any dependency on pcpu_alloc_mutex. Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Signed-off-by: Nilay Shroff Signed-off-by: Jens Axboe commit 61019afdf6ac17c8e8f9c42665aa1fa82f04a3e2 Author: Nilay Shroff Date: Thu Nov 13 14:28:20 2025 +0530 block: introduce alloc_sched_data and free_sched_data elevator methods The recent lockdep splat [1] highlights a potential deadlock risk involving ->elevator_lock and ->freeze_lock dependencies on -pcpu_alloc_ mutex. The trace shows that the issue occurs when the Kyber scheduler allocates dynamic memory for its elevator data during initialization. To address this, introduce two new elevator operation callbacks: ->alloc_sched_data and ->free_sched_data. The subsequent patch would build upon these newly introduced methods to suppress lockdep splat[1]. [1] https://lore.kernel.org/all/CAGVVp+VNW4M-5DZMNoADp6o2VKFhi7KxWpTDkcnVyjO0=-D5+A@mail.gmail.com/ Signed-off-by: Nilay Shroff Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 04728ce90966c54417fd8120a3820104d18ba68d Author: Nilay Shroff Date: Thu Nov 13 14:28:19 2025 +0530 block: move elevator tags into struct elevator_resources This patch introduces a new structure, struct elevator_resources, to group together all elevator-related resources that share the same lifetime. As a first step, this change moves the elevator tag pointer from struct elv_change_ctx into the new struct elevator_resources. Additionally, rename blk_mq_alloc_sched_tags_batch() and blk_mq_free_sched_tags_batch() to blk_mq_alloc_sched_res_batch() and blk_mq_free_sched_res_batch(), respectively. Introduce two new wrapper helpers, blk_mq_alloc_sched_res() and blk_mq_free_sched_res(), around blk_mq_alloc_sched_tags() and blk_mq_free_sched_tags(). These changes pave the way for consolidating the allocation and freeing of elevator-specific resources into common helper functions. This refactoring improves encapsulation and prepares the code for future extensions, allowing additional elevator-specific data to be added to struct elevator_resources without cluttering struct elv_change_ctx. Subsequent patches will extend struct elevator_resources to include other elevator-related data. Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Signed-off-by: Nilay Shroff Signed-off-by: Jens Axboe commit 232143b605387b372dee0ec7830f93b93df5f67d Author: Nilay Shroff Date: Thu Nov 13 14:28:18 2025 +0530 block: unify elevator tags and type xarrays into struct elv_change_ctx Currently, the nr_hw_queues update path manages two disjoint xarrays — one for elevator tags and another for elevator type — both used during elevator switching. Maintaining these two parallel structures for the same purpose adds unnecessary complexity and potential for mismatched state. This patch unifies both xarrays into a single structure, struct elv_change_ctx, which holds all per-queue elevator change context. A single xarray, named elv_tbl, now maps each queue (q->id) in a tagset to its corresponding elv_change_ctx entry, encapsulating the elevator tags, type and name references. This unification simplifies the code, improves maintainability, and clarifies ownership of per-queue elevator state. Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Signed-off-by: Nilay Shroff Signed-off-by: Jens Axboe commit 62d785159c7a5ccfae87b5849b17e51cb8fce9b1 Author: Mauro Carvalho Chehab Date: Thu Nov 13 12:00:32 2025 +0100 docs: Makefile: update SPHINXDIRS documentation Since the beginning, SPHINXDIRS was meant to be used by any subdirectory inside Documentation/ that contains a file named index.rst on it. The typical usecase for SPHINXDIRS is help building subsystem-specific documentation, without needing to wait for the entire building (with can take 3 minutes with Sphinx 8.x and above, and a lot more with older versions). Yet, the documentation for such feature was written back in 2016, where almost all index.rst files were at the first level (Documentation/*/index.rst). Update the documentation to reflect the way it works. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <683469813350214da122c258063dd71803ff700b.1763031632.git.mchehab+huawei@kernel.org> commit b70d9d7dac873a3a101a1063db2bc97fa2dc29fa Author: Bryan Brattlof Date: Wed Nov 5 09:46:42 2025 -0600 dt-bindings: arm: ti: Add binding for AM62L SoCs Add the binding for TI's AM62L family of devices. Reviewed-by: Dhruva Gole Acked-by: Krzysztof Kozlowski Signed-off-by: Bryan Brattlof Link: https://patch.msgid.link/20251105-am62lx-v8-1-496f353e8237@ti.com Signed-off-by: Vignesh Raghavendra commit c3f42a6de708db6891879547b29cd0d84ad83c92 Merge: 7b2038b1b1d432 699122b590ebbc Author: Jens Axboe Date: Thu Nov 13 09:18:19 2025 -0700 Merge branch 'bcache-updates-6.19' into for-6.19/block Merge bcache updates from Coly for 6.19: "The major change is from me, which is to remove useless discard interface and code for cache device (not the backing device). And the last patch about gc latency is a cooperative result from Robert Pang (Google), Mingzhe Zou (Easystack) and me, by inspired from their previous works, I compose the final version and Robert prvides positive benchmark result. Marco contributes 2 patches to improve the usage of per-cpu system work queue. Gustavo contributes a patch to fix the not-at-end flexible-array member warning by gcc14. And Qianfeng contributes a code cleanup patch to remove redundant __GFP_NOWARN." Link: https://lore.kernel.org/linux-block/20251113053630.54218-1-colyli@fnnas.com/ Signed-off-by: Jens Axboe * bcache-updates-6.19: bcache: Avoid -Wflex-array-member-not-at-end warning bcache: WQ_PERCPU added to alloc_workqueue users bcache: replace use of system_wq with system_percpu_wq bcache: remove redundant __GFP_NOWARN bcache: reduce gc latency by processing less nodes and sleep less time bcache: remove discard sysfs interface document bcache: drop discard sysfs interface bcache: remove discard code from alloc.c bcache: get rid of discard code from journal commit 699122b590ebbc450737eebde3ab8f5b871cc7f0 Author: Gustavo A. R. Silva Date: Thu Nov 13 13:36:30 2025 +0800 bcache: Avoid -Wflex-array-member-not-at-end warning -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix the following warning: drivers/md/bcache/bset.h:330:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of MEMBERS that would otherwise follow it. This overlays the trailing MEMBER struct btree_iter_set stack_data[MAX_BSETS]; onto the FAM struct btree_iter::data[], while keeping the FAM and the start of MEMBER aligned. The static_assert() ensures this alignment remains, and it's intentionally placed immediately after the corresponding structures --no blank line in between. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit c0c808214249c32a8961999e0779b953095b0074 Author: Marco Crivellari Date: Thu Nov 13 13:36:29 2025 +0800 bcache: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit fd82071814d06c7b760fe8d90b932d8a66cffc63 Author: Marco Crivellari Date: Thu Nov 13 13:36:28 2025 +0800 bcache: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 21194c44b6bdf50a27a0e065683d94bae16f69cb Author: Qianfeng Rong Date: Thu Nov 13 13:36:27 2025 +0800 bcache: remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Acked-by: Coly Li Acked-by: Coly Li Signed-off-by: Jens Axboe commit 70bc173ce06be90b026bb00ea175567c91f006e4 Author: Coly Li Date: Thu Nov 13 13:36:26 2025 +0800 bcache: reduce gc latency by processing less nodes and sleep less time When bcache device is busy for high I/O loads, there are two methods to reduce the garbage collection latency, - Process less nodes in eac loop of incremental garbage collection in btree_gc_recurse(). - Sleep less time between two full garbage collection in bch_btree_gc(). This patch introduces to hleper routines to provide different garbage collection nodes number and sleep intervel time. - btree_gc_min_nodes() If there is no front end I/O, return 128 nodes to process in each incremental loop, otherwise only 10 nodes are returned. Then front I/O is able to access the btree earlier. - btree_gc_sleep_ms() If there is no synchronized wait for bucket allocation, sleep 100 ms between two incremental GC loop. Othersize only sleep 10 ms before incremental GC loop. Then a faster GC may provide available buckets earlier, to avoid most of bcache working threads from being starved by buckets allocation. The idea is inspired by works from Mingzhe Zou and Robert Pang, but much simpler and the expected behavior is more predictable. Signed-off-by: Coly Li Signed-off-by: Robert Pang Signed-off-by: Mingzhe Zou Signed-off-by: Jens Axboe commit 7bf90cd740bf87dd1692cf74d49bb1dc849dcd11 Author: Coly Li Date: Thu Nov 13 13:36:25 2025 +0800 bcache: remove discard sysfs interface document This patch removes documents of bcache discard sysfs interface, it drops discard related sections from, - Documentation/ABI/testing/sysfs-block-bcache - Documentation/admin-guide/bcache.rst Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 73a004f83cf024e785b74243ba9817a329423379 Author: Coly Li Date: Thu Nov 13 13:36:24 2025 +0800 bcache: drop discard sysfs interface Since discard code is removed, now the sysfs interface to enable discard is useless. This patch removes the corresponding sysfs entry, and remove bool variable 'discard' from struct cache as well. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit b4056afbd4b90f5bdbdc53cca2768f9b8872a2dd Author: Coly Li Date: Thu Nov 13 13:36:23 2025 +0800 bcache: remove discard code from alloc.c Bcache allocator initially has no free space to allocate. Firstly it does a garbage collection which is triggered by a cache device write and fills free space into ca->free[] lists. The discard happens after the free bucket is handled by garbage collection added into one of the ca->free[] lists. But normally this bucket will be allocated out very soon to requester and filled data onto it. The discard hint on this bucket LBA range doesn't help SSD control to improve internal erasure performance, and waste extra CPU cycles to issue discard bios. This patch removes the almost-useless discard code from alloc.c. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit 0c72e9fcc156caaf123a6291321bc9bd74cd1b61 Author: Coly Li Date: Thu Nov 13 13:36:22 2025 +0800 bcache: get rid of discard code from journal In bcache journal there is discard functionality but almost useless in reality. Because discard happens after a journal bucket is reclaimed, and the reclaimed bucket is allocated for new journaling immediately. There is no time for underlying SSD to use the discard hint for internal data management. The discard code in bcache journal doesn't bring any performance optimization and wastes CPU cycles for issuing discard bios. Therefore this patch gits rid of it from journal.c and journal.h. Signed-off-by: Coly Li Signed-off-by: Jens Axboe commit f64c7e113dc937e0987c83ef51a3cd52a2c277c7 Author: Mauro Carvalho Chehab Date: Thu Nov 13 10:53:43 2025 +0100 scripts: docs: kdoc_files.py: don't consider symlinks as directories As reported by Randy, currently kdoc_files can go into endless looks when symlinks are used: $ ln -s . Documentation/peci/foo $ ./scripts/kernel-doc Documentation/peci/ ... File "/new_devel/docs/scripts/lib/kdoc/kdoc_files.py", line 52, in _parse_dir if entry.is_dir(): ~~~~~~~~~~~~^^ OSError: [Errno 40] Too many levels of symbolic links: 'Documentation/peci/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo/foo' Prevent that by not considering symlinks as directories. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/linux-doc/80701524-09fd-4d68-8715-331f47c969f2@infradead.org/ Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <73c3450f34e2a4b42ef2ef279d7487c47d22e3bd.1763027622.git.mchehab+huawei@kernel.org> commit 9f748a6177e1fba8b27588e6ac6721e129f097de Author: João Paulo Gonçalves Date: Tue Nov 11 18:54:59 2025 +0100 arm64: dts: ti: am69-aquila: Add Clover Add support for Aquila AM69 mated with Clover carrier board. Link: https://www.toradex.com/computer-on-modules/aquila-arm-family/ti-am69 Link: https://www.toradex.com/products/carrier-board/clover Signed-off-by: João Paulo Gonçalves Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20251111175502.8847-4-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 39ac6623b1d85fdc8b142c26991339fcad270606 Author: Parth Pancholi Date: Tue Nov 11 18:54:58 2025 +0100 arm64: dts: ti: Add Aquila AM69 Support Add support for the Toradex Aquila AM69 and its Development Carrier Board. The Aquila AM69 SoM is based on the TI AM69 SoC from the Jacinto 7 family and is designed for high-end embedded computing, featuring up to 32GB of LPDDR4 and 256GB eMMC storage, extensive multimedia support (3x Quad CSI, 2x Quad DSI, DisplayPort, 5x Audio I2S/TDM), six Ethernet interfaces (1x 1G, 4x 2.5G SGMII, 1x 10G), USB 3.2 Host/DRD support, and a Wi-Fi 7/BT 5.3 module, alongside an RX8130 RTC, I2C EEPROM and Temperature Sensor, and optional TPM 2.0 module. Various nodes, inherited from the SoC dtsi, are explicitly disabled in the SoM dtsi file (`status = disabled`) even if already disabled. These nodes need to be disabled in the SoM, given that the node is not complete there, explicitly disabling it limits the dependency on the SoC dtsi allowing for refactoring without no impact on this file. Link: https://www.toradex.com/computer-on-modules/aquila-arm-family/ti-am69 Link: https://www.toradex.com/products/carrier-board/aquila-development-board-kit Signed-off-by: Parth Pancholi Co-developed-by: Emanuele Ghidoli Signed-off-by: Emanuele Ghidoli Co-developed-by: Ernest Van Hoecke Signed-off-by: Ernest Van Hoecke Co-developed-by: João Paulo Gonçalves Signed-off-by: João Paulo Gonçalves Co-developed-by: Francesco Dolcini Signed-off-by: Francesco Dolcini Link: https://patch.msgid.link/20251111175502.8847-3-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 2f6ef830a756f58312b3f3bbe3c1edb739e84ec5 Author: João Paulo Gonçalves Date: Tue Nov 11 18:54:57 2025 +0100 dt-bindings: arm: ti: add Toradex Aquila AM69 Add DT compatible strings for the Toradex Aquila AM69 SoM and its supported carrier boards: the Aquila Development Board and the Clover carrier board. Link: https://www.toradex.com/computer-on-modules/aquila-arm-family/ti-am69 Link: https://www.toradex.com/products/carrier-board/aquila-development-board-kit Link: https://www.toradex.com/products/carrier-board/clover Signed-off-by: João Paulo Gonçalves Signed-off-by: Francesco Dolcini Acked-by: Conor Dooley Link: https://patch.msgid.link/20251111175502.8847-2-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 3d2492401d3cdb8e9e1276c3af5f1cd0c8a2b076 Author: Christoph Hellwig Date: Thu Nov 13 09:39:46 2025 +0100 mempool: factor out a mempool_adjust_gfp helper Add a helper to better isolate and document the gfp flags adjustments. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-6-hch@lst.de Signed-off-by: Vlastimil Babka commit b77fc08e393b77883bcb71825cfd49e44da44022 Author: Christoph Hellwig Date: Thu Nov 13 09:39:45 2025 +0100 mempool: add error injection support Add a call to should_fail_ex that forces mempool to actually allocate from the pool to stress the mempool implementation when enabled through debugfs. By default should_fail{,_ex} prints a very verbose stack trace that clutters the kernel log, slows down execution and triggers the kernel bug detection in xfstests. Pass FAULT_NOWARN and print a single-line message notating the caller instead so that full tests can be run with fault injection. Signed-off-by: Christoph Hellwig Acked-by: Vlastimil Babka Link: https://patch.msgid.link/20251113084022.1255121-5-hch@lst.de Signed-off-by: Vlastimil Babka commit 5c829783e5f8dbb7ca6fce50c5c4a33f7c75d0d4 Author: Christoph Hellwig Date: Thu Nov 13 09:39:44 2025 +0100 mempool: improve kerneldoc comments Use proper formatting, use full sentences and reduce some verbosity in function parameter descriptions. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-4-hch@lst.de Signed-off-by: Vlastimil Babka commit e9939cebc0be8dabb1798b357e9dadf6398fa859 Author: Christoph Hellwig Date: Thu Nov 13 09:39:43 2025 +0100 mm: improve kerneldoc comments for __alloc_pages_bulk Describe the semantincs in more detail, as the filling empty slots in an array scheme is not quite obvious. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-3-hch@lst.de Signed-off-by: Vlastimil Babka commit 0f2620ffc41d117cc28bc053efe2dc837cf748dd Author: Christoph Hellwig Date: Thu Nov 13 09:39:42 2025 +0100 fault-inject: make enum fault_flags available unconditionally This will allow using should_fail_ex from code without having to make it conditional on CONFIG_FAULT_INJECTION. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251113084022.1255121-2-hch@lst.de Signed-off-by: Vlastimil Babka commit 7b2038b1b1d4322a851ce7ee378ebf85a03bb1a1 Author: Damien Le Moal Date: Thu Nov 13 22:40:28 2025 +0900 dm: fix zone reset all operation processing dm_zone_get_reset_bitmap() is used to generate a bitmap of the zones of a zoned device target when a REQ_OP_ZONE_RESET_ALL request is being processed. This bitmap is built by executing a zone report with a report callback set to the function dm_zone_need_reset_cb() in struct dm_report_zones_args. However, the cb callback pointer is not anymore the same as the callback specified by callers of the blkdev_report_zones() function. Rather, this is a DM internal callback and report zones callback functions from blkdev_report_zones() are passed using struct blk_report_zones_args, introduced with commit db9aed869f34 ("block: introduce disk_report_zone()"). This commit changed the DM main report zones callback handler function dm_report_zones_cb() to call the new disk_report_zone() so that callback functions from blkdev_report_zones() are executed, and this change resulted in the DM internal dm_zone_need_reset_cb() callback function to not be executed anymore, turning any REQ_OP_ZONE_RESET_ALL request into a no-op. Fix this by calling in dm_report_zones_cb() the DM internal cb function specified in struct dm_report_zones_args. Fixes: db9aed869f34 ("block: introduce disk_report_zone()"). Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 881880b6f3079c79e4306630dcb8d05bc7de1793 Author: Damien Le Moal Date: Thu Nov 13 22:40:27 2025 +0900 block: fix NULL pointer dereference in disk_report_zones() Commit 2284eec5053d ("block: introduce blkdev_get_zone_info()") introduced the report_active field in struct blk_report_zones_args so that open and closed zones can be reported with the condition BLK_ZONE_COND_ACTIVE in the case of a cached report zone. However, the args pointer to a struct blk_report_zones_args that is passed to disk_report_zones() can be NULL, e.g. in the case of internal report zones operations for device mapper zoned targets. Fix disk_report_zones() to make sure to check that the args is not null before updating a zone condition for cached zone reports. Fixes: 2284eec5053d ("block: introduce blkdev_get_zone_info()") Reported-by: Shin'ichiro Kawasaki Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit c2b8d20628ca789640f64074a642f9440eefc623 Author: Damien Le Moal Date: Thu Nov 13 22:40:26 2025 +0900 block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() For zoned block devices that do not need zone write plugs (e.g. most device mapper devices that support zones), the disk hash table of zone write plugs is NULL. For such devices, blk_zone_reset_all_bio_endio() should not attempt to scan this has table as that causes a NULL pointer dereference. Fix this by checking that the disk does have zone write plugs using the atomic counter. This is equivalent to checking for a non-NULL hash table but has the advantage to also speed up the execution of blk_zone_reset_all_bio_endio() for devices that do use zone write plugs but do not have any plug in the hash table (e.g. a disk with only full zones). Fixes: efae226c2ef1 ("block: handle zone management operations completions") Reported-by: Shin'ichiro Kawasaki Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 65a4ee23e057f60d25c3436acd88f2f169f780c2 Author: Andreas Kemnade Date: Thu Nov 6 10:00:25 2025 +0100 dt-bindings: mfd: twl: Enable power button also for TWL603X TWL603x has also a power button function, so add the corresponding subnode. As not in all cases there is a power button connected to the corresponding pad of the TWL603x, the functionality can be disabled by status = "disabled" or simply not adding the subnode. To keep things simple, follow the established design pattern of using const interrupts as used also by the other subdevices. Signed-off-by: Andreas Kemnade Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20251106-twl6030-button-v4-1-fdf1aa6e1e9a@kernel.org Signed-off-by: Lee Jones commit f694d215d34035cc64b1d176fd82db0d1f2428d4 Author: Russell King (Oracle) Date: Tue Nov 11 11:26:44 2025 +0000 net: stmmac: always allocate mac_device_info The ->setup() method implemented by dwmac-loongson and dwmac-sun8i allocate the mac_device_info structure, as does stmmac_hwif_init(). This makes no sense. Have stmmac_hwif_init() always allocate this structure, and pass it to the ->setup() method to initialise when it is provided. Rename this method to "mac_setup" to more accurately describe what it is doing. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vImWK-0000000DrIx-28vO@rmk-PC.armlinux.org.uk Signed-off-by: Paolo Abeni commit d0af55df5a786cb8f11ca1923cd7dc8b2af01309 Author: Russell King (Oracle) Date: Tue Nov 11 11:26:39 2025 +0000 net: stmmac: clean up stmmac_reset() stmmac_reset() takes the stmmac_priv and an ioaddr. It has one call site, which passes the priv pointer, and dereferences priv for the ioaddr. stmmac_reset() then checks whether priv is NULL. If it was, the caller would have oopsed. Remove the checks for NULL, and move the dereference for ioaddr into stmmac_reset(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vImWF-0000000DrIr-1fmn@rmk-PC.armlinux.org.uk Signed-off-by: Paolo Abeni commit 1b214452b6a725a1451b244bd2baf537954863c5 Author: Linu Cherian Date: Fri Oct 17 10:44:37 2025 +0530 arm64/mm: Rename try_pgd_pgtable_alloc_init_mm With BUG_ON in pgd_pgtable_alloc_init_mm moved up to higher layer, gfp flags is the only difference between try_pgd_pgtable_alloc_init_mm and pgd_pgtable_alloc_init_mm. Hence rename the "try" version to pgd_pgtable_alloc_init_mm_gfp. Reviewed-by: Dev Jain Reviewed-by: Ryan Roberts Reviewed-by: Kevin Brodsky Signed-off-by: Linu Cherian Reviewed-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit bfc184cb1ba7226b21ab26f0b220581895c5ac9e Author: Chaitanya S Prakash Date: Fri Oct 17 10:44:36 2025 +0530 arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors arch_add_memory() is used to hotplug memory into a system but as a part of its implementation it calls __create_pgd_mapping(), which uses pgtable_alloc() in order to build intermediate page tables. As this path was initally only used during early boot pgtable_alloc() is designed to BUG_ON() on failure. However, in the event that memory hotplug is attempted when the system's memory is extremely tight and the allocation were to fail, it would lead to panicking the system, which is not desirable. Hence update __create_pgd_mapping and all it's callers to be non void and propagate -ENOMEM on allocation failure to allow system to fail gracefully. But during early boot if there is an allocation failure, we want the system to panic, hence create a wrapper around __create_pgd_mapping() called early_create_pgd_mapping() which is designed to panic, if ret is non zero value. All the init calls are updated to use this wrapper rather than the modified __create_pgd_mapping() to restore functionality. Fixes: 4ab215061554 ("arm64: Add memory hotplug support") Reviewed-by: Dev Jain Reviewed-by: Ryan Roberts Reviewed-by: Kevin Brodsky Signed-off-by: Chaitanya S Prakash Signed-off-by: Linu Cherian Reviewed-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit b0a3f0e894f34e01f14770113f86019b1ef96040 Author: Anshuman Khandual Date: Mon Oct 13 10:59:44 2025 +0530 arm64/sysreg: Replace TCR_EL1 field macros This just replaces all used TCR_EL1 field macros with tools sysreg variant based fields and subsequently drops them from the header (pgtable-hwdef.h), although while retaining the ones used for KVM (represented via the sysreg tools format). Cc: Will Deacon Cc: Mark Brown Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit 88aa23c12888348bb4910e75a6088f0affc86923 Author: Marco Crivellari Date: Wed Nov 5 12:19:24 2025 +0100 leds: trigger: Replace use of system_wq() with system_percpu_wq() Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251105111924.141555-1-marco.crivellari@suse.com Signed-off-by: Lee Jones commit 5c17042d6ce7490477eb11b7f90983adbcb5fa0c Author: Lukas Bulwahn Date: Wed Oct 29 11:42:28 2025 +0100 MAINTAINERS: Adjust file entry in NXP PF1550 PMIC MFD DRIVER Commit ebaec90ec0b5 ("mfd: pf1550: Add core driver for the PF1550 PMIC") adds the header file pf1550.h in include/linux/mfd/, and commit a7d6255a0bf3 ("MAINTAINERS: Add an entry for PF1550 MFD driver") adds a new section NXP PF1550 PMIC MFD DRIVER intending to refer to that header file. It however adds the entry for pfd1550.h; note the additional letter in the filename. Adjust the file entry to refer to the intended file. Signed-off-by: Lukas Bulwahn Reviewed-by: Samuel Kayode Link: https://patch.msgid.link/20251029104228.95498-1-lukas.bulwahn@redhat.com Signed-off-by: Lee Jones commit 482dc84e91a597149949f18c8eefb49cb2dc1bee Merge: 87c69670daba10 d6602e25819dea Author: Dave Jiang Date: Thu Nov 13 08:47:49 2025 -0700 Merge branch 'for-6.19/cxl-elc' into cxl-for-next - Add extended linear cache size sysfs attribute. - Adjust failure emission of extended linear cache detection in cxl_acpi. commit 87c69670daba100809144e637bc29335c48231cc Merge: 2be575434e4202 06377c54a13362 Author: Dave Jiang Date: Thu Nov 13 08:44:00 2025 -0700 Merge branch 'for-6.19/cxl-addr-xlat' into cxl-for-next Enable unit testing for XOR address translation of SPA to DPA and vice versa. commit 2be575434e420223dbdb68bbc717cb7af42c5c9b Merge: e9a6fb0bcdd760 8d27dd0b219f00 Author: Dave Jiang Date: Thu Nov 13 08:42:46 2025 -0700 Merge branch 'for-6.19/cxl-misc' into cxl-for-next Misc patches for CXL 6.19 - Remove incorrect page-allocator quirk section in documentation. - Remove unused devm_cxl_port_enumerate_dports() function. - Fix typo in cdat.c code comment. - Replace use of system_wq with system_percpu_wq - Add locked decoder support - Return when generic target updated - Rename region_res_match_cxl_range() to spa_maps_hpa() - Clarify comment in spa_maps_hpa() commit 7e06063a43d317c1ca9278b6662555f687f43f03 Author: Mostafa Saleh Date: Mon Nov 3 12:33:52 2025 +0000 iommu/io-pgtable-arm-selftests: Use KUnit Integrate the selftests as part of kunit. Now instead of the test only being run at boot, it can run: - With CONFIG_IOMMU_IO_PGTABLE_LPAE_KUNIT_TEST=y It will automatically run at boot as before. - Otherwise with CONFIG_IOMMU_IO_PGTABLE_LPAE_KUNIT_TEST=m: 1) on module load: Once the module load the self test will run # modprobe io-pgtable-arm-selftests 2) debugfs With CONFIG_KUNIT_DEBUGFS=y You can run the test with # echo 1 > /sys/kernel/debug/kunit/io-pgtable-arm-test/run 3) Using kunit.py You can also use the helper script which uses Qemu in the background # ./tools/testing/kunit/kunit.py run --build_dir build_kunit_arm64 --arch arm64 \ --make_options LLVM=1 --kunitconfig ./kunit/kunitconfig [18:01:09] ============= io-pgtable-arm-test (1 subtest) ============== [18:01:09] [PASSED] arm_lpae_do_selftests [18:01:09] =============== [PASSED] io-pgtable-arm-test =============== [18:01:09] ============================================================ Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Mostafa Saleh Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit a3c24b6d7cd6047fb9e234586e484391be335b4f Author: Mostafa Saleh Date: Mon Nov 3 12:33:51 2025 +0000 iommu/io-pgtable-arm-selftests: Modularize the test Remove the __init constraint, as the test will be converted to KUnit, it can run on-demand after later. Also, as KUnit can be a module, make this test modular. Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Mostafa Saleh Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit 699b059962add22b2a324645b6ae2a607fc1a93e Author: Mostafa Saleh Date: Mon Nov 3 12:33:50 2025 +0000 iommu/io-pgtable-arm: Move selftests to a separate file Clean up the io-pgtable-arm library by moving the selftests out. Next the tests will be registered with kunit. This is useful also to factor out kernel specific code out, so it can compiled as part of the hypervisor object. Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Mostafa Saleh Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit d8546833cfeeaa87c2a32ba4c3f2eb3d020c3ed4 Author: Mostafa Saleh Date: Mon Nov 3 12:33:49 2025 +0000 iommu/io-pgtable-arm: Remove arm_lpae_dump_ops() At the moment, if the selftest fails it prints a lot of information about the page table (size, levels...) this requires access to many internals, which has to be exposed in the next patch moving the tests out. Instead, we can simplify the print to only print the fmt and for each test ias, oas and pgsize_bitmap are already printed. That is enough to identify the failed case, and the rest can be deduced from the code. Signed-off-by: Mostafa Saleh Reviewed-by: Jason Gunthorpe Acked-by: Will Deacon Signed-off-by: Joerg Roedel commit 92f4b016dcb955cc0bb3942ac217cff6fe450a57 Author: Thorsten Blum Date: Mon Nov 3 13:08:09 2025 +0100 leds: led-class: Replace sprintf() with sysfs_emit() in sysfs show functions Replace sprintf() with sysfs_emit() in sysfs show functions. sysfs_emit() is preferred to format sysfs output as it provides better bounds checking. No functional changes. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251103120809.32834-1-thorsten.blum@linux.dev Signed-off-by: Lee Jones commit 70a6d820c898fc02abb7433820ed1494431d1acf Author: Samuel Kayode Date: Sun Nov 2 22:19:08 2025 -0500 MAINTAINERS: Update PF1550 driver email address Update Sam's email address for the PF1550 PMIC driver. Signed-off-by: Samuel Kayode Link: https://patch.msgid.link/20251102-update-email-v3-1-8e2c4a4507f4@gmail.com Signed-off-by: Lee Jones commit 75ba146c2674ba49ed8a222c67f9abfb4a4f2a4f Author: Jinhui Guo Date: Tue Oct 28 00:50:17 2025 +0800 iommu/amd: Fix pci_segment memleak in alloc_pci_segment() Fix a memory leak of struct amd_iommu_pci_segment in alloc_pci_segment() when system memory (or contiguous memory) is insufficient. Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table") Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table") Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table") Cc: stable@vger.kernel.org Signed-off-by: Jinhui Guo Signed-off-by: Joerg Roedel commit d1e281f832fcadad3c3f6c8c5f998aadd7cb33a5 Author: Dheeraj Kumar Srivastava Date: Thu Nov 13 02:43:50 2025 +0530 iommu/amd: Enhance "Completion-wait Time-out" error message Current IOMMU driver prints "Completion-wait Time-out" error message with insufficient information to further debug the issue. Enhancing the error message as following: 1. Log IOMMU PCI device ID in the error message. 2. With "amd_iommu_dump=1" kernel command line option, dump entire command buffer entries including Head and Tail offset. Dump the entire command buffer only on the first 'Completion-wait Time-out' to avoid dmesg spam. Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Ankit Soni Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 27376465e945c11ad13c1e1d877ed318be010062 Author: Dave Hansen Date: Mon Nov 3 15:44:39 2025 -0800 KVM: TDX: Fix sparse warnings from using 0 for NULL Stop using 0 for NULL. sparse moans: ... arch/x86/kvm/vmx/tdx.c:859:38: warning: Using plain integer as NULL pointer for several TDX pointer initializations. While I love a good ptr=0 now and then, it's good to have quiet sparse builds. Signed-off-by: Dave Hansen Fixes: a50f673f25e0 ("KVM: TDX: Do TDX specific vcpu initialization") Fixes: 8d032b683c29 ("KVM: TDX: create/destroy VM structure") Reviewed-by: Rick Edgecombe Cc: Xiaoyao Li Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: x86@kernel.org Cc: "H. Peter Anvin" Cc: "Kirill A. Shutemov" Cc: Rick Edgecombe Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Xiaoyao Li Acked-by: Kiryl Shutsemau Link: https://patch.msgid.link/20251103234439.DC8227E4@davehans-spike.ostc.intel.com Signed-off-by: Sean Christopherson commit 228add34dc2f197539c497bf5573d75cd58f5c61 Author: Dave Hansen Date: Mon Nov 3 15:44:37 2025 -0800 KVM: TDX: Remove __user annotation from kernel pointer Separate __user pointer variable declaration from kernel one. There are two 'kvm_cpuid2' pointers involved here. There's an "input" side: 'td_cpuid' which is a normal kernel pointer and an 'output' side. The output here is userspace and there is an attempt at properly annotating the variable with __user: struct kvm_cpuid2 __user *output, *td_cpuid; But, alas, this is wrong. The __user in the definition applies to both 'output' and 'td_cpuid'. Sparse notices the address space mismatch and will complain about it. Fix it up by completely separating the two definitions so that it is obviously correct without even having to know what the C syntax rules even are. Signed-off-by: Dave Hansen Fixes: 488808e682e7 ("KVM: x86: Introduce KVM_TDX_GET_CPUID") Reviewed-by: Rick Edgecombe Cc: Xiaoyao Li Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: x86@kernel.org Cc: "H. Peter Anvin" Cc: "Kirill A. Shutemov" Cc: Rick Edgecombe Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Xiaoyao Li Acked-by: Kiryl Shutsemau Link: https://patch.msgid.link/20251103234437.A0532420@davehans-spike.ostc.intel.com Signed-off-by: Sean Christopherson commit 9a89894f30d5795c5ac46a9ee9c009d610306025 Author: Rick Edgecombe Date: Mon Oct 27 17:28:24 2025 -0700 KVM: TDX: Take MMU lock around tdh_vp_init() Take MMU lock around tdh_vp_init() in KVM_TDX_INIT_VCPU to prevent meeting contention during retries in some no-fail MMU paths. The TDX module takes various try-locks internally, which can cause SEAMCALLs to return an error code when contention is met. Dealing with an error in some of the MMU paths that make SEAMCALLs is not straight forward, so KVM takes steps to ensure that these will meet no contention during a single BUSY error retry. The whole scheme relies on KVM to take appropriate steps to avoid making any SEAMCALLs that could contend while the retry is happening. Unfortunately, there is a case where contention could be met if userspace does something unusual. Specifically, hole punching a gmem fd while initializing the TD vCPU. The impact would be triggering a KVM_BUG_ON(). The resource being contended is called the "TDR resource" in TDX docs parlance. The tdh_vp_init() can take this resource as exclusive if the 'version' passed is 1, which happens to be version the kernel passes. The various MMU operations (tdh_mem_range_block(), tdh_mem_track() and tdh_mem_page_remove()) take it as shared. There isn't a KVM lock that maps conceptually and in a lock order friendly way to the TDR lock. So to minimize infrastructure, just take MMU lock around tdh_vp_init(). This makes the operations we care about mutually exclusive. Since the other operations are under a write mmu_lock, the code could just take the lock for read, however this is weirdly inverted from the actual underlying resource being contended. Since this is covering an edge case that shouldn't be hit in normal usage, be a little less weird and take the mmu_lock for write around the call. Fixes: 02ab57707bdb ("KVM: TDX: Implement hooks to propagate changes of TDP MMU mirror page table") Reported-by: Yan Zhao Suggested-by: Yan Zhao Link: https://patch.msgid.link/20251028002824.1470939-1-rick.p.edgecombe@intel.com Signed-off-by: Rick Edgecombe [sean: tweak comment and capture PUNCH_HOLE interaction] Signed-off-by: Sean Christopherson commit d2b09520a1d0f217637cf6d4fdd8a19a0f2f7ef3 Author: Luca Weiss Date: Thu Oct 23 13:32:26 2025 +0200 dt-bindings: mfd: qcom-spmi-pmic: Document PM7550 PMIC Document the compatible string for the PM7550 PMIC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251023-sm7635-pmxr2230-v3-2-f70466c030fe@fairphone.com Signed-off-by: Lee Jones commit c42b91c426a12523b8d02bc6041f7931f199a301 Author: Luca Weiss Date: Thu Oct 23 13:32:25 2025 +0200 dt-bindings: leds: qcom,spmi-flash-led: Add PM7550 Document compatible for PM7550 Torch and Flash LED controller. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251023-sm7635-pmxr2230-v3-1-f70466c030fe@fairphone.com Signed-off-by: Lee Jones commit 02a3bf382418e517dfb3072d0567dfda6c7b280d Author: Luca Weiss Date: Thu Oct 23 13:29:01 2025 +0200 dt-bindings: mfd: qcom,spmi-pmic: Document PMIV0104 Add the PMIV0104 PMIC which is found on e.g. boards with Milos SoCs. Signed-off-by: Luca Weiss Acked-by: Krzysztof Kozlowski Reviewed-by: Bjorn Andersson Link: https://patch.msgid.link/20251023-sm7635-pmiv0104-v3-1-27f1c417376d@fairphone.com Signed-off-by: Lee Jones commit b73d5593bfde6bf570d55bcff3576e35cdf4ec9a Author: Dan Carpenter Date: Sun Nov 2 14:59:22 2025 +0300 mfd: syscon: Return -EPROBE_DEFER if the syscon is not found These days we can register syscons with of_syscon_register_regmap() so when we can't find the syscon that probably means it hasn't been registered yet. Return -EPROBE_DEFER so the driver will try probing again. Signed-off-by: Dan Carpenter Reviewed-by: Arnd Bergmann Reviewed-by: Chen-Yu Tsai Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/aQdHmrchkmOr34r3@stanley.mountain Signed-off-by: Lee Jones commit d741c6255524f0691aea53381219fadcd2b38408 Author: Pavel Begunkov Date: Wed Nov 12 12:45:59 2025 +0000 io_uring: move cq/sq user offset init around Move user SQ/CQ offset initialisation at the end of io_prepare_config() where it already calculated all information to set it properly. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit eb76ff6a6829a9a54a385804cc9dbe4460f156d6 Author: Pavel Begunkov Date: Wed Nov 12 12:45:58 2025 +0000 io_uring: pre-calculate scq layout Move ring layouts calculations into io_prepare_config(), so that more misconfiguration checking can be done earlier before creating a ctx. It also deduplicates some code with ring resizing. And as a bonus, now it initialises params->sq_off.array, which is closer to all other user offset init, and also applies it to ring resizing, which was previously missing it. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 001b76b7e755767d847e9aebf1fd6e525f1e58c8 Author: Pavel Begunkov Date: Wed Nov 12 12:45:57 2025 +0000 io_uring: keep ring laoyut in a structure Add a structure keeping SQ/CQ sizes and offsets. For now it only records data previously returned from rings_size and the SQ size. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 0f4b537363cb66c78e97bb58c26986af62856356 Author: Pavel Begunkov Date: Wed Nov 12 12:45:56 2025 +0000 io_uring: introduce struct io_ctx_config There will be more information needed during ctx setup, and instead of passing a handful of pointers around, wrap them all into a new structure. Add a helper for encapsulating all configuration checks and preparation, that's also reused for ring resizing. Note, it indirectly adds a io_uring_sanitise_params() check to ring resizing, which is a good thing. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 929dbbb699110c9377da721ed7b44a660bb4ee01 Author: Pavel Begunkov Date: Wed Nov 12 12:45:55 2025 +0000 io_uring: convert params to pointer in ring reisze The parameters in io_register_resize_rings() will be moved into another structure in a later patch. In preparation to that, convert the params variable it to a pointer, but still store the data on stack. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 94cd832916521d8d51b25b40691354c24831c655 Author: Pavel Begunkov Date: Wed Nov 12 12:45:54 2025 +0000 io_uring: use size_add helpers for ring offsets Use size_add / size_mul set of functions for rings_size() calculations. It's more consistent with struct_size(), and errors are preserved across a series of calculations, so intermediate result checks can be omitted. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit e279bb4b4c4d012808fb21ff41183a2e76c26679 Author: Pavel Begunkov Date: Wed Nov 12 12:45:53 2025 +0000 io_uring: refactor rings_size nosqarray handling A preparation patch inversing the IORING_SETUP_NO_SQARRAY check, this way there is only one successful return path from the function, which will be helpful later. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit ecb8490b2f4393550a2651f547b7fa67490c4881 Merge: 712fbe97c3322c 2d0e88f3fd1dcb Author: Jens Axboe Date: Thu Nov 13 07:26:37 2025 -0700 Merge branch 'io_uring-6.18' into for-6.19/io_uring Merge 6.18-rc io_uring fixes, as certain coming changes depend on some of these. * io_uring-6.18: io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs io_uring/query: return number of available queries io_uring/rw: ensure allocated iovec gets cleared for early failure io_uring: fix regbuf vector size truncation io_uring: fix types for region size calulation io_uring/zcrx: remove sync refill uapi io_uring: fix buffer auto-commit for multishot uring_cmd io_uring: correct __must_hold annotation in io_install_fixed_file io_uring zcrx: add MAINTAINERS entry io_uring: Fix code indentation error io_uring/sqpoll: be smarter on when to update the stime usage io_uring/sqpoll: switch away from getrusage() for CPU accounting io_uring: fix incorrect unlikely() usage in io_waitid_prep() Signed-off-by: Jens Axboe commit 9f07af1d274223a4314b5e2e6d395a78166c24c5 Author: Heiner Kallweit Date: Mon Nov 10 22:20:26 2025 +0100 net: phy: fixed_phy: initialize the link status as up All callers initialize the link status as up. This change is in line with how of_phy_register_fixed_link() behaves. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/45f644e8-2292-4787-a27a-f69084c93218@gmail.com Signed-off-by: Paolo Abeni commit 0709abaf67345b3a8966198fc0957fcc361b065f Author: Thomas Zimmermann Date: Tue Nov 4 16:38:05 2025 +0100 drm/imx/ipuv3: Fix dumb-buffer allocation for non-RGB formats Align pitch to multiples of 8 pixels for bpp values that do not map to RGB formats. The call to drm_driver_color_mode_format() fails with DRM_INVALID_FORMAT in these cases. Fall back to manually computing the pitch alignment from which drm_mode_size_dumb() can compute the correct pitch. Fixes userspace that allocates dumb buffers for YUV formats, where bpp equals 12. A common example is the IGT kms_getfb test. v2: - ignore width in calculation Suggested-by: Dmitry Baryshkov Signed-off-by: Thomas Zimmermann Fixes: b1d0e470f881 ("drm/imx/ipuv3: Compute dumb-buffer sizes with drm_mode_size_dumb()") Cc: Thomas Zimmermann Cc: Philipp Zabel Cc: Shawn Guo Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Fabio Estevam Cc: dri-devel@lists.freedesktop.org Cc: imx@lists.linux.dev Cc: linux-arm-kernel@lists.infradead.org Tested-by: Philipp Zabel Reviewed-by: Philipp Zabel Link: https://patch.msgid.link/20251104153832.189666-1-tzimmermann@suse.de commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 Author: Bernd Schubert Date: Thu Oct 23 00:21:18 2025 +0200 fuse: Always flush the page cache before FOPEN_DIRECT_IO write This was done as condition on direct_io_allow_mmap, but I believe this is not right, as a file might be open two times - once with write-back enabled another time with FOPEN_DIRECT_IO. Signed-off-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit b359af8275a982a458e8df6c6beab1415be1f795 Author: Bernd Schubert Date: Thu Oct 23 00:21:17 2025 +0200 fuse: Invalidate the page cache after FOPEN_DIRECT_IO write generic_file_direct_write() also does this and has a large comment about. Reproducer here is xfstest's generic/209, which is exactly to have competing DIO write and cached IO read. Signed-off-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 03865dd8af52eb16c38062df2ed30a91b604780e Author: Haotian Zhang Date: Fri Oct 31 10:16:20 2025 +0800 leds: netxbig: Fix GPIO descriptor leak in error paths The function netxbig_gpio_ext_get() acquires GPIO descriptors but fails to release them when errors occur mid-way through initialization. The cleanup callback registered by devm_add_action_or_reset() only runs on success, leaving acquired GPIOs leaked on error paths. Add goto-based error handling to release all acquired GPIOs before returning errors. Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors") Suggested-by: Markus Elfring Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251031021620.781-1-vulab@iscas.ac.cn Signed-off-by: Lee Jones commit 40a71b53d5a6d4ea17e4d54b99b2ac03a7f5e783 Author: Byungchul Park Date: Fri Oct 24 16:39:40 2025 +0900 jbd2: use a weaker annotation in journal handling jbd2 journal handling code doesn't want jbd2_might_wait_for_commit() to be placed between start_this_handle() and stop_this_handle(). So it marks the region with rwsem_acquire_read() and rwsem_release(). However, the annotation is too strong for that purpose. We don't have to use more than try lock annotation for that. rwsem_acquire_read() implies: 1. might be a waiter on contention of the lock. 2. enter to the critical section of the lock. All we need in here is to act 2, not 1. So trylock version of annotation is sufficient for that purpose. Now that dept partially relies on lockdep annotaions, dept interpets rwsem_acquire_read() as a potential wait and might report a deadlock by the wait. Replace it with trylock version of annotation. Signed-off-by: Byungchul Park Reviewed-by: Jan Kara Cc: stable@kernel.org Message-ID: <20251024073940.1063-1-byungchul@sk.com> Signed-off-by: Theodore Ts'o commit d056bc45b62b5981ebcd18c4303a915490b8ebe9 Author: Li RongQing Date: Thu Nov 13 17:53:17 2025 +0800 RDMA/core: Prevent soft lockup during large user memory region cleanup When a process exits with numerous large, pinned memory regions consisting of 4KB pages, the cleanup of the memory region through __ib_umem_release() may cause soft lockups. This is because unpin_user_page_range_dirty_lock() is called in a tight loop for unpin and releasing page without yielding the CPU. watchdog: BUG: soft lockup - CPU#44 stuck for 26s! [python3:73464] Kernel panic - not syncing: softlockup: hung tasks CPU: 44 PID: 73464 Comm: python3 Tainted: G OEL asm_sysvec_apic_timer_interrupt+0x1b/0x20 RIP: 0010:free_unref_page+0xff/0x190 ? free_unref_page+0xe3/0x190 __put_page+0x77/0xe0 put_compound_head+0xed/0x100 unpin_user_page_range_dirty_lock+0xb2/0x180 __ib_umem_release+0x57/0xb0 [ib_core] ib_umem_release+0x3f/0xd0 [ib_core] mlx5_ib_dereg_mr+0x2e9/0x440 [mlx5_ib] ib_dereg_mr_user+0x43/0xb0 [ib_core] uverbs_free_mr+0x15/0x20 [ib_uverbs] destroy_hw_idr_uobject+0x21/0x60 [ib_uverbs] uverbs_destroy_uobject+0x38/0x1b0 [ib_uverbs] __uverbs_cleanup_ufile+0xd1/0x150 [ib_uverbs] uverbs_destroy_ufile_hw+0x3f/0x100 [ib_uverbs] ib_uverbs_close+0x1f/0xb0 [ib_uverbs] __fput+0x9c/0x280 ____fput+0xe/0x20 task_work_run+0x6a/0xb0 do_exit+0x217/0x3c0 do_group_exit+0x3b/0xb0 get_signal+0x150/0x900 arch_do_signal_or_restart+0xde/0x100 exit_to_user_mode_loop+0xc4/0x160 exit_to_user_mode_prepare+0xa0/0xb0 syscall_exit_to_user_mode+0x27/0x50 do_syscall_64+0x63/0xb0 Fix soft lockup issues by incorporating cond_resched() calls within __ib_umem_release(), and this SG entries are typically grouped in 2MB chunks on x86_64, adding cond_resched() should has minimal performance impact. Signed-off-by: Li RongQing Link: https://patch.msgid.link/20251113095317.2628-1-lirongqing@baidu.com Acked-by: Junxian Huang Signed-off-by: Leon Romanovsky commit 524c3853831cf4f7e1db579e487c757c3065165c Author: Tetsuo Handa Date: Wed Oct 22 20:11:37 2025 +0900 jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key syzbot is reporting possibility of deadlock due to sharing lock_class_key for jbd2_handle across ext4 and ocfs2. But this is a false positive, for one disk partition can't have two filesystems at the same time. Reported-by: syzbot+6e493c165d26d6fcbf72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6e493c165d26d6fcbf72 Signed-off-by: Tetsuo Handa Tested-by: syzbot+6e493c165d26d6fcbf72@syzkaller.appspotmail.com Reviewed-by: Jan Kara Message-ID: <987110fc-5470-457a-a218-d286a09dd82f@I-love.SAKURA.ne.jp> Signed-off-by: Theodore Ts'o Cc: stable@kernel.org commit b97cb7d6a051aa6ebd57906df0e26e9e36c26d14 Author: Karina Yankevich Date: Wed Oct 22 12:32:53 2025 +0300 ext4: xattr: fix null pointer deref in ext4_raw_inode() If ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED), iloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all() lacks error checking, this will lead to a null pointer dereference in ext4_raw_inode(), called right after ext4_get_inode_loc(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c8e008b60492 ("ext4: ignore xattrs past end") Cc: stable@kernel.org Signed-off-by: Karina Yankevich Reviewed-by: Sergey Shtylyov Reviewed-by: Baokun Li Message-ID: <20251022093253.3546296-1-k.yankevich@omp.ru> Signed-off-by: Theodore Ts'o commit e448372e8a8ed2708ac4f85d74979885e47d5566 Author: Michal Wajdeczko Date: Wed Nov 12 13:44:08 2025 +0100 drm/xe/pf: Use migration-friendly GGTT auto-provisioning Instead of trying very hard to find the largest fair GGTT size that could be allocated for VFs on the current tile, pick some smaller rounded down to power-of-two value that is more likely to be provisioned in the same manner by the other PF instance: num VFs | GGTT space (MiB) --------+----------------- 63..57 | 56 56..29 | 64 28..15 | 128 14..8 | 256 7..4 | 512 3..2 | 1024 1 | 2048 (regular PF) 1 | 3584 (admin only PF) Note that due to FW/HW limitations we can't share all 4GiB GGTT address space with VFs, so for the larger (>7) number of the VFs the change in the outcome is happening at different points than we have in case of GuC contexts/doorbells IDs. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20251112124408.8094-1-michal.wajdeczko@intel.com commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b Author: Deepanshu Kartikey Date: Mon Oct 20 11:39:36 2025 +0530 ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue. Reported-by: syzbot+f3185be57d7e8dda32b8@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8 Cc: stable@kernel.org Signed-off-by: Deepanshu Kartikey Message-ID: <20251020060936.474314-1-kartikey406@gmail.com> Signed-off-by: Theodore Ts'o commit 030e86dfdaa789dd2e2e481d7118979a9d1f8f4e Author: Mateusz Guzik Date: Wed Nov 5 16:06:30 2025 +0100 fs: touch up predicts in path lookup Rationale: - ND_ROOT_PRESET is only set in a condition already marked unlikely - LOOKUP_IS_SCOPED already has unlikely on it, but inconsistently applied - set_root() only fails if there is a bug - most names are not empty (see !*s) - most of the time path_init() does not encounter LOOKUP_CACHED without LOOKUP_RCU - LOOKUP_IN_ROOT is a rarely seen flag Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251105150630.756606-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 434959618c47efe9e5f2e20f4a850caac4f6b823 Author: Christian Hitz Date: Tue Oct 28 16:51:40 2025 +0100 leds: leds-lp50xx: Enable chip before any communication If a GPIO is used to control the chip's enable pin, it needs to be pulled high before any i2c communication is attempted. Currently, the enable GPIO handling is not correct. Assume the enable GPIO is low when the probe function is entered. In this case the device is in SHUTDOWN mode and does not react to i2c commands. During probe the following sequence happens: 1. The call to lp50xx_reset() on line 548 has no effect as i2c is not possible yet. 2. Then - on line 552 - lp50xx_enable_disable() is called. As "priv->enable_gpio“ has not yet been initialized, setting the GPIO has no effect. Also the i2c enable command is not executed as the device is still in SHUTDOWN. 3. On line 556 the call to lp50xx_probe_dt() finally parses the rest of the DT and the configured priv->enable_gpio is set up. As a result the device is still in SHUTDOWN mode and not ready for operation. Split lp50xx_enable_disable() into distinct enable and disable functions to enforce correct ordering between enable_gpio manipulations and i2c commands. Read enable_gpio configuration from DT before attempting to manipulate enable_gpio. Add delays to observe correct wait timing after manipulating enable_gpio and before any i2c communication. Cc: stable@vger.kernel.org Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver") Signed-off-by: Christian Hitz Link: https://patch.msgid.link/20251028155141.1603193-1-christian@klarinett.li Signed-off-by: Lee Jones commit fc584d871c1641949594ccf12a48bb226636b189 Author: Xianwei Zhao Date: Wed Nov 5 17:45:33 2025 +0800 irqchip/meson-gpio: Add support for Amlogic S6 S7 and S7D SoCs The Amlogic S6/S7/S7D SoCs support GPIO interrupt lines: S6 IRQ Number: - 99:98 2 pins on bank CC - 97 1 pin on bank TESTN - 96:81 16 pins on bank A - 80:65 16 pins on bank Z - 64:45 20 pins on bank X - 44:37 8 pins on bank H offs H1 - 36:32 5 pins on bank F - 31:25 7 pins on bank D - 24:22 3 pins on bank E - 21:14 8 pins on bank C - 13:0 14 pins on bank B S7 IRQ Number: - 83:82 2 pins on bank CC - 81 1 pin on bank TESTN - 80:68 13 pins on bank Z - 67:48 20 pins on bank X - 47:36 12 pins on bank H - 35:24 12 pins on bank D - 23:22 2 pins on bank E - 21:14 8 pins on bank C - 13:0 14 pins on bank B S7D IRQ Number: - 83:82 2 pins on bank CC - 81:75 7 pins on bank DV - 74 1 pin on bank TESTN - 73:61 13 pins on bank Z - 60:41 20 pins on bank X - 40:29 12 pins on bank H - 28:24 5 pins on bank D - 23:22 2 pins on bank E - 21:14 8 pins on bank C - 13:0 14 pins on bank B Add the required compatibles and interrupt count initializers. Signed-off-by: Xianwei Zhao Signed-off-by: Thomas Gleixner Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20251105-irqchip-gpio-s6-s7-s7d-v1-2-b4d1fe4781c1@amlogic.com commit e4ca1520081bc67b2a1a01a5ad4013a82300e06e Author: Xianwei Zhao Date: Wed Nov 5 17:45:32 2025 +0800 dt-bindings: interrupt-controller: Add support for Amlogic S6 S7 and S7D SoCs Update the device tree binding document for GPIO interrupt controller of Amlogic S6 S7 and S7D SoCs. Signed-off-by: Xianwei Zhao Signed-off-by: Thomas Gleixner Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251105-irqchip-gpio-s6-s7-s7d-v1-1-b4d1fe4781c1@amlogic.com commit 4f7ffdfb9928a70debc6b019a68a6e068745e937 Author: Rahul Kumar Date: Wed Oct 15 15:11:17 2025 +0530 firmware: stratix10-rsu: replace scnprintf() with sysfs_emit() in *_show() functions Replace scnprintf() with sysfs_emit() in sysfs *_show() functions in stratix10-rsu.c to follow the kernel's guidelines from Documentation/filesystems/sysfs.rst. This improves consistency, safety, and makes the code easier to maintain and update in the future. Signed-off-by: Rahul Kumar Signed-off-by: Dinh Nguyen commit 15847537b623f844d9a08da99ff4568315e1d4f8 Author: Mahesh Rao Date: Mon Oct 27 22:54:43 2025 +0800 firmware: stratix10-rsu: Migrate RSU driver to use stratix10 asynchronous framework. * Add support for asynchronous communication to the RSU client channel. * Migrate functions that communicate with the SDM to use the asynchronous framework. Signed-off-by: Mahesh Rao Reviewed-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit ec52379341a1209826c3e0ae53674393724d2071 Author: Mahesh Rao Date: Mon Oct 27 22:54:42 2025 +0800 firmware: stratix10-svc: Add support for RSU commands in asynchronous framework Integrate Remote System Update(RSU) service commands into the asynchronous framework for communicating with SDM. This allows the RSU commands to be processed asynchronously, improving the responsiveness of the Stratix10 service channel. The asynchronous framework now supports the following RSU commands: * COMMAND_RSU_GET_SPT_TABLE * COMMAND_RSU_STATUS * COMMAND_RSU_NOTIFY Signed-off-by: Mahesh Rao Reviewed-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit bcb9f4f0706147afc62c48533276a18fe7b8f354 Author: Mahesh Rao Date: Mon Oct 27 22:54:41 2025 +0800 firmware: stratix10-svc: Add support for async communication Introduce support for asynchronous communication with the Stratix10 service channel. Define new structures to enable asynchronous messaging with the Secure Device Manager (SDM). Add and remove asynchronous support for existing channels. Implement initialization and cleanup routines for the asynchronous framework. Enable sending and polling of messages to the SDM asynchronously. The new public functions added are: - stratix10_svc_add_async_client: Adds a client to the service channel. - stratix10_svc_remove_async_client: Removes an asynchronous client from the service channel. - stratix10_svc_async_send: Sends an asynchronous message to the SDM mailbox in EL3 secure firmware. - stratix10_svc_async_poll: Polls the status of an asynchronous service request in EL3 secure firmware. - stratix10_svc_async_done: Marks an asynchronous transaction as complete and frees up the resources. These changes enhance the functionality of the Stratix10 service channel by allowing for more efficient and flexible communication with the firmware. Signed-off-by: Mahesh Rao Reviewed-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit 85f96cbbbc67b59652b2c1ec394b8ddc0ddf1b0b Author: Mahesh Rao Date: Mon Oct 27 22:54:40 2025 +0800 firmware: stratix10-svc: Add mutex in stratix10 memory management Add mutex lock to stratix10_svc_allocate_memory and stratix10_svc_free_memory for thread safety. This prevents race conditions and ensures proper synchronization during memory operations. This is required for parallel communication with the Stratix10 service channel. Fixes: 7ca5ce896524f ("firmware: add Intel Stratix10 service layer driver") Cc: stable@vger.kernel.org Signed-off-by: Mahesh Rao Reviewed-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit 4f49088c162579a4ed049c555fe0cd188fd928c4 Author: Khairul Anuar Romli Date: Wed Oct 8 17:09:05 2025 +0800 firmware: stratix10-svc: Add definition for voltage and temperature sensor Add entry in Stratix 10 Service Layer to support temperature and voltage sensor. Signed-off-by: Khairul Anuar Romli Signed-off-by: Dinh Nguyen commit b63945b0c5b5de78712f843ce4a1f5c2ad83e6d0 Merge: 68fa5b092efab3 b305fbdad4ed7e Author: Paolo Abeni Date: Thu Nov 13 13:07:47 2025 +0100 Merge tag 'linux-can-next-for-6.19-20251112-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-11-12 this is a pull request of 11 patches for net-next/main. The first 3 patches are by Vadim Fedorenko and convert the CAN drivers to use the ndo_hwtstamp callbacks. Maud Spierings contributes a patch for the mcp251x driver that converts it to use dev_err_probe(). The next 6 patches target the mcp251xfd driver and are by Gregor Herburger and me. They add GPIO controller functionality to the driver. The final patch is by Chu Guangqing and fixes a typo in the bxcan driver. linux-can-next-for-6.19-20251112-2 * tag 'linux-can-next-for-6.19-20251112-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: bxcan: Fix a typo error for assign dt-bindings: can: mcp251xfd: add gpio-controller property can: mcp251xfd: add gpio functionality can: mcp251xfd: only configure PIN1 when rx_int is set can: mcp251xfd: add workaround for errata 5 can: mcp251xfd: utilize gather_write function for all non-CRC writes can: mcp251xfd: move chip sleep mode into runtime pm can: mcp251x: mcp251x_can_probe(): use dev_err_probe() can: peak_usb: convert to use ndo_hwtstamp callbacks can: peak_canfd: convert to use ndo_hwtstamp callbacks can: convert generic HW timestamp ioctl to ndo_hwtstamp callbacks ==================== Link: https://patch.msgid.link/20251112184344.189863-1-mkl@pengutronix.de Signed-off-by: Paolo Abeni commit d43358cda7c4696e08880aaa58a7df82e471fa7c Author: Kalesh AP Date: Thu Nov 13 16:24:57 2025 +0530 RDMA/restrack: Fix typos in the comments Fix couple of occurrences of the misspelled word "reource" in the comments with the correct spelling "resource". Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20251113105457.879903-1-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit aaecfadc22cca4c7ad381b1df457e8857c01fe14 Author: Michał Winiarski Date: Wed Nov 12 14:22:20 2025 +0100 drm/intel/bmg: Allow device ID usage with single-argument macros When INTEL_BMG_G21_IDS were added as a subplatform, token concatenation operator usage was omitted, making INTEL_BMG_IDS not usable with single-argument macros. Fix that by adding the missing operator. Fixes: 78de8f876683 ("drm/xe: Handle Wa_22010954014 and Wa_14022085890 as device workarounds") Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251112132220.516975-25-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 3b358c21f93e0e83993c991bb208ae78e0253af9 Author: Michał Winiarski Date: Wed Nov 12 14:22:19 2025 +0100 drm/xe/pf: Add wait helper for VF FLR VF FLR requires additional processing done by PF driver. The processing is done after FLR is already finished from PCIe perspective. In order to avoid a scenario where migration state transitions while PF processing is still in progress, additional synchronization point is needed. Add a helper that will be used as part of VF driver struct pci_error_handlers .reset_done() callback. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-24-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 49cf1b9b609feabd1f311aca09dded317a4df7ca Author: Michał Winiarski Date: Wed Nov 12 14:22:18 2025 +0100 drm/xe/pf: Handle VRAM migration data as part of PF control Connect the helpers to allow save and restore of VRAM migration data in stop_copy / resume device state. Co-developed-by: Lukasz Laguna Signed-off-by: Lukasz Laguna Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251112132220.516975-23-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 57a5f45b3b1d292054c89a042e43dc51032752d2 Author: Lukasz Laguna Date: Wed Nov 12 14:22:17 2025 +0100 drm/xe/migrate: Add function to copy of VRAM data in chunks Introduce a new function to copy data between VRAM and sysmem objects. The existing xe_migrate_copy() is tailored for eviction and restore operations, which involves additional logic and operates on entire objects. The xe_migrate_vram_copy_chunk() allows copying chunks of data to or from a dedicated buffer object, which is essential in case of VF migration. Signed-off-by: Lukasz Laguna Reviewed-by: Matthew Brost Link: https://patch.msgid.link/20251112132220.516975-22-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 274186fab373a047ed2ce17c9c8035c9c17474f4 Author: Lukasz Laguna Date: Wed Nov 12 14:22:16 2025 +0100 drm/xe/pf: Add helper to retrieve VF's LMEM object Instead of accessing VF's lmem_obj directly, introduce a helper function to make the access more convenient. Signed-off-by: Lukasz Laguna Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-21-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit b7c1b990f7196e217c20c0e3f6df485e5d4fbdf8 Author: Michał Winiarski Date: Wed Nov 12 14:22:15 2025 +0100 drm/xe/pf: Handle MMIO migration data as part of PF control Implement the helpers and use them for save and restore of MMIO migration data in stop_copy / resume device state. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-20-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 2579764aedd27fe3195e8e10f3dcb6c43f80429c Author: Michał Winiarski Date: Wed Nov 12 14:22:14 2025 +0100 drm/xe/pf: Handle GGTT migration data as part of PF control Connect the helpers to allow save and restore of GGTT migration data in stop_copy / resume device state. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-19-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 624ba6bfedc1b4fdbcb745db5fdaddf628d569d5 Author: Michał Winiarski Date: Wed Nov 12 14:22:13 2025 +0100 drm/xe/pf: Add helpers for VF GGTT migration data handling In an upcoming change, the VF GGTT migration data will be handled as part of VF control state machine. Add the necessary helpers to allow the migration data transfer to/from the HW GGTT resource. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-18-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 762a9f299847a4cd16017d94967847cd51e21632 Author: Michał Winiarski Date: Wed Nov 12 14:22:12 2025 +0100 drm/xe/pf: Handle GuC migration data as part of PF control Connect the helpers to allow save and restore of GuC migration data in stop_copy / resume device state. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-17-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 642a30a94649b46c417467d56839b26a32aa0b4f Author: Michał Winiarski Date: Wed Nov 12 14:22:11 2025 +0100 drm/xe/pf: Switch VF migration GuC save/restore to struct migration data In upcoming changes, the GuC VF migration data will be handled as part of separate SAVE/RESTORE states in VF control state machine. Now that the data is decoupled from both guc_state debugfs and PAUSE state, we can safely remove the struct xe_gt_sriov_state_snapshot and modify the GuC save/restore functions to operate on struct xe_sriov_migration_data. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-16-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 6e03c1366ad52d35571f7b34e90ed49fab1d3611 Author: Michał Winiarski Date: Wed Nov 12 14:22:10 2025 +0100 drm/xe/pf: Don't save GuC VF migration data on pause In upcoming changes, the GuC VF migration data will be handled as part of separate SAVE/RESTORE states in VF control state machine. Remove it from PAUSE state. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-15-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit cea084e8981d1cd2fd54e7a803d13e2e87f47992 Author: Michał Winiarski Date: Wed Nov 12 14:22:09 2025 +0100 drm/xe/pf: Remove GuC migration data save/restore from GT debugfs In upcoming changes, SR-IOV VF migration data will be extended beyond GuC data and exported to userspace using VFIO interface (with a vendor-specific variant driver) and a device-level debugfs interface. Remove the GT-level debugfs. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-14-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit d608fbf4007a4facfff3444fc867b69899e88299 Author: Michał Winiarski Date: Wed Nov 12 14:22:08 2025 +0100 drm/xe/pf: Increase PF GuC Buffer Cache size and use it for VF migration Contiguous PF GGTT VMAs can be scarce after creating VFs. Increase the GuC buffer cache size to 8M for PF so that we can fit GuC migration data (which currently maxes out at just over 4M) and use the cache instead of allocating fresh BOs. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-13-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit dca2701a6277399f9d255f09b4c34d9a7171c09b Author: Michał Winiarski Date: Wed Nov 12 14:22:07 2025 +0100 drm/xe: Allow the caller to pass guc_buf_cache size An upcoming change will use GuC buffer cache as a place where GuC migration data will be stored, and the memory requirement for that is larger than indirect data. Allow the caller to pass the size based on the intended usecase. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-12-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 4f4bdbda720c00ee5b7ef22cd0bfdb36e6aee1a3 Author: Michał Winiarski Date: Wed Nov 12 14:22:06 2025 +0100 drm/xe: Add sa/guc_buf_cache sync interface In upcoming changes the cached buffers are going to be used to read data produced by the GuC. Add a counterpart to flush, which synchronizes the CPU-side of suballocation with the GPU data and propagate the interface to GuC Buffer Cache. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-11-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 20cfef3ae2159f5fd9ab017d472fe173b179b340 Author: Michał Winiarski Date: Wed Nov 12 14:22:05 2025 +0100 drm/xe/pf: Expose VF migration data size over debugfs The size is normally used to make a decision on when to stop the device (mainly when it's in a pre_copy state). Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-10-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 70e2fa916c3826f9e3c1b1d36747acde5f0d5525 Author: Michał Winiarski Date: Wed Nov 12 14:22:04 2025 +0100 drm/xe/pf: Add minimalistic migration descriptor The descriptor reuses the KLV format used by GuC and contains metadata that can be used to quickly fail migration when source is incompatible with destination. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-9-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 1ed30397c0b92b97381dbd11362fdbbf93e046d2 Author: Michał Winiarski Date: Wed Nov 12 14:22:03 2025 +0100 drm/xe/pf: Add support for encap/decap of bitstream to/from packet Add debugfs handlers for migration state and handle bitstream .read()/.write() to convert from bitstream to/from migration data packets. As descriptor/trailer are handled at this layer - add handling for both save and restore side. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-8-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 644a699e6980d9fda947319e157b028f96ee3050 Author: Michał Winiarski Date: Wed Nov 12 14:22:02 2025 +0100 drm/xe/pf: Add helpers for migration data packet allocation / free Now that it's possible to free the packets - connect the restore handling logic with the ring. The helpers will also be used in upcoming changes that will start producing migration data packets. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-7-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 67df4a5cbc583fa3cdefd14131203d46b088ae03 Author: Michał Winiarski Date: Wed Nov 12 14:22:01 2025 +0100 drm/xe/pf: Add data structures and handlers for migration rings Migration data is queued in a per-GT ptr_ring to decouple the worker responsible for handling the data transfer from the .read() and .write() syscalls. Add the data structures and handlers that will be used in future commits. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-6-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit ed46ff0d51e4fd7a999c4fe38371b1dd25a41cc1 Author: Michał Winiarski Date: Wed Nov 12 14:22:00 2025 +0100 drm/xe/pf: Add save/restore control state stubs and connect to debugfs The states will be used by upcoming changes to produce (in case of save) or consume (in case of resume) the VF migration data. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-5-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit cd0ffc8ddc9eb525497f393525dab78f7a30c757 Author: Michał Winiarski Date: Wed Nov 12 14:21:59 2025 +0100 drm/xe/pf: Convert control state to bitmap In upcoming changes, the number of states will increase as a result of introducing SAVE and RESTORE states. This means that using unsigned long as underlying storage won't work on 32-bit architectures, as we'll run out of bits. Use bitmap instead. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510231918.XlOqymLC-lkp@intel.com/ Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-4-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit 4a43480ae07840c916e6c715d1a9f0fe5ba74009 Author: Michał Winiarski Date: Wed Nov 12 14:21:58 2025 +0100 drm/xe: Move migration support to device-level struct Upcoming changes will allow users to control VF state and obtain its migration data with a device-level granularity (not tile/gt). Change the data structures to reflect that and move the GT-level migration init to happen after device-level init. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-3-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit baf125849a22459dfd630b0210a663ca572723a3 Author: Michał Winiarski Date: Wed Nov 12 14:21:57 2025 +0100 drm/xe/pf: Remove GuC version check for migration support Since commit 4eb0aab6e4434 ("drm/xe/guc: Bump minimum required GuC version to v70.29.2"), the minimum GuC version required by the driver is v70.29.2, which should already include everything that we need for migration. Remove the version check. Suggested-by: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251112132220.516975-2-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit d363bdfa0ec6b19a4f40b572cec70430d5b13ad6 Author: Svyatoslav Ryhel Date: Mon Nov 3 16:56:29 2025 +0200 media: i2c: add Sony IMX111 CMOS camera sensor driver Add a v4l2 sub-device driver for the Sony IMX111 image sensor. This is a camera sensor using the i2c bus for control and the csi-2 bus for data. The following features are supported: - manual exposure, digital and analog gain control support - pixel rate/link freq control support - supported resolution up to 3280x2464 for single shot capture - supported resolution up to 1920x1080 @ 30fps for video - supported bayer order output SGBRG10 and SGBRG8 Camera module seems to be partially compatible with Nokia SMIA but it lacks a few registers required for clock calculations and has different vendor-specific per-mode configurations which makes it incompatible with existing CCS driver. Signed-off-by: Svyatoslav Ryhel [Sakari Ailus: Fix set_fmt() callback a bit and idle after autosuspend.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e4605fe4a61302911e456379fbe265d97ea90e9f Author: Svyatoslav Ryhel Date: Mon Nov 3 16:56:28 2025 +0200 dt-bindings: media: i2c: document Sony IMX111 CMOS sensor Add bindings for Sony IMX111 CMOS Digital Image Sensor found in LG Optimus 4X (P880) and Optimus Vu (P895) smartphones. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Conor Dooley Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b84befa3126634d78e31260f538453d534742908 Author: Jonathan Cavitt Date: Tue Nov 4 16:41:51 2025 +0000 drm/i915/display: Add default case to mipi_exec_send_packet Add a default case to the switch case statement in mipi_exec_send_packet to prevent attempts to read an uninitialized ret value. It's unlikely the default case will ever occur during regular exeuction, but if more MIPI DSI Processor-to-Peripheral transaction types are ever added, then having this in place will be a useful safety guard. Signed-off-by: Jonathan Cavitt Fixes: 23db1577ce2d ("drm/i915/dsi: log send packet sequence errors") Reviewed-by: Jani Nikula Link: https://patch.msgid.link/20251104164150.16795-2-jonathan.cavitt@intel.com Signed-off-by: Jani Nikula commit 5934b1be8dbe67fa728eff0e68cbafb958c55aa5 Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:27 2025 +0000 usercopy: Remove folio references from check_heap_object() Use page_slab() instead of virt_to_folio() followed by folio_slab(). We do end up calling compound_head() twice for non-slab copies, but that will not be a problem once we allocate memdescs separately. Signed-off-by: Matthew Wilcox (Oracle) Cc: Kees Cook Cc: Gustavo A. R. Silva Cc: linux-hardening@vger.kernel.org Link: https://patch.msgid.link/20251113000932.1589073-14-willy@infradead.org Reviewed-by: Harry Yoo Reviewed-by: Kees Cook Signed-off-by: Vlastimil Babka commit 025f5b870b2c4f30cbf452c5b07f9ab249cf73ec Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:26 2025 +0000 slab: Remove folio references from kfree_nolock() In preparation for splitting struct slab from struct page and struct folio, remove mentions of struct folio from this function. Since large kmalloc objects are not supported here, we can just use virt_to_slab(). Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-13-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 7d26842fd43cb0f7e29c9f8e98af9091ccb0aef5 Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:25 2025 +0000 slab: Remove folio references from kfree_rcu_sheaf() In preparation for splitting struct slab from struct page and struct folio, remove mentions of struct folio from this function. Since we don't need to handle large kmalloc objects specially here, we can just use virt_to_slab(). Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-12-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 4a2c2110a343b7c8762982c355ba34acf563b08a Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:24 2025 +0000 slab: Remove folio references from build_detached_freelist() Use pages and slabs directly instead of converting to folios. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-11-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 5db009dc10b16056ed340a488e948855def63fca Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:23 2025 +0000 slab: Remove folio references from __do_krealloc() One slight tweak I made is to calculate 'ks' earlier, which means we can reuse it in the warning rather than calculating the object size twice. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-10-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit e4090216859054043f8ba50866a2fb9c8e6d6b5b Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:22 2025 +0000 slab: Remove folio references from kfree() This should generate identical code to the previous version, but without any dependency on how folios work. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-9-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f262cfd75d52eb285d696d0c7357dc853d7bc7ea Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:21 2025 +0000 slab: Remove folio references from kvfree_rcu_cb() Remove conversions from folio to page and folio to slab. This is preparation for separately allocated struct slab from struct page. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-8-willy@infradead.org Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 0bdfdd6a05aa51fa66bae15af79dba977eeaffe9 Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:20 2025 +0000 slab: Remove folio references from free_large_kmalloc() There's no need to use folio APIs here; just use a page directly. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251113000932.1589073-7-willy@infradead.org Signed-off-by: Vlastimil Babka commit f9395bf5db450ccbf58eb737c227485df6aab26c Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:19 2025 +0000 slab: Remove folio references from ___kmalloc_large_node() There's no need to use folio APIs here; just use a page directly. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251113000932.1589073-6-willy@infradead.org Signed-off-by: Vlastimil Babka commit 09fa19e2f3a512310bf4287546fc0f2b10a63e5a Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:18 2025 +0000 slab: Remove folio references in slab alloc/free Use pages directly to further the split between slab and folio. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251113000932.1589073-5-willy@infradead.org Signed-off-by: Vlastimil Babka commit ea4702b1708ee3df8da06f07ce41fea84e6ed81d Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:17 2025 +0000 slab: Remove folio references in memcg_slab_post_charge() This allows us to skip the compound_head() call for large kmalloc objects as the virt_to_page() call will always give us the head page for the large kmalloc case. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251113000932.1589073-4-willy@infradead.org Signed-off-by: Vlastimil Babka commit ee1ee8abc4197e21594ca29348629ccbfff4daec Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:16 2025 +0000 slab: Remove folio references from __ksize() In the future, we will separate slab, folio and page from each other and calling virt_to_folio() on an address allocated from slab will return NULL. Delay the conversion from struct page to struct slab until we know we're not dealing with a large kmalloc allocation. There's a minor win for large kmalloc allocations as we avoid the compound_head() hidden in virt_to_folio(). This deprecates calling ksize() on memory allocated by alloc_pages(). Today it becomes a warning and support will be removed entirely in the future. Introduce large_kmalloc_size() to abstract how we represent the size of a large kmalloc allocation. For now, this is the same as page_size(), but it will change with separately allocated memdescs. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20251113000932.1589073-3-willy@infradead.org Acked-by: David Hildenbrand (Red Hat) Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 2bcd3800f2da1be13b972858f63c66d035b1ec6d Author: Matthew Wilcox (Oracle) Date: Thu Nov 13 00:09:15 2025 +0000 slab: Reimplement page_slab() In order to separate slabs from folios, we need to convert from any page in a slab to the slab directly without going through a page to folio conversion first. Up to this point, page_slab() has followed the example of other memdesc converters (page_folio(), page_ptdesc() etc) and just cast the pointer to the requested type, regardless of whether the pointer is actually a pointer to the correct type or not. That changes with this commit; we check that the page actually belongs to a slab and return NULL if it does not. Other memdesc converters will adopt this convention in future. kfence was the only user of page_slab(), so adjust it to the new way of working. It will need to be touched again when we separate slab from page. Signed-off-by: Matthew Wilcox (Oracle) Cc: Alexander Potapenko Cc: Marco Elver Cc: kasan-dev@googlegroups.com Link: https://patch.msgid.link/20251113000932.1589073-2-willy@infradead.org Acked-by: David Hildenbrand (Red Hat) Tested-by: Marco Elver Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 6bd4f9f1cc52948deff52c879d0843e5e873f8d4 Author: Lukas Bulwahn Date: Thu Oct 30 14:46:37 2025 +0100 MAINTAINERS: adjust file entry in TDA1997x MEDIA DRIVER Commit c423487bf667 ("dt-bindings: media: convert nxp,tda1997x.txt to yaml format") renames nxp,tda1997x.txt to nxp,tda19971.yaml as part of this dt-binding conversion, but misses to adjust the file entry in TDA1997x MEDIA DRIVER. Adjust the file entry after the conversion. Signed-off-by: Lukas Bulwahn Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9a9ba098e7ba6b89efaddeabf0716a84a0f54c99 Author: Tarang Raval Date: Fri Oct 31 17:18:35 2025 +0530 media: i2c: imx219: Replace exposure magic value with named constant Introduce IMX219_EXPOSURE_OFFSET (4) and use it instead of the literal '4' when computing the maximum coarse exposure. The IMX219 datasheet specifies the maximum storage time as frame_length_lines - 4. (Ref: Datasheet section 5-7-1) Also fix one indentation issue for consistency. Signed-off-by: Tarang Raval Reviewed-by: Dave Stevenson Reviewed-by: Kieran Bingham Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit dff10c7044e8777bd14bba99444ff8a69d9bb2fe Author: Tarang Raval Date: Fri Oct 31 17:18:34 2025 +0530 media: i2c: imx219: Propagate errors from control range updates Propagate return values from __v4l2_ctrl_modify_range() and __v4l2_ctrl_s_ctrl() in imx219_set_ctrl() and imx219_set_pad_format(). This ensures proper error handling instead of ignoring possible failures. Also return the result of imx219_set_pad_format() from imx219_init_state(). Signed-off-by: Tarang Raval Reviewed-by: Isaac Scott Reviewed-by: Dave Stevenson Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4985b66fbd97913998c714fd68b843d4e0feb61b Author: Hans de Goede Date: Mon Oct 20 17:37:41 2025 +0200 media: ipu6: isys: Add support for monochrome media bus formats Add support for monochrome media bus formats, for use with monochrome/IR camera sensors. This has been tested on a Dell XPS 13 9320 with OV1A1B IR sensor. Signed-off-by: Hans de Goede Reviewed-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 15ac3d54a8296e027bf176115e36c3cb8c55c8cc Author: Ricardo Ribalda Date: Mon Oct 20 20:18:13 2025 +0000 media: i2c: imx214: Rearrange control initialization Smatch is confused by the control initialization logic. It assumes that there can be a case where imx214->link_freq can be NULL and ctrls_init returns 0. Re-arrange the function to make smatch happy. This patch fixes this smatch error: drivers/media/i2c/imx214.c:1109 imx214_ctrls_init() error: we previously assumed 'imx214->link_freq' could be null (see line 1017) Signed-off-by: Ricardo Ribalda Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e687f5cae591dba4a0a968c24cbe7b6141027d93 Author: Isaac Scott Date: Wed Oct 29 18:03:21 2025 +0000 media: imx-mipi-csis: Support active data lanes differing from maximum Call on v4l2_get_active_data_lanes() to check if the driver reports that the number of lanes actively used by the MIPI CSI transmitter differs to the maximum defined in device tree. If the number of active data lanes reported by the driver is invalid, catch and return the error. If the operation is not supported, fall back to the number of allowed data lanes. Signed-off-by: Isaac Scott Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5c731dba1d8b92ecb935031cf33dabb2bd6793c4 Author: Isaac Scott Date: Wed Oct 29 18:03:20 2025 +0000 media: imx-mipi-csis: Add num_data_lanes to mipi_csis_device Add the num_data_lanes field to the mipi_csis_device struct, and set it equal to csis->bus.num_data_lanes. This is in preparation to support cases when the data lanes actively used differs from the maximum supported data lanes. No functional changes intended by this commit. Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Isaac Scott Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit e10d6d961842d1619ca172f11dfb33d1fae46b5b Author: Isaac Scott Date: Wed Oct 29 18:03:19 2025 +0000 media: imx-mipi-csis: Move redundant debug print in probe The number of data lanes is already printed as part of mipi_csis_async_register(), making the first part of this print redundant. Remove the redundant print, and move the debug print for clock frequency to mipi_csis_parse_dt(). Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Isaac Scott Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit fd3f646e1c9d783d1f4ef30e5376ccf315a8ae30 Author: Isaac Scott Date: Wed Oct 29 18:03:18 2025 +0000 media: v4l: Add helper to get number of active lanes via a pad Sometimes, users will not use all of the MIPI CSI 2 lanes available when connecting to the MIPI CSI receiver of their device. Add a helper function that checks the mbus_config for the device driver to allow users to define the number of active data lanes through the get_mbus_config op. If the driver does not implement this op, fall back to using the maximum number of lanes available. Reviewed-by: Frank Li Reviewed-by: Laurent Pinchart Signed-off-by: Isaac Scott Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ca042de64800a0bcc3e0866e4efaa4a657e8ddc9 Author: Jai Luthra Date: Thu Oct 30 14:13:01 2025 +0530 media: imx335: Switch to {enable,disable}_streams Switch from s_stream to enable_streams and disable_streams callbacks. Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 8a2451bd20e6f815e46adcc0f21be8124f16289c Author: Jai Luthra Date: Thu Oct 30 14:13:00 2025 +0530 media: imx335: Support 2x2 binning Introduce 2x2 binning mode (1312x972@60fps). Since there are multiple modes now, use v4l2_find_nearest_size() to select the appropriate mode in .set_fmt(). For 2x2 binning the minimum shutter value supported is 17 instead of 9. This effects the maximum allowed exposure time, and if not enforced then the sensor produces very dark frames when the minimum shutter limit is violated. Lastly, update the crop size reported to the userspace. When trying 2x2 binning with the datasheet suggested pixel array size (i.e. 2592 / 2 => 1296), on some platforms (Raspberry Pi 5) artefacts are introduced on the right edge of the output image. Instead, using a higher width of 1312 works fine on all platforms. Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit df3ef05b51e02ef9386346288c1e63f366372f5b Author: Jai Luthra Date: Thu Oct 30 14:12:59 2025 +0530 media: imx355: Use subdev active state Port the driver to use the subdev active state. This simplifies locking, and makes it easier to support different crop sizes for binned modes, by storing the crop rectangle inside the subdev state. Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 34af620e67550da1f693914a3a881a024e949014 Author: Jai Luthra Date: Thu Oct 30 14:12:58 2025 +0530 media: imx335: Handle runtime PM in leaf functions Simplify .s_stream callback implementation by moving the runtime PM calls to the leaf functions. This patch should not affect any functionality. Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d64ec84ac01b100619f68929a7e29f00617a6ffd Author: Jai Luthra Date: Thu Oct 30 14:12:57 2025 +0530 media: imx335: Update HBLANK range on mode change While switching modes, updating to a different value of HBLANK isn't sufficient, as this is a read-only control with a single allowed value, and thus hblank_min == hblank_max == hblank of the default mode. So to correctly update the user-facing value of the HBLANK parameter, which is necessary for correct framerate calculation, update the whole range when switching modes. Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b82801a11fd6c26cc6c74e277e44bbc4481dde56 Author: Jai Luthra Date: Thu Oct 30 14:12:56 2025 +0530 media: imx335: Update the native pixel array width The sensor datasheet reports actual total number of pixels as 2696x2044. This becomes important for supporting 2x2 binning modes that can go beyond the current maximum pixel array width set here. Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2581a40115dd295233453c5e53c6d1bccdd0f4ff Author: Umang Jain Date: Thu Oct 30 14:12:55 2025 +0530 media: imx335: Support vertical flip Support vertical flip by setting REG_VREVERSE. Additional registers also needs to be set per mode, according to the readout direction (normal/inverted) as mentioned in the data sheet. Since the register IMX335_REG_AREA3_ST_ADR_1 is based on the flip (and is set via vflip related registers), it has been moved out of the 2592x1944 mode regs. Signed-off-by: Umang Jain Reviewed-by: Tommaso Merciai Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 554f7b8d45e99eb01a498eb6cdd5da4b9ff6e3c3 Author: Umang Jain Date: Thu Oct 30 14:12:54 2025 +0530 media: imx335: Rectify name of mode struct In commit 81495a59baeb ("media: imx335: Fix active area height discrepency") the height for the mode struct was rectified to '1944'. However, the name of mode struct is still reflecting to '1940'. Update it. Signed-off-by: Umang Jain Reviewed-by: Tommaso Merciai Reviewed-by: Kieran Bingham Signed-off-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit abe3f43438be8a12ae204ca4ef1fe5ba0da4d086 Author: Hao Yao Date: Mon Nov 3 10:42:42 2025 +0100 media: ipu-bridge: Add OV05C10 to the list of supported sensors Add the OV05C10 sensor to the list of supported sensors. Signed-off-by: Hao Yao Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 84c56e1cb378f4996870a67b47ff6f5b63a6d85a Author: Jimmy Su Date: Mon Nov 3 10:42:41 2025 +0100 media: ipu-bridge: Add IMX471 to the list of supported sensors Add the IMX471 sensor, which is used with a SONY471A ACPI HID on the Lenovo ThinkPad X9 15 laptop to the list of supported sensors. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2362064 Signed-off-by: Jimmy Su Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 47781ee71fb6bf2e082580b98be72411b99b6e04 Author: Miquel Sabaté Solà Date: Mon Sep 29 15:02:46 2025 +0200 fuse: rename 'namelen' to 'namesize' By "length of a string" usually the number of non-null chars is meant (i.e. strlen(str)). So the variable 'namelen' was confusingly named, whereas 'namesize' refers more to what's being done in 'get_security_context'. Suggested-by: Miklos Szeredi Signed-off-by: Miquel Sabaté Solà Signed-off-by: Miklos Szeredi commit c755a09b52c09b8d67ef35b4ac3166ca6e797bee Author: Miquel Sabaté Solà Date: Mon Sep 29 15:02:45 2025 +0200 fuse: use strscpy instead of strcpy As pointed out in [1], strcpy() is deprecated in favor of strscpy(). Furthermore, the size of the buffer for the name to be copied is well known at this point since we are going to move the pointer by that much on the next line. Hence, it's safe to assume 'namelen' for the size of the string to be copied. [1] https://github.com/KSPP/linux/issues/88 Signed-off-by: Miquel Sabaté Solà Signed-off-by: Miklos Szeredi commit 6adf4b11fa50a31dc1c3791131020e624c6f139d Author: Baolin Liu Date: Tue Nov 11 20:22:05 2025 +0800 mm: simplify list initialization in barn_shrink() In barn_shrink(), use LIST_HEAD() to declare and initialize the list_head in one step instead of using INIT_LIST_HEAD() separately. No functional change. Signed-off-by: Baolin Liu Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 9075ceeadac3e4e4fd906cd84f1ec537442c59be Author: Michal Wilczynski Date: Tue Oct 28 13:22:34 2025 +0100 pwm: th1520: Use module_pwm_platform_driver! macro The `pwm_th1520` Rust driver calls C functions from the `PWM` namespace, triggering `modpost` warnings due to missing namespace import declarations in its `.modinfo` section. Fix these warnings and simplify the module declaration by switching from the generic `kernel::module_platform_driver!` macro to the newly introduced PWM-specific `kernel::module_pwm_platform_driver!` macro. The new macro automatically handles the required `imports_ns: ["PWM"]` declaration. Signed-off-by: Michal Wilczynski Reviewed-by: Troy Mitchell Reviewed-by: Elle Rhumsaa Link: https://patch.msgid.link/20251028-pwm_fixes-v1-3-25a532d31998@samsung.com Signed-off-by: Uwe Kleine-König commit 26dcb42086d401373b9e09b7f83357e8b9af6b55 Author: Michal Wilczynski Date: Tue Oct 28 13:22:35 2025 +0100 pwm: th1520: Fix clippy warning for redundant struct field init Clippy warns about redundant struct field initialization when the field name and the variable name are the same (e.g., `status: status`). No functional change. Signed-off-by: Michal Wilczynski Reviewed-by: Elle Rhumsaa Link: https://patch.msgid.link/20251028-pwm_fixes-v1-4-25a532d31998@samsung.com Signed-off-by: Uwe Kleine-König commit 6fe9e919c144f1296d38e2abb10c7ac4320aa7fa Author: Miguel Ojeda Date: Wed Oct 29 19:25:02 2025 +0100 pwm: Fix Rust formatting We do our best to keep the repository `rustfmt`-clean [1], thus run the tool to fix the formatting issue. A trailing empty comment [2] is added in order to preserve the wanted style for imports (otherwise the tool will compact the first two items). Link: https://rust-for-linux.com/contributing#submit-checklist-addendum [1] Link: https://docs.kernel.org/rust/coding-guidelines.html#style-formatting [2] Fixes: d8046cd50879 ("rust: pwm: Add complete abstraction layer") Fixes: 7b3dce814a15 ("rust: pwm: Add Kconfig and basic data structures") Fixes: e03724aac758 ("pwm: Add Rust driver for T-HEAD TH1520 SoC") Signed-off-by: Miguel Ojeda Link: https://patch.msgid.link/20251029182502.783392-1-ojeda@kernel.org Signed-off-by: Uwe Kleine-König commit a367b64ba498a7eac34af3a67ce59317066b2779 Author: Michal Wilczynski Date: Thu Oct 16 15:38:05 2025 +0200 dt-bindings: pwm: thead: Add T-HEAD TH1520 PWM controller Add the Device Tree binding documentation for the T-HEAD TH1520 SoC PWM controller. Reviewed-by: Krzysztof Kozlowski Acked-by: Drew Fustini Reviewed-by: Elle Rhumsaa Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20251016-rust-next-pwm-working-fan-for-sending-v16-5-a5df2405d2bd@samsung.com Signed-off-by: Uwe Kleine-König commit e03724aac758f71c6cda208ea3d1afd0bbb6d9aa Author: Michal Wilczynski Date: Thu Oct 16 15:38:04 2025 +0200 pwm: Add Rust driver for T-HEAD TH1520 SoC Introduce a PWM driver for the T-HEAD TH1520 SoC, written in Rust and utilizing the safe PWM abstractions from the preceding commit. The driver implements the pwm::PwmOps trait using the modern waveform API (round_waveform_tohw, write_waveform, etc.) to support configuration of period, duty cycle, and polarity for the TH1520's PWM channels. Resource management is handled using idiomatic Rust patterns. The PWM chip object is allocated via pwm::Chip::new and its registration with the PWM core is managed by the pwm::Registration RAII guard. This ensures pwmchip_remove is always called when the driver unbinds, preventing resource leaks. Device managed resources are used for the MMIO region, and the clock lifecycle is correctly managed in the driver's private data Drop implementation. The driver's core logic is written entirely in safe Rust, with no unsafe blocks, except for the Send and Sync implementations for the driver data, which are explained in the comments. Reviewed-by: Elle Rhumsaa Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20251016-rust-next-pwm-working-fan-for-sending-v16-4-a5df2405d2bd@samsung.com Signed-off-by: Uwe Kleine-König commit 51b4c0f9749d96d56887896383141e97916ac91b Author: Miguel Ojeda Date: Wed Oct 29 19:19:40 2025 +0100 rust: pwm: Fix broken intra-doc link `rustdoc` reports a broken intra-doc link: error: unresolved link to `Devres::register` --> rust/kernel/pwm.rs:722:11 | 722 | /// via [`Devres::register`]. This ties the lifetime of the PWM chip registration | ^^^^^^^^^^^^^^^^ no item named `Devres` in scope | = note: `-D rustdoc::broken-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::broken_intra_doc_links)]` Thus fix it. Fixes: d8046cd50879 ("rust: pwm: Add complete abstraction layer") Signed-off-by: Miguel Ojeda Link: https://patch.msgid.link/20251029181940.780629-1-ojeda@kernel.org Signed-off-by: Uwe Kleine-König commit dd6ff5cf56fb183fce605ca6a5bfce228cd8888b Author: Alice Ryhl Date: Wed Nov 12 09:48:35 2025 +0000 rust: io: add typedef for phys_addr_t The C typedef phys_addr_t is missing an analogue in Rust, meaning that we end up using bindings::phys_addr_t or ResourceSize as a replacement in various places throughout the kernel. Fix that by introducing a new typedef on the Rust side. Place it next to the existing ResourceSize typedef since they're quite related to each other. Cc: stable@vger.kernel.org # for v6.18 [1] Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20251112-resource-phys-typedefs-v2-4-538307384f82@google.com Link: https://lore.kernel.org/all/20251112-resource-phys-typedefs-v2-0-538307384f82@google.com/ [1] Signed-off-by: Danilo Krummrich commit ee2776e54b2666f99ef5e3ad0b60889e1500dada Author: Alice Ryhl Date: Wed Nov 12 09:48:34 2025 +0000 rust: scatterlist: import ResourceSize from kernel::io Now that ResourceSize has been moved to kernel::io, import it from the io module instead of the io::resource sub-module. It makes sense in this case since the dma_len isn't really related to the Resource type even though both are sizes of allocations in physical ram. Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20251112-resource-phys-typedefs-v2-3-538307384f82@google.com Signed-off-by: Danilo Krummrich commit dfd67993044f507ba8fd6ee9956f923ba4b7e851 Author: Alice Ryhl Date: Wed Nov 12 09:48:33 2025 +0000 rust: io: move ResourceSize to top-level io module Resource sizes are a general concept for dealing with physical addresses, and not specific to the Resource type, which is just one way to access physical addresses. Thus, move the typedef to the io module. Still keep a re-export under resource. This avoids this commit from being a flag-day, but I also think it's a useful re-export in general so that you can import use kernel::io::resource::{Resource, ResourceSize}; instead of having to write use kernel::io::{ resource::Resource, ResourceSize, }; in the specific cases where you need ResourceSize because you are using the Resource type. Therefore I think it makes sense to keep this re-export indefinitely and it is *not* intended as a temporary re-export for migration purposes. Cc: stable@vger.kernel.org # for v6.18 [1] Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20251112-resource-phys-typedefs-v2-2-538307384f82@google.com Link: https://lore.kernel.org/all/20251112-resource-phys-typedefs-v2-0-538307384f82@google.com/ [1] Signed-off-by: Danilo Krummrich commit c33196c9429a1db5bc6cded27b6286f341ad6be0 Author: Vlastimil Babka Date: Fri Nov 7 14:51:26 2025 +0100 slab: use struct freelist_counters as parameters in relevant functions In functions such as [__]slab_update_freelist() and __slab_update_freelist_fast/slow() we pass old and new freelist and counters as 4 separate parameters. The underlying __update_freelist_fast() then constructs struct freelist_counters variables for passing the full freelist+counter combinations to cmpxchg double. In most cases we actually start with struct freelist_counters variables, but then pass the individual fields, only to construct new struct freelist_counters variables. While it's all inlined and thus should be efficient, we can simplify this code. Thus replace the 4 parameters for individual fields with two pointers to struct freelist_counters wherever applicable. __update_freelist_fast() can then pass them directly to try_cmpxchg_freelist(). The code is also more obvious as the pattern becomes unified such that we set up "old" and "new" struct freelist_counters variables upfront as we fully need them to be, and simply call [__]slab_update_freelist() on them. Previously some of the "new" values would be hidden among the many parameters and thus make it harder to figure out what the code does. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 919b72922717e396be9435c83916b9969505bd23 Author: Alice Ryhl Date: Wed Nov 12 09:48:32 2025 +0000 rust: io: define ResourceSize as resource_size_t These typedefs are always equivalent so this should not change anything, but the code makes a lot more sense like this. Cc: stable@vger.kernel.org Signed-off-by: Alice Ryhl Fixes: 493fc33ec252 ("rust: io: add resource abstraction") Link: https://patch.msgid.link/20251112-resource-phys-typedefs-v2-1-538307384f82@google.com Signed-off-by: Danilo Krummrich commit 38759cc5ad8e1dddfa3519734cb6387e1b38dbd4 Author: Jani Nikula Date: Wed Nov 12 20:55:47 2025 +0200 drm/xe: remove stale runtime_pm member This has become unused and unnecessary. Remove. Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20251112185547.172113-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 4341dd24abb983eb6218bfc4ab0366de98873e00 Author: Jani Nikula Date: Wed Nov 12 20:13:42 2025 +0200 drm/i915/ltphy: include intel_display_utils.h instead of i915_utils.h Display code stopped using i915_utils.h in favour of intel_display_utils.h. Fix recent additions. Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20251112181342.107911-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9c7dc1dd897a1cdcade9566ea4664b03fbabf4a4 Author: Josh Poimboeuf Date: Wed Nov 12 15:47:51 2025 -0800 objtool: Warn on functions with ambiguous -ffunction-sections section names When compiled with -ffunction-sections, a function named startup() will be placed in .text.startup. However, .text.startup is also used by the compiler for functions with __attribute__((constructor)). That creates an ambiguity for the vmlinux linker script, which needs to differentiate those two cases. Similar naming conflicts exist for functions named exit(), split(), unlikely(), hot() and unknown(). One potential solution would be to use '#ifdef CC_USING_FUNCTION_SECTIONS' to create two distinct implementations of the TEXT_MAIN macro. However, -ffunction-sections can be (and is) enabled or disabled on a per-object basis (for example via ccflags-y or AUTOFDO_PROFILE). So the recently unified TEXT_MAIN macro (commit 1ba9f8979426 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros")) is necessary. This means there's no way for the linker script to disambiguate things. Instead, use objtool to warn on any function names whose resulting section names might create ambiguity when the kernel is compiled (in whole or in part) with -ffunction-sections. Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: live-patching@vger.kernel.org Cc: Linus Torvalds Link: https://patch.msgid.link/65fedea974fe14be487c8867a0b8d0e4a294ce1e.1762991150.git.jpoimboe@kernel.org commit 0330b7fbbf313b35470306a492b9e7a703b5af56 Author: Josh Poimboeuf Date: Wed Nov 12 15:47:50 2025 -0800 drivers/xen/xenbus: Fix namespace collision and split() section placement with AutoFDO When compiling the kernel with -ffunction-sections enabled, the split() function gets compiled into the .text.split section. In some cases it can even be cloned into .text.split.constprop.0 or .text.split.isra.0. However, .text.split.* is already reserved for use by the Clang -fsplit-machine-functions flag, which is used by AutoFDO. That may place part of a function's code in a .text.split. section. This naming conflict causes the vmlinux linker script to wrongly place split() with other .text.split.* code, rather than where it belongs with regular text. Fix it by renaming split() to split_strings(). Fixes: 6568f14cb5ae ("vmlinux.lds: Exclude .text.startup and .text.exit from TEXT_MAIN") Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: live-patching@vger.kernel.org Cc: Juergen Gross Cc: Linus Torvalds Link: https://patch.msgid.link/92a194234a0f757765e275b288bb1a7236c2c35c.1762991150.git.jpoimboe@kernel.org commit 56255fa96871d3bd0d924a53585cdf5594262891 Author: Josh Poimboeuf Date: Wed Nov 12 15:47:49 2025 -0800 media: atomisp: Fix namespace collision and startup() section placement with -ffunction-sections When compiling the kernel with -ffunction-sections (e.g., for LTO, livepatch, dead code elimination, AutoFDO, or Propeller), the startup() function gets compiled into the .text.startup section. In some cases it can even be cloned into .text.startup.constprop.0 or .text.startup.isra.0. However, the .text.startup and .text.startup.* section names are already reserved for use by the compiler for __attribute__((constructor)) code. This naming conflict causes the vmlinux linker script to wrongly place startup() function code in .init.text, which gets freed during boot. Fix that by renaming startup() to ov2722_startup(). Fixes: 6568f14cb5ae ("vmlinux.lds: Exclude .text.startup and .text.exit from TEXT_MAIN") Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: live-patching@vger.kernel.org Cc: Hans de Goede Cc: Mauro Carvalho Chehab Cc: Linus Torvalds Link: https://patch.msgid.link/bf8cd823a3f11f64cc82167913be5013c72afa57.1762991150.git.jpoimboe@kernel.org commit f6a8919d61484ae9ca6b1855035fcfb2ba6e2af9 Author: Josh Poimboeuf Date: Wed Nov 12 15:47:48 2025 -0800 vmlinux.lds: Fix TEXT_MAIN to include .text.start and friends Since: 6568f14cb5ae ("vmlinux.lds: Exclude .text.startup and .text.exit from TEXT_MAIN") the TEXT_MAIN macro uses a series of patterns to prevent the .text.startup[.*] and .text.exit[.*] sections from getting linked into the vmlinux runtime .text. That commit is a tad too aggressive: it also inadvertently filters out valid runtime text sections like .text.start and .text.start.constprop.0, which can be generated for a function named start() when -ffunction-sections is enabled. As a result, those sections become orphans when building with CONFIG_LD_DEAD_CODE_DATA_ELIMINATION for arm: arm-linux-gnueabi-ld: warning: orphan section `.text.start.constprop.0' from `drivers/usb/host/sl811-hcd.o' being placed in section `.text.start.constprop.0' arm-linux-gnueabi-ld: warning: orphan section `.text.start.constprop.0' from `drivers/media/dvb-frontends/drxk_hard.o' being placed in section `.text.start.constprop.0' arm-linux-gnueabi-ld: warning: orphan section `.text.start' from `drivers/media/dvb-frontends/stv0910.o' being placed in section `.text.start' arm-linux-gnueabi-ld: warning: orphan section `.text.start.constprop.0' from `drivers/media/pci/ddbridge/ddbridge-sx8.o' being placed in section `.text.start.constprop.0' Fix that by explicitly adding the partial "substring" sections (.text.s, .text.st, .text.sta, etc) and their cloned derivatives. While this unfortunately means that TEXT_MAIN continues to grow, these changes are ultimately necessary for proper support of -ffunction-sections. Fixes: 6568f14cb5ae ("vmlinux.lds: Exclude .text.startup and .text.exit from TEXT_MAIN") Reported-by: kernel test robot Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: live-patching@vger.kernel.org Cc: Linus Torvalds Link: https://patch.msgid.link/cd588144e63df901a656b06b566855019c4a931d.1762991150.git.jpoimboe@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202511040812.DFGedJiy-lkp@intel.com/ commit d851f2b2b273363f65d7285b427bedbb6f8290e2 Merge: 249092174caa3f e9a6fb0bcdd760 Author: Ingo Molnar Date: Thu Nov 13 07:58:43 2025 +0100 Merge tag 'v6.18-rc5' into objtool/core, to pick up fixes Signed-off-by: Ingo Molnar commit e360bb6dc843ffa59283705dd167478ea317567c Merge: 3813d28b2b12de 8d5cad38cf7da7 Author: Martin K. Petersen Date: Wed Nov 12 21:30:23 2025 -0500 Merge patch series "replace old wq(s), added WQ_PERCPU to alloc_workqueue" Marco Crivellari says: Hi, === Current situation: problems === Let's consider a nohz_full system with isolated CPUs: wq_unbound_cpumask is set to the housekeeping CPUs, for !WQ_UNBOUND the local CPU is selected. This leads to different scenarios if a work item is scheduled on an isolated CPU where "delay" value is 0 or greater then 0: schedule_delayed_work(, 0); This will be handled by __queue_work() that will queue the work item on the current local (isolated) CPU, while: schedule_delayed_work(, 1); Will move the timer on an housekeeping CPU, and schedule the work there. Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. === Recent changes to the WQ API === The following, address the recent changes in the Workqueue API: - commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") - commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") The old workqueues will be removed in a future release cycle. === Introduced Changes by this series === 1) [P 1] Replace uses of system_wq and system_unbound_wq system_unbound_wq is to be used when locality is not required. Because of that, system_unbound_wq has been replaced with system_dfl_wq, to make clear it should be used when locality is not required. 2) [P 2-3-4] WQ_PERCPU added to alloc_workqueue() This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. Thanks! Link: https://patch.msgid.link/20251031095643.74246-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 8d5cad38cf7da7848a2f4d7ca5adb4110b2cd968 Author: Marco Crivellari Date: Fri Nov 7 16:52:57 2025 +0100 scsi: pm80xx: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This adds a new WQ_PERCPU flag to explicitly request to alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107155257.316728-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 2e2e559390db56c36ebaa8db82fd16a2e367dfb6 Author: Marco Crivellari Date: Fri Nov 7 16:40:08 2025 +0100 scsi: target: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107154008.304127-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit f60b8957d8cc18c8913812e693593debc3829b77 Author: Marco Crivellari Date: Fri Nov 7 16:16:18 2025 +0100 scsi: qedi: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107151618.281250-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 42312d3acde57c37c9a688bef97c85618bd26cae Author: Marco Crivellari Date: Fri Nov 7 16:05:42 2025 +0100 scsi: target: ibmvscsi: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107150542.271229-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit e036dadf78f8c1bcbb3a4e5933f553c24fe5c162 Author: Marco Crivellari Date: Fri Nov 7 16:01:55 2025 +0100 scsi: qedf: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107150155.267651-3-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit a43a2e48d534ffc6361ef5a026fc71e5f03696b8 Author: Marco Crivellari Date: Fri Nov 7 16:01:54 2025 +0100 scsi: bnx2fc: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107150155.267651-2-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 6184ec8b633e507df39b2258f4627095a4dfd752 Author: Marco Crivellari Date: Fri Nov 7 15:49:49 2025 +0100 scsi: be2iscsi: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107144949.256894-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit f0dc44177ac048e1b166661d520db4c833e6b40b Author: Marco Crivellari Date: Fri Nov 7 15:14:58 2025 +0100 scsi: message: fusion: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107141458.225119-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 84150ef06f897cc2c03456edb5ad5c2a03faf9f1 Author: Marco Crivellari Date: Tue Nov 4 12:08:08 2025 +0100 scsi: lpfc: WQ_PERCPU added to alloc_workqueue() users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Justin Tee Link: https://patch.msgid.link/20251104110808.123424-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit f76e4e1e836df41f602fa4c85f64f09e2a99266e Author: Marco Crivellari Date: Fri Oct 31 10:56:43 2025 +0100 scsi: scsi_transport_fc: WQ_PERCPU added to alloc_workqueue users() Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Justin Tee Link: https://patch.msgid.link/20251031095643.74246-5-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit afad6b34defed8ca19f8593b692024e8e296287f Author: Marco Crivellari Date: Fri Oct 31 10:56:42 2025 +0100 scsi: scsi_dh_alua: WQ_PERCPU added to alloc_workqueue() users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251031095643.74246-4-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 5ca003bb438197791f6394d5c05e5abf403ada24 Author: Marco Crivellari Date: Fri Oct 31 10:56:41 2025 +0100 scsi: qla2xxx: WQ_PERCPU added to alloc_workqueue() users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251031095643.74246-3-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 0ba2fc767af711de1d830a61c8473168dcb31a8a Author: Marco Crivellari Date: Tue Nov 4 11:45:18 2025 +0100 scsi: target: sbp: Replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_dfl_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251104104518.102130-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit cd87aa2e507abb02560043c8e0e5bb9967ae7d72 Author: Marco Crivellari Date: Fri Oct 31 10:56:40 2025 +0100 scsi: scsi_transport_iscsi: Replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251031095643.74246-2-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 49783aca15fb73adb08e8ca5edc4dfb0a32540b9 Author: Marco Crivellari Date: Fri Oct 31 10:56:40 2025 +0100 scsi: qla2xxx: Replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251031095643.74246-2-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit 68fa5b092efab37a4f08a47b22bb8ca98f7f6223 Merge: 9c577f09989f92 ccb4ff9f24e23f Author: Jakub Kicinski Date: Wed Nov 12 18:13:44 2025 -0800 Merge branch 'net-stmmac-convert-glue-drivers-to-use-stmmac_get_phy_intf_sel' Russell King says: ==================== net: stmmac: convert glue drivers to use stmmac_get_phy_intf_sel() This series converts the remaining glue drivers that support multi-interface to use stmmac_get_phy_intf_sel(). The reason these drivers are not converted to the set_phy_intf_sel() method is because it is unclear whether there are ordering dependencies that would prevent it. For example, reading the stm32mp2 documentation, it is required to set the ETH1_SEL field while the dwmac core is in reset and before clocks are enabled. This requirement can not be satsified at the moment (but could with further changes.) ==================== Link: https://patch.msgid.link/aRLvrfx6tOa-RhrY@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ccb4ff9f24e23f3599dd13e124f0c7cd29380df3 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:48 2025 +0000 net: stmmac: visconti: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result and use that to set the control register to select the operating mode for the DWMAC core. Note that this will allow GMII as well as MII as the phy_intf_sel value is the same for both. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIjUe-0000000DquB-3JDY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bb68e0183e0452d0a1f3af747ec33976a9335ee5 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:43 2025 +0000 net: stmmac: visconti: use PHY_INTF_SEL_x to select PHY interface Convert dwmac-visconti to use the PHY_INTF_SEL_x definitions. The original definitions used constant 0, BIT(0) (==1) and BIT(2) (==4) to define these, but the values of the bits corresponds with the PHY_INTF_SEL_x values, so it is highly likely that these are not individual bits, but the PHY_INTF_SEL_x bitfield. This removes this incorrect use of BIT(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIjUZ-0000000Dqu5-2sDI@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 45c5e24a53f10cabb4a311c915680624b832cc2b Author: Russell King (Oracle) Date: Tue Nov 11 08:12:38 2025 +0000 net: stmmac: stm32: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value. As both configure functions would end up with the same code, call this from stm32mp1_set_mode(), validate the result and pass the resulting value into the stm32 configure function. Use this value to set the operating mode for the DWMAC core. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIjUU-0000000Dqtz-2PwT@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 07669cf12ea8c7e4cb2e5f34bb8351bf65917be2 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:33 2025 +0000 net: stmmac: stm32: use PHY_INTF_SEL_x directly Rather than defining separate constants for each, use the PHY_INTF_SEL_x definitions in the switch()es configuring the control register, and use one FIELD_PREP() to convert phy_intf_sel to the register value. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIjUP-0000000Dqtt-1bYn@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 73130c298fa0d30f5ead5d9aeb7edc813651a8b3 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:28 2025 +0000 net: stmmac: stm32: use PHY_INTF_SEL_x to select PHY interface Convert dwmac-stm32 to use the PHY_INTF_SEL_x definitions. For stm32mp1, the original definitions used constant 0 (GMII, 0 << 21), BIT(21) (RGMII, 1 << 21) and BIT(23) (RMII, 4 << 21) to define these, but from the values it can be clearly seen that these are the PHY_INTF_SEL_x inputs to the dwmac. For stm32mp2, the original definitions cover a bitfield 6:4 in the SYSCFG Ethernet1 control register (according to documentation) and use the PHY_INTF_SEL_x values. Use the common dwmac definitions for the PHY interface selection field by adding the bitfield mask, and using FIELD_PREP() for the bitfield values. This removes this incorrect use of BIT(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIjUK-0000000Dqtn-1AyK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d22045997b538aaf801b849dfa6369d76f0152c0 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:23 2025 +0000 net: stmmac: starfive: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result and use that to set the control register to select the operating mode for the DWMAC core. Signed-off-by: Russell King (Oracle) Reviewed-by: Emil Renner Berthing Link: https://patch.msgid.link/E1vIjUF-0000000Dqth-0gwD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f0917b475378055c1de6c9a911da579be8726a54 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:18 2025 +0000 net: stmmac: starfive: use PHY_INTF_SEL_x to select PHY interface Use the common dwmac definitions for the PHY interface selection field. Signed-off-by: Russell King (Oracle) Reviewed-by: Emil Renner Berthing Link: https://patch.msgid.link/E1vIjUA-0000000Dqtb-0AfP@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f06620091fe75015d5e97f4a0da4f5b124ca6455 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:12 2025 +0000 net: stmmac: mediatek: simplify set_interface() methods Use the phy_intf_sel field value when deciding what other options to apply for the configuration register. Note that this will allow GMII as well as MII as the phy_intf_sel value is the same for both. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vIjU4-0000000DqtV-3qsX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d9c7964fd93490b31a09fe08034033cb2aa747f5 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:07 2025 +0000 net: stmmac: mediatek: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result, and pass that into the implementation specific ->dwmac_set_phy_interface() method. Use this to configure the PHY interface selection field. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vIjTz-0000000DqtP-3N9v@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c3308d380e2c69c5dcb85784b750c4f83a965ef4 Author: Russell King (Oracle) Date: Tue Nov 11 08:12:02 2025 +0000 net: stmmac: mediatek: use PHY_INTF_SEL_x Use PHY_INTF_SEL_x definitions for the fields that correspond to the phy_intf_sel inputs to the dwmac core. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vIjTu-0000000DqtI-2sUB@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 83eb6c7e18641f328aed5da2e9bbf63e83806ca4 Author: Russell King (Oracle) Date: Tue Nov 11 08:11:57 2025 +0000 net: stmmac: loongson1: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result and use that to set the control register to select the operating mode for the DWMAC core. Note that this will allow GMII as well as MII as the phy_intf_sel value is the same for both. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vIjTp-0000000DqtC-2DmI@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 031f7a05d4b3ad4414e646414e16dfd4ab388772 Author: Russell King (Oracle) Date: Tue Nov 11 08:11:52 2025 +0000 net: stmmac: loongson1: use PHY_INTF_SEL_x directly Use the PHY_INTF_SEL_xx values directly in ls1c_dwmac_syscon_init(), converting them to the PHY_INTF_SELI bitfield when calling regmap_update_bits(). Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vIjTk-0000000Dqt6-1gN9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5d88b24c1de80037af8f46db478639679668ece5 Author: Russell King (Oracle) Date: Tue Nov 11 08:11:47 2025 +0000 net: stmmac: loongson1: use PHY_INTF_SEL_x Use PHY_INTF_SEL_x definitions for phy_intf_sel bitfield. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Signed-off-by: Jakub Kicinski commit 3813d28b2b12dea8f44a6828b9c30b38208d3fc5 Author: Ally Heev Date: Wed Nov 5 19:44:43 2025 +0530 scsi: scsi_debug: Fix uninitialized pointers with __free attr Uninitialized pointers with '__free' attribute can cause undefined behaviour as the memory assigned(randomly) to the pointer is freed automatically when the pointer goes out of scope scsi doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with '__free' attr in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev Link: https://patch.msgid.link/20251105-aheev-uninitialized-free-attr-scsi-v1-1-d28435a0a7ea@gmail.com Signed-off-by: Martin K. Petersen commit 9c577f09989f921e7a7cc724949fa81f9444dffb Author: Jakub Kicinski Date: Tue Nov 11 07:52:14 2025 -0800 tools: ynltool: correct install in Makefile Use the variable in case user has a custom install binary. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20251111155214.2760711-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f766f8cdde018967e9436f7f34d09907881fa7fa Author: Dimitri Daskalakis Date: Tue Nov 11 14:53:19 2025 -0800 selftests: drv-net: Limit the max number of queues in procfs_downup_hammer For NICs with a large (1024+) number of queues, this test can cause excessive memory fragmentation. This results in OOM errors, and in the worst case driver/kernel crashes. We don't need to test with the max number of queues, just enough to create a high likelihood of races between reconfiguration and stats getting read. Signed-off-by: Dimitri Daskalakis Link: https://patch.msgid.link/20251111225319.3019542-1-dimitri.daskalakis1@gmail.com Signed-off-by: Jakub Kicinski commit 18987143d4b1945a1bfcb3963ae1961ca29b27dd Author: Bart Van Assche Date: Tue Nov 11 10:47:59 2025 -0800 scsi: ufs: core: Remove an unnecessary NULL pointer check The !payload check tests the address of a member of a data structure. We know that the start address of this data structure (job) is not NULL since the 'job' pointer has already been dereferenced. Hence, the !payload check is superfluous. Remove this test. This was reported by the CodeSonar static analyzer. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251111184802.125111-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 1028258914f608023279725d1756abf5b974e6d6 Author: Nuno Sá Date: Tue Nov 11 17:50:17 2025 +0000 scsi: pm: Drop unneeded call to pm_runtime_mark_last_busy() There's no need to explicitly call pm_runtime_mark_last_busy() since pm_runtime_autosuspend() is now doing it since commit 08071e64cb64 ("PM: runtime: Mark last busy stamp in pm_runtime_autosuspend()") Signed-off-by: Nuno Sá Link: https://patch.msgid.link/20251111-scsi-pm-improv-v2-1-626b8491f4b4@analog.com Signed-off-by: Martin K. Petersen commit acd194d9b5bac419e04968ffa44351afabb50bac Author: Haotian Zhang Date: Wed Oct 29 11:25:55 2025 +0800 scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls The driver calls ioport_map() to map I/O ports in sim710_probe_common() but never calls ioport_unmap() to release the mapping. This causes resource leaks in both the error path when request_irq() fails and in the normal device removal path via sim710_device_remove(). Add ioport_unmap() calls in the out_release error path and in sim710_device_remove(). Fixes: 56fece20086e ("[PATCH] finally fix 53c700 to use the generic iomem infrastructure") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251029032555.1476-1-vulab@iscas.ac.cn Signed-off-by: Martin K. Petersen commit f6ab594672d4cba08540919a4e6be2e202b60007 Author: Junrui Luo Date: Wed Oct 29 00:29:04 2025 +0800 scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability. When a device removal is triggered (via hot-unplug or module unload), race condition can occur. The fix adds tasklet_kill() before freeing the asd_ha structure, ensuring all scheduled tasklets complete before cleanup proceeds. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/ME2PR01MB3156AB7DCACA206C845FC7E8AFFDA@ME2PR01MB3156.ausprd01.prod.outlook.com Signed-off-by: Martin K. Petersen commit ef42cf705ca32c07a58133817567ac06ef74dc19 Author: Dan Hamik Date: Wed Nov 12 07:04:51 2025 +0000 wifi: rtw89: rtw8852bu: Added dev id for ASUS AX57 NANO USB Wifi dongle Add the USB device ID 0x0b05:0x1cb6 to the rtw8852bu driver to support the ASUS AX57 Nano WiFi 6 USB adapter.This device uses the same Realtek RTL8852BU chipset as other supported models. Tested on: Linux Mint 22 with kernel 6.8.0-87-generic. The adapter initializes successfully and connects to networks. Signed-off-by: Dan Hamik Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/010f019a76e1a84b-0a6f5e9f-2a43-4a9d-9c30-de4ae6363011-000000@us-east-2.amazonses.com commit 7465c0a91278b1829f7a3e5e2459e3329edb4ae4 Author: Ping-Ke Shih Date: Tue Nov 11 10:24:52 2025 +0800 wifi: rtw89: configure RX antenna if chips can support If chip->ops->cfg_txrx_path is implemented, a chip can support to configure RX antenna, so accept setting via iw tool. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-9-pkshih@realtek.com commit d9204e99b69623997cba0d7472fa7df644df7cb5 Author: Ping-Ke Shih Date: Tue Nov 11 10:24:51 2025 +0800 wifi: rtw89: do RF calibration once setting channel when running pure monitor mode To be able to capture and inject packets in monitor mode, do RF calibration once setting certain channel. Since calibration costs time, do not change behavior of normal usage, which do calibration only when starting as AP or going to connect AP. Since driver declares IEEE80211_HW_WANT_MONITOR_VIF, the pure monitor vif must be only one when adding interface with type NL80211_IFTYPE_MONITOR. Otherwise, monitor vif must be NULL. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-8-pkshih@realtek.com commit e96abe4fd7cd6f48434d8846aa7588bf7bdb3f0e Author: Ping-Ke Shih Date: Tue Nov 11 10:24:50 2025 +0800 wifi: rtw89: consider data rate/bandwidth/GI for injected packets To send injected packets with configurable rate/bandwidth/GI, fill TXWD fields according to SKB's info->control.rates[0] annotated by mac80211. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-7-pkshih@realtek.com commit 1dd7e743dd37361c8c1ac89355a8da738e2b81fb Author: Kuan-Chung Chen Date: Tue Nov 11 10:24:49 2025 +0800 wifi: rtw89: phy: fix out-of-bounds access in rtw89_phy_read_txpwr_limit() Coverity reported a potential out-of-bounds access when 'bw' exceeds the valid range for the specified band. Add a helper `rtw89_bw_is_valid()` to check bandwidth validity for each band before accessing limit tables. Addresses-Coverity-ID: 1598844 ("Out-of-bounds access") Addresses-Coverity-ID: 1598896 ("Out-of-bounds access") Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-6-pkshih@realtek.com commit b37fb77d4530f711a08b6dd860a8a4839897aba2 Author: Ping-Ke Shih Date: Tue Nov 11 10:24:48 2025 +0800 wifi: rtw89: 8852c: add compensation of thermal value from efuse calibration The 3th bit of thermal value programmed in efuse means 8 (2 ^ 3) grams. Check the bit and signed bit, and add compensation to final thermal. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-5-pkshih@realtek.com commit 7bf433c6767ffe2ad5b7ac8680c6e93e7d0be3e4 Author: Ping-Ke Shih Date: Tue Nov 11 10:24:47 2025 +0800 wifi: rtw89: debug: add parser to diagnose along DIAG_MAC fw element The rules to diagnose MAC have a common header, and a cmd field is used to know the exact command and its format. The rules with the same tuple of fields {sheet, seq} can be seen as a set of compound rules, which treat it as positive rule if just one of the rules is positive. Take EQUALV rules as example, if value of {addr, mask} is equal to predefined value as field val, a rule is positive. Fields addr_name_offset and msg_offset are offsets related to textual messages for human readable. Format of common rule header (8 bytes) +-------+-----+--------+-----------+-----+---------+ | sheet | cmd | seq[2] | io / band | len | rsvd[2] | +-------+-----+--------+-----------+-----+---------+ Format of rule command is EQUALV (equal value) (24 bytes): +------+------------------+------+-----+------------+---------+ | addr | addr_name_offset | mask | val | msg_offset | rsvd[4] | +------+------------------+------+-----+------------+---------+ Format of message: +-----+----------+ | len | string[] | +-----+----------+ An example of output: Plain(Ignore)/Rules/Positive: 115(4)/86/81 Where, Plain is total rules written in firmware element. Ignore is the ignored rules, such as USB IO, but current is PCIE. Rules is number of set of compound rules. Positive is number of positive Rules. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-4-pkshih@realtek.com commit de19cc7def5a9c646264a1e7a2a183a3baad112f Author: Ping-Ke Shih Date: Tue Nov 11 10:24:46 2025 +0800 wifi: rtw89: fw: parse firmware element of DIAG_MAC The firmware element ID 28 is a set of rules to diagnose if MAC get abnormal. The latter patch will use these rules via debugfs to know the status. The element contains rules with their textual messages shown as below: +------------------------------------+ | | | +-----------+ | | | rule_size |-------|----------+ +----------------+-----------+-------+ -- | | rule[0] | \ | | rule[1] | | <---+ | : | / +------------------------------------+ -- | msg[0] msg[1] | each msg has variable length | msg[2] msg[3] ... | (with address align 2) | ... | +------------------------------------+ Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-3-pkshih@realtek.com commit dae8d7d63b740d8f5972b8438b139a6488e0f9fa Author: Ping-Ke Shih Date: Tue Nov 11 10:24:45 2025 +0800 wifi: rtw89: pci: add to read PCI configuration space from common code Normally only access PCI device in pci.c. However for debug purpose, a set of registers predefined in firmware element including PCI configuration space should be read for diagnosis. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251111022452.28093-2-pkshih@realtek.com commit 6276c67f2bc4aeaf350a7cf889c33c38b3330ea9 Author: Sean Christopherson Date: Wed Nov 12 09:39:44 2025 -0800 x86: Restrict KVM-induced symbol exports to KVM modules where obvious/possible Extend KVM's export macro framework to provide EXPORT_SYMBOL_FOR_KVM(), and use the helper macro to export symbols for KVM throughout x86 if and only if KVM will build one or more modules, and only for those modules. To avoid unnecessary exports when CONFIG_KVM=m but kvm.ko will not be built (because no vendor modules are selected), let arch code #define EXPORT_SYMBOL_FOR_KVM to suppress/override the exports. Note, the set of symbols to restrict to KVM was generated by manual search and audit; any "misses" are due to human error, not some grand plan. Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Acked-by: Kai Huang Tested-by: Kai Huang Link: https://patch.msgid.link/20251112173944.1380633-5-seanjc%40google.com commit e6f2d5866c55d9ed4d61c22692848b029ccd4f6c Author: Sean Christopherson Date: Wed Nov 12 09:39:43 2025 -0800 x86/mm: Drop unnecessary export of "ptdump_walk_pgd_level_debugfs" Don't export "ptdump_walk_pgd_level_debugfs" as its sole user is arch/x86/mm/debug_pagetables.c, which can't be built as a module. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251112173944.1380633-4-seanjc%40google.com commit 9c26c91e103b58ba4f75f77d3d7338620b132ac4 Author: Sean Christopherson Date: Wed Nov 12 09:39:42 2025 -0800 x86/mtrr: Drop unnecessary export of "mtrr_state" Don't export "mtrr_state" as usage is limited to arch/x86/kernel/cpu/mtrr (and nothing outside of that directory even includes the local mtrr.h). No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251112173944.1380633-3-seanjc%40google.com commit ed028824605a6ddf8707b9313f7e76419d453ca6 Author: Sean Christopherson Date: Wed Nov 12 09:39:41 2025 -0800 x86/bugs: Drop unnecessary export of "x86_spec_ctrl_base" Don't export x86_spec_ctrl_base as it's used only in bugs.c and process.c, neither of which can be built into a module. No functional change intended. Signed-off-by: Sean Christopherson Signed-off-by: Dave Hansen Link: https://patch.msgid.link/20251112173944.1380633-2-seanjc%40google.com commit d204087a59708c6c6a0b2b79e8fc2412fedc948d Merge: ab57a18665a2ad 4f5eb50f7c8206 Author: Martin K. Petersen Date: Wed Nov 12 18:17:50 2025 -0500 Merge patch series "qla2xxx target mode improvements" Tony Battersby says: This patch series improves the qla2xxx FC driver in target mode. I developed these patches using the out-of-tree SCST target-mode subsystem (https://scst.sourceforge.net/), although most of the improvements will also apply to the other target-mode subsystems such as the in-tree LIO. Unfortunately qla2xxx+LIO does not pass all of my tests, but my patches do not make it any worse (results below). These patches have been well-tested at my employer with qla2xxx+SCST in both initiator mode and target mode and with a variety of FC HBAs and initiators. Since SCST is out-of-tree, some of the patches have parts that apply in-tree and other parts that apply out-of-tree to SCST. The SCST patches can be found in the v2 posting linked above. All patches apply to linux 6.17 and SCST 3.10 master branch. Summary of patches: - bugfixes - cleanups - improve handling of aborts and task management requests - improve log message - add back SLER / SRR support (removed in 2017) Some of these patches improve handling of aborts and task management requests. This is some of the testing that I did: Test 1: Use /dev/sg to queue random disk I/O with short timeouts; make sure cmds are aborted successfully. Test 2: Queue lots of disk I/O, then use "sg_reset -N -d /dev/sg" on initiator to reset logical unit. Test 3: Queue lots of disk I/O, then use "sg_reset -N -t /dev/sg" on initiator to reset target. Test 4: Queue lots of disk I/O, then use "sg_reset -N -b /dev/sg" on initiator to reset bus. Test 5: Queue lots of disk I/O, then use "sg_reset -N -H /dev/sg" on initiator to reset host. Test 6: Use fiber channel attenuator to trigger SRR during write/read/compare test; check data integrity. With my patches, SCST passes all of these tests. Results with in-tree LIO target-mode subsystem: Test 1: Seems to abort the same cmd multiple times (both qlt_24xx_retry_term_exchange() and __qlt_send_term_exchange()). But cmds get aborted, so give it a pass? Test 2: Seems to work; cmds are aborted. Test 3: Target reset doesn't seem to abort cmds, instead, a few seconds later: qla2xxx [0000:04:00.0]-f058:9: qla_target(0): tag 1314312, op 2a: CTIO with TIMEOUT status 0xb received (state 1, port 51:40:2e:c0:18:1d:9f:cc, LUN 0) Tests 4 and 5: The initiator is unable to log back in to the target; the following messages are repeated over and over on the target: qla2xxx [0000:04:00.0]-e01c:9: Sending TERM ELS CTIO (ha=00000000f8811390) qla2xxx [0000:04:00.0]-f097:9: Linking sess 000000008df5aba8 [0] wwn 51:40:2e:c0:18:1d:9f:cc with PLOGI ACK to wwn 51:40:2e:c0:18:1d:9f:cc s_id 00:00:01, ref=2 pla 00000000835a9271 link 0 Test 6: passes with my patches; SRR not supported previously. So qla2xxx+LIO seems a bit flaky when handling exceptions, but my patches do not make it any worse. Perhaps someone who is more familiar with LIO can look at the difference between LIO and SCST and figure out how to improve it. Tony Battersby https://www.cybernetics.com/ v1: https://lore.kernel.org/r/f8977250-638c-4d7d-ac0c-65f742b8d535@cybernetics.com/ v2: https://lore.kernel.org/linux-scsi/e95ee7d0-3580-4124-b854-7f73ca3a3a84@cybernetics.com/ Link: https://patch.msgid.link/aaea0ab0-da8b-4153-9369-60db7507ff7a@cybernetics.com Signed-off-by: Martin K. Petersen commit 4f5eb50f7c8206b0b08dba8e01cf83812ddaaeb2 Author: Tony Battersby Date: Mon Nov 10 11:05:53 2025 -0500 scsi: qla2xxx: target: Improve safety of cmd lookup by handle The driver associates two different structs with numeric handles and passes the handles to the hardware. When the hardware passes the handle back to the driver, the driver consults a table of void * to convert the handle back to the struct without checking the type of struct. This can lead to type confusion if the HBA firmware misbehaves (and some firmware versions do). So verify the type of struct is what is expected before using it. But we can also do better than that. Also verify that the exchange address of the message sent from the hardware matches the exchange address of the command being returned. This adds an extra guard against buggy HBA firmware that returns duplicate messages multiple times (which has also been seen) in case the driver has reused the handle for a different command of the same type. These problems were seen on a QLE2694L with firmware 9.08.02 when testing SLER / SRR support. The SRR caused the HBA to flood the response queue with hundreds of bogus entries. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/7c7cb574-fe62-42ae-b800-d136d8dd89ca@cybernetics.com Signed-off-by: Martin K. Petersen commit c7bd85a7b9c5abcf2b69b32ac8c67f0d683b5113 Author: Tony Battersby Date: Mon Nov 10 11:04:42 2025 -0500 scsi: qla2xxx: target: Add back SRR support Background: loading qla2xxx with "ql2xtgt_tape_enable=1" enables Sequence Level Error Recovery (SLER), which is most commonly used for tape drives. With SLER enabled, if there is a recoverable I/O error during a SCSI command, a Sequence Retransmission Request (SRR) will be used to retry the I/O at a low-level completely within the driver without propagating the error to the upper levels of the SCSI stack. SRR support was removed in 2017 by commit 2c39b5ca2a8c ("qla2xxx: Remove SRR code"). Add it back, new and improved. The old removed SRR code used sequence numbers to correlate the SRR CTIOs with SRR immediate notify messages. I don't see how that would work reliably with MSI-X interrupts and multiple queues. So instead use the exchange address to find the command associated with the immediate notify (qlt_srr_to_cmd). The old removed SRR code had a function qlt_check_srr_debug() to simulate a SRR, but it didn't work for me. Instead I just used fiber optic attenuators attached to the FC cable to reduce the strength of the signal and induce errors. Unfortunately this only worked for inducing SRRs on Data-Out (write) commands, so that is all I was able to test. The code to build a new scatterlist for a SRR with nonzero offset has been improved to reduce memory requirements and has been well-tested. However it does not support protection information. When a single cmd gets multiple SRRs, the old removed SRR code would restore the data buffer from the values in cmd->se_cmd before processing the new SRR. That might be needed if the offset for the new SRR was lower than the offset for the previous SRR, but I am not sure if that can happen. In my testing, when a single cmd gets multiple SRRs, the SRR offset always increases or stays the same. But in case it can decrease, I added the function qlt_restore_orig_sg(). If this is not supposed to happen then qlt_restore_orig_sg() can be removed to simplify the code. I ran into some HBA firmware bugs with QLE269x, QLE27xx, and QLE28xx firmware 9.05.xx - 9.08.xx where a SRR would cause the HBA to misbehave badly. Since SRRs are rare and therefore difficult to test, I figured it would be worth checking for the buggy firmware and disabling SLER with a warning instead of letting others run into the same problem on the rare occasion that they get a SRR. This turned out to be difficult because the firmware version isn't known in the normal NVRAM config routine, so I added a second NVRAM config routine that is called after the firmware version is known. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/654b7181-b79e-40ed-a15b-6d6e441a5d5f@cybernetics.com Signed-off-by: Martin K. Petersen commit 04957d8c9852d8772321c4594242162d87f668aa Author: Tony Battersby Date: Mon Nov 10 11:03:25 2025 -0500 scsi: qla2xxx: target: Improve cmd logging - Add the command tag to various messages so that different messages about the same command can be correlated. - For CTIO errors (i.e. when the HW reports an error about a cmd), print the cmd tag, opcode, state, initiator WWPN, and LUN. This info helps an administrator determine what is going wrong. - When a command experiences a transport error, log a message when it is freed. This makes debugging exceptions easier. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/c579987d-5658-41ae-9653-f0e58c9d1880@cybernetics.com Signed-off-by: Martin K. Petersen commit f4199d5812561466a26fadba8ad044e346e58b3c Author: Tony Battersby Date: Mon Nov 10 11:02:13 2025 -0500 scsi: qla2xxx: target: Add cmd->rsp_sent Add cmd->rsp_sent to indicate that the SCSI status has been sent successfully, so that SCST can be informed of any transport errors. This will also be used for logging in later patches. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/d4b0203f-7817-4517-9789-5866bb24fad7@cybernetics.com Signed-off-by: Martin K. Petersen commit 091719c21d5aa0d461496de3e120cd864c5750a0 Author: Tony Battersby Date: Mon Nov 10 11:01:00 2025 -0500 scsi: qla2xxx: target: Fix invalid memory access with big CDBs struct atio7_fcp_cmnd is a variable-length data structure because of add_cdb_len, but it is embedded in struct atio_from_isp and copied around like a fixed-length data structure. For big CDBs > 16 bytes, get_datalen_for_atio() called on a fixed-length copy of the atio will access invalid memory. In some cases this can be fixed by moving the atio to the end of the data structure and using a variable-length allocation. In other cases such as allocating struct qla_tgt_cmd, the fixed-length data structures are preallocated for speed, so in the case that add_cdb_len != 0, allocate a separate buffer for the CDB. Also add memcpy_atio() as a safeguard against invalid memory accesses. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/306a9d0b-3c89-42fc-a69c-eebca8171347@cybernetics.com Signed-off-by: Martin K. Petersen commit 3d56983cc6f03aef05ab30f8cd16039c1db3c5e0 Author: Tony Battersby Date: Mon Nov 10 10:59:35 2025 -0500 scsi: qla2xxx: Fix TMR failure handling (target mode) If handle_tmr() fails: - The code for QLA_TGT_ABTS results in memory-use-after-free and double-free: qlt_do_tmr_work() qlt_build_abts_resp_iocb() qpair->req->outstanding_cmds[h] = (srb_t *)mcmd; mempool_free(mcmd, qla_tgt_mgmt_cmd_mempool); FIRST FREE qlt_handle_abts_completion() mcmd = qlt_ctio_to_cmd() cmd = req->outstanding_cmds[h]; return cmd; vha = mcmd->vha; USE-AFTER-FREE ha->tgt.tgt_ops->free_mcmd(mcmd); SECOND FREE - qlt_send_busy() makes no sense because it sends a SCSI command response instead of a TMR response. Instead just call qlt_xmit_tm_rsp() to send a TMR failed response, since that code is well-tested and handles a number of corner cases. But it would be incorrect to call ha->tgt.tgt_ops->free_mcmd() after handle_tmr() failed, so add a flag to mcmd indicating the proper way to free the mcmd so that qlt_xmit_tm_rsp() can be used for both cases. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/09a1ff3d-6738-4953-a31b-10e89c540462@cybernetics.com Signed-off-by: Martin K. Petersen commit 5c50d84798eb2d05fa86f923ec869934d04e6f31 Author: Tony Battersby Date: Mon Nov 10 10:58:12 2025 -0500 scsi: qla2xxx: target: Improve checks in qlt_xmit_response() / qlt_rdy_to_xfer() Similar fixes to both functions: qlt_xmit_response: - If the cmd cannot be processed, remember to call ->free_cmd() to prevent the target-mode midlevel from seeing a cmd lockup. - Do not try to send the response if the exchange has been terminated. - Check for chip reset once after lock instead of both before and after lock. - Give errors from qlt_pre_xmit_response() a lower priority to compensate for removing the first check for chip reset. qlt_rdy_to_xfer: - Check for chip reset after lock instead of before lock to avoid races. - Do not try to receive data if the exchange has been terminated. - Give errors from qlt_pci_map_calc_cnt() a lower priority to compensate for moving the check for chip reset. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/cd6ccd31-33fa-4454-be36-507bf578a546@cybernetics.com Signed-off-by: Martin K. Petersen commit 17488f1390749af61152ca4012b754ac3edcb42b Author: Tony Battersby Date: Mon Nov 10 10:57:00 2025 -0500 scsi: qla2xxx: target: Fix races with aborting commands cmd->cmd_lock only protects cmd->aborted, but when deciding how to process a cmd, it is necessary to consider other factors such as cmd->state and if the chip has been reset, which are protected by qpair->qp_lock_ptr. So replace cmd_lock with qp_lock_ptr, whick makes it possible to check additional values and make decisions about what to do without racing with the CTIO handler and other code. - Lock cmd->qpair->qp_lock_ptr when aborting a cmd. - Eliminate cmd->cmd_lock and change cmd->aborted to a bitfield since it is now protected by qp_lock_ptr just like all the other flags. - Add another command state QLA_TGT_STATE_DONE to avoid any possible races between qlt_abort_cmd() and tgt_ops->free_cmd(). - Add the cmd->sent_term_exchg flag to indicate if qlt_send_term_exchange() has already been called. - Export qlt_send_term_exchange() for SCST so that it can be called directly instead of trying to make qlt_abort_cmd() work for both TMR abort and HW timeout. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/2c8d03e4-308b-4d5a-a418-a334be23f815@cybernetics.com Signed-off-by: Martin K. Petersen commit d46c69a087aa3d1513f7a78f871b80251ea0c1ae Author: Tony Battersby Date: Mon Nov 10 11:07:37 2025 -0500 scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds. Fixes: aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") Fixes: 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") Co-developed-by: Dmitry Bogdanov Signed-off-by: Dmitry Bogdanov Signed-off-by: Tony Battersby Link: https://patch.msgid.link/0e7e5d26-e7a0-42d1-8235-40eeb27f3e98@cybernetics.com Signed-off-by: Martin K. Petersen commit ab57a18665a2adca492dcb80c0997316be06e6c6 Merge: c53a741a7fd4b8 08b12cda6c44dc Author: Martin K. Petersen Date: Wed Nov 12 18:16:05 2025 -0500 Merge patch series "Optimize the hot path in the UFS driver" Bart Van Assche says: Hi Martin, This patch series optimizes the hot path of the UFS driver by making struct scsi_cmnd and struct ufshcd_lrb adjacent. Making these two data structures adjacent is realized as follows: @@ -9040,6 +9046,7 @@ static const struct scsi_host_template ufshcd_driver_template = { .name = UFSHCD, .proc_name = UFSHCD, .map_queues = ufshcd_map_queues, + .cmd_size = sizeof(struct ufshcd_lrb), .init_cmd_priv = ufshcd_init_cmd_priv, .queuecommand = ufshcd_queuecommand, .mq_poll = ufshcd_poll, The following changes had to be made prior to making these two data structures adjacent: * Add support for driver-internal and reserved commands in the SCSI core. * Instead of making the reserved command slot (hba->reserved_slot) invisible to the SCSI core, let the SCSI core allocate a reserved command. * Remove all UFS data structure members that are no longer needed because struct scsi_cmnd and struct ufshcd_lrb are now adjacent * Call ufshcd_init_lrb() from inside the code for queueing a command instead of calling this function before I/O starts. This is necessary because ufshcd_memory_alloc() allocates fewer instances than the block layer allocates requests. See also the following code in the block layer core: if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx, hctx->numa_node)) Although the UFS driver could be modified such that ufshcd_init_lrb() is called from ufshcd_init_cmd_priv(), realizing this would require moving the memory allocations that happen from inside ufshcd_memory_alloc() into ufshcd_init_cmd_priv(). That would make this patch series even larger. Although ufshcd_init_lrb() is called for each command, the benefits of reduced indirection and better cache efficiency outweigh the small overhead of per-command lrb initialization. * ufshcd_add_scsi_host() happens now before any device management commands are submitted. This change is necessary because this patch makes device management command allocation happen when the SCSI host is allocated. * Allocate as many command slots as the host controller supports. Decrease host->cmds_per_lun if necessary once it is clear whether or not the UFS device supports less command slots than the host controller. Please consider this patch series for the next merge window. Thanks, Bart. Link: https://patch.msgid.link/20251031204029.2883185-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 044b9f1a7f4f3d41563007d0762c83a7d7505ac0 Author: Mika Westerberg Date: Wed Nov 12 08:46:14 2025 +0100 PCI/PTM: Enable only if device advertises relevant role We have a Switch Upstream Port (2b:00.0) that has a PTM Capability, but doesn't advertise support for any PTM roles: Capabilities: [220 v1] Precision Time Measurement PTMCap: Requester- Responder- Root- Linux enables PTM without looking into what roles it actually supports, and apparently the Port immediately sends PTM Requests even though it doesn't support the PTM Requester role. The messages include an invalid bus number, so the Root Port detects an ACS Violation (see the PCIe r7.0, sec 6.12.1.1, implementation note): pci 0000:2b:00.0: [8086:5786] type 01 class 0x060400 PCIe Switch Upstream Port pci 0000:2b:00.0: PTM enabled, 4ns granularity pcieport 0000:00:07.1: AER: Multiple Uncorrectable (Non-Fatal) error message received from 0000:00:07.1 pcieport 0000:00:07.1: PCIe Bus Error: severity=Uncorrectable (Non-Fatal), type=Transaction Layer, (Receiver ID) pcieport 0000:00:07.1: device [8086:e44f] error status/mask=00200000/00000000 pcieport 0000:00:07.1: [21] ACSViol (First) pcieport 0000:00:07.1: AER: TLP Header: 0x34000000 0x00000052 0x00000000 0x00000000 The TLP Header shows a 4 DW header, no data (001b) Msg with Local routing (1 0100b) with Requester ID 0x0000 and PTM Request code (0x52). Fix this by enabling PTM only if the following conditions are true (see sec 6.21.1 figure 6-21): - Endpoint must advertise PTM Requester Capable - Switch Upstream Port must advertise PTM Responder Capable - Root Port must advertise PTM Root Capable Signed-off-by: Mika Westerberg [bhelgaas: commit log, comments] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20251112074614.1440266-1-mika.westerberg@linux.intel.com commit ed382b95f5de9b98668b3d00c7adddfdd4fc5c31 Author: Tony Battersby Date: Mon Nov 10 10:55:22 2025 -0500 scsi: qla2xxx: target: Fix term exchange when cmd_sent_to_fw == 1 Properly set the nport_handle field of the terminate exchange message. Previously when this field was not set properly, the term exchange would fail when cmd_sent_to_fw == 1 but work when cmd_sent_to_fw == 0 (i.e. it would fail when the HW was actively transferring data or status for the cmd but work when the HW was idle). With this change, term exchange works in any cmd state, which now makes it possible to abort a command that is locked up in the HW. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/1a221699-969b-4f28-8ea4-395d2f7a7c0a@cybernetics.com Signed-off-by: Martin K. Petersen commit c34e373f535e74d3caf1c0d81b6819deb52d37ed Author: Tony Battersby Date: Mon Nov 10 10:54:07 2025 -0500 scsi: qla2xxx: target: Improve debug output for term exchange Print better debug info when terminating a command, and print the response status from the hardware. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/22f8a0b6-0e24-474d-9f28-9d65c9b7af03@cybernetics.com Signed-off-by: Martin K. Petersen commit 9da4e1dcea465acfa9a33586019e686f2b5ad379 Author: Tony Battersby Date: Mon Nov 10 10:52:49 2025 -0500 scsi: qla2xxx: target: Remove code for unsupported hardware As far as I can tell, CONTINUE_TGT_IO_TYPE and CTIO_A64_TYPE are message types from non-FWI2 boards (older than ISP24xx), which are not supported by qla_target.c. Removing them makes it possible to turn a void * into the real type and avoid some typecasts. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/cb006628-e321-4e30-a60b-08b37b8685a5@cybernetics.com Signed-off-by: Martin K. Petersen commit 957aa5974989fba4ae4f807ebcb27f12796edd4d Author: Tony Battersby Date: Mon Nov 10 10:51:28 2025 -0500 scsi: qla2xxx: Use reinit_completion on mbx_intr_comp If a mailbox command completes immediately after wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left in an inconsistent state, causing the next mailbox command not to wait for the hardware. Fix by reinitializing the completion before use. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com Signed-off-by: Martin K. Petersen commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 Author: Tony Battersby Date: Mon Nov 10 10:50:05 2025 -0500 scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled When qla2xxx is loaded with qlini_mode=disabled, ha->flags.disable_msix_handshake is used before it is set, resulting in the wrong interrupt handler being used on certain HBAs (qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be used). The only difference between these two interrupt handlers is that the _hs() version writes to a register to clear the "RISC" interrupt, whereas the other version does not. So this bug results in the RISC interrupt being cleared when it should not be. This occasionally causes a different interrupt handler qla24xx_msix_default() for a different vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt, which then causes problems like: qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20, iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500 host_status 0x40000010 hccr 0x3f00 qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20, mb[0]=0x20. Scheduling ISP abort (the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a) This problem can be reproduced with a 16 or 32 Gbps HBA by loading qla2xxx with qlini_mode=disabled and running a high IOPS test while triggering frequent RSCN database change events. While analyzing the problem I discovered that even with disable_msix_handshake forced to 0, it is not necessary to clear the RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting it, which also fixes the bug with qlini_mode=disabled. The test below describes the justification for not needing qla2xxx_msix_rsp_q_hs(): Force disable_msix_handshake to 0: qla24xx_config_rings(): if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) && (ha->flags.msix_enabled)) { In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check: (rd_reg_dword(®->host_status) & HSRX_RISC_INT) Count the number of calls to each function with HSRX_RISC_INT set and the number with HSRX_RISC_INT not set while performing some I/O. If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code): qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set (# of qla2xxx_msix_rsp_q_hs interrupts) = (# of qla24xx_msix_rsp_q interrupts) * 3 If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched code): qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set (# of qla2xxx_msix_rsp_q_hs interrupts) = (# of qla24xx_msix_rsp_q interrupts) * 3 In the case of the original code, qla24xx_msix_rsp_q() was seeing HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs() was clearing it when it shouldn't have been. In the patched code, qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which makes sense if that interrupt handler needs to clear the RISC interrupt (which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of the time, which is just overlap from the other interrupt during the high IOPS test. Tested with SCST on: QLE2742 FW:v9.08.02 (32 Gbps 2-port) QLE2694L FW:v9.10.11 (16 Gbps 4-port) QLE2694L FW:v9.08.02 (16 Gbps 4-port) QLE2672 FW:v8.07.12 (16 Gbps 2-port) both initiator and target mode Signed-off-by: Tony Battersby Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com Signed-off-by: Martin K. Petersen commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 Author: Tony Battersby Date: Mon Nov 10 10:48:45 2025 -0500 scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive When given the module parameter qlini_mode=exclusive, qla2xxx in initiator mode is initially unable to successfully send SCSI commands to devices it finds while scanning, resulting in an escalating series of resets until an adapter reset clears the issue. Fix by checking the active mode instead of the module parameter. Signed-off-by: Tony Battersby Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com Signed-off-by: Martin K. Petersen commit b57fbc88715b6d18f379463f48a15b560b087ffe Author: Tony Battersby Date: Mon Nov 10 10:47:35 2025 -0500 scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to __qla2x00_abort_all_cmds() to call sp->done() without holding a spinlock. But unlike the older code below it, this new code failed to check sp->cmd_type and just assumed TYPE_SRB, which results in a jump to an invalid pointer in target-mode with TYPE_TGT_CMD: qla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success 0000000009f7a79b qla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h. qla2xxx [0000:65:00.0]-d01e:8: -> fwdump no buffer qla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event 0x8002 occurred qla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery - ha=0000000058183fda. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor instruction fetch in kernel mode PF: error_code(0x0010) - not-present page PGD 0 P4D 0 Oops: 0010 [#1] SMP CPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G O 6.1.133 #1 Hardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206 RAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000 RDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0 RBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045 R10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40 R13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400 FS: 0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __die+0x4d/0x8b ? page_fault_oops+0x91/0x180 ? trace_buffer_unlock_commit_regs+0x38/0x1a0 ? exc_page_fault+0x391/0x5e0 ? asm_exc_page_fault+0x22/0x30 __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst] qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst] qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst] qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst] qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst] kthread+0xa8/0xd0 Then commit 4475afa2646d ("scsi: qla2xxx: Complete command early within lock") added the spinlock back, because not having the lock caused a race and a crash. But qla2x00_abort_srb() in the switch below already checks for qla2x00_chip_is_down() and handles it the same way, so the code above the switch is now redundant and still buggy in target-mode. Remove it. Cc: stable@vger.kernel.org Signed-off-by: Tony Battersby Link: https://patch.msgid.link/3a8022dc-bcfd-4b01-9f9b-7a9ec61fa2a3@cybernetics.com Signed-off-by: Martin K. Petersen commit 6b74d0a5e259d268312259c83d1a61744fbc9306 Author: Sk Anirban Date: Thu Nov 13 00:21:56 2025 +0530 drm/xe/guc: Eliminate RPa frequency caching Remove the cached pc->rpa_freq field and refactor RPA frequency handling to fetch values directly from hardware registers on each request. v2: Check graphics version instead of platform (Rodrigo) v3: Fix graphics version check (Badal) Suggested-by: Rodrigo Vivi Suggested-by: Badal Nilawar Signed-off-by: Sk Anirban Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20251112185153.3593145-6-sk.anirban@intel.com Signed-off-by: Rodrigo Vivi commit 2917e17b5fd25447a702e79f4ecba3e3b3e08d58 Author: Sk Anirban Date: Thu Nov 13 00:21:55 2025 +0530 drm/xe/guc: Eliminate RPe caching for SLPC parameter handling RPe is runtime-determined by PCODE and caching it caused stale values, leading to incorrect GuC SLPC parameter settings. Drop the cached rpe_freq field and query fresh values from hardware on each use to ensure GuC SLPC parameters reflect current RPe. v2: Remove cached RPe frequency field (Rodrigo) v3: Remove extra variable (Vinay) Modify function name (Vinay) v4: Maintain a separate function for PVC (Rodrigo) v5: Avoid RPn update while fetching RPe frequency (Rodrigo) v6: Split platform-specific RPe comments (Vinay) Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5166 Signed-off-by: Sk Anirban Reviewed-by: Vinay Belgaumkar Link: https://patch.msgid.link/20251112185153.3593145-5-sk.anirban@intel.com Signed-off-by: Rodrigo Vivi commit 56c069307dfd0a5e39b685e0aeee6c40d1d7ddfc Author: Jason Gunthorpe Date: Fri Nov 7 13:41:38 2025 -0400 vfio: Remove the get_region_info op No driver uses it now, all are using get_region_info_caps(). Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/22-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit dc10734610e29bb6464498e933fc0d622227153d Author: Jason Gunthorpe Date: Fri Nov 7 13:41:37 2025 -0400 vfio: Move the remaining drivers to get_region_info_caps Remove the duplicate code and change info to a pointer. caps are not used. Reviewed-by: Kevin Tian Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/21-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 182c62861ba5a2301c7178484d2f424aaae4283b Author: Jason Gunthorpe Date: Fri Nov 7 13:41:36 2025 -0400 vfio/platform: Convert to get_region_info_caps Remove the duplicate code and change info to a pointer. caps are not used. Reviewed-by: Kevin Tian Reviewed-by: Mostafa Saleh Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 1b0ecb5baf4af3baa8627144bbcf9848806aa5f1 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:35 2025 -0400 vfio/pci: Convert all PCI drivers to get_region_info_caps Since the core function signature changes it has to flow up to all drivers. Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Brett Creeley Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/19-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 973af0c40eaf5cf201d22f1cf6b50587d0138703 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:34 2025 -0400 vfio/ccw: Convert to get_region_info_caps Remove the duplicate code and flatten the call chain. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Reviewed-by: Eric Farman Link: https://lore.kernel.org/r/18-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 93165757c023940dc5e32a3b64a750fb6767bd8a Author: Jason Gunthorpe Date: Fri Nov 7 13:41:33 2025 -0400 vfio/gvt: Convert to get_region_info_caps Remove the duplicate code and change info to a pointer. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/17-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 45f9fa18109d9dece3604bbbc810d526e424b536 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:32 2025 -0400 vfio/mbochs: Convert mbochs to use vfio_info_add_capability() This driver open codes the cap chain manipulations. Instead use vfio_info_add_capability() and the get_region_info_caps() op. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/16-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 775f726a742a60d8d0ed2b4733a5b6a796d9d1dd Author: Jason Gunthorpe Date: Fri Nov 7 13:41:31 2025 -0400 vfio: Add get_region_info_caps op This op does the copy to/from user for the info and can return back a cap chain through a vfio_info_cap * result. Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/15-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit f97859503859fd217d27fc4496f294955e197eaf Author: Jason Gunthorpe Date: Fri Nov 7 13:41:30 2025 -0400 vfio: Require drivers to implement get_region_info Remove the fallback through the ioctl callback, no drivers use this now. Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Mostafa Saleh Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/14-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit e664067b603570164794facf06686434a12cb74d Author: Jason Gunthorpe Date: Fri Nov 7 13:41:29 2025 -0400 vfio/gvt: Provide a get_region_info op Move it out of intel_vgpu_ioctl() and re-indent it. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/13-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 61b3f7b5a72905e45f5d7769472edea8d80b56ef Author: Jason Gunthorpe Date: Fri Nov 7 13:41:28 2025 -0400 vfio/ccw: Provide a get_region_info op Move it out of vfio_ccw_mdev_ioctl() and re-indent it. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Reviewed-by: Eric Farman Link: https://lore.kernel.org/r/12-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit b9827eff6b4aab8203a1aa720ae3a6d3731f1a4d Author: Jason Gunthorpe Date: Fri Nov 7 13:41:27 2025 -0400 vfio/cdx: Provide a get_region_info op Change the signature of vfio_cdx_ioctl_get_region_info() and hook it to the op. Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/11-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 6cdae5d0c326f0ec8f0f50571df0374f2f0b8815 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:26 2025 -0400 vfio/fsl: Provide a get_region_info op Move it out of vfio_fsl_mc_ioctl() and re-indent it. Reviewed-by: Kevin Tian Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/10-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit d4635df279f57de1dd301b864724a930551028b2 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:25 2025 -0400 vfio/platform: Provide a get_region_info op Move it out of vfio_platform_ioctl() and re-indent it. Add it to all platform drivers. Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Mostafa Saleh Reviewed-by: Eric Auger Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/9-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 8339fccda83772ff1b035f848d1f992410c61c57 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:24 2025 -0400 vfio/mbochs: Provide a get_region_info op Move it out of mbochs_ioctl() and re-indent it. Reviewed-by: Kevin Tian Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/8-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit cf16acc0af09a12d46e972f42186d94931325ea8 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:23 2025 -0400 vfio/mdpy: Provide a get_region_info op Move it out of mdpy_ioctl() and re-indent it. Reviewed-by: Kevin Tian Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/7-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 0787755271096e6c48019f44aea6ccc33f93bf41 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:22 2025 -0400 vfio/mtty: Provide a get_region_info op Move it out of mtty_ioctl() and re-indent it. Reviewed-by: Kevin Tian Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/6-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit f3fddb71dd50ed31ae474238551e8623a1bc16db Author: Jason Gunthorpe Date: Fri Nov 7 13:41:21 2025 -0400 vfio/pci: Fill in the missing get_region_info ops Now that every variant driver provides a get_region_info op remove the ioctl based dispatch from vfio_pci_core_ioctl(). Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/5-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 5ac7206474777dff56f79f1d6bc9973e988f7587 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:20 2025 -0400 vfio/nvgrace: Convert to the get_region_info op Change the signature of nvgrace_gpu_ioctl_get_region_info() Reviewed-by: Kevin Tian Reviewed-by: Ankit Agrawal Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/4-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit c044eefa47864fb436254cb330e8d90cb6a3a870 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:19 2025 -0400 vfio/virtio: Convert to the get_region_info op Remove virtiovf_vfio_pci_core_ioctl() and change the signature of virtiovf_pci_ioctl_get_region_info(). Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/3-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit e238f147d517681e5dcb3dc9ab149211d66b00a1 Author: Jason Gunthorpe Date: Fri Nov 7 13:41:18 2025 -0400 vfio/hisi: Convert to the get_region_info op Change the function signature of hisi_acc_vfio_pci_ioctl() and re-indent it. Reviewed-by: Kevin Tian Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/2-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 8d27dd0b219f00fc1e0548ae5008abd7bb350611 Author: Dave Jiang Date: Thu Nov 6 10:01:08 2025 -0700 cxl: Clarify comment in spa_maps_hpa() Update the comment in spa_maps_hpa() to clearly convey the construction of extended linear cache. Suggested-by: Dan Williams Link: https://lore.kernel.org/linux-cxl/68eea19c7e67e_2f899100a8@dwillia2-mobl4.notmuch/ Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Link: https://patch.msgid.link/20251106170108.1468304-3-dave.jiang@intel.com Signed-off-by: Dave Jiang commit c43521b9db7f5ed481cfdfb04ad2e7fe0cb9dcf5 Author: Dave Jiang Date: Thu Nov 6 10:01:07 2025 -0700 cxl: Rename region_res_match_cxl_range() to spa_maps_hpa() The function name region_res_match_cxl_range() does not accurately convey the operation of address comparison with cache size. Rename to spa_maps_hpa() to provide a better function name. Suggested-by: Dan Williams Link: https://lore.kernel.org/linux-cxl/68eea19c7e67e_2f899100a8@dwillia2-mobl4.notmuch/ Reviewed-by: Jonathan Cameron Reviewed-by: Gregory Price Link: https://patch.msgid.link/20251106170108.1468304-2-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 08b12cda6c44dc015bcc152613c35ee0ae8f37b9 Author: Bart Van Assche Date: Fri Oct 31 13:39:36 2025 -0700 scsi: ufs: core: Switch to scsi_get_internal_cmd() Instead of storing the tag of the reserved command in hba->reserved_slot, use scsi_get_internal_cmd() and scsi_put_internal_cmd() to allocate the tag for the reserved command dynamically. Add ufshcd_queue_reserved_command() for submitting reserved commands. Add support in ufshcd_abort() for device management commands. Use blk_execute_rq() for submitting reserved commands. Remove the code and data structures that became superfluous. This includes ufshcd_wait_for_dev_cmd(), hba->reserved_slot and ufs_dev_cmd.complete. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-29-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit a11c015c8a4fff99cf91a5cbc9789cc7a72b3ccf Author: Bart Van Assche Date: Fri Oct 31 13:39:35 2025 -0700 scsi: ufs: core: Move code out of ufshcd_wait_for_dev_cmd() The ufshcd_dev_cmd_completion() call is useful for some but not for all ufshcd_wait_for_dev_cmd() callers. Hence, remove the ufshcd_dev_cmd_completion() call from ufshcd_wait_for_dev_cmd() and move it past the ufshcd_issue_dev_cmd() calls where appropriate. This makes it easier to detect timeout errors for UPIU frames submitted through the BSG interface. Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-28-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 4b6c0d9cca359d1d2f666e14c42482befe5c4829 Author: Bart Van Assche Date: Fri Oct 31 13:39:34 2025 -0700 scsi: ufs: core: Make blk_mq_tagset_busy_iter() skip reserved requests A later patch will convert hba->reserved_slot into a reserved tag. Make blk_mq_tagset_busy_iter() skip reserved requests such that device management commands are skipped. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-27-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 9a2c9500921d5ebbe96f7531adc73d9205c76485 Author: Bart Van Assche Date: Fri Oct 31 13:39:33 2025 -0700 scsi: ufs: core: Remove the ufshcd_lrb task_tag member Remove the ufshcd_lrb task_tag member and use scsi_cmd_to_rq(cmd)->tag instead. Use rq->tag instead of lrbp->task_tag. This patch reduces the size of struct ufshcd_lrb. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-26-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 176b93004c3475cfc0c939a4aeec846f6bf2b9a0 Author: Bart Van Assche Date: Fri Oct 31 13:39:32 2025 -0700 scsi: ufs: core: Pass a SCSI pointer instead of an LRB pointer Pass a pointer to a SCSI command between functions instead of an LRB pointer. This change prepares for removing the ufshcd_lrb task_tag member. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-25-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 22089c218037ca7cd50d4fa20e8b5bd746a9b397 Author: Bart Van Assche Date: Fri Oct 31 13:39:31 2025 -0700 scsi: ufs: core: Optimize the hot path Set .cmd_size in the SCSI host template such that the SCSI core makes struct scsi_cmnd and struct ufshcd_lrb adjacent. Convert the cmd->lrbp and lrbp->cmd memory loads into pointer offset calculations. Remove the data structure members that became superfluous, namely ufshcd_lrb.cmd and ufs_hba.lrb. Since ufshcd_lrb.cmd is removed, this pointer cannot be used anymore to test whether or not a command is a SCSI command. Introduce a new function for this purpose, namely ufshcd_is_scsi_cmd(). Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-24-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit e5f9cc2af9a82700e989ac08be3c85c25046a6f6 Author: Bart Van Assche Date: Fri Oct 31 13:39:30 2025 -0700 scsi: ufs: core: Do not clear driver-private command data Tell the SCSI core to skip the memset() call that clears driver-private data because __ufshcd_setup_cmd() performs all necessary initialization. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-23-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 1d0af94ffb5d4c9b99d38646521b6d3e4119d044 Author: Bart Van Assche Date: Fri Oct 31 13:39:29 2025 -0700 scsi: ufs: core: Make the reserved slot a reserved request Instead of letting the SCSI core allocate hba->nutrs - 1 commands, let the SCSI core allocate hba->nutrs commands, set the number of reserved tags to 1 and use the reserved tag for device management commands. This patch changes the 'reserved slot' from hba->nutrs - 1 into 0 because the block layer reserves the smallest tags for reserved commands. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-22-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit d3fd0fd7768681eaeb03742c9e8ae846c505f564 Author: Bart Van Assche Date: Fri Oct 31 13:39:28 2025 -0700 scsi: ufs: core: Use hba->reserved_slot Use hba->reserved_slot instead of open-coding it. This patch prepares for changing the value of hba->reserved_slot. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-21-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 45e636ea129486c4cf7bb342b0d59c186ae2fabb Author: Bart Van Assche Date: Fri Oct 31 13:39:27 2025 -0700 scsi: ufs: core: Call ufshcd_init_lrb() later Call ufshcd_init_lrb() from inside ufshcd_setup_dev_cmd() instead of ufshcd_host_memory_configure(). This patch prepares for calling ufshcd_host_memory_configure() before the information is available that is required to call ufshcd_setup_dev_cmd(). Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-20-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit f46b9a595fa95c82e3279b687869cac249838e96 Author: Bart Van Assche Date: Fri Oct 31 13:39:26 2025 -0700 scsi: ufs: core: Allocate the SCSI host earlier Call ufshcd_add_scsi_host() before any UPIU commands are sent to the UFS device. This patch prepares for letting ufshcd_add_scsi_host() allocate memory for both SCSI and UPIU commands. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-19-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit e8ea985a8314e0170124476e0fa5a5da868a7a40 Author: Bart Van Assche Date: Fri Oct 31 13:39:25 2025 -0700 scsi: ufs: core: Rework the SCSI host queue depth calculation code Prepare for allocating the SCSI host earlier by making the SCSI host queue depth independent of the queue depth supported by the UFS device. This patch may increase the queue depth of the UFS SCSI host. Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-18-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit f18fac1e2b729d3bdeb41b946d90b57f3515f438 Author: Bart Van Assche Date: Fri Oct 31 13:39:24 2025 -0700 scsi: ufs: core: Rework ufshcd_eh_device_reset_handler() Merge the MCQ mode and legacy mode loops into a single loop. This patch prepares for optimizing the hot path by removing the direct hba->lrb[] accesses from ufshcd_eh_device_reset_handler(). Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-17-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 63a5b959c854c33f280533eedd27bd3489e2b704 Author: Bart Van Assche Date: Fri Oct 31 13:39:23 2025 -0700 scsi: ufs: core: Rework ufshcd_mcq_compl_pending_transfer() Replace a tag loop with blk_mq_tagset_busy_iter(). This patch prepares for removing the hba->lrb[] array. Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-16-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit f59568f4e27af9ba3b0e89909c6fb2cab38700c5 Author: Bart Van Assche Date: Fri Oct 31 13:39:22 2025 -0700 scsi: ufs: core: Change the monitor function argument types Pass a SCSI command pointer instead of a struct ufshcd_lrb pointer. This patch prepares for combining the SCSI command and ufshcd_lrb data structures into a single data structure. Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-15-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit ae7bf255b10e4c8382faec06f527ba832c18be24 Author: Bart Van Assche Date: Fri Oct 31 13:39:21 2025 -0700 scsi: ufs: core: Only call ufshcd_should_inform_monitor() for SCSI commands ufshcd_should_inform_monitor() only returns 'true' for SCSI commands. Instead of checking inside ufshcd_should_inform_monitor() whether its second argument represents a SCSI command, only call this function for SCSI commands. This patch prepares for removing the lrbp->cmd member. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-14-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 3e7fff3fee5b7fa1538b2cef023733cf10366a4a Author: Bart Van Assche Date: Fri Oct 31 13:39:20 2025 -0700 scsi: ufs: core: Change the type of one ufshcd_send_command() argument Change the 'task_tag' argument into an LRB pointer. This patch prepares for the removal of the hba->lrb[] array. Reviewed-by: Avri Altman Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-13-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit ffa5d8c15300a3047c9a445dce81515cd3cde86e Author: Bart Van Assche Date: Fri Oct 31 13:39:19 2025 -0700 scsi: ufs: core: Change the type of one ufshcd_add_command_trace() argument Change the 'tag' argument into a SCSI command pointer. This patch prepares for the removal of the hba->lrb[] array. Reviewed-by: Avri Altman Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-12-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 60a1f6a8ad334475372a128a6856e893a910302e Author: Bart Van Assche Date: Fri Oct 31 13:39:18 2025 -0700 scsi: ufs: core: Only call ufshcd_add_command_trace() for SCSI commands Instead of checking inside ufshcd_add_command_trace() whether 'cmd' points at a SCSI command, let the caller perform that check. This patch prepares for removing the lrbp->cmd pointer. Reviewed-by: Avri Altman Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-11-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 9f8e09230f532c806ed088417f1ad794dd19a10f Author: Bart Van Assche Date: Fri Oct 31 13:39:17 2025 -0700 scsi: ufs: core: Change the type of one ufshcd_add_cmd_upiu_trace() argument Change the 'tag' argument into an LRB pointer. This patch prepares for the removal of the hba->lrb[] array. Reviewed-by: Avri Altman Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-10-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit dd4299af9b049c0dcb28699327ebc1386aab4b2a Author: Bart Van Assche Date: Fri Oct 31 13:39:16 2025 -0700 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() Since 'tag' is only used inside the if-statement, move the 'tag' assignment into the if-statement. This patch prepares for introducing a WARN_ON_ONCE() call in ufshcd_mcq_get_tag() if the tag lookup fails. Reviewed-by: Avri Altman Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-9-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 581ca490353ca5f4bee0d662595af27c06e603d4 Author: Bart Van Assche Date: Fri Oct 31 13:39:15 2025 -0700 scsi: scsi_debug: Abort SCSI commands via an internal command Add a .queue_reserved_command() implementation and call it from the code path that aborts SCSI commands. This ensures that the code for allocating a pseudo SCSI device and also the code for allocating and processing reserved commands gets triggered while running blktests. Most of the code in this patch is a modified version of code from John Garry. See also https://lore.kernel.org/linux-scsi/75018e17-4dea-4e1b-8c92-7a224a1e13b9@oracle.com/ Reviewed-by: John Garry Suggested-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-8-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit a2ab4e33286de37f3fe8f28f86f5f71d6b0ae3b0 Author: Hannes Reinecke Date: Fri Oct 31 13:39:14 2025 -0700 scsi: core: Add scsi_{get,put}_internal_cmd() helpers Add helper functions to allow LLDDs to allocate and free internal commands. [ bvanassche: changed the 'nowait' argument into a 'flags' argument. See also https://lore.kernel.org/linux-scsi/20211125151048.103910-3-hare@suse.de/ ] Reviewed-by: John Garry Signed-off-by: Hannes Reinecke Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-7-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 11ea1de3fc4ba94127034cb01df63a666c4c9836 Author: John Garry Date: Fri Oct 31 13:39:13 2025 -0700 scsi: core: Introduce .queue_reserved_command() Reserved commands will be used by SCSI LLDs for submitting internal commands. Since the SCSI host, target and device limits do not apply to the reserved command use cases, bypass the SCSI host limit checks for reserved commands. Introduce the .queue_reserved_command() callback for reserved commands. Additionally, do not activate the SCSI error handler if a reserved command fails such that reserved commands can be submitted from inside the SCSI error handler. [ bvanassche: modified patch title and patch description. Renamed .reserved_queuecommand() into .queue_reserved_command(). Changed the second argument of __blk_mq_end_request() from 0 into error code in the completion path if cmd->result != 0. Rewrote the scsi_queue_rq() changes. See also https://lore.kernel.org/linux-scsi/1666693096-180008-5-git-send-email-john.garry@huawei.com/ ] Cc: Hannes Reinecke Signed-off-by: John Garry Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20251031204029.2883185-6-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit d630fbf6fc8ce2fc95de7784de5499387b682dc1 Author: Hannes Reinecke Date: Fri Oct 31 13:39:12 2025 -0700 scsi: core: Support allocating a pseudo SCSI device Allocate a pseudo SCSI device if 'nr_reserved_cmds' has been set. Pseudo SCSI devices have the SCSI ID :U64_MAX so they won't clash with any devices the LLD might create. Pseudo SCSI devices are excluded from scanning and will not show up in sysfs. Additionally, pseudo SCSI devices are skipped by shost_for_each_device(). This prevents that the SCSI error handler tries to submit a reset to a non-existent logical unit. Do not allocate a budget map for pseudo SCSI devices since the cmd_per_lun limit does not apply to pseudo SCSI devices. Do not perform queue depth ramp up / ramp down for pseudo SCSI devices. Pseudo SCSI devices will be used to send internal commands to a storage device. [ bvanassche: edited patch description / renamed host_sdev into pseudo_sdev / unexported scsi_get_host_dev() / modified error path in scsi_get_pseudo_dev() / skip pseudo devices in __scsi_iterate_devices() and also when calling sdev_init(), sdev_configure() and sdev_destroy(). See also https://lore.kernel.org/linux-scsi/20211125151048.103910-2-hare@suse.de/ ] Reviewed-by: John Garry Signed-off-by: Hannes Reinecke Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-5-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit a47c7bef57858d29b83cd7f101112f52821439f9 Author: Bart Van Assche Date: Fri Oct 31 13:39:11 2025 -0700 scsi: core: Make the budget map optional Prepare for not allocating a budget map for pseudo SCSI devices by checking whether a budget map has been allocated before using it. Reviewed-by: Hannes Reinecke Cc: John Garry Cc: Ming Lei Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 21008cabc5d9bf2864ff244f4f94abebe3380947 Author: Bart Van Assche Date: Fri Oct 31 13:39:10 2025 -0700 scsi: core: Move two statements Move two statements that will be needed for pseudo SCSI devices in front of code that won't be needed for pseudo SCSI devices. No functionality has been changed. Reviewed-by: John Garry Reviewed-by: Hannes Reinecke Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit d604e1ec246d236deff57ac7e89e073dd911d60b Author: Hannes Reinecke Date: Fri Oct 31 13:39:09 2025 -0700 scsi: core: Support allocating reserved commands Quite some drivers are using management commands internally. These commands typically use the same tag pool as regular SCSI commands. Tags for these management commands are set aside before allocating the block-mq tag bitmap for regular SCSI commands. The block layer already supports this via the reserved tag mechanism. Add a new field 'nr_reserved_cmds' to the SCSI host template to instruct the block layer to set aside a tag space for these management commands by using reserved tags. Exclude reserved commands from .can_queue because .can_queue is visible in sysfs. [ bvanassche: modified patch title and patch description. Left out the following statements: "if (sht->nr_reserved_cmds)" and also "if (sdev->host->nr_reserved_cmds) flags |= BLK_MQ_REQ_RESERVED;". Moved nr_reserved_cmds declarations and statements close to the corresponding can_queue declarations and statements. See also https://lore.kernel.org/linux-scsi/20210503150333.130310-11-hare@suse.de/ ] Signed-off-by: Hannes Reinecke Reviewed-by: John Garry Signed-off-by: Bart Van Assche Link: https://patch.msgid.link/20251031204029.2883185-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 113557b0406818a8a5df3479b0a89125d2b2a04c Author: Jason Gunthorpe Date: Fri Nov 7 13:41:17 2025 -0400 vfio: Provide a get_region_info op Instead of hooking the general ioctl op, have the core code directly decode VFIO_DEVICE_GET_REGION_INFO and call an op just for it. This is intended to allow mechanical changes to the drivers to pull their VFIO_DEVICE_GET_REGION_INFO int oa function. Later patches will improve the function signature to consolidate more code. Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/1-v2-2a9e24d62f1b+e10a-vfio_get_region_info_op_jgg@nvidia.com Signed-off-by: Alex Williamson commit 123cd174a3782307787268adf45f22de4d290128 Author: Thorsten Blum Date: Wed Nov 12 21:26:25 2025 +0100 ASoC: Intel: atom: Replace strcpy() with strscpy() strcpy() is deprecated; use the safer strscpy() instead. Link: https://github.com/KSPP/linux/issues/88 Reviewed-by: Cezary Rojewski Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20251112202630.6277-1-thorsten.blum@linux.dev Signed-off-by: Mark Brown commit 15e14267889bde30b7b82bc03432483222b4b42c Author: Dave Jiang Date: Wed Nov 5 16:51:14 2025 -0700 acpi/hmat: Return when generic target is updated With the current code flow, once the generic target is updated target->registered is set and the remaining code is skipped. So return immediately instead of going through the checks and then skip. Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251105235115.85062-2-dave.jiang@intel.com Signed-off-by: Dave Jiang commit f233339188cd9b1a985fd8410d5811e920fdd4ef Author: Bart Van Assche Date: Tue Nov 11 15:29:02 2025 -0800 blk-zoned: Move code from disk_zone_wplug_add_bio() into its caller Move the following code into the only caller of disk_zone_wplug_add_bio(): - The code for clearing the REQ_NOWAIT flag. - The code that sets the BLK_ZONE_WPLUG_PLUGGED flag. - The disk_zone_wplug_schedule_bio_work() call. This patch moves all code that is related to REQ_NOWAIT or to bio scheduling into a single function. Additionally, the 'schedule_bio_work' variable is removed. No functionality has been changed. Cc: Damien Le Moal Cc: Christoph Hellwig Signed-off-by: Bart Van Assche Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit faa3be1a61bfaace4c2bd57434de7b13347f9f31 Author: Bart Van Assche Date: Tue Nov 11 15:29:01 2025 -0800 blk-zoned: Document disk_zone_wplug_schedule_bio_work() locking Document that all callers hold this lock because the code in disk_zone_wplug_schedule_bio_work() depends on this. Reviewed-by: Chaitanya Kulkarni Reviewed-by: Damien Le Moal Cc: Christoph Hellwig Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe commit fd0ae4754c7b2add72338b14ddc8c8ff5ffda426 Author: Bart Van Assche Date: Tue Nov 11 15:29:00 2025 -0800 blk-zoned: Fix a typo in a source code comment Remove a superfluous parenthesis that was introduced by commit fa8555630b32 ("blk-zoned: Improve the queue reference count strategy documentation"). Reviewed-by: Chaitanya Kulkarni Reviewed-by: Damien Le Moal Cc: Christoph Hellwig Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe commit 7f3719bf144d574a4490ef135cb540c6748760b8 Author: Ville Syrjälä Date: Fri Nov 7 20:11:26 2025 +0200 drm/i915/cursor: Initialize 845 vs 865 cursor size separately The if+ternary combo used for the max cursor width initialization on 845/865 is rather cumbersome. Just split this into a straight up if ladder. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-10-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit aa4cd70b1b5e01b0344f8cd93a8e03798e88bc27 Author: Ville Syrjälä Date: Fri Nov 7 20:11:25 2025 +0200 drm/i915/cursor: Extract intel_cursor_mode_config_init() Move the max cursor size initialization into intel_cursor.c so that all the platform specific details about cursors are concentrated in one file. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-9-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 3107fc63078bf1c3df235eabf6609155fd1c239c Author: Ville Syrjälä Date: Fri Nov 7 20:11:24 2025 +0200 drm/i915: Use mode_config->cursor_width for cursor DDB allocation Replace the hardcoded 256 with mode_config->cursor_width when doing the cursor DDB allocation. Currently 256 is correct for all SKL+, but this might change in the future. One less place to change should that happen. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-8-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 608a7d3f21755e2c3c3c6e6a404e41afb725b4de Author: Ville Syrjälä Date: Fri Nov 7 20:11:23 2025 +0200 drm/i915/wm: Use drm_get_format_info() in SKL+ cursor DDB allocation Replace the technically inaccurate drm_format_info() with the accurate drm_get_format_info() in the SKL+ cursor DDB allocation code. Since we're only interested in the linear modifier here, the two functions do actually return the same information. But let's not use drm_format_info() to avoid setting a bad example. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-7-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit f5255f900b72a2c3b3eaad80606a716147eded18 Author: Ville Syrjälä Date: Fri Nov 7 20:11:22 2025 +0200 drm/i915/fb: Init 'ret' in each error branch in intel_framebuffer_init() Make the order of things a bit less fragile in intel_framebuffer_init() by assigning 'ret' in each error branch instead of depending on some earlier assignment. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-6-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 13fad66ffca63f7826547d8d913c056737dd7538 Author: Ville Syrjälä Date: Fri Nov 7 20:11:21 2025 +0200 drm/i915: Nuke intel_plane_config.tiling Use intel_fb_modifier_to_tiling() to convert the modifier into the fence tiling mode during BIOS FB readout, rather than hand rolling it. With this we can also stop tracking the tiling mode in the intel_plane_config. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 73206a7519788c3f86d13f746f47139776f7dbd2 Author: Ville Syrjälä Date: Fri Nov 7 20:11:20 2025 +0200 drm/i915: Populate fb->format accurately in BIOS FB readout Use drm_get_format_info() instead of drm_format_info() to populate fb->format during the BIOS FB readout. The difference being that drm_get_format_info() knows about compressed formats whereas drm_format_info() doesn't. This doesn't actually matter in practice since the BIOS FB should never be compressed, but no reason we shouldn't use the more accurate function here anyway. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 95357b68b693b6c659e2a3607d3afc5b7a8d4903 Author: Ville Syrjälä Date: Fri Nov 7 20:11:19 2025 +0200 drm/i915: Pass drm_format_info into plane->max_stride() Pass the format info into plane->max_stride() from the caller instead of doing yet another drm_format_info() lookup on the spot. drm_format_info() is both rather expensive, and technically incorrect since it doesn't return the correct format info for compressed formats (though that doesn't actually matter for the current .max_stride() implementations since they are just interested in the cpp value). Most callers already have the format info available. The only exception is intel_dumb_fb_max_stride() where we shall use the actually correct drm_get_format_info() variant. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 854efdc7efb59b0c90fb61b1d287eccb6718e861 Author: Ville Syrjälä Date: Fri Nov 7 20:11:18 2025 +0200 drm/i915: Introduce intel_dumb_fb_max_stride() Wrap intel_plane_fb_max_stride() in intel_dumb_fb_max_stride() for the purposes of dumb fb creation. I want to change intel_plane_fb_max_stride() to take a 'struct drm_format_info' instead of the 'u32 pixel_format' so we need an excplicit format info lookup in the dumb fb path and I don't really want to have that in i915_gem_dumb_create() directly. This makes intel_plane_fb_max_stride() internal to the display code again, and thus we can pass in struct intel_display instead of struct drm_device. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251107181126.5743-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit fdc7da1733d9d57c466e386d4242864d9e75c6f3 Author: Fange Zhang Date: Wed Nov 5 20:06:14 2025 +0800 arm64: defconfig: Enable SX150x GPIO expander driver The ANX7625 bridge on the Qualcomm QCS615 Ride reference board is connected to a Semtech SX150x GPIO expander. Enable the SX150x driver to make the display on boards built following this design functional. Signed-off-by: Fange Zhang Link: https://lore.kernel.org/r/20251105-enable-sx150x-gpio-expander-v3-1-2ec8dfde2c9e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 593ee49222a0d751062fd9a5e4a963ade4ec028a Author: Haotian Zhang Date: Tue Nov 11 15:50:00 2025 +0800 ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() acpi_fwnode_graph_parse_endpoint() calls fwnode_get_parent() to obtain the parent fwnode but returns without calling fwnode_handle_put() on it. This potentially leads to a fwnode refcount leak and prevents the parent node from being released properly. Call fwnode_handle_put() on the parent fwnode before returning to prevent the leak from occurring. Fixes: 3b27d00e7b6d ("device property: Move fwnode graph ops to firmware specific locations") Signed-off-by: Haotian Zhang Reviewed-by: Sakari Ailus [ rjw: Changelog edits ] Link: https://patch.msgid.link/20251111075000.1828-1-vulab@iscas.ac.cn Signed-off-by: Rafael J. Wysocki commit 2230c4bdc4120417799c74326ade3123da226d54 Author: Dave Jiang Date: Wed Nov 5 13:18:26 2025 -0700 cxl: Add handling of locked CXL decoder When a decoder is locked, it means that its configuration cannot be changed. CXL spec r3.2 8.2.4.20.13 discusses the details regarding locked decoders. Locking happens when bit 8 of the decoder control register is set and then the decoder is committed afterwards (CXL spec r3.2 8.2.4.20.7). Given that the driver creates a virtual decoder for each CFMWS, the Fixed Device Configuration (bit 4) of the Window Restriction field is considered as locking for the virtual decoder by the driver. The current driver code disregards the locked status and a region can be destroyed regardless of the locking state. Add a region flag to indicate the region is in a locked configuration. The driver will considered a region locked if the CFMWS or any decoder is configured as locked. The consideration is all or nothing regarding the locked state. It is reasonable to determine the region "locked" status while the region is being assembled based on the decoders. Add a check in region commit_store() to intercept when a 0 is written to the commit sysfs attribute in order to prevent the destruction of a region when in locked state. This should be the only entry point from user space to destroy a region. Add a check is added to cxl_decoder_reset() to prevent resetting a locked decoder within the kernel driver. Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251105201826.2901915-1-dave.jiang@intel.com Signed-off-by: Dave Jiang commit 172880f7c9ea2229b1c71506dfaf95ed3ce69291 Author: Srinivas Pandruvada Date: Mon Nov 10 16:45:52 2025 -0800 ACPI: DPTF: Support Nova Lake Add Nova Lake ACPI IDs for DPTF. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251111004552.137984-3-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit dbd911a07f1448c084e37414b4ebb8367ff13b2f Author: Srinivas Pandruvada Date: Mon Nov 10 16:45:51 2025 -0800 thermal: intel: int340x: Add DLVR support for Nova Lake Add support for DLVR (Digital Linear Voltage Regulator) for Nova Lake. There are no new sysfs attributes or difference in operations compared to prior generations. MMIO offset and bit positions are changed. Also no mapping is required as units are already in MHz. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251111004552.137984-2-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit af1b80b9412650d96bf9c3ceec19f5d8ea2fe15f Author: Srinivas Pandruvada Date: Mon Nov 10 16:45:50 2025 -0800 thermal: int340x: processor_thermal: Add Nova Lake processor thermal device Add PCI IDs for Nova Lake processor thermal device. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20251111004552.137984-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 71a117d28f87884893f0398fedfdc989d76314ce Author: Jeff Lin Date: Thu Nov 6 18:45:19 2025 +0800 hwmon/pmbus: (isl68137) Add support for raa229141 The RAA229141A is a digital dual output multiphase (X+Y ≤ 12) PWM controller designed to be compliant with Intel VR13, VR13.HC, VR14 and VR14.Cloud specifications, targeting VCORE and auxiliary rails. The RAA229141A supports the Intel SVID interface along with PMBus V1.3 specifications, making it ideal for controlling the microprocessor core and system rails in Intel VR13, VR13.HC, VR14 and VR14.Cloud platforms. Signed-off-by: Jeff Lin Link: https://lore.kernel.org/r/20251106104519.2014853-1-jefflin994697@gmail.com Signed-off-by: Guenter Roeck commit 347d92a79585c6c54be635be9e667384d2685c5c Author: Kaushlendra Kumar Date: Thu Oct 30 11:04:10 2025 +0530 thermal: intel: int340x: Replace sprintf() with sysfs_emit() Replace sprintf() calls with sysfs_emit() in sysfs "show" functions to follow current kernel coding standards. sysfs_emit() is the preferred method for formatting sysfs output as it provides better bounds checking and is more secure. Signed-off-by: Kaushlendra Kumar [ rjw: Subject adjustments, changelog edits ] Link: https://patch.msgid.link/20251030053410.311656-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 901990781657660b2621fa7ff86599cf0b98da31 Author: Kaushlendra Kumar Date: Thu Oct 30 09:29:55 2025 +0530 thermal: intel: int340x: Use symbolic constant for UUID comparison Replace sizeof() with a symbolic constant for UUID matching to maintain existing ABI behavior while improving code clarity. The current behavior of comparing only the first 7 characters is sufficient to distinguish all UUIDs and changing to full string comparison would alter the kernel ABI, potentially breaking existing userspace applications. Use a defined constant to make the truncated comparison explicit and maintainable. Signed-off-by: Kaushlendra Kumar [ rjw: Subject adjustments ] Link: https://patch.msgid.link/20251030035955.62171-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 0c7d530a04b4cada1042ecaf49e12dafe90ce30e Author: Igor Reznichenko Date: Wed Nov 5 12:14:06 2025 -0800 hwmon: Add TSC1641 I2C power monitor driver Add a driver for the ST Microelectronics TSC1641 16-bit high-precision power monitor. The driver supports reading bus voltage, current, power, and temperature. Sysfs attributes are exposed for shunt resistor and update interval. The driver integrates with the hwmon subsystem and supports optional ALERT pin polarity configuration. Signed-off-by: Igor Reznichenko Link: https://lore.kernel.org/r/20251105201406.1210856-3-igor@reznichenko.net Signed-off-by: Guenter Roeck commit 96cee719d222f5a0da51099256bc97311e396b31 Author: Igor Reznichenko Date: Wed Nov 5 12:14:05 2025 -0800 dt-bindings: hwmon: ST TSC1641 power monitor Add binding for the TSC1641 I2C power monitor. Signed-off-by: Igor Reznichenko Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251105201406.1210856-2-igor@reznichenko.net Signed-off-by: Guenter Roeck commit 0796ddf4a7f0d15b0cf1ef6f265671f2e5174c1f Author: Christian Loehle Date: Mon Nov 10 12:08:19 2025 +0000 cpuidle: teo: Use this_cpu_ptr() where possible The cpuidle governor callbacks for update, select and reflect are always running on the actual idle entering/exiting CPU, so use the more optimized this_cpu_ptr() to access the internal teo data. This brings down the latency-critical teo_reflect() from static void teo_reflect(struct cpuidle_device *dev, int state) { ffffffc080ffcff0: hint #0x19 ffffffc080ffcff4: stp x29, x30, [sp, #-48]! struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu); ffffffc080ffcff8: adrp x2, ffffffc0848c0000 { ffffffc080ffcffc: add x29, sp, #0x0 ffffffc080ffd000: stp x19, x20, [sp, #16] ffffffc080ffd004: orr x20, xzr, x0 struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu); ffffffc080ffd008: add x0, x2, #0xc20 { ffffffc080ffd00c: stp x21, x22, [sp, #32] struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu); ffffffc080ffd010: adrp x19, ffffffc083eb5000 ffffffc080ffd014: add x19, x19, #0xbb0 ffffffc080ffd018: ldr w3, [x20, #4] dev->last_state_idx = state; to static void teo_reflect(struct cpuidle_device *dev, int state) { ffffffc080ffd034: hint #0x19 ffffffc080ffd038: stp x29, x30, [sp, #-48]! ffffffc080ffd03c: add x29, sp, #0x0 ffffffc080ffd040: stp x19, x20, [sp, #16] ffffffc080ffd044: orr x20, xzr, x0 struct teo_cpu *cpu_data = this_cpu_ptr(&teo_cpus); ffffffc080ffd048: adrp x19, ffffffc083eb5000 { ffffffc080ffd04c: stp x21, x22, [sp, #32] struct teo_cpu *cpu_data = this_cpu_ptr(&teo_cpus); ffffffc080ffd050: add x19, x19, #0xbb0 dev->last_state_idx = state; This saves us: adrp x2, ffffffc0848c0000 add x0, x2, #0xc20 ldr w3, [x20, #4] Signed-off-by: Christian Loehle [ rjw: Subject tweak ] Link: https://patch.msgid.link/20251110120819.714560-1-christian.loehle@arm.com Signed-off-by: Rafael J. Wysocki commit 76934e495cdc31942b53b513cee4290750578a9a Author: Rafael J. Wysocki Date: Fri Nov 7 20:07:28 2025 +0100 cpuidle: Add sanity check for exit latency and target residency Make __cpuidle_driver_init() fail if the exit latency of one of the driver's idle states is less than its target residency which would break cpuidle assumptions. Signed-off-by: Rafael J. Wysocki Reviewed-by: Artem Bityutskiy Reviewed-by: Christian Loehle [ rjw: Changelog fix ] Link: https://patch.msgid.link/12779486.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki commit 9cf02802d60af2ab52fc5f6d015baae946c85072 Author: Rafael J. Wysocki Date: Wed Nov 12 17:14:26 2025 +0100 PM: wakeup: Update after recent wakeup source removal ordering change After a recent change, wakeup_source_activate() will warn that the given wakeup source is "unregistered" after its timer has been shut down in wakeup_source_remove() which may be somewhat confusing, so change the warning message to say that the wakeup source is "unusable". Accordingly, rename wakeup_source_not_registered() to wakeup_source_not_usable() and update the comment in it to also mention the removal of the wakeup source. Also restore the comment in wakeup_source_remove() regarding the warning in wakeup_source_activate() that may trigger after shutting down the wakeup source timer. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/12788103.O9o76ZdvQC@rafael.j.wysocki commit 62c95ea763915aebb8755185d5cdf72966b27cd3 Author: Rafael J. Wysocki Date: Fri Nov 7 19:18:26 2025 +0100 cpufreq: intel_pstate: Use mutex guard for driver locking Use guard(mutex)(&intel_pstate_driver_lock), or the scoped variant of it, wherever intel_pstate_driver_lock needs to be held. This allows some local variables and goto statements to be dropped as they are not necessary any more. Signed-off-by: Rafael J. Wysocki Reviewed-by: Muhammad Usama Anjum Link: https://patch.msgid.link/2807232.mvXUDI8C0e@rafael.j.wysocki commit 25ca66300a90edb9ec7b115eaa0e9c86c19346b4 Merge: 377e38859cfffa bb31fef0d03ed1 Author: Rafael J. Wysocki Date: Wed Nov 12 20:51:53 2025 +0100 Merge tag 'amd-pstate-v6.19-2025-11-10' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Pull amd-pstate content for 6.19 (11/10/25) from Mario Liminciello: "* optimizations for parameter array handling * fix for mode changes with offline CPUs" * tag 'amd-pstate-v6.19-2025-11-10' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs cpufreq/amd-pstate: Add static asserts for EPP indices cpufreq/amd-pstate: Fix some whitespace issues cpufreq/amd-pstate: Adjust return values in amd_pstate_update_status() cpufreq/amd-pstate: Make amd_pstate_get_mode_string() never return NULL cpufreq/amd-pstate: Drop NULL value from amd_pstate_mode_string cpufreq/amd-pstate: Use sysfs_match_string() for epp commit 377e38859cfffa7d7481ee38b96a34da73a9e197 Merge: 4b747cc628d8f5 4ab25c92147663 Author: Rafael J. Wysocki Date: Wed Nov 12 20:50:58 2025 +0100 Merge back cpufreq material for 6.19 commit 3249e8a17e62eefef096ec3818efbb91debbf9c7 Author: Kumar Kartikeya Dwivedi Date: Tue Nov 11 01:38:27 2025 +0000 bpf: Adjust return value for queue destruction in rqspinlock Return -ETIMEDOUT whenever non-head waiters are signalled by head, and fix oversight in commit 7bd6e5ce5be6 ("rqspinlock: Disable queue destruction for deadlocks"). We no longer signal on deadlocks. Signed-off-by: Kumar Kartikeya Dwivedi Reviewed-by: Amery Hung Link: https://lore.kernel.org/r/20251111013827.1853484-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5e7235d122f059f7f3b335d50227d74047d0c7da Author: Adrian Ng Ho Yin Date: Tue Nov 4 15:29:07 2025 +0800 arm64: dts: intel: agilex5: Add Altera compatible for I3C controllers Add the "altr,agilex5-dw-i3c-master" compatible string to the I3C controller nodes on the Agilex5 SoCFPGA platform. Signed-off-by: Adrian Ng Ho Yin Signed-off-by: Dinh Nguyen commit 67932f691895294a95861571b0ca69a38e0a4894 Author: Andrea Righi Date: Wed Nov 12 18:29:45 2025 +0100 sched_ext: Update comments replacing breather with aborting mechanism Commit 5ebec443fb96a ("sched_ext: Exit dispatch and move operations immediately when aborting") replaced the breather mechanism with the scx_aborting flag. Update comments removing references to the breather mechanism to avoid confusion. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit fc9c17b2235256445b28b06b6dba1709f870b3c4 Author: Zide Chen Date: Wed Nov 12 08:48:23 2025 -0800 perf test: Add a perf event fallback test This adds test cases to verify the precise ip fallback logic: - If the system supports precise ip, for an event given with the maximum precision level, it should be able to decrease precise_ip to find a supported level. - The same fallback behavior should also work in more complex scenarios, such as event groups or when PEBS is involved Additional fallback tests, such as those covering missing feature cases, can be added in the future. Suggested-by: Ian Rogers Reviewed-by: Dapeng Mi Signed-off-by: Zide Chen Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit b305fbdad4ed7e66b5b3f76b15f71d05fa6af212 Author: Chu Guangqing Date: Mon Nov 3 15:40:09 2025 +0800 can: bxcan: Fix a typo error for assign Fix the spelling error of "assign". Signed-off-by: Chu Guangqing Reviewed-by: Dario Binacchi Link: https://patch.msgid.link/20251103074009.4708-1-chuguangqing@inspur.com Signed-off-by: Marc Kleine-Budde commit 2d0938702c0151dccb8f14fe183c1a0da7a93e47 Merge: 5cf236b89f4a82 6ece6b4c374793 Author: Marc Kleine-Budde Date: Wed Nov 12 19:30:55 2025 +0100 Merge patch series "can: mcp251xfd: add gpio functionality" Viken Dadhaniya says: The mcp251xfd allows two pins to be configured as GPIOs. This series adds support for this feature. The GPIO functionality is controlled with the IOCON register which has an erratum. Patch 1 from https://lore.kernel.org/linux-can/20240429-mcp251xfd-runtime_pm-v1-3-c26a93a66544@pengutronix.de/ Patch 2 refactor of no-crc functions to prepare workaround for non-crc writes Patch 3 is the fix/workaround for the aforementioned erratum Patch 4 only configure pin1 for rx-int Patch 5 adds the gpio support Patch 6 updates dt-binding https://lore.kernel.org/all/20240806-industrious-augmented-crane-44239a-mkl@pengutronix.de/ Link: https://patch.msgid.link/20251001091006.4003841-1-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit 6ece6b4c37479319410ff45b8a71b2c6e5e1c27a Author: Gregor Herburger Date: Wed Oct 1 14:40:06 2025 +0530 dt-bindings: can: mcp251xfd: add gpio-controller property The mcp251xfd has two pins that can be used as gpio. Add gpio-controller property to binding description. Acked-by: Krzysztof Kozlowski Signed-off-by: Gregor Herburger Signed-off-by: Viken Dadhaniya Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251001091006.4003841-7-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit c6106336ec2bad2084df84e5b9ad039b0622c0b8 Author: Gregor Herburger Date: Wed Oct 1 14:40:05 2025 +0530 can: mcp251xfd: add gpio functionality The mcp251xfd devices allow two pins to be configured as gpio. Add this functionality to driver. Acked-by: Bartosz Golaszewski Signed-off-by: Gregor Herburger Tested-by: Viken Dadhaniya Signed-off-by: Viken Dadhaniya Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251001091006.4003841-6-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit d35fa005f5e68b6c1730cc64438ef4c81635a733 Author: Gregor Herburger Date: Wed Oct 1 14:40:04 2025 +0530 can: mcp251xfd: only configure PIN1 when rx_int is set When rx_int is used th mcp251xfd_chip_rx_int_enable and mcp251xfd_chip_rx_int_disable function configure both PIN0 and PIN1. To prepare the support of the GPIOS only configure PIN1 with regmap_update_bits. This way PIN0 can be used as GPIO while PIN1 is used as rx_int interrupt. Signed-off-by: Gregor Herburger Tested-by: Viken Dadhaniya Signed-off-by: Viken Dadhaniya Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251001091006.4003841-5-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit c902835fc6eb7e13dbffc404210eed59293425c8 Author: Gregor Herburger Date: Wed Oct 1 14:40:03 2025 +0530 can: mcp251xfd: add workaround for errata 5 According to Errata DS80000789E 5 writing IOCON register using one SPI write command clears LAT0/LAT1. Errata Fix/Work Around suggests to write registers with single byte write instructions. However, it seems that every write to the second byte causes the overwrite of LAT0/LAT1. Never write byte 2 of IOCON register to avoid clearing of LAT0/LAT1. Signed-off-by: Gregor Herburger Tested-by: Viken Dadhaniya Signed-off-by: Viken Dadhaniya Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251001091006.4003841-4-viken.dadhaniya@oss.qualcomm.com [mkl: add missing MCP251XFD_REG_IOCON_GPIO_MASK] Signed-off-by: Marc Kleine-Budde commit 5dc8d277520be6f0be11f36712e557167b3964c8 Merge: 8dcac98a477c29 4fa617cc685148 Author: Eric Biggers Date: Wed Nov 12 10:14:33 2025 -0800 Merge tag 'arm64-fpsimd-on-stack-for-v6.19' into libcrypto-fpsimd-on-stack Pull fpsimd-on-stack changes from Ard Biesheuvel: "Shared tag/branch for arm64 FP/SIMD changes going through libcrypto" Signed-off-by: Eric Biggers commit 8dcac98a477c299f1f2347187979f508e98d6308 Author: Ard Biesheuvel Date: Wed Nov 12 09:54:34 2025 +0100 lib/crypto: arm64: Move remaining algorithms to scoped ksimd API Move the arm64 implementations of SHA-3 and POLYVAL to the newly introduced scoped ksimd API, which replaces kernel_neon_begin() and kernel_neon_end(). On arm64, this is needed because the latter API will change in an incompatible manner. Signed-off-by: Ard Biesheuvel Signed-off-by: Eric Biggers commit 3e4b89e970365db7fe2c4171be06c0e88e3bcbe6 Author: Thorsten Blum Date: Fri Oct 31 00:46:43 2025 +0900 nilfs2: replace vmalloc + copy_from_user with vmemdup_user Replace vmalloc() followed by copy_from_user() with vmemdup_user() to improve nilfs_ioctl_clean_segments() and nilfs_ioctl_set_suinfo(). Use kvfree() to free the buffers created by vmemdup_user(). Use u64_to_user_ptr() instead of manually casting the pointers and remove the obsolete 'out_free' label. No functional changes intended. Link: https://lkml.kernel.org/r/20251030154700.7444-1-konishi.ryusuke@gmail.com Signed-off-by: Thorsten Blum Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton commit ded7d97442f0f5af25e942949ac304e025b85165 Author: Hao Ge Date: Thu Oct 30 20:17:46 2025 +0800 mailmap: add entry for Hao Ge Use hao.ge@linux.dev as the main address for kernel work Link: https://lkml.kernel.org/r/20251030121746.230747-1-hao.ge@linux.dev Signed-off-by: Hao Ge Signed-off-by: Andrew Morton commit c25d24d0f4c6c0954f2b0eb1fc69d293e88192bf Author: Oleg Nesterov Date: Sun Oct 26 15:31:40 2025 +0100 release_task: kill unnecessary rcu_read_lock() around dec_rlimit_ucounts() rcu_read_lock() was added to shut RCU-lockdep up when this code used __task_cred()->rcu_dereference(), but after the commit 21d1c5e386bc ("Reimplement RLIMIT_NPROC on top of ucounts") it is no longer needed: task_ucounts()->task_cred_xxx() takes rcu_read_lock() itself. NOTE: task_ucounts() returns the pointer to another rcu-protected data, struct ucounts. So it should either be used when task->real_cred and thus task->real_cred->ucounts is stable (release_task, copy_process, copy_creds), or it should be called under rcu_read_lock(). In both cases it is pointless to take rcu_read_lock() to read the cred->ucounts pointer. Link: https://lkml.kernel.org/r/20251026143140.GA22463@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Alexey Gladkov Cc: David Howells Cc: Mateusz Guzik Cc: "Paul E . McKenney" Cc: Kees Cook Signed-off-by: Andrew Morton commit f9925019f49e75f425623f46f379182dc3a1e8cd Author: Yu-Chun Lin Date: Mon Oct 27 18:03:09 2025 +0800 mailmap: add entry for Yu-Chun Lin Map my personal email to my business email. Link: https://lkml.kernel.org/r/20251027100309.22035-1-eleanor.lin@realtek.com Signed-off-by: Yu-Chun Lin Cc: Kuan-Wei Chiu Cc: Stanley Chang Signed-off-by: Andrew Morton commit a0b8c6af29a4be3ca2ff9a95cf71e54db5d73e65 Author: Dr. David Alan Gilbert Date: Fri Oct 24 21:51:20 2025 +0100 lib/xxhash: remove more unused xxh functions xxh32_reset() and xxh32_copy_state() are unused, and with those gone, the xxh32_state struct is also unused. xxh64_copy_state() is also unused. Remove them all. (Also fixes a comment above the xxh64_state that referred to it as xxh32_state). Link: https://lkml.kernel.org/r/20251024205120.454508-1-linux@treblig.org Signed-off-by: Dr. David Alan Gilbert Suggested-by: Christoph Hellwig Reviewed-by: Kuan-Wei Chiu Reviewed-by: Christoph Hellwig Signed-off-by: Andrew Morton commit 6c2e6e2c1af1809d1d9cdbd50ac80f54f5995bdb Author: Ye Bin Date: Sat Oct 25 16:00:03 2025 +0800 dynamic_debug: add support for print stack In practical problem diagnosis, especially during the boot phase, it is often desirable to know the call sequence. However, currently, apart from adding print statements and recompiling the kernel, there seems to be no good alternative. If dynamic_debug supported printing the call stack, it would be very helpful for diagnosing issues. This patch add support '+d' for dump stack. Link: https://lkml.kernel.org/r/20251025080003.312536-1-yebin@huaweicloud.com Signed-off-by: Ye Bin Cc: Jason Baron Cc: Jim Cromie Signed-off-by: Andrew Morton commit a2b1c419ff72ec62ff5831684e30cd1d4f0b09ee Author: Dmitry Antipov Date: Thu Oct 23 17:16:50 2025 +0300 ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() In 'ocfs2_validate_inode_block()', add an extra check whether an inode with inline data (i.e. self-contained) has no clusters, thus preventing an invalid inode from being passed to 'ocfs2_evict_inode()' and below. Link: https://lkml.kernel.org/r/20251023141650.417129-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reported-by: syzbot+c16daba279a1161acfb0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c16daba279a1161acfb0 Reviewed-by: Joseph Qi Cc: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Heming Zhao Signed-off-by: Andrew Morton commit 6e89373cec09af28dd54fc5eed00cde34992f8e2 Author: Joseph Qi Date: Sat Oct 25 20:32:18 2025 +0800 ocfs2: convert to host endian in ocfs2_validate_inode_block Convert to host endian when checking OCFS2_VALID_FL to keep consistent with other checks. Link: https://lkml.kernel.org/r/20251025123218.3997866-2-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Changwei Ge Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit c9dff86eb78a4b6b02b1e407993c946ccaf9bfb4 Author: Joseph Qi Date: Sat Oct 25 20:32:17 2025 +0800 ocfs2: use correct endian in ocfs2_dinode_has_extents Fields in ocfs2_dinode is little endian, covert to host endian when checking those contents. Link: https://lkml.kernel.org/r/20251025123218.3997866-1-joseph.qi@linux.alibaba.com Fixes: fdbb6cd96ed5 ("ocfs2: correct l_next_free_rec in online check") Signed-off-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 390ac56cf0f687de53695648bc6f2259a7eae429 Author: Dmitry Antipov Date: Mon Oct 13 09:28:26 2025 +0300 ocfs2: add boundary check to ocfs2_check_dir_entry() In 'ocfs2_check_dir_entry()', add extra check whether at least the smallest possible dirent may be located at the specified offset within bh's data, thus preventing an out-of-bounds accesses below. Link: https://lkml.kernel.org/r/20251013062826.122586-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reported-by: syzbot+b20bbf680bb0f2ecedae@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b20bbf680bb0f2ecedae Reviewed-by: Heming Zhao Cc: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit d99dc586ca7c7729450af2ed39ca1483c0eb7b5c Author: Yury Norov (NVIDIA) Date: Thu Oct 23 13:16:06 2025 -0400 uaccess: decouple INLINE_COPY_FROM_USER and CONFIG_RUST Commit 1f9a8286bc0c ("uaccess: always export _copy_[from|to]_user with CONFIG_RUST") exports _copy_{from,to}_user() unconditionally, if RUST is enabled. This pollutes exported symbols namespace, and spreads RUST ifdefery in core files. It's better to declare a corresponding helper under the rust/helpers, similarly to how non-underscored copy_{from,to}_user() is handled. [yury.norov@gmail.com: drop rust part of comment for _copy_from_user(), per Alice] Link: https://lkml.kernel.org/r/20251024154754.99768-1-yury.norov@gmail.com Link: https://lkml.kernel.org/r/20251023171607.1171534-1-yury.norov@gmail.com Signed-off-by: Yury Norov (NVIDIA) Acked-by: Arnd Bergmann Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Tested-by: Alice Ryhl Cc: Alex Gaynor Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Gary Guo Cc: John Hubbard Cc: Trevor Gross Signed-off-by: Andrew Morton commit 032a730268a3e88a1df1df1bafd9af64a460822e Author: Douglas Anderson Date: Thu Oct 23 11:33:05 2025 -0700 init/main.c: wrap long kernel cmdline when printing to logs The kernel cmdline length is allowed to be longer than what printk can handle. When this happens the cmdline that's printed to the kernel ring buffer at bootup is cutoff and some kernel cmdline options are "hidden" from the logs. This undercuts the usefulness of the log message. Specifically, grepping for COMMAND_LINE_SIZE shows that 2048 is common and some architectures even define it as 4096. s390 allows a CONFIG-based maximum up to 1MB (though it's not expected that anyone will go over the default max of 4096 [1]). The maximum message pr_notice() seems to be able to handle (based on experiment) is 1021 characters. This appears to be based on the current value of PRINTKRB_RECORD_MAX as 1024 and the fact that pr_notice() spends 2 characters on the loglevel prefix and we have a '\n' at the end. While it would be possible to increase the limits of printk() (and therefore pr_notice()) somewhat, it doesn't appear possible to increase it enough to fully include a 2048-character cmdline without breaking userspace. Specifically on at least two tested userspaces (ChromeOS plus the Debian-based distro I'm typing this message on) the `dmesg` tool reads lines from `/dev/kmsg` in 2047-byte chunks. As per `Documentation/ABI/testing/dev-kmsg`: Every read() from the opened device node receives one record of the kernel's printk buffer. ... Messages in the record ring buffer get overwritten as whole, there are never partial messages received by read(). We simply can't fit a 2048-byte cmdline plus the "Kernel command line:" prefix plus info about time/log_level/etc in a 2047-byte read. The above means that if we want to avoid the truncation we need to do some type of wrapping of the cmdline when printing. Add wrapping to the printout of the kernel command line. By default, the wrapping is set to 1021 characters to avoid breaking anyone, but allow wrapping to be set lower by a Kconfig knob "CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN". Any tools that are correctly parsing the cmdline today (because it is less than 1021 characters) will see no difference in their behavior. The format of wrapped output is designed to be matched by anyone using "grep" to search for the cmdline and also to be easy for tools to handle. Anyone who is sure their tools (if any) handle the wrapped format can choose a lower wrapping value and have prettier output. Setting CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN to 0 fully disables the wrapping logic. This means that long command lines will be truncated again, but this config could be set if command lines are expected to be long and userspace is known not to handle parsing logs with the wrapping. Wrapping is based on spaces, ignoring quotes. All lines are prefixed with "Kernel command line: " and lines that are not the last line have a " \" suffix added to them. The prefix and suffix count towards the line length for wrapping purposes. The ideal length will be exceeded if no appropriate place to wrap is found. The wrapping function added here is fairly generic and could be made a library function (somewhat like print_hex_dump()) if it's needed elsewhere in the kernel. However, having printk() directly incorporate this wrapping would be unlikely to be a good idea since it would break printouts into more than one record without any obvious common line prefix to tie lines together. It would also be extra overhead when, in general, kernel log message should simply be kept smaller than 1021 bytes. For some discussion on this topic, see responses to the v1 posting of this patch [2]. [akpm@linux-foundation.org: make print_kernel_cmdline __init] [dianders@chromium.org: v4] Link: https://lkml.kernel.org/r/20251027082204.v4.1.I095f1e2c6c27f9f4de0b4841f725f356c643a13f@changeid Link: https://lkml.kernel.org/r/20251023113257.v3.1.I095f1e2c6c27f9f4de0b4841f725f356c643a13f@changeid Link: https://lore.kernel.org/r/20251021131633.26700Dd6-hca@linux.ibm.com [1] Link: https://lore.kernel.org/r/CAD=FV=VNyt1zG_8pS64wgV8VkZWiWJymnZ-XCfkrfaAhhFSKcA@mail.gmail.com [2] Signed-off-by: Douglas Anderson Tested-by: Paul E. McKenney Cc: Alexander Shishkin Cc: Andrew Chant Cc: Brian Gerst Cc: Christian Brauner Cc: Francesco Valla Cc: Geert Uytterhoeven Cc: guoweikang Cc: Heiko Carstens Cc: Huacai Chen Cc: Ingo Molnar Cc: Jan Hendrik Farr Cc: Jeff Xu Cc: Kees Cook Cc: Masahiro Yamada Cc: Michal Koutný Cc: Miguel Ojeda Cc: Mike Rapoport Cc: Nathan Chancellor Cc: Peter Zijlstra Cc: Randy Dunlap Cc: Shakeel Butt Cc: Sven Schnelle Cc: Tejun Heo Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 7229d74e5e8c1f140529d405c88d4493e37ce4e3 Author: Vlad Kulikov Date: Tue Oct 21 21:13:39 2025 +0300 ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure If setup_mq_sysctls(ns) fails after mq_init_ns(ns) succeeds, the error path skipped releasing the internal kernel mqueue mount kept in ns->mq_mnt. That leaves the vfsmount/superblock referenced until final namespace teardown, i.e. a resource leak on this rare failure edge. Unwind it by calling mntput(ns->mq_mnt) before dropping user_ns and freeing the IPC namespace. This mirrors the normal ordering used in free_ipc_ns(). Link: https://lkml.kernel.org/r/20251021181341.670297-1-vlad_kulikov_c@pm.me Signed-off-by: Vlad Kulikov Reviewed-by: Jan Kara Cc: Aleksa Sarai Cc: Christian Brauner Cc: David Hildenbrand Cc: Ma Wupeng Signed-off-by: Andrew Morton commit aa5b6a72ccd9fad2d2ed875631f6aca6b0633d80 Author: Dmitry Antipov Date: Mon Oct 13 13:37:09 2025 +0300 ocfs2: add directory size check to ocfs2_find_dir_space_id() Fix a null-pointer-deref which was detected by UBSAN: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 5317 Comm: syz-executor310 Not tainted 6.15.0-syzkaller-12141-gec7714e49479 #0 PREEMPT(full) In 'ocfs2_find_dir_space_id()', add extra check whether the directory data block is large enough to hold at least one directory entry, and raise 'ocfs2_error()' if the former is unexpectedly small. Link: https://lkml.kernel.org/r/20251013103709.146001-1-dmantipov@yandex.ru Reported-by: syzbot+ded9116588a7b73c34bc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ded9116588a7b73c34bc Signed-off-by: Dmitry Antipov Reviewed-by: Heming Zhao Cc: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 37ade54f386c829597f74b54bad335c12bd2a698 Author: Petr Pavlu Date: Wed Oct 22 10:28:04 2025 +0200 taint/module: remove unnecessary taint_flag.module field The TAINT_RANDSTRUCT and TAINT_FWCTL flags are mistakenly set in the taint_flags table as per-module flags. While this can be trivially corrected, the issue can be avoided altogether by removing the taint_flag.module field. This is possible because, since commit 7fd8329ba502 ("taint/module: Clean up global and module taint flags handling") in 2016, the handling of module taint flags has been fully generic. Specifically, module_flags_taint() can print all flags, and the required output buffer size is properly defined in terms of TAINT_FLAGS_COUNT. The actual per-module flags are always those added to module.taints by calls to add_taint_module(). Link: https://lkml.kernel.org/r/20251022082938.26670-1-petr.pavlu@suse.com Signed-off-by: Petr Pavlu Acked-by: Petr Mladek Reviewed-by: Randy Dunlap Cc: Aaron Tomlin Cc: Luis Chamberalin Cc: Petr Pavlu Cc: Sami Tolvanen Signed-off-by: Andrew Morton commit ed4bbe7e8fa186b24c61aa22a32885d5de0fe1a4 Author: Randy Dunlap Date: Wed Oct 15 15:16:26 2025 -0700 taint: add reminder about updating docs and scripts Sometimes people update taint-related pieces of the kernel without updating the supporting documentation or scripts. Add a reminder to do this. Link: https://lkml.kernel.org/r/20251015221626.1126156-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Cc: David Gow Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit adc15829fb73e402903b7030729263b6ee4a7232 Author: Sourabh Jain Date: Thu Oct 16 19:58:31 2025 +0530 crash: let architecture decide crash memory export to iomem_resource With the generic crashkernel reservation, the kernel emits the following warning on powerpc: WARNING: CPU: 0 PID: 1 at arch/powerpc/mm/mem.c:341 add_system_ram_resources+0xfc/0x180 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-auto-12607-g5472d60c129f #1 VOLUNTARY Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.01 (NH1110_069) hv:phyp pSeries NIP: c00000000201de3c LR: c00000000201de34 CTR: 0000000000000000 REGS: c000000127cef8a0 TRAP: 0700 Not tainted (6.17.0-auto-12607-g5472d60c129f) MSR: 8000000002029033 CR: 84000840 XER: 20040010 CFAR: c00000000017eed0 IRQMASK: 0 GPR00: c00000000201de34 c000000127cefb40 c0000000016a8100 0000000000000001 GPR04: c00000012005aa00 0000000020000000 c000000002b705c8 0000000000000000 GPR08: 000000007fffffff fffffffffffffff0 c000000002db8100 000000011fffffff GPR12: c00000000201dd40 c000000002ff0000 c0000000000112bc 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 c0000000015a3808 GPR24: c00000000200468c c000000001699888 0000000000000106 c0000000020d1950 GPR28: c0000000014683f8 0000000081000200 c0000000015c1868 c000000002b9f710 NIP [c00000000201de3c] add_system_ram_resources+0xfc/0x180 LR [c00000000201de34] add_system_ram_resources+0xf4/0x180 Call Trace: add_system_ram_resources+0xf4/0x180 (unreliable) do_one_initcall+0x60/0x36c do_initcalls+0x120/0x220 kernel_init_freeable+0x23c/0x390 kernel_init+0x34/0x26c ret_from_kernel_user_thread+0x14/0x1c This warning occurs due to a conflict between crashkernel and System RAM iomem resources. The generic crashkernel reservation adds the crashkernel memory range to /proc/iomem during early initialization. Later, all memblock ranges are added to /proc/iomem as System RAM. If the crashkernel region overlaps with any memblock range, it causes a conflict while adding those memblock regions as iomem resources, triggering the above warning. The conflicting memblock regions are then omitted from /proc/iomem. For example, if the following crashkernel region is added to /proc/iomem: 20000000-11fffffff : Crash kernel then the following memblock regions System RAM regions fail to be inserted: 00000000-7fffffff : System RAM 80000000-257fffffff : System RAM Fix this by not adding the crashkernel memory to /proc/iomem on powerpc. Introduce an architecture hook to let each architecture decide whether to export the crashkernel region to /proc/iomem. For more info checkout commit c40dd2f766440 ("powerpc: Add System RAM to /proc/iomem") and commit bce074bdbc36 ("powerpc: insert System RAM resource to prevent crashkernel conflict") Note: Before switching to the generic crashkernel reservation, powerpc never exported the crashkernel region to /proc/iomem. Link: https://lkml.kernel.org/r/20251016142831.144515-1-sourabhjain@linux.ibm.com Fixes: e3185ee438c2 ("powerpc/crash: use generic crashkernel reservation"). Signed-off-by: Sourabh Jain Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/all/90937fe0-2e76-4c82-b27e-7b8a7fe3ac69@linux.ibm.com/ Tested-by: Venkat Rao Bagalkote Cc: Baoquan he Cc: Hari Bathini Cc: Madhavan Srinivasan Cc: Mahesh Salgaonkar Cc: Michael Ellerman Cc: Ritesh Harjani (IBM) Cc: Vivek Goyal Cc: Dave Young Cc: Mike Rapoport Cc: Signed-off-by: Andrew Morton commit 01ef0296d2eb550511334212650011446c223da0 Author: WangYuli Date: Tue Oct 14 13:07:47 2025 +0800 .mailmap: add entry for WangYuli Map my old, obsolete work email address to my current email address. My current work email may not be ideal for timely communication, as it requires a secure network environment for access due to security policies. Therefore, associate both my previous and current work email addresses with an email address provided to me by AOSC Linux community. During work hours, my commits will likely still be authored using my company email address. Link: https://lkml.kernel.org/r/20251014050747.527357-1-wangyuli@aosc.io Signed-off-by: WangYuli Signed-off-by: WangYuli Cc: Carlos Bilbao Cc: Jarkko Sakkinen Cc: Shannon Nelson Signed-off-by: Andrew Morton commit 57f3d89691149f11bfb6c4fef9fca4890def8fb1 Author: Ankan Biswas Date: Tue Oct 14 10:54:36 2025 +0530 lib/xz: remove dead IA-64 (Itanium) support code Support for the IA-64 (Itanium) architecture was removed in commit cf8e8658100d ("arch: Remove Itanium (IA-64) architecture"). This patch drops the IA-64 specific decompression code from lib/xz, which was conditionally compiled with the now-obsolete CONFIG_XZ_DEC_IA64 option. Link: https://lkml.kernel.org/r/20251014052738.31185-1-spyjetfayed@gmail.com Signed-off-by: Ankan Biswas Reviewed-by: Kuan-Wei Chiu Reviewed-by: Khalid Aziz Acked-by: Lasse Collin Cc: David Hunter Cc: Shuah Khan Signed-off-by: Andrew Morton commit 9544f9e6947f6508d29f0d0cc2dacaa749fc1613 Author: Li RongQing Date: Wed Oct 15 14:36:15 2025 +0800 hung_task: panic when there are more than N hung tasks at the same time The hung_task_panic sysctl is currently a blunt instrument: it's all or nothing. Panicking on a single hung task can be an overreaction to a transient glitch. A more reliable indicator of a systemic problem is when multiple tasks hang simultaneously. Extend hung_task_panic to accept an integer threshold, allowing the kernel to panic only when N hung tasks are detected in a single scan. This provides finer control to distinguish between isolated incidents and system-wide failures. The accepted values are: - 0: Don't panic (unchanged) - 1: Panic on the first hung task (unchanged) - N > 1: Panic after N hung tasks are detected in a single scan The original behavior is preserved for values 0 and 1, maintaining full backward compatibility. [lance.yang@linux.dev: new changelog] Link: https://lkml.kernel.org/r/20251015063615.2632-1-lirongqing@baidu.com Signed-off-by: Li RongQing Reviewed-by: Masami Hiramatsu (Google) Reviewed-by: Lance Yang Tested-by: Lance Yang Acked-by: Andrew Jeffery [aspeed_g5_defconfig] Cc: Anshuman Khandual Cc: Arnd Bergmann Cc: David Hildenbrand Cc: Florian Wesphal Cc: Jakub Kacinski Cc: Jason A. Donenfeld Cc: Joel Granados Cc: Joel Stanley Cc: Jonathan Corbet Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Paul E . McKenney" Cc: Pawan Gupta Cc: Petr Mladek Cc: Phil Auld Cc: Randy Dunlap Cc: Russell King Cc: Shuah Khan Cc: Simon Horman Cc: Stanislav Fomichev Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 05d6f1cc2dc214c1491181be13f37d2a3a26f694 Author: Thomas Weißschuh Date: Mon Oct 13 11:12:02 2025 +0200 compiler.h: remove ARCH_SEL() Its last user was removed in commit 8ea815399c3f ("compiler: remove __ADDRESSABLE_ASM{_STR,}() again"). Link: https://lkml.kernel.org/r/20251013-arch-sel-v1-1-7eef9b22ceb0@linutronix.de Signed-off-by: Thomas Weißschuh Cc: Luc Van Oostenryck Signed-off-by: Andrew Morton commit 1b34743c31fef06d3728abf58126a7bcadb5ba1b Author: Dmitry Antipov Date: Tue Oct 7 12:46:26 2025 +0300 ocfs2: add extra consistency check to ocfs2_dx_dir_lookup_rec() In 'ocfs2_dx_dir_lookup_rec()', check whether an extent list length of the directory indexing block matches the one configured via the superblock parameters established at mount, thus preventing an out-of-bounds accesses while iterating over the extent records below. Link: https://lkml.kernel.org/r/20251007094626.196143-1-dmantipov@yandex.ru Reported-by: syzbot+30b53487d00b4f7f0922@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=30b53487d00b4f7f0922 Signed-off-by: Dmitry Antipov Reviewed-by: Joseph Qi Reviewed-by: Heming Zhao > Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 2f26f58df041bbcf692730ff4d8ab0f250d9670d Author: Dmitry Antipov Date: Tue Oct 7 15:35:26 2025 +0300 ocfs2: annotate flexible array members with __counted_by_le() Annotate flexible array members of 'struct ocfs2_extent_list', 'struct ocfs2_chain_list', 'struct ocfs2_truncate_log', 'struct ocfs2_dx_entry_list', 'ocfs2_refcount_list' and 'struct ocfs2_xattr_header' with '__counted_by_le()' attribute to improve array bounds checking when CONFIG_UBSAN_BOUNDS is enabled. [dmantipov@yandex.ru: fix __counted_by_le() usage in ocfs2_expand_inline_dx_root()] Link: https://lkml.kernel.org/r/20251014070324.130313-1-dmantipov@yandex.ru Link: https://lkml.kernel.org/r/20251007123526.213150-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reviewed-by: Joseph Qi Reviewed-by: Heming Zhao Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit cd4eaccc00d79ab97d9a96f7922558558b13f220 Author: Lukas Bulwahn Date: Fri Oct 10 10:21:38 2025 +0200 treewide: drop outdated compiler version remarks in Kconfig help texts As of writing, Documentation/Changes states the minimal versions of GNU C being 8.1, Clang being 15.0.0 and binutils being 2.30. A few Kconfig help texts are pointing out that specific GCC and Clang versions are needed, but by now, those pointers to versions, such later than 4.0, later than 4.4, or clang later than 5.0, are obsolete and unlikely to be found by users configuring their kernel builds anyway. Drop these outdated remarks in Kconfig help texts referring to older compiler and binutils versions. No functional change. Link: https://lkml.kernel.org/r/20251010082138.185752-1-lukas.bulwahn@redhat.com Signed-off-by: Lukas Bulwahn Cc: Bill Wendling Cc: Justin Stitt Cc: Nathan Chancellor Cc: Russel King Signed-off-by: Andrew Morton commit 02582ac3b7d2decc578bd3cef90db95c57031a42 Author: Martin Kepplinger-Novaković Date: Sat Oct 11 15:59:39 2025 +0000 MAINTAINERS: apply name and email address changes for Martin Update to new surname addition and currently used email address. Link: https://lkml.kernel.org/r/20251011155903.7442-2-martink@posteo.de Signed-off-by: Martin Kepplinger-Novaković Signed-off-by: Andrew Morton commit 0d63fc256ad1e8b64bbb32f97232c5f2aee046c9 Author: Martin Kepplinger-Novaković Date: Sat Oct 11 15:59:39 2025 +0000 CREDITS: update Martin's information Surname, address, email and the description changed. Apply these updates. Link: https://lkml.kernel.org/r/20251011155903.7442-3-martink@posteo.de Signed-off-by: Martin Kepplinger-Novaković Signed-off-by: Andrew Morton commit b7d06a2ae10a824f583dea85fe6e9875422eca01 Author: Martin Kepplinger-Novaković Date: Sat Oct 11 15:59:39 2025 +0000 mailmap: update name and email addresses Apply my new surname, remove unused and update to currently used email addresses. Link: https://lkml.kernel.org/r/20251011155903.7442-1-martink@posteo.de Signed-off-by: Martin Kepplinger-Novaković Signed-off-by: Andrew Morton commit 08bd4c46d5e63b78e77f2605283874bbe868ab19 Author: Zhichi Lin Date: Sat Oct 11 16:22:22 2025 +0800 scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a 'struct task_struct *' is given. 'task_scs(tsk)' is the starting address of the task's shadow call stack, and '__scs_magic(task_scs(tsk))' is the end address of the task's shadow call stack. Here should be '__scs_magic(task_scs(tsk))'. The user-visible effect of this bug is that when CONFIG_DEBUG_STACK_USAGE is enabled, the shadow call stack usage checking function (scs_check_usage) would scan an incorrect memory range. This could lead to: 1. **Inaccurate stack usage reporting**: The function would calculate wrong usage statistics for the shadow call stack, potentially showing incorrect value in kmsg. 2. **Potential kernel crash**: If the value of __scs_magic(tsk)is greater than that of __scs_magic(task_scs(tsk)), the for loop may access unmapped memory, potentially causing a kernel panic. However, this scenario is unlikely because task_struct is allocated via the slab allocator (which typically returns lower addresses), while the shadow call stack returned by task_scs(tsk) is allocated via vmalloc(which typically returns higher addresses). However, since this is purely a debugging feature (CONFIG_DEBUG_STACK_USAGE), normal production systems should be not unaffected. The bug only impacts developers and testers who are actively debugging stack usage with this configuration enabled. Link: https://lkml.kernel.org/r/20251011082222.12965-1-zhichi.lin@vivo.com Fixes: 5bbaf9d1fcb9 ("scs: Add support for stack usage debugging") Signed-off-by: Jiyuan Xie Signed-off-by: Zhichi Lin Reviewed-by: Sami Tolvanen Acked-by: Will Deacon Cc: Andrey Konovalov Cc: Kees Cook Cc: Marco Elver Cc: Will Deacon Cc: Yee Lee Cc: Signed-off-by: Andrew Morton commit 6a2e57ad227ac21cbe0ed941dbedd3b81b22ce7e Author: Justinien Bouron Date: Mon Sep 29 09:02:20 2025 -0700 kexec_core: remove superfluous page offset handling in segment loading During kexec_segment loading, when copying the content of the segment (i.e. kexec_segment::kbuf or kexec_segment::buf) to its associated pages, kimage_load_{cma,normal,crash}_segment handle the case where the physical address of the segment is not page aligned, e.g. in kimage_load_normal_segment: page = kimage_alloc_page(image, GFP_HIGHUSER, maddr); // ... ptr = kmap_local_page(page); // ... ptr += maddr & ~PAGE_MASK; mchunk = min_t(size_t, mbytes, PAGE_SIZE - (maddr & ~PAGE_MASK)); // ^^^^ Non page-aligned segments handled here ^^^ // ... if (image->file_mode) memcpy(ptr, kbuf, uchunk); else result = copy_from_user(ptr, buf, uchunk); (similar logic is present in kimage_load_{cma,crash}_segment). This is actually not needed because, prior to their loading, all kexec_segments first go through a vetting step in `sanity_check_segment_list`, which rejects any segment that is not page-aligned: for (i = 0; i < nr_segments; i++) { unsigned long mstart, mend; mstart = image->segment[i].mem; mend = mstart + image->segment[i].memsz; // ... if ((mstart & ~PAGE_MASK) || (mend & ~PAGE_MASK)) return -EADDRNOTAVAIL; // ... } In case `sanity_check_segment_list` finds a non-page aligned the whole kexec load is aborted and no segment is loaded. This means that `kimage_load_{cma,normal,crash}_segment` never actually have to handle non page-aligned segments and `(maddr & ~PAGE_MASK) == 0` is always true no matter if the segment is coming from a file (i.e. `kexec_file_load` syscall), from a user-space buffer (i.e. `kexec_load` syscall) or created by the kernel through `kexec_add_buffer`. In the latter case, `kexec_add_buffer` actually enforces the page alignment: /* Ensure minimum alignment needed for segments. */ kbuf->memsz = ALIGN(kbuf->memsz, PAGE_SIZE); kbuf->buf_align = max(kbuf->buf_align, PAGE_SIZE); [jbouron@amazon.com: v3] Link: https://lkml.kernel.org/r/20251024155009.39502-1-jbouron@amazon.com Link: https://lkml.kernel.org/r/20250929160220.47616-1-jbouron@amazon.com Signed-off-by: Justinien Bouron Reviewed-by: Gunnar Kudrjavets Reviewed-by: Andy Shevchenko Acked-by: Baoquan He Cc: Alexander Graf Cc: Marcos Paulo de Souza Cc: Mario Limonciello Cc: Petr Mladek Cc: Yan Zhao Signed-off-by: Andrew Morton commit 8a7d58845fae061c62b50bc5eeb9bae4a1dedc3d Author: Dmitry Antipov Date: Thu Oct 9 13:23:49 2025 +0300 ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just to avoid crashing the whole kernel due to a filesystem corruption. Fixes: 8f603e567aa7 ("Ocfs2/move_extents: move a range of extent.") Link: https://lkml.kernel.org/r/20251009102349.181126-2-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Closes: https://syzkaller.appspot.com/bug?extid=727d161855d11d81e411 Reported-by: syzbot+727d161855d11d81e411@syzkaller.appspotmail.com Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit c0d597e01626a28598119570b29186c93f3aced3 Author: Ard Biesheuvel Date: Wed Nov 12 10:03:18 2025 +0100 lib/crypto: arm/blake2b: Move to scoped ksimd API Even though ARM's versions of kernel_neon_begin()/_end() are not being changed, update the newly migrated ARM blake2b to the scoped ksimd API so that all ARM and arm64 in lib/crypto remains consistent in this manner. Signed-off-by: Ard Biesheuvel Signed-off-by: Eric Biggers commit 065f04001081fa48f24dd95f7095d06402756253 Merge: 2dbb6f4a25d38f f53d18a4e67eac Author: Eric Biggers Date: Wed Nov 12 09:55:55 2025 -0800 Merge tag 'scoped-ksimd-for-arm-arm64' into libcrypto-fpsimd-on-stack Pull scoped ksimd API for ARM and arm64 from Ard Biesheuvel: "Introduce a more strict replacement API for kernel_neon_begin()/kernel_neon_end() on both ARM and arm64, and replace occurrences of the latter pair appearing in lib/crypto" Signed-off-by: Eric Biggers commit de0d6e19d2ef33ba34be2467ffdf3595da5f5326 Author: Timur Tabi Date: Fri Oct 10 17:39:57 2025 -0500 drm/nouveau: fully define nvfw_hs_load_header_v2 Add the missing fields of the nvfw_hs_load_header_v2 struct, so that the struct matches the actual contents of the firmware images. nvfw_hs_load_header_v2 is a struct that defines a header for some firmware images used by Nouveau. The current structure definition is incomplete; it omits the last two fields because they are unused. To maintain consistency between Nouveau, OpenRM, and Nova, and to make it easier to support possible future images, we should fully define the struct. Also add a __counted_by tag for the flex array. Signed-off-by: Timur Tabi Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251010223957.1078525-1-ttabi@nvidia.com commit e949824730daf381bd0fe37e1a77458e0c26e8df Merge: 7e975caa0f7bf2 0eb272033b64ef Author: Jakub Kicinski Date: Wed Nov 12 09:33:23 2025 -0800 Merge tag 'wireless-next-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== More -next material, notably: - split ieee80211.h file, it's way too big - mac80211: initial chanctx work towards NAN - mac80211: MU-MIMO sniffer improvements - ath12k: statistics improvements * tag 'wireless-next-2025-11-12' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (26 commits) wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() wifi: mac80211: make monitor link info check more specific wifi: mac80211: track MU-MIMO configuration on disabled interfaces wifi: cfg80211/mac80211: Add fallback mechanism for INDOOR_SP connection wifi: cfg80211/mac80211: clean up duplicate ap_power handling wifi: cfg80211: use a C99 initializer in wiphy_register wifi: cfg80211: fix doc of struct key_params wifi: mac80211: remove unnecessary vlan NULL check wifi: mac80211: pass frame type to element parsing wifi: mac80211: remove "disabling VHT" message wifi: mac80211: add and use chanctx usage iteration wifi: mac80211: simplify ieee80211_recalc_chanctx_min_def() API wifi: mac80211: remove chanctx to link back-references wifi: mac80211: make link iteration safe for 'break' wifi: mac80211: fix EHT typo wifi: cfg80211: fix EHT typo wifi: ieee80211: split NAN definitions out wifi: ieee80211: split P2P definitions out wifi: ieee80211: split S1G definitions out wifi: ieee80211: split EHT definitions out ... ==================== Link: https://patch.msgid.link/20251112115126.16223-4-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 85ce566b362447fa4a2dd9d124c46fbfd04465be Author: Mohamed Ahmed Date: Mon Nov 10 16:33:00 2025 +0100 drm/nouveau/drm: Bump the driver version to 1.4.1 to report new features The HW can only do compression on large and huge pages, and enabling it on 4K pages leads to a MMU fault. Compression also needs kernel support for handling the compressed kinds and managing the compression tags. This increments the nouveau version number which allows NVK to enable it only when the kernel actually supports both features and avoid breaking the system if a newer mesa version is paired with an older kernel version. For the associated userspace MR, please see !36450: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/36450 Signed-off-by: Mohamed Ahmed Signed-off-by: Mary Guillemard Reviewed-by: Lyude Paul Reviewed-by: James Jones Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251110-nouveau-compv6-v6-5-83b05475f57c@mary.zone commit 0ee6a72bb0347fd191fb61715efbc2b518be0926 Author: Ben Skeggs Date: Mon Nov 10 16:32:59 2025 +0100 drm/nouveau/mmu/tu102: Add support for compressed kinds Allow compressed PTE kinds to be written into PTEs when GSP-RM is present, rather than reverting to their non-compressed versions. Signed-off-by: Ben Skeggs Signed-off-by: Mohamed Ahmed Signed-off-by: Mary Guillemard Reviewed-by: Lyude Paul Reviewed-by: James Jones Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251110-nouveau-compv6-v6-4-83b05475f57c@mary.zone commit a79d3845f91928505b056e0a1e3f345aa88c12ac Author: Ben Skeggs Date: Mon Nov 10 16:32:58 2025 +0100 drm/nouveau/mmu/gp100: Remove unused/broken support for compression From GP100 onwards it's not possible to initialise comptag RAM without PMU firmware, which nouveau has no support for. As such, this code is essentially a no-op and will always revert to the equivalent non-compressed kind due to comptag allocation failure. It's also broken for the needs of VM_BIND/Vulkan. Remove the code entirely to make way for supporting compression on GPUs that support GSM-RM. Signed-off-by: Ben Skeggs Signed-off-by: Mohamed Ahmed Signed-off-by: Mary Guillemard Reviewed-by: Lyude Paul Reviewed-by: James Jones Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251110-nouveau-compv6-v6-3-83b05475f57c@mary.zone commit c488a94e7e143b0a6c107e5c7effacca9004ca1a Author: Mary Guillemard Date: Mon Nov 10 16:32:57 2025 +0100 drm/nouveau/uvmm: Allow larger pages Now that everything in UVMM knows about the variable page shift, we can select larger values. The proposed approach relies on nouveau_bo::page unless if it would cause alignment issues (in which case we fall back to searching for an appropriate shift) Signed-off-by: Mary Guillemard Co-developed-by: Mohamed Ahmed Signed-off-by: Mohamed Ahmed Reviewed-by: Lyude Paul Reviewed-by: James Jones Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251110-nouveau-compv6-v6-2-83b05475f57c@mary.zone commit 6d13495325930d6a5ccf53e150b6c3f61f4b9a63 Author: Mary Guillemard Date: Mon Nov 10 16:32:56 2025 +0100 drm/nouveau/uvmm: Prepare for larger pages Currently memory allocated by VM_BIND uAPI can only have a granuality matching PAGE_SIZE (4KiB in common case) To have a better memory management and to allow big (64KiB) and huge (2MiB) pages later in the series, we are now passing the page shift all around the internals of UVMM. Signed-off-by: Mary Guillemard Co-developed-by: Mohamed Ahmed Signed-off-by: Mohamed Ahmed Reviewed-by: Lyude Paul Reviewed-by: James Jones Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251110-nouveau-compv6-v6-1-83b05475f57c@mary.zone commit 7e975caa0f7bf2f83a5e18b4ae69c3d7fff4eafa Author: Russell King (Oracle) Date: Tue Nov 11 11:26:34 2025 +0000 net: stmmac: improve ndev->max_mtu setup readability Improve the readibility of the code setting ndev->max_mtu. This depends on the hardware specific maximum defined by the MAC core, and also a platform provided maximum. The code was originally checking that the platform specific maximum was between ndev->min_mtu..MAC core maximum before reducing ndev->max_mtu, otherwise if the platform specific maximum was less than ndev->min_mtu, issuing a warning. Re-order the code to handle the case where the platform specific max is below ndev->min_mtu, which then means that the subsequent test is simply reducing ndev->max_mtu. Update the comment, and add a few blank lines to separate the blocks of code. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vImWA-0000000DrIl-1HZY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 387aba39b7be9e4b7fbacb04f22d8bb40be51a34 Author: Michal Wajdeczko Date: Sun Nov 9 17:24:50 2025 +0100 drm/xe/pf: Allow to lockdown the PF using custom guard Some driver components, like eudebug or ccs-mode, can't be used when VFs are enabled. Add functions to allow those components to block the PF from enabling VFs for the requested duration. Introduce trivial counter to allow lockdown or exclusive access that can be used in the scenarios where we can't follow the strict owner semantics as required by the rw_semaphore implementation. Before enabling VFs, the PF will try to arm the "vfs_enabling" guard for the exclusive access. This will fail if there are some lockdown requests already initiated by the other components. For testing purposes, add debugfs file which will call these new functions from the file's open/close hooks. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Cc: Christoph Manszewski Reviewed-by: Christoph Manszewski Link: https://patch.msgid.link/20251109162451.4779-1-michal.wajdeczko@intel.com commit 1479493c91fc14b8387db01c0442cd1508c325e6 Author: javen Date: Tue Nov 11 17:28:51 2025 +0800 r8169: add support for RTL8125K This adds support for chip RTL8125K. Its XID is 0x68a. It is basically based on the one with XID 0x688, but with different firmware file. Signed-off-by: javen Reviewed-by: Heiner Kallweit Link: https://patch.msgid.link/20251111092851.3371-1-javen_xu@realsil.com.cn Signed-off-by: Jakub Kicinski commit 337f7e3a4b4d60b41d3e9a389675bb9353925183 Author: Bo Liu Date: Wed Oct 29 15:17:42 2025 +0800 arm64: Fix double word in comments Remove the repeated word "the" in comments. Signed-off-by: Bo Liu Signed-off-by: Catalin Marinas commit fa9311d9499fedf0f6d06c22e016b228f2f5d473 Author: Junhui Liu Date: Tue Oct 21 17:41:48 2025 +0800 riscv: defconfig: Enable Anlogic SoC Enable Anlogic SoC config in defconfig to allow the default upstream kernel booting on Milianke MLKPAI-FS01 board. Acked-by: Conor Dooley Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit 7e6fd69c12f464c21e489aba763f0cef5cdd1373 Author: Junhui Liu Date: Tue Oct 21 17:41:47 2025 +0800 riscv: dts: anlogic: Add Milianke MLKPAI FS01 board Add support for the Milianke MLKPAI FS01 board based on the Anlogic DR1V90 SoC. The board features 512MB of onboard memory, USB-C UART, 1GbE RJ45 Ethernet, USB-A 2.0 port, TF card slot, and 256Mbit Quad-SPI flash. Currently, the board can boot to a console via UART1, which is connected to the onboard serial chip and routed to the Type-C interface. Acked-by: Conor Dooley Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit 77874ebd4032b1f407b01a7bbdfcad752da05592 Author: Junhui Liu Date: Tue Oct 21 17:41:46 2025 +0800 riscv: dts: Add initial Anlogic DR1V90 SoC device tree DR1V90 is a FPSoC from Anlogic, which features a RISC-V core as the PS part and 94,464 LUTs for the PL part. The PS part integrates a Nuclei UX900 RISC-V core with 32KB L1 icache and 32KB L1 dcache. It also provides two "snps,dw-apb-uart" compatible UART controllers. Some basic information of the processor can be obtained by running a simple application from nuclei-sdk [1]: -----Nuclei RISC-V CPU Configuration Information----- MARCHID: 0xc900 MIMPID: 0x20300 ISA: RV64 A B C D F I M P S U MCFG: TEE ECC ECLIC PLIC PPI ILM DLM ICACHE DCACHE IREGION No-Safety-Mechanism DLEN=VLEN/2 ILM: 256 KB has-ecc DLM: 256 KB has-ecc ICACHE: 32 KB(set=256,way=2,lsize=64,ecc=1) DCACHE: 32 KB(set=256,way=2,lsize=64,ecc=1) TLB: MainTLB(set=32,way=2,entry=1,ecc=1) ITLB(entry=8) DTLB(entry=8) IREGION: 0x68000000 128 MB Unit Size Address INFO 64KB 0x68000000 DEBUG 64KB 0x68010000 ECLIC 64KB 0x68020000 TIMER 64KB 0x68030000 PLIC 64MB 0x6c000000 INFO-Detail: mpasize : 0 PPI: 0xf8000000 128 MB -----End of Nuclei CPU INFO----- Link: https://github.com/Nuclei-Software/nuclei-sdk/blob/master/application/baremetal/cpuinfo/main.c [1] Acked-by: Conor Dooley Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit 9c96219602b1a29c1959c5799aa3e6c5e14e395c Author: Junhui Liu Date: Tue Oct 21 17:41:45 2025 +0800 riscv: Add Anlogic SoC famly Kconfig support The first SoC in the Anlogic series is DR1V90, which contains a RISC-V core from Nuclei. Acked-by: Conor Dooley Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit a94f9be29464f85e97683901162ca236dde40dc7 Author: Junhui Liu Date: Tue Oct 21 17:41:43 2025 +0800 dt-bindings: serial: snps-dw-apb-uart: Add Anlogic DR1V90 uart The Anlogic DR1V90 SoC integrates a UART controller compatible with snps,dw-apb-uart, operating at a 50 MHz clock. Acked-by: Rob Herring (Arm) Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit ccc3fd3ebeef2686f005733858c0a1b2cb89aaeb Author: Junhui Liu Date: Tue Oct 21 17:41:42 2025 +0800 dt-bindings: timer: Add Anlogic DR1V90 ACLINT MTIMER Add MTIMER support for Anlogic DR1V90 SoC, which uses Nuclei UX900 with a TIMER unit compliant with the ACLINT specification. Signed-off-by: Junhui Liu Acked-by: Rob Herring (Arm) Signed-off-by: Conor Dooley commit 4689d4422ac47ffb0a4c06fdb0e165388f585d01 Author: Junhui Liu Date: Tue Oct 21 17:41:38 2025 +0800 dt-bindings: riscv: Add Anlogic DR1V90 Add Anlogic DR1V90 FPSoC, featuring a UX900 RISC-V core as the processing system (PS) and 94,464 LUTs programmable logic (PL). It is used by the Milianke MLKPAI-FS01 board, a SBC equipped with 512MB DDR3 memory, USB-C UART, 1GbE RJ45 Ethernet, USB-A 2.0 port, TF card slot, and 256Mbit Quad-SPI flash. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit 66c2a3173cdaf7b776552203609f008c8709dd22 Author: Junhui Liu Date: Tue Oct 21 17:41:37 2025 +0800 dt-bindings: riscv: Add Nuclei UX900 compatibles The UX900 is a RISC-V core from Nuclei, used in the Anlogic DR1V90 SoC. It features a 64-bit architecture and dual-issue, 9-stage pipeline, with lots of optional extensions including V, K, Zc, and more. Acked-by: Conor Dooley Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit c86ee66e14acb15d7d20b329ea49f751c9df8bc9 Author: Junhui Liu Date: Tue Oct 21 17:41:36 2025 +0800 dt-bindings: vendor-prefixes: Add Anlogic, Milianke and Nuclei Add vendor prefixes for "anlogic", "milianke" and "nuclei". These are required for describing the Milianke MLKPAI-FS01 board with DR1V90 SoC from Anlogic, which uses a processor core designed by Nuclei. Acked-by: Krzysztof Kozlowski Signed-off-by: Junhui Liu Signed-off-by: Conor Dooley commit 96ac403ea2b4ddfc0aa99815476c3ff13a23935e Author: mrigendrachaubey Date: Thu Nov 6 19:26:55 2025 +0530 arm64: Fix typos and spelling errors in comments This patch corrects several minor typographical and spelling errors in comments across multiple arm64 source files. No functional changes. Signed-off-by: mrigendrachaubey Signed-off-by: Catalin Marinas commit 3749ea4deeba6049ea97e653d964568a45543e37 Author: Keith Busch Date: Wed Nov 12 08:42:18 2025 -0800 null_blk: fix zone read length beyond write pointer Fix up the divisor calculating the number of zone sectors being read and handle a read that straddles the zone write pointer. The length is rounded up a sector boundary, so be sure to truncate any excess bytes off to avoid copying past the data segment. Fixes: 3451cf34f51bb70 ("null_blk: allow byte aligned memory offsets") Signed-off-by: Keith Busch Tested-by: Bart van Assche Signed-off-by: Jens Axboe commit 459a0ce8dcb19edbd270d26b07fc9d72bfeece36 Author: Lucas De Marchi Date: Mon Nov 10 08:41:08 2025 -0800 drm/xe/pcode: Rework error mapping The sparse array used for error decoding from is unnecessarily big. It should be better handled by a switch statement that will also allow us to more easily improve this code. Add a CASE_ERR() macro to keep the table compact and use it instead of the 256-entries array, which saves some space: $ bloat-o-meter xe_pcode.o.old xe_pcode.o add/remove: 0/1 grow/shrink: 2/0 up/down: 190/-4096 (-3906) Function old new delta __pcode_mailbox_rw 363 465 +102 __pcode_mailbox_rw.cold 58 146 +88 err_decode 4096 - -4096 Total: Before=7890, After=3984, chg -49.51% Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20251110-pcode-errmap-v2-1-cb18c8f54238@intel.com Signed-off-by: Lucas De Marchi commit f74cf399e02e24c544b0bd4b1fe8fa2c5ae30b18 Author: Boqun Feng Date: Tue Oct 21 23:53:24 2025 -0400 rust: debugfs: Replace the usage of Rust native atomics Rust native atomics are not allowed to use in kernel due to the mismatch of memory model with Linux kernel memory model, hence remove the usage of Rust native atomics in debufs. Reviewed-by: Matthew Maurer Acked-by: Danilo Krummrich Tested-by: David Gow Acked-by: Greg Kroah-Hartman Signed-off-by: Boqun Feng Link: https://patch.msgid.link/20251022035324.70785-4-boqun.feng@gmail.com commit 013f912eb5fa7c06b3648ca630acfc4ff26456fa Author: Boqun Feng Date: Tue Oct 21 23:53:23 2025 -0400 rust: sync: atomic: Implement Debug for Atomic If `Atomic` is `Debug` then it's a `debugfs::Writer`, therefore make it so since 1) debugfs needs to support `Atomic` and 2) it's rather trivial to implement `Debug` for `Atomic`. Tested-by: David Gow Acked-by: Greg Kroah-Hartman Signed-off-by: Boqun Feng Link: https://patch.msgid.link/20251022035324.70785-3-boqun.feng@gmail.com commit 14e9a18b07ec463a85094cc8942788336164319f Author: Boqun Feng Date: Tue Oct 21 23:53:22 2025 -0400 rust: sync: atomic: Make Atomic*Ops pub(crate) In order to write code over a generate Atomic we need to make Atomic*Ops public so that functions like `.load()` and `.store()` are available. Make these pub(crate) at the beginning so the usage in kernel crate is supported. Tested-by: David Gow Acked-by: Greg Kroah-Hartman Signed-off-by: Boqun Feng Link: https://patch.msgid.link/20251022035324.70785-2-boqun.feng@gmail.com commit 9e9182cab5ebc3ee7544e60ef08ba19fdf216920 Author: Leo Yan Date: Tue Nov 11 18:58:42 2025 +0000 coresight: etm4x: Remove the state_needs_restore flag When the restore flow is invoked, it means no error occurred during the save phase. Otherwise, if any errors happened while saving the context, the function would return an error and abort the suspend sequence. Therefore, the state_needs_restore flag is unnecessary. The save and restore functions are changed to check two conditions: 1) The global flag pm_save_enable is SELF_HOSTED mode; 2) The device is in active mode (non DISABLED). Reviewed-by: Yeoreum Yun Reviewed-by: Mike Leach Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-8-f55553b6c8b3@arm.com commit 95d1df610cdc7497510cc710435a5c8c4e3db606 Author: Tejun Heo Date: Tue Nov 11 09:18:16 2025 -1000 sched_ext: Implement load balancer for bypass mode In bypass mode, tasks are queued on per-CPU bypass DSQs. While this works well in most cases, there is a failure mode where a BPF scheduler can skew task placement severely before triggering bypass in highly over-saturated systems. If most tasks end up concentrated on a few CPUs, those CPUs can accumulate queues that are too long to drain in a reasonable time, leading to RCU stalls and hung tasks. Implement a simple timer-based load balancer that redistributes tasks across CPUs within each NUMA node. The balancer runs periodically (default 500ms, tunable via bypass_lb_intv_us module parameter) and moves tasks from overloaded CPUs to underloaded ones. When moving tasks between bypass DSQs, the load balancer holds nested DSQ locks to avoid dropping and reacquiring the donor DSQ lock on each iteration, as donor DSQs can be very long and highly contended. Add the SCX_ENQ_NESTED flag and use raw_spin_lock_nested() in dispatch_enqueue() to support this. The load balancer timer function reads scx_bypass_depth locklessly to check whether bypass mode is active. Use WRITE_ONCE() when updating scx_bypass_depth to pair with the READ_ONCE() in the timer function. This has been tested on a 192 CPU dual socket AMD EPYC machine with ~20k runnable tasks running scx_cpu0. As scx_cpu0 queues all tasks to CPU0, almost all tasks end up on CPU0 creating severe imbalance. Without the load balancer, disabling the scheduler can lead to RCU stalls and hung tasks, taking a very long time to complete. With the load balancer, disable completes in about a second. The load balancing operation can be monitored using the sched_ext_bypass_lb tracepoint and disabled by setting bypass_lb_intv_us to 0. v2: Lock both rq and DSQ in bypass_lb_cpu() and use dispatch_dequeue_locked() to prevent races with dispatch_dequeue() (Andrea Righi). Cc: Andrea Righi Cc: Dan Schatzberg Cc: Emil Tsalapatis Reviewed_by: Emil Tsalapatis Signed-off-by: Tejun Heo commit d18b96ce12becf3f3aa3556ba722c2de61aca94e Author: Tejun Heo Date: Tue Nov 11 09:18:15 2025 -1000 sched_ext: Factor out abbreviated dispatch dequeue into dispatch_dequeue_locked() move_task_between_dsqs() contains open-coded abbreviated dequeue logic when moving tasks between non-local DSQs. Factor this out into dispatch_dequeue_locked() which can be used when both the task's rq and dsq locks are already held. Add lockdep assertions to both dispatch_dequeue() and the new helper to verify locking requirements. This prepares for the load balancer which will need the same abbreviated dequeue pattern. Cc: Andrea Righi Cc: Dan Schatzberg Cc: Emil Tsalapatis Signed-off-by: Tejun Heo commit d2974cc79f7139cc851b84ad4f77805e93c40fe1 Author: Tejun Heo Date: Tue Nov 11 09:18:14 2025 -1000 sched_ext: Factor out scx_dsq_list_node cursor initialization into INIT_DSQ_LIST_CURSOR Factor out scx_dsq_list_node cursor initialization into INIT_DSQ_LIST_CURSOR macro in preparation for additional users. Reviewed-by: Emil Tsalapatis Cc: Dan Schatzberg Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit c948d9f80c675aad91d1510afed207df421b68e5 Author: Tejun Heo Date: Tue Nov 11 09:18:13 2025 -1000 sched_ext: Add scx_cpu0 example scheduler Add scx_cpu0, a simple scheduler that queues all tasks to a single DSQ and only dispatches them from CPU0 in FIFO order. This is useful for testing bypass behavior when many tasks are concentrated on a single CPU. If the load balancer doesn't work, bypass mode can trigger task hangs or RCU stalls as the queue is long and there's only one CPU working on it. v2: Check whether task is on CPU0 at enqueue using scx_bpf_task_cpu() instead of nr_cpus_allowed (Andrea Righi). Cc: Dan Schatzberg Cc: Emil Tsalapatis Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 582f700e1bdc5978f41e3d8d65d3e16e34e9be8a Author: Tejun Heo Date: Tue Nov 11 09:18:12 2025 -1000 sched_ext: Hook up hardlockup detector A poorly behaving BPF scheduler can trigger hard lockup. For example, on a large system with many tasks pinned to different subsets of CPUs, if the BPF scheduler puts all tasks in a single DSQ and lets all CPUs at it, the DSQ lock can be contended to the point where hardlockup triggers. Unfortunately, hardlockup can be the first signal out of such situations, thus requiring hardlockup handling. Hook scx_hardlockup() into the hardlockup detector to try kicking out the current scheduler in an attempt to recover the system to a good state. The handling strategy can delay watchdog taking its own action by one polling period; however, given that the only remediation for hardlockup is crash, this is likely an acceptable trade-off. v2: Add missing dummy scx_hardlockup() definition for !CONFIG_SCHED_CLASS_EXT (kernel test bot). Reported-by: Dan Schatzberg Cc: Emil Tsalapatis Cc: Douglas Anderson Cc: Andrew Morton Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 7ed8df0d15022fcc092e7c7f0bd82359476cff3c Author: Tejun Heo Date: Tue Nov 11 09:18:11 2025 -1000 sched_ext: Make handle_lockup() propagate scx_verror() result handle_lockup() currently calls scx_verror() but ignores its return value, always returning true when the scheduler is enabled. Make it capture and return the result from scx_verror(). This prepares for hardlockup handling. Cc: Dan Schatzberg Cc: Emil Tsalapatis Reviewed-by: Andrea Righi Signed-off-by: Tejun Heo commit 4ba54a6cbd4ddde805b769b4be04623a2ce1668c Author: Tejun Heo Date: Tue Nov 11 09:18:10 2025 -1000 sched_ext: Refactor lockup handlers into handle_lockup() scx_rcu_cpu_stall() and scx_softlockup() share the same pattern: check if the scheduler is enabled under RCU read lock and trigger an error if so. Extract the common pattern into handle_lockup() helper. Add scx_verror() macro and use guard(rcu)(). This simplifies both handlers, reduces code duplication, and prepares for hardlockup handling. Reviewed-by: Dan Schatzberg Reviewed-by: Andrea Righi Cc: Emil Tsalapatis Signed-off-by: Tejun Heo commit f2fe382e1f9e568e6702f4ee416de587e9d6b671 Author: Tejun Heo Date: Tue Nov 11 09:18:09 2025 -1000 sched_ext: Make scx_exit() and scx_vexit() return bool Make scx_exit() and scx_vexit() return bool indicating whether the calling thread successfully claimed the exit. This will be used by the abort mechanism added in a later patch. Reviewed-by: Dan Schatzberg Reviewed-by: Andrea Righi Cc: Emil Tsalapatis Signed-off-by: Tejun Heo commit 5ebec443fb96ac305baaae51efe998194f3c87c4 Author: Tejun Heo Date: Tue Nov 11 09:18:08 2025 -1000 sched_ext: Exit dispatch and move operations immediately when aborting 62dcbab8b0ef ("sched_ext: Avoid live-locking bypass mode switching") introduced the breather mechanism to inject delays during bypass mode switching. It maintains operation semantics unchanged while reducing lock contention to avoid live-locks on large NUMA systems. However, the breather only activates when exiting the scheduler, so there's no need to maintain operation semantics. Simplify by exiting dispatch and move operations immediately when scx_aborting is set. In consume_dispatch_q(), break out of the task iteration loop. In scx_dsq_move(), return early before acquiring locks. This also fixes cases the breather mechanism cannot handle. When a large system has many runnable threads affinitized to different CPU subsets and the BPF scheduler places them all into a single DSQ, many CPUs can scan the DSQ concurrently for tasks they can run. This can cause DSQ and RQ locks to be held for extended periods, leading to various failure modes. The breather cannot solve this because once in the consume loop, there's no exit. The new mechanism fixes this by exiting the loop immediately. The bypass DSQ is exempted to ensure the bypass mechanism itself can make progress. v2: Use READ_ONCE() when reading scx_aborting (Andrea Righi). Reported-by: Dan Schatzberg Reviewed-by: Dan Schatzberg Cc: Andrea Righi Cc: Emil Tsalapatis Signed-off-by: Tejun Heo commit a69040ed57f50156e5452474d25c79b9e62075d0 Author: Tejun Heo Date: Tue Nov 11 09:18:07 2025 -1000 sched_ext: Simplify breather mechanism with scx_aborting flag The breather mechanism was introduced in 62dcbab8b0ef ("sched_ext: Avoid live-locking bypass mode switching") and e32c260195e6 ("sched_ext: Enable the ops breather and eject BPF scheduler on softlockup") to prevent live-locks by injecting delays when CPUs are trapped in dispatch paths. Currently, it uses scx_breather_depth (atomic_t) and scx_in_softlockup (unsigned long) with separate increment/decrement and cleanup operations. The breather is only activated when aborting, so tie it directly to the exit mechanism. Replace both variables with scx_aborting flag set when exit is claimed and cleared after bypass is enabled. Introduce scx_claim_exit() to consolidate exit_kind claiming and breather enablement. This eliminates scx_clear_softlockup() and simplifies scx_softlockup() and scx_bypass(). The breather mechanism will be replaced by a different abort mechanism in a future patch. This simplification prepares for that change. Reviewed-by: Dan Schatzberg Reviewed-by: Emil Tsalapatis Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit 61debc251c1c9150c7bdfd5c028bc2d078e17d22 Author: Tejun Heo Date: Tue Nov 11 09:18:06 2025 -1000 sched_ext: Use per-CPU DSQs instead of per-node global DSQs in bypass mode Bypass mode routes tasks through fallback dispatch queues. Originally a single global DSQ, b7b3b2dbae73 ("sched_ext: Split the global DSQ per NUMA node") changed this to per-node DSQs to resolve NUMA-related livelocks. Dan Schatzberg found per-node DSQs can still livelock when many threads are pinned to different small CPU subsets: each CPU must scan many incompatible tasks to find runnable ones, causing severe contention with high CPU counts. Switch to per-CPU bypass DSQs. Each task queues on its current CPU. Default idle CPU selection and direct dispatch handle most cases well. This introduces a failure mode when tasks concentrate on one CPU in over-saturated systems. If the BPF scheduler severely skews placement before triggering bypass, that CPU's queue may be too long to drain, causing RCU stalls. A load balancer in a future patch will address this. The bypass DSQ is separate from local DSQ to enable load balancing: local DSQs use rq locks, preventing efficient scanning and transfer across CPUs, especially problematic when systems are already contended. v2: Clarified why bypass DSQ is separate from local DSQ (Andrea Righi). Reported-by: Dan Schatzberg Reviewed-by: Dan Schatzberg Reviewed-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit 3546119f18647d7ddbba579737d8a222b430cb1c Author: Tejun Heo Date: Tue Nov 11 09:18:05 2025 -1000 sched_ext: Refactor do_enqueue_task() local and global DSQ paths The local and global DSQ enqueue paths in do_enqueue_task() share the same slice refill logic. Factor out the common code into a shared enqueue label. This makes adding new enqueue cases easier. No functional changes. Reviewed-by: Andrea Righi Reviewed-by: Emil Tsalapatis Signed-off-by: Tejun Heo commit bfd3749d489ec0df27ed94ee3dfd9475fea27bf9 Author: Tejun Heo Date: Tue Nov 11 09:18:04 2025 -1000 sched_ext: Use shorter slice in bypass mode There have been reported cases of bypass mode not making forward progress fast enough. The 20ms default slice is unnecessarily long for bypass mode where the primary goal is ensuring all tasks can make forward progress. Introduce SCX_SLICE_BYPASS set to 5ms and make the scheduler automatically switch to it when entering bypass mode. Also make the bypass slice value tunable through the slice_bypass_us module parameter (adjustable between 100us and 100ms) to make it easier to test whether slice durations are a factor in problem cases. v3: Use READ_ONCE/WRITE_ONCE for scx_slice_dfl access (Dan). v2: Removed slice_dfl_us module parameter. Fixed typos (Andrea). Reviewed-by: Emil Tsalapatis Reviewed-by: Andrea Righi Cc: Dan Schatzberg Signed-off-by: Tejun Heo commit 1d562ba0aa7df81335bf96c02be77efe8d5bab87 Author: Tomer Maimon Date: Wed Nov 12 17:09:50 2025 +0200 spi: dt-bindings: nuvoton,npcm-pspi: Convert to DT schema Convert the Nuvoton NPCM PSPI binding to DT schema format. Also update the binding to fix shortcoming: * Drop clock-frequency property: it is never read in the NPCM PSPI driver and has no effect. Signed-off-by: Tomer Maimon Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251112150950.1680154-1-tmaimon77@gmail.com Signed-off-by: Mark Brown commit 42690b8ec861b502538e425c5a7feb7a38764f04 Author: Andy Shevchenko Date: Wed Nov 12 09:52:20 2025 +0100 phy: sophgo: Remove unused of_gpio.h of_gpio.h is deprecated and subject to remove. The driver doesn't use it, simply remove the unused header. Signed-off-by: Andy Shevchenko Signed-off-by: Vinod Koul commit 76680d0d2825900f23bf35290ab2b80bdf3a8e4a Author: Steven Rostedt Date: Tue Nov 11 18:24:08 2025 -0500 tracing: Have function tracer define options per instance Currently the function tracer's options are saved via a global mask when it should be per instance. Use the new infrastructure to define a "default_flags" field in the tracer structure that is used for the top level instance as well as new ones. Currently the global mask causes confusion: # cd /sys/kernel/tracing # mkdir instances/foo # echo function > instances/foo/current_tracer # echo 1 > options/func-args # echo function > current_tracer # cat trace [..] -0 [005] d..3. 1050.656187: rcu_needs_cpu() <-tick_nohz_next_event -0 [005] d..3. 1050.656188: get_next_timer_interrupt(basej=0x10002dbad, basem=0xf45fd7d300) <-tick_nohz_next_event -0 [005] d..3. 1050.656189: _raw_spin_lock(lock=0xffff8944bdf5de80) <-__get_next_timer_interrupt -0 [005] d..4. 1050.656190: do_raw_spin_lock(lock=0xffff8944bdf5de80) <-__get_next_timer_interrupt -0 [005] d..4. 1050.656191: _raw_spin_lock_nested(lock=0xffff8944bdf5f140, subclass=1) <-__get_next_timer_interrupt # cat instances/foo/options/func-args 1 # cat instances/foo/trace [..] kworker/4:1-88 [004] ...1. 298.127735: next_zone <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127736: first_online_pgdat <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127738: next_online_pgdat <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127739: fold_diff <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127741: round_jiffies_relative <-vmstat_update [..] The above shows that updating the "func-args" option at the top level instance also updates the "func-args" option in the instance but because the update is only done by the instance that gets changed (as it should), it's confusing to see that the option is already set in the other instance. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251111232429.470883736@kernel.org Fixes: f20a580627f43 ("ftrace: Allow instances to use function tracing") Signed-off-by: Steven Rostedt (Google) commit 428add559b6923f13acc591913cda3467be98dfd Author: Steven Rostedt Date: Tue Nov 11 18:24:07 2025 -0500 tracing: Have tracer option be instance specific Tracers can add specify options to modify them. This logic was added before instances were created and the tracer flags were global variables. After instances were created where a tracer may exist in more than one instance, the flags were not updated from being global into instance specific. This causes confusion with these options. For example, the function tracer has an option to enable function arguments: # cd /sys/kernel/tracing # mkdir instances/foo # echo function > instances/foo/current_tracer # echo 1 > options/func-args # echo function > current_tracer # cat trace [..] -0 [005] d..3. 1050.656187: rcu_needs_cpu() <-tick_nohz_next_event -0 [005] d..3. 1050.656188: get_next_timer_interrupt(basej=0x10002dbad, basem=0xf45fd7d300) <-tick_nohz_next_event -0 [005] d..3. 1050.656189: _raw_spin_lock(lock=0xffff8944bdf5de80) <-__get_next_timer_interrupt -0 [005] d..4. 1050.656190: do_raw_spin_lock(lock=0xffff8944bdf5de80) <-__get_next_timer_interrupt -0 [005] d..4. 1050.656191: _raw_spin_lock_nested(lock=0xffff8944bdf5f140, subclass=1) <-__get_next_timer_interrupt # cat instances/foo/options/func-args 1 # cat instances/foo/trace [..] kworker/4:1-88 [004] ...1. 298.127735: next_zone <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127736: first_online_pgdat <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127738: next_online_pgdat <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127739: fold_diff <-refresh_cpu_vm_stats kworker/4:1-88 [004] ...1. 298.127741: round_jiffies_relative <-vmstat_update [..] The above shows that setting "func-args" in the top level instance also set it in the instance "foo", but since the interface of the trace flags are per instance, the update didn't take affect in the "foo" instance. Update the infrastructure to allow tracers to add a "default_flags" field in the tracer structure that can be set instead of "flags" which will make the flags per instance. If a tracer needs to keep the flags global (like blktrace), keeping the "flags" field set will keep the old behavior. This does not update function or the function graph tracers. That will be handled later. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251111232429.305317942@kernel.org Fixes: f20a580627f43 ("ftrace: Allow instances to use function tracing") Signed-off-by: Steven Rostedt (Google) commit 26b8986a18c1f8c277659340e59c59d5f17d927f Author: Eric Dumazet Date: Tue Nov 11 15:12:35 2025 +0000 net: clear skb->sk in skb_release_head_state() skb_release_head_state() inlines skb_orphan(). We need to clear skb->sk otherwise we can freeze TCP flows on a mostly idle host, because skb_fclone_busy() would return true as long as the packet is not yet processed by skb_defer_free_flush(). Fixes: 1fcf572211da ("net: allow skb_release_head_state() to be called multiple times") Fixes: e20dfbad8aab ("net: fix napi_consume_skb() with alien skbs") Signed-off-by: Eric Dumazet Tested-by: Aditya Garg Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20251111151235.1903659-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 53361aa64f2137e31a10813ccbd00d99f4dac130 Author: Kriish Sharma Date: Mon Nov 10 18:42:06 2025 +0000 drm/xe: fix kernel-doc function name mismatch in xe_pm.c Documentation build reported: WARNING: ./drivers/gpu/drm/xe/xe_pm.c:131 expecting prototype for xe_pm_might_block_on_suspend(). Prototype was for xe_pm_block_on_suspend() instead The kernel-doc comment for xe_pm_block_on_suspend() incorrectly used the function name xe_pm_might_block_on_suspend(). Fix the header to match the actual function prototype. No functional changes. Fixes: f73f6dd312a5 ("drm/xe/pm: Add lockdep annotation for the pm_block completion") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511061736.CiuroL7H-lkp@intel.com/ Signed-off-by: Kriish Sharma Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20251110184206.2113830-1-kriish.sharma2006@gmail.com Signed-off-by: Rodrigo Vivi commit 4bc259ebcb3e2420e5907527d1b04afb197067fa Merge: 3a8660878839fa b817f505926b8f Author: Vinod Koul Date: Wed Nov 12 20:11:21 2025 +0530 phy: phy-can-transceiver: Support TJA1048/TJA1051 Peng Fan says: TJA1048 is a Dual channel can transceiver with Sleep mode supported. TJA105{1,7} is a Single Channel can transceiver with Sleep mode supported. Link: https://patch.msgid.link/20251001-can-v7-0-fad29efc3884@nxp.com Signed-off-by: Vinod Koul commit b817f505926b8ffbdea8aa87b66a622acb9b96e9 Author: Peng Fan Date: Wed Oct 1 21:22:36 2025 +0800 phy: phy-can-transceiver: Add support for TJA105{1,7} Support TJA105{1,7} which are a single channel high-speed CAN transceiver with silent mode supported. phy mode is not implemented as of now. silent settings are kept in phy_power_on and phy_power_off. After phy mode is supported, the silent settings could be moved to phy_set_mode. Reviewed-by: Frank Li Signed-off-by: Peng Fan Acked-by: Marc Kleine-Budde Link: https://patch.msgid.link/20251001-can-v7-5-fad29efc3884@nxp.com Signed-off-by: Vinod Koul commit d02a7eb12924b7473a62d5a6c9e670fe5bf6e4b7 Author: Peng Fan Date: Wed Oct 1 21:22:35 2025 +0800 phy: phy-can-transceiver: Drop the gpio desc check gpiod_set_value_cansleep has an internal check on gpio_desc using 'VALIDATE_DESC(desc)', the check before invoking gpiod_set_value_cansleep could be removed. Reviewed-by: Frank Li Signed-off-by: Peng Fan Acked-by: Marc Kleine-Budde Link: https://patch.msgid.link/20251001-can-v7-4-fad29efc3884@nxp.com Signed-off-by: Vinod Koul commit 6e9fe9409e10ed25b43928062832037752630979 Author: Peng Fan Date: Wed Oct 1 21:22:34 2025 +0800 phy: phy-can-transceiver: Add dual channel support for TJA1048 - Introduce new flag CAN_TRANSCEIVER_DUAL_CH to indicate the phy has two channels. - Alloc a phy for each channel - Support TJA1048 which is a dual high-speed CAN transceiver with sleep mode supported. - Add can_transceiver_phy_xlate for parsing phy Reviewed-by: Frank Li Signed-off-by: Peng Fan Acked-by: Marc Kleine-Budde Link: https://patch.msgid.link/20251001-can-v7-3-fad29efc3884@nxp.com Signed-off-by: Vinod Koul commit c77464bd9b4155891a135e51f8e916e1ab94fc14 Author: Peng Fan Date: Wed Oct 1 21:22:33 2025 +0800 phy: phy-can-transceiver: Introduce can_transceiver_priv To prepare for dual-channel phy support, introduce can_transceiver_priv as a higher level encapsulation for phy. No functional changes. Reviewed-by: Frank Li Signed-off-by: Peng Fan Acked-by: Marc Kleine-Budde Link: https://patch.msgid.link/20251001-can-v7-2-fad29efc3884@nxp.com Signed-off-by: Vinod Koul commit 05ace63d0bcfe131e741923394c7ce03322a141e Author: Peng Fan Date: Wed Oct 1 21:22:32 2025 +0800 dt-bindings: phy: ti,tcan104x-can: Document NXP TJA105X/1048 The TJA1048 is a dual high-speed CAN transceiver with sleep mode supported and no EN pin. The TJA1051 is a high-speed CAN transceiver with slient mode supported, but only TJA1051T/E has EN pin. To make it simple, make enable-gpios as optional for TJA1051. The TJA1057 is a high-speed CAN transceiver with slient mode supported and no EN pin. Reviewed-by: Frank Li Reviewed-by: Rob Herring (Arm) Signed-off-by: Peng Fan Acked-by: Marc Kleine-Budde Link: https://patch.msgid.link/20251001-can-v7-1-fad29efc3884@nxp.com Signed-off-by: Vinod Koul commit 4001bda0cc911fcdd3dde36963a17f4eac173d7d Merge: fc6aa0e470e092 99f932c9050911 Author: Jakub Kicinski Date: Wed Nov 12 06:19:42 2025 -0800 Merge branch 'selftests-vsock-refactor-and-improve-vmtest-infrastructure' Bobby Eshleman says: ==================== selftests/vsock: refactor and improve vmtest infrastructure This patch series refactors the vsock selftest VM infrastructure to improve test run times, improve logging, and prepare for future tests which make heavy usage of these refactored functions and have new requirements such as simultaneous QEMU processes. ==================== Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-0-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 99f932c9050911fab8ac82455fc4d74b1c0200af Author: Bobby Eshleman Date: Sat Nov 8 08:01:03 2025 -0800 selftests/vsock: disable shellcheck SC2317 and SC2119 Disable shellcheck rules SC2317 and SC2119. These rules are being triggered due to false positives. For SC2317, many `return "${KSFT_PASS}"` lines are reported as unreachable, even though they are executed during normal runs. For SC2119, the fact that log_guest/log_host accept either stdin or arguments triggers SC2119, despite being valid. Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-12-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 338c5ddf4c889926e931067418797cd1711dd939 Author: Bobby Eshleman Date: Sat Nov 8 08:01:02 2025 -0800 selftests/vsock: add vsock_loopback module loading Add vsock_loopback module loading to the loopback test so that vmtest.sh can be used for kernels built with loopback as a module. This is not technically a fix as kselftest expects loopback to be built-in already (defined in selftests/vsock/config). This is useful only for using vmtest.sh outside of kselftest. Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-11-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 67422ef38f8cc1116c28a74c144c1ab3cbbdb3bb Author: Bobby Eshleman Date: Sat Nov 8 08:01:01 2025 -0800 selftests/vsock: add 1.37 to tested virtme-ng versions Testing with 1.37 shows all tests passing but emits the warning: warning: vng version 'virtme-ng 1.37' has not been tested and may not function properly. The following versions have been tested: 1.33 1.36 This patch adds 1.37 to the virtme-ng versions to get rid of the above warning. Reviewed-by: Simon Horman Reviewed-by: Stefano Garzarella Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-10-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 592e3d14cecf8ffebe718586f02007a082aa3193 Author: Bobby Eshleman Date: Sat Nov 8 08:01:00 2025 -0800 selftests/vsock: add BUILD=0 definition Add the definition for BUILD and initialize it to zero. This avoids 'bash -u vmtest.sh` from throwing 'unbound variable' when BUILD is not set to 1 and is later checked for its value. Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-9-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit d13fb04a4bf0811b593843f7d2385fac5cf313c8 Author: Bobby Eshleman Date: Sat Nov 8 08:00:59 2025 -0800 selftests/vsock: identify and execute tests that can re-use VM In preparation for future patches that introduce tests that cannot re-use the same VM, add functions to identify those that *can* re-use a VM. By continuing to re-use the same VM for these tests we can save time by avoiding the delay of booting a VM for every test. Reviewed-by: Simon Horman Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-8-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 7fea50dff98812db3ee4ddd96405c3298d9aa4cb Author: Bobby Eshleman Date: Sat Nov 8 08:00:58 2025 -0800 selftests/vsock: add check_result() for pass/fail counting Add check_result() function to reuse logic for incrementing the pass/fail counters. This function will get used by different callers as we add different types of tests in future patches (namely, namespace and non-namespace tests will be called at different places, and re-use this function). Reviewed-by: Simon Horman Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-7-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 9e2ad0bc3640c384799c91da0b8b794c672da4d3 Author: Bobby Eshleman Date: Sat Nov 8 08:00:57 2025 -0800 selftests/vsock: speed up tests by reducing the QEMU pidfile timeout Reduce the time waiting for the QEMU pidfile from three minutes to five seconds. The three minute time window was chosen to make sure QEMU had enough time to fully boot up. This, however, is an unreasonably long delay for QEMU to write the pidfile, which happens earlier when the QEMU process starts (not after VM boot). The three minute delay becomes noticeably wasteful in future tests that expect QEMU to fail and wait a full three minutes for a pidfile that will never exist. Reviewed-by: Simon Horman Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-6-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit c7df4adc0679afa2da47c13cbf7960a26e0fe7cb Author: Bobby Eshleman Date: Sat Nov 8 08:00:56 2025 -0800 selftests/vsock: do not unconditionally die if qemu fails If QEMU fails to boot, then set the returncode (via timeout) instead of unconditionally dying. This is in preparation for tests that expect QEMU to fail to boot. In that case, we just want to know if the boot failed or not so we can test the pass/fail criteria, and continue executing the next test. Reviewed-by: Simon Horman Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-5-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit ac8997e943bc035171e76c8457db6fa973c8a9ab Author: Bobby Eshleman Date: Sat Nov 8 08:00:55 2025 -0800 selftests/vsock: avoid multi-VM pidfile collisions with QEMU Change QEMU to use generated pidfile names instead of just a single globally-defined pidfile. This allows multiple QEMU instances to co-exist with different pidfiles. This is required for future tests that use multiple VMs to check for CID collissions. Additionally, this also places the burden of killing the QEMU process and cleaning up the pidfile on the caller of vm_start(). To help with this, a function terminate_pidfiles() is introduced that callers use to perform the cleanup. The terminate_pidfiles() function supports multiple pidfile removals because future patches will need to process two pidfiles at a time. Change QEMU_OPTS to be initialized inside the vm_start(). This allows the generated pidfile to be passed to the string assignment, and prepares for future vm-specific options as well (e.g., cid). Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-4-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 4f76ff14d3d96a21574e66222041757d679a8a10 Author: Bobby Eshleman Date: Sat Nov 8 08:00:54 2025 -0800 selftests/vsock: reuse logic for vsock_test through wrapper functions Add wrapper functions vm_vsock_test() and host_vsock_test() to invoke the vsock_test binary. This encapsulates several items of repeat logic, such as waiting for the server to reach listening state and enabling/disabling the bash option pipefail to avoid pipe-style logging from hiding failures. Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-3-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 2ed3ce7efbd2854fb7eb76627ccec92362b2345b Author: Bobby Eshleman Date: Sat Nov 8 08:00:53 2025 -0800 selftests/vsock: make wait_for_listener() work even if pipefail is on Rewrite wait_for_listener()'s pattern matching to avoid tripping the if-condition when pipefail is on. awk doesn't gracefully handle SIGPIPE with a non-zero exit code, so grep exiting upon finding a match causes false-positives when the pipefail option is used (grep exits, SIGPIPE emits, and awk complains with a non-zero exit code). Instead, move all of the pattern matching into awk so that SIGPIPE cannot happen and the correct exit code is returned. Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-2-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit d9cac93cd1bed31724f55857b934bcbbc8313b59 Author: Bobby Eshleman Date: Sat Nov 8 08:00:52 2025 -0800 selftests/vsock: improve logging in vmtest.sh Improve usability of logging functions. Remove the test name prefix from logging functions so that logging calls can be made deeper into the call stack without passing down the test name or setting some global. Teach log function to accept a LOG_PREFIX variable to avoid unnecessary argument shifting. Remove log_setup() and instead use log_host(). The host/guest prefixes are useful to show whether a failure happened on the guest or host side, but "setup" doesn't really give additional useful information. Since all log_setup() calls happen on the host, lets just use log_host() instead. Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20251108-vsock-selftests-fixes-and-improvements-v4-1-d5e8d6c87289@meta.com Signed-off-by: Jakub Kicinski commit 4d6e2211aeb932e096f673c88475016b1cc0f8ab Author: Kai Vehmanen Date: Wed Nov 12 19:50:45 2025 +0800 ASoC: Intel: boards: fix HDMI playback lookup when HDMI-In capture used In boards like adl_lt6911_hdmi_ssp/mtl_lt6911_hdmi_ssp/rpl_lt6911_hdmi_ssp, HDMI is supported both for playback via normal HDA display codec, as well as PCM capture from HDMI-In over I2S. The common board driver function hda_dsp_hdmi_pcm_handle() has an invalid assumption that "HDMI" is only used to identify playback HDMI PCMs on the card. This will result in failures if HDMI-In PCMs are defined in topology using the string "HDMI", and they are registered before the playback PCMs. Fix the issue by explicitly looking for FE playback PCMs. Signed-off-by: Kai Vehmanen Reviewed-by: Péter Ujfalusi Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251112115045.337062-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit ae1ef2fbb8c9091e0ea62734a4a232ad9928701b Author: Marco Crivellari Date: Wed Nov 12 13:01:25 2025 +0100 firewire: core: add WQ_UNBOUND to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds the WQ_UNBOUND flag to explicitly request alloc_workqueue() to be unbound, because this specific workload has no benefit being per-cpu. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20251112120125.124578-1-marco.crivellari@suse.com Signed-off-by: Takashi Sakamoto commit f2596d9fa19c0910319fe8eb1ccdf6348f0e02db Author: Chen Ni Date: Tue Nov 11 14:29:44 2025 +0800 pinctrl: airoha: convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni Signed-off-by: Linus Walleij commit 628cb03b15f2a0f10534979b3ea9c8befe87c381 Author: Luke D. Jones Date: Sun Nov 2 22:53:13 2025 +0100 platform/x86: asus-armoury: add panel_hd_mode attribute Add panel_hd_mode to toggle the panel mode between single and high definition modes. Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Reviewed-by: Mario Limonciello Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20251102215319.3126879-4-denis.benato@linux.dev Signed-off-by: Ilpo Järvinen commit f99eb098090e4c8bfca4190b545e20450fee8250 Author: Luke D. Jones Date: Sun Nov 2 22:53:12 2025 +0100 platform/x86: asus-armoury: move existing tunings to asus-armoury module The fw_attributes_class provides a much cleaner interface to all of the attributes introduced to asus-wmi. This patch moves all of these extra attributes over to fw_attributes_class, and shifts the bulk of these definitions to a new kernel module to reduce the clutter of asus-wmi with the intention of deprecating the asus-wmi attributes in future. The work applies only to WMI methods which don't have a clearly defined place within the sysfs and as a result ended up lumped together in /sys/devices/platform/asus-nb-wmi/ with no standard API. Where possible the fw attrs now implement defaults, min, max, scalar, choices, etc. As en example dgpu_disable becomes: /sys/class/firmware-attributes/asus-armoury/attributes/dgpu_disable/ ├── current_value ├── display_name ├── possible_values └── type as do other attributes. Co-developed-by: Denis Benato Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Link: https://patch.msgid.link/20251102215319.3126879-3-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a49a9f4555bde0b008f2225620ae1b2480d2b627 Author: Tuo Li Date: Wed Nov 12 20:02:53 2025 +0800 RDMA/irdma: Remove redundant NULL check of udata in irdma_create_user_ah() The variable udata cannot be NULL because irdma_create_user_ah() always receives it. Therefore, the if() check can be safely removed. Signed-off-by: Tuo Li Link: https://patch.msgid.link/20251112120253.68945-1-islituo@gmail.com Signed-off-by: Leon Romanovsky commit 989019c969a2be5fcf52a184dbc2e47febb8a2e2 Author: Marco Crivellari Date: Fri Nov 7 15:16:54 2025 +0100 mmc: core: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Ulf Hansson commit ff6f0286c896f062853552097220dd93961be9c4 Author: Shawn Lin Date: Tue Nov 4 15:41:34 2025 +0800 mmc: dw_mmc-rockchip: Add memory clock auto-gating support Per design recommendations, the memory clock can be gated when there is no in-flight transfer, which helps save power. This feature is introduced alongside internal phase support, and this patch enables it. Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 3187e25eb2705dec9f0509f6e42da7e018718c74 Author: Alex Elder Date: Mon Oct 27 08:30:07 2025 -0500 riscv: defconfig: enable SPI_FSL_QUADSPI as a module The SpacemiT K1 SoC QSPI IP uses the Freescale driver. Enable it as a module in the default kernel configuration for RISC-V. Acked-by: Paul Walmsley # for arch/riscv Signed-off-by: Alex Elder Signed-off-by: Conor Dooley commit 9eda581bfe8a1774390dd66f365a2e00a9d27a41 Author: Mateusz Guzik Date: Mon Nov 10 10:56:34 2025 +0100 fs: move fd_install() slowpath into a dedicated routine and provide commentary On stock kernel gcc 14 emits avoidable register spillage: endbr64 call ffffffff81374630 <__fentry__> push %r13 push %r12 push %rbx sub $0x8,%rsp [snip] Total fast path is 99 bytes. Moving the slowpath out avoids it and shortens the fast path to 74 bytes. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251110095634.1433061-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 21b561dab1406e63740ebe240c7b69f19e1bcf58 Author: Mateusz Guzik Date: Wed Nov 5 16:36:22 2025 +0100 fs: hide dentry_cache behind runtime const machinery Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251105153622.758836-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit e41c1f42919b01649ddea25b95eaa72dce2d591a Author: Mateusz Guzik Date: Sun Nov 9 13:52:54 2025 +0100 fs: touch predicts in do_dentry_open() Helps out some of the asm, the routine is still a mess. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251109125254.1288882-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 50b2a4f19b224694e2bc71a98a7a67aeebacc95e Author: Baokun Li Date: Mon Nov 10 20:47:14 2025 +0800 bdev: add hint prints in sb_set_blocksize() for LBS dependency on THP Support for block sizes greater than the page size depends on large folios, which in turn require CONFIG_TRANSPARENT_HUGEPAGE to be enabled. Because the code is wrapped in multiple layers of abstraction, this dependency is rather obscure, so users may not realize it and may be unsure how to enable LBS. As suggested by Theodore, I have added hint messages in sb_set_blocksize so that users can distinguish whether a mount failure with block size larger than page size is due to lack of filesystem support or the absence of CONFIG_TRANSPARENT_HUGEPAGE. Suggested-by: Theodore Ts'o Link: https://patch.msgid.link/20251110043226.GD2988753@mit.edu Signed-off-by: Baokun Li Link: https://patch.msgid.link/20251110124714.1329978-1-libaokun@huaweicloud.com Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 04f0955b603cb49eeb752fc8cceca9e9b2f99e14 Merge: 854e8df2ce6b02 a0a28c4e41251a Author: Christian Brauner Date: Tue Nov 11 10:38:44 2025 +0100 Merge patch series "cheaper MAY_EXEC handling for path lookup" Mateusz Guzik says: In short, MAY_WRITE checks are elided. This obsoletes the idea of pre-computing if perm checks are necessary as that turned out to be too hairy. The new code has 2 more branches per path component compared to that idea, but the perf difference for typical paths (< 6 components) was basically within noise. To be revisited if someone(tm) removes other slowdowns. Instead of the pre-computing thing I added IOP_FASTPERM_MAY_EXEC so that filesystems like btrfs can still avoid the hard work. * patches from https://patch.msgid.link/20251107142149.989998-1-mjguzik@gmail.com: fs: retire now stale MAY_WRITE predicts in inode_permission() btrfs: utilize IOP_FASTPERM_MAY_EXEC fs: speed up path lookup with cheaper handling of MAY_EXEC Link: https://patch.msgid.link/20251107142149.989998-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit a0a28c4e41251a85b4b6db987a72ffbc8613e497 Author: Mateusz Guzik Date: Fri Nov 7 15:21:49 2025 +0100 fs: retire now stale MAY_WRITE predicts in inode_permission() The primary non-MAY_WRITE consumer now uses lookup_inode_permission_may_exec(). Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251107142149.989998-4-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 3e18f6256ecc1a1fce1fd8a7707c5daa162bd6b6 Author: Mateusz Guzik Date: Fri Nov 7 15:21:48 2025 +0100 btrfs: utilize IOP_FASTPERM_MAY_EXEC Root filesystem was ext4, btrfs was mounted on /testfs. Then issuing access(2) in a loop on /testfs/repos/linux/include/linux/fs.h on Sapphire Rapids (ops/s): before: 3447976 after: 3620879 (+5%) Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251107142149.989998-3-mjguzik@gmail.com Acked-by: David Sterba Signed-off-by: Christian Brauner commit e631df89cd5d638a9d7c152dd9b0a92643efab3e Author: Mateusz Guzik Date: Fri Nov 7 15:21:47 2025 +0100 fs: speed up path lookup with cheaper handling of MAY_EXEC The generic inode_permission() routine does work which is known to be of no significance for lookup. There are checks for MAY_WRITE, while the requested permission is MAY_EXEC. Additionally devcgroup_inode_permission() is called to check for devices, but it is an invariant the inode is a directory. Absent a ->permission func, execution lands in generic_permission() which checks upfront if the requested permission is granted for everyone. We can elide the branches which are guaranteed to be false and cut straight to the check if everyone happens to be allowed MAY_EXEC on the inode (which holds true most of the time). Moreover, filesystems which provide their own ->permission routine can take advantage of the optimization by setting the IOP_FASTPERM_MAY_EXEC flag on their inodes, which they can legitimately do if their MAY_EXEC handling matches generic_permission(). As a simple benchmark, as part of compilation gcc issues access(2) on numerous long paths, for example /usr/lib/gcc/x86_64-linux-gnu/12/crtendS.o Issuing access(2) on it in a loop on ext4 on Sapphire Rapids (ops/s): before: 3797556 after: 3987789 (+5%) Note: this depends on the not-yet-landed ext4 patch to mark inodes with cache_no_acl() Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251107142149.989998-2-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 854e8df2ce6b02c8be40d6f26bd8aa700b375bb2 Author: Rasmus Villemoes Date: Thu Oct 23 10:21:42 2025 +0200 fs/pipe: stop duplicating union pipe_index declaration Now that we build with -fms-extensions, union pipe_index can be included as an anonymous member in struct pipe_inode_info, avoiding the duplication. Signed-off-by: Rasmus Villemoes Link: https://patch.msgid.link/20251023082142.2104456-1-linux@rasmusvillemoes.dk Signed-off-by: Nathan Chancellor Signed-off-by: Christian Brauner commit 9929dffce5ed7e2988e0274f4db98035508b16d9 Author: Ingo Molnar Date: Wed Nov 12 10:40:26 2025 +0100 perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use The following commit introduced a build failure on x86-32: 21954c8a0ff ("perf/x86/intel: Process arch-PEBS records or record fragments") ... arch/x86/events/intel/ds.c:2983:24: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] The forced type conversion to 'u64' and 'void *' are not 32-bit clean, but they are also entirely unnecessary: ->pebs_vaddr is 'void *' already, and integer-compatible pointer arithmetics will work just fine on it. Fix & simplify the code. Reported-by: Stephen Rothwell Fixes: d21954c8a0ff ("perf/x86/intel: Process arch-PEBS records or record fragments") Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra (Intel) Acked-by: Dapeng Mi Cc: Kan Liang Link: https://patch.msgid.link/20251029102136.61364-10-dapeng1.mi@linux.intel.com commit 5a97a38c22799a802f33001dcb022d2942fe4a41 Author: Troy Mitchell Date: Wed Nov 5 11:37:44 2025 +0800 riscv: dts: spacemit: define all missing I2C controller nodes SpacemiT K1 SoC is equipped with a total of nine I2C controllers, ranging from I2C0 to I2C8. Prior to this change, only I2C2 and I2C8 were explicitly defined within the device tree. This patch comprehensively adds the device tree node definitions for I2C controller 0, 1, 4 to 7. The I2C3 node is not added because it belongs exclusively to the secure domain which not used in the linux realm. All newly added I2C nodes are set to "disabled" status by default, allowing future board-specific device tree to enable and configure. Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20251105-k1-add-i2c-node-v1-2-d18dae246137@linux.spacemit.com Signed-off-by: Yixun Lan commit b4909ae8d4e95a5046bcba099a3afdef8024b1b2 Author: Luis Henriques Date: Tue Sep 16 14:53:10 2025 +0100 fuse: refactor fuse_conn_put() to remove negative logic. There is no functional change with this patch. It simply refactors function fuse_conn_put() to not use negative logic, which makes it more easier to read. Signed-off-by: Luis Henriques Signed-off-by: Miklos Szeredi commit 64becd224ff99dbdcffab22709dfcf170e52aff1 Author: Luis Henriques Date: Tue Sep 16 14:53:09 2025 +0100 fuse: new work queue to invalidate dentries from old epochs With the infrastructure introduced to periodically invalidate expired dentries, it is now possible to add an extra work queue to invalidate dentries when an epoch is incremented. This work queue will only be triggered when the 'inval_wq' parameter is set. Signed-off-by: Luis Henriques Signed-off-by: Miklos Szeredi commit ab84ad5973869a660ca3ad0c54a2b84d975d47c4 Author: Luis Henriques Date: Tue Sep 16 14:53:08 2025 +0100 fuse: new work queue to periodically invalidate expired dentries This patch adds the necessary infrastructure to keep track of all dentries created for FUSE file systems. A set of rbtrees, protected by hashed locks, will be used to keep all these dentries sorted by expiry time. A new module parameter 'inval_wq' is also added. When set, it will start a work queue which will periodically invalidate expired dentries. The value of this new parameter is the period, in seconds, for this work queue. Once this parameter is set, every new dentry will be added to one of the rbtrees. When the work queue is executed, it will check all the rbtrees and will invalidate those dentries that have timed-out. The work queue period can not be smaller than 5 seconds, but can be disabled by setting 'inval_wq' to zero (which is the default). Signed-off-by: Luis Henriques Signed-off-by: Miklos Szeredi commit 395b95530343e7f4bdd2870190d985a222997fb6 Author: Luis Henriques Date: Tue Sep 16 14:53:07 2025 +0100 dcache: export shrink_dentry_list() and add new helper d_dispose_if_unused() Add and export a new helper d_dispose_if_unused() which is simply a wrapper around to_shrink_list(), to add an entry to a dispose list if it's not used anymore. Also export shrink_dentry_list() to kill all dentries in a dispose list. Suggested-by: Miklos Szeredi Signed-off-by: Luis Henriques Signed-off-by: Miklos Szeredi commit 66c6a77e00a2f28330cca90c67339111cd54e54b Author: Miklos Szeredi Date: Mon Nov 3 14:10:38 2025 +0100 fuse: add WARN_ON and comment for RCU revalidate Signed-off-by: Miklos Szeredi commit 2a36511609cc7c4817c0998d4651f8c188a6db18 Author: Bernd Schubert Date: Tue Oct 21 22:46:43 2025 +0200 fuse: Fix whitespace for fuse_uring_args_to_ring() comment The function comment accidentally got wrong indentation. Signed-off-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 6e0d7f7f4a43ac8868e98c87ecf48805aa8c24dd Author: Cheng Ding Date: Tue Oct 21 22:46:42 2025 +0200 fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup] Fixes: c090c8abae4b ("fuse: Add io-uring sqe commit and fetch support") Cc: stable@vger.kernel.org # v6.14 Signed-off-by: Cheng Ding Signed-off-by: Bernd Schubert Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 3b70f972b6fb769bdee780b5b4639585845d6af4 Author: Troy Mitchell Date: Wed Nov 5 11:37:43 2025 +0800 riscv: dts: spacemit: reorder i2c2 node Reorder the i2c2 node to its correct position according to its register address.This improves the readability and maintainability of the device tree file by adhering to the established ordering convention. No functional change is introduced by this reordering. Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20251105-k1-add-i2c-node-v1-1-d18dae246137@linux.spacemit.com Signed-off-by: Yixun Lan commit 372a12bd5df0199aa234eaf8ef31ed7ecd61d40f Author: Andy Shevchenko Date: Mon Nov 10 14:21:18 2025 +0100 lib/vsprintf: Check pointer before dereferencing in time_and_date() The pointer may be invalid when gets to the printf(). In particular the time_and_date() dereferencing it in some cases without checking. Move the check from rtc_str() to time_and_date() to cover all cases. Fixes: 7daac5b2fdf8 ("lib/vsprintf: Print time64_t in human readable format") Signed-off-by: Andy Shevchenko Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20251110132118.4113976-1-andriy.shevchenko@linux.intel.com Signed-off-by: Petr Mladek commit 8c95f813d75b33564b6c9f9c22a6914cabf6ad0d Author: Herve Codina (Schneider Electric) Date: Mon Nov 3 15:18:33 2025 +0100 ARM: dts: renesas: r9a06g032: Add the ADC device The ADC available in the r9a06g032 SoC can use up to two internal ADC cores (ADC1 and ADC2) those internal cores are handled through ADC controller virtual channels. Describe this device. Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251103141834.71677-4-herve.codina@bootlin.com Signed-off-by: Geert Uytterhoeven commit 63e572b11464a233f45ad469ba64b8b9e68a9cd1 Author: Michael Opdenacker Date: Wed Nov 12 04:44:42 2025 +0000 riscv: dts: spacemit: Add OrangePi R2S board device tree Add initial device tree support for the OrangePi RV2 board [1], which is marketed as using the Ky X1 SoC but is identical in die and package to the SpacemiT K1 SoC [2]. Enable UART0, to boot into a serial console Two Gigabit Ethernet ports with RGMII interface standard support are enabled, each port is connected to an external Motorcomm YT8531C PHY chip which uses the GPIO for reset control. Enable PDMA. Enable 8 GB eMMC chip for storage. Link: http://www.orangepi.org/html/hardWare/computerAndMicrocontrollers/details/Orange-Pi-R2S.html [1] Link: https://www.spacemit.com/en/key-stone-k1 [2] Signed-off-by: Michael Opdenacker Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20251112044426.2351999-3-michael.opdenacker@rootcommit.com Signed-off-by: Yixun Lan commit 323256d11e01d5ee2a0a2e7b682890498b90b212 Author: Michael Opdenacker Date: Wed Nov 12 04:44:40 2025 +0000 dt-bindings: riscv: spacemit: Add OrangePi R2S board Document the compatible string for the OrangePi R2S board [1], which is marketed as using the Ky X1 SoC but is in fact identical in die and package to the SpacemiT K1 SoC [2]. Link: http://www.orangepi.org/html/hardWare/computerAndMicrocontrollers/details/Orange-Pi-R2S.html [1] Link: https://www.spacemit.com/en/key-stone-k1 [2] Signed-off-by: Michael Opdenacker Acked-by: Krzysztof Kozlowski Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20251112044426.2351999-2-michael.opdenacker@rootcommit.com Signed-off-by: Yixun Lan commit c4698a34993b38d4d344cf3710c38b98b4fbcea9 Author: Lad Prabhakar Date: Tue Oct 28 17:54:57 2025 +0000 arm64: dts: renesas: r9a09g087: Add GMAC nodes Add Ethernet MAC (GMAC) device nodes to the RZ/N2H (R9A09G087) SoC DTSI. The RZ/N2H integrates three GMAC interfaces based on the Synopsys DesignWare MAC (version 5.20). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028175458.1037397-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 394c1e24a4cf835773a83c3813961d03cfa9ae08 Author: Lad Prabhakar Date: Tue Oct 28 17:54:56 2025 +0000 arm64: dts: renesas: r9a09g077: Add GMAC nodes Add Ethernet MAC (GMAC) device nodes to the RZ/T2H (R9A09G077) SoC DTSI. The RZ/T2H integrates three GMAC interfaces based on the Synopsys DesignWare MAC (version 5.20). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028175458.1037397-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5d06389a0587647bb44d65db01328b2fa85257da Author: Lad Prabhakar Date: Tue Oct 28 17:54:55 2025 +0000 arm64: dts: renesas: r9a09g087: Add ETHSS node Add an Ethernet Switch Subsystem (ETHSS) device node to the RZ/N2H (R9A09G087) SoC. The ETHSS IP block is responsible for handling MII pass-through or conversion to RMII/RGMII. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028175458.1037397-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit fea7a8b7d7b538974f097a1771f63de9b0ee2259 Author: Lad Prabhakar Date: Tue Oct 28 17:54:54 2025 +0000 arm64: dts: renesas: r9a09g077: Add ETHSS node Add an Ethernet Switch Subsystem (ETHSS) device node to the RZ/T2H (R9A09G077) SoC. The ETHSS IP block is responsible for handling MII pass-through or conversion to RMII/RGMII. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028175458.1037397-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit bf3b8e915215ef78319b896c0ccc14dc57dac80f Author: Hans Holmberg Date: Fri Oct 31 09:29:48 2025 +0100 xfs: remove xarray mark for reclaimable zones We can easily check if there are any reclaimble zones by just looking at the used counters in the reclaim buckets, so do that to free up the xarray mark we currently use for this purpose. Signed-off-by: Hans Holmberg Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 6731f85d38aa476275183ccdd73527cd6d7f3297 Author: Christoph Hellwig Date: Mon Oct 27 08:05:56 2025 +0100 xfs: remove the xlog_in_core_t typedef Switch the few remaining users to use the underlying struct directly. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit bc2dd9f2ba004cb4cce671dbe62f5193f58e4abc Author: Christoph Hellwig Date: Mon Oct 27 08:05:55 2025 +0100 xfs: remove l_iclog_heads l_iclog_heads is only used in one place and can be trivially derived from l_iclog_hsize by a single shift operation. Remove it, and switch the initialization of l_iclog_hsize to use struct_size so that it is directly derived from the on-disk format definition. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit ef1e275638fe6f6d54c18a770c138e4d5972b280 Author: Christoph Hellwig Date: Mon Oct 27 08:05:54 2025 +0100 xfs: remove the xlog_rec_header_t typedef There are almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit fe985b910e03fd91193f399a1aca9d1ea22c2557 Author: Christoph Hellwig Date: Mon Oct 27 08:05:53 2025 +0100 xfs: remove xlog_in_core_2_t xlog_in_core_2_t is a really odd type, not only is it grossly misnamed because it actually is an on-disk structure, but it also reprents the actual on-disk structure in a rather odd way. A v1 or small v2 log header look like: +-----------------------+ | xlog_record | +-----------------------+ while larger v2 log headers look like: +-----------------------+ | xlog_record | +-----------------------+ | xlog_rec_ext_header | +-------------------+---+ | ..... | +-----------------------+ | xlog_rec_ext_header | +-----------------------+ I.e., the ext headers are a variable sized array at the end of the header. So instead of declaring a union of xlog_rec_header, xlog_rec_ext_header and padding to BBSIZE, add the proper padding to struct struct xlog_rec_header and struct xlog_rec_ext_header, and add a variable sized array of the latter to the former. This also exposes the somewhat unusual scope of the log checksums, which is made explicitly now by adding proper padding and macro designating the actual payload length. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 9ed9df98fcd7203c0eeac21e6784bb7cc7a291d3 Author: Christoph Hellwig Date: Mon Oct 27 08:05:52 2025 +0100 xfs: remove a very outdated comment from xlog_alloc_log The xlog_iclog definition has been pretty standard for a while, so drop this now rather misleading comment. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 16c18021e1f518e6ddd4ddf2b57aaca7a47a7124 Author: Christoph Hellwig Date: Mon Oct 27 08:05:51 2025 +0100 xfs: cleanup xlog_alloc_log a bit Remove the separate head variable, move the ic_datap initialization up a bit where the context is more obvious and remove the duplicate memset right after a zeroing memory allocation. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit be665a4e27417227cf40cfe27e616838bb46548c Author: Christoph Hellwig Date: Mon Oct 27 08:05:50 2025 +0100 xfs: don't use xlog_in_core_2_t in struct xlog_in_core Most accessed to the on-disk log record header are for the original xlog_rec_header. Make that the main structure, and case for the single remaining place using other union legs. This prepares for removing xlog_in_core_2_t entirely. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 899b7ee44baebcfb2b2366b2aff6e9aca4486c4d Author: Christoph Hellwig Date: Mon Oct 27 08:05:49 2025 +0100 xfs: add a on-disk log header cycle array accessor Accessing the cycle arrays in the original log record header vs the extended header is messy and duplicated in multiple places. Add a xlog_cycle_data helper to abstract it out. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 74d975ed6c9f8ba44179502a8ad5a839b38e8630 Author: Christoph Hellwig Date: Mon Oct 27 08:05:48 2025 +0100 xfs: add a XLOG_CYCLE_DATA_SIZE constant The XLOG_HEADER_CYCLE_SIZE / BBSIZE expression is used a lot in the log code, give it a symbolic name. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit f8def051bbcf8677f64701e9699bf6d11e2780cd Author: Haotian Zhang Date: Thu Oct 30 14:16:03 2025 +0800 clk: renesas: r9a06g032: Fix memory leak in error path The current code uses of_iomap() to map registers but never calls iounmap() on any error path after the mapping. This causes a memory leak when probe fails after successful ioremap, for example when of_clk_add_provider() or r9a06g032_add_clk_domain() fails. Replace of_iomap() with devm_of_iomap() to automatically unmap the region on probe failure. Update the error check accordingly to use IS_ERR() and PTR_ERR() since devm_of_iomap() returns ERR_PTR on error. Fixes: 4c3d88526eba ("clk: renesas: Renesas R9A06G032 clock driver") Signed-off-by: Haotian Zhang Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251030061603.1954-1-vulab@iscas.ac.cn Signed-off-by: Geert Uytterhoeven commit 7a9d0318da5d1d148021d9c9762cefecb552c54f Author: Lad Prabhakar Date: Tue Oct 28 16:51:25 2025 +0000 clk: renesas: r9a09g077: Use devm_ helpers for divider clock registration Convert the divider clock registration in the R9A09G077 CPG driver to use device-managed (devm_) helper functions. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028165127.991351-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3b32a07584a8fc940129cfd384e180bdd758b8ed Author: Lad Prabhakar Date: Tue Oct 28 16:51:24 2025 +0000 clk: renesas: r9a09g077: Remove stray blank line Remove an unnecessary blank line at the end of r9a09g077_cpg_div_clk_register() to tidy up the code. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028165127.991351-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 145dfd70b9c70e5bc03494a7ce8fa3748ac01af3 Author: Lad Prabhakar Date: Tue Oct 28 16:51:23 2025 +0000 clk: renesas: r9a09g077: Propagate rate changes to parent clocks Add the CLK_SET_RATE_PARENT flag to divider clock registration so that rate changes can propagate to parent clocks when needed. This allows the CPG divider clocks to request rate adjustments from their parent, ensuring correct frequency scaling and improved flexibility in clock rate selection. Fixes: 065fe720eec6e ("clk: renesas: Add support for R9A09G077 SoC") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251028165127.991351-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a40efd0741f228023a87bf65b1cebe683e92172b Author: Niklas Söderlund Date: Thu Nov 6 22:16:04 2025 +0100 clk: renesas: r8a779a0: Add 3DGE module clock Describe the 3DGE module clock needed to operate the PowerVR GPU. Signed-off-by: Niklas Söderlund Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106211604.2766465-5-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 86db652fc22f5674ffe3b1f7c91c397c69d26d94 Author: Jayesh Choudhary Date: Tue Nov 4 20:44:22 2025 +0530 drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook After integrating OLDI support[0], it is necessary to identify which VP instances use OLDI, since the OLDI driver owns the video port clock (as a serial clock). Clock operations on these VPs must be delegated to the OLDI driver, not handled by the TIDSS driver. This issue also emerged in upstream discussions when DSI-related clock management was attempted in the TIDSS driver[1]. To address this, add an 'is_ext_vp_clk' array to the 'tidss_device' structure, marking a VP as 'true' during 'tidss_oldi_init()' and as 'false' during 'tidss_oldi_deinit()'. TIDSS then uses 'is_ext_vp_clk' to skip clock validation checks in 'dispc_vp_mode_valid()' for VPs under OLDI control. Since OLDI uses the DSS VP clock directly as a serial interface and manages its own rate, mode validation should be implemented in the OLDI bridge's 'mode_valid' hook. This patch adds that logic, ensuring proper delegation and avoiding spurious clock handling in the TIDSS driver. [0]: https://lore.kernel.org/all/20250528122544.817829-1-aradhya.bhatia@linux.dev/ [1]: https://lore.kernel.org/all/DA6TT575Z82D.3MPK8HG5GRL8U@kernel.org/ Fixes: 7246e0929945 ("drm/tidss: Add OLDI bridge support") Tested-by: Michael Walle Reviewed-by: Devarsh Thakkar Reviewed-by: Tomi Valkeinen Signed-off-by: Jayesh Choudhary Signed-off-by: Swamil Jain Link: https://patch.msgid.link/20251104151422.307162-3-s-jain1@ti.com Signed-off-by: Tomi Valkeinen Link: https://patch.msgid.link/ffd5ebe03391b3c01e616c0c844a4b8ddecede36.1762513240.git.jani.nikula@intel.com commit 527e132573dfa793818a536b18eec49598a6f6f5 Author: Jayesh Choudhary Date: Tue Nov 4 20:44:21 2025 +0530 drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features The TIDSS hardware does not have independent maximum or minimum pixel clock limits for each video port. Instead, these limits are determined by the SoC's clock architecture. Previously, this constraint was modeled using the 'max_pclk_khz' and 'min_pclk_khz' fields in 'dispc_features', but this approach is static and does not account for the dynamic behavior of PLLs. This patch removes the 'max_pclk_khz' and 'min_pclk_khz' fields from 'dispc_features'. The correct way to check if a requested mode's pixel clock is supported is by using 'clk_round_rate()' in the 'mode_valid()' hook. If the best frequency match for the mode clock falls within the supported tolerance, it is approved. TIDSS supports a 5% pixel clock tolerance, which is now reflected in the validation logic. This change allows existing DSS-compatible drivers to be reused across SoCs that only differ in their pixel clock characteristics. The validation uses 'clk_round_rate()' for each mode, which may introduce additional delay (about 3.5 ms for 30 modes), but this is generally negligible. Users desiring faster validation may bypass these calls selectively, for example, checking only the highest resolution mode, as shown here[1]. [1]: https://lore.kernel.org/all/20250704094851.182131-3-j-choudhary@ti.com/ Tested-by: Michael Walle Reviewed-by: Devarsh Thakkar Reviewed-by: Tomi Valkeinen Signed-off-by: Jayesh Choudhary Signed-off-by: Swamil Jain Link: https://patch.msgid.link/20251104151422.307162-2-s-jain1@ti.com [Tomi: dropped 'inline' from check_pixel_clock] Signed-off-by: Tomi Valkeinen commit 4debb5e8952e43c06c183a2efe2dd7820c55f196 Author: Jiaqi Yan Date: Mon Oct 13 18:59:03 2025 +0000 Documentation: kvm: new UAPI for handling SEA Document the new userspace-visible features and APIs for handling synchronous external abort (SEA) - KVM_CAP_ARM_SEA_TO_USER: How userspace enables the new feature. - KVM_EXIT_ARM_SEA: exit userspace gets when it needs to handle SEA and what userspace gets while taking the SEA. Signed-off-by: Jiaqi Yan Link: https://msgid.link/20251013185903.1372553-4-jiaqiyan@google.com [ oliver: make documentation concise, remove implementation detail ] Signed-off-by: Oliver Upton commit a298febc47e0ce116b9fc8151337ba8b2137e42d Author: Joanne Koong Date: Tue Nov 11 11:36:55 2025 -0800 iomap: simplify when reads can be skipped for writes Currently, the logic for skipping the read range for a write is if (!(iter->flags & IOMAP_UNSHARE) && (from <= poff || from >= poff + plen) && (to <= poff || to >= poff + plen)) which breaks down to skipping the read if any of these are true: a) from <= poff && to <= poff b) from <= poff && to >= poff + plen c) from >= poff + plen && to <= poff d) from >= poff + plen && to >= poff + plen This can be simplified to if (!(iter->flags & IOMAP_UNSHARE) && from <= poff && to >= poff + plen) from the following reasoning: a) from <= poff && to <= poff This reduces to 'to <= poff' since it is guaranteed that 'from <= to' (since to = from + len). It is not possible for 'from <= to' to be true here because we only reach here if plen > 0 (thanks to the preceding 'if (plen == 0)' check that would break us out of the loop). If 'to <= poff', plen would have to be 0 since poff and plen get adjusted in lockstep for uptodate blocks. This means we can eliminate this check. c) from >= poff + plen && to <= poff This is not possible since 'from <= to' and 'plen > 0'. We can eliminate this check. d) from >= poff + plen && to >= poff + plen This reduces to 'from >= poff + plen' since 'from <= to'. It is not possible for 'from >= poff + plen' to be true here. We only reach here if plen > 0 and for writes, poff and plen will always be block-aligned, which means poff <= from < poff + plen. We can eliminate this check. The only valid check is b) from <= poff && to >= poff + plen. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-7-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit f8eaf79406fe9415db0e7a5c175b50cb01265199 Author: Joanne Koong Date: Tue Nov 11 11:36:54 2025 -0800 iomap: simplify ->read_folio_range() error handling for reads Instead of requiring that the caller calls iomap_finish_folio_read() even if the ->read_folio_range() callback returns an error, account for this internally in iomap instead, which makes the interface simpler and makes it match writeback's ->read_folio_range() error handling expectations. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-6-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 6b1fd2281fb0873ec56f8791d4e4898302070804 Author: Joanne Koong Date: Tue Nov 11 11:36:53 2025 -0800 iomap: optimize pending async writeback accounting Pending writebacks must be accounted for to determine when all requests have completed and writeback on the folio should be ended. Currently this is done by atomically incrementing ifs->write_bytes_pending for every range to be written back. Instead, the number of atomic operations can be minimized by setting ifs->write_bytes_pending to the folio size, internally tracking how many bytes are written back asynchronously, and then after sending off all the requests, decrementing ifs->write_bytes_pending by the number of bytes not written back asynchronously. Now, for N ranges written back, only N + 2 atomic operations are required instead of 2N + 2. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-5-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 7e6cea5ae2f5e62112fce69acc07ee8b694b6dd0 Author: Joanne Koong Date: Tue Nov 11 11:36:52 2025 -0800 docs: document iomap writeback's iomap_finish_folio_write() requirement Document that iomap_finish_folio_write() must be called after writeback on the range completes. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-4-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 9d875e0eef8ec15b6b1da0cb9a0f8ed13efee89e Author: Joanne Koong Date: Tue Nov 11 11:36:51 2025 -0800 iomap: account for unaligned end offsets when truncating read range The end position to start truncating from may be at an offset into a block, which under the current logic would result in overtruncation. Adjust the calculation to account for unaligned end offsets. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-3-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit a0f1cabe294c914ef58a414dce0de5c46a767bb5 Author: Joanne Koong Date: Tue Nov 11 11:36:50 2025 -0800 iomap: rename bytes_pending/bytes_accounted to bytes_submitted/bytes_not_submitted The naming "bytes_pending" and "bytes_accounted" may be confusing and could be better named. Rename this to "bytes_submitted" and "bytes_not_submitted" to make it more clear that these are bytes we passed to the IO helper to read in. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20251111193658.3495942-2-joannelkoong@gmail.com Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 4e5cba5bb6f37ceaba6a2628a171cbede02f969c Author: Randy Dunlap Date: Tue Nov 11 22:29:08 2025 -0800 RDMA/cm: Correct typedef and bad line warnings In include/rdma/ib_cm.h: Correct a typedef's kernel-doc notation by adding the 'typedef' keyword to it to avoid a warning. Add a leading " *" to a kernel-doc line to avoid a warning. Warning: ib_cm.h:289 function parameter 'ib_cm_handler' not described in 'int' Warning: ib_cm.h:289 expecting prototype for ib_cm_handler(). Prototype was for int() instead Warning: ib_cm.h:484 bad line: connection message in case duplicates are received. Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251112062908.2711007-1-rdunlap@infradead.org Signed-off-by: Leon Romanovsky commit c0241d7180d3dedde4dcd48a8b02a1ef1565ab4f Author: Yue Haibing Date: Wed Nov 12 17:20:07 2025 +0800 ALSA: gus: Remove unused declarations snd_gf1_synth_init() and snd_gf1_synth_done() were declared but never implenmented and used since the beginning of kernel git history. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20251112092007.3546539-1-yuehaibing@huawei.com Signed-off-by: Takashi Iwai commit feee9ef7ac1648835c3b1e35ba4833cf7c8b3669 Author: Jiaqi Yan Date: Mon Oct 13 18:59:02 2025 +0000 KVM: selftests: Test for KVM_EXIT_ARM_SEA Test how KVM handles guest SEA when APEI is unable to claim it, and KVM_CAP_ARM_SEA_TO_USER is enabled. The behavior is triggered by consuming recoverable memory error (UER) injected via EINJ. The test asserts two major things: 1. KVM returns to userspace with KVM_EXIT_ARM_SEA exit reason, and has provided expected fault information, e.g. esr, flags, gva, gpa. 2. Userspace is able to handle KVM_EXIT_ARM_SEA by injecting SEA to guest and KVM injects expected SEA into the VCPU. Tested on a data center server running Siryn AmpereOne processor that has RAS support. Several things to notice before attempting to run this selftest: - The test relies on EINJ support in both firmware and kernel to inject UER. Otherwise the test will be skipped. - The under-test platform's APEI should be unable to claim the SEA. Otherwise the test will be skipped. - Some platform doesn't support notrigger in EINJ, which may cause APEI and GHES to offline the memory before guest can consume injected UER, and making test unable to trigger SEA. Signed-off-by: Jiaqi Yan Link: https://msgid.link/20251013185903.1372553-3-jiaqiyan@google.com Signed-off-by: Oliver Upton commit ad9c62bd8946621ed02ac94131a921222508a8bc Author: Jiaqi Yan Date: Mon Oct 13 18:59:01 2025 +0000 KVM: arm64: VM exit to userspace to handle SEA When APEI fails to handle a stage-2 synchronous external abort (SEA), today KVM injects an asynchronous SError to the VCPU then resumes it, which usually results in unpleasant guest kernel panic. One major situation of guest SEA is when vCPU consumes recoverable uncorrected memory error (UER). Although SError and guest kernel panic effectively stops the propagation of corrupted memory, guest may re-use the corrupted memory if auto-rebooted; in worse case, guest boot may run into poisoned memory. So there is room to recover from an UER in a more graceful manner. Alternatively KVM can redirect the synchronous SEA event to VMM to - Reduce blast radius if possible. VMM can inject a SEA to VCPU via KVM's existing KVM_SET_VCPU_EVENTS API. If the memory poison consumption or fault is not from guest kernel, blast radius can be limited to the triggering thread in guest userspace, so VM can keep running. - Allow VMM to protect from future memory poison consumption by unmapping the page from stage-2, or to interrupt guest of the poisoned page so guest kernel can unmap it from stage-1 page table. - Allow VMM to track SEA events that VM customers care about, to restart VM when certain number of distinct poison events have happened, to provide observability to customers in log management UI. Introduce an userspace-visible feature to enable VMM handle SEA: - KVM_CAP_ARM_SEA_TO_USER. As the alternative fallback behavior when host APEI fails to claim a SEA, userspace can opt in this new capability to let KVM exit to userspace during SEA if it is not owned by host. - KVM_EXIT_ARM_SEA. A new exit reason is introduced for this. KVM fills kvm_run.arm_sea with as much as possible information about the SEA, enabling VMM to emulate SEA to guest by itself. - Sanitized ESR_EL2. The general rule is to keep only the bits useful for userspace and relevant to guest memory. - Flags indicating if faulting guest physical address is valid. - Faulting guest physical and virtual addresses if valid. Signed-off-by: Jiaqi Yan Co-developed-by: Oliver Upton Signed-off-by: Oliver Upton Link: https://msgid.link/20251013185903.1372553-2-jiaqiyan@google.com Signed-off-by: Oliver Upton commit 54c33a4fcf155bade9e270527670432f56e309ec Author: Jernej Skrabec Date: Tue Nov 4 19:09:42 2025 +0100 drm/sun4i: Nuke mixer pointer from layer code It's not used anymore, so remove it. This allows trully independent layer state from mixer. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-31-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 345bca734c577e27fd609077d41dbda1576f2dbf Author: Jernej Skrabec Date: Tue Nov 4 19:09:41 2025 +0100 drm/sun4i: vi_scaler: Find mixer from crtc With "floating" planes in DE33, mixer can't be stored in layer structure anymore. Find mixer using currently bound crtc. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-30-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit bb1d2ddee5c45017e6b6e50c9eda02cb2bd600b6 Author: Jernej Skrabec Date: Tue Nov 4 19:09:40 2025 +0100 drm/sun4i: layer: replace mixer with layer struct This allows to almost completely decouple layer code from mixer. This is important for DE33. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-29-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit d1fe2639425c121f811f73fd948dea2477ad9a19 Author: Jernej Skrabec Date: Tue Nov 4 19:09:39 2025 +0100 drm/sun4i: mixer: split out layer config Later special plane only driver for DE33 will provide separate configuration. This change will also help layer driver migrate away from mixer structure. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-28-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 5a96ae801f0ac39f85491d81b4f02e1a613107cd Author: Jernej Skrabec Date: Tue Nov 4 19:09:38 2025 +0100 drm/sun4i: mixer: Add quirk for number of VI scalers On DE2 and DE3, UI scalers are located right after VI scalers. So in order to calculate proper UI scaler base address, number of VI scalers must be known. In practice, it is same as number of VI channels, but it doesn't need to be. Let's make a quirk for this number. Code for configuring channels and associated functions won't have access to vi_num quirk anymore after rework for independent planes. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-27-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit a23e3402f65d1784e30b0b6654f5146905457a45 Author: Jernej Skrabec Date: Tue Nov 4 19:09:37 2025 +0100 drm/sun4i: ui_scaler: drop sanity checks They can't be triggered if mixer configuration is properly specified in quirks. Additionally, number of VI channels won't be available in future due to rework for DE33 support. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-26-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 7907cf11406bd1e1a311765a09634f73454bbe3f Author: Jernej Skrabec Date: Tue Nov 4 19:09:36 2025 +0100 drm/sun4i: mixer: Convert heuristics to quirk Determination if FCC unit can be used for VI layer alpha depends on number of VI channels. This info won't be available anymore in future to VI layer driver because of DE33 way of allocating planes from same pool to different mixers. While order is slightly changed, it doesn't affect anything due to double buffering of registers. New order keeps related registers together and quirk separate. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-25-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit c0cbdda9abd957c2392fb7b77bb3af16fb7f760a Author: Jernej Skrabec Date: Tue Nov 4 19:09:35 2025 +0100 drm/sun4i: vi_scaler: Update DE33 base calculation Now that channel base calculation is straightforward, let's update VI scaler base calculation to be simpler. At the same time, also introduce macro to avoid magic numbers. Note, reason why current magic value and new macro value isn't the same is because sun8i_channel_base() already introduces offset to channel registers. Previous value is just the difference to VI scaler registers. However, new code calculates scaler base from channel base. This is also easier to understand when looking into BSP driver. Macro value can be easily found whereas old diff value was not. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-24-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 515441734c2bde512405aff29b89c3d35d8ba7d4 Author: Jernej Skrabec Date: Tue Nov 4 19:09:34 2025 +0100 drm/sun4i: layers: add physical index arg This avoids plane mapping in layers code, which allows future refactoring, when layer code will move away from accessing mixer structure. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-23-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 0bc7d54dcc0b3f5ed47e0decce4acfea9611476e Author: Jernej Skrabec Date: Tue Nov 4 19:09:33 2025 +0100 drm/sun4i: csc: use layer arg instead of mixer Layer will be more universal, due to DE33 support. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-22-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 37aba59f5fd4389bac39fcff40baafa672a238c8 Author: Jernej Skrabec Date: Tue Nov 4 19:09:32 2025 +0100 drm/sun4i: layers: Make regmap for layers configurable Till DE33, there were no reason to decouple registers from mixer. However, with future new plane driver, this will be necessary. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-21-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit f54c353cffa4997f67103cb9b045594755f204b0 Author: Jernej Skrabec Date: Tue Nov 4 19:09:31 2025 +0100 drm/sun4i: vi_scaler: use layer instead of mixer for args Layer related peripherals should take layer struct as a input. This looks cleaner and also necessary for proper DE33 support later. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-20-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 1ebec02bba7a594ca641673a85c0eb942836b02c Author: Jernej Skrabec Date: Tue Nov 4 19:09:30 2025 +0100 drm/sun4i: ui_scaler: use layer instead of mixer for args Layer related peripherals should take layer struct as a input. This looks cleaner and also necessary for proper DE33 support later. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-19-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit f10a80105efaccd6dc5a19039958ef3061a0fba3 Author: Jernej Skrabec Date: Tue Nov 4 19:09:29 2025 +0100 drm/sun4i: vi_layer: use layer struct instead of multiple args This change is equally a cleanup (less arguments) and preparation for DE33 separate plane driver. It will introduce additional register space. No functional changes. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-18-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 7d126c6e80e4a488aa4c1839d14b4ccea560f47b Author: Jernej Skrabec Date: Tue Nov 4 19:09:28 2025 +0100 drm/sun4i: ui_layer: use layer struct instead of multiple args This change is equally a cleanup (less arguments) and preparation for DE33 separate plane driver. It will introduce additional register space. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-17-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 4fa45b04a47d6cb91add07797a683e51f88bff68 Author: Jernej Skrabec Date: Tue Nov 4 19:09:27 2025 +0100 drm/sun4i: layer: move num of planes calc out of layer code With DE33, number of planes no longer depends on mixer because layers are shared between all mixers. Get this value via parameter, so DE specific code can fill in proper value. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-16-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 32ca21b97f2f1e0f0e9a22de0642530b70339fdd Author: Jernej Skrabec Date: Tue Nov 4 19:09:26 2025 +0100 drm/sun4i: ui_layer: Change index meaning In the pursuit of making UI/VI layer code independent of DE version, change meaning of UI index to index of the plane within mixer. DE33 can split amount of VI and UI planes between multiple mixer in whatever way it deems acceptable, so simple calculation VI num + UI index won't be meaningful anymore. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-15-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit feea4205efb2455b7bfaae87abec34d90ce539bc Author: Jernej Skrabec Date: Tue Nov 4 19:09:25 2025 +0100 drm/sun4i: de2/de3: Move plane type determination to mixer Plane type determination logic inside layer init functions doesn't allow index register to be repurposed to plane sequence, which it almost is. So move out the logic to mixer, which allows further rework for DE33 support. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-14-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit a7febbd455ff0a68a874024b4674430493e1bea0 Author: Jernej Skrabec Date: Tue Nov 4 19:09:24 2025 +0100 drm/sun4i: csc: Simplify arguments with taking plane state Taking plane state directly reduces number of arguments, avoids copying values and allows making additional decisions. For example, when plane is disabled, CSC should be turned off. This is also cleanup for later patches which will move call to another place. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-13-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 870e3cf48c56c99d4f1d1a8401b8579464c78131 Author: Jernej Skrabec Date: Tue Nov 4 19:09:23 2025 +0100 drm/sun4i: de2/de3: Simplify CSC config interface Merging both function into one lets this one decide on it's own if CSC should be enabled or not. Currently heuristics for that is pretty simple - enable it for YUV formats and disable for RGB. DE3 and newer allows YUV pipeline, which will be easier to implement these way. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-12-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit fc9b4e3b78d9f03e84154f3331722c470266bc1f Author: Jernej Skrabec Date: Tue Nov 4 19:09:22 2025 +0100 drm/sun4i: mixer: Move layer enabling to atomic_update Enable or disable layer only in layer atomic update callback. Doing so will enable having separate layer driver later for DE33. There is no fear that enable bit would be set incorrectly, as all read-modify-write sequences for that register are now eliminated. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-11-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 6d166e222fe94a7329f1b164904e272081fff913 Author: Jernej Skrabec Date: Tue Nov 4 19:09:21 2025 +0100 drm/sun4i: vi layer: Write attributes in one go It turns out that none of the VI channel registers were meant to be read. Mostly it works fine but sometimes it returns incorrect values. Rework VI layer code to write all registers in one go to avoid reads. This rework will also allow proper code separation. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-10-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 1251b20a41cb0ad0b0c1080554b62d36ddb5eee4 Author: Jernej Skrabec Date: Tue Nov 4 19:09:20 2025 +0100 drm/sun4i: ui layer: Write attributes in one go It turns out that none of the UI channel registers were meant to be read. Mostly it works fine but sometimes it returns incorrect values. Rework UI layer code to write all registers in one go to avoid reads. This rework will also allow proper code separation. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-9-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 06e644c7586c265956489581282ee40743d8c7b7 Author: Jernej Skrabec Date: Tue Nov 4 19:09:19 2025 +0100 drm/sun4i: Move blender config from layers to mixer With upcoming DE33 support, layer management must be decoupled from other operations like blender configuration. There are two reasons: - DE33 will have separate driver for planes and thus it will be harder to manage different register spaces - Architecturaly it's better to split access by modules. Blender is now exclusively managed by mixer. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-8-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 1fbf862685fa6e7c0673d7aa0939ed71adcabbce Author: Jernej Skrabec Date: Tue Nov 4 19:09:18 2025 +0100 drm/sun4i: layers: Make atomic commit functions void Functions called by atomic_commit callback should not fail. None of them actually returns error, so make them void. No functional change. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-7-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit b12c28bb15d374b89908c1cecc9251a631149c37 Author: Jernej Skrabec Date: Tue Nov 4 19:09:17 2025 +0100 drm/sun4i: vi_layer: Move check from update to check callback DRM requires that all check are done in atomic_check callback. Move one check from atomic_commit to atomic_check callback. Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20251104180942.61538-6-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit f841ea7e3f7ea6409ea34235dd4b4390e368b620 Author: Jernej Skrabec Date: Tue Nov 4 19:09:16 2025 +0100 drm/sun4i: ui_layer: Move check from update to check callback DRM requires that all checks are done in atomic_check callback. Move one check from atomic_commit to atomic_check callback. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-5-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 558716d5586ae9e02847d8426ae8048701e5e913 Author: Jernej Skrabec Date: Tue Nov 4 19:09:15 2025 +0100 drm/sun4i: de2: Initialize layer fields earlier drm_universal_plane_init() can already call some callbacks, like format_mod_supported, during initialization. Because of that, fields should be initialized beforehand. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-4-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit f863fff123570a908fd03c8638ad9f29495fc847 Author: Jernej Skrabec Date: Tue Nov 4 19:09:14 2025 +0100 drm/sun4i: mixer: Remove ccsc cfg for >= DE3 Those engine versions don't need ccsc argument, since CSC units are located on different position and for each layer. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-3-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 4520911eeee0f07241758379d6202156fe4fe65c Author: Jernej Skrabec Date: Tue Nov 4 19:09:13 2025 +0100 drm/sun4i: mixer: Fix up DE33 channel macros Properly define macros. Till now raw numbers and inappropriate macro was used. Reviewed-by: Chen-Yu Tsai Tested-by: Ryan Walklin Signed-off-by: Jernej Skrabec Link: https://patch.msgid.link/20251104180942.61538-2-jernej.skrabec@gmail.com Signed-off-by: Chen-Yu Tsai commit 0eb272033b64ef05fffa30288284659c33e17830 Merge: 5e88e864118c20 2977567b244f05 Author: Johannes Berg Date: Wed Nov 12 09:56:03 2025 +0100 Merge tag 'ath-next-20251111' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.19 (#2) Just one 2-patch series for this PR. Once pulled into wireless-next, ath-next will fast-forward, and that will provide the baseline for merging ath12k-ng into ath-next. ================== Link: https://patch.msgid.link/15a98cae-0274-45f4-9b8e-be6fa9720884@oss.qualcomm.com Signed-off-by: Johannes Berg commit 736c5619508ce8d080e829a88377f123e560d1d3 Merge: a338d6e849ab31 5422318e27d7a4 Author: Leon Romanovsky Date: Wed Nov 12 03:52:18 2025 -0500 Expose definition for 1600Gbps link mode Single patch to expose new link mode for 1600Gbps, utilizing 8 lanes at 200Gbps per lane. Signed-off-by: Leon Romanovsky * mlx5-next: net/mlx5: Expose definition for 1600Gbps link mode commit 4fa617cc6851488759f79dc8f66822ae332d98f0 Author: Ard Biesheuvel Date: Wed Oct 1 13:59:42 2025 +0200 arm64/fpsimd: Allocate kernel mode FP/SIMD buffers on the stack Commit aefbab8e77eb16b5 ("arm64: fpsimd: Preserve/restore kernel mode NEON at context switch") added a 'kernel_fpsimd_state' field to struct thread_struct, which is the arch-specific portion of struct task_struct, and is allocated for each task in the system. The size of this field is 528 bytes, resulting in non-negligible bloat of task_struct, and the resulting memory overhead may impact performance on systems with many processes. This allocation is only used if the task is scheduled out or interrupted by a softirq while using the FP/SIMD unit in kernel mode, and so it is possible to transparently allocate this buffer on the caller's stack instead. So tweak the 'ksimd' scoped guard implementation so that a stack buffer is allocated and passed to both kernel_neon_begin() and kernel_neon_end(), and either record it in the task struct, or use it directly to preserve the task mode kernel FP/SIMD when running in softirq context. Passing the address to both functions, and checking the addresses for consistency ensures that callers of the updated bare begin/end API use it in a manner that is consistent with the new context switch semantics. Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 103728a7162cb5ed22904e31066904375f1fb71e Author: Ard Biesheuvel Date: Wed Oct 8 06:22:05 2025 +0200 arm64/fpu: Enforce task-context only for generic kernel mode FPU The generic kernel mode FPU API, which is used by the AMDGPU driver to perform floating point calculations, is modeled after the most restrictive architecture that supports it. This means it doesn't support preemption, and can only be used from task context. The arm64 implementation is a bit more flexible, but supporting that in the generic API complicates matters slightly, and for no good reason, given that the only user does not need it. So enforce that kernel_fpu_begin() can only be called from task context, and [redundantly] disable preemption. This removes the need for users of this API to provide a kernel mode FP/SIMD state after a future patch that makes that compulsory for preemptible task context. Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 9dc106fa1e7d074305d415e568e4518174695507 Author: Ard Biesheuvel Date: Wed Oct 8 17:22:36 2025 +0200 net/mlx5: Switch to more abstract scoped ksimd guard API on arm64 Instead of calling kernel_neon_begin/end directly, switch to the scoped guard API which encapsulates those calls. This is needed because the prototypes of those APIs are going to be modified and will require a kernel mode FP/SIMD buffer to be provided, which the scoped guard API will do transparently. Cc: Saeed Mahameed Cc: Leon Romanovsky Cc: Tariq Toukan Cc: Mark Bloch Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit ab5718f06b6774b99230c71c1ee5476236496b62 Author: Ard Biesheuvel Date: Wed Oct 1 13:58:26 2025 +0200 arm64/xorblocks: Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 03bc4768fbf1bfe72497204410b58dacf29730d2 Author: Ard Biesheuvel Date: Wed Oct 1 13:50:51 2025 +0200 crypto/arm64: sm4 - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principle, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit ab9615b5013fe8a62933212b37faa28d09fe0cbf Author: Ard Biesheuvel Date: Wed Oct 1 13:47:45 2025 +0200 crypto/arm64: sm3 - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principle, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit a6b40844550c73805fe8490bafc0e33ff5922f6c Author: Ard Biesheuvel Date: Wed Oct 1 13:47:13 2025 +0200 crypto/arm64: sha3 - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 931ceb5785755d82d80bb923c22ca08128af7721 Author: Ard Biesheuvel Date: Wed Oct 1 13:45:49 2025 +0200 crypto/arm64: polyval - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 72cb51233b59429bd9920f396d4a2e8cd1ad1a40 Author: Ard Biesheuvel Date: Wed Oct 1 13:44:23 2025 +0200 crypto/arm64: nhpoly1305 - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 87c9b04e715d13a7c110b17a66ad279da821cd0e Author: Ard Biesheuvel Date: Wed Oct 1 13:43:59 2025 +0200 crypto/arm64: aes-gcm - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit ba3c1b3b5ac9d3efd15fca09f03c5397d3b50f3b Author: Ard Biesheuvel Date: Wed Oct 1 13:43:33 2025 +0200 crypto/arm64: aes-blk - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit b044c7e4c709fddf150127e8aac051f139424eea Author: Ard Biesheuvel Date: Wed Oct 1 13:43:01 2025 +0200 crypto/arm64: aes-ccm - Switch to 'ksimd' scoped guard API Switch to the more abstract 'scoped_ksimd()' API, which will be modified in a future patch to transparently allocate a kernel mode FP/SIMD state buffer on the stack, so that kernel mode FP/SIMD code remains preemptible in principe, but without the memory overhead that adds 528 bytes to the size of struct task_struct. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 3142ec4af2a308f08693d355a786871e84a64ed9 Author: Ard Biesheuvel Date: Wed Oct 1 12:23:40 2025 +0200 raid6: Move to more abstract 'ksimd' guard API Move away from calling kernel_neon_begin() and kernel_neon_end() directly, and instead, use the newly introduced scoped_ksimd() API. This permits arm64 to modify the kernel mode NEON API without affecting code that is shared between ARM and arm64. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 88a7999e80edd13bccdb47522924f45735aa595c Author: Ard Biesheuvel Date: Wed Oct 1 12:21:53 2025 +0200 crypto: aegis128-neon - Move to more abstract 'ksimd' guard API Move away from calling kernel_neon_begin() and kernel_neon_end() directly, and instead, use the newly introduced scoped_ksimd() API. This permits arm64 to modify the kernel mode NEON API without affecting code that is shared between ARM and arm64. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit c13aebfeeed4dc991a80ec1110e1cbac5d902908 Author: Ard Biesheuvel Date: Wed Sep 17 23:33:30 2025 +0200 crypto/arm64: sm4-ce-gcm - Avoid pointless yield of the NEON unit Kernel mode NEON sections are now preemptible on arm64, and so there is no need to yield it when calling APIs that may sleep. Also, move the calls to kernel_neon_end() to the same scope as kernel_neon_begin(). This is needed for a subsequent change where a stack buffer is allocated transparently and passed to kernel_neon_begin(). While at it, simplify the logic. Reviewed-by: Eric Biggers Acked-by: Herbert Xu Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 9520ef37713308e2741a5e80c4843d43bbf906eb Author: Ard Biesheuvel Date: Wed Sep 17 23:30:18 2025 +0200 crypto/arm64: sm4-ce-ccm - Avoid pointless yield of the NEON unit Kernel mode NEON sections are now preemptible on arm64, and so there is no need to yield it when calling APIs that may sleep. Also, move the calls to kernel_neon_end() to the same scope as kernel_neon_begin(). This is needed for a subsequent change where a stack buffer is allocated transparently and passed to kernel_neon_begin(). Reviewed-by: Eric Biggers Acked-by: Herbert Xu Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit e9426f3e6bd408aaf6f484b2b43eddd63c6b3f8c Author: Ard Biesheuvel Date: Wed Sep 17 23:28:22 2025 +0200 crypto/arm64: aes-ce-ccm - Avoid pointless yield of the NEON unit Kernel mode NEON sections are now preemptible on arm64, and so there is no need to yield it explicitly in order to prevent scheduling latency spikes. Reviewed-by: Eric Biggers Acked-by: Herbert Xu Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 4fb623074ea537524d06598acbb5517f027f3b53 Author: Ard Biesheuvel Date: Wed Oct 1 13:27:08 2025 +0200 lib/crc: Switch ARM and arm64 to 'ksimd' scoped guard API Before modifying the prototypes of kernel_neon_begin() and kernel_neon_end() to accommodate kernel mode FP/SIMD state buffers allocated on the stack, move arm64 to the new 'ksimd' scoped guard API, which encapsulates the calls to those functions. For symmetry, do the same for 32-bit ARM too. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit f53d18a4e67eacf665e9d60727d508387f84327b Author: Ard Biesheuvel Date: Wed Oct 1 13:29:23 2025 +0200 lib/crypto: Switch ARM and arm64 to 'ksimd' scoped guard API Before modifying the prototypes of kernel_neon_begin() and kernel_neon_end() to accommodate kernel mode FP/SIMD state buffers allocated on the stack, move arm64 to the new 'ksimd' scoped guard API, which encapsulates the calls to those functions. For symmetry, do the same for 32-bit ARM too. Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 76c63ff12e067e1ff77b19a83c24774899ed01fc Merge: 3a8660878839fa 1602bad16d7df8 Author: Christian Brauner Date: Wed Nov 12 09:38:46 2025 +0100 Merge patch series "vfs: recall-only directory delegations for knfsd" Jeff Layton says: At the fall NFS Bakeathon last week, the NFS client and server maintainers had a discussion about how to merge support for directory delegations. We decided to start with just merging support for simple, recallable-only directory delegation support, for a number of reasons: 1/ RFC8881 has some gaps in coverage that we are hoping to have addressed in RFC8881bis. In particular, it's written such that CB_NOTIFY callbacks require directory position information. That will be hard to do properly under Linux, so we're planning to extend the spec to allow that information to be omitted. 2/ client-side support for CB_NOTIFY still lags a bit. The client side is tricky, as it involves heuristics about when to request a delegation. 3/ we have some early indication that simple, recallable-only delegations can help performance in some cases. Anna mentioned seeing a multi-minute speedup in xfstests runs with them enabled. This needs more investigation, but it's promising and seems like enough justification to merge support. This patchset is quite similar to the set I initially posted back in early 2024. We've merged some GET_DIR_DELEGATION handling patches since then, but the VFS layer support is basically the same. One thing that I want to make clear is that with this patchset, userspace can request a read lease on a directory that will be recalled on conflicting accesses. I saw no reason to prevent this, and I think it may be something useful for applications like Samba. As always, users can disable leases altogether via the fs.leases-enable sysctl if this is an issue, but I wanted to point this out in case anyone sees footguns here. * patches from https://patch.msgid.link/20251111-dir-deleg-ro-v6-0-52f3feebb2f2@kernel.org: vfs: expose delegation support to userland nfsd: wire up GET_DIR_DELEGATION handling nfsd: allow DELEGRETURN on directories nfsd: allow filecache to hold S_IFDIR files filelock: lift the ban on directory leases in generic_setlease vfs: make vfs_symlink break delegations on parent dir vfs: make vfs_mknod break delegations on parent directory vfs: make vfs_create break delegations on parent directory vfs: clean up argument list for vfs_create() vfs: break parent dir delegations in open(..., O_CREAT) codepath vfs: allow rmdir to wait for delegation break on parent vfs: allow mkdir to wait for delegation break on parent vfs: add try_break_deleg calls for parents to vfs_{link,rename,unlink} filelock: push the S_ISREG check down to ->setlease handlers filelock: add struct delegated_inode filelock: rework the __break_lease API to use flags filelock: make lease_alloc() take a flags argument Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-0-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 1602bad16d7df82faca6d7c70821117684a66f49 Author: Jeff Layton Date: Tue Nov 11 09:12:58 2025 -0500 vfs: expose delegation support to userland Now that support for recallable directory delegations is available, expose this functionality to userland with new F_SETDELEG and F_GETDELEG commands for fcntl(). Note that this also allows userland to request a FL_DELEG type lease on files too. Userland applications that do will get signalled when there are metadata changes in addition to just data changes (which is a limitation of FL_LEASE leases). These commands accept a new "struct delegation" argument that contains a flags field for future expansion. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-17-52f3feebb2f2@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 8b99f6a8c116f664a6788737705f6da2772cc96a Author: Jeff Layton Date: Tue Nov 11 09:12:57 2025 -0500 nfsd: wire up GET_DIR_DELEGATION handling Add a new routine for acquiring a read delegation on a directory. These are recallable-only delegations with no support for CB_NOTIFY. That will be added in a later phase. Since the same CB_RECALL/DELEGRETURN infrastructure is used for regular and directory delegations, a normal nfs4_delegation is used to represent a directory delegation. Reviewed-by: NeilBrown Reviewed-by: Chuck Lever Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-16-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 80c8afddc8b17bf9b6cfe3af0d0b41b42f308961 Author: Jeff Layton Date: Tue Nov 11 09:12:56 2025 -0500 nfsd: allow DELEGRETURN on directories As Trond pointed out: "...provided that the presented stateid is actually valid, it is also sufficient to uniquely identify the file to which it is associated (see RFC8881 Section 8.2.4), so the filehandle should be considered mostly irrelevant for operations like DELEGRETURN." Don't ask fh_verify to filter on file type. Reviewed-by: Chuck Lever Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-15-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 544a0ee152f0591dc689927007306fb9f09a175f Author: Jeff Layton Date: Tue Nov 11 09:12:55 2025 -0500 nfsd: allow filecache to hold S_IFDIR files The filecache infrastructure will only handle S_IFREG files at the moment. Directory delegations will require adding support for opening S_IFDIR inodes. Plumb a "type" argument into nfsd_file_do_acquire() and have all of the existing callers set it to S_IFREG. Add a new nfsd_file_acquire_dir() wrapper that nfsd can call to request a nfsd_file that holds a directory open. For now, there is no need for a fsnotify_mark for directories, as CB_NOTIFY is not yet supported. Change nfsd_file_do_acquire() to avoid allocating one for non-S_IFREG inodes. Reviewed-by: Chuck Lever Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-14-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit d0eab9fc104730982a9ef5eff5989b7c871cd104 Author: Jeff Layton Date: Tue Nov 11 09:12:54 2025 -0500 filelock: lift the ban on directory leases in generic_setlease With the addition of the try_break_lease calls in directory changing operations, allow generic_setlease to hand them out. Write leases on directories are never allowed however, so continue to reject them. For now, there is no API for requesting delegations from userland, so ensure that userland is prevented from acquiring a lease on a directory. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-13-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 92bf53577f01aad988f7f39f69163b41f94cfb7d Author: Jeff Layton Date: Tue Nov 11 09:12:53 2025 -0500 vfs: make vfs_symlink break delegations on parent dir In order to add directory delegation support, we must break delegations on the parent on any change to the directory. Add a delegated_inode parameter to vfs_symlink() and have it break the delegation. do_symlinkat() can then wait on the delegation break before proceeding. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-12-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit e8960c1b2ee9ba75d65492b8e90e851d11e5f215 Author: Jeff Layton Date: Tue Nov 11 09:12:52 2025 -0500 vfs: make vfs_mknod break delegations on parent directory In order to add directory delegation support, we need to break delegations on the parent whenever there is going to be a change in the directory. Add a new delegated_inode pointer to vfs_mknod() and have the appropriate callers wait when there is an outstanding delegation. All other callers just set the pointer to NULL. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-11-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit c826229c6a82fe1fe7b7752692f87a881eb4b545 Author: Jeff Layton Date: Tue Nov 11 09:12:51 2025 -0500 vfs: make vfs_create break delegations on parent directory In order to add directory delegation support, we need to break delegations on the parent whenever there is going to be a change in the directory. Add a delegated_inode parameter to vfs_create. Most callers are converted to pass in NULL, but do_mknodat() is changed to wait for a delegation break if there is one. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-10-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 85bbffcad7307e2ca6136be657cc21b0e1c42241 Author: Jeff Layton Date: Tue Nov 11 09:12:50 2025 -0500 vfs: clean up argument list for vfs_create() As Neil points out: "I would be in favour of dropping the "dir" arg because it is always d_inode(dentry->d_parent) which is stable." ...and... "Also *every* caller of vfs_create() passes ".excl = true". So maybe we don't need that arg at all." Drop both arguments from vfs_create() and fix up the callers. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-9-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 134796f43a5e6542546841ebecc7465e6f6a96d2 Author: Jeff Layton Date: Tue Nov 11 09:12:49 2025 -0500 vfs: break parent dir delegations in open(..., O_CREAT) codepath In order to add directory delegation support, we need to break delegations on the parent whenever there is going to be a change in the directory. Add a delegated_inode parameter to lookup_open and have it break the delegation. Then, open_last_lookups can wait for the delegation break and retry the call to lookup_open once it's done. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-8-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 4fa76319cd0cc97ca54ff71c94814dc5b1983ad2 Author: Jeff Layton Date: Tue Nov 11 09:12:48 2025 -0500 vfs: allow rmdir to wait for delegation break on parent In order to add directory delegation support, we need to break delegations on the parent whenever there is going to be a change in the directory. Add a delegated_inode struct to vfs_rmdir() and populate that pointer with the parent inode if it's non-NULL. Most existing in-kernel callers pass in a NULL pointer. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-7-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit e12d203b8c880061c0bf0339cad51e5851a33442 Author: Jeff Layton Date: Tue Nov 11 09:12:47 2025 -0500 vfs: allow mkdir to wait for delegation break on parent In order to add directory delegation support, we need to break delegations on the parent whenever there is going to be a change in the directory. Add a new delegated_inode parameter to vfs_mkdir. All of the existing callers set that to NULL for now, except for do_mkdirat which will properly block until the lease is gone. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-6-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit b46ebf9a768d39cd69012e15f99b057b52850dbd Author: Jeff Layton Date: Tue Nov 11 09:12:46 2025 -0500 vfs: add try_break_deleg calls for parents to vfs_{link,rename,unlink} In order to add directory delegation support, we need to break delegations on the parent whenever there is going to be a change in the directory. vfs_link, vfs_unlink, and vfs_rename all have existing delegation break handling for the children in the rename. Add the necessary calls for breaking delegations in the parent(s) as well. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-5-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit e6d28ebc17eb5e011b80c42a5196af0570c12240 Author: Jeff Layton Date: Tue Nov 11 09:12:45 2025 -0500 filelock: push the S_ISREG check down to ->setlease handlers When nfsd starts requesting directory delegations, setlease handlers may see requests for leases on directories. Push the !S_ISREG check down into the non-trivial setlease handlers, so we can selectively enable them where they're supported. FUSE is special: It's the only filesystem that supports atomic_open and allows kernel-internal leases. atomic_open is issued when the VFS doesn't know the state of the dentry being opened. If the file doesn't exist, it may be created, in which case the dir lease should be broken. The existing kernel-internal lease implementation has no provision for this. Ensure that we don't allow directory leases by default going forward by explicitly disabling them there. Reviewed-by: NeilBrown Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-4-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 6976ed2dd0d59086d16d853ac9b21776be68aaad Author: Jeff Layton Date: Tue Nov 11 09:12:44 2025 -0500 filelock: add struct delegated_inode The current API requires a pointer to an inode pointer. It's easy for callers to get this wrong. Add a new delegated_inode structure and use that to pass back any inode that needs to be waited on. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-3-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 4be9f3cc582a24b08f6580f65fa48a4d70332ab5 Author: Jeff Layton Date: Tue Nov 11 09:12:43 2025 -0500 filelock: rework the __break_lease API to use flags Currently __break_lease takes both a type and an openmode. With the addition of directory leases, that makes less sense. Declare a set of LEASE_BREAK_* flags that can be used to control how lease breaks work instead of requiring a type and an openmode. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-2-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit 6fc5f2b19e75b3f34d83cb65de6726ef7dd9ca89 Author: Jeff Layton Date: Tue Nov 11 09:12:42 2025 -0500 filelock: make lease_alloc() take a flags argument __break_lease() currently overrides the flc_flags field in the lease after allocating it. A forthcoming patch will add the ability to request a FL_DELEG type lease. Instead of overriding the flags field, add a flags argument to lease_alloc() and lease_init() so it's set correctly after allocating. Reviewed-by: Jan Kara Reviewed-by: NeilBrown Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20251111-dir-deleg-ro-v6-1-52f3feebb2f2@kernel.org Signed-off-by: Christian Brauner commit f5982a679a16a673a0fc374c1d9d77111cd86740 Author: Gregor Herburger Date: Wed Oct 1 14:40:02 2025 +0530 can: mcp251xfd: utilize gather_write function for all non-CRC writes This is a preparation patch to add errata workaround for non crc writes. Currently for non-crc writes to the chip can go through the .gather_write, .write or the reg_update_bits callback. To allow the addition of the errata fix at a single location use mcp251xfd_regmap_nocrc_gather_write for all non-CRC write instructions, similar to the crc regmap. Signed-off-by: Gregor Herburger Tested-by: Viken Dadhaniya Signed-off-by: Viken Dadhaniya Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251001091006.4003841-3-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit 71df9227ba9c5d18372c30904a93d360151874b2 Author: Marc Kleine-Budde Date: Wed Oct 1 14:40:01 2025 +0530 can: mcp251xfd: move chip sleep mode into runtime pm This is a preparation patch to add GPIO support. Up to now, the Vdd regulator and the clocks have been managed by Runtime-PM (on systems without CONFIG_PM these remain permanently switched on). During the mcp251xfd_open() callback the mcp251xfd is powered, soft-reset and configured. In mcp251xfd_stop() the chip is shut down again. To support the on-chip GPIOs, the chip must be supplied with power while GPIOs are being requested, even if the networking interface is down. To support this, move the functions mcp251xfd_chip_softreset() and mcp251xfd_chip_clock_init() from mcp251xfd_chip_start() to mcp251xfd_runtime_resume(). Instead of setting the controller to sleep mode in mcp251xfd_chip_stop(), bring it into configuration mode. This way it doesn't take part in bus activity and doesn't enter sleep mode. Signed-off-by: Gregor Herburger Tested-by: Viken Dadhaniya Signed-off-by: Viken Dadhaniya Reviewed-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251001091006.4003841-2-viken.dadhaniya@oss.qualcomm.com Signed-off-by: Marc Kleine-Budde commit 5422318e27d7a4662701f518e2e51b9f73a331b1 Author: Tariq Toukan Date: Tue Nov 11 14:24:48 2025 +0200 net/mlx5: Expose definition for 1600Gbps link mode This patch exposes new link mode for 1600Gbps, utilizing 8 lanes at 200Gbps per lane. Co-developed-by: Yael Chemla Reviewed-by: Shahar Shitrit Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1762863888-1092798-1-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit ccb7725df5bb3f1ad9606aa12d13688bad4deeab Author: Karol Wachowski Date: Wed Nov 12 08:19:11 2025 +0100 accel/ivpu: Fix warning due to undefined CONFIG_PROC_FS Change #if to #ifdef CONFIG_PROC_FS to fix warning reported by test robot: drivers/accel/ivpu/ivpu_drv.c:458:5: warning: "CONFIG_PROC_FS" is not defined, evaluates to 0 [-Wundef] Fixes: 63cc028484ab ("accel/ivpu: Add fdinfo support for memory statistics") Reviewed-by: Maciej Falkowski Reviewed-by: Andrzej.Kacprowski@linux.intel.com Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20251112071911.1136934-1-karol.wachowski@linux.intel.com commit 814f5415d3e3084eeb0550acdee5eca8b4966055 Author: Ard Biesheuvel Date: Wed Oct 1 12:20:32 2025 +0200 ARM/simd: Add scoped guard API for kernel mode SIMD Implement the ksimd scoped guard API so that it can be used by code that supports both ARM and arm64. Reviewed-by: Kees Cook Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit c5b91a17cc72e37fd830bca008369db12e7b9d2d Author: Ard Biesheuvel Date: Wed Oct 1 12:16:44 2025 +0200 arm64/simd: Add scoped guard API for kernel mode SIMD Encapsulate kernel_neon_begin() and kernel_neon_end() using a 'ksimd' cleanup guard. This hides the prototype of those functions, allowing them to be changed for arm64 but not ARM, without breaking code that is shared between those architectures (RAID6, AEGIS-128) It probably makes sense to expose this API more widely across architectures, as it affords more flexibility to the arch code to plumb it in, while imposing more rigid rules regarding the start/end bookends appearing in matched pairs. Reviewed-by: Kees Cook Reviewed-by: Mark Brown Reviewed-by: Eric Biggers Reviewed-by: Jonathan Cameron Acked-by: Catalin Marinas Signed-off-by: Ard Biesheuvel commit 939ba8c5b81cbaf37781d7aa4849170860124a5e Author: Bagas Sanjaya Date: Mon Nov 3 08:50:30 2025 +0700 MAINTAINERS: Add entry for XFRM documentation XFRM patches are supposed to be sent to maintainers under "NETWORKING [IPSEC]" heading, but it doesn't cover XFRM docs yet. Add the entry. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit 03e23b18c720bdb628ccfbbb3faf4486c0413354 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:29 2025 +0700 net: Move XFRM documentation into its own subdirectory XFRM docs are currently reside in Documentation/networking directory, yet these are distinctive as a group of their own. Move them into xfrm subdirectory. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit 7276e7ae569b1ce2ac2e3341107703216a290398 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:28 2025 +0700 Documentation: xfrm_sync: Number the fifth section Number the fifth section ("Exception to threshold settings") to be consistent with the rest of sections. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Suggested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit c08b786b8295fbbd1e8ac99320126fd5dd8b965c Author: Bagas Sanjaya Date: Mon Nov 3 08:50:27 2025 +0700 Documentation: xfrm_sysctl: Trim trailing colon in section heading The sole section heading ("/proc/sys/net/core/xfrm_* Variables") has trailing colon. Trim it. Suggested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Steffen Klassert commit 01ad7831fbb28b3903fa3eb4e029f5a5d6690924 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:26 2025 +0700 Documentation: xfrm_sync: Trim excess section heading characters The first section "Message Structure" has excess underline, while the second and third one ("TLVS reflect the different parameters" and "Default configurations for the parameters") have trailing colon. Trim them. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Suggested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit a397b259c17379f74158b86dd7fc4e3a7d53fc57 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:25 2025 +0700 Documentation: xfrm_sync: Properly reindent list text List texts are currently aligned at the start of column, rather than after the list marker. Reindent them. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit 840188d276a34e8883fd4b64a4a39f7b3eec0f28 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:24 2025 +0700 Documentation: xfrm_device: Separate hardware offload sublists Sublists of hardware offload type lists are rendered in combined paragraph due to lack of separator from their parent list. Add it. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit 340e2a73866557ad1f902273d534e9a81efccbd2 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:23 2025 +0700 Documentation: xfrm_device: Use numbered list for offloading steps Format xfrm offloading steps as numbered list. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit 68ec5df1d8946dd805d6ab67666a38331223f3a1 Author: Bagas Sanjaya Date: Mon Nov 3 08:50:22 2025 +0700 Documentation: xfrm_device: Wrap iproute2 snippets in literal code block iproute2 snippets (ip x) are shown in long-running definition lists instead. Format them as literal code blocks that do the semantic job better. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Steffen Klassert commit 5ce6778a31b4b1468211b75aa84166c5f2db4c3c Author: Karol Wachowski Date: Thu Nov 6 11:10:52 2025 +0100 accel/ivpu: Count only resident buffers in memory utilization Do not count buffer objects that have no backing pages, including imported buffers where pages are set by VM faults triggered by userspace or pinned by other drivers. Instead, return information about actual memory used by the NPU. Counting imported buffers results in incorrect calculations when the same pages are counted multiple times, giving overly high results. Fixes: 7bfc9fa99580 ("accel/ivpu: Expose NPU memory utilization info in sysfs") Reviewed-by: Jeff Hugo Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20251106101052.1050348-3-karol.wachowski@linux.intel.com commit 63cc028484abb7c2c61118f492b95083a2913b12 Author: Karol Wachowski Date: Thu Nov 6 11:10:51 2025 +0100 accel/ivpu: Add fdinfo support for memory statistics Implement DRM fdinfo interface to expose memory usage statistics for NPU device file descriptors. Exclude unpinned and imported buffers from resident memory calculations to provide accurate memory usage reporting. Reviewed-by: Jeff Hugo Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20251106101052.1050348-2-karol.wachowski@linux.intel.com commit 885b92bad87aed46a75cfd6f6924a2fda4af2166 Merge: 396f45a34e83cf cc4e46fa76afcb Author: Andy Shevchenko Date: Wed Nov 12 07:29:33 2025 +0100 Merge patch series "pinctrl: intel: Convert the rest to use INTEL_GPP()" Andy Shevchenko says: A few drivers use the more customised versions of INTEL_GPP(). Convert them to use INTEL_GPP() directly. Link: https://patch.msgid.link/20251111191214.1378051-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko commit cc4e46fa76afcb4fc56b801c9577dc60a64a00d6 Author: Andy Shevchenko Date: Tue Nov 11 20:10:29 2025 +0100 pinctrl: elkhartlake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit dd0c7bffe3d1c03b5e191d648f0ccc17bffe37e3 Author: Andy Shevchenko Date: Tue Nov 11 20:10:28 2025 +0100 pinctrl: cherryview: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 6c7a9976998d97f9ec9eb84e490f5a65fa2bd479 Author: Andy Shevchenko Date: Tue Nov 11 20:10:27 2025 +0100 pinctrl: emmitsburg: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit d772897c7cfd8b158c3997b00ddbd9b5671b4fa4 Author: Andy Shevchenko Date: Tue Nov 11 20:10:26 2025 +0100 pinctrl: denverton: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit ce884de219de43deac6c482590d677872bf358ff Author: Andy Shevchenko Date: Tue Nov 11 20:10:25 2025 +0100 pinctrl: cedarfork: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 4ab2ee307983548b29ddaab0ecaef82d526cf4c9 Author: Abel Vesa Date: Tue Nov 11 08:43:51 2025 +0200 kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Currently, when cross-compiling and ccache is used, the expanding of CC turns out to be without any quotes, leading to the following error: make[4]: *** No rule to make target 'aarch64-linux-gnu-gcc'. Stop. make[3]: *** [Makefile:2164: run-command] Error 2 And it makes sense, because after expansion it ends up like this: make run-command KBUILD_RUN_COMMAND=+$(MAKE) \ HOSTCC=ccache aarch64-linux-gnu-gcc VPATH= srcroot=. $(build)= ... So add another set of double quotes to surround whatever CC expands to to make sure the aarch64-linux-gnu-gcc isn't expanded to something that looks like an entirely separate target. Fixes: 140332b6ed72 ("kbuild: fix linux-headers package build when $(CC) cannot link userspace") Signed-off-by: Abel Vesa Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20251111-kbuild-install-extmod-build-fix-cc-expand-third-try-v2-1-15ba1b37e71a@linaro.org Signed-off-by: Nathan Chancellor commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7 Author: Harish Kasiviswanathan Date: Tue Oct 28 14:37:07 2025 -0400 drm/amdkfd: Fix GPU mappings for APU after prefetch Fix the following corner case:- Consider a 2M huge page SVM allocation, followed by prefetch call for the first 4K page. The whole range is initially mapped with single PTE. After the prefetch, this range gets split to first page + rest of the pages. Currently, the first page mapping is not updated on MI300A (APU) since page hasn't migrated. However, after range split PTE mapping it not valid. Fix this by forcing page table update for the whole range when prefetch is called. Calling prefetch on APU doesn't improve performance. If all it deteriotes. However, functionality has to be supported. v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout VRAM v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU v4: Remove v2 and v3 changes. Force update_mapping when range is split at a size that is not aligned to prange granularity Suggested-by: Philip Yang Signed-off-by: Harish Kasiviswanathan Reviewed-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit baefc7cdac82e39fac31818ecc799a6b9b14a312 Author: Timur Kristóf Date: Fri Nov 7 16:57:45 2025 +0100 drm/amdgpu/vce1: Workaround PLL timeout on FirePro W9000 Sometimes the VCE PLL times out waiting for CTLACK/CTLACK2. When it happens, the VCE still works, but much slower. Observed on a Tahiti GPU, but not all: - FirePro W9000 has the issue - Radeon R9 280X not affected - Radeon HD 7990 not affected As a workaround, on the affected chip just don't put the VCE PLL in sleep mode. Leaving the VCE PLL in bypass mode or reset mode both work. Using bypass mode is simpler. Signed-off-by: Timur Kristóf Acked-by: Christian König Signed-off-by: Alex Deucher commit eabc71661f01c74e5da3182b268170626e8bd290 Author: Timur Kristóf Date: Fri Nov 7 16:57:44 2025 +0100 drm/amdgpu/vce1: Enable VCE1 on Tahiti, Pitcairn, Cape Verde GPUs Add the VCE1 IP block to the SI GPUs that have it. Advertise the encoder capabilities corresponding to VCE1, so the userspace applications can detect and use it. Signed-off-by: Timur Kristóf Co-developed-by: Alexandre Demers Signed-off-by: Alexandre Demers Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 53cc70f8f143d62341b7653e829e6d2af04946dd Author: Timur Kristóf Date: Fri Nov 7 16:57:43 2025 +0100 drm/amd/pm/si: Hook up VCE1 to SI DPM On SI GPUs, the SMC needs to be aware of whether or not the VCE1 is used. The VCE1 is enabled/disabled through the DPM code. Also print VCE clocks in amdgpu_pm_info. Users can inspect the current power state using: cat /sys/kernel/debug/dri//amdgpu_pm_info Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 221cadb9c6bc2e179a717aac706dbbc9b3377acc Author: Timur Kristóf Date: Fri Nov 7 16:57:42 2025 +0100 drm/amdgpu/vce1: Ensure VCPU BO is in lower 32-bit address space (v3) Based on research and ideas by Alexandre and Christian. VCE1 actually executes its code from the VCPU BO. Due to various hardware limitations, the VCE1 requires the VCPU BO to be in the low 32 bit address range. However, VRAM is typically mapped at the high address range, which means the VCPU can't access VRAM through the FB aperture. To solve this, we write a few page table entries to map the VCPU BO in the GART address range. And we make sure that the GART is located at the low address range. That way the VCE1 can access the VCPU BO. v2: - Adjust to v2 of the GART helper commit. - Add empty line to multi-line comment. v3: - Instead of relying on gmc_v6 to set the GART space before GTT, add a new function amdgpu_vce_required_gart_pages() which is called from amdgpu_gtt_mgr_init() directly. Signed-off-by: Timur Kristóf Co-developed-by: Alexandre Demers Signed-off-by: Alexandre Demers Reviewed-by: Christian König Signed-off-by: Alex Deucher commit baf75a087c41eeb03c471099dc5d77e3b068c33b Author: Lijo Lazar Date: Thu Nov 6 18:44:29 2025 +0530 drm/amdgpu: Check if AID is active before access Access XGMI registers only if AID is active. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f Author: Timur Kristóf Date: Fri Nov 7 16:57:41 2025 +0100 drm/amdgpu/vce1: Implement VCE1 IP block (v2) Implement the necessary functionality to support the VCE1. This implementation is based on: - VCE2 code from amdgpu - VCE1 code from radeon (the old driver) - Some trial and error A subsequent commit will ensure correct mapping for the VCPU BO, which will make this actually work. v2: - Use memset_io more. - Use memcpy_toio more. - Remove __func__ from warnings. - Don't reserve and map the VCPU BO anymore. - Add empty line to multi-line comments Signed-off-by: Timur Kristóf Co-developed-by: Alexandre Demers Signed-off-by: Alexandre Demers Acked-by: Christian König Signed-off-by: Alex Deucher commit e40251971c4d158a5793c446648c62515fd67713 Author: Timur Kristóf Date: Fri Nov 7 16:57:40 2025 +0100 drm/amdgpu/vce1: Load VCE1 firmware Load VCE1 firmware using amdgpu_ucode_request, just like it is done for other VCE versions. All SI chips share the same VCE1 firmware file: vce_1_0_0.bin which will be sent to linux-firmware soon. Signed-off-by: Timur Kristóf Co-developed-by: Alexandre Demers Signed-off-by: Alexandre Demers Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1b8ed1168a78e21acac5ee8ba6de42e7ccc2360f Author: Timur Kristóf Date: Fri Nov 7 16:57:39 2025 +0100 drm/amdgpu/vce1: Clean up register definitions The sid.h header contained some VCE1 register definitions, but they were using byte offsets (probably copied from the old radeon driver). Move all of these to the proper VCE1 headers and ensure they are in dword offsets. Also add the register definitions that we need for the firmware validation mechanism in VCE1. Signed-off-by: Timur Kristóf Co-developed-by: Alexandre Demers Signed-off-by: Alexandre Demers Acked-by: Christian König Signed-off-by: Alex Deucher commit e583d31f44a78c8d9ed9901dca7645b4857414a4 Author: Timur Kristóf Date: Fri Nov 7 16:57:38 2025 +0100 drm/amdgpu/vce: Clear VCPU BO, don't unmap/unreserve (v4) The VCPU BO doesn't only contain the VCE firmware but also other ranges that the VCE uses for its stack and data. Let's initialize this to zero to avoid having garbage in the VCPU BO. Additionally, don't unmap/unreserve the VCPU BO. The VCPU BO needs to stay at the same location before and after sleep/resume because the FW code is not relocatable once it's started. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f2e18c946532db7357f33339d0ec1531ebf49ae4 Author: Timur Kristóf Date: Fri Nov 7 16:57:37 2025 +0100 drm/amdgpu/vce: Move firmware load to amdgpu_vce_early_init Try to load the VCE firmware at early_init. When the correct firmware is not found, return -ENOENT. This way, the driver initialization will complete even without VCE, and the GPU will be functional, albeit without video encoding capabilities. This is necessary because we are planning to add support for the VCE1, and AMD hasn't yet publised the correct firmware for this version. So we need to anticipate that users will try to boot amdgpu on SI GPUs without the correct VCE1 firmware present on their system. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 43a0ca334e0de9b1eba0dc25f0c901d0e5d02c2c Author: Timur Kristóf Date: Fri Nov 7 16:57:36 2025 +0100 drm/amdgpu/ttm: Use GART helper to map VRAM pages (v2) Use the GART helper function introduced in the previous commit to map the VRAM pages of the transfer window to GART. No functional changes, just code cleanup. Split this into a separate commit to make it easier to bisect, in case there are problems in the future. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 15bd4958fe38e763bc17b607ba55155254a01f55 Author: Jonathan Kim Date: Thu Nov 6 10:17:06 2025 -0500 drm/amdkfd: relax checks for over allocation of save area Over allocation of save area is not fatal, only under allocation is. ROCm has various components that independently claim authority over save area size. Unless KFD decides to claim single authority, relax size checks. Signed-off-by: Jonathan Kim Reviewed-by: Philip Yang Signed-off-by: Alex Deucher commit 2da2e952a785a49c5b3cc624bf00ab6c2d7607a5 Author: Timur Kristóf Date: Sun Nov 9 19:26:40 2025 +0100 drm/amdgpu: Use DC by default on SI dGPUs Now that DC supports analog connectors, it has reached feature parity with the legacy non-DC display driver on SI dGPUs. Use the DC display driver by default on SI dGPUs, unless it is explicitly disabled using the amdgpu.dc=0 module parameter. DC brings proper support for DP/HDMI audio, DP MST, 10-bit colors, some HDR features, atomic modesetting, etc. Also clarify the comment about what is missing to have full DC support for CIK APUs. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit 237d623ae6594df547fbb003953b5d2dd57e6124 Author: Timur Kristóf Date: Fri Nov 7 16:57:35 2025 +0100 drm/amdgpu/gart: Add helper to bind VRAM pages (v2) Binds pages that located in VRAM to the GART page table. Useful when a kernel BO is located in VRAM but needs to be accessed from the GART address space, for example to give a kernel BO a 32-bit address when GART is placed in LOW address space. v2: - Refactor function to be more reusable Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3a4132e6cb4879764d886f11b9fd225197fb48dd Author: Timur Kristóf Date: Fri Nov 7 16:57:34 2025 +0100 drm/amdgpu/gmc6: Place gart at low address range Instead of using a best-fit algorithm to determine which part of the VMID 0 address space to use for GART, always use the low address range. A subsequent commit will use this to map the VCPU BO in GART for the VCE1 IP block. Split this into a separate patch to make it easier to bisect, in case there are any errors in the future. Signed-off-by: Timur Kristóf Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3b832487a9e5b69d1f00ec8f02dc18d0299573ed Author: Jiapeng Chong Date: Thu Nov 6 09:47:47 2025 +0800 drm/amdgpu/userqueue: Remove duplicate amdgpu_reset.h header ./drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c: amdgpu_reset.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=26930 Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 46f2029fe1dbdbb2ff3d6a566b32002660d3944b Author: Jesse.Zhang Date: Fri Nov 7 19:19:08 2025 +0800 drm/amdgpu: resume MES scheduling after user queue hang detection and recovery This patch ensures the Micro-Engine Scheduler (MES) is properly resumed after detecting and recovering from a user queue hang condition. Key changes: 1. Track when a hung user queue is detected using found_hung_queue flag 2. Call amdgpu_mes_resume() to restart MES scheduling after completing the hang recovery process 3. This complements the existing recovery steps (fence force completion and device wedging) by ensuring the scheduler can process new work Without this resume call, the MES scheduler may remain in a paused state even after the hung queue has been handled, preventing newly submitted work from being processed and leading to system stalls. Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 547985579932c1de13f57f8bcf62cd9361b9d3d3 Author: Sathishkumar S Date: Tue Oct 7 13:17:51 2025 +0530 drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1 enable parse_cs callback for JPEG5_0_1. Signed-off-by: Sathishkumar S Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 9dc8d07ce08364b53bab48271beda9c3fc7c085b Author: Asad Kamal Date: Fri Nov 7 00:56:32 2025 +0800 drm/amd/pm: Remove power2_average node SOC power consumption is reported by power1_average. power2_cap_default/min/max only represent second level limits and don't represent a different type of power or power consumption by a subsection of the SOC. Therefore power2_average does not serve any purpose and hence removing power2_average sysfs node Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit af2e61d61b127300f48609bf06e69643aab1c5ef Author: Asad Kamal Date: Mon Oct 20 04:01:10 2025 +0800 drm/amd/pm: Enable ppt1 caps for smu_v13_0_12 Enable ppt1 caps to fetch and configure ppt1 for smu_v13_0_12 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 12c958d1db36bcb87467e6a6273f5a56429a0d02 Author: Asad Kamal Date: Mon Oct 20 03:26:01 2025 +0800 drm/amd/pm: Expose ppt1 limit for gc_v9_5_0 Expose power2_cap hwmon node for retrieving and configuring ppt1 limit on supported boards for gc_v9_5_0 v2: Remove version check (Lijo) v3: Remove power2_average (Lijo) v4: Put back power2_average, will be removed separately (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit d88edb246045d3b488f00d0854764cce829c1824 Author: Asad Kamal Date: Sun Oct 19 23:22:22 2025 +0800 drm/amd/pm: Add ppt1 support for smu_v13_0_12 Add support to configure and retrieve ppt1 limit for smu_v13_0_12 v2: Add update_caps function and update ppt1 cap based on max ppt1 value, optimize the return values (Lijo) v3: Add Null ptr check, return not supported in case of invalid level/type (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit efa6bffae52bc8d32b6ae66cd83151d6a31fcf0b Author: Asad Kamal Date: Sun Oct 19 19:03:51 2025 +0800 drm/amd/pm: Update pmfw headers for smu_v13_0_12 Update pmfw headers for smu_v13_0_12 to include ppt1 messages and static parameters Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit fc936aa76eea2610ca387d420f50be2f5ed8823c Author: Srinivasan Shanmugam Date: Fri Nov 7 19:56:15 2025 +0530 drm/amd/display: Add kdoc params/returns in dc/link detection helpers The link detection helpers in dc/link/link_detection.c were missing kdoc annotations for parameters and return values. Fixes the below with gcc W=1: ...link_detection.c:872 parameter 'edid_header' not described ...link_detection.c:890 parameter 'link' not described ...link_detection.c:914 parameter 'link' not described ...link_detection.c:1355 parameter 'link' not described ...link_detection.c:1355 parameter 'type' not described Cc: Aurabindo Pillai Cc: Roman Li Cc: Harry Wentland Cc: Tom Chung Signed-off-by: Srinivasan Shanmugam Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 20161e3b6bd97c2df24da83a1b68f7b17e1d2927 Author: Srinivasan Shanmugam Date: Fri Nov 7 19:36:18 2025 +0530 drm/amd/display: Fix annotations for connector poll/detect parameters Adds the missing @aconnector, @connector, and @force descriptions: @aconnector – This is the DM (Display Manager) connector. It gives access to the DRM connector, the DC link, and hotplug/poll state. The code uses it to check the link, update the sink, and manage connector state changes. @connector – This is the main DRM connector given by the DRM core. Inside the detect function, it is converted to amdgpu_dm_connector so we can run DC link detection, either light or full. @force – This flag tells the function whether to run a full detect again. If false, we avoid heavy DAC load detect steps to prevent flicker. If true, we force a re-detect even when we normally skip it. Fixes the below with gcc W=1: function param 'aconnector' not described in 'amdgpu_dm_connector_poll' function param 'force' not described in 'amdgpu_dm_connector_poll' function param 'connector' not described in 'amdgpu_dm_connector_detect' function param 'force' not described in 'amdgpu_dm_connector_detect' Cc: Aurabindo Pillai Cc: Roman Li Cc: Harry Wentland Cc: Tom Chung Signed-off-by: Srinivasan Shanmugam Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 73c8c29baac7f0c7e703d92eba009008cbb5228e Author: Sultan Alsawaf Date: Fri Nov 7 13:07:13 2025 -0500 drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO When the BO pointer provided to amdgpu_bo_create_kernel() points to non-NULL, amdgpu_bo_create_kernel() takes it as a hint to pin that address rather than allocate a new BO. This functionality is never desired for allocating ISP buffers. A new BO should always be created when isp_kernel_buffer_alloc() is called, per the description for isp_kernel_buffer_alloc(). Ensure this by zeroing *bo right before the amdgpu_bo_create_kernel() call. Fixes: 55d42f616976 ("drm/amd/amdgpu: Add helper functions for isp buffers") Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Pratap Nirujogi Signed-off-by: Sultan Alsawaf Signed-off-by: Alex Deucher commit 454b0ed8c0db6f107662ce4784caf2659b2f3700 Author: Taimur Hassan Date: Fri Oct 31 20:07:35 2025 -0500 drm/amd/display: Promote DC to 3.2.358 Summary: * Enable VRR when unsynced with the stream * Refactor DSC cap calculation for dcn35 * Add debug log for power feature * Fix fill latency issue * Do not initialize LSDMA if it is not supported by DMU Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Fangzhi Zuo Signed-off-by: Alex Deucher commit c7ade7cbca6ec0afa14dfdb97f0d5806a7446bee Author: Taimur Hassan Date: Fri Oct 31 19:00:47 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.35.0 Summary for changes in firmware: * Use panel_inst instead of otg_inst when getting fw state * Contrast strength improves when HDR desktop mode * Ensure pipes have no outstanding HUBP requests prior to IPS RCG entry * Check for vm request and vm idle status in IPS1/2 entry sequence Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 45c5fb0be343503fc972dc2696b3897786e96cbb Author: Wenjing Liu Date: Tue Nov 4 16:40:53 2025 -0500 drm/amd/display: Refactor HDCP Status Log Format Add missing part for drm/amd/display: fw locality check refactors Reviewed-by: Aurabindo Pillai Signed-off-by: Wenjing Liu Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 401f8f33adc7240baa72fa0fb68ea0552094ede9 Author: Leo Chen Date: Fri Oct 31 15:25:47 2025 -0400 drm/amd/display: dynamically clock gate before and after prefetch [Why] An invalidation request arriving during prefetch can potentially hang the system if dynamic clock gating is enabled and memory power requests are disabled. [How] • Disable clock gating and enable memory power requests for the duration of the prefetch. • Turn on clock gating and disable memory power requests again after prefetch is complete. Limit the scope for DCN35 and DCN42 only. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Leo Chen Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit b6fffcc4530a83598c672641b55d527082c454f8 Author: Dominik Kaszewski Date: Fri Oct 31 09:35:58 2025 +0100 drm/amd/display: Revert in_transfer_func_change to MED [Why] Last commit accidentally changed handling of in_transfer_func_change from MED to FAST. [How] * Revert the line. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Dominik Kaszewski Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f3f48d6ce5089b183fdea025a8a7798a220168f6 Author: Chuntao Tso Date: Fri Oct 31 10:02:51 2025 +0800 drm/amd/display: To support Replay frame skip mode [Why & How] The change is to optimize the Replay power saving by reducing the refresh rate with frame skipping mode Reviewed-by: Robin Chen Signed-off-by: Chuntao Tso Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 45de10d2d9366e261e29a16a9e543adb98550521 Author: Dominik Kaszewski Date: Mon Oct 20 15:16:07 2025 +0200 drm/amd/display: Change lock descriptor values [Why] Review of usage scenarios requires dc_lock_descriptor modification. [How] Replace STATE/LINK/STREAM/PLANE with GLOBAL/STREAM/LINK, where the first means all streams to be locked. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Dominik Kaszewski Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit d7ef56dbfa2836fd83bdd8a1094b7616d715cc7f Author: Mohit Bawa Date: Thu Oct 23 10:40:41 2025 -0400 drm/amd/display: refactor DSC cap calculation for dcn35 why: dcn35 currently uses a hardcoded DSC display clock value which is incorrect for some asic types. Newer DCN versions retrieve dsc display clock from clk_mgr. The same can be done for dcn35. how: Refactor the DSC cap calculation using pre-existing logic. Handle ODM combine requirements in dc_dsc.c. Replace hardcoded display clock with actual value retrieved from clk_mgr. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Charlene Liu Reviewed-by: Wenjing Liu Signed-off-by: Mohit Bawa Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 3953a7ba61bd797e59d0ce27c9c51cfac223884a Author: Ian Chen Date: Tue May 13 16:38:35 2025 +0800 drm/amd/display: Add new SMART POWER OLED interfaces [why && how] To optimize power consumption on certain OLED LED panels by sending MaxCLL per frame to TCON Reviewed-by: Aric Cyr Signed-off-by: Ian Chen Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit f64ec952d2cdf260714279cdf619a6b363faba33 Author: George Shen Date: Mon Oct 6 11:23:31 2025 -0400 drm/amd/display: Add interface to capture power feature status for debug logging [Why] The status of various power features is often important information when debugging certain issues, such as underflow. This info helps to narrow down the potential sources of errors. [How] Add dc interface to capture power feature enablement status. Reviewed-by: Dillon Varone Signed-off-by: George Shen Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 607df8248a011524211ee34850345305a1913f9e Author: Ivan Lipski Date: Thu Oct 23 10:03:59 2025 -0400 drm/amd/display: Allow VRR params change if unsynced with the stream [Why] When changing resolution (e.g., 4K → FHD) in mirror/clone mode with certain monitors, the monitor blanks and loses connection due to an early exit in vrr_settings_require_update(). The function only checks if VRR state, fixed refresh target, or min/max refresh rate range has changed. During mode changes, if the calculated min/max refresh values remain the same even though the stream's v_total changed, the function returns early without updating vrr_params.adjust.v_total_min/max, leaving the monitor's VRR timing parameters unsynced with the new mode, causing it to blank out. [How] Explicitly adjust VRR parameters to the stream's nominal v_total when VRR is supported, but inactive. Fixes: 6d31602a9f57 ("drm/amd/display: more liberal vmin/vmax update for freesync") Reviewed-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 8b9eac5e0faebaffc5411505e0df0d00dc09504c Author: Dillon Varone Date: Mon Oct 27 12:11:15 2025 -0400 drm/amd/display: Fix index bug for fill latency [WHY&HOW] This array should be indexed by pstate type followed by plane index. Reviewed-by: Austin Zheng Signed-off-by: Dillon Varone Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit edcace98fdfe20c485f33cfadabe78fce73cbe36 Author: Alvin Lee Date: Thu Oct 23 15:26:33 2025 -0400 drm/amd/display: Only initialize LSDMA if it is supported in DMU Need to check caps flag to determine whether LSDMA is supported in DMU Reviewed-by: Rafal Ostrowski Signed-off-by: Alvin Lee Signed-off-by: Fangzhi Zuo Tested-by: Dan Wheeler Signed-off-by: Alex Deucher commit 0ea8176ce6a912ff7f4ab9a218ef61552230b472 Author: Gangliang Xie Date: Thu Nov 6 11:06:21 2025 +0800 drm/amd/pm: remove unnecessary prints for smu busy smu busy is a normal case when calling SMU_MSG_GetBadPageCount, so no need to print error status at each time.Instead, only print error status when timeout given by user is reached. Signed-off-by: Gangliang Xie Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 7fb41ab3c94828ad48e1a6d2237e8a7e682c74b9 Author: Tao Zhou Date: Thu Nov 6 16:26:56 2025 +0800 drm/amdgpu: optimize timeout implemention in ras_eeprom_update_record_num The busy status returned by ras_eeprom_update_record_num may not be an error, increase timeout to exclude false busy status. Also add more comments to make the code readable. v2: define a macro for the timeout value. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit eed30152746ec1d8b6e8ab31e349f1eb8d8bd666 Author: Tao Zhou Date: Wed Sep 24 17:52:24 2025 +0800 drm/amdgpu: add RAS bad page threshold handling for PMFW manages eeprom Check if bad page threshold is reached and take actions accordingly. v2: remove rma message sent to smu when pmfw manages eeprom. v3: add null pointer check for con. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit ded3ad780cf97a04927773c4600823b84f7f3cc2 Author: Jesse.Zhang Date: Fri Oct 24 16:09:25 2025 +0800 drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process Fix a potential deadlock caused by inconsistent spinlock usage between interrupt and process contexts in the userq fence driver. The issue occurs when amdgpu_userq_fence_driver_process() is called from both: - Interrupt context: gfx_v11_0_eop_irq() -> amdgpu_userq_fence_driver_process() - Process context: amdgpu_eviction_fence_suspend_worker() -> amdgpu_userq_fence_driver_force_completion() -> amdgpu_userq_fence_driver_process() In interrupt context, the spinlock was acquired without disabling interrupts, leaving it in {IN-HARDIRQ-W} state. When the same lock is acquired in process context, the kernel detects inconsistent locking since the process context acquisition would enable interrupts while holding a lock previously acquired in interrupt context. Kernel log shows: [ 4039.310790] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [ 4039.310804] kworker/7:2/409 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 4039.310818] ffff9284e1bed000 (&fence_drv->fence_list_lock){?...}-{3:3}, [ 4039.310993] {IN-HARDIRQ-W} state was registered at: [ 4039.311004] lock_acquire+0xc6/0x300 [ 4039.311018] _raw_spin_lock+0x39/0x80 [ 4039.311031] amdgpu_userq_fence_driver_process.part.0+0x30/0x180 [amdgpu] [ 4039.311146] amdgpu_userq_fence_driver_process+0x17/0x30 [amdgpu] [ 4039.311257] gfx_v11_0_eop_irq+0x132/0x170 [amdgpu] Fix by using spin_lock_irqsave()/spin_unlock_irqrestore() to properly manage interrupt state regardless of calling context. Reviewed-by: Christian König Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 334b27bf712b5ddd19908aba318175e4b9bcf839 Author: Tao Zhou Date: Wed Aug 27 19:33:02 2025 +0800 drm/amdgpu: try for more times if RAS bad page number is not updated RAS info update in PMFW is time cost, wait for it. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit ec49374ccb8da86b465beaf09c367f3dfd648d8f Author: Pierre-Eric Pelloux-Prayer Date: Tue Nov 4 10:42:45 2025 +0100 drm/amdgpu: jump to the correct label on failure drm_sched_entity_init wasn't called yet, so the only thing to do is to release allocated memory. This doesn't fix any bug since entity is zero allocated and drm_sched_entity_fini does nothing in this case. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Acked-by: Christian König Signed-off-by: Alex Deucher commit 37cdb89c0a5940e41682e1f89a3ed88990a94887 Author: Ahmad Rehman Date: Wed Nov 5 09:48:08 2025 -0500 drm/amdkfd: Fixing the clang format This patch fixes the formatting in the patch "amdkfd: Do not wait for queue op response during reset" Signed-off-by: Ahmad Rehman Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 42993bcf1c8d773d783a613d2d4e9172c16b4926 Author: Asad Kamal Date: Thu Nov 6 23:47:29 2025 +0800 drm/amd/pm: Add NULL check for power limit Add NULL check for smu power limit pointer v2: Update error code on failure (Lijo) Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e84835940e60a7d5263767ee92acc08f9877cb26 Author: Tao Zhou Date: Wed Aug 27 15:48:06 2025 +0800 drm/amdgpu: get RAS bad page address from MCA address Instead of from physical address. v2: add comment to make the code more readable Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 50d9ebd66ea1393412e341c3a44706d80b38d872 Author: Mario Limonciello (AMD) Date: Thu Nov 6 14:55:27 2025 -0600 drm/amd: Clarify that amdgpu.audio only works for non-DC The comment already explains it but the module parameter help text doesn't. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4684 Signed-off-by: Mario Limonciello (AMD) Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 9dff2bb709e6fbd97e263fd12bf12802d2b5a0cf Author: Vitaly Prosyak Date: Thu Nov 6 12:35:53 2025 -0500 drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces Certain multi-GPU configurations (especially GFX12) may hit data corruption when a DCC-compressed VRAM surface is shared across GPUs using peer-to-peer (P2P) DMA transfers. Such surfaces rely on device-local metadata and cannot be safely accessed through a remote GPU’s page tables. Attempting to import a DCC-enabled surface through P2P leads to incorrect rendering or GPU faults. This change disables P2P for DCC-enabled VRAM buffers that are contiguous and allocated on GFX12+ hardware. In these cases, the importer falls back to the standard system-memory path, avoiding invalid access to compressed surfaces. Future work could consider optional migration (VRAM→System→VRAM) if a performance regression is observed when `attach->peer2peer = false`. Tested on: - Dual RX 9700 XT (Navi4x) setup - GNOME and Wayland compositor scenarios - Confirmed no corruption after disabling P2P under these conditions v2: Remove check TTM_PL_VRAM & TTM_PL_FLAG_CONTIGUOUS. v3: simplify for upsteam and fix ip version check (Alex) Suggested-by: Christian König Signed-off-by: Vitaly Prosyak Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 815e260a18a3af4dab59025ee99a7156c0e8b5e0 Author: Wenjing Liu Date: Thu Nov 6 13:49:18 2025 +0800 drm/amd/display: add macros to simplify code [Why & How] Adding macros to simplify the process of adding new error codes. Currently, to add an error code, the developer needs to add both the enum and the string translation. This is error prone and can lead to inconsistencies. The refactor adds a macro to automatically add the string translation based on the enum. Reviewed-by: Aric Cyr Signed-off-by: Wenjing Liu Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c154a96b550b66bdf032216cab613269cb91e79e Author: Tao Zhou Date: Fri Jul 25 10:47:35 2025 +0800 drm/amdgpu: load RAS bad page from PMFW in page retirement In legacy way, bad page is queried from MCA registers, switch to getting it from PMFW when PMFW manages eeprom data. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit fc6aa0e470e092873eddb213d996a8beee86bf4d Author: Robert Marko Date: Mon Nov 10 13:42:53 2025 +0100 net: sparx5/lan969x: populate netdev of_node Populate of_node for the port netdevs, to make the individual ports of_nodes available in sysfs. Signed-off-by: Robert Marko Link: https://patch.msgid.link/20251110124342.199216-1-robert.marko@sartura.hr Signed-off-by: Jakub Kicinski commit db82f6cda525c3e519cfac0b4aec714df7cc93df Author: Richard Zhu Date: Fri Oct 24 15:31:52 2025 +0800 arm64: dts: imx95-19x19-evk: Add vpcie3v3aux regulator for PCIe[0,1] Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector(PCIe0) on i.MX95 19x19 EVK board. PCIe1 uses one standard PCIe slot connector, but combines the +3.3v and +3.3Vaux into a same 3.3v power source, and intends to let it always on. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe1 on i.MX95 19x19 EVK board too. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 4737f7c7420a80b3b8c258cbb55ed666fc56d60d Author: Richard Zhu Date: Fri Oct 24 15:31:51 2025 +0800 arm64: dts: imx95-15x15-evk: Add vpcie3v3aux regulator for PCIe M.2 connector Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector on i.MX95 15x15 EVK board. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit b64620022d96743a8f55e67a48a7ab48a6782691 Author: Richard Zhu Date: Fri Oct 24 15:31:50 2025 +0800 arm64: dts: imx8qxp-mek: Add vpcie3v3aux regulator for PCIe M.2 connector Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector on i.MX8QXP MEK board. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit f4303fa035539e8a30920545b92d90251001fc83 Author: Richard Zhu Date: Fri Oct 24 15:31:49 2025 +0800 arm64: dts: imx8qm-mek: Add vpcie3v3aux regulator for PCIe M.2 connector Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector on i.MX8QM MEK board. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 6fa16090efbca3a9ae74847e720f3c84ea18ce3d Author: Richard Zhu Date: Fri Oct 24 15:31:48 2025 +0800 arm64: dts: imx8mq-evk: Add vpcie3v3aux regulator for PCIe M.2 connector Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector on i.MX8MQ EVK board. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit caf08e2d494ec9790abe4f65130327c38eeb9d83 Author: Richard Zhu Date: Fri Oct 24 15:31:47 2025 +0800 arm64: dts: imx8mp-evk: Add vpcie3v3aux regulator for PCIe M.2 connector Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector on i.MX8MP EVK board. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 55a79e599aa8fef6b2b268fb9357722d080b9730 Author: Richard Zhu Date: Fri Oct 24 15:31:46 2025 +0800 arm64: dts: imx8dxl-evk: Add vpcie3v3aux regulator for PCIe M.2 connector Refer to PCI Express M.2 Specification r5.1 sec3.1.1 Power Sources and Grounds. PCI Express M.2 Socket 1 utilizes a 3.3 V power source. The voltage source, 3.3 V, is expected to be available during the system’s stand-by/suspend state to support wake event processing on the communications card. Add vpcie3v3aux regulator to let this 3.3 V power source always on for PCIe M.2 Key E connector on i.MX8DXL EVK board. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 458ea87a6b308e85406da6f09fe0091f01ec5479 Merge: 34bff6f03c131e da3d1501235df3 Author: Jakub Kicinski Date: Tue Nov 11 17:53:30 2025 -0800 Merge branch 'net-stmmac-convert-meson8b-to-use-stmmac_get_phy_intf_sel' Russell King says: ==================== net: stmmac: convert meson8b to use stmmac_get_phy_intf_sel() This series splits out meson8b from the previous 16 patch series as that now has r-b tags. This series converts meson8b to use stmmac_get_phy_intf_sel(). This driver is not converted to the set_phy_intf_sel() method as it is unclear whether there are ordering dependencies that would prevent it. I would appreciate the driver author looking in to whether this conversion is possible. ==================== Link: https://patch.msgid.link/aRH50uVDX4_9O5ZU@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit da3d1501235df39d9f2db092ac8592eb6f7c52b1 Author: Russell King (Oracle) Date: Mon Nov 10 14:42:53 2025 +0000 net: stmmac: meson8b: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result and use that to set the control register to select the operating mode for the DWMAC core. Reviewed-by: Martin Blumenstingl Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIT6b-0000000DpPX-1LQ0@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 52d639da6feea3c8787a60b1efb534bd48ea053d Author: Russell King (Oracle) Date: Mon Nov 10 14:42:48 2025 +0000 net: stmmac: meson8b: use phy_intf_sel directly Rearrange meson_axg_set_phy_mode() to use phy_intf_sel directly, converting it to the register field for meson8b_dwmac_mask_bits(). Reviewed-by: Martin Blumenstingl Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIT6W-0000000DpPR-0tby@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 12f42597ab148753959bc466c0c66abcf10e4267 Author: Russell King (Oracle) Date: Mon Nov 10 14:42:43 2025 +0000 net: stmmac: meson8b: use PHY_INTF_SEL_x Use PHY_INTF_SEL_x definitions for phy_intf_sel bitfield. Reviewed-by: Martin Blumenstingl Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vIT6R-0000000DpPL-0Nli@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1a79e70e9d101a52810c87acfb0ea35d73707b3e Author: Richard Zhu Date: Wed Oct 15 11:04:24 2025 +0800 arm64: dts: imx8qxp-mek: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx8qxp-mek matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 44f9bcc943f53e25f63becbb471f0909fe77b603 Author: Richard Zhu Date: Wed Oct 15 11:04:23 2025 +0800 arm64: dts: imx8qm-mek: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx8qm-mek matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 053ee55576cec9a94a16680a266f242df1872eb9 Author: Richard Zhu Date: Wed Oct 15 11:04:22 2025 +0800 arm64: dts: imx8mq-evk: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx8mq-evk matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 45b68efd9bb52d18075f9440dddb3705b72d5810 Author: Richard Zhu Date: Wed Oct 15 11:04:21 2025 +0800 arm64: dts: imx8mp-evk: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx8mp-evk matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 798825c11e12a63b43a92b794dc157d966475b2b Author: Richard Zhu Date: Wed Oct 15 11:04:20 2025 +0800 arm64: dts: imx8mm-evk: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx8mm-evk matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 756d0ef76e8a3ab36e05ec03e876935d526c8d37 Author: Richard Zhu Date: Wed Oct 15 11:04:19 2025 +0800 arm64: dts: imx95-19x19-evk: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx95-19x19-evk matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit dd93ee01a5056876be537b5bbb4a4a646b50982b Author: Richard Zhu Date: Wed Oct 15 11:04:18 2025 +0800 arm64: dts: imx95-15x15-evk: Add supports-clkreq property to PCIe M.2 port According to PCIe r6.1, sec 5.5.1. The following rules define how the L1.1 and L1.2 substates are entered: Both the Upstream and Downstream Ports must monitor the logical state of the CLKREQ# signal. Typical implement is using open drain, which connect RC's clkreq# to EP's clkreq# together and pull up clkreq#. imx95-15x15-evk matches this requirement, so add supports-clkreq to allow PCIe device enter ASPM L1 Sub-State. Signed-off-by: Richard Zhu Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 34bff6f03c131ee7eb2ddbd2dbaa01c6497f0f8a Author: Nathan Chancellor Date: Mon Nov 10 13:55:34 2025 -0700 net: netcp: ethss: Fix type of first parameter in hwtstamp stubs When building without CONFIG_TI_CPTS, there are a series of errors from -Wincompatible-pointer-types: drivers/net/ethernet/ti/netcp_ethss.c:3831:27: error: initialization of 'int (*)(void *, struct kernel_hwtstamp_config *)' from incompatible pointer type 'int (*)(struct gbe_intf *, struct kernel_hwtstamp_config *)' [-Wincompatible-pointer-types] 3831 | .hwtstamp_get = gbe_hwtstamp_get, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/ti/netcp_ethss.c:3831:27: note: (near initialization for 'gbe_module.hwtstamp_get') drivers/net/ethernet/ti/netcp_ethss.c:2758:19: note: 'gbe_hwtstamp_get' declared here 2758 | static inline int gbe_hwtstamp_get(struct gbe_intf *gbe_intf, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/ti/netcp_ethss.c:3832:27: error: initialization of 'int (*)(void *, struct kernel_hwtstamp_config *, struct netlink_ext_ack *)' from incompatible pointer type 'int (*)(struct gbe_intf *, struct kernel_hwtstamp_config *, struct netlink_ext_ack *)' [-Wincompatible-pointer-types] 3832 | .hwtstamp_set = gbe_hwtstamp_set, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/ti/netcp_ethss.c:3832:27: note: (near initialization for 'gbe_module.hwtstamp_set') drivers/net/ethernet/ti/netcp_ethss.c:2764:19: note: 'gbe_hwtstamp_set' declared here 2764 | static inline int gbe_hwtstamp_set(struct gbe_intf *gbe_intf, | ^~~~~~~~~~~~~~~~ In a recent conversion to ndo_hwtstamp, the type of the first parameter was updated for the CONFIG_TI_CPTS=y implementations of gbe_hwtstamp_get() and gbe_hwtstamp_set() but not the CONFIG_TI_CPTS=n ones. Update the type of the first parameter in the CONFIG_TI_CPTS=n stubs to resolve the errors. Fixes: 3f02b8272557 ("ti: netcp: convert to ndo_hwtstamp callbacks") Reviewed-by: Vadim Fedorenko Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251110-netcp_ethss-fix-cpts-stubs-clang-wifpts-v2-1-aa6204ec1f43@kernel.org Signed-off-by: Jakub Kicinski commit da8fcfba0854dbe0b0eca465d35620c9cf4c89c1 Author: Namhyung Kim Date: Wed Nov 5 23:28:34 2025 -0800 perf stat: Align metric output without events One of my concern in the perf stat output was the alignment in the metrics and shadow stats. I think it missed to calculate the basic output length using COUNTS_LEN and EVNAME_LEN but missed to add the unit length like "msec" and surround 2 spaces. I'm not sure why it's not printed below though. But anyway, now it shows correctly aligned metric output. $ perf stat true Performance counter stats for 'true': 859,772 task-clock # 0.395 CPUs utilized 0 context-switches # 0.000 /sec 0 cpu-migrations # 0.000 /sec 56 page-faults # 65.134 K/sec 1,075,022 instructions # 0.86 insn per cycle 1,255,911 cycles # 1.461 GHz 220,573 branches # 256.548 M/sec 7,381 branch-misses # 3.35% of all branches TopdownL1 # 19.2 % tma_retiring # 28.6 % tma_backend_bound # 9.5 % tma_bad_speculation # 42.6 % tma_frontend_bound 0.002174871 seconds time elapsed ^ | 0.002154000 seconds user | 0.000000000 seconds sys here Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit 68cc6ec3ac2960f0871421c16e49cba826fdff52 Author: Ian Rogers Date: Tue Nov 11 13:22:06 2025 -0800 perf tool_pmu: Make core_wide and target_cpu json events For the sake of better documentation, add core_wide and target_cpu to the tool.json. When the values of system_wide and user_requested_cpu_list are unknown, use the values from the global stat_config. Example output showing how '-a' modifies the values in `perf stat`: ``` $ perf stat -e core_wide,target_cpu true Performance counter stats for 'true': 0 core_wide 0 target_cpu 0.000993787 seconds time elapsed 0.001128000 seconds user 0.000000000 seconds sys $ perf stat -e core_wide,target_cpu -a true Performance counter stats for 'system wide': 1 core_wide 1 target_cpu 0.002271723 seconds time elapsed $ perf list ... tool: core_wide [1 if not SMT,if SMT are events being gathered on all SMT threads 1 otherwise 0. Unit: tool] ... target_cpu [1 if CPUs being analyzed,0 if threads/processes. Unit: tool] ... ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 02432d920e3b174ff44a9fabb82fc8316f236a65 Author: Ian Rogers Date: Tue Nov 11 13:22:05 2025 -0800 perf test stat csv: Update test expectations and events Explicitly use a metric rather than implicitly expecting '-e instructions,cycles' to produce a metric. Use a metric with software events to make it more compatible. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit a48cd551d7436be3b1bd65c63a6d00163f7e7706 Author: Ian Rogers Date: Tue Nov 11 13:22:04 2025 -0800 perf test stat: Update test expectations and events test_stat_record_report and test_stat_record_script used default output which triggers a bug when sending metrics. As this isn't relevant to the test switch to using named software events. Update the match in test_hybrid as the cycles event is now cpu-cycles to workaround potential ARM issues. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 6b76f0678b245a9d59ae6a4b69a7bdd8cae89476 Author: Ian Rogers Date: Tue Nov 11 13:22:03 2025 -0800 perf test stat: Update shadow test to use metrics Previously '-e cycles,instructions' would implicitly create an IPC metric. This now has to be explicit with '-M insn_per_cycle'. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 91c1949d768520d9befa7761eb97c3826997da25 Author: Ian Rogers Date: Tue Nov 11 13:22:02 2025 -0800 perf test metrics: Update all metrics for possibly failing default metrics Default metrics may use unsupported events and be ignored. These metrics shouldn't cause metric testing to fail. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 083ae6c1fbf69a56f638aa9a477d35afdea2ab3f Author: Ian Rogers Date: Tue Nov 11 13:22:01 2025 -0800 perf test stat: Update std_output testing metric expectations Make the expectations match json metrics rather than the previous hard coded ones. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b1cb2b76bd16d5399fa7d21b2909134687f021b0 Author: Ian Rogers Date: Tue Nov 11 13:22:00 2025 -0800 perf test stat: Ignore failures in Default[234] metricgroups The Default[234] metric groups may contain unsupported legacy events. Allow those metric groups to fail. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 2c240484cf52da3c2ca14cfb70e8cf9179197ced Author: Ian Rogers Date: Tue Nov 11 13:21:59 2025 -0800 perf test stat+json: Improve metric-only testing When testing metric-only, pass a metric to perf rather than expecting a hard coded metric value to be generated. Remove keys that were really metric-only units and instead don't expect metric only to have a matching json key as it encodes metrics as {"metric_name", "metric_value"}. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 1bcd6271651e55329664e38446ab0288b64fb326 Author: Ian Rogers Date: Tue Nov 11 13:21:58 2025 -0800 perf stat: Remove "unit" workarounds for metric-only Remove code that tested the "unit" as in KB/sec for certain hard coded metric values and did workarounds. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit a745c0831c15cd93daf9651149cb54e557e54956 Author: Ian Rogers Date: Tue Nov 11 13:21:57 2025 -0800 perf stat: Sort default events/metrics To improve the readability of default events/metrics, sort the evsels after the Default metric groups have be parsed. Before: ``` $ perf stat -a sleep 1 Performance counter stats for 'system wide': 22,087 context-switches # nan cs/sec cs_per_second TopdownL1 (cpu_core) # 10.3 % tma_bad_speculation # 25.8 % tma_frontend_bound # 34.5 % tma_backend_bound # 29.3 % tma_retiring 7,829 page-faults # nan faults/sec page_faults_per_second 880,144,270 cpu_atom/cpu-cycles/ # nan GHz cycles_frequency (50.10%) 1,693,081,235 cpu_core/cpu-cycles/ # nan GHz cycles_frequency TopdownL1 (cpu_atom) # 20.5 % tma_bad_speculation # 13.8 % tma_retiring (50.26%) # 34.6 % tma_frontend_bound (50.23%) 89,326,916 cpu_atom/branches/ # nan M/sec branch_frequency (60.19%) 538,123,088 cpu_core/branches/ # nan M/sec branch_frequency 1,368 cpu-migrations # nan migrations/sec migrations_per_second # 31.1 % tma_backend_bound (60.19%) 0.00 msec cpu-clock # 0.0 CPUs CPUs_utilized 485,744,856 cpu_atom/instructions/ # 0.6 instructions insn_per_cycle (59.87%) 3,093,112,283 cpu_core/instructions/ # 1.8 instructions insn_per_cycle 4,939,427 cpu_atom/branch-misses/ # 5.0 % branch_miss_rate (49.77%) 7,632,248 cpu_core/branch-misses/ # 1.4 % branch_miss_rate 1.005084693 seconds time elapsed ``` After: ``` $ perf stat -a sleep 1 Performance counter stats for 'system wide': 22,165 context-switches # nan cs/sec cs_per_second 0.00 msec cpu-clock # 0.0 CPUs CPUs_utilized 2,260 cpu-migrations # nan migrations/sec migrations_per_second 20,476 page-faults # nan faults/sec page_faults_per_second 17,052,357 cpu_core/branch-misses/ # 1.5 % branch_miss_rate 1,120,090,590 cpu_core/branches/ # nan M/sec branch_frequency 3,402,892,275 cpu_core/cpu-cycles/ # nan GHz cycles_frequency 6,129,236,701 cpu_core/instructions/ # 1.8 instructions insn_per_cycle 6,159,523 cpu_atom/branch-misses/ # 3.1 % branch_miss_rate (49.86%) 222,158,812 cpu_atom/branches/ # nan M/sec branch_frequency (50.25%) 1,547,610,244 cpu_atom/cpu-cycles/ # nan GHz cycles_frequency (50.40%) 1,304,901,260 cpu_atom/instructions/ # 0.8 instructions insn_per_cycle (50.41%) TopdownL1 (cpu_core) # 13.7 % tma_bad_speculation # 23.5 % tma_frontend_bound # 33.3 % tma_backend_bound # 29.6 % tma_retiring TopdownL1 (cpu_atom) # 32.1 % tma_backend_bound (59.65%) # 30.1 % tma_frontend_bound (59.51%) # 22.3 % tma_bad_speculation # 15.5 % tma_retiring (59.53%) 1.008405429 seconds time elapsed ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 19df87d9ed7072d08b80a2aae58ac971716c2c18 Author: Ian Rogers Date: Tue Nov 11 13:21:56 2025 -0800 perf stat: Fix default metricgroup display on hybrid The logic to skip output of a default metric line was firing on Alderlake and not displaying 'TopdownL1 (cpu_atom)'. Remove the need_full_name check as it is equivalent to the different PMU test in the cases we care about, merge the 'if's and flip the evsel of the PMU test. The 'if' is now basically saying, if the output matches the last printed output then skip the output. Before: ``` TopdownL1 (cpu_core) # 11.3 % tma_bad_speculation # 24.3 % tma_frontend_bound TopdownL1 (cpu_core) # 33.9 % tma_backend_bound # 30.6 % tma_retiring # 42.2 % tma_backend_bound # 25.0 % tma_frontend_bound (49.81%) # 12.8 % tma_bad_speculation # 20.0 % tma_retiring (59.46%) ``` After: ``` TopdownL1 (cpu_core) # 8.3 % tma_bad_speculation # 43.7 % tma_frontend_bound # 30.7 % tma_backend_bound # 17.2 % tma_retiring TopdownL1 (cpu_atom) # 31.9 % tma_backend_bound # 37.6 % tma_frontend_bound (49.66%) # 18.0 % tma_bad_speculation # 12.6 % tma_retiring (59.58%) ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit b71f46a6a708617502faa1be915feb7dd6ecf603 Author: Ian Rogers Date: Tue Nov 11 13:21:55 2025 -0800 perf stat: Remove hard coded shadow metrics Now that the metrics are encoded in common json the hard coded printing means the metrics are shown twice. Remove the hard coded version. This means that when specifying events, and those events correspond to a hard coded metric, the metric will no longer be displayed. The metric will be displayed if the metric is requested. Due to the adhoc printing in the previous approach it was often found frustrating, the new approach avoids this. The default perf stat output on an alderlake now looks like: ``` $ perf stat -a -- sleep 1 Performance counter stats for 'system wide': 19,697 context-switches # nan cs/sec cs_per_second TopdownL1 (cpu_core) # 10.7 % tma_bad_speculation # 24.9 % tma_frontend_bound TopdownL1 (cpu_core) # 34.3 % tma_backend_bound # 30.1 % tma_retiring 6,593 page-faults # nan faults/sec page_faults_per_second 729,065,658 cpu_atom/cpu-cycles/ # nan GHz cycles_frequency (49.79%) 1,605,131,101 cpu_core/cpu-cycles/ # nan GHz cycles_frequency # 19.7 % tma_bad_speculation # 14.2 % tma_retiring (50.14%) # 37.3 % tma_frontend_bound (50.31%) 87,302,268 cpu_atom/branches/ # nan M/sec branch_frequency (60.27%) 512,046,956 cpu_core/branches/ # nan M/sec branch_frequency 1,111 cpu-migrations # nan migrations/sec migrations_per_second # 28.8 % tma_backend_bound (60.26%) 0.00 msec cpu-clock # 0.0 CPUs CPUs_utilized 392,509,323 cpu_atom/instructions/ # 0.6 instructions insn_per_cycle (60.19%) 2,990,369,310 cpu_core/instructions/ # 1.9 instructions insn_per_cycle 3,493,478 cpu_atom/branch-misses/ # 5.9 % branch_miss_rate (49.69%) 7,297,531 cpu_core/branch-misses/ # 1.4 % branch_miss_rate 1.006621701 seconds time elapsed ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 3622990efaab066897a2c570b6e90f4b9f30b200 Author: Ian Rogers Date: Tue Nov 11 13:21:54 2025 -0800 perf script: Change metric format to use json metrics The metric format option isn't properly supported. This change improves that by making the sample events update the counts of an evsel, where the shadow metric code expects to read the values. To support printing metrics, metrics need to be found. This is done on the first attempt to print a metric. Every metric is parsed and then the evsels in the metric's evlist compared to those in perf script using the perf_event_attr type and config. If the metric matches then it is added for printing. As an event in the perf script's evlist may have >1 metric id, or different leader for aggregation, the first metric matched will be displayed in those cases. An example use is: ``` $ perf record -a -e '{instructions,cpu-cycles}:S' -a -- sleep 1 $ perf script -F period,metric ... 867817 metric: 0.30 insn per cycle 125394 metric: 0.04 insn per cycle 313516 metric: 0.11 insn per cycle metric: 1.00 insn per cycle ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 2dfc0cab3da4a2054468489cc140b2bd539ce626 Author: Ian Rogers Date: Tue Nov 11 13:21:53 2025 -0800 perf stat: Add detail -d,-dd,-ddd metrics Add metrics for the stat-shadow -d, -dd and -ddd events and hard coded metrics. Remove the events as these now come from the metrics. Following this change a detailed perf stat output looks like: ``` $ perf stat -a -ddd -- sleep 1 Performance counter stats for 'system wide': 21,089 context-switches # nan cs/sec cs_per_second TopdownL1 (cpu_core) # 14.1 % tma_bad_speculation # 27.3 % tma_frontend_bound (30.56%) TopdownL1 (cpu_core) # 31.5 % tma_backend_bound # 27.2 % tma_retiring (30.56%) 6,302 page-faults # nan faults/sec page_faults_per_second 928,495,163 cpu_atom/cpu-cycles/ # nan GHz cycles_frequency (28.41%) 1,841,409,834 cpu_core/cpu-cycles/ # nan GHz cycles_frequency (38.51%) # 14.5 % tma_bad_speculation # 16.0 % tma_retiring (28.41%) # 36.8 % tma_frontend_bound (35.57%) 100,859,118 cpu_atom/branches/ # nan M/sec branch_frequency (42.73%) 572,657,734 cpu_core/branches/ # nan M/sec branch_frequency (54.43%) 1,527 cpu-migrations # nan migrations/sec migrations_per_second # 32.7 % tma_backend_bound (42.73%) 0.00 msec cpu-clock # 0.000 CPUs utilized # 0.0 CPUs CPUs_utilized 498,668,509 cpu_atom/instructions/ # 0.57 insn per cycle # 0.6 instructions insn_per_cycle (42.97%) 3,281,762,225 cpu_core/instructions/ # 1.84 insn per cycle # 1.8 instructions insn_per_cycle (62.20%) 4,919,511 cpu_atom/branch-misses/ # 5.43% of all branches # 5.4 % branch_miss_rate (35.80%) 7,431,776 cpu_core/branch-misses/ # 1.39% of all branches # 1.4 % branch_miss_rate (62.20%) 2,517,007 cpu_atom/LLC-loads/ # 0.1 % llc_miss_rate (28.62%) 3,931,318 cpu_core/LLC-loads/ # 40.4 % llc_miss_rate (45.98%) 14,918,674 cpu_core/L1-dcache-load-misses/ # 2.25% of all L1-dcache accesses # nan % l1d_miss_rate (37.80%) 27,067,264 cpu_atom/L1-icache-load-misses/ # 15.92% of all L1-icache accesses # 15.9 % l1i_miss_rate (21.47%) 116,848,994 cpu_atom/dTLB-loads/ # 0.8 % dtlb_miss_rate (21.47%) 764,870,407 cpu_core/dTLB-loads/ # 0.1 % dtlb_miss_rate (15.12%) 1.006181526 seconds time elapsed ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit a3248b5b5427dc2126c19aa9c32f1e840b65024f Author: Ian Rogers Date: Tue Nov 11 13:21:52 2025 -0800 perf jevents: Add metric DefaultShowEvents Some Default group metrics require their events showing for consistency with perf's previous behavior. Add a flag to indicate when this is the case and use it in stat-display. As events are coming from Default metrics remove that default hardware and software events from perf stat. Following this change the default perf stat output on an alderlake looks like: ``` $ perf stat -a -- sleep 1 Performance counter stats for 'system wide': 20,550 context-switches # nan cs/sec cs_per_second TopdownL1 (cpu_core) # 9.0 % tma_bad_speculation # 28.1 % tma_frontend_bound TopdownL1 (cpu_core) # 29.2 % tma_backend_bound # 33.7 % tma_retiring 6,685 page-faults # nan faults/sec page_faults_per_second 790,091,064 cpu_atom/cpu-cycles/ # nan GHz cycles_frequency (49.83%) 2,563,918,366 cpu_core/cpu-cycles/ # nan GHz cycles_frequency # 12.3 % tma_bad_speculation # 14.5 % tma_retiring (50.20%) # 33.8 % tma_frontend_bound (50.24%) 76,390,322 cpu_atom/branches/ # nan M/sec branch_frequency (60.20%) 1,015,173,047 cpu_core/branches/ # nan M/sec branch_frequency 1,325 cpu-migrations # nan migrations/sec migrations_per_second # 39.3 % tma_backend_bound (60.17%) 0.00 msec cpu-clock # 0.000 CPUs utilized # 0.0 CPUs CPUs_utilized 554,347,072 cpu_atom/instructions/ # 0.64 insn per cycle # 0.6 instructions insn_per_cycle (60.14%) 5,228,931,991 cpu_core/instructions/ # 2.04 insn per cycle # 2.0 instructions insn_per_cycle 4,308,874 cpu_atom/branch-misses/ # 5.65% of all branches # 5.6 % branch_miss_rate (49.76%) 9,890,606 cpu_core/branch-misses/ # 0.97% of all branches # 1.0 % branch_miss_rate 1.005477803 seconds time elapsed ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c7adeb0974f18da4828338ae75f1c1ebe6c03c7a Author: Ian Rogers Date: Tue Nov 11 13:21:51 2025 -0800 perf jevents: Add set of common metrics based on default ones Add support to getting a common set of metrics from a default table. It simplifies the generation to add json metrics at the same time. The metrics added are CPUs_utilized, cs_per_second, migrations_per_second, page_faults_per_second, insn_per_cycle, stalled_cycles_per_instruction, frontend_cycles_idle, backend_cycles_idle, cycles_frequency, branch_frequency and branch_miss_rate based on the shadow metric definitions. Following this change the default perf stat output on an alderlake looks like: ``` $ perf stat -a -- sleep 2 Performance counter stats for 'system wide': 0.00 msec cpu-clock # 0.000 CPUs utilized 77,739 context-switches 15,033 cpu-migrations 321,313 page-faults 14,355,634,225 cpu_atom/instructions/ # 1.40 insn per cycle (35.37%) 134,561,560,583 cpu_core/instructions/ # 3.44 insn per cycle (57.85%) 10,263,836,145 cpu_atom/cycles/ (35.42%) 39,138,632,894 cpu_core/cycles/ (57.60%) 2,989,658,777 cpu_atom/branches/ (42.60%) 32,170,570,388 cpu_core/branches/ (57.39%) 29,789,870 cpu_atom/branch-misses/ # 1.00% of all branches (42.69%) 165,991,152 cpu_core/branch-misses/ # 0.52% of all branches (57.19%) (software) # nan cs/sec cs_per_second TopdownL1 (cpu_core) # 11.9 % tma_bad_speculation # 19.6 % tma_frontend_bound (63.97%) TopdownL1 (cpu_core) # 18.8 % tma_backend_bound # 49.7 % tma_retiring (63.97%) (software) # nan faults/sec page_faults_per_second # nan GHz cycles_frequency (42.88%) # nan GHz cycles_frequency (69.88%) TopdownL1 (cpu_atom) # 11.7 % tma_bad_speculation # 29.9 % tma_retiring (50.07%) TopdownL1 (cpu_atom) # 31.3 % tma_frontend_bound (43.09%) (cpu_atom) # nan M/sec branch_frequency (43.09%) # nan M/sec branch_frequency (70.07%) # nan migrations/sec migrations_per_second TopdownL1 (cpu_atom) # 27.1 % tma_backend_bound (43.08%) (software) # 0.0 CPUs CPUs_utilized # 1.4 instructions insn_per_cycle (43.04%) # 3.5 instructions insn_per_cycle (69.99%) # 1.0 % branch_miss_rate (35.46%) # 0.5 % branch_miss_rate (65.02%) 2.005626564 seconds time elapsed ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 2e5140849b021889cf4dd8df5d2352e508213607 Author: Ian Rogers Date: Tue Nov 11 13:21:50 2025 -0800 perf expr: Add #target_cpu literal For CPU nanoseconds a lot of the stat-shadow metrics use either task-clock or cpu-clock, the latter being used when target__has_cpu. Add a #target_cpu literal so that json metrics can perform the same test. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c8035a496141b9c05dc3ce034c7a1d4b64f4eccb Author: Ian Rogers Date: Tue Nov 11 13:21:49 2025 -0800 perf metricgroup: Add care to picking the evsel for displaying a metric Rather than using the first evsel in the matched events, try to find the least shared non-tool evsel. The aim is to pick the first evsel that typifies the metric within the list of metrics. This addresses an issue where Default metric group metrics may lose their counter value due to how the stat displaying hides counters for default event/metric output. For a metricgroup like TopdownL1 on an Intel Alderlake the change is, before there are 4 events with metrics: ``` $ perf stat -M topdownL1 -a sleep 1 Performance counter stats for 'system wide': 7,782,334,296 cpu_core/TOPDOWN.SLOTS/ # 10.4 % tma_bad_speculation # 19.7 % tma_frontend_bound 2,668,927,977 cpu_core/topdown-retiring/ # 35.7 % tma_backend_bound # 34.1 % tma_retiring 803,623,987 cpu_core/topdown-bad-spec/ 167,514,386 cpu_core/topdown-heavy-ops/ 1,555,265,776 cpu_core/topdown-fe-bound/ 2,792,733,013 cpu_core/topdown-be-bound/ 279,769,310 cpu_atom/TOPDOWN_RETIRING.ALL/ # 12.2 % tma_retiring # 15.1 % tma_bad_speculation 457,917,232 cpu_atom/CPU_CLK_UNHALTED.CORE/ # 38.4 % tma_backend_bound # 34.2 % tma_frontend_bound 783,519,226 cpu_atom/TOPDOWN_FE_BOUND.ALL/ 10,790,192 cpu_core/INT_MISC.UOP_DROPPING/ 879,845,633 cpu_atom/TOPDOWN_BE_BOUND.ALL/ ``` After there are 6 events with metrics: ``` $ perf stat -M topdownL1 -a sleep 1 Performance counter stats for 'system wide': 2,377,551,258 cpu_core/TOPDOWN.SLOTS/ # 7.9 % tma_bad_speculation # 36.4 % tma_frontend_bound 480,791,142 cpu_core/topdown-retiring/ # 35.5 % tma_backend_bound 186,323,991 cpu_core/topdown-bad-spec/ 65,070,590 cpu_core/topdown-heavy-ops/ # 20.1 % tma_retiring 871,733,444 cpu_core/topdown-fe-bound/ 848,286,598 cpu_core/topdown-be-bound/ 260,936,456 cpu_atom/TOPDOWN_RETIRING.ALL/ # 12.4 % tma_retiring # 17.6 % tma_bad_speculation 419,576,513 cpu_atom/CPU_CLK_UNHALTED.CORE/ 797,132,597 cpu_atom/TOPDOWN_FE_BOUND.ALL/ # 38.0 % tma_frontend_bound 3,055,447 cpu_core/INT_MISC.UOP_DROPPING/ 671,014,164 cpu_atom/TOPDOWN_BE_BOUND.ALL/ # 32.0 % tma_backend_bound ``` Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 41a5e8777093f7946fade3737363ef045303b8dc Author: Dmitry Antipov Date: Thu Oct 9 13:23:48 2025 +0300 ocfs2: add extra flags check in ocfs2_ioctl_move_extents() In 'ocfs2_ioctl_move_extents()', add extra check whether only actually supported flags are passed via 'ioctl(..., OCFS2_IOC_MOVE_EXT, ...)', and reject anything beyond OCFS2_MOVE_EXT_FL_AUTO_DEFRAG and OCFS2_MOVE_EXT_FL_PART_DEFRAG with -EINVAL. In particular, OCFS2_MOVE_EXT_FL_COMPLETE may be set by the kernel only and should never be passed from userspace. Link: https://lkml.kernel.org/r/20251009102349.181126-1-dmantipov@yandex.ru Signed-off-by: Dmitry Antipov Reviewed-by: Joseph Qi Cc: Changwei Ge Cc: Joel Becker Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit 55b453ed53d28da0b8d2316741e11eb22ceb39d6 Author: Onur Özkan Date: Wed Sep 17 20:37:25 2025 +0300 checkpatch: document new check PLACEHOLDER_USE Adds documentation for the new check PLACEHOLDER_USE in checkpatch. Link: https://lkml.kernel.org/r/20250917173725.22547-3-work@onurozkan.dev Signed-off-by: Onur Özkan Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit fc387a0704cc86cf47de0e64236577af3e148ec2 Author: Onur Özkan Date: Wed Sep 17 20:37:24 2025 +0300 checkpatch: detect unhandled placeholders in cover letters Add a new check PLACEHOLDER_USE to detect unhandled placeholders. This prevents sending patch series with incomplete patches (mostly in cover letters) containing auto generated subject or blurb lines. These placeholders can be seen on mailing lists. With this change, checkpatch will emit an error when such text is found. Link: https://lkml.kernel.org/r/20250917173725.22547-2-work@onurozkan.dev Signed-off-by: Onur Özkan Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Jonathan Corbet Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit 969493d7d6f957e1670a025330561d5912cd194c Author: Zhou Yuhang Date: Mon Sep 29 14:24:34 2025 +0800 samples: fix coding style issues in Kconfig Fix some coding style issues in Kconfig: use one tab to indent lines under a config definition, and use an additional two spaces to indent help text. Link: https://lkml.kernel.org/r/20250929062434.4114607-1-zhouyuhang1010@163.com Signed-off-by: Zhou Yuhang Signed-off-by: Andrew Morton commit 0e6ebf877843717ced4ada5c09c7196cede5054c Author: Thorsten Blum Date: Fri Oct 31 22:39:14 2025 +0100 device_cgroup: Refactor devcgroup_seq_show to use seq_put* helpers Replace set_access(), set_majmin(), and type_to_char() with new helpers seq_putaccess(), seq_puttype(), and seq_putversion() that write directly to 'seq_file'. Simplify devcgroup_seq_show() by hard-coding "a *:* rwm", and use the new seq_put* helper functions to list the exceptions otherwise. This allows us to remove the intermediate string buffers while maintaining the same functionality, including wildcard handling. Signed-off-by: Thorsten Blum Acked-by: Serge Hallyn Signed-off-by: Paul Moore commit 367377f45c0b568882567f797b7b18b263505be7 Author: Namhyung Kim Date: Mon Nov 10 23:59:44 2025 -0800 perf tools: Fix missing feature check for inherit + SAMPLE_READ It should also have PERF_SAMPLE_TID to enable inherit and PERF_SAMPLE_READ on recent kernels. Not having _TID makes the feature check wrongly detect the inherit and _READ support. It was reported that the following command failed due to the error in the missing feature check on Intel SPR machines. $ perf record -e '{cpu/mem-loads-aux/S,cpu/mem-loads,ldlat=3/PS}' -- ls Error: Failure to open event 'cpu/mem-loads,ldlat=3/PS' on PMU 'cpu' which will be removed. Invalid event (cpu/mem-loads,ldlat=3/PS) in per-thread mode, enable system wide with '-a'. Reviewed-by: Ian Rogers Fixes: 3b193a57baf15c468 ("perf tools: Detect missing kernel features properly") Reported-and-tested-by: Chen, Zide Closes: https://lore.kernel.org/lkml/20251022220802.1335131-1-zide.chen@intel.com/ Signed-off-by: Namhyung Kim commit a5e6f584dab0c450e27616433d41cc38fc062ecd Author: Leo Yan Date: Tue Nov 11 18:58:41 2025 +0000 coresight: etm4x: Remove the redundant DSB As recommended in section 4.3.7 "Synchronization when using the memory-mapped interface" of ARM IHI0064H.b: When using the memory-mapped interface to program the trace unit, the trace analyzer must ensure that writes have completed, to ensure that the trace unit is fully programmed and either enabled or disabled. To ensure writes have completed, the trace analyzer can do ... If the memory marked is as Device-nGnRE or stronger, read back the value of any register in the trace unit. This relies on peripheral coherence order defined in the Arm architecture. Polling TRCSTATR ensures the previous write has completed. Therefore, removes the redundant DSB barrier in the enabling flow. Update the comment in the disable flow for consistency. Reviewed-by: Yeoreum Yun Signed-off-by: Leo Yan Reviewed-by: Mike Leach Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-7-f55553b6c8b3@arm.com commit 1fdc2cd347a7bc58acacb6144404ee892cea6c2e Author: Leo Yan Date: Tue Nov 11 18:58:40 2025 +0000 coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF If a CPU supports FEAT_TRF, as described in the section K5.5 "Context switching", Arm ARM (ARM DDI 0487 L.a), it defines a flow to prohibit program-flow trace, execute a TSB CSYNC instruction for flushing, followed by clearing TRCPRGCTLR.EN bit. To restore the state, the reverse sequence is required. This differs from the procedure described in the section 3.4.1 "The procedure when powering down the PE" of ARM IHI0064H.b, which involves the OS Lock to prevent external debugger accesses and implicitly disables trace. To be compatible with different ETM versions, explicitly control trace unit using etm4_disable_trace_unit() and etm4_enable_trace_unit() during CPU idle to comply with FEAT_TRF. As a result, the save states for TRFCR_ELx and trcprgctlr are redundant, remove them. Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states") Reviewed-by: Mike Leach Tested-by: James Clark Reviewed-by: Yeoreum Yun Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-6-f55553b6c8b3@arm.com commit 64eb04ae545294e105ad91714dc3167a0b660731 Author: Leo Yan Date: Tue Nov 11 18:58:39 2025 +0000 coresight: etm4x: Add context synchronization before enabling trace According to the software usage PKLXF in Arm ARM (ARM DDI 0487 L.a), a Context synchronization event is required before enabling the trace unit. An ISB is added to meet this requirement, particularly for guarding the operations in the flow: etm4x_allow_trace() `> kvm_tracing_set_el1_configuration() `> write_sysreg_s(trfcr_while_in_guest, SYS_TRFCR_EL12) Improved the barrier comments to provide more accurate information. Fixes: 1ab3bb9df5e3 ("coresight: etm4x: Add necessary synchronization for sysreg access") Reviewed-by: Mike Leach Reviewed-by: Yeoreun Yun Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-5-f55553b6c8b3@arm.com commit 4dc4e22f9536341255f5de6047977a80ff47eaef Author: Leo Yan Date: Tue Nov 11 18:58:38 2025 +0000 coresight: etm4x: Correct polling IDLE bit Since commit 4ff6039ffb79 ("coresight-etm4x: add isb() before reading the TRCSTATR"), the code has incorrectly been polling the PMSTABLE bit instead of the IDLE bit. This commit corrects the typo. Fixes: 4ff6039ffb79 ("coresight-etm4x: add isb() before reading the TRCSTATR") Reviewed-by: Yeoreum Yun Reviewed-by: Mike Leach Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-4-f55553b6c8b3@arm.com commit ab3fde32afe6a77e5cc60f868e44e6e09424752b Author: Leo Yan Date: Tue Nov 11 18:58:37 2025 +0000 coresight: etm3x: Always set tracer's device mode on target CPU The ETMv3 driver shares the same issue as ETMv4 regarding race conditions when accessing the device mode. This commit applies the same fix: ensuring that the device mode is modified only by the target CPU to eliminate race conditions across CPUs. Fixes: 22fd532eaa0c ("coresight: etm3x: adding operation mode for etm_enable()") Reviewed-by: Mike Leach Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-3-f55553b6c8b3@arm.com commit 28eee2158575aea8fee7807adb9248ceaf9196f1 Author: Leo Yan Date: Tue Nov 11 18:58:36 2025 +0000 coresight: etm4x: Always set tracer's device mode on target CPU When enabling a tracer via SysFS interface, the device mode may be set by any CPU - not necessarily the target CPU. This can lead to race condition in SMP, and may result in incorrect mode values being read. Consider the following example, where CPU0 attempts to enable the tracer on CPU1 (the target CPU): CPU0 CPU1 etm4_enable() ` coresight_take_mode(SYSFS) ` etm4_enable_sysfs() ` smp_call_function_single() ----> etm4_enable_hw_smp_call() / / CPU idle: / etm4_cpu_save() / ` coresight_get_mode() Failed to enable h/w / ^^^ ` coresight_set_mode(DISABLED) <-' Read the intermediate SYSFS mode In this case, CPU0 initiates the operation by taking the SYSFS mode to avoid conflicts with the Perf mode. It then sends an IPI to CPU1 to configure the tracer registers. If any error occurs during this process, CPU0 rolls back by setting the mode to DISABLED. However, if CPU1 enters an idle state during this time, it might read the intermediate SYSFS mode. As a result, the CPU PM flow could wrongly save and restore tracer context that is actually disabled. To resolve the issue, this commit moves the device mode setting logic on the target CPU. This ensures that the device mode is only modified by the target CPU, eliminating race condition between mode writes and reads across CPUs. An additional change introduces the etm4_disable_sysfs_smp_call() function for SMP calls, which disables the tracer and explicitly set the mode to DISABLED during SysFS operations. Rename etm4_disable_hw_smp_call() to etm4_disable_sysfs_smp_call() for naming consistency. The flow is updated with this change: CPU0 CPU1 etm4_enable() ` etm4_enable_sysfs() ` smp_call_function_single() ----> etm4_enable_hw_smp_call() ` coresight_take_mode(SYSFS) Failed, set back to DISABLED ` coresight_set_mode(DISABLED) CPU idle: etm4_cpu_save() ` coresight_get_mode() ^^^ Read out the DISABLED mode Fixes: c38a9ec2b2c1 ("coresight: etm4x: moving etm_drvdata::enable to atomic field") Reviewed-by: Yeoreum Yun Reviewed-by: mike Leach Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-2-f55553b6c8b3@arm.com commit 693d1eaca940f277af24c74873ef2313816ff444 Author: Leo Yan Date: Tue Nov 11 18:58:35 2025 +0000 coresight: Change device mode to atomic type The device mode is defined as local type. This type cannot promise SMP-safe access. Change to atomic type and impose relax ordering, which ensures the SMP-safe synchronisation and the ordering between the mode setting and relevant operations. Fixes: 22fd532eaa0c ("coresight: etm3x: adding operation mode for etm_enable()") Reviewed-by: Mike Leach Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-1-f55553b6c8b3@arm.com commit f23cb0ced8fb28ba65bf4ddaa2fcaf044c6894cc Author: Chen Ridong Date: Tue Nov 11 13:24:29 2025 +0000 cpuset: remove need_rebuild_sched_domains Previously, update_cpumasks_hier() used need_rebuild_sched_domains to decide whether to invoke rebuild_sched_domains_locked(). Now that rebuild_sched_domains_locked() only sets force_rebuild, the flag is redundant. Hence, remove it. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 648d43da64f0221ab1050825b28995c17ce091a4 Author: Chen Ridong Date: Tue Nov 11 13:24:28 2025 +0000 cpuset: remove global remote_children list The remote_children list is used to track all remote partitions attached to a cpuset. However, it serves no other purpose. Using a boolean flag to indicate whether a cpuset is a remote partition is a more direct approach, making remote_children unnecessary. This patch replaces the list with a remote_partition flag in the cpuset structure and removes remote_children entirely. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 0241e9e2bda3077ca6ec90f0a22120ba7a73e43b Author: Chen Ridong Date: Tue Nov 11 13:24:27 2025 +0000 cpuset: simplify node setting on error There is no need to jump to the 'done' label upon failure, as no cleanup is required. Return the error code directly instead. Signed-off-by: Chen Ridong Reviewed-by: Waiman Long Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit 7083e142256f92d079d2749e002f2f2499e5f63c Author: Ryan Chen Date: Thu Oct 30 14:01:55 2025 +0800 dt-bindings: interrupt-controller: aspeed,ast2700: Correct #interrupt-cells and interrupts count Update the AST2700 interrupt controller binding to match the actual hardware and the irq-aspeed-intc driver behavior. - Interrupts: First-level INTC banks request multiple interrupt lines to the root GIC, with a maximum of 10 per bank. Second-level INTC banks request only one interrupt line to their parent INTC-IC. Therefore, set the interrupts property to allow a minimum of 1 and a maximum of 10 entries. - #interrupt-cells: Set '#interrupt-cells' to <1> since the aspeed intc driver does not support specifying a trigger type; only the interrupt index is used. Signed-off-by: Ryan Chen Signed-off-by: Thomas Gleixner Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251030060155.2342604-2-ryan_chen@aspeedtech.com commit 47a4ebbf91d31782113e7def707b53953bae3050 Author: Junhui Liu Date: Tue Oct 21 17:41:44 2025 +0800 irqchip/aclint-sswi: Add Nuclei UX900 support Reuse the generic ACLINT SSWI probe for Nuclei UX900 since it is compliant with the ACLINT specification. Signed-off-by: Junhui Liu Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251021-dr1v90-basic-dt-v3-9-5478db4f664a@pigmoral.tech commit a1c3a7d7ee0291e6bbc89192cb942cbebadb31fe Author: Junhui Liu Date: Tue Oct 21 17:41:41 2025 +0800 dt-bindings: interrupt-controller: Add Anlogic DR1V90 ACLINT SSWI Add SSWI support for Anlogic DR1V90 SoC, which uses Nuclei UX900 with a TIMER unit compliant with the ACLINT specification. Signed-off-by: Junhui Liu Signed-off-by: Thomas Gleixner Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251021-dr1v90-basic-dt-v3-6-5478db4f664a@pigmoral.tech commit 579951da64253e9592d21e54b1535e0119df78ab Author: Junhui Liu Date: Tue Oct 21 17:41:40 2025 +0800 dt-bindings: interrupt-controller: Add Anlogic DR1V90 ACLINT MSWI Add MSWI support for Anlogic DR1V90 SoC, which uses Nuclei UX900 with a TIMER unit compliant with the ACLINT specification. Signed-off-by: Junhui Liu Signed-off-by: Thomas Gleixner Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251021-dr1v90-basic-dt-v3-5-5478db4f664a@pigmoral.tech commit b90ac5fe3285aa8bed625375d1df959c4c9a2cdb Author: Junhui Liu Date: Tue Oct 21 17:41:39 2025 +0800 dt-bindings: interrupt-controller: Add Anlogic DR1V90 PLIC Add PLIC support for Anlogic DR1V90. Signed-off-by: Junhui Liu Signed-off-by: Thomas Gleixner Acked-by: Conor Dooley Link: https://patch.msgid.link/20251021-dr1v90-basic-dt-v3-4-5478db4f664a@pigmoral.tech commit 45cc441de72e61b92d5eed5a9851a0301a7469de Author: Krzysztof Kozlowski Date: Thu Nov 6 16:52:01 2025 +0100 irqchip/irq-bcm7038-l1: Remove unused reg_mask_status() reg_mask_status() is not referenced anywhere leading to W=1 warning: irq-bcm7038-l1.c:85:28: error: unused function 'reg_mask_status' [-Werror,-Wunused-function] Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thomas Gleixner Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251106155200.337399-2-krzysztof.kozlowski@linaro.org commit a045359e72455c4fd178fbedbf398f8df7da97e7 Author: Charles Mirabile Date: Mon Nov 3 11:18:13 2025 -0500 irqchip/sifive-plic: Fix call to __plic_toggle() in M-Mode code path The code path for M-Mode linux that disables interrupts for other contexts was missed when refactoring __plic_toggle(). Since the new version caches updates to the state for the primary context, its use in this codepath is no longer desireable even if it could be made correct. Replace the calls to __plic_toggle() with a loop that simply disables all of the interrupts in groups of 32 with a direct mmio write. Fixes: 14ff9e54dd14 ("irqchip/sifive-plic: Cache the interrupt enable state") Reported-by: kernel test robot Signed-off-by: Charles Mirabile Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20251103161813.2437427-1-cmirabil@redhat.com Closes: https://lore.kernel.org/oe-kbuild-all/202510271316.AQM7gCCy-lkp@intel.com/ commit 73f0769ebfc6473be084f0c52db25d2973097dd4 Author: George Kelly Date: Sat Nov 8 05:27:41 2025 -0500 ARM: dts: ti/omap: fix incorrect compatible string in internal eeprom node While the Beaglebone capes have the Atmel AT24C256 chip (256kbit or 32kB), the internal Beaglebone eeprom chip (i2c bus 0, addr 0x50), is an AT24C32 (32kbit or 4kB). Yet the device tree lists AT24C256 as the compatible chip prior to this patch. You can confirm this by running `sudo hexdump -C /sys/bus/nvmem/devices/0-00500/nvmem`. You can see the factory data is repeated every 0x1000 addresses (every 4096 bytes or 32768 bits). This is because the read command wraps around to reading 0x0000 when a user requests address 0x1000. This is not a huge issue for reading, but it is for writing to the EEPROM for two reasons: 1) If a user writes to addresses 0x1000 - 0x104e, they'll accidentally overwrite the factory data stored at 0x0000 - 0x104e. This also is an issue for writing to 0x2000 - 0x204e, and so on. 2) AT24C256 has 64-byte pages, but AT24C32 only has 32 byte pages. Thus, if you attempt to write more than 32 bytes, bytes 32-64 will wrap around. This causes your data in the actual EEPROM chip's bytes 0-32 to be overwritten by the data in your request's bytes 32-64, while the EEPROM chip's bytes 32-64 remain 0xFF (unwritten). Lastly, the Beaglebone Black's user manual does correctly mention that the internal EEPROM is 4kB (while capes are 32kB or 256kbit). It's just this bit of code that does not match. Signed-off-by: George Kelly Link: https://lore.kernel.org/r/20251108102741.47628-1-george.kelly1097@gmail.com Signed-off-by: Kevin Hilman commit 29c701f90b9341f1f9c1854a9c22b71c2318457d Author: Casey Schaufler Date: Tue Nov 11 12:00:18 2025 -0800 Smack: function parameter 'gfp' not described Add a descrition of the gfp parameter to smk_import_allocated_label(). Signed-off-by: Casey Schaufler Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511061746.dPegBnNf-lkp@intel.com/ commit df717b9564c8370e9198c9cd5d62e277a18563fb Author: Li Qiang Date: Fri Sep 19 11:33:27 2025 +0800 arm64: add unlikely hint to MTE async fault check in el0_svc_common Add unlikely() hint to the _TIF_MTE_ASYNC_FAULT flag check in el0_svc_common() since asynchronous MTE faults are expected to be rare occurrences during normal system call execution. This optimization helps the compiler to improve instruction caching and branch prediction for the common case where no asynchronous MTE faults are pending, while maintaining correct behavior for the exceptional case where such faults need to be handled prior to system call execution. Signed-off-by: Li Qiang Signed-off-by: Catalin Marinas commit 287d163322b743a50adcad25c851600c004f59e3 Author: Thomas Huth Date: Fri Oct 10 15:01:16 2025 +0200 arm64: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is a mostly mechanical patch (done with a simple "sed -i" statement), except for the following files where comments with mis-spelled macros were tweaked manually: arch/arm64/include/asm/stacktrace/frame.h arch/arm64/include/asm/kvm_ptrauth.h arch/arm64/include/asm/debug-monitors.h arch/arm64/include/asm/esr.h arch/arm64/include/asm/scs.h arch/arm64/include/asm/memory.h Signed-off-by: Thomas Huth Signed-off-by: Catalin Marinas commit 639f08fc20c92c2cc373b2b4d065185daa9633e3 Author: Thomas Huth Date: Fri Oct 10 15:01:15 2025 +0200 arm64: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. Signed-off-by: Thomas Huth Signed-off-by: Catalin Marinas commit 420cab0155033c14c5cb308d5078f93e3e8bf9b3 Author: Osama Abdelkader Date: Mon Nov 10 23:21:01 2025 +0200 arm64: acpi: add newline to deferred APEI warning missing newline in pr_warn_ratelimited in apei_claim_sea Signed-off-by: Osama Abdelkader Signed-off-by: Catalin Marinas commit 555827a0645641ec3fadfeb0bc3155ab79a84b11 Author: Linus Walleij Date: Wed Nov 5 15:27:01 2025 +0100 arm64: entry: Clean out some indirection The conversion to generic IRQ entry left some functions in the EL1 (kernel) IRQ entry path very shallow, so drop the __inner_functions() where appropriate, saving some time and stack. This is not a fix but an optimization. Drop stale comments about irqentry_enter/exit() while we are at it. Signed-off-by: Linus Walleij Signed-off-by: Catalin Marinas commit e2e21a9757b9035d9f649e464c0b254cbbe8a148 Author: Anshuman Khandual Date: Fri Oct 31 07:12:55 2025 +0000 arm64/mm: Ensure PGD_SIZE is aligned to 64 bytes when PA_BITS = 52 Although the comment clearly states about PGD table's alignment requirement (when PA_BITS = 52) but the subsequent BUILD_BUG_ON() tests size comparison to 64 bytes instead. So change it as an actual alignment test. Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit 578fe3ff3d5bc9d851d597bb12dd74c22ad55ff8 Author: Eric Biggers Date: Sun Nov 9 15:47:23 2025 -0800 crypto: testmgr - Remove polyval tests These are no longer used, since polyval support has been removed from the crypto_shash API. POLYVAL remains supported via lib/crypto/, where it has a KUnit test suite instead. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b3aed551b3fca753469520c95b6f4c61ada028d3 Author: Eric Biggers Date: Sun Nov 9 15:47:18 2025 -0800 lib/crypto: tests: Add KUnit tests for POLYVAL Add a test suite for the POLYVAL library, including: - All the standard tests and the benchmark from hash-test-template.h - Comparison with a test vector from the RFC - Test with key and message containing all one bits - Additional tests related to the key struct Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b2210f35161d6202fcca4244800a1d54c80e8bc1 Author: Eric Biggers Date: Sat Oct 25 22:50:23 2025 -0700 lib/crypto: tests: Add additional SHAKE tests Add the following test cases to cover gaps in the SHAKE testing: - test_shake_all_lens_up_to_4096() - test_shake_multiple_squeezes() - test_shake_with_guarded_bufs() Remove test_shake256_tiling() and test_shake256_tiling2() since they are superseded by test_shake_multiple_squeezes(). It provides better test coverage by using randomized testing. E.g., it's able to generate a zero-length squeeze followed by a nonzero-length squeeze, which the first 7 versions of the SHA-3 patchset handled incorrectly. Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 15c64c47e48472875c2b85838581843f05057787 Author: David Howells Date: Sat Oct 25 22:50:22 2025 -0700 lib/crypto: tests: Add SHA3 kunit tests Add a SHA3 kunit test suite, providing the following: (*) A simple test of each of SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128 and SHAKE256. (*) NIST 0- and 1600-bit test vectors for SHAKE128 and SHAKE256. (*) Output tiling (multiple squeezing) tests for SHAKE256. (*) Standard hash template test for SHA3-256. To make this possible, gen-hash-testvecs.py is modified to support sha3-256. (*) Standard benchmark test for SHA3-256. [EB: dropped some unnecessary changes to gen-hash-testvecs.py, moved addition of Testing section in doc file into this commit, and other small cleanups] Signed-off-by: David Howells Reviewed-by: Ard Biesheuvel Tested-by: Harald Freudenberger Link: https://lore.kernel.org/r/20251026055032.1413733-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6401fd334ddf5e2035a0dca27cd761974d568fcd Author: Eric Biggers Date: Fri Oct 17 21:31:04 2025 -0700 lib/crypto: tests: Add KUnit tests for BLAKE2b Add a KUnit test suite for the BLAKE2b library API, mirroring the BLAKE2s test suite very closely. As with the BLAKE2s test suite, a benchmark is included. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251018043106.375964-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2dbb6f4a25d38fcf7d6c1c682e45a13e6bbe9562 Author: Eric Biggers Date: Sun Nov 9 15:47:24 2025 -0800 fscrypt: Drop obsolete recommendation to enable optimized POLYVAL CONFIG_CRYPTO_POLYVAL_ARM64_CE and CONFIG_CRYPTO_POLYVAL_CLMUL_NI no longer exist. The architecture-optimized POLYVAL code is now just enabled automatically when HCTR2 support is enabled. Update the fscrypt documentation accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit fd36de5749244c66f55eb943a5bbedbd9d6dd385 Author: Eric Biggers Date: Sun Nov 9 15:47:22 2025 -0800 crypto: polyval - Remove the polyval crypto_shash Remove polyval support from crypto_shash. It no longer has any user now that the HCTR2 code uses the POLYVAL library instead. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d35abc0b1ddff64934dc6ab637f7b5ce1cd1d91f Author: Eric Biggers Date: Sun Nov 9 15:47:21 2025 -0800 crypto: hctr2 - Convert to use POLYVAL library The "hash function" in hctr2 is fixed at POLYVAL; it can never vary. Just use the POLYVAL library, which is much easier to use than the crypto_shash API. It's faster, uses fixed-size structs, and never fails (all the functions return void). Note that this eliminates the only known user of the polyval support in crypto_shash. A later commit will remove support for polyval from crypto_shash, given that the library API is sufficient. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4d8da35579daad0392d238460ed7e9629d49ca35 Author: Eric Biggers Date: Sun Nov 9 15:47:20 2025 -0800 lib/crypto: x86/polyval: Migrate optimized code into library Migrate the x86_64 implementation of POLYVAL into lib/crypto/, wiring it up to the POLYVAL library interface. This makes the POLYVAL library be properly optimized on x86_64. This drops the x86_64 optimizations of polyval in the crypto_shash API. That's fine, since polyval will be removed from crypto_shash entirely since it is unneeded there. But even if it comes back, the crypto_shash API could just be implemented on top of the library API, as usual. Adjust the names and prototypes of the assembly functions to align more closely with the rest of the library code. Also replace a movaps instruction with movups to remove the assumption that the key struct is 16-byte aligned. Users can still align the key if they want (and at least in this case, movups is just as fast as movaps), but it's inconvenient to require it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 37919e239ebb2cba573cca56292f7c39fa6d7415 Author: Eric Biggers Date: Sun Nov 9 15:47:19 2025 -0800 lib/crypto: arm64/polyval: Migrate optimized code into library Migrate the arm64 implementation of POLYVAL into lib/crypto/, wiring it up to the POLYVAL library interface. This makes the POLYVAL library be properly optimized on arm64. This drops the arm64 optimizations of polyval in the crypto_shash API. That's fine, since polyval will be removed from crypto_shash entirely since it is unneeded there. But even if it comes back, the crypto_shash API could just be implemented on top of the library API, as usual. Adjust the names and prototypes of the assembly functions to align more closely with the rest of the library code. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3d176751e541362ff40c2478d6a2de41f8c62318 Author: Eric Biggers Date: Sun Nov 9 15:47:17 2025 -0800 lib/crypto: polyval: Add POLYVAL library Add support for POLYVAL to lib/crypto/. This will replace the polyval crypto_shash algorithm and its use in the hctr2 template, simplifying the code and reducing overhead. Specifically, this commit introduces the POLYVAL library API and a generic implementation of it. Later commits will migrate the existing architecture-optimized implementations of POLYVAL into lib/crypto/ and add a KUnit test suite. I've also rewritten the generic implementation completely, using a more modern approach instead of the traditional table-based approach. It's now constant-time, requires no precomputation or dynamic memory allocations, decreases the per-key memory usage from 4096 bytes to 16 bytes, and is faster than the old polyval-generic even on bulk data reusing the same key (at least on x86_64, where I measured 15% faster). We should do this for GHASH too, but for now just do it for POLYVAL. Reviewed-by: Ard Biesheuvel Tested-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e1c360849794c2e638cff5486e4ee256568dd3b3 Author: Eric Biggers Date: Sun Nov 9 15:47:16 2025 -0800 crypto: polyval - Rename conflicting functions Rename polyval_init() and polyval_update(), in preparation for adding library functions with the same name to . Note that polyval-generic.c will be removed later, as it will be superseded by the library. This commit just keeps the kernel building for the initial introduction of the library. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a5baf582f4c026c25a206ac121bceade926aec74 Author: Ard Biesheuvel Date: Wed Oct 15 22:56:42 2025 +0200 arm64/efi: Call EFI runtime services without disabling preemption The only remaining reason why EFI runtime services are invoked with preemption disabled is the fact that the mm is swapped out behind the back of the context switching code. The kernel no longer disables preemption in kernel_neon_begin(). Furthermore, the EFI spec is being clarified to explicitly state that only baseline FP/SIMD is permitted in EFI runtime service implementations, and so the existing kernel mode NEON context switching code is sufficient to preserve and restore the execution context of an in-progress EFI runtime service call. Most EFI calls are made from the efi_rts_wq, which is serviced by a kthread. As kthreads never return to user space, they usually don't have an mm, and so we can use the existing infrastructure to swap in the efi_mm while the EFI call is in progress. This is visible to the scheduler, which will therefore reactivate the selected mm when switching out the kthread and back in again. Given that the EFI spec explicitly permits runtime services to be called with interrupts enabled, firmware code is already required to tolerate interruptions. So rather than disable preemption, disable only migration so that EFI runtime services are less likely to cause scheduling delays. To avoid potential issues where runtime services are interrupted while polling the secure firmware for async completions, keep migration disabled so that a runtime service invocation does not resume on a different CPU from the one it was started on. Note, though, that the firmware executes at the same privilege level as the kernel, and is therefore able to disable interrupts altogether. Acked-by: Will Deacon Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 6b9c98e657559408beecde41a532c5bb4cf281bc Author: Ard Biesheuvel Date: Wed Oct 15 22:56:41 2025 +0200 arm64/efi: Move uaccess en/disable out of efi_set_pgd() efi_set_pgd() will no longer be called when invoking EFI runtime services via the efi_rts_wq work queue, but the uaccess en/disable are still needed when using PAN emulation using TTBR0 switching. So move these into the callers. Acked-by: Will Deacon Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 1068cb52e8ef4e21a31095dc932685a543b779bc Author: Ard Biesheuvel Date: Wed Oct 15 22:56:40 2025 +0200 arm64/efi: Drop efi_rt_lock spinlock from EFI arch wrapper Since commit 5894cf571e14 ("acpi/prmt: Use EFI runtime sandbox to invoke PRM handlers") all EFI runtime calls on arm64 are routed via the EFI runtime wrappers, which are serialized using the efi_runtime_lock semaphore. This means the efi_rt_lock spinlock in the arm64 arch wrapper code has become redundant, and can be dropped. For robustness, replace it with an assert that the EFI runtime lock is in fact held by 'current'. Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 7137a203b2515bdbeae1cf13446bdce17db2c2f7 Author: Ard Biesheuvel Date: Wed Oct 15 22:56:39 2025 +0200 arm64/fpsimd: Permit kernel mode NEON with IRQs off Currently, may_use_simd() will return false when called from a context where IRQs are disabled. One notable case where this happens is when calling the ResetSystem() EFI runtime service from the reboot/poweroff code path. For this case alone, there is a substantial amount of FP/SIMD support code to handle the corner case where a EFI runtime service is invoked with IRQs disabled. The only reason kernel mode SIMD is not allowed when IRQs are disabled is that re-enabling softirqs in this case produces a noisy diagnostic when lockdep is enabled. The warning is valid, in the sense that delivering pending softirqs over the back of the call to local_bh_enable() is problematic when IRQs are disabled. While the API lacks a facility to simply mask and unmask softirqs without triggering their delivery, disabling softirqs is not needed to begin with when IRQs are disabled, given that softirqs are only every taken asynchronously over the back of a hard IRQ. So dis/enable softirq processing conditionally, based on whether IRQs are enabled, and relax the check in may_use_simd(). Acked-by: Will Deacon Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 1d038e801833f6dcfd4b18d59f96eca5a963a816 Author: Ard Biesheuvel Date: Wed Oct 15 22:56:38 2025 +0200 arm64/fpsimd: Don't warn when EFI execution context is preemptible Kernel mode FP/SIMD no longer requires preemption to be disabled, so only warn on uses of FP/SIMD from preemptible context if the fallback path is taken for cases where kernel mode NEON would not be allowed otherwise. Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit a2860501203cf7a2116adf3bb4e4c456c5750872 Author: Ard Biesheuvel Date: Wed Oct 15 22:56:37 2025 +0200 efi/runtime-wrappers: Keep track of the efi_runtime_lock owner The EFI runtime wrappers use a file local semaphore to serialize access to the EFI runtime services. This means that any calls to the arch wrappers around the runtime services will also be serialized, removing the need for redundant locking. For robustness, add a facility that allows those arch wrappers to assert that the semaphore was taken by the current task. Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 40374d308e4e456048d83991e937f13fc8bda8bf Author: Ard Biesheuvel Date: Wed Oct 15 22:56:36 2025 +0200 efi: Add missing static initializer for efi_mm::cpus_allowed_lock Initialize the cpus_allowed_lock struct member of efi_mm. Cc: stable@vger.kernel.org Signed-off-by: Ard Biesheuvel Acked-by: Catalin Marinas Signed-off-by: Catalin Marinas commit 01a743550b46eba1dacbd593ccc094781b882d76 Author: Bert Karwatzki Date: Tue Nov 11 18:01:43 2025 +0100 cgroup: include missing header for struct irq_work To compile cgroup.c with PREEMPT_RT=y include header which declares struct irq_work. Fixes: 9311e6c29b34 ("cgroup: Fix sleeping from invalid context warning on PREEMPT_RT") Signed-off-by: Bert Karwatzki Signed-off-by: Tejun Heo commit 2b0d5d9b39489b9d8171896e8e24d8632c3dc807 Merge: 23523e9398efee 32172cf3cb543a Author: Mark Brown Date: Tue Nov 11 18:46:59 2025 +0000 ASoC: cs35l56: Support for restoring calibration on Merge series from Richard Fitzgerald : These two patches add ALSA controls to support restoring factory calibration during OS boot on ChromeOS. ChromeOS applies calibration during boot using a process that has restricted access permissions. This process needs ALSA controls for all settings that it must restore. commit 23523e9398efeee6a5741cf97052babf6fb2a808 Merge: b3a53024840333 873bc94689d832 Author: Mark Brown Date: Tue Nov 11 18:21:20 2025 +0000 ASoC: Intel: machine driver updates for 6.19 Merge series from Bard Liao : Add supports for new audio configurations on Intel platforms. commit cb46a58d77e5b433e9f4538faaa2a73970157e8d Author: Breno Leitao Date: Fri Oct 10 03:44:04 2025 -0700 efi/memattr: Convert efi_memattr_init() return type to void The efi_memattr_init() function's return values (0 and -ENOMEM) are never checked by callers. Convert the function to return void since the return status is unused. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Signed-off-by: Ard Biesheuvel commit 793b13541c2f47cc4822e2567ab4113a4d931c56 Author: Randy Dunlap Date: Mon Nov 10 22:02:12 2025 -0800 efi: stmm: fix kernel-doc "bad line" warnings Add a beginning " *" to each line to avoid kernel-doc warnings: Warning: drivers/firmware/efi/stmm/mm_communication.h:34 bad line: Warning: drivers/firmware/efi/stmm/mm_communication.h:113 bad line: Warning: drivers/firmware/efi/stmm/mm_communication.h:130 bad line: Fixes: c44b6be62e8d ("efi: Add tee-based EFI variable driver") Signed-off-by: Randy Dunlap Acked-by: Ilias Apalodimas Signed-off-by: Ard Biesheuvel commit 935f94ccb95b81517c73042f44a5d9396bd20dc4 Author: Qiang Ma Date: Fri Oct 31 10:43:28 2025 +0800 efi/riscv: Remove the useless failure return message print In the efi_create_mapping() in arch/riscv/kernel/efi.c, the return value is always 0, and this debug message is unnecessary. So, remove it. Signed-off-by: Qiang Ma Signed-off-by: Ard Biesheuvel commit 1e396bbf132ee9136afa8d0a52a2d39797078931 Author: Ville Syrjälä Date: Mon Nov 10 19:27:55 2025 +0200 drm/i915/dpio: Use the intel_de_wait_ms() out value Utilize the 'out_value' output parameter of intel_de_wait_ms() instead of re-reading the DPLL/DPIO_PHY_STATUS register after polling has finished. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-17-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 7f8e97670fc9d84fb7e54327d6c678beeb5598ba Author: Ville Syrjälä Date: Mon Nov 10 19:27:54 2025 +0200 drm/i915/power: Use the intel_de_wait_ms() out value Utilize the 'out_value' output parameter of intel_de_wait_ms() instead of re-reading the PHY_CONTROL register after polling has finished. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-16-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit d7659d92eb6ecb2f881beffb1d7180389d3e4680 Author: Ville Syrjälä Date: Mon Nov 10 19:27:53 2025 +0200 drm/i915/de: Replace __intel_de_wait_for_register_nowl() with intel_de_wait_fw_us_atomic() Nuke the remaining _nowl() stuff from the wakelock code in the form of __intel_de_wait_for_register_nowl(), and replace it with intel_de_wait_fw_us_atomic() that uses the low level _fw() register accessors in line with the rest of the code. No change in behaviour since wakelocks are only supported on xe, and xe doesn't have uncore.lock nor unclaimed register detection stuff. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-15-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 93daf133030bfdcd536efa122ee26159f7e0ac10 Merge: cc7bcbb5adbdcf 739f04f4a46237 Author: Ulf Hansson Date: Tue Nov 11 18:34:14 2025 +0100 mmc: Merge branch fixes into next Merge the mmc fixes for v6.18-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.19. Signed-off-by: Ulf Hansson commit 431fba465b84a998e0960713c8ff615fb498a043 Author: Ville Syrjälä Date: Mon Nov 10 19:27:52 2025 +0200 drm/i915/de: Nuke wakelocks from intel_de_wait_fw_ms() The low level _fw() register accessors aren't supposed to grab the wakelock. Stop doing so in intel_de_wait_fw_ms(). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-14-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 2206c5b850ec629f153c00f7afc515deb74d370d Author: Ville Syrjälä Date: Mon Nov 10 19:27:51 2025 +0200 drm/i915/de: Replace __intel_de_rmw_nowl() with intel_de_rmw_fw() We already have the lower level intel_de_*_fw() stuff, so use that instead of hand rolling something custom for the DMC wakelock stuff. As the wakelock stuff exists only on platforms supported by the xe driver this doesn't even result in any functional changes since xe doesn't have uncore.lock nor unclaimed register access detection. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-13-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 864787d5099d1d6ef08ca585638f1a9787a69a15 Author: Ville Syrjälä Date: Mon Nov 10 19:27:50 2025 +0200 drm/1915/dpio: Stop using intel_de_wait_fw_ms() _bxt_dpio_phy_init() doesn't us the _fw() register accessors for anything else, so stop using them for the register polling as well. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-12-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 6be05d5b286a4dc8710148cd4152e5e04cafddb2 Author: Ville Syrjälä Date: Mon Nov 10 19:27:49 2025 +0200 drm/i915/de: Use intel_de_wait_for_{set,clear}_ms() Use intel_de_wait_for_{set,clear}_ms() instead of intel_de_wait_ms() where appropriate. Done with cocci (with manual formatting fixes): @@ identifier func !~ "intel_de_wait_for"; expression display, reg, mask, timeout_ms; @@ func(...) { <... ( - intel_de_wait_ms(display, reg, mask, mask, timeout_ms, NULL) + intel_de_wait_for_set_ms(display, reg, mask, timeout_ms) | - intel_de_wait_ms(display, reg, mask, 0, timeout_ms, NULL) + intel_de_wait_for_clear_ms(display, reg, mask, timeout_ms) ) ...> } Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-11-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 0aed9d3454ab2ce916f404e7f1b99f71e297c4a7 Author: Ville Syrjälä Date: Mon Nov 10 19:27:48 2025 +0200 drm/i915/de: Use intel_de_wait_for_{set,clear}_us() Use intel_de_wait_for_{set,clear}_us() instead of intel_de_wait_us() where appropriate. Done with cocci (with manual formatting fixes): @@ identifier func !~ "intel_de_wait_for"; expression display, reg, mask, timeout_us; @@ func(...) { <... ( - intel_de_wait_us(display, reg, mask, mask, timeout_us, NULL) + intel_de_wait_for_set_us(display, reg, mask, timeout_us) | - intel_de_wait_us(display, reg, mask, 0, timeout_us, NULL) + intel_de_wait_for_clear_us(display, reg, mask, timeout_us) ) ...> } Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-10-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 58a43c91c275d727290192affd3b3138a7e615ab Author: Ville Syrjälä Date: Mon Nov 10 19:27:47 2025 +0200 drm/i915/de: Introduce intel_de_wait_for_{set,clear}_us() Add intel_de_wait_for_set_us() and intel_de_wait_for_clear_us() as the microsecond counterparts to intel_de_wait_for_set_ms() and intel_de_wait_for_clear_ms(). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-9-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit c6e73b62548bbc846201584c2c853a0e6fc162d3 Author: Ville Syrjälä Date: Mon Nov 10 19:27:46 2025 +0200 drm/i915/de: Nuke intel_de_wait_custom() intel_de_wait_custom() is finally unused. Get rid of it before people start abusing it more. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-8-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 8da977a2f2d5fdb2bf3777ff5312b3297792ddf0 Author: Ville Syrjälä Date: Mon Nov 10 19:27:45 2025 +0200 drm/i915/de: Use intel_de_wait_ms() for the obvious cases Replace some users of intel_de_wait_custom() with intel_de_wait_ms(). This includes the cases where we pass in the default 2 microsecond fast timeout, which is also what intel_de_wait_ms() uses so there are no functional changes here. Done with cocci (with manual formatting fixes): @@ expression display, reg, mask, value, timeout_ms, out_value; @@ - intel_de_wait_custom(display, reg, mask, value, 2, timeout_ms, out_value) + intel_de_wait_ms(display, reg, mask, value, timeout_ms, out_value) Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-7-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 45554c1c6428a76536d6233a86080512270b8c5d Author: Ville Syrjälä Date: Mon Nov 10 19:27:44 2025 +0200 drm/i915/de: Use intel_de_wait_us() Convert some of the intel_de_wait_custom() users over to intel_de_wait_us(). We'll eventually want to eliminate intel_de_wait_custom() as it's a hinderance towards using poll_timeout_us(). This includes all the obvious cases where we only specify a microsecond timeout to intel_de_wait_custom(). Done with cocci (with manual formatting fixes): @@ expression display, reg, mask, value, timeout_us, out_value; @@ - intel_de_wait_custom(display, reg, mask, value, timeout_us, 0, out_value) + intel_de_wait_us(display, reg, mask, value, timeout_us, out_value) Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-6-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit c6494d16f20ba1ccc978461d11351f4f5bcf852a Author: Ville Syrjälä Date: Mon Nov 10 19:27:43 2025 +0200 drm/i915/de: Introduce intel_de_wait_us() Introduce intel_de_wait_us() as the microsecond based counterpart to the millisecond based intel_de_wait_ms(). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-5-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 93e0f7c8a9b3d2a29092e8c3d55008f5ead919e5 Author: Ville Syrjälä Date: Mon Nov 10 19:27:42 2025 +0200 drm/i915/de: Include units in intel_de_wait*() function names intel_de_wait*() take the timeout in milliseconds. Include that information in the function name to make life less confusing. I'll also be introducing microsecond variants of these later. Done with cocci: @@ @@ ( static int - intel_de_wait + intel_de_wait_ms (...) { ... } | static int - intel_de_wait_fw + intel_de_wait_fw_ms (...) { ... } | static int - intel_de_wait_for_set + intel_de_wait_for_set_ms (...) { ... } | static int - intel_de_wait_for_clear + intel_de_wait_for_clear_ms (...) { ... } ) @@ @@ ( - intel_de_wait + intel_de_wait_ms | - intel_de_wait_fw + intel_de_wait_fw_ms | - intel_de_wait_for_set + intel_de_wait_for_set_ms | - intel_de_wait_for_clear + intel_de_wait_for_clear_ms ) Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-4-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit 462c1104db26ecb68014d617e716646010de5c55 Author: Ville Syrjälä Date: Mon Nov 10 19:27:41 2025 +0200 drm/i915/de: Have intel_de_wait() hand out the final register value We currently have a bunch of places that want the final register value after register polling. Currently those places are mostly using intel_de_wait_custom(). That is not a function that we want to keep around as it pretty much prevents conversion to poll_timeout_us(). Have intel_de_wait() also return the final register value so that some of the current users can be converted over to the simpler interface. Done with cocci: @@ @@ int intel_de_wait(... + ,u32 *out_value ) { ... __intel_wait_for_register(..., - NULL + out_value ) ... } @@ @@ intel_de_wait(... + ,NULL ) Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-3-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit d294e4ab22d4e74667b3fa740c63ddbafb3d9fd0 Author: Ville Syrjälä Date: Mon Nov 10 19:27:40 2025 +0200 drm/i915/de: Implement register waits one way Currently we use a messy mix of intel_wait_for_register*() and __intel_wait_for_register*() to implement various register polling functions. Make the mess a bit more understandable by always using the __intel_wait_for_register*() stuff. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251110172756.2132-2-ville.syrjala@linux.intel.com Reviewed-by: Suraj Kandpal Acked-by: Jani Nikula commit cc7bcbb5adbdcf5fa7e9f4b49fd80e3b992b7d58 Author: Marco Crivellari Date: Fri Nov 7 15:19:07 2025 +0100 mmc: omap: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Ulf Hansson commit 070f0336d19d36d91c3ed4c5cfb25798a0f32fbd Author: Marco Crivellari Date: Wed Nov 5 15:58:24 2025 +0100 mmc: mtk-sd: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Replace system_wq with system_percpu_wq, keeping the same old behavior. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 5f87aaf5b62e30539dae41371f15730db549bc9b Author: Shawn Lin Date: Tue Nov 4 16:41:53 2025 +0800 mmc: core: Allow more host caps to be modified through debugfs This makes various signal and function tests more convenient without the need to modify the DTB. /sys/kernel/debug/mmc0# echo $(($(cat caps) | (1 << 7))) > caps /sys/kernel/debug/mmc0# echo on > /sys/bus/mmc/devices/mmc0\:0001/power/control /sys/kernel/debug/mmc0# echo auto > /sys/bus/mmc/devices/mmc0\:0001/power/control // Disable 8-bit support echo $(($(cat caps) & ~(1 << 6))) > caps // Enable 8-bit support echo $(($(cat caps) | (1 << 6))) > caps // Disable 4-bit support echo $(($(cat caps) & ~(1 << 0))) > caps // Enable 4-bit support echo $(($(cat caps) | (1 << 0))) > caps // Disable CMD23 support echo $(($(cat caps) & ~(1 << 30))) > caps // Enable CMD23 support echo $(($(cat caps) | (1 << 30))) > caps // Disable CMD23 support echo $(($(cat caps) & ~(1 << 30))) > caps // Enable CMD23 support echo $(($(cat caps) | (1 << 30))) > caps // Disable CQE support echo $(($(cat caps2) & ~(1 << 23))) > caps2 // Enable CQE support echo $(($(cat caps2) | (1 << 23))) > caps2 // Disable CQE DCMD support echo $(($(cat caps2) & ~(1 << 24))) > caps2 // Enable CQE DCMD support echo $(($(cat caps2) | (1 << 24))) > caps2 /sys/kernel/debug/mmc0# echo on > /sys/bus/mmc/devices/mmc0\:0001/power/control /sys/kernel/debug/mmc0# cat ios Signed-off-by: Shawn Lin Signed-off-by: Ulf Hansson commit 1088d49b626487777913079bef0db3adef4bfb4a Author: Conor Dooley Date: Wed Nov 5 10:24:24 2025 +0000 riscv: dts: microchip: enable qspi adc/mmc-spi-slot on BeagleV Fire The BeagleV Fire has an SD card slot and an ADC connected to the QSPI controller. Signed-off-by: Conor Dooley commit 66c6ceb41ed375773491c5d024167a2cbe6fe944 Author: Conor Dooley Date: Mon Nov 10 11:23:54 2025 +0000 MAINTAINERS: rename Microchip RISC-V entry There's now non-FPGA RISC-V SoCs from Microchip, so rename the entry to reflect that. Signed-off-by: Conor Dooley commit 587c0a5e810b72c93fa44ee06d60dd555f52360b Author: Conor Dooley Date: Mon Nov 10 11:23:53 2025 +0000 MAINTAINERS: add new soc drivers to Microchip RISC-V entry Add the two new syscon drivers to the RISC-V entry for Microchip platforms. Signed-off-by: Conor Dooley commit 781f60e45bdfe351aad692ac0fa89e36f8bf4a36 Author: Conor Dooley Date: Mon Nov 10 11:23:50 2025 +0000 reset: mpfs: add non-auxiliary bus probing While the auxiliary bus was a nice bandaid, and meant that re-writing the representation of the clock regions in devicetree was not required, it has run its course. The "mss_top_sysreg" region that contains the clock and reset regions, also contains pinctrl and an interrupt controller, so the time has come rewrite the devicetree and probe the reset controller from an mfd devicetree node, rather than implement those drivers using the auxiliary bus. Wanting to avoid propagating this naive/incorrect description of the hardware to the new pic64gx SoC is a major motivating factor here. Reviewed-by: Philipp Zabel Acked-by: Philipp Zabel Signed-off-by: Conor Dooley commit fda1e0af7c28f96d4f33e57cf51565b0e9c14e63 Author: Sebastian Reichel Date: Fri Oct 31 16:58:23 2025 +0100 mmc: sdhci-of-dwcmshc: Add command queue support for rockchip SOCs This adds CQE support for the Rockchip RK3588 and RK3576 platform. To be functional, the eMMC device-tree node must have a 'supports-cqe;' flag property. As the RK3576 device-tree has been upstreamed with the 'supports-cqe;' property set by default, the kernel already tried to use CQE, which results in system hang during suspend. This fixes the issue. Co-developed-by: Yifeng Zhao Signed-off-by: Yifeng Zhao Signed-off-by: Sebastian Reichel Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit eadea8e134d4fc0d770ae14132d8b0e48f8c429d Author: Charan Pedumuru Date: Mon Oct 27 16:46:16 2025 +0000 dt-bindings: mmc: socionext,milbeaut-m10v-sdhci-3.0: convert to DT schema Convert SOCIONEXT Milbeaut SDHCI controller binding to YAML format. Add a new property "voltage-ranges" to resolve dt_check errors. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 262991d938ac144a38e87e05529e035051ba1c29 Author: Charan Pedumuru Date: Thu Oct 23 13:19:43 2025 +0000 dt-bindings: mmc: ti,da830-mmc: convert to DT schema Convert TI Highspeed MMC host controller binding to YAML format. Define 'clocks' and 'interrupts' properties to resolve errors identified by 'dt_check' and 'dtb_check'. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson commit 32b2633219d3509d8174737bb0a8afa060e55655 Author: Huan He Date: Sun Oct 19 19:53:16 2025 +0800 mmc: sdhci-of-dwcmshc: Add support for Eswin EIC7700 Add support for the mmc controller in the Eswin EIC7700 with the new compatible "eswin,eic7700-dwcmshc". Implement custom sdhci_ops for set_clock, reset, set_uhs_signaling, platform_execute_tuning. Signed-off-by: Huan He Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 30009a21f257a02feea7a7708ef3d0118e7f824a Author: Huan He Date: Sun Oct 19 19:52:38 2025 +0800 dt-bindings: mmc: sdhci-of-dwcmshc: Add Eswin EIC7700 EIC7700 use Synopsys dwcmshc IP for SD/eMMC controllers. Add Eswin EIC7700 support in sdhci-of-dwcmshc.yaml. Signed-off-by: Huan He Reviewed-by: Conor Dooley Signed-off-by: Ulf Hansson commit 65177ea9f64d7402a0b8028e0dbbd01e8a9d1b1d Author: Shrikanth Hegde Date: Tue Oct 14 15:33:41 2025 +0530 sched/deadline: Minor cleanup in select_task_rq_dl() In select_task_rq_dl, there is only one goto statement, there is no need for it. No functional changes. Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Link: https://patch.msgid.link/20251014100342.978936-2-sshegde@linux.ibm.com commit b4bfacd39216755c058f6d13c71c86a9bf5a1631 Author: Shrikanth Hegde Date: Tue Oct 14 15:33:42 2025 +0530 sched/deadline: Use cpumask_weight_and() in dl_bw_cpus cpumask_subset(a,b) -> cpumask_weight(a) should be same as cpumask_weight_and(a,b) for_each_cpu_and(a,b) to count cpus could be replaced by cpumask_weight_and(a,b) No Functional Change. It could save a few cycles since cpumask_weight_and would be more efficient. Plus one less stack variable. Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Link: https://patch.msgid.link/20251014100342.978936-3-sshegde@linux.ibm.com commit 2614069c5912e9d6f1f57c262face1b368fb8c93 Author: Peter Zijlstra Date: Mon Nov 3 11:25:52 2025 +0100 sched/deadline: Document dl_server Place the notes that resulted from going through the dl_server code in a comment. Signed-off-by: Peter Zijlstra (Intel) commit fdc1dc7dd53b95805d3943ed36785c1ec812915e Author: Laurentiu Mihalcea Date: Tue Nov 4 04:02:56 2025 -0800 clk: imx: add driver for imx8ulp's sim lpav The i.MX8ULP System Integration Module (SIM) LPAV module is a block control module found inside the LPAV subsystem, which offers some clock gating options and reset line assertion/de-assertion capabilities. Therefore, the clock gate management is supported by registering the module's driver as a clock provider, while the reset capabilities are managed via the auxiliary device API to allow the DT node to act as a reset and clock provider. Signed-off-by: Laurentiu Mihalcea Reviewed-by: Daniel Baluta Reviewed-by: Peng Fan Link: https://lore.kernel.org/r/20251104120301.913-4-laurentiumihalcea111@gmail.com Signed-off-by: Abel Vesa commit 3b521bf8c51246466e2c337f1f2b60acfdfe82d6 Author: Laurentiu Mihalcea Date: Tue Nov 4 04:02:55 2025 -0800 dt-bindings: clock: document 8ULP's SIM LPAV Add documentation for i.MX8ULP's SIM LPAV module. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Link: https://lore.kernel.org/r/20251104120301.913-3-laurentiumihalcea111@gmail.com Signed-off-by: Abel Vesa commit 186b8f8fcc86949eaf0c3bd11a47048ec4c78b5b Author: Gabor Juhos Date: Tue Nov 11 08:40:11 2025 +0100 soc: qcom: mdt_loader: rename 'firmware' parameter of qcom_mdt_load() In the 'mdt_loader.h' header, both the prototype and the inline version of the qcom_mdt_load() function uses 'fw_name' as name for the firmware name parameter. Additionally, the other qcom_mdt_* functions are using that as well. For consistency, rename the 'firmware' parameter in the implementation of the qcom_mdt_load() to 'fw_name' and update the function accordingly. No functional changes. Signed-off-by: Gabor Juhos Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251111-mdt-loader-cleanup-v1-2-71afee094dce@gmail.com Signed-off-by: Bjorn Andersson commit 0cda8823b176a5303a2c4bc2366908e3049c416e Author: Gabor Juhos Date: Tue Nov 11 08:40:10 2025 +0100 soc: qcom: mdt_loader: merge __qcom_mdt_load() and qcom_mdt_load_no_init() The qcom_mdt_load_no_init() function is just a simple wrapper around of __qcom_mdt_load(). Since commit 0daf35da397b ("soc: qcom: mdt_loader: Remove pas id parameter") both functions are using the same type of parameters and providing the same functionality. Keeping two functions for the same purpose is superfluous, so rename the __qcom_mdt_load() function to qcom_mdt_load_no_init() and remove the wrapper. No functional changes. Signed-off-by: Gabor Juhos Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20251111-mdt-loader-cleanup-v1-1-71afee094dce@gmail.com Signed-off-by: Bjorn Andersson commit b2c1dd6c6f70a5a519532227358c82d4cfda5b36 Author: Borislav Petkov (AMD) Date: Thu Oct 30 17:59:11 2025 +0100 x86/coco/sev: Convert has_cpuflag() to use cpu_feature_enabled() Drop one redundant definition, while at it. There should be no functional changes. Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20251031122122.GKaQSpwhLvkinKKbjG@fat_crate.local commit dfd1572a64c90770a2bddfab9bbb69932217b1da Author: Sean Christopherson Date: Thu Nov 6 12:51:14 2025 -0800 KVM: VMX: Make loaded_vmcs_clear() static in vmx.c Make loaded_vmcs_clear() local to vmx.c as there are no longer any external callers. No functional change intended. Link: https://patch.msgid.link/20251106205114.218226-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 6d7e3870af11c2b5966b2769f9e8a0d4764f52cc Author: Kriish Sharma Date: Tue Nov 11 11:58:10 2025 +0000 blk-mq-dma: fix kernel-doc function name for integrity DMA iterator Documentation build reported: Warning: block/blk-mq-dma.c:373 expecting prototype for blk_rq_integrity_dma_map_iter_start(). Prototype was for blk_rq_integrity_dma_map_iter_next() instead The kernel-doc comment above `blk_rq_integrity_dma_map_iter_next()` used the wrong function name (`blk_rq_integrity_dma_map_iter_start`) in its header. This patch corrects the function name in the kernel-doc block to match the actual implementation, ensuring clean documentation builds. Fixes: fec9b16dc555 ("blk-mq-dma: add scatter-less integrity data DMA mapping") Signed-off-by: Kriish Sharma Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit fd9ecd005252b595fd02ff7fcc4056251027404d Author: Keith Busch Date: Tue Nov 11 06:06:20 2025 -0800 block: fix merging data-less bios The data segment gaps the block layer tracks doesn't apply to bio's that don't have data. Skip calculating this to fix a NULL pointer access. Fixes: 2f6b2565d43cdb5 ("block: accumulate memory segment gaps per bio") Reported-by: Matthew Wilcox Signed-off-by: Keith Busch Reviewed-by: Yu Kuai Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit aee4d5a521e94f658e46c904e08a473daa9c8fc0 Author: YangWen Date: Fri Oct 31 00:20:45 2025 +0800 ntfs3: fix double free of sbi->options->nls and clarify ownership of fc->fs_private commit 02f312754c87 ("ntfs3: fix use-after-free of sbi->options in cmp_fnames") introduced a use-after-free bug due to improper handling of sbi->options in error paths. This resulted in crashes when superblock cleanup is performed in ntfs_put_super. This patch ensures that the options structure and its subfields are properly freed, preventing the memory corruption and use-after-free errors. Fixes: 02f312754c87 ("ntfs3: fix use-after-free of sbi->options in cmp_fnames") Reported-by: syzbot+cc433e4cd6d54736bf80@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cc433e4cd6d54736bf80 Signed-off-by: YangWen [almaz.alexandrovich@paragon-software.com: added fixes and closes tags] Signed-off-by: Konstantin Komarov commit a8a3ca23bbd9d849308a7921a049330dc6c91398 Author: Bartlomiej Kubik Date: Wed Nov 5 22:18:08 2025 +0100 fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized values detected: - KMSAN: uninit-value in ntfs_read_hdr (3) - KMSAN: uninit-value in bcmp (3) Memory is allocated by __getname(), which is a wrapper for kmem_cache_alloc(). This memory is used before being properly cleared. Change kmem_cache_alloc() to kmem_cache_zalloc() to properly allocate and clear memory before use. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations") Tested-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com Reported-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=332bd4e9d148f11a87dc Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations") Tested-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com Reported-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0399100e525dd9696764 Reviewed-by: Khalid Aziz Signed-off-by: Bartlomiej Kubik Signed-off-by: Konstantin Komarov commit bd5603eaae0aabf527bfb3ce1bb07e979ce5bd50 Author: Joanne Koong Date: Fri Oct 10 15:07:38 2025 -0700 fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open. However in doing so, fuse_prepare_release() now skips grabbing the reference on the inode, which makes it possible for an inode to be evicted from the dcache while there are inflight readahead requests. This causes a deadlock if the server triggers reclaim while servicing the readahead request and reclaim attempts to evict the inode of the file being read ahead. Since the folio is locked during readahead, when reclaim evicts the fuse inode and fuse_evict_inode() attempts to remove all folios associated with the inode from the page cache (truncate_inode_pages_range()), reclaim will block forever waiting for the lock since readahead cannot relinquish the lock because it is itself blocked in reclaim: >>> stack_trace(1504735) folio_wait_bit_common (mm/filemap.c:1308:4) folio_lock (./include/linux/pagemap.h:1052:3) truncate_inode_pages_range (mm/truncate.c:336:10) fuse_evict_inode (fs/fuse/inode.c:161:2) evict (fs/inode.c:704:3) dentry_unlink_inode (fs/dcache.c:412:3) __dentry_kill (fs/dcache.c:615:3) shrink_kill (fs/dcache.c:1060:12) shrink_dentry_list (fs/dcache.c:1087:3) prune_dcache_sb (fs/dcache.c:1168:2) super_cache_scan (fs/super.c:221:10) do_shrink_slab (mm/shrinker.c:435:9) shrink_slab (mm/shrinker.c:626:10) shrink_node (mm/vmscan.c:5951:2) shrink_zones (mm/vmscan.c:6195:3) do_try_to_free_pages (mm/vmscan.c:6257:3) do_swap_page (mm/memory.c:4136:11) handle_pte_fault (mm/memory.c:5562:10) handle_mm_fault (mm/memory.c:5870:9) do_user_addr_fault (arch/x86/mm/fault.c:1338:10) handle_page_fault (arch/x86/mm/fault.c:1481:3) exc_page_fault (arch/x86/mm/fault.c:1539:2) asm_exc_page_fault+0x22/0x27 Fix this deadlock by allocating ff->release_args and grabbing the reference on the inode when preparing the file for release even if the server does not implement open. The inode reference will be dropped when the last reference on the fuse file is dropped (see fuse_file_put() -> fuse_release_end()). Fixes: e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") Cc: stable@vger.kernel.org Signed-off-by: Joanne Koong Reported-by: Omar Sandoval Signed-off-by: Miklos Szeredi commit 9d97a2fe48ae77976baff441edd5b30ea4e179c0 Author: Peng Fan Date: Fri Oct 24 09:45:51 2025 +0800 clk: imx: imx8mp-audiomix: use devm_auxiliary_device_create() to simple code Use helper function devm_auxiliary_device_create() to remove some boilerplate code. Reviewed-by: Abel Vesa Reviewed-by: Frank Li Signed-off-by: Peng Fan Reviewed-by: Shengjiu Wang Link: https://lore.kernel.org/r/20251024-auxiliary-v2-1-a353dc9e6b1a@nxp.com Signed-off-by: Abel Vesa commit 25b47635f8729e9536d2652774bd509532eaa522 Author: Jacky Bai Date: Fri Aug 1 15:21:53 2025 +0800 clk: imx: Add some delay before deassert the reset Some of the PCCs on i.MX8ULP have a sw_rst bit to control the peripheral reset through SW method. For peripherals like GPU that need sync reset, some delay is necessary befere & after release the reset to make sure the HW is reset into a known status. So add some delay before & after release reset. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Link: https://lore.kernel.org/r/20250801072153.1974428-1-ping.bai@nxp.com Signed-off-by: Abel Vesa commit 7bade3f7e91969985149a66c98ef0d1d842ff464 Author: Nicolas Schier Date: Wed Nov 5 21:26:02 2025 +0100 scripts: headers_install.sh: Remove two outdated config leak ignore entries Remove config leak ignore entries for arch/arc/include/uapi/asm/page.h as they have been removed in commit d3e5bab923d3 ("arch: simplify architecture specific page size configuration"). Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251105-update-headers-install-config-leak-ignore-list-v1-1-40be3eed68cb@kernel.org Signed-off-by: Nicolas Schier commit 727a44027815aea13d34c28254d386562efc3bab Author: Caleb Sander Mateos Date: Fri Nov 7 21:23:16 2025 -0700 ublk: return unsigned from ublk_{,un}map_io() ublk_map_io() and ublk_unmap_io() never return negative values, and their return values are stored in variables of type unsigned. Clarify that they can't fail by making their return types unsigned. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 6b0a29933f688a284e8869da0f63a93acf893757 Author: Caleb Sander Mateos Date: Sat Nov 8 15:17:45 2025 -0700 ublk: remove unnecessary checks in ublk_check_and_get_req() ub = iocb->ki_filp->private_data cannot be NULL, as it's set in ublk_ch_open() before it returns succesfully. req->mq_hctx cannot be NULL as any inflight ublk request must belong to some queue. And req->mq_hctx->driver_data cannot be NULL as it's set to the ublk_queue pointer in ublk_init_hctx(). So drop the unnecessary checks. Signed-off-by: Caleb Sander Mateos Reviewed-by: Chaitanya Kulkarni Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 712fbe97c3322cb7a6ae1112e67a680e7ff1b206 Author: Pavel Begunkov Date: Mon Nov 10 13:04:52 2025 +0000 io_uring: move flags check to io_uring_sanitise_params io_uring_sanitise_params() sanitises most of the setup flags invariants, move the IORING_SETUP_FLAGS check from io_uring_setup() into it. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 01405895c1e7d950964bebc8e4b0fc7aa77de24c Author: Pavel Begunkov Date: Mon Nov 10 13:04:51 2025 +0000 io_uring: use mem_is_zero to check ring params mem_is_zero() does the job without hand rolled loops, use that to verify reserved fields of ring params. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 7bb21a52e2d435b9edffe3b40264ab4462e338e0 Author: Pavel Begunkov Date: Mon Nov 10 13:04:50 2025 +0000 io_uring: pass sq entries in the params struct There is no need to pass the user requested number of SQ entries separately from the main parameter structure io_uring_params. Initialise it at the beginning and stop passing it in favour of struct io_uring_params::sq_entries. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 4aed5b4e6d276d2308d0ea8932b0c6ebfd3d19f8 Author: Pavel Begunkov Date: Mon Nov 10 13:04:49 2025 +0000 io_uring: add helper calculating region byte size There has been type related issues with region size calculation, add an utility helper function that returns the size and handles type conversions right. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 21bd7b14a32de35bc6c4fff7a739dc5d33ce04f1 Author: Pavel Begunkov Date: Thu Nov 6 12:31:56 2025 +0000 io_uring/query: buffer size calculations with a union Instead of having an array of a calculated size as a buffer, put all query uapi structures into a union and pass that around. That way everything is well typed, and the compiler will prevent opcode handling using a structure not accounted into the buffer size. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit b6c5f9454ef34fd2753ba7843ef4d9a295c43eee Author: David Wei Date: Fri Oct 31 19:24:49 2025 -0700 io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock netdev ops must be called under instance lock or rtnl_lock, but io_register_zcrx_ifq() isn't doing this for netdev_queue_get_dma_dev(). Fix this by taking the instance lock using netdev_get_by_index_lock(). Extended the instance lock section to include attaching a memory provider. Could not move io_zcrx_create_area() outside, since the dmabuf codepath IORING_ZCRX_AREA_DMABUF requires ifq->dev. Fixes: 59b8b32ac8d4 ("io_uring/zcrx: add support for custom DMA devices") Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Reviewed-by: Jakub Kicinski Signed-off-by: Jens Axboe commit c07a491c1b735e0c27454ea5c27a446d43401b1e Author: David Wei Date: Fri Oct 31 19:24:48 2025 -0700 net: export netdev_get_by_index_lock() Need to call netdev_get_by_index_lock() from io_uring/zcrx.c, but it is currently private to net. Export the function in linux/netdevice.h. Signed-off-by: David Wei Acked-by: Jakub Kicinski Signed-off-by: Jens Axboe commit 86afb1cdc28f4332c6e0a1937244e0a80d4d63b1 Author: Chaitanya Kulkarni Date: Sat Nov 8 23:44:26 2025 -0800 block: add lockdep to queue_limits_commit_update() queue_limits_commit_update() expects q->limits_lock to be held by the caller (via queue_limits_start_update()). The API pattern is: lim = queue_limits_start_update(q); /* acquires lock */ /* modify lim */ queue_limits_commit_update(q, &lim); /* releases lock */ OR queue_limits_commit_update_frozen(q, &lim); lim = queue_limits_start_update(q); /* acquires lock */ queue_limits_commit_update(q, &lim); /* releases lock */ Add lockdep_assert_held() to report incorrect API usage. Signed-off-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 1649714b930f9ea6233ce0810ba885999da3b5d4 Author: Zheng Qixing Date: Mon Nov 10 20:49:20 2025 +0800 nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 nbd_start_device // config_refs=2 set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 recv_work done // config_refs=2 NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0 refcount_inc -> uaf ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790 The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect(): mutex_unlock(&nbd->config_lock); if (!ret) { set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); + printk("before sleep\n"); + mdelay(5 * 1000); + printk("after sleep\n"); refcount_inc(&nbd->config_refs); nbd_connect_reply(info, nbd->index); } Fixes: e46c7287b1c2 ("nbd: add a basic netlink interface") Signed-off-by: Zheng Qixing Reviewed-by: Yu Kuai Signed-off-by: Jens Axboe commit 3d076988aaaee6b0c8f4db953fd4fe8194ec370f Merge: 4cda40dce95a5b 62ed1b58224636 Author: Jens Axboe Date: Tue Nov 11 06:58:11 2025 -0700 Merge tag 'md-6.19-20251111' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into for-6.19/block Pull MD changes from Yu: "- Change maintainer's email address (Yu Kuai) - Data can be lost if array is created with different lbs devices, fix this problem and record lbs of the array in metadata (Li Nan) - Fix rcu protection for md_thread (Yun Zhou) - Fix mddev kobject lifetime regression (Xiao Ni) - Enable atomic writes for md-linear (John Garry) - Some cleanups (Chen Ni, Huiwen He, Wu Guanghao)" * tag 'md-6.19-20251111' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: md: allow configuring logical block size md: add check_new_feature module parameter md/raid0: Move queue limit setup before r0conf initialization md: init bioset in mddev_init md: delete md_redundancy_group when array is becoming inactive md: prevent adding disks with larger logical_block_size to active arrays md/raid5: remove redundant __GFP_NOWARN md: avoid repeated calls to del_gendisk md/md-llbitmap: Remove unneeded semicolon md/md-linear: Enable atomic writes Factor out code into md_should_do_recovery() md: fix rcu protection in md_wakeup_thread md: delete mddev kobj before deleting gendisk kobj MAINTAINERS: Update Yu Kuai's E-mail address commit 32172cf3cb543a04c41a1677c97a38e60cad05b6 Author: Richard Fitzgerald Date: Tue Nov 11 13:08:50 2025 +0000 ASoC: cs35l56: Allow restoring factory calibration through ALSA control Add an ALSA control (CAL_DATA) that can be used to restore amp calibration, instead of using debugfs. A readback control (CAL_DATA_RB) is also added for factory testing. On ChromeOS the process that restores amp calibration from NVRAM has limited permissions and cannot access debugfs. It requires an ALSA control that it can write the calibration blob into. ChromeOS also restricts access to ALSA controls, which avoids the risk of accidental or malicious overwriting of good calibration data with bad data. As this control is not needed for normal Linux-based distros it is a Kconfig option. A separate control, CAL_DATA_RB, provides a readback of the current calibration data, which could be either from a write to CAL_DATA or the result of factory production-line calibration. The write and read are intentionally separate controls to defeat "dumb" save-and-restore tools like alsa-restore that assume it is safe to save all control values and write them back in any order at some undefined future time. Such behavior carries the risk of restoring stale or bad data over the top of good data. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251111130850.513969-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 69f3474a01e9867dd99fc4b703fa834ea1835c7d Author: Richard Fitzgerald Date: Tue Nov 11 13:08:49 2025 +0000 ASoC: cs35l56: Add control to read CAL_SET_STATUS Create an ALSA control to read the value of the firmware CAL_SET_STATUS control. This reports whether the firmware is using a calibration blob or the default calibration from the .bin file. The firmware only reports a valid value in this register while audio is actually playing and the internal PLL is locked to the audio clock. Otherwise it returns a status of "unknown". Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251111130850.513969-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 8f76686bbdc87035eefc56a700f6788ce84f0e26 Author: Laurent Pinchart Date: Sun Oct 26 14:17:29 2025 +0200 arm64: dts: imx8mp-debix-model-a: Fix ethernet PHY address The RTL8211E ethernet PHY on the Debix Model A board it located at address 1. Replace the broadcast address with the correct unicast address. Signed-off-by: Laurent Pinchart Reviewed-by: Andrew Lunn Signed-off-by: Shawn Guo commit cd06078a38aaedfebbf8fa0c009da0f99f4473fb Author: Menglong Dong Date: Mon Nov 3 14:34:34 2025 +0800 tracing: fprobe: use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_ARGS For now, we will use ftrace for the fprobe if fp->exit_handler not exists and CONFIG_DYNAMIC_FTRACE_WITH_REGS is enabled. However, CONFIG_DYNAMIC_FTRACE_WITH_REGS is not supported by some arch, such as arm. What we need in the fprobe is the function arguments, so we can use ftrace for fprobe if CONFIG_DYNAMIC_FTRACE_WITH_ARGS is enabled. Therefore, use ftrace if CONFIG_DYNAMIC_FTRACE_WITH_REGS or CONFIG_DYNAMIC_FTRACE_WITH_ARGS enabled. Link: https://lore.kernel.org/all/20251103063434.47388-1-dongml2@chinatelecom.cn/ Signed-off-by: Menglong Dong Signed-off-by: Masami Hiramatsu (Google) commit 08ed5c81f6058bd7d6cd28d1750667ad3ceee3d1 Author: Menglong Dong Date: Wed Oct 15 16:32:38 2025 +0800 lib/test_fprobe: add testcase for mixed fprobe Add the testcase for the fprobe, which will hook the same target with two fprobe: entry, entry+exit. And the two fprobes will be registered with different order. fgraph and ftrace are both used for the fprobe, and this testcase is for the mixed situation. Link: https://lore.kernel.org/all/20251015083238.2374294-3-dongml2@chinatelecom.cn/ Signed-off-by: Menglong Dong Signed-off-by: Masami Hiramatsu (Google) commit 2c67dc457bc67367dc8fcd8f471ce2d5bb5f7b2b Author: Menglong Dong Date: Wed Oct 15 16:32:37 2025 +0800 tracing: fprobe: optimization for entry only case For now, fgraph is used for the fprobe, even if we need trace the entry only. However, the performance of ftrace is better than fgraph, and we can use ftrace_ops for this case. Then performance of kprobe-multi increases from 54M to 69M. Before this commit: $ ./benchs/run_bench_trigger.sh kprobe-multi kprobe-multi : 54.663 ± 0.493M/s After this commit: $ ./benchs/run_bench_trigger.sh kprobe-multi kprobe-multi : 69.447 ± 0.143M/s Mitigation is disable during the bench testing above. Link: https://lore.kernel.org/all/20251015083238.2374294-2-dongml2@chinatelecom.cn/ Signed-off-by: Menglong Dong Signed-off-by: Masami Hiramatsu (Google) commit e667152e0064acf1a308a1816719008e29bec76f Author: Masami Hiramatsu (Google) Date: Thu Oct 2 17:39:04 2025 +0900 tracing: fprobe: Fix to init fprobe_ip_table earlier Since the fprobe_ip_table is used from module unloading in the failure path of load_module(), it must be initialized in the earlier timing than late_initcall(). Unless that, the fprobe_module_callback() will use an uninitialized spinlock of fprobe_ip_table. Initialize fprobe_ip_table in core_initcall which is the same timing as ftrace. Link: https://lore.kernel.org/all/175939434403.3665022.13030530757238556332.stgit@mhiramat.tok.corp.google.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509301440.be4b3631-lkp@intel.com Fixes: e5a4cc28a052 ("tracing: fprobe: use rhltable for fprobe_ip_table") Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Menglong Dong commit 873bc94689d832878befbcadc10b6ad5bb4e0027 Author: Mac Chiang Date: Tue Nov 11 20:37:37 2025 +0800 ASoC: Intel: sof_sdw: add codec speaker support for the SKU This patch adds Cirrus codec internal speaker configuration to support the cs42l43_l3_cs35l56_l2 machine. Signed-off-by: Mac Chiang Reviewed-by: Simon Trimmer Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111123737.246626-7-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit dfbb57c2767dc128f6360c3e41136bff8fa6f924 Author: Mac Chiang Date: Tue Nov 11 20:37:36 2025 +0800 ASoC: Intel: soc-acpi-ptl-match: add cs42l43_agg_l3_cs35l56_2 support This patch adds the aggregated mode support: cs42l43 codec with left and right tweeters on soundwire link 3, cs35l56 left and right woofers on soundwire link 2. Signed-off-by: Mac Chiang Reviewed-by: Simon Trimmer Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111123737.246626-6-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit f78d96c289da743d517f700d3fe7c6c43df667b5 Author: Bard Liao Date: Tue Nov 11 20:37:35 2025 +0800 ASoC: Intel: sof_sdw: create BT dai link if bt_link_mask is set The bt_link_mask value is from NHLT. The BT dai link should be created if bt_link_mask is set. Besides, hda_machine_select() will look for the topology with BT BE. Suggested-by: Mac Chiang Reviewed-by: Ranjani Sridharan Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111123737.246626-5-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 1d5bf23aa1e8aea43beca78dc5d69c68955e8871 Author: Peter Ujfalusi Date: Tue Nov 11 20:37:34 2025 +0800 ASOC: Intel: sof_sdw: add quirk for Avell B.ON (OEM rebranded NUC15) Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and LAPBC710. Link: https://github.com/thesofproject/linux/issues/5529 Signed-off-by: Peter Ujfalusi Reviewed-by: Kai Vehmanen Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111123737.246626-4-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 660d946ce6fd64678b4ed6b083dfc24c0f4d5a69 Author: Mac Chiang Date: Tue Nov 11 20:37:33 2025 +0800 ASoC: Intel: sof_sdw: Add quirk to exclude RT722 speaker This SKU does not use the RT722 internal speaker. Add SOC_SDW_CODEC_SPKR to prevent DAI being created via codec_info_list.dais.quirk_exclude. Other SKUs continue to check higher-priority sdca_functions when the BIOS SDCA property is present. Signed-off-by: Mac Chiang Reviewed-by: Kai Vehmanen Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111123737.246626-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 38ecd1384079d5f7b6942b68496ee7e85aa9a883 Author: Mac Chiang Date: Tue Nov 11 20:37:32 2025 +0800 ASoC: Intel: soc-acpi-intel-ptl-match: Add support for rt722_l0_rt1320_l23 This patch adds support for the RT722 codec on SoundWire link 0, and RT1320 left and right amplifiers on links 2 and 3, respectively. Signed-off-by: Mac Chiang Reviewed-by: Kai Vehmanen Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111123737.246626-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit b3a5302484033331af37569f7277d00131694b57 Author: Balamurugan C Date: Tue Nov 11 18:35:12 2025 +0800 ASoC: Intel: sof_rt5682: Add quirk override support adding quirk override support to configure different quirk configuration at runtime. Signed-off-by: Balamurugan C Signed-off-by: Bard Liao Link: https://patch.msgid.link/20251111103512.244147-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 69d8895cb9a9f6450374577af8584c2e21cb5a9f Author: Thomas Weißschuh Date: Tue Oct 14 07:51:58 2025 +0200 rv: Add explicit lockdep context for reactors Reactors can be called from any context through tracepoints. When developing reactors care needs to be taken to only call APIs which are safe. As the tracepoints used during testing may not actually be called from restrictive contexts lockdep may not be helpful. Add explicit overrides to help lockdep find invalid code patterns. The usage of LD_WAIT_FREE will trigger lockdep warnings in the panic reactor. These are indeed valid warnings but they are out of scope for RV and will instead be fixed by the printk subsystem. Signed-off-by: Thomas Weißschuh Acked-by: Nam Cao Link: https://lore.kernel.org/r/20251014-rv-lockdep-v1-3-0b9e51919ea8@linutronix.de Signed-off-by: Gabriele Monaco commit 68f63cea46d3a410a41d9ab74d338038a22bc2ad Author: Thomas Weißschuh Date: Tue Oct 14 07:51:57 2025 +0200 rv: Make rv_reacting_on() static There are no external users left. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20251014-rv-lockdep-v1-2-0b9e51919ea8@linutronix.de Signed-off-by: Gabriele Monaco commit 4f739ed19d222de33b19ca639a34523fbbec20d0 Author: Thomas Weißschuh Date: Tue Oct 14 07:51:56 2025 +0200 rv: Pass va_list to reactors The only thing the reactors can do with the passed in varargs is to convert it into a va_list. Do that in a central helper instead. It simplifies the reactors, removes some hairy macro-generated code and introduces a convenient hook point to modify reactor behavior. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20251014-rv-lockdep-v1-1-0b9e51919ea8@linutronix.de Signed-off-by: Gabriele Monaco commit 0c0cd931a037638ec49ae57c6100fcbb6a729bae Author: Gabriele Monaco Date: Fri Oct 17 13:52:03 2025 +0200 selftests/verification: Add initial RV tests Add a series of tests to validate the RV tracefs API and basic functionality. * available monitors: Check that all monitors (from the monitors folder) appear as available and have a description. Works with nested monitors. * enable/disable: Enable and disable all monitors and validate both the enabled file and the enabled_monitors. Check that enabling container monitors enables all nested monitors. * reactors: Set all reactors and validate the setting, also for nested monitors. * wwnr with printk: wwnr is broken on purpose, run it with a load and check that the printk reactor works. Also validate disabling reacting_on or monitoring_on prevents reactions. These tests use the ftracetest suite. Acked-by: Nam Cao Link: https://lore.kernel.org/r/20251017115203.140080-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit 21f43f4a2b57cfeddf4e722d0969a85dd6185dcb Merge: 8180c4fa544424 9da611df15aa8d Author: Paolo Abeni Date: Tue Nov 11 13:17:56 2025 +0100 Merge branch 'devlink-eswitch-inactive-mode' Saeed Mahameed says: ==================== devlink eswitch inactive mode Before having traffic flow through an eswitch, a user may want to have the ability to block traffic towards the FDB until FDB is fully programmed and the user is ready to send traffic to it. For example: when two eswitches are present for vports in a multi-PF setup, one eswitch may take over the traffic from the other when the user chooses. Before this take over, a user may want to first program the inactive eswitch and then once ready redirect traffic to this new eswitch. This series introduces a user-configurable mode for an eswitch that allows dynamically switching between active and inactive modes. When inactive, traffic does not flow through the eswitch. While inactive, steering pipeline configuration can be done (e.g. adding TC rules, discovering representors, enabling the desired SDN modes such as bridge/OVS/DPDK/etc). Once configuration is completed, a user can set the eswitch mode to active and have traffic flow through. This allows admins to upgrade forwarding pipeline rules with very minimal downtime and packet drops. A user can start the eswitch in switchdev or switchdev_inactive mode. Active: Traffic is enabled on this eswitch FDB. Inactive: Traffic is ignored/dropped on this eswitch FDB. An example use case: $ devlink dev eswitch set pci/0000:08:00.1 mode switchdev_inactive Setup FDB pipeline and netdev representors ... Once ready to start receiving traffic $ devlink dev eswitch set pci/0000:08:00.1 mode switchdev v2: https://lore.kernel.org/all/20251107000831.157375-1-saeed@kernel.org/ v1: https://lore.kernel.org/all/20251016013618.2030940-1-saeed@kernel.org/ ==================== Link: https://patch.msgid.link/20251108070404.1551708-1-saeed@kernel.org Signed-off-by: Paolo Abeni commit 9da611df15aa8d519f9947b88a5c733267cba888 Author: Saeed Mahameed Date: Fri Nov 7 23:04:04 2025 -0800 net/mlx5: E-Switch, support eswitch inactive mode Add support for eswitch switchdev inactive mode Inactive mode: Drop all traffic going to FDB, Remove mpfs l2 rules and disconnect adjacent vports. Active mode: Traffic flows through FDB, mpfs table populated, and adjacent vports are connected. Signed-off-by: Saeed Mahameed Signed-off-by: Adithya Jayachandran Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251108070404.1551708-4-saeed@kernel.org Signed-off-by: Paolo Abeni commit 9902b6381d76ccd2e08e2703390e8c8a3bcda482 Author: Saeed Mahameed Date: Fri Nov 7 23:04:03 2025 -0800 net/mlx5: MPFS, add support for dynamic enable/disable MPFS (Multi PF Switch) is enabled by default in Multi-Host environments, the driver keeps a list of desired unicast mac addresses of all vports (vfs/Sfs) and applied to HW via L2_table FW command. Add API to dynamically apply the list of MACs to HW when needed for next patches, to utilize this new API in devlink eswitch active/in-active uAPI. Signed-off-by: Saeed Mahameed Signed-off-by: Adithya Jayachandran Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251108070404.1551708-3-saeed@kernel.org Signed-off-by: Paolo Abeni commit 0e535824d0bcf7c9bb0532d902283c31c78cd6f3 Author: Saeed Mahameed Date: Fri Nov 7 23:04:02 2025 -0800 devlink: Introduce switchdev_inactive eswitch mode Adds DEVLINK_ESWITCH_MODE_SWITCHDEV_INACTIVE attribute to UAPI and documentation. Before having traffic flow through an eswitch, a user may want to have the ability to block traffic towards the FDB until FDB is fully programmed and the user is ready to send traffic to it. For example: when two eswitches are present for vports in a multi-PF setup, one eswitch may take over the traffic from the other when the user chooses. Before this take over, a user may want to first program the inactive eswitch and then once ready redirect traffic to this new eswitch. switchdev modes transition semantics: legacy->switchdev_inactive: Create switchdev mode normally, traffic not allowed to flow yet. switchdev_inactive->switchdev: Enable traffic to flow. switchdev->switchdev_inactive: Block traffic on the FDB, FDB and representros state and content is preserved. When eswitch is configured to this mode, traffic is ignored/dropped on this eswitch FDB, while current configuration is kept, e.g FDB rules and netdev representros are kept available, FDB programming is allowed. Example: # start inactive switchdev devlink dev eswitch set pci/0000:08:00.1 mode switchdev_inactive # setup TC rules, representors etc .. # activate devlink dev eswitch set pci/0000:08:00.1 mode switchdev Signed-off-by: Saeed Mahameed Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20251108070404.1551708-2-saeed@kernel.org Signed-off-by: Paolo Abeni commit 8180c4fa5444247c3fcecc98c75d53cdb801604c Merge: 8da7bea7db692e 9eef97a9dea3d0 Author: Paolo Abeni Date: Tue Nov 11 12:21:06 2025 +0100 Merge branch 'tools-ynl-turn-the-page-pool-sample-into-a-real-tool' Jakub Kicinski says: ==================== tools: ynl: turn the page-pool sample into a real tool The page-pool YNL sample is quite useful. It's helps calculate recycling rate and memory consumption. Since we still haven't figured out a way to integrate with iproute2 (not for the lack of thinking how to solve it) - create a ynltool command in ynl. Add page-pool and qstats support. Most commands can use the Python YNL CLI directly but low level stats often need aggregation or some math on top to be useful. Specifically in this patch set: - page pool stats are aggregated and recycling rate computed - per-queue stats are used to compute traffic balance across queues v1: https://lore.kernel.org/20251104232348.1954349-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20251107162227.980672-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 29ae148fa88934bfd81af2a616816f9e22559b7c Merge: 97e8e73777ab21 e9a6fb0bcdd760 Author: Mauro Carvalho Chehab Date: Tue Nov 11 12:44:28 2025 +0100 Merge tag 'v6.18-rc5' into media-next Linux 6.18-rc5 * tag 'v6.18-rc5': (1016 commits) Linux 6.18-rc5 kbuild: Let kernel-doc.py use PYTHON3 override rtc: rx8025: fix incorrect register reference Revert "drm/nouveau: set DMA mask before creating the flush page" io_uring: fix regbuf vector size truncation compiler_types: Move unused static inline functions warning to W=2 smb: client: validate change notify buffer before copy tracing/tools: Fix incorrcet short option in usage text for --threads drm/xe: Enforce correct user fence signaling order using x86/microcode/AMD: Add more known models to entry sign checking drm/xe: Do clean shutdown also when using flr drm/xe: Move declarations under conditional branch drm/xe/guc: Synchronize Dead CT worker with unbind tracing: Fix memory leaks in create_field_var() ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up tracing: tprobe-events: Fix to put tracepoint_user when disable the tprobe tracing: tprobe-events: Fix to register tracepoint correctly gpio: tb10x: Drop unused tb10x_set_bits() function drm/amd/display: Enable mst when it's detected but yet to be initialized drm/amdgpu: Fix wait after reset sequence in S3 ... commit a0aa283c53a703240a93ae38aa04bc9e4ca89d12 Author: Gabriele Monaco Date: Fri Oct 17 13:52:02 2025 +0200 selftest/ftrace: Generalise ftracetest to use with RV The ftracetest script is a fairly complete test framework for tracefs-like subsystem, but it can only be used for ftrace selftests. If OPT_TEST_DIR is provided and includes a function file, use that as test directory going forward rather than just grabbing tests from it. Generalise function names like initialize_ftrace to initialize_system. Add the --rv argument to set up the test for rv, basically changing the trace directory to $TRACING_DIR/rv and displaying an error if that cannot be found. This prepares for rv selftests inclusion. Link: https://lore.kernel.org/r/20251017115203.140080-2-gmonaco@redhat.com Signed-off-by: Gabriele Monaco commit f5a538c07df26f5c601e41f7b9c7ade3e1e75803 Author: Peter Zijlstra Date: Fri Oct 31 13:54:24 2025 +0100 sched/deadline: Fix dl_server stop condition Gabriel reported that the dl_server doesn't stop as expected. The problem was found to be the fact that idle time and fair runtime are treated equally. Both will count towards dl_server runtime and push the activation forwards when it is in the zero-laxity wait state. Notably: dl_server_update_idle() update_curr_dl_se() if (dl_defer && dl_throttled && dl_runtime_exceeded()) hrtimer_try_to_cancel(); // stop timer replenish_dl_new_period() deadline = now + dl_deadline; // fwd period runtime = dl_runtime; start_dl_timer(); // restart timer And while we do want idle time accounted towards the *current* activation of the dl_server -- after all, a fair task could've ran if we had any -- we don't necessarily want idle time to cause or push forward an activation. Introduce dl_defer_idle to make this distinction. It will be set once idle time pushed the activation forward, once set idle time will only be allowed to consume any runtime but not push the activation. This will then cause dl_server_timer() to fire, which will stop the dl_server. Any non-idle time accounting during this phase will clear dl_defer_idle, so only a full period of idle will cause the dl_server to stop. Reported-by: Gabriele Monaco Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251101000057.GA2184199@noisy.programming.kicks-ass.net commit e636ffb9e31b4f7dde7fef5358669266b9ce02ec Author: Peter Zijlstra Date: Mon Oct 20 16:15:05 2025 +0200 sched/deadline: Fix dl_server time accounting The dl_server time accounting code is a little odd. The normal scheduler pattern is to update curr before doing something, such that the old state is fully accounted before changing state. Notably, the dl_server_timer() needs to propagate the current time accounting since the current task could be ran by dl_server and thus this can affect dl_se->runtime. Similarly for dl_server_start(). And since the (deferred) dl_server wants idle time accounted, rework sched_idle_class time accounting to be more like all the others. Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251020141130.GJ3245006@noisy.programming.kicks-ass.net commit e40cea333e60c548e047eaddec6ca48c6632424b Author: Hao Jia Date: Wed Oct 29 17:36:55 2025 +0800 sched/core: Remove double update_rq_clock() in __set_cpus_allowed_ptr_locked() Since commit d4c64207b88a ("sched: Cleanup the sched_change NOCLOCK usage"), update_rq_clock() is called in do_set_cpus_allowed() -> sched_change_begin() to update the rq clock. This results in a duplicate call update_rq_clock() in __set_cpus_allowed_ptr_locked(). While holding the rq lock and before calling do_set_cpus_allowed(), there is nothing that depends on an updated rq_clock. Therefore, remove the redundant update_rq_clock() in __set_cpus_allowed_ptr_locked() to avoid the warning about double rq clock updates. Fixes: d4c64207b88a ("sched: Cleanup the sched_change NOCLOCK usage") Signed-off-by: Hao Jia Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Link: https://patch.msgid.link/20251029093655.31252-1-jiahao.kernel@gmail.com commit 79f3f9bedd149ea438aaeb0fb6a083637affe205 Author: Peter Zijlstra Date: Wed Apr 2 20:07:34 2025 +0200 sched/eevdf: Fix min_vruntime vs avg_vruntime Basically, from the constraint that the sum of lag is zero, you can infer that the 0-lag point is the weighted average of the individual vruntime, which is what we're trying to compute: \Sum w_i * v_i avg = -------------- \Sum w_i Now, since vruntime takes the whole u64 (worse, it wraps), this multiplication term in the numerator is not something we can compute; instead we do the min_vruntime (v0 henceforth) thing like: v_i = (v_i - v0) + v0 This does two things: - it keeps the key: (v_i - v0) 'small'; - it creates a relative 0-point in the modular space. If you do that subtitution and work it all out, you end up with: \Sum w_i * (v_i - v0) avg = --------------------- + v0 \Sum w_i Since you cannot very well track a ratio like that (and not suffer terrible numerical problems) we simpy track the numerator and denominator individually and only perform the division when strictly needed. Notably, the numerator lives in cfs_rq->avg_vruntime and the denominator lives in cfs_rq->avg_load. The one extra 'funny' is that these numbers track the entities in the tree, and current is typically outside of the tree, so avg_vruntime() adds current when needed before doing the division. (vruntime_eligible() elides the division by cross-wise multiplication) Anyway, as mentioned above, we currently use the CFS era min_vruntime for this purpose. However, this thing can only move forward, while the above avg can in fact move backward (when a non-eligible task leaves, the average becomes smaller), this can cause trouble when through happenstance (or construction) these values drift far enough apart to wreck the game. Replace cfs_rq::min_vruntime with cfs_rq::zero_vruntime which is kept near/at avg_vruntime, following its motion. The down-side is that this requires computing the avg more often. Fixes: 147f3efaa241 ("sched/fair: Implement an EEVDF-like scheduling policy") Reported-by: Zicheng Qu Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251106111741.GC4068168@noisy.programming.kicks-ass.net Cc: stable@vger.kernel.org commit 9359d9785d85bb53f1ff1738a59aeeec4b878906 Author: Peter Zijlstra Date: Thu Nov 6 10:50:49 2025 +0100 sched/core: Add comment explaining force-idle vruntime snapshots I always end up having to re-read these emails every time I look at this code. And a future patch is going to change this story a little. This means it is past time to stick them in a comment so it can be modified and stay current. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20200506143506.GH5298@hirez.programming.kicks-ass.net Link: https://lkml.kernel.org/r/20200515103844.GG2978@hirez.programming.kicks-ass.net Link: https://patch.msgid.link/20251106111603.GB4068168@noisy.programming.kicks-ass.net commit 7f829bde94b1c97b1804fa5860e066ea49dbfca3 Author: Fernand Sieber Date: Wed Nov 5 17:25:37 2025 +0200 sched/core: Optimize core cookie matching check Early return true if the core cookie matches. This avoids the SMT mask loop to check for an idle core, which might be more expensive on wide platforms. Signed-off-by: Fernand Sieber Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Reviewed-by: Madadi Vineeth Reddy Link: https://patch.msgid.link/20251105152538.470586-1-sieberf@amazon.com commit 127b90315ca07ccad2618db7ba950a63e3b32d22 Author: Fernand Sieber Date: Thu Nov 6 12:40:10 2025 +0200 sched/proxy: Yield the donor task When executing a task in proxy context, handle yields as if they were requested by the donor task. This matches the traditional PI semantics of yield() as well. This avoids scenario like proxy task yielding, pick next task selecting the same previous blocked donor, running the proxy task again, etc. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202510211205.1e0f5223-lkp@intel.com Suggested-by: Peter Zijlstra Signed-off-by: Fernand Sieber Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251106104022.195157-1-sieberf@amazon.com commit 9eef97a9dea3d059cb719a26a055ff09933e964e Author: Jakub Kicinski Date: Fri Nov 7 08:22:27 2025 -0800 tools: ynltool: add traffic distribution balance The main if not only use case for per-queue stats today is checking for traffic imbalance. Add simple traffic balance analysis to qstats. $ ynltool qstat balance eth0 rx 44 queues: rx-packets : cv=6.9% ns=24.2% stddev=512006493 min=6278921110 max=8011570575 mean=7437054644 rx-bytes : cv=6.9% ns=24.1% stddev=759670503060 min=9326315769440 max=11884393670786 mean=11035439201354 ... $ ynltool -j qstat balance | jq [ { "ifname": "eth0", "ifindex": 2, "queue-type": "rx", "rx-packets": { "queue-count": 44, "min": 6278301665, "max": 8010780185, "mean": 7.43635E+9, "stddev": 5.12012E+8, "coefficient-of-variation": 6.88525, "normalized-spread": 24.249 }, ... Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20251107162227.980672-5-kuba@kernel.org Acked-by: Stanislav Fomichev Signed-off-by: Paolo Abeni commit 3f0a638d45fcf98f7a53ece0aadf928dfc328a06 Author: Jakub Kicinski Date: Fri Nov 7 08:22:26 2025 -0800 tools: ynltool: add qstats support $ ynltool qstat eth0 rx-packets: 493192163 rx-bytes: 1442544543997 tx-packets: 745999838 tx-bytes: 4574215826482 tx-stop: 7033 tx-wake: 7033 $ ynltool qstat show group-by queue eth0 rx-0 packets: 70196880 bytes: 178633973750 eth0 rx-1 packets: 63623419 bytes: 197274745250 ... eth0 tx-1 packets: 98645810 bytes: 631247647938 stop: 1048 wake: 1048 eth0 tx-2 packets: 86775824 bytes: 563930471952 stop: 1126 wake: 1126 ... $ ynltool -j qstat | jq [ { "ifname": "eth0", "ifindex": 2, "rx": { "packets": 493396439, "bytes": 1443608198921 }, "tx": { "packets": 746239978, "bytes": 4574333772645, "stop": 7072, "wake": 7072 } } ] Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20251107162227.980672-4-kuba@kernel.org Acked-by: Stanislav Fomichev Signed-off-by: Paolo Abeni commit 124dac9b421ca8e69ed11ad7a0fc1794d03c2519 Author: Jakub Kicinski Date: Fri Nov 7 08:22:25 2025 -0800 tools: ynltool: add page-pool stats Replace the page-pool sample with page pool support in ynltool. # ynltool page-pool stats eth0[2] page pools: 18 (zombies: 0) refs: 171456 bytes: 702283776 (refs: 0 bytes: 0) recycling: 97.3% (alloc: 2679:6134966 recycle: 1250981:4719386) # ynltool -j page-pool stats | jq [ { "ifname": "eth0", "ifindex": 2, "page_pools": 18, "zombies": 0, "live": { "refs": 171456, "bytes": 702283776 }, "zombie": { "refs": 0, "bytes": 0 }, "recycling_pct": 97.2746, "alloc": { "slow": 2679, "fast": 6135029 }, "recycle": { "ring": 1250997, "cache": 4719432 } } ] # ynltool page-pool stats group-by pp pool id: 108 dev: eth0[2] napi: 530 inflight: 9472 pages 38797312 bytes recycling: 95.5% (alloc: 148:208379 recycle: 45386:153842) pool id: 107 dev: eth0[2] napi: 529 inflight: 9408 pages 38535168 bytes recycling: 94.9% (alloc: 147:180178 recycle: 42251:128808) Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20251107162227.980672-3-kuba@kernel.org Acked-by: Stanislav Fomichev Signed-off-by: Paolo Abeni commit b02d229013aad864d89c2cbe8c713ff7da04c253 Author: Jakub Kicinski Date: Fri Nov 7 08:22:24 2025 -0800 tools: ynltool: create skeleton for the C command Based on past discussions it seems like integration of YNL into iproute2 is unlikely. YNL itself is not great as a C library, since it has no backward compat (we routinely change types). Most of the operations can be performed with the generic Python CLI directly. There is, however, a handful of operations where summarization of kernel output is very useful (mostly related to stats: page-pool, qstat). Create a command (inspired by bpftool, I think it stood the test of time reasonably well) to be able to plug the subcommands into. Link: https://lore.kernel.org/1754895902-8790-1-git-send-email-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20251107162227.980672-2-kuba@kernel.org Acked-by: Stanislav Fomichev Signed-off-by: Paolo Abeni commit 00eda392c7eda411ae469e2d25abd1ce8a55e155 Author: Jani Nikula Date: Mon Nov 10 13:20:48 2025 +0200 drm/i915/rom: convert intel_rom interfaces to struct drm_device Reduce the display dependency on struct drm_i915_private and i915_drv.h by converting the rom interface to struct drm_device. Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20251110112048.2366725-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6a7bb6ccd00580461f01e86f592c7d8c7bb54793 Author: Christoph Hellwig Date: Mon Nov 10 14:23:10 2025 +0100 xfs: reduce ilock roundtrips in xfs_qm_vop_dqalloc xfs_qm_vop_dqalloc only needs the (exclusive) ilock for attaching dquots to the inode if not done so yet. All the other locks don't touch the inode and don't need the ilock - the i_rwsem / iolock protects against changes to the IDs while we are in a method, and the ilock would not help because dropping it for the dqget calls would be racy anyway. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 13d3c1a045628e8453c31bd49578053c093e7a02 Author: Christoph Hellwig Date: Mon Nov 10 14:23:09 2025 +0100 xfs: move xfs_dquot_tree calls into xfs_qm_dqget_cache_{lookup,insert} These are the low-level functions that needs them, so localize the (trivial) calculation of the radix tree root there. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b6d2ab27cc84b19afdf72eac1361fb343c4e0186 Author: Christoph Hellwig Date: Mon Nov 10 14:23:08 2025 +0100 xfs: move quota locking into xrep_quota_item Drop two redundant lock roundtrips by not requiring q_lock to be held on entry and return. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a2ebb21f8ae1a8cc9414677ac7ddbf5c7cc6f48d Author: Christoph Hellwig Date: Mon Nov 10 14:23:07 2025 +0100 xfs: move quota locking into xqcheck_commit_dquot Drop two redundant lock roundtrips by not requiring q_lock to be held on entry and return. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 7dd30acb4b3724ec4ecad1a6e2e19a33c0f0ace4 Author: Christoph Hellwig Date: Mon Nov 10 14:23:06 2025 +0100 xfs: move q_qlock locking into xqcheck_compare_dquot Instead of having both callers do it. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit bfca8760f47ecda61441950babbea6f79a51b377 Author: Christoph Hellwig Date: Mon Nov 10 14:23:05 2025 +0100 xfs: move q_qlock locking into xchk_quota_item This avoids a pointless roundtrip because ilock needs to be taken first. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a536bf9bec6ac461ec48bc8627545d56e4e71e9c Author: Christoph Hellwig Date: Mon Nov 10 14:23:04 2025 +0100 xfs: push q_qlock acquisition from xchk_dquot_iter to the callers. There is no good reason to take q_qlock in xchk_dquot_iter, which just provides a reference to the dquot. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e85e74e4c9a64993ec5f296719705a32feca93c9 Author: Christoph Hellwig Date: Mon Nov 10 14:23:03 2025 +0100 xfs: remove q_qlock locking in xfs_qm_scall_setqlim q_type can't change for an existing dquot, so there is no need for the locking here. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 55c1bc3eb9d0f39ea4c078b339a6228f5f62584b Author: Christoph Hellwig Date: Mon Nov 10 14:23:02 2025 +0100 xfs: return the dquot unlocked from xfs_qm_dqget There is no reason to lock the dquot in xfs_qm_dqget, which just acquires a reference. Move the locking to the callers, or remove it in cases where the caller instantly unlocks the dquot. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit bf5066e169eed0b7b705e3261a05db80f1b8358e Author: Christoph Hellwig Date: Mon Nov 10 14:23:01 2025 +0100 xfs: fold xfs_qm_dqattach_one into xfs_qm_dqget_inode xfs_qm_dqattach_one is a thin wrapper around xfs_qm_dqget_inode. Move the extra asserts into xfs_qm_dqget_inode, drop the unneeded q_qlock roundtrip and merge the two functions. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit d0f93c0d7c9dc8f7fdbd1ce3f5d3bfd8e109da65 Author: Christoph Hellwig Date: Mon Nov 10 14:23:00 2025 +0100 xfs: xfs_qm_dqattach_one is never called with a non-NULL *IO_idqpp The caller already checks that, so replace the handling of this case with an assert that it does not happen. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 0494f04643de72e13acd556e402cc4edc6169950 Author: Christoph Hellwig Date: Mon Nov 10 14:22:59 2025 +0100 xfs: consolidate q_qlock locking in xfs_qm_dqget and xfs_qm_dqget_inode Move taking q_qlock from the cache lookup / insert helpers into the main functions and do it just before returning to the caller. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 6b6e6e75211687c61c5660f65b4155cd0eb7e187 Author: Christoph Hellwig Date: Mon Nov 10 14:22:58 2025 +0100 xfs: remove xfs_qm_dqput and optimize dropping dquot references With the new lockref-based dquot reference counting, there is no need to hold q_qlock for dropping the reference. Make xfs_qm_dqrele the main function to drop dquot references without taking q_qlock and convert all callers of xfs_qm_dqput to unlock q_qlock and call xfs_qm_dqrele instead. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 0c5e80bd579f7bec3704bad6c1f72b13b0d73b53 Author: Christoph Hellwig Date: Mon Nov 10 14:22:57 2025 +0100 xfs: use a lockref for the xfs_dquot reference count The xfs_dquot structure currently uses the anti-pattern of using the in-object lock that protects the content to also serialize reference count updates for the structure, leading to a cumbersome free path. This is partially papered over by the fact that we never free the dquot directly but always through the LRU. Switch to use a lockref instead and move the reference counter manipulations out of q_qlock. To make this work, xfs_qm_flush_one and xfs_qm_flush_one are converted to acquire a dquot reference while flushing to integrate with the lockref "get if not dead" scheme. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 6129b088e1f10938b86f44948ad698b39dd19faa Author: Christoph Hellwig Date: Mon Nov 10 14:22:56 2025 +0100 xfs: remove xfs_dqunlock and friends There's really no point in wrapping the basic mutex operations. Remove the wrapper to ease lock analysis annotations and make the code a litte easier to read. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 36cebabde7866c30b71ecd074e3773dbd768a1d9 Author: Christoph Hellwig Date: Mon Nov 10 14:22:55 2025 +0100 xfs: don't treat all radix_tree_insert errors as -EEXIST Return other errors to the caller instead. Note that there really shouldn't be any other errors because the entry is preallocated, but if there were, we'd better return them instead of retrying forever. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 005d5ae0c585e11d31df1e721c04f113a8281443 Author: Christoph Hellwig Date: Mon Nov 10 14:22:54 2025 +0100 xfs: make qi_dquots a 64-bit value qi_dquots counts all quotas in the file system, which can be up to 3 * UINT_MAX and overflow a 32-bit counter, but can't be negative. Make qi_dquots a uint64_t, and saturate the value to UINT_MAX for userspace reporting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 204c8f77e8d4a3006f8abe40331f221a597ce608 Author: Christoph Hellwig Date: Mon Nov 10 14:22:53 2025 +0100 xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails xfs_qm_quotacheck_dqadjust acquired the dquot through xfs_qm_dqget, which means it owns a reference and holds q_qlock. Both need to be dropped on an error exit. Cc: # v6.13 Fixes: ca378189fdfa ("xfs: convert quotacheck to attach dquot buffers") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 0ec73eb3f12350799c4b3fb764225f6e38b42d1e Author: Christoph Hellwig Date: Mon Nov 3 05:14:09 2025 -0500 xfs: add a xfs_groups_to_rfsbs helper Plus a rtgroup wrapper and use that to avoid overflows when converting zone/rtg counts to block counts. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 1c1960f57151e36f550d1a53352f832d5aaa5f8f Merge: e109f644b871df e237dfe70867f0 Author: Jani Nikula Date: Tue Nov 11 12:32:07 2025 +0200 Merge drm/drm-next into drm-intel-next Primarily sync with the drm_print.h changes from drm-misc. Signed-off-by: Jani Nikula commit 5e88e864118c20e63a1571d0ff0a152e5d684959 Author: Abdun Nihaal Date: Mon Nov 10 23:23:15 2025 +0530 wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() In one of the error paths, the memory allocated for skb_rx is not freed. Fix that by freeing it before returning. Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Abdun Nihaal Link: https://patch.msgid.link/20251110175316.106591-1-nihaal@cse.iitm.ac.in Signed-off-by: Johannes Berg commit 9e23063a79c4e7e56199d1a0642f63830dffa9ea Author: Benjamin Berg Date: Mon Nov 10 14:20:20 2025 +0200 wifi: mac80211: make monitor link info check more specific Verify that only one of the permitted change flags is set when changing the link of a monitor interface. Before the WARN_ON_ONCE would accept anything if mu_mimo_owner was set. Also, split out the mu_mimo_owner flag and enable it for all interface types. The option is set during association when VHT is available and it is not expected that any configuration of the MU groups is done without it being set. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110141948.6696dba8678d.Icafac3be4724825dd6140e4407bae3a2adb593a5@changeid Signed-off-by: Johannes Berg commit a5aa46f1ac4f53e03b9b75cbf55634131f2f8cac Author: Benjamin Berg Date: Mon Nov 10 14:18:20 2025 +0200 wifi: mac80211: track MU-MIMO configuration on disabled interfaces For monitoring, userspace will try to configure the VIF sdata, while the driver may see the monitor_sdata that is created when only monitor interfaces are up. This causes the odd situation that it may not be possible to store the MU-MIMO configuration on monitor_sdata. Fix this by storing that information on the VIF sdata and updating the monitor_sdata when available and the interface is up. Also, adjust the code that adds monitor_sdata so that it will configure MU-MIMO based on the newly added interface or one of the existing ones. This should give a mostly consistent behaviour when configuring MU-MIMO on sniffer interfaces. Should the user configure MU-MIMO on multiple sniffer interfaces, then mac80211 will simply select one of the configurations. This behaviour should be good enough and avoids breaking user expectations in the common scenarios. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110141514.677915f8f6bb.If4e04a57052f9ca763562a67248b06fd80d0c2c1@changeid Signed-off-by: Johannes Berg commit b54cf0f4495a8f3fa94245cdda7716792400299e Author: Pagadala Yesu Anjaneyulu Date: Mon Nov 10 14:10:30 2025 +0200 wifi: cfg80211/mac80211: Add fallback mechanism for INDOOR_SP connection Implement fallback to LPI mode when SP mode is not permitted by regulatory constraints for INDOOR_SP connections. Limit fallback mechanism to client mode. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110140806.8b43201a34ae.I37fc7bb5892eb9d044d619802e8f2095fde6b296@changeid Signed-off-by: Johannes Berg commit e18efacc9c2f17b12c6e019cabad70a2989bd3a9 Author: Pagadala Yesu Anjaneyulu Date: Mon Nov 10 14:10:29 2025 +0200 wifi: cfg80211/mac80211: clean up duplicate ap_power handling Move duplicated ap_power type handling code to an inline function in cfg80211. Signed-off-by: Pagadala Yesu Anjaneyulu Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110140806.959948da1cb5.I893b5168329fb3232f249c182a35c99804112da6@changeid Signed-off-by: Johannes Berg commit 706edca67984faa3d83e397334fa5ec4190f63ba Author: Emmanuel Grumbach Date: Mon Nov 10 14:03:15 2025 +0200 wifi: cfg80211: use a C99 initializer in wiphy_register struct regulatory request was not fully initialized. While this is not really a big deal because nl80211_send_reg_change_event doesn't look at the other fields, it still makes sense to zero all the other fields as Coverity suggests. Signed-off-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251110140230.f8d4fcb1328b.I87170b1caef04356809838e684c9499f5806e624@changeid Signed-off-by: Johannes Berg commit a5d908e0ec05bd4f5dd818160f0252861879a5a2 Author: Sakari Ailus Date: Tue Nov 11 11:43:02 2025 +0200 w1: omap-hdq: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20251111094302.95003-1-sakari.ailus@linux.intel.com Signed-off-by: Krzysztof Kozlowski commit dca3aa666fbd71118905d88bb1c353881002b647 Author: Mateusz Guzik Date: Sun Nov 9 13:19:31 2025 +0100 fs: move inode fields used during fast path lookup closer together This should avoid *some* cache misses. Successful path lookup is guaranteed to load at least ->i_mode, ->i_opflags and ->i_acl. At the same time the common case will avoid looking at more fields. struct inode is not guaranteed to have any particular alignment, notably ext4 has it only aligned to 8 bytes meaning nearby fields might happen to be on the same or only adjacent cache lines depending on luck (or no luck). According to pahole: umode_t i_mode; /* 0 2 */ short unsigned int i_opflags; /* 2 2 */ kuid_t i_uid; /* 4 4 */ kgid_t i_gid; /* 8 4 */ unsigned int i_flags; /* 12 4 */ struct posix_acl * i_acl; /* 16 8 */ struct posix_acl * i_default_acl; /* 24 8 */ ->i_acl is unnecessarily separated by 8 bytes from the other fields. With struct inode being offset 48 bytes into the cacheline this means an avoidable miss. Note it will still be there for the 56 byte case. New layout: umode_t i_mode; /* 0 2 */ short unsigned int i_opflags; /* 2 2 */ unsigned int i_flags; /* 4 4 */ struct posix_acl * i_acl; /* 8 8 */ struct posix_acl * i_default_acl; /* 16 8 */ kuid_t i_uid; /* 24 4 */ kgid_t i_gid; /* 28 4 */ I verified with pahole there are no size or hole changes. This is stopgap until someone(tm) sanitizes the layout in the first place, allocation methods aside. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251109121931.1285366-1-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 8da7bea7db692e786165b71729fb68b7ff65ee56 Author: Jason Xing Date: Fri Oct 31 18:33:28 2025 +0800 xsk: add indirect call for xsk_destruct_skb Since Eric proposed an idea about adding indirect call wrappers for UDP and managed to see a huge improvement[1], the same situation can also be applied in xsk scenario. This patch adds an indirect call for xsk and helps current copy mode improve the performance by around 1% stably which was observed with IXGBE at 10Gb/sec loaded. If the throughput grows, the positive effect will be magnified. I applied this patch on top of batch xmit series[2], and was able to see <5% improvement from our internal application which is a little bit unstable though. Use INDIRECT wrappers to keep xsk_destruct_skb static as it used to be when the mitigation config is off. Be aware of the freeing path that can be very hot since the frequency can reach around 2,000,000 times per second with the xdpsock test. [1]: https://lore.kernel.org/netdev/20251006193103.2684156-2-edumazet@google.com/ [2]: https://lore.kernel.org/all/20251021131209.41491-1-kerneljasonxing@gmail.com/ Suggested-by: Alexander Lobakin Signed-off-by: Jason Xing Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20251031103328.95468-1-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni commit 97e8e73777ab21f2ea9a917a76d2186748e9f9cb Author: Liao Yuanhong Date: Thu Sep 4 19:30:34 2025 +0800 media: siano: Remove redundant ternary operators For ternary operators in the form of "a ? false : true", if 'a' itself returns a boolean result, the ternary operator can be omitted. Remove redundant ternary operators to clean up the code. Signed-off-by: Liao Yuanhong Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 1240abf4b71f632f0117b056e22488e4d9808938 Author: Haotian Zhang Date: Fri Oct 31 14:03:32 2025 +0800 media: rc: st_rc: Fix reset control resource leak The driver calls reset_control_get_optional_exclusive() but never calls reset_control_put() in error paths or in the remove function. This causes a resource leak when probe fails after successfully acquiring the reset control, or when the driver is unloaded. Switch to devm_reset_control_get_optional_exclusive() to automatically manage the reset control resource. Fixes: a4b80242d046 ("media: st-rc: explicitly request exclusive reset control") Cc: stable@vger.kernel.org Signed-off-by: Haotian Zhang Reviewed-by: Patrice Chotard Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 674961a9c87903bf2222a2c26809e013903a8960 Author: Johan Hovold Date: Fri Oct 17 08:06:26 2025 +0200 media: ir-hix5hd2: Drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 2617bd81ae54128e63e764c48935e572e3dee501 Author: Kunwu Chan Date: Mon Jan 15 17:43:30 2024 +0800 powerpc/83xx: Add a null pointer check to mcu_gpiochip_add kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20240115094330.33014-1-chentao@kylinos.cn commit f90d28443b1f4dbbbdcfea1be5295f6903acc94c Author: Bhaskar Chowdhury Date: Wed Jul 23 03:29:36 2025 +0530 arch:powerpc:tools This file was missing shebang line, so added it This file was missing the shebang line, so added it. Signed-off-by: Bhaskar Chowdhury Reviewed-by: Stephen Rothwell Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250722220043.14862-1-unixbhaskar@gmail.com commit 38c64dfe0af12778953846df5f259e913275cfe5 Author: Ben Collins Date: Mon Apr 21 22:36:46 2025 -0400 kexec: Include kernel-end even without crashkernel Certain versions of kexec don't even work without kernel-end being added to the device-tree. Add it even if crash-kernel is disabled. Signed-off-by: Ben Collins Reviewed-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/2025042122-inescapable-mandrill-8a5ff2@boujee-and-buff commit af6850ac9ef3c98e6e8f2929e24ed6fd154fa39e Author: J. Neuschäfer Date: Fri Apr 18 21:28:54 2025 +0200 powerpc: p2020: Rename wdt@ nodes to watchdog@ The watchdog.yaml schema prescribes a node name of "timer" or "watchdog" rather than the abbreviation "wdt". Signed-off-by: J. Neuschäfer Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250418-watchdog-v1-4-987ff2046272@posteo.net commit 39fe29e7f2fd38b0fee9bf987d180dee976dd2c7 Author: J. Neuschäfer Date: Fri Apr 18 21:28:53 2025 +0200 powerpc: 86xx: Rename wdt@ nodes to watchdog@ The watchdog.yaml schema prescribes a node name of "timer" or "watchdog" rather than the abbreviation "wdt". Signed-off-by: J. Neuschäfer Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250418-watchdog-v1-3-987ff2046272@posteo.net commit cc156be1e7566add1f490854133e27f091ae58b6 Author: J. Neuschäfer Date: Fri Apr 18 21:28:52 2025 +0200 powerpc: 83xx: Rename wdt@ nodes to watchdog@ The watchdog.yaml schema prescribes a node name of "timer" or "watchdog" rather than the abbreviation "wdt". Signed-off-by: J. Neuschäfer Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250418-watchdog-v1-2-987ff2046272@posteo.net commit 0070b2cbfe7389159669c3a5bb23d2ef89043055 Author: J. Neuschäfer Date: Fri Apr 18 21:28:51 2025 +0200 powerpc: 512x: Rename wdt@ node to watchdog@ The watchdog.yaml schema prescribes a node name of "timer" or "watchdog" rather than the abbreviation "wdt". Signed-off-by: J. Neuschäfer Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250418-watchdog-v1-1-987ff2046272@posteo.net commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f Author: Ben Collins Date: Mon Apr 21 22:31:13 2025 -0400 powerpc/addnote: Fix overflow on 32-bit builds The PUT_64[LB]E() macros need to cast the value to unsigned long long like the GET_64[LB]E() macros. Caused lots of warnings when compiled on 32-bit, and clobbered addresses (36-bit P4080). Signed-off-by: Ben Collins Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff commit 18b5c400482f3f42875ad3b64961bf479ea4dfaa Merge: a67ee4e2ba7643 6453937581abc0 Author: Christian Brauner Date: Tue Nov 11 10:01:37 2025 +0100 Merge patch series "ns: header cleanups and initial namespace reference count improvements" Christian Brauner says: Cleanup the namespace headers by splitting them into types and helpers. Better separate common namepace types and functions from namespace tree types and functions. Fix the reference counts of initial namespaces so we don't do any pointless cacheline ping-pong for them when we know they can never go away. Add a bunch of asserts for both the passive and active reference counts to catch any changes that would break it. * patches from https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-0-e8a9264e0fb9@kernel.org: selftests/namespaces: fix nsid tests ns: drop custom reference count initialization for initial namespaces pid: rely on common reference count behavior ns: add asserts for initial namespace active reference counts ns: add asserts for initial namespace reference counts ns: make all reference counts on initial namespace a nop ipc: enable is_ns_init_id() assertions fs: use boolean to indicate anonymous mount namespace ns: rename is_initial_namespace() ns: make is_initial_namespace() argument const nstree: use guards for ns_tree_lock nstree: simplify owner list iteration nstree: switch to new structures nstree: add helper to operate on struct ns_tree_{node,root} nstree: move nstree types into separate header nstree: decouple from ns_common header ns: move namespace types into separate header Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-0-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 6453937581abc05c5e54525c65abb46955a91cd3 Author: Christian Brauner Date: Mon Nov 10 16:08:29 2025 +0100 selftests/namespaces: fix nsid tests Ensure that we always kill and cleanup all processes. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-17-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit c2bbd2db521b018c59fb0ff8e1cdfa8ee907ba88 Author: Christian Brauner Date: Mon Nov 10 16:08:28 2025 +0100 ns: drop custom reference count initialization for initial namespaces Initial namespaces don't modify their reference count anymore. They remain fixed at one so drop the custom refcount initializations. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-16-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 282879afa01936954a570e15b4088a89b6e1b549 Author: Christian Brauner Date: Mon Nov 10 16:08:27 2025 +0100 pid: rely on common reference count behavior Now that we changed the generic reference counting mechanism for all namespaces to never manipulate reference counts of initial namespaces we can drop the special handling for pid namespaces. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-15-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 7118daabb65585163fd70eb782f1fbbdb64968a6 Author: Christian Brauner Date: Mon Nov 10 16:08:26 2025 +0100 ns: add asserts for initial namespace active reference counts They always remain fixed at one. Notice when that assumptions is broken. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-14-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 2b60d56acc5b4fcab29fc323e6b82597ec78596f Author: Christian Brauner Date: Mon Nov 10 16:08:25 2025 +0100 ns: add asserts for initial namespace reference counts They always remain fixed at one. Notice when that assumptions is broken. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-13-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 657aeb436d70c66583cb2b5b6c65ca64bcf503a8 Author: Christian Brauner Date: Mon Nov 10 16:08:24 2025 +0100 ns: make all reference counts on initial namespace a nop They are always active so no need to needlessly cacheline ping-pong. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-12-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 3826d5dd06996007c13352b7fa65625ab570f651 Author: Christian Brauner Date: Mon Nov 10 16:08:23 2025 +0100 ipc: enable is_ns_init_id() assertions The ipc namespace may call put_ipc_ns() and get_ipc_ns() before it is added to the namespace tree. Assign the id early like we do for a some other namespaces. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-11-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit d9a44089ac7754e470dfdaf3658c3455b2d7f7dd Author: Christian Brauner Date: Mon Nov 10 16:08:22 2025 +0100 fs: use boolean to indicate anonymous mount namespace Stop playing games with the namespace id and use a boolean instead: * This will remove the special-casing we need to do everywhere for mount namespaces. * It will allow us to use asserts on the namespace id for initial namespaces everywhere. * It will allow us to put anonymous mount namespaces on the namespaces trees in the future and thus make them available to statmount() and listmount(). Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-10-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 6bf253855aa8c970d2191f87ee23f9f184ddaa79 Author: Christian Brauner Date: Mon Nov 10 16:08:21 2025 +0100 ns: rename is_initial_namespace() Rename is_initial_namespace() to ns_init_inum() and make it symmetrical with the ns id variant. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-9-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit ed93c0697a8dcb70972a77bca2522a6a23ba6658 Author: Christian Brauner Date: Mon Nov 10 16:08:20 2025 +0100 ns: make is_initial_namespace() argument const We don't modify the data structure at all so pass it as const. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-8-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 298ab06ae475d8f4ba81b360d8fe4193143ae757 Author: Christian Brauner Date: Mon Nov 10 16:08:19 2025 +0100 nstree: use guards for ns_tree_lock Make use of the guard infrastructure for ns_tree_lock. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-7-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 8a30420c89a8112633b23edc6f9ceffae5cf8dad Author: Christian Brauner Date: Mon Nov 10 16:08:18 2025 +0100 nstree: simplify owner list iteration Make use of list_for_each_entry_from_rcu(). Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-6-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit a657bc8a75cf40c3d0814fe6488ba4af56528f42 Author: Christian Brauner Date: Mon Nov 10 16:08:17 2025 +0100 nstree: switch to new structures Switch the nstree management to the new combined structures. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-5-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit d12ea8062fd31f02beeeb76a7884ab9bc4f5b197 Author: Christian Brauner Date: Mon Nov 10 16:08:16 2025 +0100 nstree: add helper to operate on struct ns_tree_{node,root} Add helpers that work on the combined rbtree and rculist combined. This will make the code a lot more managable and legible. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-4-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 1c64fb02ac46f5ca93ac9f5470f124921b4713b7 Author: Christian Brauner Date: Mon Nov 10 16:08:15 2025 +0100 nstree: move nstree types into separate header Introduce two new fundamental data structures for namespace tree management in a separate header file. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-3-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit ea1549e628ec51dcbea1d158301993364b754d75 Author: Christian Brauner Date: Mon Nov 10 16:08:14 2025 +0100 nstree: decouple from ns_common header Foward declare struct ns_common and remove the include of ns_common.h. We want ns_common.h to possibly include nstree structures but not the other way around. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-2-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit 2b9a0f21fbb8a3b7df7faa5b7534897a86c44b98 Author: Christian Brauner Date: Mon Nov 10 16:08:13 2025 +0100 ns: move namespace types into separate header Add a dedicated header for namespace types. Link: https://patch.msgid.link/20251110-work-namespace-nstree-fixes-v1-1-e8a9264e0fb9@kernel.org Signed-off-by: Christian Brauner commit a67ee4e2ba7643b2ff2b808155429aa4f51d57a4 Merge: ae901e5e2e9b07 3c60b0b1e55adb Author: Christian Brauner Date: Tue Nov 11 09:59:08 2025 +0100 Merge branch 'kbuild-6.19.fms.extension' Bring in the shared branch with the kbuild tree to enable '-fms-extensions' for 6.19. Further namespace cleanup work requires this extension. Signed-off-by: Christian Brauner commit cbc8bd1b7d905b3f746542cc726837a954a46bd8 Author: Antonio Alvarez Feijoo Date: Tue Sep 16 08:18:40 2025 +0200 powerpc/boot: Add missing compression methods to usage lzma and lzo are also supported. Signed-off-by: Antonio Alvarez Feijoo Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250916061840.5492-1-antonio.feijoo@suse.com commit d2be62d5858312f3e6c36dbfc43faa1f287d5249 Author: Nathan Chancellor Date: Sat Oct 18 18:52:40 2025 +0100 powerpc/vmlinux.lds: Drop .interp description Commit da30705c4621 ("arch/powerpc: Remove .interp section in vmlinux") intended to drop the .interp section from vmlinux but even with this change, relocatable kernels linked with ld.lld contain an empty .interp section, which ends up causing crashes in GDB [1]. $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 clean pseries_le_defconfig vmlinux $ llvm-readelf -S vmlinux | grep interp [44] .interp PROGBITS c0000000021ddb34 21edb34 000000 00 A 0 0 1 There appears to be a subtle difference between GNU ld and ld.lld when it comes to discarding sections that specify load addresses [2]. Since '--no-dynamic-linker' prevents emission of the .interp section, there is no need to describe it in the output sections of the vmlinux linker script. Drop the .interp section description from vmlinux.lds.S to avoid this issue altogether. Link: https://sourceware.org/bugzilla/show_bug.cgi?id=33481 [1] Link: https://github.com/ClangBuiltLinux/linux/issues/2137 [2] Reported-by: Vishal Chourasia Closes: https://lore.kernel.org/20251013040148.560439-1-vishalc@linux.ibm.com/ Signed-off-by: Nathan Chancellor Tested-by: Vishal Chourasia Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251018-ppc-fix-lld-interp-v1-1-a083de6dccc9@kernel.org commit 1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f Author: Long Li Date: Tue Aug 19 17:10:35 2025 +0800 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse The following warning appears when running syzkaller, and this issue also exists in the mainline code. ------------[ cut here ]------------ list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48 FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The WARNING occurs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition in mac_hid_toggle_emumouse(). Both processes read old_val=0, then both try to register the input handler, leading to a double list_add of the same handler. CPU0 CPU1 ------------------------- ------------------------- vfs_write() //write 1 vfs_write() //write 1 proc_sys_write() proc_sys_write() mac_hid_toggle_emumouse() mac_hid_toggle_emumouse() old_val = *valp // old_val=0 old_val = *valp // old_val=0 mutex_lock_killable() proc_dointvec() // *valp=1 mac_hid_start_emulation() input_register_handler() mutex_unlock() mutex_lock_killable() proc_dointvec() mac_hid_start_emulation() input_register_handler() //Trigger Warning mutex_unlock() Fix this by moving the old_val read inside the mutex lock region. Fixes: 99b089c3c38a ("Input: Mac button emulation - implement as an input filter") Signed-off-by: Long Li Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250819091035.2263329-1-leo.lilong@huaweicloud.com commit ededb7bcdfdbcfbb7af93e3a543165a9553e1683 Author: Danilo Krummrich Date: Mon Nov 3 20:06:50 2025 +0100 rust: dma: use NonNull instead of *mut T In struct CoherentAllocation, use NonNull instead of a raw *mut T for the CPU address; the CPU address of a valid CoherentAllocation won't ever be NULL. Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251103190655.2326191-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit f7afdc473794ab71d38475755be72dc95e361c31 Author: Danilo Krummrich Date: Mon Nov 3 20:06:49 2025 +0100 rust: dma: make use of start_ptr() and start_ptr_mut() Using start_ptr() and start_ptr_mut() has the advantage that we inherit the requirements the a mutable or immutable reference from those methods. Hence, use them instead of self.cpu_addr. Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251103190655.2326191-1-dakr@kernel.org [ Keep using self.cpu_addr in item_from_index(). - Danilo ] Signed-off-by: Danilo Krummrich commit d8407396f128d8bf4d06282b636df3f26db208c1 Author: Danilo Krummrich Date: Wed Nov 5 13:03:28 2025 +0100 rust: pci: use "kernel vertical" style for imports Convert all imports in the PCI Rust module to use "kernel vertical" style. With this subsequent patches neither introduce unrelated changes nor leave an inconsistent import pattern. While at it, drop unnecessary imports covered by prelude::*. Link: https://docs.kernel.org/rust/coding-guidelines.html#imports Reviewed-by: Zhi Wang Link: https://patch.msgid.link/20251105120352.77603-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 10e1c77c3636d815db802ceef588522c2d2d947c Author: Christophe Leroy Date: Fri Sep 12 10:37:34 2025 +0200 powerpc/32: Fix unpaired stwcx. on interrupt exit Commit b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C exception exit from ppc64") erroneouly copied to powerpc/32 the logic from powerpc/64 based on feature CPU_FTR_STCX_CHECKS_ADDRESS which is always 0 on powerpc/32. Re-instate the logic implemented by commit b64f87c16f3c ("[POWERPC] Avoid unpaired stwcx. on some processors") which is based on CPU_FTR_NEED_PAIRED_STWCX feature. Fixes: b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C exception exit from ppc64") Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/6040b5dbcf5cdaa1cd919fcf0790f12974ea6e5a.1757666244.git.christophe.leroy@csgroup.eu commit 9d39842f6afcd0438c8353a9764d624eef2d160a Author: Danilo Krummrich Date: Tue Nov 4 14:32:54 2025 +0100 rust: io: cleanup imports and use "kernel vertical" style Commit 46f045db5a94 ("rust: Add read_poll_timeout_atomic function") initiated the first import change in the I/O module using the agreed "kernel vertical" import style [1]. For consistency throughout the module, adjust all other imports accordingly. While at it, drop unnecessary imports covered by prelude::*. Link: https://docs.kernel.org/rust/coding-guidelines.html#imports [1] Reviewed-by: Zhi Wang Link: https://patch.msgid.link/20251104133301.59402-1-dakr@kernel.org [ Use prelude::* in io/poll.rs. - Danilo ] Signed-off-by: Danilo Krummrich commit 2997876c4a1a5864baa13d7393c2b68cf5b51183 Author: Christophe Leroy Date: Thu Sep 11 14:30:12 2025 +0200 powerpc/32: Restore clearing of MSR[RI] at interrupt/syscall exit Commit 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt") removed the inconditional clearing of MSR[RI] when returning from interrupt into kernel. But powerpc/32 doesn't implement interrupt restart table hence still need MSR[RI] to be cleared. It could be added back in interrupt_exit_kernel_prepare() but it is easier and better to add it back in entry_32.S for following reasons: - Writing to MSR must be followed by a synchronising instruction - The smaller the non recoverable section is the better it is So add a macro called clr_ri and use it in the three places that play up with SRR0/SRR1. Use it just before another mtspr for synchronisation to avoid having to add an isync. Now that's done in entry_32.S, exit_must_hard_disable() can return false for non book3s/64, taking into account that BOOKE doesn't have MSR_RI. Also add back blacklisting syscall_exit_finish for kprobe. This was initially added by commit 7cdf44013885 ("powerpc/entry32: Blacklist syscall exit points for kprobe.") then lost with commit 6f76a01173cc ("powerpc/syscall: implement system call entry/exit logic in C for PPC32"). Fixes: 6f76a01173cc ("powerpc/syscall: implement system call entry/exit logic in C for PPC32") Fixes: 13799748b957 ("powerpc/64: use interrupt restart table to speed up return from interrupt") Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/66d0ab070563ad460ed481328ab0887c27f21a2c.1757593807.git.christophe.leroy@csgroup.eu commit 98fa236044ca4f8841107382fb03832101fa7328 Author: Christophe Leroy Date: Wed Aug 27 16:18:53 2025 +0200 powerpc/8xx: Remove specific code from fast_exception_return The label 2: in fast_exception_return is a leftover from commit b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C exception exit from ppc64"). Once removed, we see that fast_exception_return is a standalone function that is called only from pieces of assembly dedicated to book3s/32 or booke, never by common code or 8xx code. So remove the clear of MSR[RI] enclosed in #ifdef CONFIG_PPC_8xx. Signed-off-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/39de3e0f0122b571474b1ba352a2dc3ad8cb71dd.1756304318.git.christophe.leroy@csgroup.eu commit 7afe2383eff05f76f4ce2cfda658b7889c89f101 Author: Sourabh Jain Date: Wed Nov 5 09:09:41 2025 +0530 powerpc/kdump: Fix size calculation for hot-removed memory ranges The elfcorehdr segment in the kdump image stores information about the memory regions (called crash memory ranges) that the kdump kernel must capture. When a memory hot-remove event occurs, the kernel regenerates the elfcorehdr for the currently loaded kdump image to remove the hot-removed memory from the crash memory ranges. Call chain: remove_mem_range() update_crash_elfcorehdr() arch_crash_handle_hotplug_event() crash_handle_hotplug_event() While removing the hot-removed memory from the crash memory ranges in remove_mem_range(), if the removed memory lies within an existing crash range, that range is split into two. During this split, the size of the second range was being calculated incorrectly. This leads to dump capture failure with makedumpfile with below error: $ makedumpfile -l -d 31 /proc/vmcore /tmp/vmcore readpage_elf: Attempt to read non-existent page at 0xbbdab0000. readmem: type_addr: 0, addr:c000000bbdab7f00, size:16 validate_mem_section: Can't read mem_section array. readpage_elf: Attempt to read non-existent page at 0xbbdab0000. readmem: type_addr: 0, addr:c000000bbdab7f00, size:8 get_mm_sparsemem: Can't get the address of mem_section. The updated crash memory range in PT_LOAD entry is holding incorrect data (checkout FileSiz and MemSiz): readelf -a /proc/vmcore Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000b013d0000 0xc000000b80000000 0x0000000b80000000 0xffffffffc0000000 0xffffffffc0000000 RWE 0x0 Update the size calculation for the new crash memory range to fix this issue. Note: This problem will not occur if the kdump kernel is loaded or reloaded after a memory hot-remove operation. Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support") Reported-by: Shirisha G Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251105033941.1752287-1-sourabhjain@linux.ibm.com commit b4a96ab50f368afc2360ff539a20254ca2c9a889 Author: Sourabh Jain Date: Fri Nov 7 13:33:34 2025 +0530 powerpc/kdump: Add support for crashkernel CMA reservation Commit 35c18f2933c5 ("Add a new optional ",cma" suffix to the crashkernel= command line option") and commit ab475510e042 ("kdump: implement reserve_crashkernel_cma") added CMA support for kdump crashkernel reservation. Extend crashkernel CMA reservation support to powerpc. The following changes are made to enable CMA reservation on powerpc: - Parse and obtain the CMA reservation size along with other crashkernel parameters - Call reserve_crashkernel_cma() to allocate the CMA region for kdump - Include the CMA-reserved ranges in the usable memory ranges for the kdump kernel to use. - Exclude the CMA-reserved ranges from the crash kernel memory to prevent them from being exported through /proc/vmcore. With the introduction of the CMA crashkernel regions, crash_exclude_mem_range() needs to be called multiple times to exclude both crashk_res and crashk_cma_ranges from the crash memory ranges. To avoid repetitive logic for validating mem_ranges size and handling reallocation when required, this functionality is moved to a new wrapper function crash_exclude_mem_range_guarded(). To ensure proper CMA reservation, reserve_crashkernel_cma() is called after pageblock_order is initialized. Update kernel-parameters.txt to document CMA support for crashkernel on powerpc architecture. Signed-off-by: Sourabh Jain Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20251107080334.708028-1-sourabhjain@linux.ibm.com commit 8127c4fdf169465b631b62f7e45a042ced32dc77 Author: Srikar Dronamraju Date: Wed Jul 16 16:15:56 2025 +0530 pseries/lparcfg: Add resource group monitoring Systems can now be partitioned into resource groups. By default all systems will be part of default resource group. Once a resource group is created, and resources allocated to the resource group, those resources will be removed from the default resource group. If a LPAR moved to a resource group, then it can only use resources in the resource group. So maximum processors that can be allocated to a LPAR can be equal or smaller than the resources in the resource group. lparcfg can now exposes the resource group id to which this LPAR belongs to. It also exposes the number of processors in the current resource group. The default resource group id happens to be 0. These would be documented in the upcoming PAPR update. Example of an LPAR in a default resource group root@ltcp11-lp3 $ grep resource_group /proc/powerpc/lparcfg resource_group_number=0 resource_group_active_processors=50 root@ltcp11-lp3 $ Example of an LPAR in a non-default resource group root@ltcp11-lp5 $ grep resource_group /proc/powerpc/lparcfg resource_group_number=1 resource_group_active_processors=30 root@ltcp11-lp5 $ Signed-off-by: Srikar Dronamraju Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250716104600.59102-1-srikar@linux.ibm.com commit adf6a5a275af6f75972e6d068ed9af4d50fd7493 Author: Frank Li Date: Wed Oct 22 16:43:22 2025 -0400 ARM: dts: imx: add vdd-supply and vddio-supply for fsl,mpl3115 Add vdd-supply and vddio-supply for fsl,mpl3115 to fix below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx53-ppd.dtb: pressure-sensor@60 (fsl,mpl3115): 'vdd-supply' is a required property Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 6b416cb376f42b0d58276d58677e7c925cfb517a Author: Frank Li Date: Wed Oct 22 16:43:21 2025 -0400 arm64: dts: imx8: add vdd-supply and vddio-supply for fsl,mpl3115 Add vdd-supply and vddio-supply for fsl,mpl3115 to fix CHECK_DTBS warning: arch/arm64/boot/dts/freescale/imx8qm-mek.dtb: pressure-sensor@60 (fsl,mpl3115): 'vdd-supply' is a required property from schema $id: http://devicetree.org/schemas/iio/pressure/fsl,mpl3115.yaml# Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 7753a51e61be2cf728e07d5a72d04ef81f3fee5a Author: Frank Li Date: Wed Oct 22 12:50:28 2025 -0400 arm64: dts: imx8dxl-ss-conn: delete usb3_lpcg node Delete usb3_lpcg node for imx8dxl because not exist at such hardware. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit dadcd4b92adf579007146bcffd50769dd37e0183 Author: Frank Li Date: Wed Oct 22 12:50:27 2025 -0400 arm64: dts: imx8-ss-conn: add missed clock enet_2x_txclk for fec[1,2] Add missed clock enet_2x_txclk for fec[1,2]. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit d8ce633518b4b92b9d48e0769d0faa1ff9b548d7 Author: Frank Li Date: Wed Oct 22 12:50:26 2025 -0400 arm64: dts: imx8-ss-conn: add fsl,tuning-step for usdhc1 and usdhc2 Add fsl,tuning-step for usdhc1 and usdhc2 to improve card compatibility. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 1ddf34137c739bec9c7ce0db49c4b5b9eabed62a Author: Shenwei Wang Date: Wed Oct 22 12:50:25 2025 -0400 arm64: dts: imx8: add default clock rate for usdhc Add default clock rate for usdhc nodes to support higher transfer speed. Signed-off-by: Shenwei Wang Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 7db8963633a7f2525563cc7320da975c48b7f139 Author: Frank Li Date: Wed Oct 22 12:50:24 2025 -0400 arm64: dts: imx8dxl-evk: add state_100mhz and state_200mhz for usdhc Default, state_100mhz and state_200mhz use the same settings. But current kernel driver use these to indicate if sd3.0 support. Add max-frequency for usdhc2 because board design limitation. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 1b9b4e66451501c2950ed835aaf8a8ce2d948178 Author: Frank Li Date: Wed Oct 22 12:50:23 2025 -0400 arm64: dts: imx8dxl-evk: add bt information for lpuart1 Add BT information for lpuart1. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit e279039c3ec3708707961daa7234e4a5fd645ad3 Author: Chen Ni Date: Tue Nov 11 13:44:15 2025 +0800 perf symbol: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Signed-off-by: Namhyung Kim commit 2a084f4ad727244768b919455aa9dc1c04630487 Merge: e237dfe70867f0 2e640e8e7b9e9f Author: Dave Airlie Date: Tue Nov 11 15:04:05 2025 +1000 Merge tag 'amd-drm-next-6.19-2025-11-07' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.19-2025-11-07: amdgpu: - Misc fixes - HMM cleanup - HDP flush rework - RAS updates - SMU 13.x updates - SI DPM cleanup - Suspend rework - UQ reset support - Replay/PSR fixes - HDCP updates - DC PMO fixes - DC pstate fixes - DCN4 fixes - GPUVM fixes - SMU 13 parition metrics - Fix possible fence leak in job cleanup - Hibernation fix - MST fix amdkfd: - HMM cleanup - Process cleanup fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patch.msgid.link/20251107145938.26669-1-alexander.deucher@amd.com commit bb31fef0d03ed17d587b40e3458786be408fb9df Author: Gautham R. Shenoy Date: Fri Nov 7 13:11:45 2025 +0530 cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs amd_pstate_change_mode_without_dvr_change() calls cppc_set_auto_sel() for all the present CPUs. However, this callpath eventually calls cppc_set_reg_val() which accesses the per-cpu cpc_desc_ptr object. This object is initialized only for online CPUs via acpi_soft_cpu_online() --> __acpi_processor_start() --> acpi_cppc_processor_probe(). Hence, restrict calling cppc_set_auto_sel() to only the online CPUs. Fixes: 3ca7bc818d8c ("cpufreq: amd-pstate: Add guided mode control support via sysfs") Suggested-by: Mario Limonciello (AMD) (kernel.org) Signed-off-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 077f23573d29d063a950e90aa77c8e1f79580147 Author: Mario Limonciello (AMD) Date: Thu Oct 9 11:17:56 2025 -0500 cpufreq/amd-pstate: Add static asserts for EPP indices In case a new index is introduced add a static assert to make sure that strings and values are updated. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit e9d62ca86a5525a742742fe69e9aa316cfd4f471 Author: Mario Limonciello (AMD) Date: Thu Oct 9 11:17:55 2025 -0500 cpufreq/amd-pstate: Fix some whitespace issues Add whitespace around the equals and remove leading space. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 92d6146a40b2d5ce0b9dcc7b3ff28d57b4757ed1 Author: Mario Limonciello (AMD) Date: Thu Oct 9 11:17:54 2025 -0500 cpufreq/amd-pstate: Adjust return values in amd_pstate_update_status() get_mode_idx_from_str() already checks the upper boundary for a string sent. Drop the extra check in amd_pstate_update_status() and pass the return code if there is a failure. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit baf106f3a7ba8bf317e1f9d32ee88955723cbc71 Author: Mario Limonciello (AMD) Date: Thu Oct 9 11:17:53 2025 -0500 cpufreq/amd-pstate: Make amd_pstate_get_mode_string() never return NULL amd_pstate_get_mode_string() is only used by amd-pstate-ut. Set the failure path to use AMD_PSTATE_UNDEFINED ("undefined") to avoid showing "(null)" as a string when running test suite. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 06791bc017ea0793dae71553163c9107e91c415b Author: Mario Limonciello (AMD) Date: Thu Oct 9 11:17:52 2025 -0500 cpufreq/amd-pstate: Drop NULL value from amd_pstate_mode_string None of the users actually look for the NULL value. To avoid risk of regression introducing a new value but forgetting to add a string add a static assert to test AMD_PSTATE_MAX matches the array size. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 7e17f48667b6707593fc215cbe025157920934f1 Author: Mario Limonciello (AMD) Date: Thu Oct 9 11:17:51 2025 -0500 cpufreq/amd-pstate: Use sysfs_match_string() for epp Rather than scanning the buffer and manually matching the string use the sysfs macros. Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello (AMD) commit 62ed1b58224636185fa689db81224b8c8af46473 Author: Li Nan Date: Mon Nov 3 20:57:57 2025 +0800 md: allow configuring logical block size Previously, raid array used the maximum logical block size (LBS) of all member disks. Adding a larger LBS disk at runtime could unexpectedly increase RAID's LBS, risking corruption of existing partitions. This can be reproduced by: ``` # LBS of sd[de] is 512 bytes, sdf is 4096 bytes. mdadm -CRq /dev/md0 -l1 -n3 /dev/sd[de] missing --assume-clean # LBS is 512 cat /sys/block/md0/queue/logical_block_size # create partition md0p1 parted -s /dev/md0 mklabel gpt mkpart primary 1MiB 100% lsblk | grep md0p1 # LBS becomes 4096 after adding sdf mdadm --add -q /dev/md0 /dev/sdf cat /sys/block/md0/queue/logical_block_size # partition lost partprobe /dev/md0 lsblk | grep md0p1 ``` Simply restricting larger-LBS disks is inflexible. In some scenarios, only disks with 512 bytes LBS are available currently, but later, disks with 4KB LBS may be added to the array. Making LBS configurable is the best way to solve this scenario. After this patch, the raid will: - store LBS in disk metadata - add a read-write sysfs 'mdX/logical_block_size' Future mdadm should support setting LBS via metadata field during RAID creation and the new sysfs. Though the kernel allows runtime LBS changes, users should avoid modifying it after creating partitions or filesystems to prevent compatibility issues. Only 1.x metadata supports configurable LBS. 0.90 metadata inits all fields to default values at auto-detect. Supporting 0.90 would require more extensive changes and no such use case has been observed. Note that many RAID paths rely on PAGE_SIZE alignment, including for metadata I/O. A larger LBS than PAGE_SIZE will result in metadata read/write failures. So this config should be prevented. Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-6-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Xiao Ni Signed-off-by: Yu Kuai commit 9c47127a807da3e36ce80f7c83a1134a291fc021 Author: Li Nan Date: Mon Nov 3 20:57:56 2025 +0800 md: add check_new_feature module parameter Raid checks if pad3 is zero when loading superblock from disk. Arrays created with new features may fail to assemble on old kernels as pad3 is used. Add module parameter check_new_feature to bypass this check. Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-5-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Xiao Ni Signed-off-by: Yu Kuai commit 2107457e31fa138b4baa0bccf309d6fdcf9f47dd Author: Li Nan Date: Mon Nov 3 20:57:55 2025 +0800 md/raid0: Move queue limit setup before r0conf initialization Prepare for making logical blocksize configurable. This change has no impact until logical block size becomes configurable. Move raid0_set_limits() before create_strip_zones(). It is safe as fields modified in create_strip_zones() do not involve mddev configuration, and rdev modifications there are not used in raid0_set_limits(). 'blksize' in create_strip_zones() fetches mddev's logical block size, which is already the maximum aross all rdevs, so the later max() can be removed. Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-4-linan666@huaweicloud.com Signed-off-by: Li Nan Reviewed-by: Xiao Ni Signed-off-by: Yu Kuai commit 381a3ce1c0ffed647c9b913e142b099c7e9d5afc Author: Li Nan Date: Mon Nov 3 20:57:54 2025 +0800 md: init bioset in mddev_init IO operations may be needed before md_run(), such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below: BUG: kernel NULL pointer dereference, address: 0000000000000020 Call Trace: md_update_sb+0x658/0xe00 new_level_store+0xc5/0x120 md_attr_store+0xc9/0x1e0 sysfs_kf_write+0x6f/0xa0 kernfs_fop_write_iter+0x141/0x2a0 vfs_write+0x1fc/0x5a0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x2818/0x2880 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Reproducer ``` mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd] echo inactive > /sys/block/md0/md/array_state echo 10 > /sys/block/md0/md/new_level ``` mddev_init() can only be called once per mddev, no need to test if bioset has been initialized anymore. Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-3-linan666@huaweicloud.com Fixes: d981ed841930 ("md: Add new_level sysfs interface") Signed-off-by: Li Nan Reviewed-by: Xiao Ni Signed-off-by: Yu Kuai commit 0ce112d9171ad766d4c6716951e73f91a0bfc184 Author: Li Nan Date: Mon Nov 3 20:57:53 2025 +0800 md: delete md_redundancy_group when array is becoming inactive 'md_redundancy_group' are created in md_run() and deleted in del_gendisk(), but these are not paired. Writing inactive/active to sysfs array_state can trigger md_run() multiple times without del_gendisk(), leading to duplicate creation as below: sysfs: cannot create duplicate filename '/devices/virtual/block/md0/md/sync_action' Call Trace: dump_stack_lvl+0x9f/0x120 dump_stack+0x14/0x20 sysfs_warn_dup+0x96/0xc0 sysfs_add_file_mode_ns+0x19c/0x1b0 internal_create_group+0x213/0x830 sysfs_create_group+0x17/0x20 md_run+0x856/0xe60 ? __x64_sys_openat+0x23/0x30 do_md_run+0x26/0x1d0 array_state_store+0x559/0x760 md_attr_store+0xc9/0x1e0 sysfs_kf_write+0x6f/0xa0 kernfs_fop_write_iter+0x141/0x2a0 vfs_write+0x1fc/0x5a0 ksys_write+0x79/0x180 __x64_sys_write+0x1d/0x30 x64_sys_call+0x2818/0x2880 do_syscall_64+0xa9/0x580 entry_SYSCALL_64_after_hwframe+0x4b/0x53 md: cannot register extra attributes for md0 Creation of it depends on 'pers', its lifecycle cannot be aligned with gendisk. So fix this issue by triggering 'md_redundancy_group' deletion when the array is becoming inactive. Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-2-linan666@huaweicloud.com Fixes: 790abe4d77af ("md: remove/add redundancy group only in level change") Signed-off-by: Li Nan Reviewed-by: Xiao Ni Signed-off-by: Yu Kuai commit 6c6b66f65e5510eb5de6a2342d6b37ac5c7bd678 Author: Li Nan Date: Thu Sep 18 19:57:58 2025 +0800 md: prevent adding disks with larger logical_block_size to active arrays When adding a disk to a md array, avoid updating the array's logical_block_size to match the new disk. This prevents accidental partition table loss that renders the array unusable. The later patch will introduce a way to configure the array's logical_block_size. The issue was introduced before Linux 2.6.12-rc2. Link: https://lore.kernel.org/linux-raid/20250918115759.334067-2-linan666@huaweicloud.com/ Fixes: d2e45eace8 ("[PATCH] Fix raid "bio too big" failures") Signed-off-by: Li Nan Reviewed-by: Martin K. Petersen Signed-off-by: Yu Kuai commit 1aa4ee5338cbca1c5118d5a09b523d3818dddc2f Author: Khairul Anuar Romli Date: Fri Nov 7 07:35:26 2025 +0800 arm64: dts: socfpga: Add Agilex5 SVC node with memory region Introduce the Stratix10 SoC Service Layer (SVC) node for Agilex5 SoCs. This node includes the compatible string "intel,agilex5-svc" and references a reserved memory region used for communication with the Secure Device Manager (SDM). Agilex5 introduces changes in how reserved memory is mapped and accessed compared to previous SoC generations. This commit updates the device tree structure to support Agilex5-specific handling of the SVC interface. Signed-off-by: Khairul Anuar Romli Signed-off-by: Dinh Nguyen commit b981e100c19dcd91ce8cca8562c3cdabd4fcf28c Author: Heiner Kallweit Date: Sat Nov 8 22:59:51 2025 +0100 net: dsa: loop: use new helper fixed_phy_register_100fd to simplify the code Use new helper fixed_phy_register_100fd to simplify the code. Signed-off-by: Heiner Kallweit Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/922f1b45-1748-4dd2-87eb-9d018df44731@gmail.com Signed-off-by: Jakub Kicinski commit e483a615a609d558d7ca8c161f6aedfb39226e7b Author: Marco Crivellari Date: Fri Nov 7 14:44:52 2025 +0100 isdn: kcapi: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107134452.198378-1-marco.crivellari@suse.com Signed-off-by: Jakub Kicinski commit 12e6bea1aac85cc98a55031ebf10db969eeafa34 Author: Ping-Ke Shih Date: Thu Nov 6 08:49:32 2025 +0800 wifi: rtlwifi: rtl8188ee: correct allstasleep in P2P PS H2C command The "->allstasleep" variable is a 1 bit bitfield. It can only be 0 or 1. This "= -1" assignement should be "= 0" as other chips and vendor driver. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/5c992936-4e7b-4c0a-abfc-0ec0fb9ef9fd@suswa.mountain/T/#t Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/1762390172-21091-1-git-send-email-pkshih@realtek.com commit 623c177323ec16c2c72b4ea0ad68bda223928488 Author: Bitterblue Smith Date: Fri Nov 7 18:10:19 2025 +0200 wifi: rtw89: Enable the new rtw89_8852au module Tested in station mode and a little in AP mode. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/180a5e77-9297-4ffc-80d5-191dfef47661@gmail.com commit 0029ccab53accee4919971547f4e38036ef62b2f Author: Bitterblue Smith Date: Fri Nov 7 18:09:22 2025 +0200 wifi: rtw89: Add rtw8852au.c This is the entry point of the new rtw89_8852au module. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/9580e5be-2bd1-45f9-ab75-616b86e25694@gmail.com commit 1dfd11e70022a0117bdf3fd02d2b541c9c732845 Author: Bitterblue Smith Date: Fri Nov 7 18:08:46 2025 +0200 wifi: rtw89: 8852a: Accept USB devices and load their MAC address Make rtw8852a_read_efuse() accept USB devices and load the MAC address from the correct offset. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/97412e2c-ac98-403c-9056-9d9fe1ed9f28@gmail.com commit c19b106609f398b3b1b14a89dc68ed0244420d08 Author: Bitterblue Smith Date: Fri Nov 7 18:08:14 2025 +0200 wifi: rtw89: Add rtw8852a_hfc_param_ini_usb "hfc" means "hci fc" which is "Host Control Interface Flow Control". These are some parameters needed for RTL8852AU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/d1032888-2a53-4c52-a8b9-6e00cd6758dc@gmail.com commit 0eea5e0f03db84d3d1a1a8926fca12295bda1f04 Author: Bitterblue Smith Date: Fri Nov 7 18:07:06 2025 +0200 wifi: rtw89: Add rtw8852a_dle_mem_usb Add rtw8852a_dle_mem_usb and its various quotas and sizes in struct rtw89_mac_size_set. "dle" could be "Data Link Engine" or "Double Link Engine". These are some parameters needed for RTL8852AU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/d0a09039-97a8-4501-b023-510c126d8c61@gmail.com commit 233542f5b4a8ea1fe3535f8021d37e7e92ffc4e5 Author: Bitterblue Smith Date: Fri Nov 7 18:06:27 2025 +0200 wifi: rtw89: Use the correct power sequences for USB/SDIO Make rtw89_mac_pwr_seq() select the right parts of the power sequences based on the interface type. This is only relevant for RTL8852A. The other chips don't use power sequences. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/dec13310-06eb-429e-acb8-4c5b62656836@gmail.com commit d5a9ae217b22d0646b0ed4f6fcf9fcc9254a7b97 Merge: 71bc986cd16d6e 09a81a0f4fb734 Author: Jakub Kicinski Date: Mon Nov 10 17:36:40 2025 -0800 Merge branch 'gve-improve-rx-buffer-length-management' Ankit Garg says: ==================== gve: Improve RX buffer length management This patch series improves the management of the RX buffer length for the DQO queue format in the gve driver. The goal is to make RX buffer length config more explicit, easy to change, and performant by default. We accomplish that in four patches: 1. Currently, the buffer length is implicitly coupled with the header split setting, which is an unintuitive and restrictive design. The first patch decouples the RX buffer length from the header split configuration. 2. The second patch is a preparatory step for third. It converts the XDP config verification method to use extack for better error reporting. 3. The third patch exposes the `rx_buf_len` parameter to userspace via ethtool, allowing user to directly view or modify the RX buffer length if supported by the device. 4. The final patch improves the out-of-the-box RX single stream throughput by >10% by changing the driver's default behavior to select the maximum supported RX buffer length advertised by the device during initialization. ==================== Link: https://patch.msgid.link/20251106192746.243525-1-joshwash@google.com Signed-off-by: Jakub Kicinski commit 09a81a0f4fb7346f80a7340f725aedccff8ef8e4 Author: Ankit Garg Date: Thu Nov 6 11:27:46 2025 -0800 gve: Default to max_rx_buffer_size for DQO if device supported Change the driver's default behavior to prefer the largest available RX buffer length supported by the device for DQO format, rather than always using the hardcoded 2K default. Previously, the driver would initialize with `GVE_DEFAULT_RX_BUFFER_SIZE` (2K), even if the device advertised support for a larger length (e.g., 4K). Performance observations: - With LRO disabled, we observed >10% improvement in RX single stream throughput when MTU >=2048. - With LRO enabled, we observed >10% improvement in RX single stream throughput when MTU >=1460. - No regressions were observed. Signed-off-by: Ankit Garg Reviewed-by: Harshitha Ramamurthy Reviewed-by: Jordan Rhee Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251106192746.243525-5-joshwash@google.com Signed-off-by: Jakub Kicinski commit d235bb213f411ace8317bcca3740a1008628ea9c Author: Ankit Garg Date: Thu Nov 6 11:27:45 2025 -0800 gve: Allow ethtool to configure rx_buf_len Add support for getting and setting the RX buffer length via the ethtool ring parameters (`ethtool -g`/`-G`). The driver restricts the allowed buffer length to 2048 (SZ_2K) by default and allows 4096 (SZ_4K) based on device options. As XDP is only supported when the `rx_buf_len` is 2048, the driver now enforces this in two places: 1. In `gve_xdp_set`, rejecting XDP programs if the current buffer length is not 2048. 2. In `gve_set_rx_buf_len_config`, rejecting buffer length changes if XDP is loaded and the new length is not 2048. Signed-off-by: Ankit Garg Reviewed-by: Harshitha Ramamurthy Reviewed-by: Jordan Rhee Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251106192746.243525-4-joshwash@google.com Signed-off-by: Jakub Kicinski commit 091a3b6ff2b98354270cb9278faad6d17d5aa27d Author: Ankit Garg Date: Thu Nov 6 11:27:44 2025 -0800 gve: Use extack to log xdp config verification errors Plumb extack as it allows us to send more detailed error messages back and append 'gve' suffix to method name per convention. NL_SET_ERR_MSG_FMT_MOD doesn't support format string longer than 80 chars so keeping netdev warning with actual queue count details. Signed-off-by: Ankit Garg Reviewed-by: Harshitha Ramamurthy Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251106192746.243525-3-joshwash@google.com Signed-off-by: Jakub Kicinski commit 40fef85ceb9cce2021f7ba5ca6e3212baa193cb3 Author: Ankit Garg Date: Thu Nov 6 11:27:43 2025 -0800 gve: Decouple header split from RX buffer length Previously, enabling header split via `gve_set_hsplit_config` also implicitly changed the RX buffer length to 4K (if supported by the device). This coupled two settings that should be orthogonal; this patch removes that side effect. After this change, `gve_set_hsplit_config` only toggles the header split configuration. The RX buffer length is no longer affected and must be configured independently. Signed-off-by: Ankit Garg Reviewed-by: Harshitha Ramamurthy Reviewed-by: Jordan Rhee Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Link: https://patch.msgid.link/20251106192746.243525-2-joshwash@google.com Signed-off-by: Jakub Kicinski commit 71bc986cd16d6e65842364d4b84873fe2c64a90a Merge: 7ff14c52049eaf 34bf68a691227f Author: Jakub Kicinski Date: Mon Nov 10 17:30:43 2025 -0800 Merge branch 'net-stmmac-ingenic-convert-to-set_phy_intf_sel' Russell King says: ==================== net: stmmac: ingenic: convert to set_phy_intf_sel() Convert ingenic to use the new ->set_phy_intf_sel() method that was recently introduced in net-next. This is the largest of the conversions, as there is scope for cleanups along with the conversion. ==================== Link: https://patch.msgid.link/aQ2tgEu-dudzlZlg@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 34bf68a691227faac490a313b7925ed10cf8de15 Author: Russell King (Oracle) Date: Fri Nov 7 08:29:26 2025 +0000 net: stmmac: ingenic: use ->set_phy_intf_sel() Rather than placing the phy_intf_sel() setup in the ->init() method, move it to the new ->set_phy_intf_sel() method. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHqY-0000000Djrn-1D6H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9352f74fd13de34468be95291bdb0782aac8ca3d Author: Russell King (Oracle) Date: Fri Nov 7 08:29:21 2025 +0000 net: stmmac: ingenic: pass ingenic_mac struct rather than plat_dat It no longer makes sense to pass a pointer to struct plat_stmmacenet_data when calling the set_mode() methods to only use it to get a pointer to the ingenic_mac structure that we already had in the caller. Simplify this by passing the struct ingenic_mac pointer. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHqT-0000000Djrh-0ka3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2284cca0bced3cd8c1cb643d1ae6923a75e47265 Author: Russell King (Oracle) Date: Fri Nov 7 08:29:16 2025 +0000 net: stmmac: ingenic: simplify x2000 mac_set_mode() As per the previous commit, we have validated that the phy_intf_sel value is one that is permissible for this SoC, so there is no need to handle invalid PHY interface modes. We can also apply the other configuration based upon the phy_intf_sel value rather than the PHY interface mode. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHqO-0000000Djrb-0DPN@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 608975d4d791644d15b286b2b7bfcd25359c979f Author: Russell King (Oracle) Date: Fri Nov 7 08:29:10 2025 +0000 net: stmmac: ingenic: simplify mac_set_mode() methods x1000, x1600 and x1830 only accept RMII mode. PHY_INTF_SEL_RMII is only selected with PHY_INTERFACE_MODE_RMII, and PHY_INTF_SEL_RMII has been validated by the SoC's .valid_phy_intf_sel bitmask. Thus, checking the interface mode in these functions becomes unnecessary. Remove these. jz4775 is similar, except for a greater set of PHY_INTF_SEL_x valies. Also remove the switch statement here. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHqI-0000000DjrV-3ygL@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 35147b5c9e414c1ced1903c0447609643d03e2f3 Author: Russell King (Oracle) Date: Fri Nov 7 08:29:05 2025 +0000 net: stmmac: ingenic: move "MAC PHY control register" debug Move the printing of the MAC PHY control register interface mode setting into ingenic_set_phy_intf_sel(), and use phy_modes() to print the string rather than using the enum name. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHqD-0000000DjrP-3aaU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0e2fa91c55c05f441417489957a1f909ff6c9aa1 Author: Russell King (Oracle) Date: Fri Nov 7 08:29:00 2025 +0000 net: stmmac: ingenic: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result against the SoC specific supported phy_intf_sel values, and pass into the SoC specific set_mode() methods, replacing the local phy_intf_sel variable. This provides the value for the MACPHYC_PHY_INFT_MASK field. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHq8-0000000DjrJ-2NRK@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 14497aaa5eb63f7d77cf72c281afe330baea970b Author: Russell King (Oracle) Date: Fri Nov 7 08:28:55 2025 +0000 net: stmmac: ingenic: prep PHY_INTF_SEL_x field after switch() Move the preparation of the PHY_INTF_SEL_x bitfield out of the switch() statement such that it only appears once. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHq3-0000000DjrD-1u8O@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit dbf99dc7d166944df4af1f52351a355512e1c573 Author: Russell King (Oracle) Date: Fri Nov 7 08:28:50 2025 +0000 net: stmmac: ingenic: use PHY_INTF_SEL_x directly Use the PHY_INTF_SEL_x values directly in each of the mac_set_mode methods rather than the driver private MACPHYC_PHY_INFT_x definitions. Remove the MACPHYC_PHY_INFT_x definitions. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHpy-0000000Djr7-1R1m@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit da6e9fd1046f1b936d8dd1db738ffb06f21851c0 Author: Russell King (Oracle) Date: Fri Nov 7 08:28:45 2025 +0000 net: stmmac: ingenic: use PHY_INTF_SEL_x to select PHY interface Use the common dwmac definitions for the PHY interface selection field. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHpt-0000000Djr1-0wwr@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 307a575775fd06b1a63ec017a63a82485bedf62f Author: Russell King (Oracle) Date: Fri Nov 7 08:28:40 2025 +0000 net: stmmac: ingenic: simplify jz4775 mac_set_mode() All paths configure the transmit clock as an input. Move this out of the switch() statement to simplify the code. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHpo-0000000Djqv-0RD4@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 2dd63c36453408583c2c37a742705a0232612c57 Author: Russell King (Oracle) Date: Fri Nov 7 08:28:34 2025 +0000 net: stmmac: ingenic: move ingenic_mac_init() Move ingenic_mac_init() to between variant specific set_mode() implementations and ingenic_mac_probe(). No code changes. Reviewed-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vHHpi-0000000Djqp-4910@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7ff14c52049eafecdd72cd0a12cae6905876566a Author: Simon Schippers Date: Thu Nov 6 18:56:15 2025 +0100 usbnet: Add support for Byte Queue Limits (BQL) In the current implementation, usbnet uses a fixed tx_qlen of: USB2: 60 * 1518 bytes = 91.08 KB USB3: 60 * 5 * 1518 bytes = 454.80 KB Such large transmit queues can be problematic, especially for cellular modems. For example, with a typical celluar link speed of 10 Mbit/s, a fully occupied USB3 transmit queue results in: 454.80 KB / (10 Mbit/s / 8 bit/byte) = 363.84 ms of additional latency. This patch adds support for Byte Queue Limits (BQL) [1] to dynamically manage the transmit queue size and reduce latency without sacrificing throughput. Testing was performed on various devices using the usbnet driver for packet transmission: - DELOCK 66045: USB3 to 2.5 GbE adapter (ax88179_178a) - DELOCK 61969: USB2 to 1 GbE adapter (asix) - Quectel RM520: 5G modem (qmi_wwan) - USB2 Android tethering (cdc_ncm) No performance degradation was observed for iperf3 TCP or UDP traffic, while latency for a prioritized ping application was significantly reduced. For example, using the USB3 to 2.5 GbE adapter, which was fully utilized by iperf3 UDP traffic, the prioritized ping was improved from 1.6 ms to 0.6 ms. With the same setup but with a 100 Mbit/s Ethernet connection, the prioritized ping was improved from 35 ms to 5 ms. [1] https://lwn.net/Articles/469652/ Signed-off-by: Simon Schippers Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106175615.26948-1-simon.schippers@tu-dortmund.de Signed-off-by: Jakub Kicinski commit 23c52b58cc38e398292f125e68b717001344444c Author: Breno Leitao Date: Fri Nov 7 02:36:59 2025 -0800 tg3: Fix num of RX queues being reported by ethtool Using num_online_cpus() to report number of queues is actually not correct, as reported by Michael[1]. netif_get_num_default_rss_queues() was used to replace num_online_cpus() in the past, but tg3 ethtool callbacks didn't get converted. Doing it now. Link: https://lore.kernel.org/all/CACKFLim7ruspmqvjr6bNRq5Z_XXVk3vVaLZOons7kMCzsEG23A@mail.gmail.com/#t [1] Signed-off-by: Breno Leitao Suggested-by: Michael Chan Reviewed-by: Michael Chan Link: https://patch.msgid.link/20251107-tg3_counts-v1-1-337fe5c8ccb7@debian.org Signed-off-by: Jakub Kicinski commit f5d8ec838b08e601e4652a81c9c444aed4f26829 Merge: 7fc2bf8d30beeb 2b3013ac03028a Author: Jakub Kicinski Date: Mon Nov 10 17:11:09 2025 -0800 Merge branch 'net-dsa-b53-add-support-for-bcm5389-97-98-and-bcm63xx-arl-formats' Jonas Gorski says: ==================== net: dsa: b53: add support for BCM5389/97/98 and BCM63XX ARL formats Currently b53 assumes that all switches apart from BCM5325/5365 use the same ARL formats, but there are actually multiple formats in use. Older switches use a format apparently introduced with BCM5387/BCM5389, while newer chips use a format apparently introduced with BCM5395. Note that these numbers are not linear, BCM5397/BCM5398 use the older format. In addition to that the switches integrated into BCM63XX SoCs use their own format. While accessing these normal read/write ARL entries are the same format as BCM5389 one, the search format is different. So in order to support all these different format, split all code accessing these entries into chip-family specific functions, and collect them in appropriate arl ops structs to keep the code cleaner. Sent as net-next since the ARL accesses have never worked before, and the extensive refactoring might be too much to warrant a fix. ==================== Link: https://patch.msgid.link/20251107080749.26936-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 2b3013ac03028a2364d8779719bb6bfbc0212435 Author: Jonas Gorski Date: Fri Nov 7 09:07:49 2025 +0100 net: dsa: b53: add support for bcm63xx ARL entry format The ARL registers of BCM63XX embedded switches are somewhat unique. The normal ARL table access registers have the same format as BCM5389, but the ARL search registers differ: * SRCH_CTL is at the same offset of BCM5389, but 16 bits wide. It does not have more fields, just needs to be accessed by a 16 bit read. * SRCH_RSLT_MACVID and SRCH_RSLT are aligned to 32 bit, and have shifted offsets. * SRCH_RSLT has a different format than the normal ARL data entry register. * There is only one set of ENTRY_N registers, implying a 1 bin layout. So add appropriate ops for bcm63xx and let it use it. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-9-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 300f78e8b6b7be17c2c78afeded75be68acb1aa7 Author: Jonas Gorski Date: Fri Nov 7 09:07:48 2025 +0100 net: dsa: b53: add support for 5389/5397/5398 ARL entry format BCM5389, BCM5397 and BCM5398 use a different ARL entry format with just a 16 bit fwdentry register, as well as different search control and data offsets. So add appropriate ops for them and switch those chips to use them. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-8-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit a7e73339ad46ade76d29fb6cc7d7854222608c26 Author: Jonas Gorski Date: Fri Nov 7 09:07:47 2025 +0100 net: dsa: b53: move ARL entry functions into ops struct Now that the differences in ARL entry formats are neatly contained into functions per chip family, wrap them into an ops struct and add wrapper functions to access them. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-7-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit e0c476f325a8c9b961a3d446c24d3c8ecae7d186 Author: Jonas Gorski Date: Fri Nov 7 09:07:46 2025 +0100 net: dsa: b53: split reading search entry into their own functions Split reading search entries into a function for each format. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-6-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 1716be6db04af53bac9b869f01156a460595cf41 Author: Jonas Gorski Date: Fri Nov 7 09:07:45 2025 +0100 net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL In order to more easily support more formats, move accessing ARL_SRCH_CTL into helper functions to contain the differences. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-5-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit bf6e9d2ae1dbafee53ec4ccd126595172e1e5278 Author: Jonas Gorski Date: Fri Nov 7 09:07:44 2025 +0100 net: dsa: b53: move writing ARL entries into their own functions Move writing ARL entries into individual functions for each format. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-4-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 4a291fe7226736a465ddb3fa93c21fcef7162ec7 Author: Jonas Gorski Date: Fri Nov 7 09:07:43 2025 +0100 net: dsa: b53: move reading ARL entries into their own function Instead of duplicating the whole code iterating over all bins for BCM5325, factor out reading and parsing the entry into its own functions, and name it the modern one after the first chip with that ARL format, (BCM53)95. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-3-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit a6e4fd38bf2f2e2363b61c27f4e6c49b14e4bb07 Author: Jonas Gorski Date: Fri Nov 7 09:07:42 2025 +0100 net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision Align the b53_arl_read{,25}() functions by consistently using the parsed arl entry instead of parsing the raw registers again. Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20251107080749.26936-2-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 1f2d68c354131e70af30388157703a0a678d52de Merge: 3a8660878839fa 07525a693a5ff6 Author: Stephen Boyd Date: Mon Nov 10 17:06:20 2025 -0800 Merge tag 'renesas-clk-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Various fixes for the module reset procedure on R-Car Gen4 SoCs - Add ADC and thermal (TSU) clocks on RZ/T2H and RZ/N2H - Add USB clocks and resets on RZ/G3E - Add ISP and display (DSI, LCDC) clocks and resets on RZ/V2H and RZ/V2N - Add thermal (TSU) and RTC clocks and resets on RZ/V2H - Add reset support on RZ/T2H and RZ/N2H - Fix the module stop disable procedure on RZ/T2H and RZ/N2H - Add camera (CRU) clocks and resets on RZ/V2N * tag 'renesas-clk-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: (21 commits) clk: renesas: r9a09g056: Add clock and reset entries for ISP clk: renesas: r9a09g056: Add support for PLLVDO, CRU clocks, and resets clk: renesas: r9a09g056: Add clocks and resets for DSI and LCDC modules clk: renesas: r9a09g077: Add TSU module clock clk: renesas: r9a09g057: Add clock and reset entries for DSI and LCDC clk: renesas: rzv2h: Add support for DSI clocks clk: renesas: rzv2h: Use GENMASK for PLL fields clk: renesas: rzv2h: Add instance field to struct pll clk: renesas: r9a09g057: Add clock and reset entries for RTC clk: renesas: cpg-mssr: Spelling s/offets/offsets/ clk: renesas: r9a09g057: Add clock and reset entries for TSU clk: renesas: cpg-mssr: Add read-back and delay handling for RZ/T2H MSTP clk: renesas: cpg-mssr: Add module reset support for RZ/T2H clk: renesas: r9a09g057: Add clock and reset entries for ISP clk: renesas: r9a09g047: Add clock and reset entries for USB2 clk: renesas: Use IS_ERR() for pointers that cannot be NULL dt-bindings: clock: renesas,r9a09g047-cpg: Add USB2 PHY core clocks clk: renesas: cpg-lib: Remove unneeded semicolon clk: renesas: r9a09g077: Add ADC module clocks clk: renesas: cpg-mssr: Read back reset registers to assure values latched ... commit f18e71cd6c546e65fab25829ed9a55cd1a0928b3 Author: Ma Ke Date: Thu Nov 6 16:47:35 2025 +0800 EDAC/ie31200: Fix error handling in ie31200_register_mci ie31200_register_mci() calls device_initialize() for priv->dev unconditionally. However, in the error path, put_device() is not called, leading to an imbalance. Similarly, in the unload path, put_device() is missing. Although edac_mc_free() eventually frees the memory, it does not release the device initialized by device_initialize(). For code readability and proper pairing of device_initialize()/put_device(), add put_device() calls in both error and unload paths. Found by code review. Signed-off-by: Ma Ke Signed-off-by: Tony Luck Reviewed-by: Qiuxu Zhuo Link: https://patch.msgid.link/20251106084735.35017-1-make24@iscas.ac.cn commit 79d022dcad375c6ba95e78e9035c8a0630164300 Author: Krzysztof Kozlowski Date: Thu Nov 6 18:06:08 2025 +0100 clk: sprd: sc9860: Simplify with of_device_get_match_data() Driver's probe function matches against driver's of_device_id table, where each entry has non-NULL match data, so of_match_node() can be simplified with of_device_get_match_data(). Signed-off-by: Krzysztof Kozlowski [sboyd@kernel.org: Use device_get_match_data() instead, drop printk noise] Signed-off-by: Stephen Boyd commit 5c534939ddfb88fed3a35da51e6b56a63c769153 Merge: 3a8660878839fa 2050b57ecda040 Author: Stephen Boyd Date: Mon Nov 10 16:54:59 2025 -0800 Merge tag 'socfpga_clk_for_v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into clk-socfpga Pull SoCFPGA clk driver updates from Dinh Nguyen: - Add the Agilex5 clock driver * tag 'socfpga_clk_for_v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: clk: socfpga: agilex5: add clock driver for Agilex5 commit 7fc2bf8d30beebceac5841ad2227e0bd41abdf27 Merge: 38f073a71e85c7 67f4cfb5301503 Author: Jakub Kicinski Date: Mon Nov 10 16:43:51 2025 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2025-11-10 We've added 19 non-merge commits during the last 3 day(s) which contain a total of 22 files changed, 1345 insertions(+), 197 deletions(-). The main changes are: 1) Preserve skb metadata after a TC BPF program has changed the skb, from Jakub Sitnicki. This allows a TC program at the end of a TC filter chain to still see the skb metadata, even if another TC program at the front of the chain has changed the skb using BPF helpers. 2) Initial af_smc bpf_struct_ops support to control the smc specific syn/synack options, from D. Wythe. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: bpf/selftests: Add selftest for bpf_smc_hs_ctrl net/smc: bpf: Introduce generic hook for handshake flow bpf: Export necessary symbols for modules with struct_ops selftests/bpf: Cover skb metadata access after bpf_skb_change_proto selftests/bpf: Cover skb metadata access after change_head/tail helper selftests/bpf: Cover skb metadata access after bpf_skb_adjust_room selftests/bpf: Cover skb metadata access after vlan push/pop helper selftests/bpf: Expect unclone to preserve skb metadata selftests/bpf: Dump skb metadata on verification failure selftests/bpf: Verify skb metadata in BPF instead of userspace bpf: Make bpf_skb_change_head helper metadata-safe bpf: Make bpf_skb_change_proto helper metadata-safe bpf: Make bpf_skb_adjust_room metadata-safe bpf: Make bpf_skb_vlan_push helper metadata-safe bpf: Make bpf_skb_vlan_pop helper metadata-safe vlan: Make vlan_remove_tag return nothing bpf: Unclone skb head on bpf_dynptr_write to skb metadata net: Preserve metadata on pskb_expand_head net: Helper to move packet data and metadata after skb_push/pull ==================== Link: https://patch.msgid.link/20251110232427.3929291-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 38f073a71e85c726b09f935e7886de72bc57b15b Author: Niklas Söderlund Date: Fri Nov 7 21:01:00 2025 +0100 net: ravb: Correct bad check of timestamp control flags When converting the Renesas network drivers to use flags from enum hwtstamp_rx_filters to control when to timestamp packages instead of a driver specific schema with bit-wise flags an error was made. The bit-wise driver specific flags correct logic to set get_ts was: q: RAVB_BE + tstamp_rx_ctrl: 0 => 0 q: RAVB_NC + tstamp_rx_ctrl: 0 => 0 q: RAVB_BE + tstamp_rx_ctrl: RAVB_RXTSTAMP_TYPE_V2_L2_EVENT => 0 q: RAVB_NC + tstamp_rx_ctrl: RAVB_RXTSTAMP_TYPE_V2_L2_EVENT => 1 q: RAVB_BE + tstamp_rx_ctrl: RAVB_RXTSTAMP_TYPE_ALL => 1 q: RAVB_NC + tstamp_rx_ctrl: RAVB_RXTSTAMP_TYPE_ALL => 1 The converted logic to use enum flags mapped tstamp_rx_ctrl as 0 to HWTSTAMP_FILTER_NONE RAVB_RXTSTAMP_TYPE_V2_L2_EVENT to HWTSTAMP_FILTER_PTP_V2_L2_EVENT RAVB_RXTSTAMP_TYPE_ALL to HWTSTAMP_FILTER_ALL But the logic was incorrectly changed to: q: RAVB_BE + tstamp_rx_ctrl: HWTSTAMP_FILTER_NONE => 1 (error) q: RAVB_NC + tstamp_rx_ctrl: HWTSTAMP_FILTER_NONE => 0 q: RAVB_BE + tstamp_rx_ctrl: HWTSTAMP_FILTER_PTP_V2_L2_EVENT => 0 q: RAVB_NC + tstamp_rx_ctrl: HWTSTAMP_FILTER_PTP_V2_L2_EVENT => 1 q: RAVB_BE + tstamp_rx_ctrl: HWTSTAMP_FILTER_ALL => 1 q: RAVB_NC + tstamp_rx_ctrl: HWTSTAMP_FILTER_ALL => 0 (error) This change restores the converted flag check to the correct logic of the bit-wise driver specific flags. Reported-by: Simon Horman Closes: https://lore.kernel.org/linux-renesas-soc/aQ4xSv9629XF-Bt3@horms.kernel.org/ Fixes: 16e2e6cf75e6 ("net: ravb: Use common defines for time stamping control") Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20251107200100.3637869-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 7157062bb46c8bcfba3a7d77f91fc4795bff1316 Author: Masami Hiramatsu (Google) Date: Tue Nov 11 00:48:20 2025 +0900 tracing: Report wrong dynamic event command Report wrong dynamic event type in the command via error_log. ----- # echo "z hoge" > /sys/kernel/tracing/dynamic_events sh: write error: Invalid argument # cat /sys/kernel/tracing/error_log [ 22.977022] dynevent: error: No matching dynamic event type Command: z hoge ^ ----- Cc: Mathieu Desnoyers Link: https://patch.msgid.link/176278970056.343441.10528135217342926645.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 2db833312d7e6ae22111a6fd3e733b2a14986a29 Author: Thomas Weißschuh Date: Tue Nov 11 01:13:06 2025 +0100 random: drop check for static_key_initialized Commit e871abcda3b6 ("random: handle creditable entropy from atomic process context") added the use of workqueues, which meant testing whether the workqueue is valid, but it did not remove the existing check of whether static keys have been initialized. This static key check is unnecessary because workqueues are initialized long after it. And semantically it doesn't make much sense either, because it's not really directly calling a static key function in the condition. Remove the now unnecessary check. Signed-off-by: Thomas Weißschuh [Jason: rewrite commit message with different explanation, rebase on random.git, and update code comment.] Signed-off-by: Jason A. Donenfeld commit 5b9192c2c075edf8a35f8c6c2b5ef36cdc8ce9f9 Author: Zhongqiu Han Date: Fri Nov 7 15:45:33 2025 +0800 ptp: ocp: Document sysfs output format for backward compatibility Add a comment to ptp_ocp_tty_show() explaining that the sysfs output intentionally does not include a trailing newline. This is required for backward compatibility with existing userspace software that reads the sysfs attribute and uses the value directly as a device path. A previous attempt to add a newline to align with common kernel conventions broke userspace applications that were opening device paths like "/dev/ttyS4\n" instead of "/dev/ttyS4", resulting in ENOENT errors. This comment prevents future attempts to "fix" this behavior, which would break existing userspace applications. Link: https://lore.kernel.org/netdev/20251030124519.1828058-1-zhongqiu.han@oss.qualcomm.com/ Link: https://lore.kernel.org/netdev/aef3b850-5f38-4c28-a018-3b0006dc2f08@linux.dev/ Suggested-by: Jakub Kicinski Signed-off-by: Zhongqiu Han Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251107074533.416048-1-zhongqiu.han@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit 73edb26b06ea0eb5bd8c6cae5b2df212ae3c7ab5 Author: Kuniyuki Iwashima Date: Thu Nov 6 22:34:06 2025 +0000 sctp: Don't inherit do_auto_asconf in sctp_clone_sock(). syzbot reported list_del(&sp->auto_asconf_list) corruption in sctp_destroy_sock(). The repro calls setsockopt(SCTP_AUTO_ASCONF, 1) to a SCTP listener, calls accept(), and close()s the child socket. setsockopt(SCTP_AUTO_ASCONF, 1) sets sp->do_auto_asconf to 1 and links sp->auto_asconf_list to a per-netns list. Both fields are placed after sp->pd_lobby in struct sctp_sock, and sctp_copy_descendant() did not copy the fields before the cited commit. Also, sctp_clone_sock() did not set them explicitly. In addition, sctp_auto_asconf_init() is called from sctp_sock_migrate(), but it initialises the fields only conditionally. The two fields relied on __GFP_ZERO added in sk_alloc(), but sk_clone() does not use it. Let's clear newsp->do_auto_asconf in sctp_clone_sock(). [0]: list_del corruption. prev->next should be ffff8880799e9148, but was ffff8880799e8808. (prev=ffff88803347d9f8) kernel BUG at lib/list_debug.c:64! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6008 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:__list_del_entry_valid_or_report+0x15a/0x190 lib/list_debug.c:62 Code: e8 7b 26 71 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 7c ee 92 fd 49 8b 17 48 c7 c7 80 0a bf 8b 48 89 de 4c 89 f9 e8 07 c6 94 fc 90 <0f> 0b 4c 89 f7 e8 4c 26 71 fd 43 80 3c 2c 00 74 08 4c 89 ff e8 4d RSP: 0018:ffffc90003067ad8 EFLAGS: 00010246 RAX: 000000000000006d RBX: ffff8880799e9148 RCX: b056988859ee6e00 RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffffc90003067807 R09: 1ffff9200060cf00 R10: dffffc0000000000 R11: fffff5200060cf01 R12: 1ffff1100668fb3f R13: dffffc0000000000 R14: ffff88803347d9f8 R15: ffff88803347d9f8 FS: 00005555823e5500(0000) GS:ffff88812613e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000480 CR3: 00000000741ce000 CR4: 00000000003526f0 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del include/linux/list.h:237 [inline] sctp_destroy_sock+0xb4/0x370 net/sctp/socket.c:5163 sk_common_release+0x75/0x310 net/core/sock.c:3961 sctp_close+0x77e/0x900 net/sctp/socket.c:1550 inet_release+0x144/0x190 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0xc3/0x240 net/socket.c:1455 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 16942cf4d3e3 ("sctp: Use sk_clone() in sctp_accept().") Reported-by: syzbot+ba535cb417f106327741@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/690d2185.a70a0220.22f260.000e.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Acked-by: Xin Long Link: https://patch.msgid.link/20251106223418.1455510-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3ffeb17a9a27a668efb6fbd074835e187910a9bb Author: Christian Marangi Date: Fri Nov 7 00:57:08 2025 +0100 pinctrl: airoha: add support for Airoha AN7583 PINs Add all the required entry to add suppot for Airoha AN7583 PINs. Where possible the same function group are used from Airoha EN7581 to reduce code duplication. Signed-off-by: Christian Marangi Signed-off-by: Linus Walleij commit e6e47d31d3f80d1e9eee863f1f24d8597f3c9deb Author: Christian Marangi Date: Fri Nov 7 00:57:07 2025 +0100 dt-bindings: pinctrl: airoha: Document AN7583 Pin Controller Document Airoha AN7583 Pin Controller based on Airoha EN7581 with some minor difference on some function group (PCM and LED gpio). To not bloat the EN7581 schema with massive if condition, use a dedicated YAML schema for Airoha AN7583. Signed-off-by: Christian Marangi Reviewed-by: Conor Dooley Signed-off-by: Linus Walleij commit 1552ad5d649cff9d170e5bc1d13ab1487333b4b7 Author: Christian Marangi Date: Fri Nov 7 00:57:06 2025 +0100 pinctrl: airoha: convert PWM GPIO to macro The PWM GPIO struct definition follow the same pattern for every GPIO pin hence it can be converted to a macro. Create 2 macro one for normal mux and one for ext mux and convert all the entry to these new macro to reduce code size. Signed-off-by: Christian Marangi Signed-off-by: Linus Walleij commit 579839c9548cf2a85e873ad787bc2fa6610bf8ab Author: Christian Marangi Date: Fri Nov 7 00:57:05 2025 +0100 pinctrl: airoha: convert PHY LED GPIO to macro PHY LED GPIO pinctrl struct definition is very similar across the different 4 PHY and 2 LED and it can be generelized to a macro. To reduce code size, convert them to a common macro. Signed-off-by: Christian Marangi Signed-off-by: Linus Walleij commit 4043b0c45f8555a079bdac69a19ed08695a47a7b Author: Christian Marangi Date: Fri Nov 7 00:57:04 2025 +0100 pinctrl: airoha: generalize pins/group/function/confs handling In preparation for support of Airoha AN7583, generalize pins/group/function/confs handling and move them in match_data. Inner function will base the values on the pinctrl priv struct instead of relying on hardcoded struct. This permits to use different PIN data while keeping the same logic. Signed-off-by: Christian Marangi Signed-off-by: Linus Walleij commit 9322da935c9a2db2b81a9660f650e48423ebf34d Author: Frank Wunderlich Date: Mon Oct 27 14:28:11 2025 +0100 dt-bindings: pinctrl: mt7988: allow gpio-hogs Allow gpio-hogs in pinctrl node for switching pcie on Bananapi R4 Pro. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij commit 7959deaabea8380a318fefe9f3fffc37e5b0fc15 Author: Gatien Chevallier Date: Wed Nov 5 11:50:22 2025 +0100 pinctrl: stm32: handle semaphore acquisition when handling pinctrl/pinmux When a GPIO RIF configuration is in semaphore mode, and the semaphore hasn't been taken before configuring the GPIO, the write operations silently fail. To avoid a silent fail when applying a pinctrl, if the pins that are being configured are in semaphore mode, take the semaphore. Note that there is no proper release of the RIF semaphore yet for pinctrl. Signed-off-by: Gatien Chevallier Signed-off-by: Linus Walleij commit dbd2317d7b9f88b7b4b7de0d48173ee178f2ac97 Author: Ye Zhang Date: Tue Nov 4 10:12:22 2025 +0800 pinctrl: rockchip: Add rk3506 pinctrl support Add support for the 5 rk3506 GPIO banks. Signed-off-by: Ye Zhang Reviewed-by: Heiko Stuebner Signed-off-by: Linus Walleij commit 13064950339ffc73a0e55e9b4898df861b04848e Author: Ye Zhang Date: Tue Nov 4 10:12:21 2025 +0800 dt-bindings: pinctrl: Add rk3506 pinctrl support Add the compatible string for the rk3506 SoC. Signed-off-by: Ye Zhang Acked-by: Krzysztof Kozlowski Reviewed-by: Heiko Stuebner Signed-off-by: Linus Walleij commit be4cd2a13a31496c7fb9e46a244c4391b8b7cf31 Author: Bagas Sanjaya Date: Mon Nov 10 10:59:53 2025 +0700 accel/qaic: Format DBC states table in sysfs ABI documentation Stephen Rothwell reports htmldocs warnings when merging drm-misc tree: Documentation/ABI/stable/sysfs-driver-qaic:1: ERROR: Unexpected indentation. [docutils] Documentation/ABI/stable/sysfs-driver-qaic:1: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Documentation/ABI/stable/sysfs-driver-qaic:1: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] These are caused by DMA Bridge channel (DBC) states list in sysfs ABI docs. Format it as a table to fix them. Fixes: f286066ed9df38 ("accel/qaic: Add DMA Bridge Channel(DBC) sysfs and uevents") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251110135038.29e96051@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251110035952.25778-4-bagasdotme@gmail.com commit 6d61e37833ee151fc649212ccec490df19e8cde3 Author: Bagas Sanjaya Date: Mon Nov 10 10:59:52 2025 +0700 accel/qaic: Separate DBC_STATE_* definition list Stephen Rothwell reports htmldocs warnings when merging drm-misc tree: Documentation/accel/qaic/aic100.rst:502: ERROR: Unexpected indentation. [docutils] Documentation/accel/qaic/aic100.rst:504: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Fix these by separating DBC_STATE_* definition list from preceding paragraph. Fixes: 9675093acea04c ("accel/qaic: Implement basic SSR handling") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251110132401.200d88bd@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251110035952.25778-3-bagasdotme@gmail.com commit 1d80a686907935b581c33b5f1f1eb7877a7b81e6 Merge: ea2bfb853b15f0 3cfc60e09bdc95 Author: Linus Walleij Date: Mon Nov 10 21:55:16 2025 +0100 Merge tag 'samsung-pinctrl-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/samsung into devel Samsung pinctrl drivers changes for v6.19 Add pin controller support for Samsung Exynos8890 and Axis ARTPEC-9 SoCs. The latter is a newer design of Artpec SoCs made/designed by Samsung, thus it shares most of the core blocks with Samsung Exynos, including the pinctrl. Signed-off-by: Linus Walleij commit 67f4cfb530150387dedc13bac7e2ab7f1a525d7f Merge: abd0c0f6aabc4f beb3c67297d92f Author: Martin KaFai Lau Date: Mon Nov 10 11:10:09 2025 -0800 Merge branch 'net-smc-introduce-smc_hs_ctrl' D. Wythe says: ==================== net/smc: Introduce smc_hs_ctrl This patch aims to introduce BPF injection capabilities for SMC and includes a self-test to ensure code stability. Since the SMC protocol isn't ideal for every situation, especially short-lived ones, most applications can't guarantee the absence of such scenarios. Consequently, applications may need specific strategies to decide whether to use SMC. For example, an application might limit SMC usage to certain IP addresses or ports. To maintain the principle of transparent replacement, we want applications to remain unaffected even if they need specific SMC strategies. In other words, they should not require recompilation of their code. Additionally, we need to ensure the scalability of strategy implementation. While using socket options or sysctl might be straightforward, it could complicate future expansions. Fortunately, BPF addresses these concerns effectively. Users can write their own strategies in eBPF to determine whether to use SMC, and they can easily modify those strategies in the future. This is a rework of the series from [1]. Changes since [1] are limited to the SMC parts: 1. Rename smc_ops to smc_hs_ctrl and change interface name. 2. Squash SMC patches, removing standalone non-BPF hook capability. 3. Fix typos [1]: https://lore.kernel.org/bpf/20250123015942.94810-1-alibuda@linux.alibaba.com/#t v2 -> v1: - Removed the fixes patch, which have already been merged on current branch. - Fixed compilation warning of smc_call_hsbpf() when CONFIG_SMC_HS_CTRL_BPF is not enabled. - Changed the default value of CONFIG_SMC_HS_CTRL_BPF to Y. - Fix typo and renamed some variables v3 -> v2: - Removed the libbpf patch, which have already been merged on current branch. - Fixed sparse warning of smc_call_hsbpf() and xchg(). v4 -> v3: - Rebased on latest bpf-next, updated SMC loopback config from SMC_LO to DIBS_LO per upstream changes. v5 -> v4: - Removed the redundant sk parameter from smc_call_hsbpf - Reject registration when bpf_link is set, link support will be added in the future. - Updated selftests with new test heplers. ==================== Link: https://patch.msgid.link/20251107035632.115950-1-alibuda@linux.alibaba.com Signed-off-by: Martin KaFai Lau commit beb3c67297d92f9428484410cf79135d38d0aff3 Author: D. Wythe Date: Fri Nov 7 11:56:32 2025 +0800 bpf/selftests: Add selftest for bpf_smc_hs_ctrl This tests introduces a tiny smc_hs_ctrl for filtering SMC connections based on IP pairs, and also adds a realistic topology model to verify it. Also, we can only use SMC loopback under CI test, so an additional configuration needs to be enabled. Follow the steps below to run this test. make -C tools/testing/selftests/bpf cd tools/testing/selftests/bpf sudo ./test_progs -t smc Results shows: Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: D. Wythe Signed-off-by: Martin KaFai Lau Tested-by: Saket Kumar Bhaskar Reviewed-by: Zhu Yanjun Link: https://patch.msgid.link/20251107035632.115950-4-alibuda@linux.alibaba.com commit 77cbf5fbe572f199f401a4740b9fc38707770a30 Author: Bagas Sanjaya Date: Tue Nov 4 11:18:12 2025 +0700 Documentation: tps6594-pfsm: Fix macro cross-reference syntax C macro references are erroneously written using :c:macro:: (note the double colon). This causes the references to be outputted as combination of verbatim roles and italicized names instead. Correct the syntax. Fixes: dce548889650c1 ("Documentation: Add TI TPS6594 PFSM") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104041812.31402-4-bagasdotme@gmail.com> commit 3ba679d443c55789774cdbbb1ecc127a3219ed14 Author: Bagas Sanjaya Date: Tue Nov 4 11:18:11 2025 +0700 Documentation: mrvl-cn10k-dpi: Fix macro cross-reference syntax C macro references are erroneously written using :c:macro:: (note the double colon). This causes the references to be outputted as combination of verbatim roles and italicized names instead. Correct the syntax. Fixes: 5f67eef6dff394 ("misc: mrvl-cn10k-dpi: add Octeon CN10K DPI administrative driver") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104041812.31402-3-bagasdotme@gmail.com> commit c1be952f1eb2939a38db66780854e870700eaf4c Author: Bagas Sanjaya Date: Tue Nov 4 11:18:10 2025 +0700 Documentation: amd-sbi: Wrap miscdevice listing snippet in literal code block Device file listing (ls output) is shown as long-running paragraph instead. Wrap it in literal code block. Fixes: 4d95514d14e874 ("misc: amd-sbi: Add document for AMD SB IOCTL description") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104041812.31402-2-bagasdotme@gmail.com> commit c6804c6af9985e4917693c37bf9c6dab49a3f1ea Author: Bagas Sanjaya Date: Tue Nov 4 20:07:50 2025 +0700 Documentation: taskstats: Reindent payload kinds list Payload kinds list text is indented at the first text column, rather than aligned to the list number. As an effect, the third item becomes sublist of second item's third sublist item (TASKTYPE_TYPE_STATS). Reindent the list text. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104130751.22755-1-bagasdotme@gmail.com> commit 1f37cae5d1c7c36c7bf7d2a5f5ebb3bc4a87020b Author: Gou Hao Date: Wed Nov 5 09:35:06 2025 +0800 xfs-doc: Fix typo error Online fsck may take longer than offline fsck... Signed-off-by: Gou Hao Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Message-ID: <20251105013506.358-1-gouhao@uniontech.com> commit 285f79bebf5b36a9ec57c89aeb3809051ffcb466 Author: Bagas Sanjaya Date: Wed Nov 5 19:49:47 2025 +0700 Documentation: parport-lowlevel: Separate function listing code blocks Commit be9d0411f1608a ("parport-lowlevel.txt: standardize document format") reSTify parport interface documentation but forgets to properly mark function listing code blocks up. As such, these are rendered as long-running normal paragraph instead. Fix them by adding missing separator between the code block marker and the listing. Fixes: be9d0411f1608a ("parport-lowlevel.txt: standardize document format") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251105124947.45048-1-bagasdotme@gmail.com> commit fc9e9a39cc98de2f6dc5c927bfbcce9db40978d2 Author: Mauro Carvalho Chehab Date: Fri Nov 7 14:54:49 2025 +0100 tools/docs/get_abi.py: fix get_abi library directory changeset a5dd93016f20 ("docs: move get_abi.py to tools/docs") moved the script location, but didn't update library location, causing it to fail. Fixes: a5dd93016f20 ("docs: move get_abi.py to tools/docs") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Message-ID: <3839bc4db2d5c7e14dd2686876a2c7b5d72a46cd.1762523688.git.mchehab+huawei@kernel.org> commit d69a03a97a2d9a85d344b5988640d7f5cf6f598b Author: Mauro Carvalho Chehab Date: Sat Nov 8 10:37:04 2025 +0100 docs: doc-guide: parse-headers.rst update its documentation Besides converting from Perl to Python, parse-headers has gained some new functionality and was moved to tools/docs. Update its documentation accordingly. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/linux-doc/9391a0f0-7c92-42aa-8190-28255b22e131@infradead.org/ Acked-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Dongliang Mu Signed-off-by: Jonathan Corbet Message-ID: <1f9025dc98dc58da3cc31f3343d5027f351be338.1762594622.git.mchehab+huawei@kernel.org> commit e1cf4aac38648c726e2859d8bcf43f2944526f47 Author: pierwill Date: Sun Nov 9 02:34:21 2025 +0000 docs: Fix missing word in spectre.rst Corrects a missing word in the hardware vulnerability docs. Signed-off-by: Will Pierce Signed-off-by: Jonathan Corbet Message-ID: commit 3a0d5bc76ff482c6e0c20f66f2b32e5dcf8238fe Author: Steven Rostedt Date: Wed Nov 5 19:33:26 2025 -0500 tracing: Use switch statement instead of ifs in set_tracer_flag() The "mask" passed in to set_trace_flag() has a single bit set. The function then checks if the mask is equal to one of the option masks and performs the appropriate function associated to that option. Instead of having a bunch of "if ()" statement, use a "switch ()" statement instead to make it cleaner and a bit more optimal. No function changes. Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251106003501.890298562@kernel.org Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 9c5053083eeecc7a2cd6c1271a85087e73820ae2 Author: Steven Rostedt Date: Wed Nov 5 19:33:25 2025 -0500 tracing: Exit out immediately after update_marker_trace() The call to update_marker_trace() in set_tracer_flag() performs the update to the tr->trace_flags. There's no reason to perform it again after it is called. Return immediately instead. Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251106003501.726406870@kernel.org Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 5aa0d18df08a87c1d71a39c4a84c5ec63ada67c0 Author: Steven Rostedt Date: Wed Nov 5 11:19:11 2025 -0500 tracing: Have add_tracer_options() error pass up to callers The function add_tracer_options() can fail, but currently it is ignored. Pass the status of add_tracer_options() up to adding a new tracer as well as when an instance is created. Have the instance creation fail if the add_tracer_options() fail. Only print a warning for the top level instance, like it does with other failures. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251105161935.375299297@kernel.org Signed-off-by: Steven Rostedt (Google) commit c7bed15ccf238fb2e47938c522a49ddc4a919f7d Author: Steven Rostedt Date: Wed Nov 5 11:19:10 2025 -0500 tracing: Remove dummy options and flags When a tracer does not define their own flags, dummy options and flags are used so that the values are always valid. There's not that many locations that reference these values so having dummy versions just complicates the code. Remove the dummy values and just check for NULL when appropriate. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://patch.msgid.link/20251105161935.206093132@kernel.org Signed-off-by: Steven Rostedt (Google) commit a10e6e681864ce8ae7f6957be5577f8d17669db0 Author: Steven Rostedt Date: Tue Nov 4 20:53:10 2025 -0500 tracing: Hide __NR_utimensat and _NR_mq_timedsend when not defined Some architectures (riscv-32) do not define __NR_utimensat and _NR_mq_timedsend, and fails to build when they are used. Hide them in "ifdef"s. Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20251104205310.00a1db9a@batman.local.home Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511031239.ZigDcWzY-lkp@intel.com/ Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 15f295f55656658e65bdbc9b901d6b2e49d68d72 Author: D. Wythe Date: Fri Nov 7 11:56:31 2025 +0800 net/smc: bpf: Introduce generic hook for handshake flow The introduction of IPPROTO_SMC enables eBPF programs to determine whether to use SMC based on the context of socket creation, such as network namespaces, PID and comm name, etc. As a subsequent enhancement, to introduce a new generic hook that allows decisions on whether to use SMC or not at runtime, including but not limited to local/remote IP address or ports. User can write their own implememtion via bpf_struct_ops now to choose whether to use SMC or not before TCP 3rd handshake to be comleted. Signed-off-by: D. Wythe Signed-off-by: Martin KaFai Lau Reviewed-by: Dust Li Link: https://patch.msgid.link/20251107035632.115950-3-alibuda@linux.alibaba.com commit 07c428ece3222832bdbfcc4ffa8b8d3991c5eb39 Author: D. Wythe Date: Fri Nov 7 11:56:30 2025 +0800 bpf: Export necessary symbols for modules with struct_ops Exports three necessary symbols for implementing struct_ops with tristate subsystem. To hold or release refcnt of struct_ops refcnt by inline funcs bpf_try_module_get and bpf_module_put which use bpf_struct_ops_get(put) conditionally. And to copy obj name from one to the other with effective checks by bpf_obj_name_cpy. Signed-off-by: D. Wythe Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251107035632.115950-2-alibuda@linux.alibaba.com commit abd0c0f6aabc4f60e711ea8e7de40bdda17654c5 Merge: a0c3aefb08cd81 d2c5cca3fb58f9 Author: Martin KaFai Lau Date: Mon Nov 10 10:52:33 2025 -0800 Merge branch 'make-tc-bpf-helpers-preserve-skb-metadata' Jakub Sitnicki says: ==================== Make TC BPF helpers preserve skb metadata Changes in v4: - Fix copy-paste bug in check_metadata() test helper (AI review) - Add "out of scope" section (at the bottom) - Link to v3: https://lore.kernel.org/r/20251026-skb-meta-rx-path-v3-0-37cceebb95d3@cloudflare.com Changes in v3: - Use the already existing BPF_STREAM_STDERR const in tests (Martin) - Unclone skb head on bpf_dynptr_write to skb metadata (patch 3) (Martin) - Swap order of patches 1 & 2 to refer to skb_postpush_data_move() in docs - Mention in skb_data_move() docs how to move just the metadata - Note in pskb_expand_head() docs to move metadata after skb_push() (Jakub) - Link to v2: https://lore.kernel.org/r/20251019-skb-meta-rx-path-v2-0-f9a58f3eb6d6@cloudflare.com Changes in v2: - Tweak WARN_ON_ONCE check in skb_data_move() (patch 2) - Convert all tests to verify skb metadata in BPF (patches 9-10) - Add test coverage for modified BPF helpers (patches 12-15) - Link to RFCv1: https://lore.kernel.org/r/20250929-skb-meta-rx-path-v1-0-de700a7ab1cb@cloudflare.com This patch set continues our work [1] to allow BPF programs and user-space applications to attach multiple bytes of metadata to packets via the XDP/skb metadata area. The focus of this patch set it to ensure that skb metadata remains intact when packets pass through a chain of TC BPF programs that call helpers which operate on skb head. Currently, several helpers that either adjust the skb->data pointer or reallocate skb->head do not preserve metadata at its expected location, that is immediately in front of the MAC header. These are: - bpf_skb_adjust_room - bpf_skb_change_head - bpf_skb_change_proto - bpf_skb_change_tail - bpf_skb_vlan_pop - bpf_skb_vlan_push In TC BPF context, metadata must be moved whenever skb->data changes to keep the skb->data_meta pointer valid. I don't see any way around it. Creative ideas how to avoid that would be very welcome. With that in mind, we can patch the helpers in at least two different ways: 1. Integrate metadata move into header move Replace the existing memmove, which follows skb_push/pull, with a helper that moves both headers and metadata in a single call. This avoids an extra memmove but reduces transparency. skb_pull(skb, len); - memmove(skb->data, skb->data - len, n); + skb_postpull_data_move(skb, len, n); skb->mac_header += len; skb_push(skb, len) - memmove(skb->data, skb->data + len, n); + skb_postpush_data_move(skb, len, n); skb->mac_header -= len; 2. Move metadata separately Add a dedicated metadata move after the header move. This is more explicit but costs an additional memmove. skb_pull(skb, len); memmove(skb->data, skb->data - len, n); + skb_metadata_postpull_move(skb, len); skb->mac_header += len; skb_push(skb, len) + skb_metadata_postpush_move(skb, len); memmove(skb->data, skb->data + len, n); skb->mac_header -= len; This patch set implements option (1), expecting that "you can have just one memmove" will be the most obvious feedback, while readability is a, somewhat subjective, matter of taste, which I don't claim to have ;-) The structure of the patch set is as follows: - patches 1-4 prepare ground for safe-proofing the BPF helpers - patches 5-9 modify the BPF helpers to preserve skb metadata - patches 10-11 prepare ground for metadata tests with BPF helper calls - patches 12-16 adapt and expand tests to cover the made changes Out of scope for this series: - safe-proofing tunnel & tagging devices - VLAN, GRE, ... (next in line, in development preview at [2]) - metadata access after packet foward (to do after Rx path - once metadata reliably reaches sk_filter) Thanks, -jkbs [1] https://lore.kernel.org/all/20250814-skb-metadata-thru-dynptr-v7-0-8a39e636e0fb@cloudflare.com/ [2] https://github.com/jsitnicki/linux/commits/skb-meta/safeproof-netdevs/ ==================== Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-0-5ceb08a9b37b@cloudflare.com Signed-off-by: Martin KaFai Lau commit d2c5cca3fb58f96732e1dfd19e36b43e4e54d214 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:53 2025 +0100 selftests/bpf: Cover skb metadata access after bpf_skb_change_proto Add a test to verify that skb metadata remains accessible after calling bpf_skb_change_proto(), which modifies packet headroom to accommodate different IP header sizes. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-16-5ceb08a9b37b@cloudflare.com commit 85d454afef612f880c69cb39a7d74772a24411d3 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:52 2025 +0100 selftests/bpf: Cover skb metadata access after change_head/tail helper Add a test to verify that skb metadata remains accessible after calling bpf_skb_change_head() and bpf_skb_change_tail(), which modify packet headroom/tailroom and can trigger head reallocation. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-15-5ceb08a9b37b@cloudflare.com commit 29960e635b01b148e6db5a84957f99423fd85464 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:51 2025 +0100 selftests/bpf: Cover skb metadata access after bpf_skb_adjust_room Add a test to verify that skb metadata remains accessible after calling bpf_skb_adjust_room(), which modifies the packet headroom and can trigger head reallocation. The helper expects an Ethernet frame carrying an IP packet so switch test packet identification by source MAC address since we can no longer rely on Ethernet proto being set to zero. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-14-5ceb08a9b37b@cloudflare.com commit 354d020c29f72513dce4f3902890158d99b67b67 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:50 2025 +0100 selftests/bpf: Cover skb metadata access after vlan push/pop helper Add a test to verify that skb metadata remains accessible after calling bpf_skb_vlan_push() and bpf_skb_vlan_pop(), which modify the packet headroom. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-13-5ceb08a9b37b@cloudflare.com commit 1e1357fde808a35c6069759298660134e5dab053 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:49 2025 +0100 selftests/bpf: Expect unclone to preserve skb metadata Since pskb_expand_head() no longer clears metadata on unclone, update tests for cloned packets to expect metadata to remain intact. Also simplify the clone_dynptr_kept_on_{data,meta}_slice_write tests. Creating an r/w dynptr slice is sufficient to trigger an unclone in the prologue, so remove the extraneous writes to the data/meta slice. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-12-5ceb08a9b37b@cloudflare.com commit 9ef9ac15a527739135548b87053f4646099e4bd6 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:48 2025 +0100 selftests/bpf: Dump skb metadata on verification failure Add diagnostic output when metadata verification fails to help with troubleshooting test failures. Introduce a check_metadata() helper that prints both expected and received metadata to the BPF program's stderr stream on mismatch. The userspace test reads and dumps this stream on failure. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-11-5ceb08a9b37b@cloudflare.com commit 967534e57c4439ba43b31f4af4cb85e84c86e6b7 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:47 2025 +0100 selftests/bpf: Verify skb metadata in BPF instead of userspace Move metadata verification into the BPF TC programs. Previously, userspace read metadata from a map and verified it once at test end. Now TC programs compare metadata directly using __builtin_memcmp() and set a test_pass flag. This enables verification at multiple points during test execution rather than a single final check. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-10-5ceb08a9b37b@cloudflare.com commit fb206fc3129bc9d4749905d4870ba05dc89126d2 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:46 2025 +0100 bpf: Make bpf_skb_change_head helper metadata-safe Although bpf_skb_change_head() doesn't move packet data after skb_push(), skb metadata still needs to be relocated. Use the dedicated helper to handle it. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-9-5ceb08a9b37b@cloudflare.com commit 8cfc172ce28e6559d4d2d1a96df77f0f2d6179d6 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:45 2025 +0100 bpf: Make bpf_skb_change_proto helper metadata-safe bpf_skb_change_proto reuses the same headroom operations as bpf_skb_adjust_room, already updated to handle metadata safely. The remaining step is to ensure that there is sufficient headroom to accommodate metadata on skb_push(). Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-8-5ceb08a9b37b@cloudflare.com commit be83105d38ab99737ac0488600efd59ddd57b74c Author: Jakub Sitnicki Date: Wed Nov 5 21:19:44 2025 +0100 bpf: Make bpf_skb_adjust_room metadata-safe bpf_skb_adjust_room() may push or pull bytes from skb->data. In both cases, skb metadata must be moved accordingly to stay accessible. Replace existing memmove() calls, which only move payload, with a helper that also handles metadata. Reserve enough space for metadata to fit after skb_push. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-7-5ceb08a9b37b@cloudflare.com commit 55ffc98b44d28e13a218306666d16f2c7236d0ae Author: Jakub Sitnicki Date: Wed Nov 5 21:19:43 2025 +0100 bpf: Make bpf_skb_vlan_push helper metadata-safe Use the metadata-aware helper to move packet bytes after skb_push(), ensuring metadata remains valid after calling the BPF helper. Also, take care to reserve sufficient headroom for metadata to fit. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-6-5ceb08a9b37b@cloudflare.com commit efd35c26239bed39193201e958d65e695231ccda Author: Jakub Sitnicki Date: Wed Nov 5 21:19:42 2025 +0100 bpf: Make bpf_skb_vlan_pop helper metadata-safe Use the metadata-aware helper to move packet bytes after skb_pull(), ensuring metadata remains valid after calling the BPF helper. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-5-5ceb08a9b37b@cloudflare.com commit b85be58e2f7cff47f7477ae61022644a198ee592 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:41 2025 +0100 vlan: Make vlan_remove_tag return nothing All callers ignore the return value. Prepare to reorder memmove() after skb_pull() which is a common pattern. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-4-5ceb08a9b37b@cloudflare.com commit f38499ff45f567c932d0911e6a30b8ca022b9b52 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:40 2025 +0100 bpf: Unclone skb head on bpf_dynptr_write to skb metadata Currently bpf_dynptr_from_skb_meta() marks the dynptr as read-only when the skb is cloned, preventing writes to metadata. Remove this restriction and unclone the skb head on bpf_dynptr_write() to metadata, now that the metadata is preserved during uncloning. This makes metadata dynptr consistent with skb dynptr, allowing writes regardless of whether the skb is cloned. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-3-5ceb08a9b37b@cloudflare.com commit 290fc0be09e2f6e08754782616bb7e67f8191fa1 Author: Jakub Sitnicki Date: Wed Nov 5 21:19:39 2025 +0100 net: Preserve metadata on pskb_expand_head pskb_expand_head() copies headroom, including skb metadata, into the newly allocated head, but then clears the metadata. As a result, metadata is lost when BPF helpers trigger an skb head reallocation. Let the skb metadata remain in the newly created copy of head. Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-2-5ceb08a9b37b@cloudflare.com commit 8989d328dfe7c7a3b9f4b9f0ef60006d277f81cc Author: Jakub Sitnicki Date: Wed Nov 5 21:19:38 2025 +0100 net: Helper to move packet data and metadata after skb_push/pull Lay groundwork for fixing BPF helpers available to TC(X) programs. When skb_push() or skb_pull() is called in a TC(X) ingress BPF program, the skb metadata must be kept in front of the MAC header. Otherwise, BPF programs using the __sk_buff->data_meta pseudo-pointer lose access to it. Introduce a helper that moves both metadata and a specified number of packet data bytes together, suitable as a drop-in replacement for memmove(). Signed-off-by: Jakub Sitnicki Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-1-5ceb08a9b37b@cloudflare.com commit 23e719e93b1bb0501aacc0a4cc96a1fe2d0b5a15 Author: Piotr Piórkowski Date: Fri Nov 7 22:18:45 2025 +0100 drm/xe/pf: Add runtime registers for GFX ver >= 35 Add a dedicated runtime register list for GFX ver >= 35. Compared to the list for GFX >= 30, this variant drops HUC_KERNEL_LOAD_INFO, MIRROR_FUSE1 and adds SERVICE_COPY_ENABLE. v2: - drop MIRROR_FUSE1 register - update commit message Fixes: 5e0de2dfbc1b ("drm/xe/cri: Add CRI platform definition") Signed-off-by: Piotr Piórkowski Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251107211845.3633633-1-piotr.piorkowski@intel.com Signed-off-by: Lucas De Marchi commit b06b8c421485e0e96d7fd6aa614fb0b6f2778a03 Author: Bean Huo Date: Sat Nov 8 00:05:18 2025 +0100 scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices Add OP-TEE based RPMB support for UFS devices. This enables secure RPMB operations on UFS devices through OP-TEE, providing the same functionality available for eMMC devices and extending kernel-based secure storage support to UFS-based systems. Benefits of OP-TEE based RPMB implementation: - Eliminates dependency on userspace supplicant for RPMB access - Enables early boot secure storage access (e.g., fTPM, secure UEFI variables) - Provides kernel-level RPMB access as soon as UFS driver is initialized - Removes complex initramfs dependencies and boot ordering requirements - Ensures reliable and deterministic secure storage operations - Supports both built-in and modular fTPM configurations [mkp: make this build as a module] Co-developed-by: Can Guo Signed-off-by: Can Guo Reviewed-by: Avri Altman Reviewed-by: Bart Van Assche Signed-off-by: Bean Huo Link: https://patch.msgid.link/20251107230518.4060231-4-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen commit 5a3d530caab22c235c994b38a860549da04171a4 Author: Dan Carpenter Date: Mon Oct 27 10:08:51 2025 +0300 remoteproc: mediatek: Change the snprintf() checking The snprintf() calls here work but they have several minor style issues: 1) It uses ARRAY_SIZE() which is the number of elements in an array. Since were talking about char that works, but it's more common to use sizeof() which is the number of bytes. 2) The printf format is "%1d". The "1" ensures we always print at least 1 character but since numbers all have at least 1 digit this can be removed. 3) The kernel implementation of snprintf() cannot return negative error codes. Also these particular calls to snprintf() can't return zero and the code to handle that zero return is sort of questionable. 4) In the current kernel the only "core_id" we print is "0" but if it was more than 9 then the output would be truncated so GCC complains. Add an "a >= sizeof(scp_fw_file)" check for output which is too long. Signed-off-by: Dan Carpenter Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/aP8agyKj73bLZrTQ@stanley.mountain Signed-off-by: Mathieu Poirier commit d794b499f948801f54d67ddbc34a6eac5a6d150a Author: Bean Huo Date: Sat Nov 8 00:05:17 2025 +0100 scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() The function ufshcd_read_string_desc() was duplicating memory starting from the beginning of struct uc_string_id, which included the length and type fields. As a result, the allocated buffer contained unwanted metadata in addition to the string itself. The correct behavior is to duplicate only the Unicode character array in the structure. Update the code so that only the actual string content is copied into the new buffer. Fixes: 5f57704dbcfe ("scsi: ufs: Use kmemdup in ufshcd_read_string_desc()") Reviewed-by: Avri Altman Reviewed-by: Bart Van Assche Signed-off-by: Bean Huo Link: https://patch.msgid.link/20251107230518.4060231-3-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen commit 0d9a7085ec24983b5b8a4971c0eb6c756c75f1bf Author: Bean Huo Date: Sat Nov 8 00:05:16 2025 +0100 scsi: ufs: core: Convert string descriptor format macros to enum Convert SD_ASCII_STD and SD_RAW from boolean macros to enum values for improved code readability. This makes ufshcd_read_string_desc() calls self-documenting by using explicit enum values instead of true/false. Move the ufshcd_read_string_desc() declaration from include/ufs/ufshcd.h to drivers/ufs/core/ufshcd-priv.h since this function is not exported. Co-developed-by: Bart Van Assche Signed-off-by: Bart Van Assche Suggested-by: Avri Altman Signed-off-by: Bean Huo Link: https://patch.msgid.link/20251107230518.4060231-2-beanhuo@iokpp.de Signed-off-by: Martin K. Petersen commit 3389c2be7fa0733b225c5676b1eaa87927745409 Author: Lucas De Marchi Date: Fri Nov 7 10:23:45 2025 -0800 drm/xe/vram: Move forcewake down to get_flat_ccs_offset() With SG_TILE_ADDR_RANGE use, the only thing requiring GT forcewake while probing for vram size is the get_flat_ccs_offset(). Move the forcewake down where it's needed. Suggested-by: Matt Roper Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251107-tile-addr-v1-2-a3014aadc2e7@intel.com Signed-off-by: Lucas De Marchi commit 84a6fc4c9fb95c7abdc2c749e7d9d8947061b259 Author: Fei Yang Date: Fri Nov 7 10:23:44 2025 -0800 drm/xe: Use SG_TILE_ADDR_RANGE instead of TILE_ADDR_RANGE The TILE_ADDR_RANGE register is not available on all platforms going forward as it was deprecated and is being replaced by equivalent registers within SoC MMIO space. While that doesn't happen, the SG_TILE_ADDR_RANGE (base 0x1083a0) is still valid for all platforms supported by xe. Use that instead. BSpec: 59353, 54991 Signed-off-by: Fei Yang Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251107-tile-addr-v1-1-a3014aadc2e7@intel.com Signed-off-by: Lucas De Marchi commit 4457265c61f304ebe1e732ec1b729315b379972b Author: zhang jiao Date: Mon Nov 10 09:26:07 2025 +0800 workqueue: Remove unused assert_rcu_or_wq_mutex_or_pool_mutex assert_rcu_or_wq_mutex_or_pool_mutex is never referenced in the code. Just remove it. Signed-off-by: zhang jiao Reviewed-by: Lai Jiangshan Signed-off-by: Tejun Heo commit e109f644b871df8440c886a69cdce971ed533088 Author: Imre Deak Date: Fri Nov 7 14:41:41 2025 +0200 drm/i915/dp_mst: Disable Panel Replay Disable Panel Replay on MST links until it's properly implemented. For instance the required VSC SDP is not programmed on MST and FEC is not enabled if Panel Replay is enabled. Fixes: 3257e55d3ea7 ("drm/i915/panelreplay: enable/disable panel replay") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15174 Cc: Jouni Högander Cc: Animesh Manna Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patch.msgid.link/20251107124141.911895-1-imre.deak@intel.com commit 1ddac5cd7f278345b2e8298c930e4bffe0911a45 Author: Aaron Tomlin Date: Sat Oct 18 14:02:10 2025 -0400 MAINTAINERS: Add myself as reviewer for module support Voluntering as a reviewer for Module support. Suggested-by: Luis Chamberlain Signed-off-by: Aaron Tomlin Acked-by: Luis Chamberlain Acked-by: Daniel Gomez Signed-off-by: Daniel Gomez commit 4492d54d59872bb72e119ff9f77969ab4d8a0e6b Author: Akash Goel Date: Tue Oct 21 09:10:42 2025 +0100 drm/panthor: Fix potential memleak of vma structure This commit addresses a memleak issue of panthor_vma (or drm_gpuva) structure in Panthor driver, that can happen if the GPU page table update operation to map the pages fail. The issue is very unlikely to occur in practice. v2: Add panthor_vm_op_ctx_return_vma() helper (Boris) v3: Add WARN_ON_ONCE (Boris) Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") Signed-off-by: Akash Goel Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://patch.msgid.link/20251021081042.1377406-1-akash.goel@arm.com commit 4361e1d913095fa5833fcc38914a6e55360d90f3 Author: Rodrigo Vivi Date: Fri Nov 7 23:06:35 2025 -0500 drm/xe: Fix MTL vm_max_level MTL was broken after the vm_max_level movement. Get it back to a working value. [ 37.722413] xe 0000:00:02.0: [drm] Tile0: GT0: VM job timed out on non-killed execqueue [ 37.722465] WARNING: CPU: 0 PID: 12 at drivers/gpu/drm/xe/xe_guc_submit.c:1379 guc_exec_queue_timedout_job+0x2f3/0xe00 [xe] [ 37.722559] Modules linked in: xt_REDIRECT nft_compat nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr sunrpc bnep snd_ctl_led snd_soc_s\ of_sdw snd_soc_intel_hda_dsp_common snd_soc_sdw_utils snd_sof_probes snd_soc_rt712_sdca regmap_sdw_mbq snd_hda_codec_intelhdmi regmap_sdw snd_soc_dmic snd_hda_intel snd_sof_pci_intel_mtl iwlmvm snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink\ snd_sof_intel_hda snd_hda_codec_hdmi soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp binfmt_misc snd_sof mac80211 vfat snd_sof_utils fat snd_hda_ext_core snd_hda_codec snd_hda_core snd_intel_dspcfg snd_intel_sdw_acpi snd_soc_acpi_intel_match snd_soc_acpi_intel_sdca_quirks soundwire_generic_allocation snd_soc_acpi snd_hwdep \ crc8 soundwire_bus libarc4 snd_soc_sdca snd_soc_core [ 37.722584] snd_compress ac97_bus uvcvideo snd_pcm_dmaengine iwlwifi snd_seq uvc videobuf2_vmalloc snd_seq_device videobuf2_memops videobuf2_v4l2 snd_pcm processor_thermal_device_pci videobuf2_common processor_thermal_device btusb intel_uncore_frequency processor_thermal_wt_hint intel_uncore_frequency_common platform_temp\ erature_control videodev btmtk spi_nor processor_thermal_soc_slider x86_pkg_temp_thermal btrtl snd_timer iTCO_wdt processor_thermal_rfim intel_powerclamp btbcm intel_pmc_bxt snd intel_rapl_msr processor_thermal_rapl coretemp iTCO_vendor_support mei_gsc_proxy btintel intel_rapl_common rapl intel_cstate cfg80211 bluetooth mc in\ tel_pmc_core mtd soundcore acer_wmi mei_me intel_uncore processor_thermal_wt_req i2c_i801 spi_intel_pci pmt_telemetry platform_profile mei processor_thermal_power_floor spi_intel i2c_smbus pmt_discovery igen6_edac pcspkr rfkill wmi_bmof idma64 processor_thermal_mbox intel_hid pmt_class int3403_thermal int3400_thermal joydev i\ nt340x_thermal_zone acpi_pad sparse_keymap [ 37.722611] intel_pmc_ssram_telemetry acpi_thermal_rel acer_wireless loop nfnetlink zram lz4hc_compress lz4_compress dm_crypt xe drm_ttm_helper drm_suballoc_helper gpu_sched drm_gpuvm drm_exec drm_gpusvm_helper i915 nvme i2c_algo_bit nvme_core drm_buddy ucsi_acpi ttm typec_ucsi typec nvme_keyring nvme_auth hkdf drm_displa\ y_helper hid_multitouch polyval_clmulni thunderbolt intel_vpu ghash_clmulni_intel cec vmd i2c_hid_acpi video intel_vsec i2c_hid wmi pinctrl_meteorlake serio_raw i2c_dev fuse [ 37.722638] CPU: 0 UID: 0 PID: 12 Comm: kworker/u88:0 Not tainted 6.18.0-rc2+ #37 PREEMPT(voluntary) [ 37.722641] Hardware name: Acer Swift SFG14-72/Coral_MTH, BIOS V1.01 11/06/2023 [ 37.722643] Workqueue: gt-ordered-wq drm_sched_job_timedout [gpu_sched] [ 37.722649] RIP: 0010:guc_exec_queue_timedout_job+0x2f3/0xe00 [xe] [ 37.722722] Code: 4c 24 10 44 89 44 24 08 e8 5a 95 f1 d4 44 8b 44 24 08 8b 4c 24 10 48 c7 c7 00 b7 25 c1 48 8b 54 24 18 48 89 c6 e8 4d 59 37 d4 <0f> 0b 80 3c 24 00 0f 85 55 03 00 00 49 8b 47 58 a8 01 75 1a 49 8b [ 37.722723] RSP: 0018:ffffd468000f7d80 EFLAGS: 00010246 [ 37.722725] RAX: 0000000000000000 RBX: ffff8e3d4e215c00 RCX: 0000000000000027 [ 37.722726] RDX: ffff8e40ae61cfc8 RSI: 0000000000000001 RDI: ffff8e40ae61cfc0 [ 37.722727] RBP: 00000000fffffffb R08: 0000000000000000 R09: ffffd468000f7c20 [ 37.722727] R10: ffff8e40c09fffa8 R11: 00000000fffbffff R12: ffff8e3d44c00028 [ 37.722728] R13: ffff8e3d807d4000 R14: ffff8e3d807d4018 R15: ffff8e3d95c9d600 [ 37.722729] FS: 0000000000000000(0000) GS:ffff8e4116110000(0000) knlGS:0000000000000000 [ 37.722729] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.722730] CR2: 00007ff1f3e02720 CR3: 0000000113c8d005 CR4: 0000000000f70ef0 [ 37.722731] PKRU: 55555554 [ 37.722731] Call Trace: [ 37.722734] [ 37.722735] ? __pfx_autoremove_wake_function+0x10/0x10 [ 37.722740] drm_sched_job_timedout+0x81/0x170 [gpu_sched] Fixes: 50292f9af8ec ("drm/xe: Move 'vm_max_level' flag back to platform descriptor") Cc: Lucas De Marchi Cc: Gustavo Sousa Cc: Matt Roper Reviewed-by: Lucas De Marchi Link: https://patch.msgid.link/20251108040634.6376-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi commit 3dd0be7a301bb0adcca4f7021cfd2e366ca90a0e Author: Jocelyn Falempe Date: Thu Oct 30 10:14:11 2025 +0100 drm/ast: Handle framebuffer from dma-buf In the atomic update callback, ast should call drm_gem_fb_begin_cpu_access() to make sure it can read the framebuffer from the CPU, otherwise the data might not be there due to cache, and synchronization. Tested on a Lenovo SE100, while rendering on the ArrowLake GPU with i915 driver, and using ast for display. Suggested-by: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20251030091627.340780-1-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit b1c4c05bb0aebbfab10e79c0720c576dfc31409b Author: Marek Vasut Date: Mon Nov 10 15:30:13 2025 +0100 thermal/drivers/rcar_gen3: Document R-Car Gen4 and RZ/G2 support in driver comment The R-Car Gen3 thermal driver supports both R-Car Gen3 and Gen4 SoCs as well as RZ/G2. Update the driver comment. No functional change. Reviewed-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20251110143029.10940-1-marek.vasut+renesas@mailbox.org Signed-off-by: Daniel Lezcano commit ae901e5e2e9b079761d26a366e0c80530d8aad22 Merge: 8ebfb9896c97ab 07d7ad46dad48a Author: Christian Brauner Date: Mon Nov 10 10:21:00 2025 +0100 Merge patch series "ns: fixes for namespace iteration and active reference counting" Christian Brauner says: * Make sure to initialize the active reference count for the initial network namespace and prevent __ns_common_init() from returning too early. * Make sure that passive reference counts are dropped outside of rcu read locks as some namespaces such as the mount namespace do in fact sleep when putting the last reference. * The setns() system call supports: (1) namespace file descriptors (nsfd) (2) process file descriptors (pidfd) When using nsfds the namespaces will remain active because they are pinned by the vfs. However, when pidfds are used things are more complicated. When the target task exits and passes through exit_nsproxy_namespaces() or is reaped and thus also passes through exit_cred_namespaces() after the setns()'ing task has called prepare_nsset() but before the active reference count of the set of namespaces it wants to setns() to might have been dropped already: P1 P2 pid_p1 = clone(CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) pidfd = pidfd_open(pid_p1) setns(pidfd, CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) prepare_nsset() exit(0) // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 1 -> exit_nsproxy_namespaces() -> exit_cred_namespaces() // ns_active_ref_put() will also put // the reference on the owner of the // namespace. If the only reason the // owning namespace was alive was // because it was a parent of @ns // it's active reference count now goes // to zero... -------------------------------- // | // ns->__ns_active_ref == 0 | // parent_ns->__ns_active_ref == 0 | | commit_nsset() -----------------> // If setns() // now manages to install the namespaces // it will call ns_active_ref_get() // on them thus bumping the active reference // count from zero again but without also // taking the required reference on the owner. // Thus we get: // // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 0 When later someone does ns_active_ref_put() on @ns it will underflow parent_ns->__ns_active_ref leading to a splat from our asserts thinking there are still active references when in fact the counter just underflowed. So resurrect the ownership chain if necessary as well. If the caller succeeded to grab passive references to the set of namespaces the setns() should simply succeed even if the target task exists or gets reaped in the meantime. The race is rare and can only be triggered when using pidfs to setns() to namespaces. Also note that active reference on initial namespaces are nops. Since we now always handle parent references directly we can drop ns_ref_active_get_owner() when adding a namespace to a namespace tree. This is now all handled uniformly in the places where the new namespaces actually become active. * patches from https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-0-ae8a4ad5a3b3@kernel.org: selftests/namespaces: test for efault selftests/namespaces: add active reference count regression test ns: add asserts for active refcount underflow ns: handle setns(pidfd, ...) cleanly ns: return EFAULT on put_user() error ns: make sure reference are dropped outside of rcu lock ns: don't increment or decrement initial namespaces ns: don't skip active reference count initialization Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-0-ae8a4ad5a3b3@kernel.org Signed-off-by: Christian Brauner commit 07d7ad46dad48a81ffc796fb7875b1ec141c8b48 Author: Christian Brauner Date: Sun Nov 9 22:11:29 2025 +0100 selftests/namespaces: test for efault Ensure that put_user() can fail and that namespace cleanup works correctly. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-8-ae8a4ad5a3b3@kernel.org Signed-off-by: Christian Brauner commit 22ea7b9d96e26147b7a3ea1be7aa106cc700907c Author: Luke D. Jones Date: Sun Nov 2 22:53:11 2025 +0100 platform/x86: asus-wmi: export symbols used for read/write WMI Export symbols for reading/writing WMI symbols using a namespace. Existing functions: - asus_wmi_evaluate_method - asus_wmi_set_devstate New function: - asus_wmi_get_devstate_dsts The new function is intended for use with DSTS WMI method only and avoids requiring the asus_wmi driver data to select the WMI method. Co-developed-by: Denis Benato Signed-off-by: Denis Benato Signed-off-by: Luke D. Jones Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/20251102215319.3126879-2-denis.benato@linux.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 32cf9f21828a752a364b2698ec66f8532cd66c52 Author: Vlastimil Babka Date: Fri Nov 7 14:51:25 2025 +0100 slab: use struct freelist_counters for local variables instead of struct slab In several functions we declare local struct slab variables so we can work with the freelist and counters fields (including the sub-counters that are in the union) comfortably. With struct freelist_counters containing the full counters definition, we can now reduce the local variables to that type as we don't need the other fields in struct slab. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 3993ca9d6495e1e4d6fdaffc1bba0271059940c4 Author: Vlastimil Babka Date: Fri Nov 7 14:51:24 2025 +0100 slab: turn freelist_aba_t to a struct and fully define counters there In struct slab we currently have freelist and counters pair, where counters itself is a union of unsigned long with a sub-struct of several smaller fields. Then for the usage with double cmpxchg we have freelist_aba_t that duplicates the definition of the freelist+counters with implicitly the same layout as the full definition in struct slab. Thanks to -fms-extension we can now move the full counters definition to freelist_aba_t (while changing it to struct freelist_counters as a typedef is unnecessary and discouraged) and replace the relevant part in struct slab to an unnamed reference to it. The immediate benefit is the removal of duplication and no longer relying on the same layout implicitly. It also allows further cleanups thanks to having the full definition of counters in struct freelist_counters. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit b244358e9a1cd61276b8785b1b4275f1f45a1dc2 Author: Vlastimil Babka Date: Fri Nov 7 14:51:23 2025 +0100 slab: separate struct freelist_tid from kmem_cache_cpu In kmem_cache_cpu we currently have a union of the freelist+tid pair with freelist_aba_t, relying implicitly on the type compatibility with the freelist+counters pair used in freelist_aba_t. To allow further changes to freelist_aba_t, we can instead define a separate struct freelist_tid (instead of a typedef, per the coding style) for kmem_cache_cpu, as that affects only a single helper __update_cpu_freelist_fast(). We can add the resulting struct freelist_tid to kmem_cache_cpu as unnamed field thanks to -fms-extensions, so that freelist and tid fields can still be accessed directly. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit c99f969d9a668fe317e0d1bc8e898f3dca11539a Merge: f6087b926aea65 5ff8ad3909524a Author: Vlastimil Babka Date: Mon Nov 10 15:34:28 2025 +0100 Merge tag 'kbuild-ms-extensions-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux into slab/for-6.19/freelist_aba_t_cleanups Shared branch between Kbuild and other trees for enabling '-fms-extensions' for 6.19 Signed-off-by: Nathan Chancellor Signed-off-by: Vlastimil Babka commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 Author: Josua Mayer Date: Thu Oct 30 16:16:26 2025 +0100 clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 CP110 based platforms rely on the bootloader for pci port initialization. TF-A actively prevents non-uboot re-configuration of pci lanes, and many boards do not have software control over the pci card reset. If a pci port had link at boot-time and the clock is stopped at a later point, the link fails and can not be recovered. PCI controller driver probe - and by extension ownership of a driver for the pci clocks - may be delayed especially on large modular kernels, causing the clock core to start disabling unused clocks. Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure they are not stopped before the pci controller driver has taken ownership and tested for an existing link. This fixes failed pci link detection when controller driver probes late, e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com Signed-off-by: Josua Mayer Reviewed-by: Andrew Lunn Signed-off-by: Gregory CLEMENT commit c9b6a836704753fd6fb7e47f5f07c83b408e51d4 Author: Josua Mayer Date: Thu Oct 30 16:16:25 2025 +0100 Revert "arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports" This reverts commit 794a066688038df46c01e177cc6faebded0acba4 because it misunderstood interworking between arm trusted firmware and the common phy driver, and does not consistently resolve the issue it was intended to address. Further diagnostics have revealed the root cause for the reported system lock-up in a race condition between pci driver probe and clock core disabling unused clocks. Revert the wrong change restoring driver control over all pci lanes. As a temporary workaround for the original issue, users can boot with "clk_ignore_unused". Signed-off-by: Josua Mayer Signed-off-by: Gregory CLEMENT commit ff49362eca17114bf36240f7531c2060127778d1 Author: Kurt Borja Date: Mon Nov 3 21:12:46 2025 -0500 platform/x86: alienware-wmi-wmax: Simplify FW profile to pprof matching Drop profile matching micro-optimizations to improve readability and long-term maintainability. Additionally, is_awcc_thermal_profile_id is implicitly ignoring the AWCC_PROFILE_SPECIAL_GMODE ID. State this explicitly with code and a comment. Signed-off-by: Kurt Borja Link: https://patch.msgid.link/20251103-aw-gmode-v1-1-eba7b7be0a9c@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit da69aeac10c040d78c5bd7e0ee0be0a83f12e856 Author: Rob Herring (Arm) Date: Wed Oct 29 10:39:25 2025 -0500 arm64/arm: dts: marvell: Rename "nand-rb" pinctrl node names Update the "nand-rb" pinctrl child node names to use the defined "-pins" suffix fixing DT schema warnings. Signed-off-by: Rob Herring (Arm) Signed-off-by: Gregory CLEMENT commit 410d88782af805804ebe8cd8a275bd71f88bf399 Merge: 95eacb81d0d987 e237dfe70867f0 Author: Maarten Lankhorst Date: Mon Nov 10 14:42:54 2025 +0100 Merge remote-tracking branch 'drm/drm-next' into drm-misc-next Backmerge to prevent getting out of sync with drm-next too much. Signed-off-by: Maarten Lankhorst commit 95eacb81d0d98775c9eb71dc13e6ef24110766b6 Author: Jani Nikula Date: Fri Nov 7 13:04:57 2025 +0200 drm/msm: use drm_crtc_vblank_waitqueue() We have drm_crtc_vblank_waitqueue() to get the wait_queue_head_t pointer for a vblank. Use it instead of poking at dev->vblank[] directly. Due to the macro maze of wait_event_timeout() that uses the address-of operator on the argument, we have to pass it in with the indirection operator. Cc: Rob Clark Cc: Dmitry Baryshkov Cc: Abhinav Kumar Cc: Jessica Zhang Cc: Sean Paul Cc: Marijn Suijten Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Acked-by: Dmitry Baryshkov Link: https://patch.msgid.link/5917fd537f4a775a1c135a68f294df3917980943.1762513240.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 23ab3cb314d945255e9734b509acf8cd21f6eee0 Author: Jani Nikula Date: Fri Nov 7 13:04:56 2025 +0200 drm/atomic: use drm_crtc_vblank_waitqueue() We have drm_crtc_vblank_waitqueue() to get the wait_queue_head_t pointer for a vblank. Use it instead of poking at dev->vblank[] directly. Due to the macro maze of wait_event_timeout() that uses the address-of operator on the argument, we have to pass it in with the indirection operator. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/1097348197acea9110da8baebbbc189890d01660.1762513240.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit f35590ee26f5722bfe12cdff14396c4c057a8f74 Author: Konstantin Komarov Date: Tue Oct 14 20:36:17 2025 +0300 fs/ntfs3: remove ntfs_bio_pages and use page cache for compressed I/O Replace the use of ntfs_bio_pages with the disk page cache for reading and writing compressed files. This slightly improves performance when reading compressed data and simplifies the I/O logic. When an XPRESS or LZX compressed file is opened for writing, it is now decompressed into a normal file before modification. A new argument (`int copy`) is added to ni_read_frame() to handle writing of decompressed and mapped data. Signed-off-by: Konstantin Komarov commit c3856bb499eae0cd5773b609ee9aa8a0e6e42b6c Author: Lizhi Xu Date: Thu Oct 9 10:37:33 2025 +0800 ntfs3: avoid memcpy size warning There are more entries after the structure, use unsafe_memcpy() to avoid this warning. syzbot reported: memcpy: detected field-spanning write (size 3656) of single field "hdr1" at fs/ntfs3/index.c:1927 (size 16) Call Trace: indx_insert_entry+0x1a0/0x460 fs/ntfs3/index.c:1996 ni_add_name+0x4dd/0x820 fs/ntfs3/frecord.c:2995 ni_rename+0x98/0x170 fs/ntfs3/frecord.c:3026 ntfs_rename+0xab9/0xf00 fs/ntfs3/namei.c:332 Reported-by: syzbot+3a1878433bc1cb97b42a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3a1878433bc1cb97b42a Signed-off-by: Lizhi Xu Signed-off-by: Konstantin Komarov commit 5f33da04e6ceee849e76e6592cc283c72fef7af9 Author: Nirbhay Sharma Date: Tue Oct 7 04:08:04 2025 +0530 fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list The call to kmalloc() to allocate the attribute list buffer is given a size of al_aligned(rs). This size can be larger than the data subsequently copied into the buffer, leaving trailing bytes uninitialized. This can trigger a KMSAN "uninit-value" warning if that memory is later accessed. Fix this by using kzalloc() instead, which ensures the entire allocated buffer is zero-initialized, preventing the warning. Reported-by: syzbot+83c9dd5c0dcf6184fdbf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=83c9dd5c0dcf6184fdbf Signed-off-by: Nirbhay Sharma Signed-off-by: Konstantin Komarov commit be99c62ac7e7af514e4b13f83c891a3cccefaa48 Author: Edward Adam Davis Date: Tue Sep 16 13:50:13 2025 +0800 ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot. Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the do_truncate() routine would not be entered. Add the run_lock initialization when loading $Extend. syzbot reported: INFO: trying to register non-static key. Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984 register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860 ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808 Fixes: 4e8011ffec79 ("ntfs3: pretend $Extend records as regular files") Reported-by: syzbot+bdeb22a4b9a09ab9aa45@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bdeb22a4b9a09ab9aa45 Tested-by: syzbot+bdeb22a4b9a09ab9aa45@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Konstantin Komarov commit d1693a7d5a38acf6424235a6070bcf5b186a360d Author: Pedro Demarchi Gomes Date: Fri Oct 3 12:38:50 2025 -0300 ntfs: set dummy blocksize to read boot_block when mounting When mounting, sb->s_blocksize is used to read the boot_block without being defined or validated. Set a dummy blocksize before attempting to read the boot_block. The issue can be triggered with the following syz reproducer: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x121403, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40081271, &(0x7f0000000980)=0x4000) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='ntfs3\x00', 0x2208004, 0x0) syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) Here, the ioctl sets the bdev block size to 16384. During mount, get_tree_bdev_flags() calls sb_set_blocksize(sb, block_size(bdev)), but since block_size(bdev) > PAGE_SIZE, sb_set_blocksize() leaves sb->s_blocksize at zero. Later, ntfs_init_from_boot() attempts to read the boot_block while sb->s_blocksize is still zero, which triggers the bug. Reported-by: syzbot+f4f84b57a01d6b8364ad@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f4f84b57a01d6b8364ad Signed-off-by: Pedro Demarchi Gomes [almaz.alexandrovich@paragon-software.com: changed comment style, added return value handling] Signed-off-by: Konstantin Komarov commit 772ada50282b0c80343c8989147db816961f571d Author: Richard Fitzgerald Date: Mon Nov 10 11:43:27 2025 +0000 ASoC: cs35l56: Alter error codes for calibration routine Adjust the error codes returned by the calibration debugfs files to provide a wider range of errors and make them more consistent. There is a limited number of standard errors and it's not always easy to find an error code that accurately describes what happened. Additionally, user code often uses strerror() or something similar to report a generic error description. The original calibration code used a limited set of errors to attempt to avoid user error strings that would be confusing or unclear on a file read/write. However, this restricts the ability to provide informative errors. This limited error range didn't help very much with debugging so it has been expanded, rather than worrying about what strerror() would return. The errors are now more consistent: ENXIO Calibration is not supported by the driver. EOPNOTSUPP The given calibration command is not supported. EBUSY Cannot calibrate because the amp is playing audio. ERANGE Calibration result was out-of-range. ETIMEDOUT Calibration did not complete. EMSGSIZE Blob written to cal_data is the wrong size. ENODATA No calibration data available to read from cal_data, or Blob written to cal_data does not contain calibration, or No calibration data available to save to UEFI. EIO General failure to communicate with the firmware, mainly indicating that firmware controls are missing. EINVAL Has its normal meaning that an invalid argument was passed. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20251110114327.84370-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 4acbfcf11cbe6c46c42091b49875c7002b0bff3d Author: Frank Li Date: Fri Oct 31 10:46:19 2025 -0400 ASoC: dt-bindings: consolidate simple audio codec to trivial-codec.yaml Consolidate simple audio codec (one compatible string, one reg, one optional reset-gpios and '#sound-dai-cells' 0) to a trivial-codec.yaml. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251031144622.4033833-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit 394aa576c0b783ae728d87ed98fe4f1831dfd720 Author: Petr Mladek Date: Fri Nov 7 20:47:20 2025 +0100 printk_ringbuffer: Create a helper function to decide whether more space is needed The decision whether some more space is needed is tricky in the printk ring buffer code: 1. The given lpos values might overflow. A subtraction must be used instead of a simple "lower than" check. 2. Another CPU might reuse the space in the mean time. It can be detected when the subtraction is bigger than DATA_SIZE(data_ring). 3. There is exactly enough space when the result of the subtraction is zero. But more space is needed when the result is exactly DATA_SIZE(data_ring). Add a helper function to make sure that the check is done correctly in all situations. Also it helps to make the code consistent and better documented. Suggested-by: John Ogness Link: https://lore.kernel.org/r/87tsz7iea2.fsf@jogness.linutronix.de Reviewed-by: John Ogness Link: https://patch.msgid.link/20251107194720.1231457-3-pmladek@suse.com [pmladek@suse.com: Updated wording as suggested by John] Signed-off-by: Petr Mladek commit e1304efc19ee5c823791a0199e7f4faa6d22bc6b Author: Manaf Meethalavalappu Pallikunhi Date: Tue Oct 21 23:23:59 2025 -0700 dt-bindings: thermal: qcom-tsens: document the Kaanapali Temperature Sensor Document the Temperature Sensor (TSENS) on the Kaanapali Platform. Signed-off-by: Manaf Meethalavalappu Pallikunhi Signed-off-by: Jingyi Wang Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251021-b4-knp-tsens-v2-1-7b662e2e71b4@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit cc3bad11de6e0d6012460487903e7167d3e73957 Author: Petr Mladek Date: Fri Nov 7 20:47:19 2025 +0100 printk_ringbuffer: Fix check of valid data size when blk_lpos overflows The commit 67e1b0052f6bb8 ("printk_ringbuffer: don't needlessly wrap data blocks around") allows to use the last 4 bytes of the ring buffer. But the check for the @data_size was not properly updated in get_data(). It fails when "blk_lpos->next" overflows to "0". In this case: + is_blk_wrapped(data_ring, blk_lpos->begin, blk_lpos->next) returns "false" because it checks "blk_lpos->next - 1". + "blk_lpos->begin < blk_lpos->next" fails because "blk_lpos->next" is already 0. + is_blk_wrapped(data_ring, blk_lpos->begin + DATA_SIZE(data_ring), blk_lpos->next) returns "false" because "begin_lpos" is from the next wrap but "next_lpos - 1" is from the previous one. As a result, get_data() triggers the WARN_ON_ONCE() for "Illegal block description", for example: [ 216.317316][ T7652] loop0: detected capacity change from 0 to 16 ** 1 printk messages dropped ** [ 216.327750][ T7652] ------------[ cut here ]------------ [ 216.327789][ T7652] WARNING: kernel/printk/printk_ringbuffer.c:1278 at get_data+0x48a/0x840, CPU#1: syz.0.585/7652 [ 216.327848][ T7652] Modules linked in: [ 216.327907][ T7652] CPU: 1 UID: 0 PID: 7652 Comm: syz.0.585 Not tainted syzkaller #0 PREEMPT(full) [ 216.327933][ T7652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 216.327953][ T7652] RIP: 0010:get_data+0x48a/0x840 [ 216.327986][ T7652] Code: 83 c4 f8 48 b8 00 00 00 00 00 fc ff df 41 0f b6 04 07 84 c0 0f 85 ee 01 00 00 44 89 65 00 49 83 c5 08 eb 13 e8 a7 19 1f 00 90 <0f> 0b 90 eb 05 e8 9c 19 1f 00 45 31 ed 4c 89 e8 48 83 c4 28 5b 41 [ 216.328007][ T7652] RSP: 0018:ffffc900035170e0 EFLAGS: 00010293 [ 216.328029][ T7652] RAX: ffffffff81a1eee9 RBX: 00003fffffffffff RCX: ffff888033255b80 [ 216.328048][ T7652] RDX: 0000000000000000 RSI: 00003fffffffffff RDI: 0000000000000000 [ 216.328063][ T7652] RBP: 0000000000000012 R08: 0000000000000e55 R09: 000000325e213cc7 [ 216.328079][ T7652] R10: 000000325e213cc7 R11: 00001de4c2000037 R12: 0000000000000012 [ 216.328095][ T7652] R13: 0000000000000000 R14: ffffc90003517228 R15: 1ffffffff1bca646 [ 216.328111][ T7652] FS: 00007f44eb8da6c0(0000) GS:ffff888125fda000(0000) knlGS:0000000000000000 [ 216.328131][ T7652] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 216.328147][ T7652] CR2: 00007f44ea9722e0 CR3: 0000000066344000 CR4: 00000000003526f0 [ 216.328168][ T7652] Call Trace: [ 216.328178][ T7652] [ 216.328199][ T7652] _prb_read_valid+0x672/0xa90 [ 216.328328][ T7652] ? desc_read+0x1b8/0x3f0 [ 216.328381][ T7652] ? __pfx__prb_read_valid+0x10/0x10 [ 216.328422][ T7652] ? panic_on_this_cpu+0x32/0x40 [ 216.328450][ T7652] prb_read_valid+0x3c/0x60 [ 216.328482][ T7652] printk_get_next_message+0x15c/0x7b0 [ 216.328526][ T7652] ? __pfx_printk_get_next_message+0x10/0x10 [ 216.328561][ T7652] ? __lock_acquire+0xab9/0xd20 [ 216.328595][ T7652] ? console_flush_all+0x131/0xb10 [ 216.328621][ T7652] ? console_flush_all+0x478/0xb10 [ 216.328648][ T7652] console_flush_all+0x4cc/0xb10 [ 216.328673][ T7652] ? console_flush_all+0x131/0xb10 [ 216.328704][ T7652] ? __pfx_console_flush_all+0x10/0x10 [ 216.328748][ T7652] ? is_printk_cpu_sync_owner+0x32/0x40 [ 216.328781][ T7652] console_unlock+0xbb/0x190 [ 216.328815][ T7652] ? __pfx___down_trylock_console_sem+0x10/0x10 [ 216.328853][ T7652] ? __pfx_console_unlock+0x10/0x10 [ 216.328899][ T7652] vprintk_emit+0x4c5/0x590 [ 216.328935][ T7652] ? __pfx_vprintk_emit+0x10/0x10 [ 216.328993][ T7652] _printk+0xcf/0x120 [ 216.329028][ T7652] ? __pfx__printk+0x10/0x10 [ 216.329051][ T7652] ? kernfs_get+0x5a/0x90 [ 216.329090][ T7652] _erofs_printk+0x349/0x410 [ 216.329130][ T7652] ? __pfx__erofs_printk+0x10/0x10 [ 216.329161][ T7652] ? __raw_spin_lock_init+0x45/0x100 [ 216.329186][ T7652] ? __init_swait_queue_head+0xa9/0x150 [ 216.329231][ T7652] erofs_fc_fill_super+0x1591/0x1b20 [ 216.329285][ T7652] ? __pfx_erofs_fc_fill_super+0x10/0x10 [ 216.329324][ T7652] ? sb_set_blocksize+0x104/0x180 [ 216.329356][ T7652] ? setup_bdev_super+0x4c1/0x5b0 [ 216.329385][ T7652] get_tree_bdev_flags+0x40e/0x4d0 [ 216.329410][ T7652] ? __pfx_erofs_fc_fill_super+0x10/0x10 [ 216.329444][ T7652] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 216.329483][ T7652] vfs_get_tree+0x92/0x2b0 [ 216.329512][ T7652] do_new_mount+0x302/0xa10 [ 216.329537][ T7652] ? apparmor_capable+0x137/0x1b0 [ 216.329576][ T7652] ? __pfx_do_new_mount+0x10/0x10 [ 216.329605][ T7652] ? ns_capable+0x8a/0xf0 [ 216.329637][ T7652] ? kmem_cache_free+0x19b/0x690 [ 216.329682][ T7652] __se_sys_mount+0x313/0x410 [ 216.329717][ T7652] ? __pfx___se_sys_mount+0x10/0x10 [ 216.329836][ T7652] ? do_syscall_64+0xbe/0xfa0 [ 216.329869][ T7652] ? __x64_sys_mount+0x20/0xc0 [ 216.329901][ T7652] do_syscall_64+0xfa/0xfa0 [ 216.329932][ T7652] ? lockdep_hardirqs_on+0x9c/0x150 [ 216.329964][ T7652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.329988][ T7652] ? clear_bhb_loop+0x60/0xb0 [ 216.330017][ T7652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.330040][ T7652] RIP: 0033:0x7f44ea99076a [ 216.330080][ T7652] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.330100][ T7652] RSP: 002b:00007f44eb8d9e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 216.330128][ T7652] RAX: ffffffffffffffda RBX: 00007f44eb8d9ef0 RCX: 00007f44ea99076a [ 216.330146][ T7652] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007f44eb8d9eb0 [ 216.330164][ T7652] RBP: 0000200000000180 R08: 00007f44eb8d9ef0 R09: 0000000000000000 [ 216.330181][ T7652] R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000001c0 [ 216.330196][ T7652] R13: 00007f44eb8d9eb0 R14: 00000000000001a1 R15: 0000200000000080 [ 216.330233][ T7652] Solve the problem by moving and fixing the sanity check. The problematic if-else-if-else code will just distinguish three basic scenarios: "regular" vs. "wrapped" vs. "too many times wrapped" block. The new sanity check is more precise. A valid "data_size" must be lower than half of the data buffer size. Also it must not be zero at this stage. It allows to catch problematic "data_size" even for wrapped blocks. Closes: https://lore.kernel.org/all/69096836.a70a0220.88fb8.0006.GAE@google.com/ Closes: https://lore.kernel.org/all/69078fb6.050a0220.29fc44.0029.GAE@google.com/ Fixes: 67e1b0052f6bb82 ("printk_ringbuffer: don't needlessly wrap data blocks around") Reviewed-by: John Ogness Tested-by: John Ogness Link: https://patch.msgid.link/20251107194720.1231457-2-pmladek@suse.com Signed-off-by: Petr Mladek commit 30183a67a8a0e74adf92e2dc66b5674465d42025 Author: Ovidiu Panait Date: Mon Oct 20 14:31:06 2025 +0000 dt-bindings: thermal: r9a09g047-tsu: Document RZ/V2H TSU The Renesas RZ/V2H SoC includes a Thermal Sensor Unit (TSU) block designed to measure the junction temperature. The device provides real-time temperature measurements for thermal management, utilizing two dedicated channels for temperature sensing. The Renesas RZ/V2H SoC is using the same TSU IP found on the RZ/G3E SoC, the only difference being that it has two channels instead of one. Add new compatible string "renesas,r9a09g057-tsu" for RZ/V2H and use "renesas,r9a09g047-tsu" as a fallback compatible to indicate hardware compatibility with the RZ/G3E implementation. Signed-off-by: Ovidiu Panait Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251020143107.13974-3-ovidiu.panait.rb@renesas.com commit 249092174caa3fe9fb8f7914991a8c0de484bcf8 Author: Borislav Petkov (AMD) Date: Sat Nov 1 13:37:51 2025 +0100 tools/objtool: Copy the __cleanup unused variable fix for older clang Copy from 54da6a092431 ("locking: Introduce __cleanup() based infrastructure") the bits which mark the variable with a cleanup attribute unused so that my clang 15 can dispose of it properly instead of warning that it is unused which then fails the build due to -Werror. Suggested-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20251031114919.GBaQSiPxZrziOs3RCW@fat_crate.local commit d930ffa5d6e8867a290db9c6aad1c62731aeb2c3 Author: Jani Nikula Date: Fri Nov 7 13:05:00 2025 +0200 drm/gma500: use drm_crtc_vblank_crtc() We have drm_crtc_vblank_crtc() to get the struct drm_vblank_crtc pointer for a crtc. Use it instead of poking at dev->vblank[] directly. However, we also need to get the crtc to start with. We could use drm_crtc_from_index(), but refactor to use drm_for_each_crtc() instead. This is all a bit tedious, and perhaps the driver shouldn't be poking at vblank->enabled directly in the first place. But at least hide away the dev->vblank[] access in drm_vblank.c where it belongs. Cc: Patrik Jakobsson Acked-by: Patrik Jakobsson Link: https://patch.msgid.link/27b2c6772c68120d0d5ec28477db0d993743e955.1762513240.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 44ea44ad7256964b5ace233cf69e589e29beeee7 Author: Jani Nikula Date: Fri Nov 7 13:04:59 2025 +0200 drm/vmwgfx: use drm_crtc_vblank_crtc() We have drm_crtc_vblank_crtc() to get the struct drm_vblank_crtc pointer for a crtc. Use it instead of poking at dev->vblank[] directly. Cc: Zack Rusin Cc: Broadcom internal kernel review list Reviewed-by: Ian Forbes Link: https://patch.msgid.link/5157c2e927676aad75348855cf7b6745cba90003.1762513240.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 0830e122ce579d5c22461c5770c9586096fa3c60 Author: Jani Nikula Date: Fri Nov 7 13:04:58 2025 +0200 drm/tidss: use drm_crtc_vblank_crtc() We have drm_crtc_vblank_crtc() to get the struct drm_vblank_crtc pointer for a crtc. Use it instead of poking at dev->vblank[] directly. Cc: Jyri Sarha Cc: Tomi Valkeinen Acked-by: Jyri Sarha Link: https://patch.msgid.link/ffd5ebe03391b3c01e616c0c844a4b8ddecede36.1762513240.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6b83815bb114cbf9de5e6a71bc20015be8b17c9d Author: Jani Nikula Date: Fri Nov 7 13:04:55 2025 +0200 drm/vblank: use drm_crtc_vblank_crtc() in workers We have drm_crtc_vblank_crtc() to get the struct drm_vblank_crtc pointer for a crtc. Use it instead of poking at dev->vblank[] directly. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/f046701a10340c1dcaecb1b52e41dcf2236fded1.1762513240.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit fd4e0255269bca311c90f0d0c1d5bd53c8846a59 Author: Uros Bizjak Date: Sun Sep 7 20:48:46 2025 +0200 x86/percpu: Use BIT_WORD() and BIT_MASK() macros Use BIT_WORD() and BIT_MASK() macros from in instead of open-coding them. No functional change intended. Signed-off-by: Uros Bizjak Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20250907184915.78041-1-ubizjak@gmail.com commit e96a7dc6de5f6c2cac8cc919584c95ae52cf1f9a Author: Lad Prabhakar Date: Thu Oct 23 22:33:50 2025 +0100 dt-bindings: display: renesas,rzg2l-du: Add support for RZ/V2N SoC Document support for the DU IP found on the Renesas RZ/V2N (R9A09G056) SoC. The DU IP is functionally identical to that on the RZ/V2H(P) SoC, so no driver changes are needed. The existing `renesas,r9a09g057-du` compatible will be used as a fallback for the RZ/V2N SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://patch.msgid.link/20251023213350.681602-1-prabhakar.mahadev-lad.rj@bp.renesas.com commit 47c303ba6e8090f5941cc264bf207ccbda13586c Author: Marco Crivellari Date: Thu Nov 6 17:33:41 2025 +0100 cpufreq: tegra194: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari [ Viresh: Fixed Subject ] Signed-off-by: Viresh Kumar commit 58f5d39d5ed8f2e43f230389ea0d59791afdcd55 Author: Christian Marangi Date: Wed Nov 5 12:21:34 2025 +0100 cpufreq: qcom-nvmem: add compatible fallback for ipq806x for no SMEM On some IPQ806x SoC SMEM might be not initialized by SBL. This is the case for some Google devices (the OnHub family) that can't make use of SMEM to detect the SoC ID (and socinfo can't be used either as it does depends on SMEM presence). To handle these specific case, check if the SMEM is not initialized (by checking if the qcom_smem_get_soc_id returns -ENODEV) and fallback to OF machine compatible checking to identify the SoC variant. Suggested-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Christian Marangi Signed-off-by: Viresh Kumar commit fa4aa0b271db78de3d1bace6e3383cd65efa31b1 Author: Suraj Kandpal Date: Mon Nov 10 11:49:41 2025 +0530 drm/i915/ltphy: Return lowest portclock for HDMI from reverse algorithm Return the lowest port clock for HDMI when the reverse algorithm calculates it to be 0 to avoid errors later but throw a warn. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20251110061940.545183-2-suraj.kandpal@intel.com commit 6fedb7bf73d7b39e654b34829d5a73228e640b32 Author: Suraj Kandpal Date: Mon Nov 10 11:49:40 2025 +0530 drm/i915/ltphy: Implement HDMI Algo for Pll state Implement the HDMI Algorithm to dynamically create LT PHY state based on the port clock provided. Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Link: https://patch.msgid.link/20251110061940.545183-1-suraj.kandpal@intel.com commit 75b51437a4ac18195cc0683acea7bf75b6f43e7f Author: Finn Thain Date: Mon Nov 10 11:44:49 2025 +1100 parisc: Drop linux/kernel.h include from asm/bug.h header While working on an unrelated patch series, I needed to include linux/bug.h from linux/instrumented.h, in order to call WARN_ON_ONCE(). Doing so resulted in the following compiler error on parisc: In file included from ./include/linux/atomic/atomic-instrumented.h:17, from ./include/linux/atomic.h:82, from ./arch/parisc/include/asm/bitops.h:13, from ./include/linux/bitops.h:67, from ./include/linux/kernel.h:23, from ./arch/parisc/include/asm/bug.h:5, from ./include/linux/bug.h:5, from ./include/linux/page-flags.h:10, from kernel/bounds.c:10: ./include/linux/instrumented.h: In function 'instrument_atomic_alignment_check': ./include/linux/instrumented.h:69:9: error: implicit declaration of function 'WARN_ON_ONCE' [-Werror=implicit-function-declaration] 69 | WARN_ON_ONCE((unsigned long)v & (size - 1)); | ^~~~~~~~~~~~ cc1: some warnings being treated as errors make[3]: *** [scripts/Makefile.build:182: kernel/bounds.s] Error 1 The problem is, asm/bug.h indirectly includes atomic-instrumented.h, which means a new cycle appeared in the graph of #includes. And because some headers in the cycle can't see all definitions, my new WARN_ON_ONCE() call appears to be an undeclared function. This only happens on parisc and it's easy to fix. In the error message above, linux/kernel.h is included by asm/bug.h, but it's no longer needed there, so just remove that include. The comment about needing BUGFLAG_TAINT seems to be incorrect as of commit 19d436268dde ("debug: Add _ONCE() logic to report_bug()"). Also, there's a comment in linux/kernel.h which strongly discourages use of that header. Acked-by: Helge Deller # parisc Signed-off-by: Finn Thain Signed-off-by: Helge Deller commit e8f288a115f4850a65063af8787545dbf50abf47 Author: Takahiro Kuwano Date: Wed Nov 5 16:48:00 2025 +0900 mtd: spi-nor: spansion: SMPT fixups for S25FS-S S25FS-S family supports SMPT that helps to detect sector layout settings in configuration registers, but some of parameters in the table are wrong or undetermined so the fixups below are required. Read Any Register op is used to read configuration registers that related to sector map. The op requires 8 cycles latency by default. Implement smpt_read_dummy() to set correct dummy cycles. Map ID is structured by combination of CR3NV[3], CR1NV[2], and CR3NV[1]. However, in S25FS512S, CR3NV[1] is RFU and always 0, while map IDs defined in the table assume it is always 1. Implement smpt_map_id() to fix map ID for S25FS512S. Other densities in S25FS-S family (256Mb and 128Mb) don't need this fix as CR3NV[1] in those chips is configurable and map IDs are correctly defined in SMPT. Co-developed-by: Marek Vasut Signed-off-by: Marek Vasut Reviewed-by: Tudor Ambarus Tested-by: Marek Vasut # S25FS512S Signed-off-by: Takahiro Kuwano Signed-off-by: Pratyush Yadav commit f74de390557bf2bcc5dca4a357b41c0701d3f76e Author: Takahiro Kuwano Date: Wed Nov 5 16:47:59 2025 +0900 mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook Certain chips have inconsistent Sector Map Parameter Table (SMPT) data, which leads to the wrong map ID being identified, causing failures to detect the correct sector map. To fix this, introduce smpt_map_id() into the struct spi_nor_fixups. This function will be called after the initial SMPT-based detection, allowing chip-specific logic to correct the map ID. Infineon S25FS512S needs this fixup as it has inconsistency between map ID definition and configuration register value actually obtained. Co-developed-by: Marek Vasut Signed-off-by: Marek Vasut Reviewed-by: Tudor Ambarus Tested-by: Marek Vasut # S25FS512S Signed-off-by: Takahiro Kuwano Reviewed-by: Tudor Ambarus > Signed-off-by: Pratyush Yadav commit 653f6def567c81f37302f9591ffd54df3e2a11eb Author: Takahiro Kuwano Date: Wed Nov 5 16:47:58 2025 +0900 mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook SMPT contains config detection info that describes opcode, address, and dummy cycles to read sector map config. The dummy cycles parameter can be SMPT_CMD_READ_DUMMY_IS_VARIABLE and in that case nor->read_dummy (initialized as 0) is used. In Infineon flash chips, Read Any Register command with variable dummy cycle is defined in SMPT. S25Hx/S28Hx flash has 0 dummy cycle by default to read volatile regiters and nor->read_dummy can work. S25FS-S flash has 8 dummy cycles so we need a hook that can fix dummy cycles with actually used value. Inroduce smpt_read_dummy() in struct spi_nor_fixups. It is called when the dummy cycle field in SMPT config detection is 'varialble'. Reviewed-by: Tudor Ambarus Tested-by: Marek Vasut # S25FS512S Signed-off-by: Takahiro Kuwano Signed-off-by: Pratyush Yadav commit 7d41b3085b0b23a3536e2d4c964898428e9b9833 Author: Niklas Söderlund Date: Thu Nov 6 22:23:42 2025 +0100 arm64: dts: renesas: r8a779a0: Add GE7800 GPU node Describe Imagination Technologies PowerVR Rogue GE7800 BNVC 15.5.1.64 present in Renesas R-Car R8A779A0 V3U SoC. Signed-off-by: Niklas Söderlund Reviewed-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106212342.2771579-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 3bef06115a22df00e3826a4957eb270d9270f6ca Merge: 303a5185e024ee 1de3d9e2cd3a3c Author: Geert Uytterhoeven Date: Mon Nov 10 11:09:40 2025 +0100 Merge tag 'renesas-r8a779a0-dt-binding-defs-tag2' into renesas-dts-for-v6.19 Renesas R-Car V3U Graphics Clock DT Binding Definition Graphics Clock DT binding definition for the Renesas R-Car V3U (R8A779A0) SoC, shared by driver and DT source files. commit ea2bfb853b15f01b6a24e3fb020feb1c0568873b Author: Rob Herring (Arm) Date: Mon Oct 27 16:26:41 2025 -0500 dt-bindings: pinctrl: Convert sprd,sc9860-pinctrl to DT schema Convert the sprd,sc9860-pinctrl binding to DT schema format. What's valid for the the sleep mode child nodes wasn't well defined. The schema is based on the example (as there's no .dts with pin states) and the driver's register definitions. Signed-off-by: Rob Herring (Arm) Signed-off-by: Linus Walleij commit 303a5185e024ee6282d93c13304ef88bea45e603 Author: Marek Vasut Date: Tue Nov 4 14:56:07 2025 +0100 arm64: dts: renesas: r8a77965: Add GE7800 GPU node Describe Imagination Technologies PowerVR Rogue GE7800 BNVC 15.5.1.64 present in Renesas R-Car R8A77965 M3-N SoC. Reviewed-by: Geert Uytterhoeven Signed-off-by: Marek Vasut Acked-by: Matt Coster Link: https://patch.msgid.link/20251104135716.12497-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit b139702a889692ec30702534ebb1ae2b11ed1cbf Author: Jie Gan Date: Thu Sep 25 18:42:33 2025 +0800 coresight: change the sink_ops to accept coresight_path Update the sink_enable functions to accept coresight_path instead of a generic void *data, as coresight_path encapsulates all the necessary data required by devices along the path. Tested-by: Carl Worth Reviewed-by: Carl Worth Reviewed-by: Leo Yan Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250925-fix_helper_data-v2-3-edd8a07c1646@oss.qualcomm.com commit 94baedb51dea4b0c97e3c9acd90953bec98d03e7 Author: Jie Gan Date: Thu Sep 25 18:42:32 2025 +0800 coresight: change helper_ops to accept coresight_path Update the helper_enable and helper_disable functions to accept coresight_path instead of a generic void *data, as coresight_path encapsulates all the necessary data required by devices along the path. Tested-by: Carl Worth Reviewed-by: Carl Worth Reviewed-by: Leo Yan Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250925-fix_helper_data-v2-2-edd8a07c1646@oss.qualcomm.com commit aaa5abcc9d44d2c8484f779ab46d242d774cabcb Author: Carl Worth Date: Thu Sep 25 18:42:31 2025 +0800 coresight: tmc: add the handle of the event to the path The handle is essential for retrieving the AUX_EVENT of each CPU and is required in perf mode. It has been added to the coresight_path so that dependent devices can access it from the path when needed. The existing bug can be reproduced with: perf record -e cs_etm//k -C 0-9 dd if=/dev/zero of=/dev/null Showing an oops as follows: Unable to handle kernel paging request at virtual address 000f6e84934ed19e Call trace: tmc_etr_get_buffer+0x30/0x80 [coresight_tmc] (P) catu_enable_hw+0xbc/0x3d0 [coresight_catu] catu_enable+0x70/0xe0 [coresight_catu] coresight_enable_path+0xb0/0x258 [coresight] Fixes: 080ee83cc361 ("Coresight: Change functions to accept the coresight_path") Signed-off-by: Carl Worth Reviewed-by: Leo Yan Co-developed-by: Jie Gan Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250925-fix_helper_data-v2-1-edd8a07c1646@oss.qualcomm.com commit f8ea1a2760296831a45a57748ae0587751b6688f Author: Niklas Söderlund Date: Thu Nov 6 22:16:03 2025 +0100 clk: renesas: r8a779a0: Add ZG Core clock Describe the ZG Core clock needed to operate the PowerVR GPU. Signed-off-by: Niklas Söderlund Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106211604.2766465-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit cec551ec79c2f287d1eb048f70fe4bff66cc7d41 Author: Armin Wolf Date: Sun Nov 2 18:29:42 2025 +0100 Documentation: laptops: Add documentation for uniwill laptops Add documentation for admins regarding Uniwill laptops. This should help them to setup the uniwill-laptop driver, which sadly cannot be loaded automatically. Reported-by: cyear Closes: https://github.com/lm-sensors/lm-sensors/issues/508 Closes: https://github.com/Wer-Wolf/uniwill-laptop/issues/3 Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251102172942.17879-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d050479693bb91da5a0e305ca9dd59f4c0b55dd3 Author: Armin Wolf Date: Sun Nov 2 18:29:41 2025 +0100 platform/x86: Add Uniwill laptop driver Add a new driver for Uniwill laptops. The driver uses a ACPI interface to talk with the embedded controller, but relies on a ACPI WMI interface for receiving event notifications. The driver is reverse-engineered based on the following information: - OEM software from intel - https://github.com/pobrn/qc71_laptop - https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers - https://github.com/tuxedocomputers/tuxedo-control-center The underlying EC supports various features, including hwmon sensors, battery charge limiting, a RGB lightbar and keyboard-related controls. Reported-by: cyear Closes: https://github.com/lm-sensors/lm-sensors/issues/508 Closes: https://github.com/Wer-Wolf/uniwill-laptop/issues/3 Tested-by: Werner Sembach Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20251102172942.17879-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 19be362ce66f4ec464bec912fe4882ef8cfeef60 Merge: 566ed24a0a79e2 1de3d9e2cd3a3c Author: Geert Uytterhoeven Date: Mon Nov 10 11:03:51 2025 +0100 Merge tag 'renesas-r8a779a0-dt-binding-defs-tag2' into renesas-clk-for-v6.19 Renesas R-Car V3U Graphics Clock DT Binding Definition Graphics Clock DT binding definition for the Renesas R-Car V3U (R8A779A0) SoC, shared by driver and DT source files. commit 566ed24a0a79e23b37cc883a49d515916a245cdb Author: Niklas Söderlund Date: Thu Nov 6 22:16:02 2025 +0100 clk: renesas: rcar-gen4: Add support for clock dividers in FRQCRB The FRQCRB register on R-Car V3U, V4H and V4M do in addition to the already supported KICK bit contain settings for the frequency division ratios for the clocks ZTR, ZT, ZS and ZG. It is however not possible to use the latter when registering a Z clock with the DEF_GEN4_Z() macro. This change adds support for that by extending the existing practice of treating the bit field offsets at multiples of 32 to map to a different register. With this new mapping in palace bit offsets 0 - 31 map to FRQCRC0 bit offsets 32 - 63 map to FRQCRC1 bit offsets 64 - 95 map to FRQCRB The change also adds an error condition to return an error if an unknown offset is used. The KICK bit defined in FRQCRB and already supported covers all three registers and no addition to how it is handled are needed. Signed-off-by: Niklas Söderlund Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106211604.2766465-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 1de3d9e2cd3a3c6f503cd31ec1f552c9dd8cf8ca Author: Niklas Söderlund Date: Thu Nov 6 22:16:01 2025 +0100 dt-bindings: clock: r8a779a0: Add ZG core clock Add the core clock used by the GPU on the Renesas R-Car V3U (R8A779A0) SoC. Signed-off-by: Niklas Söderlund Acked-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20251106211604.2766465-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 90430ea98f5585270bc185cee548154d239af8d7 Author: Rong Zhang Date: Thu Nov 6 02:28:27 2025 +0800 platform/x86: ideapad-laptop: Add charge_types:Fast (Rapid Charge) The GBMD/SBMC interface on recent devices supports Rapid Charge mode (charge_types: Fast) in addition to Conservation Mode (charge_types: Long_Life). Query the GBMD interface on probe to determine if a device supports Rapid Charge. If so, expose these two modes while carefully maintaining their mutually exclusive state, which aligns with the behavior of manufacturer utilities on Windows. Signed-off-by: Rong Zhang Acked-by: Ike Panhc Reviewed-by: Mark Pearson Tested-By: Jelle van der Waa Link: https://patch.msgid.link/20251105182832.104946-5-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5c54ece0476638f7c5fc655c655e721286a26bf1 Author: Rong Zhang Date: Thu Nov 6 02:28:26 2025 +0800 platform/x86: ideapad-laptop: Support multiple power_supply_ext definitions Some recent devices supports more charge_types. To properly support these device without breaking the existing ones, we need to define multiple power_supply_ext for different GBMD/SBMC interface revisions. No functional change intended. Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20251105182832.104946-4-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 85901a0d8591ecd756078e57be077f12a0ee78be Author: Rong Zhang Date: Thu Nov 6 02:28:25 2025 +0800 platform/x86: ideapad-laptop: Protect GBMD/SBMC calls with mutex The upcoming changes for Rapid Charge support require two consecutive SBMC calls to switch charge_types. Hence, a mutex is required. No functional change intended. Signed-off-by: Rong Zhang Acked-by: Ike Panhc Link: https://patch.msgid.link/20251105182832.104946-3-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 06c129cac01be45e458d37534d1a6ba753cf6f13 Author: Rong Zhang Date: Thu Nov 6 02:28:24 2025 +0800 platform/x86: ideapad-laptop: Use str_on_off() helper Use the str_on_off() helper instead of open-coding the same operation. This improves code readability. No functional change intended. Suggested-by: kernel test robot Suggested-by: Julia Lawall Link: https://lore.kernel.org/r/202510311551.xjWbHTrm-lkp@intel.com/ Suggested-by: Ilpo Järvinen Link: https://lore.kernel.org/r/2bae2ea7-2ef9-0cfa-0c2c-39a7043b2aa5@linux.intel.com/ Signed-off-by: Rong Zhang Link: https://patch.msgid.link/20251105182832.104946-2-i@rong.moe Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8903597df7b6d511f81abb47708a33e9a1e6a530 Author: Geert Uytterhoeven Date: Tue Nov 4 17:59:47 2025 +0100 pinctrl: renesas: r8a779h0: Remove STPWT_EXTFXR Rev.0.81 of the R-Car V4M Series Hardware User’s Manual removed the "STPWT_EXTFXR" signal from the pin control register tables. As this is further unused in the pin control driver, it can be removed safely. Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut Link: https://patch.msgid.link/f849fa3b9b516e9dd04b45462b69f52225259480.1762274384.git.geert+renesas@glider.be commit 3a430f50b8ceaae345ee507abfa5e7360819db71 Author: Huy Bui Date: Tue Nov 4 17:59:46 2025 +0100 pinctrl: renesas: r8a779h0: Remove CC5_OSCOUT Rev.0.71 of the R-Car V4M Series Hardware User’s Manual removed the "CC5_OSCOUT" signal from the pin control register tables. As this is further unused in the pin control driver, it can be removed safely. Signed-off-by: Huy Bui Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut Link: https://patch.msgid.link/895bb560467309706931d14aeea0e063ad0e86eb.1762274384.git.geert+renesas@glider.be commit 87f8ed0518bd7d792948809f3bf8f789522fad74 Author: Huy Bui Date: Tue Nov 4 17:59:45 2025 +0100 pinctrl: renesas: r8a779g0: Remove STPWT_EXTFXR Rev.1.30 of the R-Car V4H Series Hardware User’s Manual removed the "STPWT_EXTFXR" signal from the pin control register tables. As this is further unused in the pin control driver, it can be removed safely. Signed-off-by: Huy Bui Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut Link: https://patch.msgid.link/f6cfdbbc024d85e87583a1d57ea01582632f1216.1762274384.git.geert+renesas@glider.be commit ac4e5f4ab6f367be3d5acfe2d3cfc519d149d7ac Author: Huy Bui Date: Tue Nov 4 17:59:44 2025 +0100 pinctrl: renesas: r8a779g0: Remove CC5_OSCOUT Rev.1.30 of the R-Car V4H Series Hardware User’s Manual removed the "CC5_OSCOUT" signal from the pin control register tables. As this is further unused in the pin control driver, it can be removed safely. Signed-off-by: Huy Bui Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut Link: https://patch.msgid.link/77f9efe5388f2801ace945b7793d4823618eeec8.1762274384.git.geert+renesas@glider.be commit b737322278ffabd2766ac681c28553609a48694e Author: Thanh Quan Date: Tue Nov 4 17:59:43 2025 +0100 pinctrl: renesas: r8a779g0: Remove AVB[01]_MII Rev.1.30 of the R-Car V4H Series Hardware User’s Manual removed the "AVB[01]_MII_*" signals from the pin control register tables. As these are further unused in the pin control driver, they can be removed safely. Signed-off-by: Thanh Quan Signed-off-by: Geert Uytterhoeven Reviewed-by: Marek Vasut Link: https://patch.msgid.link/58662f50136280532bcc8bbe94741d82425bd118.1762274384.git.geert+renesas@glider.be commit aa70b9cf6856a7f9f7780ab39d2eb07fce7477c0 Merge: a6446829f841bf 3c60b0b1e55adb Author: Christian Brauner Date: Mon Nov 10 10:41:58 2025 +0100 Merge branch 'kbuild-6.19.fms.extension' Bring in the shared branch with the Kbuild tree for enabling '-fms-extensions' for 6.19. Signed-off-by: Christian Brauner commit 473235677af46ecb167917887586646e9d70d9ff Author: Chien Wong Date: Fri Nov 7 22:23:32 2025 +0800 wifi: cfg80211: fix doc of struct key_params The seq in struct key_params is for many ciphers, including CCMP, GCMP, CMAC, GMAC. In addition to get_key(), it is also used when setting keys. Signed-off-by: Chien Wong Link: https://patch.msgid.link/20251107142332.181308-1-m@xv97.com Signed-off-by: Johannes Berg commit 243d30fbb679f3442d2e697bd344dee975982583 Author: Johannes Berg Date: Wed Nov 5 16:10:33 2025 +0100 wifi: mac80211: remove unnecessary vlan NULL check In a vlan iteration loop the vlan pointer cannot be NULL. Remove the unnecessary check. Link: https://patch.msgid.link/20251105161033.670b5a06296c.I24cb1a5338736ab0a8a24d6a492c259f894d09fb@changeid Signed-off-by: Johannes Berg commit 68eb1b791ac8da7c3d03967143f1417e2978bf5e Author: Johannes Berg Date: Wed Nov 5 16:08:10 2025 +0100 wifi: mac80211: pass frame type to element parsing This will be needed for UHR operation parsing, and we already pass whether or not the frame is an action frame, replace that by the full type. Note this fixes a few cases where 'false' was erroneously passed (mesh and TDLS) and removes ieee802_11_parse_elems_crc() as it's unused. Link: https://patch.msgid.link/20251105160810.a476d20a6e01.Ie659535f9357f2f9a3c73f8c059ccfc96bf93b54@changeid Signed-off-by: Johannes Berg commit 1fba15768585ef75dbf86b1c75533dd5b81e247a Author: Johannes Berg Date: Wed Nov 5 16:05:38 2025 +0100 wifi: mac80211: remove "disabling VHT" message This message always occurs with any AP that is simply HT/11n, remove it. Link: https://patch.msgid.link/20251105160538.f8b286cfba08.Ib91b5b09a3fff753341b0f7cb0df7f6913a4abe6@changeid Signed-off-by: Johannes Berg commit 1ce954c98b8968e66a304c8586122d706bae97c3 Author: Johannes Berg Date: Wed Nov 5 16:03:45 2025 +0100 wifi: mac80211: add and use chanctx usage iteration In preparation for NAN interfaces using multiple channel contexts, add an iterator macro that iterates all users of a given channel context. The logic during reserved assign/reassign handling the bandwidth in ieee80211_get_chanctx_max_required_bw() is a bit more complicated and should be cleaned up, so it isn't yet converted. Link: https://patch.msgid.link/20251105160431.5aaccc2f127d.I2b7fd0858a263916f43abab49c6d3cc0b5aa16ec@changeid Signed-off-by: Johannes Berg commit 52363af3a9c989e8d8d6f8a2343a7f669e53a57f Author: Johannes Berg Date: Wed Nov 5 16:03:44 2025 +0100 wifi: mac80211: simplify ieee80211_recalc_chanctx_min_def() API ieee80211_recalc_chanctx_min_def() is used outside the chandef code, but then should/is always used with NULL/false for the two last arguments. Remove them, and create another level of indirection for use inside the file. Link: https://patch.msgid.link/20251105160431.33408844c392.I4f52298861780c17a27cd229609e8a3e29c8d740@changeid Signed-off-by: Johannes Berg commit a1dc648aa76d61d8e75692cecea043b1bfdfeda6 Author: Johannes Berg Date: Wed Nov 5 16:03:43 2025 +0100 wifi: mac80211: remove chanctx to link back-references Each link can currently use a chanctx and have another one reserved, and both of these are also tracked backwards in the assigned_links and reserved_links lists. If we consider that there aren't *that* many links, this duplicate book- keeping isn't necessary. (I think it used to be necessary before the wiphy locking changes, when chanctx_mtx existed, because we couldn't do any interface iterations while holding only chanctx_mtx.) Additionally, for NAN, we're going to want to track which chanctxs are in use by the (group of) NAN interfaces. For those, links don't really make sense as such, so chanctxs need to be assigned to a different data structure. Thus, as a first step, remove those back-lists of users (right now only links) of each channel context. This is a very basic conversion, ieee80211_vif_use_reserved_switch() should made to iterate smarter. Link: https://patch.msgid.link/20251105160431.dbeea1c42e76.I8d273c407274e1c05a4778aa20b56a9f326e87a7@changeid Signed-off-by: Johannes Berg commit 29cc798e7061e603843091af2f17b5b25009e7b8 Author: Johannes Berg Date: Wed Nov 5 16:03:42 2025 +0100 wifi: mac80211: make link iteration safe for 'break' The current link iteration macros for_each_sdata_link() and for_each_sdata_link_rcu() are various nested for loops, but because they iterate all sdata instances and then all links inside, using 'break' inside the iteration doesn't actually break out of the whole iteration. Make it work by tracking whether or not the inner iteration (over links) actually completed, if it broke out then given list_for_each_entry() it still iterates all sdata instances but won't go into them. Link: https://patch.msgid.link/20251105160431.c21956654fc0.I8d4739af061c44c57d172f19a15303a44ad1e596@changeid Signed-off-by: Johannes Berg commit 1a1cad924e8a60252132446fbba1284035010b4f Author: Johannes Berg Date: Wed Nov 5 15:39:58 2025 +0100 wifi: mac80211: fix EHT typo This is clearly EHT, not ETH, fix the typo. Link: https://patch.msgid.link/20251105153958.12a04517f7ec.Idcf800817fa30605b1002c3d2287cad016e7aea7@changeid Signed-off-by: Johannes Berg commit 30b6089aad35500e683025dddc029ac28705385d Author: Johannes Berg Date: Wed Nov 5 15:39:57 2025 +0100 wifi: cfg80211: fix EHT typo This is clearly EHT, not ETH, fix the typo. Link: https://patch.msgid.link/20251105153958.e9d4af3b768e.I5f3378326837e3f62928a2f1fd3403f29cea069b@changeid Signed-off-by: Johannes Berg commit 60a3734192fa6909c48e33b0d212990ebaff54c4 Author: Johannes Berg Date: Wed Nov 5 15:36:56 2025 +0100 wifi: ieee80211: split NAN definitions out The ieee80211.h file has gotten very long, continue splitting it by putting NAN definitions into a separate file. Note that NAN isn't really even IEEE 802.11 but WFA. Link: https://patch.msgid.link/20251105153843.8da0e796dda2.I7b2ce11220b70e8794019501eabbf8afbaf431a6@changeid Signed-off-by: Johannes Berg commit fcd42b909ba06737dfcda47f3a0a9718bd3ebf03 Author: Johannes Berg Date: Wed Nov 5 15:36:55 2025 +0100 wifi: ieee80211: split P2P definitions out The ieee80211.h file has gotten very long, continue splitting it by putting P2P definitions into a separate file. Note that P2P isn't really even IEEE 802.11 but WFA. Link: https://patch.msgid.link/20251105153843.e47b2614e9d2.Id242f61da720e365f6b5d7a4a545fbbc2f1e92b4@changeid Signed-off-by: Johannes Berg commit 00105d7600bfb171037783da5f26e2565c7d2106 Author: Johannes Berg Date: Wed Nov 5 15:36:54 2025 +0100 wifi: ieee80211: split S1G definitions out The ieee80211.h file has gotten very long, continue splitting it by putting S1G definitions into a separate file. Link: https://patch.msgid.link/20251105153843.82c0bddee6e3.Ic6646615286dad240b42e31e9d428c7e4ea40ce0@changeid Signed-off-by: Johannes Berg commit 86bc0c662322b4749cd666678d2fdce7015bcae3 Author: Johannes Berg Date: Wed Nov 5 15:36:53 2025 +0100 wifi: ieee80211: split EHT definitions out The ieee80211.h file has gotten very long, continue splitting it by putting EHT definitions into a separate file. Link: https://patch.msgid.link/20251105153843.bf77fe169140.I691267e0edd914c604a5bfd447d33be00044c9b4@changeid Signed-off-by: Johannes Berg commit 02a2cf302557eb59794bba0b05d6755f44928d78 Author: Johannes Berg Date: Wed Nov 5 15:36:52 2025 +0100 wifi: ieee80211: split HE definitions out The ieee80211.h file has gotten very long, continue splitting it by putting HE definitions into a separate file. Link: https://patch.msgid.link/20251105153843.6998c0802104.I3dd7cfea6abbd118b999ecdedd48437d39cb0533@changeid Signed-off-by: Johannes Berg commit 7cb14da1d7bbfa4a6417ed7f1bc07dd77bcd9c83 Author: Johannes Berg Date: Wed Nov 5 15:36:51 2025 +0100 wifi: ieee80211: split VHT definitions out The ieee80211.h file has gotten very long, continue splitting it by putting VHT definitions into a separate file. Link: https://patch.msgid.link/20251105153843.c31cb771a250.I787a13064db7d80440101de3445be17881daf1b6@changeid Signed-off-by: Johannes Berg commit fdc1c141f3ef4dc94e3880e973061681843f62c0 Author: Johannes Berg Date: Wed Nov 5 15:36:50 2025 +0100 wifi: ieee80211: split HT definitions out The ieee80211.h file has gotten very long, continue splitting it by putting HT definitions into a separate file. Link: https://patch.msgid.link/20251105153843.7532471178d0.Id956a5433ad8658e4e5c0272dbcbb59587206142@changeid Signed-off-by: Johannes Berg commit 69674282fc97fffd98a85ab5b4837edbc5898145 Author: Johannes Berg Date: Wed Nov 5 15:36:49 2025 +0100 wifi: ieee80211: split mesh definitions out The ieee80211.h file has gotten very long, start splitting it by putting mesh definitions into a separate file. Link: https://patch.msgid.link/20251105153843.489713ca8b34.I3befb4bf6ace0315758a1794224ddd18c4652e32@changeid Signed-off-by: Johannes Berg commit 3c60b0b1e55adbcf15528d78e0afca1933fa8c84 Merge: dcb6fa37fd7bc9 5ff8ad3909524a Author: Christian Brauner Date: Mon Nov 10 10:38:07 2025 +0100 Merge patch "kbuild: Add '-fms-extensions' to areas with dedicated CFLAGS" Nathan Chancellor says: Shared branch between Kbuild and other trees for enabling '-fms-extensions' for 6.19. * tag 'kbuild-ms-extensions-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Add '-fms-extensions' to areas with dedicated CFLAGS Kbuild: enable -fms-extensions jfs: Rename _inline to avoid conflict with clang's '-fms-extensions' Link: https://patch.msgid.link/20251101-kbuild-ms-extensions-dedicated-cflags-v1-1-38004aba524b@kernel.org Signed-off-by: Christian Brauner commit 88efd7c6997ee9da3e0274106f72b99fa105f45f Author: Christian Brauner Date: Sun Nov 9 22:11:28 2025 +0100 selftests/namespaces: add active reference count regression test Add a regression test for setns() with pidfd. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-7-ae8a4ad5a3b3@kernel.org Signed-off-by: Christian Brauner commit 57b39aabb99ea69b9046df2915404a931d9d6695 Author: Christian Brauner Date: Sun Nov 9 22:11:27 2025 +0100 ns: add asserts for active refcount underflow Add a few more assert to detect active reference count underflows. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-6-ae8a4ad5a3b3@kernel.org Signed-off-by: Christian Brauner commit f8d5a8970d2f49411824fb1fdd34bbb3eea22756 Author: Christian Brauner Date: Sun Nov 9 22:11:26 2025 +0100 ns: handle setns(pidfd, ...) cleanly The setns() system call supports: (1) namespace file descriptors (nsfd) (2) process file descriptors (pidfd) When using nsfds the namespaces will remain active because they are pinned by the vfs. However, when pidfds are used things are more complicated. When the target task exits and passes through exit_nsproxy_namespaces() or is reaped and thus also passes through exit_cred_namespaces() after the setns()'ing task has called prepare_nsset() but before the active reference count of the set of namespaces it wants to setns() to might have been dropped already: P1 P2 pid_p1 = clone(CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) pidfd = pidfd_open(pid_p1) setns(pidfd, CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS) prepare_nsset() exit(0) // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 1 -> exit_nsproxy_namespaces() -> exit_cred_namespaces() // ns_active_ref_put() will also put // the reference on the owner of the // namespace. If the only reason the // owning namespace was alive was // because it was a parent of @ns // it's active reference count now goes // to zero... -------------------------------- // | // ns->__ns_active_ref == 0 | // parent_ns->__ns_active_ref == 0 | | commit_nsset() -----------------> // If setns() // now manages to install the namespaces // it will call ns_active_ref_get() // on them thus bumping the active reference // count from zero again but without also // taking the required reference on the owner. // Thus we get: // // ns->__ns_active_ref == 1 // parent_ns->__ns_active_ref == 0 When later someone does ns_active_ref_put() on @ns it will underflow parent_ns->__ns_active_ref leading to a splat from our asserts thinking there are still active references when in fact the counter just underflowed. So resurrect the ownership chain if necessary as well. If the caller succeeded to grab passive references to the set of namespaces the setns() should simply succeed even if the target task exists or gets reaped in the meantime and thus has dropped all active references to its namespaces. The race is rare and can only be triggered when using pidfs to setns() to namespaces. Also note that active reference on initial namespaces are nops. Since we now always handle parent references directly we can drop ns_ref_active_get_owner() when adding a namespace to a namespace tree. This is now all handled uniformly in the places where the new namespaces actually become active. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-5-ae8a4ad5a3b3@kernel.org Fixes: 3c9820d5c64a ("ns: add active reference count") Reported-by: syzbot+1957b26299cf3ff7890c@syzkaller.appspotmail.com Signed-off-by: Christian Brauner commit a51dce7c3261d26e574b35da71dac3903bb35ae2 Author: Christian Brauner Date: Sun Nov 9 22:11:25 2025 +0100 ns: return EFAULT on put_user() error Don't return EINVAL, return EFAULT just like we do in other system calls. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-4-ae8a4ad5a3b3@kernel.org Signed-off-by: Christian Brauner commit 2ec2aff3c8e2523f3bde90e78031bae811335f3c Author: Christian Brauner Date: Sun Nov 9 22:11:24 2025 +0100 ns: make sure reference are dropped outside of rcu lock The mount namespace may in fact sleep when putting the last passive reference so we need to drop the namespace reference outside of the rcu read lock. Do this by delaying the put until the next iteration where we've already moved on to the next namespace and legitimized it. Once we drop the rcu read lock to call put_user() we will also drop the reference to the previous namespace in the tree. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-3-ae8a4ad5a3b3@kernel.org Fixes: 76b6f5dfb3fd ("nstree: add listns()") Signed-off-by: Christian Brauner commit 7cd3d204412b0584df38fd7be20002137f34721a Author: Christian Brauner Date: Sun Nov 9 22:11:23 2025 +0100 ns: don't increment or decrement initial namespaces There's no need to bump the active reference counts of initial namespaces as they're always active and can simply remain at 1. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-2-ae8a4ad5a3b3@kernel.org Signed-off-by: Christian Brauner commit 0355dcae2d157d95f234a56b540ab110350fd022 Author: Christian Brauner Date: Sun Nov 9 22:11:22 2025 +0100 ns: don't skip active reference count initialization Don't skip active reference count initialization for initial namespaces. Doing this will break network namespace active reference counting. Link: https://patch.msgid.link/20251109-namespace-6-19-fixes-v1-1-ae8a4ad5a3b3@kernel.org Fixes: 3a18f809184b ("ns: add active reference count") Signed-off-by: Christian Brauner commit e54ad0cd3673c93cdafda58505eaa81610fe3aef Author: Lyude Paul Date: Fri Nov 7 15:25:56 2025 -0500 rust/drm/gem: Fix missing header in `Object` rustdoc Invariants should be prefixed with a # to turn it into a header. There are no functional changes in this patch. Cc: stable@vger.kernel.org Fixes: c284d3e42338 ("rust: drm: gem: Add GEM object abstraction") Signed-off-by: Lyude Paul Link: https://patch.msgid.link/20251107202603.465932-1-lyude@redhat.com Signed-off-by: Alice Ryhl commit d4f279eced3903e77de418aa9090bf8db587f897 Author: Michał Winiarski Date: Fri Nov 7 17:10:00 2025 +0100 drm/xe/vf: Enable VF resource fixup unconditionally All the feature enabling code is in place - drop the debug flag requirement for VF resource fixup. Reviewed-by: Michal Wajdeczko Link: https://patch.msgid.link/20251107161000.1938186-1-michal.winiarski@intel.com Signed-off-by: Michał Winiarski commit c23cb4565ad8b976613f3bb91017feb6532c341c Author: Ahmad Fatoum Date: Tue Oct 7 07:36:02 2025 +0200 ARM: dts: stm32: lxa: drop unnecessary vusb_d/a-supply The LXA device trees are the only STM32MP1 device tree that specify vusb_d/usb_a-supply and apparently not for good reason: - vusb_d-supply (vdd_usb) is the same as the phy-supply for usbphyc_port1 - vusb_a-supply (reg18) is the same as vdda1v8-supply for usbphyc_port1 and usbphyc_port1 is linked to the usbotg_hs node via the phys property. Specifying the regulators in the &usbotg_hs node is thus superfluous and has been even found to be harmful in one instance: Linux v6.10 was found to lock up every 50-125 or so reboots on the LXA TAC when the DWC2 driver probe enables the regulators in bulk, unless both properties were removed. This issue was so far not reproducible on v6.17 (> 500 reboots), but as these properties are unnecessary and different from other STM32MP1 boards, remove them anyway. Signed-off-by: Ahmad Fatoum Link: https://lore.kernel.org/r/20251007-lxa-usb-dt-v1-1-cacde8088bb9@pengutronix.de Signed-off-by: Alexandre Torgue commit e40b061cd379f4897e705d17cf1b4572ad0f3963 Author: Jihed Chaibi Date: Tue Sep 16 00:46:11 2025 +0200 ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Move st,adc-freq, st,mod-12b, st,ref-sel, and st,sample-time properties from the touchscreen subnode to the parent touch@44 node. These properties are defined in the st,stmpe.yaml schema for the parent node, not the touchscreen subnode, resolving the validation error about unevaluated properties. Fixes: 27538a18a4fcc ("ARM: dts: stm32: add STM32MP1-based Phytec SoM") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/r/20250915224611.169980-1-jihed.chaibi.dev@gmail.com Signed-off-by: Alexandre Torgue commit a338d6e849ab31f32c08b4fcac11c0c72afbb150 Author: Ma Ke Date: Mon Nov 10 08:51:58 2025 +0800 RDMA/rtrs: server: Fix error handling in get_or_create_srv After device_initialize() is called, use put_device() to release the device according to kernel device management rules. While direct kfree() work in this case, using put_device() is more correct. Found by code review. Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") Signed-off-by: Ma Ke Link: https://patch.msgid.link/20251110005158.13394-1-make24@iscas.ac.cn Acked-by: Jack Wang Signed-off-by: Leon Romanovsky commit 0d1250c6af81eb549f3539d016e28fa19c936d33 Author: Laurent Pinchart Date: Fri Aug 22 03:27:33 2025 +0300 arm64: dts: imx8mp: Specify the number of channels for CSI-2 receivers The CSI-2 receivers in the i.MX8MP have 3 output channels. Specify this in the device tree, to enable support for more than one channel. Signed-off-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 9e24bdfecdb071a3a42fb74be1ab503c958e2740 Author: Marco Crivellari Date: Thu Nov 6 17:24:30 2025 +0100 bus: mhi: ep: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251106162430.328701-1-marco.crivellari@suse.com commit 081006b7c8e19406dc6674c6b6d086764d415b5c Author: Ian Rogers Date: Sat Nov 8 16:59:59 2025 -0800 perf test: Add test that command line period overrides sysfs/json values The behavior of weak terms is subtle, add a test that they aren't accidentally broken. The test finds an event with a weak 'period' and then overrides it. In no such event is present then the test skips. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 0e9b51a43214f81f07813b63349b03ded35139c7 Author: Ian Rogers Date: Sat Nov 8 16:59:58 2025 -0800 perf pmu: Make pmu_alias_terms weak again The terms for a json event should be weak so they don't override command line options. Before: ``` $ perf record -vv -c 1000 -e uops_issued.any -o /dev/null true 2>&1 |grep "{ sample_period, sample_freq }" { sample_period, sample_freq } 200003 { sample_period, sample_freq } 2000003 { sample_period, sample_freq } 1000 ``` After: ``` $ perf record -vv -c 1000 -e uops_issued.any -o /dev/null true 2>&1 |grep "{ sample_period, sample_freq }" { sample_period, sample_freq } 1000 { sample_period, sample_freq } 1000 { sample_period, sample_freq } 1000 ``` Fixes: 84bae3af20d0 ("perf pmu: Don't eagerly parse event terms") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit c9243d6df0d617535e842aa4c3d1d7dfdb91d07b Author: Andy Shevchenko Date: Sun Nov 9 21:16:37 2025 +0100 fpga: altera-cvp: Use pci_find_vsec_capability() when probing FPGA device Currently altera_cvp_probe() open-codes pci_find_vsec_capability(). Refactor the former to use the latter. With that done: - use the VSEC ID as per datasheet [1] - update the error message accordingly Link: https://www.intel.com/content/www/us/en/docs/programmable/683763/23-1/vendor-specific-header-register.html [1] Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20251109201729.3220460-1-andriy.shevchenko@linux.intel.com Reviewed-by: Xu Yilun Signed-off-by: Xu Yilun commit 2cf07ffeba5eb893c9f3637cbdbc5dcf95d7eaac Author: Dinh Nguyen Date: Sat Nov 1 14:08:48 2025 -0500 dt-bindings: fpga: update link for Altera's and AMD partial recon The link is giving the 404 error, so use the correct link for the documents Signed-off-by: Dinh Nguyen Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20251101190848.24271-1-dinguyen@kernel.org Reviewed-by: Xu Yilun Signed-off-by: Xu Yilun commit 85faa6495f34129778db61d8cd5a80db8ab19261 Author: Fabio Estevam Date: Sun Oct 26 08:02:37 2025 -0300 fpga: xilinx-spi: Add missing spi_device_id table The "xlnx,fpga-slave-serial" devicetree compatible string currently misses its SPI device ID entry. Without an spi_device_id table, the driver still works with device tree, but triggers the following runtime warning when registered via SPI core: SPI driver xlnx-slave-spi has no spi_device_id for xlnx,fpga-slave-serial Fix it by adding a corresponding spi_device_id table entry. Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20251026110237.986279-1-festevam@gmail.com [ Yilun: Remove extra whitespaces ] Reviewed-by: Xu Yilun Signed-off-by: Xu Yilun commit eff0306b109f2d611e44f0155b0324f6cfec3ef4 Author: Manivannan Sadhasivam Date: Sat Nov 1 09:59:42 2025 +0530 PCI: meson: Fix parsing the DBI register region First of all, the driver was parsing the 'dbi' register region as 'elbi'. This was due to DT mistakenly passing 'dbi' as 'elbi'. Since the DT is now fixed to supply 'dbi' region, this driver can rely on the DWC core driver to parse and map it. However, to support the old DTs, if the 'elbi' region is found in DT, parse and map the region as both 'dw_pcie::elbi_base' as 'dw_pcie::dbi_base'. This will allow the driver to work with both broken and fixed DTs. Also, skip parsing the 'elbi' region in DWC core if 'pci->elbi_base' was already populated. Fixes: 9c0ef6d34fdb ("PCI: amlogic: Add the Amlogic Meson PCIe controller driver") Fixes: c96992a24bec ("PCI: dwc: Add support for ELBI resource mapping") Reported-by: Linnaea Lavia Closes: https://lore.kernel.org/linux-pci/DM4PR05MB102707B8CDF84D776C39F22F2C7F0A@DM4PR05MB10270.namprd05.prod.outlook.com/ Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Tested-by: Neil Armstrong # on Bananapi-M2S Reviewed-by: Neil Armstrong Cc: stable@vger.kernel.org # 6.2 Link: https://patch.msgid.link/20251101-pci-meson-fix-v1-3-c50dcc56ed6a@oss.qualcomm.com commit 4813dea9e272ba0a57c50b8d51d440dd8e3ccdd7 Author: Manivannan Sadhasivam Date: Sat Nov 1 09:59:40 2025 +0530 dt-bindings: PCI: amlogic: Fix the register name of the DBI region Binding incorrectly specifies the 'DBI' region as 'ELBI'. DBI is a must have region for DWC controllers as it has the Root Port and controller specific registers, while ELBI has optional registers. Hence, fix the binding. Though this is an ABI break, this change is needed to accurately describe the PCI memory map. Fixes: 7cd210391101 ("dt-bindings: PCI: meson: add DT bindings for Amlogic Meson PCIe controller") Signed-off-by: Manivannan Sadhasivam Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20251101-pci-meson-fix-v1-1-c50dcc56ed6a@oss.qualcomm.com commit 944edca81e7aea15f83cf9a13a6ab67f711e8abd Author: Tzung-Bi Shih Date: Fri Oct 31 03:39:00 2025 +0000 platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread `cros_ec_console_log_work` is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device in .remove() which should shutdown sub-devices synchronously. Fix it. Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit dd94481408ba0e3b68c42d3ee986d83215a9fac9 Author: Khairul Anuar Romli Date: Fri Nov 7 07:35:25 2025 +0800 dt-bindings: firmware: svc: Add IOMMU support for Agilex5 In Agilex5, the TBU (Translation Buffer Unit) can now operate in non-secure mode, enabling Linux to utilize it through the IOMMU framework. This allows improved memory management capabilities in non-secure environments. With Agilex5 lifting this restriction, we are now extending the device tree bindings to support IOMMU for the Agilex5 SVC. Signed-off-by: Khairul Anuar Romli Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dinh Nguyen commit 4f91d2b0945571beac819f525416a22e7c37f669 Merge: 59d2d28f2269df a5fad3aeff41f8 Author: Linus Walleij Date: Sun Nov 9 23:55:18 2025 +0100 Merge tag 'renesas-pinctrl-for-v6.19-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.19 - Fix interrupt configuration and port mode after resume on RZ/G2L family SoCs, - Miscellaneous fixes and improvements. Signed-off-by: Linus Walleij commit 2d8482959efee5721456d199106b9c256c11b11b Author: Thomas Weißschuh Date: Sun Nov 9 20:27:29 2025 +0100 tools/nolibc: avoid using plain integer as NULL pointer While an integer zero is a valid NULL pointer as per the C standard, sparse will complain about it. Use explicit NULL pointers instead. Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202509261452.g5peaXCc-lkp@intel.com/ Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau commit c3454ac0367fbc38b2558fbd6c7d25acdee71c50 Author: Matthew Wilcox (Oracle) Date: Thu Nov 6 20:29:42 2025 +0000 gfs2: Use bio_add_folio_nofail() As the label says, we've just allocated a new BIO so we know we can add this folio to it. We now have bio_add_folio_nofail() for this purpose. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andreas Gruenbacher commit 780813d7018067f2796f023b56b51385970be460 Author: Arnd Bergmann Date: Thu Aug 7 22:53:28 2025 +0200 x86/math-emu: Fix div_Xsig() prototype The third argument of div_Xsig() is the output of the division, but is marked 'const', which means the compiler is not expecting it to be updated and may generate bad code around the call. clang-21 now warns about the pattern since an uninitialized variable is passed into two 'const' arguments by reference: arch/x86/math-emu/poly_atan.c:93:28: error: variable 'argSignif' is uninitialized \ when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 93 | div_Xsig(&Numer, &Denom, &argSignif); | ^~~~~~~~~ arch/x86/math-emu/poly_l2.c:195:29: error: variable 'argSignif' is uninitialized \ when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 195 | div_Xsig(&Numer, &Denom, &argSignif); | ^~~~~~~~~ The implementation is in assembly, so the problem has gone unnoticed since the code was added in the linux-1.1 days. Remove the 'const' marker here. Fixes: e19a1bdb835c ("Import 1.1.38") Signed-off-by: Arnd Bergmann Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20250807205334.123231-1-arnd@kernel.org commit d16d1c2553248f9b859b86c94344d8b81f0297cd Author: Remi Buisson Date: Thu Nov 6 15:31:07 2025 +0000 iio: imu: inv_icm45600: Initializes inv_icm45600_buffer_postdisable() sleep The sleep variable in inv_icm45600_buffer_postdisable() could be used without being assigned in case of error. It must be initialized to 0 by default. Fixes: 06674a72cf7a ("iio: imu: inv_icm45600: add buffer support in iio devices") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-iio/aPi6Xw-ZoUkW76zR@stanley.mountain/ Signed-off-by: Remi Buisson Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 9eb98a05f050be20e60852f8f0ddf34c7e49740d Author: Marco Crivellari Date: Wed Nov 5 11:43:30 2025 +0100 iio: adc: pac1934: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") system_percpu_wq replaced system_wq, so change the wq in iio/adc/pac1934. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jonathan Cameron commit 826ccaecbe06b9626bbc1863f892485e62af5813 Author: Michael Hennerich Date: Tue Nov 4 15:35:17 2025 +0000 iio: dac: ad5446: Add AD5542 to the spi id table This adds support for the AD5542 single channel Current Source and Voltage Output DACs. It is similar to the AD5542A model so just use the same id. Signed-off-by: Michael Hennerich Co-developed-by: Nuno Sá Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 8265cc284dc619aefb49fb07dde436bb3e8b52e3 Author: Nuno Sá Date: Tue Nov 4 15:35:16 2025 +0000 iio: dac: ad5446: Fix coding style issues Fix style issues as reported by checkpatch. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit bb5565a98660035370d8492085ed442151014954 Author: Nuno Sá Date: Tue Nov 4 15:35:15 2025 +0000 iio: dac: ad5446: Refactor header inclusion Make sure include files are given in alphabetical order and that we include the ones that were missing and remove the ones we don't really use. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 308d4474cfa298dbf4a7e4f18314a86c38a51da1 Author: Nuno Sá Date: Tue Nov 4 15:35:14 2025 +0000 iio: dac: ad5446: Make use of the cleanup helpers Use the auto unlocking helpers from cleanup.h. Allows for some code simplification. While at it, don't use the ternary operator in ad5446_write_dac_powerdown() and add an helper function to write the DAC code. The reason for the function was purely to avoid having to use unreachable(). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6e43c10675d876a5fb71e57a9bcca9533fccccd9 Author: Nuno Sá Date: Tue Nov 4 15:35:13 2025 +0000 iio: dac: ad5446: Make use of devm_mutex_init() Use devm_mutex_init() which is helpful with CONFIG_DEBUG_MUTEXES. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 876d94024087b03494b206a5b5561fcd267824e7 Author: Nuno Sá Date: Tue Nov 4 15:35:12 2025 +0000 iio: dac: ad5446: Separate I2C/SPI into different drivers Properly separate the I2C and SPI drivers into two different drivers living in their own source file (as usual). So that no need for the hacky ifdefery. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 5b622340bf19c2192ee5769f1b603ab5711949be Author: Nuno Sá Date: Tue Nov 4 15:35:11 2025 +0000 iio: dac: ad5456: Add missing DT compatibles Add missing of_device_id compatibles for the i2c and spi drivers. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 45d510a7203f63caa0298e40190b364d4646e2b2 Author: Nuno Sá Date: Tue Nov 4 15:35:10 2025 +0000 iio: dac: ad5446: Move to single chip_info structures Do not use an array with an enum id kind of thing. Use the more maintainable chip_info variable per chip. Adapt the probe functions to use the proper helpers (for SPI and I2c). Note that in a following patch we'll also add the chip_info variables to the of_device_id tables. Hence already use the helpers that internally use device_get_match_data(). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 14b72d8acea0a5c53dcffacafa43a9090fda3311 Author: Nuno Sá Date: Tue Nov 4 15:35:09 2025 +0000 iio: dac: ad5446: Don't ignore missing regulator If the chip does not have an internal reference, do not ignore a missing regulator as we won't be able to actually provide a proper scale for the DAC. Since it's now seen as an error, flip the if() logic so errors are treated first (which is the typical pattern). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 63232c9b5413bf398f62425266dfacaa321564c9 Author: Nuno Sá Date: Tue Nov 4 15:35:08 2025 +0000 iio: dac: ad5446: Drop duplicated spi_id entry AD5600 and AD5541A are compatible so there's no need to have a dedicated entry for ID_AD5600. Suggested-by: Andy Shevchenko Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 86c341d796b91f147d8995fe10ff92f8c9d57f41 Author: Nuno Sá Date: Tue Nov 4 15:35:07 2025 +0000 iio: dac: ad5446: Use DMA safe buffer for transfers Make sure to use DMA safe buffer. While for i2c we could be fine without them, we need it for spi anyways. As we now have DMA safe buffers, use i2c_master_send_dmasafe(). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 2e5f09334719bb9bd319c97c067dac9a9aa82df5 Author: Nuno Sá Date: Tue Nov 4 15:35:06 2025 +0000 dt-bindings: iio: dac: Document AD5446 and similar devices Add device tree binding documentation for the Analog Devices AD5446 family of Digital-to-Analog Converters and derivative devices from Texas Instruments. There's both SPI and I2C interfaces and feature resolutions ranging from 8-bit to 16-bit. The binding covers 29 derivatives devices including the AD5446 series, AD5600 series, AD5620/5640/5660 variants with different voltage ranges, and TI DAC081s101/DAC101s101/DAC121s101 devices. Signed-off-by: Nuno Sá Acked-by: Conor Dooley Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 5478fd5a599463970378c874dcc4ccb9e1113c63 Author: Herve Codina (Schneider Electric) Date: Mon Nov 3 15:18:34 2025 +0100 MAINTAINERS: Add the Renesas RZ/N1 ADC driver entry After contributing the driver, add myself as the maintainer for the Renesas RZ/N1 ADC driver. Signed-off-by: Herve Codina (Schneider Electric) Signed-off-by: Jonathan Cameron commit 2387a7d6e5ab81cded0310f2d7544f4470666a6c Author: Herve Codina (Schneider Electric) Date: Mon Nov 3 15:18:32 2025 +0100 iio: adc: Add support for the Renesas RZ/N1 ADC The Renesas RZ/N1 ADC controller is the ADC controller available in the Renesas RZ/N1 SoCs family. It can use up to two internal ADC cores (ADC1 and ADC2) those internal cores are not directly accessed but are handled through ADC controller virtual channels. Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 77538d110933de556c8a2dae7c04fd459db58d8b Author: Herve Codina (Schneider Electric) Date: Mon Nov 3 15:18:31 2025 +0100 dt-bindings: iio: adc: Add the Renesas RZ/N1 ADC The Renesas RZ/N1 ADC controller is the ADC controller available in the Renesas RZ/N1 SoCs family. Signed-off-by: Herve Codina (Schneider Electric) Reviewed-by: Rob Herring (Arm) Signed-off-by: Jonathan Cameron commit 9d8b88ffb773470ea3a324b67e77e64c0fa8400d Author: Billy Tsai Date: Mon Nov 3 18:52:17 2025 +0800 iio: adc: aspeed: Add AST2700 ADC support This patch adds support for the ADCs found on the Aspeed AST2700 SoC, which includes two instances: "ast2700-adc0" and "ast2700-adc1". While they are functionally similar to those on AST2600, the OTP trimming data is located at the same offset (0x820), but uses different bitfields. Signed-off-by: Billy Tsai Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 436cd7712598e9ca07c76f14d1531a1f6c3c502f Author: Billy Tsai Date: Mon Nov 3 18:52:16 2025 +0800 dt-bindings: iio: adc: Add AST2700 ADC compatible strings Add the compatible strings "aspeed,ast2700-adc0" and "aspeed,ast2700-adc1" to the binding for the Aspeed ADC. These new compatibles represent the ADC instances found on the AST2700 SoC, which are similar to the AST2600 but have their trimming data located at different SCU offset. Signed-off-by: Billy Tsai Acked-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 69f5dcaa990e3f43c89fc5cec4ae92ececdb12f3 Author: Andy Shevchenko Date: Mon Nov 3 09:29:11 2025 +0100 iio: common: scmi_sensors: Get rid of const_ilog2() Fisrt of all, const_ilog2() was a workaround of some sparse issue, which was never appeared in the C functions. Second, the calls here are done against constants and work with a bit of luck. Replace this altogether by a pre-calculated simple integer constant. Amend a comment to give a hint where it comes from. Signed-off-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 02f86101e430cce9a99a044b483c4ed5b91bb3b8 Author: Rodrigo Gobbi Date: Sun Nov 2 19:30:18 2025 -0300 iio: imu: bmi270: fix dev_err_probe error msg The bmi270 can be connected to I2C or a SPI interface. If it is a SPI, during probe, if devm_regmap_init() fails, it should print the "spi" term rather "i2c". Fixes: 92cc50a00574 ("iio: imu: bmi270: Add spi driver for bmi270 imu") Signed-off-by: Rodrigo Gobbi Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 698dcf54282a221588281b2e1e6107707cc61f37 Author: Chu Guangqing Date: Fri Oct 24 15:38:23 2025 +0800 iio: light: apds9960: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Chu Guangqing Signed-off-by: Jonathan Cameron commit 52d182b2ff99d5e50e763ad5a5a874da3b49434f Author: Chu Guangqing Date: Fri Oct 24 15:38:22 2025 +0800 iio: light: apds9306: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Chu Guangqing Acked-by: Subhajit Ghosh Signed-off-by: Jonathan Cameron commit 00d3bd9e3f7166220838d7065e52bffc85b871df Author: Chu Guangqing Date: Fri Oct 24 15:38:21 2025 +0800 iio: light: veml3235: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Chu Guangqing Signed-off-by: Jonathan Cameron commit e5191f62a67aada464ff2c4ab6d96a657b1486aa Author: Chu Guangqing Date: Fri Oct 24 15:38:20 2025 +0800 iio: adc: ade9000: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: Chu Guangqing Signed-off-by: Jonathan Cameron commit 49708f45be675d726b6c39a0eee260c0df1f77bc Author: Kriish Sharma Date: Tue Oct 28 09:33:26 2025 +0000 iio: backend: fix kernel-doc to avoid warnings and ensure consistency Fix multiple kernel-doc warnings and make the documentation style consistent in drivers/iio/industrialio-backend.c. Changes include: - Add missing @chan parameter description in iio_backend_oversampling_ratio_set(). - Add missing RETURNS section in iio_backend_get_priv(). - Replace Return: with “RETURNS:” across the file for consistency. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506292344.HLJbrrgR-lkp@intel.com Suggested-by: Andy Shevchenko Suggested-by: David Lechner Signed-off-by: Kriish Sharma Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 59f40887509d258d1ac40300f6b224cac853a6d1 Author: Frank Li Date: Wed Oct 29 15:27:18 2025 -0400 dt-bindings: iio: imu: mpu6050: remove interrupts from required list Irq is optional signal to make sensor work. Not all boards connect this signals, so remove it from required list. Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 759cafdd8b4997b4f266b67ea5684373722742f2 Author: Jack Hsu Date: Thu Oct 30 21:44:34 2025 +0800 dt-bindings: iio: adc: Support MediaTek MT8189 evb board auxadc add compatible string for mt8189 evb board dts node of auxadc Signed-off-by: Jack Hsu Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Jonathan Cameron commit a337775ed8e7f9a8cf273cd61a3920f73aa9b422 Author: Matti Vaittinen Date: Mon Oct 27 14:50:51 2025 +0200 iio: adc: rohm-bd79124: Use regmap_reg_range() Initializing the regmap_ranges using direct assignment to the range_min and range_max members is slightly verbose. We can make it a tad cleaner when using the regmap_reg_range() macro. Clean up the code using regmap_reg_range() when initializing the regmap_range structure. Signed-off-by: Matti Vaittinen Signed-off-by: Jonathan Cameron commit d2e805319bf092ea748cbfe84b775e1f398ed9b3 Author: Matti Vaittinen Date: Mon Oct 27 14:50:30 2025 +0200 iio: adc: rohm-bd79112: Use regmap_reg_range() Initializing the regmap_ranges using direct assignment to the range_min and range_max members is slightly verbose. We can make it a tad cleaner when using the regmap_reg_range() macro. Clean up the code using regmap_reg_range() when initializing the regmap_range structure. Signed-off-by: Matti Vaittinen Signed-off-by: Jonathan Cameron commit 1d165919c8261b927f8dc8cfe61eb04342bedb7e Author: Randy Dunlap Date: Sat Oct 25 19:47:59 2025 -0700 iio: imu: adis: fix all kernel-doc warnings in header file Correct and add to adis.h to resolve all kernel-doc warnings: - add a missing struct member description - change one non-kernel-doc comment to use /* instead of /** - correct function parameter @value to @val (7 locations) - add function return value comments (13 locations) Warning: include/linux/iio/imu/adis.h:97 struct member 'has_fifo' not described in 'adis_data' Warning: include/linux/iio/imu/adis.h:139 Incorrect use of kernel-doc format: * The state_lock is meant to be used during operations that require Warning: include/linux/iio/imu/adis.h:158 struct member '"__adis_"' not described in 'adis' Warning: include/linux/iio/imu/adis.h:264 function parameter 'val' not described in 'adis_write_reg' Warning: include/linux/iio/imu/adis.h:371 No description found for return value of 'adis_update_bits_base' Signed-off-by: Randy Dunlap Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit bb578dd7a01ebbb186dd6d1c27285b29f7fdba37 Author: Akhilesh Patil Date: Sat Oct 25 11:50:55 2025 +0530 iio: pressure: adp810: Add driver for adp810 sensor Add driver for Aosong adp810 differential pressure and temperature sensor. This sensor provides an I2C interface for reading data. Calculate CRC of the data received using standard crc8 library to verify data integrity. Tested on TI am62x sk board with sensor connected at i2c-2. Signed-off-by: Akhilesh Patil Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit f9c30b3e6735bf8ff26414f6452f482d45b179e9 Author: Akhilesh Patil Date: Sat Oct 25 11:48:41 2025 +0530 dt-bindings: iio: pressure: Add Aosong adp810 Add bindings for adp810 differential pressure and temperature sensor. This sensor communicates over I2C with CRC support and can measure pressure in the range -500 to 500Pa and temperature in the range -40 to +85 degree celsius. Signed-off-by: Akhilesh Patil Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonathan Cameron commit 97289f6accca405d63149e56774912c8be85f76b Author: David Lechner Date: Wed Oct 22 10:15:05 2025 -0500 iio: adc: ad7124: fix possible OOB array access Reorder the channel bounds check before using it to index into the channels array in ad7124_release_config_slot(). This prevents reading past the end of the array. The value read from invalid memory was not used, so this was mostly harmless, but we still should not be reading out of bounds in the first place. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-iio/aPi6V-hcaKReSNWK@stanley.mountain/ Fixes: 9065197e0d41 ("iio: adc: ad7124: change setup reg allocation strategy") Signed-off-by: David Lechner Reviewed-by: Marcelo Schmitt Signed-off-by: Jonathan Cameron commit c6763b15c49edc4926a8c6cd8cd2f01d49134d74 Author: Dan Carpenter Date: Wed Oct 22 14:02:20 2025 +0300 iio: imu: inv_icm45600: Add a missing return statement in probe() The intention here was clearly to return -ENODEV but the return statement was missing. It would result in an off by one read in i3c_chip_info[] on the next line. Add the return statement. Fixes: 1bef24e9007e ("iio: imu: inv_icm45600: add I3C driver for inv_icm45600 driver") Signed-off-by: Dan Carpenter Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron commit 3ddda1db1514f3cb5efd1c95c35b24fd7e4ef7ff Author: Heiko Stuebner Date: Wed Oct 22 00:31:07 2025 +0200 dt-bindings: iio: adc: Add rockchip,rk3506-saradc variant The SARADC of the RK3506 is similar to the one found in the RK3528 in terms of number of channels and the other implementation details. So add a variant compatible for it, that reflects this fact. Signed-off-by: Heiko Stuebner Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 451a9c4a415dae08f88792e6874e85b025eb9420 Author: Antoniu Miclaus Date: Tue Oct 21 10:53:48 2025 +0000 iio: adc: ad4080: add support for AD4087 Add support for AD4087 14-bit SAR ADC. The AD4087 differs from AD4080 in resolution (14-bit vs 20-bit) and LVDS CNV clock count maximum (1 vs 7). Changes: - Add AD4087_CHIP_ID definition (0x0057) - Create ad4087_channel with 14-bit resolution and 16-bit storage - Add ad4087_chip_info with lvds_cnv_clk_cnt_max = 1 - Register AD4087 in device ID and OF match tables Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 24e6d7e9f2fce0afc1a63593d1470dbb6df5e9c3 Author: Antoniu Miclaus Date: Tue Oct 21 10:53:47 2025 +0000 dt-bindings: iio: adc: adi,ad4080: add support for AD4087 Add device tree binding support for the AD4087 14-bit SAR ADC. Add adi,ad4087 to the compatible enum. A fallback compatible string to adi,ad4080 is not appropriate as the AD4087 has different resolution (14-bit vs 20-bit) and LVDS CNV clock count maximum (1 vs 7), requiring different driver configuration. Signed-off-by: Antoniu Miclaus Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 916354e7c7c08aedff37bdf322e049836aa8d2aa Author: Antoniu Miclaus Date: Tue Oct 21 10:53:46 2025 +0000 iio: adc: ad4080: add support for AD4086 Add support for AD4086 14-bit SAR ADC. The AD4086 differs from AD4080 in resolution (14-bit vs 20-bit) and LVDS CNV clock count maximum (4 vs 7). Changes: - Add AD4086_CHIP_ID definition (0x0056) - Create ad4086_channel with 14-bit resolution and 16-bit storage - Add ad4086_chip_info with lvds_cnv_clk_cnt_max = 4 - Register AD4086 in device ID and OF match tables Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit 45e81d6ac0e1af349e5da050dc0be48a72fad9dd Author: Antoniu Miclaus Date: Tue Oct 21 10:53:45 2025 +0000 dt-bindings: iio: adc: adi,ad4080: add support for AD4086 Add device tree binding support for the AD4086 14-bit SAR ADC. Add adi,ad4086 to the compatible enum. A fallback compatible string to adi,ad4080 is not appropriate as the AD4086 has different resolution (14-bit vs 20-bit) and LVDS CNV clock count maximum (4 vs 7), requiring different driver configuration. Signed-off-by: Antoniu Miclaus Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit 4028cbcf3415f6e0810326d87c6e0b494814ae12 Author: Antoniu Miclaus Date: Tue Oct 21 10:53:44 2025 +0000 iio: adc: ad4080: add support for AD4083 Add support for AD4083 16-bit SAR ADC. The AD4083 differs from AD4080 in resolution (16-bit vs 20-bit) and LVDS CNV clock count maximum (5 vs 7). Changes: - Add AD4083_CHIP_ID definition (0x0053) - Create ad4083_channel with 16-bit resolution and storage - Add ad4083_chip_info with lvds_cnv_clk_cnt_max = 5 - Register AD4083 in device ID and OF match tables Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron commit f11de95215311816595a1f2ee81cf8239d9b660a Author: Antoniu Miclaus Date: Tue Oct 21 10:53:43 2025 +0000 dt-bindings: iio: adc: adi,ad4080: add support for AD4083 Add device tree binding support for the AD4083 16-bit SAR ADC. Add adi,ad4083 to the compatible enum. A fallback compatible string to adi,ad4080 is not appropriate as the AD4083 has different resolution (16-bit vs 20-bit) and LVDS CNV clock count maximum (5 vs 7), requiring different driver configuration. Signed-off-by: Antoniu Miclaus Acked-by: Conor Dooley Signed-off-by: Jonathan Cameron commit db52c405f352f809b6ff96466fe5456b0220e354 Author: Petre Rodan Date: Tue Oct 21 13:31:49 2025 +0300 iio: accel: bma220: move set_wdt() out of bma220_core Move bma220_set_wdt() into bma220_i2c.c instead of using a conditional based on i2c_verify_client() in bma220_core.c that would make core always depend on the i2c module. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/ Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron commit 6f3d8de8886dae587467e1a2600d3bff4ad23e30 Author: Jianping Shen Date: Thu Oct 9 17:31:49 2025 +0200 iio: imu: smi330: Add driver Add the iio driver for bosch imu smi330. The smi330 is a combined three axis angular rate and three axis acceleration sensor. Signed-off-by: Jianping Shen Signed-off-by: Jonathan Cameron commit 5c467151f6197dd7b8c36b33310b288a52bcca3d Author: Marco Crivellari Date: Fri Nov 7 14:36:26 2025 +0100 IB/isert: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107133626.190952-1-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit 65d21dee533755ae8fff7450328c93599c36b092 Author: Marco Crivellari Date: Fri Nov 7 14:33:06 2025 +0100 IB/iser: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251107133306.187939-1-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit 5dd68a59145e6a7dd96e07ffbf5bdc486e6cc8a2 Author: Jacob Moroni Date: Wed Nov 5 16:28:41 2025 +0000 RDMA/irdma: Remove unused CQ registry The CQ registry was never actually used (ceq->reg_cq was always NULL), so remove the dead code. Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20251105162841.31786-1-jmoroni@google.com Acked-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky commit 6e79e210058e8f95fb3824e33b781960851ae7d1 Author: Patrisious Haddad Date: Wed Oct 29 17:42:59 2025 +0200 RDMA/mlx5: Add other eswitch support to userspace tables Allows the creation of RDMA TRANSPORT tables over VFs/SFs that belong to another eswitch manager. Which is only possible for PFs that were connected via a create_lag PRM command. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-7-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit f277662b734e96bf38ce7d422b091f53df3ff8cb Author: Patrisious Haddad Date: Wed Oct 29 17:42:58 2025 +0200 RDMA/mlx5: Refactor _get_prio() function Refactor the _get_prio() function to remove redundant arguments by reusing the existing flow table attributes struct instead of passing attributes separately. This improves code clarity and maintainability. In addition allows downstream patch to add new parameter without needing to change __get_prio() arguments. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-6-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit 5939decc64f6b9099c2c356d75047c66a6639e00 Author: Patrisious Haddad Date: Wed Oct 29 17:42:57 2025 +0200 RDMA/mlx5: Add other_eswitch support for devx destruction When building a devx object destruction command for steering objects add consideration for other_eswitch argument to allow proper destruction for objects that were created with it. Signed-off-by: Patrisious Haddad Reviewed-by: Mark Bloch Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-5-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit 3506242da07156e6804c061554bd01d77c1b463b Author: Patrisious Haddad Date: Wed Oct 29 17:42:56 2025 +0200 RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces In case of a LAG configuration change the root namespace core device for all of the LAG slaves to be the core device of the master device for RDMA_TRANSPORT namespaces, in order to ensure all tables are created through the master device. Once the LAG is disabled revert back to the native core device. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-4-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit d06ccdc9529235130798b519f6519103d83a7272 Merge: cf274907901115 583b4fe1c19d97 Author: Leon Romanovsky Date: Sun Nov 9 05:17:37 2025 -0500 Add other eswitch support When the device in switchdev mode, the RDMA device manages all the vports which belong to its representors, which can lead to a situation where the PF that is used to manage the RDMA device isn't the native PF of some of the vports it manages. Add infrastructure to allow the master PF to manage all the hardware resources for the vports under its management. Whereas currently the only such resource is RDMA TRANSPORT steering domains. That is done by adding new FW argument other_eswitch which is passed by the driver to the FW to allow the master PF to properly manage vports belonging to other native PF. Signed-off-by: Leon Romanovsky commit 583b4fe1c19d978bb787e0adf9ce469cb7f68455 Author: Patrisious Haddad Date: Wed Oct 29 17:42:55 2025 +0200 net/mlx5: fs, set non default device per namespace Add mlx5_fs_set_root_dev() function which swaps the root namespace core device with another one for a given table_type. It is intended for usage only by RDMA_TRANSPORT tables in case of LAG configuration, to allow the creation of tables during LAG always through the LAG master device, which is valid since during LAG the master is allowed to manage the RDMA_TRANSPORT tables of its slaves. In addition move the table_type enum to global include to allow its use in a downstream patch in the RDMA driver. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-3-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit 3b848dec7e821bace785b9e405bf1884c077635a Author: Patrisious Haddad Date: Wed Oct 29 17:42:54 2025 +0200 net/mlx5: fs, Add other_eswitch support for steering tables Add other_eswitch support which allows flow tables creation above vports that reside on different esw managers. The new flag MLX5_FLOW_TABLE_OTHER_ESWITCH indicates if the esw_owner_vhca_id attribute is supported. Note that this is only supported if the Advanced-RDMA cap- rdma_transport_manager_other_eswitch is set. And it is the caller responsibility to check that. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-2-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit 6948417b3f1fafbeab85c051f8dba5e305a8f9c4 Author: Patrisious Haddad Date: Wed Oct 29 17:42:53 2025 +0200 net/mlx5: Add OTHER_ESWITCH HW capabilities Add OTHER_ESWITCH capabilities which includes other_eswitch and eswitch_owner_vhca_id to all steering objects. Signed-off-by: Patrisious Haddad Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-1-98bb707b5d57@nvidia.com Signed-off-by: Leon Romanovsky commit 2d838c11e10e9169cae4f7778345c11b5447ef05 Author: Yishai Hadas Date: Mon Oct 27 11:34:02 2025 +0200 net/mlx5: Add direct ST mode support for RDMA Add support for direct ST mode where ST Table Location equals PCI_TPH_LOC_NONE. In that case, no steering table exists, the steering tag itself will be used directly by the SW, FW, HW from the mkey. This enables RDMA users to use the current exposed APIs to work in direct mode. Signed-off-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251027-st-direct-mode-v1-2-e0ad953866b6@nvidia.com Signed-off-by: Leon Romanovsky commit 7b8a8ec20cfce2298f6737089f5d17407ea346b4 Author: Yishai Hadas Date: Mon Oct 27 11:34:01 2025 +0200 PCI/TPH: Expose pcie_tph_get_st_table_loc() Expose pcie_tph_get_st_table_loc() to be used by drivers as will be done in the next patch from the series. Signed-off-by: Yishai Hadas Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20251027-st-direct-mode-v1-1-e0ad953866b6@nvidia.com Acked-by: Bjorn Helgaas Signed-off-by: Leon Romanovsky commit cf274907901115d7cec71bc89fbfac8842ee57dd Author: Kalesh AP Date: Mon Nov 3 10:04:25 2025 +0530 RDMA/bnxt_re: Add a debugfs entry for CQE coalescing tuning This patch adds debugfs interfaces that allows the user to enable/disable the RoCE CQ coalescing and fine tune certain CQ coalescing parameters which would be helpful during debug. Signed-off-by: Damodharam Ammepalli Reviewed-by: Hongguang Gao Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20251103043425.234846-1-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 594a6a27fb17b967fcdf32166845efdf3e1ecfbf Author: Takashi Sakamoto Date: Sun Nov 9 15:55:25 2025 +0900 firewire: core: clear sources of hardware interrupt at card removal Due to the factors external to the system, hardware events may still be handled while a card instance is being removed. The sources of hardware IRQs should be cleared during card removal so that workqueues can be safely destroyed. This commit adds a disable callback to the underlying driver operations. After this callback returns, the underlying driver guarantees that it will no longer handle hardware events. Link: https://lore.kernel.org/r/20251109065525.163464-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 7f8fcc6f09fb732745b3252f481def76b18fb99c Author: Akira Yokosawa Date: Wed Nov 5 12:17:28 2025 +0900 memory-barriers.txt: Sort wait_event* and wait_on_bit* list alphabetically Commit 88172700423c ("docs/memory-barriers.txt: Add wait_event_cmd() and wait_event_exclusive_cmd()") added two APIs without taking care of the list order. Sort the list for readability. While there, make it clear that this is incomplete by saying "for example". Signed-off-by: Akira Yokosawa Reviewed-by: Håkon Bugge Signed-off-by: Paul E. McKenney commit bd10acae08aeb9cd2f555acdbacb98b9fbb02a27 Author: Jai Luthra Date: Wed Oct 29 16:00:11 2025 +0530 platform/raspberrypi: Destage VCHIQ MMAL driver Destage the VCHIQ MMAL driver to drivers/platform/raspberrypi. Signed-off-by: Jai Luthra Link: https://patch.msgid.link/20251029-vchiq-destage-v3-7-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit aa125180c673881f88b528600b57865dc158b3a7 Author: Jai Luthra Date: Wed Oct 29 16:00:10 2025 +0530 platform/raspberrypi: Destage VCHIQ interface Destage the VCHIQ interface driver to drivers/platform/raspberrypi. There is still the remaining TODO item of improving the documentation, which can be handled post destaging. Secondly, multimedia drivers like codec and ISP that rely on this interface need to be upstreamed. And lastly, the drivers that facilitate the shared memory between VideoCore and Linux, like the vc-sm-cma driver and vc_mem char driver also need to be upstreamed. Signed-off-by: Jai Luthra Link: https://patch.msgid.link/20251029-vchiq-destage-v3-6-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit b178ad64edf4cc4ba7fa86de9060ffcc7fc04ffb Author: Jai Luthra Date: Wed Oct 29 16:00:09 2025 +0530 staging: vc04_services: Cleanup VCHIQ TODO entries Raspberry Pi downstream drivers using VCHIQ have changed a lot since kernel version 4.4 mentioned in the TODO, and are tangential to the destaing process - so drop those items from the list. Secondly, the code indentation for the vchiq interface driver is not so bad anymore since Umang's series (linked below) got merged, so drop it from the TODO. Link: https://lore.kernel.org/all/20241013112128.397249-1-umang.jain@ideasonboard.com/ Acked-by: Laurent Pinchart Signed-off-by: Jai Luthra Reviewed-by: Stefan Wahren Link: https://patch.msgid.link/20251029-vchiq-destage-v3-5-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit bf9f0b00bb7fd0470c1255bcc8e76c81d122a609 Author: Jai Luthra Date: Wed Oct 29 16:00:08 2025 +0530 include: linux: Destage VCHIQ interface headers Move the VCHIQ headers from drivers/staging/vc04_services/include to include/linux/raspberrypi This is done so that they can be shared between the VCHIQ interface (which is going to be de-staged in a subsequent commit from staging) and the VCHIQ drivers left in the staging/vc04_services (namely bcm2835-audio, bcm2835-camera). The include/linux/raspberrypi/ provides a central location to serve both of these areas. Co-developed-by: Umang Jain Signed-off-by: Umang Jain Reviewed-by: Laurent Pinchart Signed-off-by: Jai Luthra Link: https://patch.msgid.link/20251029-vchiq-destage-v3-4-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit 3d2115ea5d14154fbf83112f5e505bf3b24984a8 Author: Phil Elwell Date: Wed Oct 29 16:00:07 2025 +0530 staging: vchiq_arm: Improve inline documentation Add more comments to the VCHIQ driver, which provides some high-level descriptions how things work. Link: https://github.com/raspberrypi/linux/pull/6801 Signed-off-by: Phil Elwell [wahrenst@gmx.net: Rewrite commit log] Signed-off-by: Stefan Wahren Signed-off-by: Jai Luthra Link: https://patch.msgid.link/20251029-vchiq-destage-v3-3-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit e31d4d647038ddec3185a6e1fd27001599b27756 Author: Jai Luthra Date: Wed Oct 29 16:00:06 2025 +0530 staging: vchiq_arm: Remove bcm2835_camera from vchiq As bcm2835_camera driver is dropped, also drop the loading/unloading support for it in vchiq. Signed-off-by: Jai Luthra Reviewed-by: Stefan Wahren Link: https://patch.msgid.link/20251029-vchiq-destage-v3-2-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit 90204a38a760b6445690e32f82b0b0e8ba857d29 Author: Jai Luthra Date: Wed Oct 29 16:00:05 2025 +0530 staging: vc04_services: Drop bcm2835-camera driver The bcm2835-camera driver is replaced by the V4L2 bcm2835-unicam driver that is already upstream. So drop it from staging. This also simplifies destaging of VCHIQ MMAL, by reducing the users of the MMAL API (this driver is one of them). Acked-by: Laurent Pinchart Signed-off-by: Jai Luthra Acked-by: Stefan Wahren Link: https://patch.msgid.link/20251029-vchiq-destage-v3-1-da8d6c83c2c5@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit 23413fe138e05eef7f7cc86eaf2acf7ab7d8a628 Author: Cristian Del Gobbo Date: Mon Nov 3 00:01:39 2025 +0100 staging: sm750fb: avoid chained assignment in setcolreg() Replace the chained assignment of red/green/blue with a temporary variable and braces. This keeps behavior identical while improving readability and satisfying checkpatch. No functional change intended. Signed-off-by: Cristian Del Gobbo Link: https://patch.msgid.link/20251102230139.1720-2-cristiandelgobbo87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3a3fd27e06c38933f248eddf8e2ca328c24f0b07 Author: Cristian Del Gobbo Date: Mon Nov 3 00:01:38 2025 +0100 staging: sm750fb: align sm750_hw_cursor_set_size() arguments Align the continued arguments with the opening parenthesis to satisfy CodingStyle and checkpatch. No functional change intended. Signed-off-by: Cristian Del Gobbo Link: https://patch.msgid.link/20251102230139.1720-1-cristiandelgobbo87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 70421f9bd8554c183877f2fe1fb95e7011f7a021 Author: Dan Carpenter Date: Wed Oct 29 16:13:13 2025 +0300 staging: vchiq_arm: delete unnecessary check Both sides of this if else statement print exactly the same thing. Delete the unnecessary if statement. Signed-off-by: Dan Carpenter Reviewed-by: Umang Jain Link: https://patch.msgid.link/aQIS6Q73Ss8xyJTD@stanley.mountain Signed-off-by: Greg Kroah-Hartman commit 79b67612605096c0008e71f23f3820c7c117ba11 Author: Dharanitharan R Date: Thu Oct 23 14:59:03 2025 +0000 staging: rtl8723bs: use ether_addr_copy() for MAC address copying Replaces multiple memcpy() calls with ether_addr_copy() for copying MAC/Ethernet addresses in rtl8723bs. This improves readability and aligns with Linux kernel best practices for handling Ethernet addresses. Fixes the following checkpatch.pl warning: "Use ether_addr_copy() instead of memcpy() for Ethernet addresses." These updates enhance code clarity and maintain consistency with network driver conventions. Signed-off-by: Dharanitharan R Link: https://patch.msgid.link/20251023145903.2557-1-dharanitharan725@gmail.com Signed-off-by: Greg Kroah-Hartman commit de4cbbdf2d98a6f94dfc116247798d6600936335 Author: Rodrigo Gobbi Date: Wed Oct 22 19:00:51 2025 -0300 staging: rtl8723bs: remove todo/note and duplicated EFUSE_CTRL macro The usage of EFUSE_xxx and MSR macros are already in place, so the note and todo about that can be removed. Also, there was a duplication of the definition of EFUSE_CTRL macro in two places, keep the one at the .h file. Signed-off-by: Rodrigo Gobbi Link: https://patch.msgid.link/20251022220324.14260-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Greg Kroah-Hartman commit 495df2da6944477d282d5cc0c13174d06e25b310 Author: Johan Hovold Date: Wed Oct 29 10:34:42 2025 +0100 staging: most: remove broken i2c driver The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging. Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it. Fixes: 723de0f9171e ("staging: most: remove device from interface structure") Cc: Christian Gromm Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20251029093442.29256-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3317aaca33dc6620d3dcc46216061df33bfff7db Author: Jiapeng Chong Date: Mon Oct 13 10:30:11 2025 +0800 parisc: remove unneeded semicolon in perf_regs.c No functional modification involved. ./arch/parisc/kernel/perf_regs.c:30:2-3: Unneeded semicolon. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=26159 Signed-off-by: Jiapeng Chong Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511090323.OwYsZkev-lkp@intel.com/ Signed-off-by: Helge Deller commit ddb37d5b130e173090c861b4d1c20a632fb49d7a Author: Jarkko Nikula Date: Fri Nov 7 08:07:50 2025 +0200 i3c: mipi-i3c-hci-pci: Add support for Intel Nova Lake-S I3C Add I3C controller PCI IDs for Intel Nova Lake-S. Signed-off-by: Jarkko Nikula Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20251107060750.7995-1-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni commit fba0e56ee7524995b1fc9d1e90602496fc09d80f Author: Adrian Ng Ho Yin Date: Tue Nov 4 15:29:08 2025 +0800 i3c: dw: Disable runtime PM on Agilex5 to avoid bus hang on IBI When running compliance tests on the Altera Agilex5 SoCFPGA platform, the I3C bus can hang when a slave issues an IBI after the DAA process completes. The DesignWare I3C master enters runtime suspend once DAA finishes and stops driving SCL, preventing the IBI transfer from completing and leaving SDA stuck low. Add a new compatible string, "altr,agilex5-dw-i3c-master" and apply a quirk that keep runtime PM always active on this platform by calling pm_runtime_get_noresume() during probe. Prevent bus hangs triggered by IBIs on Agilex5 while maintaining keep the same behavior on other platforms. Signed-off-by: Adrian Ng Ho Yin Reviewed-by: Frank Li Link: https://patch.msgid.link/482d540722a98c2809d8275445aaa544b565bf85.1762237922.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni commit 8d1d2c408cc05021970df5dd7d41133d220cf851 Author: Adrian Ng Ho Yin Date: Tue Nov 4 15:29:06 2025 +0800 dt-bindings: i3c: snps: Add Altera SoCFPGA compatible Add the "altr,agilex5-dw-i3c-master" compatible string to the Synopsys DesignWare I3C master binding. This allow Agilex5 to use the generic DW I3C master controller while applying any required platform-specific quirks. Signed-off-by: Adrian Ng Ho Yin Reviewed-by: Krzysztof Kozlowski Reviewed-by: Frank Li Link: https://patch.msgid.link/4ef059b129e9457eaadcfa6b996b9b6b000c7dba.1762237922.git.adrianhoyin.ng@altera.com Signed-off-by: Alexandre Belloni commit c53a741a7fd4b8e9d07acf1861b5e4a188c6585a Merge: 5b5dedf0073ce2 8c59fc1c90df7f Author: Martin K. Petersen Date: Sat Nov 8 13:26:28 2025 -0500 Merge patch series "Support power resources defined in acpi on ata" Markus Probst says: This series adds support for power resources defined in acpi on ata ports/devices. A device can define a power resource in an ata port/device, which then gets powered on right before the port is probed. This can be useful for devices, which have sata power connectors that are: a: powered down by default b: can be individually powered on like in some synology nas devices. If thats the case it will be assumed, that the power resource won't survive reboots and therefore the disk will be stopped. Link: https://patch.msgid.link/20251104142413.322347-1-markus.probst@posteo.de Signed-off-by: Martin K. Petersen commit 8c59fc1c90df7ff29565d9743f0e61180e9ee00d Author: Markus Probst Date: Tue Nov 4 14:24:34 2025 +0000 scsi: ata: Stop disk on restart if ACPI power resources are found Some embedded devices have the ability to control whether power is provided to the disks via the SATA power connector or not. ACPI power resources are usually off by default, thus making it unclear if the specific power resource will retain its state after a restart. If power resources are defined on ATA ports / devices in ACPI, we should stop the disk on SYSTEM_RESTART, to ensure the disk will not lose power while active. Add a new function, ata_acpi_dev_manage_restart(), that will be used to determine if a disk should be stopped before restarting the system. If a usable ACPI power resource has been found, it is assumed that the disk will lose power after a restart and should be stopped to avoid unclean shutdown due to power loss. Reviewed-by: Damien Le Moal Signed-off-by: Markus Probst Link: https://patch.msgid.link/20251104142413.322347-4-markus.probst@posteo.de Signed-off-by: Martin K. Petersen commit ce6d26b5330c5de4f458143e9675984e367f6a40 Author: Markus Probst Date: Tue Nov 4 14:24:33 2025 +0000 scsi: ata: Use ACPI methods to power on disks Some embedded devices have the ability to control whether power is provided to the disks via the SATA power connector or not. If power resources are defined on ATA ports / devices in ACPI, we should try to set the power state to D0 before probing the disk to ensure that any power supply or power gate that may exist is providing power to the disk. An example for such devices would be newer synology NAS devices. Every disk slot has its own SATA power connector. Whether the connector is providing power is controlled via an gpio, which is *off by default*. Also the disk loses power on reboots. Add a new function, ata_acpi_port_power_on(), that will be used to power on the SATA power connector if usable ACPI power resources on the associated ATA port / device are found. It will be called right before probing the port, therefore the disk will be powered on just in time. Signed-off-by: Markus Probst Reviewed-by: Damien Le Moal Link: https://patch.msgid.link/20251104142413.322347-3-markus.probst@posteo.de Signed-off-by: Martin K. Petersen commit 8fdfdb1488162c195f3f0af10b7bc2b8b42928c5 Author: Markus Probst Date: Tue Nov 4 14:24:32 2025 +0000 scsi: sd: Add manage_restart device attribute to scsi_disk In addition to the already existing manage_shutdown, manage_system_start_stop and manage_runtime_start_stop device scsi_disk attributes, add manage_restart, which allows the high-level device driver (sd) to manage the device power state for SYSTEM_RESTART if set to 1. This attribute is necessary for the following commit "ata: stop disk on restart if ACPI power resources are found" to avoid a potential disk power failure in the case the SATA power connector does not retain the power state after a restart. Reviewed-by: Damien Le Moal Signed-off-by: Markus Probst Link: https://patch.msgid.link/20251104142413.322347-2-markus.probst@posteo.de Signed-off-by: Martin K. Petersen commit 5b5dedf0073ce22393ee5a7f12d439fe297ceec4 Merge: e15710242e3f84 d45fdc6cdd7370 Author: Martin K. Petersen Date: Sat Nov 8 13:19:17 2025 -0500 Merge patch series "Update lpfc to revision 14.4.0.12" Justin Tee says: Update lpfc to revision 14.4.0.12 This patch set contains updates to log messaging, revision of outdated comment descriptions, fixes to kref accounting, support for BB credit recovery in point-to-point mode, and introduction of registering unique platform name identifiers with fabrics. The patches were cut against Martin's 6.19/scsi-queue tree. Link: https://patch.msgid.link/20251106224639.139176-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit d45fdc6cdd7370ce2c8eb55b65af34594cdd9d7e Author: Justin Tee Date: Thu Nov 6 14:46:39 2025 -0800 scsi: lpfc: Update lpfc version to 14.4.0.12 Update lpfc version to 14.4.0.12 Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-11-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 191da2c71b13b1975d8759f852b0ce9bbc913545 Author: Justin Tee Date: Thu Nov 6 14:46:38 2025 -0800 scsi: lpfc: Add capability to register Platform Name ID to fabric FC-LS and FC-GS specifications outline fields for registering a platform name identifier (PNI) to the fabric. The PNI assists fabrics with identifying the physical server source of frames in the fabric. lpfc generates a PNI based partially on the uuid specific for the system. Initial attempts to extract a uuid are made from SMBIOS's System Information 08h uuid entry. If SMBIOS DMI does not exist, a PNI is not generated and PNI registration with the fabric is skipped. The PNI is submitted in FLOGI and FDISC frames. After successful fabric login, the RSPNI_PNI CT frame is submitted to the fabric to register the OS host name tying it to the PNI. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-10-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 683df5fc3ec5b9bd2596f84d120c4fda8151fd09 Author: Justin Tee Date: Thu Nov 6 14:46:37 2025 -0800 scsi: lpfc: Allow support for BB credit recovery in point-to-point topology Currently, BB credit recovery is excluded to fabric topology mode. This patch allows setting of BB_SC_N in PLOGIs and PLOGI_ACCs when in point-to-point mode so that BB credit recovery can operate in point-to-point topology as well. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 07caedc6a3887938813727beafea40f07c497705 Author: Justin Tee Date: Thu Nov 6 14:46:36 2025 -0800 scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI It's possible for an unstable link to repeatedly bounce allowing a FLOGI retry, but then bounce again forcing an abort of the FLOGI. Ensure that the initial reference count on the FLOGI ndlp is restored in this faulty link scenario. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-8-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 0b8b15a0b74dafe4b184dfae120d715172960ae5 Author: Justin Tee Date: Thu Nov 6 14:46:35 2025 -0800 scsi: lpfc: Modify kref handling for Fabric Controller ndlps Currently, there is a kref put in the lpfc_cleanup() routine that takes care of outstanding references on fabric controller ndlps in UNUSED state. While typically there is a state change from UNUSED -> REGLOGIN when the ndlp successfully logs into the fabric, there may be cases when FLOGI is unsuccessful and the ndlp will remain in UNUSED state without a registered rpi, yet the ndlp incorrectly has a kref count of one. To address this, handling of Fabric Controller ndlps are moved into the routines: lpfc_issue_els_scr(), lpfc_issue_els_rdf(), lpfc_cmpl_els_disc_cmd(). In both lpfc_issue_els_scr() and lpfc_issue_els_rdf(), if there does not exist a previously created fabric controller ndlp, an ndlp will be created. Otherwise, we can reuse the pre-existing ndlp object. In lpfc_cmpl_els_disc_cmd(), if the SCR or RDF are not successfully issued, the initial reference on the ndlp that is not registered with upper layers will be decremented with a kref_put(). Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 23f4906729a0064e734fb9da2ed02e8fbbf8db00 Author: Justin Tee Date: Thu Nov 6 14:46:34 2025 -0800 scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology In point-to-point topology, the driver sometimes defers the unsolicited FLOGI LS_ACC until it sends its FLOGI to the remote port. When this happens, lpfc neglects to release the ndlp allocated for the unsolicited FLOGI. This patch adds code to release the ndlp for the deferred unsolicited FLOGI LS_ACC. An NLP_FLOGI_DFR_ACC flag is introduced to facilitate identifying an ndlp with an expected deferred FLOGI LS_ACC completion. When lpfc_cmpl_els_rsp() detects the correct qualifiers, it releases the initial reference on the ndlp object. And when lpfc_cmpl_els_rsp() exits, the remaining put for the deferred action is executed and the ndlp is released. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 6f81582b7a9deb3ab10354e801b3ea5cec92b06c Author: Justin Tee Date: Thu Nov 6 14:46:33 2025 -0800 scsi: lpfc: Ensure unregistration of rpis for received PLOGIs Unregistration of an rpi object should be done when a PLOGI is received as PLOGI receipt implies an implicit LOGO. Previously, the driver would continue using the same, already registered, rpi and ACC the received PLOGI. Replace the ACC and early return statement with break to execute the rest of the lpfc_rcv_plogi logic outside the switch case statement. This ensures unregistration and reregistration of an rpi after PLOGI_ACC completion. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-5-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 3c228061c80df4ea63c2d5ca2c781323885bac7a Author: Justin Tee Date: Thu Nov 6 14:46:32 2025 -0800 scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() Remove redundant cmd_dmabuf and bpl_dmabuf NULL ptr assignment as they are already initialized to NULL when handling a new unsolicited event. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit f7a302e4759c521fe57c7319e40549697424393d Author: Justin Tee Date: Thu Nov 6 14:46:31 2025 -0800 scsi: lpfc: Revise discovery related function headers and comments Correcting discovery related function headers, return status information, and comment descriptions. There are no functional changes. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-3-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 051d4b65e839c1b5dd43469b291cd1199d16bc68 Author: Justin Tee Date: Thu Nov 6 14:46:30 2025 -0800 scsi: lpfc: Update various NPIV diagnostic log messaging Update PRLI status log message to automatically warn when CQE status is non-zero. When issuing an RSCN, log ndlp's kref count to the debugfs trace buffer. Add the NPIV virtual port index to the FDMI registration log message with the fabric. Signed-off-by: Justin Tee Link: https://patch.msgid.link/20251106224639.139176-2-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit e15710242e3f84cebb8bc1665da2ac46355ea6ba Merge: 02880c083c1314 4cec99e83d9240 Author: Martin K. Petersen Date: Sat Nov 8 13:09:49 2025 -0500 Merge patch series "smartpqi updates" Don Brace says: These patches are based on Martin Petersen's 6.19/scsi-queue tree https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git 6.19/scsi-queue This patch series includes four patches, with two main functional changes: 1. smartpqi-Add-timeout-value-to-RAID-path-requests-to-physical-devices Sets a timeout value for requests sent to physical devices via the RAID path. This prevents the controller firmware from waiting indefinitely and allows it to time out requests a few seconds before the OS issues Target Management Function (TMF) commands. The timeout value sent to the firmware is set to 3 seconds less than the OS timeout, which significantly reduces TMF invocations. 2. smartpqi-fix-Device-resources-accessed-after-device-removal Fixes a race condition during device removal by: * Checking for device removal in the reset handler and canceling any pending reset work if the device is no longer present. * Canceling outstanding TMF work items in the .sdev_destroy handler. Together, these changes eliminate races between reset operations and device removal. The other two patches: 3. smartpqi-add-new-Hurray-Data-pci-device Adds support for new Hurray Data PCI device. No functional changes. 4. smartpqi-update-driver-version-to-2.1.36-026 Updates the driver version string. No functional changes. Link: https://patch.msgid.link/20251106163823.786828-1-don.brace@microchip.com Signed-off-by: Martin K. Petersen commit 4cec99e83d924045e68418034ced62a6e5f3b513 Author: Don Brace Date: Thu Nov 6 10:38:22 2025 -0600 scsi: smartpqi: Update version to 2.1.36-026 Update driver version to 2.1.36-026 Reviewed-by: Scott Benesh Reviewed-by: Scott Teel Reviewed-by: Gerry Morong Signed-off-by: Don Brace Link: https://patch.msgid.link/20251106163823.786828-5-don.brace@microchip.com Signed-off-by: Martin K. Petersen commit 48e6b7e708029cea451e53a8c16fc8c16039ecdc Author: David Strahan Date: Thu Nov 6 10:38:21 2025 -0600 scsi: smartpqi: Add support for Hurray Data new controller PCI device Add support for new Hurray Data controller. All entries are in HEX. Add PCI IDs for Hurray Data controllers: VID / DID / SVID / SDID ---- ---- ---- ---- 9005 028f 207d 4840 Reviewed-by: Scott Benesh Reviewed-by: Scott Teel Reviewed-by: Mike McGowen Signed-off-by: David Strahan Signed-off-by: Don Brace Link: https://patch.msgid.link/20251106163823.786828-4-don.brace@microchip.com Signed-off-by: Martin K. Petersen commit b518e86d1a70a88f6592a7c396cf1b93493d1aab Author: Mike McGowen Date: Thu Nov 6 10:38:20 2025 -0600 scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets. Fixes: 2d80f4054f7f ("scsi: smartpqi: Update deleting a LUN via sysfs") Reviewed-by: Scott Teel Reviewed-by: Scott Benesh Signed-off-by: Mike McGowen Signed-off-by: Don Brace Link: https://patch.msgid.link/20251106163823.786828-3-don.brace@microchip.com Signed-off-by: Martin K. Petersen commit f3ecbba1aa715fd22234df3d2f3a0ecf7c458e36 Author: Mike McGowen Date: Thu Nov 6 10:38:19 2025 -0600 scsi: smartpqi: Add timeout value to RAID path requests to physical devices Add a timeout value to requests sent to physical devices via the RAID path. A timeout value of zero means wait indefinitely, which may cause the OS to issue Target Management Function (TMF) commands if the device does not respond. For input timeouts of 8 seconds or greater, the value sent to firmware is reduced by 3 seconds to provide an earlier firmware timeout and allow the OS additional time before timing out. This change improves timeout handling between the driver, firmware, and OS, helping to better manage device responsiveness and avoid indefinite waits. Reviewed-by: David Strahan Reviewed-by: Scott Benesh Reviewed-by: Scott Teel Signed-off-by: Mike McGowen Signed-off-by: Don Brace Link: https://patch.msgid.link/20251106163823.786828-2-don.brace@microchip.com Signed-off-by: Martin K. Petersen commit 02880c083c13143ecf7c624808eda7980f843368 Author: Thomas Richard (TI.com) Date: Thu Nov 6 15:21:54 2025 +0100 scsi: ufs: ti-j721e: Add suspend-resume support Restore the ctrl register to resume the TI UFS wrapper. Signed-off-by: Thomas Richard (TI.com) Link: https://patch.msgid.link/20251106-scsi-ufs-ti-j721e-suspend-resume-support-v1-1-6f395f51219e@bootlin.com Signed-off-by: Martin K. Petersen commit 57565f97b0eaf56934c5d40f8673d1873cfd11cf Author: Marco Crivellari Date: Wed Nov 5 16:03:36 2025 +0100 scsi: fcoe: Add WQ_PERCPU to alloc_workqueue() users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a CPU is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. Continue the effort to refactor workqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-CPU when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20251105150336.244079-1-marco.crivellari@suse.com Signed-off-by: Martin K. Petersen commit d27418aaf8bcb21f3f9b54a57427a0ae4f025bf7 Author: David Jeffery Date: Tue Nov 4 10:46:23 2025 -0500 scsi: st: Skip buffer flush for information ioctls With commit 9604eea5bd3a ("scsi: st: Add third party poweron reset handling") some customer tape applications fail from being unable to complete ioctls to verify ID information for the device when there has been any type of reset event to their tape devices. The st driver currently will fail all standard SCSI ioctls if a call to flush_buffer() fails in st_ioctl(). This causes ioctls which otherwise have no effect on tape state to succeed or fail based on events unrelated to the requested ioctl. This makes SCSI information ioctls unreliable after a reset even if no buffering is in use. With a reset setting the pos_unknown field, flush_buffer() will report failure and fail all ioctls. So any application expecting to use ioctls to check the identify the device will be unable to do so in such a state. For SCSI information ioctls, avoid the need for a buffer flush and allow the ioctls to execute regardless of buffer state. Signed-off-by: David Jeffery Tested-by: Laurence Oberman Acked-by: Kai Mäkisara Reviewed-by: John Meneghini Tested-by: John Meneghini Link: https://patch.msgid.link/20251104154709.6436-2-djeffery@redhat.com Signed-off-by: Martin K. Petersen commit b37d70c0df85e217a868ecdf535500ff926427ae Author: David Jeffery Date: Tue Nov 4 10:46:22 2025 -0500 scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling The st ioctl function currently interleaves code for handling various st specific ioctls with parts of code needed for handling ioctls common to all SCSI devices. Separate out st's code for the common ioctls into a more manageable, separate function. Signed-off-by: David Jeffery Tested-by: Laurence Oberman Acked-by: Kai Mäkisara Reviewed-by: John Meneghini Tested-by: John Meneghini Link: https://patch.msgid.link/20251104154709.6436-1-djeffery@redhat.com Signed-off-by: Martin K. Petersen commit ad4716ad48d4f1da4f991a1707f2230f4a97bff1 Author: Peter Wang Date: Mon Nov 3 19:57:36 2025 +0800 scsi: dt-bindings: phy: mediatek,ufs-phy: Update maintainer information in mediatek,ufs-phy.yaml Replace Stanley Chu with me and Chaotian in the maintainers field, since his email address is no longer active. Signed-off-by: Peter Wang Acked-by: Conor Dooley Link: https://patch.msgid.link/20251103115808.3771214-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 20da637eb545b04753e20c675cfe97b04c7b600b Author: Haotian Zhang Date: Tue Nov 4 17:48:47 2025 +0800 scsi: stex: Fix reboot_notifier leak in probe error path In stex_probe(), register_reboot_notifier() is called at the beginning, but if any subsequent initialization step fails, the function returns without unregistering the notifier, resulting in a resource leak. Add unregister_reboot_notifier() in the out_disable error path to ensure proper cleanup on all failure paths. Fixes: 61b745fa63db ("scsi: stex: Add S6 support") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251104094847.270-1-vulab@iscas.ac.cn Signed-off-by: Martin K. Petersen commit 107eb8336e8782ae8e98b60962852a1e29aca715 Author: Thomas Weißschuh Date: Fri Nov 7 15:13:38 2025 +0100 tools/nolibc: add support for fchdir() Add support for the file descriptor based variant of chdir(). Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Signed-off-by: Thomas Weißschuh commit 4cda40dce95a5b4ec0620a84f322472730d01f7a Author: Caleb Sander Mateos Date: Fri Nov 7 21:06:13 2025 -0700 block: clean up indentation in blk_rq_map_iter_init() blk_rq_map_iter_init() has one line with 7 spaces of indentation and another that mixes 1 tab and 8 spaces. Convert both to tabs. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 9517b82d8d422d426a988b213fdd45c6b417b86d Author: Zheng Qixing Date: Sat Nov 8 15:02:02 2025 +0800 nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open // conf_ref=3 recv_work A done // conf_ref=2 NBD_CLEAR_SOCK // conf_ref=1 nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B) close nbd // conf_ref=1 recv_work B config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Or only running NBD_CLEAR_SOCK: nbd_genl_connect // conf_ref=2 nbd_open // conf_ref=3 NBD_CLEAR_SOCK // conf_ref=2 close nbd nbd_release config_put // conf_ref=1 recv_work config_put // conf_ref=0 atomic_dec(&config->recv_threads); -> UAF Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the waiter") moved nbd_config_put() to run before waking up the waiter in recv_work, in order to ensure that nbd_start_device_ioctl() would not be woken up while nbd->task_recv was still uncleared. However, in nbd_start_device_ioctl(), after being woken up it explicitly calls flush_workqueue() to make sure all current works are finished. Therefore, there is no need to move the config put ahead of the wakeup. Move nbd_config_put() to the end of recv_work, so that the reference is held for the whole lifetime of the worker thread. This makes sure the config cannot be freed while recv_work is still running, even if clear + reconfigure interleave. In addition, we don't need to worry about recv_work dropping the last nbd_put (which causes deadlock): path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=1 (trigger recv_work) open nbd // nbd_refs=2 NBD_CLEAR_SOCK close nbd nbd_release nbd_disconnect_and_put flush_workqueue // recv_work done nbd_config_put nbd_put // nbd_refs=1 nbd_put // nbd_refs=0 queue_work path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT): connect // nbd_refs=2 (trigger recv_work) open nbd // nbd_refs=3 NBD_CLEAR_SOCK // conf_refs=2 close nbd nbd_release nbd_config_put // conf_refs=1 nbd_put // nbd_refs=2 recv_work done // conf_refs=0, nbd_refs=1 rmmod // nbd_refs=0 Reported-by: syzbot+56fbf4c7ddf65e95c7cc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6907edce.a70a0220.37351b.0014.GAE@google.com/T/ Fixes: 87aac3a80af5 ("nbd: make the config put is called before the notifying the waiter") Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put") Signed-off-by: Zheng Qixing Signed-off-by: Jens Axboe commit 9362d34acf91a706c543d919ade3e651b9bd2d6f Author: Pat Somaru Date: Tue Oct 7 20:45:28 2025 -0400 scripts/clang-tools: Handle included .c files in gen_compile_commands The gen_compile_commands.py script currently only creates entries for the primary source files found in .cmd files, but some kernel source files text-include others (i.e. kernel/sched/build_policy.c). This prevents tools like clangd from working properly on text-included c files, such as kernel/sched/ext.c because the generated compile_commands.json does not have entries for them. Extend process_line() to detect when a source file includes .c files, and generate additional compile_commands.json entries for them. For included c files, use the same compile flags as their parent and add their parents headers. This enables lsp tools like clangd to work properly on files like kernel/sched/ext.c Signed-off-by: Pat Somaru Reviewed-by: Nathan Chancellor Tested-by: Justin Stitt Tested-by: Eduard Zingerman Link: https://patch.msgid.link/20251008004615.2690081-1-patso@likewhatevs.io Signed-off-by: Nicolas Schier commit 2d7eda1db504e98650c03706e8c551b35a468c34 Author: Nathan Chancellor Date: Thu Oct 23 23:51:29 2025 +0100 kbuild: uapi: Drop types.h check from headers_check.pl Since commit d6fc9fcbaa65 ("kbuild: compile-test exported headers to ensure they are self-contained"), the UAPI headers are compile tested standalone with the compiler. This compile testing will catch a missing include of types.h, making the types.h checking in headers_check.pl originally added in commit 483b41218fa9 ("kbuild: add checks for include of linux/types in userspace headers") obsolete. Signed-off-by: Nathan Chancellor Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20251023-headers-pl-drop-check-sizes-v1-1-18bd21cf8f5e@kernel.org Signed-off-by: Nicolas Schier commit 7319256dda306b867506899b6438e6eb96a1ead0 Author: Nathan Chancellor Date: Thu Oct 23 22:01:36 2025 +0200 kbuild: Rename Makefile.extrawarn to Makefile.warn Since commit e88ca24319e4 ("kbuild: consolidate warning flags in scripts/Makefile.extrawarn"), scripts/Makefile.extrawarn contains all warnings for the main kernel build, not just warnings enabled by the values for W=. Rename it to scripts/Makefile.warn to make it clearer that this Makefile is where all Kbuild warning handling should exist. Signed-off-by: Nathan Chancellor Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20251023-rename-scripts-makefile-extrawarn-v1-1-8f7531542169@kernel.org Signed-off-by: Nicolas Schier commit d569067318f50251ed8ef52ccfff512e048d3eae Author: Nicolas Schier Date: Sat Oct 25 20:38:25 2025 +0200 MAINTAINERS, .mailmap: Update mail address for Nicolas Schier Update kbuild entry by my kernel.org address, and change my mailmap entry appropriately. Acked-by: Nathan Chancellor Signed-off-by: Nicolas Schier commit c4cb34aee13785d032b30e750214d2e1a486a242 Author: Thomas Weißschuh Date: Tue Oct 14 07:55:32 2025 +0200 kbuild: uapi: reuse KBUILD_USERCFLAGS The toplevel Makefile already provides the compiler flags necessary to build userspace applications for the target. Make use of them instead of duplicating the logic. Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Link: https://patch.msgid.link/20251014-kbuild-uapi-usercflags-v1-1-c162f9059c47@linutronix.de Signed-off-by: Nicolas Schier commit bfb046f67ae1f20572d4dee73a173c6db706f5d4 Author: Gang Yan Date: Fri Oct 17 10:12:09 2025 +0800 kbuild: doc: improve KBUILD_BUILD_TIMESTAMP documentation This patch adds an example of how to set KBUILD_BUILD_TIMESTAMP to a specific date. Also, note that the provided timestamp is used for initramfs mtime fields, which are 32-bit and thus limited to dates between the Unix epoch and 2106-02-07 06:28:15 UTC. Dates outside this range will cause errors. Suggested-by: David Disseldorp Signed-off-by: Gang Yan Reviewed-by: David Disseldorp Reviewed-by: Nicolas Schier Link: https://patch.msgid.link/20251017021209.6586-1-gang.yan@linux.dev Signed-off-by: Nicolas Schier commit af61da281f52aba0c5b090bafb3a31c5739850ff Author: Mikhail Malyshev Date: Wed Oct 15 16:34:52 2025 +0000 kbuild: Use objtree for module signing key path When building out-of-tree modules with CONFIG_MODULE_SIG_FORCE=y, module signing fails because the private key path uses $(srctree) while the public key path uses $(objtree). Since signing keys are generated in the build directory during kernel compilation, both paths should use $(objtree) for consistency. This causes SSL errors like: SSL error:02001002:system library:fopen:No such file or directory sign-file: /kernel-src/certs/signing_key.pem The issue occurs because: - sig-key uses: $(srctree)/certs/signing_key.pem (source tree) - cmd_sign uses: $(objtree)/certs/signing_key.x509 (build tree) But both keys are generated in $(objtree) during the build. This complements commit 25ff08aa43e37 ("kbuild: Fix signing issue for external modules") which fixed the scripts path and public key path, but missed the private key path inconsistency. Fixes out-of-tree module signing for configurations with separate source and build directories (e.g., O=/kernel-out). Signed-off-by: Mikhail Malyshev Reviewed-by: Nathan Chancellor Tested-by: Nicolas Schier Link: https://patch.msgid.link/20251015163452.3754286-1-mike.malyshev@gmail.com Signed-off-by: Nicolas Schier commit d599f571b3b42df1a4643531e27a262260296b86 Author: Rasmus Villemoes Date: Mon Oct 20 16:22:28 2025 +0200 btrfs: send: make use of -fms-extensions for defining struct fs_path The newly introduced -fms-extensions compiler flag allows defining struct fs_path in such a way that inline_buf becomes a proper array with a size known to the compiler. This also makes the problem fixed by commit 8aec9dbf2db2 ("btrfs: send: fix -Wflex-array-member-not-at-end warning in struct send_ctx") go away. Whether cur_inode_path should be put back to its original place in struct send_ctx I don't know, but at least the comment no longer applies. Signed-off-by: Rasmus Villemoes Acked-by: David Sterba Link: https://patch.msgid.link/20251020142228.1819871-3-linux@rasmusvillemoes.dk Signed-off-by: Nathan Chancellor Signed-off-by: Nicolas Schier commit 352899fd911cafd16b3f41bb5c8585124dbd7f4b Author: Kaushlendra Kumar Date: Mon Oct 27 10:11:27 2025 +0530 PM: wakeup: Delete timer before removing wakeup source from list Replace timer_delete_sync() with timer_shutdown_sync() and move it before list_del_rcu() in wakeup_source_remove() to improve the cleanup ordering and code clarity. This ensures that the timer is stopped before removing the wakeup source from the events list, providing a more logical cleanup sequence. While the current ordering is functionally correct, stopping the timer first makes the cleanup flow more intuitive and follows the general pattern of disabling active components before removing data structures. Signed-off-by: Kaushlendra Kumar [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251027044127.2456365-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit 9716818d615a1472279436cb7d5dfed136f41ca9 Merge: 211ddde0823f14 5ff8ad3909524a Author: Nicolas Schier Date: Sat Nov 8 12:16:41 2025 +0100 Merge tag 'kbuild-ms-extensions-6.19' into kbuild-next Shared branch between Kbuild and other trees for enabling '-fms-extensions' for 6.19 Signed-off-by: Nathan Chancellor Signed-off-by: Nicolas Schier commit bab55c25f2ebed2608e053183146893b63d6f078 Author: Robert Marko Date: Wed Sep 24 22:27:15 2025 +0200 clk: lan966x: remove unused dt-bindings include In preparation for LAN969x support, all instances referring to defines in the LAN966x specific header were dropped, so its safe to drop its inclusion in the driver. Signed-off-by: Robert Marko Reviewed-by: Daniel Machon Link: https://lore.kernel.org/r/20250924202810.1641883-1-robert.marko@sartura.hr Signed-off-by: Claudiu Beznea commit a811db39198817c91b60adb5e2a8f8bfe76012e4 Author: Huiwen He Date: Sun Nov 2 23:25:40 2025 +0800 md/raid5: remove redundant __GFP_NOWARN The __GFP_NOWARN flag was included in GFP_NOWAIT since commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT"). So remove the redundant __GFP_NOWARN flag. Link: https://lore.kernel.org/linux-raid/20251102152540.871568-1-hehuiwen@kylinos.cn Signed-off-by: Huiwen He Reviewed-by: Li Nan Reviewed-by: Xiao Ni Signed-off-by: Yu Kuai commit 90e3bb44c0a86e245d8e5c6520206fa113acb1ee Author: Xiao Ni Date: Wed Oct 29 14:34:19 2025 +0800 md: avoid repeated calls to del_gendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RIP: 0010:bdi_unregister+0x4b/0x170 Call Trace: __del_gendisk+0x356/0x3e0 mddev_unlock+0x351/0x360 rdev_attr_store+0x217/0x280 kernfs_fop_write_iter+0x14a/0x210 vfs_write+0x29e/0x550 ksys_write+0x74/0xf0 do_syscall_64+0xbb/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff5250a177e The sequence is: 1. rdev remove path gets reconfig_mutex 2. rdev remove path release reconfig_mutex in mddev_unlock 3. md stop calls do_md_stop and sets MD_DELETED 4. rdev remove path calls del_gendisk because MD_DELETED is set 5. md stop path release reconfig_mutex and calls del_gendisk again So there is a race condition we should resolve. This patch adds a flag MD_DO_DELETE to avoid the race condition. Link: https://lore.kernel.org/linux-raid/20251029063419.21700-1-xni@redhat.com Fixes: 9e59d609763f ("md: call del_gendisk in control path") Signed-off-by: Xiao Ni Suggested-by: Yu Kuai Reviewed-by: Li Nan Signed-off-by: Yu Kuai commit c1c654b5daceea6143a31292ec0e4f53cac2083d Author: Manikandan Muralidharan Date: Tue Sep 23 15:15:52 2025 +0530 ARM: at91: at91_dt_defconfig: set MMC_SPI to module Change CONFIG_MMC_SPI from built-in to module in the at91_dt_defconfig. This allows the MMC over SPI driver to be loaded only when needed for WILC subsystem. Signed-off-by: Manikandan Muralidharan Link: https://lore.kernel.org/r/20250923094552.430595-1-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit 46caa40534fcab1b341455b156c2bcf3674a6bdc Author: Chen Ni Date: Wed Sep 10 17:19:12 2025 +0800 md/md-llbitmap: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Link: https://lore.kernel.org/linux-raid/20250910091912.25624-1-nichen@iscas.ac.cn Signed-off-by: Chen Ni Signed-off-by: Yu Kuai commit 7fc8f632e68cd4db3bfee11ff7aa2ac731c5147a Author: John Garry Date: Wed Sep 3 16:10:52 2025 +0000 md/md-linear: Enable atomic writes All the infrastructure has already been plumbed to support this for stacked devices, so just enable the request_queue limits features flag. A note about chunk sectors for linear arrays: While it is possible to set a chunk sectors param for building a linear array, this is for specifying the granularity at which data sectors from the device are used. It is not the same as a stripe size, like for RAID0. As such, it is not appropriate to set chunk_sectors request queue limit to the same value, as chunk_sectors request limit is a boundary for which requests cannot straddle. However, request_queue limit max_hw_sectors is set to chunk sectors, which almost has the same effect as setting chunk_sectors limit. Link: https://lore.kernel.org/linux-raid/20250903161052.3326176-1-john.g.garry@oracle.com Signed-off-by: John Garry Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 082d680faf262cd52b51ca0b8dcbc7a9f311c220 Author: Wu Guanghao Date: Mon Sep 8 16:20:37 2025 +0800 Factor out code into md_should_do_recovery() In md_check_recovery(), use new helper to make code cleaner. Link: https://lore.kernel.org/linux-raid/e62894c8-d916-94bc-ef48-3c60e6e1fc5d@huawei.com Signed-off-by: Wu Guanghao Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit 0dc76205549b4c25705e54345f211b9f66e018a0 Author: Yun Zhou Date: Wed Oct 15 16:32:27 2025 +0800 md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after-free. Link: https://lore.kernel.org/linux-raid/20251015083227.1079009-1-yun.zhou@windriver.com Fixes: 446931543982 ("md: protect md_thread with rcu") Signed-off-by: Yun Zhou Reviewed-by: Li Nan Reviewed-by: Yu Kuai Signed-off-by: Yu Kuai commit cc394b94dc40b661efc9895665abf03640ffff2d Author: Xiao Ni Date: Sun Sep 28 09:24:24 2025 +0800 md: delete mddev kobj before deleting gendisk kobj In sync del gendisk path, it deletes gendisk first and the directory /sys/block/md is removed. Then it releases mddev kobj in a delayed work. If we enable debug log in sysfs_remove_group, we can see the debug log 'sysfs group bitmap not found for kobject md'. It's the reason that the parent kobj has been deleted, so it can't find parent directory. In creating path, it allocs gendisk first, then adds mddev kobj. So it should delete mddev kobj before deleting gendisk. Before commit 9e59d609763f ("md: call del_gendisk in control path"), it releases mddev kobj first. If the kobj hasn't been deleted, it does clean job and deletes the kobj. Then it calls del_gendisk and releases gendisk kobj. So it doesn't need to call kobject_del to delete mddev kobj. After this patch, in sync del gendisk path, the sequence changes. So it needs to call kobject_del to delete mddev kobj. After this patch, the sequence is: 1. kobject del mddev kobj 2. del_gendisk deletes gendisk kobj 3. mddev_delayed_delete releases mddev kobj 4. md_kobj_release releases gendisk kobj Link: https://lore.kernel.org/linux-raid/20250928012424.61370-1-xni@redhat.com Fixes: 9e59d609763f ("md: call del_gendisk in control path") Signed-off-by: Xiao Ni Reviewed-by: Li Nan Signed-off-by: Yu Kuai commit 3d7b1dbaa09877db78560d8020ea4d1c972720b9 Author: Yu Kuai Date: Tue Oct 21 20:28:00 2025 +0800 MAINTAINERS: Update Yu Kuai's E-mail address Change to my new email address on fnnas.com. Link: https://lore.kernel.org/linux-raid/20251021122800.3158836-1-yukuai@fnnas.com Signed-off-by: Yu Kuai Reviewed-by: Paul Menzel commit 4b1b92bdc4ca13fd6712cfaa0084d3cfdf76e24c Author: wangdicheng Date: Fri Nov 7 10:45:25 2025 +0800 ALSA: au88x0: Fix array bounds warning in EQ drivers In file included from ../sound/pci/au88x0/au8830.c:15: In function ‘vortex_Eqlzr_SetAllBandsFromActiveCoeffSet’, ../sound/pci/au88x0/au88x0_eq.c:571:9: error: ‘vortex_EqHw_SetRightGainsTarget’ reading 2 bytes from a region of size 0 [-Werror=stringop-overread] vortex_EqHw_SetRightGainsTarget(vortex, &(eq->this130[eq->this10])); Modified the array access in vortex_Eqlzr_SetAllBandsFromActiveCoeffSet() to use pointer arithmetic instead of array indexing. This resolves a compiler warning that incorrectly flagged a buffer overread when accessing the EQ gain array. The this130 array has fixed size 20 and the index is safely within bounds, making the original code correct but confusing to static analysis. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20251107024525.38454-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 592d1c23afb287d1eea0c83687203bff9d7e6eb3 Author: wangdicheng Date: Fri Nov 7 10:40:30 2025 +0800 ALSA: hda/senary: Replace magic numbers with defined constants Replace hardcoded GPIO node value with a defined constant for better code readability and maintainability. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20251107024030.36712-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit a0c3aefb08cd81864b17c23c25b388dba90b9dad Merge: 7c46332810d4b6 3da28eb277c1c1 Author: Jakub Kicinski Date: Fri Nov 7 19:15:36 2025 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-11-06 (i40, ice, iavf) Mohammad Heib introduces a new devlink parameter, max_mac_per_vf, for controlling the maximum number of MAC address filters allowed by a VF. This allows administrators to control the VF behavior in a more nuanced manner. Aleksandr and Przemek add support for Receive Side Scaling of GTP to iAVF for VFs running on E800 series ice hardware. This improves performance and scalability for virtualized network functions in 5G and LTE deployments. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: iavf: add RSS support for GTP protocol via ethtool ice: Extend PTYPE bitmap coverage for GTP encapsulated flows ice: improve TCAM priority handling for RSS profiles ice: implement GTP RSS context tracking and configuration ice: add virtchnl definitions and static data for GTP RSS ice: add flow parsing for GTP and new protocol field support i40e: support generic devlink param "max_mac_per_vf" devlink: Add new "max_mac_per_vf" generic device param ==================== Link: https://patch.msgid.link/20251106225321.1609605-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 7c46332810d4b6a550094a257481e5f46d217b25 Merge: 86b721bb0b4c44 e3c8f25cf2aa3f Author: Jakub Kicinski Date: Fri Nov 7 19:05:51 2025 -0800 Merge branch 'net-stmmac-lpc18xx-and-sti-convert-to-set_phy_intf_sel' Russell King says: ==================== net: stmmac: lpc18xx and sti: convert to set_phy_intf_sel() This series converts lpc18xx and sti to use the new .set_phy_intf_sel() method. ==================== Link: https://patch.msgid.link/aQyEs4DAZRWpAz32@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e3c8f25cf2aa3f2547da26e7a46424c016550d31 Author: Russell King (Oracle) Date: Thu Nov 6 11:23:52 2025 +0000 net: stmmac: sti: use ->set_phy_intf_sel() Rather than placing the phy_intf_sel() setup in the ->init() method, move it to the new ->set_phy_intf_sel() method. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5o-0000000DhQn-34JE@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ef5e870be90ffc390ae9afc0b50d411d3538126c Author: Russell King (Oracle) Date: Thu Nov 6 11:23:47 2025 +0000 net: stmmac: sti: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validate the result and use that to set the control register to select the operating mode for the DWMAC core. Note that when an unsupported interface mode is used, the array would decode this to PHY_INTF_SEL_GMII_MII, so preserve this behaviour. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5j-0000000DhQh-2e0x@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bd5a68159259efc910a5b199b3cd1a27d47205fb Author: Russell King (Oracle) Date: Thu Nov 6 11:23:42 2025 +0000 net: stmmac: sti: use PHY_INTF_SEL_x directly Use the PHY_INTF_SEL_x values directly rather than the driver private ETH_PHY_SEL_x values. Move the FIELD_PREP() into sti_dwmac_set_mode(). Use dwmac->interface directly. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5e-0000000DhQb-2B7I@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9cd23c02ac57a4727095e1d1d62974e0bea445fb Author: Russell King (Oracle) Date: Thu Nov 6 11:23:37 2025 +0000 net: stmmac: sti: use PHY_INTF_SEL_x to select PHY interface Use the common dwmac definitions for the PHY interface selection field, adding MII_PHY_SEL_VAL() temporarily to avoid line wrapping. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5Z-0000000DhQV-1e2l@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7fe0e06a7364ff7ffb3b44fe1c9340824b45c1a8 Author: Russell King (Oracle) Date: Thu Nov 6 11:23:32 2025 +0000 net: stmmac: lpc18xx: use ->set_phy_intf_sel() Move the configuration of the dwmac PHY interface selection to the new ->set_phy_intf_sel() method. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5U-0000000DhQP-19Hd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4bad4219249f12dabb5c246f5cf9378f3693e226 Author: Russell King (Oracle) Date: Thu Nov 6 11:23:27 2025 +0000 net: stmmac: lpc18xx: validate phy_intf_sel Validate the phy_intf_sel value rather than the PHY interface mode. This will allow us to transition to the ->set_phy_intf_sel() method. Note that this will allow GMII as well as MII as the phy_intf_sel value is the same for both. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5P-0000000DhQJ-0Oi3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9882f12194082a0178a025946911e677cfdcd8d8 Author: Russell King (Oracle) Date: Thu Nov 6 11:23:21 2025 +0000 net: stmmac: lpc18xx: use stmmac_get_phy_intf_sel() Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, and use the result to program the ethernet mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5J-0000000DhQD-46Ob@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit eb0533c7e63be03c1220f24bd00aeb2a4f0e3f78 Author: Russell King (Oracle) Date: Thu Nov 6 11:23:16 2025 +0000 net: stmmac: lpc18xx: use PHY_INTF_SEL_x directly Use the PHY_INTF_SEL_x values directly rather than the driver private LPC18XX_CREG_CREG6_ETHMODE_x definitions, and convert LPC18XX_CREG_CREG6_ETHMODE_MASK to use GENMASK(). Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy5E-0000000DhQ7-3cuy@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5636fcdb02114f492dd922cef67d1b1b5f09893b Author: Russell King (Oracle) Date: Thu Nov 6 11:23:11 2025 +0000 net: stmmac: lpc18xx: convert to PHY_INTF_SEL_x Use the common dwmac definitions for the PHY interface selection field. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vGy59-0000000DhQ1-393H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 86b721bb0b4c44499a29253b9fe26fa9ec5d2d82 Merge: fd9557c3606bb6 b61785852ed0a0 Author: Jakub Kicinski Date: Fri Nov 7 19:02:42 2025 -0800 Merge branch 'net-use-skb_attempt_defer_free-in-napi_consume_skb' Eric Dumazet says: ==================== net: use skb_attempt_defer_free() in napi_consume_skb() There is a lack of NUMA awareness and more generally lack of slab caches affinity on TX completion path. Modern drivers are using napi_consume_skb(), hoping to cache sk_buff in per-cpu caches so that they can be recycled in RX path. Only use this if the skb was allocated on the same cpu, otherwise use skb_attempt_defer_free() so that the skb is freed on the original cpu. This removes contention on SLUB spinlocks and data structures, and this makes sure that recycled sk_buff have correct NUMA locality. After this series, I get ~50% improvement for an UDP tx workload on an AMD EPYC 9B45 (IDPF 200Gbit NIC with 32 TX queues). I will later refactor skb_attempt_defer_free() to no longer have to care of skb_shared() and skb_release_head_state(). ==================== Link: https://patch.msgid.link/20251106202935.1776179-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit b61785852ed0a0e7dc16b606157e4a0228cd76cf Author: Eric Dumazet Date: Thu Nov 6 20:29:35 2025 +0000 net: increase skb_defer_max default to 128 skb_defer_max value is very conservative, and can be increased to avoid too many calls to kick_defer_list_purge(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Jason Xing Link: https://patch.msgid.link/20251106202935.1776179-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit e20dfbad8aab2b7c72571ae3c3e2e646d6b04cb7 Author: Eric Dumazet Date: Thu Nov 6 20:29:34 2025 +0000 net: fix napi_consume_skb() with alien skbs There is a lack of NUMA awareness and more generally lack of slab caches affinity on TX completion path. Modern drivers are using napi_consume_skb(), hoping to cache sk_buff in per-cpu caches so that they can be recycled in RX path. Only use this if the skb was allocated on the same cpu, otherwise use skb_attempt_defer_free() so that the skb is freed on the original cpu. This removes contention on SLUB spinlocks and data structures. After this patch, I get ~50% improvement for an UDP tx workload on an AMD EPYC 9B45 (IDPF 200Gbit NIC with 32 TX queues). 80 Mpps -> 120 Mpps. Profiling one of the 32 cpus servicing NIC interrupts : Before: mpstat -P 511 1 1 Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 511 0.00 0.00 0.00 0.00 0.00 98.00 0.00 0.00 0.00 2.00 31.01% ksoftirqd/511 [kernel.kallsyms] [k] queued_spin_lock_slowpath 12.45% swapper [kernel.kallsyms] [k] queued_spin_lock_slowpath 5.60% ksoftirqd/511 [kernel.kallsyms] [k] __slab_free 3.31% ksoftirqd/511 [kernel.kallsyms] [k] idpf_tx_clean_buf_ring 3.27% ksoftirqd/511 [kernel.kallsyms] [k] idpf_tx_splitq_clean_all 2.95% ksoftirqd/511 [kernel.kallsyms] [k] idpf_tx_splitq_start 2.52% ksoftirqd/511 [kernel.kallsyms] [k] fq_dequeue 2.32% ksoftirqd/511 [kernel.kallsyms] [k] read_tsc 2.25% ksoftirqd/511 [kernel.kallsyms] [k] build_detached_freelist 2.15% ksoftirqd/511 [kernel.kallsyms] [k] kmem_cache_free 2.11% swapper [kernel.kallsyms] [k] __slab_free 2.06% ksoftirqd/511 [kernel.kallsyms] [k] idpf_features_check 2.01% ksoftirqd/511 [kernel.kallsyms] [k] idpf_tx_splitq_clean_hdr 1.97% ksoftirqd/511 [kernel.kallsyms] [k] skb_release_data 1.52% ksoftirqd/511 [kernel.kallsyms] [k] sock_wfree 1.34% swapper [kernel.kallsyms] [k] idpf_tx_clean_buf_ring 1.23% swapper [kernel.kallsyms] [k] idpf_tx_splitq_clean_all 1.15% ksoftirqd/511 [kernel.kallsyms] [k] dma_unmap_page_attrs 1.11% swapper [kernel.kallsyms] [k] idpf_tx_splitq_start 1.03% swapper [kernel.kallsyms] [k] fq_dequeue 0.94% swapper [kernel.kallsyms] [k] kmem_cache_free 0.93% swapper [kernel.kallsyms] [k] read_tsc 0.81% ksoftirqd/511 [kernel.kallsyms] [k] napi_consume_skb 0.79% swapper [kernel.kallsyms] [k] idpf_tx_splitq_clean_hdr 0.77% ksoftirqd/511 [kernel.kallsyms] [k] skb_free_head 0.76% swapper [kernel.kallsyms] [k] idpf_features_check 0.72% swapper [kernel.kallsyms] [k] skb_release_data 0.69% swapper [kernel.kallsyms] [k] build_detached_freelist 0.58% ksoftirqd/511 [kernel.kallsyms] [k] skb_release_head_state 0.56% ksoftirqd/511 [kernel.kallsyms] [k] __put_partials 0.55% ksoftirqd/511 [kernel.kallsyms] [k] kmem_cache_free_bulk 0.48% swapper [kernel.kallsyms] [k] sock_wfree After: mpstat -P 511 1 1 Average: CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle Average: 511 0.00 0.00 0.00 0.00 0.00 51.49 0.00 0.00 0.00 48.51 19.10% swapper [kernel.kallsyms] [k] idpf_tx_splitq_clean_hdr 13.86% swapper [kernel.kallsyms] [k] idpf_tx_clean_buf_ring 10.80% swapper [kernel.kallsyms] [k] skb_attempt_defer_free 10.57% swapper [kernel.kallsyms] [k] idpf_tx_splitq_clean_all 7.18% swapper [kernel.kallsyms] [k] queued_spin_lock_slowpath 6.69% swapper [kernel.kallsyms] [k] sock_wfree 5.55% swapper [kernel.kallsyms] [k] dma_unmap_page_attrs 3.10% swapper [kernel.kallsyms] [k] fq_dequeue 3.00% swapper [kernel.kallsyms] [k] skb_release_head_state 2.73% swapper [kernel.kallsyms] [k] read_tsc 2.48% swapper [kernel.kallsyms] [k] idpf_tx_splitq_start 1.20% swapper [kernel.kallsyms] [k] idpf_features_check 1.13% swapper [kernel.kallsyms] [k] napi_consume_skb 0.93% swapper [kernel.kallsyms] [k] idpf_vport_splitq_napi_poll 0.64% swapper [kernel.kallsyms] [k] native_send_call_func_single_ipi 0.60% swapper [kernel.kallsyms] [k] acpi_processor_ffh_cstate_enter 0.53% swapper [kernel.kallsyms] [k] io_idle 0.43% swapper [kernel.kallsyms] [k] netif_skb_features 0.41% swapper [kernel.kallsyms] [k] __direct_call_cpuidle_state_enter2 0.40% swapper [kernel.kallsyms] [k] native_irq_return_iret 0.40% swapper [kernel.kallsyms] [k] idpf_tx_buf_hw_update 0.36% swapper [kernel.kallsyms] [k] sched_clock_noinstr 0.34% swapper [kernel.kallsyms] [k] handle_softirqs 0.32% swapper [kernel.kallsyms] [k] net_rx_action 0.32% swapper [kernel.kallsyms] [k] dql_completed 0.32% swapper [kernel.kallsyms] [k] validate_xmit_skb 0.31% swapper [kernel.kallsyms] [k] skb_network_protocol 0.29% swapper [kernel.kallsyms] [k] skb_csum_hwoffload_help 0.29% swapper [kernel.kallsyms] [k] x2apic_send_IPI 0.28% swapper [kernel.kallsyms] [k] ktime_get 0.24% swapper [kernel.kallsyms] [k] __qdisc_run Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Jason Xing Link: https://patch.msgid.link/20251106202935.1776179-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1fcf572211da626982223ab4e4641bcd92db0701 Author: Eric Dumazet Date: Thu Nov 6 20:29:33 2025 +0000 net: allow skb_release_head_state() to be called multiple times Currently, only skb dst is cleared (thanks to skb_dst_drop()) Make sure skb->destructor, conntrack and extensions are cleared. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20251106202935.1776179-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit fd9557c3606bb683c01a6c7627e915b539b9a8df Author: Eric Dumazet Date: Thu Nov 6 08:55:00 2025 +0000 net: add prefetch() in skb_defer_free_flush() skb_defer_free_flush() is becoming more important these days. Add a prefetch operation to reduce latency a bit on some platforms like AMD EPYC 7B12. On more recent cpus, a stall happens when reading skb_shinfo(). Avoiding it will require a more elaborate strategy. Signed-off-by: Eric Dumazet Acked-by: Paolo Abeni Link: https://patch.msgid.link/20251106085500.2438951-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 01c87d7f48b4f9b8be0950ed4de5d345632bd564 Merge: f73e0f46bbfab2 178f0763c5f3cf Author: Jakub Kicinski Date: Fri Nov 7 18:54:07 2025 -0800 Merge branch 'psp-track-stats-from-core-and-provide-a-driver-stats-api' Daniel Zahka says: ==================== psp: track stats from core and provide a driver stats api This series introduces stats counters for psp. Device key rotations, and so called 'stale-events' are common to all drivers and are tracked by the core. A driver facing api is provided for reporting stats required by the "Implementation Requirements" section of the PSP Architecture Specification. Drivers must implement these stats. Lastly, implementations of the driver stats api for mlx5 and netdevsim are included. Here is the output of running the psp selftest suite and then printing out stats with the ynl cli on system with a psp-capable CX7: $ ./ksft-psp-stats/drivers/net/psp.py TAP version 13 1..28 ok 1 psp.test_case # SKIP Test requires IPv4 connectivity ok 2 psp.data_basic_send_v0_ip6 ok 3 psp.test_case # SKIP Test requires IPv4 connectivity ok 4 psp.data_basic_send_v1_ip6 ok 5 psp.test_case # SKIP Test requires IPv4 connectivity ok 6 psp.data_basic_send_v2_ip6 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-128') ok 7 psp.test_case # SKIP Test requires IPv4 connectivity ok 8 psp.data_basic_send_v3_ip6 # SKIP ('PSP version not supported', 'hdr0-aes-gmac-256') ok 9 psp.test_case # SKIP Test requires IPv4 connectivity ok 10 psp.data_mss_adjust_ip6 ok 11 psp.dev_list_devices ok 12 psp.dev_get_device ok 13 psp.dev_get_device_bad ok 14 psp.dev_rotate ok 15 psp.dev_rotate_spi ok 16 psp.assoc_basic ok 17 psp.assoc_bad_dev ok 18 psp.assoc_sk_only_conn ok 19 psp.assoc_sk_only_mismatch ok 20 psp.assoc_sk_only_mismatch_tx ok 21 psp.assoc_sk_only_unconn ok 22 psp.assoc_version_mismatch ok 23 psp.assoc_twice ok 24 psp.data_send_bad_key ok 25 psp.data_send_disconnect ok 26 psp.data_stale_key ok 27 psp.removal_device_rx # XFAIL Test only works on netdevsim ok 28 psp.removal_device_bi # XFAIL Test only works on netdevsim # Totals: pass:19 fail:0 xfail:2 xpass:0 skip:7 error:0 # # Responder logs (0): # STDERR: # Set PSP enable on device 1 to 0x3 # Set PSP enable on device 1 to 0x0 $ ynl --family psp --dump get-stats [{'dev-id': 1, 'key-rotations': 5, 'rx-auth-fail': 21, 'rx-bad': 0, 'rx-bytes': 11844, 'rx-error': 0, 'rx-packets': 94, 'stale-events': 6, 'tx-bytes': 1128456, 'tx-error': 0, 'tx-packets': 780}] ==================== Link: https://patch.msgid.link/20251106002608.1578518-1-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 178f0763c5f3cf710062ddf2e4d659127fee66b2 Author: Daniel Zahka Date: Wed Nov 5 16:26:06 2025 -0800 netdevsim: implement psp device stats For now only tx/rx packets/bytes are reported. This is not compliant with the PSP Architecture Specification. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251106002608.1578518-6-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit b1346219e5350990ab36cdf8d1b302c1b53fc21a Author: Jakub Kicinski Date: Wed Nov 5 16:26:05 2025 -0800 net/mlx5e: Add PSP stats support for Rx/Tx flows Add all statistics described under the "Implementation Requirements" section of the PSP Architecture Specification: Rx successfully decrypted PSP packets: psp_rx_pkts : Number of packets decrypted successfully psp_rx_bytes : Number of bytes decrypted successfully Rx PSP authentication failure statistics: psp_rx_pkts_auth_fail : Number of PSP packets that failed authentication psp_rx_bytes_auth_fail : Number of PSP bytes that failed authentication Rx PSP bad frame error statistics: psp_rx_pkts_frame_err; psp_rx_bytes_frame_err; Rx PSP drop statistics: psp_rx_pkts_drop : Number of PSP packets dropped psp_rx_bytes_drop : Number of PSP bytes dropped Tx successfully encrypted PSP packets: psp_tx_pkts : Number of packets encrypted successfully psp_tx_bytes : Number of bytes encrypted successfully Tx drops: tx_drop : Number of misc psp related drops The above can be seen using the ynl cli: ./pyynl/cli.py --spec netlink/specs/psp.yaml --dump get-stats Signed-off-by: Raed Salem Signed-off-by: Rahul Rameshbabu Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251106002608.1578518-5-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit f05d26198cf2c71f25f6bbe62ca4481c15543922 Author: Jakub Kicinski Date: Wed Nov 5 16:26:04 2025 -0800 psp: add stats from psp spec to driver facing api Provide a driver api for reporting device statistics required by the "Implementation Requirements" section of the PSP Architecture Specification. Use a warning to ensure drivers report stats required by the spec. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251106002608.1578518-4-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 2098cec32865422b3ddc6a1bd8beb055a3850451 Author: Daniel Zahka Date: Wed Nov 5 16:26:03 2025 -0800 selftests: drv-net: psp: add assertions on core-tracked psp dev stats Add assertions to existing test cases to cover key rotations and 'stale-events'. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251106002608.1578518-3-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit dae4a92399fa8d68aa917db6bb3245f83021e762 Author: Jakub Kicinski Date: Wed Nov 5 16:26:02 2025 -0800 psp: report basic stats from the core Track and report stats common to all psp devices from the core. A 'stale-event' is when the core marks the rx state of an active psp_assoc as incapable of authenticating psp encapsulated data. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20251106002608.1578518-2-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit f73e0f46bbfab29b111ff52d047f15aa13623972 Author: Heiner Kallweit Date: Wed Nov 5 23:09:17 2025 +0100 net: phy: fixed_phy: shrink size of struct fixed_phy_status All three members are effectively of type bool, so make this explicit and shrink size of struct fixed_phy_status. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/9eca3d7e-fa64-4724-8fdc-f2c1a8f2ae8f@gmail.com Signed-off-by: Jakub Kicinski commit ac81130e3607a2c34a6fb20a8da9ace0c09ed6ff Merge: 140039580efa96 f424409483d26b Author: Jakub Kicinski Date: Fri Nov 7 18:52:36 2025 -0800 Merge branch 'net-phy-add-open-alliance-tc14-10base-t1s-phy-cable-diagnostic-support' Parthiban Veerasooran says: ==================== net: phy: Add Open Alliance TC14 10Base-T1S PHY cable diagnostic support This patch series adds Open Alliance TC14 (OATC14) 10BASE-T1S cable diagnostic feature support to the Linux kernel PHY subsystem and enable this feature for Microchip LAN867x Rev.D0 PHYs. These patches provide standardized cable test functionality for 10BASE-T1S Ethernet PHYs, allowing users to perform cable diagnostics via ethtool. Patch Summary: 1. add OATC14 10BASE-T1S PHY cable diagnostic support - Implements support for the OATC14 cable diagnostic feature in Clause 45 PHYs. - Adds functions to start a cable test and retrieve its status, mapping hardware results to ethtool codes. - Exports these functions for use by PHY drivers. - Open Alliance TC14 10BASE-T1S Advanced Diagnostic PHY Features. https://opensig.org/wp-content/uploads/2025/06/OPEN_Alliance_10BASE-T1S_Advanced_PHY_features_for-automotive_Ethernet_V2.1b.pdf 2. add cable diagnostic support for LAN867x Rev.D0 - Integrates the generic OATC14 cable test functions into the Microchip LAN867x Rev.D0 PHY driver. - Enables ethtool cable diagnostics for this PHY, improving troubleshooting and maintenance. ==================== Link: https://patch.msgid.link/20251105051213.50443-1-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit f424409483d26b3d54439cda832f273a54745cf6 Author: Parthiban Veerasooran Date: Wed Nov 5 10:42:13 2025 +0530 net: phy: microchip_t1s:: add cable diagnostic support for LAN867x Rev.D0 Enable Open Alliance TC14 (OATC14) 10Base-T1S cable diagnostic feature for Microchip LAN867x Rev.D0 PHY by implementing `cable_test_start` and `cable_test_get_status` using the generic C45 functions. This allows the `ethtool` utility to perform cable diagnostic tests directly on the PHY, improving network troubleshooting and maintenance. Signed-off-by: Parthiban Veerasooran Link: https://patch.msgid.link/20251105051213.50443-3-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit b87ee13e34931779ac1dcd3264beba50b54966fd Author: Parthiban Veerasooran Date: Wed Nov 5 10:42:12 2025 +0530 net: phy: phy-c45: add OATC14 10BASE-T1S PHY cable diagnostic support Add support for Open Alliance TC14 (OATC14) 10BASE-T1S PHYs cable diagnostic feature. This patch implements: - genphy_c45_oatc14_cable_test_start() to initiate a cable test - genphy_c45_oatc14_cable_test_get_status() to retrieve test results - Helper function to map PHY cable test status to ethtool result codes - Function declarations and exports for use by PHY drivers This enables ethtool to report ok, open, short, and undetectable cable conditions on OATC14 10Base-T1S PHYs. Open Alliance TC14 10BASE-T1S Advanced Diagnostic PHY Features Specification ref: https://opensig.org/wp-content/uploads/2025/06/OPEN_Alliance_10BASE-T1S_Advanced_PHY_features_for-automotive_Ethernet_V2.1b.pdf Signed-off-by: Parthiban Veerasooran Link: https://patch.msgid.link/20251105051213.50443-2-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 140039580efa96d18576a6c9fa6b1158be8a1d0f Author: Erni Sri Satya Vennela Date: Wed Nov 5 11:04:28 2025 -0800 net: mana: Fix incorrect speed reported by debugfs Once the netshaper is created for MANA, the current bandwidth is reported in debugfs like this: $ sudo ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/net_shaper.yaml \ --do set \ --json '{"ifindex":'3', "handle":{ "scope": "netdev", "id":'1' }, "bw-max": 200000000 }' None $ sudo cat /sys/kernel/debug/mana/1/vport0/current_speed 200 After the shaper is deleted, it is expected to report the maximum speed supported by the SKU. But currently it is reporting 0, which is incorrect. Fix this inconsistency, by resetting apc->speed to apc->max_speed during deletion of the shaper object. This will improve readability and debuggability. Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1762369468-32570-1-git-send-email-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 3f47e67dff1f7266e112c50313d63824f6f17102 Author: Lorenzo Bianconi Date: Thu Nov 6 13:53:23 2025 +0100 net: airoha: Add the capability to consume out-of-order DMA tx descriptors EN7581 and AN7583 SoCs are capable of DMA mapping non-linear tx skbs on non-consecutive DMA descriptors. This feature is useful when multiple flows are queued on the same hw tx queue since it allows to fully utilize the available tx DMA descriptors and to avoid the starvation of high-priority flow we have in the current codebase due to head-of-line blocking introduced by low-priority flows. Tested-by: Xuegang Lu Reviewed-by: Jacob Keller Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251106-airoha-tx-linked-list-v2-1-0706d4a322bd@kernel.org Signed-off-by: Jakub Kicinski commit 416dd649f3aa3774907c668167a29c668dbc634b Author: Eric Dumazet Date: Thu Nov 6 11:52:36 2025 +0000 tcp: add net.ipv4.tcp_comp_sack_rtt_percent TCP SACK compression has been added in 2018 in commit 5d9f4262b7ea ("tcp: add SACK compression"). It is working great for WAN flows (with large RTT). Wifi in particular gets a significant boost _when_ ACK are suppressed. Add a new sysctl so that we can tune the very conservative 5 % value that has been used so far in this formula, so that small RTT flows can benefit from this feature. delay = min ( 5 % of RTT, 1 ms) This patch adds new tcp_comp_sack_rtt_percent sysctl to ease experiments and tuning. Given that we cap the delay to 1ms (tcp_comp_sack_delay_ns sysctl), set the default value to 33 %. Quoting Neal Cardwell ( https://lore.kernel.org/netdev/CADVnQymZ1tFnEA1Q=vtECs0=Db7zHQ8=+WCQtnhHFVbEOzjVnQ@mail.gmail.com/ ) The rationale for 33% is basically to try to facilitate pipelining, where there are always at least 3 ACKs and 3 GSO/TSO skbs per SRTT, so that the path can maintain a budget for 3 full-sized GSO/TSO skbs "in flight" at all times: + 1 skb in the qdisc waiting to be sent by the NIC next + 1 skb being sent by the NIC (being serialized by the NIC out onto the wire) + 1 skb being received and aggregated by the receiver machine's aggregation mechanism (some combination of LRO, GRO, and sack compression) Note that this is basically the same magic number (3) and the same rationales as: (a) tcp_tso_should_defer() ensuring that we defer sending data for no longer than cwnd/tcp_tso_win_divisor (where tcp_tso_win_divisor = 3), and (b) bbr_quantization_budget() ensuring that cwnd is at least 3 GSO/TSO skbs to maintain pipelining and full throughput at low RTTs Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20251106115236.3450026-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 45cb3c6fbe875e1fda037a798e4c95c43b901d17 Merge: c6934c4e049c8a ffc56c90819e86 Author: Jakub Kicinski Date: Fri Nov 7 18:05:28 2025 -0800 Merge branch 'tcp-clean-up-syn-ack-rto-code-and-apply-max-rto' Kuniyuki Iwashima says: ==================== tcp: Clean up SYN+ACK RTO code and apply max RTO. Patch 1 - 4 are misc cleanup. Patch 5 applies max RTO to non-TFO SYN+ACK. Patch 6 adds a test for max RTO of SYN+ACK. ==================== Link: https://patch.msgid.link/20251106003357.273403-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ffc56c90819e86d3a8c4eff6f831317d1c1476b6 Author: Kuniyuki Iwashima Date: Thu Nov 6 00:32:45 2025 +0000 selftest: packetdrill: Add max RTO test for SYN+ACK. This script sets net.ipv4.tcp_rto_max_ms to 1000 and checks if SYN+ACK RTO is capped at 1s for TFO and non-TFO. Without the previous patch, the max RTO is applied to TFO SYN+ACK only, and non-TFO SYN+ACK RTO increases exponentially. # selftests: net/packetdrill: tcp_rto_synack_rto_max.pkt # TAP version 13 # 1..2 # tcp_rto_synack_rto_max.pkt:46: error handling packet: timing error: expected outbound packet at 5.091936 sec but happened at 6.107826 sec; tolerance 0.127974 sec # script packet: 5.091936 S. 0:0(0) ack 1 # actual packet: 6.107826 S. 0:0(0) ack 1 win 65535 # not ok 1 ipv4 # tcp_rto_synack_rto_max.pkt:46: error handling packet: timing error: expected outbound packet at 5.075901 sec but happened at 6.091841 sec; tolerance 0.127976 sec # script packet: 5.075901 S. 0:0(0) ack 1 # actual packet: 6.091841 S. 0:0(0) ack 1 win 65535 # not ok 2 ipv6 # # Totals: pass:0 fail:2 xfail:0 xpass:0 skip:0 error:0 not ok 49 selftests: net/packetdrill: tcp_rto_synack_rto_max.pkt # exit=1 With the previous patch, all SYN+ACKs are retransmitted after 1s. # selftests: net/packetdrill: tcp_rto_synack_rto_max.pkt # TAP version 13 # 1..2 # ok 1 ipv4 # ok 2 ipv6 # # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 ok 49 selftests: net/packetdrill: tcp_rto_synack_rto_max.pkt Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106003357.273403-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 1e9d3005e02cba82047d49f859982fc73b9a100b Author: Kuniyuki Iwashima Date: Thu Nov 6 00:32:44 2025 +0000 tcp: Apply max RTO to non-TFO SYN+ACK. Since commit 54a378f43425 ("tcp: add the ability to control max RTO"), TFO SYN+ACK RTO is capped by the TFO full sk's inet_csk(sk)->icsk_rto_max. The value is inherited from the parent listener. Let's apply the same cap to non-TFO SYN+ACK. Note that req->rsk_listener is always non-NULL when we call tcp_reqsk_timeout() in reqsk_timer_handler() or tcp_check_req(). It could be NULL for SYN cookie req, but we do not use req->timeout then. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106003357.273403-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 207ce0f6bc131812c96cf4f6db328af5396cebac Author: Kuniyuki Iwashima Date: Thu Nov 6 00:32:43 2025 +0000 tcp: Remove timeout arg from reqsk_timeout(). reqsk_timeout() is always called with @timeout being TCP_RTO_MAX. Let's remove the arg. As a prep for the next patch, reqsk_timeout() is moved to tcp.h and renamed to tcp_reqsk_timeout(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106003357.273403-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 6fbf648d5cc48ebf250f32a8793a95a2596c0d50 Author: Kuniyuki Iwashima Date: Thu Nov 6 00:32:42 2025 +0000 tcp: Remove redundant init for req->num_timeout. Commit 5903123f662e ("tcp: Use BPF timeout setting for SYN ACK RTO") introduced req->timeout and initialised it in 3 places: 1. reqsk_alloc() sets 0 2. inet_reqsk_alloc() sets TCP_TIMEOUT_INIT 3. tcp_conn_request() sets tcp_timeout_init() 1. has been always redundant as 2. overwrites it immediately. 2. was necessary for TFO SYN+ACK but is no longer needed after commit 8ea731d4c2ce ("tcp: Make SYN ACK RTO tunable by BPF programs with TFO"). 3. was moved to reqsk_queue_hash_req() in the previous patch. Now, we always initialise req->timeout just before scheduling the SYN+ACK timer: * For non-TFO SYN+ACK : reqsk_queue_hash_req() * For TFO SYN+ACK : tcp_fastopen_create_child() Let's remove the redundant initialisation of req->timeout in reqsk_alloc() and inet_reqsk_alloc(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106003357.273403-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3ce5dd8161ecdf12ffe0af99ff8980f1432f64a5 Author: Kuniyuki Iwashima Date: Thu Nov 6 00:32:41 2025 +0000 tcp: Remove timeout arg from reqsk_queue_hash_req(). inet_csk_reqsk_queue_hash_add() is no longer shared by DCCP. We do not need to pass req->timeout down to reqsk_queue_hash_req(). Let's move tcp_timeout_init() from tcp_conn_request() to reqsk_queue_hash_req(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106003357.273403-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit be88c549e9d78828a2e06126ed7e17fc2e030f1f Author: Kuniyuki Iwashima Date: Thu Nov 6 00:32:40 2025 +0000 tcp: Call tcp_syn_ack_timeout() directly. Since DCCP has been removed, we do not need to use request_sock_ops.syn_ack_timeout(). Let's call tcp_syn_ack_timeout() directly. Now other function pointers of request_sock_ops are protocol-dependent. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20251106003357.273403-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 41d34e0b5497f919229d32580fbe34386087458f Author: Alex Elder Date: Mon Oct 27 08:30:06 2025 -0500 riscv: dts: spacemit: enable K1 SoC QSPI on BPI-F3 Define DTS nodes to enable support for QSPI on the K1 SoC, including the pin control configuration used. Enable QSPI on the Banana Pi BPI-F3 board. Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20251027133008.360237-9-elder@riscstar.com Signed-off-by: Yixun Lan commit 80b3dc0a5a2e51fb2b8f3406f5ee20ad4a652316 Author: Alexandre Courbot Date: Sun Oct 26 22:06:54 2025 +0900 gpu: nova-core: justify remaining uses of `as` There are a few remaining cases where we *do* want to use `as`, because we specifically want to strip the data that does not fit into the destination type. Comment these uses to clear confusion about the intent. Acked-by: Danilo Krummrich [acourbot@nvidia.com: fix merge conflicts after rebase.] Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-as-v3-6-6a30c7333ad9@nvidia.com> commit 84e2b401bcc551e7c2e1a995f90cce421bce5bfd Author: Alexandre Courbot Date: Mon Oct 27 23:12:31 2025 +0900 gpu: nova-core: replace use of `as` with functions from `num` Use the newly-introduced `num` module to replace the use of `as` wherever it is safe to do. This ensures that a given conversion cannot lose data if its source or destination type ever changes. Acked-by: Danilo Krummrich [acourbot@nvidia.com: fix merge conflicts after rebase.] Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-as-v3-5-6a30c7333ad9@nvidia.com> commit 5525ac03ca7adec61d39f3fd3a143b5e294bdff7 Author: Alexandre Courbot Date: Thu Oct 16 11:55:48 2025 +0900 gpu: nova-core: add functions and traits for lossless integer conversions The core library's `From` implementations do not cover conversions that are not portable or future-proof. For instance, even though it is safe today, `From` is not implemented for `u64` because of the possibility to support larger-than-64bit architectures in the future. However, the kernel supports a narrower set of architectures, and in the case of Nova we only support 64-bit. This makes it helpful and desirable to provide more infallible conversions, lest we need to rely on the `as` keyword and carry the risk of silently losing data. Thus, introduce a new module `num` that provides safe const functions performing more conversions allowed by the build target, as well as `FromSafeCast` and `IntoSafeCast` traits that are just extensions of `From` and `Into` to conversions that are known to be lossless. Suggested-by: Danilo Krummrich Link: https://lore.kernel.org/rust-for-linux/DDK4KADWJHMG.1FUPL3SDR26XF@kernel.org/ Acked-by: Danilo Krummrich [acourbot@nvidia.com: fix merge conflicts after rebase.] Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-as-v3-4-6a30c7333ad9@nvidia.com> commit 0bc605713f16ad77e0a3f30f992aa3794c381372 Author: Danilo Krummrich Date: Fri Nov 7 10:16:07 2025 +0100 rust: debugfs: Implement BinaryReader for Mutex only when T is Unpin Commit da123f0ee40f ("rust: lock: guard: Add T: Unpin bound to DerefMut") from tip/master adds an Unpin bound to T for Mutex, hence also restrict the implementation of BinaryReader for Mutex accordingly. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20251107134144.117905bd@canb.auug.org.au/ Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251107091612.2557480-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c8a3dfe7315945ebcc80ed5be8267920b609649a Author: Ricardo Robaina Date: Fri Oct 31 09:33:28 2025 -0300 audit: merge loops in __audit_inode_child() Whenever there's audit context, __audit_inode_child() gets called numerous times, which can lead to high latency in scenarios that create too many sysfs/debugfs entries at once, for instance, upon device_add_disk() invocation. # uname -r 6.18.0-rc2+ # auditctl -a always,exit -F path=/tmp -k foo # time insmod loop max_loop=1000 real 0m46.676s user 0m0.000s sys 0m46.405s # perf record -a insmod loop max_loop=1000 # perf report --stdio |grep __audit_inode_child 32.73% insmod [kernel.kallsyms] [k] __audit_inode_child __audit_inode_child() searches for both the parent and the child in two different loops that iterate over the same list. This process can be optimized by merging these into a single loop, without changing the function behavior or affecting the code's readability. This patch merges the two loops that walk through the list context->names_list into a single loop. This optimization resulted in around 51% performance enhancement for the benchmark. # uname -r 6.18.0-rc2-enhancedv3+ # auditctl -a always,exit -F path=/tmp -k foo # time insmod loop max_loop=1000 real 0m22.899s user 0m0.001s sys 0m22.652s Signed-off-by: Ricardo Robaina Signed-off-by: Paul Moore commit 77563f3d4704206c8f6626852365591aa4e0b779 Author: Gongwei Li Date: Wed Nov 5 18:36:19 2025 +0800 audit: Use kzalloc() instead of kmalloc()/memset() in audit_krule_to_data() Replace kmalloc+memset by kzalloc for better readability and simplicity. This addresses the warning below: WARNING: kzalloc should be used for data, instead of kmalloc/memset Signed-off-by: Gongwei Li [PM: subject and description tweaks] Signed-off-by: Paul Moore commit 6331b266935916bf050149a55bfafb45aa3d9d9e Author: Ian Rogers Date: Fri Nov 7 09:07:12 2025 -0800 perf tool: Add a delegate_tool that just delegates actions to another tool Add an ability to be able to compose perf_tools, by having one perform an action and then calling a delegate. Currently the perf_tools have if-then-elses setting the callback and then if-then-elses within the callback. Understanding the behavior is complex as it is in two places and logic for numerous operations, within things like perf inject, is interwoven. By chaining perf_tools together based on command line options this kind of code can be avoided. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 71062e282d6a662b75df9aff65702455563ff7c9 Author: Ian Rogers Date: Fri Nov 7 09:07:11 2025 -0800 perf tool: Add the perf_tool argument to all callbacks Getting context for what a tool is doing, such as the perf_inject instance, using container_of the tool is a common pattern in the code. This isn't possible event_op2, event_op3 and event_op4 callbacks as the tool isn't passed. Add the argument and then fix function signatures to match. As tools maybe reading a tool from somewhere else, change that code to use the passed in tool. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 2f58be82fc2f17ff15f0224a2ad0732cc11ee04c Author: Kaushlendra Kumar Date: Tue Oct 28 10:45:54 2025 +0530 ACPI: DPTF: Use ACPI_FREE() for ACPI buffer deallocation Replace kfree() with ACPI_FREE() in pch_fivr_read() to follow ACPICA memory management conventions. While functionally equivalent in Linux (ACPI_FREE() is implemented as kfree()), using ACPI_FREE() maintains consistency with ACPICA coding standards for deallocating ACPI buffer objects. Signed-off-by: Kaushlendra Kumar [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20251028051554.2862049-1-kaushlendra.kumar@intel.com Signed-off-by: Rafael J. Wysocki commit fc1abd409318b81274566e1808c598b0b0462dc6 Author: Anshuman Khandual Date: Wed Oct 15 03:10:24 2025 +0100 arm64/mm: Drop cpu_set_[default|idmap]_tcr_t0sz() These TCR_El1 helpers don't have any other callers. Drop these redundant indirections completely thus making this code more compact and readable. No functional change. Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Anshuman Khandual Acked-by: Will Deacon Signed-off-by: Catalin Marinas commit a7717cad615f2b169ccca93418a07eaa526b4a1a Author: Mark Rutland Date: Mon Nov 3 16:04:17 2025 +0000 kselftest/arm64: Align zt-test register dumps The zt-test output is awkward to read, as the 'Expected' value isn't dumped on its own line and isn't aligned with the 'Got' value beneath. For example: Mismatch: PID=5281, iteration=3270249 Expected [00a1146901a1146902a1146903a1146904a1146905a1146906a1146907a1146908a1146909a114690aa114690ba114690ca114690da114690ea114690fa11469] Got [00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000] SVCR: 2 Add a newline, matching the other FPSIMD/SVE/SME tests, so that we get output that can be read more easily: Mismatch: PID=5281, iteration=3270249 Expected [00a1146901a1146902a1146903a1146904a1146905a1146906a1146907a1146908a1146909a114690aa114690ba114690ca114690da114690ea114690fa11469] Got [00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000] SVCR: 2 Admittedly this isn't all that important when the 'Got' value is all zeroes, but otherwise this would be a major help for identifying which portion of the 'Got' value is not as expected. Signed-off-by: Mark Rutland Cc: Mark Brown Cc: Shuah Khan Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kselftest@vger.kernel.org Reviewed-by: Mark Brown Signed-off-by: Catalin Marinas commit bf6b3fed186665cecbf0cf8be72da15d6585bfb0 Author: Omar Sandoval Date: Wed Oct 8 16:01:30 2025 -0700 arm64: remove unused ARCH_PFN_OFFSET This is only relevant to the FLATMEM memory model, which isn't an option since commit 782276b4d0ad ("arm64: Force SPARSEMEM_VMEMMAP as the only memory management model"). Signed-off-by: Omar Sandoval Acked-by: Will Deacon Reviewed-by: Anshuman Khandual Signed-off-by: Catalin Marinas commit d3b570eba7bf6f712e85e59dd37e8a9c6360b7b0 Author: Ryo Takakura Date: Wed Nov 5 16:42:59 2025 +0900 arm64: use SOFTIRQ_ON_OWN_STACK for enabling softirq stack For those architectures with HAVE_SOFTIRQ_ON_OWN_STACK use their dedicated softirq stack when !PREEMPT_RT. This condition is ensured by SOFTIRQ_ON_OWN_STACK. Let arm64 use SOFTIRQ_ON_OWN_STACK as well to select its usage of the stack. Signed-off-by: Ryo Takakura Reviewed-by: Sebastian Andrzej Siewior Acked-by: Will Deacon Signed-off-by: Catalin Marinas commit e32c402533cc68abe20fcf3246b9ff53e1f96021 Author: Goko Mell Date: Thu Nov 6 00:03:16 2025 +0800 ASoC: spacemit: fix incorrect error check for sspa clock Fix a wrong IS_ERR() check in spacemit_i2s_probe() where `clk` was used instead of `i2s->sspa_clk`. Signed-off-by: Goko Mell Link: https://patch.msgid.link/20251106-spacemit-i2s-fix-v1-1-ee2cedcdda23@gmail.com Signed-off-by: Mark Brown commit 4002068508caceb2a6f006fdf265a8de702768d0 Author: Dawei Li Date: Mon Nov 3 23:23:45 2025 +0800 arm64: Remove assertion on CONFIG_VMAP_STACK CONFIG_VMAP_STACK is selected by arm64 arch unconditionly since commit ef6861b8e6dd ("arm64: Mandate VMAP_STACK"). Remove the redundant assertion and headers. Signed-off-by: Dawei Li Acked-by: Will Deacon Signed-off-by: Catalin Marinas commit 966c9e65ba5246d5874a9f6ac5f318f7f50aea89 Author: Slawomir Rosek Date: Mon Nov 3 16:25:16 2025 +0000 ACPI: DPTF: Remove int340x thermal scan handler Using the IS_ENABLED() macro in the int340x_thermal_handler_attach() forces the kernel to be recompiled when thermal drivers are enabled or disabled, which is a significant limitation of its modularity. The IS_ENABLED() macro is particularly problematic for the Android Generic Kernel Image (GKI) project which uses unified core kernel while SoC/board support is moved to loadable vendor modules. The Intel Dynamic Platform and Thermal Framework (DPTF) requires thermal drivers to be loaded at runtime, thus ACPI bus scan handler is not needed and acpi_default_enumeration() may create all platform devices, regardless of the actual setting of CONFIG_INT340X_THERMAL. Signed-off-by: Slawomir Rosek Link: https://patch.msgid.link/20251103162516.2606158-3-srosek@google.com Signed-off-by: Rafael J. Wysocki commit 13a96342d59f4edbe237245e84c418c045b66188 Author: Slawomir Rosek Date: Mon Nov 3 16:25:15 2025 +0000 thermal: intel: Select INT340X_THERMAL from INTEL_SOC_DTS_THERMAL The IRQ used by the Intel SoC DTS thermal device for critical overheating notification is listed in _CRS of device INT3401 which therefore needs to be enumerated for Intel SoC DTS thermal to work. The enumeration happens by binding the int3401_thermal driver to the INT3401 platform device. Thus CONFIG_INT340X_THERMAL is in fact necessary for enumerating it, so checking CONFIG_INTEL_SOC_DTS_THERMAL in int340x_thermal_handler_attach() is pointless and INT340X_THERMAL may as well be selected by INTEL_SOC_DTS_THERMAL. Signed-off-by: Slawomir Rosek [ rjw: New subject ] Link: https://patch.msgid.link/20251103162516.2606158-2-srosek@google.com Signed-off-by: Rafael J. Wysocki commit 995d504100cf66d846461133f8862b483295f995 Author: Hou Wenlong Date: Thu Oct 30 12:15:28 2025 -0700 KVM: x86: Don't disable IRQs when unregistering user-return notifier Remove the code to disable IRQs when unregistering KVM's user-return notifier now that KVM doesn't invoke kvm_on_user_return() when disabling virtualization via IPI function call, i.e. now that there's no need to guard against re-entrancy via IPI callback. Note, disabling IRQs has largely been unnecessary since commit a377ac1cd9d7b ("x86/entry: Move user return notifier out of loop") moved fire_user_return_notifiers() into the section with IRQs disabled. In doing so, the commit somewhat inadvertently fixed the underlying issue that was papered over by commit 1650b4ebc99d ("KVM: Disable irq while unregistering user notifier"). I.e. in practice, the code and comment has been stale since commit a377ac1cd9d7b. Signed-off-by: Hou Wenlong [sean: rewrite changelog after rebasing, drop lockdep assert] Reviewed-by: Kai Huang Link: https://patch.msgid.link/20251030191528.3380553-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 2baa33a8ddd61feb1347db95271f157fd9e9d53d Author: Sean Christopherson Date: Thu Oct 30 12:15:27 2025 -0700 KVM: x86: Leave user-return notifier registered on reboot/shutdown Leave KVM's user-return notifier registered in the unlikely case that the notifier is registered when disabling virtualization via IPI callback in response to reboot/shutdown. On reboot/shutdown, keeping the notifier registered is ok as far as MSR state is concerned (arguably better then restoring MSRs at an unknown point in time), as the callback will run cleanly and restore host MSRs if the CPU manages to return to userspace before the system goes down. The only wrinkle is that if kvm.ko module unload manages to race with reboot/shutdown, then leaving the notifier registered could lead to use-after-free due to calling into unloaded kvm.ko module code. But such a race is only possible on --forced reboot/shutdown, because otherwise userspace tasks would be frozen before kvm_shutdown() is called, i.e. on a "normal" reboot/shutdown, it should be impossible for the CPU to return to userspace after kvm_shutdown(). Furthermore, on a --forced reboot/shutdown, unregistering the user-return hook from IRQ context doesn't fully guard against use-after-free, because KVM could immediately re-register the hook, e.g. if the IRQ arrives before kvm_user_return_register_notifier() is called. Rather than trying to guard against the IPI in the "normal" user-return code, which is difficult and noisy, simply leave the user-return notifier registered on a reboot, and bump the kvm.ko module refcount to defend against a use-after-free due to kvm.ko unload racing against reboot. Alternatively, KVM could allow kvm.ko and try to drop the notifiers during kvm_x86_exit(), but that's also a can of worms as registration is per-CPU, and so KVM would need to blast an IPI, and doing so while a reboot/shutdown is in-progress is far risky than preventing userspace from unloading KVM. Link: https://patch.msgid.link/20251030191528.3380553-4-seanjc@google.com Signed-off-by: Sean Christopherson commit b371174d2fa60bbbb730a1a5292c865d12036c2a Author: Sean Christopherson Date: Thu Oct 30 12:15:26 2025 -0700 KVM: x86: WARN if user-return MSR notifier is registered on exit When freeing the per-CPU user-return MSRs structures, WARN if any CPU has a registered notifier to help detect and/or debug potential use-after-free issues. The lifecycle of the notifiers is rather convoluted, and has several non-obvious paths where notifiers are unregistered, i.e. isn't exactly the most robust code possible. The notifiers they are registered on-demand in KVM, on the first WRMSR to a tracked register. _Usually_ the notifier is unregistered whenever the CPU returns to userspace. But because any given CPU isn't guaranteed to return to userspace, e.g. the CPU could be offlined before doing so, KVM also "drops", a.k.a. unregisters, the notifiers when virtualization is disabled on the CPU. Further complicating the unregister path is the fact that the calls to disable virtualization come from common KVM, and the per-CPU calls are guarded by a per-CPU flag (to harden _that_ code against bugs, e.g. due to mishandling reboot). Reboot/shutdown in particular is problematic, as KVM disables virtualization via IPI function call, i.e. from IRQ context, instead of using the cpuhp framework, which runs in task context. I.e. on reboot/shutdown, drop_user_return_notifiers() is called asynchronously. Forced reboot/shutdown is the most problematic scenario, as userspace tasks are not frozen before kvm_shutdown() is invoked, i.e. KVM could be actively manipulating the user-return MSR lists and/or notifiers when the IPI arrives. To a certain extent, all bets are off when userspace forces a reboot/shutdown, but KVM should at least avoid a use-after-free, e.g. to avoid crashing the kernel when trying to reboot. Link: https://patch.msgid.link/20251030191528.3380553-3-seanjc@google.com Signed-off-by: Sean Christopherson commit c0711f8c610e1634ed54fb04da1e82252730306a Author: Sean Christopherson Date: Thu Oct 30 12:15:25 2025 -0700 KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module Set all user-return MSRs to their post-TD-exit value when preparing to run a TDX vCPU to ensure the value that KVM expects to be loaded after running the vCPU is indeed the value that's loaded in hardware. If the TDX-Module doesn't actually enter the guest, i.e. doesn't do VM-Enter, then it won't "restore" VMM state, i.e. won't clobber user-return MSRs to their expected post-run values, in which case simply updating KVM's "cached" value will effectively corrupt the cache due to hardware still holding the original value. In theory, KVM could conditionally update the current user-return value if and only if tdh_vp_enter() succeeds, but in practice "success" doesn't guarantee the TDX-Module actually entered the guest, e.g. if the TDX-Module synthesizes an EPT Violation because it suspects a zero-step attack. Force-load the expected values instead of trying to decipher whether or not the TDX-Module restored/clobbered MSRs, as the risk doesn't justify the benefits. Effectively avoiding four WRMSRs once per run loop (even if the vCPU is scheduled out, user-return MSRs only need to be reloaded if the CPU exits to userspace or runs a non-TDX vCPU) is likely in the noise when amortized over all entries, given the cost of running a TDX vCPU. E.g. the cost of the WRMSRs is somewhere between ~300 and ~500 cycles, whereas the cost of a _single_ roundtrip to/from a TDX guest is thousands of cycles. Fixes: e0b4f31a3c65 ("KVM: TDX: restore user ret MSRs") Cc: stable@vger.kernel.org Cc: Yan Zhao Cc: Xiaoyao Li Cc: Rick Edgecombe Reviewed-by: Xiaoyao Li Link: https://patch.msgid.link/20251030191528.3380553-2-seanjc@google.com Signed-off-by: Sean Christopherson commit ab4e41eb9fabd4607304fa7cfe8ec9c0bd8e1552 Author: Maxim Levitsky Date: Tue Oct 14 23:32:58 2025 -0400 KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) Fix an interaction between SMM and PV asynchronous #PFs where an #SMI can cause KVM to drop an async #PF ready event, and thus result in guest tasks becoming permanently stuck due to the task that encountered the #PF never being resumed. Specifically, don't clear the completion queue when paging is disabled, and re-check for completed async #PFs if/when paging is enabled. Prior to commit 2635b5c4a0e4 ("KVM: x86: interrupt based APF 'page ready' event delivery"), flushing the APF queue without notifying the guest of completed APF requests when paging is disabled was "necessary", in that delivering a #PF to the guest when paging is disabled would likely confuse and/or crash the guest. And presumably the original async #PF development assumed that a guest would only disable paging when there was no intent to ever re-enable paging. That assumption fails in several scenarios, most visibly on an emulated SMI, as entering SMM always disables CR0.PG (i.e. initially runs with paging disabled). When the SMM handler eventually executes RSM, the interrupted paging-enabled is restored, and the async #PF event is lost. Similarly, invoking firmware, e.g. via EFI runtime calls, might require a transition through paging modes and thus also disable paging with valid entries in the competion queue. To avoid dropping completion events, drop the "clear" entirely, and handle paging-enable transitions in the same way KVM already handles APIC enable/disable events: if a vCPU's APIC is disabled, APF completion events are not kept pending and not injected while APIC is disabled. Once a vCPU's APIC is re-enabled, KVM raises KVM_REQ_APF_READY so that the vCPU recognizes any pending pending #APF ready events. Signed-off-by: Maxim Levitsky Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251015033258.50974-4-mlevitsk@redhat.com [sean: rework changelog to call out #PF injection, drop "real mode" references, expand the code comment] Signed-off-by: Sean Christopherson commit 68c35f89d016dd0ebcc4a0298e63aa7981fca9e0 Author: Maxim Levitsky Date: Tue Oct 14 23:32:57 2025 -0400 KVM: x86: Fix a semi theoretical bug in kvm_arch_async_page_present_queued() Fix a semi theoretical race condition related to a lack of memory barriers when dealing with vcpu->arch.apf.pageready_pending. In theory, the "ready" side could see a stale pageready_pending and neglect to kick the vCPU, and thus allow the vCPU to enter the guest with a pending KVM_REQ_APF_READY and no kick/IPI on the way, in which case the KVM would fail to deliver a completed async #PF event to the guest in a timely manner as the request would be recognized only on the next (coincidental) VM-Exit. kvm_arch_async_page_present_queued() running in workqueue context: kvm_make_request(KVM_REQ_APF_READY, vcpu); /* memory barrier is missing here*/ if (!vcpu->arch.apf.pageready_pending) kvm_vcpu_kick(vcpu); kvm_set_msr_common() running in task context: vcpu->arch.apf.pageready_pending = false; /* memory barrier is missing here*/ And later, vcpu_enter_guest() running in task context: if (kvm_check_request(KVM_REQ_APF_READY, vcpu)) kvm_check_async_pf_completion(vcpu) Add missing full memory barriers in both cases to avoid theoretical case of not kicking the vCPU thread. Note that the bug is mostly theoretical because kvm_make_request() uses an atomic operation, which is always serializing on x86, requiring only for documentation purposes the smp_mb__after_atomic() after it (smp_mb__after_atomic() is a NOP on x86). The second missing barrier, between kvm_set_msr_common() and vcpu_enter_guest(), isn't strictly needed because KVM executes several barriers in between calling these functions, however it still makes sense to have an explicit barrier to be on the safe side and to document the ordering dependencies. Finally, also use READ_ONCE/WRITE_ONCE. Thanks a lot to Paolo for the help with this patch. Link: https://lore.kernel.org/all/7c7a5a75-a786-4a05-a836-4368582ca4c2@redhat.com Suggested-by: Paolo Bonzini Signed-off-by: Maxim Levitsky Link: https://patch.msgid.link/20251015033258.50974-3-mlevitsk@redhat.com [sean: explain the race and its impact in more detail] Signed-off-by: Sean Christopherson commit a46768ef5f91f2029a67513f43658dfa5451be4a Author: Michal Wajdeczko Date: Thu Nov 6 17:59:32 2025 +0100 drm/xe/tests: Add KUnit tests for PF fair provisioning Add test cases to check outcome of fair GuC context or doorbells IDs allocations for regular and admin-only PF mode. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20251106165932.2143-1-michal.wajdeczko@intel.com commit bfbcf66186b535382f090fa2e55bcaea2123c8a0 Author: Michal Wajdeczko Date: Wed Nov 5 19:32:51 2025 +0100 drm/xe/pf: Use migration-friendly doorbells auto-provisioning Instead of trying very hard to find the largest fair number of GuC doorbell IDs that could be allocated for VFs on the current GT, pick some smaller rounded down to power-of-two value that is more likely to be provisioned in the same manner by the other PF instance: num VFs | num doorbells --------+-------------- 63..32 | 4 31..16 | 8 15..8 | 16 7..4 | 32 3..2 | 64 1 | 128 (regular PF) 1 | 240 (admin only PF) Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20251105183253.863-3-michal.wajdeczko@intel.com commit 8fb1d7d3cf643d62fd84eca225562467c1e9b770 Author: Michal Wajdeczko Date: Wed Nov 5 19:32:50 2025 +0100 drm/xe/pf: Use migration-friendly context IDs auto-provisioning Instead of trying very hard to find the largest fair number of GuC context IDs that could be allocated for VFs on the current GT, pick some smaller rounded down to power-of-two value that is more likely to be provisioned in the same manner by the other PF instance: num VFs | num contexts --------+------------- 63..32 | 1024 31..16 | 2048 15..8 | 4096 7..4 | 8192 3..2 | 16384 1 | 32768 (regular PF) 1 | 64512 (admin only PF) Add also helper function to determine if the PF is admin-only, and for now use .probe_display flag for that. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://patch.msgid.link/20251105183253.863-2-michal.wajdeczko@intel.com commit d5230cd5c493323442ae9521833361d73cb3771f Author: Ville Syrjälä Date: Thu Nov 6 17:20:49 2025 +0200 drm/i915/pmdemand: Use the default 2 usec fast polling timeout For whatever unknown reason the pmdemand code is using a custom 50 usec fast polling timeout instead of the normal 2 usec value. Switch to the standard value to get rid of the special case. The eventual aim is to get rid of the fast vs. slow timeout entirely and switch over to poll_timeout_us(). Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-11-ville.syrjala@linux.intel.com commit 308fabf3c3104902f6b17ebcd2e783ce21a5bea5 Author: Ville Syrjälä Date: Thu Nov 6 17:20:48 2025 +0200 drm/i915/hdcp: Use the default 2 usec fast polling timeout For whatever unknown reason the HDCP code is using a custom 10 usec fast polling timeout instead of the normal 2 usec value. Switch to the standard value to get rid of the special case. The eventual aim is to get rid of the fast vs. slow timeout entirely and switch over to poll_timeout_us(). Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-10-ville.syrjala@linux.intel.com commit 177deeea4db7fb1361c0846450a8bfb9814caece Author: Ville Syrjälä Date: Thu Nov 6 17:20:47 2025 +0200 drm/i915/ltphy: Nuke bogus weird timeouts The LT PHY code is abusing intel_de_wait_custom() in all kinds of weird ways. Get rid of the weird fast timeouts, and just use the slow ones. For consistency with intel_wait_for_register() we'll stick to the default 2 usec fast timeout for all cases. Someone really needs to properly document where all these magic numbers came from... This will let us eventually nuke intel_de_wait_custom() and convert over to poll_timeout_us(). v2: Go for the longer (ms) timeout in case it actually matters Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-9-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit d4270f090d90a3a5b974e7efdefeec2fe6a41232 Author: Ville Syrjälä Date: Thu Nov 6 17:52:49 2025 +0200 drm/i915/cx0: s/XELPDP_PORT_RESET_END_TIMEOUT/XELPDP_PORT_RESET_END_TIMEOUT_MS/ Include the units the in the define name for XELPDP_PORT_RESET_END_TIMEOUT to make it match all its other counterparts. v2: It's _MS not _US (Jani) Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106155249.2810-1-ville.syrjala@linux.intel.com commit 2d41de2565ef485c31bebef15b8661b177991016 Author: Ville Syrjälä Date: Thu Nov 6 17:20:45 2025 +0200 drm/i915/cx0: s/XELPDP_MSGBUS_TIMEOUT_SLOW/XELPDP_MSGBUS_TIMEOUT_MS/ The slow vs. fast timeout stuff is really just an implementation detail. Let's not spread that terminology in random timeout defines. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-7-ville.syrjala@linux.intel.com commit e92ef446cb4c2877b75e2afacf4de6d785660f74 Author: Ville Syrjälä Date: Thu Nov 6 17:20:44 2025 +0200 drm/i915/cx0: Get rid of XELPDP_MSGBUS_TIMEOUT_FAST_US XELPDP_MSGBUS_TIMEOUT_FAST_US looks to be just an obfuscated version of the default 2 microsecond fast timeout used by intel_wait_for_register(). Get rid of it to make it clear what's going on here. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-6-ville.syrjala@linux.intel.com commit 50101556349d9bd0128e65a852d338aca09d6f9b Author: Ville Syrjälä Date: Thu Nov 6 17:20:43 2025 +0200 drm/i915/cx0: Replace XELPDP_PORT_POWERDOWN_UPDATE_TIMEOUT_US with XELPDP_PORT_POWERDOWN_UPDATE_TIMEOUT_MS There was a completely unjustified change to the cx0 powerdown timeout, and the way it was done now prevents future conversion to poll_timeout_us(). Assuming there was some reason the bigger timeout let's nuke the old short timeout (XELPDP_PORT_POWERDOWN_UPDATE_TIMEOUT_US) nd replace it with the bigger timeout (XELPDP_PORT_POWERDOWN_UPDATE_TIMEOUT_MS). For consistency with intel_wait_for_register() we'll stick to the default 2 usec for the fast timeout. v2: Go for the longer (ms) timeout in case it actually matters v3: Note the defaullt 2 usec fast timeout (Jani) Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit dfd58249ff4df474c7c61671dc66fcb917215619 Author: Ville Syrjälä Date: Thu Nov 6 17:20:42 2025 +0200 drm/i915/ltphy: Nuke extraneous timeout debugs The actual timeout used isn't particularly interesting, so don't print it. Makes the code simpler. The debugs are also using some random capitalizaton rule. Clean that up a bit while at it. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit df17e6bc55e7a0c6448c43245a3994b577a99e25 Author: Ville Syrjälä Date: Thu Nov 6 17:20:40 2025 +0200 drm/i915/cx0: Nuke extraneous timeout debugs The actual timeout used isn't particularly interesting, so don't print it. Makes the code simpler. The debugs are also using some random capitalizaton rule. Clean that up a bit while at it. Also intel_cx0_powerdown_change_sequence() used one timeout in the actual code but printed a different one. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251106152049.21115-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit a2b0c33e9423cd06133304e2f81c713849059b10 Author: Zack McKevitt Date: Fri Oct 31 12:25:12 2025 -0700 accel/qaic: Add qaic_ prefix to irq_polling_work Rename irq_polling_work to qaic_irq_polling_work to reduce ambiguity and avoid potential naming conflicts in the future. Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031192511.3179130-1-zachary.mckevitt@oss.qualcomm.com commit 6bc1fe6c748caaf926eaf14c8a262f4c65aead9f Author: Pranjal Ramajor Asha Kanojiya Date: Fri Oct 31 10:41:04 2025 -0700 accel/qaic: Collect crashdump from SSR channel After subsystem of the device has crashed it sends a message with command DEBUG_TRANSFER_INFO to kernel(host). Send ACK for that message and then prepare to collect the ramdump of the subsystem Steps of crashdump collection is as follows, 1) Device sends DEBUG_TRANSFER_INFO message indicating that device wants to send crashdump. 2) Send an acknowledgment to that message either ACK or NACK. a) NACK will inform the device that host will not download the crashdump b) ACK will inform the device that host will download the crashdump 3) Along with the DEBUG_TRANSFER_INFO we receive a table base address and its length, use that to download that table from device. a) This table is meta data of the crashdump and not the actual crashdump. 4) After we respond as ACK for message received on step 1) we start downloading the table. Use series of MEMORY_READ/MEMORY_READ_RSP SSR commands to download the entire table. 5) Each entry in the table represents a segment of crashdump. Once the table downloading is complete, iterate through each entry of table and download each crashdump segment(same as table itself). Table entry contains the memory base address and length along with other info. 6) After the entire crashdump is downloaded send DEBUG_TRANSFER_DONE which marks that host is terminating the crashdump transfer. This message can be send in both success or error case. 7) After receiving DEBUG_TRANSFER_DONE_RSP hand over the crashdump to dev_coredumpv() and free all the necessary memory. Co-developed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Co-developed-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-4-zachary.mckevitt@oss.qualcomm.com commit 9675093acea04c7b51ac3a646c7d0ba376b000d6 Author: Jeff Hugo Date: Fri Oct 31 10:41:02 2025 -0700 accel/qaic: Implement basic SSR handling Subsystem restart (SSR) for a qaic device means that a NSP has crashed, and will be restarted. However the restart process will lose any state associated with activation, so the user will need to do some recovery. While SSR has the provision to collect a crash dump, this patch does not implement support for it. Co-developed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Co-developed-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Pranjal Ramajor Asha Kanojiya Co-developed-by: Troy Hanson Signed-off-by: Troy Hanson Co-developed-by: Aswin Venkatesan Signed-off-by: Aswin Venkatesan Signed-off-by: Jeffrey Hugo Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo [jhugo: Fix minor checkpatch whitespace issues] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-3-zachary.mckevitt@oss.qualcomm.com commit f286066ed9df38637eb6c12fb2856f1e0b9731d4 Author: Pranjal Ramajor Asha Kanojiya Date: Fri Oct 31 10:41:00 2025 -0700 accel/qaic: Add DMA Bridge Channel(DBC) sysfs and uevents Expose sysfs files for each DBC representing the current state of that DBC. For example, sysfs for DBC ID 0 and accel minor number 0 looks like this, /sys/class/accel/accel0/dbc0_state Following are the states and their corresponding values, DBC_STATE_IDLE (0) DBC_STATE_ASSIGNED (1) DBC_STATE_BEFORE_SHUTDOWN (2) DBC_STATE_AFTER_SHUTDOWN (3) DBC_STATE_BEFORE_POWER_UP (4) DBC_STATE_AFTER_POWER_UP (5) Signed-off-by: Pranjal Ramajor Asha Kanojiya Signed-off-by: Youssef Samir Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251031174059.2814445-2-zachary.mckevitt@oss.qualcomm.com commit 77ca1612b80154c62d4002a3e303bc2c2999aac7 Author: Huisong Li Date: Wed Nov 5 17:36:47 2025 +0800 ACPI: processor: idle: Drop redundant C-state count checks acpi_processor_setup_cstates() and acpi_processor_setup_cpuidle_cx() are called after successfully obtaining power information. Among other things, these setup functions check the C-state count against zero. However, that check is done by acpi_processor_get_power_info_cst() which will cause acpi_processor_get_power_info() to fail if it does no pass, so the checks in the two functions mentioned above are redundant. Drop those redundant checks. No intentional functional impact. Signed-off-by: Huisong Li [ rjw: Subject and changelog rewrite ] Link: https://patch.msgid.link/20251105093647.3557248-1-lihuisong@huawei.com Signed-off-by: Rafael J. Wysocki commit 2308de27c03d8ed75b28dab2354eb02c5f8e69be Author: Jiucheng Xu Date: Fri Oct 10 10:45:50 2025 +0000 f2fs: Use mapping->gfp_mask to get file cache for writing On 32-bit architectures, when GFP_NOFS is used, the file cache for write operations cannot be allocated from the highmem and CMA. Since mapping->gfp_mask is set to GFP_HIGHUSER_MOVABLE during inode allocation, using mapping_gfp_mask(mapping) as the GFP flag of getting file cache for writing is more efficient for 32-bit architectures. Additionally, use FGP_NOFS to avoid potential deadlock issues caused by GFP_FS in GFP_HIGHUSER_MOVABLE Signed-off-by: Jiucheng Xu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fb1ebb10468da414d57153ddebaab29c38ef1a78 Author: Gabor Juhos Date: Fri Nov 7 18:10:08 2025 +0100 regulator: core: disable supply if enabling main regulator fails For 'always-on' and 'boot-on' regulators, the set_machine_constraints() may enable supply before enabling the main regulator, however if the latter fails, the function returns with an error but the supply remains enabled. When this happens, the regulator_register() function continues on the error path where it puts the supply regulator. Since enabling the supply is not balanced with a disable call, a warning similar to the following gets issued from _regulator_put(): [ 1.603889] WARNING: CPU: 2 PID: 44 at _regulator_put+0x8c/0xa0 [ 1.603908] Modules linked in: [ 1.603926] CPU: 2 UID: 0 PID: 44 Comm: kworker/u16:3 Not tainted 6.18.0-rc4 #0 NONE [ 1.603938] Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT) [ 1.603945] Workqueue: async async_run_entry_fn [ 1.603958] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.603967] pc : _regulator_put+0x8c/0xa0 [ 1.603976] lr : _regulator_put+0x7c/0xa0 ... [ 1.604140] Call trace: [ 1.604145] _regulator_put+0x8c/0xa0 (P) [ 1.604156] regulator_register+0x2ec/0xbf0 [ 1.604166] devm_regulator_register+0x60/0xb0 [ 1.604178] rpm_reg_probe+0x120/0x208 [ 1.604187] platform_probe+0x64/0xa8 ... In order to avoid this, change the set_machine_constraints() function to disable the supply if enabling the main regulator fails. Fixes: 05f224ca6693 ("regulator: core: Clean enabling always-on regulators + their supplies") Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20251107-regulator-disable-supply-v1-1-c95f0536f1b5@gmail.com Signed-off-by: Mark Brown commit 06416555c883e3ffabcc62ad39617c23d6b2f012 Author: Marco Crivellari Date: Fri Nov 7 14:24:43 2025 +0100 HID: nintendo: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Jiri Kosina commit 1750e652a996382a8608ec70167c3719d0556bda Author: Lizhi Hou Date: Thu Nov 6 10:05:21 2025 -0800 accel/amdxdna: Treat power-off failure as unrecoverable error Failing to set power off indicates an unrecoverable hardware or firmware error. Update the driver to treat such a failure as a fatal condition and stop further operations that depend on successful power state transition. This prevents undefined behavior when the hardware remains in an unexpected state after a failed power-off attempt. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251106180521.1095218-1-lizhi.hou@amd.com commit a9ed446c1908b2feb53314951054e9a259342659 Author: Xi Pardee Date: Wed Nov 5 13:50:15 2025 -0800 platform/x86:intel/pmc: Enable SSRAM support for Wildcat Lake Enable Wildcat Lake platforms to achieve PMC information from Intel PMC SSRAM Telemetry driver and substate requirements data from telemetry region. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20251105215020.1984036-2-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit bc977e5de6bedb488b15c055ad169cf32cf3851a Author: Xi Pardee Date: Wed Nov 5 13:50:14 2025 -0800 platform/x86/intel/vsec: Add support for Wildcat Lake Add Wildcat Lake PMT telemetry support. Signed-off-by: Xi Pardee Link: https://patch.msgid.link/20251105215020.1984036-1-xi.pardee@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ed4f9638d905a97cebd49ecea85cc9b706b73761 Author: Julian Stecklina Date: Sat Oct 30 16:21:48 2021 +0200 x86/apic: Fix frequency in apic=verbose log output When apic=verbose is specified, the LAPIC timer calibration prints its results to the console. At least while debugging virtualization code, the CPU and bus frequencies are printed incorrectly. Specifically, for a 1.7 GHz CPU with 1 GHz bus frequency and HZ=1000, the log includes a superfluous 0 after the period: ..... calibration result: 999978 ..... CPU clock speed is 1696.0783 MHz. ..... host bus clock speed is 999.0978 MHz. Looking at the code, this only worked as intended for HZ=100. After the fix, the correct frequency is printed: ..... calibration result: 999828 ..... CPU clock speed is 1696.507 MHz. ..... host bus clock speed is 999.828 MHz. There is no functional change to the LAPIC calibration here, beyond the printing format changes. [ bp: - Massage commit message - Figures it should apply this patch about ~4 years later - Massage it into the current code ] Suggested-by: Markus Napierkowski Signed-off-by: Julian Stecklina Signed-off-by: Borislav Petkov (AMD) Link: https://patch.msgid.link/20211030142148.143261-1-js@alien8.de commit 25976c314f6596254c9b1e2291d94393b7d5ae81 Author: Damien Le Moal Date: Fri Nov 7 15:38:44 2025 +0900 block: introduce bdev_zone_start() Introduce the function bdev_zone_start() as a more explicit (and clear) replacement for ALIGN_DOWN() to get the start sector of a zone containing a particular sector of a zoned block device. Use this new helper in blkdev_get_zone_info() and blkdev_report_zones_cached(). Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit e2b0ec776164c11569ee021fac89596a2642654c Author: Damien Le Moal Date: Fri Nov 7 15:38:43 2025 +0900 block: refactor disk_zone_wplug_sync_wp_offset() The helper function blk_zone_wp_offset() is called from disk_zone_wplug_sync_wp_offset(), and again called from blk_revalidate_seq_zone() right after the call to disk_zone_wplug_sync_wp_offset(). Change disk_zone_wplug_sync_wp_offset() to return the value of obtained with blk_zone_wp_offset() to avoid this double call, which simplifies a little blk_revalidate_seq_zone(). Signed-off-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit bbac6e0fa57f6624123edf20ba8f9b7c0e092117 Author: Damien Le Moal Date: Fri Nov 7 15:38:42 2025 +0900 block: improve blk_zone_wp_offset() blk_zone_wp_offset() is always called with a struct blk_zone obtained from the device, that is, it will never see the BLK_ZONE_COND_ACTIVE condition. However, handling this condition makes this function more solid and will also avoid issues when propagating cached report requests to underlying stacked devices is implemented. Add BLK_ZONE_COND_ACTIVE as a new case in blk_zone_wp_offset() switch. Also while at it, change the handling of the full condition to return UINT_MAX for the zone write pointer to reflect the fact that the write pointer of a full zone is invalid. Signed-off-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit c6934c4e049c8a7f2b7fab620c04bc5dfbd947c1 Author: Jakub Kicinski Date: Tue Nov 4 15:23:44 2025 -0800 netlink: specs: netdev add missing stats to qstat-get Add missing entries in C attribute list. Link: https://patch.msgid.link/20251104232348.1954349-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f85cd99e2c06cf38d97210885f31c8a0405c3341 Author: Ville Syrjälä Date: Thu Oct 16 21:54:08 2025 +0300 drm/i915/gem: s/i915_gem_object_get_frontbuffer/i915_gem_object_frontbuffer_lookup/ The i915_gem_object_get_frontbuffer() name is rather confusing wrt. intel_frontbuffer_get(). Rename to i915_gem_object_frontbuffer_lookup() to make things less confusing. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-11-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 965930962a41cdb24a4b0e1c2f580b20b139bacb Author: Ville Syrjälä Date: Thu Oct 16 21:54:07 2025 +0300 drm/i915/frontbuffer: Fix intel_frontbuffer lifetime handling The current attempted split between xe/i915 vs. display for intel_frontbuffer is a mess: - the i915 rcu leaks through the interface to the display side - the obj->frontbuffer write-side is now protected by a display specific spinlock even though the actual obj->framebuffer pointer lives in a i915 specific structure - the kref is getting poked directly from both sides - i915_active is still on the display side Clean up the mess by moving everything about the frontbuffer lifetime management to the i915/xe side: - the rcu usage is now completely contained in i915 - frontbuffer_lock is moved into i915 - kref is on the i915/xe side (xe needs the refcount as well due to intel_frontbuffer_queue_flush()->intel_frontbuffer_ref()) - the bo (and its refcounting) is no longer on the display side - i915_active is contained in i915 I was pondering whether we could do this in some kind of smaller steps, and perhaps we could, but it would probably have to start with a bunch of reverts (which for sure won't go cleanly anymore). So not convinced it's worth the hassle. Acked-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-10-ville.syrjala@linux.intel.com commit 8f1ddb0251452c9de35a96ac5f7c4f5e87a37266 Author: Ville Syrjälä Date: Thu Oct 16 21:54:06 2025 +0300 drm/i915/frontbuffer: Add intel_frontbuffer::display After upcoming intel_frontbuffer lifetime related changes we won't need intel_frontbuffer::obj for anything apart from getting at the display. Add a direct pointer for that instead so that the obj pointer can be completely eliminated. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-9-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit bc2e56fa093c31489dac85f5a6ad460407bb1466 Author: Ville Syrjälä Date: Thu Oct 16 21:54:05 2025 +0300 drm/i915/frontbuffer: Extract intel_frontbuffer_ref() I want to hide the kref from the high level frontbuffer code. To that end abstract the kref_get() in intel_frontbuffer_queue_flush() (which is the only high level function that needs this) as a new intel_frontbuffer_ref(). Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-8-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 3afef438eee38947ba7e8bb9b23d56d77c25f14b Author: Ville Syrjälä Date: Thu Oct 16 21:54:04 2025 +0300 drm/i915/frontbuffer: Split fb_tracking.lock into two Our fb_tracking.lock is serving a double duty: - protects fb_tracking.busy_bits - provides the write-side protection for obj->frontbuffer Split obj->frontbuffer role into a separate lock so that we can clean up the current mess with the frontbuffer lifetime management. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-7-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 65417489541fcef7f14104f3a0292e479f08f72b Author: Ville Syrjälä Date: Thu Oct 16 21:54:03 2025 +0300 drm/i915/frontbuffer: Handle the dirtyfb cache flush inside intel_frontbuffer_flush() intel_bo_frontbuffer_flush_for_display() is a bit too low level to be directly in the high level dirtyfb code. Move the calls into intel_frontbuffer_flush(). There is a slight behavioural change here in that we now skip the flush if the bo is not a current scanout buffer (front->bits == 0). But that is fine as the flush will eventually happen via the fb pinning code if/when the bo becomes a scanout buffer again. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-6-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 5391ab2542fde3c283fa647255e1f320044a2755 Author: Ville Syrjälä Date: Thu Oct 16 21:54:02 2025 +0300 drm/i915/frontbuffer: Turn intel_bo_flush_if_display() into a frontbuffer operation Convert intel_bo_flush_if_display() to be an operation on the frontbuffer object rather than the underlying gem bo. This will help with cleaning up the frontbuffer xe/i915 vs. display split. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-5-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 739e1a79519b146f849452f32c44b441390adf64 Author: Ville Syrjälä Date: Thu Oct 16 21:54:01 2025 +0300 drm/i915/frontbuffer: Nuke intel_frontbuffer_flip_{prepare,complete}() Get rid of intel_frontbuffer_flip_{prepare,complete}() (and the accompanying flip_bits) since they are unused. I suppose these could technically provide a minor optimization over intel_frontbuffer_flip() in that the flush would get deferred further if new rendering were to sneak in between the prepare() and complete() calls. But for correctness it should not make any difference since another flush will anyway follow once the new rendering finishes. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit fcef1a9dcf1a79104c5688015d90fd9f9c195a93 Author: Ville Syrjälä Date: Thu Oct 16 21:54:00 2025 +0300 drm/i915/overlay: Switch to intel_frontbuffer_flip() Get rid of intel_frontbuffer_flip_{prepare,complete}() from the overlay code and just use intel_frontbuffer_flip() instead. The only difference between these are the light interactions with the ORIGIN_CS busyness tracking, but since the only user of this is the overlay/xf86-video-intel/Xv the buffer will always be filled by the CPU and thus we'll never see any ORIGIN_CS frontbuffer activity there anyway. Also I don't think we actually have anything covered by the frontbuffer tracking that affects the overlay (FBC is on the primary plane, DRRS isn't currently enabled on the platforms with overlay, and PSR doesn't exist in the hardware). Acked-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-3-ville.syrjala@linux.intel.com commit 6d2ccd2f1c4ee50ffa4eb98e2b694c758a330225 Author: Ville Syrjälä Date: Thu Oct 16 21:53:59 2025 +0300 drm/i915/overlay: Drop the DIRTYFB flush I don't even know why we have this DIRTYFB flush in the overlay code. We'll anyway call intel_frontbuffer_flip() so there should be no need to pretend that this is some kind of frontbuffer only rendering operation. Acked-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20251016185408.22735-2-ville.syrjala@linux.intel.com commit 39ce15a48f6730c8e53cc8fd0f63995a5e4bb239 Author: Mario Limonciello (AMD) Date: Thu Nov 6 08:25:10 2025 -0600 Documentation: power: Correct a mistaken configuration option Somehow CONFIG_PSTORE_FIRMWARE ended up in this document when I intended it to be CONFIG_CHROMEOS_PSTORE. Correct the configuration option and make it clear that not all options are required. Fixes: b1f02f005a2e ("Documentation: power: Add document on debugging shutdown hangs") Reported-by: Rodrigo Siqueira Signed-off-by: Mario Limonciello (AMD) [ rjw: Fixes: tag ] Link: https://patch.msgid.link/20251106142524.3841343-1-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit acd9ea1714bbe910753bf6f3ce0e861a7fed6b56 Author: Bagas Sanjaya Date: Wed Nov 5 19:47:08 2025 +0700 Documentation: btt: Unwrap bit 31-30 nested table Bit 31-30 usage table is already formatted as reST simple table, but it is wrapped in literal code block instead. Unwrap it. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20251105124707.44736-2-bagasdotme@gmail.com Signed-off-by: Ira Weiny commit 9ad648017b1813a05c4ce899e5e454ec3adb1dfe Author: Joerg Roedel Date: Fri Nov 7 11:47:01 2025 +0100 iommu/iommupt: Fix build error in genericpt unit-tests Fix the include of iommu-pages.h in the KUnit tests for the IOMMU generic page-table code to make the tests compile again. Reported-by: Thorsten Leemhuis Closes: https://lore.kernel.org/all/9844d4cb-f517-478b-9911-b6dc1a963b8e@leemhuis.info/ Reported-by: "Longia, Amandeep Kaur" Closes: https://lore.kernel.org/all/e641c955-25ad-4eae-b3fe-4392966cf768@amd.com/ Fixes: 1dd4187f53c3 ("iommupt: Add a kunit test for Generic Page Table") Reviewed-by: Jason Gunthorpe Tested-by: Thorsten Leemhuis Signed-off-by: Joerg Roedel commit 453a73000c56d2ee21f327c0a2a3249aa359bcc9 Author: Daniel del Castillo Date: Tue Nov 4 20:37:51 2025 +0100 Documentation: nova: Update the todo list This small patch updates the nova todo list to remove some tasks that have been solved lately: * COHA is solved in this patch series * TRSM was solved recently [1] [1] https://lore.kernel.org/rust-for-linux/DCEJ9SV4LBJL.11EUZVXX6EB9H@nvidia.com/ Signed-off-by: Daniel del Castillo [acourbot@nvidia.com: set prefix to "Documentation: nova:".] Signed-off-by: Alexandre Courbot Message-ID: <20251104193756.57726-4-delcastillodelarosadaniel@gmail.com> commit 3577e265e4bdb09441941a52c1bf9dfd1e27d707 Author: Daniel del Castillo Date: Tue Nov 4 20:37:50 2025 +0100 gpu: nova-core: Simplify `DmaObject::from_data` in nova-core/dma.rs This patch solves one of the existing mentions of COHA, a task in the Nova task list about improving the `CoherentAllocation` API. It uses the `write` method from `CoherentAllocation`. Signed-off-by: Daniel del Castillo [acourbot@nvidia.com: set prefix to "gpu: nova-core:".] Signed-off-by: Alexandre Courbot Message-ID: <20251104193756.57726-3-delcastillodelarosadaniel@gmail.com> commit 571ce401a78ee9cb5992b74d36df1b6a8ffd4b16 Author: Daniel del Castillo Date: Tue Nov 4 20:37:49 2025 +0100 gpu: nova-core: Fix capitalization of some comments Some comments that already existed didn't start with a capital letter, this patch fixes that. Signed-off-by: Daniel del Castillo [acourbot@nvidia.com: set prefix to "gpu: nova-core:".] Signed-off-by: Alexandre Courbot Message-ID: <20251104193756.57726-2-delcastillodelarosadaniel@gmail.com> commit 473f778592e499c0dd0e1dd9fce8eb80923355d9 Author: Daniel del Castillo Date: Tue Nov 4 20:37:48 2025 +0100 gpu: nova-core: Simplify `transmute` and `transmute_mut` in fwsec.rs This patch solves one of the existing mentions of COHA, a task in the Nova task list about improving the `CoherentAllocation` API. It uses the new `from_bytes` method from the `FromBytes` trait as well as the `as_slice` and `as_slice_mut` methods from `CoherentAllocation`. Signed-off-by: Daniel del Castillo [acourbot@nvidia.com: set prefix to "gpu: nova-core:".] [acourbot@nvidia.com: fix merge conflict after imports refactor.] Signed-off-by: Alexandre Courbot Message-ID: <20251104193756.57726-1-delcastillodelarosadaniel@gmail.com> commit 173c99b85aa05387fcfb3231293124c5d611d167 Author: John Hubbard Date: Thu Nov 6 18:10:06 2025 -0800 gpu: nova-core: apply the one "use" item per line policy As per [1], we need one "use" item per line, in order to reduce merge conflicts. Furthermore, we need a trailing ", //" in order to tell rustfmt(1) to leave it alone. This does that for the entire nova-core driver. [1] https://docs.kernel.org/rust/coding-guidelines.html#imports Acked-by: Danilo Krummrich Signed-off-by: John Hubbard [acourbot@nvidia.com: remove imports already in prelude as pointed out by Danilo.] [acourbot@nvidia.com: remove a few unneeded trailing `//`.] Signed-off-by: Alexandre Courbot Message-ID: <20251107021006.434109-1-jhubbard@nvidia.com> commit 2093d8cf80fa5552d1025a78a8f3a10bf3b6466e Author: Peter Zijlstra Date: Fri Nov 7 14:50:20 2025 +0100 perf/x86/intel: Optimize PEBS extended config Similar to enable_acr_event, avoid the branch. Signed-off-by: Peter Zijlstra (Intel) commit 02da693f6658b9f73b97fce3695358ef3f13d0d1 Author: Peter Zijlstra Date: Fri Nov 7 14:50:16 2025 +0100 perf/x86/intel: Check PEBS dyn_constraints Handle the interaction between ("perf/x86/intel: Update dyn_constraint base on PEBS event precise level") and ("perf/x86/intel: Add a check for dynamic constraints"). Signed-off-by: Peter Zijlstra (Intel) commit bd24f9beed591422f45fa6d8d0d3bd3a755b8a48 Author: Kan Liang Date: Mon May 12 10:55:42 2025 -0700 perf/x86/intel: Add a check for dynamic constraints The current event scheduler has a limit. If the counter constraint of an event is not a subset of any other counter constraint with an equal or higher weight. The counters may not be fully utilized. To workaround it, the commit bc1738f6ee83 ("perf, x86: Fix event scheduler for constraints with overlapping counters") introduced an overlap flag, which is hardcoded to the event constraint that may trigger the limit. It only works for static constraints. Many features on and after Intel PMON v6 require dynamic constraints. An event constraint is decided by both static and dynamic constraints at runtime. See commit 4dfe3232cc04 ("perf/x86: Add dynamic constraint"). The dynamic constraints are from CPUID enumeration. It's impossible to hardcode it in advance. It's not practical to set the overlap flag to all events. It's harmful to the scheduler. For the existing Intel platforms, the dynamic constraints don't trigger the limit. A real fix is not required. However, for virtualization, VMM may give a weird CPUID enumeration to a guest. It's impossible to indicate what the weird enumeration is. A check is introduced, which can list the possible breaks if a weird enumeration is used. Check the dynamic constraints enumerated for normal, branch counters logging, and auto-counter reload. Check both PEBS and non-PEBS constratins. Closes: https://lore.kernel.org/lkml/20250416195610.GC38216@noisy.programming.kicks-ass.net/ Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20250512175542.2000708-1-kan.liang@linux.intel.com commit bb5f13df3c455110c4468a31a5b21954268108c9 Author: Dapeng Mi Date: Wed Oct 29 18:21:36 2025 +0800 perf/x86/intel: Add counter group support for arch-PEBS Base on previous adaptive PEBS counter snapshot support, add counter group support for architectural PEBS. Since arch-PEBS shares same counter group layout with adaptive PEBS, directly reuse __setup_pebs_counter_group() helper to process arch-PEBS counter group. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-13-dapeng1.mi@linux.intel.com commit 52448a0a739002eca3d051a6ec314a0b178949a1 Author: Dapeng Mi Date: Wed Oct 29 18:21:35 2025 +0800 perf/x86/intel: Setup PEBS data configuration and enable legacy groups Different with legacy PEBS, arch-PEBS provides per-counter PEBS data configuration by programing MSR IA32_PMC_GPx/FXx_CFG_C MSRs. This patch obtains PEBS data configuration from event attribute and then writes the PEBS data configuration to MSR IA32_PMC_GPx/FXx_CFG_C and enable corresponding PEBS groups. Please notice this patch only enables XMM SIMD regs sampling for arch-PEBS, the other SIMD regs (OPMASK/YMM/ZMM) sampling on arch-PEBS would be supported after PMI based SIMD regs (OPMASK/YMM/ZMM) sampling is supported. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-12-dapeng1.mi@linux.intel.com commit e89c5d1f290e8915e0aad10014f2241086ea95e4 Author: Dapeng Mi Date: Wed Oct 29 18:21:34 2025 +0800 perf/x86/intel: Update dyn_constraint base on PEBS event precise level arch-PEBS provides CPUIDs to enumerate which counters support PEBS sampling and precise distribution PEBS sampling. Thus PEBS constraints should be dynamically configured base on these counter and precise distribution bitmap instead of defining them statically. Update event dyn_constraint base on PEBS event precise level. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-11-dapeng1.mi@linux.intel.com commit 2721e8da2de7271533ac36285332219f700d16ca Author: Dapeng Mi Date: Wed Oct 29 18:21:33 2025 +0800 perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR Arch-PEBS introduces a new MSR IA32_PEBS_BASE to store the arch-PEBS buffer physical address. This patch allocates arch-PEBS buffer and then initialize IA32_PEBS_BASE MSR with the buffer physical address. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-10-dapeng1.mi@linux.intel.com commit d21954c8a0ffbc94ffdd65106fb6da5b59042e0a Author: Dapeng Mi Date: Wed Oct 29 18:21:32 2025 +0800 perf/x86/intel: Process arch-PEBS records or record fragments A significant difference with adaptive PEBS is that arch-PEBS record supports fragments which means an arch-PEBS record could be split into several independent fragments which have its own arch-PEBS header in each fragment. This patch defines architectural PEBS record layout structures and add helpers to process arch-PEBS records or fragments. Only legacy PEBS groups like basic, GPR, XMM and LBR groups are supported in this patch, the new added YMM/ZMM/OPMASK vector registers capturing would be supported in the future. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-9-dapeng1.mi@linux.intel.com commit 167cde7dc9b36b7a88f3c29d836fabce13023327 Author: Dapeng Mi Date: Wed Oct 29 18:21:31 2025 +0800 perf/x86/intel/ds: Factor out PEBS group processing code to functions Adaptive PEBS and arch-PEBS share lots of same code to process these PEBS groups, like basic, GPR and meminfo groups. Extract these shared code to generic functions to avoid duplicated code. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-8-dapeng1.mi@linux.intel.com commit 8807d922705f0a137d8de5f636b50e7b4fbef155 Author: Dapeng Mi Date: Wed Oct 29 18:21:30 2025 +0800 perf/x86/intel/ds: Factor out PEBS record processing code to functions Beside some PEBS record layout difference, arch-PEBS can share most of PEBS record processing code with adaptive PEBS. Thus, factor out these common processing code to independent inline functions, so they can be reused by subsequent arch-PEBS handler. Suggested-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-7-dapeng1.mi@linux.intel.com commit d243d0bb64af1e90ec18ac2fa6e7cadfe8895913 Author: Dapeng Mi Date: Wed Oct 29 18:21:29 2025 +0800 perf/x86/intel: Initialize architectural PEBS arch-PEBS leverages CPUID.23H.4/5 sub-leaves enumerate arch-PEBS supported capabilities and counters bitmap. This patch parses these 2 sub-leaves and initializes arch-PEBS capabilities and corresponding structures. Since IA32_PEBS_ENABLE and MSR_PEBS_DATA_CFG MSRs are no longer existed for arch-PEBS, arch-PEBS doesn't need to manipulate these MSRs. Thus add a simple pair of __intel_pmu_pebs_enable/disable() callbacks for arch-PEBS. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-6-dapeng1.mi@linux.intel.com commit 5e4e355ae7cdeb0fef5dbe908866e1f895abfacc Author: Dapeng Mi Date: Wed Oct 29 18:21:28 2025 +0800 perf/x86/intel: Correct large PEBS flag check current large PEBS flag check only checks if sample_regs_user contains unsupported GPRs but doesn't check if sample_regs_intr contains unsupported GPRs. Of course, currently PEBS HW supports to sample all perf supported GPRs, the missed check doesn't cause real issue. But it won't be true any more after the subsequent patches support to sample SSP register. SSP sampling is not supported by adaptive PEBS HW and it would be supported until arch-PEBS HW. So correct this issue. Fixes: a47ba4d77e12 ("perf/x86: Enable free running PEBS for REGS_USER/INTR") Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-5-dapeng1.mi@linux.intel.com commit ee98b8bfc7c4baca69a6852c4ecc399794f7e53b Author: Dapeng Mi Date: Wed Oct 29 18:21:27 2025 +0800 perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call Use x86_pmu_drain_pebs static call to replace calling x86_pmu.drain_pebs function pointer. Suggested-by: Peter Zijlstra Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-4-dapeng1.mi@linux.intel.com commit 7e772a93eb61cb6265bdd1c5bde17d0f2718b452 Author: Dapeng Mi Date: Wed Oct 29 18:21:26 2025 +0800 perf/x86: Fix NULL event access and potential PEBS record loss When intel_pmu_drain_pebs_icl() is called to drain PEBS records, the perf_event_overflow() could be called to process the last PEBS record. While perf_event_overflow() could trigger the interrupt throttle and stop all events of the group, like what the below call-chain shows. perf_event_overflow() -> __perf_event_overflow() ->__perf_event_account_interrupt() -> perf_event_throttle_group() -> perf_event_throttle() -> event->pmu->stop() -> x86_pmu_stop() The side effect of stopping the events is that all corresponding event pointers in cpuc->events[] array are cleared to NULL. Assume there are two PEBS events (event a and event b) in a group. When intel_pmu_drain_pebs_icl() calls perf_event_overflow() to process the last PEBS record of PEBS event a, interrupt throttle is triggered and all pointers of event a and event b are cleared to NULL. Then intel_pmu_drain_pebs_icl() tries to process the last PEBS record of event b and encounters NULL pointer access. To avoid this issue, move cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del(). It's safe since cpuc->active_mask or cpuc->pebs_enabled is always checked before access the event pointer from cpuc->events[]. Closes: https://lore.kernel.org/oe-lkp/202507042103.a15d2923-lkp@intel.com Fixes: 9734e25fbf5a ("perf: Fix the throttle logic for a group") Reported-by: kernel test robot Suggested-by: Peter Zijlstra Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-3-dapeng1.mi@linux.intel.com commit c7f69dc073e51f1c448713320ccd2e2be63fb1f6 Author: Dapeng Mi Date: Wed Oct 29 18:21:25 2025 +0800 perf/x86: Remove redundant is_x86_event() prototype 2 is_x86_event() prototypes are defined in perf_event.h. Remove the redundant one. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251029102136.61364-2-dapeng1.mi@linux.intel.com commit 6985defd1d832f1dd9d1977a6a2cc2cef7632704 Author: Charles Keepax Date: Fri Nov 7 10:45:51 2025 +0000 regmap: sdw-mbq: Reorder regmap_mbq_context struct for better packing Avoid a hole in struct regmap_mbq_context by shuffling the members slightly. Pahole before: struct regmap_mbq_context { struct device * dev; /* 0 8 */ struct sdw_slave * sdw; /* 8 8 */ struct regmap_sdw_mbq_cfg cfg; /* 16 32 */ int val_size; /* 48 4 */ /* XXX 4 bytes hole, try to pack */ bool (*readable_reg)(struct device *, unsigned int); /* 56 8 */ /* size: 64, cachelines: 1, members: 5 */ /* sum members: 60, holes: 1, sum holes: 4 */ }; Pahole after: struct regmap_mbq_context { struct device * dev; /* 0 8 */ struct sdw_slave * sdw; /* 8 8 */ bool (*readable_reg)(struct device *, unsigned int); /* 16 8 */ struct regmap_sdw_mbq_cfg cfg; /* 24 32 */ int val_size; /* 56 4 */ /* size: 64, cachelines: 1, members: 5 */ /* padding: 4 */ }; Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20251107104551.1553526-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7ab06ea41af53aa1713186ceaa154179e4b0d4c9 Author: Yicong Yang Date: Wed Nov 5 18:38:49 2025 +0800 arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY The arm_pmu driver is using topology_core_has_smt() for retrieving the SMT implementation which depends on CONFIG_GENERIC_ARCH_TOPOLOGY. The config is optional on arm platforms so provide a !CONFIG_GENERIC_ARCH_TOPOLOGY stub for topology_core_has_smt(). Fixes: c3d78c34ad00 ("perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511041757.vuCGOmFc-lkp@intel.com/ Suggested-by: Will Deacon Signed-off-by: Yicong Yang Reviewed-by: Mark Brown Signed-off-by: Will Deacon commit 2d7a824807015209de4dd58c7ac240c5a276753e Author: Robin Murphy Date: Tue Nov 4 18:29:40 2025 +0000 perf/arm-ni: Fix and optimise register offset calculation LKP points out an operator precedence oversight in the new NoC S3 support that, annoyingly, my local W=1 build didn't flag. In fixing that, we can also take the similarly-missed opportunity to cache the version check itself at event_init time. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202511041749.ok8zDP6u-lkp@intel.com/ Fixes: 8fa08f8835e5 ("perf/arm-ni: Add NoC S3 support") Signed-off-by: Robin Murphy Signed-off-by: Will Deacon commit 204ab51445a72eab2b74165061282c868573f59c Author: Paul E. McKenney Date: Sun Nov 2 14:49:47 2025 -0800 refscale: Do not disable interrupts for tests involving local_bh_enable() Some kernel configurations prohibit invoking local_bh_enable() while interrupts are disabled. However, refscale disables interrupts to reduce OS noise during the tests, which results in splats. This commit therefore adds an ->enable_irqs flag to the ref_scale_ops structure, and refrains from disabling interrupts when that flag is set. This flag is set for the "bh" and "incpercpubh" scale_type module-parameter values. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 448b66a7aaf33cf52dc47dd7807652ce827e8dfd Author: Paul E. McKenney Date: Sun Nov 2 14:49:46 2025 -0800 refscale: Add non-atomic per-CPU increment readers This commit adds refscale readers based on READ_ONCE() and WRITE_ONCE() that are unprotected (can lose counts, "refscale.scale_type=incpercpu"), preempt-disabled ("refscale.scale_type=incpercpupreempt"), bh-disabled ("refscale.scale_type=incpercpubh"), and irq-disabled ("refscale.scale_type=incpercpuirqsave"). On my x86 laptop, these are about 4.3ns, 3.8ns, and 7.3ns per pair, respectively. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit bdba8330ad705ae0e08150892fb1e2de48406630 Author: Paul E. McKenney Date: Sun Nov 2 14:49:45 2025 -0800 refscale: Add this_cpu_inc() readers This commit adds refscale readers based on this_cpu_inc() and this_cpu_inc() ("refscale.scale_type=percpuinc"). On my x86 laptop, these are about 4.5ns per pair. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 057df3eaca289365e28f413d1f30c63819719076 Author: Paul E. McKenney Date: Sun Nov 2 14:49:44 2025 -0800 refscale: Add preempt_disable() readers This commit adds refscale readers based on preempt_disable() and preempt_enable() ("refscale.scale_type=preempt"). On my x86 laptop, these are about 2.8ns. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 78a731cefce65a9aa56ec5ee57347672b9aa9119 Author: Paul E. McKenney Date: Sun Nov 2 14:49:43 2025 -0800 refscale: Add local_bh_disable() readers This commit adds refscale readers based on local_bh_disable() and local_bh_enable() ("refscale.scale_type=bh"). On my x86 laptop, these are about 4.9ns. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit edd6f78b75fb4b2db4de035e7a19e2445dea9747 Author: Paul E. McKenney Date: Sun Nov 2 14:49:42 2025 -0800 refscale: Add local_irq_disable() and local_irq_save() readers This commit adds refscale readers based on local_irq_disable() and local_irq_enable() ("refscale.scale_type=irq") and on local_irq_save() and local_irq_restore ("refscale.scale_type=irqsave"). On my x86 laptop, these are about 2.8ns and 7.5ns per enable/disable pair, respectively. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 2750f6765d6974f7e163c5d540a96c8703f6d8dd Author: Jani Nikula Date: Thu Nov 6 22:00:00 2025 +0200 drm/i915/psr: fix pipe to vblank conversion First, we can't assume pipe == crtc index. If a pipe is fused off in between, it no longer holds. intel_crtc_for_pipe() is the only proper way to get from a pipe to the corresponding crtc. Second, drivers aren't supposed to access or index drm->vblank[] directly. There's drm_crtc_vblank_crtc() for this. Use both functions to fix the pipe to vblank conversion. Fixes: f02658c46cf7 ("drm/i915/psr: Add mechanism to notify PSR of pipe enable/disable") Cc: Jouni Högander Cc: stable@vger.kernel.org # v6.16+ Reviewed-by: Jouni Högander Link: https://patch.msgid.link/20251106200000.1455164-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit aa5edd1b5ece68aa806b2af6508b4b8006026da0 Author: Jie Gan Date: Fri Nov 7 14:16:39 2025 +0800 coresight: tpdm: remove redundant check for drvdata Remove the redundant check for drvdata data because the drvdata here already has been guarranted to be non-NULL. Signed-off-by: Jie Gan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20251107-fix_tpdm_redundant_check-v1-1-b63468a2dd73@oss.qualcomm.com commit 187de7c212e5fa87779e1026bf949337bca0cdaa Author: John Ogness Date: Mon Oct 27 17:18:03 2025 +0106 printk: nbcon: Allow unsafe write_atomic() for panic There may be console drivers that have not yet figured out a way to implement safe atomic printing (->write_atomic() callback). These drivers could choose to only implement threaded printing (->write_thread() callback), but then it is guaranteed that _no_ output will be printed during panic. Not even attempted. As a result, developers may be tempted to implement unsafe ->write_atomic() callbacks and/or implement some sort of custom deferred printing trickery to try to make it work. This goes against the principle intention of the nbcon API as well as endangers other nbcon drivers that are doing things correctly (safely). As a compromise, allow nbcon drivers to implement unsafe ->write_atomic() callbacks by providing a new console flag CON_NBCON_ATOMIC_UNSAFE. When specified, the ->write_atomic() callback for that console will _only_ be called during the final "hope and pray" flush attempt at the end of a panic: nbcon_atomic_flush_unsafe(). Signed-off-by: John Ogness Link: https://lore.kernel.org/lkml/b2qps3uywhmjaym4mht2wpxul4yqtuuayeoq4iv4k3zf5wdgh3@tocu6c7mj4lt Reviewed-by: Petr Mladek Link: https://lore.kernel.org/all/swdpckuwwlv3uiessmtnf2jwlx3jusw6u7fpk5iggqo4t2vdws@7rpjso4gr7qp/ [1] Link: https://lore.kernel.org/all/20251103-fix_netpoll_aa-v4-1-4cfecdf6da7c@debian.org/ [2] Link: https://patch.msgid.link/20251027161212.334219-2-john.ogness@linutronix.de [pmladek@suse.com: Fix build with rework/nbcon-in-kdb branch.] Signed-off-by: Petr Mladek commit f2b7d6252c674e35e327682ef8e1447f2d8b0d17 Author: Paul E. McKenney Date: Wed Nov 5 12:32:13 2025 -0800 torture: Permit negative kvm.sh --kconfig numberic arguments This commit loosens the kvm.sh script's regular expressions to permit negative-valued Kconfig options, for example: --kconfig CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=-1 Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 37827223f86aa71b267769d5f51ca16b44b45ae5 Author: Paul E. McKenney Date: Wed Nov 5 12:32:12 2025 -0800 srcu: Add SRCU_READ_FLAVOR_FAST_UPDOWN CPP macro This commit adds the SRCU_READ_FLAVOR_FAST_UPDOWN=0x8 macro and adjusts rcutorture to make use of it. In this commit, both SRCU_READ_FLAVOR_FAST=0x4 and the new SRCU_READ_FLAVOR_FAST_UPDOWN test SRCU-fast. When the SRCU-fast-updown is added, the new SRCU_READ_FLAVOR_FAST_UPDOWN macro will test it when passed to the rcutorture.reader_flavor module parameter. The old SRCU_READ_FLAVOR_FAST macro's value changed from 0x8 to 0x4. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit 3ed04e3f0362351a57cb3eda1c504506f2df82b1 Author: Paul E. McKenney Date: Wed Nov 5 12:32:11 2025 -0800 rcu: Mark diagnostic functions as notrace The rcu_lockdep_current_cpu_online(), rcu_read_lock_sched_held(), rcu_read_lock_held(), rcu_read_lock_bh_held(), rcu_read_lock_any_held() are used by tracing-related code paths, so putting traces on them is unlikely to make anyone happy. This commit therefore marks them all "notrace". Reported-by: Leon Hwang Reported-by: Alexei Starovoitov Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 24e3848a2e903fe614fbeef3048fa4fe91e46482 Author: Marco Crivellari Date: Thu Nov 6 12:24:54 2025 +0100 RAS/CEC: Replace use of system_wq with system_percpu_wq Switch to using system_percpu_wq because system_wq is going away as part of a workqueue restructuring. Currently if a user enqueues a work item using schedule_delayed_work() the used workqueue is "system_wq" (per-cpu workqueue) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a CPU is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use of WORK_CPU_UNBOUND again. This lack of consistency cannot be addressed without refactoring the API. For more details see those commits and the Link tag below. 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") [ bp: Massage commit message. ] Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de commit 86a9ce21f5b781c56eba23cbbd2264ab74778ab0 Author: Christoph Hellwig Date: Thu Nov 6 15:53:32 2025 +0100 block: don't return 1 for the fallback case in blkdev_get_zone_info blkdev_do_report_zones returns the number of reported zones, but blkdev_get_zone_info returns 0 or an errno. Translate to the expected return value in blkdev_report_zone_fallback. Fixes: b037d41762fd ("block: introduce blkdev_get_zone_info()") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Signed-off-by: Jens Axboe commit 5cb637d9425d7c6282b9f7470d273e4ecac6efb8 Author: Jason Gunthorpe Date: Thu Nov 6 15:02:14 2025 -0400 iommupt: Documentation fixes Some adjustments pointed out by Randy: "decodes an full 64-bit" -> "decodes the full 64 bit" Correct the function parameter name for iova_to_phys() Use the recommended section heading style. Suggested-by: Randy Dunlap Fixes: ab0b572847ac ("genpt: Add Documentation/ files") Fixes: 879ced2bab1b ("iommupt: Add the AMD IOMMU v1 page table format") Fixes: 9d4c274cd7d5 ("iommupt: Add iova_to_phys op") Signed-off-by: Jason Gunthorpe Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Joerg Roedel commit e4dfaf25df1210af6776b6672191cf5e32ba5529 Author: Bagas Sanjaya Date: Fri Nov 7 15:13:01 2025 +0700 iommupt: Describe @bitnr parameter Sphinx reports kernel-doc warnings when making htmldocs: WARNING: ./drivers/iommu/generic_pt/pt_common.h:361 function parameter 'bitnr' not described in 'pt_test_sw_bit_acquire' WARNING: ./drivers/iommu/generic_pt/pt_common.h:371 function parameter 'bitnr' not described in 'pt_set_sw_bit_release' Describe @bitnr to squash them. Fixes: bcc64b57b48e ("iommupt: Add basic support for SW bits in the page table") Reviewed-by: Jason Gunthorpe Signed-off-by: Bagas Sanjaya Signed-off-by: Joerg Roedel commit 6573d552e28c22f5f7b7eedce3ac7c2677032b13 Author: Bagas Sanjaya Date: Fri Nov 7 15:13:00 2025 +0700 Documentation: genpt: Don't use code block marker before iommu_amdv1.c include listing Stephen Rothwell reports htmldocs warning when merging iommu tree: Documentation/driver-api/generic_pt.rst:32: WARNING: Literal block expected; none found. [docutils] This is because of duplicate double colon code block markers: one after generic_pt/fmt/iommu_amdv1.c and the one in its preceding paragraph. The resulting htmldocs, however, only marks the include listing (after the former) up as it should be. Drop the latter to fix the warning. Fixes: ab0b572847ac ("genpt: Add Documentation/ files") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251106143925.578e411b@canb.auug.org.au/ Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Jason Gunthorpe Signed-off-by: Bagas Sanjaya Signed-off-by: Joerg Roedel commit 9393a3a4207f35a2cd1ff5994ed17e8fbd9ce787 Author: Marco Crivellari Date: Wed Nov 5 17:27:36 2025 +0100 thunderbolt: Replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Replace system_wq with system_percpu_wq, keeping the old behavior. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Mika Westerberg commit 2089f086303b773e181567fd8d5df3038bd85937 Author: Chen Ni Date: Fri Nov 7 16:51:09 2025 +0800 regulator: mt6363: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20251107085109.2316999-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit b6f4bd64f453183954184ffbc2b89d73ed8fb135 Author: Marco Crivellari Date: Thu Nov 6 15:29:14 2025 +0100 regulator: irq_helper: replace use of system_wq with system_dfl_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This specific workload do not benefit from a per-cpu workqueue, so use the default unbound workqueue (system_dfl_wq) instead. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251106142914.227875-1-marco.crivellari@suse.com Signed-off-by: Mark Brown commit 4a58f60df578bb55a1d0adca0c356e03b2818de1 Merge: 4e92abd0a11b91 abc9a349b87ac0 Author: Mark Brown Date: Fri Nov 7 09:33:17 2025 +0000 spi: enable the SpacemiT K1 SoC QSPI Merge series from Alex Elder : This series adds support for the SpacemiT K1 SoC QSPI. This IP is generally compatible with the Freescale QSPI driver, requiring three minor changes to enable it to be supported. The changes are: - Adding support for optional resets - Having the clock *not* be disabled when changing its rate - Allowing the size of storage blocks written to flash chips to be set to something different from the AHB buffer size commit a69a54f8dffb105b2df2e606b4c9f61127d006ac Author: Uwe Kleine-König Date: Sat Oct 25 14:23:56 2025 +0200 rust: pwm: Drop wrapping of PWM polarity and state These were introduced and used in an earlier revision of the patch that became commit fb3957af9ec6 ("pwm: Add Rust driver for T-HEAD TH1520 SoC"). The variant that was actually applied sticks to the modern waveform abstraction only (and other drivers are supposed to do that, too), so they can be dropped. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20251025122359.361372-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 264b501bb40dd22e8c4ab2c8a3378e32c2e04ec6 Author: Michal Wilczynski Date: Tue Oct 28 13:22:33 2025 +0100 rust: pwm: Add module_pwm_platform_driver! macro Rust PWM drivers using the abstractions in `kernel/pwm.rs` typically call C functions (like `pwmchip_alloc`, `__pwmchip_add`, etc.) that are exported to the `PWM` C symbol namespace. With the introduction of `imports_ns` support in the `module!` macro, every PWM driver would need to manually include `imports_ns: ["PWM"]` in its module declaration. To simplify this for driver authors and ensure consistency, introduce a new helper macro `module_pwm_platform_driver!` in `pwm.rs`. This macro wraps the standard `module_platform_driver!`, forwards all user provided arguments using the `($($user_args:tt)*)` pattern, and automatically injects the `imports_ns: ["PWM"]` declaration. This follows the pattern used in other subsystems (e.g., `module_pci_driver!`) to provide specialized module registration helpers. It makes writing PWM drivers slightly simpler and less error prone regarding namespace imports. Signed-off-by: Michal Wilczynski Reviewed-by: Elle Rhumsaa Link: https://patch.msgid.link/20251028-pwm_fixes-v1-2-25a532d31998@samsung.com Signed-off-by: Uwe Kleine-König commit d8046cd50879db371bbf6220477ec521692ab2f6 Author: Michal Wilczynski Date: Thu Oct 16 15:38:03 2025 +0200 rust: pwm: Add complete abstraction layer Introduce a comprehensive abstraction layer for the PWM subsystem to enable writing drivers in Rust. Because `Device`, `Chip`, and `PwmOps` all refer to each other, they form a single, indivisible unit with circular dependencies. They are introduced together in this single commit to create a complete, compilable abstraction layer. The main components are: - Data Wrappers: Safe, idiomatic wrappers for core C types like `pwm_device`, and `pwm_chip`. - PwmOps Trait: An interface that drivers can implement to provide their hardware-specific logic, mirroring the C `pwm_ops` interface. - FFI VTable and Adapter: A bridge to connect the high-level PwmOps trait to the C kernel's pwm_ops vtable. - Allocation and Lifetime Management: A high-level `Chip::new()` API to safely allocate a chip and a `Registration` guard that integrates with `devres` to manage the chip's registration with the PWM core. An `AlwaysRefCounted` implementation and a custom release handler prevent memory leaks by managing the chip's lifetime and freeing driver data correctly. Reviewed-by: Danilo Krummrich Reviewed-by: Elle Rhumsaa Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20251016-rust-next-pwm-working-fan-for-sending-v16-3-a5df2405d2bd@samsung.com Signed-off-by: Uwe Kleine-König commit 7b3dce814a15bc5d9fb6124cd945291012c4ebb9 Author: Michal Wilczynski Date: Thu Oct 16 15:38:02 2025 +0200 rust: pwm: Add Kconfig and basic data structures Introduce the foundational support for PWM abstractions in Rust. This commit adds the `RUST_PWM_ABSTRACTIONS` Kconfig option to enable the feature, along with the necessary build-system support and C helpers. It also introduces the first set of safe wrappers for the PWM subsystem, covering the basic data carrying C structs and enums: - `Polarity`: A safe wrapper for `enum pwm_polarity`. - `Waveform`: A wrapper for `struct pwm_waveform`. - `State`: A wrapper for `struct pwm_state`. These types provide memory safe, idiomatic Rust representations of the core PWM data structures and form the building blocks for the abstractions that will follow. Tested-by: Drew Fustini Reviewed-by: Daniel Almeida Reviewed-by: Elle Rhumsaa Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20251016-rust-next-pwm-working-fan-for-sending-v16-2-a5df2405d2bd@samsung.com Signed-off-by: Uwe Kleine-König commit ce284f882022ebcb953984c7eccf4fc4eb531978 Author: Michal Wilczynski Date: Thu Oct 16 15:38:01 2025 +0200 pwm: Export `pwmchip_release` for external use The upcoming Rust abstraction layer for the PWM subsystem uses a custom `dev->release` handler to safely manage the lifetime of its driver data. To prevent leaking the memory of the `struct pwm_chip` (allocated by `pwmchip_alloc`), this custom handler must also call the original `pwmchip_release` function to complete the cleanup. Make `pwmchip_release` a global, exported function so that it can be called from the Rust FFI bridge. This involves removing the `static` keyword, adding a prototype to the public header, and exporting the symbol. Reviewed-by: Elle Rhumsaa Signed-off-by: Michal Wilczynski Link: https://patch.msgid.link/20251016-rust-next-pwm-working-fan-for-sending-v16-1-a5df2405d2bd@samsung.com Signed-off-by: Uwe Kleine-König commit 739ad9be61e5f53dbd8d7d7e80723d0799ff077c Author: Michal Wilczynski Date: Tue Oct 28 13:22:32 2025 +0100 rust: macros: Add support for 'imports_ns' to module! Kernel modules that use C symbols exported via `EXPORT_SYMBOL_NS` must declare this dependency for `modpost` verification. C modules achieve this by using the `MODULE_IMPORT_NS(NAMESPACE)` macro, which embeds an `import_ns=` tag into the `.modinfo` section. The Rust `module!` macro lacked the ability to generate these tags, resulting in build warnings for Rust drivers (like the PWM driver) that call namespaced C functions. Modify the `module!` macro's internal parser (`ModuleInfo`) to accept a new optional field `imports_ns`, which takes an array of namespace strings. Update the code generator (`ModInfoBuilder::emit`) loop to iterate over these strings and emit the corresponding `import_ns=` tags into the `.modinfo` section using the existing `#[link_section]` mechanism. This provides the necessary infrastructure for Rust modules to correctly declare their C namespace dependencies. Signed-off-by: Michal Wilczynski Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Reviewed-by: Elle Rhumsaa Acked-by: Daniel Gomez Link: https://patch.msgid.link/20251028-pwm_fixes-v1-1-25a532d31998@samsung.com Signed-off-by: Uwe Kleine-König commit 4c0a17e28340e458627d672564200406e220d6a3 Author: Vlastimil Babka Date: Wed Nov 5 10:05:33 2025 +0100 slab: prevent recursive kmalloc() in alloc_empty_sheaf() We want to expand usage of sheaves to all non-boot caches, including kmalloc caches. Since sheaves themselves are also allocated by kmalloc(), we need to prevent excessive or infinite recursion - depending on sheaf size, the sheaf can be allocated from smaller, same or larger kmalloc size bucket, there's no particular constraint. This is similar to allocating the objext arrays so let's just reuse the existing mechanisms for those. __GFP_NO_OBJ_EXT in alloc_empty_sheaf() will prevent a nested kmalloc() from allocating a sheaf itself - it will either have sheaves already, or fallback to a non-sheaf-cached allocation (so bootstrap of sheaves in a kmalloc cache that allocates sheaves from its own size bucket is possible). Additionally, reuse OBJCGS_CLEAR_MASK to clear unwanted gfp flags from the nested allocation. Link: https://patch.msgid.link/20251105-sheaves-cleanups-v1-5-b8218e1ac7ef@suse.cz Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f6087b926aea65768975fd4cbc3775965cbd8621 Author: Vlastimil Babka Date: Wed Nov 5 10:05:29 2025 +0100 slab: make __slab_free() more clear The function is tricky and many of its tests are hard to understand. Try to improve that by using more descriptively named variables and added comments. - rename 'prior' to 'old_head' to match the head and tail parameters - introduce a 'bool was_full' to make it more obvious what we are testing instead of the !prior and prior tests - add or improve comments in various places to explain what we're doing Also replace kmem_cache_has_cpu_partial() tests with IS_ENABLED(CONFIG_SLUB_CPU_PARTIAL) which are compile-time constants. We can do that because the kmem_cache_debug(s) case is handled upfront via free_to_partial_list(). Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20251105-sheaves-cleanups-v1-1-b8218e1ac7ef@suse.cz Signed-off-by: Vlastimil Babka commit 31e0886fd57d426d18a239dd55e176032c9c1cb0 Author: Vlastimil Babka Date: Wed Nov 5 10:05:32 2025 +0100 slub: remove CONFIG_SLUB_TINY specific code paths CONFIG_SLUB_TINY minimizes the SLUB's memory overhead in multiple ways, mainly by avoiding percpu caching of slabs and objects. It also reduces code size by replacing some code paths with simplified ones through ifdefs, but the benefits of that are smaller and would complicate the upcoming changes. Thus remove these code paths and associated ifdefs and simplify the code base. Link: https://patch.msgid.link/20251105-sheaves-cleanups-v1-4-b8218e1ac7ef@suse.cz Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 1ce20c28eafdc101164a4bfedd2ea818eb137de7 Author: Vlastimil Babka Date: Wed Nov 5 10:05:31 2025 +0100 slab: handle pfmemalloc slabs properly with sheaves When a pfmemalloc allocation actually dips into reserves, the slab is marked accordingly and non-pfmemalloc allocations should not be allowed to allocate from it. The sheaves percpu caching currently doesn't follow this rule, so implement it before we expand sheaves usage to all caches. Make sure objects from pfmemalloc slabs don't end up in percpu sheaves. When freeing, skip sheaves when freeing an object from pfmemalloc slab. When refilling sheaves, use __GFP_NOMEMALLOC to override any pfmemalloc context - the allocation will fallback to regular slab allocations when sheaves are depleted and can't be refilled because of the override. For kfree_rcu(), detect pfmemalloc slabs after processing the rcu_sheaf after the grace period in __rcu_free_sheaf_prepare() and simply flush it if any object is from pfmemalloc slabs. For prefilled sheaves, try to refill them first with __GFP_NOMEMALLOC and if it fails, retry without __GFP_NOMEMALLOC but then mark the sheaf pfmemalloc, which makes it flushed back to slabs when returned. Link: https://patch.msgid.link/20251105-sheaves-cleanups-v1-3-b8218e1ac7ef@suse.cz Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit ea6b5e5778b1dc58b1909e4badd3e180ddae7418 Author: Vlastimil Babka Date: Wed Nov 5 10:05:30 2025 +0100 slab: move kfence_alloc() out of internal bulk alloc SLUB's internal bulk allocation __kmem_cache_alloc_bulk() can currently allocate some objects from KFENCE, i.e. when refilling a sheaf. It works but it's conceptually the wrong layer, as KFENCE allocations should only happen when objects are actually handed out from slab to its users. Currently for sheaf-enabled caches, slab_alloc_node() can return KFENCE object via kfence_alloc(), but also via alloc_from_pcs() when a sheaf was refilled with KFENCE objects. Continuing like this would also complicate the upcoming sheaf refill changes. Thus remove KFENCE allocation from __kmem_cache_alloc_bulk() and move it to the places that return slab objects to users. slab_alloc_node() is already covered (see above). Add kfence_alloc() to kmem_cache_alloc_from_sheaf() to handle KFENCE allocations from prefilled sheafs, with a comment that the caller should not expect the sheaf size to decrease after every allocation because of this possibility. For kmem_cache_alloc_bulk() implement a different strategy to handle KFENCE upfront and rely on internal batched operations afterwards. Assume there will be at most once KFENCE allocation per bulk allocation and then assign its index in the array of objects randomly. Cc: Alexander Potapenko Cc: Marco Elver Cc: Dmitry Vyukov Link: https://patch.msgid.link/20251105-sheaves-cleanups-v1-2-b8218e1ac7ef@suse.cz Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit 9942d36a73c2d46c52fdd6f37cf698f3cb09ce5c Author: Thomas Zimmermann Date: Tue Nov 4 11:36:04 2025 +0100 drm/vmwgfx: Set surface-framebuffer GEM objects Set struct drm_framebuffer.obj[0] to the allocated GEM buffer object for surface framebuffers. Avoids a NULL-pointer deref in the client's vmap helpers. [ 22.640191] Console: switching to colour frame buffer device 160x50 [ 22.641788] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001f: 0000 [#1] SMP KASAN NOPTI [ 22.641795] KASAN: null-ptr-deref in range [0x00000000000000f8-0x00000000000000ff] [...] [ 22.641809] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.24928539.B64.2508260915 08/26/2025 [ 22.641812] Workqueue: events drm_fb_helper_damage_work [ 22.641824] RIP: 0010:drm_gem_lock+0x25/0x50 [ 22.641831] Code: 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 53 48 89 fb 48 81 c7 f8 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 0f 48 8b bb f8 00 00 00 31 f6 5b e9 16 2e 15 01 e8 [...] [ 22.641889] Call Trace: [ 22.641891] [ 22.641894] drm_client_buffer_vmap_local+0x78/0x140 [ 22.641903] drm_fbdev_ttm_helper_fb_dirty+0x20c/0x510 [drm_ttm_helper] [ 22.641913] ? __pfx_drm_fbdev_ttm_helper_fb_dirty+0x10/0x10 [drm_ttm_helper] [ 22.641918] ? __raw_spin_lock_irqsave+0x8c/0xf0 [ 22.641924] ? __pfx___raw_spin_lock_irqsave+0x10/0x10 [ 22.641928] ? __pfx_mutex_lock+0x10/0x10 [ 22.641936] drm_fb_helper_fb_dirty+0x29a/0x5e0 [ 22.641942] ? __pfx_drm_fb_helper_fb_dirty+0x10/0x10 [...] Signed-off-by: Thomas Zimmermann Fixes: ea39f2e66e61 ("drm/client: Deprecate struct drm_client_buffer.gem") Reported-by: Ian Forbes Closes: https://lore.kernel.org/dri-devel/CAO6MGtjg8PiRiSLomJQRBduTBSC0WkqX67tEZwA9qwOgRzchpw@mail.gmail.com/ Cc: Thomas Zimmermann Cc: Jocelyn Falempe Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Simona Vetter Cc: dri-devel@lists.freedesktop.org Tested-by: Ian Forbes Reviewed-by: Jocelyn Falempe Reviewed-by: Zack Rusin Link: https://patch.msgid.link/20251104103611.167821-1-tzimmermann@suse.de commit f050da08a4edfcccb92bbc93eafb9723286a5ce2 Author: Chintan Patel Date: Mon Oct 27 20:43:37 2025 -0700 drm/vblank: Increase timeout in drm_wait_one_vblank() Currently, wait_event_timeout() in drm_wait_one_vblank() uses a 100ms timeout. Under heavy scheduling pressure or rare delayed vblank handling, this can trigger WARNs unnecessarily. Increase the timeout to 1000ms to reduce spurious WARNs, while still catching genuine issues. Reported-by: syzbot+147ba789658184f0ce04@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=147ba789658184f0ce04 Tested-by: syzbot+147ba789658184f0ce04@syzkaller.appspotmail.com Signed-off-by: Chintan Patel v2: - Dropped unnecessary in-code comment (suggested by Thomas Zimmermann) - Removed else branch, only log timeout case v3: - Replaced drm_dbg_kms()/manual logging with drm_err() (suggested by Ville Syrjälä) - Removed unnecessary curr = drm_vblank_count() (suggested by Thomas Zimmermann) - Fixed commit message wording ("invalid userspace calls" → "delayed vblank handling") v4: - Keep the original drm_WARN() to catch genuine kernel issues - Increased timeout from 100ms → 1000ms to reduce spurious WARNs (suggested by Thomas Zimmermann) Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20251028034337.6341-1-chintanlike@gmail.com commit 3946d3ba99342f3b9996e621f05e7003d4308171 Author: Thomas Zimmermann Date: Thu Nov 6 08:31:58 2025 +0100 drm/vblank: Fix kernel docs for vblank timer Fix documentation for drm_crtc_vblank_start_timer(), which referred to drm_crtc_vblank_cancel_timer(). Signed-off-by: Thomas Zimmermann Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/dri-devel/20251106152201.6f248c09@canb.auug.org.au/ Fixes: 74afeb812850 ("drm/vblank: Add vblank timer") Cc: Thomas Zimmermann Cc: Louis Chauvet Cc: Javier Martinez Canillas Cc: David Airlie Cc: Simona Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: dri-devel@lists.freedesktop.org Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20251106073207.11192-1-tzimmermann@suse.de commit 13f4d99582c8825ca22b35c023f370e4cdcb18f4 Author: Marco Crivellari Date: Thu Nov 6 17:08:13 2025 +0100 ata: libata-sff: add WQ_PERCPU to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel commit 83646541d197fe732b6fb7503557e4989f9e3551 Author: Marco Crivellari Date: Thu Nov 6 16:01:21 2025 +0100 drm/sched: Replace use of system_wq with system_percpu_wq In the general workqueue implementation, if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. For more details see the Link tag below. This continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Use the successor of system_wq, system_percpu_wq, for the scheduler's default timeout_wq. system_wq will be removed in a few release cycles. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20251106150121.256367-1-marco.crivellari@suse.com commit e237dfe70867f02de223e36340fe5f8b0fe0eada Merge: 8f037e11d070a3 6126a7f27f0024 Author: Dave Airlie Date: Fri Nov 7 12:40:51 2025 +1000 Merge tag 'drm-misc-next-2025-11-05-1' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v6.19-rc1: UAPI Changes: - Add userptr support to ivpu. - Add IOCTL's for resource and telemetry data in amdxdna. Core Changes: - Improve some atomic state checking handling. - drm/client updates. - Use forward declarations instead of including drm_print.h - RUse allocation flags in ttm_pool/device_init and allow specifying max useful pool size and propagate ENOSPC. - Updates and fixes to scheduler and bridge code. - Add support for quirking DisplayID checksum errors. Driver Changes: - Assorted cleanups and fixes in rcar-du, accel/ivpu, panel/nv3052cf, sti, imxm, accel/qaic, accel/amdxdna, imagination, tidss, sti, panthor, vkms. - Add Samsung S6E3FC2X01 DDIC/AMS641RW, Synaptics TDDI series DSI, TL121BVMS07-00 (IL79900A) panels. - Add mali MediaTek MT8196 SoC gpu support. - Add etnaviv GC8000 Nano Ultra VIP r6205 support. - Document powervr ge7800 support in the devicetree. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/5afae707-c9aa-4a47-b726-5e1f1aa7a106@linux.intel.com commit fa4a527af5cddad6f13abf80105f4da79876c31e Author: Xu Yang Date: Thu Aug 21 19:01:51 2025 +0800 perf vendor events arm64:: Add i.MX94 DDR Performance Monitor metrics Add JSON metrics for i.MX94 DDR Performance Monitor. Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Xu Yang Acked-by: Ian Rogers Acked-by: Conor Dooley Signed-off-by: Namhyung Kim commit 268a31a9f88759c2f1a85a1d81524326d0e47290 Author: Namhyung Kim Date: Thu Nov 6 13:53:50 2025 -0800 perf stat: Add ScaleUnit to {cpu,task}-clock JSON description This changes the output of the event like below. In fact, that's the output it used to have before the JSON conversion. Before: $ perf stat -e task-clock true Performance counter stats for 'true': 313,848 task-clock # 0.290 CPUs utilized 0.001081223 seconds time elapsed 0.001122000 seconds user 0.000000000 seconds sys After: $ perf stat -e task-clock true Performance counter stats for 'true': 0.36 msec task-clock # 0.297 CPUs utilized 0.001225435 seconds time elapsed 0.001268000 seconds user 0.000000000 seconds sys Reviewed-by: Ian Rogers Fixes: 9957d8c801fe0cb90 ("perf jevents: Add common software event json") Signed-off-by: Namhyung Kim commit 6fc33710cd6c55397e606eeb544bdf56ee87aae5 Merge: 25e63e559c41b5 16e2e6cf75e621 Author: Jakub Kicinski Date: Thu Nov 6 17:38:27 2025 -0800 Merge branch 'net-renesas-cleanup-usage-of-gptp-flags' Niklas Söderlund says: ==================== net: renesas: Cleanup usage of gPTP flags This series aim is to prepare for future work that will enable the use of gPTP on R-Car RAVB on Gen4. Currently RAVB have a dedicated gPTP implementation supported on Gen2 and Gen3 (ravb_ptp.c). For Gen4 a new implementation that is already upstream (rcar_gen4_ptp.c) and used by other Gen4 devices such as RTSN and RSWITCH is needed. Unfortunately the design of the Gen2/Gen3 RAVB driver where driver specific flags to control gPTP behavior have been mimicked in RTSN and RSWITCH. This was OK as there was no overlap between the two gPTP implementations. Now that RAVB needs to be able to use both having to translate between driver specific flags and common net code flags becomes even more cumbersome as there are two sets of driver specific flags to pick from. This series cleans this up for all Renesas drivers using gPTP by removing all driver specific flags and using the common flags directly. This simplifies drivers while at the same time prepare RAVB to be extended with Gen4 support. Patch 1/7 is a drive by patch where RSWITCH specific define was added in the wrong header. Patch 2/7 removes a short-cut used in RTSN and RSWITCH that prevents extending Gen4 support to RAVB without fuss. While patch 3/7 to 7/7 rework the Renesas drivers to use the common flags instead of driver specific ones. There is no intentional behavior change and only a small rework in logic in the RAVB driver. Looking at patch 3/7, 4/7 and 7/7 one can clearly see how the code have been copied from RAVB to the later implementations in RTSN and RSWITCH. ==================== Link: https://patch.msgid.link/20251104222420.882731-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 16e2e6cf75e62182b9e28d0e48ab72d93c464bda Author: Niklas Söderlund Date: Tue Nov 4 23:24:20 2025 +0100 net: ravb: Use common defines for time stamping control Instead of translating to/from driver specific flags for packet time stamp control use the common flags directly. This simplifies the driver as the translating code can be removed while at the same time making it clear the flags are not flags written to hardware registers. The change from a device specific bit-field track variable to the common enum datatypes forces us to touch the ravb_rx_rcar_hwstamp() in a non trivial way. To make this cleaner and easier to understand expand the nested conditions. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20251104222420.882731-8-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 5ce97b8d6132a0f252c68d58fed35f73c31e0bee Author: Niklas Söderlund Date: Tue Nov 4 23:24:19 2025 +0100 net: ravb: Break out Rx hardware timestamping Prepare for moving away from device specific bit-fields to track how to do hardware Rx timestamping to using net common enums by breaking out the timestamping to a helper function. This is done to create cleaner code and prepare for easier changes improving the hardware timestapming. There is no functional change. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20251104222420.882731-7-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 3614d249d1da83b4806e015740117ed1069e3ca1 Author: Niklas Söderlund Date: Tue Nov 4 23:24:18 2025 +0100 net: rcar_gen4_ptp: Remove unused defines The driver specific flags to control packet time stamps have all been replaced by values from enum hwtstamp_tx_types and enum hwtstamp_rx_filters. Remove the driver specific flags as there are no more users. Signed-off-by: Niklas Söderlund Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251104222420.882731-6-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit e43791f40b814d00b8e2be41f9d2bc2a97246d6d Author: Niklas Söderlund Date: Tue Nov 4 23:24:17 2025 +0100 net: rtsn: Use common defines for time stamping control Instead of translating to/from driver specific flags for packet time stamp control use the common flags directly. This simplifies the driver as the translating code can be removed while at the same time making it clear the flags are not flags written to hardware registers. One thing to note is that the bit-wise and check in rtsn_rx() of RCAR_GEN4_RXTSTAMP_TYPE_V2_L2_EVENT is replaced with a not set check of HWTSTAMP_FILTER_NONE. This is okay as the bit of device specific event replaced was set for all modes except HWTSTAMP_FILTER_NONE. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20251104222420.882731-5-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit b314e4f7a9d9ba7821cfac57e1bf3648bb27a289 Author: Niklas Söderlund Date: Tue Nov 4 23:24:16 2025 +0100 net: rswitch: Use common defines for time stamping control Instead of translating to/from driver specific flags for packet time stamp control use the common flags directly. This simplifies the driver as the translating code can be removed while at the same time making it clear the flags are not flags written to hardware registers. One thing to note is that the bit-wise and check in rswitch_rx() of RCAR_GEN4_RXTSTAMP_TYPE_V2_L2_EVENT is replaced with a not set check of HWTSTAMP_FILTER_NONE. This is okay as the bit of device specific event replaced was set for all modes except HWTSTAMP_FILTER_NONE. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20251104222420.882731-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 50ab1c6becdec42ce7cc9b52f2ea67c6a81218f2 Author: Niklas Söderlund Date: Tue Nov 4 23:24:15 2025 +0100 net: rcar_gen4_ptp: Move control fields to users The struct rcar_gen4_ptp_private provides two fields for convenience of its users, tstamp_tx_ctrl and tstamp_rx_ctrl. These fields are not used by the rcar_gen4_ptp driver itself but only by the drivers using it. Upcoming work will enable the RAVB driver currently only supporting gPTP on pre-Gen4 SoCs to use the Gen4 implementation as well. To facilitate this the convenience of having these fields in struct rcar_gen4_ptp_private becomes a problem as the RAVB driver already have it's own driver specific fields for the same thing. Move the fields from struct rcar_gen4_ptp_private to each driver using the Gen4 gPTP clocks own private data structures. There is no functional change. Signed-off-by: Niklas Söderlund Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251104222420.882731-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit e98d8792929df31ec51710773509f6fd2964ea81 Author: Niklas Söderlund Date: Tue Nov 4 23:24:14 2025 +0100 net: rswitch: Move definition of S4 gPTP offset The files rcar_gen4_ptp.{c,h} implements an abstraction of the gPTP support implemented together with different other IP blocks. The first device added which supported this was RSWITCH on R-Car S4. While doing so the RSWITCH R-Car S4 specific offset was added to the generic Gen4 gPTP header file. Move it to the RSWITCH driver to make it clear it only applies to this driver. Signed-off-by: Niklas Söderlund Link: https://patch.msgid.link/20251104222420.882731-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Jakub Kicinski commit 6bd89ae7d14788ba15e25289479addcb98e7dc26 Author: Namhyung Kim Date: Thu Nov 6 11:00:23 2025 -0800 perf record: Make sure to update build-ID cache Recent change on enabling --buildid-mmap by default brought an issue with build-id handling. With build-ID in MMAP2 records, we don't need to save the build-ID table in the header of a perf data file. But the actual file contents still need to be cached in the debug directory for annotation etc. Split the build-ID header processing and caching and make sure perf record to save hit DSOs in the build-ID cache by moving perf_session__cache_build_ids() to the end of the record__ finish_output(). Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim commit bc840b21a25a50f00e2b240329c09281506df387 Author: Keith Busch Date: Tue Oct 14 08:04:56 2025 -0700 nvme: remove virtual boundary for sgl capable devices The nvme virtual boundary is only required for the PRP format. Devices that can use SGL for DMA don't need it for IO queues. Drop reporting it for such devices; rdma fabrics controllers will continue to use the limit as they currently don't report any boundary requirements, but tcp and fc never needed it in the first place so they get to report no virtual boundary. Applications may continue to align to the same virtual boundaries for optimization purposes if they want, and the driver will continue to decide whether to use the PRP format the same as before if the IO allows it. Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 2f6b2565d43cdb5087cac23d530cca84aa3d897e Author: Keith Busch Date: Tue Oct 14 08:04:55 2025 -0700 block: accumulate memory segment gaps per bio The blk-mq dma iterator has an optimization for requests that align to the device's iommu merge boundary. This boundary may be larger than the device's virtual boundary, but the code had been depending on that queue limit to know ahead of time if the request is guaranteed to align to that optimization. Rather than rely on that queue limit, which many devices may not report, save the lowest set bit of any boundary gap between each segment in the bio while checking the segments. The request stores the value for merging and quickly checking per io if the request can use iova optimizations. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 25e63e559c41b5caa2ad8f076eba90f9897c0a07 Author: Daniel Borkmann Date: Fri Oct 31 22:20:59 2025 +0100 netkit: Document fast vs slowpath members via macros Instead of a comment, just use two cachline groups to document the intent for members often accessed in fast or slow path. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20251031212103.310683-11-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 24ab8efb9aea77764dd99d2bad41fd8991223013 Author: Daniel Borkmann Date: Fri Oct 31 22:20:55 2025 +0100 xsk: Move NETDEV_XDP_ACT_ZC into generic header Move NETDEV_XDP_ACT_ZC into xdp_sock_drv.h header such that external code can reuse it, and rename it into more generic NETDEV_XDP_ACT_XSK. Signed-off-by: Daniel Borkmann Co-developed-by: David Wei Signed-off-by: David Wei Reviewed-by: Maciej Fijalkowski Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20251031212103.310683-7-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit f8c67d8550ee69ce684c7015b2c8c63cda24bbfb Author: Puranjay Mohan Date: Thu Nov 6 17:06:07 2025 +0000 bpf: Use kmalloc_nolock() in range tree The range tree uses bpf_mem_alloc() that is safe to be called from all contexts and uses a pre-allocated pool of memory to serve these allocations. Replace bpf_mem_alloc() with kmalloc_nolock() as it can be called safely from all contexts and is more scalable than bpf_mem_alloc(). Remove the migrate_disable/enable pairs as they were only needed for bpf_mem_alloc() as it does per-cpu operations, kmalloc_nolock() doesn't need this. Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20251106170608.4800-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 8f037e11d070a38d143b85d72d369190514dca99 Merge: f67d54e96bc9e4 c4227e1609b355 Author: Dave Airlie Date: Fri Nov 7 09:45:38 2025 +1000 Merge tag 'drm-intel-next-2025-11-04' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull for v6.19: Features and functionality: - Enable LNL+ content adaptive sharpness filter (CASF) (Nemesa) - Use optimized VRR guardband (Ankit, Ville) - Enable Xe3p LT PHY (Suraj) - Enable FBC support for Xe3p_LPD display (Sai Teja, Vinod) - Specify DMC firmware for display version 30.02 (Dnyaneshwar) - Report reason for disabling PSR to debugfs (Michał) - Extend i915_display_info with Type-C port details (Khaled) - Log DSI send packet sequence errors and contents Refactoring and cleanups: - Refactoring to prepare for VRR guardband optimization (Ankit) - Abstract VRR live status wait (Ankit) - Refactor VRR and DSB timing to handle Set Context Latency explicitly (Ankit) - Helpers for prefill latency calculations (Ville) - Refactor SKL+ watermark latency setup (Ville) - VRR refactoring and cleanups (Ville) - SKL+ universal plane cleanups (Ville) - Decouple CDCLK from state->modeset refactor (Ville) - Refactor VLV/CHV clock functions (Jani) - Refactor fbdev handling (Jani) - Call i915 and xe runtime PM from display via function pointers (Jouni) - IRQ code refactoring (Jani) - Drop display dependency on i915 feature check macros (Jani) - Refactor and unify i915 and xe stolen memory interfaces towards display (Jani) - Switch to driver agnostic drm to display pointer chase (Jani) - Use display version over graphics version in display code (Matt A) - GVT cleanups (Jonathan, Andi) - Rename a VLV clock function to unify (Michał) - Explicitly sanitize DMC package header num entries (Luca) - Remove redundant port clock check from ALPM (Jouni) - Use sysfs_emit() instead of sprintf() in PMU sysfs (Madhur Kumar) - Clean up C20 PHY PLL register macros (Imre, Mika)) - Abstract "address in MMIO table" helper for general use (Matt A) - Improve VRR platform abstractions (Ville) - Move towards more standard PCI PM code usage (Ville) - Framebuffer refactoring (Ville) - Drop display dependency on i915_utils.h (Jani) - Include cleanups (Jani) Fixes: - Workaround docking station DSC issues with high pixel clock and bpp (Imre) - Fix Panel Replay in DSC mode (Imre) - Disable tracepoints for PREEMPT_RT as a workaround (Maarten) - Fix intel_crtc_get_vblank_counter() on PREEMPT_RT (Maarten) - Fix C10 PHY identification on PTL/WCL (Dnyaneshwar) - Take AS SDP into account with optimized guardband (Jouni) - Fix panic structure allocation memory leak (Jani) - Adjust an FBC workaround platforms (Vinod) - Add fallback for CDCLK selection (Naladala) - Avoid using invalid transcoder in MST transport select (Suraj) - Don't use cursor size reduction on display version 14+ (Nemesa) - Fix C20 PHY PLL register programming (Imre, Mika) - Fix PSR frontbuffer flush handling (Jouni) - Store ALPM parameters in crtc state (Jouni) - Defeature DRRS on LNL+ (Ville) - Fix the scope of the large DRAM DIMM workaround (Ville) - Fix PICA vs. AUX power ordering issue (Gustavo) - Fix pixel rate for computing watermark line time (Ville) - Fix framebuffer set_tiling vs. addfb race (Ville) - DMC event handler fixes (Ville) DRM Core: - CRTC sharpness strength property (Nemesa) - DPCD DSC quirk for Synaptics Panamera devices (Imre) - Helpers to query the branch DSC max throughput/line-width (Imre) Merges: - Backmerge drm-next for v6.18-rc and to sync with drm-xe-next (Jani) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/ec5a05f2df6d597a62033ee2d57225cce707b320@intel.com commit 0739c2c6a015604a7c01506bea28200a2cc2e08c Author: Cong Zhang Date: Tue Oct 21 19:07:56 2025 +0800 virtio_blk: NULL out vqs to avoid double free on failed resume The vblk->vqs releases during freeze. If resume fails before vblk->vqs is allocated, later freeze/remove may attempt to free vqs again. Set vblk->vqs to NULL after freeing to avoid double free. Signed-off-by: Cong Zhang Acked-by: Jason Wang Signed-off-by: Jens Axboe commit 3451cf34f51bb70c24413abb20b423e64486161b Author: Keith Busch Date: Wed Nov 5 17:54:47 2025 -0800 null_blk: allow byte aligned memory offsets Allowing byte aligned memory provides a nice testing ground for direct-io. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Tested-by: Hans Holmberg Signed-off-by: Jens Axboe commit 262a3dd04e729386bececffeb095d31f7a9c43d5 Author: Keith Busch Date: Wed Nov 5 17:54:46 2025 -0800 null_blk: single kmap per bio segment Rather than kmap the the request bio segment for each sector, do the mapping just once. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Tested-by: Hans Holmberg Signed-off-by: Jens Axboe commit 845928381963c61a537b932b6b3f494ce0ccea2d Author: Keith Busch Date: Wed Nov 5 17:54:45 2025 -0800 null_blk: consistently use blk_status_t No need to mix errno and blk_status_t error types. Just use the standard block layer type. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Tested-by: Hans Holmberg Signed-off-by: Jens Axboe commit 1165d20f4d1abba59ff2f032df271605ad49c255 Author: Keith Busch Date: Wed Nov 5 17:54:44 2025 -0800 null_blk: simplify copy_from_nullb It always returns success, so the code that saves the errors status, but proceeds without checking it looks a bit odd. Clean this up. Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Tested-by: Hans Holmberg Signed-off-by: Jens Axboe commit e87d66ab27ac89494b75ddc3fed697b5aa8417f1 Author: Caleb Sander Mateos Date: Thu Nov 6 10:16:47 2025 -0700 ublk: use rq_for_each_segment() for user copy ublk_advance_io_iter() and ublk_copy_io_pages() currently open-code the iteration over the request's bvecs. Switch to the rq_for_each_segment() macro provided by blk-mq to avoid reaching into the bio internals and simplify the code. Suggested-by: Ming Lei Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 2299ceec364eecdc0a5b4ec80c757551d130389c Author: Caleb Sander Mateos Date: Thu Nov 6 10:16:46 2025 -0700 ublk: use copy_{to,from}_iter() for user copy ublk_copy_user_pages()/ublk_copy_io_pages() currently uses iov_iter_get_pages2() to extract the pages from the iov_iter and memcpy()s between the bvec_iter and the iov_iter's pages one at a time. Switch to using copy_to_iter()/copy_from_iter() instead. This avoids the user page reference count increments and decrements and needing to split the memcpy() at user page boundaries. It also simplifies the code considerably. Ming reports a 40% throughput improvement when issuing I/O to the selftests null ublk server with zero-copy disabled. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 93e197e524b14d185d011813b72773a1a49d932d Author: Pavel Begunkov Date: Thu Nov 6 12:58:19 2025 +0000 io_uring: use WRITE_ONCE for user shared memory IORING_SETUP_NO_MMAP rings remain user accessible even before the ctx setup is finalised, so use WRITE_ONCE consistently when initialising rings. Fixes: 03d89a2de25bb ("io_uring: support for user allocated memory for rings/sqes") Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 75c299a917e4547dfe640ce7fd83c8a14d8409d0 Author: David Wei Date: Tue Nov 4 14:44:58 2025 -0800 io_uring/zcrx: reverse ifq refcount Add a refcount to struct io_zcrx_ifq to reverse the refcounting relationship i.e. rings now reference ifqs instead. As a result of this, remove ctx->refs that an ifq holds on a ring via the page pool memory provider. This ref ifq->refs is held by internal users of an ifq, namely rings and the page pool memory provider associated with an ifq. This is needed to keep the ifq around until the page pool is destroyed. Since ifqs now no longer hold refs to ring ctx, there isn't a need to split the cleanup of ifqs into two: io_shutdown_zcrx_ifqs() in io_ring_exit_work() while waiting for ctx->refs to drop to 0, and io_unregister_zcrx_ifqs() after. Remove io_shutdown_zcrx_ifqs(). Signed-off-by: David Wei Co-developed-by: Pavel Begunkov Signed-off-by: Pavel Begunkov Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 1bd95163dae80b940ea4b7bfa0720d3cc538a68b Author: David Wei Date: Tue Nov 4 14:44:57 2025 -0800 io_uring/zcrx: move io_unregister_zcrx_ifqs() down In preparation for removing the ref on ctx->refs held by an ifq and removing io_shutdown_zcrx_ifqs(), move io_unregister_zcrx_ifqs() down such that it can call io_zcrx_scrub(). Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 5c686456a4e83ef06c74d40be05c21a0ef136684 Author: David Wei Date: Tue Nov 4 14:44:56 2025 -0800 io_uring/zcrx: add user_struct and mm_struct to io_zcrx_ifq In preparation for removing ifq->ctx and making ifq lifetime independent of ring ctx, add user_struct and mm_struct to io_zcrx_ifq. In the ifq cleanup path, these are the only fields used from the main ring ctx to do accounting. Taking a copy in the ifq allows ifq->ctx to be removed later, including the ctx->refs held by the ifq. Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit edd706ede85fc9a563556945069f87dbec769e07 Author: David Wei Date: Tue Nov 4 14:44:55 2025 -0800 io_uring/zcrx: add io_zcrx_ifq arg to io_zcrx_free_area() Add io_zcrx_ifq arg to io_zcrx_free_area(). A QOL change to reduce line widths. Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6ab39b392e7973ffc45bf7ab523d8777904c4128 Author: David Wei Date: Tue Nov 4 14:44:54 2025 -0800 io_uring/rsrc: refactor io_{un}account_mem() to take {user,mm}_struct param Refactor io_{un}account_mem() to take user_struct and mm_struct directly, instead of accessing it from the ring ctx. Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 1fa7a34131110e3c41a13b19127da132dea32dcd Author: David Wei Date: Tue Nov 4 14:44:53 2025 -0800 io_uring/memmap: refactor io_free_region() to take user_struct param Refactor io_free_region() to take user_struct directly, instead of accessing it from the ring ctx. Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit a5af56a9020c0dd27bc6ab2b58d1820b01621612 Author: David Wei Date: Tue Nov 4 14:44:52 2025 -0800 io_uring/memmap: remove unneeded io_ring_ctx arg Remove io_ring_ctx arg from io_region_pin_pages() and io_region_allocate_pages() that isn't used. Signed-off-by: David Wei Reviewed-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 6f1f4c1638fe95637a43699892c036c9ae908d9a Merge: b54a8e130c0204 5b7d6c91986e98 Author: Martin KaFai Lau Date: Thu Nov 6 09:30:21 2025 -0800 Merge branch 'selftests-bpf-enfoce-so_reuseaddr-in-basic-test-servers' Alexis Lothoré says: ==================== This small series is another follow-up to [1], in which I misunderstood Martin's initial feedback (see [2]). I proposed to make tc-tunnel apply SO_REUSEPORT once server is brought up. This series updates start_server_addr to really apply Martin's proposal after his clarification [3] [1] https://lore.kernel.org/bpf/20251031-tc_tunnel_improv-v1-0-0ffe44d27eda@bootlin.com/ [2] https://lore.kernel.org/bpf/efa3540a-1f52-46ca-9f49-e631a5e3e48c@linux.dev/ [3] https://lore.kernel.org/bpf/4cbabdf1-af2c-490a-a41a-b40c1539c1cb@linux.dev/ ==================== Link: https://patch.msgid.link/20251105-start-server-soreuseaddr-v1-0-1bbd9c1f8d65@bootlin.com Signed-off-by: Martin KaFai Lau commit 5b7d6c91986e98b4cab5d1f7bdcf392a42d1057b Author: Alexis Lothoré (eBPF Foundation) Date: Wed Nov 5 09:22:49 2025 +0100 selftests/bpf: Use start_server_str rather than start_reuseport_server in tc_tunnel Now that start_server_str enforces SO_REUSEADDR, there's no need to keep using start_reusport_server in tc_tunnel, especially since it only uses one server at a time. Replace start_reuseport_server with start_server_str in tc_tunnel test. Signed-off-by: Alexis Lothoré (eBPF Foundation) Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-start-server-soreuseaddr-v1-2-1bbd9c1f8d65@bootlin.com commit 38e36514fcb01ff1cce84cd77a93906f233a4cb8 Author: Alexis Lothoré (eBPF Foundation) Date: Wed Nov 5 09:22:48 2025 +0100 selftests/bpf: Systematically add SO_REUSEADDR in start_server_addr Some tests have to stop/start a server multiple time with the same listening address. Doing so without SO_REUSADDR leads to failures due to the socket still being in TIME_WAIT right after the first instance stop/before the second instance start. Instead of letting each test manually set SO_REUSEADDR on their servers, it can be done automatically by start_server_addr for all tests (and without any major downside). Enforce SO_REUSEADDR in start_server_addr for all tests. Signed-off-by: Alexis Lothoré (eBPF Foundation) Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20251105-start-server-soreuseaddr-v1-1-1bbd9c1f8d65@bootlin.com commit 15638d52cbcf6e969f4a5e2757b118355db583f3 Author: Christoph Hellwig Date: Wed Nov 5 14:52:15 2025 -0500 block: fix cached zone reporting after zone append was used No zone plugs are allocated when a zone is opened by calling Zone Append on it. This makes the cached zone reporting report incorrectly empty zones if the file system is unmounted and report zones is called after that, e.g. by xfstests test cases using the scratch device. Fix this by recording if zone append was used on a device, and disable cached reporting for the device until a ZONE_RESET_ALL happens that guarantees all zones are empty. We could probably do even better using a per-zone flag, but the practical use cache for zone reporting after the initial mount are rather limited, so let's keep things simple for now. Fixes: 31f0656a4ab7 ("block: introduce blkdev_report_zones_cached()") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit c6886cf610f4bb0b8aa6b88ab013a042e317f898 Author: Christoph Hellwig Date: Wed Nov 5 14:52:14 2025 -0500 block: don't leak disk->zones_cond for !disk_need_zone_resources disk->zones_cond is allocated for all zoned devices, but disk_free_zone_resources skips it when the zone write plug hash is not allocated, leaking the allocation for non-mq devices that don't emulate zone append. This is reported by kmemleak-enabled xfstests for various tests that use simple device mapper targets. Fix this by moving all code that requires writes plugs from disk_free_zone_resources into disk_destroy_zone_wplugs_hash_table and executing the rest of the code, including the disk->zones_cond freeing unconditionally. Fixes: 6e945ffb6555 ("block: use zone condition to determine conventional zones") Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit 156a530ed5ed012f35e8319c2ee5223dfc7195d3 Author: Coia Prant Date: Tue Nov 4 01:17:02 2025 +0800 arm64: dts: rockchip: Add devicetree for the 9Tripod X3568 v4 The 9Tripod X3568 v4 is an RK3568-based SBC, just like the RK3568-EVB. It always uses soldered connections between the X3568CV2/X3568CV3/X3568CV4 core board and the X3568bv4 I/O board. The differences between the core boards - PCB size, layout - CPU (RKK3568B2/RK3568J) - Memory type (DDR4/LPDDR4/LPDDR4X) and size - eMMC size - DSI/EDP resistor values Although the components vary, they maintain full compatibility. The X3568 board has multiple hardware revisions, and we currently support v4 (I/O board). Specification: - SoC: RockChip RK3568 ARM64 (4 cores) - eMMC: 16-128 GB - RAM: 2-16 GB - Power: DC 12V 2A - Ethernet: 2x YT8521SC RGMII (10/100/1000 Mbps) - Wireless radio: 802.11b/g/n/ac/ax dual-band - LED: Power: AlwaysOn User: GPIO - Button: VOL+: SARADC/0 <35k µV> VOL-: SARADC/0 <450k µV> Power/Reset: PMIC RK809 - CAN CAN/1: 4-pin (PH 2.0) - PWM PWM/4: Backlight DSI/0 DSI/1 PWM/7: IR Receiver [may not install] - UART: UART/2: Debug TTL - 1500000 8N1 (1.25mm) UART/3: TTL (PH 2.0) UART/4: TTL (PH 2.0) UART/8: AP6275S Bluetooth UART/9: TTL (PH 2.0) - I2C: I2C/0: PMIC RK809 I2C/1: Touchscreen DSI/0 DSI/1 I2C/4: Camera I2C/5: RTC@51 PCF8563 - I2S: I2S/0: miniHDMI Sound I2S/1: RK809 Audio Codec I2S/3: AP6275S Bluetooth Sound - SDMMC: SDMMC/0: microSD (TF) slot SDMMC/2: AP6275S SDIO WiFi card - Camera: 1x CSI - Video: miniHDMI / DSI0 (MIPI/LVDS) / DSI1 (MIPI/EDP) - Audio: miniHDMI / MIC on-board / Speaker / SPDIF / 3.5mm Headphones / AP6275S Bluetooth - USB: USB 2.0 HOST x2 USB 2.0 HOST x3 (4-pin) USB 2.0 OTG x1 (shared with USB 3.0 OTG/HOST) [slot may not install] USB 3.0 HOST x1 USB 3.0 OTG/HOST x1 - SATA: 1x SATA 3.0 with Power/4-pin [slot may not install] - PCIe: 1x PCIe 3.0 x2 (x4 connecter) [power/clock/slot may not install] Link: - https://appletsapi.52solution.com/media/X3568V4%E5%BC%80%E5%8F%91%E6%9D%BF%E7%A1%AC%E4%BB%B6%E6%89%8B%E5%86%8C.pdf - https://blog.gov.cooking/archives/research-ninetripod-x3568-v4-and-flash.html Signed-off-by: Coia Prant Link: https://patch.msgid.link/20251103171702.1518730-4-coiaprant@gmail.com Signed-off-by: Heiko Stuebner commit 4e92abd0a11b91af3742197a9ca962c3c00d0948 Author: Carlos Song Date: Mon Oct 27 19:02:56 2025 +0800 spi: imx: add i.MX51 ECSPI target mode support ECSPI in i.MX51 and i.MX53 support target mode. Current code only support i.MX53. Remove is_imx53_ecspi() check for target mode to support i.MX51. Signed-off-by: Carlos Song Link: https://patch.msgid.link/20251027110256.543314-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit 6951be397ca8b8b167c9f99b5a11c541148c38cb Author: Srinivas Kandagatla Date: Tue Oct 14 16:35:41 2025 +0100 ASoC: codecs: pm4125: remove duplicate code With recent addition of wcd-common, lot of code duplication in pm4125 codec can be removed now. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251014153541.283899-1-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 4db4ce15706d6423cc4cac4b05114b0469507bad Author: Thomas Weißschuh Date: Thu Nov 6 15:41:57 2025 +0100 ASoC: stm32: dfsdm: don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251106-restricted-pointers-stm-v1-1-7d03eb5020ba@linutronix.de Signed-off-by: Mark Brown commit 9311e6c29b348b005e79228ef6facd38ebcc73f9 Author: Tejun Heo Date: Thu Nov 6 08:12:36 2025 -1000 cgroup: Fix sleeping from invalid context warning on PREEMPT_RT cgroup_task_dead() is called from finish_task_switch() which runs with preemption disabled and doesn't allow scheduling even on PREEMPT_RT. The function needs to acquire css_set_lock which is a regular spinlock that can sleep on RT kernels, leading to "sleeping function called from invalid context" warnings. css_set_lock is too large in scope to convert to a raw_spinlock. However, the unlinking operations don't need to run synchronously - they just need to complete after the task is done running. On PREEMPT_RT, defer the work through irq_work. While the work doesn't need to happen immediately, it can't be delayed indefinitely either as the dead task pins the cgroup and task_struct can be pinned indefinitely. Use the lazy version of irq_work to allow batching and lower impact while ensuring timely completion. v2: Use IRQ_WORK_INIT_LAZY instead of immediate irq_work and add explanation for why the work can't be delayed indefinitely (Sebastian Andrzej Siewior). Fixes: d245698d727a ("cgroup: Defer task cgroup unlink until after the task is done switching out") Reported-by: Calvin Owens Link: https://lore.kernel.org/r/20251104181114.489391-1-calvin@wbinvd.org Signed-off-by: Tejun Heo commit 9d6d6b06933c86849e8e12f1cb9c1afb9c048536 Author: Shubhi Garg Date: Tue Oct 7 13:57:37 2025 +0000 rtc: nvvrs: add NVIDIA VRS RTC device driver Add support for NVIDIA VRS (Voltage Regulator Specification) RTC device driver. NVIDIA VRS is a Power Management IC (PMIC) that implements a power sequencing solution with I2C interface. The device includes RTC which provides functionality to get/set system time, retain system time across boot, wake system from suspend and shutdown state. Supported platforms: - NVIDIA Jetson AGX Orin Developer Kit - NVIDIA IGX Orin Development Kit - NVIDIA Jetson Orin NX Developer Kit - NVIDIA Jetson Orin Nano Developer Kit Signed-off-by: Shubhi Garg Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20251007135738.487694-4-shgarg@nvidia.com Signed-off-by: Alexandre Belloni commit 4c03653f19ae9b57e84cfe2d625b13bd1dfd449e Author: Shubhi Garg Date: Tue Oct 7 13:57:35 2025 +0000 dt-bindings: rtc: Document NVIDIA VRS RTC Add device tree bindings for NVIDIA VRS (Voltage Regulator Specification) RTC device. NVIDIA VRS is a Power Management IC (PMIC) that implements a power sequencing solution with I2C interface. The device includes RTC which provides functionality to get/set system time, retain system time across boot, wake system from suspend and shutdown state. Supported platforms: - NVIDIA Jetson AGX Orin Developer Kit - NVIDIA IGX Orin Development Kit - NVIDIA Jetson Orin NX Developer Kit - NVIDIA Jetson Orin Nano Developer Kit Signed-off-by: Shubhi Garg Reviewed-by: Rob Herring (Arm) Reviewed-by: Jon Hunter Tested-by: Jon Hunter Link: https://patch.msgid.link/20251007135738.487694-2-shgarg@nvidia.com Signed-off-by: Alexandre Belloni commit 8a25a2e34157d882032112e4194ccdfb29c499e8 Author: FUJITA Tomonori Date: Wed Nov 5 22:31:26 2025 +0900 net: phy: qt2025: Wait until PHY becomes ready Wait until a PHY becomes ready in the probe callback by using read_poll_timeout function. Reviewed-by: Andrew Lunn Reviewed-by: Alice Ryhl Reviewed-by: Gary Guo Signed-off-by: FUJITA Tomonori Link: https://patch.msgid.link/20251105133126.3221948-1-fujita.tomonori@gmail.com Signed-off-by: Jakub Kicinski commit a12838aab0cea1e4427d8d620906ce6a1a83a344 Author: Coia Prant Date: Tue Nov 4 01:17:01 2025 +0800 dt-bindings: arm: rockchip: Add 9Tripod X3568 series This documents 9Tripod X3568 v4 which is a SBC based on RK3568 SoC. Link: http://www.9tripod.com/showpro.php?id=117 Link: https://appletsapi.52solution.com/media/X3568V4%E5%BC%80%E5%8F%91%E6%9D%BF%E7%A1%AC%E4%BB%B6%E6%89%8B%E5%86%8C.pdf Signed-off-by: Coia Prant Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251103171702.1518730-3-coiaprant@gmail.com Signed-off-by: Heiko Stuebner commit 25802f8d16374bcfc1e32d26fdee0d89ec82f865 Author: Coia Prant Date: Tue Nov 4 01:17:00 2025 +0800 dt-bindings: vendor-prefixes: Add 9Tripod Add 9Tripod to the vendor prefixes. Signed-off-by: Coia Prant Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251103171702.1518730-2-coiaprant@gmail.com Signed-off-by: Heiko Stuebner commit fbf90d1b697faf61bb8b3ed72be6a8ebeb09de3d Author: FUKAUMI Naoki Date: Tue Nov 4 08:52:27 2025 +0000 arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T The Radxa ROCK 5B+/5T USB Type-C port supports Dual Role Data and should also act as a host. However, currently, when acting as a host, only self-powered devices work. Since the ROCK 5B+ supports Dual Role Power, set the power-role property to "dual" and the try-power-role property to "sink". (along with related properties) The ROCK 5T should only support the "source" power-role. This allows the port to act as a host, supply power to the port, and allow bus-powered devices to work. Note that on the ROCK 5T, with this patch applied, it has been observed that some bus-powered devices do not work correctly. Also, it has been observed that after connecting a device (and the data-role switches to host), connecting a host device does not switch the data-role back to the device role. These issues should be addressed separately. Note that there is a separate known issue where USB 3.0 SuperSpeed devices do not work when oriented in reverse. This issue should also be addressed separately. (USB 2.0/1.1 devices work in both orientations) Fixes: 67b2c15d8fb3c ("arm64: dts: rockchip: add USB-C support for ROCK 5B/5B+/5T") Signed-off-by: FUKAUMI Naoki Link: https://patch.msgid.link/20251104085227.820-1-naoki@radxa.com Signed-off-by: Heiko Stuebner commit 4f90742d4a09a8253861b0d5fd0984e3cd399c9b Author: Francesco Pompo Date: Mon Nov 3 13:25:39 2025 +0100 efistub/x86: Add fallback for SMBIOS record lookup Some Apple EFI firmwares do not provide the SMBIOS Protocol, causing efi_get_smbios_record() to fail. This prevents retrieval of system information such as product name, which is needed by apple_set_os() to enable the integrated GPU on dual-graphics Intel MacBooks. Add a fallback that directly parses the SMBIOS entry point table when the protocol is unavailable. Signed-off-by: Francesco Pompo [ardb: cosmetic tweaks] Signed-off-by: Ard Biesheuvel commit c6c76445c30bb73fd4cfba8f4742e642dcfe90f5 Author: Chris Morgan Date: Wed Nov 5 14:57:08 2025 -0600 arm64: dts: rockchip: Fix DMA for Indiedroid Nova Bluetooth When the device was first added, there was a problem with the bluetooth controller that manifested when DMA was enabled for the underlying UART interface. At some point in the intervening time the problem appears to have been resolved. Add the UART rx and tx channels back to re-enable UART. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251105205708.732125-6-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit cce837b7a3599dc83cd9c08afc07b076f127354b Author: Chris Morgan Date: Wed Nov 5 14:57:07 2025 -0600 arm64: dts: rockchip: Enable HS400 for Indiedroid Nova Once the DLL_STRBIN_TAPNUM_DEFAULT is set to the correct value [1], the workaround to ensure stable eMMC operation is no longer needed. I have observed testing this that hdparm went from: "Timing buffered disk reads: 502 MB in 3.00 seconds = 167.14 MB/sec" to the following: "Timing buffered disk reads: 832 MB in 3.00 seconds = 277.32 MB/sec" [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/drivers/mmc/host/sdhci-of-dwcmshc.c?id=a28352cf2d2f8380e7aca8cb61682396dca7a991 Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251105205708.732125-5-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit dfa4f7f5cb2c66fac5a17d63e5fcf1bf50ea7344 Author: Chris Morgan Date: Wed Nov 5 14:57:06 2025 -0600 arm64: dts: rockchip: enable NPU on Indiedroid Nova Enable the NPU on the Indiedroid Nova. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251105205708.732125-4-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 318bc4b5ad229435abbb7b9a7c8b1876fae311e7 Author: Chris Morgan Date: Wed Nov 5 14:57:04 2025 -0600 arm64: dts: rockchip: Add device type for Indiedroid Nova. Update the devicetree node to note the device category of the Indiedroid Nova as an embedded device. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251105205708.732125-2-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit c04956cccb78cc233a20cc18f663689671f03c65 Author: Breno Leitao Date: Wed Nov 5 10:01:12 2025 -0800 tg3: extract GRXRINGS from .get_rxnfc Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to optimize RX ring queries") added specific support for GRXRINGS callback, simplifying .get_rxnfc. Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new .get_rx_ring_count(). Given that tg3_get_rxnfc() only handles ETHTOOL_GRXRINGS, then this function becomes useless now, and it is removed. This also fixes the behavior for devices without MSIX support. Previously, the function would return -EOPNOTSUPP, but now it correctly returns 1. The functionality remains the same: return the current queue count if the device is running, otherwise return the minimum of online CPUs and TG3_RSS_MAX_NUM_QS. Signed-off-by: Breno Leitao Reviewed-by: Michael Chan Link: https://patch.msgid.link/20251105-grxrings_v1-v1-1-54c2caafa1fd@debian.org Signed-off-by: Jakub Kicinski commit 8a429c58354a59fa3cbd1fd964fa2e310c47af4a Author: Chris Morgan Date: Thu Nov 6 12:24:36 2025 -0600 arm64: dts: rockchip: enable NPU on Gameforce Ace Enable the NPU on the Gameforce Ace. Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20251106182436.771805-1-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 37f46601383aa5a19bd42ea99617fa0fa6215f77 Author: Steven Rostedt Date: Tue Oct 14 14:51:49 2025 -0400 selftests/tracing: Add basic test for trace_marker_raw file Commit 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read user space") made an update that fixed both trace_marker and trace_marker_raw. But the small difference made to trace_marker_raw had a blatant bug in it that any basic testing would have uncovered. Unfortunately, the self tests have tests for trace_marker but nothing for trace_marker_raw which allowed the bug to get upstream. Add basic selftests to test trace_marker_raw so that this doesn't happen again. Link: https://lore.kernel.org/r/20251014145149.3e3c1033@gandalf.local.home Signed-off-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Shuah Khan commit 3da28eb277c1c175df1aa048e404cc765ae04327 Author: Aleksandr Loktionov Date: Thu Oct 30 14:59:50 2025 +0100 iavf: add RSS support for GTP protocol via ethtool Extend the iavf driver to support Receive Side Scaling (RSS) configuration for GTP (GPRS Tunneling Protocol) flows using ethtool. The implementation introduces new RSS flow segment headers and hash field definitions for various GTP encapsulations, including: - GTPC - GTPU (IP, Extension Header, Uplink, Downlink) - TEID-based hashing The ethtool interface is updated to parse and apply these new flow types and hash fields, enabling fine-grained traffic distribution for GTP-based mobile workloads. This enhancement improves performance and scalability for virtualized network functions (VNFs) and user plane functions (UPFs) in 5G and LTE deployments. Reviewed-by: Jedrzej Jagielski Reviewed-by: Simon Horman Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 41e880eb8482499f0acb6371b30fe7d8dd44eb8b Author: Przemek Kitszel Date: Thu Oct 30 14:59:49 2025 +0100 ice: Extend PTYPE bitmap coverage for GTP encapsulated flows Consolidate updates to the Protocol Type (PTYPE) bitmap definitions across multiple flow types in the Intel ICE driver to support GTP (GPRS Tunneling Protocol) encapsulated traffic. Enable improved Receive Side Scaling (RSS) configuration for both user and control plane GTP flows. Cover a wide range of protocol and encapsulation scenarios, including: - MAC OFOS and IL - IPv4 and IPv6 (OFOS, IL, ALL, no-L4) - TCP, SCTP, ICMP - GRE OF - GTPC (control plane) Expand the PTYPE bitmap entries to improve classification and distribution of GTP traffic across multiple queues, enhancing performance and scalability in mobile network environments. Co-developed-by: Dan Nowlin Signed-off-by: Dan Nowlin Co-developed-by: Qi Zhang Signed-off-by: Qi Zhang Co-developed-by: Jie Wang Signed-off-by: Jie Wang Co-developed-by: Junfeng Guo Signed-off-by: Junfeng Guo Signed-off-by: Przemek Kitszel Reviewed-by: Jedrzej Jagielski Reviewed-by: Simon Horman Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit f89e4e1512333fcb92474e0e8487929b352c50de Author: Aleksandr Loktionov Date: Thu Oct 30 14:59:48 2025 +0100 ice: improve TCAM priority handling for RSS profiles Enhance TCAM priority logic to avoid conflicts between RSS profiles with overlapping PTGs and attributes. Track used PTG and attribute combinations. Ensure higher-priority profiles override lower ones. Add helper for setting TCAM flags and masks. Ensure RSS rule consistency and prevent unintended matches. Co-developed-by: Dan Nowlin Signed-off-by: Dan Nowlin Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 3a6d87e2eaaced60411b32c06191a5971c1303c2 Author: Aleksandr Loktionov Date: Thu Oct 30 14:59:47 2025 +0100 ice: implement GTP RSS context tracking and configuration This commit implements the core RSS context management and configuration logic for GTP (GTPU) protocol support in VF RSS operations. Key implementation features: - GTPU hash context management with pre/post processing functions - Context index calculation and mapping for different GTPU scenarios - Integration with main RSS configuration flow via wrapper functions - Support for IPv4/IPv6 GTPU RSS configurations - Rollback mechanism for handling RSS rule conflicts - Hash context reset and cleanup functionality The implementation provides comprehensive GTPU RSS support by: 1. Adding ice_add_rss_cfg_pre_gtpu() for preprocessing GTPU contexts 2. Adding ice_add_rss_cfg_post_gtpu() for postprocessing configurations 3. Adding ice_calc_gtpu_ctx_idx() for context index calculation 4. Integrating GTPU logic into ice_add_rss_cfg_wrap() and ice_rem_rss_cfg_wrap() 5. Supporting context tracking in VF hash_ctx structures This completes the GTP RSS infrastructure enabling VFs to configure RSS hashing on GTP-encapsulated traffic. Co-developed-by: Dan Nowlin Signed-off-by: Dan Nowlin Co-developed-by: Jie Wang Signed-off-by: Jie Wang Co-developed-by: Junfeng Guo Signed-off-by: Junfeng Guo Co-developed-by: Qi Zhang Signed-off-by: Qi Zhang Co-developed-by: Ting Xu Signed-off-by: Ting Xu Signed-off-by: Przemek Kitszel Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 38724a474c0fc37b6604e8b20c75d87446fc2fd1 Author: Aleksandr Loktionov Date: Thu Oct 30 14:59:46 2025 +0100 ice: add virtchnl definitions and static data for GTP RSS Add virtchnl protocol header and field definitions for advanced RSS configuration including GTPC, GTPU, L2TPv2, ECPRI, PPP, GRE, and IP fragment headers. - Define new virtchnl protocol header types - Add RSS field selectors for tunnel protocols - Extend static mapping arrays for protocol field matching - Add L2TPv2 session ID and length+session ID field support This provides the foundational definitions needed for VF RSS configuration of tunnel protocols. Co-developed-by: Dan Nowlin Signed-off-by: Dan Nowlin Co-developed-by: Jie Wang Signed-off-by: Jie Wang Co-developed-by: Junfeng Guo Signed-off-by: Junfeng Guo Co-developed-by: Qi Zhang Signed-off-by: Qi Zhang Co-developed-by: Ting Xu Signed-off-by: Ting Xu Signed-off-by: Przemek Kitszel Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 12ed3e5a03a8a5150977c2fa7e4dd739320592bc Author: Aleksandr Loktionov Date: Thu Oct 30 14:59:45 2025 +0100 ice: add flow parsing for GTP and new protocol field support Introduce new protocol header types and field sizes to support GTPU, GTPC tunneling protocols. - Add field size macros for GTP TEID, QFI, and other headers - Extend ice_flow_field_info and enum definitions - Update hash macros for new protocols - Add support for IPv6 prefix matching and fragment headers This patch lays the groundwork for enhanced RSS and flow classification capabilities. Co-developed-by: Dan Nowlin Signed-off-by: Dan Nowlin Co-developed-by: Junfeng Guo Signed-off-by: Junfeng Guo Co-developed-by: Ting Xu Signed-off-by: Ting Xu Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Signed-off-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 380e6f3c7bc53c74697423ff3f057138ad2b6d8f Merge: 1ec9871fbb80ba 22335939ec907c Author: Jakub Kicinski Date: Thu Nov 6 14:16:20 2025 -0800 Merge branch 'net-dsa-lantiq_gswip-add-support-for-maxlinear-gsw1xx-switch-family' Daniel Golle says: ==================== net: dsa: lantiq_gswip: Add support for MaxLinear GSW1xx switch family This patch series extends the existing lantiq_gswip DSA driver to support the MaxLinear GSW1xx family of dedicated Ethernet switch ICs. These switches are based on the same IP as the Lantiq/Intel GSWIP found in VR9 and xRX MIPS router SoCs which are currently supported by the lantiq_gswip driver, but they are dedicated ICs connected via MDIO rather than built-in components of a SoC accessible via memory-mapped I/O. The series includes several improvements and refactoring to implement support for GSW1xx switch ICs by reusing the existing lantiq_gswip driver. The GSW1xx family includes several variants: - GSW120: 4 ports, 2 PHYs, RGMII & SGMII/2500Base-X - GSW125: 4 ports, 2 PHYs, RGMII & SGMII/2500Base-X, industrial temperature - GSW140: 6 ports, 4 PHYs, RGMII & SGMII/2500Base-X - GSW141: 6 ports, 4 PHYs, RGMII & SGMII - GSW145: 6 ports, 4 PHYs, RGMII & SGMII/2500Base-X, industrial temperature Key features implemented: - MDIO-based register access using regmap - Support for SGMII/1000Base-X/2500Base-X SerDes interfaces - Configurable RGMII delays via device tree properties - Configurable RMII clock direction - Energy Efficient Ethernet (EEE) support - enabling/disabling learning ==================== Link: https://patch.msgid.link/cover.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 22335939ec907cca26be41f10f6cc01f0df8b0e9 Author: Daniel Golle Date: Mon Nov 3 12:20:28 2025 +0000 net: dsa: add driver for MaxLinear GSW1xx switch family Add driver for the MaxLinear GSW1xx family of Ethernet switch ICs which are based on the same IP as the Lantiq/Intel GSWIP found in the Lantiq VR9 and Intel GRX MIPS router SoCs. The main difference is that instead of using memory-mapped I/O to communicate with the host CPU these ICs are connected via MDIO (or SPI, which isn't supported by this driver). Implement the regmap API to access the switch registers over MDIO to allow reusing lantiq_gswip_common for all core functionality. The GSW1xx also comes with a SerDes port capable of 1000Base-X, SGMII and 2500Base-X, which can either be used to connect an external PHY or SFP cage, or as the CPU port. Support for the SerDes interface is implemented in this driver using the phylink_pcs interface. Signed-off-by: Daniel Golle Tested-by: Alexander Sverdlin Link: https://patch.msgid.link/b567ec1b4beb08fd37abf18b280c56d5d8253c26.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit c6230446b1a6f3c91effafd99f604de455da52e5 Author: Daniel Golle Date: Mon Nov 3 12:20:20 2025 +0000 net: dsa: add tagging driver for MaxLinear GSW1xx switch family Add support for a new DSA tagging protocol driver for the MaxLinear GSW1xx switch family. The GSW1xx switches use a proprietary 8-byte special tag inserted between the source MAC address and the EtherType field to indicate the source and destination ports for frames traversing the CPU port. Implement the tag handling logic to insert the special tag on transmit and parse it on receive. Signed-off-by: Daniel Golle Reviewed-by: Alexander Sverdlin Tested-by: Alexander Sverdlin Link: https://patch.msgid.link/0e973ebfd9433c30c96f50670da9e9449a0d98f2.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit e1bb4b36a7ae0915f16abb5fd7073d2547235fa7 Author: Daniel Golle Date: Mon Nov 3 12:20:12 2025 +0000 dt-bindings: net: dsa: lantiq,gswip: add support for MaxLinear GSW1xx switches Extend the Lantiq GSWIP device tree binding to also cover MaxLinear GSW1xx switches which are based on the same hardware IP but connected via MDIO instead of being memory-mapped. Add compatible strings for MaxLinear GSW120, GSW125, GSW140, GSW141, and GSW145 switches and adjust the schema to handle the different connection methods with conditional properties. Add MaxLinear GSW125 example showing MDIO-connected configuration. Signed-off-by: Daniel Golle Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/fc96f1dedb2b418a63e69960356dde7f6eb86424.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit cdef8e47b638bcc35b0e05f48269a2667ec665da Author: Daniel Golle Date: Mon Nov 3 12:20:05 2025 +0000 net: dsa: lantiq_gswip: allow adjusting MII delays Currently the MII clk vs. data delay is configured based on the PHY interface mode. In addition to that add support for setting up MII delays using the standard Device Tree properties 'tx-internal-delay-ps' and 'rx-internal-delay-ps', using the values determined by the PHY interface mode as default to maintain backward compatibility with legacy device trees. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/37203e831cff87dc46e5ef9e8cbd68fb8689773d.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit bea0c17786116141aaf3980dc73758e3cc0d2748 Author: Daniel Golle Date: Mon Nov 3 12:19:58 2025 +0000 dt-bindings: net: dsa: lantiq,gswip: add support for MII delay properties Add support for standard tx-internal-delay-ps and rx-internal-delay-ps properties on port nodes to allow fine-tuning of RGMII clock delays. The GSWIP switch hardware supports delay values in 500 picosecond increments from 0 to 3500 picoseconds, with a post-reset default of 2000 picoseconds for both TX and RX delays. The driver currently sets the delay to 0 in case the PHY is setup to carry out the delay by the corresponding interface modes ("rgmii-id", "rgmii-rxid", "rgmii-txid"). This corresponds to the driver changes that allow adjusting MII delays using Device Tree properties instead of relying solely on the PHY interface mode. Signed-off-by: Daniel Golle Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/9e007d4f85c2c6d69e0b91f3663d99e0f6fc8eac.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 319fd7e9d446bb90469a82f876e78785f6da0bc5 Author: Daniel Golle Date: Mon Nov 3 12:19:47 2025 +0000 net: dsa: lantiq_gswip: add vendor property to setup MII refclk output Read boolean Device Tree property "maxlinear,rmii-refclk-out" and switch the RMII reference clock to be a clock output rather than an input if it is set. Signed-off-by: Daniel Golle Reviewed-by: Alexander Sverdlin Tested-by: Alexander Sverdlin Link: https://patch.msgid.link/947d14970f74f760e4a60c777aabee64e7e4f356.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit e836824116b5644eb681777cd58cba915f4cbe75 Author: Daniel Golle Date: Mon Nov 3 12:19:34 2025 +0000 dt-bindings: net: dsa: lantiq,gswip: add MaxLinear RMII refclk output property Add support for the maxlinear,rmii-refclk-out boolean property on port nodes to configure the RMII reference clock to be an output rather than an input. This property is only applicable for ports in RMII mode and allows the switch to provide the reference clock for RMII-connected PHYs instead of requiring an external clock source. This corresponds to the driver changes that read this Device Tree property to configure the RMII clock direction. Signed-off-by: Daniel Golle Reviewed-by: Alexander Sverdlin Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/9813bb916ecce9bae366e6c50c081014fe5371ea.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 0c56a98560c16d118d35e58a25541a3ac2717b78 Author: Daniel Golle Date: Mon Nov 3 12:19:25 2025 +0000 net: dsa: lantiq_gswip: define and use GSWIP_TABLE_MAC_BRIDGE_VAL1_VALID When adding FDB entries to the MAC bridge table on GSWIP 2.2 or later it is needed to set an (undocumented) bit to mark the entry as valid. If this bit isn't set for entries in the MAC bridge table, then those entries won't be considered as valid MAC addresses. Signed-off-by: Daniel Golle Link: https://patch.msgid.link/e02fe0d946c98920bc55b5f389a8f56382aae7df.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 3e5ef3b1709afecd86886bc8eb2425e39b09196d Author: Daniel Golle Date: Mon Nov 3 12:19:10 2025 +0000 net: dsa: lantiq_gswip: set link parameters also for CPU port On standalone switch ICs the link parameters of the CPU port need to be setup just like user ports. The destinction in the driver to not carry out link parameter setup for the CPU port does make sense for in-SoC switches on which the CPU port is internally connected to the SoC's Ethernet MAC. Set link parameters also for the CPU port unless it is an internal interface. Note that the internal TP PHYs anyway cannot be used as CPU ports, hence it doesn't matter that they are now also covered by that condition. Signed-off-by: Daniel Golle Reviewed-by: Alexander Sverdlin Tested-by: Alexander Sverdlin Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/07c6b8d3a12296123be5e5938b454fc620f819e6.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 9ec1fc0bf2b0ee89b3195d1c1db2cdb471a8c85d Author: Daniel Golle Date: Mon Nov 3 12:19:00 2025 +0000 net: dsa: lantiq_gswip: support Energy Efficient Ethernet Introduce support for Energy Efficient Ethernet (EEE) on hardware version 2.2 or later. Signed-off-by: Daniel Golle Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/753e45acb25e185689ca1afd8a9bd0c199d1c15b.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit a7d4b05f9d748fef80de89d2dd650d5d2ae2f590 Author: Daniel Golle Date: Mon Nov 3 12:18:49 2025 +0000 net: dsa: lantiq_gswip: support enable/disable learning Switch API 2.2 or later supports enabling or disabling learning on each port. Implement support for BR_LEARNING bridge flag and announce support for BR_LEARNING on GSWIP 2.2 or later. Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/0aa4621e01c998378ad5812464bc17d23aa3bf62.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 322a1e6f3d687d3b116837036299abeb4d79ba76 Author: Daniel Golle Date: Mon Nov 3 12:18:41 2025 +0000 net: dsa: lantiq_gswip: split into common and MMIO parts Move all parts specific for the MMIO/SoC driver into a module of its own to prepare for supporting MDIO-connected switch ICs. Modify gswip_probe() functions by splitting it into a common function gswip_probe_common() which covers allocating, initializing and registering the DSA switch, while keeping transport-specific regmap initialization as well as PHY firmware loading in the new MMIO/SoC-specific gswip_probe() function. Signed-off-by: Daniel Golle Tested-by: Alexander Sverdlin Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/dc7da5b65ec220ba8e9bc4bd04fe1ed7de046656.1762170107.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 7adca706fe16581c899317196f5f40d3ad5ccc84 Author: CL Wang Date: Mon Sep 15 11:14:39 2025 +0800 rtc: atcrtc100: Add ATCRTC100 RTC driver RTC driver for Andes ATCRTC100 Real-Time Clock. Signed-off-by: CL Wang Link: https://patch.msgid.link/20250915031439.2680364-4-cl634@andestech.com Signed-off-by: Alexandre Belloni commit a603092d5be1b24af19676ad8a4a7974d426b7f8 Author: CL Wang Date: Mon Sep 15 11:14:38 2025 +0800 MAINTAINERS: Add entry for ATCRTC100 RTC driver Add support entry for the Andes ATCRTC100 RTC driver in the MAINTAINERS file. Signed-off-by: CL Wang Link: https://patch.msgid.link/20250915031439.2680364-3-cl634@andestech.com Signed-off-by: Alexandre Belloni commit e1794c59730a68d6ece55430766cc51720ac653a Author: CL Wang Date: Mon Sep 15 11:14:37 2025 +0800 dt-bindings: rtc: Add support for ATCRTC100 RTC Document Device Tree bindings for the Andes ATCRTC100 Real-Time Clock. Signed-off-by: CL Wang Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20250915031439.2680364-2-cl634@andestech.com Signed-off-by: Alexandre Belloni commit 0ed3a30fd996cb0cac872432cf25185fda7e5316 Author: Raghavendra Rao Ananta Date: Fri Oct 31 17:06:03 2025 +0000 hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops The commit, <86624ba3b522> ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD") accidentally ignored including the .match_token_uuid callback in the hisi_acc_vfio_pci_migrn_ops struct. Introduce the missed callback here. Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD") Cc: stable@vger.kernel.org Suggested-by: Longfang Liu Signed-off-by: Raghavendra Rao Ananta Reviewed-by: Longfang Liu Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20251031170603.2260022-3-rananta@google.com Signed-off-by: Alex Williamson commit 2f03f21fe7516902283b135de272d3c7b10672de Author: Raghavendra Rao Ananta Date: Fri Oct 31 17:06:02 2025 +0000 vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd() For the cases where user includes a non-zero value in 'token_uuid_ptr' field of 'struct vfio_device_bind_iommufd', the copy_struct_from_user() in vfio_df_ioctl_bind_iommufd() fails with -E2BIG. For the 'minsz' passed, copy_struct_from_user() expects the newly introduced field to be zero-ed, which would be incorrect in this case. Fix this by passing the actual size of the kernel struct. If working with a newer userspace, copy_struct_from_user() would copy the 'token_uuid_ptr' field, and if working with an old userspace, it would zero out this field, thus still retaining backward compatibility. Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD") Cc: stable@vger.kernel.org Signed-off-by: Raghavendra Rao Ananta Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20251031170603.2260022-2-rananta@google.com Signed-off-by: Alex Williamson commit deb769920ebf905580d24b3ad18a9f804b72147a Author: Ravi Kumar Vodapalli Date: Wed Nov 5 11:07:06 2025 -0300 drm/i915/xe3p_lpd: Adapt to updates on MBUS_CTL/DBUF_CTL registers Xe3p_LPD updated fields of registers MBUS_CTL and DBUF_CTL to accommodate for higher MDCLK:CDCLK ratios. Update the code to use the new fields. The field MBUS_TRANSLATION_THROTTLE_MIN_MASK was changed from range [15:13] to [16:13]. Since bit 16 is not reserved in previous display IPs and already used for something else, we can't simply extend the mask definition to include it, but rather define an Xe3p-specific mask and select the correct one to use based on the IP version. Similarly, DBUF_MIN_TRACKER_STATE_SERVICE_MASK was changed from range [18:16] to [20:16]. For the same reasons stated above, it needs a Xe3p-specific mask definition. v2: - Keep definitions in the same line (i.e. without line continuation breaks) for better readability. (Jani) v3: - Keep mask fields sorted by the upper limit. (Matt) - Extend commit message to indicate why we need Xe3p-specific definitions of the masks instead of just extending the existing ones. (Matt) Bspec: 68868, 68872 Cc: Jani Nikula Signed-off-by: Ravi Kumar Vodapalli Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-18-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit e2a06cf825ef07f3c657b9434abe5269aff8a56b Author: Gustavo Sousa Date: Wed Nov 5 11:07:05 2025 -0300 drm/i915/xe3p_lpd: Always apply WaWmMemoryReadLatency When reading memory latencies for watermark calculations, previous display releases instructed to apply an adjustment of adding a certain value (e.g. 6us) to all levels when the level 0's memory latency read from hardware was zero. For Xe3p_LPD, the instruction is to always use 6us for level 0 and to add that value to the other levels. Add the necessary code in sanitize_wm_latency() so that WaWmMemoryReadLatency is always applied for Xe3p_LPD and beyond. v2: - Rebased after addition of prep patch "drm/i915/wm: Reorder adjust_wm_latency() for Xe3_LPD" (dropped in v3). v3: - Back to the simpler approach of doing the 'wm[0] = 0' step without modifying the rest of the code, and that inside sanitize_wm_latency(). (Matt Roper, Ville) Bspec: 68986, 69126 Cc: Matt Atwood Cc: Ville Syrjälä Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-20-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 9b286c3b0bc0e0f242b2495ccb1b3523d50be484 Author: Gustavo Sousa Date: Wed Nov 5 11:07:04 2025 -0300 drm/i915/dram: Add field ecc_impacting_de_bw Starting with Xe3p_LPD, we now have a new field in MEM_SS_INFO_GLOBAL that indicates whether the memory has enabled ECC that limits display bandwidth. Add the field ecc_impacting_de_bw to struct dram_info to contain that information and set it appropriately when probing for memory info. Currently there are no instructions in Bspec on how to handle that case, so let's throw a warning if we ever find such a scenario. v2: - s/ecc_impacting_de/ecc_impacting_de_bw/ to be more specific. (Matt Atwood) - Add warning if ecc_impacting_de_bw is true, since we currently do not have instructions on how to handle it. (Matt Roper) v3: - Check on ecc_impacting_de_bw for the warning only for Xe3p_LPD and beyond. - Change warning macro from drm_WARN_ON_ONCE() to drm_WARN_ON(). Bspec: 69131 Cc: Jani Nikula Cc: Matt Atwood Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-15-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 979c7cbd6c6cd3d8061bb69c32832a4c847e0ee6 Author: Luca Coelho Date: Wed Nov 5 11:07:03 2025 -0300 drm/i915/wm: don't use method1 in Xe3p_LPD onwards Starting from display version 35, we don't need to use method1 to calculate the watermark values anymore, so skip it. Bspec: 68985 Signed-off-by: Luca Coelho Reviewed-by: Shekhar Chauhan Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-14-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 6171b78ac273acf606660b0d1fc1d123cec378b1 Author: Gustavo Sousa Date: Wed Nov 5 11:07:02 2025 -0300 drm/i915/xe3p_lpd: Reload DMC MMIO for pipes C and D Xe3p_LPD has the same behavior as for Xe3_LPD with respect to DMC context data for pipes C and D, which are lost when their power wells are disabled. As such, let's extend the condition for Xe3_LPD in need_pipedmc_load_mmio() to also catch Xe3p_LPD. Bspec: 68851 Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-13-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit c128c31393baa898c87c069c1758bd5bdede890d Author: Juha-pekka Heikkila Date: Wed Nov 5 11:07:01 2025 -0300 drm/i915/xe3p_lpd: Don't allow odd ypan or ysize with semiplanar format Disable support for odd panning and size in y direction when running on display version 35 and using semiplanar formats. Bspec: 68903 Signed-off-by: Juha-pekka Heikkila Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-12-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 9676c29f74cab237a04b92fceaa1bb2e33de1e1b Author: Gustavo Sousa Date: Wed Nov 5 11:07:00 2025 -0300 drm/i915/xe3p_lpd: Extend Wa_16025573575 Wa_16025573575 also applies to Xe3p_LPD, so let's include it in the IP version checks. Reviewed-by: Shekhar Chauhan Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-11-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit b9802de99c4119bc09dcd9bdeae1e0c0387ffc03 Author: Ankit Nautiyal Date: Wed Nov 5 11:06:59 2025 -0300 drm/i915/xe3p_lpd: Drop support for interlace mode Interlace mode is officially removed from HW from Xe3p_LPD. The register TRANS_VSYNCSHIFT and the bits in TRANS_CONF are now removed, so make sure we do not set/get these anymore. Bspec: 69961, 70000 Signed-off-by: Ankit Nautiyal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-10-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit b8118807f752c2ba3f957f0c9cfdf89acb36bd43 Author: Gustavo Sousa Date: Wed Nov 5 11:06:58 2025 -0300 drm/i915/xe3p_lpd: Load DMC firmware Load the DMC firmware for Xe3p_LPD. Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-9-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit af28e607fc754a2c5ef9ce72e0045b6952b4f3ad Author: Gustavo Sousa Date: Wed Nov 5 11:06:57 2025 -0300 drm/i915/xe3p_lpd: Add CDCLK table Add CDCLK table for Xe3p_LPD. Just as with Xe3_LPD, we don't need to send voltage index info in the PMDemand message, so we are able to re-use xe3lpd_cdclk_funcs. With the new CDCLK table, we also need to update the maximum CDCLK value returned by intel_update_max_cdclk(). Bspec: 68861, 68863 Reviewed-by: Matt Atwood Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-8-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 2d608ce6e6597c37a78e7f98c160ac1a27941774 Author: Sai Teja Pottumuttu Date: Wed Nov 5 11:06:56 2025 -0300 drm/i915/xe3p_lpd: Remove gamma,csc bottom color checks With Xe3p_LPD, the SKL_BOTTOM_COLOR_GAMMA_ENABLE and SKL_BOTTOM_COLOR_CSC_ENABLE bits are being removed. Thus, we need not set gamma_enable nor csc_enable in crtc_state. Note that GAMMA_MODE.POST_CSC_GAMMA_ENABLE and CSC_MODE.ICL_CSC_ENABLE are the documented alternatives for the bottom color bits being removed. But as these suggested bits are being checked in state checker as part of gamma_mode, csc_mode fields and as gamma_enable/csc_enable are not being used anywhere else functionally post ICL, we need not set these fields in crtc_state. Bspec: 69734 Signed-off-by: Sai Teja Pottumuttu Reviewed-by: Chaitanya Kumar Borah Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-7-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 8d8efb83c818f777c528e96542d5a7bd12d42ad0 Author: Sai Teja Pottumuttu Date: Wed Nov 5 11:06:55 2025 -0300 drm/i915/xe3p_lpd: Horizontal flip support for linear surfaces Starting from Xe3p_LPD, linear surfaces also support horizontal flip. Bspec: 68904 Signed-off-by: Sai Teja Pottumuttu Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-6-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit fd0e715adf4a0e178e94f66b1cdce384b66c2475 Author: Sai Teja Pottumuttu Date: Wed Nov 5 11:06:54 2025 -0300 drm/i915/xe3p_lpd: Expand bifield masks dbuf blocks fields On Xe3p_LPD, the dbuf blocks fields of different registers are now documented as 13-bit fields. The dbuf isn't really large enough to need the 13th bit, but let's go ahead and update the definition now just in case some new display IP in future ends up needing the larger size. The extra bit is an unused bit in previous display versions, so we can safely just extend the existing definition. Bspec: 69847, 69880, 72053 Signed-off-by: Sai Teja Pottumuttu Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-5-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 398fea05360291a77a5cc839cc5168059342722b Author: Matt Atwood Date: Wed Nov 5 11:06:53 2025 -0300 drm/i915/xe3p_lpd: Update bandwidth parameters Bandwidth parameters for Xe3p_LPD are the same as for Xe3_LPD. Re-use them. Since handling for Xe3_LPD version 30.02 is more like a special case, let's use a "== 3002" check for it inside the ">= 30" branch instead of adding a new branch for version 35. That allows us to re-use the ">= 30" branch for Xe3p_LPD. v2: - Do not have a special case for ecc_impacting_de_bw, since there are no specific instructions in Bspec for this scenario. (Matt Roper) v3: - Re-use the ">= 30" branch in the if-ladder. (Matt Roper) Bspec: 68859 Signed-off-by: Matt Atwood Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-4-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit b28ba095f3d06e4a00c8e72aba047b92c3e6a746 Author: Gustavo Sousa Date: Wed Nov 5 11:06:52 2025 -0300 drm/i915/display: Use braces for if-ladder in intel_bw_init_hw() Looking at the current if-ladder in intel_bw_init_hw(), we see that Xe2_HPD contains two entries, differing only for ECC memories. Let's improve readability by using braces and allowing adding extra conditions for each case. v2: - Tweaked commit message, since we are not going to add the ECC case for Xe3p_LPD anymore. Reviewed-by: Matt Roper Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-3-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 7f0a653a16a84399d59a2c09d508bf87ed38e1c6 Author: Matt Roper Date: Wed Nov 5 11:06:51 2025 -0300 drm/i915/xe3p_lpd: Drop north display reset option programming The NDE_RSTWRN_OPT has been removed on Xe3p platforms and reset option programming is no longer necessary during display init. Bspec: 68846, 69137 Signed-off-by: Matt Roper Reviewed-by: Matt Atwood Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-2-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 91a5bcdb548b9cd59966b804295d28187299e4f7 Author: Sai Teja Pottumuttu Date: Wed Nov 5 11:06:50 2025 -0300 drm/i915/xe3p_lpd: Add Xe3p_LPD display IP features Xe3p_LPD (display version 35) is similar to Xe2_LPD with respect to the features described by struct intel_display_device_info, so reuse its device descriptor. v2: - Add reference to Bspec 74201. (Shekhar) Bspec: 74201, 74304 Signed-off-by: Sai Teja Pottumuttu Reviewed-by: Shekhar Chauhan Link: https://patch.msgid.link/20251103-xe3p_lpd-basic-enabling-v3-1-00e87b510ae7@intel.com Signed-off-by: Gustavo Sousa commit 2c031d4c772f3a9191d04d57a3403ad6a56375c7 Author: Mohammad Heib Date: Sat Oct 25 16:08:59 2025 +0300 i40e: support generic devlink param "max_mac_per_vf" Currently the i40e driver enforces its own internally calculated per-VF MAC filter limit, derived from the number of allocated VFs and available hardware resources. This limit is not configurable by the administrator, which makes it difficult to control how many MAC addresses each VF may use. This patch adds support for the new generic devlink runtime parameter "max_mac_per_vf" which provides administrators with a way to cap the number of MAC addresses a VF can use: - When the parameter is set to 0 (default), the driver continues to use its internally calculated limit. - When set to a non-zero value, the driver applies this value as a strict cap for VFs, overriding the internal calculation. Important notes: - The configured value is a theoretical maximum. Hardware limits may still prevent additional MAC addresses from being added, even if the parameter allows it. - Since MAC filters are a shared hardware resource across all VFs, setting a high value may cause resource contention and starve other VFs. - This change gives administrators predictable and flexible control over VF resource allocation, while still respecting hardware limitations. - Previous discussion about this change: https://lore.kernel.org/netdev/20250805134042.2604897-2-dhill@redhat.com https://lore.kernel.org/netdev/20250823094952.182181-1-mheib@redhat.com Signed-off-by: Mohammad Heib Reviewed-by: Jacob Keller Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Jacob Keller Signed-off-by: Tony Nguyen commit 9352d40c8bcd2ef29366d2c38b163c0b115039ed Author: Mohammad Heib Date: Sat Oct 25 16:08:58 2025 +0300 devlink: Add new "max_mac_per_vf" generic device param Add a new device generic parameter to controls the maximum number of MAC filters allowed per VF. For example, to limit a VF to 3 MAC addresses: $ devlink dev param set pci/0000:3b:00.0 name max_mac_per_vf \ value 3 \ cmode runtime Signed-off-by: Mohammad Heib Reviewed-by: Simon Horman Signed-off-by: Jacob Keller Signed-off-by: Tony Nguyen commit c331b400e291a510eb9a0dbdc783b38e6f8321f0 Author: Uros Bizjak Date: Thu Nov 6 11:12:30 2025 -0800 KVM: SVM: Ensure SPEC_CTRL[63:32] is context switched between guest and host SPEC_CTRL is an MSR, i.e. a 64-bit value, but the VMRUN assembly code assumes bits 63:32 are always zero. The bug is _currently_ benign because neither KVM nor the kernel support setting any of bits 63:32, but it's still a bug that needs to be fixed. Signed-off-by: Uros Bizjak Suggested-by: Sean Christopherson Co-developed-by: Sean Christopherson Link: https://patch.msgid.link/20251106191230.182393-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 6918667af5a7315eff3c56d871be4c5439f7f9d2 Author: Mukesh Ojha Date: Tue Nov 4 18:39:06 2025 +0530 soc: qcom: socinfo: Add reserve field to support future extension Some of the new field added to socinfo structure with version 21, 22 and 23 which is only used by boot firmware and it is of no use for Linux.Add reserve field in socinfo so that the structure remain updated and prepared if we get any new field in future which could be used by Linux. While at it, also updates switch case for backward compatibility if the SoC runs with boot firmware which has these new version added. Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20251104130906.167666-2-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 6a571d762cda6c25517c5533b8bd06d56028cdcb Author: Mukesh Ojha Date: Tue Nov 4 18:39:05 2025 +0530 soc: qcom: socinfo: Add support for new fields in revision 20 Add support for socinfo version 20. Version 20 adds a new field package id and its zeroth bit contain information that can be can be used to tune temperature thresholds on devices which might be able to withstand higher temperatures. Zeroth bit value 1 means that its heat dissipation is better and more relaxed thermal scheme can be put in place and 0 means a more aggressive scheme may be needed. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20251104130906.167666-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 35ddab284539c5c4352f07f7866163c5b6c2a236 Author: Jie Gan Date: Tue Nov 4 13:48:14 2025 +0800 arm64: dts: qcom: kodiak: add coresight nodes Add TPDM, TPDA, CTI and funnel coresight devices for AOSS and QDSS blocks. Signed-off-by: Jie Gan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20251104-add-coresight-nodes-for-sc7280-v2-1-c67fa3890c2a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08 Author: Dan Carpenter Date: Fri Oct 3 12:30:43 2025 +0300 hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_bnode_put(node) which drops the refcount and then dreferences "node" on the next line. It's only safe to use "node" when we're holding a reference so flip these two lines around. Fixes: a06ec283e125 ("hfs: add logic of correcting a next unused CNID") Signed-off-by: Dan Carpenter Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/aN-Xw8KnbSnuIcLk@stanley.mountain Signed-off-by: Viacheslav Dubeyko commit 715974499a2199bd199fb4630501f55545342ea4 Author: Nitin Gote Date: Thu Nov 6 15:35:17 2025 +0530 drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg Wa_15016589081 applies to Xe3_LPG renderCS Signed-off-by: Nitin Gote Link: https://patch.msgid.link/20251106100516.318863-2-nitin.r.gote@intel.com Signed-off-by: Matt Roper commit 1ec9871fbb80ba7db84f868f6aa40d38bc43f0e0 Merge: 13068e9d57264d c2c2ccfd4ba727 Author: Jakub Kicinski Date: Thu Nov 6 09:25:16 2025 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.18-rc5). Conflicts: drivers/net/wireless/ath/ath12k/mac.c 9222582ec524 ("Revert "wifi: ath12k: Fix missing station power save configuration"") 6917e268c433 ("wifi: ath12k: Defer vdev bring-up until CSA finalize to avoid stale beacon") https://lore.kernel.org/11cece9f7e36c12efd732baa5718239b1bf8c950.camel@sipsolutions.net Adjacent changes: drivers/net/ethernet/intel/Kconfig b1d16f7c0063 ("libie: depend on DEBUG_FS when building LIBIE_FWLOG") 93f53db9f9dc ("ice: switch to Page Pool") Signed-off-by: Jakub Kicinski commit dea9f84776b96a703f504631ebe9fea07bd2c181 Author: Lizhi Hou Date: Wed Nov 5 11:41:40 2025 -0800 accel/amdxdna: Fix dma_fence leak when job is canceled Currently, dma_fence_put(job->fence) is called in job notification callback. However, if a job is canceled, the notification callback is never invoked, leading to a memory leak. Move dma_fence_put(job->fence) to the job cleanup function to ensure the fence is always released. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251105194140.1004314-1-lizhi.hou@amd.com commit 47d98d432f19030faf06d4b2ca7fc7493057cae1 Merge: 1b0f3f9ee41ee2 84f5526e4dce0a Author: Mark Brown Date: Thu Nov 6 17:13:06 2025 +0000 ASoC: Merge up fixes There is some overlap with the cs4271 driver. commit 30ed024fb0768e9353f21d1d9e6960b7028acdfa Author: Stanimir Varbanov Date: Wed Sep 17 09:32:32 2025 +0300 mfd: bcm2835-pm: Add support for BCM2712 The BCM2712 SoC has PM block but lacks the "asb" and "rpivid_asb" register spaces, and doesn't need clock(s). Add a compatible string for bcm2712 to allow probe of bcm2835-wdt and bcm2835-power drivers. Signed-off-by: Stanimir Varbanov Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250917063233.1270-4-svarbanov@suse.de Signed-off-by: Lee Jones commit ea1c4c7e648d1ca91577071fc42fdc219521098c Author: Duje Mihanović Date: Tue Jul 29 19:18:29 2025 +0200 leds: Drop duplicate LEDS_EXPRESSWIRE config While moving said config symbol out of the "if NEW_LEDS" block, I accidentally left a copy inside that block. Remove it. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/all/b6c481bb-e854-405e-a428-90301789fe20@infradead.org/ Fixes: 2cd0d1db31e7 ("leds: expresswire: Don't depend on NEW_LEDS") Signed-off-by: Duje Mihanović Reviewed-by: Daniel Thompson (RISCstar) Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20250729-expresswire-dep-fix-v1-1-635cd4cc746b@dujemihanovic.xyz Signed-off-by: Lee Jones commit abc9a349b87ac0fd3ba8787ca00971b59c2e1257 Author: Alex Elder Date: Mon Oct 27 08:30:05 2025 -0500 spi: fsl-qspi: support the SpacemiT K1 SoC Allow the SPI_FSL_QUADSPI Kconfig option to be selected if ARCH_SPACEMIT enabled. Add support for the SpacemiT K1 SoC in the Freescale QSPI driver by defining the device type data for its QSPI implementation. Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-8-elder@riscstar.com Signed-off-by: Mark Brown commit 56931105074fe7e5fc9d54e3163df3b95075643c Author: Alex Elder Date: Mon Oct 27 08:30:04 2025 -0500 spi: fsl-qspi: introduce sfa_size devtype data In fsl_qspi_default_setup(), four registers define the size of blocks of data to written to each of four chips that comprise SPI NOR flash storage. They are currently defined to be the same as the AHB buffer size. The SpacemiT QSPI has an AHB buffer size of 512 bytes, but requires these four sizes to be multiples of 1024 bytes. Define a new field sfa_size in the fsl_qspi_devtype_data structure that, if non-zero, will be used instead of the AHB buffer size to define the size of these chip regions. Reviewed-by: Frank Li Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-7-elder@riscstar.com Signed-off-by: Mark Brown commit 1797d254f5c4b46b295527a635af7321a3fe1318 Author: Alex Elder Date: Mon Oct 27 08:30:03 2025 -0500 spi: fsl-qspi: add a clock disable quirk The SpacemiT K1 SoC QSPI implementation needs to avoid shutting off the clock when changing its rate. Add a new quirk to indicate that disabling and enabling the clock should be skipped when changing its rate. Reviewed-by: Frank Li Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-6-elder@riscstar.com Signed-off-by: Mark Brown commit 6b398c1d3da7a673b13b1857f9fff4c15ee20cef Author: Alex Elder Date: Mon Oct 27 08:30:02 2025 -0500 spi: fsl-qspi: switch predicates to bool Change all the needs_*() functions so they are no longer inline, and return bool rather than int. Reviewed-by: Frank Li Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-5-elder@riscstar.com Signed-off-by: Mark Brown commit 106d7641e55a472e7523c1f525c77fb6d420064d Author: Alex Elder Date: Mon Oct 27 08:30:01 2025 -0500 spi: fsl-qspi: add optional reset support Add support for one or more optional exclusive resets. These simply need to be deasserted at probe time, and can remain that way for the life of the device. Reviewed-by: Frank Li Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-4-elder@riscstar.com Signed-off-by: Mark Brown commit 873a46141460d209bb62eaa0dc9e7b67bff924a6 Author: Alex Elder Date: Mon Oct 27 08:30:00 2025 -0500 spi: dt-bindings: fsl-qspi: add optional resets Allow two resets to be defined to support the SpacemiT K1 SoC QSPI IP. Move the allOf block down, below the required section. Reviewed-by: Frank Li Acked-by: Conor Dooley Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-3-elder@riscstar.com Signed-off-by: Mark Brown commit bd352547df647be8a1e6c9d4ca2b54b459f3abc1 Author: Alex Elder Date: Mon Oct 27 08:29:59 2025 -0500 spi: dt-bindings: fsl-qspi: support SpacemiT K1 Add the SpacemiT K1 SoC QSPI IP to the list of supported hardware. This is the first non-Freescale device represented here. It has a nearly identidal register set, and this binding correctly describes the hardware. Acked-by: Conor Dooley Reviewed-by: Frank Li Signed-off-by: Alex Elder Link: https://patch.msgid.link/20251027133008.360237-2-elder@riscstar.com Signed-off-by: Mark Brown commit d95963e309bc1211e28051314e72638d98225614 Author: Duje Mihanović Date: Tue Jul 29 19:18:30 2025 +0200 backlight: ktd2801: Depend on GPIOLIB The LEDS_EXPRESSWIRE library used by the driver requires GPIOLIB. Make sure this dependency is not left unsatisfied. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/all/b6c481bb-e854-405e-a428-90301789fe20@infradead.org/ Signed-off-by: Duje Mihanović Reviewed-by: Daniel Thompson (RISCstar) Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Randy Dunlap Link: https://patch.msgid.link/20250729-expresswire-dep-fix-v1-2-635cd4cc746b@dujemihanovic.xyz Signed-off-by: Lee Jones commit 4dbf066d965cd3299fb396f1375d10423c9c625c Author: Thomas Weißschuh Date: Tue Oct 28 16:31:03 2025 +0100 leds: leds-cros_ec: Skip LEDs without color components A user reports that on their Lenovo Corsola Magneton with EC firmware steelix-15194.270.0 the driver probe fails with EINVAL. It turns out that the power LED does not contain any color components as indicated by the following "ectool led power query" output: Brightness range for LED 1: red : 0x0 green : 0x0 blue : 0x0 yellow : 0x0 white : 0x0 amber : 0x0 The LED also does not react to commands sent manually through ectool and is generally non-functional. Instead of failing the probe for all LEDs managed by the EC when one without color components is encountered, silently skip those. Cc: stable@vger.kernel.org Fixes: 8d6ce6f3ec9d ("leds: Add ChromeOS EC driver") Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-cros_ec-leds-no-colors-v1-1-ebe13a02022a@weissschuh.net Signed-off-by: Lee Jones commit f23e40e378a0858da26e8d5a6f09f82ecd95e247 Author: Ajye Huang Date: Sat Nov 1 12:00:43 2025 +0800 drm/edid: add 6 bpc quirk to the Sharp LQ116M1JW10 The Sharp LQ116M1JW105 reports that it supports 8 bpc modes, but it will happen display noise in some videos. So, limit it to 6 bpc modes. Signed-off-by: Ajye Huang Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20251101040043.3768848-1-ajye_huang@compal.corp-partner.google.com commit 6f15c3d715f1bf1025f88890eec7f3da210097a9 Author: Andy Shevchenko Date: Thu Nov 6 09:02:51 2025 +0100 bitops: Update kernel-doc in hweight.c to fix the issues with it The kernel-doc in lib/hweight.c is global to the file and currently has issues: Warning: lib/hweight.c:13 expecting prototype for hweightN(). Prototype was for __sw_hweight32() instead Warning: lib/hweight.c:13 function parameter 'w' not described in '__sw_hweight32' Update it accordingly. Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov (NVIDIA) commit 0cb302c9c9b702efe09398c8a591beffe083b742 Author: Andy Shevchenko Date: Thu Nov 6 09:02:50 2025 +0100 bitops: Add missed file to MAINTAINERS In accordance with the history and nature of the operation add lib/hweight.c to the BITOPS record in MAINTAINERS. Signed-off-by: Andy Shevchenko Signed-off-by: Yury Norov (NVIDIA) commit ecf6bc474ae97c404e2125b413eb0ef3627b03c5 Author: Troy Mitchell Date: Mon Oct 27 13:48:05 2025 +0800 mfd: simple-mfd-i2c: Remove select I2C_K1 from MFD_SPACEMIT_P1 select will force a symbol to a specific value without considering its dependencies. As a result, the i2c-k1 driver will fail to build when OF or COMMON_CLK are disabled. The reason for removing I2C_K1 instead of adding a depends on condition is to keep the possibility for other SoCs to use this PMIC. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510211523.sSEVqPUQ-lkp@intel.com/ Acked-by: Alex Elder Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/all/20251022004830-GYB1522542@gentoo.org/ [1] Link: https://patch.msgid.link/20251027-p1-kconfig-fix-v2-1-49688f30bae8@linux.spacemit.com Signed-off-by: Lee Jones commit 1810b210872ffc9985febca0880702a7102aad31 Author: Matti Vaittinen Date: Mon Oct 27 14:12:06 2025 +0200 mfd: bd718x7: Use regmap_reg_range() for pmic_status_range Initializing the regmap_ranges using direct assignment to the range_min and range_max members is a slightly verbose. In general we can make it a tad cleaner when using the regmap_reg_range() macro. The rohm-bd718x7.c is doing this open-coded initialization. It's not really bad as there is only one range defined, but it is still worth converting it to use the regmap_reg_range() so no-one uses it as a bad example. Additionally, the regmap_access_table expects a pointer to an array of ranges. This is a tad more obvious when we use an array with single range, instead of claiming a pointer to a range struct being a single element array. Use regmap_reg_range() when initializing the regmap_range structure and use a real one-element array instead of a pointer to a struct. Signed-off-by: Matti Vaittinen Link: https://patch.msgid.link/aP9hlpRO-0vmEHBZ@mva-rohm Signed-off-by: Lee Jones commit 9dbf945320b11c5865d2f550f8e972566d04d181 Author: Zhang Yi Date: Mon Oct 13 09:51:28 2025 +0800 ext4: add two trace points for moving extents To facilitate tracking the length, type, and outcome of the move extent, add a trace point at both the entry and exit of mext_move_extent(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-13-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 65097262f5ee786e649224ead2c08b7552376269 Author: Zhang Yi Date: Mon Oct 13 09:51:27 2025 +0800 ext4: add large folios support for moving extents Pass the moving extent length into mext_folio_double_lock() so that it can acquire a higher-order folio if the length exceeds PAGE_SIZE. This can speed up extent moving when the extent is larger than one page. Additionally, remove the unnecessary comments from mext_folio_double_lock(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-12-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 4589c4518f7c19e49ae2ba4767a86db881017793 Author: Zhang Yi Date: Mon Oct 13 09:51:26 2025 +0800 ext4: switch to using the new extent movement method Now that we have mext_move_extent(), we can switch to this new interface and deprecate move_extent_per_page(). First, after acquiring the i_rwsem, we can directly use ext4_map_blocks() to obtain a contiguous extent from the original inode as the extent to be moved. It can and it's safe to get mapping information from the extent status tree without needing to access the ondisk extent tree, because ext4_move_extent() will check the sequence cookie under the folio lock. Then, after populating the mext_data structure, we call ext4_move_extent() to move the extent. Finally, the length of the extent will be adjusted in mext.orig_map.m_len and the actual length moved is returned through m_len. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-11-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 962e8a01eab95597bb571672f59ab2ec9fec342a Author: Zhang Yi Date: Mon Oct 13 09:51:25 2025 +0800 ext4: introduce mext_move_extent() When moving extents, the current move_extent_per_page() process can only move extents of length PAGE_SIZE at a time, which is highly inefficient, especially when the fragmentation of the file is not particularly severe, this will result in a large number of unnecessary extent split and merge operations. Moreover, since the ext4 file system now supports large folios, using PAGE_SIZE as the processing unit is no longer practical. Therefore, introduce a new move extents method, mext_move_extent(). It moves one extent of the origin inode at a time, but not exceeding the size of a folio. The parameters for the move are passed through the new mext_data data structure, which includes the origin inode, donor inode, the mapping extent of the origin inode to be moved, and the starting offset of the donor inode. The move process is similar to move_extent_per_page() and can be categorized into three types: MEXT_SKIP_EXTENT, MEXT_MOVE_EXTENT, and MEXT_COPY_DATA. MEXT_SKIP_EXTENT indicates that the corresponding area of the donor file is a hole, meaning no actual space is allocated, so the move is skipped. MEXT_MOVE_EXTENT indicates that the corresponding areas of both the origin and donor files are unwritten, so no data needs to be copied; only the extents are swapped. MEXT_COPY_DATA indicates that the corresponding areas of both the origin and donor files contain data, so data must be copied. The data copying is performed in three steps: first, the data from the original location is read into the page cache; then, the extents are swapped, and the page cache is rebuilt to reflect the index of the physical blocks; finally, the dirty page cache is marked and written back to ensure that the data is written to disk before the metadata is persisted. One important point to note is that the folio lock and i_data_sem are held only during the moving process. Therefore, before moving an extent, it is necessary to check whether the sequence cookie of the area to be moved has changed while holding the folio lock. If a change is detected, it indicates that concurrent write-back operations may have occurred during this period, and the type of the extent to be moved can no longer be considered reliable. For example, it may have changed from unwritten to written. In such cases, return -ESTALE, and the calling function should reacquire the move extent of the original file and retry the movement. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-10-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 37cb211f97f8a0d30d7195d6c427f3233fa0271f Author: Zhang Yi Date: Mon Oct 13 09:51:24 2025 +0800 ext4: rename mext_page_mkuptodate() to mext_folio_mkuptodate() mext_page_mkuptodate() no longer works on a single page, so rename it to mext_folio_mkuptodate(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-9-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 57c1df07f1ac2668a4e65796565adcbc6995f86c Author: Zhang Yi Date: Mon Oct 13 09:51:23 2025 +0800 ext4: refactor mext_check_arguments() When moving extents, mext_check_validity() performs some basic file system and file checks. However, some essential checks need to be performed after acquiring the i_rwsem are still scattered in mext_check_arguments(). Move those checks into mext_check_validity() and make it executes entirely under the i_rwsem to make the checks clearer. Furthermore, rename mext_check_arguments() to mext_check_adjust_range(), as it only performs checks and length adjustments on the move extent range. Finally, also change the print message for the non-existent file check to be consistent with other unsupported checks. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-8-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 22218516e462d59b27ffcfc9dd75d4f98e482c51 Author: Zhang Yi Date: Mon Oct 13 09:51:22 2025 +0800 ext4: add mext_check_validity() to do basic check Currently, the basic validation checks during the move extent operation are scattered across __ext4_ioctl() and ext4_move_extents(), which makes the code somewhat disorganized. Introduce a new helper, mext_check_validity(), to handle these checks. This change involves only code relocation without any logical modifications. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-7-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit c9570b6634243cc7a55307dffd1965a3b8798591 Author: Zhang Yi Date: Mon Oct 13 09:51:21 2025 +0800 ext4: use EXT4_B_TO_LBLK() in mext_check_arguments() Switch to using EXT4_B_TO_LBLK() to calculate the EOF position of the origin and donor inodes, instead of using open-coded calculations. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-6-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 07c440e8da8fee5b3512a5742ddc71776a0041ac Author: Zhang Yi Date: Mon Oct 13 09:51:20 2025 +0800 ext4: pass out extent seq counter when mapping blocks When creating or querying mapping blocks using the ext4_map_blocks() and ext4_map_{query|create}_blocks() helpers, also pass out the extent sequence number of the block mapping info through the ext4_map_blocks structure. This sequence number can later serve as a valid cookie within iomap infrastructure and the move extents procedure. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-5-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 7da5565cab4069b2b171dbfa7554b596a7fdf827 Author: Zhang Yi Date: Mon Oct 13 09:51:19 2025 +0800 ext4: make ext4_es_lookup_extent() pass out the extent seq counter When querying extents in the extent status tree, we should hold the data_sem if we want to obtain the sequence number as a valid cookie simultaneously. However, currently, ext4_map_blocks() calls ext4_es_lookup_extent() without holding data_sem. Therefore, we should acquire i_es_lock instead, which also ensures that the sequence cookie and the extent remain consistent. Consequently, make ext4_es_lookup_extent() to pass out the sequence number when necessary. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-4-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit dd064d5101ea473d39c39ffaa8beeb8f47bbeb09 Author: Zhang Yi Date: Mon Oct 13 09:51:18 2025 +0800 ext4: introduce seq counter for the extent status entry In the iomap_write_iter(), the iomap buffered write frame does not hold any locks between querying the inode extent mapping info and performing page cache writes. As a result, the extent mapping can be changed due to concurrent I/O in flight. Similarly, in the iomap_writepage_map(), the write-back process faces a similar problem: concurrent changes can invalidate the extent mapping before the I/O is submitted. Therefore, both of these processes must recheck the mapping info after acquiring the folio lock. To address this, similar to XFS, we propose introducing an extent sequence number to serve as a validity cookie for the extent. After commit 24b7a2331fcd ("ext4: clairfy the rules for modifying extents"), we can ensure the extent information should always be processed through the extent status tree, and the extent status tree is always uptodate under i_rwsem or invalidate_lock or folio lock, so it's safe to introduce this sequence number. The sequence number will be increased whenever the extent status tree changes, preparing for the buffered write iomap conversion. Besides, this mechanism is also applicable for the moving extents case. In move_extent_per_page(), it also needs to reacquire data_sem and check the mapping info again under the folio lock. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-3-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit a2e5a3cea4b18f6e2575acc444a5e8cce1fc8260 Author: Zhang Yi Date: Mon Oct 13 09:51:17 2025 +0800 ext4: correct the checking of quota files before moving extents The move extent operation should return -EOPNOTSUPP if any of the inodes is a quota inode, rather than requiring both to be quota inodes. Fixes: 02749a4c2082 ("ext4: add ext4_is_quota_file()") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Message-ID: <20251013015128.499308-2-yi.zhang@huaweicloud.com> Signed-off-by: Theodore Ts'o commit 6640d552185f7c11235c64a832004db9af119b2d Author: Ranganath V N Date: Sat Oct 11 12:08:29 2025 +0530 fs: ext4: fix uninitialized symbols Fix the issue detected by the smatch tool. fs/ext4/inode.c:3583 ext4_map_blocks_atomic_write_slow() error: uninitialized symbol 'next_pblk'. fs/ext4/namei.c:1776 ext4_lookup() error: uninitialized symbol 'de'. fs/ext4/namei.c:1829 ext4_get_parent() error: uninitialized symbol 'de'. fs/ext4/namei.c:3162 ext4_rmdir() error: uninitialized symbol 'de'. fs/ext4/namei.c:3242 __ext4_unlink() error: uninitialized symbol 'de'. fs/ext4/namei.c:3697 ext4_find_delete_entry() error: uninitialized symbol 'de'. These changes enhance code clarity, address static analysis tool errors. Signed-off-by: Ranganath V N Message-ID: <20251011063830.47485-1-vnranganath.20@gmail.com> Signed-off-by: Theodore Ts'o commit 2977567b244f056d86658160659f06cd6c78ba3d Author: Manish Dharanenthiran Date: Fri Oct 31 08:37:46 2025 +0530 wifi: ath12k: Fix timeout error during beacon stats retrieval Currently, for beacon_stats, ath12k_mac_get_fw_stats() is called for each started BSS on the specified hardware. ath12k_mac_get_fw_stats() will wait for the fw_stats_done completion after fetching the requested data from firmware. For the beacon_stats, fw_stats_done completion will be set only when stats are received for all BSSes. However, for other stats like vdev_stats or pdev_stats, there is one request to the firmware for all enabled BSSes. Since beacon_stats is fetched individually for all BSSes enabled in that pdev, waiting for the completion event results in a timeout error when multiple BSSes are enabled. Avoid this by completing the fw_stats_done immediately after updating the requested BSS's beacon stats in the list. Subsequently, this list will be used to display the beacon stats for all enabled BSSes in the requested pdev. Additionally, remove 'num_bcn_recvd' from the ath12k_fw_stats struct as it is no longer needed. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 9fe4669ae919 ("wifi: ath12k: Request beacon stats from firmware") Signed-off-by: Manish Dharanenthiran Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20251031-beacon_stats-v1-2-f52fce7b03ac@qti.qualcomm.com Signed-off-by: Jeff Johnson commit bd6ec8111e6546d01f16bb113aee1fcada6e86a9 Author: Manish Dharanenthiran Date: Fri Oct 31 08:37:45 2025 +0530 wifi: ath12k: Make firmware stats reset caller-driven Currently, ath12k_fw_stats_reset() is called in ath12k_mac_get_fw_stats() before fetching the required stats from the firmware. However, ath12k_open_bcn_stats() requests firmware stats for each enabled BSS individually. Since the firmware stats are reset before fetching, only the last BSS's data is displayed. Also, in ath12k_mac_op_get_txpower(), ath12k_mac_op_sta_statistics(), and ath12k_mac_op_link_sta_statistics(), after getting the stats from the firmware, the reset function is not called until the next firmware stats are requested or while unloading the module. Hence, the stats buffer will not be freed until one of the above sequences is executed. However, in ath12k_open_vdev_stats(), ath12k_open_bcn_stats() and ath12k_open_pdev_stats(), firmware stats are reset after copying the necessary data in ath12k_wmi_fw_stats_dump(). This leads to inconsistent usage of ath12k_fw_stats_reset() for freeing the firmware stats. Avoid these discrepancies by making it the caller's responsibility to free the stats buffer, thereby removing the need to free the stats buffer in ath12k_mac_get_fw_stats() and ath12k_wmi_fw_stats_dump(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Manish Dharanenthiran Reviewed-by: Vasanthakumar Thiagarajan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20251031-beacon_stats-v1-1-f52fce7b03ac@qti.qualcomm.com Signed-off-by: Jeff Johnson commit ce3236a3c7d8e048e0bcc7f445f12f911dd9dc7d Author: Julian Sun Date: Fri Oct 10 17:52:57 2025 +0800 ext4: make error code in __ext4fs_dirhash() consistent. Currently __ext4fs_dirhash() returns -1 (-EPERM) if fscrypt doesn't have encryption key, which may confuse users. Make the error code here consistent with existing error code. Signed-off-by: Julian Sun Message-ID: <20251010095257.3008275-1-sunjunchao@bytedance.com> Signed-off-by: Theodore Ts'o commit 2e640e8e7b9e9fc0f42c1e15ea0e02d00916ad57 Author: Asad Kamal Date: Thu Nov 6 14:11:45 2025 +0800 drm/amd/pm: Update default power1_cap Update default power1_cap to max limit for smu_v13_0_6 and smu_v13_0_12 Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 541414065c59db785000d7661d3d07184e104ec2 Author: Tao Zhou Date: Mon Sep 8 20:39:49 2025 +0800 drm/amdgpu: skip writing eeprom when PMFW manages RAS data Only update bad page number in legacy eeprom write path. v2: add null pointer check for con. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 62320fb8d91a0bddc44a228203cfa9bfbb5395bd Author: Wayne Lin Date: Wed Nov 5 10:36:31 2025 +0800 drm/amd/display: Enable mst when it's detected but yet to be initialized [Why] drm_dp_mst_topology_queue_probe() is used under the assumption that mst is already initialized. If we connect system with SST first then switch to the mst branch during suspend, we will fail probing topology by calling the wrong API since the mst manager is yet to be initialized. [How] At dm_resume(), once it's detected as mst branc connected, check if the mst is initialized already. If not, call dm_helpers_dp_mst_start_top_mgr() instead to initialize mst V2: Adjust the commit msg a bit Fixes: bc068194f548 ("drm/amd/display: Don't write DP_MSTM_CTRL after LT") Cc: Fangzhi Zuo Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Tom Chung Signed-off-by: Wayne Lin Signed-off-by: Alex Deucher commit e1ca536e1772f952e1b08be47fe9006c54a711a8 Author: Tao Zhou Date: Thu Jul 24 15:01:03 2025 +0800 drm/amdgpu: support to load RAS bad pages from PMFW PMFW manages eeprom bad page records, update bad page loading accrodingly. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 1ad25fd272753db14c5d1cc8c68e20ce01f3f888 Author: Lijo Lazar Date: Mon Nov 3 16:21:50 2025 +0530 drm/amdgpu: Fix wait after reset sequence in S3 For a mode-1 reset done at the end of S3 on PSPv11 dGPUs, only check if TOS is unloaded. Fixes: 32f73741d6ee ("drm/amdgpu: Wait for bootloader after PSPv11 reset") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4649 Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 7f34ddf77d30959fcc24cd279074f7e0d4f732df Author: Tao Zhou Date: Wed Jul 23 19:04:17 2025 +0800 drm/amdgpu: add ras_eeprom_read_idx interface PMFW will manage RAS eeprom data by itself, add new interface to read eeprom data via PMFW, we can read part of records by setting index. v2: use IPID parse interface. pa is not used and set it to a fixed value. v3: optimize the null pointer check for IPID parse interface. Signed-off-by: Tao Zhou Reviewed-by: Yang Wang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit cd74132be8461429b5e98991aa15edeeb81a9f56 Author: Tao Zhou Date: Tue Sep 30 10:56:00 2025 +0800 drm/amdgpu: make MCA IPID parse global So we can call it in other blocks. v2: add a new IPID parse interface for umc and we can implement it for each ASIC. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 4104c0a454f6a4d1e0d14895d03c0e7bdd0c8240 Author: Mario Limonciello Date: Tue Nov 4 13:38:02 2025 -0600 drm/amd: Fix suspend failure with secure display TA commit c760bcda83571 ("drm/amd: Check whether secure display TA loaded successfully") attempted to fix extra messages, but failed to port the cleanup that was in commit 5c6d52ff4b61e ("drm/amd: Don't try to enable secure display TA multiple times") to prevent multiple tries. Add that to the failure handling path even on a quick failure. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4679 Fixes: c760bcda8357 ("drm/amd: Check whether secure display TA loaded successfully") Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit be031770bfc1662e773e2dfc696f1a0c1401f300 Author: YiPeng Chai Date: Wed Nov 5 17:25:37 2025 +0800 drm/amd/ras: Fix the issue of incorrect function call When amdgpu_device_health_check fails, amdgpu_ras_pre_reset will not be called and therefore amdgpu_ras_post_reset cannot be called either. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5d1b32cfe4a676fe552416cb5ae847b215463a1a Author: Samuel Zhang Date: Wed Nov 5 03:04:08 2025 +0000 drm/amdgpu: fix gpu page fault after hibernation on PF passthrough On PF passthrough environment, after hibernate and then resume, coralgemm will cause gpu page fault. Mode1 reset happens during hibernate, but partition mode is not restored on resume, register mmCP_HYP_XCP_CTL and mmCP_PSP_XCP_CTL is not right after resume. When CP access the MQD BO, wrong stride size is used, this will cause out of bound access on the MQD BO, resulting page fault. The fix is to ensure gfx_v9_4_3_switch_compute_partition() is called when resume from a hibernation. KFD resume is called separately during a reset recovery or resume from suspend sequence. Hence it's not required to be called as part of partition switch. Signed-off-by: Samuel Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 127cdd726f997d2aeadb43d3c4b299c3d101aa7a Author: YiPeng Chai Date: Tue Nov 4 20:07:58 2025 +0800 drm/amd/ras: ras supports i2c eeprom for mp1 v13_0_12 ras supports i2c eeprom for mp1 v13_0_12. Signed-off-by: YiPeng Chai Acked-by: Alex Deucher Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 07528f7d97f9f78a6e075662404ed4217ac6707b Author: Ahmad Rehman Date: Tue Nov 4 12:23:09 2025 -0500 drm/amdkfd: Do not wait for queue op response during reset This patch adds the condition to not wait for the queue response for unmap, if the gpu is in reset. Signed-off-by: Ahmad Rehman Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit b665f29a2f93a266183dc8cd5d732f203157613b Author: David (Ming Qiang) Wu Date: Tue Oct 28 18:42:05 2025 -0400 drm/amdgpu/userq: need to unref bo unref bo after amdgpu_bo_reserve() failure as it has called amdgpu_bo_ref() already Reviewed-by: Alex Deucher Signed-off-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher commit 1349b31313d5bf840e0ffe780d17acafc4ef81f8 Author: Gangliang Xie Date: Fri Oct 31 13:41:36 2025 +0800 drm/amdgpu: initialize max record count after table reset initialize max record count and record offset after table reset Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit a448c40ff275d9506c859e9874048454c9791860 Author: Gangliang Xie Date: Wed Oct 22 10:36:40 2025 +0800 drm/amd/pm: check pmfw eeprom feature bit get and check the pmfw eeprom feature bit to decide if pmfw eeprom is supported Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit cd5b28a040edc46dd251cd681d6f414953a988c6 Author: Gangliang Xie Date: Thu Sep 4 18:09:40 2025 +0800 drm/amdgpu: add check function for pmfw eeprom add check function for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 604cf6a40157abba4677dea9834de8df9047d798 Author: Miquel Raynal Date: Wed Nov 5 18:27:05 2025 +0100 mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips These chips must be described as none of the block protection information are discoverable. This chip supports 4 bits plus the top/bottom addressing capability to identify the protected blocks. Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav commit 1df1fdbc7e63350b2962dc7d87ded124ee26f3ad Author: Miquel Raynal Date: Wed Nov 5 18:27:04 2025 +0100 mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips These chips must be described as none of the block protection information are discoverable. This chip supports 4 bits plus the top/bottom addressing capability to identify the protected blocks. Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav commit f21d2c7d37553b24825918f2f61df123e182b712 Author: Miquel Raynal Date: Wed Nov 5 18:27:03 2025 +0100 mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips These chips must be described as none of the block protection information are discoverable. This chip supports 4 bits plus the top/bottom addressing capability to identify the protected blocks. Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav commit 71c239348d9fbdb1f0d6f36013f1697cc06c3e9c Author: Miquel Raynal Date: Wed Nov 5 18:27:02 2025 +0100 mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips These chips must be described as none of the block protection information are discoverable. This chip supports 4 bits plus the top/bottom addressing capability to identify the protected blocks. Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav commit a607e676c8b9258eabc3fc88f45bcd70ea178b41 Author: Miquel Raynal Date: Wed Nov 5 18:27:01 2025 +0100 mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips These chips must be described as none of the block protection information are discoverable. This chip supports 4 bits plus the top/bottom addressing capability to identify the protected blocks. Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav commit aee8c4d9d48d661624d72de670ebe5c6b5687842 Author: Miquel Raynal Date: Wed Nov 5 18:27:00 2025 +0100 mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips This chip must be described as none of the block protection information are discoverable. This chip supports 4 bits plus the top/bottom addressing capability to identify the protected blocks. Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Reviewed-by: Michael Walle Signed-off-by: Pratyush Yadav commit 19c815d516745083994009518f63092a89f6edc1 Author: Gangliang Xie Date: Thu Sep 4 18:07:40 2025 +0800 drm/amdgpu: add initialization function for pmfw eeprom add initialization function for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 9ce015e5fd025a23e357bbbe6602c1e7cb4b89e0 Author: Gangliang Xie Date: Thu Sep 4 18:04:33 2025 +0800 drm/amdgpu: adapt reset function for pmfw eeprom adapt reset function for pmfw eeprom Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 13068e9d57264d0a86b8195817a01155ba33d230 Author: Pavan Kumar Linga Date: Mon Nov 3 14:46:30 2025 -0800 idpf: add support for IDPF PCI programming interface At present IDPF supports only 0x1452 and 0x145C as PF and VF device IDs on our current generation hardware. Future hardware exposes a new set of device IDs for each generation. To avoid adding a new device ID for each generation and to make the driver forward and backward compatible, make use of the IDPF PCI programming interface to load the driver. Write and read the VF_ARQBAL mailbox register to find if the current device is a PF or a VF. PCI SIG allocated a new programming interface for the IDPF compliant ethernet network controller devices. It can be found at: https://members.pcisig.com/wg/PCI-SIG/document/20113 with the document titled as 'PCI Code and ID Assignment Revision 1.16' or any latest revisions. Tested this patch by doing a simple driver load/unload on Intel IPU E2000 hardware which supports 0x1452 and 0x145C device IDs and new hardware which supports the IDPF PCI programming interface. Reviewed-by: Sridhar Samudrala Reviewed-by: Simon Horman Signed-off-by: Pavan Kumar Linga Signed-off-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Tested-by: Marek Landowski Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20251103224631.595527-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit 0cc4b846159184892f4210c440daeb97cbe9583a Author: Aswin Karuvally Date: Mon Nov 3 11:16:52 2025 +0100 s390/ctcm: Use info level for handshake UC_RCRESET CTC adapter throws CTC_EVENT_UC_RCRESET (Unit check remote reset event) during initial handshake, if the peer is not ready yet. This causes the ctcm driver to re-attempt the handshake. As it is normal for the event to occur during initialization, use info instead of warn level in kernel log and NOTICE instead of ERROR level in s390 debug feature. Also reword the log message for clarity. Reviewed-by: Alexandra Winter Signed-off-by: Aswin Karuvally Link: https://patch.msgid.link/20251103101652.2349855-1-aswin@linux.ibm.com Signed-off-by: Paolo Abeni commit 32ed0bc2f0f8ce411a822531c71b49fa93608b37 Author: Uros Bizjak Date: Wed Aug 20 11:59:54 2025 +0200 KVM: VMX: Ensure guest's SPEC_CTRL[63:32] is loaded on VM-Enter SPEC_CTRL is an MSR, i.e. a 64-bit value, but the assembly code that loads the guest's value assumes bits 63:32 are always zero. The bug is _currently_ benign because neither KVM nor the kernel support setting any of bits 63:32, but it's still a bug that needs to be fixed. Note, the host's value is restored in C code and is unaffected. Fixes: 07853adc29a0 ("KVM: VMX: Prevent RSB underflow before vmenter") Suggested-by: Sean Christopherson Signed-off-by: Uros Bizjak Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Josh Poimboeuf Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Link: https://patch.msgid.link/20250820100007.356761-1-ubizjak@gmail.com [sean: call out that only the guest's value is affected] Signed-off-by: Sean Christopherson commit 049929c5a159c8671b9b0c12a7da963fef535b00 Author: Christophe JAILLET Date: Sat Oct 25 13:27:16 2025 +0200 mfd: da9055: Simplify the error handling path in da9055_device_init() If mfd_add_devices() fails, there is no need to call mfd_remove_devices(). The needed clean-up is already done in the error handling path of mfd_add_devices(). So, remove the unneeded (and harmless) call. Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/871f52e7ab5d12853bc39f36ac78b5a8e484d863.1761391599.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 2bac49bad1f3553cc3b3bfb22cc194e9bd9e8427 Author: Krzysztof Kozlowski Date: Thu Oct 23 12:19:40 2025 +0200 mfd: max77620: Fix potential IRQ chip conflict when probing two devices MAX77620 is most likely always a single device on the board, however nothing stops board designers to have two of them, thus same device driver could probe twice. Or user could manually try to probing second time. Device driver is not ready for that case, because it allocates statically 'struct regmap_irq_chip' as non-const and stores during probe in 'irq_drv_data' member a pointer to per-probe state container ('struct max77620_chip'). devm_regmap_add_irq_chip() does not make a copy of 'struct regmap_irq_chip' but store the pointer. Second probe - either successful or failure - would overwrite the 'irq_drv_data' from previous device probe, so interrupts would be executed in a wrong context. Cc: stable@vger.kernel.org Fixes: 3df140d11c6d ("mfd: max77620: Mask/unmask interrupt before/after servicing it") Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251023101939.67991-2-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit 5d5d7c427ee69368cf715e53806e786cd02e6386 Author: Shree Ramamoorthy Date: Tue Oct 21 13:27:16 2025 -0500 dt-bindings: mfd: tps65910: Make interrupt properties optional Mark 'interrupts', 'interrupt-controller', and 'interrupt-cells' as optional in the binding schema. The 'interrupts' property should not be required for the TPS65910 PMIC. On the AM335x-ICEV2 SoC, there is no hardware connection from the PMIC_INT pin to the SoC. Without the 'interrupts' property defined, the PMIC cannot forward interrupts. Signed-off-by: Shree Ramamoorthy Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251021182716.292652-1-s-ramamoorthy@ti.com Signed-off-by: Lee Jones commit 0fcb5085668c4baacb0286de5aea7fdc40ad85da Author: Frank Li Date: Tue Oct 14 14:41:14 2025 -0400 dt-bindings: mfd: dlg,da9063: Allow wakeup-source property Allow wakeup-source property to below CHECK_DTBS warnings: arch/arm/boot/dts/nxp/imx/imx6dl-emcon-avari.dtb: pmic@58 (dlg,da9063): onkey: 'wakeup-source' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251014184114.2353199-1-Frank.Li@nxp.com Signed-off-by: Lee Jones commit 1b58acfd067ca16116b9234cd6b2d30cc8ab7502 Author: Haotian Zhang Date: Fri Oct 10 09:17:36 2025 +0800 mfd: da9055: Fix missing regmap_del_irq_chip() in error path When da9055_device_init() fails after regmap_add_irq_chip() succeeds but mfd_add_devices() fails, the error handling path only calls mfd_remove_devices() but forgets to call regmap_del_irq_chip(). This results in a resource leak. Fix this by adding regmap_del_irq_chip() to the error path so that resources are released properly. Fixes: 2896434cf272 ("mfd: DA9055 core driver") Signed-off-by: Haotian Zhang Link: https://patch.msgid.link/20251010011737.1078-1-vulab@iscas.ac.cn Signed-off-by: Lee Jones commit c19e675a3c82aeee99f7007f6cfbd5b292167cbb Author: Wolfram Sang Date: Fri Oct 10 11:43:43 2025 +0200 dt-bindings: mfd: Add Renesas R2A11302FT PMIC This PMIC is referenced in upstream DTs for the Renesas Lager and Koelsch boards. Sadly, there is no documentation available. This minimal binding description states the facts that we do know. Fixes: arch/arm/boot/dts/renesas/r8a7790-lager.dtb: /soc/spi@e6e10000/pmic@0: failed to match any schema with compatible: ['renesas,r2a11302ft'] arch/arm/boot/dts/renesas/r8a7791-koelsch.dtb: /soc/spi@e6e20000/pmic@0: failed to match any schema with compatible: ['renesas,r2a11302ft'] Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251010094734.10487-2-wsa+renesas@sang-engineering.com Signed-off-by: Lee Jones commit 18597dbccfa5a99ccb7278046234c0ae29ec7a19 Author: Wolfram Sang Date: Thu Oct 23 08:55:59 2025 +0200 mfd: da9063: Occupy second I2C address The second address can be used as a shortcut to access register pages 2+3. The driver does not use this feature yet. The second address should still be marked as used, otherwise userspace could interfere with the driver. Signed-off-by: Wolfram Sang Reviewed-by: Peter Rosin Reviewed-by: Bartosz Golaszewski Reviewed-by: Kieran Bingham Link: https://patch.msgid.link/20251023065610.2855-2-wsa+renesas@sang-engineering.com Signed-off-by: Lee Jones commit 78bf081ddf39ba83b551f96d42fe2e4a8fda8718 Author: Matthias Schiffer Date: Tue Oct 7 11:54:24 2025 +0200 mfd: tqmx86: Add board definitions for TQMxCU1-HPCM and TQMxCU2-HPCM This adds support for 2 new TQMx86 COMs: - TQMxCU1-HPCM (COM-HPC Mini Module with Intel Core Ultra Processors [1]) - TQMxCU2-HPCM (in development) [1] https://www.tq-group.com/en/products/tq-embedded/x86-architecture/tqmxcu1-hpcm/ Signed-off-by: Matthias Schiffer Link: https://patch.msgid.link/20251007095424.138878-1-matthias.schiffer@ew.tq-group.com Signed-off-by: Lee Jones commit 617347e716178d3a317a129ece05116967f06d53 Author: Dr. David Alan Gilbert Date: Wed Jun 25 14:32:58 2025 +0100 mfd: wl1273-core: Remove the header The wl1273 FM radio is on Arnd's unused driver list: https://lore.kernel.org/lkml/a15bb180-401d-49ad-a212-0c81d613fbc8@app.fastmail.com/ Other patches have removed the core, the ASoC code and the Radio code. With all those in, remove the header. Also, tidy the ref in the docs. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arnd Bergmann Signed-off-by: Lee Jones commit 5b79c9b6e73546967d457ec3bba3efe0577195be Author: Dr. David Alan Gilbert Date: Wed Jun 25 14:32:57 2025 +0100 mfd: wl1273-core: Remove unused driver The wl1273 FM radio is on Arnd's unused driver list: https://lore.kernel.org/lkml/a15bb180-401d-49ad-a212-0c81d613fbc8@app.fastmail.com/ Remove the core. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arnd Bergmann Signed-off-by: Lee Jones commit dfe1b53eec1da485d93f9c6b8f9c7293f6deebfe Author: Dzmitry Sankouski Date: Fri Sep 26 20:13:28 2025 +0300 dt-bindings: max77705: Add interrupt-controller property Add interrupt-controller property, because max77705 has dedicated interrupt source register to determine which sub device triggered an interrupt. Signed-off-by: Dzmitry Sankouski Reviewed-by: Rob Herring (Arm) Signed-off-by: Lee Jones commit ccb7cd3218e48665f3c7e19eede0da5f069c323d Author: Johan Hovold Date: Thu Sep 25 17:02:19 2025 +0200 mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup Make sure to drop the reference taken to the sysmgr platform device when retrieving its driver data. Note that holding a reference to a device does not prevent its driver data from going away. Fixes: f36e789a1f8d ("mfd: altera-sysmgr: Add SOCFPGA System Manager") Cc: stable@vger.kernel.org # 5.2 Signed-off-by: Johan Hovold Signed-off-by: Lee Jones commit d306cbbc34cc9aa6ed2235472110fe797f887db7 Author: Atharva Tiwari Date: Tue Oct 7 18:35:10 2025 +0530 mfd: macsmc: Make SMC write buffers const Mark the write buffer arguments in apple_smc_write(), apple_smc_rw(), and apple_smc_write_atomic() as const. These functions do not modify the data provided by the caller, so the parameters should be const qualified. Signed-off-by: Atharva Tiwari Reviewed-by: Sven Peter Signed-off-by: Lee Jones commit dbecccac97208bfe5a165aa15423bd4285e41980 Author: Johan Hovold Date: Thu Sep 25 17:05:04 2025 +0200 mfd: altera-sysmgr: Enable compile testing Nothing seems to prevent this driver from being compile tested so allow that. Signed-off-by: Johan Hovold Signed-off-by: Lee Jones commit 9abcd6fd5918525e7708fa3a2f82cfcfaca97cfa Author: Andreas Kemnade Date: Wed Sep 17 09:14:29 2025 +0200 dt-bindings: mfd: sy7636a: Add missing GPIO pins and supply To be able to fully describe how the SY7636A is connected to the system, add properties for the EN and VCOM_EN pins. To squeeze out every bit of unused current, in many devices it is possible to power off the complete chip. Add an input regulator to allow that. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andreas Kemnade Signed-off-by: Lee Jones commit 2d1702d46fb75866cf15ae424e3280d212d8695e Merge: b340412a3b22b6 a7d6255a0bf302 Author: Lee Jones Date: Thu Nov 6 14:02:34 2025 +0000 Merge branches 'ib-mfd-hwmon-6.19' and 'ib-mfd-input-power-regulator-6.19' into ibs-for-mfd-merged commit b340412a3b22b60b5e19cce8726940c7b5b14439 Author: James Calligeros Date: Sat Oct 25 10:24:36 2025 +1000 mfd: macsmc: Add new __SMC_KEY macro When using the _SMC_KEY macro in switch/case statements, GCC 15.2.1 errors out with 'case label does not reduce to an integer constant'. Introduce a new __SMC_KEY macro that can be used instead. Signed-off-by: James Calligeros Link: https://patch.msgid.link/20251025-macsmc-subdevs-v4-5-374d5c9eba0e@gmail.com Signed-off-by: Lee Jones commit 3112b589d3a99a52467a034db6abd35fee5c7c7c Author: Brian Masney Date: Sun Aug 10 18:21:51 2025 -0400 peci: controller: peci-aspeed: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. Signed-off-by: Brian Masney Reviewed-by: Iwona Winiarska Link: https://lore.kernel.org/r/20250810-peci-round-rate-v1-1-ec96d216a455@redhat.com Signed-off-by: Iwona Winiarska commit c1287d67c3a91aa19e4d9bbd3ad943cfbfa6bed4 Author: Sumanth Korikkar Date: Wed Nov 5 13:55:28 2025 +0100 s390/sclp_mem: Consider global memory_hotplug.memmap_on_memory setting When the global kernel command line parameter memory_hotplug.memmap_on_memory is set to false, per-memory-block memmap_on_memory setting can still be set to true. However, when configuring memory block, add_memory_resource() would configure it without memmap_on_memory. i.e. Even if the MHP_MEMMAP_ON_MEMORY flag is set, mhp_supports_memmap_on_memory() returns false unless the kernel command line parameter "memory_hotplug.memmap_on_memory" is enabled. When both the flag and the cmdline parameter are set, the memory block can be configured with or without memmap_on_memory support. To ensure consistent behavior, permit configuring per-memory-block memmap_on_memory only when the memory_hotplug.memmap_on_memory kernel command line parameter is enabled. This is similar to commit 73954d379efd ("dax: add a sysfs knob to control memmap_on_memory behavior") Fixes: ff18dcb19aab ("s390/sclp: Add support for dynamic (de)configuration of memory") Signed-off-by: Sumanth Korikkar Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 8840cc45209b3224cb17a44c0ff4f95760baf761 Author: Mete Durlu Date: Wed Nov 5 12:15:34 2025 +0100 s390/hiperdispatch: Decrease steal time threshold Higher steal time thresholds favor low utilization scenarios, which is not the common case for s390. Set steal time threshold to a lower value to prioritize vertical high and medium CPUs sooner and allow high utilization scenarios to benefit from it. Suggested-by: Christian Borntraeger Signed-off-by: Mete Durlu Acked-by: Christian Borntraeger Signed-off-by: Heiko Carstens commit eb3a9b405b85e872d6f3dac427b7faa01e7e724e Author: Thorsten Blum Date: Thu Oct 30 14:42:41 2025 +0100 s390/smp: Mark pcpu_delegate() and smp_call_ipl_cpu() as __noreturn pcpu_delegate() never returns to its caller. If the target CPU is the current CPU, it calls __pcpu_delegate(), whose delegate function is not supposed to return. In any case, even if __pcpu_delegate() unexpectedly returns, pcpu_delegate() sends SIGP_STOP to the current CPU and waits in an infinite loop. Annotate pcpu_delegate() with the __noreturn attribute to improve compiler optimizations. Also annotate smp_call_ipl_cpu() accordingly since it always calls pcpu_delegate(). [hca: Merge two patches from Thorsten Blum] Signed-off-by: Thorsten Blum Signed-off-by: Heiko Carstens commit f07ebfa5e48c59c41aea247982184fe956cbb756 Author: Thorsten Blum Date: Mon Oct 27 09:47:25 2025 +0100 s390/nmi: Annotate s390_handle_damage() with __noreturn s390_handle_damage() ends by calling the non-returning function disabled_wait() and therefore also never returns. Annotate it with the __noreturn compiler attribute to improve compiler optimizations. Remove the unreachable infinite while loop. Signed-off-by: Thorsten Blum Signed-off-by: Heiko Carstens commit 858063c1aec837a7a500db9bd13145a17b0b7641 Author: Bo Liu Date: Wed Oct 29 15:19:51 2025 +0800 s390: Fix double word in comments Remove the repeated word "the" in comments. Signed-off-by: Bo Liu Signed-off-by: Heiko Carstens commit 55d03b5b5bdd04daf9a35ce49db18d8bb488dffb Author: Clark Wang Date: Fri Oct 24 13:52:11 2025 +0800 spi: imx: remove CLK calculation and check for target mode In target mode, the clock signal is controlled by the master. Target does not need to check, calculate and configure the clock frequency division. The target can directly use the root clock to sample the SCL signal. Therefore, remove check, calculation and frequency division function of the clock for target mode. Signed-off-by: Carlos Song Signed-off-by: Clark Wang Reviewed-by: Frank Li Link: https://patch.msgid.link/20251024055211.408440-1-carlos.song@nxp.com Signed-off-by: Mark Brown commit 547e9feb0e413c51e8e0e390d476666c6f08ad4e Merge: 020d5dc57874e5 68807a894f0c1c Author: Heiko Carstens Date: Thu Nov 6 14:14:00 2025 +0100 Merge branch 'dat-enhancement-1' Heiko Carstens says: ==================== Add the Dat-Enhancement facility 1 to the list of facilities which are required to start the kernel. The facility provides the CSPG and IDTE instructions. In particular the CSPG instruction can be used to replace a valid page table entry with a different page table entry, which also differs in the page frame real address. Without the CSPG instruction it is possible to use the CSP instruction to change valid page table entries, however it only allows to change the lower or higher 32 bits of such entries, which means it cannot be used to change the page frame real address of valid page table entries. Given that there is code around (e.g. HugeTLB vmemmap optimization) which requires to change valid page table entries of the kernel mapping, without the detour over an invalid page table entry, make the CSPG instruction unconditionally available. The Dat-Enhancement facility 1 is available since z990, which is older than the currently supported minimum architecture (z10). Therefore adding this the architecture level set shouldn't cause any problems. ==================== Signed-off-by: Heiko Carstens commit 68807a894f0c1cb294a568d8e53c1a77ceaf0c6f Author: Heiko Carstens Date: Mon Nov 3 14:39:28 2025 +0100 s390/mm: Replace the CSP instruction with CSPG The CSPG instruction is part of the Dat-Enhancement facility 1, which is always available. Given that it can be used everywhere where also the CSP instruction can be used, replace CSP with CSPG everywhere. This allows to remove the csp() inline assembly. Also remove the unused gmap_pmdp_csp() function. Acked-by: Alexander Gordeev Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens commit 220d8e10d69a30db7d9cbd0d3483a739768ed16c Author: Heiko Carstens Date: Mon Nov 3 14:39:27 2025 +0100 s390/mm: Remove cpu_has_idte() Remove cpu_has_idte(). The IDTE instruction is part of the Dat-Enhancement facility 1, which is always available. Therefore remove the helper and now superfluous code. Acked-by: Alexander Gordeev Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens commit 73c4b5d728265a6b019c3aba6d7ea2329ca4785a Author: Heiko Carstens Date: Mon Nov 3 14:39:26 2025 +0100 s390: Add Dat-Enhancement facility 1 to architecture level set Add the Dat-Enhancement facility 1 to the list of facilities which are required to start the kernel. The facility provides the CSPG and IDTE instructions. In particular the CSPG instruction can be used to replace a valid page table entry with a different page table entry, which also differs in the page frame real address. Without the CSPG instruction it is possible to use the CSP instruction to change valid page table entries, however it only allows to change the lower or higher 32 bits of such entries, which means it cannot be used to change the page frame real address of valid page table entries. Given that there is code around (e.g. HugeTLB vmemmap optimization) which requires to change valid page table entries of the kernel mapping, without the detour over an invalid page table entry, make the CSPG instruction unconditionally available. The Dat-Enhancement facility 1 is available since z990, which is older than the currently supported minimum architecture (z10). Therefore adding this to the architecture level set shouldn't cause any problems. Reviewed-by: Alexander Gordeev Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens commit 6bd1ad97eb790570c167d4de4ca59fbc9c33722a Author: Andy Shevchenko Date: Thu Nov 6 12:46:28 2025 +0100 regulator: pf9453: Fix kernel doc for mux_poll() The validator is not happy: Warning: drivers/regulator/pf9453-regulator.c:303 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Update the kernel-doc accordingly. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20251106114628.2302762-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 1b0f3f9ee41ee2bdd206667f85ea2aa36dfe6e69 Author: Shuming Fan Date: Thu Nov 6 17:33:35 2025 +0800 ASoC: SDCA: support Q7.8 volume format The SDCA specification uses Q7.8 volume format. This patch adds a field to indicate whether it is SDCA volume control and supports the volume settings. Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20251106093335.1363237-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 6d34b66fb726a613b98c936adee70d42aa5e4aa7 Author: Peter Ujfalusi Date: Wed Oct 29 09:36:00 2025 +0200 ASoC: soc-pcm: Preserve hw parameters from components in dpcm_runtime_setup_fe Component drivers can prepare snd_pcm_hardware struct based on the hardware capabilities which information should not be discarded. Only touch the rates, channels_max and formats if they were left to 0, otherwise keep the provided configuration intact for the parameter cross checking decision. Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20251029073600.13624-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 5246e3673eeeccb4f5bf4f42375dd495d465ac15 Author: Christian Hitz Date: Wed Oct 22 08:33:04 2025 +0200 leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs LP5009 supports 9 LED outputs that are grouped into 3 modules. Cc: stable@vger.kernel.org Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver") Signed-off-by: Christian Hitz Link: https://patch.msgid.link/20251022063305.972190-1-christian@klarinett.li Signed-off-by: Lee Jones commit f47b0c11829ac4dcb73caa899bcde37d9a9c7c89 Merge: 0567c84d683d1f 9c11b6b1abcd32 Author: Paolo Abeni Date: Thu Nov 6 13:38:13 2025 +0100 Merge branch 'amd-xgbe-introduce-support-for-ethtool-selftests' Raju Rangoju says: ==================== amd-xgbe: introduce support for ethtool selftests This patch series introduces support for ethtool selftests, which helps in finding the misconfiguration of HW. Makes use of network selftest packet creation infrastructure. Supports the following tests: - MAC loopback selftest - PHY loopback selftest - Split header selftest - Jumbo frame selftest ==================== Link: https://patch.msgid.link/20251031111555.774425-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 9c11b6b1abcd328136fc0cbc381734d6815d1c16 Author: Raju Rangoju Date: Fri Oct 31 16:45:59 2025 +0530 amd-xgbe: add ethtool jumbo frame selftest Adds support for jumbo frame selftest. Works only for mtu size greater than 1500. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20251031111555.774425-5-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit d7735c6bb2310f7ca8235af7f946e6c8716cdb5e Author: Raju Rangoju Date: Fri Oct 31 16:45:57 2025 +0530 amd-xgbe: add ethtool split header selftest Adds support for ethtool split header selftest. Performs UDP and TCP check to ensure split header selft test works for both packet types. Signed-off-by: Raju Rangoju Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251031111555.774425-4-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 42b06fcc878d08785a0c44d2af42c8db453487e2 Author: Raju Rangoju Date: Fri Oct 31 16:45:55 2025 +0530 amd-xgbe: add ethtool phy loopback selftest Add support for PHY loopback testing via ethtool self-test. The test uses phy_loopback() which enables PHY-level loopback through the PHY driver's set_loopback callback if provided, else uses the genphy_loopback(). Signed-off-by: Raju Rangoju Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251031111555.774425-3-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 862a64c83faf7708e7e79498193ff5270543a68d Author: Raju Rangoju Date: Fri Oct 31 16:45:53 2025 +0530 amd-xgbe: introduce support ethtool selftest Add support for ethtool selftest for MAC loopback. This includes the sanity check and helps in finding the misconfiguration of HW. Uses the existing selftest infrastructure to create test packets. Signed-off-by: Raju Rangoju Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251031111555.774425-2-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 6b47af35a6dded074ff583361f6d6668dd7a401d Author: Raju Rangoju Date: Fri Oct 31 16:48:11 2025 +0530 net: selftests: export packet creation helpers for driver use Export the network selftest packet creation infrastructure to allow network drivers to reuse the existing selftest framework instead of duplicating packet creation code. Signed-off-by: Raju Rangoju Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251031111811.775434-1-Raju.Rangoju@amd.com Signed-off-by: Paolo Abeni commit 8616025ae6e55b1fad4390fbb738f48c25e84216 Author: Avadhut Naik Date: Thu Nov 6 01:54:46 2025 +0000 EDAC: Remove the legacy EDAC sysfs interface Commit 199747106934 ("edac: add a new per-dimm API and make the old per-virtual-rank API obsolete") introduced a new per-DIMM sysfs interface for EDAC making the old per-virtual-rank sysfs interface obsolete. Since this new sysfs interface was introduced more than a decade ago, remove the obsolete legacy interface. Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251106015727.1987246-1-avadhut.naik@amd.com commit 0ee59934662dfb89b43a8392e64ac4880c2fca88 Author: Troy Mitchell Date: Thu Oct 23 15:28:30 2025 +0800 riscv: dts: spacemit: add MusePi Pro board device tree Add initial device tree support for the MusePi Pro board [1]. The board is using the SpacemiT K1/M1 SoC. This device tree is adapted from the SpacemiT vendor tree [2] and enables basic board functionality, including UART console, LED, eMMC, Ethernet, and PDMA. Link: https://developer.spacemit.com/documentation?token=YJtdwnvvViPVcmkoPDpcvwfVnrh&type=pdf [1] Link: https://gitee.com/bianbu-linux/linux-6.6/blob/k1-bl-v2.2.y/arch/riscv/boot/dts/spacemit/k1-x_MUSE-Pi-Pro.dts [2] Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20251023-k1-musepi-pro-dts-v4-2-01836303e10f@linux.spacemit.com Signed-off-by: Yixun Lan commit 2cc22890635ded33856e2761b780688f54a49393 Author: Troy Mitchell Date: Thu Oct 23 15:28:29 2025 +0800 dt-bindings: riscv: spacemit: add MusePi Pro board Document the compatible string for the MusePi Pro [1]. It is a 1.8-inch single board computer based on the SpacemiT K1/M1 RISC-V SoC [2]. Here's a refined list of its core features: - SoC: SpacemiT M1/K1, 8-core 64-bit RISC-V. - Memory: LPDDR4X @ 2400MT/s, available in 8GB & 16GB options. - Storage: Onboard eMMC 5.1 (64GB/128GB options), M.2 M-Key for NVMe SSD (2230 size), and a microSD slot (UHS-II) for expansion. - Display: HDMI 1.4 (1080P@60Hz) and 2-lane MIPI DSI FPC (1080P@60Hz). - Connectivity: Onboard Wi-Fi 6 & Bluetooth 5.2, single Gigabit Ethernet port (RJ45). - USB: 4x USB 3.0 Type-A (host) and 1x USB 2.0 Type-C (device/OTG). - Expansion: Full-size miniPCIe slot and a second M.2 M-Key (2230). - GPIO: Standard 40-pin GPIO interface. - MIPI: 1x 4-lane MIPI CSI FPC and 2x MIPI DSI FPC interfaces. - Clock: Onboard RTC with battery support. Link: https://developer.spacemit.com/documentation?token=YJtdwnvvViPVcmkoPDpcvwfVnrh&type=pdf [1] Link: https://www.spacemit.com/en/key-stone-k1 [2] Acked-by: Conor Dooley Signed-off-by: Troy Mitchell Link: https://lore.kernel.org/r/20251023-k1-musepi-pro-dts-v4-1-01836303e10f@linux.spacemit.com Signed-off-by: Yixun Lan commit 293f71435d14f5b5c46fc3398695fa265c69363d Author: Thomas Weißschuh Date: Tue Oct 28 10:15:45 2025 +0100 um: Always set up AT_HWCAP and AT_PLATFORM Historically the code to set up AT_HWCAP and AT_PLATFORM was only built for 32bit x86 as it was intermingled with the vDSO passthrough code. Now that vDSO passthrough has been removed, always pass through AT_HWCAP and AT_PLATFORM. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-10-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 117e796fc5bfe84f18eec7e8f3b4f4090f605322 Author: Thomas Weißschuh Date: Tue Oct 28 10:15:44 2025 +0100 x86/um: Remove FIXADDR_USER_START and FIXADDR_USE_END There are no users left. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-9-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit f20e32ffda93e002ec4ce9fa15d71175a5445a96 Author: Thomas Weißschuh Date: Tue Oct 28 10:15:43 2025 +0100 um: Remove __access_ok_vsyscall() FIXADDR_USER_START and FIXADDR_USER_END are now always zero. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-8-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 880f615bf96eff89eab88b4f9aacf527cf55a714 Author: Thomas Weißschuh Date: Tue Oct 28 10:15:42 2025 +0100 um: Remove redundant range check from __access_ok_vsyscall() The only caller __access_ok() is already doing the same check through __addr_range_nowrap(). Remove the redundant check. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-7-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 78fdfc9fc4215add97fe331aff7c64e4a423a104 Author: Thomas Weißschuh Date: Tue Oct 28 10:15:41 2025 +0100 um: Remove fixaddr_user_init() With the removal of the vDSO passthrough from the host, FIXADDR_USER_START is always 0 and fixaddr_user_init() is dead code. Remove it. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-6-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit dbd7cf408ab74abb62ae483a81094abb45c9111b Author: Thomas Weißschuh Date: Tue Oct 28 10:15:40 2025 +0100 x86/um: Drop gate area handling With the removal of the vDSO passthrough from the host, FIXADDR_USER_START is always 0 and the gate area setup code is dead. Remove it. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-5-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 70d52694b6a67ace517da44ce4071594fcccd1ee Author: Thomas Weißschuh Date: Tue Oct 28 10:15:39 2025 +0100 x86/um: Do not inherit vDSO from host Inheriting the vDSO from the host is problematic. The values read from the time functions will not be correct for the UML kernel. Furthermore the start and end of the vDSO are not stable or detectable by userspace. Specifically the vDSO datapages start before AT_SYSINFO_EHDR and the vDSO itself is larger than a single page. This codepath is only used on 32bit x86 UML. In my testing with both 32bit and 64bit hosts the passthrough functionality has always been disabled anyways due to the checks against envp in scan_elf_aux(). Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-4-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 83b4b44a2b05330d13a4432caae0b036f9621ea1 Author: Thomas Weißschuh Date: Tue Oct 28 10:15:38 2025 +0100 um: Split out default elf_aux_hwcap Setting all auxiliary vector values to default values if one of them was not provided by the host will discard perfectly fine values. Remove the elf_aux_platform fallback from the vDSO ones. As zero is the correct fallback anyways, don't create a new conditional. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-3-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit c1b077515116dc7916dbf72d8803a682c5989aa6 Author: Thomas Weißschuh Date: Tue Oct 28 10:15:37 2025 +0100 x86/um: Move ELF_PLATFORM fallback to x86-specific code The generic UM code should not have references to x86-specific value. Move the fallback into the x86-specific header. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-2-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 74d438872dae44abfcfffad4daccd7f22cdf7bad Author: Thomas Weißschuh Date: Tue Oct 28 10:15:36 2025 +0100 um: Split out default elf_aux_platform Setting all auxiliary vector values to default values if one of them was not provided by the host will discard perfectly fine values. Move the elf_aux_platform fallback to its own conditional. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20251028-uml-remove-32bit-pseudo-vdso-v1-1-e930063eff5f@weissschuh.net Signed-off-by: Johannes Berg commit 6a857969150908ff1deebb8b368a872281d103bd Author: Avadhut Naik Date: Thu Nov 6 01:54:45 2025 +0000 EDAC/amd64: Remove NUM_CONTROLLERS macro Currently, the NUM_CONTROLLERS macro is used to limit the amount of memory controllers (UMCs) available per node. The number of UMCs available per node, however, is already cached by the max_mcs variable of struct amd64_pvt. Allocate the relevant data structures dynamically using the variable instead of static allocation through the macro. The max_mcs variable is used for legacy systems too. These systems have a max of 2 controllers. Since the default value of max_mcs, set in per_family_init(), is 2, these legacy systems are also covered. Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251106015727.1987246-1-avadhut.naik@amd.com commit b4fbb13db86adb0bae1d7f968b61ea8dc9635e33 Author: Vincent Knecht Date: Thu Oct 30 08:59:14 2025 +0100 media: qcom: camss: Add support for MSM8939 The camera subsystem for the MSM8939 is the same as MSM8916 except with 3 CSID instead of 2, and some higher clock rates. As a quirk, this SoC needs writing values to 2 VFE VBIF registers (see downstream msm8939-camera.dtsi vbif-{regs,settings} properties). This fixes black stripes across sensor and garbage in CSID TPG outputs. Add support for the MSM8939 camera subsystem. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vincent Knecht Signed-off-by: André Apitzsch Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f0e8ffb46b26bfb77aaa2344f4bf7b07aa96d7df Author: Vincent Knecht Date: Thu Oct 30 08:59:13 2025 +0100 media: qcom: camss: vfe: Add VBIF setting support Some devices need writing values to VFE VBIF registers. Add helper functions to do this. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vincent Knecht Signed-off-by: André Apitzsch Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 2f1ff4e1320d9909978aaecc26fc3e3cd5f0d68d Author: Vincent Knecht Date: Thu Oct 30 08:59:12 2025 +0100 media: dt-bindings: Add qcom,msm8939-camss Add bindings for qcom,msm8939-camss in order to support the camera subsystem for MSM8939. Signed-off-by: Vincent Knecht [André: Make order of items the same as in 8916] Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: André Apitzsch Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c33f7e61a1c9e9255597102e61add4b4fe91668c Author: Vladimir Zapolskiy Date: Fri Oct 17 06:11:30 2025 +0300 media: qcom: camss: Add CSIPHY 2.2.0 lane configuration for SM8650 Add a configuration for all CSI lanes into D-PHY bus mode on Qualcomm SM8650 CAMSS CSIPHY IPs. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8650-QRD Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6a0b9d3f111ed8008ce676af7bff6539afea880c Author: Vladimir Zapolskiy Date: Fri Oct 17 06:11:29 2025 +0300 media: qcom: camss: Add Qualcomm SM8650 CAMSS support Add the basic support of CAMSS IP on Qualcomm SM8650 SoC powered boards. SM8650 CAMSS provides: - 6 x CSIPHY, - 3 x CSID, 2 x CSID Lite, - 3 x VFE, 2 x VFE Lite. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8650-QRD Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit bbad9ae1ccc05333ef05b7ac4a06b32c13e1e2aa Author: Vladimir Zapolskiy Date: Fri Oct 17 06:11:28 2025 +0300 dt-bindings: media: Describe Qualcomm SM8650 CAMSS IP Add device tree bindings for Qualcomm SM8650 camera subsystem. Qualcomm SM8650 CAMSS IP contains the next subdevices: * 6 x CSIPHY, * 3 x CSID, 2 x CSID Lite, * 3 x IFE, 2 x IFE Lite. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Reviewed-by: Krzysztof Kozlowski Tested-by: Neil Armstrong # on SM8650-QRD Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ec697196d6b1c292feec12e3d9c0bd45b63ce5d3 Author: Hangxiang Ma Date: Thu Oct 30 23:38:28 2025 +0000 media: qcom: camss: Enable setting the rate to camnoc_rt_axi clock On hardware architectures where a single CAMNOC module is split into two, one for each of the real time (RT) and non real time (NRT) modules within camera sub system, processing VFE output over the AXI bus requires enabling and setting the appropriate clock rate for the RT CAMNOC. This change lays the groundwork for supporting such configurations. Signed-off-by: Hangxiang Ma Reviewed-by: Bryan O'Donoghue Reviewed-by: Vijay Kumar Tumati Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit d5479f002fe7181fa249fab9c5268ecf38258ab2 Author: Hangxiang Ma Date: Thu Oct 30 23:24:56 2025 +0000 media: qcom: camss: Use a macro to specify the initial buffer count Replace the hardcoded buffer count value with a macro to enable operating on these buffers elsewhere in the CAMSS driver based on this count. Some of the hardware architectures require deferring the AUP and REG update until after the CSID configuration and this macro is expected to be useful in such scenarios. Signed-off-by: Hangxiang Ma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c38d1d7033f05438ddf6d2d6312ff9d7ac2fb84a Author: Johan Hovold Date: Fri Oct 17 08:04:35 2025 +0200 media: qcom: camss: drop unused module alias The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 52862dc98932fff8fc3da6e3c12594f389cc892e Author: Krzysztof Kozlowski Date: Tue Oct 28 12:11:16 2025 +0100 media: dt-bindings: qcom,x1e80100-camss: Fix typo in CSIPHY supply description Correct description of the CSIPHY 1.2 V supply ("vdd-csiphy-1p2-supply"), because it supplies 1.2 V, confirmed with DTS on the mailing lists. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Acked-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 14ae052f794715c1d78113d87f3d42adf2ae24d0 Author: Jie Gan Date: Tue Oct 28 18:11:41 2025 +0800 coresight: tpdm: add static tpdm support The static TPDM function as a dummy source, however, it is essential to enable the port connected to the TPDA and configure the element size. Without this, the TPDA cannot correctly receive trace data from the static TPDM. Since the static TPDM does not require MMIO mapping to access its registers, a clock controller is not mandatory for its operation. Signed-off-by: Jie Gan Link: https://lore.kernel.org/r/20251028-add_static_tpdm_support-v4-2-84e21b98e727@oss.qualcomm.com Signed-off-by: Suzuki K Poulose commit 8d204b6f1f7a6d5c74e5cbf09539e6081ee0a9be Author: Jie Gan Date: Tue Oct 28 18:11:40 2025 +0800 dt-bindings: arm: document the static TPDM compatible The static TPDM device is intended for sources that do not require MMIO mapping. Its compatible string should be documented clearly, along with an example illustrating how to define a static TPDM node in the DT. Reviewed-by: Rob Herring (Arm) Signed-off-by: Jie Gan Link: https://lore.kernel.org/r/20251028-add_static_tpdm_support-v4-1-84e21b98e727@oss.qualcomm.com Signed-off-by: Suzuki K Poulose commit e9abd990aefd7d8a64f90fff2d391e42b8d512f7 Author: Avadhut Naik Date: Thu Nov 6 01:54:44 2025 +0000 EDAC/amd64: Generate ctl_name string at runtime Currently, the ctl_name string is statically assigned based on the family and model of the SOC when the amd64_edac module is loaded. The same, however, is not exactly needed as the string can be generated and assigned at runtime through scnprintf(). Remove all static assignments and generate the string at runtime. Also, cleanup the switch cases which became defunct and consolidate identical cases. Signed-off-by: Avadhut Naik Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251106015727.1987246-1-avadhut.naik@amd.com commit 1044821176a64a8dc7f861e878506cde34c8b658 Merge: 9de2057bbdfb58 3c36965df80801 Author: Mark Brown Date: Thu Nov 6 11:34:53 2025 +0000 Add support MT6316/6363/MT6373 PMICs regulators Merge series from AngeloGioacchino Del Regno : This series adds support for three new MediaTek PMICs: MT6316, MT6363 and MT6373 and their variants - used in board designs featuring the MediaTek MT8196 Chromebook SoC, or the MT6991 Dimensity 9400 Smartphone SoC. In particular, MT6316 is a regulator, but the MT6363 and MT6373 PMICs are multi-function devices, as they have and expose multiple sub-devices; moreover, some of those also contain an interrupt controller, managing internal IPs interrupts: for those, a chained interrupt handler is registered, which parent is the SPMI controller itself. This series adds support for all of the MT6316 regulator variants and for MT6363, MT6373 SPMI PMICs and their interrupt controller. commit 7a381e373a4243926a41b8e6ebbdeb90fe9afda3 Merge: aa897ffc396b48 655079ac8a7721 Author: Mark Brown Date: Thu Nov 6 11:34:45 2025 +0000 ASoC: qcom: q6dsp: fixes and updates Merge series from Srinivas Kandagatla : This patchset has 4 fixes and some enhancements to the Elite DSP driver support. Fixes includes - setting correct flags for expected behaviour of appl_ptr - fix closing of copp instances - fix buffer alignment. - fix state checks before closing asm stream Enhancements include: - adding q6asm_get_hw_pointer and ack callback support - simplify code via __free(kfree) mechanism. - use spinlock guards - few cleanups discovered during doing above 2. There is another set of updates comming soon, which will add support for early memory mapping and few more modules support in audioreach. commit 1f0de24c547d19adbdba338072fe19a01e87b9b1 Author: Gary Yang Date: Tue Oct 21 15:04:10 2025 +0800 arm64: dts: cix: Add pinctrl nodes for sky1 Add the pin-controller nodes for Sky1 platform. Signed-off-by: Gary Yang Link: https://lore.kernel.org/r/20251021070410.3585997-4-gary.yang@cixtech.com Signed-off-by: Peter Chen commit 74178bb23c6bdca547c8c6bad89f3338f1af89be Author: Jun Guo Date: Fri Sep 19 09:31:18 2025 +0800 arm64: dts: cix: add DT nodes for SPI Add the device tree node for the spi controller of the CIX SKY1 SoC. Signed-off-by: Jun Guo Link: https://lore.kernel.org/r/20250919013118.853078-1-jun.guo@cixtech.com Signed-off-by: Peter Chen commit 79d062bdefbd404e6b350d04f3099617a2b82933 Author: Zhang Chujun Date: Thu Nov 6 13:58:19 2025 +0800 selftest/alsa: correct grammar in conf_get_bool error string The phrase "an bool" is grammatically incorrect; it should be "a bool". Signed-off-by: Zhang Chujun Link: https://patch.msgid.link/20251106055819.1996-1-zhangchujun@cmss.chinamobile.com Signed-off-by: Takashi Iwai commit 3ca8b2668ca5a410c23a7a7932cc406ebbb89ab2 Author: Bagas Sanjaya Date: Thu Nov 6 07:52:17 2025 +0700 drm/ttm: Fix @alloc_flags description Stephen Rothwell reports htmldocs warnings when merging drm-misc tree: Documentation/gpu/drm-mm:40: include/drm/ttm/ttm_device.h:225: ERROR: Unknown target name: "ttm_allocation". [docutils] Documentation/gpu/drm-mm:43: drivers/gpu/drm/ttm/ttm_device.c:202: ERROR: Unknown target name: "ttm_allocation". [docutils] Documentation/gpu/drm-mm:73: include/drm/ttm/ttm_pool.h:68: ERROR: Unknown target name: "ttm_allocation_pool". [docutils] Documentation/gpu/drm-mm:76: drivers/gpu/drm/ttm/ttm_pool.c:1070: ERROR: Unknown target name: "ttm_allocation_pool". [docutils] Fix these by adding missing wildcard on TTM_ALLOCATION_* and TTM_ALLOCATION_POOL_* in @alloc_flags description. Fixes: 0af5b6a8f8dd ("drm/ttm: Replace multiple booleans with flags in pool init") Fixes: 77e19f8d3297 ("drm/ttm: Replace multiple booleans with flags in device init") Fixes: 402b3a865090 ("drm/ttm: Add an allocation flag to propagate -ENOSPC on OOM") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20251105161838.55b962a3@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Acked-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251106005217.14026-1-bagasdotme@gmail.com commit ad699fa78b59241c9d71a8cafb51525f3dab04d4 Author: Wangao Wang Date: Mon Oct 27 17:35:59 2025 +0800 media: iris: Add sanity check for stop streaming Add sanity check in iris_vb2_stop_streaming. If inst->state is already IRIS_INST_ERROR, we should skip the stream_off operation because it would still send packets to the firmware. In iris_kill_session, inst->state is set to IRIS_INST_ERROR and session_close is executed, which will kfree(inst_hfi_gen2->packet). If stop_streaming is called afterward, it will cause a crash. Fixes: 11712ce70f8e5 ("media: iris: implement vb2 streaming ops") Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Signed-off-by: Wangao Wang Reviewed-by: Vikash Garodia [bod: remove qcom from patch title] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit aec75e355c633e4b0967c99580bd8ef93e0cdc98 Author: Dikshita Agarwal Date: Wed Nov 5 11:17:37 2025 +0530 media: iris: Refine internal buffer reconfiguration logic for resolution change Improve the condition used to determine when input internal buffers need to be reconfigured during streamon on the capture port. Previously, the check relied on the INPUT_PAUSE sub-state, which was also being set during seek operations. This led to input buffers being queued multiple times to the firmware, causing session errors due to duplicate buffer submissions. This change introduces a more accurate check using the FIRST_IPSC and DRC sub-states to ensure that input buffer reconfiguration is triggered only during resolution change scenarios, such as streamoff/on on the capture port. This avoids duplicate buffer queuing during seek operations. Fixes: c1f8b2cc72ec ("media: iris: handle streamoff/on from client in dynamic resolution change") Cc: stable@vger.kernel.org Reported-by: Val Packett Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4700 Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit e81b60c4a88e428b43ad53e7729fa5157ad6e5f2 Author: Laurent Pinchart Date: Sun Oct 26 20:11:38 2025 +0200 media: iris: Constify iris_v4l2_file_ops The iris_v4l2_file_ops structure is never modified. Make it const. Signed-off-by: Laurent Pinchart Reviewed-by: Dikshita Agarwal Reviewed-by: Abel Vesa [bod: drop qcom from patch title for consistency with other patches] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 542e3540ddd75f0a46dd365978476bcc1dda5b5a Author: Dmitry Baryshkov Date: Tue Oct 28 13:46:25 2025 +0200 media: iris: enable support for SC7280 platform As a part of migrating code from the old Venus driver to the new Iris one, add support for the SC7280 platform. It is very similar to SM8250, but it (currently) uses no reset controls (there is an optional GCC-generated reset, it will be added later) and no AON registers region. Extend the VPU ops to support optional clocks and skip the AON shutdown for this platform. Signed-off-by: Dmitry Baryshkov Reviewed-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3b72f5e206e65d57df99677dc3142be913cc2114 Author: Dmitry Baryshkov Date: Tue Oct 28 13:46:24 2025 +0200 media: iris: rename sm8250 platform file to gen1 In preparation to adding more Gen1 platforms, which will share a significant amount of data, rename the SM8250 platform file to iris_platform_gen1.c. Reviewed-by: Konrad Dybcio Reviewed-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 69dfada4c9d077fefc968cca8186ce975d874d49 Author: Dmitry Baryshkov Date: Tue Oct 28 13:46:23 2025 +0200 media: iris: remove duplication between generic gen2 data and qcs8300 Now as we have removed PIPE value from inst_fw_caps_dec there should be no difference between inst_fw_caps of QCS8300 and SM8550+. Drop the QCS8300-specific tables and use generic one instead. The differences between QCS8300 and SM8550 data comes from a non-conflict merge of commit d22037f3fd33 ("media: iris: Set platform capabilities to firmware for encoder video device") (which added .set callbacks), and commit 6bdfa3f947a7 ("media: iris: Add platform-specific capabilities for encoder video device") (which added QCS8300 data, but not the callbacks). Reviewed-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6c67d1cf18dce081f126a6aeb9f7cbd328805591 Author: Dmitry Baryshkov Date: Tue Oct 28 13:46:22 2025 +0200 media: iris: stop encoding PIPE value into fw_caps The value of the PIPE property depends on the number of pipes available on the platform and is frequently the only difference between several fw_caps. In order to reduce duplication, use num_vpp_pipe from the iris_platform_data rather than hardcoding the value into the fw_cap. Reviewed-by: Konrad Dybcio Reviewed-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Signed-off-by: Dmitry Baryshkov [bod: duplciation -> duplication] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7a02a8b98419c992faf8ab714cf4df7da99b2c46 Author: Dmitry Baryshkov Date: Tue Oct 28 13:46:21 2025 +0200 media: iris: turn platform data into constants Make all struct iris_platform_data instances constant, they are not modified at runtime. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit e5894eeefdebf5a6d7512cd23efec78071985738 Author: Dmitry Baryshkov Date: Tue Oct 28 13:46:20 2025 +0200 media: iris: turn platform caps into constants Make all struct platform_inst_fw_cap instances constant, they are not modified at runtime. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 456c99da41cb6f39c5c8420710b72fb9fd1450b4 Author: Dikshita Agarwal Date: Wed Oct 8 15:22:27 2025 +0530 media: iris: Add support for QC08C format for encoder Introduce handling for the QC08C format in the encoder. QC08C format is NV12 with UBWC compression. Update format checks and configuration to enable encoding to QC08C streams. Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit cfd71b14b0d6f62d97338a524c858c63cf699c3f Author: Dikshita Agarwal Date: Wed Oct 8 15:22:26 2025 +0530 media: iris: Add support for QC08C format for decoder Introduce handling for the QC08C format in the decoder. QC08C format is NV12 with UBWC compression. Update format checks and configuration to enable decoding of QC08C streams. Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7c1f3bd58fa02f427ff4ef611fa49b56bc6f8f76 Author: Dikshita Agarwal Date: Wed Oct 8 15:22:25 2025 +0530 media: iris: Add support for HFI_PROP_OPB_ENABLE to control split mode Add handling for the HFI_PROP_OPB_ENABLE property, which allows enabling or disabling split mode in the firmware. When HFI_PROP_OPB_ENABLE is set to true, the firmware activates split mode for output picture buffers (OPB). The OPB format is determined by the HFI_PROP_COLOR_FORMAT property, supporting NV12 or QC08C formats. Signed-off-by: Dikshita Agarwal Reviewed-by: Vikash Garodia Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit bcaaa08dda6cd4477c3895c5841c73c4b1f45328 Author: Johan Hovold Date: Fri Oct 17 08:05:40 2025 +0200 media: venus: drop unused module aliases The driver has never supported anything but OF probing so drop the unused platform module aliases. Signed-off-by: Johan Hovold Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6e971cfe62e7a56593b22ab1ad0050ac49551696 Author: Johan Hovold Date: Fri Oct 17 07:58:09 2025 +0200 media: venus: drop bogus probe deferrals The encoder and decoder platform devices are registered by the venus driver as children of the venus device, but even if someone were to mess this up no amount of probe deferring is going to conjure up a parent. Relatedly, the venus driver sets its driver data before registering the child devices and if this ever breaks we want to learn about it by failing probe. Signed-off-by: Johan Hovold Reviewed-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 416acb41d4c773906f91360b07723add9bc6d5f8 Author: Rob Herring (Arm) Date: Wed Aug 13 16:49:48 2025 -0500 media: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Reviewed-by: Dikshita Agarwal Reviewed-by: Ming Qian Signed-off-by: Rob Herring (Arm) Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0c4a13ba88594fd4a27292853e736c6b4349823d Author: Junrui Luo Date: Thu Nov 6 10:49:46 2025 +0800 ALSA: wavefront: Fix integer overflow in sample size validation The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 but gets cast to int for comparison with dev->freemem Fix by using unsigned comparison to avoid integer overflow. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB7881B47789D1B060CE8BF4C3AFC2A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Takashi Iwai commit e11c5c13ce0ab2325d38fe63500be1dd88b81e38 Author: Junrui Luo Date: Thu Nov 6 10:24:57 2025 +0800 ALSA: wavefront: Clear substream pointers on close Clear substream pointers in close functions to avoid leaving dangling pointers, helping to improve code safety and prevents potential issues. Reported-by: Yuhao Jiang Reported-by: Junrui Luo Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Link: https://patch.msgid.link/SYBPR01MB7881DF762CAB45EE42F6D812AFC2A@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Takashi Iwai commit ab3bd3662ed4605b7859988f224e2ed615f03060 Author: HariKrishna Sagala Date: Wed Nov 5 16:22:30 2025 +0530 ALSA: ac97: Fix kernel-doc warning for snd_ac97_reset kernel-doc populated the below warning for the non static function "snd_ac97_reset". "Warning: ./sound/ac97_bus.c:56 No description found for return value of 'snd_ac97_reset'". Added the return values as per the kernel-doc format. Signed-off-by: HariKrishna Sagala Link: https://patch.msgid.link/20251105105229.112172-2-hariconscious@gmail.com Signed-off-by: Takashi Iwai commit b892ed360de8227d700ef010b08564f87ad3a7ce Author: Danilo Krummrich Date: Mon Nov 3 21:30:13 2025 +0100 rust: platform: get rid of redundant Result in IRQ methods Currently request_irq_by_index() returns Result, Error> + 'a> which may carry an error in the Result or the initializer; the same is true for the other IRQ methods. Use pin_init::pin_init_scope() to get rid of this redundancy. Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251103203053.2348783-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 1f7b01661f5f62211ca079afee922e1b44e3ae5d Author: Danilo Krummrich Date: Mon Nov 3 21:30:12 2025 +0100 rust: pci: get rid of redundant Result in IRQ methods Currently request_irq() returns Result, Error> + 'a> which may carry an error in the Result or the initializer; the same is true for request_threaded_irq(). Use pin_init::pin_init_scope() to get rid of this redundancy. Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20251103203053.2348783-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 9b2d2beaefcfa17259fdbce16d59d660894147cb Author: Sjoerd Simons Date: Wed Nov 5 22:17:57 2025 +0100 arm64: dts: mediatek: mt7981b-openwrt-one: Enable software leds The openwrt has 3 status leds at the front: * red: Used as failsafe led by openwrt * white: Used as boot led by openwrt * green: Used as running/upgrade led by openwrt On the back each RJ45 jack has the typical amber/green leds. For the WAN jack this is hardware controlled by the phy, for LAN these are under software control and enabled by this patch. Signed-off-by: Sjoerd Simons Signed-off-by: AngeloGioacchino Del Regno commit 869b3bb5ada2b1632ad0372df5789f07ff53fa68 Author: Sjoerd Simons Date: Wed Nov 5 22:17:56 2025 +0100 arm64: dts: mediatek: mt7981b-openwrt-one: Enable SPI NOR The openwrt one has a SPI NOR flash which from factory is used for: * Recovery system * WiFi eeprom data * ethernet Mac addresses Describe this following the same partitions as the openwrt configuration uses. Signed-off-by: Sjoerd Simons Signed-off-by: AngeloGioacchino Del Regno commit a58c368067417f3d89b92ccc18fa0bb610b34349 Author: Frank Wunderlich Date: Wed Nov 5 20:50:05 2025 +0100 arm64: dts: mediatek: mt7988a-bpi-r4pro: Add mmc overlays Add MMC overlays for BPI-R4 Pro. Signed-off-by: Frank Wunderlich Signed-off-by: AngeloGioacchino Del Regno commit dec929e61a42ed5d6717d3ec2b6a7734c2ab825b Author: Frank Wunderlich Date: Wed Nov 5 20:50:04 2025 +0100 arm64: dts: mediatek: mt7988a-bpi-r4-pro: Add PCIe overlays Add overlays to switch between key-m and key-e slots. Signed-off-by: Frank Wunderlich Signed-off-by: AngeloGioacchino Del Regno commit f397471a6a8c2b621e1fd06430fc528ab3925422 Author: Frank Wunderlich Date: Wed Nov 5 20:50:03 2025 +0100 arm64: dts: mediatek: mt7988: Add devicetree for BananaPi R4 Pro Add devicetree for Bpi-R4-Pro. BananaPi R4 Pro is a MT7988A based board which exists in 2 different hardware versions: - 4E: 4 GB RAM and using internal 2.5G Phy for WAN-Combo - 8X: 8 GB RAM and 2x Aeonsemi AS21010P 10G phys common parts: - MediaTek MT7988A Quad-core Arm Corex-A73,1.8GHz processor - 8GB eMMC flash - 256MB SPI-NAND Flash - Micro SD card slot - 1x 10G SFP+ WAN - 1x 10G SFP+ LAN - 4x 2.5G RJ45 LAN (MxL86252C) - 1x 1G RJ45 LAN (MT7988 internal switch) - 2x miniPCIe slots with PCIe3.0 2lane interface for Wi-Fi NIC - 2x M.2 M-KEY slots with PCIe3.0 1lane interface for NVME SSD - 3x M.2 B-KEY slots with USB3.2 for 5G Module (PCIe shared with key-m) - 1x USB3.2 slot - 1x USB2.0 slot - 1x USB TypeC Debug Console - 2x13 PIN Header for expanding application https://docs.banana-pi.org/en/BPI-R4_Pro/BananaPi_BPI-R4_Pro The PCIe is per default in key-m state and can be changed to key-b with the pcie-overlays. Signed-off-by: Frank Wunderlich Signed-off-by: AngeloGioacchino Del Regno commit 0e5d9e529383688deccce632c713692e53b31cf6 Author: Frank Wunderlich Date: Wed Nov 5 20:50:02 2025 +0100 arm64: dts: mediatek: mt7988: Disable 2.5G phy and enable at board layer The internal 2.5G phy of mt7988 is only used by some specific board variants. Disable it by default and enable it where needed. Signed-off-by: Frank Wunderlich Signed-off-by: AngeloGioacchino Del Regno commit b6fa6100cec0287856ec1b363b0a962a9be90e6c Author: Randy Dunlap Date: Thu Oct 30 22:41:51 2025 -0700 drm/panfrost: fix UAPI kernel-doc warnings Fix all kernel-doc warnings in include/uapi/drm/panfrost_drm.h. This mostly means modifying existing comments to conform to kernel-doc format, but there also some additions of missing kernel-doc comments and changing non-kernel-doc comments to use "/*" to begin them. Warning: panfrost_drm.h:83 struct member 'jc' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'in_syncs' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'in_sync_count' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'out_sync' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'bo_handles' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'bo_handle_count' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'requirements' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'jm_ctx_handle' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:83 struct member 'pad' not described in 'drm_panfrost_submit' Warning: panfrost_drm.h:116 Incorrect use of kernel-doc format: * Returned offset for the BO in the GPU address space. This offset Warning: panfrost_drm.h:124 struct member 'size' not described in 'drm_panfrost_create_bo' Warning: panfrost_drm.h:124 struct member 'flags' not described in 'drm_panfrost_create_bo' Warning: panfrost_drm.h:124 struct member 'handle' not described in 'drm_panfrost_create_bo' Warning: panfrost_drm.h:124 struct member 'pad' not described in 'drm_panfrost_create_bo' Warning: panfrost_drm.h:124 struct member 'nonzero' not described in 'drm_panfrost_create_bo' Warning: panfrost_drm.h:143 struct member 'handle' not described in 'drm_panfrost_mmap_bo' Warning: panfrost_drm.h:143 struct member 'flags' not described in 'drm_panfrost_mmap_bo' Warning: panfrost_drm.h:143 struct member 'offset' not described in 'drm_panfrost_mmap_bo' Signed-off-by: Randy Dunlap Reviewed-by: Steven Price Reviewed-by: Adrián Larumbe Signed-off-by: Steven Price Link: https://patch.msgid.link/20251031054152.1406764-1-rdunlap@infradead.org commit 512c83265796d613f21255c766839eaed1c1cc79 Author: Randy Dunlap Date: Tue Nov 4 20:51:27 2025 -0800 IB/rdmavt: rdmavt_qp.h: clean up kernel-doc comments Correct the kernel-doc comments format to avoid around 35 kernel-doc warnings: - use struct keyword to introduce struct kernel-doc comments - use correct variable name for some struct members - use correct function name in comments for some functions - fix spelling in a few comments - use a ':' instead of '-' to separate struct members from their descriptions - add a function name heading for rvt_div_mtu() This leaves one struct member that is not described: rdmavt_qp.h:206: warning: Function parameter or struct member 'wq' not described in 'rvt_krwq' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20251105045127.106822-1-rdunlap@infradead.org Signed-off-by: Leon Romanovsky commit 7196156b0ce3dc4cdbda5c09897708b2e1081de1 Author: Marco Crivellari Date: Sat Nov 1 17:31:15 2025 +0100 IB/rdmavt: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. CC: Dennis Dalessandro Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251101163121.78400-6-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit 5267feda50680c73e33b118dbebfb961d6a864bd Author: Marco Crivellari Date: Sat Nov 1 17:31:14 2025 +0100 RDMA/mlx4: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. CC: Yishai Hadas Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251101163121.78400-5-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit 5f93287fa9d0db9bad0251e526dead4aed448288 Author: Marco Crivellari Date: Sat Nov 1 17:31:13 2025 +0100 hfi1: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. CC: Dennis Dalessandro Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251101163121.78400-4-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit e60c5583b661da65b09bfd6ae91126607397490e Author: Marco Crivellari Date: Sat Nov 1 17:31:12 2025 +0100 RDMA/core: WQ_PERCPU added to alloc_workqueue users Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. alloc_workqueue() treats all queues as per-CPU by default, while unbound workqueues must opt-in via WQ_UNBOUND. This default is suboptimal: most workloads benefit from unbound queues, allowing the scheduler to place worker threads where they’re needed and reducing noise when CPUs are isolated. This change adds a new WQ_PERCPU flag to explicitly request alloc_workqueue() to be per-cpu when WQ_UNBOUND has not been specified. With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251101163121.78400-3-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit f673fb3449fcd8afdd7f67277217a93b2fcba435 Author: Marco Crivellari Date: Sat Nov 1 17:31:11 2025 +0100 RDMA/core: RDMA/mlx5: replace use of system_unbound_wq with system_dfl_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. The old system_unbound_wq will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://patch.msgid.link/20251101163121.78400-2-marco.crivellari@suse.com Signed-off-by: Leon Romanovsky commit da58d4223b1690dd47652aa4b5227f39ab139b76 Author: Jay Bhat Date: Thu Oct 30 21:17:26 2025 -0500 RDMA/irdma: Take a lock before moving SRQ tail in poll_cq Need to take an SRQ lock in poll_cq before moving SRQ tail. Signed-off-by: Jay Bhat Reviewed-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Link: https://patch.msgid.link/20251031021726.1003-7-tatyana.e.nikolova@intel.com Signed-off-by: Leon Romanovsky commit d5da3d9fb05f6e2b2685c58b37067749b342b518 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:17 2025 +0300 wifi: rtw89: process TX wait skbs for USB via C2H handler TX wait skbs need to be completed when they are done. PCIe part does this inside rtw89_pci_tx_status() during RPP processing. Other HCIs use a mechanism based on C2H firmware messages. Store TX wait skbs inside TX report queue so that it'll be possible to identify completed items inside the C2H handler. Try to do this as similar to PCIe path as possible. When the corresponding TX wait skb is found inside TX report queue, unlink it from there and call rtw89_core_tx_wait_complete() to mark the completion. If the callee waiting for the completion has already timed out, the TX wait skb is placed into TX wait list (like PCIe part does). It's important that during HCI reset all pending TX wait frames should be completed inside hci.ops->reset method before calling rtw89_tx_wait_list_clear(). Found by Linux Verification Center (linuxtesting.org). Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-11-pchelkin@ispras.ru commit cc7070e41786a51953f71e39a1e6e803a1ed2d50 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:16 2025 +0300 wifi: rtw89: provide TX reports for management frames In order to provide TX reports for the management queue rtw89 should configure the firmware. Do this with SET_CMC_TBL_MGQ_RPT_EN() for the WiFi6 chips and with CCTLINFO_G7_W0_MGQ_RPT_EN flag for the WiFi7 ones. Suggested-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-10-pchelkin@ispras.ru commit 816e849ef83aaf989035545d4a927b50a3d03525 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:15 2025 +0300 wifi: rtw89: handle IEEE80211_TX_CTL_REQ_TX_STATUS frames for USB Frames flagged with IEEE80211_TX_CTL_REQ_TX_STATUS mean the driver has to report to mac80211 stack whether AP sent ACK for the null frame/probe request or not. It's not implemented in USB part of the driver yet. PCIe HCI has its own way of getting TX status incorporated into RPP feature, and it's always enabled there. Other HCIs need a different scheme based on processing C2H messages. Thus define a .tx_rpt_enabled flag indicating which HCIs need to enable a TX report feature. Currently it is USB only. Toggle a bit in the TX descriptor and place flagged skbs in a fix-sized queue to wait for a message from the firmware. Firmware maintains a 4-bit sequence number for required frames hence the queue can contain just 16 elements simultaneously. That's enough for normal driver / firmware communication. If the firmware crashes for any reason and doesn't provide TX reports in time, driver will handle this and report the obsolete frames as dropped. rtw89 also has a new feature providing a TX report for each transmission attempt. Ignore a failed TX status reported by the firmware until retry limit is reached or successful status appears. When there is no success and the retry limit is reached, report the frame up to the wireless stack as failed eventually. HCI reset should stop all pending TX activity so forcefully flush the queue there. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-9-pchelkin@ispras.ru commit 26a42d804aa89f6e62be68126114a4b62a8fe713 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:14 2025 +0300 wifi: rtw89: usb: anchor TX URBs During HCI reset all pending TX URBs should be canceled. Use anchor to keep track of them and have an ability to cancel them synchronously. Note however that canceling RX URBs can't be done here in rtw89_usb_ops_reset() as it breaks driver initialization. Found by Linux Verification Center (linuxtesting.org). Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-8-pchelkin@ispras.ru commit 21b946104087cd48e16ea51903c421cc3962225b Author: Ping-Ke Shih Date: Tue Nov 4 16:57:13 2025 +0300 wifi: rtw89: fill TX descriptor of FWCMD in shortcut TX type FWCMD is used to download firmware and send H2C commands, and it only fill few fields of TX description, such as desc_info->pkt_size. Therefore, early return the TX type FWCMD. Signed-off-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Link: https://patch.msgid.link/20251104135720.321110-7-pchelkin@ispras.ru commit d633730bb3873578a00fde4b97f9ac62a1be8d34 Author: Thorsten Blum Date: Sat Nov 1 15:04:42 2025 +0100 crypto: octeontx2 - Replace deprecated strcpy in cpt_ucode_load_fw strcpy() is deprecated; use the safer strscpy() instead. The destination buffer is only zero-initialized for the first iteration and since strscpy() guarantees its NUL termination anyway, remove zero-initializing 'eng_type'. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit b6410c1e50164da0542b671fc14caf4cff1c4819 Author: Thorsten Blum Date: Thu Oct 30 17:32:17 2025 +0100 crypto: deflate - Use struct_size to improve deflate_alloc_stream Use struct_size(), which provides additional compile-time checks for structures with flexible array members (e.g., __must_be_array()), to calculate the allocation size for a new 'deflate_stream'. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 9fc6290117259a8dbf8247cb54559df62fd1550f Author: Mario Limonciello (AMD) Date: Wed Oct 29 11:15:01 2025 -0500 crypto: ccp - Add support for PCI device 0x115A PCI device 0x115A is similar to pspv5, except it doesn't have platform access mailbox support. Signed-off-by: Mario Limonciello (AMD) Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit 457be301fc6f8731c825b19b9be55a8d72c624b8 Author: Gaurav Kashyap Date: Wed Oct 29 01:25:31 2025 -0700 crypto: qce - fix version check The previous version check made it difficult to support newer major versions (e.g., v6.0) without adding extra checks/macros. Update the logic to only reject v5.0 and allow future versions without additional changes. Signed-off-by: Gaurav Kashyap Signed-off-by: Jingyi Wang Reviewed-by: Bjorn Andersson Signed-off-by: Herbert Xu commit 5a331d1cd550649f0d9e8370914773ed391d2d7b Author: Gaurav Kashyap Date: Wed Oct 29 01:25:30 2025 -0700 dt-bindings: crypto: qcom-qce: Document the kaanapli crypto engine Document the crypto engine on the kaanapali platform. Signed-off-by: Gaurav Kashyap Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jingyi Wang Signed-off-by: Herbert Xu commit e74a03e519063d4e641e437f307e838d05b28e8e Author: Gaurav Kashyap Date: Wed Oct 29 01:25:29 2025 -0700 dt-bindings: crypto: qcom,prng: Document kaanapali RNG Document kaanapali compatible for the True Random Number Generator. Signed-off-by: Gaurav Kashyap Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jingyi Wang Signed-off-by: Herbert Xu commit 426b1a1bdfcec75457104f50443e7d7dc024e5e8 Author: Harsh Jain Date: Wed Oct 29 12:38:38 2025 +0530 crypto: xilinx - Use %pe to print PTR_ERR Fix cocci warnings to use %pe to print PTR_ERR(). Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202510231229.Z6TduqZy-lkp@intel.com/ Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu commit c33c6a1b6f72ae48570530a271c68131c17abdbb Author: Fedor Pchelkin Date: Tue Nov 4 16:57:12 2025 +0300 wifi: rtw89: implement C2H TX report handler rtw89 has several ways of handling TX status report events. The first one is based on RPP feature which is used by PCIe HCI. The other one depends on firmware sending a corresponding C2H message, quite similar to what rtw88 has. Toggle a bit in the TX descriptor to indicate to the firmware that TX report for the frame is expected. This will allow handling TX wait skbs and the ones flagged with IEEE80211_TX_CTL_REQ_TX_STATUS correctly. Do the bulk of the patch according to the vendor driver for RTL8851BU. However, there are slight differences in C2H message format between different types of chips. RTL885xB ones follow format V0. RTL8852C has format V1, and RTL8922AU has format V2. Found by Linux Verification Center (linuxtesting.org). Suggested-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-6-pchelkin@ispras.ru commit 8986bafb0945821b7fc160780074d39eae5f7247 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:11 2025 +0300 wifi: rtw89: refine rtw89_core_tx_wait_complete() Pass TX status value directly into rtw89_core_tx_wait_complete(). This will make it a bit in sync with further patches and will give flexibility in future work. Also use scope based RCU locking which simplifies the code of the function. Found by Linux Verification Center (linuxtesting.org). Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-5-pchelkin@ispras.ru commit 45a6a88f011fc57ba8518f4d032cc2b4f6543c12 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:10 2025 +0300 wifi: rtw89: usb: use ieee80211_free_txskb() where appropriate rtw89_usb_ops_tx_kick_off() may need to release skb if a failure occurs. It operates mainly on skbs coming from the core wireless stack and the ones containing firmware commands. Use ieee80211_free_txskb() for the former case. Suggested-by: Ping-Ke Shih Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-4-pchelkin@ispras.ru commit 7543818e97d5d54b3b2f75f1c4dedee298d7d914 Author: Fedor Pchelkin Date: Tue Nov 4 16:57:09 2025 +0300 wifi: rtw89: usb: fix leak in rtw89_usb_write_port() When there is an attempt to write data and RTW89_FLAG_UNPLUGGED is set, this means device is disconnected and no urb is submitted. Return appropriate error code to the caller to properly free the allocated resources. Found by Linux Verification Center (linuxtesting.org). Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}") Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-3-pchelkin@ispras.ru commit 28a45575289f3292aa9cb7bacae18ba3ee7a6adf Author: Fedor Pchelkin Date: Tue Nov 4 16:57:08 2025 +0300 wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() Allow adding rx_skb to rx_free_queue for later reuse on the common error handling path, otherwise free it. Found by Linux Verification Center (linuxtesting.org). Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}") Acked-by: Ping-Ke Shih Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20251104135720.321110-2-pchelkin@ispras.ru commit c984dd0ecde05e2464cdad00ccd699da48552a3a Author: Siddharth Vadapalli Date: Wed Oct 15 16:43:37 2025 +0530 arm64: dts: ti: k3-j721s2: disable "mcu_cpsw" in SoC file and enable in board files Following the existing convention of disabling nodes in the SoC file and enabling only the required ones in the board file, disable "mcu_cpsw" node in the SoC file "k3-j721s2-mcu-wakeup.dtsi" and enable it in the board files: a) k3-am68-phyboard-izar.dts b) k3-am68-sk-base-board.dts c) k3-j721s2-common-proc-board.dts Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251015111344.3639415-6-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit ee90abbed770849e8fb1041aa11ce8e8b22c9956 Author: Siddharth Vadapalli Date: Wed Oct 15 16:43:36 2025 +0530 arm64: dts: ti: k3-j721e: disable "mcu_cpsw" in SoC file and enable it in board file Following the existing convention of disabling nodes in the SoC file and enabling only the required ones in the board file, disable "mcu_cpsw" node in the SoC file "k3-j721e-mcu-wakeup.dtsi" and enable it in the board files: a) k3-j721e-beagleboneai64.dts b) k3-j721e-common-proc-board.dts c) k3-j721e-sk.dts Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251015111344.3639415-5-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 5a74aa002cd9ff373c81fc0c8ac7614c9a13c546 Author: Siddharth Vadapalli Date: Wed Oct 15 16:43:35 2025 +0530 arm64: dts: ti: k3-j7200: disable "mcu_cpsw" in SoC file and enable in board file Following the existing convention of disabling nodes in the SoC file and enabling only the required ones in the board file, disable "mcu_cpsw" node in the SoC file "k3-j7200-mcu-wakeup.dtsi" and enable it in the board file "k3-j7200-common-proc-board.dts". Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251015111344.3639415-4-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 6d2138b85ec0d200b6249c413967f913abae212f Author: Siddharth Vadapalli Date: Wed Oct 15 16:43:34 2025 +0530 arm64: dts: ti: k3-am65: disable "mcu_cpsw" in SoC file and enable in board file Following the existing convention of disabling nodes in the SoC file and enabling only the required ones in the board file, disable "mcu_cpsw" node in the SoC file "k3-am65-mcu.dtsi" and enable it in the board file "k3-am654-base-board.dts". Also, now that "mcu_cpsw" is disabled in the SoC file, disabling it in "k3-am65-iot2050-common.dtsi" is no longer required. Hence, remove the section corresponding to this change. Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251015111344.3639415-3-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit e8535e2b2786cb072470467f34cf6cf09f07e862 Author: Siddharth Vadapalli Date: Wed Oct 15 16:43:33 2025 +0530 arm64: dts: ti: k3-am62: disable "cpsw3g" in SoC file and enable in board file Following the existing convention of disabling nodes in the SoC file and enabling only the required ones in the board file, disable "cpsw3g" node in the SoC file "k3-am62-main.dtsi" and enable it in the board (or board include) files: a) k3-am62-lp-sk.dts b) k3-am62-phycore-som.dtsi c) k3-am625-beagleplay.dts d) k3-am625-sk-common.dtsi Signed-off-by: Siddharth Vadapalli Link: https://patch.msgid.link/20251015111344.3639415-2-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit 1581a732f1688cf8a676bea11566045e33beca35 Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:39:33 2025 +0100 arm64: dts: ti: k3-am62p5-sk: Set wakeup-source system-states The CANUART pins of mcu_mcan0, mcu_mcan1, mcu_uart0 and wkup_uart0 are powered during Partial-IO and I/O Only + DDR and are capable of waking up the system in these states. Specify the states in which these units can do a wakeup on this board. Note that the UARTs are not capable of wakeup in Partial-IO because of of a UART mux on the board not being powered during Partial-IO. Add pincontrol definitions for mcu_mcan0 and mcu_mcan1 for wakeup from Partial-IO. Add these as wakeup pinctrl entries for both devices. Signed-off-by: Markus Schneider-Pargmann (TI.com) Link: https://patch.msgid.link/20251103-topic-am62-dt-partialio-v6-15-v5-6-b8d9ff5f2742@baylibre.com Signed-off-by: Vignesh Raghavendra commit afb919a6b36bf86e9000060634740fb4ab987d45 Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:39:32 2025 +0100 arm64: dts: ti: k3-am62a7-sk: Set wakeup-source system-states The CANUART pins of mcu_mcan0, mcu_mcan1, mcu_uart0 and wkup_uart0 are powered during Partial-IO and I/O Only + DDR and are capable of waking up the system in these states. Specify the states in which these units can do a wakeup on this board. Note that the UARTs are not capable of wakeup in Partial-IO because of of a UART mux on the board not being powered during Partial-IO. Add pincontrol definitions for mcu_mcan0 and mcu_mcan1 for wakeup from Partial-IO. Add these as wakeup pinctrl entries for both devices. Signed-off-by: Markus Schneider-Pargmann (TI.com) Link: https://patch.msgid.link/20251103-topic-am62-dt-partialio-v6-15-v5-5-b8d9ff5f2742@baylibre.com Signed-off-by: Vignesh Raghavendra commit 1f2f34b619ad9f3934bcf7486a61ff70d18bf420 Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:39:31 2025 +0100 arm64: dts: ti: k3-am62-lp-sk: Set wakeup-source system-states The CANUART pins of mcu_mcan0, mcu_mcan1, mcu_uart0 and wkup_uart0 are powered during Partial-IO and I/O Only + DDR and are capable of waking up the system in these states. Specify the states in which these units can do a wakeup on this board. Note that the UARTs are not capable of wakeup in Partial-IO because of of a UART mux on the board not being powered during Partial-IO. As I/O Only + DDR is not supported on AM62x, the UARTs are not added in this patch. Add pincontrol definitions for mcu_mcan0 and mcu_mcan1 for wakeup from Partial-IO. Add these as wakeup pinctrl entries for both devices. Signed-off-by: Markus Schneider-Pargmann (TI.com) Link: https://patch.msgid.link/20251103-topic-am62-dt-partialio-v6-15-v5-4-b8d9ff5f2742@baylibre.com Signed-off-by: Vignesh Raghavendra commit 4060cf6015e20d7647e9e242a5ba21762741e11f Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:39:30 2025 +0100 arm64: dts: ti: k3-am62p: Define possible system states Add the system states that are available on TI AM62P SoCs. Signed-off-by: Markus Schneider-Pargmann (TI.com) Link: https://patch.msgid.link/20251103-topic-am62-dt-partialio-v6-15-v5-3-b8d9ff5f2742@baylibre.com Signed-off-by: Vignesh Raghavendra commit 6992c72c3aa03c1c578c950979b11101a3fc51c4 Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:39:29 2025 +0100 arm64: dts: ti: k3-am62a: Define possible system states Add the system states that are available on TI AM62A SoCs. Signed-off-by: Markus Schneider-Pargmann (TI.com) Link: https://patch.msgid.link/20251103-topic-am62-dt-partialio-v6-15-v5-2-b8d9ff5f2742@baylibre.com Signed-off-by: Vignesh Raghavendra commit 1b45cec18f89d8f55284bdd4ab124b3cbd0ee1eb Author: Markus Schneider-Pargmann (TI.com) Date: Mon Nov 3 13:39:28 2025 +0100 arm64: dts: ti: k3-am62: Define possible system states Add the system states that are available on TI AM62 SoCs. Signed-off-by: Markus Schneider-Pargmann (TI.com) Link: https://patch.msgid.link/20251103-topic-am62-dt-partialio-v6-15-v5-1-b8d9ff5f2742@baylibre.com Signed-off-by: Vignesh Raghavendra commit 2fc9f6f112426dfcfcdc3bd63a90558a6acb99fb Author: Michael Walle Date: Mon Nov 3 16:28:18 2025 +0100 arm64: dts: ti: k3-am62p-j722s-common-main: move audio_refclk here Since commit 9dee9cb2df08 ("arm64: dts: ti: k3-j722s-main: fix the audio refclk source") the clock nodes of the am62p and j722 are the same. Move them into the commit dtsi. Please note, that for the j722s the nodes are renamed from clock@ to clock-controller@. Suggested-by: Udit Kumar Signed-off-by: Michael Walle Link: https://patch.msgid.link/20251103152826.1608309-1-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 1446fc4dc0728328904e8cb402f065bcc905bcec Author: Siddharth Vadapalli Date: Sat Oct 25 13:07:59 2025 +0530 arm64: dts: ti: k3-*: Replace rgmii-rxid with rgmii-id for CPSW ports The MAC Ports across all of the CPSW instances (CPSW2G, CPSW3G, CPSW5G and CPSW9G) present in various K3 SoCs only support the 'RGMII-ID' mode. This correction has been implemented/enforced by the updates to: a) Device-Tree binding for CPSW [0] b) Driver for CPSW [1] c) Driver for CPSW MAC Port's GMII [2] To complete the transition from 'RGMII-RXID' to 'RGMII-ID', update the 'phy-mode' property for all CPSW ports by replacing 'rgmii-rxid' with 'rgmii-id'. [0]: commit 9b357ea52523 ("dt-bindings: net: ti: k3-am654-cpsw-nuss: update phy-mode in example") [1]: commit ca13b249f291 ("net: ethernet: ti: am65-cpsw: fixup PHY mode for fixed RGMII TX delay") [2]: commit a22d3b0d49d4 ("phy: ti: gmii-sel: Always write the RGMII ID setting") Signed-off-by: Siddharth Vadapalli Tested-by: Matthias Schiffer # k3-am642-tqma64xxl-mbax4xxl Tested-by: Francesco Dolcini # Toradex Verdin AM62P Link: https://patch.msgid.link/20251025073802.1790437-1-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit c9836bf7c38f70623b2369b361d716b26b50f67c Author: Matthias Schiffer Date: Wed Nov 5 15:17:26 2025 +0100 arm64: dts: ti: k3-am642-tqma64xxl: add boot phase tags Similar to other AM64x-based boards, add boot phase tags to make the Device Trees usable for firmware/bootloaders without modification. Supported boot devices are eMMC/SD card, SPI-NOR and USB (both mass storage and DFU). The I2C EEPROM is included to allow the firmware to select the correct RAM configuration for different TQMa64xxL variants. Signed-off-by: Matthias Schiffer Link: https://patch.msgid.link/20251105141726.39579-1-matthias.schiffer@ew.tq-group.com Signed-off-by: Vignesh Raghavendra commit 8ba60c5914f25a44f10189c6919a737b199f6dbf Author: Eric Biggers Date: Sun Nov 2 15:42:09 2025 -0800 lib/crypto: x86/blake2s: Use vpternlogd for 3-input XORs AVX-512 supports 3-input XORs via the vpternlogd (or vpternlogq) instruction with immediate 0x96. This approach, vs. the alternative of two vpxor instructions, is already used in the CRC, AES-GCM, and AES-XTS code, since it reduces the instruction count and is faster on some CPUs. Make blake2s_compress_avx512() take advantage of it too. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102234209.62133-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit cd5528621abb01664a477392cd3e76be2ef6296b Author: Eric Biggers Date: Sun Nov 2 15:42:08 2025 -0800 lib/crypto: x86/blake2s: Avoid writing back unchanged 'f' value Just before returning, blake2s_compress_ssse3() and blake2s_compress_avx512() store updated values to the 'h', 't', and 'f' fields of struct blake2s_ctx. But 'f' is always unchanged (which is correct; only the C code changes it). So, there's no need to write to 'f'. Use 64-bit stores (movq and vmovq) instead of 128-bit stores (movdqu and vmovdqu) so that only 't' is written. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102234209.62133-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a7acd77ebd7f17b07a6ab2ca1dd1e4d487bdfa80 Author: Eric Biggers Date: Sun Nov 2 15:42:07 2025 -0800 lib/crypto: x86/blake2s: Improve readability Various cleanups for readability. No change to the generated code: - Add some comments - Add #defines for arguments - Rename some labels - Use decimal constants instead of hex where it makes sense. (The pshufd immediates intentionally remain as hex.) - Add blank lines when there's a logical break The round loop still could use some work, but this is at least a start. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102234209.62133-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 83c1a867c9999b3bb83e3da8f22eec9ec77a523c Author: Eric Biggers Date: Sun Nov 2 15:42:06 2025 -0800 lib/crypto: x86/blake2s: Use local labels for data Following the usual practice, prefix the names of the data labels with ".L" so that the assembler treats them as truly local. This more clearly expresses the intent and is less error-prone. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102234209.62133-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c19bdf24cc274e96006267173d664df2ef4b13db Author: Eric Biggers Date: Sun Nov 2 15:42:05 2025 -0800 lib/crypto: x86/blake2s: Drop check for nblocks == 0 Since blake2s_compress() is always passed nblocks != 0, remove the unnecessary check for nblocks == 0 from blake2s_compress_ssse3(). Note that this makes it consistent with blake2s_compress_avx512() in the same file as well as the arm32 blake2s_compress(). Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102234209.62133-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2f22115709fc7ebcfa40af3367a508fbbd2f71e9 Author: Eric Biggers Date: Sun Nov 2 15:42:04 2025 -0800 lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit In the C code, the 'inc' argument to the assembly functions blake2s_compress_ssse3() and blake2s_compress_avx512() is declared with type u32, matching blake2s_compress(). The assembly code then reads it from the 64-bit %rcx. However, the ABI doesn't guarantee zero-extension to 64 bits, nor do gcc or clang guarantee it. Therefore, fix these functions to read this argument from the 32-bit %ecx. In theory, this bug could have caused the wrong 'inc' value to be used, causing incorrect BLAKE2s hashes. In practice, probably not: I've fixed essentially this same bug in many other assembly files too, but there's never been a real report of it having caused a problem. In x86_64, all writes to 32-bit registers are zero-extended to 64 bits. That results in zero-extension in nearly all situations. I've only been able to demonstrate a lack of zero-extension with a somewhat contrived example involving truncation, e.g. when the C code has a u64 variable holding 0x1234567800000040 and passes it as a u32 expecting it to be truncated to 0x40 (64). But that's not what the real code does, of course. Fixes: ed0356eda153 ("crypto: blake2s - x86_64 SIMD implementation") Cc: stable@vger.kernel.org Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102234209.62133-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 95ce85de0b8c8a1192c692cbd5948e4dcbc1563f Author: Eric Biggers Date: Sat Nov 1 18:48:06 2025 -0700 lib/crypto: arm, arm64: Drop filenames from file comments Remove self-references to filenames from assembly files in lib/crypto/arm/ and lib/crypto/arm64/. This follows the recommended practice and eliminates an outdated reference to sha2-ce-core.S. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102014809.170713-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b8b816ec046922ef362120c14009516b92a26385 Author: Eric Biggers Date: Sat Nov 1 19:15:53 2025 -0700 lib/crypto: arm/blake2s: Fix some comments Fix the indices in some comments in blake2s-core.S. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251102021553.176587-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 496df7cd649dcb0437d3dbde5231bd5dcd77d2ec Author: Eric Biggers Date: Sat Oct 25 22:50:32 2025 -0700 crypto: s390/sha3 - Remove superseded SHA-3 code The SHA-3 library now utilizes the same s390 SHA-3 acceleration capabilities as the arch/s390/crypto/ SHA-3 crypto_shash algorithms. Moreover, crypto/sha3.c now uses the SHA-3 library. The result is that all SHA-3 APIs are now s390-accelerated without any need for the old SHA-3 code in arch/s390/crypto/. Remove this superseded code. Also update the s390 defconfig and debug_defconfig files to enable CONFIG_CRYPTO_SHA3 instead of CONFIG_CRYPTO_SHA3_256_S390 and CONFIG_CRYPTO_SHA3_512_S390. This makes it so that the s390-optimized SHA-3 continues to be built when either of these defconfigs is used. Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-16-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f1799d17285ca99243328cd92133a9f84ee3a593 Author: Eric Biggers Date: Sat Oct 25 22:50:31 2025 -0700 crypto: sha3 - Reimplement using library API Replace sha3_generic.c with a new file sha3.c which implements the SHA-3 crypto_shash algorithms on top of the SHA-3 library API. Change the driver name suffix from "-generic" to "-lib" to reflect that these algorithms now just use the (possibly arch-optimized) library. This closely mirrors crypto/{md5,sha1,sha256,sha512,blake2b}.c. Implement export_core and import_core, since crypto/hmac.c expects these to be present. (Note that there is no security purpose in wrapping SHA-3 with HMAC. HMAC was designed for older algorithms that don't resist length extension attacks. But since someone could be using "hmac(sha3-*)" via crypto_shash anyway, keep supporting it for now.) Reviewed-by: Ard Biesheuvel Tested-by: Harald Freudenberger Link: https://lore.kernel.org/r/20251026055032.1413733-15-ebiggers@kernel.org Signed-off-by: Eric Biggers commit d280d4d56a13b271ce6af9524feb1af1aa307606 Author: Eric Biggers Date: Sat Oct 25 22:50:30 2025 -0700 crypto: jitterentropy - Use default sha3 implementation Make jitterentropy use "sha3-256" instead of "sha3-256-generic", as the ability to explicitly request the generic code is going away. It's not worth providing a special generic API just for jitterentropy. There are many other solutions available to it, such as doing more iterations or using a more effective jitter collection method. Moreover, the status quo is that SHA-3 is quite slow anyway. Currently only arm64 and s390 have architecture-optimized SHA-3 code. I'm not familiar with the performance of the s390 one, but the arm64 one isn't actually that much faster than the generic code anyway. Note that jitterentropy should just use the library API instead of crypto_shash. But that belongs in a separate change later. Reviewed-by: Ard Biesheuvel Tested-by: Harald Freudenberger Link: https://lore.kernel.org/r/20251026055032.1413733-14-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 862445d3b9e74f58360a7a89787da4dca783e6dd Author: Eric Biggers Date: Sat Oct 25 22:50:29 2025 -0700 lib/crypto: s390/sha3: Add optimized one-shot SHA-3 digest functions Some z/Architecture processors can compute a SHA-3 digest in a single instruction. arch/s390/crypto/ already uses this capability to optimize the SHA-3 crypto_shash algorithms. Use this capability to implement the sha3_224(), sha3_256(), sha3_384(), and sha3_512() library functions too. SHA3-256 benchmark results provided by Harald Freudenberger (https://lore.kernel.org/r/4188d18bfcc8a64941c5ebd8de10ede2@linux.ibm.com/) on a z/Architecture machine with "facility 86" (MSA level 12): Length (bytes) Before (MB/s) After (MB/s) ============== ============= ============ 16 212 225 64 820 915 256 1850 3350 1024 5400 8300 4096 11200 11300 Note: the original data from Harald was given in the form of a graph for each length, showing the distribution of throughputs from 500 runs. I guesstimated the peak of each one. Harald also reported that the generic SHA-3 code was at most 259 MB/s (https://lore.kernel.org/r/c39f6b6c110def0095e5da5becc12085@linux.ibm.com/). So as expected, the earlier commit that optimized sha3_absorb_blocks() and sha3_keccakf() is the more important one; it optimized the Keccak permutation which is the most performance-critical part of SHA-3. Still, this additional commit does notably improve performance further on some lengths. Reviewed-by: Ard Biesheuvel Tested-by: Harald Freudenberger Link: https://lore.kernel.org/r/20251026055032.1413733-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0354d3c1f1b8628e60eceb304b6d2ef75eea6f41 Author: Eric Biggers Date: Sat Oct 25 22:50:28 2025 -0700 lib/crypto: sha3: Support arch overrides of one-shot digest functions Add support for architecture-specific overrides of sha3_224(), sha3_256(), sha3_384(), and sha3_512(). This will be used to implement these functions more efficiently on s390 than is possible via the usual init + update + final flow. Reviewed-by: Ard Biesheuvel Tested-by: Harald Freudenberger Link: https://lore.kernel.org/r/20251026055032.1413733-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 04171105d33ae77945791a637d23b76789f3bef9 Author: Eric Biggers Date: Sat Oct 25 22:50:27 2025 -0700 lib/crypto: s390/sha3: Add optimized Keccak functions Implement sha3_absorb_blocks() and sha3_keccakf() using the hardware- accelerated SHA-3 support in Message-Security-Assist Extension 6. This accelerates the SHA3-224, SHA3-256, SHA3-384, SHA3-512, and SHAKE256 library functions. Note that arch/s390/crypto/ already has SHA-3 code that uses this extension, but it is exposed only via crypto_shash. This commit brings the same acceleration to the SHA-3 library. The arch/s390/crypto/ version will become redundant and be removed in later changes. Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1e29a750572a25200fcea995d91e5f6448f340c0 Author: Eric Biggers Date: Sat Oct 25 22:50:26 2025 -0700 lib/crypto: arm64/sha3: Migrate optimized code into library Instead of exposing the arm64-optimized SHA-3 code via arm64-specific crypto_shash algorithms, instead just implement the sha3_absorb_blocks() and sha3_keccakf() library functions. This is much simpler, it makes the SHA-3 library functions be arm64-optimized, and it fixes the longstanding issue where the arm64-optimized SHA-3 code was disabled by default. SHA-3 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/arm64/crypto/sha3-ce-glue.c to lib/crypto/arm64/sha3.h, view this commit with 'git show -M10'. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit be755eb2b021495e1935813abaf9e1f1de1d8c78 Author: Eric Biggers Date: Sat Oct 25 22:50:25 2025 -0700 crypto: arm64/sha3 - Update sha3_ce_transform() to prepare for library - Use size_t lengths, to match the library. - Pass the block size instead of digest size, and add support for the block size that SHAKE128 uses. This allows the code to be used with SHAKE128 and SHAKE256, which don't have the concept of a digest size. SHAKE256 has the same block size as SHA3-256, but SHAKE128 has a unique block size. Thus, there are now 5 supported block sizes. Don't bother changing the "glue" code arm64_sha3_update() too much, as it gets deleted when the SHA-3 code is migrated into lib/crypto/ anyway. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6fa873641c0bdfa849130a81aa7339ccfd42b52a Author: Eric Biggers Date: Sat Oct 25 22:50:24 2025 -0700 lib/crypto: sha3: Add FIPS cryptographic algorithm self-test Since the SHA-3 algorithms are FIPS-approved, add the boot-time self-test which is apparently required. This closely follows the corresponding SHA-1, SHA-256, and SHA-512 tests. Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c0db39e253ebca9dea57e8885450ff0a0a6d6155 Author: David Howells Date: Sat Oct 25 22:50:21 2025 -0700 lib/crypto: sha3: Move SHA3 Iota step mapping into round function In crypto/sha3_generic.c, the keccakf() function calls keccakf_round() to do four of Keccak-f's five step mappings. However, it does not do the Iota step mapping - presumably because that is dependent on round number, whereas Theta, Rho, Pi and Chi are not. Note that the keccakf_round() function needs to be explicitly non-inlined on certain architectures as gcc's produced output will (or used to) use over 1KiB of stack space if inlined. Now, this code was copied more or less verbatim into lib/crypto/sha3.c, so that has the same aesthetic issue. Fix this there by passing the round number into sha3_keccakf_one_round_generic() and doing the Iota step mapping there. crypto/sha3_generic.c is left untouched as that will be converted to use lib/crypto/sha3.c at some point. Suggested-by: Eric Biggers Signed-off-by: David Howells Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0593447248044ab609b43b947d0e198c887ac281 Author: David Howells Date: Sat Oct 25 22:50:20 2025 -0700 lib/crypto: sha3: Add SHA-3 support Add SHA-3 support to lib/crypto/. All six algorithms in the SHA-3 family are supported: four digests (SHA3-224, SHA3-256, SHA3-384, and SHA3-512) and two extendable-output functions (SHAKE128 and SHAKE256). The SHAKE algorithms will be required for ML-DSA. [EB: simplified the API to use fewer types and functions, fixed bug that sometimes caused incorrect SHAKE output, cleaned up the documentation, dropped an ad-hoc test that was inconsistent with the rest of lib/crypto/, and many other cleanups] Signed-off-by: David Howells Co-developed-by: Eric Biggers Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0567c84d683d1f38dc41928eec786ec5c02bf7b4 Author: Shangjuan Wei Date: Tue Nov 4 15:33:05 2025 +0800 dt-bindings: ethernet: eswin: fix yaml schema issues eswin,hsp-sp-csr attribute is one phandle with multiple arguments, so the syntax should be in the form of: items: - items: - description: ... - description: ... - description: ... - description: ... To align with the description of the 'eswin-sp-csr' attribute in the mmc,usb modules, the description of the 'eswin,hsp-sp-csr' attribute has been modified. Fixes: 888bd0eca93c ("dt-bindings: ethernet: eswin: Document for EIC7700 SoC") Reported-by: Rob Herring (Arm) Closes: https://lore.kernel.org/all/176096011380.22917.1988679321096076522.robh@kernel.org/ Signed-off-by: Shangjuan Wei Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251104073305.299-1-weishangjuan@eswincomputing.com Signed-off-by: Jakub Kicinski commit 9158447f09aae33e85744517d9d4a1812bb39007 Merge: 9b73cdad58893d fd8c4f6454963a Author: Jakub Kicinski Date: Wed Nov 5 18:35:16 2025 -0800 Merge branch 'net-stmmac-socfpga-add-agilex5-platform-support-and-enhancements' Rohan G Thomas says: ==================== net: stmmac: socfpga: Add Agilex5 platform support and enhancements This patch series adds support for the Agilex5 EMAC platform to the dwmac-socfpga driver. The series includes: - Platform configuration for Agilex5 EMAC - Enabling Time-Based Scheduling (TBS) for Tx queues 6 and 7 - Enabling TCP Segmentation Offload(TSO) - Adding hardware-supported cross timestamping using the SMTG IP, allowing precise synchronization between MAC and system time via PTP_SYS_OFFSET_PRECISE. ==================== Link: https://patch.msgid.link/20251101-agilex5_ext-v2-0-a6b51b4dca4d@altera.com Signed-off-by: Jakub Kicinski commit fd8c4f6454963aa7ea895657472aa57f33779d57 Author: Rohan G Thomas Date: Sat Nov 1 01:27:10 2025 +0800 net: stmmac: socfpga: Add hardware supported cross-timestamp Cross timestamping is supported on Agilex5 platform with Synchronized Multidrop Timestamp Gathering(SMTG) IP. The hardware cross-timestamp result is made available the applications through the ioctl call PTP_SYS_OFFSET_PRECISE, which inturn calls stmmac_getcrosststamp(). Device time is stored in the MAC Auxiliary register. The 64-bit System time (ARM_ARCH_COUNTER) is stored in SMTG IP. SMTG IP is an MDIO device with 0xC - 0xF MDIO register space holds 64-bit system time. This commit is similar to following commit for Intel platforms: Commit 341f67e424e5 ("net: stmmac: Add hardware supported cross-timestamp") Signed-off-by: Rohan G Thomas Link: https://patch.msgid.link/20251101-agilex5_ext-v2-4-a6b51b4dca4d@altera.com Signed-off-by: Jakub Kicinski commit e28988aef70f8f993d93a62161a202e930cfce55 Author: Rohan G Thomas Date: Sat Nov 1 01:27:09 2025 +0800 net: stmmac: socfpga: Enable TSO for Agilex5 platform Agilex5 supports TCP Segmentation Offload(TSO). This commit enables TSO for Agilex5 socfpga platforms. Signed-off-by: Rohan G Thomas Link: https://patch.msgid.link/20251101-agilex5_ext-v2-3-a6b51b4dca4d@altera.com Signed-off-by: Jakub Kicinski commit 4c00476d44804db3c16838299b87a11741cd0dbd Author: Rohan G Thomas Date: Sat Nov 1 01:27:08 2025 +0800 net: stmmac: socfpga: Enable TBS support for Agilex5 Agilex5 supports Time-Based Scheduling(TBS) for Tx queue 6 and Tx queue 7. This commit enables TBS support for these queues. Signed-off-by: Rohan G Thomas Link: https://patch.msgid.link/20251101-agilex5_ext-v2-2-a6b51b4dca4d@altera.com Signed-off-by: Jakub Kicinski commit 93d46ea3e984323fae0e5d2919cf5817e1297d41 Author: Rohan G Thomas Date: Sat Nov 1 01:27:07 2025 +0800 net: stmmac: socfpga: Agilex5 EMAC platform configuration Agilex5 HPS EMAC uses the dwxgmac-3.10a IP, unlike previous socfpga platforms which use dwmac1000 IP. Due to differences in platform configuration, Agilex5 requires a distinct setup. Introduce a setup_plat_dat() callback in socfpga_dwmac_ops to handle platform-specific setup. This callback is invoked before stmmac_dvr_probe() to ensure the platform data is correctly configured. Also, implemented separate setup_plat_dat() callback for current socfpga platforms and Agilex5. Signed-off-by: Rohan G Thomas Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20251101-agilex5_ext-v2-1-a6b51b4dca4d@altera.com Signed-off-by: Jakub Kicinski commit 9b73cdad58893d2f88682c50275384c4b3b684f6 Merge: c79a022524577e 2f6adeaf92c4ea Author: Jakub Kicinski Date: Wed Nov 5 18:09:23 2025 -0800 Merge tag 'wireless-next-2025-11-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== More changes from drivers are coming in, notably: - ath10k: factory test support - ath11k: TX power insertion support - ath12k: BSS color change support - iwlwifi: new sniffer API support * tag 'wireless-next-2025-11-05' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (63 commits) wifi: ath10k: use = {} to initialize bmi_target_info instead of memset wifi: ath10k: use = {} to initialize pm_qos_request instead of memset wifi: ath12k: unassign arvif on scan vdev create failure wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create() wifi: ath12k: Set EHT fixed rates for associated STAs wifi: ath12k: add EHT rates to ath12k_mac_op_set_bitrate_mask() wifi: ath12k: Add EHT fixed GI/LTF wifi: ath12k: Add EHT MCS/NSS rates to Peer Assoc wifi: ath12k: add EHT rate handling to existing set rate functions wifi: ath12k: generalize GI and LTF fixed rate functions wifi: ath12k: fix error handling in creating hardware group wifi: ath12k: fix reusing m3 memory wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() wifi: iwlwifi: mld: check for NULL pointer after kmalloc wifi: iwlwifi: cfg: fix a few device names wifi: iwlwifi: mld: Move EMLSR prints to IWL_DL_EHT wifi: iwlwifi: disable EHT if the device doesn't allow it wifi: iwlwifi: bump core version for BZ/SC/DR wifi: iwlwifi: mld: use FW_CHECK on bad ROC notification ... ==================== Link: https://patch.msgid.link/20251105153537.54096-38-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit c79a022524577e486220bc9627ccebc706148c1f Author: Dan Carpenter Date: Fri Oct 31 16:05:01 2025 +0300 net: dsa: microchip: Fix a link check in ksz9477_pcs_read() The BMSR_LSTATUS define is 0x4 but the "p->phydev.link" variable is a 1 bit bitfield in a u32. Since 4 doesn't fit in 0-1 range it means that ".link" is always set to false. Add a !! to fix this. [Jakub: According to Maxime the phydev struct isn't really used and we should consider removing it completely. So not treating this as a fix.] Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aQSz_euUg0Ja8ZaH@stanley.mountain Signed-off-by: Jakub Kicinski commit b54a8e130c0204330de0787d81b28d2a0c9dc871 Merge: 4cb4897bb49a4c ac4d838ce12232 Author: Alexei Starovoitov Date: Wed Nov 5 17:31:26 2025 -0800 Merge branch 'bpf-indirect-jumps' Anton Protopopov says: ==================== BPF indirect jumps This patchset implements a new type of map, instruction set, and uses it to build support for indirect branches in BPF (on x86). (The same map will be later used to provide support for indirect calls and static keys.) See [1], [2] for more context. Short table of contents: * Patches 1-6 implement the new map of type BPF_MAP_TYPE_INSN_SET and corresponding selftests. This map can be used to track the "original -> xlated -> jitted mapping" for a given program. * Patches 7-12 implement the support for indirect jumps on x86 and add libbpf support for LLVM-compiled programs containing indirect jumps, and selftests. The jump table support was merged to LLVM and now can be enabled with -mcpu=v4, see [3]. The __BPF_FEATURE_GOTOX macros can be used to check if the compiler supports the feature or not. See individual patches for more details on the implementation details. v10 -> v11 (this series): * rearranged patches and split libbpf patch such that first 6 patches implementing instruction arrays can be applied independently * instruction arrays: * move [fake] aux->used_maps assignment in this patch * indirect jumps: * call clear_insn_aux_data before bpf_remove_insns (AI) * libbpf: * remove the relocations check after the new LLVM is released (Eduard, Yonghong) * libbpf: fix an index printed in pr_warn (AI) * selftests: * protect programs triggered by nanosleep from fake runs (Eduard) * patch verifier_gotox to not emit .rel.jumptables v9 -> v10 (https://lore.kernel.org/bpf/20251102205722.3266908-1-a.s.protopopov@gmail.com/T/#t): * Three bugs were noticed by AI in v9 (two old, one introduced by v9): * [new] insn_array_alloc_size could overflow u32, switched to u64 (AI) * map_ptr should be compared in regsafe for PTR_TO_INSN (AI) * duplicate elements were copied in jt_from_map (AI) * added a selftest in verifier_gotox with a jump table containing non-unique entries v8 -> v9 (https://lore.kernel.org/bpf/20251101110717.2860949-1-a.s.protopopov@gmail.com/T/#t): * instruction arrays: * remove the size restriction of 256 elements * add a comments about addrs usage, old and new (Alexei) * libbpf: * properly prefix warnings (Andrii) * cast j[t] to long long for printf and some other minor cleanups (Andrii) * selftests: * use __BPF_FEATURE_GOTOX in selftests and skip tests if it's not set (Eduard) * fix a typo in a selftest assembly (AI) v7 -> v8 (https://lore.kernel.org/bpf/20251028142049.1324520-1-a.s.protopopov@gmail.com/T/#u): * instruction arrays: * simplify the bpf_prog_update_insn_ptrs function (Eduard) * remove a semicolon after a function definition (AI) * libbpf: * add a proper error path in libbpf patch (AI) * re-re-factor the create_jt_map & find_subprog_idx (Eduard) * selftests: * verifier_gotox: add a test for a jump table pointing to outside of a subprog (Eduard) * used test__skip instead of just running an empty test * split tests in bpf_gotox into subtests for convenience * random: * drop the docs commit for now v6 -> v7 (https://lore.kernel.org/bpf/20251026192709.1964787-1-a.s.protopopov@gmail.com/T/#t): * rebased and dropped already merged commits * instruction arrays * use jit_data to find mappings from insn to jit (Alexei) * alloc `ips` as part of the main allocation (Eduard) * the `jitted_ip` member wasn't actually used (Eduard) * remove the bpf_insn_ptr structure, which is not needed for this patch * indirect jumps, kernel: * fix a memory leak in `create_jt` (AI) * use proper reg+8*ereg in `its_static_thunk` (AI) * some minor cleanups (Eduard) * indirect jumps, libbpf: * refactor the `jt_adjust_off()` piece (Edurad) * move "JUMPTABLES_SEC" into libbpf_internal.h (Eduard) * remove an unnecessary if (Eduard) * verifier_gotox: add tests to verify that `gotox rX` works with all registers v5 -> v6 (https://lore.kernel.org/bpf/20251019202145.3944697-1-a.s.protopopov@gmail.com/T/#u): * instruction arrays: * better document `struct bpf_insn_array_value` (Eduard) * remove a condition in `bpf_insn_array_adjust_after_remove` (Eduard) * make userspace see original, xlated, and jitted indexes (+original) (Eduard) * indirect jumps, kernel: * reject writes to the map * reject unaligned ops * add a check what `w` is not outside the program in check_config for `gotox` (Eduard) * do not introduce unneeded `bpf_find_containing_subprog_idx` * simplify error processing for `bpf_find_containing_subprog` (Eduard) * add `insn_state |= DISCOVERED` when it's discovered (Eduard) * support SUB operations on PTR_TO_INSN (Eduard) * make `gotox_tmp_buf` a bpf_iarray and use helper to relocate it (Eduard) * rename fields of `bpf_iarray` to more generic (Eduard) * re-implement `visit_gotox_insn` in a loop (Eduard) * some minor cleanups (Eduard) * libbpf: * `struct reloc_desc`: add a comment about `union` (Eduard) * rename parameters of (and one other place in code) `{create,add}_jt_map` to `sym_off` (Eduard) * `create_jt_map`: check that size/off are 8-byte aligned (Eduard) * Selftests: * instruction array selftests: * only run tests on x86_64 * write a more generic function to test things to reduce code (Eduard) * errno wasn't used in checks, so don't reset it (Eduard) * print `i`, `xlated_off` and `map_out[i]` here (Eduard) * added `verifier_gotox` selftests which do not depend on LLVM: * disabled `bpf_gotox` tests by default * other changes: * remove an extra function in bpf disasm (Eduard) * some minor cleanups in the insn_successors patch (Eduard) * update documentation in `Documentation/bpf/linux-notes.html` about jumps, now it is supported :) v3 -> v4 -> v5 (https://lore.kernel.org/bpf/20250930125111.1269861-1-a.s.protopopov@gmail.com/): * [v4 -> v5] rebased on top of the last bpf-next/master * instruction arrays: * add copyright (Alexei) * remove mutexes, add frozen back (Alexei) * setup 1:1 prog-map correspondence using atomic_xchg * do not copy/paste array_map_get_next_key, add a common helper (Alexei) * misc minor code cleanups (Alexei) * indirect jumps, kernel side: * remove jt_allocated, just check if insn is gotox (Eduard) * use copy_register_state instead of individual copies (Eduard) * in push_stack is_speculative should be inherited (Eduard) * a few cleanups for insn_successors, including omitting error path (Eduard) * check if reserved fields are used when considering `gotox` instruction (Eduard) * read size and alignment of read from insn_array should be 8 (Eduard) * put buffer for sorting in subfun info and realloc to grow as needed (Eduard) * properly do `jump_point` / `prune_point` from `push_gotox_edge` (Eduard) * use range_within to check states (Eduard) * some minor cleanups and fix commit message (Eduard) * indirect jumps, libbpf side: * close map_fd in some error paths in create_jt_map (Andrii) * maps for jump tables are actually not closed at all, fix this (Andrii) * rename map from `jt` to `.jumptables` (Andrii) * use `errstr` in an error message (Andrii) * rephrase error message to look more standard (Andrii) * misc other minor renames and cleanups (Andrii) * selftests: * add the frozen selftest back * add a selftest for two jumps loading same table * some other changes: * rebase and split insn_successor changes into separate patch * use PTR_ERR_OR_ZERO in the push stack patch (Eduard) * indirect jumps on x86: properly re-read *pprog (Eduard) v2 -> v3 (https://lore.kernel.org/bpf/20250918093850.455051-1-a.s.protopopov@gmail.com/): * fix build failure when CONFIG_BPF_SYSCALL is not set (kbuild-bot) * reformat bpftool help messages (Quentin) v1 -> v2 (https://lore.kernel.org/bpf/20250913193922.1910480-1-a.s.protopopov@gmail.com/): * push_stack changes: * sanitize_speculative_path should just return int (Eduard) * return code from sanitize_speculative_path, not EFAULT (Eduard) * when BPF_COMPLEXITY_LIMIT_JMP_SEQ is reached, return E2BIG (Eduard) * indirect jumps: * omit support for .imm=fd in gotox, as we're not using it for now (Eduard) * struct jt -> struct bpf_iarray (Eduard) * insn_successors: rewrite the interface to just return a pointer (Eduard) * remove min_index/max_index, use umin_value/umax_value instead (Alexei, Eduard) * move emit_indirect_jump args change to the previous patch (Eduard) * add a comment to map_mem_size() (Eduard) * use verifier_bug for some error cases in check_indirect_jump (Eduard) * clear_insn_aux_data: use start,len instead of start,end (Eduard) * make regs[insn->dst_reg].type = PTR_TO_INSN part of check_mem_access (Eduard) * constant blinding changes: * make subprog_start adjustment better readable (Eduard) * do not set subprog len, it is already set (Eduard) * libbpf: * remove check that relocations from .rodata are ok (Anton) * do not freeze the map, it is not necessary anymore (Anton) * rename the goto_x -> gotox everywhere (Anton) * use u64 when parsing LLVM jump tables (Eduard) * split patch in two due to spaces->tabs change (Eduard) * split bpftool changes to bpftool patch (Andrii) * make sym_size it a union with ext_idx (Andrii) * properly copy/free the jumptables_data section from elf (Andrii) * a few cosmetic changes around create_jt_map (Andrii) * fix some comments + rewrite patch description (Andrii) * inline bpf_prog__append_subprog_offsets (Andrii) * subprog_sec_offst -> subprog_sec_off (Andrii) * !strcmp -> strcmp() == 0 (Andrii) * make some function names more readable (Andrii) * allocate table of subfunc offsets via libbpf_reallocarray (Andrii) * selftests: * squash insn_array* tests together (Anton) * fixed build warnings (kernel test robot) RFC -> v1 (https://lore.kernel.org/bpf/20250816180631.952085-1-a.s.protopopov@gmail.com/): * I've tried to address all the comments provided by Alexei and Eduard in RFC. Will try to list the most important of them below. * One big change: move from older LLVM version [5] to newer [4]. Now LLVM generates jump tables as symbols in the new special section ".jumptables". Another part of this change is that libbpf now doesn't try to link map load and goto *rX, as 1) this is absolutely not reliable 2) for some use cases this is impossible (namely, when more than one jump table can be used in the same gotox instruction). * Added insn_successors() support (Alexei, Eduard). This includes getting rid of the ugly bpf_insn_set_iter_xlated_offset() interface (Eduard). * Removed hack for the unreachable instruction, as new LLVM thank to Eduard doesn't generate it. * Set mem_size for direct map access properly instead of hacking. Remove off>0 check. (Alexei) * Do not allocate new memory for min_index/max_index (Alexei, Eduard) * Information required during check_cfg is now cached to be reused later (Alexei + general logic for supporting multiple JT per jump) * Properly compare registers in regsafe (Alexei, Eduard) * Remove support for JMP32 (Eduard) * Better checks in adjust_ptr_min_max_vals (Eduard) * More selftests were added (but still there's room for more) which directly use gotox (Alexei) * More checks and verbose messages added * "unique pointers" are no more in the map Links: 1. https://lpc.events/event/18/contributions/1941/ 2. https://lwn.net/Articles/1017439/ 3. https://github.com/llvm/llvm-project/pull/149715 4. https://github.com/llvm/llvm-project/pull/149715#issuecomment-3274833753 6. rfc: https://lore.kernel.org/bpf/20250615085943.3871208-1-a.s.protopopov@gmail.com/ ==================== Link: https://patch.msgid.link/20251105090410.1250500-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit ac4d838ce122324b327f69d6de97c96442fcc6ba Author: Anton Protopopov Date: Wed Nov 5 09:04:10 2025 +0000 selftests/bpf: add C-level selftests for indirect jumps Add C-level selftests for indirect jumps to validate LLVM and libbpf functionality. The tests are intentionally disabled, to be run locally by developers, but will not make the CI red. Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251105090410.1250500-13-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit ccbdb48ce5cd50733578c20b0c6860666c3d2a69 Author: Anton Protopopov Date: Wed Nov 5 09:04:09 2025 +0000 selftests/bpf: add new verifier_gotox test Add a set of tests to validate core gotox functionality without need to rely on compilers. Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251105090410.1250500-12-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit dd3fd3c965595a3ae8f4d70df6c42931b2fdfd24 Author: Anton Protopopov Date: Wed Nov 5 09:04:08 2025 +0000 libbpf: support llvm-generated indirect jumps For v4 instruction set LLVM is allowed to generate indirect jumps for switch statements and for 'goto *rX' assembly. Every such a jump will be accompanied by necessary metadata, e.g. (`llvm-objdump -Sr ...`): 0: r2 = 0x0 ll 0000000000000030: R_BPF_64_64 BPF.JT.0.0 Here BPF.JT.1.0 is a symbol residing in the .jumptables section: Symbol table: 4: 0000000000000000 240 OBJECT GLOBAL DEFAULT 4 BPF.JT.0.0 The -bpf-min-jump-table-entries llvm option may be used to control the minimal size of a switch which will be converted to an indirect jumps. Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-11-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit bc414d35831bffae725b249c8650669ed100e5f7 Author: Anton Protopopov Date: Wed Nov 5 09:04:07 2025 +0000 bpf: disasm: add support for BPF_JMP|BPF_JA|BPF_X Add support for indirect jump instruction. Example output from bpftool: 0: (79) r3 = *(u64 *)(r1 +0) 1: (25) if r3 > 0x4 goto pc+666 2: (67) r3 <<= 3 3: (18) r1 = 0xffffbeefspameggs 5: (0f) r1 += r3 6: (79) r1 = *(u64 *)(r1 +0) 7: (0d) gotox r1 Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-10-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 493d9e0d608339a32f568504d5fd411a261bb0af Author: Anton Protopopov Date: Wed Nov 5 09:04:06 2025 +0000 bpf, x86: add support for indirect jumps Add support for a new instruction BPF_JMP|BPF_X|BPF_JA, SRC=0, DST=Rx, off=0, imm=0 which does an indirect jump to a location stored in Rx. The register Rx should have type PTR_TO_INSN. This new type assures that the Rx register contains a value (or a range of values) loaded from a correct jump table – map of type instruction array. For example, for a C switch LLVM will generate the following code: 0: r3 = r1 # "switch (r3)" 1: if r3 > 0x13 goto +0x666 # check r3 boundaries 2: r3 <<= 0x3 # adjust to an index in array of addresses 3: r1 = 0xbeef ll # r1 is PTR_TO_MAP_VALUE, r1->map_ptr=M 5: r1 += r3 # r1 inherits boundaries from r3 6: r1 = *(u64 *)(r1 + 0x0) # r1 now has type INSN_TO_PTR 7: gotox r1 # jit will generate proper code Here the gotox instruction corresponds to one particular map. This is possible however to have a gotox instruction which can be loaded from different maps, e.g. 0: r1 &= 0x1 1: r2 <<= 0x3 2: r3 = 0x0 ll # load from map M_1 4: r3 += r2 5: if r1 == 0x0 goto +0x4 6: r1 <<= 0x3 7: r3 = 0x0 ll # load from map M_2 9: r3 += r1 A: r1 = *(u64 *)(r3 + 0x0) B: gotox r1 # jump to target loaded from M_1 or M_2 During check_cfg stage the verifier will collect all the maps which point to inside the subprog being verified. When building the config, the high 16 bytes of the insn_state are used, so this patch (theoretically) supports jump tables of up to 2^16 slots. During the later stage, in check_indirect_jump, it is checked that the register Rx was loaded from a particular instruction array. Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-9-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 5bef46ac9c574d6d37d53dd802f7dbf677141fc2 Author: Anton Protopopov Date: Wed Nov 5 09:04:05 2025 +0000 bpf, x86: allow indirect jumps to r8...r15 Currently the emit_indirect_jump() function only accepts one of the RAX, RCX, ..., RBP registers as the destination. Make it to accept R8, R9, ..., R15 as well, and make callers to pass BPF registers, not native registers. This is required to enable indirect jumps support in eBPF. Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-8-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit ae48162a667b79fba19296e5f2ee4d6602c809f5 Author: Anton Protopopov Date: Wed Nov 5 09:04:04 2025 +0000 selftests/bpf: test instructions arrays with blinding Add a specific test for instructions arrays with blinding enabled. Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-7-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 30ec0ec09bf53e3309c02e79dc325a4d1244bd4b Author: Anton Protopopov Date: Wed Nov 5 09:04:03 2025 +0000 bpf: support instructions arrays with constants blinding When bpf_jit_harden is enabled, all constants in the BPF code are blinded to prevent JIT spraying attacks. This happens during JIT phase. Adjust all the related instruction arrays accordingly. Signed-off-by: Anton Protopopov Reviewed-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-6-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 218edd6db6b984d09d9965553b1742f42138754b Author: Anton Protopopov Date: Wed Nov 5 09:04:02 2025 +0000 selftests/bpf: add selftests for new insn_array map Add the following selftests for new insn_array map: * Incorrect instruction indexes are rejected * Two programs can't use the same map * BPF progs can't operate the map * no changes to code => map is the same * expected changes when instructions are added * expected changes when instructions are deleted * expected changes when multiple functions are present Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-5-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit dfb073d32cac28cdb597d16d1e0589b25c841661 Author: Tim Hostetler Date: Tue Nov 4 14:59:15 2025 -0800 ptp: Return -EINVAL on ptp_clock_register if required ops are NULL ptp_clock should never be registered unless it stubs one of gettimex64() or gettime64() and settime64(). WARN_ON_ONCE and error out if either set of function pointers is null. For consistency, n_alarm validation is also folded into the WARN_ON_ONCE. Suggested-by: Kuniyuki Iwashima Reviewed-by: Kuniyuki Iwashima Reviewed-by: Harshitha Ramamurthy Reviewed-by: Vadim Fedorenko Signed-off-by: Tim Hostetler Acked-by: Richard Cochran Link: https://patch.msgid.link/20251104225915.2040080-1-thostet@google.com Signed-off-by: Jakub Kicinski commit cbef91de0271b3d0c965a9eee5c33d49db24cd20 Author: Anton Protopopov Date: Wed Nov 5 09:04:01 2025 +0000 libbpf: Recognize insn_array map type Teach libbpf about the existence of the new instruction array map. Signed-off-by: Anton Protopopov Link: https://lore.kernel.org/r/20251105090410.1250500-4-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 18a187bf258421b3d7c0ba32b2e1fde2fdf0f112 Author: Anton Protopopov Date: Wed Nov 5 09:04:00 2025 +0000 bpftool: Recognize insn_array map type Teach bpftool to recognize instruction array map type. Signed-off-by: Anton Protopopov Acked-by: Quentin Monnet Link: https://lore.kernel.org/r/20251105090410.1250500-3-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit b4ce5923e780d6896d4aaf19de5a27652b8bf1ea Author: Anton Protopopov Date: Wed Nov 5 09:03:59 2025 +0000 bpf, x86: add new map type: instructions array On bpf(BPF_PROG_LOAD) syscall user-supplied BPF programs are translated by the verifier into "xlated" BPF programs. During this process the original instructions offsets might be adjusted and/or individual instructions might be replaced by new sets of instructions, or deleted. Add a new BPF map type which is aimed to keep track of how, for a given program, the original instructions were relocated during the verification. Also, besides keeping track of the original -> xlated mapping, make x86 JIT to build the xlated -> jitted mapping for every instruction listed in an instruction array. This is required for every future application of instruction arrays: static keys, indirect jumps and indirect calls. A map of the BPF_MAP_TYPE_INSN_ARRAY type must be created with a u32 keys and value of size 8. The values have different semantics for userspace and for BPF space. For userspace a value consists of two u32 values – xlated and jitted offsets. For BPF side the value is a real pointer to a jitted instruction. On map creation/initialization, before loading the program, each element of the map should be initialized to point to an instruction offset within the program. Before the program load such maps should be made frozen. After the program verification xlated and jitted offsets can be read via the bpf(2) syscall. If a tracked instruction is removed by the verifier, then the xlated offset is set to (u32)-1 which is considered to be too big for a valid BPF program offset. One such a map can, obviously, be used to track one and only one BPF program. If the verification process was unsuccessful, then the same map can be re-used to verify the program with a different log level. However, if the program was loaded fine, then such a map, being frozen in any case, can't be reused by other programs even after the program release. Example. Consider the following original and xlated programs: Original prog: Xlated prog: 0: r1 = 0x0 0: r1 = 0 1: *(u32 *)(r10 - 0x4) = r1 1: *(u32 *)(r10 -4) = r1 2: r2 = r10 2: r2 = r10 3: r2 += -0x4 3: r2 += -4 4: r1 = 0x0 ll 4: r1 = map[id:88] 6: call 0x1 6: r1 += 272 7: r0 = *(u32 *)(r2 +0) 8: if r0 >= 0x1 goto pc+3 9: r0 <<= 3 10: r0 += r1 11: goto pc+1 12: r0 = 0 7: r6 = r0 13: r6 = r0 8: if r6 == 0x0 goto +0x2 14: if r6 == 0x0 goto pc+4 9: call 0x76 15: r0 = 0xffffffff8d2079c0 17: r0 = *(u64 *)(r0 +0) 10: *(u64 *)(r6 + 0x0) = r0 18: *(u64 *)(r6 +0) = r0 11: r0 = 0x0 19: r0 = 0x0 12: exit 20: exit An instruction array map, containing, e.g., instructions [0,4,7,12] will be translated by the verifier to [0,4,13,20]. A map with index 5 (the middle of 16-byte instruction) or indexes greater than 12 (outside the program boundaries) would be rejected. The functionality provided by this patch will be extended in consequent patches to implement BPF Static Keys, indirect jumps, and indirect calls. Signed-off-by: Anton Protopopov Reviewed-by: Eduard Zingerman Link: https://lore.kernel.org/r/20251105090410.1250500-2-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit ba13710ddd1f47884701213a3b6a5e470f6bc81e Author: Shankari Anand Date: Sun Oct 12 19:50:12 2025 +0530 rust: block: update ARef and AlwaysRefCounted imports from sync::aref Update call sites in the block subsystem to import `ARef` and `AlwaysRefCounted` from `sync::aref` instead of `types`. This aligns with the ongoing effort to move `ARef` and `AlwaysRefCounted` to sync. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Signed-off-by: Jens Axboe commit 35c973187f59328a5a58be132bd83ec2fe076620 Author: Nathan Chancellor Date: Wed Nov 5 13:41:09 2025 -0700 ARM: dts: omap: am335x-mba335x: Fix stray '/*' in comment When preprocessing arch/arm/boot/dts/ti/omap/am335x-mba335x.dts with clang, there are a couple of warnings about '/*' within a block comment. arch/arm/boot/dts/ti/omap/am335x-mba335x.dts:260:7: warning: '/*' within block comment [-Wcomment] 260 | /* /* gpmc_csn3.gpio2_0 - interrupt */ | ^ arch/arm/boot/dts/ti/omap/am335x-mba335x.dts:267:7: warning: '/*' within block comment [-Wcomment] 267 | /* /* gpmc_ben1.gpio1_28 - interrupt */ | ^ Remove the duplicate '/*' to clear up the warning. Fixes: 5267fcd180b1 ("ARM: dts: omap: Add support for TQMa335x/MBa335x") Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20251105-omap-mba335x-fix-clang-comment-warning-v2-1-f8a0003e1003@kernel.org Signed-off-by: Kevin Hilman commit c1d5c2026969efa372b759aefb2f3e63eff29aa3 Author: Alexander Stein Date: Wed Nov 5 09:34:20 2025 +0100 ARM: dts: omap: am335x-tqma335x/mba335x: Fix MicIn routing 'Mic Jack' is connected to IN3_L and 'Mic Bias' is connected to 'Mic Jack' Adjust routing accordingly. Fixes: 5267fcd180b1 ("ARM: dts: omap: Add support for TQMa335x/MBa335x") Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20251105083422.1010825-1-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit e06a419eaab9cee7cd5bbb0cfcfbe49e443a9d75 Author: Heiko Stuebner Date: Tue Nov 4 00:49:26 2025 +0100 arm64: dts: rockchip: add missing clocks for cpu cores on rk356x All cpu cores are supplied by the same clock, but all except the first core are missing that clocks reference - add the missing ones. Reviewed-by: Diederik de Haas Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251103234926.416137-4-heiko@sntech.de commit ff8912700f31782021ec28c530de1482fa99eab3 Author: Heiko Stuebner Date: Tue Nov 4 00:49:25 2025 +0100 arm64: dts: rockchip: use SCMI clock id for cpu clock on rk356x Instead of hard-coding 0, use the more descriptive ID from the binding to reference the SCMI clock for the cpu on rk356x. Reviewed-by: Diederik de Haas Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251103234926.416137-3-heiko@sntech.de commit 6c30efe5401bcd9207d07414c1bd0d7692a51a58 Merge: d809417c5a4012 88b6a93af4345e Author: Heiko Stuebner Date: Thu Nov 6 00:24:17 2025 +0100 Merge branch 'v6.19-shared/clkids' into v6.19-armsoc/dts64 commit 82a224498005b2a2e8edaba8e6b89464688f20e1 Author: Valentin Schneider Date: Fri Oct 10 17:38:14 2025 +0200 rcutorture: Make TREE04 use CONFIG_RCU_DYNTICKS_TORTURE We now have an RCU_EXPERT config for testing small-sized RCU dynticks counter: CONFIG_RCU_DYNTICKS_TORTURE. Modify scenario TREE04 to exercise to use this config in order to test a ridiculously small counter (2 bits). Link: http://lore.kernel.org/r/4c2cb573-168f-4806-b1d9-164e8276e66a@paulmck-laptop Suggested-by: Paul E. McKenney Signed-off-by: Valentin Schneider Reviewed-by: Paul E. McKenney Reviewed-by: Frederic Weisbecker Signed-off-by: Frederic Weisbecker commit ca38f0f65eefd79889b409c89c6932d7e2fe0993 Author: Heiko Stuebner Date: Tue Nov 4 00:40:32 2025 +0100 dt-bindings: clock: rk3568: Drop CLK_NR_CLKS define CLK_NR_CLKS has always only be used on the driver side to calculate array sizes should never have been part of the clock-binding. Let's drop it, since the kernel code no longer uses it either and nothing else has ever used it. Acked-by: Conor Dooley Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251103234032.413563-3-heiko@sntech.de commit 2a42e3210d4331dddfb04b020050bd774cf99659 Author: Heiko Stuebner Date: Tue Nov 4 00:40:31 2025 +0100 clk: rockchip: rk3568: Drop CLK_NR_CLKS usage In order to get rid of CLK_NR_CLKS and be able to drop it from the bindings, use rockchip_clk_find_max_clk_id helper to find the highest clock id. Reviewed-by: Sebastian Reichel Signed-off-by: Heiko Stuebner Link: https://patch.msgid.link/20251103234032.413563-2-heiko@sntech.de commit d4500d68bc9f6d01fab046f706ff88674604cd75 Author: Paul E. McKenney Date: Wed Nov 5 12:20:00 2025 -0800 rcutorture: Remove redundant rcutorture_one_extend() from rcu_torture_one_read() This commit removes a harmless but potentially confusing invocation of rcutorture_one_extend() within rcu_torture_one_read(). The immediately preceding call to rcu_torture_one_read_start() already does this cleanup, and the other call to rcu_torture_one_read_start() already relies on this. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit f121fbbdafeb98c5961c83d23628eee96e6dc28a Author: Paul E. McKenney Date: Wed Nov 5 12:19:59 2025 -0800 rcutorture: Permit kvm-again.sh to re-use the build directory This commit adds "inplace" and "inplace-force" values to the kvm-again.sh "--link" argument, which causes the run's output to be placed into the build directory. This could be used to save build time if the machine went down partway into a run, but it can also be used to do a large number of builds, and run the resulting kernels concurrently even if the builds are based on different commits. A later commit will add this latter capability to kvm-series.sh in order to produce large speedups for branch-checking operations. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 515a48fedce7fe93e9d6193af58bb74e1237aef3 Author: Paul E. McKenney Date: Wed Nov 5 12:19:58 2025 -0800 torture: Add kvm-series.sh to test commit/scenario combination This commit adds a kvm-series.sh script that takes a list of scenarios and a list of commits, and then runs each scenario on all of the commits. A given scenario is run on all the commits before advancing to the next scenario to minimize build times. The successes and failures are summarized at the end of the run. Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 34e82569d59391bf7d808a558ff631c4428b026d Author: Xuanqiang Luo Date: Wed Nov 5 12:19:57 2025 -0800 rcu: use WRITE_ONCE() for ->next and ->pprev of hlist_nulls In rculist_nulls.h we can still see ordinary assignments to ->pprev and ->next of hlist_nulls. As noted in the two patches below: commit efd04f8a8b45 ("rcu: Use WRITE_ONCE() for assignments to ->next for rculist_nulls") commit 860c8802ace1 ("rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls") We should use WRITE_ONCE(). Signed-off-by: Xuanqiang Luo Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit e52b43883d084a9af263c573f2a1bd1ca5088389 Author: Wang Liang Date: Wed Nov 5 12:19:56 2025 -0800 locktorture: Fix memory leak in param_set_cpumask() With CONFIG_CPUMASK_OFFSTACK=y, the 'bind_writers' buffer is allocated via alloc_cpumask_var() in param_set_cpumask(). But it is not freed, when setting the module parameter multiple times by sysfs interface or removing module. Below kmemleak trace is seen for this issue: unreferenced object 0xffff888100aabff8 (size 8): comm "bash", pid 323, jiffies 4295059233 hex dump (first 8 bytes): 07 00 00 00 00 00 00 00 ........ backtrace (crc ac50919): __kmalloc_node_noprof+0x2e5/0x420 alloc_cpumask_var_node+0x1f/0x30 param_set_cpumask+0x26/0xb0 [locktorture] param_attr_store+0x93/0x100 module_attr_store+0x1b/0x30 kernfs_fop_write_iter+0x114/0x1b0 vfs_write+0x300/0x410 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f This issue can be reproduced by: insmod locktorture.ko bind_writers=1 rmmod locktorture or: insmod locktorture.ko bind_writers=1 echo 2 > /sys/module/locktorture/parameters/bind_writers Considering that setting the module parameter 'bind_writers' or 'bind_readers' by sysfs interface has no real effect, set the parameter permissions to 0444. To fix the memory leak when removing module, free 'bind_writers' and 'bind_readers' memory in lock_torture_cleanup(). Fixes: 73e341242483 ("locktorture: Add readers_bind and writers_bind module parameters") Suggested-by: Zhang Changzhong Signed-off-by: Wang Liang Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 88b6a93af4345e901206d0576bdb4e88ea3eaeb8 Author: Heiko Stuebner Date: Tue Nov 4 00:49:24 2025 +0100 dt-bindings: clock: rk3568: Add SCMI clock ids The Trusted Firmware on RK3568 exposes 3 clocks via the SCMI clock interface. Add descriptive IDs for them. The clock ids are used in both the older vendor-binary TF-A, as well as the recently merged upstream SCMI clock implementation. Link: https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/31265 Reviewed-by: Diederik de Haas Acked-by: Conor Dooley Link: https://patch.msgid.link/20251103234926.416137-2-heiko@sntech.de Signed-off-by: Heiko Stuebner commit 8c8250ee3b3d9e4aaba6f33cfb743e900a773db0 Author: Paul E. McKenney Date: Wed Nov 5 12:32:09 2025 -0800 doc: Update for SRCU-fast definitions and initialization This commit documents the DEFINE_SRCU_FAST(), DEFINE_STATIC_SRCU_FAST(), and init_srcu_struct_fast() API members. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit ac51c40c2c148a75f3191ff401c9889a7fc12cb1 Author: Paul E. McKenney Date: Wed Nov 5 12:32:08 2025 -0800 srcu: Make SRCU-fast readers enforce use of SRCU-fast definition/init This commit makes CONFIG_PROVE_RCU=y kernels enforce the new rule that srcu_struct structures that are passed to srcu_read_lock_fast() and other SRCU-fast read-side markers be either initialized with init_srcu_struct_fast() on the one hand or defined with DEFINE_SRCU_FAST() or DEFINE_STATIC_SRCU_FAST() on the other. This eliminates the read-side test that was formerly included in srcu_read_lock_fast() and friends, speeding these primitives up by about 25% (admittedly only about half of a nanosecond, but when tracing on fastpaths...) Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit 8235bcfd39e865763e764b4c968012bdfb808af1 Author: Paul E. McKenney Date: Wed Nov 5 12:32:07 2025 -0800 srcu: Require special srcu_struct define/init for SRCU-fast readers This commit adds CONFIG_PROVE_RCU=y checking to enforce the new rule that srcu_struct structures passed to srcu_read_lock_fast() and other SRCU-fast read-side markers be either initialized with init_srcu_struct_fast() on the one hand or defined using either DEFINE_SRCU_FAST() or DEFINE_STATIC_SRCU_FAST(). This will enable removal of the non-debug read-side checks from srcu_read_lock_fast() and friends, which on my laptop provides a 25% speedup (which admittedly amounts to about half a nanosecond, but when tracing fastpaths...) Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit e4ed20c1603c9e2846de31034cb4d50b3ef59ec8 Author: Paul E. McKenney Date: Wed Nov 5 12:32:06 2025 -0800 rcutorture: Exercise DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast() This commit updates the initialization for the "srcu" and "srcud" torture types to use DEFINE_STATIC_SRCU_FAST() and init_srcu_struct_fast(), respectively, when reader_flavor is equal to SRCU_READ_FLAVOR_FAST. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit c5fee33f884c6e29e9c351a3a8f080d8178544d0 Author: Paul E. McKenney Date: Wed Nov 5 12:32:05 2025 -0800 srcu: Make grace-period determination use ssp->srcu_reader_flavor This commit causes the srcu_readers_unlock_idx() function to take the srcu_struct structure's ->srcu_reader_flavor field into account. This ensures that structures defined via DEFINE_SRCU_FAST( or initialized via init_srcu_struct_fast() have their grace periods use synchronize_srcu() or synchronize_srcu_expedited() instead of smp_mb(), even before the first SRCU reader has been entered. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit ee90848499b169070dbf85a4276a45ccbb7ff7d3 Author: Paul E. McKenney Date: Wed Nov 5 12:32:04 2025 -0800 srcu: Create a DEFINE_SRCU_FAST() This commit creates DEFINE_SRCU_FAST() and DEFINE_STATIC_SRCU_FAST() macros that are similar to DEFINE_SRCU() and DEFINE_STATIC_SRCU(), but which create srcu_struct structures that are usable only by readers initiated by srcu_read_lock_fast() and friends. This commit does make DEFINE_SRCU_FAST() available to modules, in which case the per-CPU srcu_data structures are not created at compile time, but rather at module-load time. This means that the >srcu_reader_flavor field of the srcu_data structure is not available. Therefore, this commit instead creates an ->srcu_reader_flavor field in the srcu_struct structure, adds arguments to the DEFINE_SRCU()-related macros to initialize this new field, and extends the checks in the __srcu_check_read_flavor() function to include this new field. This commit also allows dynamically allocated srcu_struct structure to be marked for SRCU-fast readers. It does so by defining a new init_srcu_struct_fast() function that marks the specified srcu_struct structure for use by srcu_read_lock_fast() and friends. Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Frederic Weisbecker commit 950063c6e89736c3f5a5072f9e1ef98646a46a3a Author: Paul E. McKenney Date: Wed Nov 5 12:32:03 2025 -0800 rcutorture: Test srcu_expedite_current() This commit adds a ->exp_current member to the rcu_torture_ops structure to test the srcu_expedite_current() function. Signed-off-by: Paul E. McKenney Cc: Andrii Nakryiko Cc: Alexei Starovoitov Cc: Peter Zijlstra Cc: Signed-off-by: Frederic Weisbecker commit 34dc27f02cb3799d56a99002261e4d091da0cea4 Author: Paul E. McKenney Date: Wed Nov 5 12:32:02 2025 -0800 srcu: Create an srcu_expedite_current() function This commit creates an srcu_expedite_current() function that expedites the current (and possibly the next) SRCU grace period for the specified srcu_struct structure. This functionality will be inherited by RCU Tasks Trace courtesy of its mapping to SRCU fast. If the current SRCU grace period is already waiting, that wait will complete before the expediting takes effect. If there is no SRCU grace period in flight, this function might well create one. [ paulmck: Apply Zqiang feedback for PREEMPT_RT use. ] Signed-off-by: Paul E. McKenney Cc: Andrii Nakryiko Cc: Alexei Starovoitov Cc: Peter Zijlstra Cc: Signed-off-by: Frederic Weisbecker commit 58ac42f278054fbc4c3f174524280d7263b0699a Author: Paul E. McKenney Date: Wed Nov 5 12:32:01 2025 -0800 srcu: Permit Tiny SRCU srcu_read_unlock() with interrupts disabled The current Tiny SRCU implementation of srcu_read_unlock() awakens the grace-period processing when exiting the outermost SRCU read-side critical section. However, not all Linux-kernel configurations and contexts permit swake_up_one() to be invoked while interrupts are disabled, and this can result in indefinitely extended SRCU grace periods. This commit therefore only invokes swake_up_one() when interrupts are enabled, and introduces polling to the grace-period workqueue handler. Reported-by: kernel test robot Reported-by: Zqiang Closes: https://lore.kernel.org/oe-lkp/202508261642.b15eefbb-lkp@intel.com Signed-off-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker commit 3301ef0a72b4b43a65914747150c076f52b39344 Author: Youssef Samir Date: Wed Oct 29 11:18:12 2025 -0700 accel/qaic: Add support for PM callbacks Add initial support for suspend and hibernation PM callbacks to QAIC. The device can be suspended any time in which the data path is not busy as queued I/O operations are lost on suspension and cannot be resumed after suspend. Signed-off-by: Youssef Samir Reviewed-by: Carl Vanderlip Signed-off-by: Zack McKevitt Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20251029181808.1216466-1-zachary.mckevitt@oss.qualcomm.com commit 2131c1517f3004da208b7f1a3b06b8119172e194 Author: Longfang Liu Date: Thu Oct 30 09:57:44 2025 +0800 hisi_acc_vfio_pci: adapt to new migration configuration On new platforms greater than QM_HW_V3, the migration region has been relocated from the VF to the PF. The VF's own configuration space is restored to the complete 64KB, and there is no need to divide the size of the BAR configuration space equally. The driver should be modified accordingly to adapt to the new hardware device. On the older hardware platform QM_HW_V3, the live migration configuration region is placed in the latter 32K portion of the VF's BAR2 configuration space. On the new hardware platform QM_HW_V4, the live migration configuration region also exists in the same 32K area immediately following the VF's BAR2, just like on QM_HW_V3. However, access to this region is now controlled by hardware. Additionally, a copy of the live migration configuration region is present in the PF's BAR2 configuration space. On the new hardware platform QM_HW_V4, when an older version of the driver is loaded, it behaves like QM_HW_V3 and uses the configuration region in the VF, ensuring that the live migration function continues to work normally. When the new version of the driver is loaded, it directly uses the configuration region in the PF. Meanwhile, hardware configuration disables the live migration configuration region in the VF's BAR2: reads return all 0xF values, and writes are silently ignored. Signed-off-by: Longfang Liu Reviewed-by: Shameer Kolothum Link: https://lore.kernel.org/r/20251030015744.131771-3-liulongfang@huawei.com Signed-off-by: Alex Williamson commit c8e00cdc7425d5c60fd1ce6e7f71e5fb1b236991 Merge: a85787996aa974 06765b6efc463c Author: Christian Brauner Date: Mon Nov 3 22:44:50 2025 +0100 Merge patch series "credential guards: credential preparation" Christian Brauner says: This converts most users combining * prepare_creds() * modify new creds * override_creds() * revert_creds() * put_cred() to rely on credentials guards. * patches from https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-0-b447b82f2c9b@kernel.org: trace: use override credential guard trace: use prepare credential guard coredump: use override credential guard coredump: use prepare credential guard coredump: split out do_coredump() from vfs_coredump() coredump: mark struct mm_struct as const coredump: pass struct linux_binfmt as const coredump: move revert_cred() before coredump_cleanup() sev-dev: use override credential guards sev-dev: use prepare credential guard sev-dev: use guard for path cred: add prepare credential guard Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-0-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit 06765b6efc463ce4d3c0c80a3cc2c888dc902dfa Author: Christian Brauner Date: Mon Nov 3 15:57:38 2025 +0100 trace: use override credential guard Use override credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-12-b447b82f2c9b@kernel.org Acked-by: Steven Rostedt (Google) Signed-off-by: Christian Brauner commit 2ed6a34de9851dcd4db8441a33882b168261be88 Author: Christian Brauner Date: Mon Nov 3 15:57:37 2025 +0100 trace: use prepare credential guard Use the prepare credential guard for allocating a new set of credentials. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-11-b447b82f2c9b@kernel.org Acked-by: Steven Rostedt (Google) Signed-off-by: Christian Brauner commit 545985dd3701988c95cba9a8f895631de2039b21 Author: Christian Brauner Date: Mon Nov 3 15:57:36 2025 +0100 coredump: use override credential guard Use override credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-10-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit 8ed3473c5a8b356c8af950a29d5620be337c3cab Author: Christian Brauner Date: Mon Nov 3 15:57:35 2025 +0100 coredump: use prepare credential guard Use the prepare credential guard for allocating a new set of credentials. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-9-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit af9803d4b8ca3f59ec66bb6b1557e40a18bc5599 Author: Christian Brauner Date: Mon Nov 3 15:57:34 2025 +0100 coredump: split out do_coredump() from vfs_coredump() Make the function easier to follow and prepare for some of the following changes. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-8-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit 313a335057f0894e6e59290d4e7fb8b35ec250e6 Author: Christian Brauner Date: Mon Nov 3 15:57:33 2025 +0100 coredump: mark struct mm_struct as const We don't actually modify it. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-7-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit 1ec760fb42404dd7257d1c73dd68295a0d1a974f Author: Christian Brauner Date: Mon Nov 3 15:57:32 2025 +0100 coredump: pass struct linux_binfmt as const We don't actually modify it. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-6-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit eb937201bad03bf2f25ac630979e521fbb5e2a07 Author: Christian Brauner Date: Mon Nov 3 15:57:31 2025 +0100 coredump: move revert_cred() before coredump_cleanup() There's no need to pin the credentials across the coredump_cleanup() call. Nothing in there depends on elevated credentials. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-5-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit b7b4f7554bcc6b9ee0ec0404999bf080adad1f3c Author: Christian Brauner Date: Mon Nov 3 15:57:30 2025 +0100 sev-dev: use override credential guards Use override credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-4-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit 5a629ecbcdffacfb04fc4eb0098c0688f38c8b9d Author: Tejun Heo Date: Wed Nov 5 12:03:08 2025 -1000 sched_ext: Mark racy bitfields to prevent adding fields that can't tolerate races The warned bitfields in struct scx_sched are updated racily from concurrent CPUs causing RMW races, which is fine for these boolean warning flags. Add a comment marking this area to prevent future fields that can't tolerate racy updates from being added here. Signed-off-by: Tejun Heo commit 73fd0dba0beb1d2d1695ee5452eac8dfabce3f9e Merge: 5b8ed52866e3d1 ab5f296076f3cd Author: Christian Brauner Date: Wed Nov 5 09:37:47 2025 +0100 Merge patch series "fs: introduce super write guard" Christian Brauner says: I'm in the process of adding a few more guards for vfs constructs. I've chosen the easy case of super_start_write() and super_end_write() and converted eligible callers. I think long-term we can move a lot of the manual placement to completely rely on guards - where sensible. * patches from https://patch.msgid.link/20251104-work-guards-v1-0-5108ac78a171@kernel.org: xfs: use super write guard in xfs_file_ioctl() open: use super write guard in do_ftruncate() btrfs: use super write guard in relocating_repair_kthread() ext4: use super write guard in write_mmp_block() btrfs: use super write guard in sb_start_write() btrfs: use super write guard btrfs_run_defrag_inode() btrfs: use super write guard in btrfs_reclaim_bgs_work() fs: add super_write_guard Link: https://patch.msgid.link/20251104-work-guards-v1-0-5108ac78a171@kernel.org Signed-off-by: Christian Brauner commit ab5f296076f3cd43470e2f70db61c9fd258db85b Author: Christian Brauner Date: Tue Nov 4 13:12:37 2025 +0100 xfs: use super write guard in xfs_file_ioctl() Link: https://patch.msgid.link/20251104-work-guards-v1-8-5108ac78a171@kernel.org Signed-off-by: Christian Brauner commit 4868d2d52df6f724b01531843805a3b1322e2dd9 Author: Longfang Liu Date: Thu Oct 30 09:57:43 2025 +0800 crypto: hisilicon - qm updates BAR configuration On new platforms greater than QM_HW_V3, the configuration region for the live migration function of the accelerator device is no longer placed in the VF, but is instead placed in the PF. Therefore, the configuration region of the live migration function needs to be opened when the QM driver is loaded. When the QM driver is uninstalled, the driver needs to clear this configuration. Signed-off-by: Longfang Liu Reviewed-by: Shameer Kolothum Acked-by: Herbert Xu Link: https://lore.kernel.org/r/20251030015744.131771-2-liulongfang@huawei.com Signed-off-by: Alex Williamson commit 97f9d2d282c9f5647784301b4bed82f825e1c2d6 Author: Christian Brauner Date: Tue Nov 4 13:12:36 2025 +0100 open: use super write guard in do_ftruncate() Link: https://patch.msgid.link/20251104-work-guards-v1-7-5108ac78a171@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit b7b8aca68e2e857ec16fe67ed6e1d8b3eafc2653 Author: Christian Brauner Date: Tue Nov 4 13:12:35 2025 +0100 btrfs: use super write guard in relocating_repair_kthread() Link: https://patch.msgid.link/20251104-work-guards-v1-6-5108ac78a171@kernel.org Signed-off-by: Christian Brauner commit 2774bac21f26d8cc1cd66386b6f357ec6120bc94 Author: Christian Brauner Date: Tue Nov 4 13:12:34 2025 +0100 ext4: use super write guard in write_mmp_block() Link: https://patch.msgid.link/20251104-work-guards-v1-5-5108ac78a171@kernel.org Acked-by: Theodore Ts'o Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 6e5b78cb17c2a76c8c9f1d0874e377debfacbf88 Author: Christian Brauner Date: Tue Nov 4 13:12:33 2025 +0100 btrfs: use super write guard in sb_start_write() Link: https://patch.msgid.link/20251104-work-guards-v1-4-5108ac78a171@kernel.org Signed-off-by: Christian Brauner commit e79a4512cc8703521b7132bcbb27a1245dac6f55 Author: Christian Brauner Date: Tue Nov 4 13:12:32 2025 +0100 btrfs: use super write guard btrfs_run_defrag_inode() Link: https://patch.msgid.link/20251104-work-guards-v1-3-5108ac78a171@kernel.org Signed-off-by: Christian Brauner commit a5e3d0be9e401de325de0104038da375a3e82e61 Author: Christian Brauner Date: Tue Nov 4 13:12:31 2025 +0100 btrfs: use super write guard in btrfs_reclaim_bgs_work() Link: https://patch.msgid.link/20251104-work-guards-v1-2-5108ac78a171@kernel.org Signed-off-by: Christian Brauner commit 8e4d576ed3ff917eda65b989ba56b02d9a3894f9 Author: Christian Brauner Date: Tue Nov 4 13:12:30 2025 +0100 fs: add super_write_guard Link: https://patch.msgid.link/20251104-work-guards-v1-1-5108ac78a171@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 5b8ed52866e3d19e02860c7cf1d6bbbd70b619e9 Author: Mateusz Guzik Date: Tue Nov 4 18:04:48 2025 +0100 fs: inline current_umask() and move it to fs_struct.h There is no good reason to have this as a func call, other than avoiding the churn of adding fs_struct.h as needed. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20251104170448.630414-1-mjguzik@gmail.com Signed-off-by: Christian Brauner commit 723cd9872dc1335639eb99422b1722697552a09a Merge: dcb6fa37fd7bc9 f7b3d14165222a Author: Christian Brauner Date: Wed Nov 5 09:51:36 2025 +0100 Merge patch series "fs: start to split up fs.h" Christian Brauner says: Take first steps to split up fs.h. Add fs/super_types.h and fs/super.h headers that contain the types and functions associated with super blocks respectively. * patches from https://patch.msgid.link/20251104-work-fs-header-v1-0-fb39a2efe39e@kernel.org: fs: add fs/super.h header fs: add fs/super_types.h header fs: rename fs_types.h to fs_dirent.h Link: https://patch.msgid.link/20251104-work-fs-header-v1-0-fb39a2efe39e@kernel.org Signed-off-by: Christian Brauner commit f7b3d14165222a3ad9c4d0d31dfa81e396751801 Author: Christian Brauner Date: Tue Nov 4 15:46:34 2025 +0100 fs: add fs/super.h header Split out super block associated functions into a separate header. Link: https://patch.msgid.link/20251104-work-fs-header-v1-3-fb39a2efe39e@kernel.org Signed-off-by: Christian Brauner commit 7e898a9a992293eea8df11c8bb6fe120df6f8e6f Author: Marco Crivellari Date: Wed Nov 5 16:08:26 2025 +0100 nvdimm: replace use of system_wq with system_percpu_wq Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Replace system_wq with system_percpu_wq, keeping the same old behavior. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20251105150826.248673-1-marco.crivellari@suse.com Signed-off-by: Ira Weiny commit e0b62a4dee24e9176f2c4be52a1b47fe1d97c560 Author: Christian Brauner Date: Tue Nov 4 15:46:33 2025 +0100 fs: add fs/super_types.h header Split out super block associated structures into a separate header. Link: https://patch.msgid.link/20251104-work-fs-header-v1-2-fb39a2efe39e@kernel.org Signed-off-by: Christian Brauner commit 56f17be67a332d146821d1a812ab16388d07ace7 Author: Yazen Ghannam Date: Tue Nov 4 14:55:43 2025 +0000 x86/mce/amd: Define threshold restart function for banks Prepare for CMCI storm support by moving the common bank/block iterator code to a helper function. Include a parameter to switch the interrupt enable. This will be used by the CMCI storm handling function. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit 3206b41604f80bb84c19ae3ed7c01d9d671ece2a Author: Yazen Ghannam Date: Tue Nov 4 14:55:42 2025 +0000 x86/mce/amd: Remove redundant reset_block() Many of the checks in reset_block() are done again in the block reset function. So drop the redundant checks. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit 3d80f4c93d3d26d0f9a0dd2844961a632eeea634 Author: Yosry Ahmed Date: Fri Oct 24 19:29:18 2025 +0000 KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE When emulating L2 instructions, svm_check_intercept() checks whether a write to CR0 should trigger a synthesized #VMEXIT with SVM_EXIT_CR0_SEL_WRITE. However, it does not check whether L1 enabled the intercept for SVM_EXIT_WRITE_CR0, which has higher priority according to the APM (24593—Rev. 3.42—March 2024, Table 15-7): When both selective and non-selective CR0-write intercepts are active at the same time, the non-selective intercept takes priority. With respect to exceptions, the priority of this intercept is the same as the generic CR0-write intercept. Make sure L1 does NOT intercept SVM_EXIT_WRITE_CR0 before checking if SVM_EXIT_CR0_SEL_WRITE needs to be injected. Opportunistically tweak the "not CR0" logic to explicitly bail early so that it's more obvious that only CR0 has a selective intercept, and that modifying icpt_info.exit_code is functionally necessary so that the call to nested_svm_exit_handled() checks the correct exit code. Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses") Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251024192918.3191141-4-yosry.ahmed@linux.dev [sean: isolate non-CR0 write logic, tweak comments accordingly] Signed-off-by: Sean Christopherson commit 5674a76db0213f9db1e4d08e847ff649b46889c0 Author: Yosry Ahmed Date: Fri Oct 24 19:29:17 2025 +0000 KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation When emulating L2 instructions, svm_check_intercept() checks whether a write to CR0 should trigger a synthesized #VMEXIT with SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only triggered if any bit other than CR0.MP and CR0.TS is updated. However, according to the APM (24593—Rev. 3.42—March 2024, Table 15-7): The LMSW instruction treats the selective CR0-write intercept as a non-selective intercept (i.e., it intercepts regardless of the value being written). Skip checking the changed bits for x86_intercept_lmsw and always inject SVM_EXIT_CR0_SEL_WRITE. Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses") Cc: stable@vger.kernel.org Reported-by: Matteo Rizzo Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251024192918.3191141-3-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 3d31bdf9cc79a3752bd1b6ba91af4e5ba37c47a8 Author: Yosry Ahmed Date: Fri Oct 24 19:29:16 2025 +0000 KVM: nSVM: Remove redundant cases in nested_svm_intercept() Both the CRx and DRx cases are doing exactly what the default case is doing, remove them. No functional change intended. Signed-off-by: Yosry Ahmed Link: https://patch.msgid.link/20251024192918.3191141-2-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson commit 4efaec6e16c249b64d389c85c3ef01345580483a Author: Yazen Ghannam Date: Tue Nov 4 14:55:41 2025 +0000 x86/mce/amd: Support SMCA Corrected Error Interrupt AMD systems optionally support MCA thresholding which provides the ability for hardware to send an interrupt when a set error threshold is reached. This feature counts errors of all severities, but it is commonly used to report correctable errors with an interrupt rather than polling. Scalable MCA systems allow the platform to take control of this feature. In this case, the OS will not see the feature configuration and control bits in the MCA_MISC* registers. The OS will not receive the MCA thresholding interrupt, and it will need to poll for correctable errors. A "corrected error interrupt" will be available on Scalable MCA systems. This will be used in the same configuration where the platform controls MCA thresholding. However, the platform will now be able to send the MCA thresholding interrupt to the OS. Check for, and enable, this feature during per-CPU SMCA init. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tony Luck Tested-by: Tony Luck Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit 92469795363454aee7b79bd26650a44c3669b9c7 Author: Jens Axboe Date: Wed Jun 4 09:02:08 2025 -0600 io_uring/futex: move futexv owned status to struct io_futexv_data Free up a bit of space in the shared futex opcode private data, by moving the futexv specific futexv_owned out of there and into the struct specific to vectored futexes. Signed-off-by: Jens Axboe commit 88559f8b2a25a0293d7679907ffe3a58151662ef Author: Jens Axboe Date: Wed Jun 4 08:58:39 2025 -0600 io_uring/futex: move futexv async data handling to struct io_futexv_data Rather than alloc an array of struct futex_vector for the futexv wait handling, wrap it in a struct io_futexv_data struct, similar to what the non-vectored futex wait handling does. No functional changes in this patch. Signed-off-by: Jens Axboe commit 67d1adb55b2192bee1c79670d0f0f33ccabb54d6 Author: Alok Tiwari Date: Mon Nov 3 05:23:31 2025 -0800 drm/i915/dmc: Fix extra bracket and wrong variable in PIPEDMC error logs Fixes two issues in intel_pipedmc_irq_handler(): - Removed an extra ']' in the PIPEDMC error and interrupt vector log. - Corrected the interrupt vector log to print int_vector instead of tmp, as tmp will be zero in this case. Signed-off-by: Alok Tiwari Reviewed-by: Rodrigo Vivi Link: https://patch.msgid.link/20251103132337.762156-1-alok.a.tiwari@oracle.com Signed-off-by: Rodrigo Vivi commit 1e3a825c9ec90f91ef61dc9cbda610d9ec887db8 Author: Yan Zhao Date: Thu Oct 30 13:09:51 2025 -0700 KVM: TDX: Fix list_add corruption during vcpu_load() During vCPU creation, a vCPU may be destroyed immediately after kvm_arch_vcpu_create() (e.g., due to vCPU id confiliction). However, the vcpu_load() inside kvm_arch_vcpu_create() may have associate the vCPU to pCPU via "list_add(&tdx->cpu_list, &per_cpu(associated_tdvcpus, cpu))" before invoking tdx_vcpu_free(). Though there's no need to invoke tdh_vp_flush() on the vCPU, failing to dissociate the vCPU from pCPU (i.e., "list_del(&to_tdx(vcpu)->cpu_list)") will cause list corruption of the per-pCPU list associated_tdvcpus. Then, a later list_add() during vcpu_load() would detect list corruption and print calltrace as shown below. Dissociate a vCPU from its associated pCPU in tdx_vcpu_free() for the vCPUs destroyed immediately after creation which must be in VCPU_TD_STATE_UNINITIALIZED state. kernel BUG at lib/list_debug.c:29! Oops: invalid opcode: 0000 [#2] SMP NOPTI RIP: 0010:__list_add_valid_or_report+0x82/0xd0 Call Trace: tdx_vcpu_load+0xa8/0x120 vt_vcpu_load+0x25/0x30 kvm_arch_vcpu_load+0x81/0x300 vcpu_load+0x55/0x90 kvm_arch_vcpu_create+0x24f/0x330 kvm_vm_ioctl_create_vcpu+0x1b1/0x53 kvm_vm_ioctl+0xc2/0xa60 __x64_sys_ioctl+0x9a/0xf0 x64_sys_call+0x10ee/0x20d0 do_syscall_64+0xc3/0x470 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: d789fa6efac9 ("KVM: TDX: Handle vCPU dissociation") Signed-off-by: Yan Zhao Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-29-seanjc@google.com Signed-off-by: Sean Christopherson commit ad44aa4c5d3f40f4254a25a2ebab8cb9be0e37a3 Author: Sean Christopherson Date: Thu Oct 30 13:09:50 2025 -0700 KVM: TDX: Bug the VM if extending the initial measurement fails WARN and terminate the VM if TDH_MR_EXTEND fails, as extending the measurement should fail if and only if there is a KVM bug, or if the S-EPT mapping is invalid. Now that KVM makes all state transitions mutually exclusive via tdx_vm_state_guard, it should be impossible for S-EPT mappings to be removed between kvm_tdp_mmu_map_private_pfn() and tdh_mr_extend(). Holding slots_lock prevents zaps due to memslot updates, filemap_invalidate_lock() prevents zaps due to guest_memfd PUNCH_HOLE, vcpu->mutex locks prevents updates from other vCPUs, kvm->lock prevents VM-scoped ioctls from creating havoc (e.g. by creating new vCPUs), and all usage of kvm_zap_gfn_range() is mutually exclusive with S-EPT entries that can be used for the initial image. For kvm_zap_gfn_range(), the call from sev.c is obviously mutually exclusive, TDX disallows KVM_X86_QUIRK_IGNORE_GUEST_PAT so the same goes for kvm_noncoherent_dma_assignment_start_or_stop(), and __kvm_set_or_clear_apicv_inhibit() is blocked by virtue of holding all VM and vCPU mutexes (and the APIC page has its own KVM-internal memslot that is never created for TDX VMs, and so can't possibly be used for the initial image, which means that too is mutually exclusive irrespective of locking). Opportunistically return early if the region doesn't need to be measured in order to reduce line lengths and avoid wraps. Similarly, immediately and explicitly return if TDH_MR_EXTEND fails to make it clear that KVM needs to bail entirely if extending the measurement fails. Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-28-seanjc@google.com Signed-off-by: Sean Christopherson commit 15945e9ec1951d8cf7c1a7ec8c441017969d5aa1 Author: Sean Christopherson Date: Thu Oct 30 13:09:49 2025 -0700 KVM: TDX: Guard VM state transitions with "all" the locks Acquire kvm->lock, kvm->slots_lock, and all vcpu->mutex locks when servicing ioctls that (a) transition the TD to a new state, i.e. when doing INIT or FINALIZE or (b) are only valid if the TD is in a specific state, i.e. when initializing a vCPU or memory region. Acquiring "all" the locks fixes several KVM_BUG_ON() situations where a SEAMCALL can fail due to racing actions, e.g. if tdh_vp_create() contends with either tdh_mr_extend() or tdh_mr_finalize(). For all intents and purposes, the paths in question are fully serialized, i.e. there's no reason to try and allow anything remotely interesting to happen. Smack 'em with a big hammer instead of trying to be "nice". Acquire kvm->lock to prevent VM-wide things from happening, slots_lock to prevent kvm_mmu_zap_all_fast(), and _all_ vCPU mutexes to prevent vCPUs from interefering. Use the recently-renamed kvm_arch_vcpu_unlocked_ioctl() to service the vCPU-scoped ioctls to avoid a lock inversion problem, e.g. due to taking vcpu->mutex outside kvm->lock. See also commit ecf371f8b02d ("KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight"), which fixed a similar bug with SEV intra-host migration where an in-flight vCPU creation could race with a VM-wide state transition. Define a fancy new CLASS to handle the lock+check => unlock logic with guard()-like syntax: CLASS(tdx_vm_state_guard, guard)(kvm); if (IS_ERR(guard)) return PTR_ERR(guard); to simplify juggling the many locks. Note! Take kvm->slots_lock *after* all vcpu->mutex locks, as per KVM's soon-to-be-documented lock ordering rules[1]. Link: https://lore.kernel.org/all/20251016235538.171962-1-seanjc@google.com [1] Reported-by: Yan Zhao Closes: https://lore.kernel.org/all/aLFiPq1smdzN3Ary@yzhao56-desk.sh.intel.com Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-27-seanjc@google.com Signed-off-by: Sean Christopherson commit f26061fe2c259d6f07f641fc8fe677637e06421b Author: Sean Christopherson Date: Thu Oct 30 13:09:48 2025 -0700 KVM: TDX: Don't copy "cmd" back to userspace for KVM_TDX_CAPABILITIES Don't copy the kvm_tdx_cmd structure back to userspace when handling KVM_TDX_CAPABILITIES, as tdx_get_capabilities() doesn't modify hw_error or any other fields. Opportunistically hoist the call to tdx_get_capabilities() outside of the kvm->lock critical section, as getting the capabilities doesn't touch the VM in any way, e.g. doesn't even take @kvm. Suggested-by: Kai Huang Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-26-seanjc@google.com Signed-off-by: Sean Christopherson commit 0b76e827b29db17a37870a71814e347970394c78 Author: Sean Christopherson Date: Thu Oct 30 13:09:47 2025 -0700 KVM: TDX: Use guard() to acquire kvm->lock in tdx_vm_ioctl() Use guard() in tdx_vm_ioctl() to tidy up the code a small amount, but more importantly to minimize the diff of a future change, which will use guard-like semantics to acquire and release multiple locks. No functional change intended. Reviewed-by: Rick Edgecombe Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-25-seanjc@google.com Signed-off-by: Sean Christopherson commit 94428e3ba3258fc2862db3f9999e548d5a2d2a2a Author: Sean Christopherson Date: Thu Oct 30 13:09:46 2025 -0700 KVM: TDX: Convert INIT_MEM_REGION and INIT_VCPU to "unlocked" vCPU ioctl Handle the KVM_TDX_INIT_MEM_REGION and KVM_TDX_INIT_VCPU vCPU sub-ioctls in the unlocked variant, i.e. outside of vcpu->mutex, in anticipation of taking kvm->lock along with all other vCPU mutexes, at which point the sub-ioctls _must_ start without vcpu->mutex held. No functional change intended. Reviewed-by: Kai Huang Co-developed-by: Yan Zhao Signed-off-by: Yan Zhao Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-24-seanjc@google.com Signed-off-by: Sean Christopherson commit 59d5c1ed6df222791ab7263e5a0c95eea9d83363 Author: Sean Christopherson Date: Thu Oct 30 13:09:45 2025 -0700 KVM: TDX: Add tdx_get_cmd() helper to get and validate sub-ioctl command Add a helper to copy a kvm_tdx_cmd structure from userspace and verify that must-be-zero fields are indeed zero. No functional change intended. Reviewed-by: Rick Edgecombe Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-23-seanjc@google.com Signed-off-by: Sean Christopherson commit 3d626ce5a8cca64eb6d317eef4b24b70a0e5b27b Author: Sean Christopherson Date: Thu Oct 30 13:09:44 2025 -0700 KVM: TDX: Add macro to retry SEAMCALLs when forcing vCPUs out of guest Add a macro to handle kicking vCPUs out of the guest and retrying SEAMCALLs on TDX_OPERAND_BUSY instead of providing small helpers to be used by each SEAMCALL. Wrapping the SEAMCALLs in a macro makes it a little harder to tease out which SEAMCALL is being made, but significantly reduces the amount of copy+paste code, and makes it all but impossible to leave an elevated wait_for_sept_zap. Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-22-seanjc@google.com Signed-off-by: Sean Christopherson commit abe7d636403b7cbdb8d2d5bab253cfe8087faa7a Author: Chu Guangqing Date: Wed Oct 15 09:59:54 2025 +0800 vfio/mtty: Fix spelling typo in samples/vfio-mdev The comment incorrectly used "atleast" instead of "at least". Signed-off-by: Chu Guangqing Link: https://lore.kernel.org/r/20251015015954.2363-2-chuguangqing@inspur.com Signed-off-by: Alex Williamson commit 2ff14116982c663066f3cdb4e2af5dfa7a812caa Author: Sean Christopherson Date: Thu Oct 30 13:09:43 2025 -0700 KVM: TDX: Assert that mmu_lock is held for write when removing S-EPT entries Unconditionally assert that mmu_lock is held for write when removing S-EPT entries, not just when removing S-EPT entries triggers certain conditions, e.g. needs to do TDH_MEM_TRACK or kick vCPUs out of the guest. Conditionally asserting implies that it's safe to hold mmu_lock for read when those paths aren't hit, which is simply not true, as KVM doesn't support removing S-EPT entries under read-lock. Only two paths lead to remove_external_spte(), and both paths asserts that mmu_lock is held for write (tdp_mmu_set_spte() via lockdep, and handle_removed_pt() via KVM_BUG_ON()). Deliberately leave lockdep assertions in the "no vCPUs" helpers to document that wait_for_sept_zap is guarded by holding mmu_lock for write, and keep the conditional assert in tdx_track() as well, but with a comment to help explain why holding mmu_lock for write matters (above and beyond why tdx_sept_remove_private_spte()'s requirements). Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-21-seanjc@google.com Signed-off-by: Sean Christopherson commit 55560b6be5bc39384917ff456d1c9ba0a3790277 Author: Sean Christopherson Date: Thu Oct 30 13:09:42 2025 -0700 KVM: TDX: Derive error argument names from the local variable names When printing SEAMCALL errors, use the name of the variable holding an error parameter instead of the register from whence it came, so that flows which use descriptive variable names will similarly print descriptive error messages. Suggested-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-20-seanjc@google.com Signed-off-by: Sean Christopherson commit 597d7068702fc3120b6a37bb8c5cd6c1bab898e0 Author: Sean Christopherson Date: Thu Oct 30 13:09:41 2025 -0700 KVM: TDX: Combine KVM_BUG_ON + pr_tdx_error() into TDX_BUG_ON() Add TDX_BUG_ON() macros (with varying numbers of arguments) to deduplicate the myriad flows that do KVM_BUG_ON()/WARN_ON_ONCE() followed by a call to pr_tdx_error(). In addition to reducing boilerplate copy+paste code, this also helps ensure that KVM provides consistent handling of SEAMCALL errors. Opportunistically convert a handful of bare WARN_ON_ONCE() paths to the equivalent of KVM_BUG_ON(), i.e. have them terminate the VM. If a SEAMCALL error is fatal enough to WARN on, it's fatal enough to terminate the TD. Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 14c9938619bee7743eb2f2443b7d5f412a80838b Author: Sean Christopherson Date: Thu Oct 30 13:09:40 2025 -0700 KVM: TDX: Fold tdx_sept_zap_private_spte() into tdx_sept_remove_private_spte() Do TDH_MEM_RANGE_BLOCK directly in tdx_sept_remove_private_spte() instead of using a one-off helper now that the nr_premapped tracking is gone. Opportunistically drop the WARN on hugepages, which was dead code (see the KVM_BUG_ON() in tdx_sept_remove_private_spte()). No functional change intended. Reviewed-by: Rick Edgecombe Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 6b5b71ffabf9b0eb250ae6d4e0ab7fbac622f0f0 Author: Sean Christopherson Date: Thu Oct 30 13:09:39 2025 -0700 KVM: TDX: ADD pages to the TD image while populating mirror EPT entries When populating the initial memory image for a TDX guest, ADD pages to the TD as part of establishing the mappings in the mirror EPT, as opposed to creating the mappings and then doing ADD after the fact. Doing ADD in the S-EPT callbacks eliminates the need to track "premapped" pages, as the mirror EPT (M-EPT) and S-EPT are always synchronized, e.g. if ADD fails, KVM reverts to the previous M-EPT entry (guaranteed to be !PRESENT). Eliminating the hole where the M-EPT can have a mapping that doesn't exist in the S-EPT in turn obviates the need to handle errors that are unique to encountering a missing S-EPT entry (see tdx_is_sept_zap_err_due_to_premap()). Keeping the M-EPT and S-EPT synchronized also eliminates the need to check for unconsumed "premap" entries during tdx_td_finalize(), as there simply can't be any such entries. Dropping that check in particular reduces the overall cognitive load, as the management of nr_premapped with respect to removal of S-EPT is _very_ subtle. E.g. successful removal of an S-EPT entry after it completed ADD doesn't adjust nr_premapped, but it's not clear why that's "ok" but having half-baked entries is not (it's not truly "ok" in that removing pages from the image will likely prevent the guest from booting, but from KVM's perspective it's "ok"). Doing ADD in the S-EPT path requires passing an argument via a scratch field, but the current approach of tracking the number of "premapped" pages effectively does the same. And the "premapped" counter is much more dangerous, as it doesn't have a singular lock to protect its usage, since nr_premapped can be modified as soon as mmu_lock is dropped, at least in theory. I.e. nr_premapped is guarded by slots_lock, but only for "happy" paths. Note, this approach was used/tried at various points in TDX development, but was ultimately discarded due to a desire to avoid stashing temporary state in kvm_tdx. But as above, KVM ended up with such state anyways, and fully committing to using temporary state provides better access rules (100% guarded by slots_lock), and makes several edge cases flat out impossible. Note #2, continue to extend the measurement outside of mmu_lock, as it's a slow operation (typically 16 SEAMCALLs per page whose data is included in the measurement), and doesn't *need* to be done under mmu_lock, e.g. for consistency purposes. However, MR.EXTEND isn't _that_ slow, e.g. ~1ms latency to measure a full page, so if it needs to be done under mmu_lock in the future, e.g. because KVM gains a flow that can remove S-EPT entries during KVM_TDX_INIT_MEM_REGION, then extending the measurement can also be moved into the S-EPT mapping path (again, only if absolutely necessary). P.S. _If_ MR.EXTEND is moved into the S-EPT path, take care not to return an error up the stack if TDH_MR_EXTEND fails, as removing the M-EPT entry but not the S-EPT entry would result in inconsistent state! Reviewed-by: Rick Edgecombe Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-17-seanjc@google.com Signed-off-by: Sean Christopherson commit b4b2b6eda5afa92f42fd1cd67f2729acf7e95f5b Author: Sean Christopherson Date: Thu Oct 30 13:09:38 2025 -0700 KVM: TDX: Fold tdx_mem_page_record_premap_cnt() into its sole caller Fold tdx_mem_page_record_premap_cnt() into tdx_sept_set_private_spte() as providing a one-off helper for effectively three lines of code is at best a wash, and splitting the code makes the comment for smp_rmb() _extremely_ confusing as the comment talks about reading kvm->arch.pre_fault_allowed before kvm_tdx->state, but the immediately visible code does the exact opposite. Opportunistically rewrite the comments to more explicitly explain who is checking what, as well as _why_ the ordering matters. No functional change intended. Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-16-seanjc@google.com Signed-off-by: Sean Christopherson commit af96d5452e5e88019bed9c081d4be1c489d7c081 Author: Sean Christopherson Date: Thu Oct 30 13:09:37 2025 -0700 KVM: TDX: Use atomic64_dec_return() instead of a poor equivalent Use atomic64_dec_return() when decrementing the number of "pre-mapped" S-EPT pages to ensure that the count can't go negative without KVM noticing. In theory, checking for '0' and then decrementing in a separate operation could miss a 0=>-1 transition. In practice, such a condition is impossible because nr_premapped is protected by slots_lock, i.e. doesn't actually need to be an atomic (that wart will be addressed shortly). Don't bother trying to keep the count non-negative, as the KVM_BUG_ON() ensures the VM is dead, i.e. there's no point in trying to limp along. Reviewed-by: Rick Edgecombe Reviewed-by: Ira Weiny Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 24adff39705223f06607926f2717e6f8dec12d28 Author: Sean Christopherson Date: Thu Oct 30 13:09:36 2025 -0700 KVM: TDX: Avoid a double-KVM_BUG_ON() in tdx_sept_zap_private_spte() Return -EIO immediately from tdx_sept_zap_private_spte() if the number of to-be-added pages underflows, so that the following "KVM_BUG_ON(err, kvm)" isn't also triggered. Isolating the check from the "is premap error" if-statement will also allow adding a lockdep assertion that premap errors are encountered if and only if slots_lock is held. Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-14-seanjc@google.com Signed-off-by: Sean Christopherson commit b9d5cf6de0b6bd3bdd8957b5fea5a243e43c928f Author: Sean Christopherson Date: Thu Oct 30 13:09:35 2025 -0700 KVM: TDX: WARN if mirror SPTE doesn't have full RWX when creating S-EPT mapping Pass in the mirror_spte to kvm_x86_ops.set_external_spte() to provide symmetry with .remove_external_spte(), and assert in TDX that the mirror SPTE is shadow-present with full RWX permissions (the TDX-Module doesn't allow the hypervisor to control protections). Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 7139c860650535cf517a9344212ce56a21ba37f5 Author: Sean Christopherson Date: Thu Oct 30 13:09:34 2025 -0700 KVM: x86/mmu: Drop the return code from kvm_x86_ops.remove_external_spte() Drop the return code from kvm_x86_ops.remove_external_spte(), a.k.a. tdx_sept_remove_private_spte(), as KVM simply does a KVM_BUG_ON() failure, and that KVM_BUG_ON() is redundant since all error paths in TDX also do a KVM_BUG_ON(). Opportunistically pass the spte instead of the pfn, as the API is clearly about removing an spte. Suggested-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-12-seanjc@google.com Signed-off-by: Sean Christopherson commit b836503300dcc0d60f7ffc359f0768cd545d8ef9 Author: Sean Christopherson Date: Thu Oct 30 13:09:33 2025 -0700 KVM: TDX: Fold tdx_sept_drop_private_spte() into tdx_sept_remove_private_spte() Fold tdx_sept_drop_private_spte() into tdx_sept_remove_private_spte() as a step towards having "remove" be the one and only function that deals with removing/zapping/dropping a SPTE, e.g. to avoid having to differentiate between "zap", "drop", and "remove". Eliminating the "drop" helper also gets rid of what is effectively dead code due to redundant checks, e.g. on an HKID being assigned. No functional change intended. Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-11-seanjc@google.com Signed-off-by: Sean Christopherson commit e6348c90dda9cb7beeda1ce83eed6177e46830d2 Author: Sean Christopherson Date: Thu Oct 30 13:09:32 2025 -0700 KVM: TDX: Return -EIO, not -EINVAL, on a KVM_BUG_ON() condition Return -EIO when a KVM_BUG_ON() is tripped, as KVM's ABI is to return -EIO when a VM has been killed due to a KVM bug, not -EINVAL. Note, many (all?) of the affected paths never propagate the error code to userspace, i.e. this is about internal consistency more than anything else. Reviewed-by: Rick Edgecombe Reviewed-by: Ira Weiny Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-10-seanjc@google.com Signed-off-by: Sean Christopherson commit ce7b5695397b54677ed827e0d52058daaecad2a1 Author: Yan Zhao Date: Thu Oct 30 13:09:31 2025 -0700 KVM: TDX: Drop superfluous page pinning in S-EPT management Don't explicitly pin pages when mapping pages into the S-EPT, guest_memfd doesn't support page migration in any capacity, i.e. there are no migrate callbacks because guest_memfd pages *can't* be migrated. See the WARN in kvm_gmem_migrate_folio(). Eliminating TDX's explicit pinning will also enable guest_memfd to support in-place conversion between shared and private memory[1][2]. Because KVM cannot distinguish between speculative/transient refcounts and the intentional refcount for TDX on private pages[3], failing to release private page refcount in TDX could cause guest_memfd to indefinitely wait on decreasing the refcount for the splitting. Under normal conditions, not holding an extra page refcount in TDX is safe because guest_memfd ensures pages are retained until its invalidation notification to KVM MMU is completed. However, if there're bugs in KVM/TDX module, not holding an extra refcount when a page is mapped in S-EPT could result in a page being released from guest_memfd while still mapped in the S-EPT. But, doing work to make a fatal error slightly less fatal is a net negative when that extra work adds complexity and confusion. Several approaches were considered to address the refcount issue, including - Attempting to modify the KVM unmap operation to return a failure, which was deemed too complex and potentially incorrect[4]. - Increasing the folio reference count only upon S-EPT zapping failure[5]. - Use page flags or page_ext to indicate a page is still used by TDX[6], which does not work for HVO (HugeTLB Vmemmap Optimization). - Setting HWPOISON bit or leveraging folio_set_hugetlb_hwpoison()[7]. Due to the complexity or inappropriateness of these approaches, and the fact that S-EPT zapping failure is currently only possible when there are bugs in the KVM or TDX module, which is very rare in a production kernel, a straightforward approach of simply not holding the page reference count in TDX was chosen[8]. When S-EPT zapping errors occur, KVM_BUG_ON() is invoked to kick off all vCPUs and mark the VM as dead. Although there is a potential window that a private page mapped in the S-EPT could be reallocated and used outside the VM, the loud warning from KVM_BUG_ON() should provide sufficient debug information. To be robust against bugs, the user can enable panic_on_warn as normal. Link: https://lore.kernel.org/all/cover.1747264138.git.ackerleytng@google.com [1] Link: https://youtu.be/UnBKahkAon4 [2] Link: https://lore.kernel.org/all/CAGtprH_ypohFy9TOJ8Emm_roT4XbQUtLKZNFcM6Fr+fhTFkE0Q@mail.gmail.com [3] Link: https://lore.kernel.org/all/aEEEJbTzlncbRaRA@yzhao56-desk.sh.intel.com [4] Link: https://lore.kernel.org/all/aE%2Fq9VKkmaCcuwpU@yzhao56-desk.sh.intel.com [5] Link: https://lore.kernel.org/all/aFkeBtuNBN1RrDAJ@yzhao56-desk.sh.intel.com [6] Link: https://lore.kernel.org/all/diqzy0tikran.fsf@ackerleytng-ctop.c.googlers.com [7] Link: https://lore.kernel.org/all/53ea5239f8ef9d8df9af593647243c10435fd219.camel@intel.com [8] Suggested-by: Vishal Annapurve Suggested-by: Ackerley Tng Suggested-by: Rick Edgecombe Signed-off-by: Yan Zhao Reviewed-by: Ira Weiny Reviewed-by: Kai Huang [sean: extract out of hugepage series, massage changelog accordingly] Reviewed-by: Binbin Wu Reviewed-by: Rick Edgecombe Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 6de2fb089bb27c2c03ca838f2478a659c826d686 Author: Sean Christopherson Date: Thu Oct 30 13:09:30 2025 -0700 KVM: x86/mmu: Rename kvm_tdp_map_page() to kvm_tdp_page_prefault() Rename kvm_tdp_map_page() to kvm_tdp_page_prefault() now that it's used only by kvm_arch_vcpu_pre_fault_memory(). No functional change intended. Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-8-seanjc@google.com Signed-off-by: Sean Christopherson commit fe7413e39810235fc812d5d85053cb1957388090 Author: Sean Christopherson Date: Thu Oct 30 13:09:29 2025 -0700 Revert "KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU" Remove the helper and exports that were added to allow TDX code to reuse kvm_tdp_map_page() for its gmem post-populate flow now that a dedicated TDP MMU API is provided to install a mapping given a gfn+pfn pair. This reverts commit 2608f105760115e94a03efd9f12f8fbfd1f9af4b. Reviewed-by: Rick Edgecombe Reviewed-by: Binbin Wu Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-7-seanjc@google.com Signed-off-by: Sean Christopherson commit c1f173fb3389d39f78fc57f14b767e7127bc3908 Author: Sean Christopherson Date: Thu Oct 30 13:09:28 2025 -0700 KVM: x86/mmu: WARN if KVM attempts to map into an invalid TDP MMU root When mapping into the TDP MMU, WARN (if KVM_PROVE_MMU=y) if the root is invalid, e.g. if KVM is attempting to insert a mapping without checking if the information and MMU context is fresh. Reviewed-by: Kai Huang Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 3ab3283dbb2c1246cbabdba8f3c52e72a3d88121 Author: Sean Christopherson Date: Thu Oct 30 13:09:27 2025 -0700 KVM: x86/mmu: Add dedicated API to map guest_memfd pfn into TDP MMU Add and use a new API for mapping a private pfn from guest_memfd into the TDP MMU from TDX's post-populate hook instead of partially open-coding the functionality into the TDX code. Sharing code with the pre-fault path sounded good on paper, but it's fatally flawed as simulating a fault loses the pfn, and calling back into gmem to re-retrieve the pfn creates locking problems, e.g. kvm_gmem_populate() already holds the gmem invalidation lock. Providing a dedicated API will also removing several MMU exports that ideally would not be exposed outside of the MMU, let alone to vendor code. On that topic, opportunistically drop the kvm_mmu_load() export. Leave kvm_tdp_mmu_gpa_is_mapped() alone for now; the entire commit that added kvm_tdp_mmu_gpa_is_mapped() will be removed in the near future. Gate the API on CONFIG_KVM_GUEST_MEMFD=y as private memory _must_ be backed by guest_memfd. Add a lockdep-only assert to that the incoming pfn is indeed backed by guest_memfd, and that the gmem instance's invalidate lock is held (which, combined with slots_lock being held, obviates the need to check for a stale "fault"). Cc: Michael Roth Cc: Yan Zhao Cc: Ira Weiny Cc: Vishal Annapurve Cc: Rick Edgecombe Reviewed-by: Rick Edgecombe Reviewed-by: Kai Huang Link: https://lore.kernel.org/all/20250709232103.zwmufocd3l7sqk7y@amd.com Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 5294a4b93e07ab74ef334434b927a5a33aa0ecfe Author: Sean Christopherson Date: Thu Oct 30 13:09:26 2025 -0700 KVM: TDX: Drop PROVE_MMU=y sanity check on to-be-populated mappings Drop TDX's sanity check that a mirror EPT mapping isn't zapped between creating said mapping and doing TDH.MEM.PAGE.ADD, as the check is simultaneously superfluous and incomplete. Per commit 2608f1057601 ("KVM: x86/tdp_mmu: Add a helper function to walk down the TDP MMU"), the justification for introducing kvm_tdp_mmu_gpa_is_mapped() was to check that the target gfn was pre-populated, with a link that points to this snippet: : > One small question: : > : > What if the memory region passed to KVM_TDX_INIT_MEM_REGION hasn't been pre- : > populated? If we want to make KVM_TDX_INIT_MEM_REGION work with these regions, : > then we still need to do the real map. Or we can make KVM_TDX_INIT_MEM_REGION : > return error when it finds the region hasn't been pre-populated? : : Return an error. I don't love the idea of bleeding so many TDX details into : userspace, but I'm pretty sure that ship sailed a long, long time ago. But that justification makes little sense for the final code, as the check on nr_premapped after TDH.MEM.PAGE.ADD will detect and return an error if KVM attempted to zap a S-EPT entry (tdx_sept_zap_private_spte() will fail on TDH.MEM.RANGE.BLOCK due lack of a valid S-EPT entry). And as evidenced by the "is mapped?" code being guarded with CONFIG_KVM_PROVE_MMU=y, KVM is NOT relying on the check for general correctness. The sanity check is also incomplete in the sense that mmu_lock is dropped between the check and TDH.MEM.PAGE.ADD, i.e. will only detect KVM bugs that zap SPTEs in a very specific window (note, this also applies to the check on nr_premapped). Removing the sanity check will allow removing kvm_tdp_mmu_gpa_is_mapped(), which has no business being exposed to vendor code, and more importantly will pave the way for eliminating the "pre-map" approach entirely in favor of doing TDH.MEM.PAGE.ADD under mmu_lock. Reviewed-by: Ira Weiny Reviewed-by: Kai Huang Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 50efc2340a598da4bafa40bc01e18f8cf73a4ae3 Author: Sean Christopherson Date: Thu Oct 30 13:09:25 2025 -0700 KVM: Rename kvm_arch_vcpu_async_ioctl() to kvm_arch_vcpu_unlocked_ioctl() Rename the "async" ioctl API to "unlocked" so that upcoming usage in x86's TDX code doesn't result in a massive misnomer. To avoid having to retry SEAMCALLs, TDX needs to acquire kvm->lock *and* all vcpu->mutex locks, and acquiring all of those locks after/inside the current vCPU's mutex is a non-starter. However, TDX also needs to acquire the vCPU's mutex and load the vCPU, i.e. the handling is very much not async to the vCPU. No functional change intended. Acked-by: Claudio Imbrenda Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 0a0da3f92118950862700497bc7917f0fbf6a6e8 Author: Sean Christopherson Date: Thu Oct 30 13:09:24 2025 -0700 KVM: Make support for kvm_arch_vcpu_async_ioctl() mandatory Implement kvm_arch_vcpu_async_ioctl() "natively" in x86 and arm64 instead of relying on an #ifdef'd stub, and drop HAVE_KVM_VCPU_ASYNC_IOCTL in anticipation of using the API on x86. Once x86 uses the API, providing a stub for one architecture and having all other architectures opt-in requires more code than simply implementing the API in the lone holdout. Eliminating the Kconfig will also reduce churn if the API is renamed in the future (spoiler alert). No functional change intended. Acked-by: Claudio Imbrenda Reviewed-by: Yan Zhao Tested-by: Yan Zhao Tested-by: Kai Huang Link: https://patch.msgid.link/20251030200951.3402865-2-seanjc@google.com Signed-off-by: Sean Christopherson commit a52b1a71120bac2cac691f11b8fd2f64254570f0 Author: David Matlack Date: Mon Sep 22 22:48:57 2025 +0000 vfio: selftests: Store libvfio build outputs in $(OUTPUT)/libvfio Store the tools/testing/selftests/vfio/lib outputs (e.g. object files) in $(OUTPUT)/libvfio rather than in $(OUTPUT)/lib. This is in preparation for building the VFIO selftests library into the KVM selftests (see Link below). Specifically this will avoid name conflicts between tools/testing/selftests/{vfio,kvm/lib and also avoid leaving behind empty directories under tools/testing/selftests/kvm after a make clean. Link: https://lore.kernel.org/kvm/20250912222525.2515416-2-dmatlack@google.com/ Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20250922224857.2528737-1-dmatlack@google.com Signed-off-by: Alex Williamson commit 8710524f3fc9adb25f844fabab36b75f23199e8b Author: Randy Dunlap Date: Sat Nov 1 23:04:57 2025 -0700 docs: ABI: sysfs-module: update modules taint flags Add missing taint flags for loadable modules, as pointed out by Petr Pavlu [1]. [1] https://lore.kernel.org/all/c58152f1-0fbe-4f50-bb61-e2f4c0584025@suse.com/ Signed-off-by: Randy Dunlap Reviewed-by: Petr Pavlu Signed-off-by: Jonathan Corbet Message-ID: <20251102060458.517911-1-rdunlap@infradead.org> commit f4c6e50568a1c92cfda4b7d216b78ba9c9e7468e Author: Bagas Sanjaya Date: Mon Nov 3 16:38:18 2025 +0700 Documentation: uacce: Add explicit title Uacce docs' sections are listed in misc-devices toctree instead due to lack of explicit docs title. Add it to clean up the toctree. Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Message-ID: <20251103093817.52764-2-bagasdotme@gmail.com> commit 0629278ecb97355b98cfe5df5bb9c338777f9fdf Author: Bagas Sanjaya Date: Mon Nov 3 10:02:28 2025 +0700 Documentation: pldmfw: Demote library overview section pldmfw library overview section is formatted as title heading (the second title of index.rst), making it listed in driver-api toctree. Demote the section. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Jacob Keller Signed-off-by: Jonathan Corbet Message-ID: <20251103030228.23851-1-bagasdotme@gmail.com> commit dd3e817e879c8c0e640b1afaed67a00935483b87 Author: Randy Dunlap Date: Mon Nov 3 21:09:30 2025 -0800 doc-guide: kernel-doc: add %CONST examples Add examples of using '%' for formatting constant values to facilitate more usage of "%CONST" in kernel-doc. Suggested-by: Tony Luck Signed-off-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104050930.720711-1-rdunlap@infradead.org> commit 6894ea0b9ab507f8571ff8d63531112bfec02085 Author: Bhanu Seshu Kumar Valluri Date: Tue Nov 4 11:47:23 2025 +0530 docs: Makefile: Sort Documentation targets case-insensitively in make help Avoid case-sensitive sorting when listing Documentation targets in make help. Previously, targets like PCI and RCU appeared ahead of others due to uppercase names. Normalize casing during _SPHINXDIRS generation to ensure consistent and intuitive ordering. Fixes: 965fc39f7393 ("Documentation: sort _SPHINXDIRS for 'make help'") Tested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Bhanu Seshu Kumar Valluri Signed-off-by: Jonathan Corbet Message-ID: <20251104061723.16629-1-bhanuseshukumar@gmail.com> commit 0c6636d8268f325d7cfaef3852951f47b018174b Author: Randy Dunlap Date: Tue Nov 4 11:44:03 2025 -0800 docs: w1: fix w1-netlink invalid URL The URL in w1-netlink.rst for an example userspace application has changed. The former URL is no longer valid. Update it to the github URL. Fixes: e4e056aa3518 ("w1: documentation update") Signed-off-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104194403.945611-1-rdunlap@infradead.org> commit 21d5c65d955f27efbf0dc62cd3eeebb9ba2ec61a Author: Tomas Glozar Date: Fri Oct 10 10:33:38 2025 +0200 Documentation/rtla: Include defaults for tracer options Commit 0122938a7ab4 ("rtla: Always set all tracer options") changed the behavior of RTLA to always set all osnoise and timerlat tracer options to default values taken from the tracers whenever an RTLA measurement is started. The change was done to make RTLA results consistent on subsequent runs of the same command. Include the default values for tracer options also in documentation where appropriate. Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-10-tglozar@redhat.com> commit b9f6a40dc3f03f1d688faad7bf9b7f78c366d0dd Author: Tomas Glozar Date: Fri Oct 10 10:33:37 2025 +0200 Documentation/trace: Specify exact priority for timerlat The timerlat tracer documentation mentions that threads are created with real-time priority, but does not mention which priority and scheduling class is used. Add the information so that users do not have to look it up in trace_osnoise.c. Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-9-tglozar@redhat.com> commit 122a552b5b1c1a33fa14e9d2d7d6a92a553a9c3e Author: Tomas Glozar Date: Fri Oct 10 10:33:36 2025 +0200 Documentation/rtla: Mention default cgroup state The RTLA option -C/--cgroup is used to set a cgroup for workload threads. This is either a specific cgroup, if passed an argument, or rtla's cgroup, if no argument is given. Expand the documentation of the -C option to also include the information about the cgroup settings when the option is not specified. Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-8-tglozar@redhat.com> commit 198fcc7cb832b995a84b32c52f016223c9ac1a82 Author: Tomas Glozar Date: Fri Oct 10 10:33:35 2025 +0200 Documentation/rtla: Mention default priority RTLA allows the priority of workload threads to be set using the -P option. This is covered in docs, but the default state for RTLA's own user workload (implemented in timerlat_u.c) is not mentioned. Add mention of the default user workload priority as well as a reference to osnoise and timerlat tracers for kernel workload priority. Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-7-tglozar@redhat.com> commit 3e30aee838081756e611caa76485d21fbdf99048 Author: Tomas Glozar Date: Fri Oct 10 10:33:34 2025 +0200 Documentation/rtla: Correct tracer name for common options Several options in common_options.rst say "osnoise tracer" for both osnoise and timerlat. Use |tool| variable so that the correct tool name is used. Fixes: b1be48307de4 ("rtla: Add rtla osnoise top documentation") Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-6-tglozar@redhat.com> commit 5e954a379fec9104ca1cff015a6e02300d226d8d Author: Tomas Glozar Date: Fri Oct 10 10:33:33 2025 +0200 Documentation/rtla: Fix typo in common_timerlat_options.txt Fix spelling error "equilavent" in place of "equivalent". Fixes: 173a3b014827 ("rtla/timerlat: Add the automatic trace option") Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-5-tglozar@redhat.com> commit 5bad56b4a246aab5d5d6b4a8532a5df926c930dd Author: Tomas Glozar Date: Fri Oct 10 10:33:32 2025 +0200 Documentation/rtla: Fix typo in rtla-timerlat-top.rst Fix "seem" in place of intended "seen" in rtla-timerlat-top documentation. Fixes: df337d014b57 ("rtla: Add rtla timerlat top documentation") Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-4-tglozar@redhat.com> commit 6524d31e158cdf4c0a98d7757f949e4de8516deb Author: Tomas Glozar Date: Fri Oct 10 10:33:31 2025 +0200 Documentation/rtla: Fix typo in common_timerlat_options.txt Fix "awakes" being used in place of "awakened" in --users-threads option documentation. Fixes: 612738321774 ("Documentation: Add tools/rtla timerlat -u option documentation") Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-3-tglozar@redhat.com> commit aad1530ff6cedb2f6fb02f17950bda0bfef68db2 Author: Tomas Glozar Date: Fri Oct 10 10:33:30 2025 +0200 Documentation/rtla: Fix typo in common_options.txt Fix "unlike" being spelled "nlike" in --on-threshold documentation. Fixes: 70165c78e31d ("Documentation/rtla: Add actions feature") Signed-off-by: Tomas Glozar Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Message-ID: <20251010083338.478961-2-tglozar@redhat.com> commit 469c1c9eb6c9243e4b59ef93518d4e0acb1b2b3e Author: Andy Shevchenko Date: Tue Nov 4 22:55:02 2025 +0100 kernel-doc: Issue warnings that were silently discarded When kernel-doc parses the sections for the documentation some errors may occur. In many cases the warning is simply stored to the current "entry" object. However, in the most of such cases this object gets discarded and there is no way for the output engine to even know about that. To avoid that, check if the "entry" is going to be discarded and if there warnings have been collected, issue them to the current logger as is and then flush the "entry". This fixes the problem that original Perl implementation doesn't have. As of Linux kernel v6.18-rc4 the reproducer can be: $ scripts/kernel-doc -v -none -Wall include/linux/util_macros.h ... Info: include/linux/util_macros.h:138 Scanning doc for function to_user_ptr ... while with the proposed change applied it gives one more line: $ scripts/kernel-doc -v -none -Wall include/linux/util_macros.h ... Info: include/linux/util_macros.h:138 Scanning doc for function to_user_ptr Warning: include/linux/util_macros.h:144 expecting prototype for to_user_ptr(). Prototype was for u64_to_user_ptr() instead ... And with the original Perl script: $ scripts/kernel-doc.pl -v -none -Wall include/linux/util_macros.h ... include/linux/util_macros.h:139: info: Scanning doc for function to_user_ptr include/linux/util_macros.h:149: warning: expecting prototype for to_user_ptr(). Prototype was for u64_to_user_ptr() instead ... Fixes: 9cbc2d3b137b ("scripts/kernel-doc.py: postpone warnings to the output plugin") Signed-off-by: Andy Shevchenko Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20251104215502.1049817-1-andriy.shevchenko@linux.intel.com> commit 396f45a34e83cf2e228bf40ef64bbbdbfd86a758 Merge: ce27278119f36b d99b7a9d51ad95 Author: Andy Shevchenko Date: Wed Nov 5 18:15:07 2025 +0100 Merge patch series "pinctrl: intel: Consolidate struct intel_padgroup initialisers" Andy Shevchenko says: We have plenty of repetitive *_GPP() macros across the drivers. Consolidate them under a newly introduced INTEL_GPP(). Link: https://patch.msgid.link/20251104145814.1018867-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko commit d99b7a9d51ad9585c20427f99b83ea756bd84b4b Author: Andy Shevchenko Date: Tue Nov 4 15:56:44 2025 +0100 pinctrl: sunrisepoint: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit ba6467787b6843dec08d16944f9d2a7757b5acfb Author: Andy Shevchenko Date: Tue Nov 4 15:56:43 2025 +0100 pinctrl: tigerlake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit 9151857eefbb8528690e37b07260301a58e9127d Author: Andy Shevchenko Date: Tue Nov 4 15:56:42 2025 +0100 pinctrl: meteorpoint: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit cac89a3dca3a6dbc420bf5253c2d212cb9b4b339 Author: Andy Shevchenko Date: Tue Nov 4 15:56:41 2025 +0100 pinctrl: meteorlake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit c11e90dc9ab324cc14f90b9b26ec95710f52b846 Author: Andy Shevchenko Date: Tue Nov 4 15:56:40 2025 +0100 pinctrl: lakefield: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit 29d06c2d39d054eb72f62adac1ba1b63f2d0b365 Author: Andy Shevchenko Date: Tue Nov 4 15:56:39 2025 +0100 pinctrl: jasperlake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit 51327d683963cf2f4f4210f8275e9a522ba27dd4 Author: Andy Shevchenko Date: Tue Nov 4 15:56:38 2025 +0100 pinctrl: icelake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit 9db14f71029d9d2b23f831203d893c30b8e2a079 Author: Andy Shevchenko Date: Tue Nov 4 15:56:37 2025 +0100 pinctrl: cannonlake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Signed-off-by: Andy Shevchenko commit 16b37ed0f373638c85bf9ed68d070073bd2921a5 Author: Andy Shevchenko Date: Tue Nov 4 15:56:36 2025 +0100 pinctrl: alderlake: Switch to INTEL_GPP() macro Replace custom macro with the recently defined INTEL_GPP(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit e1a57abb3be5ca5a33b84861d4ff7ece923419b9 Author: Andy Shevchenko Date: Tue Nov 4 15:56:35 2025 +0100 pinctrl: intel: Introduce INTEL_GPP() macro A new macro will be used for the further refactoring of the drivers. Signed-off-by: Andy Shevchenko commit 59d2d28f2269dfb89d64828fd330bc32113fd036 Author: Linus Walleij Date: Tue Nov 4 14:01:03 2025 +0100 pinctrl: cix: sky1: Provide pin control dummy states This exports and calls the pinctrl_provide_dummies() function from the CIX SKY1 driver. The reasons are explained in a comment in the commit, in essence the two pin controllers need to go through explicit state transitions default->sleep->default despite they only handle one single state each. Reviewed-by: Hans Zhang Reviewed-by: Fugang Duan Signed-off-by: Linus Walleij commit be04e96ba911fac1dc4c7f89ebb42018d167043f Author: Waiman Long Date: Tue Nov 4 23:38:48 2025 -0500 cgroup/cpuset: Globally track isolated_cpus update The current cpuset code passes a local isolcpus_updated flag around in a number of functions to determine if external isolation related cpumasks like wq_unbound_cpumask should be updated. It is a bit cumbersome and makes the code more complex. Simplify the code by using a global boolean flag "isolated_cpus_updating" to track this. This flag will be set in isolated_cpus_update() and cleared in update_isolation_cpumasks(). No functional change is expected. Signed-off-by: Waiman Long Reviewed-by: Chen Ridong Signed-off-by: Tejun Heo commit b1034a690129acd8995137bf4462470b4a2aa690 Author: Waiman Long Date: Tue Nov 4 23:38:47 2025 -0500 cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition Commit 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup") is supposed to ensure that domain isolated CPUs designated by the "isolcpus" boot command line option stay either in root partition or in isolated partitions. However, the required check wasn't implemented when a remote partition was created or when an existing partition changed type from "root" to "isolated". Even though this is a relatively minor issue, we still need to add the required prstate_housekeeping_conflict() call in the right places to ensure that the rule is strictly followed. The following steps can be used to reproduce the problem before this fix. # fmt -1 /proc/cmdline | grep isolcpus isolcpus=9 # cd /sys/fs/cgroup/ # echo +cpuset > cgroup.subtree_control # mkdir test # echo 9 > test/cpuset.cpus # echo isolated > test/cpuset.cpus.partition # cat test/cpuset.cpus.partition isolated # cat test/cpuset.cpus.effective 9 # echo root > test/cpuset.cpus.partition # cat test/cpuset.cpus.effective 9 # cat test/cpuset.cpus.partition root With this fix, the last few steps will become: # echo root > test/cpuset.cpus.partition # cat test/cpuset.cpus.effective 0-8,10-95 # cat test/cpuset.cpus.partition root invalid (partition config conflicts with housekeeping setup) Reported-by: Chen Ridong Signed-off-by: Waiman Long Reviewed-by: Chen Ridong Signed-off-by: Tejun Heo commit 6cfeddbf4ade9202849d75c27c4d0c82b42c73d1 Author: Waiman Long Date: Tue Nov 4 23:38:46 2025 -0500 cgroup/cpuset: Move up prstate_housekeeping_conflict() helper Move up the prstate_housekeeping_conflict() helper so that it can be used in remote partition code. Signed-off-by: Waiman Long Reviewed-by: Chen Ridong Signed-off-by: Tejun Heo commit 103b08709e8a59876980a8edddf4e68f3a23e34e Author: Waiman Long Date: Tue Nov 4 23:38:45 2025 -0500 cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping Currently the user can set up isolated cpus via cpuset and nohz_full in such a way that leaves no housekeeping CPU (i.e. no CPU that is neither domain isolated nor nohz full). This can be a problem for other subsystems (e.g. the timer wheel imgration). Prevent this configuration by blocking any assignation that would cause the union of domain isolated cpus and nohz_full to covers all CPUs. [longman: Remove isolated_cpus_should_update() and rewrite the checking in update_prstate() and update_parent_effective_cpumask()] Originally-by: Gabriele Monaco Signed-off-by: Waiman Long Reviewed-by: Chen Ridong Signed-off-by: Tejun Heo commit 55939cf28a48dad27d6906e57d3b45905bb0d001 Author: Gabriele Monaco Date: Tue Nov 4 23:38:44 2025 -0500 cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks() update_unbound_workqueue_cpumask() updates unbound workqueues settings when there's a change in isolated CPUs, but it can be used for other subsystems requiring updated when isolated CPUs change. Generalise the name to update_isolation_cpumasks() to prepare for other functions unrelated to workqueues to be called in that spot. [longman: Change the function name to update_isolation_cpumasks()] Acked-by: Frederic Weisbecker Acked-by: Waiman Long Signed-off-by: Gabriele Monaco Signed-off-by: Waiman Long Reviewed-by: Chen Ridong Reviewed-by: Chen Ridong Signed-off-by: Tejun Heo commit 3a0ff7b98af4a5de1b995dfb57e65843f9b7b628 Author: Lizhi Hou Date: Tue Nov 4 10:53:39 2025 -0800 accel/amdxdna: Support preemption requests The driver checks the firmware version during initialization.If preemption is supported, the driver configures preemption accordingly and handles userspace preemption requests. Otherwise, the driver returns an error for userspace preemption requests. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251104185340.897560-1-lizhi.hou@amd.com commit 059835bbfa282918a1e8e5e2d9628aa600093052 Author: Zuo An Date: Fri Oct 24 05:46:47 2025 +0000 tools/power/cpupower: Support building libcpupower statically The cpupower Makefile built and installed libcpupower as a shared library (libcpupower.so) without passing `STATIC=true`, but did not build a static version of the library even with `STATIC=true`. (Only the programs were static). Thus, out-of-tree programs using libcpupower were unable to link statically against the library without having access to intermediate object files produced during the build. This fixes that situation by ensuring that libcpupower.a is built and installed when `STATIC=true` is specified. Link: https://lore.kernel.org/r/x7geegquiks3zndiavw2arihdc2rk7e2dx3lk7yxkewqii6zpg@tzjijqxyzwmu Signed-off-by: Zuo An Signed-off-by: Shuah Khan commit 83ccde67a3f73326e89dde66c0c775c932a30570 Author: Lucas De Marchi Date: Tue Nov 4 14:20:51 2025 -0800 drm/xe/gt_throttle: Avoid TOCTOU when monitoring reasons It's currently not possible to safely monitor if there's throttling happening and what are the reasons. The approach of reading the status and then reading the reasons is not reliable as by the time sysadmin reads the reason, the throttling could not be happening anymore. Previous tentative to fix that[1] was breaking the ABI and potentially sysadmin's scripts. This takes a different approach of adding and documenting the additional attribute. It's still valuable, though redundant, to provide the simpler 0/1 interface. In order to avoid userspace knowledge on the bitmask meaning and to be able to maintain the kernel side in sync with possible changes in future, just walk the attribute group and check what are the masks that match the value read. [1] https://lore.kernel.org/intel-xe/20241025092238.167042-1-raag.jadav@intel.com/ Cc: Raag Jadav Cc: Rodrigo Vivi Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20251104-gt-throttle-cri-v5-1-4948b060bbfd@intel.com Signed-off-by: Lucas De Marchi commit 84361123413efc84b06f3441c6c827b95d902732 Author: Usama Arif Date: Mon Nov 3 14:09:23 2025 +0000 efi/libstub: Fix page table access in 5-level to 4-level paging transition When transitioning from 5-level to 4-level paging, the existing code incorrectly accesses page table entries by directly dereferencing CR3 and applying PAGE_MASK. This approach has several issues: - __native_read_cr3() returns the raw CR3 register value, which on x86_64 includes not just the physical address but also flags Bits above the physical address width of the system (i.e. above __PHYSICAL_MASK_SHIFT) are also not masked. - The pgd value is masked by PAGE_SIZE which doesn't take into account the higher bits such as _PAGE_BIT_NOPTISHADOW. Replace this with proper accessor functions: - native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out of CR3 (like SME or LAM bits). All remaining bits are real address bits or reserved and must be 0. - mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above the max physical address are reserved and must be 0. Fixes: cb1c9e02b0c1 ("x86/efistub: Perform 4/5 level paging switch from the stub") Reported-by: Michael van der Westhuizen Reported-by: Tobias Fleig Co-developed-by: Kiryl Shutsemau Signed-off-by: Kiryl Shutsemau Signed-off-by: Usama Arif Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Ard Biesheuvel Link: https://patch.msgid.link/20251103141002.2280812-3-usamaarif642@gmail.com commit eb2266312507d7b757859e2227aa5c4ba6280ebe Author: Usama Arif Date: Mon Nov 3 14:09:22 2025 +0000 x86/boot: Fix page table access in 5-level to 4-level paging transition When transitioning from 5-level to 4-level paging, the existing code incorrectly accesses page table entries by directly dereferencing CR3 and applying PAGE_MASK. This approach has several issues: - __native_read_cr3() returns the raw CR3 register value, which on x86_64 includes not just the physical address but also flags. Bits above the physical address width of the system i.e. above __PHYSICAL_MASK_SHIFT) are also not masked. - The PGD entry is masked by PAGE_SIZE which doesn't take into account the higher bits such as _PAGE_BIT_NOPTISHADOW. Replace this with proper accessor functions: - native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out of CR3 (like SME or LAM bits). All remaining bits are real address bits or reserved and must be 0. - mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above the max physical address are reserved and must be 0. Fixes: e9d0e6330eb8 ("x86/boot/compressed/64: Prepare new top-level page table for trampoline") Reported-by: Michael van der Westhuizen Reported-by: Tobias Fleig Co-developed-by: Kiryl Shutsemau Signed-off-by: Kiryl Shutsemau Signed-off-by: Usama Arif Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Ard Biesheuvel Acked-by: Dave Hansen Link: https://lore.kernel.org/r/a482fd68-ce54-472d-8df1-33d6ac9f6bb5@intel.com commit 35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3 Author: Xiaoqi Zhuang Date: Tue Oct 21 16:45:25 2025 +0800 coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue. Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it. Fixes: bd2767ec3df2 ("coresight: Fix run time warnings while reusing ETR buffer") Signed-off-by: Xiaoqi Zhuang Signed-off-by: Suzuki K Poulose Tested-by: Leo Yan Link: https://lore.kernel.org/r/20251021-fix_etr_issue-v3-1-99a2d066fee2@oss.qualcomm.com commit 134b1eabe6d9df8873bd018c9465994db8bff945 Author: Yazen Ghannam Date: Tue Nov 4 14:55:40 2025 +0000 x86/mce/amd: Enable interrupt vectors once per-CPU on SMCA systems Scalable MCA systems have a per-CPU register that gives the APIC LVT offset for the thresholding and deferred error interrupts. Currently, this register is read once to set up the deferred error interrupt and then read again for each thresholding block. Furthermore, the APIC LVT registers are configured each time, but they only need to be configured once per-CPU. Move the APIC LVT setup to the early part of CPU init, so that the registers are set up once. Also, this ensures that the kernel is ready to service the interrupts before the individual error sources (each MCA bank) are enabled. Apply this change only to SMCA systems to avoid breaking any legacy behavior. The deferred error interrupt is technically advertised by the SUCCOR feature. However, this was first made available on SMCA systems. Therefore, only set up the deferred error interrupt on SMCA systems and simplify the code. Guidance from hardware designers is that the LVT offsets provided from the platform should be used. The kernel should not try to enforce specific values. However, the kernel should check that an LVT offset is not reused for multiple sources. Therefore, remove the extra checking and value enforcement from the MCE code. The "reuse/conflict" case is already handled in setup_APIC_eilvt(). Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tony Luck Tested-by: Tony Luck Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit 424e2cce078255c1ccaf7d30ec1508ea5d1b89b1 Author: Gwan-gyeong Mun Date: Wed Nov 5 03:13:11 2025 +0200 drm/xe: Remove never used code in xe_vm_create() Clang is not happy with set but unused variable (this is visible with `make LLVM=1` build: drivers/gpu/drm/xe/xe_vm.c:1462:11: error: variable 'number_tiles' set but not used [-Werror,-Wunused-but-set-variable] The use of this variable was removed in the commit mentioned below as "Fixes:" but only its declaration and update remain. It seems like the variable is not used along with the assignment that does not have side effects as far as I can see. Remove those altogether. Fixes: cb99e12ba8cb ("drm/xe: Decouple bind queue last fence from TLB invalidations") Signed-off-by: Gwan-gyeong Mun Reviewed-by: Michał Winiarski Link: https://patch.msgid.link/20251105011311.3177875-1-gwan-gyeong.mun@intel.com Signed-off-by: Michał Winiarski commit 7cb735d7c0cb4307b2072aae6268b5b2069a8658 Author: Yazen Ghannam Date: Tue Nov 4 14:55:39 2025 +0000 x86/mce: Unify AMD DFR handler with MCA Polling AMD systems optionally support a deferred error interrupt. The interrupt should be used as another signal to trigger MCA polling. This is similar to how other MCA interrupts are handled. Deferred errors do not require any special handling related to the interrupt, e.g. resetting or rearming the interrupt, etc. However, Scalable MCA systems include a pair of registers, MCA_DESTAT and MCA_DEADDR, that should be checked for valid errors. This check should be done whenever MCA registers are polled. Currently, the deferred error interrupt does this check, but the MCA polling function does not. Call the MCA polling function when handling the deferred error interrupt. This keeps all "polling" cases in a common function. Add an SMCA status check helper. This will do the same status check and register clearing that the interrupt handler has done. And it extends the common polling flow to find AMD deferred errors. Clear the MCA_DESTAT register at the end of the handler rather than the beginning. This maintains the procedure that the 'status' register must be cleared as the final step. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit af205a9b6837b453137bf41a78732480b6128096 Author: Lukas Bulwahn Date: Wed Nov 5 11:28:32 2025 +0100 MAINTAINERS: add printk core-api doc file to PRINTK The files in Documentation/core-api/ are by virtue of their top-level directory part of the Documentation section in MAINTAINERS. Each file in Documentation/core-api/ should however also have a further section in MAINTAINERS it belongs to, which fits to the technical area of the documented API in that file. The printk.rst provides some explanation to the printk API defined in include/linux/printk.h, which itself is part of the PRINTK section. Add this core-api document to PRINTK. Signed-off-by: Lukas Bulwahn Link: https://patch.msgid.link/20251105102832.155823-1-lukas.bulwahn@redhat.com Signed-off-by: Petr Mladek commit 2f6adeaf92c4ea4adf5a91b87497ba13bb057996 Merge: dcbc94c1f04423 059ca8fd692b67 Author: Johannes Berg Date: Wed Nov 5 16:28:53 2025 +0100 Merge tag 'ath-next-20251103' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath into wireless-next Jeff Johnson says: ================== ath.git patches for v6.19 Highlights for some specific drivers include: ath10k: Add support for Factory Test TLV commands ath11k: Add support for Tx Power insertion ath12k: Add support for BSS color change And of course there is the usual set of cleanups and bug fixes across the entire family of "ath" drivers. We do expect to have one more pull request before the v6.19 merge window to pull in the refactored ath12k driver from the ath12k-ng branch. ================== Signed-off-by: Johannes Berg commit 59f44afbe8cfe7904e8cf8d2bb67eb86b79e58da Author: Alok Tiwari Date: Tue Nov 4 21:01:09 2025 -0800 io_uring: fix typos and comment wording Corrected spelling mistakes in comments "reuqests" -> "requests", "noifications" -> "notifications", "seperately" -> "separately"). Fixed a small grammar issue ("then" -> "than"). Updated "flag" -> "flags" in fdinfo.c Signed-off-by: Alok Tiwari Signed-off-by: Jens Axboe commit 55de535e0769cbc61c2ac415673365ee0efa96e0 Merge: f68ff6bc0d0893 e04ccfc28252f1 Author: Jens Axboe Date: Wed Nov 5 08:07:41 2025 -0700 Merge branch 'cached-zones' into for-6.19/block This patch series implements a cached report zones using information from the block layer zone write plugs and a new zone condition tracking. This avoids having to execute slow report zones commands on the device when for instance mounting file systems, which can significantly speed things up, especially in setups with multiple SMR HDDs (e.g. a BTRFS RAID volume). The first patch improves handling of zone management commands. Patch 2 fixes zone resource updates and the following 3 patches cleanup the zone code in preparation for introducing cached zone report support. From patch 6 to 13, cached report zones is implemented and made available to users with a new ioctl() command. Finally, patches 14 and 15 introduce the use of cached report zones in the mount operation of XFS and BTRFS. Link: https://lore.kernel.org/linux-block/20251104212249.1075412-1-dlemoal@kernel.org/ Signed-off-by: Jens Axboe * cached-zones: xfs: use blkdev_report_zones_cached() btrfs: use blkdev_report_zones_cached() block: add zone write plug condition to debugfs zone_wplugs block: improve zone_wplugs debugfs attribute output block: introduce BLKREPORTZONESV2 ioctl block: introduce blkdev_report_zones_cached() block: introduce blkdev_get_zone_info() block: refactor blkdev_report_zones() code block: track zone conditions block: use zone condition to determine conventional zones block: reorganize struct blk_zone_wplug block: introduce disk_report_zone() block: cleanup blkdev_report_zones() block: freeze queue when updating zone resources block: handle zone management operations completions commit e04ccfc28252f181ea8d469d834b48e7dece65b2 Author: Damien Le Moal Date: Wed Nov 5 06:22:49 2025 +0900 xfs: use blkdev_report_zones_cached() Modify xfs_mount_zones() to replace the call to blkdev_report_zones() with blkdev_report_zones_cached() to speed-up mount operations. Since this causes xfs_zone_validate_seq() to see zones with the BLK_ZONE_COND_ACTIVE condition, this function is also modified to acept this condition as valid. With this change, mounting a freshly formatted large capacity (30 TB) SMR HDD completes under 2s compared to over 4.7s before. Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit ad3c1188b401cbc0533515ba2d45396b4fa320e1 Author: Damien Le Moal Date: Wed Nov 5 06:22:48 2025 +0900 btrfs: use blkdev_report_zones_cached() Modify btrfs_get_dev_zones() and btrfs_sb_log_location_bdev() to replace the call to blkdev_report_zones() with blkdev_report_zones_cached() to speed-up mount operations. btrfs_get_dev_zone_info() is also modified to take into account the BLK_ZONE_COND_ACTIVE condition, which is equivalent to either BLK_ZONE_COND_IMP_OPEN, BLK_ZONE_COND_EXP_OPEN or BLK_ZONE_COND_CLOSED. With this change, mounting a freshly formatted large capacity (30 TB) SMR HDD completes under 100ms compared to over 1.8s before. Signed-off-by: Damien Le Moal Acked-by: David Sterba Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 1efbbc641ef7d673059cded789b9c8a743c17c9a Author: Damien Le Moal Date: Wed Nov 5 06:22:47 2025 +0900 block: add zone write plug condition to debugfs zone_wplugs Modify queue_zone_wplug_show() to include the condition of a zone write plug to the zone_wplugs debugfs attribute of a zoned block device. To improve readability and ease of use, rather than the zone condition raw value, the zone condition name is given using blk_zone_cond_str(). Suggested-by: Johannes Thumshirn Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 2b39d4a6c67d11ead8f39ec6376645d8e9d34554 Author: Damien Le Moal Date: Wed Nov 5 06:22:46 2025 +0900 block: improve zone_wplugs debugfs attribute output Make the output of the zone_wplugs debugfs attribute file more easily readable by adding the name of the zone write plugs fields in the output. No functional changes. Suggested-by: Bart Van Assche Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit b30ffcdc0c15a88f8866529d3532454e02571221 Author: Damien Le Moal Date: Wed Nov 5 06:22:45 2025 +0900 block: introduce BLKREPORTZONESV2 ioctl Introduce the new BLKREPORTZONESV2 ioctl command to allow user applications access to the fast zone report implemented by blkdev_report_zones_cached(). This new ioctl is defined as number 142 and is documented in include/uapi/linux/fs.h. Unlike the existing BLKREPORTZONES ioctl, this new ioctl uses the flags field of struct blk_zone_report also as an input. If the user sets the BLK_ZONE_REP_CACHED flag as an input, then blkdev_report_zones_cached() is used to generate the zone report using cached zone information. If this flag is not set, then BLKREPORTZONESV2 behaves in the same manner as BLKREPORTZONES and the zone report is generated by accessing the zoned device. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 31f0656a4ab712edf2888eabcc0664197a4a938e Author: Damien Le Moal Date: Wed Nov 5 06:22:44 2025 +0900 block: introduce blkdev_report_zones_cached() Introduce the function blkdev_report_zones_cached() to provide a fast report zone built using the blkdev_get_zone_info() function, which gets zone information from a disk zones_cond array or zone write plugs. For a large capacity SMR drive, such fast report zone can be completed in a few milliseconds compared to several seconds completion times when the report zone is obtained from the device. The zone report is built in the same manner as with the regular blkdev_report_zones() function, that is, the first zone reported is the one containing the specified start sector and the report is limited to the specified number of zones (nr_zones argument). The information for each zone in the report is obtained using blkdev_get_zone_info(). For zoned devices that do not use zone write plug resources, using blkdev_get_zone_info() is inefficient as the zone report would be very slow, generated one zone at a time. To avoid this, blkdev_report_zones_cached() falls back to calling blkdev_do_report_zones() to execute a regular zone report. In this case, the .report_active field of struct blk_report_zones_args is set to true to report zone conditions using the BLK_ZONE_COND_ACTIVE condition in place of the implicit open, explicit open and closed conditions. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit f2284eec5053df271c78e687672247922bcee881 Author: Damien Le Moal Date: Wed Nov 5 06:22:43 2025 +0900 block: introduce blkdev_get_zone_info() Introduce the function blkdev_get_zone_info() to obtain a single zone information from cached zone data, that is, either from the zone write plug for the target zone if it exists and from the disk zones_cond array otherwise. Since sequential zones that do not have a zone write plug are either full, empty or in a bad state (read-only or offline), the zone write pointer can be inferred from the zone condition cached in the disk zones_cond array. For sequential zones that have a zone write plug, the zone condition and zone write pointer are obtained from the condition and write pointer offset managed with the zone write plug. This allows obtaining the information for a zone much more quickly than having to execute a report zones command on the device. blkdev_get_zone_info() falls back to using a regular zone report if the target zone is flagged as needing an update with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag, or if the target device does not use zone write plugs (i.e. a device mapper device). In this case, the new function blkdev_report_zone_fallback() is used and the zone condition is reported consistantly with the cahced report, that is, the BLK_ZONE_COND_ACTIVE condition is used in place of the implicit open, explicit open and closed conditions. This is achieved by adding the .report_active field to struct blk_report_zones_args and by having disk_report_zone() sets the correct zone condition if .report_active is true. In preparation for using blkdev_get_zone_info() in upcoming file systems changes, also export this function as a GPL symbol. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 1af3f4e0c42b377f3405df498440566e3468c314 Author: Damien Le Moal Date: Wed Nov 5 06:22:42 2025 +0900 block: refactor blkdev_report_zones() code In preparation for implementing cached report zone, split the main part of the code of blkdev_report_zones() into the helper function blkdev_do_report_zones(), with this new helper taking as argument a struct blk_report_zones_args pointer instead of a report callback function and its private argument. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 0bf0e2e4666822b62d7ad6473dc37fd6b377b5f1 Author: Damien Le Moal Date: Wed Nov 5 06:22:41 2025 +0900 block: track zone conditions The function blk_revalidate_zone_cond() already caches the condition of all zones of a zoned block device in the zones_cond array of a gendisk. However, the zone conditions are updated only when the device is scanned or revalidated. Implement tracking of the runtime changes to zone conditions using the new cond field in struct blk_zone_wplug. The size of this structure remains 112 Bytes as the new field replaces the 4 Bytes padding at the end of the structure. Beause zones that do not have a zone write plug can be in the empty, implicit open, explicit open or full condition, the zones_cond array of a disk is used to track the conditions, of zones that do not have a zone write plug. The condition of such zone is updated in the disk zones_cond array when a zone reset, reset all or finish operation is executed, and also when a zone write plug is removed from the disk hash table when the zone becomes full. Since a device may automatically close an implicitly open zone when writing to an empty or closed zone, if the total number of open zones has reached the device limit, the BLK_ZONE_COND_IMP_OPEN and BLK_ZONE_COND_CLOSED zone conditions cannot be precisely tracked. To overcome this, the zone condition BLK_ZONE_COND_ACTIVE is introduced to represent a zone that has the condition BLK_ZONE_COND_IMP_OPEN, BLK_ZONE_COND_EXP_OPEN or BLK_ZONE_COND_CLOSED. This follows the definition of an active zone as defined in the NVMe Zoned Namespace specifications. As such, for a zoned device that has a limit on the maximum number of open zones, we will never have more zones in the BLK_ZONE_COND_ACTIVE condition than the device limit. This is compatible with the SCSI ZBC and ATA ZAC specifications for SMR HDDs as these devices do not have a limit on the number of active zones. The function disk_zone_wplug_set_wp_offset() is modified to use the new helper disk_zone_wplug_update_cond() to update a zone write plug condition whenever a zone write plug write offset is updated on submission or merging of write BIOs to a zone. The functions blk_zone_reset_bio_endio(), blk_zone_reset_all_bio_endio() and blk_zone_finish_bio_endio() are modified to update the condition of the zones targeted by reset, reset_all and finish operations, either using though disk_zone_wplug_set_wp_offset() for zones that have a zone write plug, or using the disk_zone_set_cond() helper to update the zones_cond array of the disk for zones that do not have a zone write plug. When a zone write plug is removed from the disk hash table (when the zone becomes empty or full), the condition of struct blk_zone_wplug is used to update the disk zones_cond array. Conversely, when a zone write plug is added to the disk hash table, the zones_cond array is used to initialize the zone write plug condition. Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit 6e945ffb6555705cf20b1fcdc21a139911562995 Author: Damien Le Moal Date: Wed Nov 5 06:22:40 2025 +0900 block: use zone condition to determine conventional zones The conv_zones_bitmap field of struct gendisk is used to define a bitmap to identify the conventional zones of a zoned block device. The bit for a zone is set in this bitmap if the zone is a conventional one, that is, if the zone type is BLK_ZONE_TYPE_CONVENTIONAL. For such zone, this always corresponds to the zone condition BLK_ZONE_COND_NOT_WP. In other words, conv_zones_bitmap tracks a single condition of the zones of a zoned block device. In preparation for tracking more zone conditions, change conv_zones_bitmap into an array of zone conditions, using 1 byte per zone. This increases the memory usage from 1 bit per zone to 1 byte per zone, that is, from 16 KiB to about 100 KiB for a 30 TB SMR HDD with 256 MiB zones. This is a trade-off to allow fast cached report zones later on top of this change. Rename the conv_zones_bitmap field of struct gendisk to zones_cond. Add a blk_revalidate_zone_cond() function to initialize the zones_cond array of a disk during device scan and to update it on device revalidation. Move the allocation of the zones_cond array to disk_revalidate_zone_resources(), making sure that this array is always allocated, even for devices that do not need zone write plugs (zone resources), to ensure that bdev_zone_is_seq() can be re-implemented to use the zone condition array in place of the conv zones bitmap. Finally, the function bdev_zone_is_seq() is rewritten to use a test on the condition of the target zone. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit ca1a897fb266c4b23b5ecb99fe787ed18559057d Author: Damien Le Moal Date: Wed Nov 5 06:22:39 2025 +0900 block: reorganize struct blk_zone_wplug Reorganize the fields of struct blk_zone_wplug to remove a hole after the wp_offset field and avoid having the bio_work structure split between 2 cache lines. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit fdb9aed869f34d776298b3a8197909eb820e4d0d Author: Damien Le Moal Date: Wed Nov 5 06:22:38 2025 +0900 block: introduce disk_report_zone() Commit b76b840fd933 ("dm: Fix dm-zoned-reclaim zone write pointer alignment") introduced an indirect call for the callback function of a report zones executed with blkdev_report_zones(). This is necessary so that the function disk_zone_wplug_sync_wp_offset() can be called to refresh a zone write plug zone write pointer offset after a write error. However, this solution makes following the path of a zone information harder to understand. Clean this up by introducing the new blk_report_zones_args structure to define a zone report callback and its private data and introduce the helper function disk_report_zone() which calls both disk_zone_wplug_sync_wp_offset() and the zone report user callback function for all zones of a zone report. This helper function must be called by all block device drivers that implement the report zones block operation in order to correctly report a zone information. All block device drivers supporting the report_zones block operation are updated to use this new scheme. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit e8ecb21f081fe0cab33dc20cbe65ccbbfe615c15 Author: Damien Le Moal Date: Wed Nov 5 06:22:37 2025 +0900 block: cleanup blkdev_report_zones() The variable capacity is used only in one place and so can be removed and get_capacity(disk) used directly instead. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit bba4322e3f303b2d656e748be758320b567f046f Author: Damien Le Moal Date: Wed Nov 5 06:22:36 2025 +0900 block: freeze queue when updating zone resources Modify disk_update_zone_resources() to freeze the device queue before updating the number of zones, zone capacity and other zone related resources. The locking order resulting from the call to queue_limits_commit_update_frozen() is preserved, that is, the queue limits lock is first taken by calling queue_limits_start_update() before freezing the queue, and the queue is unfrozen after executing queue_limits_commit_update(), which replaces the call to queue_limits_commit_update_frozen(). This change ensures that there are no in-flights I/Os when the zone resources are updated due to a zone revalidation. In case of error when the limits are applied, directly call disk_free_zone_resources() from disk_update_zone_resources() while the disk queue is still frozen to avoid needing to freeze & unfreeze the queue again in blk_revalidate_disk_zones(), thus simplifying that function code a little. Fixes: 0b83c86b444a ("block: Prevent potential deadlock in blk_revalidate_disk_zones()") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit efae226c2ef19528ffd81d29ba0eecf1b0896ca2 Author: Damien Le Moal Date: Wed Nov 5 06:22:35 2025 +0900 block: handle zone management operations completions The functions blk_zone_wplug_handle_reset_or_finish() and blk_zone_wplug_handle_reset_all() both modify the zone write pointer offset of zone write plugs that are the target of a reset, reset all or finish zone management operation. However, these functions do this modification before the BIO is executed. So if the zone operation fails, the modified zone write pointer offsets become invalid. Avoid this by modifying the zone write pointer offset of a zone write plug that is the target of a zone management operation when the operation completes. To do so, modify blk_zone_bio_endio() to call the new function blk_zone_mgmt_bio_endio() which in turn calls the functions blk_zone_reset_all_bio_endio(), blk_zone_reset_bio_endio() or blk_zone_finish_bio_endio() depending on the operation of the completed BIO, to modify a zone write plug write pointer offset accordingly. These functions are called only if the BIO execution was successful. Fixes: dd291d77cc90 ("block: Introduce zone write plugging") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Jens Axboe commit ad531f3d8b37521248508d5084b0ba480a27ef6d Author: Christian König Date: Wed Oct 8 15:39:26 2025 +0200 dma-buf: rework stub fence initialisation v2 Instead of doing this on the first call of the function just initialize the stub fence during kernel load. This has the clear advantage of lower overhead and also doesn't rely on the ops to not be NULL any more. v2: use correct signal function Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20251031134442.113648-3-christian.koenig@amd.com commit 21ef26d0e71f053e809926d45b86b0afbc3686bb Author: Niklas Cassel Date: Thu Oct 9 16:22:54 2025 +0200 arm64: tegra: Add pinctrl definitions for pcie-ep nodes When the PCIe controller is running in endpoint mode, the controller initialization is triggered by a PERST# (PCIe reset) GPIO deassertion. The driver has configured an IRQ to trigger when the PERST# GPIO changes state. Without the pinctrl definition, we do not get an IRQ when PERST# is deasserted, so the PCIe controller never gets initialized. Add the missing definitions, so that the controller actually gets initialized. Fixes: ec142c44b026 ("arm64: tegra: Add P2U and PCIe controller nodes to Tegra234 DT") Fixes: 0580286d0d22 ("arm64: tegra: Add Tegra234 PCIe C4 EP definition") Signed-off-by: Niklas Cassel Reviewed-by: Manikanta Maddireddy [treding@nvidia.com: add blank lines to separate blocks] Signed-off-by: Thierry Reding commit 3c36965df80801344850388592e95033eceea05b Author: AngeloGioacchino Del Regno Date: Mon Oct 27 12:05:22 2025 +0100 regulator: Add support for MediaTek MT6363 SPMI PMIC Regulators Add a driver for the regulators found on the MT6363 PMIC, fully controlled by SPMI interface. This PMIC regulates voltage with an input range of 2.6-5.0V, and features 10 buck converters and 26 LDOs. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251027110527.21002-5-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit d0f9f5b7a3356b43f78b37b9cc3671ecc7469356 Author: AngeloGioacchino Del Regno Date: Mon Oct 27 12:05:21 2025 +0100 dt-bindings: regulator: Document MediaTek MT6363 PMIC Regulators Add bindings for the regulators found in the MediaTek MT6363 PMIC, usually found in board designs using the MT6991 Dimensity 9400 and on MT8196 Kompanio SoC for Chromebooks, along with the MT6316 and MT6373 PMICs. Reviewed-by: Rob Herring (Arm) Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251027110527.21002-4-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit a87a7b3530728fb7477a74c27fc27e060bf5684f Author: AngeloGioacchino Del Regno Date: Mon Oct 27 12:05:20 2025 +0100 regulator: Add support for MediaTek MT6316 SPMI PMIC Regulators Add a driver for the regulators found on all types of the MediaTek MT6316 SPMI PMIC, fully controlled by SPMI interface and featuring four step down DCDC (buck) converters. In particular, this includes support for: - MT6316(BP/VP): 2+2 Phase (Phase 1: buck1+2, Phase 2: buck3+4) - MT6316(CP/HP/KP): 3+1 Phase (Phase 1: buck1+2+4, Phase 2: buck3) - MT6316(DP/TP): 4+0 Phase (Single phase, buck1+2+3+4) Please note that the set/clear registers for the enable bits are not documented in the datasheet version that I used as reference, but those are used in the downstream driver and I verified that are actually working as expected. Besides, it's also worth clearly mentioning that the MT6316 PMICs voltage selector register uses a weird 9-bits Big Endian format, for which a driver-private helper is provided. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20251027110527.21002-3-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit 40a7c5db9020079547358f486ef12d57c1a7aa1f Author: AngeloGioacchino Del Regno Date: Mon Oct 27 12:05:19 2025 +0100 dt-bindings: regulator: Document MediaTek MT6316 PMIC Regulators Add bindings for the regulators found in the MediaTek MT6316 PMIC, usually found in board designs using the MT6991 Dimensity 9400 and on MT8196 Kompanio SoC for Chromebooks. This chip is fully controlled by SPMI and has multiple variants providing different phase configurations. Reviewed-by: Chen-Yu Tsai Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20251027110527.21002-2-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit 655079ac8a7721ac215a0596e3f33b740e01144a Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:44 2025 +0100 ASoC: qcom: q6asm: Use guard() for spin locks Clean up the code using guard() for spin locks. No functional changes, just cleanup. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-21-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 680c683c8f49455bcfa1604eac4e508ba96ccbfa Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:43 2025 +0100 ASoC: qcom: q6asm-dai: Use guard() for spin locks Clean up the code using guard() for spin locks. No functional changes, just cleanup. Signed-off-by: Srinivas Kandagatla Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-20-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit b828059f86f67729aae3934650ae9e44a59ff9d8 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:42 2025 +0100 ASoC: qcom: q6apm-dai: Use guard() for spin locks Clean up the code using guard() for spin locks. No functional changes, just cleanup. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-19-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 4b1edbb028fb95b546893068b321a983b1ef50bc Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:41 2025 +0100 ASoC: qcom: q6afe: Use guard() for spin locks Clean up the code using guard() for spin locks. No functional changes, just cleanup. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-18-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 6e00112d31c86029ad0440f8c29ee0d131984cda Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:40 2025 +0100 ASoc: qcom: q6asm: Use automatic cleanup of kfree() Its common pattern in q6dsp code to allocate temporary buffer to send gpr/apr packets and free at the function exit. Now this can be simplified via __free(kfree) mechanism. No functional changes. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-17-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit de8e95773c48bad9d7339ccb376ad22d93932468 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:39 2025 +0100 ASoc: qcom: q6prm: Use automatic cleanup of kfree() Its common pattern in q6dsp code to allocate temporary buffer to send gpr/apr packets and free at the function exit. Now this can be simplified via __free(kfree) mechanism. No functional changes. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-16-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 89cf2223ee7bd83d45c6bef3ac52bedd018f77dd Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:38 2025 +0100 ASoc: qcom: q6apm: Use automatic cleanup of kfree() Its common pattern in q6dsp code to allocate temporary buffer to send gpr/apr packets and free at the function exit. Now this can be simplified via __free(kfree) mechanism. No functional changes. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-15-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 55094e55ae36c7566e29ae0473d205dbc9d2f4a8 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:37 2025 +0100 ASoc: qcom: q6afe: Use automatic cleanup of kfree() Its common pattern in q6dsp code to allocate temporary buffer to send gpr/apr packets and free at the function exit. Now this can be simplified via __free(kfree) mechanism. No functional changes. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-14-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 896f1e4e106449ac2b39f0ca62b6afaed540f758 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:36 2025 +0100 ASoc: qcom: q6adm: Use automatic cleanup of kfree() Its common pattern in q6dsp code to allocate temporary buffer to send gpr/apr packets and free at the function exit. Now this can be simplified via __free(kfree) mechanism. No functional changes. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-13-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 88a5f8e628ef745bb94bdf2fa019d9f8e069ccea Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:35 2025 +0100 ASoc: qcom: audioreach: Use automatic cleanup of kfree() Its common pattern in q6dsp code to allocate temporary buffer to send gpr/apr packets and free at the function exit. Now this can be simplified via __free(kfree) mechanism. No functional changes. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-12-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit bcb3f6f5286b96ff0a7106d2ca7208744b20b37e Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:34 2025 +0100 ASoc: qcom: audioreach: remove unused variables remove unused variables in some of the audioreach functions. Signed-off-by: Srinivas Kandagatla Link: https://patch.msgid.link/20251023102444.88158-11-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit f678ea19e8f60b05b8d3a5bcda9a238d5355bd50 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:33 2025 +0100 ASoC: qcom: q6asm: set runtime correctly for each stream Both capture and playback can have different runtimes, so set them accordingly. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-10-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 44432315444cbbedadbb9d808c9fc8c8b21cb4bf Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:32 2025 +0100 ASoC: qcom: q6asm-dai: use q6asm_get_hw_pointer make use of q6asm_get_hw_pointer to get the current hardware read/write pointer and remove any additional code that does calculate this manually. As this is redundant and prone to errors. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-9-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit b6a1d7243ec3a3fe1a3c2969fcd32c802fb5d2a9 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:31 2025 +0100 ASoC: qcom: q6asm: add q6asm_get_hw_pointer Currently q6asm-dai is performing an extra layer of calculation on the hw_ptr, which is always prone to errors and redundant. q6asm already has tokens to indentify the pointer pointers which an be used to get the hw_ptr and this is more accurate then doing the artificial calculation at upper layers. Add helper function q6asm_get_hw_pointer() to get this hw_ptr. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-8-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit e386c2cf3df2b62a6cc78d2f7984102b64753bee Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:30 2025 +0100 ASoC: qcom: q6asm-dai: schedule all available frames to avoid dsp under-runs With the existing code, we are only setting up one period at a time, in a ping-pong buffer style. This triggers lot of underruns in the dsp leading to jitter noise during audio playback. Fix this by scheduling all available periods, this will ensure that the dsp has enough buffer feed and ultimatley fixing the underruns and audio distortion. Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-7-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit a354f030dbce17ab3cf299660a38b162d97f7151 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:29 2025 +0100 ASoC: qcom: q6asm: handle the responses after closing For record path, multiple read requests are queued to dsp in advance. However when data stream is closed, the pending read requests are rejected by the dsp and a response is sent to the driver, this case is not handled in the driver resulting in errors like below q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: command[0x10dac] not expecting rsp q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: command[0x10dac] not expecting rsp q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: command[0x10dac] not expecting rsp This is same for both write and eos. Fix this by allowing ASM_DATA_CMD_READ_V2, ASM_DATA_CMD_EOS and ASM_DATA_CMD_WRITE_V2 as expected response. Reported-by: Martino Facchin Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-6-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit bfbb12dfa144d45575bcfe139a71360b3ce80237 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:28 2025 +0100 ASoC: qcom: q6asm-dai: perform correct state check before closing Do not stop a q6asm stream if its not started, this can result in unnecessary dsp command which will timeout anyway something like below: q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: CMD 10bcd timeout Fix this by correctly checking the state. Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 81c53b52de21b8d5a3de55ebd06b6bf188bf7efd Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:27 2025 +0100 ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. DSP expects the periods to be aligned to fragment sizes, currently setting up to hw constriants on periods bytes is not going to work correctly as we can endup with periods sizes aligned to 32 bytes however not aligned to fragment size. Update the constriants to use fragment size, and also set at step of 10ms for period size to accommodate DSP requirements of 10ms latency. Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 74cc4f3ea4e99262ba0d619c6a4ee33e2cd47f65 Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:26 2025 +0100 ASoC: qcom: q6adm: the the copp device only during last instance A matching Common object post processing instance is normally resused across multiple streams. However currently we close this on DSP even though there is a refcount on this copp object, this can result in below error. q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0 qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2 q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2] q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0 qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2 q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2] qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2 qcom-q6adm aprsvc:service:4:8: DSP returned error[2] qcom-q6adm aprsvc:service:4:8: Failed to close copp -22 qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2 qcom-q6adm aprsvc:service:4:8: DSP returned error[2] qcom-q6adm aprsvc:service:4:8: Failed to close copp -22 Fix this by addressing moving the adm_close to copp_kref destructor callback. Fixes: 7b20b2be51e1 ("ASoC: qdsp6: q6adm: Add q6adm driver") Cc: Stable@vger.kernel.org Reported-by: Martino Facchin Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit 950a4e5788fc7dc6e8e93614a7d4d0449c39fb8d Author: Srinivas Kandagatla Date: Thu Oct 23 11:24:25 2025 +0100 ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr Driver does not expect the appl_ptr to move backward and requires explict sync. Make sure that the userspace does not do appl_ptr rewinds by specifying the correct flags in pcm_info. Without this patch, the result could be a forever loop as current logic assumes that appl_ptr can only move forward. Fixes: 3d4a4411aa8b ("ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs") Cc: Stable@vger.kernel.org Signed-off-by: Srinivas Kandagatla Tested-by: Alexey Klimov # RB5, RB3 Link: https://patch.msgid.link/20251023102444.88158-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown commit ae83f3b72621bd3187eb7956c7c2993a97d4b187 Author: Kees Cook Date: Thu Oct 9 20:06:09 2025 -0700 module: Add compile-time check for embedded NUL characters Long ago, the kernel module license checks were bypassed by embedding a NUL character in the MODULE_LICENSE() string[1]. By using a string like "GPL\0proprietary text", the kernel would only read "GPL" due to C string termination at the NUL byte, allowing proprietary modules to avoid kernel tainting and access GPL-only symbols. The MODULE_INFO() macro stores these strings in the .modinfo ELF section, and get_next_modinfo() uses strcmp()-family functions which stop at the first NUL. This split the embedded string into two separate .modinfo entries, with only the first part being processed by license_is_gpl_compatible(). Add a compile-time check using static_assert that compares the full string length (sizeof - 1) against __builtin_strlen(), which stops at the first NUL. If they differ, compilation fails with a clear error message. While this check can still be circumvented by modifying the ELF binary post-compilation, it prevents accidental embedded NULs and forces intentional abuse to require deliberate binary manipulation rather than simple source-level tricks. Build tested with test modules containing both valid and invalid license strings. The check correctly rejects: MODULE_LICENSE("GPL\0proprietary") while accepting normal declarations: MODULE_LICENSE("GPL") Link: https://lwn.net/Articles/82305/ [1] Suggested-by: Rusty Russell Signed-off-by: Kees Cook Reviewed-by: Daniel Gomez Reviewed-by: Aaron Tomlin Reviewed-by: Petr Pavlu Tested-by: Daniel Gomez Signed-off-by: Daniel Gomez commit 57e9853737e2e4c948d5c62f85c814bb406c2d6f Author: Kees Cook Date: Thu Oct 9 20:06:08 2025 -0700 media: radio: si470x: Fix DRIVER_AUTHOR macro definition The DRIVER_AUTHOR macro incorrectly included a semicolon in its string literal definition. Right now, this wasn't causing any real problem, but coming changes to the MODULE_INFO() macro make this more sensitive. Specifically, when used with MODULE_AUTHOR(), this created syntax errors during macro expansion: MODULE_AUTHOR(DRIVER_AUTHOR); expands to: MODULE_INFO(author, "Joonyoung Shim ";) ^ syntax error Remove the trailing semicolon from the DRIVER_AUTHOR definition. Semicolons should only appear at the point of use, not in the macro definition. Reviewed-by: Hans Verkuil Signed-off-by: Kees Cook Reviewed-by: Mauro Carvalho Chehab Reviewed-by: Daniel Gomez Tested-by: Daniel Gomez Signed-off-by: Daniel Gomez commit 9de2198ab975a07c1160e8ece6a28a41fdff2cfd Author: Kees Cook Date: Thu Oct 9 20:06:07 2025 -0700 media: dvb-usb-v2: lmedm04: Fix firmware macro definitions The firmware filename macros incorrectly included semicolons in their string literal definitions. Right now, this wasn't causing any real problem, but coming changes to the MODULE_INFO() macro make this more sensitive. Specifically, when used with MODULE_FIRMWARE(), this created syntax errors during macro expansion: MODULE_FIRMWARE(LME2510_C_S7395); expands to: MODULE_INFO(firmware, "dvb-usb-lme2510c-s7395.fw";) ^ syntax error Remove the trailing semicolons from all six firmware filename macro definitions. Semicolons should only appear at the point of use, not in the macro definition. Reviewed-by: Hans Verkuil Signed-off-by: Kees Cook Reviewed-by: Mauro Carvalho Chehab Reviewed-by: Daniel Gomez Tested-by: Daniel Gomez Signed-off-by: Daniel Gomez commit cf76553aaa363620f58a6b6409bf544f4bcfa8de Author: Peter Zijlstra Date: Wed Nov 5 11:00:14 2025 +0100 entry,unwind/deferred: Fix unwind_reset_info() placement Stephen reported that on KASAN builds he's seeing: vmlinux.o: warning: objtool: user_exc_vmm_communication+0x15a: call to __kasan_check_read() leaves .noinstr.text section vmlinux.o: warning: objtool: exc_debug_user+0x182: call to __kasan_check_read() leaves .noinstr.text section vmlinux.o: warning: objtool: exc_int3+0x123: call to __kasan_check_read() leaves .noinstr.text section vmlinux.o: warning: objtool: noist_exc_machine_check+0x17a: call to __kasan_check_read() leaves .noinstr.text section vmlinux.o: warning: objtool: fred_exc_machine_check+0x17e: call to __kasan_check_read() leaves .noinstr.text section This turns out to be atomic ops from unwind_reset_info() that have explicit instrumentation. Place unwind_reset_info() in the preceding instrumentation_begin() section. Fixes: c6439bfaabf2 ("Merge tag 'trace-deferred-unwind-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace") Reported-by: Stephen Rothwell Reported-by: Ingo Molnar Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20251105100014.GY4068168@noisy.programming.kicks-ass.net commit b88827cb0bd1a192855db40494970bbdd7aad939 Author: Frank Wunderlich Date: Mon Oct 27 14:28:12 2025 +0100 dt-bindings: arm: mediatek: add BPI-R4 Pro board Add compatibles for Bananapi R4 Pro boards. Signed-off-by: Frank Wunderlich Reviewed-by: Krzysztof Kozlowski Signed-off-by: AngeloGioacchino Del Regno commit 0d534518ce87317e884dbd1485111b0f1606a194 Merge: 3a8660878839fa 009a2ba40303cb Author: Christian Brauner Date: Wed Nov 5 13:45:26 2025 +0100 Merge patch series "Fix two syzbot corruption bugs in minix filesystem" Jori Koolstra says: Syzbot fuzzes /fs by trying to mount and manipulate deliberately corrupted filesystems. This should not lead to BUG_ONs and WARN_ONs for easy to detect corruptions. This series adds code to be able to report such corruptions and fixes two syzbot bugs on this kind. * patches from https://patch.msgid.link/20251104143005.3283980-1-jkoolstra@xs4all.nl: Fix a drop_nlink warning in minix_rename Fix a drop_nlink warning in minix_rmdir Add error handling to minix filesystem for inode corruption detection Link: https://patch.msgid.link/20251104143005.3283980-1-jkoolstra@xs4all.nl Signed-off-by: Christian Brauner commit 009a2ba40303cb1e3556c41233338e609ac509ea Author: Jori Koolstra Date: Tue Nov 4 15:30:05 2025 +0100 Fix a drop_nlink warning in minix_rename Syzbot found a drop_nlink warning that is triggered by an easy to detect nlink corruption. This patch adds sanity checks to minix_unlink and minix_rename to prevent the warning and instead return EFSCORRUPTED to the caller. The changes were tested using the syzbot reproducer as well as local testing. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20251104143005.3283980-4-jkoolstra@xs4all.nl Reviewed-by: Jan Kara Reported-by: syzbot+a65e824272c5f741247d@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=a65e824272c5f741247d Signed-off-by: Christian Brauner commit d3e0e8661ceb4fe3aab85af3730dbf41240d561f Author: Jori Koolstra Date: Tue Nov 4 15:30:04 2025 +0100 Fix a drop_nlink warning in minix_rmdir Syzbot found a drop_nlink warning that is triggered by an easy to detect nlink corruption of a directory. This patch adds a sanity check to minix_rmdir to prevent the warning and instead return EFSCORRUPTED to the caller. The changes were tested using the syzbot reproducer as well as local testing. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20251104143005.3283980-3-jkoolstra@xs4all.nl Reviewed-by: Jan Kara Reported-by: syzbot+4e49728ec1cbaf3b91d2@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=4e49728ec1cbaf3b91d2 Signed-off-by: Christian Brauner commit 21215ce7a95ae03891708028a8c805e5dc47395e Author: Jori Koolstra Date: Tue Nov 4 15:30:03 2025 +0100 Add error handling to minix filesystem for inode corruption detection We would like to provide early and specific warnings of filesystem corruption without running into generic WARN_ONs and BUG_ONs. Towards this goal, ext4, e.g., has a EFSCORRUPTED errno and a standardized inode corruption message format. This patch adds this errno and message format to the minix filesystem. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20251104143005.3283980-2-jkoolstra@xs4all.nl Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 34da4a5d6814ca4cd0116144e37433bf55cf0189 Author: Yazen Ghannam Date: Tue Nov 4 14:55:38 2025 +0000 x86/mce: Unify AMD THR handler with MCA Polling AMD systems optionally support an MCA thresholding interrupt. The interrupt should be used as another signal to trigger MCA polling. This is similar to how the Intel Corrected Machine Check interrupt (CMCI) is handled. AMD MCA thresholding is managed using the MCA_MISC registers within an MCA bank. The OS will need to modify the hardware error count field in order to reset the threshold limit and rearm the interrupt. Management of the MCA_MISC register should be done as a follow up to the basic MCA polling flow. It should not be the main focus of the interrupt handler. Furthermore, future systems will have the ability to send an MCA thresholding interrupt to the OS even when the OS does not manage the feature, i.e. MCA_MISC registers are Read-as-Zero/Locked. Call the common MCA polling function when handling the MCA thresholding interrupt. This will allow the OS to find any valid errors whether or not the MCA thresholding feature is OS-managed. Also, this allows the common MCA polling options and kernel parameters to apply to AMD systems. Add a callback to the MCA polling function to check and reset any threshold blocks that have reached their threshold limit. Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20251104-wip-mca-updates-v8-0-66c8eacf67b9@amd.com commit 34194cb385033656d347ebe45c241e4739a58125 Author: Stanimir Varbanov Date: Fri Oct 31 20:33:07 2025 +0200 dt-bindings: soc: bcm: Add bcm2712 compatible Add bcm2712-pm compatible and update the bindings to satisfy it's requirements. The PM hardware block inside bcm2712 lacks the "asb" and "rpivid_asb" register ranges and also does not have clocks, update the bindings accordingly. Signed-off-by: Stanimir Varbanov Reviewed-by: Florian Fainelli Acked-by: Conor Dooley Signed-off-by: Ulf Hansson commit 41f4767000667f402be2f1ccd70cd215bfc41ec3 Author: Marc Herbert Date: Mon Nov 3 03:08:11 2025 +0000 x86/msr: Add CPU_OUT_OF_SPEC taint name to "unrecognized" pr_warn(msg) While restricting access, a7e1f67ed29f ("x86/msr: Filter MSR writes") also added warning and started tainting the kernel. But the warning message never mentioned tainting. Moreover, this uses the "CPU_OUT_OF_SPEC" flag which is not clearly related to MSRs: that flag is overloaded by several, fairly different situations, including some much scarier ones. So, without an expert around (thank you Dave Hansen), it would have been practically impossible to root cause the tainting from just the log file at hand. So it would be prudent to explicitly mention in the logs when the tainting happens so that debugging crashes can be made easier. Fix this by simply appending the CPU_OUT_OF_SPEC flag to the warning message. This readability issue happened when staring at logs involving the Intel Memory Latency Checker (among many other things going on in that log). The MLC disables hardware prefetch. [ bp: Massage and extend commit message. ] Signed-off-by: Marc Herbert Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20251101-tainted-msr-v1-1-e00658ba04d4@linux.intel.com commit ca3557a6868478268a6f8ab71268dd75eb47e875 Merge: 560507cbc151cf 8caec6c9fef70c Author: Christian Brauner Date: Wed Nov 5 13:09:32 2025 +0100 Merge patch series "alloc misaligned vectors for zoned XFS v2" Christoph Hellwig says: This series enables the new block layer support for misaligned individual vectors for zoned XFS. The first patch is the from Qu and supposedly already applied to the vfs iomap 6.19 branch, but I can't find it there. The next two are small fixups for it, and the last one makes use of this new functionality in XFS. * patches from https://patch.msgid.link/20251031131045.1613229-1-hch@lst.de: xfs: support sub-block aligned vectors in always COW mode iomap: add IOMAP_DIO_FSBLOCK_ALIGNED flag Link: https://patch.msgid.link/20251031131045.1613229-1-hch@lst.de Signed-off-by: Christian Brauner commit 8caec6c9fef70c0d0ce1bf38ad343e18e5e1f6a0 Author: Christoph Hellwig Date: Fri Oct 31 14:10:27 2025 +0100 xfs: support sub-block aligned vectors in always COW mode Now that the block layer and iomap have grown support to indicate the bio sector size explicitly instead of assuming the device sector size, we can ask for logical block size alignment and thus support direct I/O writes where the overall size is logical block size aligned, but the boundaries between vectors might not be. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251031131045.1613229-3-hch@lst.de Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 001397f5ef4908ea46a63059439e8c3bf3552d9f Author: Qu Wenruo Date: Fri Oct 31 14:10:26 2025 +0100 iomap: add IOMAP_DIO_FSBLOCK_ALIGNED flag Btrfs requires all of its bios to be fs block aligned, normally it's totally fine but with the incoming block size larger than page size (bs > ps) support, the requirement is no longer met for direct IOs. Because iomap_dio_bio_iter() calls bio_iov_iter_get_pages(), only requiring alignment to be bdev_logical_block_size(). In the real world that value is either 512 or 4K, on 4K page sized systems it means bio_iov_iter_get_pages() can break the bio at any page boundary, breaking btrfs' requirement for bs > ps cases. To address this problem, introduce a new public iomap dio flag, IOMAP_DIO_FSBLOCK_ALIGNED. When calling __iomap_dio_rw() with that new flag, iomap_dio::flags will inherit that new flag, and iomap_dio_bio_iter() will take fs block size into the calculation of the alignment, and pass the alignment to bio_iov_iter_get_pages(), respecting the fs block size requirement. The initial user of this flag will be btrfs, which needs to calculate the checksum for direct read and thus requires the biovec to be fs block aligned for the incoming bs > ps support. Signed-off-by: Qu Wenruo Reviewed-by: Pankaj Raghav [hch: also align pos/len, incorporate the trace flags from Darrick] Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20251031131045.1613229-2-hch@lst.de Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 560507cbc151cf5c02d8831781e4912e64587298 Merge: 4966b46652680b 66d78a11479cfe Author: Christian Brauner Date: Tue Oct 7 13:11:16 2025 +0200 Merge patch series "iomap: zero range folio batch support" Brian Foster says: This adds folio batch support for iomap. This initially only targets zero range, the use case being zeroing of dirty folios over unwritten mappings. There is potential to support other operations in the future: iomap seek data/hole has similar raciness issues as zero range, the prospect of using this for buffered write has been raised for granular locking purposes, etc. The one major caveat with this zero range implementation is that it doesn't look at iomap_folio_state to determine whether to zero a sub-folio portion of the folio. Instead it just relies on whether the folio was dirty or not. This means that spurious zeroing of unwritten ranges is possible if a folio is dirty but the target range includes a subrange that is not. The reasoning is that this is essentially a complexity tradeoff. The current use cases for iomap_zero_range() are limited mostly to partial block zeroing scenarios. It's relatively harmless to zero an unwritten block (i.e. not a correctness issue), and this is something that filesystems have done in the past without much notice or issue. The advantage is less code and this makes it a little easier to use a filemap lookup function for the batch rather than open coding more logic in iomap. That said, this can probably be enhanced to look at ifs in the future if the use case expands and/or other operations justify it. WRT testing, I've tested with and without a local hack to redirect fallocate zero range calls to iomap_zero_range() in XFS. This helps test beyond the partial block/folio use case, i.e. to cover boundary conditions like full folio batch handling, etc. I recently added patch 7 in spirit of that, which turns this logic into an XFS errortag. Further comments on that are inline with patch 7. * patches from https://lore.kernel.org/20251003134642.604736-1-bfoster@redhat.com: xfs: error tag to force zeroing on debug kernels iomap: remove old partial eof zeroing optimization xfs: fill dirty folios on zero range of unwritten mappings xfs: always trim mapping to requested range for zero range iomap: optional zero range dirty folio processing iomap: remove pos+len BUG_ON() to after folio lookup filemap: add helper to look up dirty folios in a range Signed-off-by: Christian Brauner commit 66d78a11479cfea00e8d1d9d3e33f3db1597e6bf Author: Brian Foster Date: Fri Oct 3 09:46:41 2025 -0400 xfs: error tag to force zeroing on debug kernels iomap_zero_range() has to cover various corner cases that are difficult to test on production kernels because it is used in fairly limited use cases. For example, it is currently only used by XFS and mostly only in partial block zeroing cases. While it's possible to test most of these functional cases, we can provide more robust test coverage by co-opting fallocate zero range to invoke zeroing of the entire range instead of the more efficient block punch/allocate sequence. Add an errortag to occasionally invoke forced zeroing. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 39be21386d14974393ac45eda11942989720f81b Author: Brian Foster Date: Fri Oct 3 09:46:40 2025 -0400 iomap: remove old partial eof zeroing optimization iomap_zero_range() optimizes the partial eof block zeroing use case by force zeroing if the mapping is dirty. This is to avoid frequent flushing on file extending workloads, which hurts performance. Now that the folio batch mechanism provides a more generic solution and is used by the only real zero range user (XFS), this isolated optimization is no longer needed. Remove the unnecessary code and let callers use the folio batch or fall back to flushing by default. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 77c475692c5e4e72eee9de869056008e62d3733b Author: Brian Foster Date: Fri Oct 3 09:46:39 2025 -0400 xfs: fill dirty folios on zero range of unwritten mappings Use the iomap folio batch mechanism to select folios to zero on zero range of unwritten mappings. Trim the resulting mapping if the batch is filled (unlikely for current use cases) to distinguish between a range to skip and one that requires another iteration due to a full batch. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 5c13dde963dfe38ad88757e53d1fb8883cd01385 Author: Brian Foster Date: Fri Oct 3 09:46:38 2025 -0400 xfs: always trim mapping to requested range for zero range Refactor and tweak the IOMAP_ZERO logic in preparation to support filling the folio batch for unwritten mappings. Drop the superfluous imap offset check since the hole case has already been filtered out. Split the the delalloc case handling into a sub-branch, and always trim the imap to the requested offset/count so it can be more easily used to bound the range to lookup in pagecache. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 4966b46652680b2d86b8a59319d4f529edf20187 Merge: 7aa6bc3e876699 93570c652b80cd Author: Christian Brauner Date: Mon Sep 29 11:38:29 2025 +0200 Merge patch series "fuse: use iomap for buffered reads + readahead" Joanne Koong says: This series adds fuse iomap support for buffered reads and readahead. This is needed so that granular uptodate tracking can be used in fuse when large folios are enabled so that only the non-uptodate portions of the folio need to be read in instead of having to read in the entire folio. It also is needed in order to turn on large folios for servers that use the writeback cache since otherwise there is a race condition that may lead to data corruption if there is a partial write, then a read and the read happens before the write has undergone writeback, since otherwise the folio will not be marked uptodate from the partial write so the read will read in the entire folio from disk, which will overwrite the partial write. This is on top of two locally-patched iomap patches [1] [2] patched on top of commit f1c864be6e88 ("Merge branch 'vfs-6.18.async' into vfs.all") in Christian's vfs.all tree. This series was run through fstests on fuse passthrough_hp with an out-of kernel patch enabling fuse large folios. This patchset does not enable large folios on fuse yet. That will be part of a different patchset. * patches from https://lore.kernel.org/20250926002609.1302233-1-joannelkoong@gmail.com: fuse: remove fc->blkbits workaround for partial writes fuse: use iomap for readahead fuse: use iomap for read_folio iomap: make iomap_read_folio() a void return iomap: move buffered io bio logic into new file iomap: add caller-provided callbacks for read and readahead iomap: set accurate iter->pos when reading folio ranges iomap: track pending read bytes more optimally iomap: rename iomap_readpage_ctx struct to iomap_read_folio_ctx iomap: rename iomap_readpage_iter() to iomap_read_folio_iter() iomap: iterate over folio mapping in iomap_readpage_iter() iomap: store read/readahead bio generically iomap: move read/readahead bio submission logic into helper function iomap: move bio read logic into helper function Signed-off-by: Christian Brauner commit 395ed1ef0012e1bb1e4050e84ba0173b3623112a Author: Brian Foster Date: Fri Oct 3 09:46:37 2025 -0400 iomap: optional zero range dirty folio processing The only way zero range can currently process unwritten mappings with dirty pagecache is to check whether the range is dirty before mapping lookup and then flush when at least one underlying mapping is unwritten. This ordering is required to prevent iomap lookup from racing with folio writeback and reclaim. Since zero range can skip ranges of unwritten mappings that are clean in cache, this operation can be improved by allowing the filesystem to provide a set of dirty folios that require zeroing. In turn, rather than flush or iterate file offsets, zero range can iterate on folios in the batch and advance over clean or uncached ranges in between. Add a folio_batch in struct iomap and provide a helper for filesystems to populate the batch at lookup time. Update the folio lookup path to return the next folio in the batch, if provided, and advance the iter if the folio starts beyond the current offset. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 93570c652b80cd632dc49b590a35d3f0e268893b Author: Joanne Koong Date: Thu Sep 25 17:26:09 2025 -0700 fuse: remove fc->blkbits workaround for partial writes Now that fuse is integrated with iomap for read/readahead, we can remove the workaround that was added in commit bd24d2108e9c ("fuse: fix fuseblk i_blkbits for iomap partial writes"), which was previously needed to avoid a race condition where an iomap partial write may be overwritten by a read if blocksize < PAGE_SIZE. Now that fuse does iomap read/readahead, this is protected against since there is granular uptodate tracking of blocks, which means this workaround can be removed. Signed-off-by: Joanne Koong Tested-by: syzbot@syzkaller.appspotmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 49590716be886cc3cbbac10964eac551cfe570b2 Author: Brian Foster Date: Fri Oct 3 09:46:36 2025 -0400 iomap: remove pos+len BUG_ON() to after folio lookup The bug checks at the top of iomap_write_begin() assume the pos/len reflect exactly the next range to process. This may no longer be the case once the get folio path is able to process a folio batch from the filesystem. On top of that, len is already trimmed to within the iomap/srcmap by iomap_length(), so these checks aren't terribly useful. Remove the unnecessary BUG_ON() checks. Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 4ea907108a5ca800e91708f0dbbe01bc95f8f5af Author: Joanne Koong Date: Thu Sep 25 17:26:08 2025 -0700 fuse: use iomap for readahead Do readahead in fuse using iomap. This gives us granular uptodate tracking for large folios, which optimizes how much data needs to be read in. If some portions of the folio are already uptodate (eg through a prior write), we only need to read in the non-uptodate portions. Signed-off-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit f8d98072feee32722086ddae4f288b6c45ae4330 Author: Brian Foster Date: Fri Oct 3 09:46:35 2025 -0400 filemap: add helper to look up dirty folios in a range Add a new filemap_get_folios_dirty() helper to look up existing dirty folios in a range and add them to a folio_batch. This is to support optimization of certain iomap operations that only care about dirty folios in a target range. For example, zero range only zeroes the subset of dirty pages over unwritten mappings, seek hole/data may use similar logic in the future, etc. Note that the helper is intended for use under internal fs locks. Therefore it trylocks folios in order to filter out clean folios. This loosely follows the logic from filemap_range_has_writeback(). Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 03e9618e82402e2aa9cc747793343768ced61a55 Author: Joanne Koong Date: Thu Sep 25 17:26:07 2025 -0700 fuse: use iomap for read_folio Read folio data into the page cache using iomap. This gives us granular uptodate tracking for large folios, which optimizes how much data needs to be read in. If some portions of the folio are already uptodate (eg through a prior write), we only need to read in the non-uptodate portions. Signed-off-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit d4e88bb08e5f7e6eb4e9c3685894b9b57bfdfb08 Author: Joanne Koong Date: Thu Sep 25 17:26:06 2025 -0700 iomap: make iomap_read_folio() a void return No errors are propagated in iomap_read_folio(). Change iomap_read_folio() to a void return to make this clearer to callers. Signed-off-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit c2b1adc4624573f9d5a35ccb8ebe31eb1bdb0d22 Author: Christoph Hellwig Date: Thu Sep 25 17:26:05 2025 -0700 iomap: move buffered io bio logic into new file Move bio logic in the buffered io code into its own file and remove CONFIG_BLOCK gating for iomap read/readahead. [1] https://lore.kernel.org/linux-fsdevel/aMK2GuumUf93ep99@infradead.org/ Signed-off-by: Christoph Hellwig Signed-off-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit b2f35ac4146d32d4424aaa941bbc681f12c1b9e6 Author: Joanne Koong Date: Thu Sep 25 17:26:04 2025 -0700 iomap: add caller-provided callbacks for read and readahead Add caller-provided callbacks for read and readahead so that it can be used generically, especially by filesystems that are not block-based. In particular, this: * Modifies the read and readahead interface to take in a struct iomap_read_folio_ctx that is publicly defined as: struct iomap_read_folio_ctx { const struct iomap_read_ops *ops; struct folio *cur_folio; struct readahead_control *rac; void *read_ctx; }; where struct iomap_read_ops is defined as: struct iomap_read_ops { int (*read_folio_range)(const struct iomap_iter *iter, struct iomap_read_folio_ctx *ctx, size_t len); void (*read_submit)(struct iomap_read_folio_ctx *ctx); }; read_folio_range() reads in the folio range and is required by the caller to provide. read_submit() is optional and is used for submitting any pending read requests. * Modifies existing filesystems that use iomap for read and readahead to use the new API, through the new statically inlined helpers iomap_bio_read_folio() and iomap_bio_readahead(). There is no change in functionality for those filesystems. Signed-off-by: Joanne Koong Signed-off-by: Christian Brauner commit fb7a10ac4704fe2df12fcc560c0b49a69e016af0 Author: Joanne Koong Date: Thu Sep 25 17:26:03 2025 -0700 iomap: set accurate iter->pos when reading folio ranges Advance iter to the correct position before calling an IO helper to read in a folio range. This allows the helper to reliably use iter->pos to determine the starting offset for reading. This will simplify the interface for reading in folio ranges when iomap read/readahead supports caller-provided callbacks. Signed-off-by: Joanne Koong Suggested-by: Christoph Hellwig Signed-off-by: Christian Brauner commit d43558ae67299266ea54715773610fdec4291c90 Author: Joanne Koong Date: Thu Sep 25 17:26:02 2025 -0700 iomap: track pending read bytes more optimally Instead of incrementing read_bytes_pending for every folio range read in (which requires acquiring the spinlock to do so), set read_bytes_pending to the folio size when the first range is asynchronously read in, keep track of how many bytes total are asynchronously read in, and adjust read_bytes_pending accordingly after issuing requests to read in all the necessary ranges. iomap_read_folio_ctx->cur_folio_in_bio can be removed since a non-zero value for pending bytes necessarily indicates the folio is in the bio. Signed-off-by: Joanne Koong Suggested-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 2f538ef9f6f7c3d700c68536f21447dfc598f8c8 Author: Chin-Ting Kuo Date: Wed Nov 5 16:49:52 2025 +0800 spi: aspeed: Use devm_iounmap() to unmap devm_ioremap() memory The AHB IO memory for each chip select is mapped using devm_ioremap(), so it should be unmapped using devm_iounmap() to ensure proper device-managed resource cleanup. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510292356.JnTUBxCl-lkp@intel.com/ Signed-off-by: Chin-Ting Kuo Reviewed-by: Cédric Le Goater Link: https://patch.msgid.link/20251105084952.1063489-1-chin-ting_kuo@aspeedtech.com Signed-off-by: Mark Brown commit aa897ffc396b48cc39eee133b6b43175d0df9eb5 Author: Ranganath V N Date: Tue Nov 4 16:04:58 2025 +0530 ASoC: dt-bindings: ti,pcm1862: convert to dtschema convert the Texas Instruments PCM186x Universal audio ADC bindings to DT schema. The PCM186x codec provides a single digital audio interface. Therefore this binding adds a reference to dai-common.yaml and defines '#sound-dai-cells = 0". Signed-off-by: Ranganath V N Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251104-dtbs-v7-1-224aacb09671@gmail.com Signed-off-by: Mark Brown commit 8b6faa7fddf0ae69c5f1a9315a64edee6f022037 Merge: ecd0de438c1f0e 380fd29d57abe6 Author: Mark Brown Date: Wed Nov 5 11:54:48 2025 +0000 spi: tegra210-quad: Improve timeout handling under Merge series from Vishwaroop A : This patch series addresses timeout handling issues in the Tegra QSPI driver that occur under high system load conditions. We've observed that when CPUs are saturated (due to error injection, RAS firmware activity, or general CPU contention), QSPI interrupt handlers can be delayed, causing spurious transfer failures even though the hardware completed the operation successfully. These changes have been tested in production environments under various high load scenarios including RAS testing and CPU saturation workloads. commit a6446829f841bf108fca8ca1e8f4f67b3a59d86c Author: Kaushlendra Kumar Date: Mon Nov 3 13:36:27 2025 +0530 init: Replace simple_strtoul() with kstrtouint() in root_delay_setup() Replace deprecated simple_strtoul() with kstrtouint() for better error handling and input validation. Return 0 on parsing failure to indicate invalid parameter, maintaining existing behavior for valid inputs. The simple_strtoul() function is deprecated in favor of kstrtoint() family functions which provide better error handling and are recommended for new code and replacements. Signed-off-by: Kaushlendra Kumar Link: https://patch.msgid.link/20251103080627.1844645-1-kaushlendra.kumar@intel.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit a4db63b88f16b8a0dae0bf1d8651f7d3c0d24072 Merge: 20052f2ef08a74 2706659d642eb6 Author: Christian Brauner Date: Wed Nov 5 12:30:05 2025 +0100 Merge patch series "fs: fully sync all fsese even for an emergency sync" Qu Wenruo says: The first patch is a cleanup related to sync_inodes_one_sb() callback. Since it always wait for the writeback, there is no need to pass any parameter for it. The second patch is a fix mostly affecting btrfs, as btrfs requires a explicit sync_fc() call with wait == 1, to commit its super blocks, and sync_bdevs() won't cut it at all. However the current emergency sync never passes wait == 1, it means btrfs will writeback all dirty data and metadata, but still no super block update, resulting everything still pointing back to the old data/metadata. This lead to a problem where btrfs doesn't seem to do anything during emergency sync. The second patch fixes the problem by passing wait == 1 for the second iteration of sync_fs_one_sb(). * patches from https://patch.msgid.link/cover.1762142636.git.wqu@suse.com: fs: fully sync all fses even for an emergency sync fs: do not pass a parameter for sync_inodes_one_sb() Link: https://patch.msgid.link/cover.1762142636.git.wqu@suse.com Signed-off-by: Christian Brauner commit 2706659d642eb6b2d659aab52c122d6170e59dd0 Author: Qu Wenruo Date: Mon Nov 3 14:37:29 2025 +1030 fs: fully sync all fses even for an emergency sync [BUG] There is a bug report that during emergency sync, btrfs only write back all the dirty data and metadadta, but no full transaction commit, resulting the super block still pointing to the old trees, thus the end user can only see the old data, not the newer one. [CAUSE] Initially this looks like a btrfs specific bug, since ext4 doesn't get affected by this one. But the root problem here is, a combination of btrfs features and the no wait nature of emergency sync. Firstly do_sync_work() will call sync_inodes_one_sb() for every fs, to writeback all the dirty pages for the fs. Btrfs will properly writeback all dirty pages, including both data and the updated metadata. So far so good. Then sync_fs_one_sb() called with @nowait, in the case of btrfs it means no full transaction commit, thus no super block update. At this stage, btrfs is only one super block update away to be fully committed. I believe it's the more or less the same for other fses too. The problem is the next step, sync_bdevs(). Normally other fses have their super block already updated in the page cache of the block device, but btrfs only updates the super block during full transaction commit. So sync_bdevs() may work for other fses, but not for btrfs, btrfs is still using its older super block, all pointing back to the old metadata and data. Thus if after emergency sync, power loss happened, the end user will only see the old data, not the newer one, despite that everything but the super block is already written back. [FIX] Since the emergency sync is already executing in a workqueue, I didn't see much need to only do a nowait sync. Especially after the fact that sync_inodes_one_sb() always wait for the writeback to finish. Instead for the second iteration of sync_fs_one_sb(), pass wait == 1 into it, so fses like btrfs can properly commit its super blocks. Reported-by: Askar Safin Link: https://lore.kernel.org/linux-btrfs/20251101150429.321537-1-safinaskar@gmail.com/ Signed-off-by: Qu Wenruo Link: https://patch.msgid.link/7b7fd40c5fe440b633b6c0c741d96ce93eb5a89a.1762142636.git.wqu@suse.com Signed-off-by: Christian Brauner commit fbc22c29963668e8d5eac603ab2b90b844df9787 Author: Qu Wenruo Date: Mon Nov 3 14:37:28 2025 +1030 fs: do not pass a parameter for sync_inodes_one_sb() The function sync_inodes_one_sb() will always wait for the writeback, and ignore the optional parameter. Explicitly pass NULL as parameter for the call sites inside do_sync_work(). Signed-off-by: Qu Wenruo Link: https://patch.msgid.link/8079af1c4798cb36887022a8c51547a727c353cf.1762142636.git.wqu@suse.com Signed-off-by: Christian Brauner commit ade19c5060dfa39b84a9475a4a6b05e2a8a2b3ac Author: Alexandre Courbot Date: Wed Oct 29 00:07:40 2025 +0900 gpu: nova-core: vbios: use FromBytes for NpdeStruct Use `from_bytes_copy_prefix` to create `NpdeStruct` instead of building it ourselves from the bytes stream. This lets us remove a few array accesses and results in shorter code. Reviewed-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-vbios-frombytes-v1-5-ac441ebc1de3@nvidia.com> commit 46768644a164f0f5eaa06fdf93718edcbbc47b64 Author: Alexandre Courbot Date: Wed Oct 29 00:07:39 2025 +0900 gpu: nova-core: vbios: use FromBytes for BitHeader Use `from_bytes_copy_prefix` to create `BitHeader` instead of building it ourselves from the bytes stream. This lets us remove a few array accesses and results in shorter code. Reviewed-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-vbios-frombytes-v1-4-ac441ebc1de3@nvidia.com> commit 56bb4b17a696a91aeaf7939d467a4f586edb01c6 Author: Alexandre Courbot Date: Wed Oct 29 00:07:38 2025 +0900 gpu: nova-core: vbios: use FromBytes for PcirStruct Use `from_bytes_copy_prefix` to create `PcirStruct` instead of building it ourselves from the bytes stream. This lets us remove a few array accesses and results in shorter code. Reviewed-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-vbios-frombytes-v1-3-ac441ebc1de3@nvidia.com> commit 7f74842d95d1a24c68d23320de4f3eb27e6ba82b Author: Alexandre Courbot Date: Wed Oct 29 00:07:37 2025 +0900 gpu: nova-core: vbios: use FromBytes for PmuLookupTable header Use `from_bytes_copy_prefix` to create the `PmuLookupTable` header instead of building it ourselves from the bytes stream. This lets us remove a few `as` conversions and array accesses. Reviewed-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-vbios-frombytes-v1-2-ac441ebc1de3@nvidia.com> commit e4ead68a390511384d6af7bc9d00835dd6185e3b Author: Alexandre Courbot Date: Wed Oct 29 00:07:36 2025 +0900 rust: transmute: add `from_bytes_prefix` family of methods The `from_bytes*` family of functions expect a slice of the exact same size as the requested type. This can be sometimes cumbersome for callers that deal with dynamic stream of data that needs to be manually cut before each invocation of `from_bytes`. To simplify such callers, introduce a new `from_bytes*_prefix` family of methods, which split the input slice at the index required for the equivalent `from_bytes` method to succeed, and return its result alongside with the remainder of the slice. This design is inspired by zerocopy's `try_*_from_prefix` family of methods. Reviewed-by: Joel Fernandes Reviewed-by: Danilo Krummrich Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-vbios-frombytes-v1-1-ac441ebc1de3@nvidia.com> Message-ID: <20251101-b4-frombytes-prefix-v1-1-0d9c1fd63b34@nvidia.com> commit b6d31cd41814a33c1a22b8c676131820440cc44e Author: Marco Crivellari Date: Fri Oct 31 12:16:28 2025 +0100 gpio: cdev: replace use of system_wq with system_percpu_wq Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. system_wq should be the per-cpu workqueue, yet in this name nothing makes that clear, so replace system_wq with system_percpu_wq. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Link: https://lore.kernel.org/r/20251031111628.143924-2-marco.crivellari@suse.com Signed-off-by: Bartosz Golaszewski commit 6126a7f27f002408803f3fc50ff610699e57601d Author: Marek Vasut Date: Tue Nov 4 14:56:06 2025 +0100 dt-bindings: gpu: img,powervr-rogue: Document GE7800 GPU in Renesas R-Car M3-N Document Imagination Technologies PowerVR Rogue GE7800 BNVC 15.5.1.64 present in Renesas R-Car R8A77965 M3-N SoC. Reviewed-by: Geert Uytterhoeven Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Reviewed-by: Matt Coster Link: https://patch.msgid.link/20251104135716.12497-2-marek.vasut+renesas@mailbox.org Signed-off-by: Matt Coster commit cc2a5cae75720b41ba58b7d3ce977e0729c9b82d Author: Marek Vasut Date: Tue Nov 4 14:56:05 2025 +0100 dt-bindings: gpu: img,powervr-rogue: Keep lists sorted alphabetically Sort the enum: list alphabetically. No functional change. Signed-off-by: Marek Vasut Reviewed-by: Krzysztof Kozlowski Reviewed-by: Matt Coster Link: https://patch.msgid.link/20251104135716.12497-1-marek.vasut+renesas@mailbox.org Signed-off-by: Matt Coster commit c84d874615d9da910186f4e5f00174b8036007ce Author: Alok Tiwari Date: Fri Oct 17 12:16:21 2025 -0700 drm: rcar-du: fix incorrect return in rcar_du_crtc_cleanup() The rcar_du_crtc_cleanup() function has a void return type, but incorrectly uses a return statement with a call to drm_crtc_cleanup(), which also returns void. Remove the return statement to ensure proper function semantics. No functional change intended. Signed-off-by: Alok Tiwari Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham Link: https://patch.msgid.link/20251017191634.1454201-1-alok.a.tiwari@oracle.com Signed-off-by: Tomi Valkeinen commit 355531a5ffd9e26f4d87ab34015c679e32d60e3c Author: Jason-JH Lin Date: Fri Oct 31 23:56:29 2025 +0800 arm64: dts: mediatek: Add GCE header for MT8196 Add GCE header define for GCE Thread Priority and GCE Event IDs that used in the MT8196 dtsi. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: AngeloGioacchino Del Regno commit c6dcf3283044533ec425eb45af3627ec8834aebe Author: Sjoerd Simons Date: Sat Nov 1 14:32:47 2025 +0100 arm64: dts: mediatek: mt7981b: Add reserved memory for TF-A Add memory range handled by ARM Trusted Firmware Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Sjoerd Simons Signed-off-by: AngeloGioacchino Del Regno commit 8bc650405f4476667973b10ec58152d37cd41a99 Author: Sjoerd Simons Date: Sat Nov 1 14:32:46 2025 +0100 arm64: dts: mediatek: mt7981b: Configure UART0 pinmux Add explicit pinctrl configuration for UART0 Signed-off-by: Sjoerd Simons Signed-off-by: AngeloGioacchino Del Regno commit 0485a18d9141775d54489997b284fe2557b5898e Author: Christian Brauner Date: Tue Nov 4 15:46:32 2025 +0100 fs: rename fs_types.h to fs_dirent.h We will split out a bunch of types into a separate header. So free up the appropriate name for it. Link: https://patch.msgid.link/20251104-work-fs-header-v1-1-fb39a2efe39e@kernel.org Signed-off-by: Christian Brauner commit 6303c0187f03ab47c748302f020789558d825f70 Author: Jason Gunthorpe Date: Thu Oct 23 15:22:38 2025 -0300 iommupt: Add a kunit test for the SW bits Add some basic checks that the sw_bit APIs work as expected. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 101a2854110fa8787226dae1202892071ff2c369 Author: Jason Gunthorpe Date: Thu Oct 23 15:22:37 2025 -0300 iommu/vt-d: Follow PT_FEAT_DMA_INCOHERENT into the PASID entry Currently a incoherent walk domain cannot be attached to a coherent capable iommu. Kevin says HW probably doesn't exist with such a mixture, but making the driver support it makes logical sense anyhow. When building the PASID entry the PWSNP (Page Walk Snoop) bit tells the HW if it should issue snoops. If the page table is cache flushed because of PT_FEAT_DMA_INCOHERENT then it is fine to set this bit to 0 even if the HW supports 1. Weaken the compatible check to permit a coherent instance to accept an incoherent table and fix the PASID table construction to set PWSNP from PT_FEAT_DMA_INCOHERENT. SVA always sets PWSNP. Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit d373449d8e97891434db0c64afca79d903c1194e Author: Jason Gunthorpe Date: Thu Oct 23 15:22:36 2025 -0300 iommu/vt-d: Use the generic iommu page table Replace the VT-d iommu_domain implementation of the VT-d second stage and first stage page tables with the iommupt VTDSS and x86_64 pagetables. x86_64 is shared with the AMD driver. There are a couple notable things in VT-d: - Like AMD the second stage format is not sign extended, unlike AMD it cannot decode a full 64 bits. The first stage format is a normal sign extended x86 page table - The HW caps can indicate how many levels, how many address bits and what leaf page sizes are supported in HW. As before the highest number of levels that can translate the entire supported address width is used. The supported page sizes are adjusted directly from the dedicated first/second stage cap bits. - VTD requires flushing 'write buffers'. This logic is left unchanged, the write buffer flushes on any gather flush or through iotlb_sync_map. - Like ARM, VTD has an optional non-coherent page table walker that requires cache flushing. This is supported through PT_FEAT_DMA_INCOHERENT the same as ARM, however x86 can't use the DMA API for flush, it must call the arch function clflush_cache_range() - The PT_FEAT_DYNAMIC_TOP can probably be supported on VT-d someday for the second stage when it uses 128 bit atomic stores for the HW context structures. - PT_FEAT_VTDSS_FORCE_WRITEABLE is used to work around ERRATA_772415_SPR17 - A kernel command line parameter "sp_off" disables all page sizes except 4k Remove all the unused iommu_domain page table code. The debugfs paths have their own independent page table walker that is left alone for now. This corrects a race with the non-coherent walker that the ARM implementations have fixed: CPU 0 CPU 1 pfn_to_dma_pte() pfn_to_dma_pte() pte = &parent[offset]; if (!dma_pte_present(pte)) { try_cmpxchg64(&pte->val) pte = &parent[offset]; .. dma_pte_present(pte) .. [...] // iommu_map() completes // Device does DMA domain_flush_cache(pte) The CPU 1 mapping operation shares a page table level with the CPU 0 mapping operation. CPU 0 installed a new page table level but has not flushed it yet. CPU1 returns from iommu_map() and the device does DMA. The non coherent walker fails to see the new table level installed by CPU 0 and fails the DMA with non-present. The iommupt PT_FEAT_DMA_INCOHERENT implementation uses the ARM design of storing a flag when CPU 0 completes the flush. If the flag is not set CPU 1 will also flush to ensure the HW can fully walk to the PTE being installed. Cc: Tina Zhang Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit ef7bfe5bbffdcfa033beeeb068c6317f71730679 Author: Jason Gunthorpe Date: Thu Oct 23 15:22:35 2025 -0300 iommupt/x86: Support SW bits and permit PT_FEAT_DMA_INCOHERENT VT-d requires PT_FEAT_DMA_INCOHERENT for the x86 page table as well, implement the required SW bits and enable the feature. Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 1978fac28168bc3e6a66afb9c41ec0f1e8dafa0f Author: Jason Gunthorpe Date: Thu Oct 23 15:22:34 2025 -0300 iommupt/x86: Set the dirty bit only for writable PTEs AMD and VTD are historically different here, adopt the VTD version of setting the D bit only on writable PTEs as it makes more sense. Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 5448c1558f60d4051c90938f2878c6fb20e2982a Author: Jason Gunthorpe Date: Thu Oct 23 15:22:33 2025 -0300 iommupt: Add the Intel VT-d second stage page table format The VT-d second stage format is almost the same as the x86 PAE format, except the bit encodings in the PTE are different and a few new PTE features, like force coherency are present. Among all the formats it is unique in not having a designated present bit. Comparing the performance of several operations to the existing version: iommu_map() pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 53,66 , 50,64 , 21.21 2^21, 59,70 , 56,67 , 16.16 2^30, 54,66 , 52,63 , 17.17 256*2^12, 384,524 , 337,516 , 34.34 256*2^21, 387,632 , 336,626 , 46.46 256*2^30, 376,629 , 323,623 , 48.48 iommu_unmap() pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 67,86 , 63,84 , 25.25 2^21, 64,84 , 59,80 , 26.26 2^30, 59,78 , 56,74 , 24.24 256*2^12, 216,335 , 198,317 , 37.37 256*2^21, 245,350 , 232,344 , 32.32 256*2^30, 248,345 , 226,339 , 33.33 Cc: Tina Zhang Cc: Kevin Tian Cc: Lu Baolu Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit df92fad9354605e0797c8b4fa791090889541202 Author: Markus Elfring Date: Mon Oct 20 16:52:35 2025 +0200 platform/x86: x86-android-tablets: Omit a variable reassignment in lenovo_yoga_tab2_830_1050_init_codec() An error code was assigned to a variable and checked accordingly. This value was passed to a dev_err_probe() call in an if branch. This function is documented in the way that the same value is returned. Thus delete a redundant variable reassignment. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring Link: https://patch.msgid.link/90a2385c-9d19-46f2-8d31-618d5c10aa91@web.de Signed-off-by: Ilpo Järvinen commit 1eae7d43ec375619d0452c892489ddca113b4567 Author: Markus Elfring Date: Mon Oct 20 16:34:59 2025 +0200 platform/surface: aggregator: Omit a variable reassignment in ssam_serial_hub_probe() An error code was assigned to a variable and checked accordingly. This value was passed to a dev_err_probe() call in an if branch. This function is documented in the way that the same value is returned. Thus delete a redundant variable reassignment. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring Link: https://patch.msgid.link/b25c9842-7ebc-43f0-a411-8098359f81a6@web.de Signed-off-by: Ilpo Järvinen commit efa03dab7ce4ed786b131f412440e2fd45fba11f Author: Jason Gunthorpe Date: Thu Oct 23 15:22:32 2025 -0300 iommupt: Flush the CPU cache after any writes to the page table Flush the CPU cache for the page table memory after each set of writes to the page table. The iommu should have visibility to the updated entries as soon as the map/unmap/etc operations return, like normal coherent hardware does. The caches also have to be flushed before any gather can be submitted to the driver. Implement the same solution to the race as io-pgtable-arm by using a software PTE bit to track if a table entry has been flushed or not. If another thread is still flushing then another concurrent map operation could return without IOMMU visibility to a required table entry. The SW bit will tell the second thread to also flush the cache. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit aefd967dab6469f5b827b59e50016a760dcc1fbc Author: Jason Gunthorpe Date: Thu Oct 23 15:22:31 2025 -0300 iommupt: Use the incoherent start/stop functions for PT_FEAT_DMA_INCOHERENT This is the first step to supporting an incoherent walker, start and stop the incoherence around the allocation and frees of the page table memory. The iommu_pages API maps this to dma_map/unmap_single(), or arch cache flushing calls. Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit bcc64b57b48e1c79fe6a53fec3427e14bc2054e7 Author: Jason Gunthorpe Date: Thu Oct 23 15:22:30 2025 -0300 iommupt: Add basic support for SW bits in the page table SW bits can be placed on items, including table entries, single OA's and individual items within a contiguous OA. They are guaranteed to be ignored by the HW. The API is very basic since the only use case so far is a single bit. Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel commit 36ae67b13976f8fe1fed2bbbc45ed09d0d113d45 Author: Jason Gunthorpe Date: Thu Oct 23 15:22:29 2025 -0300 iommu/pages: Add support for incoherent IOMMU page table walkers Some IOMMU HW cannot snoop the CPU cache when it walks the IO page tables. The CPU is required to flush the cache to make changes visible to the HW. Provide some helpers from iommu-pages to manage this. The helpers combine both the ARM and x86 (used in Intel VT-d) versions of the cache flushing under a single API. The ARM version uses the DMA API to access the cache flush on the assumption that the iommu is using a direct mapping and is already marked incoherent. The helpers will do the DMA API calls to set things up and keep track of DMA mapped folios using a bit in the ioptdesc so that unmapping on error paths is cleaner. The Intel version just calls the arch cache flush call directly and has no need to cleanup prior to destruction. Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit bc5233c0904eb116a4bd94e10cd3666733216063 Author: Jason Gunthorpe Date: Tue Nov 4 14:30:13 2025 -0400 iommupt: Add a kunit test for the IOMMU implementation This intends to have high coverage of the page table format functions and the IOMMU implementation itself, exercising the various corner cases. The kunit tests can be run in the kunit framework, using commands like: tools/testing/kunit/kunit.py run --build_dir build_kunit_arm64 --arch arm64 --make_options LLVM=-19 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_uml --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_x86_64 --arch x86_64 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_i386 --arch i386 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_i386pae --arch i386 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig --kconfig_add CONFIG_X86_PAE=y There are several interesting corner cases on the 32 bit platforms that need checking. Like the generic tests, these are run on the format's configuration list using kunit "params". This also checks the core iommu parts of the page table code as it enters the logic through a mock iommu_domain. The following are checked: - PT_FEAT_DYNAMIC_TOP properly adds levels one by one - Every page size can be iommu_map()'d, and mapping creates that size - iommu_iova_to_phys() works with every page size - Test converting OA -> non present -> OA when the two OAs overlap and free table levels - Test that unmap stops at holes, unmap doesn't split, and unmap returns the right values for partial unmap requests - Randomly map/unmap. Checks map with random sizes, that map fails when hitting collisions doing nothing, unmap/map with random intersections and full unmap of random sizes. Also checks iommu_iova_to_phys() with random sizes - Check for memory leaks by monitoring NR_SECONDARY_PAGETABLE Reviewed-by: Kevin Tian Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 2fdf6db436e3071a8e4c9c3e67674448a13860d4 Author: Jason Gunthorpe Date: Tue Nov 4 14:30:12 2025 -0400 iommu/amd: Remove AMD io_pgtable support None of this is used anymore, delete it. Reviewed-by: Alejandro Jimenez Reviewed-by: Vasant Hegde Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 789a5913b29c2558a4a80b8740a2523f75285507 Author: Alejandro Jimenez Date: Tue Nov 4 14:30:11 2025 -0400 iommu/amd: Use the generic iommu page table Replace the io_pgtable versions with pt_iommu versions. The v2 page table uses the x86 implementation that will be eventually shared with VT-d. This supports the same special features as the original code: - increase_top for the v1 format to allow scaling from 3 to 6 levels - non-present flushing - Dirty tracking for v1 only - __sme_set() to adjust the PTEs for CC - Optimization for flushing with virtualization to minimize the range - amd_iommu_pgsize_bitmap override of the native page sizes - page tables allocate from the device's NUMA node Rework the domain ops so that v1/v2 get their own ops. Make dedicated allocation functions for v1 and v2. Hook up invalidation for a top change to struct pt_iommu_flush_ops. Delete some of the iopgtable related code that becomes unused in this patch. The next patch will delete the rest of it. This fixes a race bug in AMD's increase_address_space() implementation. It stores the top level and top pointer in different memory, which prevents other threads from reading a coherent version: increase_address_space() alloc_pte() level = pgtable->mode - 1; pgtable->root = pte; pgtable->mode += 1; pte = &pgtable->root[PM_LEVEL_INDEX(level, address)]; The iommupt version is careful to put mode and root under a single READ_ONCE and then is careful to only READ_ONCE a single time per walk. Signed-off-by: Alejandro Jimenez Reviewed-by: Vasant Hegde Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit aef5de756ea871ab44e3a1a87be6c944e6587c51 Author: Jason Gunthorpe Date: Tue Nov 4 14:30:10 2025 -0400 iommupt: Add the x86 64 bit page table format This is used by x86 CPUs and can be used in AMD/VT-d x86 IOMMUs. When a x86 IOMMU is running SVA the MM will be using this format. This implementation follows the AMD v2 io-pgtable version. There is nothing remarkable here, the format can have 4 or 5 levels and limited support for different page sizes. No contiguous pages support. x86 uses a sign extension mechanism where the top bits of the VA must match the sign bit. The core code supports this through PT_FEAT_SIGN_EXTEND which creates and upper and lower VA range. All the new operations will work correctly in both spaces, however currently there is no way to report the upper space to other layers. Future patches can improve that. In principle this can support 3 page tables levels matching the 32 bit PAE table format, but no iommu driver needs this. The focus is on the modern 64 bit 4 and 5 level formats. Comparing the performance of several operations to the existing version: iommu_map() pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 71,61 , 66,58 , -13.13 2^21, 66,60 , 61,55 , -10.10 2^30, 59,56 , 56,54 , -3.03 256*2^12, 392,1360 , 345,1289 , 73.73 256*2^21, 383,1159 , 335,1145 , 70.70 256*2^30, 378,965 , 331,892 , 62.62 iommu_unmap() pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 77,71 , 73,68 , -7.07 2^21, 76,70 , 70,66 , -6.06 2^30, 69,66 , 66,63 , -4.04 256*2^12, 225,899 , 210,870 , 75.75 256*2^21, 262,722 , 248,710 , 65.65 256*2^30, 251,643 , 244,634 , 61.61 The small -ve values in the iommu_unmap() are due to the core code calling iommu_pgsize() before invoking the domain op. This is unncessary with this implementation. Future work optimizes this and gets to 2%, 4%, 3%. Reviewed-by: Kevin Tian Reviewed-by: Vasant Hegde Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit e93d5945ed5bb086431e83eed7ab98b6c058cc0b Author: Jason Gunthorpe Date: Tue Nov 4 14:30:09 2025 -0400 iommufd: Change the selftest to use iommupt instead of xarray The iommufd self test uses an xarray to store the pfns and their orders to emulate a page table. Make it act more like a real iommu driver by replacing the xarray with an iommupt based page table. The new AMDv1 mock format behaves similarly to the xarray. Add set_dirty() as a iommu_pt operation to allow the test suite to simulate HW dirty. Userspace can select between several formats including the normal AMDv1 format and a special MOCK_IOMMUPT_HUGE variation for testing huge page dirty tracking. To make the dirty tracking test work the page table must only store exactly 2M huge pages otherwise the logic the test uses fails. They cannot be broken up or combined. Aside from aligning the selftest with a real page table implementation, this helps test the iommupt code itself. Reviewed-by: Kevin Tian Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit e5359dcc617a2174d834bab4083340196615d8bd Author: Jason Gunthorpe Date: Tue Nov 4 14:30:08 2025 -0400 iommupt: Add a mock pagetable format for iommufd selftest to use The iommufd self test uses an xarray to store the pfns and their orders to emulate a page table. Slightly modify the amdv1 page table to create a real page table that has similar properties: - 2k base granule to simulate something like a 4k page table on a 64K PAGE_SIZE ARM system - Contiguous page support for every PFN order - Dirty tracking AMDv1 is the closest format, as it is the only one that already supports every page size. Tweak it to have only 5 levels and an 11 bit base granule and compile it separately as a format variant. Reviewed-by: Kevin Tian Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 1dd4187f53c35165262691795109879e37ddca62 Author: Jason Gunthorpe Date: Tue Nov 4 14:30:07 2025 -0400 iommupt: Add a kunit test for Generic Page Table This intends to have high coverage of the page table format functions, it uses the IOMMU implementation to create a tree which it then walks through and directly calls the generic page table functions to test them. It is a good starting point to test a new format header as it is often able to find typos and inconsistencies much more directly, rather than with an obscure failure in the iommu implementation. The tests can be run with commands like: tools/testing/kunit/kunit.py run --build_dir build_kunit_arm64 --arch arm64 --make_options LLVM=-19 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_uml --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig --kconfig_add CONFIG_WERROR=n tools/testing/kunit/kunit.py run --build_dir build_kunit_x86_64 --arch x86_64 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_i386 --arch i386 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig tools/testing/kunit/kunit.py run --build_dir build_kunit_i386pae --arch i386 --kunitconfig ./drivers/iommu/generic_pt/.kunitconfig --kconfig_add CONFIG_X86_PAE=y There are several interesting corner cases on the 32 bit platforms that need checking. The format can declare a list of configurations that generate different configurations the initialize the page table, for instance with different top levels or other parameters. The kunit will turn these into "params" which cause each test to run multiple times. The tests are repeated to run at every table level to check that all the item encoding formats work. The following are checked: - Basic init works for each configuration - The various log2 functions have the expected behavior at the limits - pt_compute_best_pgsize() works - pt_table_pa() reads back what pt_install_table() writes - range.max_vasz_lg2 works properly - pt_table_oa_lg2sz() and pt_table_item_lg2sz() use a contiguous non-overlapping set of bits from the VA up to the defined max_va - pt_possible_sizes() and pt_can_have_leaf() produces a sensible layout - pt_item_oa(), pt_entry_oa(), and pt_entry_num_contig_lg2() read back what pt_install_leaf_entry() writes - pt_clear_entry() works - pt_attr_from_entry() reads back what pt_iommu_set_prot() & pt_install_leaf_entry() writes - pt_entry_set_write_clean(), pt_entry_make_write_dirty(), and pt_entry_write_is_dirty() work Reviewed-by: Kevin Tian Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 4a00f943489103b4b9edff9f39bd484efbfb15fa Author: Jason Gunthorpe Date: Tue Nov 4 14:30:06 2025 -0400 iommupt: Add read_and_clear_dirty op IOMMU HW now supports updating a dirty bit in an entry when a DMA writes to the entry's VA range. iommufd has a uAPI to read and clear the dirty bits from the tables. This is a trivial recursive descent algorithm to read and optionally clear the dirty bits. The format needs a function to tell if a contiguous entry is dirty, and a function to clear a contiguous entry back to clean. Reviewed-by: Kevin Tian Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit dcd6a011a8d523a114af2360a8753de5bd60c139 Author: Jason Gunthorpe Date: Tue Nov 4 14:30:05 2025 -0400 iommupt: Add map_pages op map is slightly complicated because it has to handle a number of special edge cases: - Overmapping a previously shared, but now empty, table level with an OA. Requries validating and freeing the possibly empty tables - Doing the above across an entire to-be-created contiguous entry - Installing a new shared table level concurrently with another thread - Expanding the table by adding more top levels Table expansion is a unique feature of AMDv1, this version is quite similar except we handle racing concurrent lockless map. The table top pointer and starting level are encoded in a single uintptr_t which ensures we can READ_ONCE() without tearing. Any op will do the READ_ONCE() and use that fixed point as its starting point. Concurrent expansion is handled with a table global spinlock. When inserting a new table entry map checks that the entire portion of the table is empty. This includes freeing any empty lower tables that will be overwritten by an OA. A separate free list is used while checking and collecting all the empty lower tables so that writing the new entry is uninterrupted, either the new entry fully writes or nothing changes. A special fast path for PAGE_SIZE is implemented that does a direct walk to the leaf level and installs a single entry. This gives ~15% improvement for iommu_map() when mapping lists of single pages. This version sits under the iommu_domain_ops as map_pages() but does not require the external page size calculation. The implementation is actually map_range() and can do arbitrary ranges, internally handling all the validation and supporting any arrangment of page sizes. A future series can optimize iommu_map() to take advantage of this. Reviewed-by: Kevin Tian Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 7c53f4238aa8bfb476e177263133ead2eeb8d55d Author: Jason Gunthorpe Date: Tue Nov 4 14:30:04 2025 -0400 iommupt: Add unmap_pages op unmap_pages removes mappings and any fully contained interior tables from the given range. This follows the now-standard iommu_domain API definition where it does not split up larger page sizes into smaller. The caller must perform unmap only on ranges created by map or it must have somehow otherwise determined safe cut points (eg iommufd/vfio use iova_to_phys to scan for them) A future work will provide 'cut' which explicitly does the page size split if the HW can support it. unmap is implemented with a recursive descent of the tree. If the caller provides a VA range that spans an entire table item then the table memory can be freed as well. If an entire table item can be freed then this version will also check the leaf-only level of the tree to ensure that all entries are present to generate -EINVAL. Many of the existing drivers don't do this extra check. This version sits under the iommu_domain_ops as unmap_pages() but does not require the external page size calculation. The implementation is actually unmap_range() and can do arbitrary ranges, internally handling all the validation and supporting any arrangment of page sizes. A future series can optimize __iommu_unmap() to take advantage of this. Freed page table memory is batched up in the gather and will be freed in the driver's iotlb_sync() callback after the IOTLB flush completes. Reviewed-by: Kevin Tian Reviewed-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 9d4c274cd7d5e1b6b9e116e155f16bcd208237d8 Author: Jason Gunthorpe Date: Tue Nov 4 14:30:03 2025 -0400 iommupt: Add iova_to_phys op iova_to_phys is a performance path for the DMA API and iommufd, implement it using an unrolled get_user_pages() like function waterfall scheme. The implementation itself is fairly trivial. Reviewed-by: Kevin Tian Reviewed-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 879ced2bab1ba95e98fac56c9503791183bc7cbb Author: Jason Gunthorpe Date: Tue Nov 4 14:30:02 2025 -0400 iommupt: Add the AMD IOMMU v1 page table format AMD IOMMU v1 is unique in supporting contiguous pages with a variable size and it can decode the full 64 bit VA space. Unlike other x86 page tables this explicitly does not do sign extension as part of allowing the entire 64 bit VA space to be supported. The general design is quite similar to the x86 PAE format, except with a 6th level and quite different PTE encoding. This format is the only one that uses the PT_FEAT_DYNAMIC_TOP feature in the existing code as the existing AMDv1 code starts out with a 3 level table and adds levels on the fly if more IOVA is needed. Comparing the performance of several operations to the existing version: iommu_map() pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 65,64 , 62,61 , -1.01 2^13, 70,66 , 67,62 , -8.08 2^14, 73,69 , 71,65 , -9.09 2^15, 78,75 , 75,71 , -5.05 2^16, 89,89 , 86,84 , -2.02 2^17, 128,121 , 124,112 , -10.10 2^18, 175,175 , 170,163 , -4.04 2^19, 264,306 , 261,279 , 6.06 2^20, 444,525 , 438,489 , 10.10 2^21, 60,62 , 58,59 , 1.01 256*2^12, 381,1833 , 367,1795 , 79.79 256*2^21, 375,1623 , 356,1555 , 77.77 256*2^30, 356,1338 , 349,1277 , 72.72 iommu_unmap() pgsz ,avg new,old ns, min new,old ns , min % (+ve is better) 2^12, 76,89 , 71,86 , 17.17 2^13, 79,89 , 75,86 , 12.12 2^14, 78,90 , 74,86 , 13.13 2^15, 82,89 , 74,86 , 13.13 2^16, 79,89 , 74,86 , 13.13 2^17, 81,89 , 77,87 , 11.11 2^18, 90,92 , 87,89 , 2.02 2^19, 91,93 , 88,90 , 2.02 2^20, 96,95 , 91,92 , 1.01 2^21, 72,88 , 68,85 , 20.20 256*2^12, 372,6583 , 364,6251 , 94.94 256*2^21, 398,6032 , 392,5758 , 93.93 256*2^30, 396,5665 , 389,5258 , 92.92 The ~5-17x speedup when working with mutli-PTE map/unmaps is because the AMD implementation rewalks the entire table on every new PTE while this version retains its position. The same speedup will be seen with dirtys as well. The old implementation triggers a compiler optimization that ends up generating a "rep stos" memset for contiguous PTEs. Since AMD can have contiguous PTEs that span 2Kbytes of table this is a huge win compared to a normal movq loop. It is why the unmap side has a fairly flat runtime as the contiguous PTE sides increases. This version makes it explicit with a memset64() call. Reviewed-by: Kevin Tian Reviewed-by: Vasant Hegde Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit cdb39d9185795b744dab4d4d782f2fe3f5eca10c Author: Jason Gunthorpe Date: Tue Nov 4 14:30:01 2025 -0400 iommupt: Add the basic structure of the iommu implementation The existing IOMMU page table implementations duplicate all of the working algorithms for each format. By using the generic page table API a single C version of the IOMMU algorithms can be created and re-used for all of the different formats used in the drivers. The implementation will provide a single C version of the iommu domain operations: iova_to_phys, map, unmap, and read_and_clear_dirty. Further, adding new algorithms and techniques becomes easy to do across the entire fleet of drivers and formats. The C functions are drop in compatible with the existing iommu_domain_ops using the IOMMU_PT_DOMAIN_OPS() macro. Each per-format implementation compilation unit will produce exported symbols following the pattern pt_iommu_FMT_map_pages() which the macro directly maps to the iommu_domain_ops members. This avoids the additional function pointer indirection like io-pgtable has. The top level struct used by the drivers is pt_iommu_table_FMT. It contains the other structs to allow container_of() to move between the driver, iommu page table, generic page table, and generic format layers. struct pt_iommu_table_amdv1 { struct pt_iommu { struct iommu_domain domain; } iommu; struct pt_amdv1 { struct pt_common common; } amdpt; }; The driver is expected to union the pt_iommu_table_FMT with its own existing domain struct: struct driver_domain { union { struct iommu_domain domain; struct pt_iommu_table_amdv1 amdv1; }; }; PT_IOMMU_CHECK_DOMAIN(struct driver_domain, amdv1, domain); To create an alias to avoid renaming 'domain' in a lot of driver code. This allows all the layers to access all the necessary functions to implement their different roles with no change to any of the existing iommu core code. Implement the basic starting point: pt_iommu_init(), get_info() and deinit(). Reviewed-by: Kevin Tian Reviewed-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit ab0b572847acb551ee3f0f7ed1477f060c44598a Author: Jason Gunthorpe Date: Tue Nov 4 14:30:00 2025 -0400 genpt: Add Documentation/ files Add some general description and pull in the kdoc comments from the source file to index most of the useful functions. Reviewed-by: Kevin Tian Reviewed-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit 7c5b184db7145fd417785377337bd15c4fe1d0f4 Author: Jason Gunthorpe Date: Tue Nov 4 14:29:59 2025 -0400 genpt: Generic Page Table base API The generic API is intended to be separated from the implementation of page table algorithms. It contains only accessors for walking and manipulating the table and helpers that are useful for building an implementation. Memory management is not in the generic API, but part of the implementation. Using a multi-compilation approach the implementation module would include headers in this order: common.h defs_FMT.h pt_defs.h FMT.h pt_common.h IMPLEMENTATION.h Where each compilation unit would have a combination of FMT and IMPLEMENTATION to produce a per-format per-implementation module. The API is designed so that the format headers have minimal logic, and default implementations are provided if the format doesn't include one. Generally formats provide their code via an inline function using the pattern: static inline FMTpt_XX(..) {} #define pt_XX FMTpt_XX The common code then enforces a function signature so that there is no drift in function arguments, or accidental polymorphic functions (as has been slightly troublesome in mm). Use of function-like #defines are avoided in the format even though many of the functions are small enough. Provide kdocs for the API surface. This is enough to implement the 8 initial format variations with all of their features: * Entries comprised of contiguous blocks of IO PTEs for larger page sizes (AMDv1, ARMv8) * Multi-level tables, up to 6 levels. Runtime selected top level * The size of the top table level can be selected at runtime (ARM's concatenated tables) * The number of levels in the table can optionally increase dynamically during map (AMDv1) * Optional leaf entries at any level * 32 bit/64 bit virtual and output addresses, using every bit * Sign extended addressing (x86) * Dirty tracking A basic simple format takes about 200 lines to declare the require inline functions. Reviewed-by: Kevin Tian Reviewed-by: Pasha Tatashin Reviewed-by: Samiullah Khawaja Tested-by: Alejandro Jimenez Tested-by: Pasha Tatashin Signed-off-by: Jason Gunthorpe Signed-off-by: Joerg Roedel commit db892a9f7a841575868756017a47921c7dc93042 Author: Karol Wachowski Date: Tue Nov 4 14:24:18 2025 +0100 accel/ivpu: Improve debug and warning messages Add IOCTL debug bit for logging user provided parameter validation errors. Refactor several warning and error messages to better reflect fault reason. User generated faults should not flood kernel messages with warnings or errors, so change those to ivpu_dbg(). Add additional debug logs for parameter validation in IOCTLs. Check size provided by in metric streamer start and return -EINVAL together with a debug message print. Reviewed-by: Jeff Hugo Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20251104132418.970784-1-karol.wachowski@linux.intel.com commit cad767a9af055c921e29b7b268f99e83c82baab3 Author: Kaustabh Chakraborty Date: Fri Oct 31 00:50:19 2025 +0530 arm64: dts: exynos7870-j6lte: enable display panel support Enable DECON and DSI nodes, and add the compatible display panel and appropriate panel timings for this device. Also, remove the simple-framebuffer node in favor of the panel. This device has a 720x1480 AMOLED Samsung AMS561RA01 panel with S6E8AA5X01 controller. Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20251031-exynos7870-drm-dts-v4-5-c1f77fb16b87@disroot.org Signed-off-by: Krzysztof Kozlowski commit ba2cd209cf8dc6e826f3ede80212911c23ed2076 Author: Kaustabh Chakraborty Date: Fri Oct 31 00:50:18 2025 +0530 arm64: dts: exynos7870-a2corelte: enable display panel support Enable DECON and DSI nodes, and add the compatible display panel and appropriate panel timings for this device. Also, remove the simple-framebuffer node in favor of the panel. This device has a 540x960 Synaptics TD4101 display panel. Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20251031-exynos7870-drm-dts-v4-4-c1f77fb16b87@disroot.org Signed-off-by: Krzysztof Kozlowski commit 35e69cc6bdef74a3c4794bd278a94dfb512abd7a Author: Kaustabh Chakraborty Date: Fri Oct 31 00:50:17 2025 +0530 arm64: dts: exynos7870-on7xelte: enable display panel support Enable DECON and DSI nodes, and add the compatible display panel and appropriate panel timings for this device. Also, remove the simple-framebuffer node in favor of the panel. This device has a 1080x1920 Synaptics TD4300 display panel. Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20251031-exynos7870-drm-dts-v4-3-c1f77fb16b87@disroot.org Signed-off-by: Krzysztof Kozlowski commit fe02894a1930c85e542e5dd2044e6a3afcf717a7 Author: Kaustabh Chakraborty Date: Fri Oct 31 00:50:16 2025 +0530 arm64: dts: exynos7870: add DSI support Add devicetree nodes for MIPI PHYs, Samsung's DECON and DSIM blocks, and DECON IOMMU devicetree nodes. Enables SoC support for hardware to be able to drive a MIPI DSI display. Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20251031-exynos7870-drm-dts-v4-2-c1f77fb16b87@disroot.org Signed-off-by: Krzysztof Kozlowski commit 81280d39a2f9e7dc12056db889da52cce067b1b6 Author: Kaustabh Chakraborty Date: Fri Oct 31 00:50:15 2025 +0530 dt-bindings: soc: samsung: exynos-pmu: allow mipi-phy subnode for Exynos7870 PMU Exynos7870 PMU is already documented in schema. Add Exynos7870's PMU compatible to the list of nodes which allow a MIPI PHY driver. Signed-off-by: Kaustabh Chakraborty Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20251031-exynos7870-drm-dts-v4-1-c1f77fb16b87@disroot.org Signed-off-by: Krzysztof Kozlowski commit 89aec171d9d1ab168e43fcf9754b82e4c0aef9b9 Merge: bd0fa860730861 2b5e9f9b7e414c Author: Jakub Kicinski Date: Tue Nov 4 19:10:35 2025 -0800 Merge branch 'net-introduce-struct-sockaddr_unsized' Kees Cook says: ==================== net: Introduce struct sockaddr_unsized The historically fixed-size struct sockaddr is part of UAPI and embedded in many existing structures. The kernel uses struct sockaddr extensively within the kernel to represent arbitrarily sized sockaddr structures, which caused problems with the compiler's ability to determine object sizes correctly. The "temporary" solution was to make sockaddr explicitly use a flexible array, but this causes problems for embedding struct sockaddr in structures, where once again the compiler has to guess about the size of such objects, and causes thousands of warnings under the coming -Wflex-array-member-not-at-end warning. Switching to sockaddr_storage internally everywhere wastes a lot of memory, so we are left with needing two changes: - introduction of an explicitly arbitrarily sized sockaddr struct - switch struct sockaddr back to being fixed size Doing the latter step requires all "arbitrarily sized" uses of struct sockaddr to be replaced with the new struct from the first step. So, introduce the new struct and do enough conversions that we can switch sockaddr back to a fixed-size sa_data. ==================== Link: https://patch.msgid.link/20251104002608.do.383-kees@kernel.org Signed-off-by: Jakub Kicinski commit 2b5e9f9b7e414c5eeb20dd7a7b80816ff55cf57b Author: Kees Cook Date: Mon Nov 3 16:26:16 2025 -0800 net: Convert struct sockaddr to fixed-size "sa_data[14]" Revert struct sockaddr from flexible array to fixed 14-byte "sa_data", to solve over 36,000 -Wflex-array-member-not-at-end warnings, since struct sockaddr is embedded within many network structs. With socket/proto sockaddr-based internal APIs switched to use struct sockaddr_unsized, there should be no more uses of struct sockaddr that depend on reading beyond the end of struct sockaddr::sa_data that might trigger bounds checking. Comparing an x86_64 "allyesconfig" vmlinux build before and after this patch showed no new "ud1" instructions from CONFIG_UBSAN_BOUNDS nor any new "field-spanning" memcpy CONFIG_FORTIFY_SOURCE instrumentations. Cc: Gustavo A. R. Silva Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-8-kees@kernel.org Signed-off-by: Jakub Kicinski commit c1a799eef62b8c3298a4d82753fe0f2a448e5e4f Author: Kees Cook Date: Mon Nov 3 16:26:15 2025 -0800 bpf: Convert bpf_sock_addr_kern "uaddr" to sockaddr_unsized Change struct bpf_sock_addr_kern to use sockaddr_unsized for the "uaddr" field instead of sockaddr. This improves type safety in the BPF cgroup socket address filtering code. The casting in __cgroup_bpf_run_filter_sock_addr() is updated to match the new type, removing an unnecessary cast in the initialization and updating the conditional assignment to use the appropriate sockaddr_unsized cast. Additionally rename the "unspec" variable to "storage" to better align with its usage. No binary changes expected. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-7-kees@kernel.org Signed-off-by: Jakub Kicinski commit 8116d803e7f8f20bf00ce23ff8bd0baab41e1635 Author: Kees Cook Date: Mon Nov 3 16:26:14 2025 -0800 bpf: Convert cgroup sockaddr filters to use sockaddr_unsized consistently Update BPF cgroup sockaddr filtering infrastructure to use sockaddr_unsized consistently throughout the call chain, removing redundant explicit casts from callers. No binary changes expected. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-6-kees@kernel.org Signed-off-by: Jakub Kicinski commit 449f68f8fffa2c41fc265730bd05a3c4947916c1 Author: Kees Cook Date: Mon Nov 3 16:26:13 2025 -0800 net: Convert proto callbacks from sockaddr to sockaddr_unsized Convert struct proto pre_connect(), connect(), bind(), and bind_add() callback function prototypes from struct sockaddr to struct sockaddr_unsized. This does not change per-implementation use of sockaddr for passing around an arbitrarily sized sockaddr struct. Those will be addressed in future patches. Additionally removes the no longer referenced struct sockaddr from include/net/inet_common.h. No binary changes expected. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-5-kees@kernel.org Signed-off-by: Jakub Kicinski commit 3d39d34146f2b38127eadf36a0513e130eaa7eec Author: Kees Cook Date: Mon Nov 3 16:26:12 2025 -0800 net: Remove struct sockaddr from net.h Now that struct sockaddr is no longer used by net.h, remove it. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-4-kees@kernel.org Signed-off-by: Jakub Kicinski commit 85cb0757d7e1f9370a8b52a8b8144c37941cba0a Author: Kees Cook Date: Mon Nov 3 16:26:11 2025 -0800 net: Convert proto_ops connect() callbacks to use sockaddr_unsized Update all struct proto_ops connect() callback function prototypes from "struct sockaddr *" to "struct sockaddr_unsized *" to avoid lying to the compiler about object sizes. Calls into struct proto handlers gain casts that will be removed in the struct proto conversion patch. No binary changes expected. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-3-kees@kernel.org Signed-off-by: Jakub Kicinski commit 0e50474fa514822e9d990874e554bf8043a201d7 Author: Kees Cook Date: Mon Nov 3 16:26:10 2025 -0800 net: Convert proto_ops bind() callbacks to use sockaddr_unsized Update all struct proto_ops bind() callback function prototypes from "struct sockaddr *" to "struct sockaddr_unsized *" to avoid lying to the compiler about object sizes. Calls into struct proto handlers gain casts that will be removed in the struct proto conversion patch. No binary changes expected. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-2-kees@kernel.org Signed-off-by: Jakub Kicinski commit bf33247a90d3e85d53a9b55bb276b725456ff0bf Author: Kees Cook Date: Mon Nov 3 16:26:09 2025 -0800 net: Add struct sockaddr_unsized for sockaddr of unknown length Add flexible sockaddr structure to support addresses longer than the traditional 14-byte struct sockaddr::sa_data limitation without requiring the full 128-byte sa_data of struct sockaddr_storage. This allows the network APIs to pass around a pointer to an object that isn't lying to the compiler about how big it is, but must be accompanied by its actual size as an additional parameter. It's possible we may way to migrate to including the size with the struct in the future, e.g.: struct sockaddr_unsized { u16 sa_data_len; u16 sa_family; u8 sa_data[] __counted_by(sa_data_len); }; Signed-off-by: Kees Cook Link: https://patch.msgid.link/20251104002617.2752303-1-kees@kernel.org Signed-off-by: Jakub Kicinski commit bd0fa860730861bd6482b7acc5d39fd1e15c7453 Merge: 907c46ae20cd1a 5de9ea1c50f061 Author: Jakub Kicinski Date: Tue Nov 4 18:46:15 2025 -0800 Merge branch 'net-phy-remove-fixed_phy_add-and-first-its-users' Heiner Kallweit says: ==================== net: phy: remove fixed_phy_add and first its users fixed_phy_add() has a number of problems/disadvantages: - It uses phy address 0 w/o checking whether a fixed phy with this address exists already. - A subsequent call to fixed_phy_register() would also use phy address 0, because fixed_phy_add() doesn't mark it as used. - fixed_phy_add() is used from platform code, therefore requires that fixed phy code is built-in. fixed_phy_add() has only two users - coldfire/5272, using fec - bcm47xx, using b44 So migrate fec and b44 to use fixed_phy_register_100fd(), afterwards remove usage of fixed_phy_add() from the two platforms, and eventually remove fixed_phy_add(). ==================== Link: https://patch.msgid.link/0285fcb0-0fb5-4f6f-823c-7b6e85e28ba3@gmail.com Signed-off-by: Jakub Kicinski commit 5de9ea1c50f061892625388880e83fdc50a4ef66 Author: Heiner Kallweit Date: Thu Oct 30 22:46:32 2025 +0100 net: phy: fixed_phy: remove fixed_phy_add fixed_phy_add() has a number of problems/disadvantages: - It uses phy address 0 w/o checking whether a fixed phy with this address exists already. - A subsequent call to fixed_phy_register() would also use phy address 0, because fixed_phy_add() doesn't mark it as used. - fixed_phy_add() is used from platform code, therefore requires that fixed_phy code is built-in. Now that for the only two users (coldfire/5272 and bcm47xx) fixed_phy creation has been moved to the respective ethernet driver (fec, b44), we can remove fixed_phy_add(). Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/bee046a1-1e77-4057-8b04-fdb2a1bbbd08@gmail.com Signed-off-by: Jakub Kicinski commit 458639c42b7e6927a746bbbf0954ce3dd738c468 Author: Heiner Kallweit Date: Thu Oct 30 22:45:30 2025 +0100 MIPS: BCM47XX: remove creating a fixed phy Now that b44 ethernet driver creates a fixed phy if needed, we can remove this here. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/8983b705-6bca-4728-9283-7aa60f49340f@gmail.com Signed-off-by: Jakub Kicinski commit 10d2f15afba2391471576846fd22d49631e34b21 Author: Heiner Kallweit Date: Thu Oct 30 22:44:35 2025 +0100 net: b44: register a fixed phy using fixed_phy_register_100fd if needed In case of bcm47xx a fixed phy is used, which so far is created by platform code, using fixed_phy_add(). This function has a number of problems, therefore create a potentially needed fixed phy here, using fixed_phy_register_100fd. Due to lack of hardware, this is compile-tested only. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/53e4e74d-a49e-4f37-b970-5543a35041db@gmail.com Signed-off-by: Jakub Kicinski commit 0ee21f39c5d844e0b30ea323542b39ce73b3dd86 Author: Heiner Kallweit Date: Thu Oct 30 22:43:36 2025 +0100 m68k: coldfire: remove creating a fixed phy Now that the fec ethernet driver creates a fixed phy if needed, we can remove this here. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/212e0cb5-a2f5-460f-8e03-3c3369d0acf1@gmail.com Signed-off-by: Jakub Kicinski commit dc86b621e1b4129cc9ceea09ee449ae97fcf106f Author: Heiner Kallweit Date: Thu Oct 30 22:42:30 2025 +0100 net: fec: register a fixed phy using fixed_phy_register_100fd if needed In case of coldfire/5272 a fixed phy is used, which so far is created by platform code, using fixed_phy_add(). This function has a number of problems, therefore create a potentially needed fixed phy here, using fixed_phy_register_100fd. Note 1: This includes a small functional change, as coldfire/5272 created a fixed phy in half-duplex mode. Likely this was by mistake, because the fec MAC is 100FD-capable, and connection is to a switch. Note 2: Usage of phy_find_next() makes use of the fact that dev_id can only be 0 or 1. Due to lack of hardware, this is compile-tested only. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/adf4dc5c-5fa3-4ae6-a75c-a73954dede73@gmail.com Signed-off-by: Jakub Kicinski commit c9445e3c087656e01d0160a48f90389856baf368 Author: Heiner Kallweit Date: Thu Oct 30 22:41:19 2025 +0100 net: phy: fixed_phy: add helper fixed_phy_register_100fd In few places a 100FD fixed PHY is used. Create a helper so that users don't have to define the struct fixed_phy_status. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/bf564b19-e9bc-4896-aeae-9f721cc4fecd@gmail.com Signed-off-by: Jakub Kicinski commit 907c46ae20cd1a8f2fe2cd732a6089d115a36cf5 Merge: 617a0dd24ef2b4 055e554b8fff7b Author: Jakub Kicinski Date: Tue Nov 4 18:15:17 2025 -0800 Merge branch 'net-altera-tse-cleanup-init-sequence' Maxime Chevallier says: ==================== net: altera-tse: Cleanup init sequence Altera TSE cleanup to make sure everything is properly intialized before registering the netdev. When Altera TSE was converted to phylink, the PCS and phylink creation were added after register_netdev(), which is wrong as this may race with .ndo_open() once the netdev is registered. This series makes so that we register the netdev once all resources are cleanly initialised, that includes PCS and phylink creation as well as a few other operations such as reading the IP version. No errors were found in the wild, so this series doesn't target net, but given that we fix some racy-ness, a point could be made to send that to net. This series doesn't introduce functional changes, however the internal mii_bus for PCS configuration is renamed. v1: https://lore.kernel.org/20251030102418.114518-1-maxime.chevallier@bootlin.com ==================== Link: https://patch.msgid.link/20251103104928.58461-1-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 055e554b8fff7bb47e026bb8d199b213756e4321 Author: Maxime Chevallier Date: Mon Nov 3 11:49:27 2025 +0100 net: altera-tse: Init PCS and phylink before registering netdev register_netdev() must be done only once all resources are ready, as they may be used in .ndo_open() immediately upon registration. Move the lynx PCS and phylink initialisation before registerng the netdevice. We also remove the call to netif_carrier_off(), as phylink takes care of that. Reviewed-by: Andrew Lunn Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20251103104928.58461-5-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 9350ea63fec6f0cd713b6e90bd60cc2ee433b14f Author: Maxime Chevallier Date: Mon Nov 3 11:49:26 2025 +0100 net: altera-tse: Don't use netdev name for the PCS mdio bus The PCS mdio bus must be created before registering the net_device. To do that, we musn't depend on the netdev name to create the mdio bus name. Let's use the device's name instead. Note that this changes the bus name in /sys/bus/mdiobus Reviewed-by: Andrew Lunn Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20251103104928.58461-4-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit dd2619d38d7e97d17995e1156293be1ec08b058d Author: Maxime Chevallier Date: Mon Nov 3 11:49:25 2025 +0100 net: altera-tse: Warn on bad revision at probe time Instead of reading the core revision at probe time, and print a warning for an unexecpected version at .ndo_open() time, let's print that warning directly in .probe(). This allows getting rid of the "revision" private field, and also prevent a potential race between reading the revision in .probe() after netdev registration, and accessing that revision in .ndo_open(). By printing the warning after register_netdev(), we are sure that we have a netdev name, and that we try to print the revision after having read it from the internal registers. Suggested-by: Andrew Lunn Signed-off-by: Maxime Chevallier Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20251103104928.58461-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 6874520518868a660bda182da060b69372265a16 Author: Maxime Chevallier Date: Mon Nov 3 11:49:24 2025 +0100 net: altera-tse: Set platform drvdata before registering netdev We don't have to wait until netdev is registered before setting it as the pdev's drvdata. Move it at netdev alloc time. Reviewed-by: Andrew Lunn Signed-off-by: Maxime Chevallier Link: https://patch.msgid.link/20251103104928.58461-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski commit 617a0dd24ef2b4e6240df48b1fbac1c3ebfa9282 Author: Heiner Kallweit Date: Mon Nov 3 23:26:49 2025 +0100 net: phy: make phy_device members pause and asym_pause bitfield bits We can reduce the size of struct phy_device a little by switching the type of members pause and asym_pause from int to a single bit. As C99 is supported now, we can use type bool for the bitfield members, what provides us with the benefit of the usual implicit bool conversions. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/764e9a31-b40b-4dc9-b808-118192a16d87@gmail.com Signed-off-by: Jakub Kicinski commit f005b348d36fbe8f6b80c19e2ac6076559493706 Merge: 3f02b82725576a 2ee95ec17e97c5 Author: Jakub Kicinski Date: Tue Nov 4 18:11:38 2025 -0800 Merge branch 'add-driver-for-1gbe-network-chips-from-mucse' Dong Yibo says: ==================== Add driver for 1Gbe network chips from MUCSE This patch series adds support for MUCSE RNPGBE 1Gbps PCIe Ethernet controllers (N500/N210 series), including build infrastructure, hardware initialization, mailbox (MBX) communication with firmware, and basic netdev registration (Can show mac witch is got from firmware, and tx/rx will be added later). Series breakdown (5 patches): 01/05: net: ethernet/mucse: Add build support for rnpgbe - Kconfig/Makefile for MUCSE vendor, basic PCI probe (no netdev) 02/05: net: ethernet/mucse: Add N500/N210 chip support - netdev allocation, BAR mapping 03/05: net: ethernet/mucse: Add basic MBX ops for PF-FW communication - base read/write, write with poll ack, poll and read data 04/05: net: ethernet/mucse: Add FW commands (sync, reset, MAC query) - FW sync retry logic, MAC address retrieval, reset hw with base mbx ops in patch4 05/05: net: ethernet/mucse: Complete netdev registration - HW reset, MAC setup, netdev_ops registration ==================== Link: https://patch.msgid.link/20251101013849.120565-1-dong100@mucse.com Signed-off-by: Jakub Kicinski commit 2ee95ec17e97c58b65e978a08b75fa8cb6424e4e Author: Dong Yibo Date: Sat Nov 1 09:38:49 2025 +0800 net: rnpgbe: Add register_netdev Complete the network device (netdev) registration flow for Mucse Gbe Ethernet chips, including: 1. Hardware state initialization: - Send powerup notification to firmware (via echo_fw_status) - Sync with firmware - Reset hardware 2. MAC address handling: - Retrieve permanent MAC from firmware (via mucse_mbx_get_macaddr) - Fallback to random valid MAC (eth_random_addr) if not valid mac from Fw Signed-off-by: Dong Yibo Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251101013849.120565-6-dong100@mucse.com Signed-off-by: Jakub Kicinski commit c6d3f0198eaa4efba506933d2dbcd417e987630a Author: Dong Yibo Date: Sat Nov 1 09:38:48 2025 +0800 net: rnpgbe: Add basic mbx_fw support Add fundamental firmware (FW) communication operations via PF-FW mailbox, including: - FW sync (via HW info query with retries) - HW reset (post FW command to reset hardware) - MAC address retrieval (request FW for port-specific MAC) - Power management (powerup/powerdown notification to FW) Signed-off-by: Dong Yibo Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251101013849.120565-5-dong100@mucse.com Signed-off-by: Jakub Kicinski commit 4543534c3ef5115189ee2981e0911d1626af57ed Author: Dong Yibo Date: Sat Nov 1 09:38:47 2025 +0800 net: rnpgbe: Add basic mbx ops support Add fundamental mailbox (MBX) communication operations between PF (Physical Function) and firmware for n500/n210 chips Signed-off-by: Dong Yibo Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20251101013849.120565-4-dong100@mucse.com Signed-off-by: Jakub Kicinski commit 1b7f85f733fd243d7c9073b9ff3d93e6ba5d1055 Author: Dong Yibo Date: Sat Nov 1 09:38:46 2025 +0800 net: rnpgbe: Add n500/n210 chip support with BAR2 mapping Add hardware initialization foundation for MUCSE 1Gbe controller, including: 1. Map PCI BAR2 as hardware register base; 2. Bind PCI device to driver private data (struct mucse) and initialize hardware context (struct mucse_hw); 3. Reserve board-specific init framework via rnpgbe_init_hw. Signed-off-by: Dong Yibo Reviewed-by: Vadim Fedorenko Reviewed-by: MD Danish Anwar Link: https://patch.msgid.link/20251101013849.120565-3-dong100@mucse.com Signed-off-by: Jakub Kicinski commit ee61c10cd4820e8844dba4315f2d1e522f1f3b98 Author: Dong Yibo Date: Sat Nov 1 09:38:45 2025 +0800 net: rnpgbe: Add build support for rnpgbe Add build options and doc for mucse. Initialize pci device access for MUCSE devices. Signed-off-by: Dong Yibo Reviewed-by: Andrew Lunn Reviewed-by: Vadim Fedorenko Reviewed-by: MD Danish Anwar Link: https://patch.msgid.link/20251101013849.120565-2-dong100@mucse.com Signed-off-by: Jakub Kicinski commit 3f02b82725576a85a1219547e28a2ab30b53666f Author: Vadim Fedorenko Date: Mon Nov 3 17:29:02 2025 +0000 ti: netcp: convert to ndo_hwtstamp callbacks Convert TI NetCP driver to use ndo_hwtstamp_get()/ndo_hwtstamp_set() callbacks. The logic is slightly changed, because I believe the original logic was not really correct. Config reading part is using the very first module to get the configuration instead of iterating over all of them and keep the last one as the configuration is supposed to be identical for all modules. HW timestamp config set path is now trying to configure all modules, but in case of error from one module it adds extack message. This way the configuration will be as synchronized as possible. There are only 2 modules using netcp core infrastructure, and both use the very same function to configure HW timestamping, so no actual difference in behavior is expected. Signed-off-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20251103172902.3538392-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit bdf27b544742d9382a697bfa215792ab366a1582 Merge: e0c78fcad2bb04 d8fdc7069474a2 Author: Jakub Kicinski Date: Tue Nov 4 17:32:04 2025 -0800 Merge branch 'convert-drivers-to-use-ndo_hwtstamp-callbacks-part-3' Vadim Fedorenko says: ==================== convert drivers to use ndo_hwtstamp callbacks part 3 [part] This patchset converts the rest of ethernet drivers to use ndo callbacks instead ioctl to configure and report time stamping. The drivers in part 3 originally implemented only SIOCSHWTSTAMP command, but converted to also provide configuration back to users. ==================== Link: https://patch.msgid.link/20251103150952.3538205-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit d8fdc7069474a298ec63ee338b5fcc879a33c754 Author: Vadim Fedorenko Date: Mon Nov 3 15:09:51 2025 +0000 net: pch_gbe: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl command only, but it stores configuration in the private data, so it is possible to report it back to users. Implement both ndo_hwtstamp_set and ndo_hwtstamp_get callbacks. To properly report RX filter type, store it in hwts_rx_en instead of using this field as a simple flag. The logic didn't change because receive path used this field as boolean flag. Signed-off-by: Vadim Fedorenko Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20251103150952.3538205-7-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit a23d0486d05a7b6d816d55099a7574c3c4ca4869 Author: Vadim Fedorenko Date: Mon Nov 3 15:09:50 2025 +0000 net: thunderx: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl command only, but it also stores configuration in private data, so it's possible to report it back to users. Implement both ndo_hwtstamp_set and ndo_hwtstamp_get callbacks. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251103150952.3538205-6-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 72c35e3a9589005e6ba55d63902eeb8b9fdb3a4e Author: Vadim Fedorenko Date: Mon Nov 3 15:09:49 2025 +0000 net: octeon: mgmt: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl command only. But it stores timestamping configuration, so it is possible to report it to users. Implement both ndo_hwtstamp_set and ndo_hwtstamp_get callbacks. After this the ndo_eth_ioctl effectively becomes phy_do_ioctl - adjust callback accordingly. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251103150952.3538205-5-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 94037a0e18e3340912a039fa8435a69bee50bfd1 Author: Vadim Fedorenko Date: Mon Nov 3 15:09:48 2025 +0000 net: liquidio_vf: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl command only, but there is a way to get configuration back. Implement both ndo_hwtstamp_set and ndo_hwtstamp_set callbacks. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251103150952.3538205-4-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit 2b38447548813ccdb8ad79385094a35d77c01e3b Author: Vadim Fedorenko Date: Mon Nov 3 15:09:47 2025 +0000 net: liquidio: convert to use ndo_hwtstamp callbacks The driver implemented SIOCSHWTSTAMP ioctl command only, but there is a way to get configured status. Implement both ndo_hwtstamp_set and ndo_hwtstamp_get callbacks. Reviewed-by: Kory Maincent Signed-off-by: Vadim Fedorenko Link: https://patch.msgid.link/20251103150952.3538205-3-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski commit e0c78fcad2bb04651af2ad40ed20714501931d7a Author: Buday Csaba Date: Mon Nov 3 09:13:42 2025 +0100 dt-bindings: net: ethernet-phy: clarify when compatible must specify PHY ID Change PHY ID description in ethernet-phy.yaml to clarify that a PHY ID is required (may -> must) when the PHY requires special initialization sequence. Link: https://lore.kernel.org/netdev/20251026212026.GA2959311-robh@kernel.org/ Link: https://lore.kernel.org/netdev/aQIZvDt5gooZSTcp@debianbuilder/ Signed-off-by: Buday Csaba Acked-by: Conor Dooley Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/64c52d1a726944a68a308355433e8ef0f82c4240.1762157515.git.buday.csaba@prolan.hu Signed-off-by: Jakub Kicinski commit f2143e283c6b993f4ad8b85a45aa16ac899f1abc Author: Yue Haibing Date: Mon Nov 3 15:20:46 2025 +0800 net: devmem: Remove unused declaration net_devmem_bind_tx_release() Commit bd61848900bf ("net: devmem: Implement TX path") declared this but never implemented it. Signed-off-by: Yue Haibing Acked-by: Stanislav Fomichev Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20251103072046.1670574-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit f102600ebe95cc797af7702478f764349f51b41f Merge: b117befe8afde5 5c59df126bae1f Author: Jakub Kicinski Date: Tue Nov 4 17:16:06 2025 -0800 Merge branch 'mptcp-pm-in-kernel-fullmesh-endp-nb-bind-cases' Matthieu Baerts says: ==================== mptcp: pm: in-kernel: fullmesh endp nb + bind cases Here is a small optimisation for the in-kernel PM, joined by a small behavioural change to avoid confusions, and followed by a few more tests. - Patch 1: record fullmesh endpoints numbers, not to iterate over all endpoints to check if one is marked as fullmesh. - Patch 2: when at least one endpoint is marked as fullmesh, only use these endpoints when reacting to an ADD_ADDR, even if there are no endpoints for this IP family: this is less confusing. - Patch 3: reduce duplicated code to prepare the next patch. - Patch 4: extra "bind" cases: the listen socket restrict the bind to one IP address, not allowing MP_JOIN to extra IP addresses, except if another listening socket accepts them. ==================== Link: https://patch.msgid.link/20251101-net-next-mptcp-fm-endp-nb-bind-v1-0-b4166772d6bb@kernel.org Signed-off-by: Jakub Kicinski commit 5c59df126bae1f2bb6fce6c11eef0e9776b32598 Author: Matthieu Baerts (NGI0) Date: Sat Nov 1 18:56:54 2025 +0100 selftests: mptcp: join: validate extra bind cases By design, an MPTCP connection will not accept extra subflows where no MPTCP listening sockets can accept such requests. In other words, it means that if the 'server' listens on a specific address / device, it cannot accept MP_JOIN sent to a different address / device. Except if there is another MPTCP listening socket accepting them. This is what the new tests are validating: - Forcing a bind on the main v4/v6 address, and checking that MP_JOIN to announced addresses are not accepted. - Also forcing a bind on the main v4/v6 address, but before, another listening socket is created to accept additional subflows. Note that 'mptcpize run nc -l' -- or something else only doing: socket(MPTCP), bind(), listen(0) -- would be enough, but here mptcp_connect is reused not to depend on another tool just for that. - Same as the previous one, but using v6 link-local addresses: this is a bit particular because it is required to specify the outgoing network interface when connecting to a link-local address announced by the other peer. When using the routing rules, this doesn't work (the outgoing interface is not known) ; but it does work with a 'laminar' endpoint having a specified interface. Note that extra small modifications are needed for these tests to work: - mptcp_connect's check_getpeername_connect() check should strip the specified interface when comparing addresses. - With IPv6 link-local addresses, it is required to wait for them to be ready (no longer in 'tentative' mode) before using them, otherwise the bind() will not be allowed. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/591 Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251101-net-next-mptcp-fm-endp-nb-bind-v1-4-b4166772d6bb@kernel.org Signed-off-by: Jakub Kicinski commit 4a6220a453c8afd46a01f0bbe56bc6734adb77b7 Author: Matthieu Baerts (NGI0) Date: Sat Nov 1 18:56:53 2025 +0100 selftests: mptcp: join: do_transfer: reduce code dup The same extra long commands are present twice, with small differences: the variable for the stdin file is different. Use new dedicated variables in one command to avoid this code duplication. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251101-net-next-mptcp-fm-endp-nb-bind-v1-3-b4166772d6bb@kernel.org Signed-off-by: Jakub Kicinski commit e461e8a799a2984e9b55f40c65d123a114496dff Author: Matthieu Baerts (NGI0) Date: Sat Nov 1 18:56:52 2025 +0100 mptcp: pm: in kernel: only use fullmesh endp if any Our documentation is saying that the in-kernel PM is only using fullmesh endpoints to establish subflows to announced addresses when at least one endpoint has a fullmesh flag. But this was not totally correct: only fullmesh endpoints were used if at least one endpoint *from the same address family as the received ADD_ADDR* has the fullmesh flag. This is confusing, and it seems clearer not to have differences depending on the address family. So, now, when at least one MPTCP endpoint has a fullmesh flag, the local addresses are picked from all fullmesh endpoints, which might be 0 if there are no endpoints for the correct address family. One selftest needs to be adapted for this behaviour change. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251101-net-next-mptcp-fm-endp-nb-bind-v1-2-b4166772d6bb@kernel.org Signed-off-by: Jakub Kicinski commit f88191c7f3618405f1fc5c331a94ebfe601c5b08 Author: Matthieu Baerts (NGI0) Date: Sat Nov 1 18:56:51 2025 +0100 mptcp: pm: in-kernel: record fullmesh endp nb Instead of iterating over all endpoints, under RCU read lock, just to check if one of them as the fullmesh flag, we can keep a counter of fullmesh endpoint, similar to what is done with the other flags. This counter is now checked, before iterating over all endpoints. Similar to the other counters, this new one is also exposed. A userspace app can then know when it is being used in a fullmesh mode, with potentially (too) many subflows. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20251101-net-next-mptcp-fm-endp-nb-bind-v1-1-b4166772d6bb@kernel.org Signed-off-by: Jakub Kicinski commit b117befe8afde52fe8d961e763b54bf907950b30 Merge: 52665fcc2241f8 3b88a535a8e10d Author: Jakub Kicinski Date: Tue Nov 4 17:04:53 2025 -0800 Merge branch 'net-mlx5e-reduce-interface-downtime-on-configuration-change' Tariq Toukan says: ==================== net/mlx5e: Reduce interface downtime on configuration change This series significantly reduces the interface downtime while swapping channels during a configuration change, on capable devices. Here we remove an old requirement on operations ordering that became obsolete on recent capable devices. This helps cutting the downtime by a factor of magnitude, ~80% in our example. Perf numbers: Measured the number of dropped packets in a simple ping flood test, during a configuration change operation, that switches the number of channels from 247 to 248. Before: 71 packets lost After: 15 packets lost, ~80% saving. ==================== Link: https://patch.msgid.link/1761831159-1013140-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 3b88a535a8e10d83335f04c60aafbdfd37146a01 Author: Tariq Toukan Date: Thu Oct 30 15:32:39 2025 +0200 net/mlx5e: Defer channels closure to reduce interface down time Cap bit tis_tir_td_order=1 indicates that an old firmware requirement / limitation no longer exists. When unset, the latency of several firmware commands significantly increases with the presence of high number of co-existing channels (both old and new sets). Hence, we used to close unneeded old channels before invoking those firmware commands. Today, on capable devices, this is no longer the case. Minimize the interface down time by deferring the old channels closure, after the activation of the new ones. Perf numbers: Measured the number of dropped packets in a simple ping flood test, during a configuration change operation, that switches the number of channels from 247 to 248. Before: 71 packets lost After: 15 packets lost, ~80% saving. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-8-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 911e3a37b024163d8329e3560d6fd5f0f0da2558 Author: Tariq Toukan Date: Thu Oct 30 15:32:38 2025 +0200 net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels Let the caller function mlx5e_safe_switch_params() maintain a copy of the old channels, and pass it to mlx5e_switch_priv_channels(). This is in preparation for the next patch. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-7-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 477c352adda4ba0bd80c945ab13165161802239e Author: Tariq Toukan Date: Thu Oct 30 15:32:37 2025 +0200 net/mlx5e: Do not re-apply TIR loopback configuration if not necessary On old firmware, (tis_tir_td_order=0), TIR of a transport domain should either be created after all SQs of the same domain, or TIR.self_lb_en should be reapplied using MODIFY_TIR, for self loopback filtering to function correctly. This is not necessary anymnore on new FW (tis_tir_td_order=1), thus there's no need for calling modify_tir operations after creating a new set of SQs to maintain the self loopback prevention functional. Skip these operations. This saves O(max_num_channels) MODIFY_TIR firmware commands in operations like interface up or channels configuration change. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a4c81e72f132b93a3b920196621a7b78c71fb7fc Author: Tariq Toukan Date: Thu Oct 30 15:32:36 2025 +0200 net/mlx5: IPoIB, set self loopback prevention in TIR init In IPoIB, the self loopback prevention configuration apply in activation stage has two roles: fulfill a firmware requirement for old firmware (tis_tir_td_order=0), and update the proper configuration as it was not set in init. Here we set the proper configuration in init, to allow skipping the modify_tirs commands on new firmware in a downstream patch. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 99b002018f6a3dc08c789e2962070d6de7cb3bac Author: Tariq Toukan Date: Thu Oct 30 15:32:35 2025 +0200 net/mlx5e: Allow setting self loopback prevention bits on TIR init Until now, IPoIB was creating TIRs without setting self loopback prevention, then modifying them in activation stage. This is a preparation patch, that will be used by IPoIB to init TIRs properly without the need for following calls of modify_tir. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5c51a86122b20326229c6c9dff4a92c186cbb6bf Author: Tariq Toukan Date: Thu Oct 30 15:32:34 2025 +0200 net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() Extend the TIR API and use it in mlx5e_modify_tirs_lb() instead of the explicit modify_tir code. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 091400a5d411ee7398095ba832361eb12b345f3d Author: Tariq Toukan Date: Thu Oct 30 15:32:33 2025 +0200 net/mlx5e: Enhance function structures for self loopback prevention application The re-application of self loopback prevention attributes in TIRs is necessary in old firmwares (where tis_tir_td_order cap is cleared) after recreation of SQs. However, this is not needed in new firmware with tis_tir_td_order=1. As a preparation patch, enhance the function structures to differentiate between an explicit loopback prevention configuration apply, and the re-apply operation required by old firmware. Loopback selftests should now call mlx5e_modify_tirs_lb() directly, as their use case is not related to the firmware limitation. Signed-off-by: Tariq Toukan Reviewed-by: Carolina Jubran Reviewed-by: Simon Horman Link: https://patch.msgid.link/1761831159-1013140-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 52665fcc2241f8f9a17543d9a6531b1a1b029bde Author: Chu Guangqing Date: Mon Nov 3 11:22:12 2025 +0800 xen/netfront: Comment Correction: Fix Spelling Error and Description of Queue Quantity Rules The original comments contained spelling errors and incomplete logical descriptions, which could easily lead to misunderstandings of the code logic. The specific modifications are as follows: Correct the spelling error by changing "inut max" to "but not exceed the maximum limit"; Add the note "If the user has not specified a value, the default maximum limit is 8" to clarify the default value logic; Improve the coherence of the statement to make the queue quantity rules clearer. After the modification, the comments can accurately reflect the code behavior of "taking the smaller value between the number of CPUs and the default maximum limit of 8 for the number of queues", enhancing code maintainability. Signed-off-by: Chu Guangqing Reviewed-by: Juergen Gross Link: https://patch.msgid.link/20251103032212.2462-1-chuguangqing@inspur.com Signed-off-by: Jakub Kicinski commit 96c68954cd3b65f321d40b9078cdb49a26bdaf9a Author: Chu Guangqing Date: Mon Nov 3 13:44:43 2025 +0800 net: sungem_phy: Fix a typo error in sungem_phy Fix a spelling mistakes for regularly Signed-off-by: Chu Guangqing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20251103054443.2878-1-chuguangqing@inspur.com Signed-off-by: Jakub Kicinski commit 9781642e58903e52f3c607e957e5220e95e792b6 Author: Chu Guangqing Date: Mon Nov 3 13:53:51 2025 +0800 veth: Fix a typo error in veth Fix a spellling error for resources Signed-off-by: Chu Guangqing Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251103055351.3150-1-chuguangqing@inspur.com Signed-off-by: Jakub Kicinski commit 2428803d5eef1fd8451a6c4ba41d17cd199f3715 Author: Chu Guangqing Date: Mon Nov 3 14:05:04 2025 +0800 gtp: Fix a typo error for size Fix the spelling error of "size". Signed-off-by: Chu Guangqing Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20251103060504.3524-1-chuguangqing@inspur.com Signed-off-by: Jakub Kicinski commit f4b2786fb14bef2b16c66be076e41863da1e511b Author: Chu Guangqing Date: Mon Nov 3 15:43:05 2025 +0800 virtio_net: Fix a typo error in virtio_net Fix the spelling error of "separate". Signed-off-by: Chu Guangqing Reviewed-by: Jacob Keller Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20251103074305.4727-1-chuguangqing@inspur.com Signed-off-by: Jakub Kicinski commit 1bf5b90cd2f984e5d6ff6fd30d5d85f9f579b6f0 Author: Danilo Krummrich Date: Mon Nov 3 21:39:18 2025 +0100 rust: auxiliary: fix false positive warning for missing a safety comment Some older (yet supported) versions of clippy throw a false positive warning for missing a safety comment when the safety comment is on a multiline statement. warning: unsafe block missing a safety comment --> rust/kernel/auxiliary.rs:351:22 | 351 | Self(unsafe { NonNull::new_unchecked(adev) }), | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | = help: consider adding a safety comment on the preceding line = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#undocumented_unsafe_blocks = note: requested on the command line with `-W clippy::undocumented-unsafe-blocks` warning: 1 warning emitted Fix this by placing the safety comment right on top of the same line introducing the unsafe block. Fixes: e4e679c8608e ("rust: auxiliary: unregister on parent device unbind") Reviewed-by: Alice Ryhl Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20251103203932.2361660-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 31113a452a3d0ca1d592b7c61644995ace984fff Merge: 46173144e03d87 eaca1a4dc51e5e Author: Jakub Kicinski Date: Tue Nov 4 16:15:56 2025 -0800 Merge branch 'net-stmmac-multi-interface-stmmac' Russell King says: ==================== net: stmmac: multi-interface stmmac This series adds a callback for platform glue to configure the stmmac core interface mode depending on the PHY interface mode that is being used. This is currently only called just before the dwmac core is reset since these signals are latched on reset. Included in this series are changes to s32 to move its PHY_INTF_SEL_x definitions out of the way of the dwmac core's signals which has more entitlement to use this name. We convert dwmac-imx as an example. Including other platform glue would make this series excessively large, but once this core code is merged, the individual platform glue updates can be posted one after another as they will be independent of each other. It is hoped that this callback can be used in future to reconfigure the dwmac core when the interface mode changes to support PHYs that change their interface mode, but we're nowhere near being able to do that yet. ==================== Link: https://patch.msgid.link/aQiWzyrXU_2hGJ4j@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit eaca1a4dc51e5e4979e45a4ad72a1c2a88a80a72 Author: Russell King (Oracle) Date: Mon Nov 3 11:50:46 2025 +0000 net: stmmac: imx: use ->set_phy_intf_sel() Rather than placing the phy_intf_sel() setup in the ->init() method, move it to the new ->set_phy_intf_sel() method. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt5C-0000000ChpR-2kAB@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 38cd4e84b369c11680966fdea129e11dbb28a6ec Author: Russell King (Oracle) Date: Mon Nov 3 11:50:41 2025 +0000 net: stmmac: imx: cleanup arguments for set_intf_mode() method Pass the imx_priv_data instead of the plat_stmmacenet_data into the set_intf_mode() SoC specific methods. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt57-0000000ChpL-25kS@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 35103babce3036058cd9ed8674c98e9ab397d715 Author: Russell King (Oracle) Date: Mon Nov 3 11:50:36 2025 +0000 net: stmmac: imx: simplify set_intf_mode() implementations Simplify the set_intf_mode() implementations, testing the phy_intf_sel value rather than the PHY interface mode. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt52-0000000ChpG-1bsd@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c012710c14a70dfa21691e2542d18dd4b621c518 Author: Russell King (Oracle) Date: Mon Nov 3 11:50:31 2025 +0000 net: stmmac: imx: use stmmac_get_phy_intf_sel() i.MX implementations other than IMX8DXL involve setting the dwmac core phy_intf_sel input. Use stmmac_get_phy_intf_sel() to decode the PHY interface mode to the phy_intf_sel value, validating the result, and passing it into the implementation specific .set_intf_mode() method rather than each .set_intf_mode() method doing this. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt4x-0000000ChpA-1Edr@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d73c1dccfb9909f0e2d517af887fe414ab421cea Author: Russell King (Oracle) Date: Mon Nov 3 11:50:26 2025 +0000 net: stmmac: imx: use FIELD_PREP()/FIELD_GET() for PHY_INTF_SEL_x Use FIELD_PREP()/FIELD_GET() in the functions to construct the PHY interface selection bitfield or to extract its value. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt4s-0000000Chp4-0kwf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8233cc439779eac1d2682d334c1aa6bb6d95120c Author: Russell King (Oracle) Date: Mon Nov 3 11:50:21 2025 +0000 net: stmmac: imx: convert to PHY_INTF_SEL_xxx Convert dwmac-imx to use the PHY_INTF_SEL_xxx definitions rather than constants via: - ensuring that the prefix for the MASK and value definitions is the same. - using FIELD_PREP() to shift the PHY_INTF_SEL_xxx definition to the appropriate bitfield. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt4n-0000000Choy-0IeG@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1b6aa81c85621d6b55099906585ff09a477203b8 Author: Russell King (Oracle) Date: Mon Nov 3 11:50:15 2025 +0000 net: stmmac: add support for configuring the phy_intf_sel inputs When dwmac is synthesised with support for multiple PHY interfaces, the core provides phy_intf_sel inputs, sampled on reset, to configure the PHY facing interface. Use stmmac_get_phy_intf_sel() in core code to determine the dwmac phy_intf_sel input value, and provide a new platform method called with this value just before we issue a soft reset to the dwmac core. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt4h-0000000Chos-3wxX@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b459790d3fd6d7ead31182ae0cd8632fe79deed6 Author: Russell King (Oracle) Date: Mon Nov 3 11:50:10 2025 +0000 net: stmmac: add stmmac_get_phy_intf_sel() Provide a function to translate the PHY interface mode to the phy_intf_sel pin configuration for dwmac1000 and dwmac4 cores that support multiple interfaces. We currently handle MII, GMII, RGMII, SGMII, RMII and REVMII, but not TBI, RTBI nor SMII as drivers do not appear to use these three and the driver doesn't currently support these. Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt4c-0000000Choe-3SII@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4a4692e9091867dd413764c7d81f09e8109a233a Author: Russell King (Oracle) Date: Mon Nov 3 11:50:05 2025 +0000 net: stmmac: add phy_intf_sel and ACTPHYIF definitions Add definitions for the active PHY interface found in DMA hardware feature register 0, and also used to configure the core in multi- interface designs via phy_intf_sel. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1vFt4X-0000000ChoY-30p9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 553f23d1953527eb277efa902cd498131b2527e1 Author: Russell King (Oracle) Date: Mon Nov 3 11:50:00 2025 +0000 net: stmmac: s32: move PHY_INTF_SEL_x definitions out of the way S32's PHY_INTF_SEL_x definitions conflict with those for the dwmac cores as they use a different bitmapping. Add a S32 prefix so that they are unique. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Reviewed-by: Jan Petrous (OSS) Link: https://patch.msgid.link/E1vFt4S-0000000ChoS-2Ahi@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit dec568a36f9b16f0334aed8e95ec4225606830cc Author: Russell King (Oracle) Date: Mon Nov 3 11:49:55 2025 +0000 net: stmmac: imx: use phylink's interface mode for set_clk_tx_rate() imx_dwmac_set_clk_tx_rate() is passed the interface mode from phylink which will be the same as plat_dat->phy_interface. Use the passed-in interface mode rather than plat_dat->phy_interface. Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Signed-off-by: Russell King (Oracle) Link: https://patch.msgid.link/E1vFt4N-0000000ChoM-1llp@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 46173144e03d87beddf02ee785cbdf818087687a Author: Eric Dumazet Date: Mon Nov 3 16:52:56 2025 +0000 net: mark deliver_skb() as unlikely and not inlined deliver_skb() should not be inlined as is it not called in the fast path. Add unlikely() clauses giving hints to the compiler about this fact. Before this patch: size net/core/dev.o text data bss dec hex filename 121794 13330 176 135300 21084 net/core/dev.o __netif_receive_skb_core() size on x86_64 : 4080 bytes. After: size net/core/dev.o text data bss dec hex filenamee 120330 13338 176 133844 20ad4 net/core/dev.o __netif_receive_skb_core() size on x86_64 : 2781 bytes. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20251103165256.1712169-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 105bae321862b3bac300c73748192ff61a5129cd Author: Adrian Moreno Date: Mon Nov 3 16:40:04 2025 +0100 rtnetlink: honor RTEXT_FILTER_SKIP_STATS in IFLA_STATS Gathering interface statistics can be a relatively expensive operation on certain systems as it requires iterating over all the cpus. RTEXT_FILTER_SKIP_STATS was first introduced [1] to skip AF_INET6 statistics from interface dumps and it was then extended [2] to also exclude IFLA_VF_INFO. The semantics of the flag does not seem to be limited to AF_INET or VF statistics and having a way to query the interface status (e.g: carrier, address) without retrieving its statistics seems reasonable. So this patch extends the use RTEXT_FILTER_SKIP_STATS to also affect IFLA_STATS. [1] https://lore.kernel.org/all/20150911204848.GC9687@oracle.com/ [2] https://lore.kernel.org/all/20230611105108.122586-1-gal@nvidia.com/ Signed-off-by: Adrian Moreno Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Eric Dumazet Reviewed-by: Nicolas Dichtel Link: https://patch.msgid.link/20251103154006.1189707-1-amorenoz@redhat.com Signed-off-by: Jakub Kicinski commit f656279afde16afee3ac163b90584ddceacb4e61 Author: Danilo Krummrich Date: Wed Oct 22 16:30:44 2025 +0200 samples: rust: debugfs_scoped: add example for blobs Extend the rust_debugfs_scoped sample to demonstrate how to export a large binary object through a ScopedDir. Reviewed-by: Alice Ryhl Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Signed-off-by: Danilo Krummrich commit 35bd14d929af1b16f58d7b786c52187628427922 Author: Danilo Krummrich Date: Wed Oct 22 16:30:43 2025 +0200 rust: debugfs: support binary large objects for ScopedDir Add support for creating binary debugfs files via ScopedDir. This mirrors the existing functionality for Dir, but without producing an owning handle -- files are automatically removed when the associated Scope is dropped. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Reviewed-by: Alice Ryhl Signed-off-by: Danilo Krummrich commit 52af0c37964be5a685cfd7aa4127bdd29d629cc7 Author: Danilo Krummrich Date: Wed Oct 22 16:30:42 2025 +0200 samples: rust: debugfs: add example for blobs Extend the Rust debugfs sample to demonstrate usage of binary file support. The example now shows how to expose both fixed-size arrays and dynamically sized vectors as binary blobs in debugfs. Reviewed-by: Alice Ryhl Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Signed-off-by: Danilo Krummrich commit a9fca8a7b2c5078c00960866d2a512b8cea7ce3b Author: Danilo Krummrich Date: Wed Oct 22 16:30:41 2025 +0200 rust: debugfs: support blobs from smart pointers Extend Rust debugfs binary support to allow exposing data stored in common smart pointers and heap-allocated collections. - Implement BinaryWriter for Box, Pin>, Arc, and Vec. - Introduce BinaryReaderMut for mutable binary access with outer locks. - Implement BinaryReaderMut for Box, Vec, and base types. - Update BinaryReader to delegate to BinaryReaderMut for Mutex, Box, Pin> and Arc. This enables debugfs files to directly expose or update data stored inside heap-allocated, reference-counted, or lock-protected containers without manual dereferencing or locking. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Reviewed-by: Alice Ryhl Signed-off-by: Danilo Krummrich commit 9c804d9cf2dbe90cfde89c905b45aacbd07ee537 Author: Danilo Krummrich Date: Wed Oct 22 16:30:40 2025 +0200 rust: debugfs: support for binary large objects Introduce support for read-only, write-only, and read-write binary files in Rust debugfs. This adds: - BinaryWriter and BinaryReader traits for writing to and reading from user slices in binary form. - New Dir methods: read_binary_file(), write_binary_file(), `read_write_binary_file`. - Corresponding FileOps implementations: BinaryReadFile, BinaryWriteFile, BinaryReadWriteFile. This allows kernel modules to expose arbitrary binary data through debugfs, with proper support for offsets and partial reads/writes. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Reviewed-by: Alice Ryhl Signed-off-by: Danilo Krummrich commit 0ddceba2701e7012646f6df6d32c4e4b7c4dc938 Author: Danilo Krummrich Date: Wed Oct 22 16:30:39 2025 +0200 rust: uaccess: add UserSliceWriter::write_slice_file() Add UserSliceWriter::write_slice_file(), which is the same as UserSliceWriter::write_slice_partial() but updates the given file::Offset by the number of bytes written. This is equivalent to C's `simple_read_from_buffer()` and useful when dealing with file offsets from file operations. Reviewed-by: Alice Ryhl Acked-by: Miguel Ojeda [ Replace saturating_add() with the raw operator and a corresponding OVERFLOW comment. - Danilo ] Signed-off-by: Danilo Krummrich commit 86150533476774ee6ad5875e764ff6acc9a2e48a Author: Danilo Krummrich Date: Wed Oct 22 16:30:38 2025 +0200 rust: uaccess: add UserSliceWriter::write_slice_partial() The existing write_slice() method is a wrapper around copy_to_user() and expects the user buffer to be larger than the source buffer. However, userspace may split up reads in multiple partial operations providing an offset into the source buffer and a smaller user buffer. In order to support this common case, provide a helper for partial writes. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Acked-by: Miguel Ojeda [ Replace map_or() with let-else; use saturating_add(). - Danilo ] Signed-off-by: Danilo Krummrich commit 5829e330482b67a14c8c6d2d500431846d493d67 Author: Danilo Krummrich Date: Wed Oct 22 16:30:37 2025 +0200 rust: uaccess: add UserSliceReader::read_slice_file() Add UserSliceReader::read_slice_file(), which is the same as UserSliceReader::read_slice_partial() but updates the given file::Offset by the number of bytes read. This is equivalent to C's `simple_write_to_buffer()` and useful when dealing with file offsets from file operations. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Acked-by: Miguel Ojeda [ Replace saturating_add() with the raw operator and a corresponding OVERFLOW comment. - Danilo ] Signed-off-by: Danilo Krummrich commit f2af7b01b05545fff1cea0768c14e2da552a56ee Author: Danilo Krummrich Date: Wed Oct 22 16:30:36 2025 +0200 rust: uaccess: add UserSliceReader::read_slice_partial() The existing read_slice() method is a wrapper around copy_from_user() and expects the user buffer to be larger than the destination buffer. However, userspace may split up writes in multiple partial operations providing an offset into the destination buffer and a smaller user buffer. In order to support this common case, provide a helper for partial reads. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Matthew Maurer Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Acked-by: Miguel Ojeda [ Replace map_or() with let-else; use saturating_add(). - Danilo ] Signed-off-by: Danilo Krummrich commit 390d967653e17205f0e519f691b7d6be0a05ff45 Author: Christian Brauner Date: Wed Nov 5 00:05:01 2025 +0100 pidfs: reduce wait_pidfd lock scope There's no need to hold the lock after we realized that pid->attr is set. We're holding a reference to struct pid so it won't go away and pidfs_exit() is called once per struct pid. Link: https://patch.msgid.link/20251105-work-pidfs-wait_pidfd-lock-v1-1-02638783be07@kernel.org Signed-off-by: Christian Brauner commit db7bd1affa852b61dbc0d2ae2809f0f5bf2e3d9d Author: Danilo Krummrich Date: Tue Oct 21 00:26:13 2025 +0200 rust: fs: add file::Offset type alias Add a type alias for file offsets, i.e. bindings::loff_t. Trying to avoid using raw bindings types, this seems to be the better alternative compared to just using i64. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Reviewed-by: Alice Ryhl Reviewed-by: Christian Brauner Link: https://patch.msgid.link/20251020222722.240473-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 333fa35fbd1f20b0d8a4af3b236fd9f52f3431b2 Author: Charan Pedumuru Date: Fri Oct 24 07:57:10 2025 +0000 dt-bindings: mmc: ti,omap2430-sdhci: convert to DT schema Convert TI OMAP SDHCI Controller binding to YAML format. Changes during Conversion: - Define new properties like "clocks", "clock-names", "pbias-supply" and "power-domains" to resolve dtb_check errors. - Remove "pinctrl-names" and "pinctrl-" from required as they are not necessary for all DTS files. - Remove "ti,hwmods" property entirely from the YAML as the DTS doesn't contain this property for the given compatibles and the text binding is misleading. - Add "clocks", "clock-names" and "max-frequency" to the required properties based on the compatible and the text binding doesn't mention these properties as required. - Add missing strings like "default-rev11", "sdr12-rev11", "sdr25-rev11", "hs-rev11", "sdr25-rev11" and "sleep" to pinctrl-names string array to resolve errors detected by dtb_check. Signed-off-by: Charan Pedumuru Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20251024-ti-sdhci-omap-v5-3-df5f6f033a38@gmail.com Signed-off-by: Kevin Hilman commit 9485ba8ab325c4b420ec92661f15ed14741bb9d1 Author: Charan Pedumuru Date: Fri Oct 24 07:57:09 2025 +0000 arm: dts: ti: omap: Drop unnecessary properties for SDHCI node Remove the "ti,needs-special-reset", "ti,needs-special-hs-handling", and "cap-mmc-dual-data-rate" properties from the DTS for the sdhci nodes, as the sdhci-omap driver does not depend on these properties. Signed-off-by: Charan Pedumuru Link: https://lore.kernel.org/r/20251024-ti-sdhci-omap-v5-2-df5f6f033a38@gmail.com Signed-off-by: Kevin Hilman commit bb2ffb47d82229a4f54ca6a83784fa288914803b Author: Charan Pedumuru Date: Fri Oct 24 07:57:08 2025 +0000 arm: dts: ti: omap: am335x-pepper: Fix vmmc-supply property typo Rectify a typo for the property "vmmc-supply" to resolve the errors detected by dtb_check. Signed-off-by: Charan Pedumuru Link: https://lore.kernel.org/r/20251024-ti-sdhci-omap-v5-1-df5f6f033a38@gmail.com Signed-off-by: Kevin Hilman commit 3862123e9b56663c7a3e4a308e6e65bffe44f646 Author: Jihed Chaibi Date: Sun Sep 14 21:25:16 2025 +0200 ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible The "ti,twl4030-power-n900" compatible string is obsolete and is not supported by any in-kernel driver. Currently, the kernel falls back to the second entry, "ti,twl4030-power-idle-osc-off", to bind a driver to this node. Make this fallback explicit by removing the obsolete board-specific compatible. This preserves the existing functionality while making the DTS compliant with the new, stricter 'ti,twl.yaml' binding. Fixes: daebabd578647 ("mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/r/20250914192516.164629-4-jihed.chaibi.dev@gmail.com Signed-off-by: Kevin Hilman commit f7f3bc18300a230e0f1bfb17fc8889435c1e47f5 Author: Jihed Chaibi Date: Sun Sep 14 21:25:15 2025 +0200 ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible The "ti,twl4030-power-beagleboard-xm" compatible string is obsolete and is not supported by any in-kernel driver. Currently, the kernel falls back to the second entry, "ti,twl4030-power-idle-osc-off", to bind a driver to this node. Make this fallback explicit by removing the obsolete board-specific compatible. This preserves the existing functionality while making the DTS compliant with the new, stricter 'ti,twl.yaml' binding. Fixes: 9188883fd66e9 ("ARM: dts: Enable twl4030 off-idle configuration for selected omaps") Signed-off-by: Jihed Chaibi Link: https://lore.kernel.org/r/20250914192516.164629-3-jihed.chaibi.dev@gmail.com Signed-off-by: Kevin Hilman commit 5267fcd180b170d39cd2017f62e332a26311534a Author: Matthias Schiffer Date: Tue Aug 26 16:08:49 2025 +0200 ARM: dts: omap: Add support for TQMa335x/MBa335x TQMa335x[L] is a SoM family using TI AM335x CPU family. MBa335x is an evaluation mainboard for this SoM. Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250826140853.2570528-4-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit c579ced456db4b95c55491574788c03618cf88d1 Author: Matthias Schiffer Date: Tue Aug 26 16:08:48 2025 +0200 ARM: dts: omap: AM33xx: add cpu label Board Device Trees often want to set the cpu0-supply. Provide a label to reference the cpu@0 node. Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250826140853.2570528-3-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit 6cf18454d7caf5a56776f6011ab9c6bca823c7e7 Author: Matthias Schiffer Date: Tue Aug 26 16:08:47 2025 +0200 dt-bindings: omap: add AM335x-based TQMa335x SOM and MBa335x board TQMa335x[L] is a SOM family using TI AM335x CPU family. MBa335x is an evaluation mainboard for this SOM. Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250826140853.2570528-2-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit 3f61783920504b2cf99330b372d82914bb004d8e Author: Matthias Schiffer Date: Mon Aug 25 15:11:13 2025 +0200 ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx am33xx.dtsi has the same clock setup as am35xx.dtsi, setting ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, so AM33 needs the same workaround as AM35 to avoid ti-sysc probe failing on certain target modules. Signed-off-by: Matthias Schiffer Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com Signed-off-by: Kevin Hilman commit ae18c465b3ae0879a023b4a89c032064afb78234 Author: Ali Khan Date: Tue Oct 7 12:53:09 2025 +0000 ARM: OMAP2+: Fix falg->flag typo in omap_smc2() Fix a spelling error in the omap_smc2() function declaration and in a corresponding comment within the assembly source. This was reported via bugzilla in 2019. Reported-by: Jens Schleusener Link: https://bugzilla.kernel.org/show_bug.cgi?id=205891 Signed-off-by: Ali Khan Link: https://lore.kernel.org/r/20251007-omap-falg-fix-v1-1-545a1de74a0a@gmail.com Signed-off-by: Kevin Hilman commit d0c4b1723c419a18cb434903c7754954ecb51d35 Author: Yegor Yefremov Date: Tue Oct 7 12:38:51 2025 +0200 ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Fixes: 8e9d75fd2ec2 ("ARM: dts: am335x-netcom: add GPIO names for NetCom Plus 2-port devices") Signed-off-by: Yegor Yefremov Link: https://lore.kernel.org/r/20251007103851.3765678-1-yegorslists@googlemail.com Signed-off-by: Kevin Hilman commit 473de5d3466f879b84a9d063fa34acdd9e895d76 Author: Yegor Yefremov Date: Tue Oct 7 10:50:37 2025 +0200 ARM: dts: ti: omap: am335x-baltos: add a regulator for the mPCIe slot Baltos device provide a mPCIe slot that can be power cycled via a GPIO. Add a userspace consumer mpcie-power-switch that references a fixed regulator attached to the GPIO3_4. Signed-off-by: Yegor Yefremov Link: https://lore.kernel.org/r/20251007085037.3605676-1-yegorslists@googlemail.com Signed-off-by: Kevin Hilman commit 905664e27647224b2f5f29a1825c3d6bff3fc49c Author: Yegor Yefremov Date: Mon Oct 6 11:35:17 2025 +0200 ARM: dts: omap: rework Baltos LED nodes Add labels to the Baltos LED nodes. Signed-off-by: Yegor Yefremov Link: https://lore.kernel.org/r/20251006093517.3075431-1-yegorslists@googlemail.com Signed-off-by: Kevin Hilman commit 9c95fc710b0d05f797db9e26d56524efa74f8978 Author: Geert Uytterhoeven Date: Thu Oct 2 11:53:05 2025 +0200 ARM: dts: am33xx: Add missing serial console speed Without a serial console speed specified in chosen/stdout-path in the DTB, the serial console uses the default speed of the serial driver, unless explicitly overridden in a legacy console= kernel command-line parameter. After dropping "ti,omap3-uart" from the list of compatible values in DT, AM33xx serial ports can no longer be used with the legacy OMAP serial driver, but only with the OMAP-flavored 8250 serial driver (which is mutually-exclusive with the former). However, replacing CONFIG_SERIAL_OMAP=y by CONFIG_SERIAL_8250_OMAP=y (with/without enabling CONFIG_SERIAL_8250_OMAP_TTYO_FIXUP) may not be sufficient to restore serial console functionality: the legacy OMAP serial driver defaults to 115200 bps, while the 8250 serial driver defaults to 9600 bps, causing no visible output on the serial console when no appropriate console= kernel command-line parameter is specified. Fix this for all AM33xx boards by adding ":115200n8" to chosen/stdout-path. This requires replacing the "&uartN" reference by the corresponding "serialN" DT alias. Fixes: ca8be8fc2c306efb ("ARM: dts: am33xx-l4: fix UART compatible") Fixes: 077e1cde78c3f904 ("ARM: omap2plus_defconfig: Enable 8250_OMAP") Closes: https://lore.kernel.org/CAMuHMdUb7Jb2=GqK3=Rn+Gv5G9KogcQieqDvjDCkJA4zyX4VcA@mail.gmail.com Signed-off-by: Geert Uytterhoeven Reviewed-by: Matti Vaittinen Tested-by: Matti Vaittinen Reviewed-by: Bruno Thomsen Link: https://lore.kernel.org/r/63cef5c3643d359e8ec13366ca79377f12dd73b1.1759398641.git.geert+renesas@glider.be Signed-off-by: Kevin Hilman commit 47955b58cf9b97fe4dc2b0d622b8ea3a2656bbf9 Author: Borislav Petkov (AMD) Date: Wed Oct 15 12:35:48 2025 +0200 x86/cpufeatures: Correct LKGS feature flag description Quotation marks in cpufeatures.h comments are special and when the comment begins with a quoted string, that string lands in /proc/cpuinfo, turning it into a user-visible one. The LKGS comment doesn't begin with a quoted string but just in case drop the quoted "kernel" in there to avoid confusion. And while at it, simply change the description into what the LKGS instruction does for more clarity. No functional changes. Reviewed-by: Xin Li (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20251015103548.10194-1-bp@kernel.org commit d723f36e014d296d668b577c0c69cc37be75e6d2 Author: Tejun Heo Date: Tue Nov 4 11:42:55 2025 -1000 sched_ext: Minor cleanups to scx_task_iter - Use memset() in scx_task_iter_start() instead of zeroing fields individually. - In scx_task_iter_next(), move __scx_task_iter_maybe_relock() after the batch check which is simpler. - Update comment to reflect that tasks are removed from scx_tasks when dead (commit 7900aa699c34 ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()")). No functional changes. Signed-off-by: Tejun Heo commit 023af03caed8c1c7b863b912b661bb76a8c13c24 Author: Tejun Heo Date: Tue Nov 4 11:40:22 2025 -1000 sched_ext: Move __SCX_DSQ_ITER_ALL_FLAGS BUILD_BUG_ON to the right place The BUILD_BUG_ON() which checks that __SCX_DSQ_ITER_ALL_FLAGS doesn't overlap with the private lnode bits was in scx_task_iter_start() which has nothing to do with DSQ iteration. Move it to bpf_iter_scx_dsq_new() where it belongs. No functional changes. Signed-off-by: Tejun Heo commit 4cb4897bb49a4caf4246c72c24b743d44e7f52d5 Merge: b3387b31222678 cc77a203896edb Author: Andrii Nakryiko Date: Tue Nov 4 13:44:12 2025 -0800 Merge branch 'multi-split-btf-fixes-and-test' Alan Maguire says: ==================== Multi-split BTF fixes and test This small series consists of a fix to multi-split BTF parsing (patch 1) and a test which exercises (multi-)split BTF parsing (patch 2). Changes since v3 [1] - add asserts to ensure number of types in original and parsed BTF are identical, and the calls to btf__type_by_id() return valid pointers (code review bot, patch 2) Changes since v2 [2] - fix Fixes: tag formatting (Andrii, patch 1) - BPF code-review bot saw we were doing ASSERT_OK_PTR() on wrong BTF (not multisplit) in patch 2 - ensure cleanup is correctly handled for BTF, unlink in split tests (Andrii, patch 2) Changes since v1 [3] - BPF code-review bot spotted another place that the string offset needed to be adjusted based upon base start string offset + header string offset. - added selftests to extend split BTF testing to parsing [1] https://lore.kernel.org/bpf/20251028225544.1312356-1-alan.maguire@oracle.com/ [2] https://lore.kernel.org/bpf/20251028155709.1265445-1-alan.maguire@oracle.com/ [3] https://lore.kernel.org/bpf/20251023142812.258870-1-alan.maguire@oracle.com/ ==================== Link: https://patch.msgid.link/20251104203309.318429-1-alan.maguire@oracle.com Signed-off-by: Andrii Nakryiko commit cc77a203896edbfecb566538e7046b882a971999 Author: Alan Maguire Date: Tue Nov 4 20:33:09 2025 +0000 selftests/bpf: Test parsing of (multi-)split BTF Write raw BTF to files, parse it and compare to original; this allows us to test parsing of (multi-)split BTF code. Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251104203309.318429-3-alan.maguire@oracle.com commit 4f596acc260e691a2e348f64230392f3472feea3 Author: Alan Maguire Date: Tue Nov 4 20:33:08 2025 +0000 libbpf: Fix parsing of multi-split BTF When creating multi-split BTF we correctly set the start string offset to be the size of the base string section plus the base BTF start string offset; the latter is needed for multi-split BTF since the offset is non-zero there. Unfortunately the BTF parsing case needed that logic and it was missed. Fixes: 4e29128a9ace ("libbpf/btf: Fix string handling to support multi-split BTF") Signed-off-by: Alan Maguire Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251104203309.318429-2-alan.maguire@oracle.com commit aef9703dcbf8a816af06a30e51a0f9e3773086e3 Author: Adrian Ng Ho Yin Date: Wed Oct 15 10:12:43 2025 +0800 arm64: dts: socfpga: agilex5: Add SMMU-V3-PMCG nodes Add SMMU-V3 Performance Monitoring Counter Group (PMCG) nodes for Agilex5 to support SMMU performance event monitoring. Signed-off-by: Adrian Ng Ho Yin Signed-off-by: Dinh Nguyen commit 3e99d51aaaba3ed3f092f635ad053fe1ca5953ff Author: Adrian Ng Ho Yin Date: Wed Oct 15 10:12:42 2025 +0800 arm64: dts: socfpga: agilex5: Add L2 and L3 cache Add L2 and L3 cache nodes to the device tree to resolve the "unable to detect cache hierarchy" warning reported by cacheinfo. Signed-off-by: Adrian Ng Ho Yin Signed-off-by: Dinh Nguyen commit a45ff1c7c9e9447ffca83a9d219c50e9eb8bdaeb Merge: 3a8660878839fa cbb842548a9dd6 Author: Christian Brauner Date: Thu Oct 30 14:25:22 2025 +0100 Merge patch series "coredump: cleanups & pidfd extension" Christian Brauner says: The recent changes to rework coredump handling to rely on unix sockets are in the process of being used in systemd. Yu reported on shortcoming nameling that the signal causing the coredump was available before the crashing process was reaped. The previous systemd coredump container interface requires the coredump file descriptor, and basic information including the signal number to be sent to the container. This means we need to have the signal number available before sending the coredump to the container. In general, the extension makes sense and fits with the rest of the coredump information. In addition to this extension this fixes a bunch of the tests that were failing and reworks the publication mechanism for exit and coredump info retrievable via the pidfd ioctl. * patches from https://patch.msgid.link/20251028-work-coredump-signal-v1-0-ca449b7b7aa0@kernel.org: (22 commits) selftests/coredump: add second PIDFD_INFO_COREDUMP_SIGNAL test selftests/coredump: add first PIDFD_INFO_COREDUMP_SIGNAL test selftests/coredump: ignore ENOSPC errors selftests/coredump: add debug logging to coredump socket protocol tests selftests/coredump: add debug logging to coredump socket tests selftests/coredump: add debug logging to test helpers selftests/coredump: handle edge-triggered epoll correctly selftests/coredump: fix userspace coredump client detection selftests/coredump: fix userspace client detection selftests/coredump: split out coredump socket tests selftests/coredump: split out common helpers selftests/pidfd: add second supported_mask test selftests/pidfd: add first supported_mask test selftests/pidfd: update pidfd header pidfs: expose coredump signal pidfs: drop struct pidfs_exit_info pidfs: prepare to drop exit_info pointer pidfd: add a new supported_mask field pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info pidfs: add missing PIDFD_INFO_SIZE_VER1 ... Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-0-ca449b7b7aa0@kernel.org Signed-off-by: Christian Brauner commit cbb842548a9dd6ffcb87934eb5e32e5408460767 Author: Christian Brauner Date: Tue Oct 28 09:46:07 2025 +0100 selftests/coredump: add second PIDFD_INFO_COREDUMP_SIGNAL test Verify that when using simple socket-based coredump (@ pattern), the coredump_signal field is correctly exposed as SIGABRT. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-22-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 619e2227cc324155e99bce56a8c9e751cbf777e5 Author: Christian Brauner Date: Tue Oct 28 09:46:06 2025 +0100 selftests/coredump: add first PIDFD_INFO_COREDUMP_SIGNAL test Verify that when using simple socket-based coredump (@ pattern), the coredump_signal field is correctly exposed as SIGSEGV. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-21-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 32ae33f796cbff57a4a6ce848360e5539b92ec2a Author: Christian Brauner Date: Tue Oct 28 09:46:05 2025 +0100 selftests/coredump: ignore ENOSPC errors If we crash multiple processes at the same time we may run out of space. Just ignore those errors. They're not actually all that relevant for the test. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-20-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 408a0ed9eed07dcfee965220404a8ada82b00b1a Author: Christian Brauner Date: Tue Oct 28 09:46:04 2025 +0100 selftests/coredump: add debug logging to coredump socket protocol tests So it's easier to figure out bugs. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-19-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 2343cbee9f60ec1f469ce9bf979bd87465bab8bc Author: Christian Brauner Date: Tue Oct 28 09:46:03 2025 +0100 selftests/coredump: add debug logging to coredump socket tests So it's easier to figure out bugs. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-18-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit d5694db5dc7388102dda81e0d20e3160cdcc55f5 Author: Christian Brauner Date: Tue Oct 28 09:46:02 2025 +0100 selftests/coredump: add debug logging to test helpers so we can easily figure out why something failed. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-17-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 305e6b167c596dac4ba9f8b324c973e50aa3025d Author: Christian Brauner Date: Tue Oct 28 09:46:01 2025 +0100 selftests/coredump: handle edge-triggered epoll correctly by putting the file descriptor into non-blocking mode. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-16-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 8b64f54c81d5baaef7fe117caa2f565be50ba440 Author: Christian Brauner Date: Tue Oct 28 09:46:00 2025 +0100 selftests/coredump: fix userspace coredump client detection PIDFD_INFO_COREDUMP is only retrievable until the task has exited. After it has exited task->mm is NULL. So if the task didn't actually coredump we can't retrieve it's dumpability settings anymore. Only if the task did coredump will we have stashed the coredump information in the respective struct pid. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-15-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 32ae9fa4063a7b4295e0c82d8f13bf3da6523e2d Author: Christian Brauner Date: Tue Oct 28 09:45:59 2025 +0100 selftests/coredump: fix userspace client detection We need to request PIDFD_INFO_COREDUMP in the first place. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-14-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit c09ea6659e50360cc7894eb262a598e14125b921 Author: Christian Brauner Date: Tue Oct 28 09:45:58 2025 +0100 selftests/coredump: split out coredump socket tests Split the coredump socket tests into separate files. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-13-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit c71147f42bff7edda59d62fb554980f11fc4dc4e Author: Christian Brauner Date: Tue Oct 28 09:45:57 2025 +0100 selftests/coredump: split out common helpers into separate files. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-12-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 2593deaac80f84a95d62d40fc414bfe546444d8f Author: Christian Brauner Date: Tue Oct 28 09:45:56 2025 +0100 selftests/pidfd: add second supported_mask test Verify that supported_mask is returned even when other fields are requested. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-11-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit e12f734208c5415a7fef92bafcc572afbd9ec8e8 Author: Christian Brauner Date: Tue Oct 28 09:45:55 2025 +0100 selftests/pidfd: add first supported_mask test Verify that when PIDFD_INFO_SUPPORTED_MASK is requested, the kernel returns the supported_mask field indicating which flags the kernel supports. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-10-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit a945535dfd21fb74be516ded5c8d053e922f0729 Author: Christian Brauner Date: Tue Oct 28 09:45:54 2025 +0100 selftests/pidfd: update pidfd header Include the new defines and members. Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-9-ca449b7b7aa0@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit f68ff6bc0d0893d959aac39c662895096d866c84 Merge: 3f5b1169d2ab20 ec7f31b2a2d3bf Author: Jens Axboe Date: Tue Nov 4 12:43:02 2025 -0700 Merge branch 'autopi-deadlock' into for-6.19/block Currently the automatic block layer PI generation allocates the integrity buffer using kmalloc, and thus could deadlock, or fail I/O request due to memory pressure. Fix this by adding a mempool, and capping the maximum I/O size on PI capable devices to not exceed the allocation size of the mempool. Link: https://lore.kernel.org/linux-block/20251103101653.2083310-1-hch@lst.de/ Signed-off-by: Jens Axboe * autopi-deadlock: block: make bio auto-integrity deadlock safe block: blocking mempool_alloc doesn't fail commit ec7f31b2a2d3bf6b9e4d4b8cd156587f1d0607d5 Author: Christoph Hellwig Date: Mon Nov 3 05:16:45 2025 -0500 block: make bio auto-integrity deadlock safe The current block layer automatic integrity protection allocates the actual integrity buffer, which has three problems: - because it happens at the bottom of the I/O stack and doesn't use a mempool it can deadlock under load - because the data size in a bio is almost unbounded when using lage folios it can relatively easily exceed the maximum kmalloc size - even when it does not exceed the maximum kmalloc size, it could exceed the maximum segment size of the device Fix this by limiting the I/O size so that we can allocate at least a 2MiB integrity buffer, i.e. 128MiB for 8 byte PI and 512 byte integrity intervals, and create a mempool as a last resort for this maximum size, mirroring the scheme used for bvecs. As a nice upside none of this can fail now, so we remove the error handling and open code the trivial addition of the bip vec. The new allocation helpers sit outside of bio-integrity-auto.c because I plan to reuse them for file system based PI in the near future. Fixes: 7ba1ba12eeef ("block: Block layer data integrity support") Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit eef09f742be2a89126742f9f6f6a0d5d7c83cba8 Author: Christoph Hellwig Date: Mon Nov 3 05:16:44 2025 -0500 block: blocking mempool_alloc doesn't fail So remove the error check for it in bio_integrity_prep. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Reviewed-by: Johannes Thumshirn Reviewed-by: Anuj Gupta Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit 5935461b458463ee51aac8d95c25d7a5e1de8c4d Author: Miguel Ojeda Date: Mon Oct 13 00:46:45 2025 +0200 docs: rust: quick-start: add Debian 13 (Trixie) Debian 13 (released 2025-08-09) packages Rust 1.85.0 [1], which is recent enough to build Linux. Thus document it. In fact, we are planning to propose that the minimum supported Rust version in Linux follows Debian Stable releases, with Debian 13 being the first one we upgrade to, i.e. Rust 1.85. Link: https://www.debian.org/News/2025/20250809 [1] Link: https://patch.msgid.link/20251012224645.1148411-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit b3387b312226788db111050ca51d0fb321509d6a Author: Donald Hunter Date: Wed Oct 29 18:09:32 2025 +0000 docs/bpf: Add missing BPF k/uprobe program types to docs Update the table of program types in the libbpf docs with the missing k/uprobe multi and session program types. Signed-off-by: Donald Hunter Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251029180932.98038-1-donald.hunter@gmail.com commit efa47566ad0b2a6178d5c3ecba6a9c71c82f2588 Author: Jianyun Gao Date: Mon Nov 3 20:07:27 2025 +0800 libbpf: Update the comment to remove the reference to the deprecated interface bpf_program__load(). Commit be2f2d1680df ("libbpf: Deprecate bpf_program__load() API") marked bpf_program__load() as deprecated starting with libbpf v0.6. And later in commit 146bf811f5ac ("libbpf: remove most other deprecated high-level APIs") actually removed the bpf_program__load() implementation and related old high-level APIs. This patch update the comment in bpf_program__set_attach_target() to remove the reference to the deprecated interface bpf_program__load(). Signed-off-by: Jianyun Gao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251103120727.145965-1-jianyungao89@gmail.com commit 74bd7bc0683e25eac1397e39ab0b4c0394d6241a Author: Jianyun Gao Date: Mon Nov 3 19:58:36 2025 +0800 libbpf: Complete the missing @param and @return tags in btf.h Complete the missing @param and @return tags in the Doxygen comments of the btf.h file. Signed-off-by: Jianyun Gao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20251103115836.144339-1-jianyungao89@gmail.com commit 6422060aa9c7bb2039b23948db5d4e8194036657 Author: Kai Huang Date: Wed Oct 22 00:43:45 2025 +1300 KVM: x86/mmu: Move the misplaced export of kvm_zap_gfn_range() Currently, the export of kvm_zap_gfn_range() is misplaced, i.e., it's not placed right after the kvm_zap_gfn_range() function body but after kvm_mmu_zap_collapsible_spte(). Move it to the right place. No functional change intended. Signed-off-by: Kai Huang Link: https://patch.msgid.link/20251021114345.159372-1-kai.huang@intel.com Signed-off-by: Sean Christopherson commit 65a70164aba7c5d3b37a2d1e04a8d19c9d980994 Author: Sean Christopherson Date: Thu Oct 30 11:50:03 2025 -0700 KVM: x86: Add a helper to dedup reporting of unhandled VM-Exits Add and use a helper, kvm_prepare_unexpected_reason_exit(), to dedup the code that fills the exit reason and CPU when KVM encounters a VM-Exit that KVM doesn't know how to handle. Reviewed-by: yaoyuan@linux.alibaba.com Reviewed-by: Yao Yuan Reviewed-by: Yosry Ahmed Reviewed-by: Pankaj Gupta Reviewed-by: Xiaoyao Li Reviewed-by: Binbin Wu Acked-by: Kai Huang Link: https://patch.msgid.link/20251030185004.3372256-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 816e12793c6daef977f3d024b1ae91c54988e3ef Author: Matthew Brost Date: Fri Oct 31 09:54:16 2025 -0700 drm/xe: Remove unused GT page fault code With the Xe page fault layer and GuC page layer in place, this is now dead code and can be removed. ACC code is also removed, but this was dead code. Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-8-matthew.brost@intel.com commit f289f7807119128d4f9d59f34ac557549c7562e5 Author: Matthew Brost Date: Fri Oct 31 09:54:15 2025 -0700 drm/xe: Add xe_guc_pagefault layer Add xe_guc_pagefault layer (producer) which parses G2H fault messages messages into struct xe_pagefault, forwards them to the page fault layer (consumer) for servicing, and provides a vfunc to acknowledge faults to the GuC upon completion. Replace the old (and incorrect) GT page fault layer with this new layer throughout the driver. As part of this change, the ACC handling code has been removed, as it is dead code that is currently unused. v2: - Include engine instance (Stuart) Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-7-matthew.brost@intel.com commit fb544b8445080c6488a58c01022550adc0873283 Author: Matthew Brost Date: Fri Oct 31 09:54:14 2025 -0700 drm/xe: Implement xe_pagefault_queue_work Implement a worker that services page faults, using the same implementation as in xe_gt_pagefault.c. v2: - Rebase on exhaustive eviction changes - Include engine instance in debug prints (Stuart) Signed-off-by: Matthew Brost Reviewed-by: Stuart Summers Reviewed-by: Lucas De Marchi Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-6-matthew.brost@intel.com commit 143aa16572c5508f95b2a78b1769b0c83bfee09c Author: Matthew Brost Date: Fri Oct 31 09:54:13 2025 -0700 drm/xe: Implement xe_pagefault_handler Enqueue (copy) the input struct xe_pagefault into a queue (i.e., into a memory buffer) and schedule a worker to service it. Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-5-matthew.brost@intel.com commit 79be336d1a5d0dce7c51ef7baccb2bcc3773800d Author: Matthew Brost Date: Fri Oct 31 09:54:12 2025 -0700 drm/xe: Implement xe_pagefault_reset Squash any pending faults on the GT being reset by setting the GT field in struct xe_pagefault to NULL. v4: - Only do reset it page faults queues initialized (CI) Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-4-matthew.brost@intel.com commit 1919d1687efac63420d57c10cf9fe6ba87297e59 Author: Matthew Brost Date: Fri Oct 31 09:54:11 2025 -0700 drm/xe: Implement xe_pagefault_init Create pagefault queues and initialize them. v2: - Fix kernel doc + add comment for number PF queue (Francois) v4: - Move init after GT init (CI, Francois) Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-3-matthew.brost@intel.com commit e568dc3e625d818f199bd085005213cce3271453 Author: Lizhi Hou Date: Mon Nov 3 22:25:45 2025 -0800 accel/amdxdna: Add IOCTL parameter for telemetry data Extend DRM_IOCTL_AMDXDNA_GET_INFO to include additional parameters that allow collection of telemetry data. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251104062546.833771-3-lizhi.hou@amd.com commit 1556c170d2f78344a9eee567fbfcee4651689813 Author: Lizhi Hou Date: Mon Nov 3 22:25:44 2025 -0800 accel/amdxdna: Add IOCTL parameter for resource data Extend DRM_IOCTL_AMDXDNA_GET_INFO to include additional parameters that allow collection of resource data. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251104062546.833771-2-lizhi.hou@amd.com commit 620a09fb0bddf387f418663478b48ca4ba62b6d6 Author: Matthew Brost Date: Fri Oct 31 09:54:10 2025 -0700 drm/xe: Stub out new pagefault layer Stub out the new page fault layer and add kernel documentation. This is intended as a replacement for the GT page fault layer, enabling multiple producers to hook into a shared page fault consumer interface. v2: - Fix kernel doc typo (checkpatch) - Remove comment around GT (Stuart) - Add explaination around reclaim (Francois) - Add comment around u8 vs enum (Francois) - Include engine instance (Stuart) v3: - Fix XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION kernel doc (Stuart) Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Tested-by: Francois Dugast Link: https://patch.msgid.link/20251031165416.2871503-2-matthew.brost@intel.com commit c48f1f459e4227abbb88271e2717235de575b22e Author: Lizhi Hou Date: Mon Nov 3 22:25:43 2025 -0800 accel/amdxdna: Add hardware specific attributes Add three hardware specific attributes to describe device capabilities: hwctx_limit: The maximum number of hardware context supported. max_tops: The maximum TOPS supported. curr_tops: The TOPS achievable with the current power and frequency configuration. Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20251104062546.833771-1-lizhi.hou@amd.com commit f903b85ed0f14fc412d8a781d3fcc0c023dfcd7c Author: Alex Deucher Date: Wed Oct 22 17:11:38 2025 -0400 drm/amdgpu: fix possible fence leaks from job structure If we don't end up initializing the fences, free them when we free the job. We can't set the hw_fence to NULL after emitting it because we need it in the cleanup path for the submit direct case. v2: take a reference to the fences if we emit them v3: handle non-job fence in error paths Fixes: db36632ea51e ("drm/amdgpu: clean up and unify hw fence handling") Reviewed-by: Jesse Zhang (v1) Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d95ca7f515cfd2e721de07e86aa79adb17575a52 Author: YiPeng Chai Date: Tue Oct 28 16:18:31 2025 +0800 drm/amdgpu: suspend ras module before gpu reset During gpu reset, all GPU-related resources are inaccessible. To avoid affecting ras functionality, suspend ras module before gpu reset and resume it after gpu reset is complete. V2: Rename functions to avoid misunderstanding. V3: Move flush_delayed_work to amdgpu_ras_process_pause, Move schedule_delayed_work to amdgpu_ras_process_unpause. V4: Rename functions. V5: Move the function to amdgpu_ras.c. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Reviewed-by: Hawking Zhang Acked-by: Lijo Lazar Signed-off-by: Alex Deucher commit d4432f16d3393180e8f0b344b21839e553f7938b Author: Gangliang Xie Date: Mon Sep 15 17:13:25 2025 +0800 drm/amdgpu: add wrapper functions for pmfw eeprom interface add wrapper functions for pmfw eeprom interface, for these interfaces to be easily and safely called Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit f6cdcbd2c0f37896766623b928a4ce95c54fb3e6 Author: Gangliang Xie Date: Mon Sep 15 12:55:36 2025 +0800 drm/amdgpu: add function to check if pmfw eeprom is supported add function to check if pmfw is supported, skip eeprom check and recover when pmfw eeprom is supported Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit f5346a176cb5e2860581ee91110d6f037bb87d85 Author: Gangliang Xie Date: Mon Sep 15 12:52:35 2025 +0800 drm/amd/pm: add smu ras driver framework add functions to get smu ras driver Signed-off-by: Gangliang Xie Signed-off-by: Yang Wang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 77dbd7c0a2e5ead15564ce2e7ef66a7f38d60794 Author: Gangliang Xie Date: Fri Sep 12 12:43:35 2025 +0800 drm/amd/pm: implement ras_smu_drv interface for smu v13.0.12 implement ras_smu_drv interface for smu v13.0.12 Signed-off-by: Gangliang Xie Signed-off-by: Yang Wang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 0c6f09e65b86cec39a96ec60912d5da29aee0ff3 Author: Gangliang Xie Date: Mon Sep 8 17:08:29 2025 +0800 drm/amd/pm: add new message definitions for pmfw eeprom interface Add new message definitions for pmfw eeprom interface Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 88ef4de35f46b76a19858f8ca5b93e5e23f244e2 Author: Philip Yang Date: Wed Oct 29 09:41:04 2025 -0400 Revert "drm/amdkfd: Improve signal event slow path" To fix regression report on gfx8, which requires the exhaustive search path for signaled event. The high CPU usage of KFD interrupt wq issue is gone after HIP/ROCr add option to reduce HW event interrupts, safe to revert this optimization patch now. This reverts commit de844846f72b152119faaef1b363448dc8ea368f. Signed-off-by: Philip Yang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit f19bbecd34e3c15eed7e5e593db2ac0fc7a0e6d8 Author: Rong Zhang Date: Tue Oct 14 00:47:35 2025 +0800 drm/amd/display: Fix NULL deref in debugfs odm_combine_segments When a connector is connected but inactive (e.g., disabled by desktop environments), pipe_ctx->stream_res.tg will be destroyed. Then, reading odm_combine_segments causes kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 16 UID: 0 PID: 26474 Comm: cat Not tainted 6.17.0+ #2 PREEMPT(lazy) e6a17af9ee6db7c63e9d90dbe5b28ccab67520c6 Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN25WW 03/27/2025 RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: seq_read_iter+0x125/0x490 ? __alloc_frozen_pages_noprof+0x18f/0x350 seq_read+0x12c/0x170 full_proxy_read+0x51/0x80 vfs_read+0xbc/0x390 ? __handle_mm_fault+0xa46/0xef0 ? do_syscall_64+0x71/0x900 ksys_read+0x73/0xf0 do_syscall_64+0x71/0x900 ? count_memcg_events+0xc2/0x190 ? handle_mm_fault+0x1d7/0x2d0 ? do_user_addr_fault+0x21a/0x690 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 RIP: 0033:0x7f44d4031687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00> RSP: 002b:00007ffdb4b5f0b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f44d3f9f740 RCX: 00007f44d4031687 RDX: 0000000000040000 RSI: 00007f44d3f5e000 RDI: 0000000000000003 RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007f44d3f5e000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000040000 Modules linked in: tls tcp_diag inet_diag xt_mark ccm snd_hrtimer snd_seq_dummy snd_seq_midi snd_seq_oss snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device x> snd_hda_codec_atihdmi snd_hda_codec_realtek_lib lenovo_wmi_helpers think_lmi snd_hda_codec_generic snd_hda_codec_hdmi snd_soc_core kvm snd_compress uvcvideo sn> platform_profile joydev amd_pmc mousedev mac_hid sch_fq_codel uinput i2c_dev parport_pc ppdev lp parport nvme_fabrics loop nfnetlink ip_tables x_tables dm_cryp> CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Fix this by checking pipe_ctx->stream_res.tg before dereferencing. Fixes: 07926ba8a44f ("drm/amd/display: Add debugfs interface for ODM combine info") Signed-off-by: Rong Zhang Reviewed-by: Mario Limoncello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 10c382ec6c6d1e11975a11962bec21cba6360391 Author: Philip Yang Date: Fri Oct 31 10:50:02 2025 -0400 drm/amdkfd: Don't clear PT after process killed If process is killed. the vm entity is stopped, submit pt update job will trigger the error message "*ERROR* Trying to push to a killed entity", job will not execute. Suggested-by: Christian König Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3f16007d8658357e0434f35f5ddb26cafd771df8 Author: YiPeng Chai Date: Fri Oct 31 15:39:20 2025 +0800 drm/amd/ras: Add ras support for umc v12_5_0 Add ras support for umc v12_5_0. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit d7f105a402191d560cbff7ffb930378dec25ecbb Author: YiPeng Chai Date: Fri Oct 31 15:41:26 2025 +0800 drm/amd/ras: Add ras support for nbio v7_9_1 Add ras support for nbio v7_9_1. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 2f46c547e4af870df9f6140af3a2068f6bc0b84d Author: YiPeng Chai Date: Fri Oct 31 14:33:18 2025 +0800 drm/amdgpu: Add ras ip block name Add ras ip block name. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 36265d2bcc9eef005e1b175c849f715b4dcd48df Author: YiPeng Chai Date: Fri Oct 31 13:37:30 2025 +0800 drm/amd/ras: Increase ras switch control range Increase ras switch control range. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit fd39b5a5830d8f2553e0c09d4d50bdff28b10080 Author: Alex Deucher Date: Fri Oct 24 13:08:11 2025 -0400 drm/amdgpu/smu: Handle S0ix for vangogh Fix the flows for S0ix. There is no need to stop rlc or reintialize PMFW in S0ix. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659 Reviewed-by: Mario Limonciello Reported-by: Antheas Kapenekakis Tested-by: Antheas Kapenekakis Signed-off-by: Alex Deucher commit c83fd2a6656ee47cba989146271c4b1e5f04966b Author: Lijo Lazar Date: Mon Aug 18 12:25:50 2025 +0530 drm/amd/pm: Update SMUv13.0.12 partition metrics Update SMUv13.0.12 partition metrics to partition metrics v1.1 schema. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 56aeca499ae6216cf7717997d744eda67d3d5500 Author: Lijo Lazar Date: Mon Aug 18 12:21:23 2025 +0530 drm/amd/pm: Update SMUv13.0.6 partition metrics For SMU v13.0.6 SOCs, move to partition metrics v1.1 schema Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 4f993e2309ba7f51b970044c563e5124b1cc03b1 Author: Lijo Lazar Date: Mon Aug 18 12:03:41 2025 +0530 drm/amd/pm: Add schema v1.1 for parition metrics Use a schema similar to gpu metrics v1.9 for partition metrics also. It will have field type encoded followed by the field value(s). The attribute ids used will be shared with gpu metrics. The structure definition is only to distinguish between gpu metrics and partition metrics though both gpu metrics v1.9 and partition metrics v1.1 follow the same definition. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit b480f573a8abd8f98474496fcf1eec86bf954002 Author: Lijo Lazar Date: Thu Aug 14 16:35:39 2025 +0530 drm/amd/pm: Use gpu metrics 1.9 for SMUv13.0.12 Fill and publish GPU metrics in v1.9 format for SMUv13.0.12 SOCs Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit cd6250f3aeb5ee81bf3724891f274f8a43737198 Author: Sunil Khatri Date: Fri Oct 31 14:10:13 2025 +0530 drm/amdgpu: validate the bo from done list for NULL Make sure the bo is valid before using it. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 36ffc58b8a8704e690a0ce679db26baa5759256f Author: Pierre-Eric Pelloux-Prayer Date: Tue Oct 28 14:09:05 2025 +0100 drm/amdgpu: lock bo before calling amdgpu_vm_bo_update_shared BO's reservation object must be locked before using amdgpu_vm_bo_update_shared otherwise dma_resv_assert_held will complain in amdgpu_vm_update_shared. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Signed-off-by: Alex Deucher commit c72d41a8f3090c2ecc12afdde1bcf9ed726157ce Author: Christian König Date: Fri Oct 31 09:21:36 2025 +0100 drm/amdgpu: grab a BO reference in vm_lock_done_list. Otherwise it is possible that between dropping the status lock and locking the BO that the BO is freed up. Signed-off-by: Christian König Reviewed-by: Sunil Khatri Signed-off-by: Alex Deucher commit 7cf422ed3386460ee13a3219f8192896f9759d77 Author: Xiang Liu Date: Thu Oct 30 22:38:49 2025 +0800 drm/amd/ras: Fix format truncation ../ras/rascore/ras_cper.c: In function ‘cper_generate_fatal_record.isra’: ../ras/rascore/ras_cper.c:75:36: error: ‘%llX’ directive output may be truncated writing between 1 and 14 bytes into a region of size between 0 and 7 [-Werror=format-truncation=] 75 | snprintf(record_id, 9, "%d:%llX", dev_info.socket_id, | ^~~~ ../ras/rascore/ras_cper.c:75:32: note: directive argument in the range [0, 72057594037927935] 75 | snprintf(record_id, 9, "%d:%llX", dev_info.socket_id, | ^~~~~~~~~ ../ras/rascore/ras_cper.c:75:9: note: ‘snprintf’ output between 4 and 27 bytes into a destination of size 9 75 | snprintf(record_id, 9, "%d:%llX", dev_info.socket_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 76 | RAS_LOG_SEQNO_TO_BATCH_IDX(trace->seqno)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../ras/rascore/ras_cper.c: In function ‘cper_generate_runtime_record.isra’: ../ras/rascore/ras_cper.c:75:36: error: ‘%llX’ directive output may be truncated writing between 1 and 14 bytes into a region of size between 0 and 7 [-Werror=format-truncation=] 75 | snprintf(record_id, 9, "%d:%llX", dev_info.socket_id, | ^~~~ ../ras/rascore/ras_cper.c:75:32: note: directive argument in the range [0, 72057594037927935] 75 | snprintf(record_id, 9, "%d:%llX", dev_info.socket_id, | ^~~~~~~~~ ../ras/rascore/ras_cper.c:75:9: note: ‘snprintf’ output between 4 and 27 bytes into a destination of size 9 75 | snprintf(record_id, 9, "%d:%llX", dev_info.socket_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 76 | RAS_LOG_SEQNO_TO_BATCH_IDX(trace->seqno)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors Signed-off-by: Xiang Liu Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 1da571bdb2b8b5b0a1b759cde1233c4cbf7ac00f Author: Taimur Hassan Date: Fri Oct 24 19:38:14 2025 -0500 drm/amd/display: Promote DC to 3.2.357 This version brings along following update: - HDCP2 FW locality check refactors - Fix black screen issue with HDMI output - Increase IB mem size - Revert max buffered cursor size to 64 - Extend inbox0 lock to run Replay / PSR - Refactor VActive implementation - Add Pstate viewport reduction - Persist stream refcount through restore Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3f0c27edd8fa0dd1e64d232687057a0be4ea836c Author: Taimur Hassan Date: Fri Oct 24 18:42:39 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.34.0 Release hightlights DCN35/36 * Dynamically clock gate before and after prefetch Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 678c901443a6d2e909e3b51331a20f9d8f84ce82 Author: Alex Hung Date: Wed Oct 22 16:19:34 2025 -0600 drm/amd/display: Fix black screen with HDMI outputs [Why & How] This fixes the black screen issue on certain APUs with HDMI, accompanied by the following messages: amdgpu 0000:c4:00.0: amdgpu: [drm] Failed to setup vendor info frame on connector DP-1: -22 amdgpu 0000:c4:00.0: [drm] Cannot find any crtc or sizes [drm] Cannot find any crtc or sizes Fixes: 489f0f600ce2 ("drm/amd/display: Fix DVI-D/HDMI adapters") Suggested-by: Timur Kristóf Reviewed-by: Harry Wentland Signed-off-by: Alex Hung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 54963d18a8e99e3eb5fe39b73c83b66fe8caf43f Author: Alvin Lee Date: Thu Oct 23 13:56:32 2025 -0400 drm/amd/display: Increase IB mem size [Why & How] Increase IB mem size to match size of largest structure that will use IB transfer between driver and DMU. Reviewed-by: Oleh Kuzhylnyi Signed-off-by: Alvin Lee Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ac7f4fcc7b7d3b922a0001a101f4ce1bd8824a5e Author: Dillon Varone Date: Thu Oct 23 17:07:04 2025 -0400 drm/amd/display: Revert DCN4 max buffered cursor size to 64 [Why & How] The buffered cursor cap is expressed assuming a square cursor, and usage of the cursor buffer is limited by the request size. For greater than 32 pixels, the request size is fixed at 256 bytes, so the maximum width must be floored to the nearest 256th byte. At 4bpp this means even with 24kB DCN4 can only hold a 64x64 cursor in the buffer as even 65 pixels would require 512 bytes per line instead of 256. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b0ba3108e3f8b20d8631ca4475a1a6d171973651 Author: Joshua Aberback Date: Thu Oct 23 16:43:56 2025 -0400 drm/amd/display: Persist stream refcount through restore [Why & How] Overwriting the refcount on stream restore can lead to double-free errors or memory leaks if an unbalanced number of retains and releases occurs between a backup and restore. Reviewed-by: Dillon Varone Signed-off-by: Joshua Aberback Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 717b836c27d9a4d5bcaae74fa83f7b3312d45620 Author: Austin Zheng Date: Tue Sep 30 14:32:03 2025 -0500 drm/amd/display: Add Pstate viewport reduction [Why/How] Add struct to hold calculated reduced viewport pstate recout reduction lines per plane Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1b3246352af8761f00c98f4ee9502e91634c33ed Author: Austin Zheng Date: Fri Oct 3 10:39:49 2025 -0400 drm/amd/display: Refactor VActive implementation [Why & How] Refactors VActive accounting in PMO, and breaks down fill time requirement by P-State type as it can result in drasitcally different bandwidth requirements depending on the blackout length. Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e44ee152a5ea8ee1b5f5440a754a9fd17639f230 Author: Austin Zheng Date: Wed Sep 24 10:23:24 2025 -0400 drm/amd/display: Update P-state naming for clarity. [Why & How] P-state can refer to different things like UCLK P-state, PPT, or temp read Update naming for clarity Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9c83768e578f991031d6943815842ede2ba94fcf Author: Austin Zheng Date: Wed Sep 17 12:56:00 2025 -0400 drm/amd/display: Remove old PMO options [Why & How] Removes deprecated or unused PMO options. Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e19cb97ea80865d4a5b33e94450213f25d470541 Author: Austin Zheng Date: Wed Sep 17 10:38:37 2025 -0500 drm/amd/display: Add pte_buffer_mode and force_one_row_for_frame in dchub reg [Why & How] Update structs for rq regs Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 7d041982fe11fff29b32a09228c4d52f159b56ad Author: Andrew Mazour Date: Wed Oct 15 12:19:49 2025 -0400 drm/amd/display: Extend inbox0 lock to run Replay/PSR [Why] The inbox1 infrastructure is deprecated, so to support display power features requiring a DMUB interlock moving forward extend the inbox0 locking conditions to also include Replay or PSR. [How] Implemented a series of changes to improve HW lock handling: - Deprecated should_use_dmub_inbox1_lock() and guarded it with DCN401 flag. - Migrated lock checks into inbox0 helpers and added PSR/Replay enablement checks to ensure correct behavior. - Updated HWSS fast update path to acquire HW lock as needed using the new helpers. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Andrew Mazour Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit face6a3615a649456eb4549f6d474221d877d604 Author: Wenjing Liu Date: Fri Oct 3 11:59:39 2025 -0400 drm/amd/display: fw locality check refactors [why] There are some new changes for HDCP2 firmware locality check. The implementation doesn't perfectly fit the intended design and clarity. 1. Clarify and consolidate variable responsibilities. The previous implementation introduced the following variables: - config.ddc.funcs.atomic_write_poll_read_i2c (optional pointer) - hdcp->config.ddc.funcs.atomic_write_poll_read_aux (optional pointer) - hdcp->connection.link.adjust.hdcp2.force_sw_locality_check (bool) - hdcp->config.debug.lc_enable_sw_fallback (bool) - use_fw (bool) They will be used together to determine two operations: - Whether to use FW locality check - Whether to use SW fallback on FW locality check failure The refactor streamlines this by introducing two variables in the hdcp2 link adjustment, while ensuring function pointers are always assigned and remain independent from policy decisions: - use_fw_locality_check (bool) -> true if fw locality should be used. - use_sw_locality_fallback (bool) -> true to reset use_fw_locality_check back to false and retry on fw locality check failure. 2. Mixed meanings of l_prime_read transition input l_prime_read originally means if l_prime is read when sw locality check is used. When FW locality check is used, l_prime_read means if lc init write, l prime poll and l_prime read combo operation is successful. The mix of meanings is confusing. The refactor introduces a new variable l_prime_combo_read to isolate the second meaning into its own variable. 3. Missing specific error code on firmware locality error. The original change reuses the generic DDC failure error code when firmware fails to return locality check result. This is not ideal as DDC failure indicates an error occurred during an I2C/AUX transaction. FW locality failure could be caused by polling timeout in firmware or failure to acquire firmware access. Which sits at a higher level of abstraction above DDC hardware. An incorrect error code could mislead the debug into a wrong direction. 4. Correcting misplaced comments. The previous implementation of the firmware locality check resulted in some comments in hdcp2_transition being incorrectly positioned. This refactor relocates those comments to their appropriate locations for better clarity. Reviewed-by: Aric Cyr Signed-off-by: Wenjing Liu Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 290f46cf5726509f55fac4c7abe9b9d311aa5a3a Author: Jesse.Zhang Date: Fri Oct 24 10:51:52 2025 +0800 drm/amdgpu: Implement user queue reset functionality This patch adds robust reset handling for user queues (userq) to improve recovery from queue failures. The key components include: 1. Queue detection and reset logic: - amdgpu_userq_detect_and_reset_queues() identifies failed queues - Per-IP detect_and_reset callbacks for targeted recovery - Falls back to full GPU reset when needed 2. Reset infrastructure: - Adds userq_reset_work workqueue for async reset handling - Implements pre/post reset handlers for queue state management - Integrates with existing GPU reset framework 3. Error handling improvements: - Enhanced state tracking with HUNG state - Automatic reset triggering on critical failures - VRAM loss handling during recovery 4. Integration points: - Added to device init/reset paths - Called during queue destroy, suspend, and isolation events - Handles both individual queue and full GPU resets The reset functionality works with both gfx/compute and sdma queues, providing better resilience against queue failures while minimizing disruption to unaffected queues. v2: add detection and reset calls when preemption/unmaped fails. add a per device userq counter for each user queue type.(Alex) v3: make sure we hold the adev->userq_mutex when we call amdgpu_userq_detect_and_reset_queues. (Alex) warn if the adev->userq_mutex is not held. v4: make sure we have all of the uqm->userq_mutex held. warn if the uqm->userq_mutex is not held. v5: Use array for user queue type counters.(Alex) all of the uqm->userq_mutex need to be held when calling detect and reset. (Alex) v6: fix lock dep warning in amdgpu_userq_fence_dence_driver_process v7: add the queue types in an array and use a loop in amdgpu_userq_detect_and_reset_queues (Lijo) v8: remove atomic_set(&userq_mgr->userq_count[i], 0). it should already be 0 since we kzalloc the structure (Alex) v9: For consistency with kernel queues, We may want something like: amdgpu_userq_is_reset_type_supported (Alex) Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 825df7ff4bb1a383ad4827545e09aec60d230770 Author: Mario Limonciello (AMD) Date: Thu Oct 30 14:39:43 2025 -0500 drm/amd/display: Don't stretch non-native images by default in eDP commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") started using the GPU scaler hardware to scale when a non-native resolution was picked on eDP. This scaling was done to fill the screen instead of maintain aspect ratio. The idea was supposed to be that if a different scaling behavior is preferred then the compositor would request it. The not following aspect ratio behavior however isn't desirable, so adjust it to follow aspect ratio and still try to fill screen. Note: This will lead to black bars in some cases for non-native resolutions. Compositors can request the previous behavior if desired. Fixes: 978fa2f6d0b1 ("drm/amd/display: Use scaling for non-native resolutions on eDP") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538 Signed-off-by: Mario Limonciello (AMD) Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit ff7644faf3529d186861b02957bf9c6b2fceb4c0 Author: Sunday Clement Date: Mon Oct 27 14:00:59 2025 -0400 drm/amdkfd: Fix Unchecked Return Values Properly Check for return values from calls to debug functions in runtime_disable(). v2: storing the last non zero returned value from the loop. Signed-off-by: Sunday Clement Reviewed-by: Jonathan Kim Signed-off-by: Alex Deucher commit 72b0b75d608b54f7bb94ee12737c4a62d95bce4a Author: Mario Limonciello (AMD) Date: Sat Oct 25 23:29:39 2025 -0500 drm/amd: Unwind for failed device suspend If device suspend has failed, add a recovery flow that will attempt to unwind the suspend and get things back up and running. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4627 Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 1d611218729dd7ab7bbc05e57ace5d4fa224b9bb Author: Mario Limonciello (AMD) Date: Sat Oct 25 23:29:38 2025 -0500 drm/amd: Add an unwind for failures in amdgpu_device_ip_suspend_phase2() If any hardware IPs involved with the second phase of suspend fail, unwind all steps to restore back to original state. Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 6f4208f9d992104fed0854f0b975a31ffb9c0d46 Author: Mario Limonciello (AMD) Date: Sat Oct 25 23:29:37 2025 -0500 drm/amd: Add an unwind for failures in amdgpu_device_ip_suspend_phase1() If any hardware IPs involved with the first phase of suspend fail, unwind all steps to restore back to original state. Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 960e30a61e1a7ca5341a6cf9481e770e1cda24aa Author: Alex Deucher Date: Sat Oct 25 23:29:36 2025 -0500 drm/amdgpu: Drop PMFW RLC notifier from amdgpu_device_suspend() For S3 on vangogh, PMFW needs to be notified before the driver powers down RLC. This already happens in smu_disable_dpms() so drop the superfluous call in amdgpu_device_suspend(). Co-developed-by: Mario Limonciello (AMD) Reviewed-by: Alex Deucher Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher commit 988fd51e45fce61ae8283ee47488fc9df31b57cf Author: Xiang Liu Date: Thu Oct 23 10:10:02 2025 +0800 drm/amd/ras: Use correct severity for BP threshold exceed event The severity of CPER for BP threshold exceed event should be set as FATAL to match the OOB implementation. Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit bfdffc29956eea59520b32308d8db0dbc7f6deb9 Author: Xiang Liu Date: Mon Oct 20 16:44:29 2025 +0800 drm/amd/ras: Correct info field of bad page threshold exceed CPER Correct valid_bits and ms_chk_bits of section info field for bad page threshold exceed CPER to match OOB's behavior. Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 399299d81f3d16e50d641a0ac454e7d4737cf08c Author: Lukas Bulwahn Date: Thu Oct 30 15:37:37 2025 +0100 MAINTAINERS: adjust file entry in AMD DISPLAY CORE - DML Commit e6a8a000cfe6 ("drm/amd/display: Rename dml2 to dml2_0 folder") renames the directory dml2 to dml2_0 in ./drivers/gpu/drm/amd/display/dc, but misses to adjust the file entry in AMD DISPLAY CORE - DML. Adjust the file entry after this directory renaming. Signed-off-by: Lukas Bulwahn Signed-off-by: Alex Deucher commit 2a30ff5bc4954fb1bc882d73a48b9b9cfabf55ce Author: Jiapeng Chong Date: Thu Oct 30 09:56:29 2025 +0800 drm/amd/display: remove unneeded semicolon No functional modification involved. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c:7392:3-4: Unneeded semicolon. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=26821 Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 26c288c1709aa638fc8c8d57f03f1739a0c3317f Author: Jiapeng Chong Date: Thu Oct 30 09:56:30 2025 +0800 drm/amd/display: remove unneeded semicolon No functional modification involved. ./drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c:1850:3-4: Unneeded semicolon. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=26821 Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 5d7ccf080cc43b1fe96c2f38bcb61dafce398e5b Author: Jiapeng Chong Date: Thu Oct 30 09:56:31 2025 +0800 drm/amd/display: remove unneeded semicolon No functional modification involved. ./drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c:1674:3-4: Unneeded semicolon. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=26821 Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 9f1cb2c3fa26d5529976c8bf795c14b7b677ce94 Author: Timur Kristóf Date: Thu Oct 30 10:15:56 2025 +0100 drm/amd/pm/si: Delete unused structs and fields The contents of si_dpm.h seem to have been copied from the old radeon driver, including a lot of structs and fields which were only relevant to GPU generations even older than SI. A lot of these can be deleted without causing much churn to the actual SI DPM code. Let's delete them to make the code easier to understand. Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher commit b4f748f22d315ae622ebfe068b9559b988702df8 Author: Lijo Lazar Date: Tue Aug 12 18:26:59 2025 +0530 drm/amd/pm: Use gpu metrics 1.9 for SMUv13.0.6 Fill and publish GPU metrics in v1.9 format for SMUv13.0.6 SOCs Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit c3cd00fea6d6980faf32421495d0f48727ace89a Author: Lijo Lazar Date: Mon Aug 11 19:07:05 2025 +0530 drm/amd/pm: Add helper functions for gpu metrics Add helper macros to define metrics struct definitions. It will define structs with field type followed by actual field. A helper macro is also added to initialize the field encoding for all fields and to initialize the field members to 0xFFs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 4c4c138a1c86775c4d47e24f26357a1f8b64d0a3 Author: Yang Wang Date: Thu Oct 30 13:06:24 2025 +0800 drm/amd/pm: fix missing device_attr cleanup in amdgpu_pm_sysfs_init() Use the correct label to complete all cleanup work. Fixes: 4d154b1ca580 ("drm/amd/pm: Add support for DPM policies") Fixes: 25e82f2e2c59 ("drm/amd/pm: Add temperature metrics sysfs entry") Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 8f94d5d0d7ec2af5c583ca6666acfc8f4413a850 Author: Yang Wang Date: Mon Oct 27 15:22:54 2025 +0800 drm/amd/pm: fix the issue of size calculation error for smu 13.0.6 v1: the driver should handle return value of smu_v13_0_6_printk_clk_levels() to return the correct size for sysfs reads. v2: fix the issue of size calculation error in smu_v13_0_6_print_clks() Fixes: cdfdec6f1608 ("drm/amd/pm: Avoid writing nulls into `pp_od_clk_voltage`") Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 87208c10683930fbc066e6fe3b6111a0ab67bd04 Author: Xiang Liu Date: Mon Oct 20 15:45:23 2025 +0800 drm/amd/ras: Update IPID value for bad page threshold CPER The IPID register value for bad page threshold CPER holds socket_id info now according to the latest definition. Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 5e55fd9bc6bd5098ba963f6b3118549f2621bca5 Author: Harry Wentland Date: Wed Oct 29 10:28:14 2025 -0400 drm/amd/display: Fix null pointer on analog detection Check if we have an amdgpu_dm_connector->dc_sink first before adding common modes for analog outputs. If we don't have a sink yet we can safely skip this. Fixes: 70181ad96ec2 ("drm/amd/display: Add common modes to analog displays without EDID") Signed-off-by: Harry Wentland Reviewed-by: Timur Kristóf Signed-off-by: Alex Deucher commit 812b727364f166e9e4529a56c33707a9cf15e651 Author: YiPeng Chai Date: Tue Oct 28 16:30:12 2025 +0800 drm/amdgpu: Fix error injection parameter error Fix error injection parameter error. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit fd0e35bdd3a5ca43cfe4dad48ad7df510ee18407 Author: YiPeng Chai Date: Tue Oct 28 16:34:34 2025 +0800 drm/amd/ras: Fix the error of undefined reference to `__udivdi3' Fix the error: drivers/gpu/drm/amd/amdgpu/../ras/ras_mgr/amdgpu_ras_mgr.c:132:undefined reference to `__udivdi3' Fixes: fa0b203cd902 ("drm/amd/ras: Add amdgpu ras management function.") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202510272144.6SUHUoWx-lkp@intel.com/ Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 380fd29d57abe6679d87ec56babe65ddc5873a37 Author: Vishwaroop A Date: Tue Oct 28 15:57:03 2025 +0000 spi: tegra210-quad: Check hardware status on timeout Under high system load, QSPI interrupts can be delayed or blocked on the target CPU, causing wait_for_completion_timeout() to report failure even though the hardware successfully completed the transfer. When a timeout occurs, check the QSPI_RDY bit in QSPI_TRANS_STATUS to determine if the hardware actually completed the transfer. If so, manually invoke the completion handler to process the transfer successfully instead of failing it. This distinguishes lost/delayed interrupts from real hardware timeouts, preventing unnecessary failures of transfers that completed successfully. Signed-off-by: Vishwaroop A Acked-by: Thierry Reding Link: https://patch.msgid.link/20251028155703.4151791-4-va@nvidia.com Signed-off-by: Mark Brown commit 6022eacdda8b0b06a2e1d4122e5268099b62ff5d Author: Vishwaroop A Date: Tue Oct 28 15:57:02 2025 +0000 spi: tegra210-quad: Refactor error handling into helper functions Extract common cleanup code into dedicated helper functions to simplify the code and improve readability. This refactoring includes: - tegra_qspi_reset(): Device reset and interrupt cleanup - tegra_qspi_dma_stop(): DMA termination and disable - tegra_qspi_pio_stop(): PIO mode disable No functional changes. This is purely a code reorganization to prepare for improved timeout handling in subsequent patches. Signed-off-by: Vishwaroop A Acked-by: Thierry Reding Link: https://patch.msgid.link/20251028155703.4151791-3-va@nvidia.com Signed-off-by: Mark Brown commit b4e002d8a7cee3b1d70efad0e222567f92a73000 Author: Vishwaroop A Date: Tue Oct 28 15:57:01 2025 +0000 spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running before the transfer timeout is reached. While handling the timeouts, any pending transfers are cleaned up and the message that they correspond to is marked as failed, which leaves the curr_xfer field pointing at stale memory. To avoid this, clear curr_xfer to NULL upon timeout and check for this condition when the IRQ thread is finally run. While at it, also make sure to clear interrupts on failure so that new interrupts can be run. A better, more involved, fix would move the interrupt clearing into a hard IRQ handler. Ideally we would also want to signal that the IRQ thread no longer needs to be run after the timeout is hit to avoid the extra check for a valid transfer. Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller") Signed-off-by: Thierry Reding Signed-off-by: Vishwaroop A Link: https://patch.msgid.link/20251028155703.4151791-2-va@nvidia.com Signed-off-by: Mark Brown commit d80391dd037af032a38e36a9f9d366b7afd195b4 Author: Asad Kamal Date: Tue Oct 28 22:08:28 2025 +0800 drm/amdgpu: Remove invalidate and flush hdp macros Remove amdgpu_asic_flush_hdp & amdgpu_asic_invalidate_hdp functions and directly use the mapped ones Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 527e3d40339b228f1c5a81ef17b4d883ead18530 Author: Xiang Liu Date: Wed Oct 22 15:11:42 2025 +0800 drm/amd/ras: Add CPER ring read for uniras Read CPER raw data from debugfs node "/sys/kernel/debug/dri/*/ amdgpu_ring_cper". Signed-off-by: Xiang Liu Reviewed-by: Tao Zhou Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit ad0a48e531a3137cec16bb5f8f60c8cc8de06b01 Author: Alex Deucher Date: Tue Oct 14 17:01:05 2025 -0400 drm/amdgpu: move reset debug disable handling Move everything to the supported resets masks rather than having an explicit misc checks for this. Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit b5e333e634bfcb740ae157653a9788f6c75226c2 Author: Asad Kamal Date: Mon Oct 27 18:11:52 2025 +0800 drm/amdgpu: Update invalidate and flush hdp function Update asic_invalidate_hdp and asic_flush_hdp function to check if ip function exist, if not return void v2: Use else/if (Kevin) Update function name (Lijo) Signed-off-by: Asad Kamal Suggested-by: Lijo Lazar Reviewed-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit c6526cc6f887c710bab21ee934035a2c9ffb8c4b Author: Sunil Khatri Date: Tue Oct 28 17:39:27 2025 +0530 drm/amdgpu: caller should make sure not to double free Remove the NULL check from amdgpu_hmm_range_free for hmm_pfns as caller is responsible not to call amdgpu_hmm_range_free more than once. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 1972763505d728c604b537180727ec8132e619df Author: Alex Deucher Date: Tue Oct 14 16:45:17 2025 -0400 drm/amdgpu: set default gfx reset masks for gfx6-8 These were not set so soft recovery was inadvertantly disabled. Fixes: 6ac55eab4fc4 ("drm/amdgpu: move reset support type checks into the caller") Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit c0de552910bbd9e49568c1052e00ed118712152a Author: Sunil Khatri Date: Tue Oct 28 13:49:24 2025 +0530 drm/amdkfd: clean up the code to free hmm_range a. hmm_range is either NULL or a valid pointer so we do not need to set range to NULL ever. b. keep the hmm_range_free in the end irrespective of the other conditions to avoid some additional checks and also avoid double free issue. Signed-off-by: Sunil Khatri Reviewed-by: Felix Kuehling Acked-by: Christian König Signed-off-by: Alex Deucher commit 4b25b75c30d90a2ad45eb6c79d4c71fdbb06bb4e Author: Caleb Sander Mateos Date: Wed Oct 15 11:25:54 2025 -0600 io_uring/memmap: return bool from io_mem_alloc_compound() io_mem_alloc_compound() returns either ERR_PTR(-ENOMEM) or a virtual address for the allocated memory, but its caller just checks whether the result is an error. Return a bool success value instead. Signed-off-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit ffce324364318220acf83e576eac06549cbf9911 Author: Jens Axboe Date: Mon Nov 3 12:39:05 2025 -0700 io_uring/cancel: move cancelation code from io_uring.c to cancel.c There's a bunch of code strictly dealing with cancelations, and that code really belongs in cancel.c rather than in the core io_uring.c file. Move the code there. Mostly mechanical, only real oddity here is that struct io_defer_entry now needs to be visible across both io_uring.c and cancel.c. Signed-off-by: Jens Axboe commit 01e019b2a30df41c485f602a5246124ea911071b Author: Jens Axboe Date: Mon Nov 3 11:23:23 2025 -0700 io_uring/cancel: move __io_uring_cancel() into cancel.c Yet another function that should be in cancel.c, move it over. Signed-off-by: Jens Axboe commit 0d677936d67774f1b4ebfb3b26f207320f0fe3c6 Author: Jens Axboe Date: Mon Nov 3 11:21:39 2025 -0700 io_uring/cancel: move request/task cancelation logic into cancel.c Move io_match_task_safe() and helpers into cancel.c, where it belongs. Signed-off-by: Jens Axboe commit bc82b02218204d89f26fd1fde5aed265f40453d3 Author: Jens Axboe Date: Mon Nov 3 11:11:27 2025 -0700 io_uring/memmap: remove dead io_create_region_mmap_safe() declaration No longer used and doesn't even exist, kill it from the memmap header file. Signed-off-by: Jens Axboe commit 1a2cf01e1c92f29fd22ae394c06860da1c339339 Author: Matthew Brost Date: Fri Oct 31 16:40:50 2025 -0700 drm/xe: Remove last fence dependency check from binds and execs Eliminate redundant last fence dependency checks in exec and bind jobs, as they are now equivalent to xe_exec_queue_is_idle. Simplify the code by removing this dead logic. Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-7-matthew.brost@intel.com commit aa87b681bc728ae2fb2b725733bcb129079985f4 Author: Matthew Brost Date: Fri Oct 31 16:40:49 2025 -0700 drm/xe: Disallow input fences on zero batch execs and zero binds Prevent input fences from being installed on zero batch execs or zero binds, which were originally added to support queue idling in Mesa via output fences. Although input fence support was introduced for interface consistency, it leads to incorrect behavior due to chained composite fences, which are disallowed. Avoid the complexity of fixing this by removing support, as input fences for these cases are not used in practice. Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-6-matthew.brost@intel.com commit ebb0880d497356befb0ff4d36fb0e1d072701805 Author: Matthew Brost Date: Fri Oct 31 16:40:48 2025 -0700 drm/xe: Skip TLB invalidation waits in page fault binds Avoid waiting on unrelated TLB invalidations when servicing page fault binds. Since the migrate queue is shared across processes, TLB invalidations triggered by other processes may occur concurrently but are not relevant to the current bind. Teach the bind pipeline to skip waits on such invalidations to prevent unnecessary serialization. Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-5-matthew.brost@intel.com commit cb99e12ba8cb8a16c44e6de7927e9a1d84260f24 Author: Matthew Brost Date: Fri Oct 31 16:40:47 2025 -0700 drm/xe: Decouple bind queue last fence from TLB invalidations Separate the bind queue’s last fence to apply exclusively to the bind job, avoiding unnecessary serialization on prior TLB invalidations. Preserve correct user fence signaling by merging bind and TLB invalidation fences later in the pipeline. v3: - Fix lockdep assert for migrate queues (CI) - Use individual dma fence contexts for array out fences (Testing) - Don't set last fence with arrays (Testing) - Move TLB invalid last fence under migrate lock (Testing) - Don't set queue last for migrate queues (Testing) Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6047 Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-4-matthew.brost@intel.com commit b2d7ec41f2a3ab99cf0bf0fafc20d4d10bb6b0de Author: Matthew Brost Date: Fri Oct 31 16:40:46 2025 -0700 drm/xe: Attach last fence to TLB invalidation job queues Add support for attaching the last fence to TLB invalidation job queues to address serialization issues during bursts of unbind jobs. Ensure that user fence signaling for a bind job reflects both the bind job itself and the last fences of all related TLB invalidations. Maintain submission order based solely on the state of the bind and TLB invalidation queues. Introduce support functions for last fence attachment to TLB invalidation queues. v3: - Fix assert in xe_exec_queue_tlb_inval_last_fence_set (CI) - Ensure migrate lock held for migrate queues (Testing) v5: - Style nits (Thomas) - Rewrite commit message (Thomas) Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-3-matthew.brost@intel.com commit adda4e855ab6409a3edaa585293f1f2069ab7299 Author: Matthew Brost Date: Fri Oct 31 16:40:45 2025 -0700 drm/xe: Enforce correct user fence signaling order using Prevent application hangs caused by out-of-order fence signaling when user fences are attached. Use drm_syncobj (via dma-fence-chain) to guarantee that each user fence signals in order, regardless of the signaling order of the attached fences. Ensure user fence writebacks to user space occur in the correct sequence. v7: - Skip drm_syncbj create of error (CI) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com commit 2f6da95cfbafce1fc92f8f37944356c248bec36d Author: Dinh Nguyen Date: Tue Nov 4 06:55:16 2025 -0600 arm64: dts: socfpga: agilex5: fix CHECK_DTBS warning for NAND Add the required clock-names property NAND controller. This change corrects the warning: socfpga_agilex5_socdk_nand.dtb: nand-controller@10b80000 (cdns,hp-nfc): 'clock-names' is a required property Signed-off-by: Dinh Nguyen commit a3fcddaa434712747e136a2a7d02ebd30dc6d76b Author: Marek Vasut Date: Fri Sep 19 20:30:15 2025 +0200 drm/etnaviv: add HWDB entry for GC8000 Nano Ultra VIP r6205 This is the GPU/NPU combined device found on the ST STM32MP25 SoC. Feature bits taken from the downstream kernel driver 6.4.21. Signed-off-by: Marek Vasut Acked-by: Christian Gmeiner Signed-off-by: Christian Gmeiner Link: https://patch.msgid.link/20250919183042.273687-1-marek.vasut@mailbox.org commit 2f294c35c0b9302dac2a741fa715822a10c265c3 Merge: 25bd47a592751e 1149fcf75972f6 Author: Steven Rostedt Date: Tue Nov 4 10:05:02 2025 -0500 Merge branch 'topic/func-profiler-offset' of git://git.kernel.org/pub/scm/linux/kernel/git/mhiramat/linux into trace/trace/core Updates to the function profiler adds new options to tracefs. The options are currently defined by an enum as flags. The added options brings the number of options over 32, which means they can no longer be held in a 32 bit enum. The TRACE_ITER_* flags are converted to a macro TRACE_ITER(*) to allow the creation of options to still be done by macros. This change is intrusive, as it affects all TRACE_ITER* options throughout the trace code. Merge the branch that added these options and converted the TRACE_ITER_* enum into a TRACE_ITER(*) macro, to allow the topic branches to still be developed without conflict. Signed-off-by: Steven Rostedt (Google) commit 255d75ef029f33f75fcf5015052b7302486f7ad2 Merge: 27cb3de7f43ac0 30ed05adca4a05 Author: Paolo Abeni Date: Tue Nov 4 16:10:54 2025 +0100 Merge branch 'xsk-minor-optimizations-around-locks' Jason Xing says: ==================== xsk: minor optimizations around locks Two optimizations regarding xsk_tx_list_lock and cq_lock can yield a performance increase because of avoiding disabling and enabling interrupts frequently. ==================== Link: https://patch.msgid.link/20251030000646.18859-1-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni commit 30ed05adca4a05c50594384cff18910858dd1d35 Author: Jason Xing Date: Thu Oct 30 08:06:46 2025 +0800 xsk: use a smaller new lock for shared pool case - Split cq_lock into two smaller locks: cq_prod_lock and cq_cached_prod_lock - Avoid disabling/enabling interrupts in the hot xmit path In either xsk_cq_cancel_locked() or xsk_cq_reserve_locked() function, the race condition is only between multiple xsks sharing the same pool. They are all in the process context rather than interrupt context, so now the small lock named cq_cached_prod_lock can be used without handling interrupts. While cq_cached_prod_lock ensures the exclusive modification of @cached_prod, cq_prod_lock in xsk_cq_submit_addr_locked() only cares about @producer and corresponding @desc. Both of them don't necessarily be consistent with @cached_prod protected by cq_cached_prod_lock. That's the reason why the previous big lock can be split into two smaller ones. Please note that SPSC rule is all about the global state of producer and consumer that can affect both layers instead of local or cached ones. Frequently disabling and enabling interrupt are very time consuming in some cases, especially in a per-descriptor granularity, which now can be avoided after this optimization, even when the pool is shared by multiple xsks. With this patch, the performance number[1] could go from 1,872,565 pps to 1,961,009 pps. It's a minor rise of around 5%. [1]: taskset -c 1 ./xdpsock -i enp2s0f1 -q 0 -t -S -s 64 Signed-off-by: Jason Xing Acked-by: Maciej Fijalkowski Link: https://patch.msgid.link/20251030000646.18859-3-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni commit 462280043466b2bc74483c56a5d5316ff6b16380 Author: Jason Xing Date: Thu Oct 30 08:06:45 2025 +0800 xsk: do not enable/disable irq when grabbing/releasing xsk_tx_list_lock The commit ac98d8aab61b ("xsk: wire upp Tx zero-copy functions") originally introducing this lock put the deletion process in the sk_destruct which can run in irq context obviously, so the xxx_irqsave()/xxx_irqrestore() pair was used. But later another commit 541d7fdd7694 ("xsk: proper AF_XDP socket teardown ordering") moved the deletion into xsk_release() that only happens in process context. It means that since this commit, it doesn't necessarily need that pair. Now, there are two places that use this xsk_tx_list_lock and only run in the process context. So avoid manipulating the irq then. Signed-off-by: Jason Xing Acked-by: Maciej Fijalkowski Link: https://patch.msgid.link/20251030000646.18859-2-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni commit c4e68959af66df525d71db619ffe44af9178bb22 Author: Baojun Xu Date: Tue Nov 4 12:13:13 2025 +0800 ASoC: dt-bindings: ti,tas2781: Add TAS5822 support TAS5822 is in same family with TAS58XX. Signed-off-by: Baojun Xu Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20251104041314.792-2-baojun.xu@ti.com Signed-off-by: Mark Brown commit ecaba8b7990d8c6d8ba097cd4499b3b92d9df6ea Author: Baojun Xu Date: Tue Nov 4 12:13:12 2025 +0800 ASoC: tas2781: Add tas5822 support TAS5822 has on-chip DSP without current/voltage feedback. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20251104041314.792-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit 3b071bdd26849172101081573a18022af108fb21 Author: HariKrishna Sagala Date: Tue Nov 4 11:12:58 2025 +0530 ASoC: tas2781: Replace deprecated strcpy() with strscpy() strcpy() is deprecated,use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: HariKrishna Sagala Link: https://patch.msgid.link/20251104054257.9953-2-hariconscious@gmail.com Signed-off-by: Mark Brown commit a4ff26b7c8ef38e4dd34f77cbcd73576fdde6dd4 Author: Jouni Högander Date: Fri Oct 31 14:23:11 2025 +0200 drm/xe: Do clean shutdown also when using flr Currently Xe driver is triggering flr without any clean-up on shutdown. This is causing random warnings from pending related works as the underlying hardware is reset in the middle of their execution. Fix this by performing clean shutdown also when using flr. Fixes: 501d799a47e2 ("drm/xe: Wire up device shutdown handler") Cc: Maarten Lankhorst Signed-off-by: Jouni Högander Reviewed-by: Maarten Lankhorst Link: https://patch.msgid.link/20251031122312.1836534-1-jouni.hogander@intel.com Signed-off-by: Maarten Lankhorst commit af9c8092d84244ca54ffb590435735f788e7a170 Author: Andy Shevchenko Date: Mon Nov 3 19:09:46 2025 +0100 regmap: i3c: Use ARRAY_SIZE() Use ARRAY_SIZE() instead of hard coded numbers to show the intention and make code robust against potential changes. Signed-off-by: Andy Shevchenko Reviewed-by: Danilo Krummrich Link: https://patch.msgid.link/20251103180946.604127-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 9de2057bbdfb58f4d9bb1476135317cd3fe6aa52 Merge: 252abf2d07d33b 2ecc8c089802e0 Author: Mark Brown Date: Tue Nov 4 13:29:43 2025 +0000 regulator: pf9453: optimize PMIC PF9453 driver Merge series from Joy Zou : For the details, please check the patch commit log. Signed-off-by: Joy Zou --- Joy Zou (3): regulator: pf9453: change the device ID register address regulator: pf9453: remove low power mode regulator: pf9453: remove unused I2C_LT register drivers/regulator/pf9453-regulator.c | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) --- base-commit: 98bd8b16ae57e8f25c95d496fcde3dfdd8223d41 change-id: 20251103-b4-next-pf9453-c9f8fb6e0c10 Best regards, -- Joy Zou commit 46f045db5a94cd50b24dc1449bdd444e4473b28b Author: FUJITA Tomonori Date: Mon Nov 3 20:29:58 2025 +0900 rust: Add read_poll_timeout_atomic function Add read_poll_timeout_atomic function which polls periodically until a condition is met, an error occurs, or the attempt limit is reached. The C's read_poll_timeout_atomic() is used for the similar purpose. In atomic context the timekeeping infrastructure is unavailable, so reliable time-based timeouts cannot be implemented. So instead, the helper accepts a maximum number of attempts and busy-waits (udelay + cpu_relax) between tries. Reviewed-by: Alice Ryhl Signed-off-by: FUJITA Tomonori Link: https://patch.msgid.link/20251103112958.2961517-3-fujita.tomonori@gmail.com [ Adjust imports to use "kernel vertical" style. - Danilo ] Signed-off-by: Danilo Krummrich commit 83cbb4d33dc22b0ca1a4e85c6e892c9b729e28d4 Author: Jani Nikula Date: Tue Oct 28 22:07:27 2025 +0200 drm/displayid: add quirk to ignore DisplayID checksum errors Add a mechanism for DisplayID specific quirks, and add the first quirk to ignore DisplayID section checksum errors. It would be quite inconvenient to pass existing EDID quirks from drm_edid.c for DisplayID parsing. Not all places doing DisplayID iteration have the quirks readily available, and would have to pass it in all places. Simply add a separate array of DisplayID specific EDID quirks. We do end up checking it every time we iterate DisplayID blocks, but hopefully the number of quirks remains small. There are a few laptop models with DisplayID checksum failures, leading to higher refresh rates only present in the DisplayID blocks being ignored. Add a quirk for the panel in the machines. Reported-by: Tiago Martins Araújo Closes: https://lore.kernel.org/r/CACRbrPGvLP5LANXuFi6z0S7XMbAG4X5y2YOLBDxfOVtfGGqiKQ@mail.gmail.com Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14703 Acked-by: Alex Deucher Tested-by: Tiago Martins Araújo Cc: stable@vger.kernel.org Link: https://patch.msgid.link/c04d81ae648c5f21b3f5b7953f924718051f2798.1761681968.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 8b61583f993589a64c061aa91b44f5bd350d90a5 Author: Jani Nikula Date: Tue Oct 28 22:07:26 2025 +0200 drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident Add a convenience helper for initializing struct drm_edid_ident. Cc: Tiago Martins Araújo Acked-by: Alex Deucher Tested-by: Tiago Martins Araújo Cc: stable@vger.kernel.org Link: https://patch.msgid.link/710b2ac6a211606ec1f90afa57b79e8c7375a27e.1761681968.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 520f37c30992fd0c212a34fbe99c062b7a3dc52e Author: Jani Nikula Date: Tue Oct 28 22:07:25 2025 +0200 drm/displayid: pass iter to drm_find_displayid_extension() It's more convenient to pass iter than a handful of its members to drm_find_displayid_extension(), especially as we're about to add another member. Rename the function find_next_displayid_extension() while at it, to be more descriptive. Cc: Tiago Martins Araújo Acked-by: Alex Deucher Tested-by: Tiago Martins Araújo Cc: stable@vger.kernel.org Link: https://patch.msgid.link/3837ae7f095e77a082ac2422ce2fac96c4f9373d.1761681968.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1149fcf75972f6918aeb05303b1aa1e38e0df6eb Author: Masami Hiramatsu (Google) Date: Fri Oct 31 11:46:20 2025 +0900 tracing: Add an option to show symbols in _text+offset for function profiler Function profiler shows the hit count of each function using its symbol name. However, there are some same-name local symbols, which we can not distinguish. To solve this issue, this introduces an option to show the symbols in "_text+OFFSET" format. This can avoid exposing the random shift of KASLR. The functions in modules are shown as "MODNAME+OFFSET" where the offset is from ".text". E.g. for the kernel text symbols, specify vmlinux and the output to addr2line, you can find the actual function and source info; $ addr2line -fie vmlinux _text+3078208 __balance_callbacks kernel/sched/core.c:5064 for modules, specify the module file and .text+OFFSET; $ addr2line -fie samples/trace_events/trace-events-sample.ko .text+8224 do_simple_thread_func samples/trace_events/trace-events-sample.c:23 Link: https://lore.kernel.org/all/176187878064.994619.8878296550240416558.stgit@devnote2/ Suggested-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit bbec8e28cac5928c20052c489cb2e345e6bd4271 Author: Masami Hiramatsu (Google) Date: Fri Oct 31 11:46:11 2025 +0900 tracing: Allow tracer to add more than 32 options Since enum trace_iterator_flags is 32bit, the max number of the option flags is limited to 32 and it is fully used now. To add a new option, we need to expand it. So replace the TRACE_ITER_##flag with TRACE_ITER(flag) macro which is 64bit bitmask. Link: https://lore.kernel.org/all/176187877103.994619.166076000668757232.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit 74ba587f402d5501af2c85e50cf1e4044263b6ca Author: Jani Nikula Date: Tue Nov 4 12:02:53 2025 +0200 drm/hyperv: include drm_print.h where needed hyperv_drm_drv.c and hyperv_drm_modeset.c depend on drm_print.h being indirectly included via drm_buddy.h, drm_mm.h, or ttm/ttm_resource.h. Include drm_print.h explicitly. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20251104101158.1cc9abcd@canb.auug.org.au Fixes: f6e8dc9edf96 ("drm: include drm_print.h where needed") Cc: Thomas Zimmermann Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20251104100253.646577-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1a31cb2782104969e48c7ce7e4fc06e403fcb5cf Author: Edward Adam Davis Date: Mon Nov 3 19:57:49 2025 +0800 media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc syzbot reported a uninit-value in pctv452e_i2c_msg. [1] When the snd_len or rcv_len check fails and jumps to failed, buf is uninitialized, triggering the uninit-value issue. Move the snd/rcv length check before kmalloc, and return -EINVAL directly if the condition is met. [1] BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220 pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502 Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe Signed-off-by: Edward Adam Davis Signed-off-by: Hans Verkuil commit c4227e1609b355cde373b5770bd91a7eb49eb9cb Author: Khaled Almahallawy Date: Tue Oct 28 12:07:53 2025 -0700 drm/i915/display: Extend i915_display_info with Type-C port details Expose key Type-C port data in i915_display_info to make it easier to understand the port configuration and active mode, especially whether the link is in DP-Alt or TBT-Alt, without having to scan kernel logs. Tested in DP-Alt, TBT-Alt, SST, and MST. Expected output: [CONNECTOR:290:DP-2]: status: connected TC Port: E/TC#2 mode: tbt-alt pin assignment: - max lanes: 4 physical dimensions: 600x340mm ... [CONNECTOR:263:DP-5]: status: connected TC Port: G/TC#4 mode: dp-alt pin assignment: C max lanes: 4 physical dimensions: 610x350mm v2: Use drm_printer (Ville) Lock/Unlock around the printf (Imre) v3: Forward Declaration drm_printer struct (Jani) v4: Handle MST connector with no active encoder (Imre) Add a delimiter between fields and ":" after the port name (Imre) v5: Init dig_port and use it in intel_encorder_is_tc and tc_info (Imre) Move tc->port_name to a newline (Imre) v6: Use intel_tc_port_lock/Unlock (Imre) Cc: Ville Syrjälä Cc: Imre Deak Cc: Jani Nikula Signed-off-by: Khaled Almahallawy Reviewed-by: Imre Deak Signed-off-by: Imre Deak Link: https://patch.msgid.link/20251028190753.3089937-1-khaled.almahallawy@intel.com commit ad68b55a9ed0e5ce16508cb10081a73ea8f4bbef Author: FUJITA Tomonori Date: Mon Nov 3 20:29:57 2025 +0900 rust: add udelay() function Add udelay() function, inserts a delay based on microseconds with busy waiting, in preparation for supporting read_poll_timeout_atomic(). Reviewed-by: Andreas Hindborg Reviewed-by: Alice Ryhl Signed-off-by: FUJITA Tomonori Acked-by: Andreas Hindborg Link: https://patch.msgid.link/20251103112958.2961517-2-fujita.tomonori@gmail.com Signed-off-by: Danilo Krummrich commit 89c545e29ecd6252968611b3ee2599034b911dd8 Author: Christian Brauner Date: Mon Nov 3 15:57:29 2025 +0100 sev-dev: use prepare credential guard Use the prepare credential guard for allocating a new set of credentials. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-3-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit 4c5941ca1104d58a94e59100ebde97a162e72de4 Author: Christian Brauner Date: Mon Nov 3 15:57:28 2025 +0100 sev-dev: use guard for path Just use a guard and also move the path_put() out of the credential change's scope. There's no need to do this with the overridden credentials. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-2-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit c8ad3098e1272444b6c75910d6196a36f5c8bc17 Author: Christian Brauner Date: Mon Nov 3 15:57:27 2025 +0100 cred: add prepare credential guard A lot of code uses the following pattern: * prepare new credentials * modify them for their use-case * drop them Support that easier with the new guard infrastructure. Link: https://patch.msgid.link/20251103-work-creds-guards-prepare_creds-v1-1-b447b82f2c9b@kernel.org Signed-off-by: Christian Brauner commit a85787996aa97412223ff1975f5cd44b592e2f5f Merge: e0876bde29c42c 4037e28cd47e5a Author: Christian Brauner Date: Mon Nov 3 22:42:45 2025 +0100 Merge patch series "credentials guards: the easy cases" Christian Brauner says: This converts all users of override_creds() to rely on credentials guards. Leave all those that do the prepare_creds() + modify creds + override_creds() dance alone for now. Some of them qualify for their own variant. * patches from https://patch.msgid.link/20251103-work-creds-guards-simple-v1-0-a3e156839e7f@kernel.org: net/dns_resolver: use credential guards in dns_query() cgroup: use credential guards in cgroup_attach_permissions() act: use credential guards in acct_write_process() smb: use credential guards in cifs_get_spnego_key() nfs: use credential guards in nfs_idmap_get_key() nfs: use credential guards in nfs_local_call_write() nfs: use credential guards in nfs_local_call_read() erofs: use credential guards binfmt_misc: use credential guards backing-file: use credential guards for mmap backing-file: use credential guards for splice write backing-file: use credential guards for splice read backing-file: use credential guards for writes backing-file: use credential guards for reads aio: use credential guards cred: add {scoped_}with_creds() guards Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-0-a3e156839e7f@kernel.org Signed-off-by: Christian Brauner commit 4037e28cd47e5a860ea23214024bcbe8a7585d81 Author: Christian Brauner Date: Mon Nov 3 12:27:04 2025 +0100 net/dns_resolver: use credential guards in dns_query() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-16-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b66c7af4d86de00db3c28294467bf986083dc963 Author: Christian Brauner Date: Mon Nov 3 12:27:03 2025 +0100 cgroup: use credential guards in cgroup_attach_permissions() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-15-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5db84abd2afb822594291faea8b6a1336c74db44 Author: Christian Brauner Date: Mon Nov 3 12:27:02 2025 +0100 act: use credential guards in acct_write_process() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-14-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit c5c92c624aeb90d708db276ce2dd57db11fdb823 Author: Christian Brauner Date: Mon Nov 3 12:27:01 2025 +0100 smb: use credential guards in cifs_get_spnego_key() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-13-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit f41799b2e1697779748bb0a15d4aafffe9d2f8dd Author: Christian Brauner Date: Mon Nov 3 12:27:00 2025 +0100 nfs: use credential guards in nfs_idmap_get_key() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-12-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit bff3c841f7bde5604b26e8ea755728b8e329c6d5 Author: Christian Brauner Date: Mon Nov 3 12:26:59 2025 +0100 nfs: use credential guards in nfs_local_call_write() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-11-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 94afb627dfc2ed8819a9eaa0ff51f0dd24839da8 Author: Christian Brauner Date: Mon Nov 3 12:26:58 2025 +0100 nfs: use credential guards in nfs_local_call_read() Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-10-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 5e88d1aadcd20a8e2cf317839cac0c94006cee64 Author: Christian Brauner Date: Mon Nov 3 12:26:57 2025 +0100 erofs: use credential guards Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-9-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit ff2044cd277d8d2d6d6ea609d5a10fcbe68a23f9 Author: Christian Brauner Date: Mon Nov 3 12:26:56 2025 +0100 binfmt_misc: use credential guards Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-8-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 6e1d1c1fa7b1a8d318ccb5f4f64b2a2b5803cf1c Author: Christian Brauner Date: Mon Nov 3 12:26:55 2025 +0100 backing-file: use credential guards for mmap Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-7-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b688171f910e22d1a32dec24bae8dbecbf2fe395 Author: Christian Brauner Date: Mon Nov 3 12:26:54 2025 +0100 backing-file: use credential guards for splice write Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-6-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit c3076d146e312af1ee2eff0287e298cf20774b39 Author: Christian Brauner Date: Mon Nov 3 12:26:53 2025 +0100 backing-file: use credential guards for splice read Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-5-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit f119feaa06586aed78b98b13ac9bcfac942c583e Author: Christian Brauner Date: Mon Nov 3 12:26:52 2025 +0100 backing-file: use credential guards for writes Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-4-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 4f0a4825786a114898b6f10a1ffe95ac0402e57e Author: Christian Brauner Date: Mon Nov 3 12:26:51 2025 +0100 backing-file: use credential guards for reads Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-3-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 84c1a329b4fce8e51958cd4f27bd62743b892a7d Author: Christian Brauner Date: Mon Nov 3 12:26:50 2025 +0100 aio: use credential guards Use credential guards for scoped credential override with automatic restoration on scope exit. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-2-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 019e52e8d324d568e71730946beb11e7b275ff08 Author: Christian Brauner Date: Mon Nov 3 12:26:49 2025 +0100 cred: add scoped_with_creds() guards and implement scoped_with_kernel_creds() on top of it. Link: https://patch.msgid.link/20251103-work-creds-guards-simple-v1-1-a3e156839e7f@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit e0876bde29c42c5de8ad087b5df7cd27b29defec Merge: dcb6fa37fd7bc9 1ad5b411afc327 Author: Christian Brauner Date: Mon Nov 3 00:14:37 2025 +0100 Merge patch series "creds: add {scoped_}with_kernel_creds()" Christian Brauner says: A few months ago I did work to make override_creds()/revert_creds() completely reference count free - mostly for the sake of overlayfs but it has been beneficial to everyone using this. In a recent pull request from Jens that introduced another round of override_creds()/revert_creds() for nbd Linus asked whether we could avoide the prepare_kernel_creds() calls that duplicate the kernel credentials and then drop them again later. Yes, we can actually. We can use the guard infrastructure to completely avoid the allocation and then also to never expose the temporary variable to hold the kernel credentials anywhere in the callers. So add with_kernel_creds() and scoped_with_kernel_creds() for this purpose. Also take the opportunity to fixup the scoped_class() macro I introduced two cycles ago. * patches from https://patch.msgid.link/20251103-work-creds-init_cred-v1-0-cb3ec8711a6a@kernel.org: unix: don't copy creds target: don't copy kernel creds nbd: don't copy kernel creds firmware: don't copy kernel creds cred: add {scoped_}with_kernel_creds cred: make init_cred static cred: add kernel_cred() helper cleanup: fix scoped_class() Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-0-cb3ec8711a6a@kernel.org Signed-off-by: Christian Brauner commit 1ad5b411afc327ae50e569dbfa15774e0baefa68 Author: Christian Brauner Date: Mon Nov 3 00:12:47 2025 +0100 unix: don't copy creds No need to copy kernel credentials. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-8-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit 0f0e7cee3496cc053c7a1a15a428b585d6b7e897 Author: Christian Brauner Date: Mon Nov 3 00:12:46 2025 +0100 target: don't copy kernel creds Get rid of all the boilerplate and tightly scope when the task runs with kernel creds. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-7-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit 4601b7923d1b51b3788581b890a0d4d105a137de Author: Christian Brauner Date: Mon Nov 3 00:12:45 2025 +0100 nbd: don't copy kernel creds No need to copy kernel credentials. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-6-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit b9e3594e70193c84066b868e7a1eb38263d9a999 Author: Christian Brauner Date: Mon Nov 3 00:12:44 2025 +0100 firmware: don't copy kernel creds No need to copy kernel credentials. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-5-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit ae40e6c65791f47c76cc14d0cce2707fe6053f72 Author: Christian Brauner Date: Mon Nov 3 00:12:43 2025 +0100 cred: add scoped_with_kernel_creds() Add a new cleanup class for override creds. We can make use of this in a bunch of places going forward. Based on this scoped_with_kernel_creds() that can be used to temporarily assume kernel credentials for specific tasks such as firmware loading, or coredump socket connections. At no point will the caller interact with the kernel credentials directly. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-4-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit 40314c2818b700da695c9686348be7aef9e156a2 Author: Christian Brauner Date: Mon Nov 3 00:12:42 2025 +0100 cred: make init_cred static There's zero need to expose struct init_cred. The very few places that need access can just go through init_task which is already exported. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-3-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit 4c7ceeb62d3330b6fb2b549ae833a92c0f481f3e Author: Christian Brauner Date: Mon Nov 3 00:12:41 2025 +0100 cred: add kernel_cred() helper Access kernel creds based off of init_task. This will let us avoid any direct access to init_cred. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-2-cb3ec8711a6a@kernel.org Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit 4e97bae1b412cd6ed8053b3d8a242122952985cc Author: Christian Brauner Date: Mon Nov 3 00:12:40 2025 +0100 cleanup: fix scoped_class() This is a class, not a guard so why on earth is it checking for guard pointers or conditional lock acquisition? None of it makes any sense at all. I'm not sure what happened back then. Maybe I had a brief psychedelic period that I completely forgot about and spaced out into a zone where that initial macro implementation made any sense at all. Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-1-cb3ec8711a6a@kernel.org Fixes: 5c21c5f22d07 ("cleanup: add a scoped version of CLASS()") Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit b63300ac4095f892a8472a82f465fdc7c63a8c57 Author: José Expósito Date: Fri Oct 24 13:00:05 2025 +0200 drm/vkms: Update testing with IGT IGT_DEVICE VKMS is no longer in the platform bus, instead, it is in the faux bus. In addition, when present, IGT picks hardware drivers instead of virtual drivers, like VKMS or vgem, if they are not forced. Update the documentation to use IGT_FORCE_DRIVER instead of IGT_DEVICE. Signed-off-by: José Expósito Reviewed-by: Louis Chauvet Link: https://lore.kernel.org/r/20251024110014.4614-2-jose.exposito89@gmail.com Signed-off-by: Louis Chauvet commit edcdd00099f1b755095dd770c9cd5d3374e49ebc Author: José Expósito Date: Fri Oct 24 13:00:04 2025 +0200 drm/vkms: Fix run-tests.sh script name The script is "run-tests.sh", no "run-test.sh". Signed-off-by: José Expósito Reviewed-by: Louis Chauvet Link: https://lore.kernel.org/r/20251024110014.4614-1-jose.exposito89@gmail.com Signed-off-by: Louis Chauvet commit f9e46acc172138a472ffb3bf0270a0b156a77411 Author: Dan Carpenter Date: Fri Oct 24 14:15:23 2025 +0300 drm/vkms: Fix use after frees on error paths These error paths free a pointer and then dereference it on the next line to get the error code. Save the error code first and then free the memory. Fixes: 3e4d5b30d2b2 ("drm/vkms: Allow to configure multiple CRTCs via configfs") Fixes: 2f1734ba271b ("drm/vkms: Allow to configure multiple planes via configfs") Fixes: 67d8cf92e13e ("drm/vkms: Allow to configure multiple encoders via configfs") Fixes: 272acbca96a3 ("drm/vkms: Allow to configure multiple connectors via configfs") Fixes: 13fc9b9745cc ("drm/vkms: Add and remove VKMS instances via configfs") Signed-off-by: Dan Carpenter Reviewed-by: José Expósito Link: https://lore.kernel.org/r/aPtfy2jCI_kb3Df7@stanley.mountain Signed-off-by: Louis Chauvet commit a0c7005333f9a968abb058b1d77bbcd7fb7fd1e7 Author: Songtang Liu Date: Thu Oct 30 22:55:25 2025 -0700 iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`. This assumes a 4-byte access. However, the corresponding show handler, iommu_mmio_show(), uses readq() to perform an 8-byte (64-bit) read. If a user provides an offset equal to `mmio_phys_end - 4`, the check passes, and will lead to a 4-byte out-of-bounds read. Fix this by adjusting the boundary check to use sizeof(u64), which corresponds to the size of the readq() operation. Fixes: 7a4ee419e8c1 ("iommu/amd: Add debugfs support to dump IOMMU MMIO registers") Signed-off-by: Songtang Liu Reviewed-by: Dheeraj Kumar Srivastava Tested-by: Dheeraj Kumar Srivastava Signed-off-by: Joerg Roedel commit 27cb3de7f43ac0263474d87a2c84d96f904d73e2 Author: Tonghao Zhang Date: Tue Oct 28 12:32:44 2025 +0800 net: add net cookie for net device trace events In a multi-network card or container environment, this is needed in order to differentiate between trace events relating to net devices that exist in different network namespaces and share the same name. for xmit_timeout trace events: [002] ..s1. 1838.311662: net_dev_xmit_timeout: dev=eth0 driver=virtio_net queue=10 net_cookie=3 [007] ..s1. 1839.335650: net_dev_xmit_timeout: dev=eth0 driver=virtio_net queue=10 net_cookie=4100 [007] ..s1. 1844.455659: net_dev_xmit_timeout: dev=eth0 driver=virtio_net queue=10 net_cookie=3 [002] ..s1. 1850.087647: net_dev_xmit_timeout: dev=eth0 driver=virtio_net queue=10 net_cookie=3 Cc: Eran Ben Elisha Cc: Jiri Pirko Cc: Cong Wang Cc: Jakub Kicinski Cc: Eric Dumazet Cc: Simon Horman Cc: Paolo Abeni Suggested-by: Ido Schimmel Signed-off-by: Tonghao Zhang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20251028043244.82288-1-tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit ce27278119f36ba55ecd320856efc8f9f1a70fa2 Merge: 3a8660878839fa 534ea60bc4809b Author: Andy Shevchenko Date: Tue Nov 4 09:29:58 2025 +0100 Merge patch series "pinctrl: intel: Unify error messages" Andy Shevchenko says: Unify error messages with help of dev_err_probe(). This brings a common pattern with error code printed as well. While at it, make the text message the same for the same reasons across the Intel pin control drivers. Link: https://patch.msgid.link/20251103200235.712436-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko commit 534ea60bc4809b8ec4f13d6b252c4bb8d5f243d2 Author: Andy Shevchenko Date: Mon Nov 3 20:58:31 2025 +0100 pinctrl: tangier: Unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit a13735785c27c0df5b51919b63fa98c1a03118f7 Author: Andy Shevchenko Date: Mon Nov 3 20:19:15 2025 +0100 pinctrl: lynxpoint: Unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Signed-off-by: Andy Shevchenko commit e2620a2c44dcb00af8216afb74040bfe4dc4a211 Author: Andy Shevchenko Date: Mon Nov 3 20:58:30 2025 +0100 pinctrl: intel: Unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 6afe489df6b3af0851fb98f522ecdb41c75e4632 Author: Andy Shevchenko Date: Mon Nov 3 20:58:29 2025 +0100 pinctrl: cherryview: Unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit cf6dd6cafdfc3844648ba52efdaec0bd4e631129 Author: Andy Shevchenko Date: Mon Nov 3 20:58:28 2025 +0100 pinctrl: baytrail: Unify messages with help of dev_err_probe() Unify error messages that might appear during probe phase by switching to use dev_err_probe(). Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 1fe4002cf7f23d70c79bda429ca2a9423ebcfdfa Author: Peter Zijlstra Date: Fri Oct 31 12:04:24 2025 +0100 x86/ptrace: Always inline trivial accessors A KASAN build bloats these single load/store helpers such that it fails to inline them: vmlinux.o: error: objtool: irqentry_exit+0x5e8: call to instruction_pointer_set() with UACCESS enabled Make sure the compiler isn't allowed to do stupid. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251031105435.GU4068168@noisy.programming.kicks-ass.net commit 323d93f0432edb5415c79bd35e15e5754a76e486 Author: Peter Zijlstra Date: Fri Oct 31 12:02:12 2025 +0100 cleanup: Always inline everything KASAN bloat caused cleanup helper functions to not get inlined: vmlinux.o: error: objtool: irqentry_exit+0x323: call to class_user_rw_access_destructor() with UACCESS enabled Force inline all the cleanup helpers like they already are on normal builds. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251031105435.GU4068168@noisy.programming.kicks-ass.net commit 32034df66b5f49626aa450ceaf1849a08d87906e Author: Thomas Gleixner Date: Mon Oct 27 09:45:26 2025 +0100 rseq: Switch to TIF_RSEQ if supported TIF_NOTIFY_RESUME is a multiplexing TIF bit, which is suboptimal especially with the RSEQ fast path depending on it, but not really handling it. Define a separate TIF_RSEQ in the generic TIF space and enable the full separation of fast and slow path for architectures which utilize that. That avoids the hassle with invocations of resume_user_mode_work() from hypervisors, which clear TIF_NOTIFY_RESUME. It makes the therefore required re-evaluation at the end of vcpu_run() a NOOP on architectures which utilize the generic TIF space and have a separate TIF_RSEQ. The hypervisor TIF handling does not include the separate TIF_RSEQ as there is no point in doing so. The guest does neither know nor care about the VMM host applications RSEQ state. That state is only relevant when the ioctl() returns to user space. The fastpath implementation still utilizes TIF_NOTIFY_RESUME for failure handling, but this only happens within exit_to_user_mode_loop(), so arguably the hypervisor ioctl() code is long done when this happens. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.903622031@linutronix.de commit 7a5201ea1907534efe3a6e9c001ef4c0257cb3f0 Author: Thomas Gleixner Date: Mon Oct 27 09:45:24 2025 +0100 rseq: Split up rseq_exit_to_user_mode() Separate the interrupt and syscall exit handling. Syscall exit does not require to clear the user_irq bit as it can't be set. On interrupt exit it can be set when the interrupt did not result in a scheduling event and therefore the return path did not invoke the TIF work handling, which would have cleared it. The debug check for the event state is also not really required even when debug mode is enabled via the static key. Debug mode is largely aiding user space by enabling a larger amount of validation checks, which cause a segfault when a malformed critical section is detected. In production mode the critical section handling takes the content mostly as is and lets user space keep the pieces when it screwed up. On kernel changes in that area the state check is useful, but that can be done when lockdep is enabled, which is anyway a required test scenario for fundamental changes. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.842785700@linutronix.de commit 70fe25a3bc53a891f0e6184c12bd55cc524cb13b Author: Thomas Gleixner Date: Mon Oct 27 09:45:21 2025 +0100 entry: Split up exit_to_user_mode_prepare() exit_to_user_mode_prepare() is used for both interrupts and syscalls, but there is extra rseq work, which is only required for in the interrupt exit case. Split up the function and provide wrappers for syscalls and interrupts, which allows to separate the rseq exit work in the next step. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.782234789@linutronix.de commit 3db6b38dfe640207da706b286d4181237391f5bd Author: Thomas Gleixner Date: Mon Oct 27 09:45:19 2025 +0100 rseq: Switch to fast path processing on exit to user Now that all bits and pieces are in place, hook the RSEQ handling fast path function into exit_to_user_mode_prepare() after the TIF work bits have been handled. If case of fast path failure, TIF_NOTIFY_RESUME has been raised and the caller needs to take another turn through the TIF handling slow path. This only works for architectures which use the generic entry code. Architectures who still have their own incomplete hacks are not supported and won't be. This results in the following improvements: Kernel build Before After Reduction exit to user 80692981 80514451 signal checks: 32581 121 99% slowpath runs: 1201408 1.49% 198 0.00% 100% fastpath runs: 675941 0.84% N/A id updates: 1233989 1.53% 50541 0.06% 96% cs checks: 1125366 1.39% 0 0.00% 100% cs cleared: 1125366 100% 0 100% cs fixup: 0 0% 0 RSEQ selftests Before After Reduction exit to user: 386281778 387373750 signal checks: 35661203 0 100% slowpath runs: 140542396 36.38% 100 0.00% 100% fastpath runs: 9509789 2.51% N/A id updates: 176203599 45.62% 9087994 2.35% 95% cs checks: 175587856 45.46% 4728394 1.22% 98% cs cleared: 172359544 98.16% 1319307 27.90% 99% cs fixup: 3228312 1.84% 3409087 72.10% The 'cs cleared' and 'cs fixup' percentages are not relative to the exit to user invocations, they are relative to the actual 'cs check' invocations. While some of this could have been avoided in the original code, like the obvious clearing of CS when it's already clear, the main problem of going through TIF_NOTIFY_RESUME cannot be solved. In some workloads the RSEQ notify handler is invoked more than once before going out to user space. Doing this once when everything has stabilized is the only solution to avoid this. The initial attempt to completely decouple it from the TIF work turned out to be suboptimal for workloads, which do a lot of quick and short system calls. Even if the fast path decision is only 4 instructions (including a conditional branch), this adds up quickly and becomes measurable when the rate for actually having to handle rseq is in the low single digit percentage range of user/kernel transitions. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.701201365@linutronix.de commit 05b44aef709cae5e4274590f050cf35049dcc24e Author: Thomas Gleixner Date: Mon Oct 27 09:45:17 2025 +0100 rseq: Implement fast path for exit to user Implement the actual logic for handling RSEQ updates in a fast path after handling the TIF work and at the point where the task is actually returning to user space. This is the right point to do that because at this point the CPU and the MM CID are stable and cannot longer change due to yet another reschedule. That happens when the task is handling it via TIF_NOTIFY_RESUME in resume_user_mode_work(), which is invoked from the exit to user mode work loop. The function is invoked after the TIF work is handled and runs with interrupts disabled, which means it cannot resolve page faults. It therefore disables page faults and in case the access to the user space memory faults, it: - notes the fail in the event struct - raises TIF_NOTIFY_RESUME - returns false to the caller The caller has to go back to the TIF work, which runs with interrupts enabled and therefore can resolve the page faults. This happens mostly on fork() when the memory is marked COW. If the user memory inspection finds invalid data, the function returns false as well and sets the fatal flag in the event struct along with TIF_NOTIFY_RESUME. The slow path notify handler has to evaluate that flag and terminate the task with SIGSEGV as documented. The initial decision to invoke any of this is based on one flags in the event struct: @sched_switch. The decision is in pseudo ASM: load tsk::event::sched_switch jnz inspect_user_space mov $0, tsk::event::events ... leave So for the common case where the task was not scheduled out, this really boils down to three instructions before going out if the compiler is not completely stupid (and yes, some of them are). If the condition is true, then it checks, whether CPU ID or MM CID have changed. If so, then the CPU/MM IDs have to be updated and are thereby cached for the next round. The update unconditionally retrieves the user space critical section address to spare another user*begin/end() pair. If that's not zero and tsk::event::user_irq is set, then the critical section is analyzed and acted upon. If either zero or the entry came via syscall the critical section analysis is skipped. If the comparison is false then the critical section has to be analyzed because the event flag is then only true when entry from user was by interrupt. This is provided without the actual hookup to let reviewers focus on the implementation details. The hookup happens in the next step. Note: As with quite some other optimizations this depends on the generic entry infrastructure and is not enabled to be sucked into random architecture implementations. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.638929615@linutronix.de commit 39a167560a61f913560ba803a96dbe6c15239f5c Author: Thomas Gleixner Date: Mon Oct 27 09:45:14 2025 +0100 rseq: Optimize event setting After removing the various condition bits earlier it turns out that one extra information is needed to avoid setting event::sched_switch and TIF_NOTIFY_RESUME unconditionally on every context switch. The update of the RSEQ user space memory is only required, when either the task was interrupted in user space and schedules or the CPU or MM CID changes in schedule() independent of the entry mode Right now only the interrupt from user information is available. Add an event flag, which is set when the CPU or MM CID or both change. Evaluate this event in the scheduler to decide whether the sched_switch event and the TIF bit need to be set. It's an extra conditional in context_switch(), but the downside of unconditionally handling RSEQ after a context switch to user is way more significant. The utilized boolean logic minimizes this to a single conditional branch. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.578058898@linutronix.de commit e2d4f42271155045a49b89530f2c06ad8e9f1a1e Author: Thomas Gleixner Date: Mon Oct 27 09:45:12 2025 +0100 rseq: Rework the TIF_NOTIFY handler Replace the whole logic with a new implementation, which is shared with signal delivery and the upcoming exit fast path. Contrary to the original implementation, this ignores invocations from KVM/IO-uring, which invoke resume_user_mode_work() with the @regs argument set to NULL. The original implementation updated the CPU/Node/MM CID fields, but that was just a side effect, which was addressing the problem that this invocation cleared TIF_NOTIFY_RESUME, which in turn could cause an update on return to user space to be lost. This problem has been addressed differently, so that it's not longer required to do that update before entering the guest. That might be considered a user visible change, when the hosts thread TLS memory is mapped into the guest, but as this was never intentionally supported, this abuse of kernel internal implementation details is not considered an ABI break. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.517640811@linutronix.de commit 9f6ffd4cebda86841700775de3213f22bb0ea22d Author: Thomas Gleixner Date: Mon Oct 27 09:45:10 2025 +0100 rseq: Separate the signal delivery path Completely separate the signal delivery path from the notify handler as they have different semantics versus the event handling. The signal delivery only needs to ensure that the interrupted user context was not in a critical section or the section is aborted before it switches to the signal frame context. The signal frame context does not have the original instruction pointer anymore, so that can't be handled on exit to user space. No point in updating the CPU/CID ids as they might change again before the task returns to user space for real. The fast path optimization, which checks for the 'entry from user via interrupt' condition is only available for architectures which use the generic entry code. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.455429038@linutronix.de commit 0f085b41880e3140efa6941ff2b8fd43bac4d659 Author: Thomas Gleixner Date: Mon Oct 27 09:45:08 2025 +0100 rseq: Provide and use rseq_set_ids() Provide a new and straight forward implementation to set the IDs (CPU ID, Node ID and MM CID), which can be later inlined into the fast path. It does all operations in one scoped_user_rw_access() section and retrieves also the critical section member (rseq::cs_rseq) from user space to avoid another user..begin/end() pair. This is in preparation for optimizing the fast path to avoid extra work when not required. On rseq registration set the CPU ID fields to RSEQ_CPU_ID_UNINITIALIZED and node and MM CID to zero. That's the same as the kernel internal reset values. That makes the debug validation in the exit code work correctly on the first exit to user space. Use it to replace the whole related zoo in rseq.c Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.393972266@linutronix.de commit eaa9088d568c84afd72fa32dbe01833aef861d0d Author: Thomas Gleixner Date: Mon Oct 27 09:45:05 2025 +0100 rseq: Use static branch for syscall exit debug when GENERIC_IRQ_ENTRY=y Make the syscall exit debug mechanism available via the static branch on architectures which utilize the generic entry code. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.333440475@linutronix.de commit c1cbad8f99b5c73c6af6e96acbfa64eaaaeb085f Author: Thomas Gleixner Date: Mon Oct 27 09:45:02 2025 +0100 rseq: Make exit debugging static branch based Disconnect it from the config switch and use the static debug branch. This is a temporary measure for validating the rework. At the end this check needs to be hidden behind lockdep as it has nothing to do with the other debug infrastructure, which mainly aids user space debugging by enabling a zoo of checks which terminate misbehaving tasks instead of letting them keep the hard to diagnose pieces. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.272660745@linutronix.de commit f7ee1964ac397bee5c6d1c017557c0eec8856145 Author: Thomas Gleixner Date: Mon Oct 27 09:45:00 2025 +0100 rseq: Replace the original debug implementation Just utilize the new infrastructure and put the original one to rest. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.212510692@linutronix.de commit abc850e7616c91ebaa3f5ba3617ab0a104d45039 Author: Thomas Gleixner Date: Mon Oct 27 09:44:57 2025 +0100 rseq: Provide and use rseq_update_user_cs() Provide a straight forward implementation to check for and eventually clear/fixup critical sections in user space. The non-debug version does only the minimal sanity checks and aims for efficiency. There are two attack vectors, which are checked for: 1) An abort IP which is in the kernel address space. That would cause at least x86 to return to kernel space via IRET. 2) A rogue critical section descriptor with an abort IP pointing to some arbitrary address, which is not preceded by the RSEQ signature. If the section descriptors are invalid then the resulting misbehaviour of the user space application is not the kernels problem. The kernel provides a run-time switchable debug slow path, which implements the full zoo of checks including termination of the task when one of the gazillion conditions is not met. Replace the zoo in rseq.c with it and invoke it from the TIF_NOTIFY_RESUME handler. Move the remainders into the CONFIG_DEBUG_RSEQ section, which will be replaced and removed in a subsequent step. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.151465632@linutronix.de commit 9c37cb6e80b8fcdddc1236ba42ffd438f511192b Author: Thomas Gleixner Date: Mon Oct 27 09:44:55 2025 +0100 rseq: Provide static branch for runtime debugging Config based debug is rarely turned on and is not available easily when things go wrong. Provide a static branch to allow permanent integration of debug mechanisms along with the usual toggles in Kconfig, command line and debugfs. Requested-by: Peter Zijlstra Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.089270547@linutronix.de commit 5412910487d0839111e4f2f3a6f33f6c9af9b007 Author: Thomas Gleixner Date: Mon Oct 27 09:44:52 2025 +0100 rseq: Expose lightweight statistics in debugfs Analyzing the call frequency without actually using tracing is helpful for analysis of this infrastructure. The overhead is minimal as it just increments a per CPU counter associated to each operation. The debugfs readout provides a racy sum of all counters. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084307.027916598@linutronix.de commit dab344753e021fe84c24f9d8b0b63cb5bcf463d7 Author: Thomas Gleixner Date: Mon Oct 27 09:44:50 2025 +0100 rseq: Provide tracepoint wrappers for inline code Provide tracepoint wrappers for the upcoming RSEQ exit to user space inline fast path, so that the header can be safely included by code which defines actual trace points. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.967114316@linutronix.de commit 2fc0e4b4126caadfa5772ba69276b350609584dd Author: Thomas Gleixner Date: Mon Oct 27 09:44:48 2025 +0100 rseq: Record interrupt from user space For RSEQ the only relevant reason to inspect and eventually fixup (abort) user space critical sections is when user space was interrupted and the task was scheduled out. If the user to kernel entry was from a syscall no fixup is required. If user space invokes a syscall from a critical section it can keep the pieces as documented. This is only supported on architectures which utilize the generic entry code. If your architecture does not use it, bad luck. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.905067101@linutronix.de commit 4b7de6df20d43dd651031aef8d818fa5da981dbf Author: Thomas Gleixner Date: Mon Oct 27 09:44:45 2025 +0100 rseq: Cache CPU ID and MM CID values In preparation for rewriting RSEQ exit to user space handling provide storage to cache the CPU ID and MM CID values which were written to user space. That prepares for a quick check, which avoids the update when nothing changed. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.841964081@linutronix.de commit 4fc9225d19ad6289c03340a520d35e3a6d1aebed Author: Thomas Gleixner Date: Mon Oct 27 09:44:42 2025 +0100 sched: Move MM CID related functions to sched.h There is nothing mm specific in that and including mm.h can cause header recursion hell. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.778457951@linutronix.de commit 7702a9c2856794b6bf961b408eba3bacb753bd5b Author: Thomas Gleixner Date: Mon Oct 27 09:44:40 2025 +0100 entry: Inline irqentry_enter/exit_from/to_user_mode() There is no point to have this as a function which just inlines enter_from_user_mode(). The function call overhead is larger than the function itself. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.715309918@linutronix.de commit 54a5ab56242f96555999aaa41228f77b4a76e386 Author: Thomas Gleixner Date: Mon Oct 27 09:44:38 2025 +0100 entry: Remove syscall_enter_from_user_mode_prepare() Open code the only user in the x86 syscall code and reduce the zoo of functions. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.652839989@linutronix.de commit 5204be16790f305febbf331d0ec2cead7978b3c3 Author: Thomas Gleixner Date: Mon Oct 27 09:44:36 2025 +0100 entry: Clean up header Clean up the include ordering, kernel-doc and other trivialities before making further changes. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.590338411@linutronix.de commit faba9d250eaec7afa248bba71531a08ccc497aab Author: Thomas Gleixner Date: Mon Oct 27 09:44:33 2025 +0100 rseq: Introduce struct rseq_data In preparation for a major rewrite of this code, provide a data structure for rseq management. Put all the rseq related data into it (except for the debug part), which allows to simplify fork/execve by using memset() and memcpy() instead of adding new fields to initialize over and over. Create a storage struct for event management as well and put the sched_switch event and a indicator for RSEQ on a task into it as a start. That uses a union, which allows to mask and clear the whole lot efficiently. The indicators are explicitly not a bit field. Bit fields generate abysmal code. The boolean members are defined as u8 as that actually guarantees that it fits. There seem to be strange architecture ABIs which need more than 8 bits for a boolean. The has_rseq member is redundant vs. task::rseq, but it turns out that boolean operations and quick checks on the union generate better code than fiddling with separate entities and data types. This struct will be extended over time to carry more information. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.527086690@linutronix.de commit 566d8015f7eef11d82cd63dc4e1f620fcfc2a394 Author: Thomas Gleixner Date: Mon Oct 27 09:44:31 2025 +0100 rseq: Avoid CPU/MM CID updates when no event pending There is no need to update these values unconditionally if there is no event pending. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.462964916@linutronix.de commit 83409986f49f17b14a675f9c598ad50d4c60191b Author: Thomas Gleixner Date: Mon Oct 27 09:44:28 2025 +0100 rseq, virt: Retrigger RSEQ after vcpu_run() Hypervisors invoke resume_user_mode_work() before entering the guest, which clears TIF_NOTIFY_RESUME. The @regs argument is NULL as there is no user space context available to them, so the rseq notify handler skips inspecting the critical section, but updates the CPU/MM CID values unconditionally so that the eventual pending rseq event is not lost on the way to user space. This is a pointless exercise as the task might be rescheduled before actually returning to user space and it creates unnecessary work in the vcpu_run() loops. It's way more efficient to ignore that invocation based on @regs == NULL and let the hypervisors re-raise TIF_NOTIFY_RESUME after returning from the vcpu_run() loop before returning from the ioctl(). This ensures that a pending RSEQ update is not lost and the IDs are updated before returning to user space. Once the RSEQ handling is decoupled from TIF_NOTIFY_RESUME, this turns into a NOOP. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Acked-by: Sean Christopherson Link: https://patch.msgid.link/20251027084306.399495855@linutronix.de commit d923739e2e356424cc566143a3323c62cd6ed067 Author: Thomas Gleixner Date: Mon Oct 27 09:44:26 2025 +0100 rseq: Simplify the event notification Since commit 0190e4198e47 ("rseq: Deprecate RSEQ_CS_FLAG_NO_RESTART_ON_* flags") the bits in task::rseq_event_mask are meaningless and just extra work in terms of setting them individually. Aside of that the only relevant point where an event has to be raised is context switch. Neither the CPU nor MM CID can change without going through a context switch. Collapse them all into a single boolean which simplifies the code a lot and remove the pointless invocations which have been sprinkled all over the place for no value. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.336978188@linutronix.de commit 067b3b41b4dd5bf51d6874206f5c1f72e0684eeb Author: Thomas Gleixner Date: Mon Oct 27 09:44:24 2025 +0100 rseq: Simplify registration There is no point to read the critical section element in the newly registered user space RSEQ struct first in order to clear it. Just clear it and be done with it. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.274661227@linutronix.de commit 41b43a6ba3848be8ceec77b8b2a56ddeca6167ed Author: Thomas Gleixner Date: Mon Oct 27 09:44:22 2025 +0100 rseq: Remove the ksig argument from rseq_handle_notify_resume() There is no point for this being visible in the resume_to_user_mode() handling. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.211520245@linutronix.de commit 77f19e4d4fc90a9364f5055a4daf8b98a76cb303 Author: Thomas Gleixner Date: Mon Oct 27 09:44:20 2025 +0100 rseq: Move algorithm comment to top Move the comment which documents the RSEQ algorithm to the top of the file, so it does not create horrible diffs later when the actual implementation is fed into the mincer. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.149519580@linutronix.de commit fdc0f39d289ebcf46ef44f43460207ef24c94ed7 Author: Thomas Gleixner Date: Mon Oct 27 09:44:18 2025 +0100 rseq: Condense the inline stubs Scrolling over tons of pointless { } lines to find the actual code is annoying at best. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.085971048@linutronix.de commit 3ca59da7aa5c7f569b04a511dc8670861d58b509 Author: Thomas Gleixner Date: Mon Oct 27 09:44:16 2025 +0100 rseq: Avoid pointless evaluation in __rseq_notify_resume() The RSEQ critical section mechanism only clears the event mask when a critical section is registered, otherwise it is stale and collects bits. That means once a critical section is installed the first invocation of that code when TIF_NOTIFY_RESUME is set will abort the critical section, even when the TIF bit was not raised by the rseq preempt/migrate/signal helpers. This also has a performance implication because TIF_NOTIFY_RESUME is a multiplexing TIF bit, which is utilized by quite some infrastructure. That means every invocation of __rseq_notify_resume() goes unconditionally through the heavy lifting of user space access and consistency checks even if there is no reason to do so. Keeping the stale event mask around when exiting to user space also prevents it from being utilized by the upcoming time slice extension mechanism. Avoid this by reading and clearing the event mask before doing the user space critical section access with interrupts or preemption disabled, which ensures that the read and clear operation is CPU local atomic versus scheduling and the membarrier IPI. This is correct as after re-enabling interrupts/preemption any relevant event will set the bit again and raise TIF_NOTIFY_RESUME, which makes the user space exit code take another round of TIF bit clearing. If the event mask was non-zero, invoke the slow path. On debug kernels the slow path is invoked unconditionally and the result of the event mask evaluation is handed in. Add a exit path check after the TIF bit loop, which validates on debug kernels that the event mask is zero before exiting to user space. While at it reword the convoluted comment why the pt_regs pointer can be NULL under certain circumstances. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027084306.022571576@linutronix.de commit 3ce17e6909944b3f83b54915e36f5957f1327712 Author: Thomas Gleixner Date: Mon Oct 27 09:44:04 2025 +0100 select: Convert to scoped user access Replace the open coded implementation with the scoped user access guard. No functional change intended. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027083745.862419776@linutronix.de commit e02718c9865c7cbcb7959044a704b3dc5929640e Author: Thomas Gleixner Date: Mon Oct 27 09:44:02 2025 +0100 x86/futex: Convert to scoped user access Replace the open coded implementation with the scoped user access guards No functional change intended. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251027083745.799714344@linutronix.de commit e4e28fd6986e8cf963ec4137e6c0b95403f636ab Author: Thomas Gleixner Date: Mon Oct 27 09:44:00 2025 +0100 futex: Convert to get/put_user_inline() Replace the open coded implementation with the new get/put_user_inline() helpers. This might be replaced by a regular get/put_user(), but that needs a proper performance evaluation. No functional change intended. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Link: https://patch.msgid.link/20251027083745.736737934@linutronix.de commit b2cfc0cd68b830dde80fce2406580e258a1e976d Author: Thomas Gleixner Date: Mon Oct 27 09:43:56 2025 +0100 uaccess: Provide put/get_user_inline() Provide convenience wrappers around scoped user access similar to put/get_user(), which reduce the usage sites to: if (!get_user_inline(val, ptr)) return -EFAULT; Should only be used if there is a demonstrable performance benefit. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027083745.609031602@linutronix.de commit e497310b4ffb559e1149ee89470d5c518d234ddf Author: Thomas Gleixner Date: Mon Oct 27 09:43:55 2025 +0100 uaccess: Provide scoped user access regions User space access regions are tedious and require similar code patterns all over the place: if (!user_read_access_begin(from, sizeof(*from))) return -EFAULT; unsafe_get_user(val, from, Efault); user_read_access_end(); return 0; Efault: user_read_access_end(); return -EFAULT; This got worse with the recent addition of masked user access, which optimizes the speculation prevention: if (can_do_masked_user_access()) from = masked_user_read_access_begin((from)); else if (!user_read_access_begin(from, sizeof(*from))) return -EFAULT; unsafe_get_user(val, from, Efault); user_read_access_end(); return 0; Efault: user_read_access_end(); return -EFAULT; There have been issues with using the wrong user_*_access_end() variant in the error path and other typical Copy&Pasta problems, e.g. using the wrong fault label in the user accessor which ends up using the wrong accesss end variant. These patterns beg for scopes with automatic cleanup. The resulting outcome is: scoped_user_read_access(from, Efault) unsafe_get_user(val, from, Efault); return 0; Efault: return -EFAULT; The scope guarantees the proper cleanup for the access mode is invoked both in the success and the failure (fault) path. The scoped_user_$MODE_access() macros are implemented as self terminating nested for() loops. Thanks to Andrew Cooper for pointing me at them. The scope can therefore be left with 'break', 'goto' and 'return'. Even 'continue' "works" due to the self termination mechanism. Both GCC and clang optimize all the convoluted macro maze out and the above results with clang in: b80: f3 0f 1e fa endbr64 b84: 48 b8 ef cd ab 89 67 45 23 01 movabs $0x123456789abcdef,%rax b8e: 48 39 c7 cmp %rax,%rdi b91: 48 0f 47 f8 cmova %rax,%rdi b95: 90 nop b96: 90 nop b97: 90 nop b98: 31 c9 xor %ecx,%ecx b9a: 8b 07 mov (%rdi),%eax b9c: 89 06 mov %eax,(%rsi) b9e: 85 c9 test %ecx,%ecx ba0: 0f 94 c0 sete %al ba3: 90 nop ba4: 90 nop ba5: 90 nop ba6: c3 ret Which looks as compact as it gets. The NOPs are placeholder for STAC/CLAC. GCC emits the fault path seperately: bf0: f3 0f 1e fa endbr64 bf4: 48 b8 ef cd ab 89 67 45 23 01 movabs $0x123456789abcdef,%rax bfe: 48 39 c7 cmp %rax,%rdi c01: 48 0f 47 f8 cmova %rax,%rdi c05: 90 nop c06: 90 nop c07: 90 nop c08: 31 d2 xor %edx,%edx c0a: 8b 07 mov (%rdi),%eax c0c: 89 06 mov %eax,(%rsi) c0e: 85 d2 test %edx,%edx c10: 75 09 jne c1b c12: 90 nop c13: 90 nop c14: 90 nop c15: b8 01 00 00 00 mov $0x1,%eax c1a: c3 ret c1b: 90 nop c1c: 90 nop c1d: 90 nop c1e: 31 c0 xor %eax,%eax c20: c3 ret The fault labels for the scoped*() macros and the fault labels for the actual user space accessors can be shared and must be placed outside of the scope. If masked user access is enabled on an architecture, then the pointer handed in to scoped_user_$MODE_access() can be modified to point to a guaranteed faulting user address. This modification is only scope local as the pointer is aliased inside the scope. When the scope is left the alias is not longer in effect. IOW the original pointer value is preserved so it can be used e.g. for fixup or diagnostic purposes in the fault path. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Mathieu Desnoyers Link: https://patch.msgid.link/20251027083745.546420421@linutronix.de commit 2db48d8bf87d3cb9d968e73623efc1c5a02523e7 Author: Thomas Gleixner Date: Fri Oct 31 10:37:09 2025 +0100 arm64: uaccess: Use unsafe wrappers for ASM GOTO Clang propagates a provided label, which is outside of a cleanup scope to ASM GOTO despite the fact that __raw_get_mem() has a local label for that purpose: "error: cannot jump from this asm goto statement to one of its possible targets" Using the unsafe wrapper with the extra local label indirection cures that. Reported-by: Stephen Rothwell Reported-by: kernel test robot Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar commit 4df43709370cc18e9b09aa8049a6ab1f780af77e Author: Ian Rogers Date: Fri Oct 24 10:58:41 2025 -0700 perf jevents: Make all tables static The tables created by jevents.py are only used within the pmu-events.c file. Change the declarations of those global variables to be static to encapsulate this. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 3f02cebe130260fbfe6e2028d252d63503ba99a8 Author: Ian Rogers Date: Fri Oct 24 10:58:39 2025 -0700 perf metricgroup: When copy metrics copy default information When copy metrics into a group also copy default information from the original metrics. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 3bae9228a5503f7fb6464e895c3f542221ce9395 Author: Ian Rogers Date: Fri Oct 24 10:58:38 2025 -0700 perf metricgroup: Missed free on error path If an out-of-memory occurs the expr also needs freeing. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 5faa23cdab412ad2c65d18c30f78d6489ec7c9de Author: Ian Rogers Date: Fri Oct 24 10:58:37 2025 -0700 perf metricgroup: Update comment on location of metric_event list Update comment as the stat_config no longer holds all metrics. Signed-off-by: Ian Rogers Fixes: faebee18d720 ("perf stat: Move metric list from config to evlist") Signed-off-by: Namhyung Kim commit 371d32394e538a759a1a7bb475de67424c1d633b Author: Ian Rogers Date: Fri Oct 24 10:58:36 2025 -0700 perf evsel: Remove unused metric_events variable The metric_events exist in the metric_expr list and so this variable has been unused for a while. Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit 6553a8f168fb7941ae73d39eccac64f3a2b9b399 Author: Alexandre Courbot Date: Wed Oct 29 08:12:11 2025 +0900 gpu: nova-core: use `try_from` instead of `as` for u32 conversions There are a few situations in the driver where we convert a `usize` into a `u32` using `as`. Even though most of these are obviously correct, use `try_from` and let the compiler optimize wherever it is safe to do so. Acked-by: Danilo Krummrich Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-as-v3-3-6a30c7333ad9@nvidia.com> commit 505c3ec507a7eb4bbaef9aa8b13b6452e86baca2 Author: Alexandre Courbot Date: Wed Oct 29 08:12:10 2025 +0900 gpu: nova-core: vbios: do not use `as` when comparing BiosImageType Use the `image_type` method and compare its result to avoid using `as`. Reviewed-by: Joel Fernandes Signed-off-by: Alexandre Courbot Message-ID: <20251029-nova-as-v3-2-6a30c7333ad9@nvidia.com> commit a4438f06b1db15ce3d831ce82b8767665638aa2a Author: Dan Williams Date: Fri Oct 31 14:29:01 2025 -0700 PCI/TSM: Report active IDE streams Given that the platform TSM owns IDE Stream ID allocation, report the active streams via the TSM class device. Establish a symlink from the class device to the PCI endpoint device consuming the stream, named by the Stream ID. Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Alexey Kardashevskiy Link: https://patch.msgid.link/20251031212902.2256310-10-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 9ddaf9c3ed007cd03c1335fb40920ad76f72a3d5 Author: Dan Williams Date: Fri Oct 31 14:29:00 2025 -0700 PCI/IDE: Report available IDE streams The limited number of link-encryption (IDE) streams that a given set of host bridges supports is a platform specific detail. Provide pci_ide_init_nr_streams() as a generic facility for either platform TSM drivers, or PCI core native IDE, to report the number available streams. After invoking pci_ide_init_nr_streams() an "available_secure_streams" attribute appears in PCI host bridge sysfs to convey that count. Introduce a device-type, @pci_host_bridge_type, now that both a release method and sysfs attribute groups are being specified for all 'struct pci_host_bridge' instances. Cc: Bjorn Helgaas Cc: Lukas Wunner Cc: Samuel Ortiz Cc: Alexey Kardashevskiy Cc: Xu Yilun Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251031212902.2256310-9-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 1e4d2ff3ae450dab37b5b5726c3f7df3e60d6e89 Author: Dan Williams Date: Fri Oct 31 14:28:59 2025 -0700 PCI/IDE: Add IDE establishment helpers There are two components to establishing an encrypted link, provisioning the stream in Partner Port config-space, and programming the keys into the link layer via IDE_KM (IDE Key Management). This new library, drivers/pci/ide.c, enables the former. IDE_KM, via a TSM low-level driver, is saved for later. With the platform TSM implementations of SEV-TIO and TDX Connect in mind this library abstracts small differences in those implementations. For example, TDX Connect handles Root Port register setup while SEV-TIO expects System Software to update the Root Port registers. This is the rationale for fine-grained 'setup' + 'enable' verbs. The other design detail for TSM-coordinated IDE establishment is that the TSM may manage allocation of Stream IDs, this is why the Stream ID value is passed in to pci_ide_stream_setup(). The flow is: pci_ide_stream_alloc(): Allocate a Selective IDE Stream Register Block in each Partner Port (Endpoint + Root Port), and reserve a host bridge / platform stream slot. Gather Partner Port specific stream settings like Requester ID. pci_ide_stream_register(): Publish the stream in sysfs after allocating a Stream ID. In the TSM case the TSM allocates the Stream ID for the Partner Port pair. pci_ide_stream_setup(): Program the stream settings to a Partner Port. Caller is responsible for optionally calling this for the Root Port as well if the TSM implementation requires it. pci_ide_stream_enable(): Enable the stream after IDE_KM. In support of system administrators auditing where platform, Root Port, and Endpoint IDE stream resources are being spent, the allocated stream is reflected as a symlink from the host bridge to the endpoint with the name: stream%d.%d.%d Where the tuple of integers reflects the allocated platform, Root Port, and Endpoint stream index (Selective IDE Stream Register Block) values. Thanks to Wu Hao for a draft implementation of this infrastructure. Cc: Bjorn Helgaas Cc: Lukas Wunner Cc: Samuel Ortiz Co-developed-by: Alexey Kardashevskiy Signed-off-by: Alexey Kardashevskiy Co-developed-by: Xu Yilun Signed-off-by: Xu Yilun Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251031212902.2256310-8-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 290b633a7d8ad56f1176c4e89bce8cb5092e6cea Author: Dan Williams Date: Fri Oct 31 14:28:58 2025 -0700 PCI: Establish document for PCI host bridge sysfs attributes In preparation for adding more host bridge sysfs attributes, document the existing naming format and 'firmware_node' attribute. Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251031212902.2256310-7-dan.j.williams@intel.com Signed-off-by: Dan Williams commit c0c1262fbfbafe943dbccd5f97b500b72dbd2205 Author: Dan Williams Date: Fri Oct 31 14:28:57 2025 -0700 PCI: Add PCIe Device 3 Extended Capability enumeration PCIe r7.0 Section 7.7.9 Device 3 Extended Capability Structure, defines the canonical location for determining the Flit Mode of a device. This status is a dependency for PCIe IDE enabling. Add a new fm_enabled flag to 'struct pci_dev'. Cc: Lukas Wunner Cc: Ilpo Järvinen Cc: Bjorn Helgaas Cc: Samuel Ortiz Cc: Alexey Kardashevskiy Cc: Xu Yilun Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251031212902.2256310-6-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 3225f52cde56f46789a4972d3c54df8a4d75f022 Author: Dan Williams Date: Fri Oct 31 14:28:56 2025 -0700 PCI/TSM: Establish Secure Sessions and Link Encryption The PCIe 7.0 specification, section 11, defines the Trusted Execution Environment (TEE) Device Interface Security Protocol (TDISP). This protocol definition builds upon Component Measurement and Authentication (CMA), and link Integrity and Data Encryption (IDE). It adds support for assigning devices (PCI physical or virtual function) to a confidential VM such that the assigned device is enabled to access guest private memory protected by technologies like Intel TDX, AMD SEV-SNP, RISCV COVE, or ARM CCA. The "TSM" (TEE Security Manager) is a concept in the TDISP specification of an agent that mediates between a "DSM" (Device Security Manager) and system software in both a VMM and a confidential VM. A VMM uses TSM ABIs to setup link security and assign devices. A confidential VM uses TSM ABIs to transition an assigned device into the TDISP "RUN" state and validate its configuration. From a Linux perspective the TSM abstracts many of the details of TDISP, IDE, and CMA. Some of those details leak through at times, but for the most part TDISP is an internal implementation detail of the TSM. CONFIG_PCI_TSM adds an "authenticated" attribute and "tsm/" subdirectory to pci-sysfs. Consider that the TSM driver may itself be a PCI driver. Userspace can watch for the arrival of a "TSM" device, /sys/class/tsm/tsm0/uevent KOBJ_CHANGE, to know when the PCI core has initialized TSM services. The operations that can be executed against a PCI device are split into two mutually exclusive operation sets, "Link" and "Security" (struct pci_tsm_{link,security}_ops). The "Link" operations manage physical link security properties and communication with the device's Device Security Manager firmware. These are the host side operations in TDISP. The "Security" operations coordinate the security state of the assigned virtual device (TDI). These are the guest side operations in TDISP. Only "link" (Secure Session and physical Link Encryption) operations are defined at this stage. There are placeholders for the device security (Trusted Computing Base entry / exit) operations. The locking allows for multiple devices to be executing commands simultaneously, one outstanding command per-device and an rwsem synchronizes the implementation relative to TSM registration/unregistration events. Thanks to Wu Hao for his work on an early draft of this support. Cc: Lukas Wunner Cc: Samuel Ortiz Acked-by: Bjorn Helgaas Reviewed-by: Jonathan Cameron Reviewed-by: Alexey Kardashevskiy Co-developed-by: Xu Yilun Signed-off-by: Xu Yilun Link: https://patch.msgid.link/20251031212902.2256310-5-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 215afa89d249bb095126cf00f8be719e421c75e9 Author: Dan Williams Date: Fri Oct 31 14:28:55 2025 -0700 PCI: Introduce pci_walk_bus_reverse(), for_each_pci_dev_reverse() PCI/TSM, the PCI core functionality for the PCIe TEE Device Interface Security Protocol (TDISP), has a need to walk all subordinate functions of a Device Security Manager (DSM) to setup a device security context. A DSM is physical function 0 of multi-function or SR-IOV device endpoint, or it is an upstream switch port. In error scenarios or when a TEE Security Manager (TSM) device is removed it needs to unwind all established DSM contexts. Introduce reverse versions of PCI device iteration helpers to mirror the setup path and ensure that dependent children are handled before parents. Cc: Greg Kroah-Hartman Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20251031212902.2256310-4-dan.j.williams@intel.com Signed-off-by: Dan Williams commit f16469ee733ac52b2373216803699cbb05e82786 Author: Dan Williams Date: Fri Oct 31 14:28:54 2025 -0700 PCI/IDE: Enumerate Selective Stream IDE capabilities Link encryption is a new PCIe feature enumerated by "PCIe r7.0 section 7.9.26 IDE Extended Capability". It is both a standalone port + endpoint capability, and a building block for the security protocol defined by "PCIe r7.0 section 11 TEE Device Interface Security Protocol (TDISP)". That protocol coordinates device security setup between a platform TSM (TEE Security Manager) and a device DSM (Device Security Manager). While the platform TSM can allocate resources like Stream ID and manage keys, it still requires system software to manage the IDE capability register block. Add register definitions and basic enumeration in preparation for Selective IDE Stream establishment. A follow on change selects the new CONFIG_PCI_IDE symbol. Note that while the IDE specification defines both a point-to-point "Link Stream" and a Root Port to endpoint "Selective Stream", only "Selective Stream" is considered for Linux as that is the predominant mode expected by Trusted Execution Environment Security Managers (TSMs), and it is the security model that limits the number of PCI components within the TCB in a PCIe topology with switches. Co-developed-by: Alexey Kardashevskiy Signed-off-by: Alexey Kardashevskiy Co-developed-by: Xu Yilun Signed-off-by: Xu Yilun Reviewed-by: Jonathan Cameron Reviewed-by: Alexey Kardashevskiy Reviewed-by: Aneesh Kumar K.V Link: https://patch.msgid.link/20251031212902.2256310-3-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 603c646f001008eaf8b5a7a888043e5cc8c494a2 Author: Dan Williams Date: Fri Oct 31 14:28:53 2025 -0700 coco/tsm: Introduce a core device for TEE Security Managers A "TSM" is a platform component that provides an API for securely provisioning resources for a confidential guest (TVM) to consume. The name originates from the PCI specification for platform agent that carries out operations for PCIe TDISP (TEE Device Interface Security Protocol). Instances of this core device are parented by a device representing the platform security function like CONFIG_CRYPTO_DEV_CCP or CONFIG_INTEL_TDX_HOST. This device interface is a frontend to the aspects of a TSM and TEE I/O that are cross-architecture common. This includes mechanisms like enumerating available platform TEE I/O capabilities and provisioning connections between the platform TSM and device DSMs (Device Security Manager (TDISP)). For now this is just the scaffolding for registering a TSM device sysfs interface. Cc: Xu Yilun Reviewed-by: Jonathan Cameron Co-developed-by: Aneesh Kumar K.V (Arm) Signed-off-by: Aneesh Kumar K.V (Arm) Acked-by: Bjorn Helgaas Reviewed-by: Alexey Kardashevskiy Link: https://patch.msgid.link/20251031212902.2256310-2-dan.j.williams@intel.com Signed-off-by: Dan Williams commit 682921ab33129ec46392b27e9dafcb206c2a08dd Author: Jingyi Wang Date: Sun Nov 2 23:25:07 2025 -0800 dt-bindings: firmware: qcom,scm: Document SCM on Kaanapali SOC Document SCM compatible for the Qualcomm Kaanapali SoC. Reviewed-by: Eugen Hristev Acked-by: Rob Herring (Arm) Signed-off-by: Jingyi Wang Link: https://lore.kernel.org/r/20251102-knp-soc-binding-v3-2-11255ec4a535@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit db252c105648d1c15826b24dd4251b005e243c30 Author: Kathiravan Thirumoorthy Date: Fri Oct 31 11:21:02 2025 +0530 soc: qcom: socinfo: add support to extract more than 32 image versions SMEM_IMAGE_VERSION_TABLE contains the version of the first 32 images. Add images beyond that and read these from SMEM_IMAGE_VERSION_TABLE_2. Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20251031-image-crm-part2-v2-2-c224c45c381a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d403276969b2aae147f671506a6c69089587ddd7 Author: Kathiravan Thirumoorthy Date: Fri Oct 31 11:21:01 2025 +0530 soc: qcom: smem: drop the WARN_ON() on SMEM item validation When a SMEM item is allocated or retrieved, sanity check on the SMEM item is performed and backtrace is printed if it is invalid. But there is no benefit in dumping that information in the logs. Lets drop it. Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20251031-image-crm-part2-v2-1-c224c45c381a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 4e13c6aed86f4409d0e6385a6cdad41994575990 Author: Luo Jie Date: Tue Oct 14 22:35:35 2025 +0800 arm64: defconfig: Build NSS clock controller driver for IPQ5424 NSS clock controller is needed for supplying clocks and resets to the networking blocks for the Ethernet functions on the IPQ5424 platforms. All boards based on the IPQ5424 SoC will require this driver to be enabled. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luo Jie Link: https://lore.kernel.org/r/20251014-qcom_ipq5424_nsscc-v7-10-081f4956be02@quicinc.com Signed-off-by: Bjorn Andersson commit 85d55d8cc3ef7f77b249c97e9fac6a0fc5f5daa7 Author: Akhil P Oommen Date: Tue Sep 30 11:18:06 2025 +0530 soc: qcom: ubwc: Add config for Kaanapali Add the ubwc configuration for Kaanapali chipset. This chipset brings support for UBWC v6 version. The rest of the configurations remains as usual. Signed-off-by: Akhil P Oommen Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250930-kaana-gpu-support-v1-1-73530b0700ed@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9e8a443401dfb15574f9cc962783500ca8c2eec2 Merge: ff371a7e73c8e6 fd93ed77efe473 Author: Jakub Kicinski Date: Mon Nov 3 18:32:33 2025 -0800 Merge branch 'ethtool-introduce-phy-mse-diagnostics-uapi-and-drivers' Oleksij Rempel says: ==================== ethtool: introduce PHY MSE diagnostics UAPI and drivers This series introduces a generic kernel-userspace API for retrieving PHY Mean Square Error (MSE) diagnostics, together with netlink integration, a fast-path reporting hook in LINKSTATE_GET, and initial driver implementations for the KSZ9477 and DP83TD510E PHYs. MSE is defined by the OPEN Alliance "Advanced diagnostic features for 100BASE-T1 automotive Ethernet PHYs" specification [1] as a measure of slicer error rate, typically used internally to derive the Signal Quality Indicator (SQI). While SQI is useful as a normalized quality index, it hides raw measurement data, varies in scaling and thresholds between vendors, and may not indicate certain failure modes - for example, cases where autonegotiation would fail even though SQI reports a good link. In practice, such scenarios can only be investigated in fixed-link mode; here, MSE can provide an empirically estimated value indicating conditions under which autonegotiation would not succeed. Example output with current implementation: root@DistroKit:~ ethtool lan1 Settings for lan1: ... Speed: 1000Mb/s Duplex: Full ... Link detected: yes SQI: 5/7 MSE: 3/127 (channel: worst) root@DistroKit:~ ethtool --show-mse lan1 MSE diagnostics for lan1: MSE Configuration: Max Average MSE: 127 Refresh Rate: 2000000 ps Symbols per Sample: 250 Supported capabilities: average channel-a channel-b channel-c channel-d worst MSE Snapshot (Channel: a): Average MSE: 4 MSE Snapshot (Channel: b): Average MSE: 3 MSE Snapshot (Channel: c): Average MSE: 2 MSE Snapshot (Channel: d): Average MSE: 3 [1] https://opensig.org/wp-content/uploads/2024/01/Advanced_PHY_features_for_automotive_Ethernet_V1.0.pdf ==================== Link: https://patch.msgid.link/20251027122801.982364-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit fd93ed77efe4735cd2b9a3fbccd5e199ced19bba Author: Oleksij Rempel Date: Mon Oct 27 13:28:01 2025 +0100 net: phy: dp83td510: add MSE interface support for 10BASE-T1L Implement get_mse_capability() and get_mse_snapshot() for the DP83TD510E to expose its Mean Square Error (MSE) register via the new PHY MSE UAPI. The DP83TD510E does not document any peak MSE values; it only exposes a single average MSE register used internally to derive SQI. This implementation therefore advertises only PHY_MSE_CAP_AVG, along with LINK and channel-A selectors. Scaling is fixed to 0xFFFF, and the refresh interval/number of symbols are estimated from 10BASE-T1L symbol rate (7.5 MBd) and typical diagnostic intervals (~1 ms). For 10BASE-T1L deployments, SQI is a reliable indicator of link modulation quality once the link is established, but it does not indicate whether autonegotiation pulses will be correctly received in marginal conditions. MSE provides a direct measurement of slicer error rate that can be used to evaluate if autonegotiation is likely to succeed under a given cable length and condition. In practice, testing such scenarios often requires forcing a fixed-link setup to isolate MSE behaviour from the autonegotiation process. Signed-off-by: Oleksij Rempel Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251027122801.982364-5-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 335a9660e141349d7751b3b880d7531ea401a8db Author: Oleksij Rempel Date: Mon Oct 27 13:28:00 2025 +0100 net: phy: micrel: add MSE interface support for KSZ9477 family Implement the get_mse_capability() and get_mse_snapshot() PHY driver ops for KSZ9477-series integrated PHYs to demonstrate the new PHY MSE UAPI. These PHYs do not expose a documented direct MSE register, but the Signal Quality Indicator (SQI) registers are derived from the internal MSE computation. This hook maps SQI readings into the MSE interface so that tooling can retrieve the raw value together with metadata for correct interpretation in userspace. Behaviour: - For 1000BASE-T, report per-channel (A–D) values and support a WORST channel selector. - For 100BASE-TX, only LINK-wide measurements are available. - Report average MSE only, with a max scale based on KSZ9477_MMD_SQI_MASK and a fixed refresh rate of 2 µs. This mapping differs from the OPEN Alliance SQI definition, which assigns thresholds such as pre-fail indices; the MSE interface instead provides the raw measurement, leaving interpretation to userspace. Signed-off-by: Oleksij Rempel Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251027122801.982364-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit e6e93fb01302e9b7a15d17f3b8a00eff8a601654 Author: Oleksij Rempel Date: Mon Oct 27 13:27:59 2025 +0100 ethtool: netlink: add ETHTOOL_MSG_MSE_GET and wire up PHY MSE access Introduce the userspace entry point for PHY MSE diagnostics via ethtool netlink. This exposes the core API added previously and returns both capability information and one or more snapshots. Userspace sends ETHTOOL_MSG_MSE_GET. The reply carries: - ETHTOOL_A_MSE_CAPABILITIES: scale limits and timing information - ETHTOOL_A_MSE_CHANNEL_* nests: one or more snapshots (per-channel if available, otherwise WORST, otherwise LINK) Link down returns -ENETDOWN. Changes: - YAML: add attribute sets (mse, mse-capabilities, mse-snapshot) and the mse-get operation - UAPI (generated): add ETHTOOL_A_MSE_* enums and message IDs, ETHTOOL_MSG_MSE_GET/REPLY - ethtool core: add net/ethtool/mse.c implementing the request, register genl op, and hook into ethnl dispatch - docs: document MSE_GET in ethtool-netlink.rst The include/uapi/linux/ethtool_netlink_generated.h is generated from Documentation/netlink/specs/ethtool.yaml. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20251027122801.982364-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit abcf6eef90c6e47efed62a7c233ffc1a6a90797e Author: Oleksij Rempel Date: Mon Oct 27 13:27:58 2025 +0100 net: phy: introduce internal API for PHY MSE diagnostics Add the base infrastructure for Mean Square Error (MSE) diagnostics, as proposed by the OPEN Alliance "Advanced diagnostic features for 100BASE-T1 automotive Ethernet PHYs" [1] specification. The OPEN Alliance spec defines only average MSE and average peak MSE over a fixed number of symbols. However, other PHYs, such as the KSZ9131, additionally expose a worst-peak MSE value latched since the last channel capture. This API accounts for such vendor extensions by adding a distinct capability bit and snapshot field. Channel-to-pair mapping is normally straightforward, but in some cases (e.g. 100BASE-TX with MDI-X resolution unknown) the mapping is ambiguous. If hardware does not expose MDI-X status, the exact pair cannot be determined. To avoid returning misleading per-channel data in this case, a LINK selector is defined for aggregate MSE measurements. All investigated devices differ in MSE capabilities, such as sample rate, number of analyzed symbols, and scaling factors. For example, the KSZ9131 uses different scaling for MSE and pMSE. To make this visible to callers, scale limits and timing information are returned via get_mse_capability(). Some PHYs sample very few symbols at high frequency (e.g. 2 us update rate). To cover such cases and allow for future high-speed PHYs with even shorter intervals, the refresh rate is reported as u64 in picoseconds. This patch introduces the internal PHY API for Mean Square Error diagnostics. It defines new kernel-side data types and driver hooks: - struct phy_mse_capability: describes supported metrics, scale limits, update interval, and sampling length. - struct phy_mse_snapshot: holds one correlated measurement set. - New phy_driver ops: `get_mse_capability()` and `get_mse_snapshot()`. These definitions form the core kernel API. No user-visible interfaces are added in this commit. Standardization notes: OPEN Alliance defines presence and interpretation of some metrics but does not fix numeric scales or sampling internals: - SQI (3-bit, 0..7) is mandatory; correlation to SNR/BER is informative (OA 100BASE-T1 TC1 v1.0 6.1.2; OA 1000BASE-T1 TC12 v2.2 6.1.2). - MSE is optional; OA recommends 2^16 symbols and scaling to 0..511, with a worst-case latch since last read (OA 100BASE-T1 TC1 v1.0 6.1.1; OA 1000BASE-T1 TC12 v2.2 6.1.1). Refresh is recommended (~0.8-2.0 ms for 100BASE-T1; ~80-200 us for 1000BASE-T1). Exact scaling/time windows are vendor-specific. - Peak MSE (pMSE) is defined only for 100BASE-T1 as optional, e.g. 128-symbol sliding window with 8-bit range and worst-case latch (OA 100BASE-T1 TC1 v1.0 6.1.3). Therefore this API exposes which measures and selectors a PHY supports, and documents where behavior is standard-referenced vs vendor-specific. [1] Signed-off-by: Oleksij Rempel Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20251027122801.982364-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit ff371a7e73c8e624d6a28684d839ed074ac97a2b Merge: 998b5d9683d9c4 add3c1324a8912 Author: Jakub Kicinski Date: Mon Nov 3 18:11:43 2025 -0800 Merge branch 'add-support-to-do-threaded-napi-busy-poll' Samiullah Khawaja says: ==================== Add support to do threaded napi busy poll Extend the already existing support of threaded napi poll to do continuous busy polling. This is used for doing continuous polling of napi to fetch descriptors from backing RX/TX queues for low latency applications. Allow enabling of threaded busypoll using netlink so this can be enabled on a set of dedicated napis for low latency applications. Once enabled user can fetch the PID of the kthread doing NAPI polling and set affinity, priority and scheduler for it depending on the low-latency requirements. Extend the netlink interface to allow enabling/disabling threaded busypolling at individual napi level. We use this for our AF_XDP based hard low-latency usecase with usecs level latency requirement. For our usecase we want low jitter and stable latency at P99. Following is an analysis and comparison of available (and compatible) busy poll interfaces for a low latency usecase with stable P99. This can be suitable for applications that want very low latency at the expense of cpu usage and efficiency. Already existing APIs (SO_BUSYPOLL and epoll) allow busy polling a NAPI backing a socket, but the missing piece is a mechanism to busy poll a NAPI instance in a dedicated thread while ignoring available events or packets, regardless of the userspace API. Most existing mechanisms are designed to work in a pattern where you poll until new packets or events are received, after which userspace is expected to handle them. As a result, one has to hack together a solution using a mechanism intended to receive packets or events, not to simply NAPI poll. NAPI threaded busy polling, on the other hand, provides this capability natively, independent of any userspace API. This makes it really easy to setup and manage. For analysis we use an AF_XDP based benchmarking tool `xsk_rr`. The description of the tool and how it tries to simulate the real workload is following, - It sends UDP packets between 2 machines. - The client machine sends packets at a fixed frequency. To maintain the frequency of the packet being sent, we use open-loop sampling. That is the packets are sent in a separate thread. - The server replies to the packet inline by reading the pkt from the recv ring and replies using the tx ring. - To simulate the application processing time, we use a configurable delay in usecs on the client side after a reply is received from the server. The xsk_rr tool is posted separately as an RFC for tools/testing/selftest. We use this tool with following napi polling configurations, - Interrupts only - SO_BUSYPOLL (inline in the same thread where the client receives the packet). - SO_BUSYPOLL (separate thread and separate core) - Threaded NAPI busypoll System is configured using following script in all 4 cases, ``` echo 0 | sudo tee /sys/class/net/eth0/threaded echo 0 | sudo tee /proc/sys/kernel/timer_migration echo off | sudo tee /sys/devices/system/cpu/smt/control sudo ethtool -L eth0 rx 1 tx 1 sudo ethtool -G eth0 rx 1024 echo 0 | sudo tee /proc/sys/net/core/rps_sock_flow_entries echo 0 | sudo tee /sys/class/net/eth0/queues/rx-0/rps_cpus # pin IRQs on CPU 2 IRQS="$(gawk '/eth0-(TxRx-)?1/ {match($1, /([0-9]+)/, arr); \ print arr[0]}' < /proc/interrupts)" for irq in "${IRQS}"; \ do echo 2 | sudo tee /proc/irq/$irq/smp_affinity_list; done echo -1 | sudo tee /proc/sys/kernel/sched_rt_runtime_us for i in /sys/devices/virtual/workqueue/*/cpumask; \ do echo $i; echo 1,2,3,4,5,6 > $i; done if [[ -z "$1" ]]; then echo 400 | sudo tee /proc/sys/net/core/busy_read echo 100 | sudo tee /sys/class/net/eth0/napi_defer_hard_irqs echo 15000 | sudo tee /sys/class/net/eth0/gro_flush_timeout fi sudo ethtool -C eth0 adaptive-rx off adaptive-tx off rx-usecs 0 tx-usecs 0 if [[ "$1" == "enable_threaded" ]]; then echo 0 | sudo tee /proc/sys/net/core/busy_poll echo 0 | sudo tee /proc/sys/net/core/busy_read echo 100 | sudo tee /sys/class/net/eth0/napi_defer_hard_irqs echo 15000 | sudo tee /sys/class/net/eth0/gro_flush_timeout NAPI_ID=$(ynl --family netdev --output-json --do queue-get \ --json '{"ifindex": '${IFINDEX}', "id": '0', "type": "rx"}' | jq '."napi-id"') ynl --family netdev --json '{"id": "'${NAPI_ID}'", "threaded": "busy-poll"}' NAPI_T=$(ynl --family netdev --output-json --do napi-get \ --json '{"id": "'$NAPI_ID'"}' | jq '."pid"') sudo chrt -f -p 50 $NAPI_T # pin threaded poll thread to CPU 2 sudo taskset -pc 2 $NAPI_T fi if [[ "$1" == "enable_interrupt" ]]; then echo 0 | sudo tee /proc/sys/net/core/busy_read echo 0 | sudo tee /sys/class/net/eth0/napi_defer_hard_irqs echo 15000 | sudo tee /sys/class/net/eth0/gro_flush_timeout fi ``` To enable various configurations, script can be run as following, - Interrupt Only ```